diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..5d79390a
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+# Copies of the vendored krilla source diff, one per patch (see vendor/krilla/README.craft.md).
+vendor/krilla/patches/*.patch linguist-generated=true
diff --git a/.github/workflows/ai-core.yml b/.github/workflows/ai-core.yml
index 5f2204f7..2dd03168 100644
--- a/.github/workflows/ai-core.yml
+++ b/.github/workflows/ai-core.yml
@@ -20,7 +20,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
diff --git a/.github/workflows/atomic.yml b/.github/workflows/atomic.yml
index d2112768..9cda9f28 100644
--- a/.github/workflows/atomic.yml
+++ b/.github/workflows/atomic.yml
@@ -20,7 +20,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
diff --git a/.github/workflows/docpath.yml b/.github/workflows/docpath.yml
index 3aaaa97e..3cae8fb5 100644
--- a/.github/workflows/docpath.yml
+++ b/.github/workflows/docpath.yml
@@ -20,7 +20,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
diff --git a/.github/workflows/i18n.yml b/.github/workflows/i18n.yml
index a973e37f..7a887649 100644
--- a/.github/workflows/i18n.yml
+++ b/.github/workflows/i18n.yml
@@ -20,10 +20,10 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
       - run: cargo fmt --check
-      - run: cargo clippy -p craft-i18n --all-targets --locked -- -D warnings
-      - run: cargo test -p craft-i18n --locked -- --nocapture
+      - run: cargo clippy -p craft-i18n --all-targets --features collate --locked -- -D warnings
+      - run: cargo test -p craft-i18n --features collate --locked -- --nocapture
diff --git a/.github/workflows/jpeg.yml b/.github/workflows/jpeg.yml
new file mode 100644
index 00000000..d10c2598
--- /dev/null
+++ b/.github/workflows/jpeg.yml
@@ -0,0 +1,37 @@
+name: Shared JPEG
+
+on:
+  push:
+    branches: [main]
+    paths: ["crates/jpeg/**", "Cargo.toml", "Cargo.lock", ".github/workflows/jpeg.yml"]
+  pull_request:
+    paths: ["crates/jpeg/**", "Cargo.toml", "Cargo.lock", ".github/workflows/jpeg.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: shared-jpeg-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    timeout-minutes: 10
+    name: JPEG lint, tests, WASM
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          components: rustfmt, clippy
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          key: craft-jpeg
+      - run: cargo fmt -p craft-jpeg --check
+      - run: cargo clippy -p craft-jpeg --all-targets --locked -- -D warnings
+      - run: cargo test -p craft-jpeg --locked
+      - run: cargo check -p craft-jpeg --locked --target wasm32-unknown-unknown
diff --git a/.github/workflows/keymap.yml b/.github/workflows/keymap.yml
new file mode 100644
index 00000000..51ff2ba0
--- /dev/null
+++ b/.github/workflows/keymap.yml
@@ -0,0 +1,92 @@
+name: Keymap
+
+on:
+  push:
+    branches: [main]
+    paths: ["crates/keymap/**", "crates/settings/**", "crates/ui/**", "crates/i18n/**", "Cargo.toml", "Cargo.lock", ".github/workflows/keymap.yml"]
+  pull_request:
+    paths: ["crates/keymap/**", "crates/settings/**", "crates/ui/**", "crates/i18n/**", "Cargo.toml", "Cargo.lock", ".github/workflows/keymap.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: keymap-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  linux:
+    timeout-minutes: 15
+    name: Keymap (Linux)
+    runs-on: ubuntu-latest
+    env:
+      CRAFT_FONTS_DIR: ${{ github.workspace }}/.test-inputs/craft-fonts
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Checkout test fonts
+        uses: actions/checkout@v4
+        with:
+          repository: storytold/craft-fonts
+          ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+          path: .test-inputs/craft-fonts
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          key: craft-keymap-linux
+      - run: cargo fmt -p craft-keymap --check
+      - run: cargo clippy -p craft-keymap --all-targets --no-default-features --locked -- -D warnings
+      # `snapshot` covers `ui` and `egui` and compiles the dialog screenshots, which need a GPU
+      # to run, so the test steps leave them out.
+      - run: cargo clippy -p craft-keymap --all-targets --features snapshot --locked -- -D warnings
+      # Doctests run once, in the `ui` step.
+      - name: Test core
+        run: cargo test -p craft-keymap --no-default-features --lib --tests --locked
+      - name: Test egui dispatch and the shortcuts dialog
+        run: cargo test -p craft-keymap --features ui --locked
+  native:
+    timeout-minutes: 15
+    name: Keymap (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    env:
+      CRAFT_FONTS_DIR: ${{ github.workspace }}/.test-inputs/craft-fonts
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Checkout test fonts
+        uses: actions/checkout@v4
+        with:
+          repository: storytold/craft-fonts
+          ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+          path: .test-inputs/craft-fonts
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          key: craft-keymap-${{ matrix.os }}
+      - run: cargo test -p craft-keymap --features ui --locked
+  wasm:
+    timeout-minutes: 10
+    name: Keymap WASM
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          key: craft-keymap-wasm
+      - run: cargo check -p craft-keymap --features ui --locked --target wasm32-unknown-unknown
diff --git a/.github/workflows/media.yml b/.github/workflows/media.yml
index a9fa3213..5d519b0a 100644
--- a/.github/workflows/media.yml
+++ b/.github/workflows/media.yml
@@ -21,7 +21,7 @@ jobs:
     name: Media lint, feature sets, WASM
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
@@ -43,7 +43,7 @@ jobs:
     name: Media tests with ffmpeg oracles
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
diff --git a/.github/workflows/pdf.yml b/.github/workflows/pdf.yml
index c2f8c3f6..2ff73a7a 100644
--- a/.github/workflows/pdf.yml
+++ b/.github/workflows/pdf.yml
@@ -3,9 +3,9 @@ name: Shared PDF
 on:
   push:
     branches: [main]
-    paths: ["crates/pdf/**", "vendor/hayro*/**", "vendor/krilla/**", "scripts/test-pdf-backends.sh", "scripts/*fetch-pdf-test-fonts.py", "Cargo.toml", "Cargo.lock", ".github/workflows/pdf.yml"]
+    paths: ["crates/pdf/**", "crates/plate-test/**", "crates/prepress/**", "crates/cms/**", "vendor/hayro*/**", "vendor/krilla/**", "scripts/test-pdf-backends.sh", "scripts/*fetch-pdf-test-fonts.py", "Cargo.toml", "Cargo.lock", ".github/workflows/pdf.yml"]
   pull_request:
-    paths: ["crates/pdf/**", "vendor/hayro*/**", "vendor/krilla/**", "scripts/test-pdf-backends.sh", "scripts/*fetch-pdf-test-fonts.py", "Cargo.toml", "Cargo.lock", ".github/workflows/pdf.yml"]
+    paths: ["crates/pdf/**", "crates/plate-test/**", "crates/prepress/**", "crates/cms/**", "vendor/hayro*/**", "vendor/krilla/**", "scripts/test-pdf-backends.sh", "scripts/*fetch-pdf-test-fonts.py", "Cargo.toml", "Cargo.lock", ".github/workflows/pdf.yml"]
   workflow_dispatch:
 
 permissions:
@@ -26,14 +26,14 @@ jobs:
     env:
       RUSTFLAGS: --cfg craft_pdf_unicode_fixtures
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-pdf
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Provision licensed PDF test fonts
@@ -50,7 +50,7 @@ jobs:
     name: PDF vendored contracts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
@@ -63,14 +63,14 @@ jobs:
       RUSTFLAGS: --cfg craft_pdf_unicode_fixtures
       CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER: wasm-bindgen-test-runner
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           targets: wasm32-unknown-unknown
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: craft-pdf-wasm
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Provision licensed PDF test fonts
@@ -86,3 +86,25 @@ jobs:
           cargo install wasm-bindgen-cli --version "$runner_version" --locked
       - run: cargo test -p craft-pdf --all-features --locked --target wasm32-unknown-unknown
       - run: cargo test --manifest-path crates/pdf/read-only-contract/Cargo.toml --locked --target wasm32-unknown-unknown
+  plate-test:
+    name: Plate tests and craft-prepress
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          key: craft-plate-test
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Provision licensed PDF test fonts
+        shell: bash
+        run: |
+          python scripts/test-fetch-pdf-test-fonts.py
+          python scripts/fetch-pdf-test-fonts.py "$RUNNER_TEMP/craft-pdf-test-fonts"
+          echo "CRAFT_PDF_TEST_FONT_DIR=$RUNNER_TEMP/craft-pdf-test-fonts" >> "$GITHUB_ENV"
+      - run: cargo clippy -p craft-plate-test -p craft-prepress --all-targets --all-features --locked -- -D warnings
+      - run: cargo test -p craft-plate-test -p craft-prepress --all-features --locked
diff --git a/.github/workflows/print.yml b/.github/workflows/print.yml
index 270ac75e..9e144a04 100644
--- a/.github/workflows/print.yml
+++ b/.github/workflows/print.yml
@@ -17,7 +17,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt, clippy
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index e78fe1ea..1f88bd5d 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -16,6 +16,8 @@ concurrency:
 
 jobs:
   sonarcloud:
-    # Tracked at @main so org-wide CI improvements propagate without PR churn.
+    # Track shared CI improvements on main.
     uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    with:
+      pdf-test-fonts: true
     secrets: inherit
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml
index 3db33478..e9299f37 100644
--- a/.github/workflows/ui.yml
+++ b/.github/workflows/ui.yml
@@ -3,9 +3,9 @@ name: Shared UI
 on:
   push:
     branches: [main]
-    paths: ["crates/ui/**", "Cargo.toml", "Cargo.lock", ".github/workflows/ui.yml"]
+    paths: ["crates/ui/**", "crates/i18n/**", "Cargo.toml", "Cargo.lock", ".github/workflows/ui.yml"]
   pull_request:
-    paths: ["crates/ui/**", "Cargo.toml", "Cargo.lock", ".github/workflows/ui.yml"]
+    paths: ["crates/ui/**", "crates/i18n/**", "Cargo.toml", "Cargo.lock", ".github/workflows/ui.yml"]
   workflow_dispatch:
 
 permissions:
@@ -25,7 +25,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install software Vulkan renderer
         if: runner.os == 'Linux'
         run: |
@@ -48,7 +48,7 @@ jobs:
     name: UI WASM
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           targets: wasm32-unknown-unknown
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
new file mode 100644
index 00000000..be10934e
--- /dev/null
+++ b/.github/workflows/update.yml
@@ -0,0 +1,36 @@
+name: App updates
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths: ['crates/update/**', 'Cargo.toml', 'Cargo.lock', 'rustfmt.toml', 'clippy.toml', '.github/workflows/update.yml']
+  pull_request:
+    paths: ['crates/update/**', 'Cargo.toml', 'Cargo.lock', 'rustfmt.toml', 'clippy.toml', '.github/workflows/update.yml']
+
+permissions:
+  contents: read
+
+jobs:
+  update:
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # The token isn't needed after checkout; cargo runs build scripts and proc macros from
+          # dependencies, so don't leave it in .git/config for that third-party code to read.
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          components: rustfmt, clippy
+      - run: cargo fmt --check
+      # Default (no egui) and the egui feature both build and lint cleanly.
+      - run: cargo clippy -p craft-update --all-targets --locked -- -D warnings
+      - run: cargo clippy -p craft-update --all-targets --locked --features egui -- -D warnings
+      - run: cargo test -p craft-update --locked -- --nocapture
+      - run: cargo test -p craft-update --locked --features egui -- --nocapture
diff --git a/.github/workflows/window.yml b/.github/workflows/window.yml
index 80aa86b6..b384d61b 100644
--- a/.github/workflows/window.yml
+++ b/.github/workflows/window.yml
@@ -20,7 +20,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # The token isn't needed after checkout; cargo runs build scripts and proc macros from
           # dependencies, so don't leave it in .git/config for that third-party code to read.
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 34cd2ee2..c6345e85 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -8,7 +8,20 @@ author, source and license. Library code and original assets are under the repos
 |---|---|---|---|
 | `crates/cms/profiles/photocraft-coated-cmyk.icc` | PhotoCraft contributors; generated by `craft_cms::synth::coated_cmyk` | [PhotoCraft `crates/cms`](https://github.com/storytold/photocraft/tree/b3222ee8e7e6bcb4799c37f904c595f20f9baf5e/crates/cms) | CC0-1.0 |
 | `crates/cms/profiles/craft-coated-fogra39.icc` | craft-libs contributors; generated by `crates/cms/tests/fogra39.rs` from the FOGRA39 data below | this repository | CC0-1.0 |
+| `crates/font-store/index/sources.json` (unmodified) | craft-font-index contributors | [aiongg/craft-font-index@5a9a7f8](https://github.com/aiongg/craft-font-index/tree/5a9a7f8038c8f3e2e1583a79c92a816e8e71b34f) | Apache-2.0 |
+| `crates/font-store/index/indexes/google-fonts.json.gz` (unmodified) | craft-font-index contributors; generated from the METADATA.pb files of [google/fonts](https://github.com/google/fonts) at `45e3d5269e4a17d823f6d84470bc084dc5ae46f6` | [aiongg/craft-font-index@5a9a7f8](https://github.com/aiongg/craft-font-index/tree/5a9a7f8038c8f3e2e1583a79c92a816e8e71b34f) | Apache-2.0 |
+| `crates/font-store/index/indexes/noto.json.gz` (unmodified) | craft-font-index contributors; generated from [notofonts/notofonts.github.io](https://github.com/notofonts/notofonts.github.io) at `93fac8abebe6c7fed0c5b7d2456d8fa484fa146c` and [noto-cjk](https://github.com/notofonts/noto-cjk) releases | [aiongg/craft-font-index@5a9a7f8](https://github.com/aiongg/craft-font-index/tree/5a9a7f8038c8f3e2e1583a79c92a816e8e71b34f) | Apache-2.0 |
 | `crates/cms/tests/data/FOGRA39.txt` (unmodified) | Fogra | [Fogra characterisation data](https://fogra.org/en/downloads/work-tools/characterisation-data), `FOGRA39_to_FOGRA60_v2.zip` | Fogra terms: free use and redistribution, unmodified, with Fogra identified as the source; "FOGRA39" identifies the reference data only and implies no certification, approval or endorsement by Fogra (full text in [NOTICE](NOTICE)) |
+| `crates/i18n/data/collation.postcard` | Unicode, Inc. (ICU 78.1 collation data, CLDR 48.2.1); generated by `crates/i18n/data/generate-collation.sh` | [ICU](https://github.com/unicode-org/icu/releases/tag/release-78.1rc) | Unicode-3.0 |
+| `crates/text/assets/hyphen/en-us.dic` | Grady Ward (Moby Hyphenator II), converted by DesignCraft | [Project Gutenberg eBook #3204](https://www.gutenberg.org/ebooks/3204) | Public domain |
+| `crates/text/assets/hyphen/en-us.pat` | DesignCraft contributors, trained from the Moby Hyphenator II list | `crates/text/examples/hyphgen.rs` | CC0-1.0 |
+| Patterns embedded through `hypher` (optional `craft-text` language features) | hyph-utf8 authors, per language | [tex-hyphen](https://github.com/hyphenation/tex-hyphen), as packaged in [hypher](https://github.com/typst/hypher/tree/main/patterns) | Per file header: LPPL, MIT, BSD-3-Clause, Unlicense or a permit-any-use notice (or a choice including one); Slovak (`hyph-sk.tex`, embedded whenever `hypher/slovak` is on: feature `slovak-gpl`, or another dependency through feature unification) is GPL-2.0-or-later; Spanish (`hyph-es.tex` 5.0, Javier Bezos, CervanTeX) is MIT |
+| Word-break dictionaries and LSTM models embedded through `icu_segmenter_data` (optional `craft-text` features `thai`, `lao`, `khmer`, `burmese`) | Unicode, Inc. and ICU4X contributors | [ICU4X](https://github.com/unicode-org/icu4x) | Unicode-3.0 |
+| `crates/ui/tests/fonts/NotoSansArabic-test.ttf` (subset to the test strings, default weight set to 100, width axis dropped) | The Noto Project Authors | [google/fonts@7085eb8 `ofl/notosansarabic`](https://github.com/google/fonts/tree/7085eb89a950e85db5b166b7a58d414544b4140c/ofl/notosansarabic), via craft-fonts | OFL-1.1 (`licenses/ui-test-fonts/OFL-NotoSansArabic.txt`) |
+| `crates/ui/tests/fonts/NotoSansCJKsc-test.otf` (subset to the test strings) | The Noto Project Authors (Adobe, Google) | [notofonts/noto-cjk@f8d1575 `Sans/OTF/SimplifiedChinese`](https://github.com/notofonts/noto-cjk/tree/f8d157532fbfaeda587e826d4cd5b21a49186f7c/Sans/OTF/SimplifiedChinese), via craft-fonts | OFL-1.1 (`licenses/ui-test-fonts/OFL-NotoSansCJK.txt`) |
+| `crates/ui/tests/fonts/NotoSansArabic-screens.ttf` (instance at weight 400 and width 100, subset to the screen test strings) | The Noto Project Authors | [google/fonts@7085eb8 `ofl/notosansarabic`](https://github.com/google/fonts/tree/7085eb89a950e85db5b166b7a58d414544b4140c/ofl/notosansarabic), via craft-fonts | OFL-1.1 (`licenses/ui-test-fonts/OFL-NotoSansArabic.txt`) |
+| `crates/ui/tests/fonts/NotoSansCJKsc-screens.otf` (subset to printable ASCII and the screen test strings) | The Noto Project Authors (Adobe, Google) | [notofonts/noto-cjk@f8d1575 `Sans/OTF/SimplifiedChinese`](https://github.com/notofonts/noto-cjk/tree/f8d157532fbfaeda587e826d4cd5b21a49186f7c/Sans/OTF/SimplifiedChinese), via craft-fonts | OFL-1.1 (`licenses/ui-test-fonts/OFL-NotoSansCJK.txt`) |
+| `crates/ui/tests/fonts/NotoSansThai-screens.ttf` (instance at weight 400 and width 100, subset to the screen test strings) | The Noto Project Authors | [google/fonts@8b0a1d0 `ofl/notosansthai`](https://github.com/google/fonts/tree/8b0a1d0f5983c89bc2b93f1b5fb55f9e252744b5/ofl/notosansthai), via craft-fonts | OFL-1.1 (`licenses/ui-test-fonts/OFL-NotoSansThai.txt`) |
 
 Original assets are covered by the repository licence.
 
@@ -28,14 +41,15 @@ The profile licence is retained in `licenses/pdf-writer/LICENSE-ICC.txt`.
 | `krilla 0.8.2 / icc/sRGB-v4.icc` | Clinton Ingram | https://github.com/LaurenzV/krilla/blob/3ffdf0588cf98050aad6edba51ca70162e1fb5b5/crates/krilla/icc/sRGB-v4.icc | CC0-1.0 | `c56e1685d888f5edb92fe07f2750f387f8fe8e91b32ff8fb0b56bfbbb9458353` | PDF writer colour profiles |
 
 The four Krilla ICC entries above are also stored unchanged in `vendor/krilla/icc`.
-The vendored source patch and per-file hashes are recorded in `vendor/krilla/README.craft.md` and `vendor/krilla/SOURCE.json`.
+The vendored source patches are in `vendor/krilla/patches`, described in `vendor/krilla/README.craft.md`; per-file hashes are in `vendor/krilla/SOURCE.json`.
 
 ## Assets retained with the optional PDF reader
 
-The shared reader centralizes the four existing patched Hayro source trees from PdfCraft.
+The shared reader centralizes the five patched Hayro source trees from PdfCraft and the
+patched crates.io `hayro-postscript` 0.1.0 scanner, which bundles no assets.
 The standard-14 fonts, CMYK profile and generated metrics listed below remain byte-identical
-in `vendor/hayro-interpret`; no application document fonts are added. CMaps remain a pinned
-registry dependency. The removed upstream LAB.icc profile is not restored. Source hashes
+in `vendor/hayro-interpret`, and the CMaps in `vendor/hayro-cmap/assets`; no application
+document fonts are added. The removed upstream LAB.icc profile is not restored. Source hashes
 and the exact transfer revision are recorded in each vendored crate's SOURCE.json.
 
 | Crate / file | Author | Source | Licence | SHA-256 | Use |
@@ -55,5 +69,5 @@ and the exact transfer revision are recorded in each vendored crate's SOURCE.jso
 | `hayro-interpret 0.7.0 / assets/FoxitSerifItalic.pfb` | Foxit Software Inc. / PDFium Authors | https://github.com/storytold/pdfcraft/blob/7437bde378f43856eada40af25b983812e615e8a/vendor/hayro-interpret/assets/FoxitSerifItalic.pfb | BSD-3-Clause | `610ae0687198045c4db5d1a6650fd5e92536631706382eb8b72e38df578d0ae9` | Renders non-embedded standard-14 fonts (pinned hayro-interpret) |
 | `hayro-interpret 0.7.0 / assets/FoxitSymbol.pfb` | Foxit Software Inc. / PDFium Authors | https://github.com/storytold/pdfcraft/blob/7437bde378f43856eada40af25b983812e615e8a/vendor/hayro-interpret/assets/FoxitSymbol.pfb | BSD-3-Clause | `47967d055530e7357088a08403115425643ec2cdfd6201ba8af0fbd7116c1539` | Renders non-embedded standard-14 fonts (pinned hayro-interpret) |
 | `hayro-interpret 0.7.0 / assets/CGATS001Compat-v2-micro.icc` | Clinton Ingram (saucecontrol/Compact-ICC-Profiles) | https://github.com/storytold/pdfcraft/blob/7437bde378f43856eada40af25b983812e615e8a/vendor/hayro-interpret/assets/CGATS001Compat-v2-micro.icc | CC0-1.0 | `73e1ba37d2bad5bab2a964f40a9eed96209666efc067c3322626214bbef234a0` | Default CMYK colour conversion (pinned hayro-interpret) |
-| `hayro-cmap 0.1.0 / assets/cmaps.brotli` | Adobe | https://crates.io/crates/hayro-cmap/0.1.0 | BSD-3-Clause | `ddf37af521d904d5646c2fc37b2b7e912dc1b56f0d210190b61f598154758e46` | Character-code mapping tables required to read CJK PDFs. Non-visual dependency data; existing embedding unchanged |
+| `hayro-cmap 0.1.0 / assets/cmaps.brotli` | Adobe | https://github.com/storytold/pdfcraft/blob/a2ec27b4775f53c40cad3456936d9406611e3a8d/vendor/hayro-cmap/assets/cmaps.brotli | BSD-3-Clause | `ddf37af521d904d5646c2fc37b2b7e912dc1b56f0d210190b61f598154758e46` | Character-code mapping tables required to read CJK PDFs. Non-visual dependency data; existing embedding unchanged |
 | `hayro-interpret 0.7.0 / src/font/generated/metrics.rs` | Adobe (Core 14 AFM metrics, PDF specification encodings); tables by The Hayro Authors | https://github.com/storytold/pdfcraft/blob/7437bde378f43856eada40af25b983812e615e8a/vendor/hayro-interpret/src/font/generated/metrics.rs | MIT OR Apache-2.0 | `2ec9e608573eda459de1e1d9bda3bb494315e36bee885acc88912a11fe0caa41` | Glyph widths and encodings for non-embedded standard fonts. Non-visual dependency data; existing embedding unchanged |
diff --git a/Cargo.lock b/Cargo.lock
index 2b2ebaeb..e2f00610 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8,6 +8,8 @@ version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad442f58ee04714aaa0ba0a2768c1ea1935b29507bb22ddece8cbbc76db02932"
 dependencies = [
+ "enumn",
+ "serde",
  "uuid",
 ]
 
@@ -35,6 +37,7 @@ checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
 dependencies = [
  "cfg-if",
  "once_cell",
+ "serde",
  "version_check",
  "zerocopy",
 ]
@@ -94,6 +97,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
 [[package]]
 name = "arrayref"
 version = "0.3.9"
@@ -105,6 +114,15 @@ name = "arrayvec"
 version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "as-raw-xcb-connection"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175571dd1d178ced59193a6fc02dde1b972eb0bc56c892cde9beeceac5bf0f6b"
 
 [[package]]
 name = "ash"
@@ -513,6 +531,15 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
+[[package]]
+name = "cgl"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ced0551234e87afee12411d535648dd89d2e7f34c78b753395567aff3d447ff"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "chacha20"
 version = "0.10.2"
@@ -571,6 +598,15 @@ dependencies = [
  "x509-cert",
 ]
 
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "codespan-reporting"
 version = "0.13.1"
@@ -597,6 +633,16 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
+[[package]]
+name = "colored"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "117725a109d387c937a1533ce01b450cbde6b88abceea8473c4d7a85853cda3c"
+dependencies = [
+ "lazy_static",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "combine"
 version = "4.6.8"
@@ -733,15 +779,112 @@ dependencies = [
 name = "craft-docpath"
 version = "0.1.0"
 
+[[package]]
+name = "craft-font-catalog"
+version = "0.1.0"
+dependencies = [
+ "fontique",
+ "skrifa 0.47.0",
+ "thiserror 2.0.21",
+ "windows-registry",
+ "write-fonts 0.54.1",
+]
+
+[[package]]
+name = "craft-font-manager"
+version = "0.1.0"
+dependencies = [
+ "craft-font-catalog",
+ "craft-font-store",
+ "craft-i18n",
+ "craft-ui",
+ "egui",
+ "egui_kittest",
+ "egui_system_font_provider",
+ "epaint_default_fonts",
+ "image",
+ "log",
+ "serde",
+]
+
+[[package]]
+name = "craft-font-store"
+version = "0.1.0"
+dependencies = [
+ "craft-atomic",
+ "craft-font-catalog",
+ "flate2",
+ "serde",
+ "serde_json",
+ "sha2",
+ "skrifa 0.47.0",
+ "thiserror 2.0.21",
+ "ureq",
+ "write-fonts 0.54.1",
+]
+
+[[package]]
+name = "craft-fonts-build"
+version = "0.1.0"
+dependencies = [
+ "craft-fonts-build-consumer",
+ "skera",
+ "skrifa 0.48.0",
+]
+
+[[package]]
+name = "craft-fonts-build-consumer"
+version = "0.1.0"
+dependencies = [
+ "craft-fonts-build",
+]
+
 [[package]]
 name = "craft-i18n"
 version = "0.1.0"
 dependencies = [
- "intl_pluralrules",
+ "fixed_decimal",
+ "icu_collator",
+ "icu_decimal",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_normalizer",
+ "icu_plurals",
+ "icu_properties",
+ "icu_provider",
+ "icu_provider_adapters",
+ "icu_provider_blob",
  "log",
+ "objc2-foundation 0.3.2",
  "sys-locale",
- "unic-langid",
  "unicode-bidi",
+ "windows-registry",
+ "writeable",
+]
+
+[[package]]
+name = "craft-jpeg"
+version = "0.1.0"
+dependencies = [
+ "jpeg-encoder",
+ "thiserror 2.0.21",
+ "zune-jpeg",
+]
+
+[[package]]
+name = "craft-keymap"
+version = "0.1.0"
+dependencies = [
+ "craft-i18n",
+ "craft-settings",
+ "craft-ui",
+ "egui",
+ "egui_kittest",
+ "image",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
 ]
 
 [[package]]
@@ -753,6 +896,18 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "craft-menu"
+version = "0.1.0"
+dependencies = [
+ "craft-keymap",
+ "craft-quit",
+ "egui",
+ "muda",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+]
+
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
@@ -769,6 +924,18 @@ dependencies = [
  "wasm-bindgen-test",
 ]
 
+[[package]]
+name = "craft-plate-test"
+version = "0.1.0"
+dependencies = [
+ "craft-cms",
+ "craft-pdf",
+ "hayro-syntax",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "craft-platform"
 version = "0.1.0"
@@ -786,13 +953,26 @@ dependencies = [
  "zbus",
 ]
 
+[[package]]
+name = "craft-prepress"
+version = "0.1.0"
+dependencies = [
+ "craft-cms",
+ "craft-pdf",
+ "craft-plate-test",
+ "kurbo 0.13.1",
+ "linesweeper",
+ "thiserror 2.0.21",
+ "ttf-parser",
+]
+
 [[package]]
 name = "craft-print"
 version = "0.1.0"
 dependencies = [
  "craft-winprint-gdi",
- "miniz_oxide 0.8.9",
- "roxmltree",
+ "miniz_oxide 0.9.1",
+ "roxmltree 0.21.2",
  "tempfile",
  "winprint",
  "winsafe",
@@ -820,16 +1000,70 @@ dependencies = [
  "toml_edit",
 ]
 
+[[package]]
+name = "craft-text"
+version = "0.1.0"
+dependencies = [
+ "hypher",
+ "icu_segmenter",
+ "miniz_oxide 0.8.9",
+ "unicode-bidi",
+ "unicode-bidi-mirroring",
+ "unicode-general-category",
+ "unicode-linebreak",
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
 dependencies = [
+ "craft-fonts-build",
+ "craft-i18n",
+ "eframe",
  "egui",
  "egui_extras",
  "egui_kittest",
+ "epaint",
+ "fontique",
  "image",
+ "js-sys",
+ "log",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
  "serde",
  "serde_json",
+ "skrifa 0.44.0",
+ "unicode-script",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-bindgen-test",
+ "web-sys",
+]
+
+[[package]]
+name = "craft-update"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "dunce",
+ "egui",
+ "flate2",
+ "getrandom 0.3.4",
+ "log",
+ "plist",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tar",
+ "tempfile",
+ "ureq",
+ "verifysign",
+ "winreg",
+ "winsafe",
+ "zip",
 ]
 
 [[package]]
@@ -837,6 +1071,8 @@ name = "craft-window"
 version = "0.1.0"
 dependencies = [
  "egui",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
  "wayland-client",
 ]
 
@@ -955,6 +1191,25 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "deranged"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e"
+
+[[package]]
+name = "dify"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90ce0fb972943b4e88cd03b8f92953df0c71bb05e0bde8e5b684895d808013cc"
+dependencies = [
+ "anyhow",
+ "colored",
+ "getopts",
+ "image",
+ "rayon",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -1052,18 +1307,17 @@ checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 [[package]]
 name = "ecolor"
 version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31bcbef0d4263a63eb32c4834e5d711613035ce1333468e107d928923e21e6e2"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "emath",
+ "serde",
 ]
 
 [[package]]
 name = "eframe"
 version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c5642501a65ca657d05f00c643a5c14ff2346cb3818032bfe23d58e1f8e5f84"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1071,6 +1325,9 @@ dependencies = [
  "egui",
  "egui-wgpu",
  "egui-winit",
+ "egui_glow",
+ "glutin",
+ "glutin-winit",
  "image",
  "js-sys",
  "log",
@@ -1095,8 +1352,7 @@ dependencies = [
 [[package]]
 name = "egui"
 version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec9144f49b7a28b5f395d3147e325b4fe3e77ba686eac11d1bdf0a7da3f375f"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit",
  "ahash",
@@ -1107,6 +1363,7 @@ dependencies = [
  "log",
  "nohash-hasher",
  "profiling",
+ "serde",
  "smallvec",
  "unicode-segmentation",
  "web-sys",
@@ -1115,8 +1372,7 @@ dependencies = [
 [[package]]
 name = "egui-wgpu"
 version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0309cbe1febed48af5b974e4bcc424b35e9664863a4d402697147b57a488c864"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1135,10 +1391,10 @@ dependencies = [
 [[package]]
 name = "egui-winit"
 version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4e449f4c4a2a60c7ccb4ba7fa4078417bfe1f9ddc03b5e05ce75748e33a70de"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "block2 0.6.2",
+ "bytemuck",
  "egui",
  "log",
  "objc2 0.6.5",
@@ -1155,8 +1411,7 @@ dependencies = [
 [[package]]
 name = "egui_extras"
 version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "def286cf47194f3fe45b8e37c503ada7a20a64b59a903b4bc704baec943b1827"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "egui",
@@ -1167,24 +1422,53 @@ dependencies = [
  "resvg",
 ]
 
+[[package]]
+name = "egui_glow"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+dependencies = [
+ "bytemuck",
+ "egui",
+ "glow",
+ "log",
+ "profiling",
+ "winit",
+]
+
 [[package]]
 name = "egui_kittest"
 version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0979c2e37860fcf13a2bea77508607f067a9a6a84ba9bd47b5e298582fb59b86"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
+ "dify",
  "eframe",
  "egui",
  "egui-wgpu",
  "image",
  "kittest",
  "log",
+ "open",
  "pollster",
  "serde",
+ "tempfile",
  "toml",
  "wgpu",
 ]
 
+[[package]]
+name = "egui_system_font_provider"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+dependencies = [
+ "epaint",
+ "fontique",
+ "log",
+ "poll-promise",
+ "skrifa 0.44.0",
+ "sys-locale",
+ "unicode-script",
+]
+
 [[package]]
 name = "either"
 version = "1.19.0"
@@ -1194,12 +1478,24 @@ checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
 [[package]]
 name = "emath"
 version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e73ce90f54750be8672c02be0743fe47530e6f251e066f0ee2869b59eb297af5"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
+ "serde",
 ]
 
+[[package]]
+name = "embedded-io"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
+
+[[package]]
+name = "embedded-io"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.42"
@@ -1261,26 +1557,38 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "enumn"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f9ed6b3789237c8a0c1c505af1c7eb2c560df6186f01b098c3a1064ea532f38"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "epaint"
 version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97bac86ae3dde93fc3951e790951caea739ff39a6c89d909cdaf1d9278dbb1bd"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
  "ecolor",
  "emath",
  "epaint_default_fonts",
- "font-types 0.12.6",
+ "font-types 0.12.7",
  "harfrust",
  "log",
  "nohash-hasher",
  "parking_lot",
  "profiling",
  "self_cell",
+ "serde",
  "skrifa 0.44.0",
  "smallvec",
+ "unicode-bidi",
  "unicode-general-category",
  "unicode-properties",
  "unicode-segmentation",
@@ -1290,8 +1598,7 @@ dependencies = [
 [[package]]
 name = "epaint_default_fonts"
 version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfc1cc505827f4c23eedc297975a0fd038268d41293f389dd8ff3b574aefab19"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 
 [[package]]
 name = "equivalent"
@@ -1375,6 +1682,17 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixed_decimal"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2214fb00f669ee96bee5bb29dfb1ddabe058b2bc426817efc79afa03c9bc55ae"
+dependencies = [
+ "displaydoc",
+ "smallvec",
+ "writeable",
+]
+
 [[package]]
 name = "flagset"
 version = "0.4.7"
@@ -1446,11 +1764,34 @@ dependencies = [
 
 [[package]]
 name = "font-types"
-version = "0.12.6"
+version = "0.12.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c92d9081c7ab3bd83ef1eecdfad090f3d966e3ce74106779664114cfe1a6274"
+checksum = "835ae9d781464a79026cde387f9cbc650c9a4909d7cf7e658b127e3c35d2f35d"
 dependencies = [
  "bytemuck",
+ "serde",
+]
+
+[[package]]
+name = "fontique"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6688bc1294fe7117d788937b6c53480169b29c566954af490830d4c09da9516a"
+dependencies = [
+ "hashbrown 0.17.1",
+ "linebender_resource_handle",
+ "memmap2",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+ "objc2-core-text",
+ "objc2-foundation 0.3.2",
+ "parlance",
+ "read-fonts 0.41.0",
+ "roxmltree 0.21.2",
+ "smallvec",
+ "windows",
+ "windows-core",
+ "yeslogic-fontconfig-sys",
 ]
 
 [[package]]
@@ -1567,6 +1908,25 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "gethostname"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8"
+dependencies = [
+ "rustix 1.1.5",
+ "windows-link",
+]
+
+[[package]]
+name = "getopts"
+version = "0.2.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe4fbac503b8d1f88e6676011885f34b7174f46e59956bba534ba83abded4df"
+dependencies = [
+ "unicode-width",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -1580,6 +1940,18 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.4.3"
@@ -1589,7 +1961,7 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "r-efi",
+ "r-efi 6.0.0",
  "rand_core 0.10.1",
  "wasm-bindgen",
 ]
@@ -1643,6 +2015,7 @@ dependencies = [
  "hashbrown 0.17.1",
  "log",
  "peniko",
+ "png 0.18.1",
  "skrifa 0.44.0",
  "smallvec",
  "vello_common 0.2.0",
@@ -1660,6 +2033,62 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "glutin"
+version = "0.32.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12124de845cacfebedff80e877bb37b5b75c34c5a4c89e47e1cdd67fb6041325"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg_aliases",
+ "cgl",
+ "dispatch2",
+ "glutin_egl_sys",
+ "glutin_glx_sys",
+ "glutin_wgl_sys",
+ "libloading",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "once_cell",
+ "raw-window-handle",
+ "windows-sys 0.52.0",
+ "x11-dl",
+]
+
+[[package]]
+name = "glutin-winit"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85edca7075f8fc728f28cb8fbb111a96c3b89e930574369e3e9c27eb75d3788f"
+dependencies = [
+ "cfg_aliases",
+ "glutin",
+ "raw-window-handle",
+ "winit",
+]
+
+[[package]]
+name = "glutin_egl_sys"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4680ba6195f424febdc3ba46e7a42a0e58743f2edb115297b86d7f8ecc02d2"
+dependencies = [
+ "gl_generator",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "glutin_glx_sys"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7bb2938045a88b612499fbcba375a77198e01306f52272e692f8c1f3751185"
+dependencies = [
+ "gl_generator",
+ "x11-dl",
+]
+
 [[package]]
 name = "glutin_wgl_sys"
 version = "0.6.1"
@@ -1777,8 +2206,6 @@ checksum = "9f4d0e94ddd48749f06bbe4e5389fb9799a0c45bcaf00495042076ef05e3241a"
 [[package]]
 name = "hayro-cmap"
 version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d285dc30731c8485de5fa732fbdf2b3affdf01e4da7c2135022ca6fa664bf6"
 dependencies = [
  "brotli",
  "hayro-postscript",
@@ -1821,8 +2248,6 @@ dependencies = [
 [[package]]
 name = "hayro-postscript"
 version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "885c5ef0654933139a9b9546fc2c69e18d37f38aa2520f079092b1be18f1fcaa"
 
 [[package]]
 name = "hayro-syntax"
@@ -1969,6 +2394,12 @@ dependencies = [
  "windows-registry",
 ]
 
+[[package]]
+name = "hypher"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45f2b4f6b5da34d400d4c112eadcc14512cc5d04307a8eee182586d9bebd7ce6"
+
 [[package]]
 name = "iana-time-zone"
 version = "0.1.65"
@@ -1993,6 +2424,24 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_collator"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08984ed58ac439ebf3e13d2cf26b0c46a60afcd21721c1d14087c0b240344dda"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_normalizer",
+ "icu_properties",
+ "icu_provider",
+ "serde",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_collections"
 version = "2.3.0"
@@ -2001,12 +2450,30 @@ checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "serde",
  "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
 ]
 
+[[package]]
+name = "icu_decimal"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb8f655bba2d0c0459e43a5b0e6cd3cd388109898fb3d85d048165e8b0abd08"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_locale_core",
+ "icu_pattern",
+ "icu_plurals",
+ "icu_provider",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_locale_core"
 version = "2.3.0"
@@ -2015,11 +2482,32 @@ checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
+ "serde",
  "tinystr",
  "writeable",
  "zerovec",
 ]
 
+[[package]]
+name = "icu_locale_fallback"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
+dependencies = [
+ "icu_locale_core",
+ "icu_locale_fallback_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
+
 [[package]]
 name = "icu_normalizer"
 version = "2.3.0"
@@ -2030,7 +2518,11 @@ dependencies = [
  "icu_normalizer_data",
  "icu_properties",
  "icu_provider",
+ "serde",
  "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
  "zerovec",
 ]
 
@@ -2040,6 +2532,32 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
+[[package]]
+name = "icu_pattern"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b3db611446bd92c246b03e4aa0bafa71ddb194af431ddbb42b9d70e4bfce1a0"
+dependencies = [
+ "displaydoc",
+ "either",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e475e6766ef87b1d3c1f97be6363995b0bfaeddbc789671615df598a97ff0593"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_provider",
+ "serde",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_properties"
 version = "2.3.0"
@@ -2051,6 +2569,7 @@ dependencies = [
  "icu_locale_core",
  "icu_properties_data",
  "icu_provider",
+ "serde",
  "zerotrie",
  "zerovec",
 ]
@@ -2069,6 +2588,9 @@ checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
+ "postcard",
+ "serde",
+ "stable_deref_trait",
  "writeable",
  "yoke",
  "zerofrom",
@@ -2076,6 +2598,53 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_provider_adapters"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df887bc4f55dbc773c7c45a0c7dfa75be886f7b7812830a71ab7271cc1801820"
+dependencies = [
+ "icu_locale_fallback",
+ "icu_provider",
+]
+
+[[package]]
+name = "icu_provider_blob"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5916b44fac319d3f58e4d8d805a627df19e27937b582cd99fcde3bb6b7ce1b0e"
+dependencies = [
+ "icu_provider",
+ "postcard",
+ "serde",
+ "writeable",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_segmenter"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82d07aafccd67af15d02512a6adf5896fbc5ed00f2e99b471d2efa14016db3db"
+dependencies = [
+ "core_maths",
+ "icu_collections",
+ "icu_locale_fallback",
+ "icu_provider",
+ "icu_segmenter_data",
+ "potential_utf",
+ "smallvec",
+ "utf8_iter",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_segmenter_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae293c039020f9ec10710af98d29ce6aa2051486638b49c9a6409f3b4a9e98ad"
+
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -2142,21 +2711,31 @@ dependencies = [
  "hashbrown 0.17.1",
 ]
 
-[[package]]
-name = "intl_pluralrules"
-version = "7.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "078ea7b7c29a2b4df841a7f6ac8775ff6074020c6776d48491ce2268e068f972"
-dependencies = [
- "unic-langid",
-]
-
 [[package]]
 name = "ipnet"
 version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
+[[package]]
+name = "is-docker"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "928bae27f42bc99b60d9ac7334e3a21d10ad8f1835a4e12ec3ec0464765ed1b3"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "is-wsl"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "173609498df190136aa7dea1a91db051746d339e18476eed5ca40521f02d7aa5"
+dependencies = [
+ "is-docker",
+ "once_cell",
+]
+
 [[package]]
 name = "itertools"
 version = "0.15.0"
@@ -2240,6 +2819,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "jpeg-encoder"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b454d911ac55068f53495488d8ccd0646eaa540c033a28ee15b07838afafb01f"
+
 [[package]]
 name = "js-sys"
 version = "0.3.106"
@@ -2335,9 +2920,16 @@ dependencies = [
  "arrayvec",
  "euclid",
  "polycool",
+ "serde",
  "smallvec",
 ]
 
+[[package]]
+name = "lazy_static"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
+
 [[package]]
 name = "libc"
 version = "0.2.190"
@@ -2378,6 +2970,19 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d4a5ff6bcca6c4867b1c4fd4ef63e4db7436ef363e0ad7531d1558856bae64f4"
 
+[[package]]
+name = "linesweeper"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a25df1b0c5432893f41bba817150e323703ee5f6d974f3a6808ac7fd7f046d18"
+dependencies = [
+ "arrayvec",
+ "kurbo 0.13.1",
+ "polycool",
+ "rustc-hash 2.1.3",
+ "smallvec",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.15"
@@ -2395,6 +3000,9 @@ name = "litemap"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "litrs"
@@ -2429,6 +3037,15 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
+[[package]]
+name = "memmap2"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b0ca1155a9ecc25aa12e8313a119f32edf0255fea2f44839c4ac0a12b2ac157"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "memoffset"
 version = "0.9.1"
@@ -2587,6 +3204,18 @@ dependencies = [
  "jni-sys 0.3.1",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
@@ -2602,6 +3231,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2771,6 +3406,16 @@ dependencies = [
  "objc2-foundation 0.2.2",
 ]
 
+[[package]]
+name = "objc2-core-text"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "objc2-encode"
 version = "4.1.0"
@@ -2955,6 +3600,16 @@ version = "11.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
 
+[[package]]
+name = "open"
+version = "5.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d8c8b8e725ad26404d6896eb2f064294a0a7b4f1d9120210d85544684c4ca95"
+dependencies = [
+ "is-wsl",
+ "libc",
+]
+
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
@@ -3025,6 +3680,12 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "parlance"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73072a9470554c8e794778acece2312661218aaabb635600957d952cf01c716e"
+
 [[package]]
 name = "pdf-writer"
 version = "0.15.0"
@@ -3182,6 +3843,19 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
+[[package]]
+name = "plist"
+version = "1.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "327a4cb2ad49dc48adfdc9da89e22c64d488b508c67a044d71ba729e4521a285"
+dependencies = [
+ "base64 0.23.1",
+ "indexmap",
+ "quick-xml 0.42.0",
+ "serde",
+ "time",
+]
+
 [[package]]
 name = "png"
 version = "0.17.16"
@@ -3208,6 +3882,16 @@ dependencies = [
  "miniz_oxide 0.8.9",
 ]
 
+[[package]]
+name = "poll-promise"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6a58fecbf9da8965bcdb20ce4fd29788d1acee68ddbb64f0ba1b81bccdb7df"
+dependencies = [
+ "document-features",
+ "static_assertions",
+]
+
 [[package]]
 name = "polling"
 version = "3.11.0"
@@ -3252,15 +3936,35 @@ dependencies = [
  "portable-atomic",
 ]
 
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "embedded-io 0.4.0",
+ "embedded-io 0.6.1",
+ "serde",
+]
+
 [[package]]
 name = "potential_utf"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
+ "serde_core",
+ "writeable",
  "zerovec",
 ]
 
+[[package]]
+name = "powerfmt"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
+
 [[package]]
 name = "presser"
 version = "0.3.1"
@@ -3362,6 +4066,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quinn"
 version = "0.11.12"
@@ -3428,6 +4141,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "r-efi"
 version = "6.0.0"
@@ -3536,7 +4255,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "046a7d674daf459825b32f5062056d6882db0d2f5a479fbd76ccfc870ac18709"
 dependencies = [
  "bytemuck",
- "font-types 0.12.6",
+ "font-types 0.12.7",
  "once_cell",
 ]
 
@@ -3547,10 +4266,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d5a0cf4bb6cbce4c29756270d189a5e400ac05e91192161d83a0bcb6e68492e8"
 dependencies = [
  "bytemuck",
- "font-types 0.12.6",
+ "font-types 0.12.7",
  "once_cell",
 ]
 
+[[package]]
+name = "read-fonts"
+version = "0.45.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4edc8db0d972de88e53a085b1f01fb3fbdae7bb0cb7a0ce2b2f8285a412fe3ef"
+dependencies = [
+ "bytemuck",
+ "foldhash",
+ "font-types 0.12.7",
+ "once_cell",
+ "yoke",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.4.1"
@@ -3686,6 +4418,15 @@ version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
 
+[[package]]
+name = "roxmltree"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9da7f59328b09405b181fee1018925fad50f157afb43c0c0f5c522c256dd5907"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -3735,12 +4476,14 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "aws-lc-rs",
+ "log",
  "once_cell",
+ "ring",
  "rustls-pki-types",
  "rustls-webpki",
  "subtle",
@@ -3914,6 +4657,10 @@ name = "semver"
 version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+dependencies = [
+ "serde",
+ "serde_core",
+]
 
 [[package]]
 name = "send_wrapper"
@@ -3953,9 +4700,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
  "itoa",
  "memchr",
@@ -4251,6 +4998,18 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33f4fe9184a62d842c9ef383018f3306d8ba224fd9d836f56d7288308847c256"
 
+[[package]]
+name = "skera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "531045338e36ad05b9652912a47ba38a935d0eaa0293c3e33d8112cfa414c14b"
+dependencies = [
+ "hashbrown 0.17.1",
+ "skrifa 0.48.0",
+ "thiserror 2.0.21",
+ "write-fonts 0.54.1",
+]
+
 [[package]]
 name = "skrifa"
 version = "0.42.1"
@@ -4281,6 +5040,16 @@ dependencies = [
  "read-fonts 0.44.0",
 ]
 
+[[package]]
+name = "skrifa"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5213b4825bac3587046330052d61bfac7bd3bd0d203c758d7c2ef726fcea034"
+dependencies = [
+ "bytemuck",
+ "read-fonts 0.45.1",
+]
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -4301,6 +5070,9 @@ name = "smallvec"
 version = "1.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "smol_str"
@@ -4402,7 +5174,7 @@ dependencies = [
  "kurbo 0.13.1",
  "rustc-hash 2.1.3",
  "skrifa 0.42.1",
- "write-fonts",
+ "write-fonts 0.48.1",
 ]
 
 [[package]]
@@ -4579,6 +5351,36 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tiny-skia"
 version = "0.11.4"
@@ -4844,6 +5646,12 @@ dependencies = [
  "rustc-hash 2.1.3",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
+
 [[package]]
 name = "typenum"
 version = "1.20.1"
@@ -4867,24 +5675,6 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
 
-[[package]]
-name = "unic-langid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a28ba52c9b05311f4f6e62d5d9d46f094bd6e84cb8df7b3ef952748d752a7d05"
-dependencies = [
- "unic-langid-impl",
-]
-
-[[package]]
-name = "unic-langid-impl"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dce1bf08044d4b7a94028c93786f8566047edc11110595914de93362559bc658"
-dependencies = [
- "tinystr",
-]
-
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"
@@ -4915,6 +5705,12 @@ version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
+[[package]]
+name = "unicode-linebreak"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
+
 [[package]]
 name = "unicode-normalization"
 version = "0.1.25"
@@ -4960,6 +5756,36 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
+[[package]]
+name = "ureq"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cde93ff05758a36a851a398a772b0b79a82fbe3c186a46f2696baaeaf84c966b"
+dependencies = [
+ "base64 0.23.1",
+ "flate2",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "ureq-proto",
+ "utf8-zero",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841583fc36089d7d59419568ae157f43a5a03a2e5a81ba87c77d1596ef46e922"
+dependencies = [
+ "base64 0.23.1",
+ "http",
+ "httparse",
+ "log",
+]
+
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -4985,7 +5811,7 @@ dependencies = [
  "kurbo 0.11.3",
  "log",
  "pico-args",
- "roxmltree",
+ "roxmltree 0.20.0",
  "simplecss",
  "siphasher",
  "strict-num",
@@ -4994,6 +5820,18 @@ dependencies = [
  "xmlwriter",
 ]
 
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -5056,6 +5894,7 @@ dependencies = [
  "guillotiere",
  "log",
  "peniko",
+ "png 0.18.1",
  "smallvec",
  "thiserror 2.0.21",
 ]
@@ -5082,9 +5921,20 @@ dependencies = [
  "bytemuck",
  "glifo 0.3.0",
  "hashbrown 0.17.1",
+ "png 0.18.1",
  "vello_common 0.2.0",
 ]
 
+[[package]]
+name = "verifysign"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6acfcc42a8d44f340d001193d97ef56bf33210b51ad760ae8308c97d5241ca51"
+dependencies = [
+ "core-foundation 0.10.1",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
@@ -5125,6 +5975,15 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.129"
@@ -5252,7 +6111,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
  "proc-macro2",
- "quick-xml",
+ "quick-xml 0.41.0",
  "quote",
 ]
 
@@ -5297,6 +6156,15 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -5710,13 +6578,13 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 [[package]]
 name = "winit"
 version = "0.30.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
+source = "git+https://github.com/storytold/winit.git?rev=a517b3846ee8457d84ee4975110bfda6797c44dc#a517b3846ee8457d84ee4975110bfda6797c44dc"
 dependencies = [
  "android-activity",
  "atomic-waker",
  "bitflags 2.13.2",
  "block2 0.5.1",
+ "bytemuck",
  "calloop",
  "cfg_aliases",
  "concurrent-queue",
@@ -5732,6 +6600,7 @@ dependencies = [
  "objc2-foundation 0.2.2",
  "objc2-ui-kit 0.2.2",
  "orbclient",
+ "percent-encoding",
  "pin-project",
  "raw-window-handle",
  "redox_syscall 0.4.1",
@@ -5744,6 +6613,8 @@ dependencies = [
  "web-sys",
  "web-time",
  "windows-sys 0.52.0",
+ "x11-dl",
+ "x11rb",
  "xkbcommon-dl",
 ]
 
@@ -5777,12 +6648,28 @@ dependencies = [
  "xml",
 ]
 
+[[package]]
+name = "winreg"
+version = "0.55.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb5a765337c50e9ec252c2069be9bf91c7df47afb103b642ba3a53bf8101be97"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "winsafe"
 version = "0.0.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ef0ffc427f045c0cc9ebffd6f4f91153dcd2a1547b5c3c29ee3f541e16e95c6"
 
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
 [[package]]
 name = "write-fonts"
 version = "0.48.1"
@@ -5796,11 +6683,65 @@ dependencies = [
  "read-fonts 0.39.2",
 ]
 
+[[package]]
+name = "write-fonts"
+version = "0.54.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55716cfa7e8bcdb90289e07dfac478ccb2e3ec0f9a604fe682c7a03a7984d705"
+dependencies = [
+ "font-types 0.12.7",
+ "indexmap",
+ "kurbo 0.13.1",
+ "log",
+ "read-fonts 0.45.1",
+]
+
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
 [[package]]
 name = "writeable"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "x11-dl"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f"
+dependencies = [
+ "libc",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "x11rb"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9993aa5be5a26815fe2c3eacfc1fde061fc1a1f094bf1ad2a18bf9c495dd7414"
+dependencies = [
+ "as-raw-xcb-connection",
+ "gethostname",
+ "libc",
+ "libloading",
+ "once_cell",
+ "rustix 1.1.5",
+ "x11rb-protocol",
+]
+
+[[package]]
+name = "x11rb-protocol"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
 
 [[package]]
 name = "x509-cert"
@@ -5880,6 +6821,17 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
+[[package]]
+name = "yeslogic-fontconfig-sys"
+version = "6.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d8b8abf912b9a29ff112e1671c97c33636903d13a69712037190e6805af4f76"
+dependencies = [
+ "dlib",
+ "once_cell",
+ "pkg-config",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.3"
@@ -6041,8 +6993,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
+ "litemap",
+ "serde_core",
  "yoke",
  "zerofrom",
+ "zerovec",
 ]
 
 [[package]]
@@ -6068,6 +7023,23 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "zip"
+version = "9.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2886b00003a72c4ccee3f42cfc34908d33b2508a74d827dc2a4244706475c704"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "getrandom 0.4.3",
+ "indexmap",
+ "memchr",
+ "nix",
+ "typed-path",
+ "windows-sys 0.61.2",
+ "zopfli",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.8"
@@ -6080,6 +7052,18 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
+[[package]]
+name = "zopfli"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaf7fc5d30c28483d93805c4a5e12b05bbb52407fa67c5f8bd552374cd01fb11"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
 [[package]]
 name = "zune-core"
 version = "0.5.3"
@@ -6135,3 +7119,13 @@ dependencies = [
  "syn 3.0.6",
  "winnow",
 ]
+
+[[patch.unused]]
+name = "egui_demo_lib"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_inspection"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
diff --git a/Cargo.toml b/Cargo.toml
index 45ff1948..daa783f8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,7 +1,7 @@
 [workspace]
 resolver = "3"
 members = ["crates/*"]
-exclude = ["vendor/krilla", "vendor/hayro", "vendor/hayro-interpret", "vendor/hayro-syntax", "vendor/hayro-jbig2"]
+exclude = ["vendor/krilla", "vendor/hayro", "vendor/hayro-interpret", "vendor/hayro-syntax", "vendor/hayro-jbig2", "vendor/hayro-cmap", "vendor/hayro-postscript"]
 
 [workspace.package]
 version = "0.1.0"
@@ -15,21 +15,33 @@ repository = "https://github.com/storytold/craft-libs"
 craft-platform = { path = "crates/platform" }
 craft-ai-core = { path = "crates/ai-core" }
 craft-pdf = { path = "crates/pdf", version = "=0.1.0" }
+craft-plate-test = { path = "crates/plate-test" }
 krilla = { version = "=0.8.2", default-features = false, features = ["raster-images"] }
 hayro = { version = "=0.7.1", default-features = false }
 hayro-interpret = { version = "=0.7.0", default-features = false, features = ["embed-fonts", "embed-cmaps"] }
 hayro-syntax = { version = "=0.7.2", default-features = false, features = ["std"] }
 bytemuck = "1"
+kurbo = "0.13"
 thiserror = "2"
 craft-atomic = { path = "crates/atomic" }
 craft-cms = { path = "crates/cms" }
 craft-docpath = { path = "crates/docpath" }
+craft-font-catalog = { path = "crates/font-catalog" }
+craft-font-manager = { path = "crates/font-manager" }
+craft-font-store = { path = "crates/font-store" }
+craft-fonts-build = { path = "crates/fonts-build" }
 craft-i18n = { path = "crates/i18n" }
+craft-jpeg = { path = "crates/jpeg" }
+craft-keymap = { path = "crates/keymap" }
 craft-media = { path = "crates/media" }
+craft-menu = { path = "crates/menu" }
+craft-prepress = { path = "crates/prepress" }
 craft-print = { path = "crates/print" }
 craft-quit = { path = "crates/quit" }
 craft-settings = { path = "crates/settings" }
+craft-text = { path = "crates/text" }
 craft-ui = { path = "crates/ui" }
+craft-update = { path = "crates/update" }
 craft-window = { path = "crates/window" }
 egui = { version = "0.37", default-features = false }
 rayon = "1"
@@ -44,6 +56,9 @@ unsafe_code = "forbid"
 unexpected_cfgs = { level = "warn", check-cfg = ["cfg(craft_pdf_unicode_fixtures)"] }
 
 [workspace.lints.clippy]
+cognitive_complexity = "deny"
+too_many_arguments = "deny"
+wildcard_imports = "deny"
 dbg_macro = "warn"
 todo = "warn"
 
@@ -54,3 +69,20 @@ hayro = { path = "vendor/hayro" }
 hayro-interpret = { path = "vendor/hayro-interpret" }
 hayro-syntax = { path = "vendor/hayro-syntax" }
 hayro-jbig2 = { path = "vendor/hayro-jbig2" }
+hayro-cmap = { path = "vendor/hayro-cmap" }
+hayro-postscript = { path = "vendor/hayro-postscript" }
+ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint_default_fonts = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-winit = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-wgpu = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_glow = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_extras = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_kittest = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_system_font_provider = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+eframe = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_demo_lib = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_inspection = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+winit = { git = "https://github.com/storytold/winit.git", rev = "a517b3846ee8457d84ee4975110bfda6797c44dc" }
diff --git a/NOTICE b/NOTICE
index 38a65fcf..a46d3754 100644
--- a/NOTICE
+++ b/NOTICE
@@ -19,6 +19,40 @@ crates/cms/tests/data/FOGRA39.txt: FOGRA39 characterisation data, distributed un
   the data are distributed unmodified and Fogra is identified as the source. The designation
   FOGRAxx may be used solely to identify the respective reference data. Such use does not
   imply certification, approval or endorsement by Fogra."
+crates/text/assets/hyphen/en-us.dic: public domain, derived from the Moby Hyphenator II list by
+  Grady Ward (Project Gutenberg eBook #3204).
+crates/text/assets/hyphen/en-us.pat: CC0-1.0, trained from en-us.dic by DesignCraft's trainer.
+Hyphenation patterns for other languages, embedded through the hypher crate only when the
+  matching craft-text feature is enabled (none are by default). They come from hyph-utf8,
+  https://github.com/hyphenation/tex-hyphen, as packaged in https://github.com/typst/hypher
+  (patterns/). Each file is under the license stated in its header: LPPL, MIT, BSD-3-Clause, the
+  Unlicense, a notice permitting any use, or a choice of licenses that includes one of these. An
+  application that enables a language ships that file's copyright and license notice. The
+  exception is Slovak (hyph-sk.tex, Copyright (C) 1992 Jana Chlebíková), under the GNU General
+  Public License, version 2 or later (SPDX: GPL-2.0-or-later). craft-text asks for it through the
+  feature "slovak-gpl", which "all-languages" does not include; an application that enables it
+  ships GPL-licensed data. Cargo unifies features, so another dependency that enables hypher's
+  "slovak" feature (hypher's default features do) embeds the same data; a build that must exclude
+  it checks its dependency graph. The Spanish patterns (feature "spanish") are hyph-es.tex 5.0.
+  Copyright (C) 1993, 1997 Javier Bezos, 2001-2019 Javier Bezos, CervanTeX. MIT License:
+  Permission is hereby granted, free of charge, to any person obtaining a copy of this software
+  and associated documentation files (the "Software"), to deal in the Software without
+  restriction, including without limitation the rights to use, copy, modify, merge, publish,
+  distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the
+  Software is furnished to do so, subject to the following conditions: The above copyright notice
+  and this permission notice shall be included in all copies or substantial portions of the
+  Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+  INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE
+  AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+  DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+- Word-break dictionaries and LSTM models for Thai, Lao, Khmer and Burmese, embedded through the
+  icu_segmenter_data crate only when craft-text's "thai", "lao", "khmer" or "burmese" feature is
+  enabled (none are by default). From ICU4X, https://github.com/unicode-org/icu4x.
+  Copyright (c) 2020-2024 Unicode, Inc. Unicode License v3 (SPDX: Unicode-3.0); portions adapted
+  from ICU4C, (c) 1995-2016 International Business Machines Corporation and others. An
+  application that enables one of these features ships the Unicode License v3 copyright and
+  permission notice, https://www.unicode.org/license.txt.
 
 The optional PDF writer bundles four CC0 ICC profiles by Clinton Ingram. See ATTRIBUTION.md for per-file sources and hashes.
 
@@ -53,6 +87,13 @@ The transactional panel model and drop-zone semantics in crates/ui/src/docking d
 FilmCraft/EffectCraft split, tab and accordion layouts and VectorCraft floating groups listed
 above. The generic transaction validation, optional renderer and workspace-location helpers
 are implemented here without dependencies on application engines or native window helpers.
+The hyphenation code, data and generator in crates/text (src/hyphen/, assets/hyphen/ and
+examples/hyphgen.rs) are adapted from:
+- DesignCraft, crates/compose/src/hyphen/, crates/compose/examples/hyphgen.rs and
+  assets/hyphenation/, revision e161878e4c7744fa06f9a2eede8103cb4c296355 (above).
+- WordCraft, crates/proof/src/hyphen.rs, revision e4b7d155f15a7784197ba34eeea0b54490d70eb2.
+  https://github.com/storytold/wordcraft
+  Copyright (c) 2026 ArtCraft Team and the WordCraft contributors.
 All sources listed above are licensed MIT OR Apache-2.0. No icon artwork is copied here.
 
 The PDF spooler in crates/print is extracted from:
@@ -75,6 +116,31 @@ PrintTicket and its driver-paper preference):
   Copyright (c) 2026 ArtCraft Team and the PdfCraft contributors.
   Licensed MIT OR Apache-2.0.
 
+The menu layout and native-menu driver in crates/menu are extracted from:
+- PhotoCraft, crates/ui-egui/src/native_menu.rs, revision 6f85054288a564f9fbbccb99268ffdb34e581584.
+  https://github.com/storytold/photocraft
+  Copyright (c) 2026 ArtCraft Team and the PhotoCraft contributors.
+  Licensed MIT OR Apache-2.0. PhotoCraft's menus, translations and command handling are not copied.
+The macOS backend in crates/menu/src/mac.rs is adapted from:
+- PhotoCraft, apps/photocraft/src/mac_menu.rs, revision 6f85054288a564f9fbbccb99268ffdb34e581584.
+  https://github.com/storytold/photocraft
+  Copyright (c) 2026 ArtCraft Team and the PhotoCraft contributors.
+- VectorCraft, apps/vectorcraft/src/mac_menu.rs, revision 0d0ea352df99044589a7ce0efc7004f7a5b6b7c0
+  (closing an open menu on a click or Escape, and its tests, in crates/menu/src/driver.rs).
+  https://github.com/storytold/vectorcraft
+  Copyright (c) 2026 ArtCraft Team and the VectorCraft contributors.
+  Both licensed MIT OR Apache-2.0.
+The egui menu bar in crates/menu/src/bar (its menu navigation, scrolling, submenu hover
+intent, keyboard access and mnemonics, and their tests) is ported from:
+- PhotoCraft, crates/ui-egui/src/menu_nav.rs and menu_nav_tests.rs, menu_keys.rs and
+  menu_keys_tests.rs, and the menu bar in crates/ui-egui/src/menus.rs, revision
+  c36e46c3873ee39f299cc50a3dcd28494c78366d.
+  https://github.com/storytold/photocraft
+  Copyright (c) 2026 ArtCraft Team and the PhotoCraft contributors, among them aiongg, artman67,
+  BFlat, Brandon Thomas, Brennan Stehling, Daniel Lošák, David Mann, Fabio Lissi, FredApps,
+  Higgs32584, itsF4LCON, jason4short, Korg1ch, MarekSpodBiedry and Nigel Ihza Firdausy.
+  Licensed MIT OR Apache-2.0. PhotoCraft's menus, theme and Help search are not copied.
+
 The colour management module in crates/cms is extracted from:
 - PhotoCraft, crates/cms, revision b3222ee8e7e6bcb4799c37f904c595f20f9baf5e.
   https://github.com/storytold/photocraft
@@ -91,20 +157,31 @@ The optional writer embeds Compact ICC Profiles by Clinton Ingram
 See licenses/pdf-writer/LICENSE-ICC.txt and ATTRIBUTION.md for sources and hashes.
 The writer adds no font files. Its four existing ICC profiles are retained under vendor/krilla/icc.
 
-Krilla is vendored with a native unwind-cleanup patch; see vendor/krilla/README.craft.md
+Krilla is vendored with the local patches in vendor/krilla/patches; see vendor/krilla/README.craft.md
 and vendor/krilla/SOURCE.json. Its upstream MIT/Apache-2.0 licences and CC0 profiles are unchanged.
 
 Optional PDF reader
 
-Hayro 0.7.1, hayro-interpret 0.7.0, hayro-syntax 0.7.2 and hayro-jbig2 0.3.0
-(https://github.com/LaurenzV/hayro), MIT OR Apache-2.0, retain their upstream licence files.
-These patched sources are transferred from PdfCraft revision
-7437bde378f43856eada40af25b983812e615e8a (https://github.com/storytold/pdfcraft).
+Hayro 0.7.1, hayro-interpret 0.7.0, hayro-syntax 0.7.2, hayro-jbig2 0.3.0, hayro-cmap 0.1.0
+and hayro-postscript 0.1.0 (https://github.com/LaurenzV/hayro), MIT OR Apache-2.0, retain their
+upstream licence files. The first five are patched sources transferred from PdfCraft
+(https://github.com/storytold/pdfcraft): hayro-cmap from revision
+a2ec27b4775f53c40cad3456936d9406611e3a8d, the others from revision
+ec0a965074f376a5bf610435948e4e5184bf3299. hayro-postscript is the crates.io 0.1.0 package
+(upstream revision a2354aebaf86f5ab13e5fd6b6b0521306488bf9d) with one local patch.
 See vendor/README.craft-reader.md and each crate's SOURCE.json for provenance and local changes.
+The hayro-interpret plate mode (separations, overprint and output-intent simulation) is ported
+from PdfCraft pull request #2770 by Guillem Hermida, commit
+6fcf2a4aca29e943e28cb69017ff8f87d00656c6 (https://github.com/storytold/pdfcraft/pull/2770),
+MIT OR Apache-2.0; crates/pdf/tests/plates.rs and tests/support/synthetic_icc.rs adapt its tests.
+Knockout transparency groups in hayro-interpret and hayro are ported from PdfCraft pull request
+#2974 by mtlcl410, commit bae69819594a6385a027fec1f67e6b3c36c259b4
+(https://github.com/storytold/pdfcraft/pull/2974), MIT OR Apache-2.0;
+crates/pdf/tests/knockout.rs adapts its test.
 The reader retains the existing Foxit/PDFium standard-14 font assets (BSD-3-Clause),
 Compact ICC Profiles by Clinton Ingram (CC0-1.0), and dependency CMaps (BSD-3-Clause).
 Their licences and per-file hashes are retained in vendor/hayro-interpret/assets,
-licenses/pdf-backend and ATTRIBUTION.md. These are existing reader dependency assets;
+vendor/hayro-cmap/assets, licenses/pdf-backend and ATTRIBUTION.md. These are existing reader dependency assets;
 applications retain their own document-font selection and licensing policy.
 
 Platform lifecycle source provenance
diff --git a/README.md b/README.md
index 2dc92f8a..421c5aea 100644
--- a/README.md
+++ b/README.md
@@ -37,13 +37,40 @@ craft-<name> = { git = "https://github.com/storytold/craft-libs", rev = "<commit
 - [`craft-docpath`](crates/docpath/src/lib.rs): decides whether a path or `file:` URL stored in a
   document may be opened. Paths stored in documents are followed only when they are local or on the
   document's own network share; other network paths, device paths and non-file URLs are refused.
+- [`craft-font-catalog`](crates/font-catalog/README.md): the installed fonts on every platform
+  (font folders, fontconfig and Flatpak host folders, CoreText, DirectWrite, the font store),
+  lookup by family, style, localized, legacy, full and PostScript names, family loads shared
+  between threads, and rescans when fonts are installed or removed.
+- [`craft-font-manager`](crates/font-manager/README.md): Craft Font Manager as a library: search
+  and filters over the Google Fonts index, installed fonts by family, the font store interface,
+  and (`egui` feature) `FontsPanel`, the whole interface as one panel for the launcher's Fonts tab
+  and the standalone app.
+- [`craft-font-store`](crates/font-store/README.md): the suite's font store: the pinned Google
+  Fonts and Noto indexes plus indexes the user adds (never curated), exact lookup by family and
+  style or PostScript name, and installs from each source's URLs (jsDelivr, then raw GitHub)
+  checked by size, sha256 and parsing, with the licence, a manifest, and removal. Off until the
+  user turns downloading on; agents can't.
+- [`craft-fonts-build`](crates/fonts-build/README.md): embeds the optional craft-fonts faces
+  from an app's `build.rs` (`CRAFT_FONTS_DIR`, `CRAFT_FONTS_REQUIRED`, script filters) as a table
+  of `EmbeddedFace`s. No dependencies; the app picks the faces.
 - [`craft-i18n`](crates/i18n/README.md): translations over the embedded craft-i18n catalogs:
   lookup with fallback (`pt-br` → `pt` → English), plurals, language names, the system locale and
   a pseudo locale. The catalogs stay a fully optional build input; apps keep `tl!` and their
   language setting.
+- [`craft-jpeg`](crates/jpeg/README.md): clean-room decoder for 12-bit and arithmetic-coded
+  JPEG (T.81 SOF0/SOF1 at 12 bits, SOF9, SOF10), from PhotoCraft, and a frame probe for routing.
+  Metadata stays in each app.
+- [`craft-keymap`](crates/keymap/README.md): keyboard bindings: chords and their text forms,
+  scopes, conflicts, user overrides stored through craft-settings and import of other
+  applications' shortcut sets. Command catalogs, file readers and the shortcut editor UI stay
+  in each app.
 - [`craft-media`](crates/media/README.md): bit-level I/O (`bitstream`), clean-room MP4/MOV
   (`isobmff`) and Matroska/WebM (`matroska`) demuxers and muxers, from FilmCraft, and an ISO BMFF
   box reader. Containers only; codecs stay in each app.
+- [`craft-menu`](crates/menu/README.md): an app's menus as a macOS menu bar: the Mac layout
+  (app menu, Window, Help, system-key clashes), a platform backend trait, and key equivalents
+  fed back to egui as the input egui-winit would have made. Commands and their enabled state
+  stay in each app.
 - [`craft-print`](crates/print/README.md): PDF submission to CUPS and Windows, printer discovery,
   duplex/copies/colour and driver preferences. PDF generation stays in each app.
 
@@ -51,6 +78,9 @@ craft-<name> = { git = "https://github.com/storytold/craft-libs", rev = "<commit
   app menu. Unsaved-document decisions and save prompts stay in each app.
 
 - [`craft-settings`](crates/settings/README.md): `config.toml` settings storage for every app: platform folders, portable mode and overrides, atomic saves while running, backup, damaged-file recovery and schema migrations. Policy in [docs/settings-storage.md](docs/settings-storage.md).
+- [`craft-text`](crates/text/README.md): text processing below the composer. Its `hyphen` module finds
+  hyphenation points, with a bundled US English dictionary and patterns and optional hypher patterns
+  for 47 more languages (one cargo feature each).
 - [`craft-ui`](crates/ui/README.md): SVG catalogs, icon buttons, tabs, pane controls, transactional docking, print settings and theme helpers for egui frontends;
   assets, themes, localization and command handling stay in each app. Requires Rust 1.95 or later.
 - [Shared UI component audit](docs/ui-components-audit.md): source inventory, extraction priorities
diff --git a/clippy.toml b/clippy.toml
index 4b6c79f5..ea4e52e5 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -2,3 +2,4 @@ allow-unwrap-in-tests = true
 allow-expect-in-tests = true
 allow-panic-in-tests = true
 allow-indexing-slicing-in-tests = true
+cognitive-complexity-threshold = 30
diff --git a/crates/font-catalog/Cargo.toml b/crates/font-catalog/Cargo.toml
new file mode 100644
index 00000000..a95e1c28
--- /dev/null
+++ b/crates/font-catalog/Cargo.toml
@@ -0,0 +1,31 @@
+[package]
+name = "craft-font-catalog"
+description = "Installed fonts for the Craft apps: discovery on every platform, family, style and PostScript lookup, and loading shared between threads."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+
+[features]
+default = ["system"]
+# The platform's font service through fontique: CoreText on macOS, DirectWrite on Windows,
+# fontconfig on Linux and FreeBSD. The same version and features craft-ui's system fonts use, so
+# the apps build fontique once.
+system = ["dep:fontique"]
+
+[dependencies]
+skrifa = { version = "0.47", default-features = false, features = ["std"] }
+thiserror = { workspace = true }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+fontique = { version = "0.11.1", default-features = false, features = ["system", "fontconfig-dlopen"], optional = true }
+
+[target.'cfg(windows)'.dependencies]
+windows-registry = "0.6"
+
+[dev-dependencies]
+write-fonts = "0.54"
+
+[lints]
+workspace = true
diff --git a/crates/font-catalog/README.md b/crates/font-catalog/README.md
new file mode 100644
index 00000000..c0576767
--- /dev/null
+++ b/crates/font-catalog/README.md
@@ -0,0 +1,83 @@
+# craft-font-catalog
+
+The installed fonts for the Craft apps: discovery on every platform, lookup by family and style or by any other name, and loading shared between threads.
+
+## What it finds
+
+A `Catalog` reads, in this order:
+
+| Where | Source | Platforms |
+|---|---|---|
+| The platform's font folders (`font_dirs`) | `System` | all |
+| The suite's font store (`font_store_dir`) | `Store` | all |
+| The app's own folders (`Catalog::set_app_dirs`, for example `office_font_dirs`) | `App` | all |
+| Files the platform's font service knows (`system` feature, through fontique) | `System` | macOS, Windows, Linux, FreeBSD |
+| The registry's font list | `System` | Windows |
+| Files from injected listers (`Catalog::with_lister`) | `System` | all |
+
+The font folders:
+
+- macOS: `/System/Library/Fonts`, `/Library/Fonts`, `/Network/Library/Fonts`, `~/Library/Fonts`, `/System/Library/Assets` and the font assets macOS downloads on demand (`AssetsV2/com_apple_MobileAsset_Font*`).
+- Windows: `%WINDIR%\Fonts` and `%LOCALAPPDATA%\Microsoft\Windows\Fonts`.
+- Linux and the BSDs: `/usr/share/fonts`, `/usr/local/share/fonts`, the Flatpak host folders (`/run/host/fonts`, `/run/host/local-fonts`, `/run/host/user-fonts`), `~/.local/share/fonts`, `~/.fonts`, `$XDG_DATA_HOME/fonts`, `$XDG_DATA_DIRS/*/fonts`, and the `<dir>` and `<remap-dir>` entries of the fontconfig configuration with its includes and the user's own. Inside a Flatpak sandbox, also the host's folders from `/run/host/font-dirs.xml` and from the host's configuration under `/run/host/etc/fonts`.
+- Haiku: the system's and the user's `data/fonts` folders.
+
+The font service covers fonts outside those folders:
+
+- macOS: CoreText's available fonts, which include fonts that Adobe Fonts, RightFont and other font managers activate from their own folders.
+- Windows: DirectWrite's system font collection, which includes per-user fonts and the fonts that font services such as Adobe Fonts load at run time. The registry adds fonts that programs register by full path.
+- Linux and FreeBSD: fontconfig, loaded at run time (`fontconfig-dlopen`), so a system without it still runs.
+
+`FontEnv` holds the environment all of this depends on (`HOME`, the XDG variables, `FONTCONFIG_FILE`, `WINDIR`, `LOCALAPPDATA`, `CRAFT_FONT_STORE`, a file system root), so tests can describe any system without touching the process environment.
+
+## The font store
+
+`font_store_dir` is the one per-user folder that the suite's font store installs fonts into and every app's catalog reads. No other program reads it.
+
+| Platform | Folder |
+|---|---|
+| macOS | `~/Library/Application Support/Craft Fonts` |
+| Windows | `%LOCALAPPDATA%\Craft Fonts` |
+| Linux, BSDs, Haiku | `$XDG_DATA_HOME/craft-fonts` (`~/.local/share/craft-fonts`) |
+
+`CRAFT_FONT_STORE` replaces it, for portable installs and tests.
+
+## Scanning
+
+The scan reads each file's table directory and its `name`, `OS/2` and `fvar` tables, at most 1 MiB per table, never the whole file. Faces without outline tables (`glyf`, `CFF `, `CFF2`, `VARC`) are left out. Files in folders count when they have a font extension (`.ttf`, `.otf`, `.ttc`, `.otc`); files a font service or lister names count whatever their name. Mac suitcase fonts are read from their resource fork. Damaged files give no faces, never a panic.
+
+Each face (`FaceInfo`) has its family and style, legacy family and style, family names in other languages, full name, PostScript name, weight, width, italic, a named instance's axis settings, `fsType`, the OS/2 code page bits, its file and index, and its source. Each named instance of a variable font is a face of its own.
+
+## Lookup
+
+- `families()` and `styles(family)`.
+- `family(name)` and `resolve(name, style)` accept any name of a family: its own name ignoring ASCII case, its names in other languages and its legacy names ignoring case and anything but letters and digits. `resolve` also accepts a legacy family with its legacy style (`Roboto Light` / `Regular`), a full name, and a PostScript name.
+- Within a family, `resolve` matches the style by name (any of its names). Otherwise it picks the nearest weight, with italic differing counting as 1000, then the nearest width. It returns `Match::Exact` or `Match::NearestStyle`, so the app decides about substitutes.
+- `by_postscript_name(name)`.
+
+## Loading and threads
+
+- The first scan runs on first use, or on a background thread after `scan_in_background`. Lookups wait for it.
+- Lookups read an immutable snapshot, so a rescan never blocks them.
+- `load_family` reads a family's files once. Other threads asking for the same family wait and share the result; other families load at the same time. Faces of one file share its bytes (`Arc<[u8]>`).
+- `add_bytes` and `add_file` add fonts from documents, downloads or the app's bundle, within `Limits`. Added faces win over installed faces of the same family and style. `remove_added` removes a source's faces, for example when a document closes.
+
+## Changes
+
+- `rescan` scans again, reading only new and changed files.
+- `installed_fonts_changed` compares the modification times of every folder the scan read (and the folders of files a font service named) and, on Windows, the registry's font list. It costs a few hundred `stat` calls, not a scan.
+- `rescan_if_changed` does both; apps call it when their window is activated.
+- `watch(interval, on_change)` polls on a background thread.
+- `generation` counts the catalog's changes.
+
+## One enumeration for the UI and documents
+
+With the `system` feature, `system::collection()` returns the process's fontique `Collection`: the system's fonts and the font store's. The catalog lists its files, and craft-ui's font fallback can query the same collection instead of building its own, so the system's fonts are enumerated once per process. A rescan builds a new collection; `system::generation()` tells holders of an older clone to take a new one.
+
+## Try it
+
+```sh
+cargo run -p craft-font-catalog --example fonts             # counts, folders, faces outside them
+cargo run -p craft-font-catalog --example fonts -- Arial     # a family's faces
+cargo run -p craft-font-catalog --example fonts -- --watch   # report fonts installed or removed
+```
diff --git a/crates/font-catalog/examples/fonts.rs b/crates/font-catalog/examples/fonts.rs
new file mode 100644
index 00000000..772ad515
--- /dev/null
+++ b/crates/font-catalog/examples/fonts.rs
@@ -0,0 +1,51 @@
+//! Lists what the catalog finds on this computer, to check discovery by hand.
+//!
+//! ```text
+//! cargo run -p craft-font-catalog --example fonts             # counts, folders, font store
+//! cargo run -p craft-font-catalog --example fonts -- Arial     # a family's faces
+//! cargo run -p craft-font-catalog --example fonts -- --watch   # report fonts installed or removed
+//! ```
+
+use std::time::{Duration, Instant};
+
+use craft_font_catalog::{Catalog, font_dirs, font_store_dir};
+
+fn main() {
+    let catalog = Catalog::global();
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let start = Instant::now();
+    let families = catalog.families();
+    let faces = catalog.faces();
+    println!("{} families, {} faces, first scan {:?}", families.len(), faces.len(), start.elapsed());
+    println!("font store: {:?}", font_store_dir(catalog.env()));
+    for dir in font_dirs(catalog.env()).iter().filter(|d| d.is_dir()) {
+        println!("folder: {}", dir.display());
+    }
+    let outside: Vec<_> =
+        faces.iter().filter(|f| f.path.as_ref().is_some_and(|p| !font_dirs(catalog.env()).iter().any(|d| p.starts_with(d)))).collect();
+    println!("{} faces outside the font folders (font service, store, registry):", outside.len());
+    for f in outside.iter().take(40) {
+        println!("  {} {} ({:?}) {}", f.family, f.style, f.source, f.path.as_deref().map(|p| p.display().to_string()).unwrap_or_default());
+    }
+    match args.first().map(String::as_str) {
+        Some("--watch") => {
+            let _watch = catalog.watch(Duration::from_secs(2), |c| println!("changed: {} families", c.families().len()));
+            println!("watching; install or remove a font, Ctrl+C to stop");
+            loop {
+                std::thread::sleep(Duration::from_secs(3600));
+            }
+        }
+        Some(name) => {
+            for f in catalog.styles(name) {
+                println!(
+                    "{} / {}: weight {} width {} italic {} ps {:?} {:?} #{} {:?}",
+                    f.family, f.style, f.weight, f.width, f.italic, f.postscript_name, f.path, f.index, f.source
+                );
+            }
+            if let Some((f, m)) = catalog.resolve(name, args.get(1).map_or("Regular", String::as_str)) {
+                println!("resolve: {} {} ({m:?})", f.family, f.style);
+            }
+        }
+        None => {}
+    }
+}
diff --git a/crates/font-catalog/src/catalog.rs b/crates/font-catalog/src/catalog.rs
new file mode 100644
index 00000000..c20753fb
--- /dev/null
+++ b/crates/font-catalog/src/catalog.rs
@@ -0,0 +1,778 @@
+//! The catalog: every installed face, found by any of its names, loaded once.
+
+use std::collections::{HashMap, HashSet};
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+use std::sync::{Arc, Mutex, MutexGuard, OnceLock, PoisonError, RwLock, Weak};
+use std::time::{Duration, SystemTime};
+
+use crate::scan::{self, Face, FaceInfo, Source, norm, style_italic, style_weight, style_width};
+use crate::{FontEnv, Os, font_dirs, font_store_dir};
+
+/// Lists font files that the platform's font service knows outside the font folders. Called by
+/// every scan.
+pub type Lister = Arc<dyn Fn() -> Vec<PathBuf> + Send + Sync>;
+
+/// How deep the scan goes below a font folder.
+const MAX_DEPTH: usize = 12;
+/// The most folder entries one scan looks at.
+const MAX_ENTRIES: usize = 200_000;
+/// The most bytes the scan reads from one file (its tables, or a suitcase's resource fork).
+const MAX_SCAN_READ: u64 = 256 << 20;
+/// The largest font file loaded.
+const MAX_LOAD: u64 = 512 << 20;
+
+/// Why a font file or font data wasn't added or loaded.
+#[derive(Debug, thiserror::Error)]
+pub enum FontFileError {
+    /// Reading the file failed.
+    #[error("the font file can't be read: {0}")]
+    Io(#[from] std::io::Error),
+    /// The file is larger than the limit.
+    #[error("the font file is {size} bytes, more than the {max} allowed")]
+    TooLarge {
+        /// The file's size.
+        size: u64,
+        /// The limit.
+        max: u64,
+    },
+    /// No face in it could be read.
+    #[error("not a font file, or a damaged one")]
+    NotAFont,
+    /// Adding it would pass the limit on added faces.
+    #[error("more than {max} added font faces")]
+    TooManyFaces {
+        /// The limit.
+        max: usize,
+    },
+    /// The face is no longer in the catalog (its data was removed).
+    #[error("the font is no longer available")]
+    Gone,
+}
+
+/// Limits on fonts added from files or bytes ([`Catalog::add_bytes`], [`Catalog::add_file`]),
+/// which may come from documents or downloads.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Limits {
+    /// The largest file accepted.
+    pub max_file_bytes: u64,
+    /// The most faces read from one file (a collection).
+    pub max_faces_per_file: u32,
+    /// The most added faces the catalog holds in all.
+    pub max_added_faces: usize,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Self { max_file_bytes: 256 << 20, max_faces_per_file: 256, max_added_faces: 1000 }
+    }
+}
+
+/// How [`Catalog::resolve`] matched.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Match {
+    /// The family and style asked for, by any of their names.
+    Exact,
+    /// The family, in the style nearest to the one asked for.
+    NearestStyle,
+}
+
+/// A face's data: the whole file (or a suitcase font's resource) and the face's index in it.
+#[derive(Clone, Debug)]
+pub struct FontData {
+    /// The file's bytes, shared by every face loaded from it.
+    pub bytes: Arc<[u8]>,
+    /// The index to pass to a font parser.
+    pub index: u32,
+}
+
+/// A loaded face ([`Catalog::load_family`]).
+#[derive(Clone, Debug)]
+pub struct LoadedFace {
+    /// The face.
+    pub info: FaceInfo,
+    /// Its data.
+    pub data: FontData,
+}
+
+/// A face the scan can't find again, as an alias records it.
+#[derive(Clone, Debug)]
+enum Alias {
+    /// The family of this face.
+    Family(usize),
+    /// A legacy family name: this face, under this legacy style.
+    Legacy(usize, String),
+    /// A full or PostScript name: this face.
+    Face(usize),
+}
+
+/// One state of the catalog: what lookups read while a scan builds the next one.
+#[derive(Default)]
+struct Index {
+    faces: Vec<Face>,
+    infos: Arc<[FaceInfo]>,
+    families: Arc<[String]>,
+    by_family: HashMap<String, Vec<usize>>,
+    aliases: HashMap<String, Vec<Alias>>,
+    postscript: HashMap<String, usize>,
+}
+
+impl Index {
+    /// Added faces first: a document's or the app's own face wins over an installed face of the
+    /// same family and style.
+    fn build(added: &[Face], scanned: &[Face]) -> Self {
+        let mut faces: Vec<Face> = Vec::new();
+        let mut seen = HashSet::new();
+        for f in added.iter().chain(scanned) {
+            let variations: Vec<(u32, u32)> = f.info.variations.iter().map(|(t, v)| (u32::from_be_bytes(*t), v.to_bits())).collect();
+            let key = (f.info.family.to_ascii_lowercase(), norm(&f.info.style), f.keys.postscript.first().cloned(), variations);
+            if seen.insert(key) {
+                faces.push(f.clone());
+            }
+        }
+        let mut by_family: HashMap<String, Vec<usize>> = HashMap::new();
+        let mut aliases: HashMap<String, Vec<Alias>> = HashMap::new();
+        let mut postscript: HashMap<String, usize> = HashMap::new();
+        let mut families: Vec<String> = Vec::new();
+        for (i, f) in faces.iter().enumerate() {
+            let entry = by_family.entry(f.info.family.to_ascii_lowercase()).or_default();
+            if entry.is_empty() {
+                families.push(f.info.family.clone());
+            }
+            entry.push(i);
+            for k in &f.keys.families {
+                let list = aliases.entry(k.clone()).or_default();
+                if !list
+                    .iter()
+                    .any(|a| matches!(a, Alias::Family(j) if faces.get(*j).is_some_and(|g| g.info.family.eq_ignore_ascii_case(&f.info.family))))
+                {
+                    list.push(Alias::Family(i));
+                }
+            }
+            for (family, style) in &f.keys.legacy {
+                aliases.entry(family.clone()).or_default().push(Alias::Legacy(i, style.clone()));
+            }
+            for k in f.keys.full_names.iter().chain(&f.keys.postscript) {
+                aliases.entry(k.clone()).or_default().push(Alias::Face(i));
+            }
+            for k in &f.keys.postscript {
+                postscript.entry(k.clone()).or_insert(i);
+            }
+        }
+        // Narrow to wide, light to heavy, upright first. The sort is stable, so of two faces alike
+        // the added one stays first and wins a tie in `pick_style`.
+        for list in by_family.values_mut() {
+            list.sort_by(|a, b| {
+                let (Some(a), Some(b)) = (faces.get(*a), faces.get(*b)) else { return std::cmp::Ordering::Equal };
+                (a.info.width.total_cmp(&b.info.width)).then(a.info.weight.total_cmp(&b.info.weight)).then(a.info.italic.cmp(&b.info.italic))
+            });
+        }
+        families.sort_by_cached_key(|f| (f.to_lowercase(), f.clone()));
+        let infos: Arc<[FaceInfo]> = faces.iter().map(|f| f.info.clone()).collect();
+        Self { faces, infos, families: families.into(), by_family, aliases, postscript }
+    }
+
+    fn face(&self, i: usize) -> Option<&Face> {
+        self.faces.get(i)
+    }
+
+    /// The family `name` names: a family name ignoring ASCII case, else any family name of a face
+    /// (another language, legacy) ignoring case and everything but letters and digits.
+    fn family_of(&self, name: &str) -> Option<&[usize]> {
+        if let Some(faces) = self.by_family.get(&name.to_ascii_lowercase()) {
+            return Some(faces);
+        }
+        let aliases = self.aliases.get(&norm(name))?;
+        let i = aliases.iter().find_map(|a| match a {
+            Alias::Family(i) => Some(*i),
+            _ => None,
+        })?;
+        self.by_family.get(&self.face(i)?.info.family.to_ascii_lowercase()).map(Vec::as_slice)
+    }
+
+    fn resolve(&self, name: &str, style: &str) -> Option<(usize, Match)> {
+        if let Some(faces) = self.family_of(name) {
+            return self.pick_style(faces, style);
+        }
+        let aliases = self.aliases.get(&norm(name))?;
+        let legacy: Vec<(usize, &str)> = aliases
+            .iter()
+            .filter_map(|a| match a {
+                Alias::Legacy(i, s) => Some((*i, s.as_str())),
+                _ => None,
+            })
+            .collect();
+        if !legacy.is_empty() {
+            let ns = style_key(style);
+            if let Some((i, _)) = legacy.iter().find(|(_, s)| *s == ns) {
+                return Some((*i, Match::Exact));
+            }
+            let faces: Vec<usize> = legacy.iter().map(|(i, _)| *i).collect();
+            return self.pick_style(&faces, style).map(|(i, _)| (i, Match::NearestStyle));
+        }
+        aliases.iter().find_map(|a| match a {
+            Alias::Face(i) => Some((*i, Match::Exact)),
+            _ => None,
+        })
+    }
+
+    /// The face of `faces` (one family) in `style`: by its style name, then by any other name of
+    /// its style, else the nearest weight with italic differing costing 1000, then the nearest
+    /// width; the first face wins a tie.
+    fn pick_style(&self, faces: &[usize], style: &str) -> Option<(usize, Match)> {
+        let ns = style_key(style);
+        let cands: Vec<(usize, &Face)> = faces.iter().filter_map(|i| Some((*i, self.face(*i)?))).collect();
+        if let Some((i, _)) = cands.iter().find(|(_, f)| norm(&f.info.style) == ns) {
+            return Some((*i, Match::Exact));
+        }
+        if let Some((i, _)) = cands.iter().find(|(_, f)| f.keys.styles.contains(&ns)) {
+            return Some((*i, Match::Exact));
+        }
+        let (tw, ti, twd) = (style_weight(style), style_italic(style), style_width(style));
+        let score = |f: &Face| ((f.info.weight - tw).abs() + if f.info.italic != ti { 1000.0 } else { 0.0 }, (f.info.width - twd).abs());
+        cands
+            .iter()
+            .min_by(|(_, a), (_, b)| {
+                let (sa, sb) = (score(a), score(b));
+                sa.0.total_cmp(&sb.0).then(sa.1.total_cmp(&sb.1))
+            })
+            .map(|(i, _)| (*i, Match::NearestStyle))
+    }
+}
+
+/// A style name as compared: normalized, with no style meaning `Regular`.
+fn style_key(style: &str) -> String {
+    let ns = norm(style);
+    if ns.is_empty() { "regular".into() } else { ns }
+}
+
+/// What the catalog reads besides the platform's font folders.
+struct Config {
+    app_dirs: Vec<PathBuf>,
+    listers: Vec<Lister>,
+    font_service: bool,
+}
+
+/// A file found by a scan, remembered so a rescan reads only files that changed.
+struct Cached {
+    len: u64,
+    modified: Option<SystemTime>,
+    faces: Vec<Face>,
+}
+
+#[derive(Default)]
+struct ScanState {
+    files: HashMap<PathBuf, Cached>,
+}
+
+/// What a change check compares with.
+#[derive(Default)]
+struct Stamp {
+    app_dirs: Vec<PathBuf>,
+    /// Every folder the scan listed, and the folders holding the files listers named, with their
+    /// modification times (`None`: missing).
+    dirs: Vec<(PathBuf, Option<SystemTime>)>,
+    /// The fonts registered with Windows.
+    registered: Vec<PathBuf>,
+}
+
+#[derive(Default)]
+struct Added {
+    faces: Vec<Face>,
+    blobs: HashMap<u64, Arc<[u8]>>,
+    next_blob: u64,
+}
+
+/// A family's faces, loaded once ([`Catalog::load_family`]).
+type FamilyLoad = Arc<OnceLock<Arc<[LoadedFace]>>>;
+
+/// The installed fonts: the platform's font folders, the files its font service knows, the font
+/// store and the app's own folders, plus faces added from files or bytes.
+///
+/// The first scan runs on first use or on a background thread ([`Catalog::scan_in_background`]);
+/// lookups wait for it. Lookups read an immutable snapshot, so they never wait for a rescan.
+/// Each family's files load once ([`Catalog::load_family`]): other threads asking for the same
+/// family wait for that load, other families load at the same time.
+pub struct Catalog {
+    env: FontEnv,
+    config: RwLock<Config>,
+    index: RwLock<Arc<Index>>,
+    ready: OnceLock<()>,
+    scan: Mutex<ScanState>,
+    stamp: Mutex<Stamp>,
+    generation: AtomicU64,
+    added: Mutex<Added>,
+    loaded: Mutex<HashMap<String, FamilyLoad>>,
+    files: Mutex<HashMap<PathBuf, Weak<[u8]>>>,
+}
+
+fn lock<T>(m: &Mutex<T>) -> MutexGuard<'_, T> {
+    m.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+fn modified(path: &Path) -> Option<SystemTime> {
+    std::fs::metadata(path).and_then(|m| m.modified()).ok()
+}
+
+impl Catalog {
+    /// A catalog of the fonts installed on the system `env` describes, the font store, and the
+    /// files the platform's font service lists (with the `system` feature).
+    pub fn new(env: FontEnv) -> Self {
+        Self {
+            env,
+            config: RwLock::new(Config { app_dirs: Vec::new(), listers: Vec::new(), font_service: cfg!(feature = "system") }),
+            index: RwLock::new(Arc::new(Index::default())),
+            ready: OnceLock::new(),
+            scan: Mutex::new(ScanState::default()),
+            stamp: Mutex::new(Stamp::default()),
+            generation: AtomicU64::new(0),
+            added: Mutex::new(Added::default()),
+            loaded: Mutex::new(HashMap::new()),
+            files: Mutex::new(HashMap::new()),
+        }
+    }
+
+    /// The process's catalog, for [`FontEnv::from_process`].
+    pub fn global() -> &'static Arc<Catalog> {
+        static GLOBAL: OnceLock<Arc<Catalog>> = OnceLock::new();
+        GLOBAL.get_or_init(|| Arc::new(Catalog::new(FontEnv::from_process())))
+    }
+
+    /// Whether scans ask the platform's font service (CoreText, DirectWrite, fontconfig) for the
+    /// font files it knows: on by default with the `system` feature, which provides it.
+    #[must_use]
+    pub fn with_font_service(self, on: bool) -> Self {
+        self.write_config().font_service = on && cfg!(feature = "system");
+        self
+    }
+
+    /// Have every scan also read the files `lister` names (any file name; a folder is read with
+    /// its subfolders), as fonts of the system.
+    #[must_use]
+    pub fn with_lister(self, lister: Lister) -> Self {
+        self.write_config().listers.push(lister);
+        self
+    }
+
+    /// The app's own font folders (its Fonts folder, Office's, folders the user picked), read
+    /// with their subfolders from the next scan on. A change shows in
+    /// [`Catalog::installed_fonts_changed`].
+    pub fn set_app_dirs(&self, dirs: Vec<PathBuf>) {
+        self.write_config().app_dirs = dirs;
+    }
+
+    fn write_config(&self) -> std::sync::RwLockWriteGuard<'_, Config> {
+        self.config.write().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    fn read_config(&self) -> std::sync::RwLockReadGuard<'_, Config> {
+        self.config.read().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    /// The environment the catalog was made for.
+    pub fn env(&self) -> &FontEnv {
+        &self.env
+    }
+
+    /// Start the first scan on a background thread, so the first lookup doesn't wait for all of
+    /// it. Does nothing once it has run, or when no thread can be started (the first lookup
+    /// then scans).
+    pub fn scan_in_background(self: &Arc<Self>) {
+        if self.ready.get().is_none() {
+            let me = Arc::clone(self);
+            let _ = std::thread::Builder::new().name("font-catalog-scan".into()).spawn(move || me.ensure());
+        }
+    }
+
+    fn ensure(&self) {
+        self.ready.get_or_init(|| {
+            self.scan_now(false);
+        });
+    }
+
+    /// Whether the first scan has finished: lookups won't wait.
+    pub fn is_ready(&self) -> bool {
+        self.ready.get().is_some()
+    }
+
+    /// Scan again, for fonts installed or removed since; only new and changed files are read.
+    /// Families loaded before load again on their next [`Catalog::load_family`]. Returns the
+    /// number of faces cataloged.
+    pub fn rescan(&self) -> usize {
+        let mut first = false;
+        self.ready.get_or_init(|| {
+            first = true;
+            self.scan_now(false);
+        });
+        if !first {
+            self.scan_now(true);
+        }
+        self.snapshot().faces.len()
+    }
+
+    /// [`Catalog::rescan`] when [`Catalog::installed_fonts_changed`] says so, for an app to call
+    /// when its window is activated. Returns whether it rescanned.
+    pub fn rescan_if_changed(&self) -> bool {
+        let changed = self.installed_fonts_changed();
+        if changed {
+            self.rescan();
+        }
+        changed
+    }
+
+    /// Whether fonts were installed or removed since the last scan: a folder the scan read (or
+    /// the folder of a file the font service named) changed, a missing one appeared, the app's
+    /// folders changed, or on Windows the registry's font list changed. It looks at folders,
+    /// not files, so it costs far less than a scan. `false` before the first scan.
+    ///
+    /// Fonts a font service registers from a folder no scan has seen are found by the next
+    /// [`Catalog::rescan`] only.
+    pub fn installed_fonts_changed(&self) -> bool {
+        if !self.is_ready() {
+            return false;
+        }
+        let stamp = lock(&self.stamp);
+        if stamp.app_dirs != self.read_config().app_dirs {
+            return true;
+        }
+        if stamp.dirs.iter().any(|(p, t)| modified(p) != *t) {
+            return true;
+        }
+        self.read_config().font_service && self.env.os == Os::Windows && stamp.registered != crate::registry::registered_font_files()
+    }
+
+    /// Poll for installed and removed fonts every `interval` on a background thread: when
+    /// [`Catalog::installed_fonts_changed`], rescan and call `on_change`. Stops when the returned
+    /// [`Watch`] or the catalog is dropped.
+    pub fn watch(self: &Arc<Self>, interval: Duration, on_change: impl Fn(&Catalog) + Send + 'static) -> Watch {
+        let stop = Arc::new(AtomicBool::new(false));
+        let (me, flag) = (Arc::downgrade(self), Arc::clone(&stop));
+        let _ = std::thread::Builder::new().name("font-catalog-watch".into()).spawn(move || {
+            loop {
+                std::thread::sleep(interval);
+                if flag.load(Ordering::Relaxed) {
+                    return;
+                }
+                let Some(catalog) = me.upgrade() else { return };
+                if catalog.rescan_if_changed() {
+                    on_change(&catalog);
+                }
+            }
+        });
+        Watch { stop }
+    }
+
+    /// Counts the catalog's changes: each scan, and each face added or removed.
+    pub fn generation(&self) -> u64 {
+        self.generation.load(Ordering::Acquire)
+    }
+
+    fn snapshot(&self) -> Arc<Index> {
+        self.ensure();
+        Arc::clone(&self.index.read().unwrap_or_else(PoisonError::into_inner))
+    }
+
+    fn publish(&self, index: Index) {
+        *self.index.write().unwrap_or_else(PoisonError::into_inner) = Arc::new(index);
+        lock(&self.loaded).clear();
+        self.generation.fetch_add(1, Ordering::AcqRel);
+    }
+
+    /// The family names, sorted ignoring case.
+    pub fn families(&self) -> Arc<[String]> {
+        Arc::clone(&self.snapshot().families)
+    }
+
+    /// Every face, added faces first.
+    pub fn faces(&self) -> Arc<[FaceInfo]> {
+        Arc::clone(&self.snapshot().infos)
+    }
+
+    /// The family `name` names: its own name ignoring ASCII case, or any other of its names
+    /// (another language, a legacy name) ignoring case and everything but letters and digits.
+    pub fn family(&self, name: &str) -> Option<String> {
+        let index = self.snapshot();
+        let i = *index.family_of(name)?.first()?;
+        index.face(i).map(|f| f.info.family.clone())
+    }
+
+    /// The faces of the family `name` names ([`Catalog::family`]).
+    pub fn styles(&self, family: &str) -> Vec<FaceInfo> {
+        let index = self.snapshot();
+        index.family_of(family).unwrap_or_default().iter().filter_map(|i| index.face(*i)).map(|f| f.info.clone()).collect()
+    }
+
+    /// The face for `name` in `style`, and how it matched. `name` is a family name (any of its
+    /// names, as [`Catalog::family`]), a legacy family name (`Roboto Light`, matched with its
+    /// legacy style), a full name or a PostScript name (which name one face; `style` is then
+    /// ignored). Within the family, `style` matches by name; otherwise the nearest weight wins,
+    /// italic differing counting as 1000, then the nearest width. An empty style is `Regular`.
+    /// `None` when nothing has that name.
+    pub fn resolve(&self, name: &str, style: &str) -> Option<(FaceInfo, Match)> {
+        let index = self.snapshot();
+        let (i, matched) = index.resolve(name, style)?;
+        Some((index.face(i)?.info.clone(), matched))
+    }
+
+    /// The face with this PostScript name (a named instance's too), ignoring case and everything
+    /// but letters and digits.
+    pub fn by_postscript_name(&self, name: &str) -> Option<FaceInfo> {
+        let index = self.snapshot();
+        let i = *index.postscript.get(&norm(name))?;
+        index.face(i).map(|f| f.info.clone())
+    }
+
+    /// The data of `face`, read from its file (shared with other faces of the file still loaded).
+    pub fn load(&self, face: &FaceInfo) -> Result<FontData, FontFileError> {
+        if let Some(blob) = face.blob {
+            let bytes = lock(&self.added).blobs.get(&blob).cloned().ok_or(FontFileError::Gone)?;
+            return Ok(FontData { bytes, index: face.index });
+        }
+        let path = face.path.as_deref().ok_or(FontFileError::Gone)?;
+        if crate::suitcase::is_suitcase(path) {
+            let font = crate::suitcase::read_fonts(path).into_iter().nth(face.index as usize).ok_or(FontFileError::NotAFont)?;
+            return Ok(FontData { bytes: font.into(), index: 0 });
+        }
+        Ok(FontData { bytes: self.file_bytes(path)?, index: face.index })
+    }
+
+    fn file_bytes(&self, path: &Path) -> Result<Arc<[u8]>, FontFileError> {
+        if let Some(bytes) = lock(&self.files).get(path).and_then(Weak::upgrade) {
+            return Ok(bytes);
+        }
+        let size = std::fs::metadata(path)?.len();
+        if size > MAX_LOAD {
+            return Err(FontFileError::TooLarge { size, max: MAX_LOAD });
+        }
+        let bytes: Arc<[u8]> = std::fs::read(path)?.into();
+        let mut files = lock(&self.files);
+        files.retain(|_, w| w.strong_count() > 0);
+        files.insert(path.to_path_buf(), Arc::downgrade(&bytes));
+        Ok(bytes)
+    }
+
+    /// Every face of the family `family` names ([`Catalog::family`]) with its data. The first
+    /// call reads the family's files; calls for the same family on other threads wait for it and
+    /// share the result, while other families load at the same time. Faces whose files can't be
+    /// read are left out. After a rescan, the next call reads the files again.
+    pub fn load_family(&self, family: &str) -> Arc<[LoadedFace]> {
+        let Some(name) = self.family(family) else { return Arc::from([]) };
+        let cell = Arc::clone(lock(&self.loaded).entry(name.to_ascii_lowercase()).or_default());
+        Arc::clone(
+            cell.get_or_init(|| self.styles(&name).into_iter().filter_map(|info| Some(LoadedFace { data: self.load(&info).ok()?, info })).collect()),
+        )
+    }
+
+    /// Add the faces of a font file's `bytes` (a font or a collection) for this session, as
+    /// `source`. Returns the faces added.
+    pub fn add_bytes(&self, bytes: Vec<u8>, source: Source, limits: &Limits) -> Result<Vec<FaceInfo>, FontFileError> {
+        let size = bytes.len() as u64;
+        if size > limits.max_file_bytes {
+            return Err(FontFileError::TooLarge { size, max: limits.max_file_bytes });
+        }
+        let mut faces = scan::data_faces(&bytes, limits.max_faces_per_file, None, source);
+        if faces.is_empty() {
+            return Err(FontFileError::NotAFont);
+        }
+        self.ensure();
+        let mut added = lock(&self.added);
+        if added.faces.len() + faces.len() > limits.max_added_faces {
+            return Err(FontFileError::TooManyFaces { max: limits.max_added_faces });
+        }
+        let blob = added.next_blob;
+        added.next_blob += 1;
+        added.blobs.insert(blob, bytes.into());
+        for f in &mut faces {
+            f.info.blob = Some(blob);
+        }
+        Ok(self.push_added(added, faces))
+    }
+
+    /// Add the faces of the font file at `path` for this session, as `source`, read in place.
+    /// Returns the faces added.
+    pub fn add_file(&self, path: &Path, source: Source, limits: &Limits) -> Result<Vec<FaceInfo>, FontFileError> {
+        let size = std::fs::metadata(path)?.len();
+        if size > limits.max_file_bytes {
+            return Err(FontFileError::TooLarge { size, max: limits.max_file_bytes });
+        }
+        let mut faces = scan::file_faces(path, limits.max_file_bytes, source);
+        let mut fonts: Vec<u32> = faces.iter().map(|f| f.info.index).collect();
+        fonts.dedup();
+        if let Some(&keep) = fonts.get(limits.max_faces_per_file as usize) {
+            faces.retain(|f| f.info.index < keep);
+        }
+        if faces.is_empty() {
+            return Err(FontFileError::NotAFont);
+        }
+        self.ensure();
+        let added = lock(&self.added);
+        if added.faces.len() + faces.len() > limits.max_added_faces {
+            return Err(FontFileError::TooManyFaces { max: limits.max_added_faces });
+        }
+        Ok(self.push_added(added, faces))
+    }
+
+    fn push_added(&self, mut added: MutexGuard<'_, Added>, faces: Vec<Face>) -> Vec<FaceInfo> {
+        let infos = faces.iter().map(|f| f.info.clone()).collect();
+        added.faces.extend(faces);
+        let scanned = self.scanned();
+        self.publish(Index::build(&added.faces, &scanned));
+        infos
+    }
+
+    /// Remove every added face of `source` (a closed document's fonts). Returns how many.
+    pub fn remove_added(&self, source: Source) -> usize {
+        let mut added = lock(&self.added);
+        let before = added.faces.len();
+        added.faces.retain(|f| f.info.source != source);
+        let blobs: HashSet<u64> = added.faces.iter().filter_map(|f| f.info.blob).collect();
+        added.blobs.retain(|b, _| blobs.contains(b));
+        let removed = before - added.faces.len();
+        if removed > 0 {
+            let scanned = self.scanned();
+            self.publish(Index::build(&added.faces, &scanned));
+        }
+        removed
+    }
+
+    /// The faces the last scan found.
+    fn scanned(&self) -> Vec<Face> {
+        let scan = lock(&self.scan);
+        let mut faces: Vec<(&PathBuf, &Cached)> = scan.files.iter().collect();
+        faces.sort_by(|a, b| a.0.cmp(b.0));
+        faces.into_iter().flat_map(|(_, c)| c.faces.iter().cloned()).collect()
+    }
+
+    fn scan_now(&self, refresh: bool) {
+        let mut state = lock(&self.scan);
+        let (app_dirs, listers, service) = {
+            let c = self.read_config();
+            (c.app_dirs.clone(), c.listers.clone(), c.font_service)
+        };
+        let ignore_case = self.env.os == Os::Windows;
+        let mut roots: Vec<(PathBuf, Source)> = font_dirs(&self.env).into_iter().map(|d| (d, Source::System)).collect();
+        roots.extend(font_store_dir(&self.env).map(|d| (d, Source::Store)));
+        roots.extend(app_dirs.iter().map(|d| (d.clone(), Source::App)));
+
+        let mut named: Vec<PathBuf> = Vec::new();
+        let mut registered = Vec::new();
+        if service {
+            named.extend(crate::system::font_files(refresh));
+            if self.env.os == Os::Windows {
+                registered = crate::registry::registered_font_files();
+                named.extend(registered.iter().cloned());
+            }
+        }
+        for lister in &listers {
+            named.extend(lister());
+        }
+
+        let mut walk = Walk { ignore_case, seen_dirs: HashSet::new(), seen_files: HashSet::new(), entries: 0, dirs: Vec::new(), files: Vec::new() };
+        for (root, source) in &roots {
+            walk.dir(root, *source, 0);
+        }
+        let mut parents = HashSet::new();
+        for file in named {
+            if file.is_dir() {
+                walk.dir(&file, Source::System, 0);
+                continue;
+            }
+            if let Some(parent) = file.parent()
+                && parents.insert(parent.to_path_buf())
+            {
+                walk.dirs.push((parent.to_path_buf(), modified(parent)));
+            }
+            walk.file(file, Source::System, true);
+        }
+
+        let mut files = HashMap::new();
+        for (path, source, by_name) in walk.files {
+            let Ok(meta) = std::fs::metadata(&path) else { continue };
+            let (len, mtime) = (meta.len(), meta.modified().ok());
+            let cached = state.files.remove(&path).filter(|c| c.len == len && c.modified == mtime);
+            let mut faces = match cached {
+                Some(c) => c.faces,
+                None if by_name || scan::is_font_file(&path) || crate::suitcase::is_suitcase(&path) => scan::file_faces(&path, MAX_SCAN_READ, source),
+                None => continue,
+            };
+            for f in &mut faces {
+                f.info.source = source;
+            }
+            files.insert(path, Cached { len, modified: mtime, faces });
+        }
+        state.files = files;
+        drop(state);
+
+        *lock(&self.stamp) = Stamp { app_dirs, dirs: walk.dirs, registered };
+        let added = lock(&self.added);
+        let scanned = self.scanned();
+        self.publish(Index::build(&added.faces, &scanned));
+    }
+}
+
+/// Stops a [`Catalog::watch`] when dropped.
+#[must_use = "dropping a Watch stops it"]
+pub struct Watch {
+    stop: Arc<AtomicBool>,
+}
+
+impl Drop for Watch {
+    fn drop(&mut self) {
+        self.stop.store(true, Ordering::Relaxed);
+    }
+}
+
+/// The files of one scan: each folder and file once, however links lead back to it.
+struct Walk {
+    ignore_case: bool,
+    seen_dirs: HashSet<PathBuf>,
+    seen_files: HashSet<PathBuf>,
+    entries: usize,
+    dirs: Vec<(PathBuf, Option<SystemTime>)>,
+    /// Each file with where it was found and whether a lister named it.
+    files: Vec<(PathBuf, Source, bool)>,
+}
+
+impl Walk {
+    fn key(&self, path: &Path) -> PathBuf {
+        let real = std::fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf());
+        if self.ignore_case { PathBuf::from(real.to_string_lossy().to_lowercase()) } else { real }
+    }
+
+    fn dir(&mut self, dir: &Path, source: Source, depth: usize) {
+        let key = self.key(dir);
+        if !self.seen_dirs.insert(key) {
+            return;
+        }
+        // Stamped before it is listed: a font installed meanwhile changes it after this.
+        self.dirs.push((dir.to_path_buf(), modified(dir)));
+        let Ok(entries) = std::fs::read_dir(dir) else { return };
+        let mut paths: Vec<(PathBuf, bool)> = Vec::new();
+        for e in entries.flatten() {
+            self.entries += 1;
+            if self.entries > MAX_ENTRIES {
+                break;
+            }
+            let path = e.path();
+            let is_dir = e.file_type().is_ok_and(|t| t.is_dir() || (t.is_symlink() && path.is_dir()));
+            paths.push((path, is_dir));
+        }
+        paths.sort();
+        for (path, is_dir) in paths {
+            if is_dir {
+                if depth < MAX_DEPTH {
+                    self.dir(&path, source, depth + 1);
+                }
+            } else {
+                self.file(path, source, false);
+            }
+        }
+    }
+
+    fn file(&mut self, path: PathBuf, source: Source, by_name: bool) {
+        let key = self.key(&path);
+        if self.seen_files.insert(key) {
+            self.files.push((path, source, by_name));
+        }
+    }
+}
diff --git a/crates/font-catalog/src/env.rs b/crates/font-catalog/src/env.rs
new file mode 100644
index 00000000..08a84bdd
--- /dev/null
+++ b/crates/font-catalog/src/env.rs
@@ -0,0 +1,235 @@
+//! Where fonts are installed: the platform's font folders and the suite's font store, worked out
+//! from a [`FontEnv`] value rather than the process environment, so tests can describe any system.
+
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+
+/// The platform family whose font folders apply.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub enum Os {
+    /// macOS.
+    MacOs,
+    /// Windows.
+    Windows,
+    /// Linux and the BSDs: XDG folders, fontconfig and Flatpak.
+    #[default]
+    Unix,
+    /// Haiku.
+    Haiku,
+    /// The web, Android, iOS and anything else without font folders to scan.
+    None,
+}
+
+impl Os {
+    /// The platform this build runs on.
+    pub fn current() -> Self {
+        if cfg!(target_arch = "wasm32") || cfg!(target_os = "android") || cfg!(target_os = "ios") {
+            Self::None
+        } else if cfg!(target_os = "macos") {
+            Self::MacOs
+        } else if cfg!(windows) {
+            Self::Windows
+        } else if cfg!(target_os = "haiku") {
+            Self::Haiku
+        } else {
+            Self::Unix
+        }
+    }
+}
+
+/// The environment the font folders depend on.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct FontEnv {
+    /// Which platform's folders to list.
+    pub os: Os,
+    /// The file system root that fixed system folders (`/usr/share/fonts`, `/run/host/fonts`,
+    /// `/System/Library/Fonts`, `/etc/fonts/fonts.conf`) and absolute fontconfig `<dir>` entries
+    /// are under: `/` on a real system, a temporary folder in tests.
+    pub root: PathBuf,
+    /// `HOME` (`USERPROFILE` on Windows).
+    pub home: Option<PathBuf>,
+    /// `XDG_DATA_HOME`.
+    pub xdg_data_home: Option<PathBuf>,
+    /// `XDG_DATA_DIRS`.
+    pub xdg_data_dirs: Option<OsString>,
+    /// `XDG_CONFIG_HOME`.
+    pub xdg_config_home: Option<PathBuf>,
+    /// `FONTCONFIG_FILE`: the main fontconfig file instead of `/etc/fonts/fonts.conf`.
+    pub fontconfig_file: Option<PathBuf>,
+    /// Inside a Flatpak sandbox (`/.flatpak-info` exists): the host's fontconfig folders are read
+    /// too, under `/run/host`.
+    pub flatpak: bool,
+    /// `WINDIR`.
+    pub windir: Option<PathBuf>,
+    /// `LOCALAPPDATA`.
+    pub local_app_data: Option<PathBuf>,
+    /// `CRAFT_FONT_STORE`: the font store folder instead of the platform's ([`font_store_dir`]).
+    pub font_store: Option<PathBuf>,
+}
+
+impl FontEnv {
+    /// The environment of this process. Empty variables count as unset.
+    pub fn from_process() -> Self {
+        let var = |k: &str| std::env::var_os(k).filter(|v| !v.is_empty());
+        let path = |k: &str| var(k).map(PathBuf::from);
+        let os = Os::current();
+        let home = if os == Os::Windows { path("USERPROFILE").or_else(|| path("HOME")) } else { path("HOME") };
+        Self {
+            os,
+            root: PathBuf::from("/"),
+            home,
+            xdg_data_home: path("XDG_DATA_HOME"),
+            xdg_data_dirs: var("XDG_DATA_DIRS"),
+            xdg_config_home: path("XDG_CONFIG_HOME"),
+            fontconfig_file: path("FONTCONFIG_FILE"),
+            flatpak: os == Os::Unix && Path::new("/.flatpak-info").exists(),
+            windir: path("WINDIR"),
+            local_app_data: path("LOCALAPPDATA"),
+            font_store: path("CRAFT_FONT_STORE"),
+        }
+    }
+
+    /// `path` (absolute, as on the real system) under [`FontEnv::root`].
+    pub(crate) fn rooted(&self, path: impl AsRef<Path>) -> PathBuf {
+        let path = path.as_ref();
+        let relative: PathBuf = path.components().filter(|c| matches!(c, std::path::Component::Normal(_))).collect();
+        if self.root.as_os_str().is_empty() { Path::new("/").join(relative) } else { self.root.join(relative) }
+    }
+
+    /// `$XDG_DATA_HOME`, else `~/.local/share` (a relative `XDG_DATA_HOME` is ignored, as the XDG
+    /// specification says).
+    pub(crate) fn data_home(&self) -> Option<PathBuf> {
+        self.xdg_data_home.clone().filter(|p| p.is_absolute()).or_else(|| self.home.as_ref().map(|h| h.join(".local/share")))
+    }
+
+    /// `$XDG_CONFIG_HOME`, else `~/.config`.
+    pub(crate) fn config_home(&self) -> Option<PathBuf> {
+        self.xdg_config_home.clone().filter(|p| p.is_absolute()).or_else(|| self.home.as_ref().map(|h| h.join(".config")))
+    }
+
+    fn windows_fonts(&self) -> PathBuf {
+        self.windir.clone().unwrap_or_else(|| PathBuf::from("C:\\Windows")).join("Fonts")
+    }
+}
+
+/// The folder name of the font store under the platform's per-user data folder, spelled as the
+/// suite's other per-user folders are (`ArtCraft Launcher`, `artcraft-launcher`).
+fn store_name(os: Os) -> &'static str {
+    if matches!(os, Os::MacOs | Os::Windows) { "Craft Fonts" } else { "craft-fonts" }
+}
+
+/// The suite's font store: one per-user folder of fonts installed by Craft Font Manager or an
+/// app's "install missing font", read by every app's catalog and by no other program.
+///
+/// - macOS: `~/Library/Application Support/Craft Fonts`
+/// - Windows: `%LOCALAPPDATA%\Craft Fonts`
+/// - Linux, the BSDs and Haiku: `$XDG_DATA_HOME/craft-fonts` (`~/.local/share/craft-fonts`)
+///
+/// `CRAFT_FONT_STORE` ([`FontEnv::font_store`]) replaces it. `None` where there is no per-user
+/// folder (the web), or when the variables it is built from are unset.
+pub fn font_store_dir(env: &FontEnv) -> Option<PathBuf> {
+    if let Some(dir) = &env.font_store {
+        return Some(dir.clone());
+    }
+    let base = match env.os {
+        Os::MacOs => env.home.as_ref()?.join("Library/Application Support"),
+        Os::Windows => env.local_app_data.clone()?,
+        Os::Unix | Os::Haiku => env.data_home()?,
+        Os::None => return None,
+    };
+    Some(base.join(store_name(env.os)))
+}
+
+/// The platform's font folders, the system's and the user's, without duplicates. Folders that
+/// don't exist are kept: a scan skips them, and a change check notices when one appears.
+///
+/// - macOS: `/System/Library/Fonts`, `/Library/Fonts`, `/Network/Library/Fonts`,
+///   `~/Library/Fonts`, `/System/Library/Assets`, and the font assets macOS downloads on demand
+///   (`/System/Library/AssetsV2/com_apple_MobileAsset_Font*`, also under
+///   `PreinstalledAssetsV2/InstallWithOs`).
+/// - Windows: `%WINDIR%\Fonts` and the current user's `%LOCALAPPDATA%\Microsoft\Windows\Fonts`.
+///   The registry's font list is read by the catalog itself.
+/// - Linux and the BSDs: `/usr/share/fonts`, `/usr/local/share/fonts`, the Flatpak host folders
+///   (`/run/host/fonts`, `/run/host/local-fonts`, `/run/host/user-fonts`), `~/.local/share/fonts`,
+///   `~/.fonts`, `$XDG_DATA_HOME/fonts`, `$XDG_DATA_DIRS/*/fonts`, and the `<dir>` and
+///   `<remap-dir>` entries of the fontconfig configuration ([`crate::fontconfig_dirs`]).
+/// - Haiku: the system's and the user's `data/fonts` folders, packaged and non-packaged.
+pub fn font_dirs(env: &FontEnv) -> Vec<PathBuf> {
+    let mut dirs: Vec<PathBuf> = Vec::new();
+    match env.os {
+        Os::MacOs => {
+            dirs.extend(["/System/Library/Fonts", "/Library/Fonts", "/Network/Library/Fonts"].map(|d| env.rooted(d)));
+            dirs.extend(env.home.as_ref().map(|h| h.join("Library/Fonts")));
+            dirs.push(env.rooted("/System/Library/Assets"));
+            for parent in ["/System/Library/AssetsV2", "/System/Library/AssetsV2/PreinstalledAssetsV2/InstallWithOs"] {
+                let mut assets: Vec<PathBuf> = std::fs::read_dir(env.rooted(parent))
+                    .into_iter()
+                    .flatten()
+                    .flatten()
+                    .filter(|e| e.file_name().to_string_lossy().starts_with("com_apple_MobileAsset_Font"))
+                    .map(|e| e.path())
+                    .collect();
+                assets.sort();
+                dirs.extend(assets);
+            }
+        }
+        Os::Windows => {
+            dirs.push(env.windows_fonts());
+            dirs.extend(env.local_app_data.as_ref().map(|l| l.join("Microsoft\\Windows\\Fonts")));
+        }
+        Os::Unix => {
+            dirs.extend(
+                ["/usr/share/fonts", "/usr/local/share/fonts", "/run/host/fonts", "/run/host/local-fonts", "/run/host/user-fonts"]
+                    .map(|d| env.rooted(d)),
+            );
+            if let Some(h) = &env.home {
+                dirs.push(h.join(".local/share/fonts"));
+                dirs.push(h.join(".fonts"));
+            }
+            dirs.extend(env.data_home().map(|d| d.join("fonts")));
+            let data_dirs = env.xdg_data_dirs.clone().unwrap_or_else(|| "/usr/local/share:/usr/share".into());
+            dirs.extend(std::env::split_paths(&data_dirs).filter(|p| p.is_absolute()).map(|p| env.rooted(p).join("fonts")));
+            dirs.extend(crate::fontconfig::fontconfig_dirs(env));
+        }
+        Os::Haiku => {
+            dirs.extend(["/boot/system/data/fonts", "/boot/system/non-packaged/data/fonts"].map(|d| env.rooted(d)));
+            if let Some(h) = &env.home {
+                dirs.push(h.join("config/data/fonts"));
+                dirs.push(h.join("config/non-packaged/data/fonts"));
+            }
+        }
+        Os::None => {}
+    }
+    dedup_dirs(dirs, env.os == Os::Windows)
+}
+
+/// The folders Microsoft Office keeps its own fonts in (Calibri, Cambria, Aptos, and the cloud
+/// fonts it downloads), which other apps don't see. Apps that open Office documents add them to
+/// their catalog ([`crate::Catalog::set_app_dirs`]).
+pub fn office_font_dirs(env: &FontEnv) -> Vec<PathBuf> {
+    match env.os {
+        Os::MacOs => {
+            let mut dirs: Vec<PathBuf> =
+                env.home.iter().map(|h| h.join("Library/Group Containers/UBF8T346G9.Office/FontCache/4/CloudFonts")).collect();
+            dirs.extend(
+                ["Microsoft Word", "Microsoft Excel", "Microsoft PowerPoint", "Microsoft Outlook"]
+                    .map(|app| env.rooted(format!("/Applications/{app}.app/Contents/Resources/DFonts"))),
+            );
+            dirs
+        }
+        Os::Windows => env.local_app_data.iter().map(|l| l.join("Microsoft\\FontCache\\4\\CloudFonts")).collect(),
+        _ => Vec::new(),
+    }
+}
+
+/// `dirs` without repeats (also one folder reached through a link), keeping the first. Windows
+/// paths compare ignoring case.
+pub(crate) fn dedup_dirs(dirs: Vec<PathBuf>, ignore_case: bool) -> Vec<PathBuf> {
+    let mut seen = std::collections::HashSet::new();
+    dirs.into_iter()
+        .filter(|d| {
+            let key = std::fs::canonicalize(d).unwrap_or_else(|_| d.clone());
+            seen.insert(if ignore_case { PathBuf::from(key.to_string_lossy().to_lowercase()) } else { key })
+        })
+        .collect()
+}
diff --git a/crates/font-catalog/src/fontconfig.rs b/crates/font-catalog/src/fontconfig.rs
new file mode 100644
index 00000000..401e5f31
--- /dev/null
+++ b/crates/font-catalog/src/fontconfig.rs
@@ -0,0 +1,193 @@
+//! The font folders named by the fontconfig configuration, read with a small tag scanner (no
+//! fontconfig library, no XML crate): only `<dir>`, `<remap-dir>` and `<include>` matter here.
+//! The work is bounded: include depth, number and size of the files read, and every file is read
+//! at most once.
+
+use std::collections::HashSet;
+use std::path::{Path, PathBuf};
+
+use crate::FontEnv;
+
+const MAX_INCLUDE_DEPTH: u32 = 8;
+const MAX_FILES: usize = 512;
+const MAX_FILE_BYTES: u64 = 1 << 20;
+
+/// The folders the fontconfig configuration for `env` names, in the order it names them.
+///
+/// The main file is `FONTCONFIG_FILE`, else the first of `/etc/fonts/fonts.conf` and
+/// `/usr/local/etc/fonts/fonts.conf` (FreeBSD) that exists. The user's own configuration
+/// (`$XDG_CONFIG_HOME/fontconfig/fonts.conf` and `conf.d`) is read too, in case the main file
+/// doesn't include it. In a Flatpak sandbox ([`FontEnv::flatpak`]) the host's folders are added:
+/// those `/run/host/font-dirs.xml` maps, and those of the host's own configuration when the
+/// sandbox can see it (`/run/host/etc/fonts/fonts.conf`), under `/run/host`.
+pub fn fontconfig_dirs(env: &FontEnv) -> Vec<PathBuf> {
+    let mut reader = Reader { env, out: Vec::new(), seen: HashSet::new(), host: None };
+    let root = match &env.fontconfig_file {
+        Some(f) => Some(f.clone()),
+        None => ["/etc/fonts/fonts.conf", "/usr/local/etc/fonts/fonts.conf"].map(|p| env.rooted(p)).into_iter().find(|p| p.is_file()),
+    };
+    if let Some(root) = root {
+        reader.file(&root, 0);
+    }
+    if let Some(c) = env.config_home() {
+        reader.include(&c.join("fontconfig/fonts.conf"), 0);
+        reader.include(&c.join("fontconfig/conf.d"), 0);
+    }
+    if env.flatpak {
+        reader.file(&env.rooted("/run/host/font-dirs.xml"), 0);
+        reader.host = Some(env.rooted("/run/host"));
+        reader.file(&env.rooted("/run/host/etc/fonts/fonts.conf"), 0);
+    }
+    reader.out
+}
+
+struct Reader<'a> {
+    env: &'a FontEnv,
+    out: Vec<PathBuf>,
+    seen: HashSet<PathBuf>,
+    /// While reading the host's configuration from a sandbox: where the host's root is.
+    host: Option<PathBuf>,
+}
+
+impl Reader<'_> {
+    /// Read a configuration file or, for a folder, its `NN-name.conf` files in name order.
+    fn include(&mut self, path: &Path, depth: u32) {
+        if path.is_dir() {
+            let Ok(rd) = std::fs::read_dir(path) else { return };
+            let mut files: Vec<PathBuf> = rd
+                .flatten()
+                .map(|e| e.path())
+                .filter(|p| {
+                    p.file_name().and_then(|n| n.to_str()).is_some_and(|n| n.ends_with(".conf") && n.starts_with(|c: char| c.is_ascii_digit()))
+                })
+                .collect();
+            files.sort();
+            for f in files {
+                self.file(&f, depth);
+            }
+        } else {
+            self.file(path, depth);
+        }
+    }
+
+    fn file(&mut self, path: &Path, depth: u32) {
+        if depth > MAX_INCLUDE_DEPTH || self.seen.len() >= MAX_FILES || !path.is_file() {
+            return;
+        }
+        let key = std::fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf());
+        if !self.seen.insert(key) {
+            return;
+        }
+        if std::fs::metadata(path).map(|m| m.len() > MAX_FILE_BYTES).unwrap_or(true) {
+            return;
+        }
+        let Ok(text) = std::fs::read_to_string(path) else { return };
+        let base = path.parent().map(Path::to_path_buf).unwrap_or_default();
+        for el in elements(&text) {
+            match el.name {
+                "dir" | "remap-dir" => {
+                    if let Some(p) = self.resolve(&el, &base, false) {
+                        self.out.push(p);
+                    }
+                }
+                "include" => {
+                    if let Some(p) = self.resolve(&el, &base, true) {
+                        self.include(&p, depth.saturating_add(1));
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+
+    /// The path an element names: `~` is the home folder, `prefix="xdg"` the XDG data (folders)
+    /// or config (includes) home, `prefix="relative"` and plain relative paths the including
+    /// file's folder, `prefix="default"`/`"cwd"` the working folder. Absolute paths are under the
+    /// root, or under the host's root while reading the host's configuration.
+    fn resolve(&self, el: &Element, base: &Path, include: bool) -> Option<PathBuf> {
+        let v = el.text.trim();
+        if v.is_empty() {
+            return None;
+        }
+        if let Some(rest) = v.strip_prefix('~') {
+            return Some(self.env.home.as_ref()?.join(rest.trim_start_matches('/')));
+        }
+        let p = Path::new(v);
+        if p.is_absolute() {
+            return Some(match &self.host {
+                Some(host) => host.join(p.strip_prefix("/").unwrap_or(p)),
+                None => self.env.rooted(p),
+            });
+        }
+        match el.attr("prefix") {
+            Some("xdg") => Some(if include { self.env.config_home()? } else { self.env.data_home()? }.join(p)),
+            Some("default" | "cwd") => std::env::current_dir().ok().map(|c| c.join(p)),
+            _ => Some(base.join(p)),
+        }
+    }
+}
+
+struct Element<'a> {
+    name: &'a str,
+    attrs: &'a str,
+    text: String,
+}
+
+impl Element<'_> {
+    fn attr(&self, key: &str) -> Option<&str> {
+        let mut rest = self.attrs;
+        while let Some(eq) = rest.find('=') {
+            let k = rest.get(..eq)?.trim();
+            let after = rest.get(eq + 1..)?.trim_start();
+            let q = after.chars().next()?;
+            if q != '"' && q != '\'' {
+                return None;
+            }
+            let body = after.get(1..)?;
+            let end = body.find(q)?;
+            if k == key {
+                return body.get(..end);
+            }
+            rest = body.get(end + 1..)?;
+        }
+        None
+    }
+}
+
+/// The `<dir>`, `<remap-dir>` and `<include>` elements of a fontconfig file, comments skipped.
+fn elements(src: &str) -> Vec<Element<'_>> {
+    let mut out = Vec::new();
+    let mut i = 0;
+    while let Some(off) = src.get(i..).and_then(|s| s.find('<')) {
+        let start = i + off;
+        let Some(tail) = src.get(start..) else { break };
+        if tail.starts_with("<!--") {
+            match tail.find("-->") {
+                Some(e) => {
+                    i = start + e + 3;
+                    continue;
+                }
+                None => break,
+            }
+        }
+        let Some(close) = tail.find('>') else { break };
+        let inner = tail.get(1..close).unwrap_or_default();
+        i = start + close + 1;
+        let name_len = inner.find(|c: char| c.is_whitespace() || c == '/').unwrap_or(inner.len());
+        let name = inner.get(..name_len).unwrap_or_default();
+        if !matches!(name, "dir" | "remap-dir" | "include") || inner.ends_with('/') {
+            continue;
+        }
+        let attrs = inner.get(name_len..).unwrap_or_default();
+        let end_tag = format!("</{name}>");
+        let Some(body_len) = src.get(i..).and_then(|s| s.find(&end_tag)) else { break };
+        let body = src.get(i..i + body_len).unwrap_or_default();
+        i += body_len + end_tag.len();
+        out.push(Element { name, attrs, text: decode_entities(body) });
+    }
+    out
+}
+
+fn decode_entities(s: &str) -> String {
+    s.replace("&lt;", "<").replace("&gt;", ">").replace("&quot;", "\"").replace("&apos;", "'").replace("&amp;", "&")
+}
diff --git a/crates/font-catalog/src/lib.rs b/crates/font-catalog/src/lib.rs
new file mode 100644
index 00000000..c787d3ec
--- /dev/null
+++ b/crates/font-catalog/src/lib.rs
@@ -0,0 +1,37 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+//! The installed fonts, for every Craft app: discovery on every platform, lookup by family and
+//! style or by any other name, and loading shared between threads.
+//!
+//! A [`Catalog`] scans the platform's font folders ([`font_dirs`]), the suite's font store
+//! ([`font_store_dir`]), the app's own folders ([`Catalog::set_app_dirs`]) and, with the `system`
+//! feature, the files the platform's font service knows ([`system`]): CoreText on macOS,
+//! DirectWrite on Windows, fontconfig on Linux and FreeBSD. On Windows it also reads the
+//! registry's font list. The scan reads each file's table directory and its `name`, `OS/2` and
+//! `fvar` tables, never whole files, and a rescan reads only files that changed.
+//!
+//! ```no_run
+//! use craft_font_catalog::{Catalog, Match};
+//!
+//! let catalog = Catalog::global();
+//! catalog.scan_in_background();
+//! if let Some((face, Match::Exact)) = catalog.resolve("Source Serif 4", "Bold Italic") {
+//!     let data = catalog.load(&face);
+//! }
+//! ```
+
+mod catalog;
+mod env;
+mod fontconfig;
+mod registry;
+mod scan;
+mod suitcase;
+pub mod system;
+
+pub use catalog::{Catalog, FontData, FontFileError, Limits, Lister, LoadedFace, Match, Watch};
+pub use env::{FontEnv, Os, font_dirs, font_store_dir, office_font_dirs};
+pub use fontconfig::fontconfig_dirs;
+pub use scan::{FaceInfo, LocalizedName, Source, is_font_file, style_italic, style_weight, style_width};
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/font-catalog/src/registry.rs b/crates/font-catalog/src/registry.rs
new file mode 100644
index 00000000..11154234
--- /dev/null
+++ b/crates/font-catalog/src/registry.rs
@@ -0,0 +1,30 @@
+//! The fonts registered with Windows in the registry: one value per face, holding a file name in
+//! the Windows font folder or a full path. Programs that install fonts into their own folders
+//! register them with full paths, which only the registry lists.
+
+use std::path::PathBuf;
+
+/// The full paths the registry lists for the machine's and the current user's fonts, sorted and
+/// without repeats. Bare file names (files in the Windows font folder) are left out: the scan
+/// reads that folder. Empty elsewhere than on Windows.
+pub(crate) fn registered_font_files() -> Vec<PathBuf> {
+    #[cfg(windows)]
+    {
+        const MAX_REGISTERED: usize = 1 << 16;
+        const KEY: &str = r"Software\Microsoft\Windows NT\CurrentVersion\Fonts";
+        use windows_registry::{CURRENT_USER, LOCAL_MACHINE};
+        let mut files: Vec<PathBuf> = [LOCAL_MACHINE, CURRENT_USER]
+            .into_iter()
+            .filter_map(|root| root.open(KEY).ok())
+            .flat_map(|key| key.values().map(|vs| vs.filter_map(|(_, v)| String::try_from(v).ok()).collect::<Vec<_>>()).unwrap_or_default())
+            .take(MAX_REGISTERED)
+            .map(PathBuf::from)
+            .filter(|p| p.is_absolute())
+            .collect();
+        files.sort();
+        files.dedup();
+        files
+    }
+    #[cfg(not(windows))]
+    Vec::new()
+}
diff --git a/crates/font-catalog/src/scan.rs b/crates/font-catalog/src/scan.rs
new file mode 100644
index 00000000..ae321dac
--- /dev/null
+++ b/crates/font-catalog/src/scan.rs
@@ -0,0 +1,461 @@
+//! Reading face records from font files: the table directory and the `name`, `OS/2` and `fvar`
+//! tables, never the whole file.
+
+use std::path::{Path, PathBuf};
+
+use skrifa::raw::{FileRef, TableProvider};
+use skrifa::{MetadataProvider, string::StringId};
+
+/// Where a face comes from.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Source {
+    /// Installed on the system: a platform font folder or the platform's font service.
+    System,
+    /// The suite's font store ([`crate::font_store_dir`]).
+    Store,
+    /// A folder the app added ([`crate::Catalog::set_app_dirs`]).
+    App,
+    /// Bundled with the app and added as bytes.
+    Bundled,
+    /// Added by the user to this app.
+    User,
+    /// Embedded in, or shipped beside, an open document.
+    Document,
+}
+
+/// A name in one language, from the font's `name` table.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct LocalizedName {
+    /// The record's BCP 47 language tag (`ja`, `zh-Hant`), when the font says.
+    pub language: Option<String>,
+    /// The name.
+    pub name: String,
+}
+
+/// One face of an installed or added font: one face of a file, or one named instance of a
+/// variable font.
+#[derive(Clone, Debug, PartialEq)]
+pub struct FaceInfo {
+    /// The family: the typographic family name (name ID 16), else the family name (ID 1), in
+    /// English when the font has an English record.
+    pub family: String,
+    /// The style: the typographic subfamily (ID 17), else the subfamily (ID 2), else `Regular`.
+    /// A named instance's subfamily name.
+    pub style: String,
+    /// The legacy family name (ID 1) when it differs from [`FaceInfo::family`] (`Roboto Light`
+    /// in the family `Roboto`).
+    pub legacy_family: Option<String>,
+    /// The legacy style (ID 2) that goes with [`FaceInfo::legacy_family`].
+    pub legacy_style: Option<String>,
+    /// The family's names in other languages (`ヒラギノ角ゴシック`).
+    pub localized_families: Vec<LocalizedName>,
+    /// The full name (ID 4) of the face itself; `None` for a named instance.
+    pub full_name: Option<String>,
+    /// The PostScript name (ID 6, or a named instance's own), as PDF and other documents name fonts.
+    pub postscript_name: Option<String>,
+    /// The weight, 1 to 1000 (400 regular, 700 bold): `usWeightClass`, a named instance's `wght`,
+    /// else the weight the style name implies.
+    pub weight: f32,
+    /// The width as a percentage of normal (100; 75 condensed, 125 expanded): `usWidthClass`, a
+    /// named instance's `wdth`, else the width the style name implies.
+    pub width: f32,
+    /// Italic or oblique.
+    pub italic: bool,
+    /// A named instance's axis settings (tag, user units); empty for the face itself.
+    pub variations: Vec<([u8; 4], f32)>,
+    /// The face has variation axes.
+    pub variable: bool,
+    /// The OS/2 `fsType` embedding permissions (0 without an OS/2 table).
+    pub fs_type: u16,
+    /// The OS/2 code page bits (`ulCodePageRange1`, `ulCodePageRange2`).
+    pub code_pages: [u32; 2],
+    /// The file the face is in; `None` for a face added as bytes.
+    pub path: Option<PathBuf>,
+    /// The face's number in its file: its index in a collection (0 in a single font), or for a
+    /// Mac suitcase font the number of its `sfnt` resource.
+    pub index: u32,
+    /// Where it comes from.
+    pub source: Source,
+    /// For a face added as bytes: which of the catalog's added blobs holds it.
+    pub(crate) blob: Option<u64>,
+}
+
+/// A face record with the normalized names it answers to.
+#[derive(Clone, Debug)]
+pub(crate) struct Face {
+    pub info: FaceInfo,
+    pub keys: Keys,
+}
+
+/// Every name a face answers to besides its family and style, normalized ([`norm`]).
+#[derive(Clone, Debug, Default)]
+pub(crate) struct Keys {
+    /// Its family in every language, typographic else legacy.
+    pub families: Vec<String>,
+    /// Its style in every language, and a variable font's default instance's name.
+    pub styles: Vec<String>,
+    /// Legacy family and style pairs (`Hiragino Sans W3` / `Regular`), per language record.
+    pub legacy: Vec<(String, String)>,
+    pub full_names: Vec<String>,
+    pub postscript: Vec<String>,
+}
+
+const MAX_AXES: usize = 64;
+const MAX_INSTANCES: usize = 512;
+/// The most faces read from a (possibly damaged) collection.
+pub(crate) const MAX_FACES: u32 = 256;
+/// The largest table the scan reads.
+const MAX_TABLE: u32 = 1 << 20;
+/// Tables holding outlines a renderer draws. A face with none of them (outlines in Apple's `hvgl`
+/// table, bitmaps only) draws nothing and is left out.
+const OUTLINE_TABLES: [&[u8; 4]; 4] = [b"glyf", b"CFF ", b"CFF2", b"VARC"];
+
+pub(crate) fn norm(s: &str) -> String {
+    s.chars().filter(|c| c.is_alphanumeric()).flat_map(char::to_lowercase).collect()
+}
+
+/// The weight a style name implies (400 when it names none).
+pub fn style_weight(style: &str) -> f32 {
+    const TABLE: &[(&str, f32)] = &[
+        ("extralight", 200.0),
+        ("ultralight", 200.0),
+        ("semibold", 600.0),
+        ("demibold", 600.0),
+        ("extrabold", 800.0),
+        ("ultrabold", 800.0),
+        ("hairline", 100.0),
+        ("thin", 100.0),
+        ("light", 300.0),
+        ("medium", 500.0),
+        ("bold", 700.0),
+        ("black", 900.0),
+        ("heavy", 900.0),
+    ];
+    let s = norm(style);
+    TABLE.iter().find(|(k, _)| s.contains(k)).map_or(400.0, |(_, w)| *w)
+}
+
+/// Whether a style name says italic or oblique.
+pub fn style_italic(style: &str) -> bool {
+    let s = norm(style);
+    s.contains("italic") || s.contains("oblique") || s == "it"
+}
+
+/// The width a style name implies, in percent of normal (100 when it names none).
+pub fn style_width(style: &str) -> f32 {
+    const TABLE: &[(&str, f32)] = &[
+        ("ultracondensed", 50.0),
+        ("extracondensed", 62.5),
+        ("semicondensed", 87.5),
+        ("condensed", 75.0),
+        ("narrow", 75.0),
+        ("ultraexpanded", 200.0),
+        ("extraexpanded", 150.0),
+        ("semiexpanded", 112.5),
+        ("expanded", 125.0),
+        ("extended", 125.0),
+        ("wide", 125.0),
+    ];
+    let s = norm(style);
+    TABLE.iter().find(|(k, _)| s.contains(k)).map_or(100.0, |(_, w)| *w)
+}
+
+/// `usWidthClass` (1–9) as a percentage of normal.
+fn width_class_percent(class: u16) -> Option<f32> {
+    const PERCENT: [f32; 9] = [50.0, 62.5, 75.0, 87.5, 100.0, 112.5, 125.0, 150.0, 200.0];
+    PERCENT.get(usize::from(class).checked_sub(1)?).copied()
+}
+
+fn name(font: &skrifa::FontRef<'_>, ids: &[StringId]) -> Option<String> {
+    ids.iter().find_map(|id| font.localized_strings(*id).english_or_first().map(|s| s.to_string()).filter(|s| !s.is_empty()))
+}
+
+/// Every string of `id`, with its language.
+fn localized(font: &skrifa::FontRef<'_>, id: StringId) -> Vec<(Option<String>, String)> {
+    font.localized_strings(id).map(|s| (s.language().map(str::to_owned), s.to_string())).filter(|(_, s)| !s.is_empty()).collect()
+}
+
+fn all_names(font: &skrifa::FontRef<'_>, id: StringId) -> Vec<String> {
+    localized(font, id).into_iter().map(|(_, s)| s).collect()
+}
+
+fn sort_dedup(v: &mut Vec<String>) {
+    v.retain(|k| !k.is_empty());
+    v.sort();
+    v.dedup();
+}
+
+/// The faces `font` (face `index` of its file) offers: the face itself, then the named instances
+/// of a variable font. Empty when it has no family name.
+pub(crate) fn font_faces(font: &skrifa::FontRef<'_>, index: u32, path: Option<&Path>, source: Source) -> Vec<Face> {
+    let Some(family) = name(font, &[StringId::TYPOGRAPHIC_FAMILY_NAME, StringId::FAMILY_NAME]) else { return vec![] };
+    let style = name(font, &[StringId::TYPOGRAPHIC_SUBFAMILY_NAME, StringId::SUBFAMILY_NAME]).unwrap_or_else(|| "Regular".into());
+    let typo_family = localized(font, StringId::TYPOGRAPHIC_FAMILY_NAME);
+    let typo_style = all_names(font, StringId::TYPOGRAPHIC_SUBFAMILY_NAME);
+    let legacy_family = localized(font, StringId::FAMILY_NAME);
+    let legacy_style = localized(font, StringId::SUBFAMILY_NAME);
+
+    let family_records = if typo_family.is_empty() { &legacy_family } else { &typo_family };
+    let mut localized_families: Vec<LocalizedName> = Vec::new();
+    for (language, n) in family_records {
+        if *n != family && !localized_families.iter().any(|l| l.name == *n) {
+            localized_families.push(LocalizedName { language: language.clone(), name: n.clone() });
+        }
+    }
+    let mut families: Vec<String> = std::iter::once(family.as_str()).chain(family_records.iter().map(|(_, f)| f.as_str())).map(norm).collect();
+    // A legacy style names the face beside its legacy family only when the font has a
+    // typographic style: every weight of `Hiragino Sans` is `Regular` in its own legacy family.
+    let style_names: Vec<String> = if typo_style.is_empty() { legacy_style.iter().map(|(_, s)| s.clone()).collect() } else { typo_style };
+    let mut styles: Vec<String> = std::iter::once(style.as_str()).chain(style_names.iter().map(String::as_str)).map(norm).collect();
+    let mut legacy: Vec<(String, String)> = if typo_family.is_empty() {
+        vec![]
+    } else {
+        legacy_family
+            .iter()
+            .flat_map(|(lf, f)| legacy_style.iter().filter(move |(ls, _)| ls == lf).map(move |(_, s)| (norm(f), norm(s))))
+            .filter(|(f, s)| !f.is_empty() && !s.is_empty())
+            .collect()
+    };
+    legacy.sort();
+    legacy.dedup();
+    let mut postscript: Vec<String> = all_names(font, StringId::POSTSCRIPT_NAME).iter().map(|n| norm(n)).collect();
+    let mut full_names: Vec<String> = all_names(font, StringId::FULL_NAME).iter().map(|n| norm(n)).collect();
+    for v in [&mut families, &mut styles, &mut full_names, &mut postscript] {
+        sort_dedup(v);
+    }
+
+    let os2 = font.os2().ok();
+    let weight = os2
+        .as_ref()
+        .map(|t| t.us_weight_class())
+        .map(|w| if (1..10).contains(&w) { w * 100 } else { w })
+        .filter(|w| (1..=1000).contains(w))
+        .map_or_else(|| style_weight(&style), f32::from);
+    let width = os2.as_ref().and_then(|t| width_class_percent(t.us_width_class())).unwrap_or_else(|| style_width(&style));
+    let selection_italic = os2.as_ref().is_some_and(|t| {
+        let f = t.fs_selection();
+        f.contains(skrifa::raw::tables::os2::SelectionFlags::ITALIC) || f.contains(skrifa::raw::tables::os2::SelectionFlags::OBLIQUE)
+    });
+    let fs_type = os2.as_ref().map_or(0, |t| t.fs_type());
+    let code_pages = os2.as_ref().map_or([0, 0], |t| [t.ul_code_page_range_1().unwrap_or(0), t.ul_code_page_range_2().unwrap_or(0)]);
+    let axes = font.axes();
+    let legacy_pair = (!typo_family.is_empty())
+        .then(|| name(font, &[StringId::FAMILY_NAME]))
+        .flatten()
+        .filter(|f| *f != family)
+        .map(|f| (f, name(font, &[StringId::SUBFAMILY_NAME])));
+
+    let info = FaceInfo {
+        family: family.clone(),
+        style: style.clone(),
+        legacy_family: legacy_pair.as_ref().map(|(f, _)| f.clone()),
+        legacy_style: legacy_pair.and_then(|(_, s)| s),
+        localized_families,
+        full_name: name(font, &[StringId::FULL_NAME]),
+        postscript_name: name(font, &[StringId::POSTSCRIPT_NAME]),
+        weight,
+        width,
+        italic: selection_italic || style_italic(&style),
+        variations: vec![],
+        variable: !axes.is_empty(),
+        fs_type,
+        code_pages,
+        path: path.map(Path::to_path_buf),
+        index,
+        source,
+        blob: None,
+    };
+    let mut keys = Keys { families, styles, legacy, full_names, postscript };
+    let instances = named_instances(font, &info, &mut keys);
+    std::iter::once(Face { info, keys }).chain(instances).collect()
+}
+
+/// The named instances of a variable face (its `fvar` table) as faces of its family, without the
+/// default instance (the face itself) and without names already taken. The default instance's
+/// name, when it isn't the face's style (a face `Regular` whose default instance is `Book`), names
+/// the face too. Damaged tables give fewer instances or none.
+fn named_instances(font: &skrifa::FontRef<'_>, face: &FaceInfo, keys: &mut Keys) -> Vec<Face> {
+    let axes = font.axes();
+    if axes.is_empty() || axes.len() > MAX_AXES {
+        return vec![];
+    }
+    let tags: Vec<[u8; 4]> = axes.iter().map(|a| a.tag().to_be_bytes()).collect();
+    let defaults: Vec<f32> = axes.iter().map(|a| a.default_value()).collect();
+    // Instances without a PostScript name of their own are named `<prefix>-<style>` (Adobe
+    // Technical Note #5902).
+    let prefix = name(font, &[StringId::VARIATIONS_POSTSCRIPT_NAME_PREFIX]).unwrap_or_else(|| face.family.replace(' ', ""));
+    let mut taken = vec![norm(&face.style)];
+    let mut out = Vec::new();
+    for inst in font.named_instances().iter().take(MAX_INSTANCES) {
+        let coords: Vec<f32> = inst.user_coords().take(MAX_AXES).collect();
+        if coords.len() != tags.len() || coords.iter().any(|c| !c.is_finite()) {
+            continue;
+        }
+        let Some(style) = name(font, &[inst.subfamily_name_id()]) else { continue };
+        let ns = norm(&style);
+        if ns.is_empty() || taken.contains(&ns) {
+            continue;
+        }
+        let ps_default = format!("{prefix}-{}", style.replace(' ', ""));
+        taken.push(ns.clone());
+        if coords.iter().zip(&defaults).all(|(c, d)| (c - d).abs() < 1e-3) {
+            keys.styles.push(ns);
+            keys.postscript.push(norm(&ps_default));
+            continue;
+        }
+        let axis = |tag: &[u8; 4]| tags.iter().zip(&coords).find(|(t, _)| *t == tag).map(|(_, v)| *v);
+        let weight = axis(b"wght").map_or_else(|| style_weight(&style), |w| w.clamp(1.0, 1000.0));
+        let width = axis(b"wdth").map_or_else(|| style_width(&style), |w| w.clamp(25.0, 400.0));
+        let italic = style_italic(&style) || axis(b"ital").is_some_and(|v| v >= 0.5) || axis(b"slnt").is_some_and(|v| v != 0.0);
+        let own_ps = inst.postscript_name_id().and_then(|id| name(font, &[id]));
+        let mut styles: Vec<String> = std::iter::once(style.clone()).chain(all_names(font, inst.subfamily_name_id())).map(|s| norm(&s)).collect();
+        let mut postscript: Vec<String> =
+            inst.postscript_name_id().map(|id| all_names(font, id)).unwrap_or_default().iter().map(|n| norm(n)).collect();
+        postscript.push(norm(&ps_default));
+        sort_dedup(&mut styles);
+        sort_dedup(&mut postscript);
+        let info = FaceInfo {
+            style,
+            legacy_family: None,
+            legacy_style: None,
+            full_name: None,
+            postscript_name: Some(own_ps.unwrap_or(ps_default)),
+            weight,
+            width,
+            italic,
+            variations: tags.iter().copied().zip(coords.iter().copied()).collect(),
+            ..face.clone()
+        };
+        let keys = Keys { families: keys.families.clone(), styles, legacy: vec![], full_names: vec![], postscript };
+        out.push(Face { info, keys });
+    }
+    sort_dedup(&mut keys.styles);
+    sort_dedup(&mut keys.postscript);
+    out
+}
+
+/// How many faces `data` (a font file or collection) holds; 0 when it isn't one.
+pub(crate) fn face_count(data: &[u8]) -> u32 {
+    match FileRef::new(data) {
+        Ok(FileRef::Font(_)) => 1,
+        Ok(FileRef::Collection(c)) => c.len(),
+        Err(_) => 0,
+    }
+}
+
+/// The faces of every font in `data`, at most `max_faces` font faces read.
+pub(crate) fn data_faces(data: &[u8], max_faces: u32, path: Option<&Path>, source: Source) -> Vec<Face> {
+    (0..face_count(data).min(max_faces))
+        .filter_map(|i| Some((i, skrifa::FontRef::from_index(data, i).ok()?)))
+        .filter(|(_, f)| OUTLINE_TABLES.iter().any(|t| f.table_data(skrifa::Tag::new(t)).is_some()))
+        .flat_map(|(i, f)| font_faces(&f, i, path, source))
+        .collect()
+}
+
+/// The faces of the font file at `path`, reading only its table directories and `name`, `fvar`
+/// and `OS/2` tables, at most `max_read` bytes in all: a scan opens thousands of files, many of
+/// them megabytes long. A Mac suitcase font's `sfnt` resources are read instead.
+pub(crate) fn file_faces(path: &Path, max_read: u64, source: Source) -> Vec<Face> {
+    if crate::suitcase::is_suitcase(path) {
+        if crate::suitcase::fork_len(path) > max_read {
+            return vec![];
+        }
+        let mut faces = Vec::new();
+        for (resource, font) in (0u32..).zip(crate::suitcase::read_fonts(path)) {
+            for mut face in data_faces(&font, 1, Some(path), source) {
+                face.info.index = resource;
+                faces.push(face);
+            }
+        }
+        return faces;
+    }
+    match std::fs::File::open(path) {
+        Ok(file) => reader_faces(file, MAX_FACES, max_read, path, source),
+        Err(_) => vec![],
+    }
+}
+
+fn reader_faces(mut file: impl std::io::Read + std::io::Seek, max_faces: u32, max_read: u64, path: &Path, source: Source) -> Vec<Face> {
+    use std::io::SeekFrom;
+    let mut read = 0u64;
+    let file_len = file.seek(SeekFrom::End(0)).unwrap_or(0);
+    let mut read_at = |offset: u64, len: usize| -> Option<Vec<u8>> {
+        read = read.checked_add(u64::try_from(len).ok()?).filter(|r| *r <= max_read)?;
+        let mut buf = vec![0; len];
+        file.seek(SeekFrom::Start(offset)).ok()?;
+        file.read_exact(&mut buf).ok()?;
+        Some(buf)
+    };
+    let be32 = |b: &[u8], at: usize| b.get(at..at + 4).and_then(|s| s.try_into().ok()).map(u32::from_be_bytes);
+    let Some(head) = read_at(0, 12) else { return vec![] };
+    let starts: Vec<u32> = if head.starts_with(b"ttcf") {
+        // A damaged count is capped by what the file can hold.
+        let fits = u32::try_from(file_len.saturating_sub(12) / 4).unwrap_or(u32::MAX);
+        let n = be32(&head, 8).unwrap_or(0).min(max_faces).min(fits) as usize;
+        read_at(12, n * 4).map(|b| b.as_chunks::<4>().0.iter().map(|c| u32::from_be_bytes(*c)).collect()).unwrap_or_default()
+    } else {
+        vec![0]
+    };
+    (0u32..)
+        .zip(starts)
+        .filter_map(|(index, start)| {
+            let dir = read_at(start.into(), 12)?;
+            let tables = usize::from(u16::from_be_bytes(dir.get(4..6)?.try_into().ok()?));
+            let records = read_at(u64::from(start) + 12, tables * 16)?;
+            let records: Vec<&[u8]> = records.as_chunks::<16>().0.iter().map(|r| r.as_slice()).collect();
+            if !records.iter().any(|r| OUTLINE_TABLES.iter().any(|t| r.starts_with(*t))) {
+                return None;
+            }
+            let mut table = |tag: &[u8; 4]| -> Option<Vec<u8>> {
+                let rec = records.iter().find(|r| r.starts_with(tag))?;
+                let (offset, len) = (be32(rec, 8)?, be32(rec, 12)?);
+                if len > MAX_TABLE {
+                    return None;
+                }
+                read_at(offset.into(), len as usize)
+            };
+            let name = table(b"name")?;
+            let mut tables: Vec<(&[u8; 4], Vec<u8>)> = vec![(b"name", name)];
+            for tag in [b"fvar", b"OS/2"] {
+                if let Some(t) = table(tag) {
+                    tables.push((tag, t));
+                }
+            }
+            let refs: Vec<(&[u8; 4], &[u8])> = tables.iter().map(|(t, d)| (*t, d.as_slice())).collect();
+            let font = sfnt_of(&refs)?;
+            Some(font_faces(&skrifa::FontRef::new(&font).ok()?, index, Some(path), source))
+        })
+        .flatten()
+        .collect()
+}
+
+/// A font file holding `tables` (tag, data), sorted by tag as table directories are.
+pub(crate) fn sfnt_of(tables: &[(&[u8; 4], &[u8])]) -> Option<Vec<u8>> {
+    let mut tables = tables.to_vec();
+    tables.sort_by_key(|t| *t.0);
+    let n = u16::try_from(tables.len()).ok()?;
+    let mut font = Vec::new();
+    font.extend_from_slice(&0x0001_0000_u32.to_be_bytes());
+    for v in [n, 0, 0, 0] {
+        font.extend_from_slice(&v.to_be_bytes());
+    }
+    let mut offset = 12 + 16 * tables.len();
+    for (tag, data) in &tables {
+        font.extend_from_slice(*tag);
+        for v in [0, u32::try_from(offset).ok()?, u32::try_from(data.len()).ok()?] {
+            font.extend_from_slice(&v.to_be_bytes());
+        }
+        offset += data.len().next_multiple_of(4);
+    }
+    for (_, data) in &tables {
+        font.extend_from_slice(data);
+        font.resize(font.len().next_multiple_of(4), 0);
+    }
+    Some(font)
+}
+
+/// Whether `path` has a font file's extension (`.ttf`, `.otf`, `.ttc`, `.otc`, in any case), as
+/// the scan picks files in a folder.
+pub fn is_font_file(path: &Path) -> bool {
+    path.extension().and_then(|e| e.to_str()).is_some_and(|e| ["ttf", "otf", "ttc", "otc"].iter().any(|x| e.eq_ignore_ascii_case(x)))
+}
diff --git a/crates/font-catalog/src/suitcase.rs b/crates/font-catalog/src/suitcase.rs
new file mode 100644
index 00000000..ef64c01d
--- /dev/null
+++ b/crates/font-catalog/src/suitcase.rs
@@ -0,0 +1,102 @@
+//! Suitcase fonts: classic Mac OS font files whose data fork is empty and whose fonts are `sfnt`
+//! resources in the resource fork (Microsoft Office installs its fonts this way in
+//! `/Library/Fonts/Microsoft`). macOS lists them as installed; a reader of the file's data finds
+//! nothing, so the scan reads the resource fork. The fork's layout is Apple's published resource
+//! file format (Inside Macintosh: More Macintosh Toolbox, "Resource Manager").
+
+use std::path::Path;
+
+/// Caps on what a (possibly damaged) fork can make the scan read.
+const MAX_FORK: u64 = 256 << 20;
+const MAX_TYPES: usize = 1 << 12;
+const MAX_FONTS: usize = 256;
+
+fn be16(b: &[u8], at: usize) -> Option<usize> {
+    b.get(at..at.checked_add(2)?).and_then(|s| s.try_into().ok()).map(|s| u16::from_be_bytes(s) as usize)
+}
+
+fn be32(b: &[u8], at: usize) -> Option<usize> {
+    b.get(at..at.checked_add(4)?).and_then(|s| s.try_into().ok()).map(|s| u32::from_be_bytes(s) as usize)
+}
+
+/// The font files (`sfnt` resources) of a resource fork, in the order its map lists them. A
+/// fork that isn't well formed gives the fonts read before the damage, or none.
+pub(crate) fn sfnt_resources(fork: &[u8]) -> Vec<&[u8]> {
+    let mut fonts = Vec::new();
+    let _ = collect(fork, &mut fonts);
+    fonts
+}
+
+fn collect<'a>(fork: &'a [u8], fonts: &mut Vec<&'a [u8]>) -> Option<()> {
+    // The header: where the data and the map start.
+    let data = be32(fork, 0)?;
+    let map = fork.get(be32(fork, 4)?..)?;
+    // The map: its type list starts at the offset kept 24 bytes in, and counts from the map.
+    let types = be16(map, 24)?;
+    // Counts are stored less one, so a list of none is 0xFFFF.
+    let n_types = (be16(map, types)? + 1) & 0xFFFF;
+    let mut total = 0usize;
+    for t in 0..n_types.min(MAX_TYPES) {
+        let at = types + 2 + t * 8;
+        if map.get(at..at.checked_add(4)?)? != b"sfnt" {
+            continue;
+        }
+        let count = (be16(map, at + 4)? + 1) & 0xFFFF;
+        // Each reference: its data's offset is the low three bytes of the word 4 bytes in.
+        let refs = types + be16(map, at + 6)?;
+        for r in 0..count {
+            let start = data.checked_add(be32(map, refs + r * 12 + 4)? & 0x00FF_FFFF)?;
+            let len = be32(fork, start)?;
+            // References can share data: cap the total too, as every font is copied out.
+            total = total.checked_add(len)?;
+            if fonts.len() >= MAX_FONTS || total as u64 > MAX_FORK {
+                return Some(());
+            }
+            fonts.push(fork.get(start.checked_add(4)?..start.checked_add(4)?.checked_add(len)?)?);
+        }
+    }
+    Some(())
+}
+
+/// The fonts of the suitcase font at `path`, read from its resource fork; none for a file
+/// without one, and off macOS, the only place such a fork is a part of a file.
+pub(crate) fn read_fonts(path: &Path) -> Vec<Vec<u8>> {
+    let Some(fork) = read_fork(path) else { return vec![] };
+    sfnt_resources(&fork).into_iter().map(<[u8]>::to_vec).collect()
+}
+
+/// Whether the file at `path` is a suitcase font: nothing in its data fork and something in its
+/// resource fork.
+pub(crate) fn is_suitcase(path: &Path) -> bool {
+    // Off macOS no file has a fork: don't look at every font file twice.
+    cfg!(target_os = "macos") && std::fs::metadata(path).is_ok_and(|m| m.is_file() && m.len() == 0) && fork_len(path) > 0
+}
+
+#[cfg(target_os = "macos")]
+fn fork_path(path: &Path) -> std::path::PathBuf {
+    path.join("..namedfork/rsrc")
+}
+
+#[cfg(target_os = "macos")]
+pub(crate) fn fork_len(path: &Path) -> u64 {
+    std::fs::metadata(fork_path(path)).map_or(0, |m| m.len())
+}
+
+#[cfg(target_os = "macos")]
+fn read_fork(path: &Path) -> Option<Vec<u8>> {
+    use std::io::Read;
+    let mut fork = Vec::new();
+    std::fs::File::open(fork_path(path)).ok()?.take(MAX_FORK).read_to_end(&mut fork).ok()?;
+    Some(fork)
+}
+
+#[cfg(not(target_os = "macos"))]
+pub(crate) fn fork_len(_: &Path) -> u64 {
+    0
+}
+
+#[cfg(not(target_os = "macos"))]
+fn read_fork(_: &Path) -> Option<Vec<u8>> {
+    let _ = MAX_FORK;
+    None
+}
diff --git a/crates/font-catalog/src/system.rs b/crates/font-catalog/src/system.rs
new file mode 100644
index 00000000..8cac5131
--- /dev/null
+++ b/crates/font-catalog/src/system.rs
@@ -0,0 +1,122 @@
+//! The platform's font service through fontique: CoreText's available fonts on macOS (fonts that
+//! Adobe Fonts, RightFont and other managers activate from their own folders included),
+//! DirectWrite's system font collection on Windows (per-user fonts and font-service fonts
+//! included), and fontconfig on Linux and FreeBSD (Flatpak's host fonts included).
+//!
+//! One fontique collection serves the whole process: the catalog lists its files, and the UI's
+//! font fallback ([`collection`]) queries the same collection, so the system's fonts are
+//! enumerated once.
+
+#[cfg(all(feature = "system", not(target_arch = "wasm32")))]
+mod imp {
+    use std::path::PathBuf;
+    use std::sync::{Mutex, PoisonError};
+
+    use fontique::{Collection, CollectionOptions, SourceKind};
+
+    use crate::{FontEnv, font_store_dir};
+
+    struct Shared {
+        generation: u64,
+        collection: Collection,
+    }
+
+    static SHARED: Mutex<Option<Shared>> = Mutex::new(None);
+
+    /// A new collection of the system's fonts and the font store's. `None` when fontique panics
+    /// (its DirectWrite backend unwraps a failed factory).
+    fn build() -> Option<Collection> {
+        std::panic::catch_unwind(|| {
+            let mut collection = Collection::new(CollectionOptions { shared: false, system_fonts: true });
+            if let Some(store) = font_store_dir(&FontEnv::from_process()).filter(|d| d.is_dir()) {
+                collection.load_fonts_from_paths([store]);
+            }
+            collection
+        })
+        .ok()
+    }
+
+    fn with<R>(refresh: bool, f: impl FnOnce(&mut Shared) -> R) -> R {
+        let mut guard = SHARED.lock().unwrap_or_else(PoisonError::into_inner);
+        let generation = guard.as_ref().map_or(0, |s| s.generation);
+        let shared = match &mut *guard {
+            Some(shared) if !refresh => shared,
+            slot => {
+                let collection = build().unwrap_or_else(|| Collection::new(CollectionOptions { shared: false, system_fonts: false }));
+                slot.insert(Shared { generation: generation + 1, collection })
+            }
+        };
+        f(shared)
+    }
+
+    pub fn collection() -> Collection {
+        with(false, |s| s.collection.clone())
+    }
+
+    pub fn generation() -> u64 {
+        SHARED.lock().unwrap_or_else(PoisonError::into_inner).as_ref().map_or(0, |s| s.generation)
+    }
+
+    pub fn refresh() {
+        with(true, |_| ());
+    }
+
+    pub fn font_files(refresh: bool) -> Vec<PathBuf> {
+        with(refresh, |s| {
+            let names: Vec<String> = s.collection.family_names().map(str::to_owned).collect();
+            let mut files: Vec<PathBuf> = names
+                .iter()
+                .filter_map(|name| s.collection.family_by_name(name))
+                .flat_map(|family| {
+                    family
+                        .fonts()
+                        .iter()
+                        .filter_map(|font| match font.source().kind() {
+                            SourceKind::Path(path) => Some(path.to_path_buf()),
+                            SourceKind::Memory(_) => None,
+                        })
+                        .collect::<Vec<_>>()
+                })
+                .collect();
+            files.sort();
+            files.dedup();
+            files
+        })
+    }
+}
+
+#[cfg(not(all(feature = "system", not(target_arch = "wasm32"))))]
+mod imp {
+    use std::path::PathBuf;
+
+    pub fn font_files(_refresh: bool) -> Vec<PathBuf> {
+        Vec::new()
+    }
+}
+
+#[cfg(all(feature = "system", not(target_arch = "wasm32")))]
+/// The process's fontique collection of the system's fonts and the font store's, built on the
+/// first call (which waits for the enumeration; later calls are cheap clones that share it).
+/// Clones taken before a rescan keep the fonts as they were: compare [`generation`] to know when
+/// to take a new one.
+pub fn collection() -> fontique::Collection {
+    imp::collection()
+}
+
+#[cfg(all(feature = "system", not(target_arch = "wasm32")))]
+/// Counts the builds of [`collection`]: 0 before the first, one more after each rescan that asked
+/// the font service again.
+pub fn generation() -> u64 {
+    imp::generation()
+}
+
+#[cfg(all(feature = "system", not(target_arch = "wasm32")))]
+/// Enumerate the system's fonts again (a catalog's [`crate::Catalog::rescan`] does this).
+pub fn refresh() {
+    imp::refresh();
+}
+
+/// The font files the platform's font service lists, enumerating again first with `refresh`.
+pub(crate) fn font_files(refresh: bool) -> Vec<std::path::PathBuf> {
+    imp::font_files(refresh)
+}
diff --git a/crates/font-catalog/src/tests.rs b/crates/font-catalog/src/tests.rs
new file mode 100644
index 00000000..1e1effc1
--- /dev/null
+++ b/crates/font-catalog/src/tests.rs
@@ -0,0 +1,500 @@
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, mpsc};
+use std::time::Duration;
+
+use write_fonts::FontBuilder;
+use write_fonts::tables::fvar::{AxisInstanceArrays, Fvar, InstanceRecord, VariationAxisRecord};
+use write_fonts::tables::name::{Name, NameRecord};
+use write_fonts::tables::os2::{Os2, SelectionFlags};
+use write_fonts::types::{Fixed, NameId, Tag};
+
+use crate::*;
+
+/// A test font: only the tables the catalog reads, and an empty `glyf` so it counts as drawable.
+#[derive(Clone)]
+struct Spec {
+    family: &'static str,
+    style: &'static str,
+    /// Legacy family and style (name IDs 1 and 2); the names above are then typographic.
+    legacy: Option<(&'static str, &'static str)>,
+    /// Japanese family name.
+    ja: Option<&'static str>,
+    weight: u16,
+    width: u16,
+    italic: bool,
+    fs_type: u16,
+    /// Named instances: style and `wght`; the font gets a `wght` axis from 100 to 900, default 400.
+    instances: Vec<(&'static str, f64)>,
+    outlines: bool,
+}
+
+fn spec(family: &'static str, style: &'static str, weight: u16) -> Spec {
+    Spec { family, style, legacy: None, ja: None, weight, width: 5, italic: false, fs_type: 0, instances: vec![], outlines: true }
+}
+
+fn font(s: &Spec) -> Vec<u8> {
+    let mut records = Vec::new();
+    let mut add = |lang: u16, id: u16, text: String| records.push(NameRecord::new(3, 1, lang, NameId::new(id), text.into()));
+    let ps = format!("{}-{}", s.family.replace(' ', ""), s.style.replace(' ', ""));
+    match s.legacy {
+        Some((family, style)) => {
+            add(0x409, 1, family.into());
+            add(0x409, 2, style.into());
+            add(0x409, 16, s.family.into());
+            add(0x409, 17, s.style.into());
+        }
+        None => {
+            add(0x409, 1, s.family.into());
+            add(0x409, 2, s.style.into());
+        }
+    }
+    add(0x409, 4, format!("{} {}", s.family, s.style));
+    add(0x409, 6, ps);
+    if let Some(ja) = s.ja {
+        add(0x411, if s.legacy.is_some() { 16 } else { 1 }, ja.into());
+    }
+    let mut instances = Vec::new();
+    for (next_id, (style, wght)) in (256..).zip(&s.instances) {
+        add(0x409, next_id, (*style).into());
+        instances.push(InstanceRecord {
+            subfamily_name_id: NameId::new(next_id),
+            flags: 0,
+            coordinates: vec![Fixed::from_f64(*wght)],
+            post_script_name_id: None,
+        });
+    }
+    records.sort_by_key(|r| (r.platform_id, r.encoding_id, r.language_id, r.name_id));
+    let mut builder = FontBuilder::new();
+    builder.add_table(&Name::new(records)).unwrap();
+    let os2 = Os2 {
+        us_weight_class: s.weight,
+        us_width_class: s.width,
+        fs_type: s.fs_type,
+        fs_selection: if s.italic { SelectionFlags::ITALIC } else { SelectionFlags::REGULAR },
+        ul_code_page_range_1: Some(1),
+        ul_code_page_range_2: Some(0),
+        ..Default::default()
+    };
+    builder.add_table(&os2).unwrap();
+    if !instances.is_empty() {
+        let axis = VariationAxisRecord {
+            axis_tag: Tag::new(b"wght"),
+            min_value: Fixed::from_f64(100.0),
+            default_value: Fixed::from_f64(400.0),
+            max_value: Fixed::from_f64(900.0),
+            flags: 0,
+            axis_name_id: NameId::new(255),
+        };
+        builder.add_table(&Fvar::new(AxisInstanceArrays::new(vec![axis], instances))).unwrap();
+    }
+    if s.outlines {
+        builder.add_raw(Tag::new(b"glyf"), vec![0u8; 4]);
+    }
+    builder.build()
+}
+
+/// A font collection of `fonts`: their table directories, with offsets moved to the new file.
+fn collection(fonts: &[Vec<u8>]) -> Vec<u8> {
+    let header = 12 + 4 * fonts.len();
+    let mut out = Vec::new();
+    out.extend_from_slice(b"ttcf");
+    out.extend_from_slice(&0x0001_0000u32.to_be_bytes());
+    out.extend_from_slice(&(fonts.len() as u32).to_be_bytes());
+    let mut base = header;
+    let mut bodies = Vec::new();
+    for f in fonts {
+        out.extend_from_slice(&(base as u32).to_be_bytes());
+        let mut f = f.clone();
+        let tables = u16::from_be_bytes([f[4], f[5]]) as usize;
+        for t in 0..tables {
+            let at = 12 + 16 * t + 8;
+            let offset = u32::from_be_bytes(f[at..at + 4].try_into().unwrap()) + base as u32;
+            f[at..at + 4].copy_from_slice(&offset.to_be_bytes());
+        }
+        base += f.len();
+        bodies.push(f);
+    }
+    for b in bodies {
+        out.extend(b);
+    }
+    out
+}
+
+fn temp(name: &str) -> PathBuf {
+    static N: AtomicUsize = AtomicUsize::new(0);
+    let d = std::env::temp_dir().join(format!("craft-font-catalog-{name}-{}-{}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+fn write(path: &Path, data: impl AsRef<[u8]>) {
+    std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+    std::fs::write(path, data).unwrap();
+}
+
+/// A Linux system under `root` with no fontconfig configuration and no other XDG folders.
+fn linux_env(root: &Path) -> FontEnv {
+    FontEnv {
+        os: Os::Unix,
+        root: root.to_path_buf(),
+        home: Some(root.join("home")),
+        xdg_data_dirs: Some(root.join("share").into_os_string()),
+        ..Default::default()
+    }
+}
+
+#[test]
+fn linux_font_dirs_cover_xdg_flatpak_and_fontconfig() {
+    let root = temp("dirs");
+    write(&root.join("etc/fonts/fonts.conf"), "<fontconfig><dir>/opt/texmf/fonts</dir><dir>/usr/share/fonts</dir></fontconfig>");
+    let mut env = linux_env(&root);
+    env.xdg_data_home = Some(root.join("data"));
+    let dirs = font_dirs(&env);
+    let want: Vec<PathBuf> = vec![
+        root.join("usr/share/fonts"),
+        root.join("usr/local/share/fonts"),
+        root.join("run/host/fonts"),
+        root.join("run/host/local-fonts"),
+        root.join("run/host/user-fonts"),
+        root.join("home/.local/share/fonts"),
+        root.join("home/.fonts"),
+        root.join("data/fonts"),
+        root.join(root.join("share").strip_prefix("/").unwrap()).join("fonts"),
+        root.join("opt/texmf/fonts"),
+    ];
+    assert_eq!(dirs, want);
+}
+
+#[test]
+fn fontconfig_dirs_follow_includes_prefixes_and_skip_the_rest() {
+    let root = temp("conf");
+    let etc = root.join("etc/fonts");
+    write(
+        &etc.join("fonts.conf"),
+        r#"<?xml version="1.0"?>
+<fontconfig>
+  <!-- <dir>/commented/out</dir> -->
+  <dir>/sys/fonts</dir>
+  <dir prefix="xdg">fonts</dir>
+  <dir>~/.fonts</dir>
+  <cachedir>/var/cache/fontconfig</cachedir>
+  <dir prefix="relative">local-fonts</dir>
+  <dir salt="x">/a&amp;b/fonts</dir>
+  <include ignore_missing="yes">conf.d</include>
+  <include ignore_missing="yes">missing.conf</include>
+  <include>fonts.conf</include>
+</fontconfig>"#,
+    );
+    write(&etc.join("conf.d/60-remap.conf"), "<fontconfig><remap-dir as-path=\"/usr/share/fonts\">/remapped/fonts</remap-dir></fontconfig>");
+    write(&etc.join("conf.d/README"), "<dir>/not/a/conf/file</dir>");
+    write(&etc.join("conf.d/nodigit.conf"), "<fontconfig><dir>/no/digit</dir></fontconfig>");
+    write(&etc.join("b.conf"), "<fontconfig><include>fonts.conf</include><dir>/unclosed");
+    write(
+        &root.join("home/.config/fontconfig/fonts.conf"),
+        "<fontconfig><dir>/user/conf/fonts</dir><include>../../../etc/fonts/b.conf</include></fontconfig>",
+    );
+    let home = root.join("home");
+    assert_eq!(
+        fontconfig_dirs(&linux_env(&root)),
+        vec![
+            root.join("sys/fonts"),
+            home.join(".local/share/fonts"),
+            home.join(".fonts"),
+            etc.join("local-fonts"),
+            root.join("a&b/fonts"),
+            root.join("remapped/fonts"),
+            root.join("user/conf/fonts"),
+        ]
+    );
+}
+
+#[test]
+fn flatpak_adds_the_hosts_font_folders() {
+    let root = temp("flatpak");
+    write(&root.join("run/host/font-dirs.xml"), "<fontconfig><remap-dir as-path=\"/usr/share/fonts\">/run/host/fonts</remap-dir></fontconfig>");
+    write(&root.join("run/host/etc/fonts/fonts.conf"), "<fontconfig><dir>/usr/share/texmf/fonts</dir><dir>~/MyFonts</dir></fontconfig>");
+    let mut env = linux_env(&root);
+    assert!(fontconfig_dirs(&env).is_empty());
+    env.flatpak = true;
+    assert_eq!(fontconfig_dirs(&env), vec![root.join("run/host/fonts"), root.join("run/host/usr/share/texmf/fonts"), root.join("home/MyFonts")]);
+}
+
+#[test]
+fn macos_and_windows_folders() {
+    let root = temp("mac");
+    for asset in ["com_apple_MobileAsset_Font7/abc.asset", "com_apple_MobileAsset_Other/x"] {
+        std::fs::create_dir_all(root.join("System/Library/AssetsV2").join(asset)).unwrap();
+    }
+    let env = FontEnv { os: Os::MacOs, root: root.clone(), home: Some("/Users/me".into()), ..Default::default() };
+    let dirs = font_dirs(&env);
+    assert!(dirs.contains(&root.join("System/Library/Fonts")));
+    assert!(dirs.contains(&PathBuf::from("/Users/me/Library/Fonts")));
+    assert!(dirs.contains(&root.join("System/Library/AssetsV2/com_apple_MobileAsset_Font7")));
+    assert!(!dirs.iter().any(|d| d.ends_with("com_apple_MobileAsset_Other")));
+    assert_eq!(font_store_dir(&env), Some(PathBuf::from("/Users/me/Library/Application Support/Craft Fonts")));
+
+    let env = FontEnv {
+        os: Os::Windows,
+        windir: Some("C:\\Windows".into()),
+        local_app_data: Some("C:\\Users\\me\\AppData\\Local".into()),
+        ..Default::default()
+    };
+    assert_eq!(
+        font_dirs(&env),
+        vec![PathBuf::from("C:\\Windows").join("Fonts"), PathBuf::from("C:\\Users\\me\\AppData\\Local").join("Microsoft\\Windows\\Fonts")]
+    );
+    assert_eq!(font_store_dir(&env), Some(PathBuf::from("C:\\Users\\me\\AppData\\Local").join("Craft Fonts")));
+    assert_eq!(office_font_dirs(&env).len(), 1);
+}
+
+#[test]
+fn font_store_folder() {
+    let env = FontEnv { os: Os::Unix, home: Some("/home/me".into()), ..Default::default() };
+    assert_eq!(font_store_dir(&env), Some(PathBuf::from("/home/me/.local/share/craft-fonts")));
+    let env = FontEnv { xdg_data_home: Some("/data".into()), ..env };
+    assert_eq!(font_store_dir(&env), Some(PathBuf::from("/data/craft-fonts")));
+    let env = FontEnv { font_store: Some("/portable/fonts".into()), ..env };
+    assert_eq!(font_store_dir(&env), Some(PathBuf::from("/portable/fonts")));
+    assert_eq!(font_store_dir(&FontEnv { os: Os::None, home: Some("/h".into()), ..Default::default() }), None);
+}
+
+/// A Linux system with fonts in a system folder, the Flatpak host folder, the user's folder and
+/// the font store, plus a collection, a lister's file without an extension, and files that aren't
+/// fonts.
+fn system(root: &Path) -> Arc<Catalog> {
+    let sys = root.join("usr/share/fonts/test");
+    write(&sys.join("TestSans-Regular.ttf"), font(&spec("Test Sans", "Regular", 400)));
+    write(&sys.join("TestSans-Bold.ttf"), font(&spec("Test Sans", "Bold", 700)));
+    write(&sys.join("TestSans-Italic.TTF"), font(&Spec { italic: true, ..spec("Test Sans", "Italic", 400) }));
+    write(&sys.join("TestSans-Light.ttf"), font(&Spec { legacy: Some(("Test Sans Light", "Regular")), ..spec("Test Sans", "Light", 300) }));
+    write(&sys.join("TestSans-Condensed.ttf"), font(&Spec { width: 3, ..spec("Test Sans", "Condensed", 400) }));
+    write(&sys.join("Bitmap.ttf"), font(&Spec { outlines: false, ..spec("Bitmap Only", "Regular", 400) }));
+    write(&sys.join("damaged.otf"), b"OTTO\0\x10garbage");
+    write(&sys.join("notes.txt"), font(&spec("Not Scanned", "Regular", 400)));
+    write(
+        &root.join("run/host/fonts/HostSerif.ttc"),
+        collection(&[font(&spec("Host Serif", "Regular", 400)), font(&spec("Host Serif", "Bold", 700))]),
+    );
+    write(
+        &root.join("home/.local/share/fonts/Gothic.otf"),
+        font(&Spec { legacy: Some(("Test Gothic W3", "Regular")), ja: Some("テストゴシック"), ..spec("Test Gothic", "W3", 300) }),
+    );
+    write(
+        &root.join("home/.local/share/fonts/Variable.ttf"),
+        font(&Spec { instances: vec![("Regular", 400.0), ("Thin", 100.0), ("Black", 900.0)], ..spec("Test Variable", "Regular", 400) }),
+    );
+    write(&root.join("home/.local/share/craft-fonts/Store/StoreFace.ttf"), font(&spec("Store Face", "Regular", 400)));
+    let service = root.join("service/.hidden/f1");
+    write(&service, font(&Spec { fs_type: 2, ..spec("Service Font", "Regular", 400) }));
+    Arc::new(Catalog::new(linux_env(root)).with_font_service(false).with_lister(Arc::new(move || vec![service.clone()])))
+}
+
+#[test]
+fn a_scan_finds_folders_store_lister_files_and_collections() {
+    let root = temp("scan");
+    let cat = system(&root);
+    cat.scan_in_background();
+    let families: Vec<String> = cat.families().to_vec();
+    assert_eq!(families, ["Host Serif", "Service Font", "Store Face", "Test Gothic", "Test Sans", "Test Variable"]);
+    assert!(cat.is_ready());
+    let host = cat.styles("host serif");
+    assert_eq!(host.iter().map(|f| (f.style.as_str(), f.index)).collect::<Vec<_>>(), [("Regular", 0), ("Bold", 1)]);
+    assert_eq!(cat.styles("Store Face")[0].source, Source::Store);
+    assert_eq!(host[0].source, Source::System);
+    let service = &cat.styles("Service Font")[0];
+    assert_eq!((service.source, service.fs_type), (Source::System, 2));
+    assert_eq!(cat.styles("Test Sans").len(), 5);
+    let light = cat.resolve("Test Sans", "Light").unwrap().0;
+    assert_eq!((light.legacy_family.as_deref(), light.legacy_style.as_deref()), (Some("Test Sans Light"), Some("Regular")));
+    assert_eq!(light.code_pages, [1, 0]);
+}
+
+#[test]
+fn lookup_by_every_name_kind() {
+    let root = temp("lookup");
+    let cat = system(&root);
+    let found = |name: &str, style: &str| cat.resolve(name, style).map(|(f, m)| (f.family, f.style, m));
+    let exact = |family: &str, style: &str| Some((family.to_string(), style.to_string(), Match::Exact));
+    let nearest = |family: &str, style: &str| Some((family.to_string(), style.to_string(), Match::NearestStyle));
+    assert_eq!(found("TEST SANS", "bold"), exact("Test Sans", "Bold"));
+    assert_eq!(found("Test Sans", ""), exact("Test Sans", "Regular"));
+    // Nearest weight, italic differing costing more than any weight.
+    assert_eq!(found("Test Sans", "Semibold"), nearest("Test Sans", "Bold"));
+    assert_eq!(found("Test Sans", "Bold Italic"), nearest("Test Sans", "Italic"));
+    assert_eq!(found("Test Sans", "Thin"), nearest("Test Sans", "Light"));
+    // Equal weights: the nearest width.
+    assert_eq!(found("Test Sans", "Book Condensed"), nearest("Test Sans", "Condensed"));
+    // A legacy family with its legacy style, a localized family, full and PostScript names.
+    assert_eq!(found("Test Sans Light", "Regular"), exact("Test Sans", "Light"));
+    assert_eq!(found("Test Gothic W3", "Regular"), exact("Test Gothic", "W3"));
+    assert_eq!(found("テストゴシック", "W3"), exact("Test Gothic", "W3"));
+    assert_eq!(cat.family("testgothic"), Some("Test Gothic".into()));
+    assert_eq!(found("Test Sans Bold", ""), exact("Test Sans", "Bold"));
+    assert_eq!(found("TestSans-Bold", "Regular"), exact("Test Sans", "Bold"));
+    assert_eq!(cat.by_postscript_name("TestSans-Italic").map(|f| f.style), Some("Italic".into()));
+    // Named instances: by style, by their PostScript names, and the default instance names the face.
+    let thin = cat.resolve("Test Variable", "Thin").unwrap().0;
+    assert_eq!((thin.weight, thin.variations.clone()), (100.0, vec![(*b"wght", 100.0)]));
+    assert_eq!(cat.by_postscript_name("TestVariable-Black").map(|f| f.weight), Some(900.0));
+    assert_eq!(cat.styles("Test Variable").len(), 3);
+    assert_eq!(found("Missing Family", "Regular"), None);
+    assert_eq!(cat.by_postscript_name("Missing-Regular"), None);
+}
+
+#[test]
+fn installed_and_removed_fonts_are_seen_without_a_restart() {
+    let root = temp("rescan");
+    let cat = system(&root);
+    assert!(!cat.installed_fonts_changed());
+    assert!(cat.family("Test Sans").is_some());
+    let generation = cat.generation();
+    assert!(!cat.installed_fonts_changed());
+    let (tx, rx) = mpsc::channel();
+    let _watch = cat.watch(Duration::from_millis(20), move |c| {
+        let _ = tx.send((c.family("New Face"), c.family("Later")));
+    });
+    write(&root.join("usr/share/fonts/test/new/NewFace.otf"), font(&spec("New Face", "Regular", 400)));
+    assert_eq!(rx.recv_timeout(Duration::from_secs(10)).unwrap(), (Some("New Face".into()), None));
+    assert!(cat.generation() > generation);
+    // A font store install, then a removal.
+    write(&root.join("home/.local/share/craft-fonts/Later.ttf"), font(&spec("Later", "Regular", 400)));
+    assert_eq!(rx.recv_timeout(Duration::from_secs(10)).unwrap(), (Some("New Face".into()), Some("Later".into())));
+    assert_eq!(cat.styles("Later")[0].source, Source::Store);
+    std::fs::remove_file(root.join("usr/share/fonts/test/new/NewFace.otf")).unwrap();
+    assert_eq!(rx.recv_timeout(Duration::from_secs(10)).unwrap(), (None, Some("Later".into())));
+}
+
+#[test]
+fn app_folders_are_scanned_after_a_change() {
+    let root = temp("app");
+    let cat = Catalog::new(linux_env(&root)).with_font_service(false);
+    assert!(cat.families().is_empty());
+    write(&root.join("app-fonts/AppFace.ttf"), font(&spec("App Face", "Regular", 400)));
+    cat.set_app_dirs(vec![root.join("app-fonts")]);
+    assert!(cat.rescan_if_changed());
+    assert_eq!(cat.styles("App Face")[0].source, Source::App);
+    assert!(!cat.rescan_if_changed());
+}
+
+#[test]
+fn a_family_loads_once_for_every_thread() {
+    let root = temp("load");
+    let cat = system(&root);
+    let loads: Vec<Arc<[LoadedFace]>> = std::thread::scope(|s| {
+        let threads: Vec<_> = (0..8).map(|_| s.spawn(|| cat.load_family("host serif"))).collect();
+        threads.into_iter().map(|t| t.join().unwrap()).collect()
+    });
+    assert!(loads.iter().all(|l| Arc::ptr_eq(l, &loads[0])));
+    let host = &loads[0];
+    assert_eq!(host.len(), 2);
+    // Both faces of the collection share its bytes.
+    assert!(Arc::ptr_eq(&host[0].data.bytes, &host[1].data.bytes));
+    assert_eq!(host[1].data.index, 1);
+    assert!(skrifa::FontRef::from_index(&host[1].data.bytes, 1).is_ok());
+    // Another family loads separately, and a rescan makes the next load read again.
+    assert_eq!(cat.load_family("Test Sans").len(), 5);
+    cat.rescan();
+    assert!(!Arc::ptr_eq(&cat.load_family("Host Serif"), &loads[0]));
+    assert!(cat.load_family("Missing").is_empty());
+}
+
+#[test]
+fn added_fonts_come_first_and_respect_the_limits() {
+    let root = temp("add");
+    let cat = system(&root);
+    let limits = Limits::default();
+    let doc = font(&spec("Test Sans", "Bold", 700));
+    let added = cat.add_bytes(doc.clone(), Source::Document, &limits).unwrap();
+    assert_eq!(added.len(), 1);
+    let (bold, m) = cat.resolve("Test Sans", "Bold").unwrap();
+    assert_eq!((bold.source, bold.path.clone(), m), (Source::Document, None, Match::Exact));
+    assert_eq!(&*cat.load(&bold).unwrap().bytes, doc.as_slice());
+    assert!(matches!(cat.add_bytes(b"not a font".to_vec(), Source::User, &limits), Err(FontFileError::NotAFont)));
+    let small = Limits { max_file_bytes: 10, ..limits };
+    assert!(matches!(cat.add_bytes(doc.clone(), Source::User, &small), Err(FontFileError::TooLarge { .. })));
+    let few = Limits { max_added_faces: 1, ..limits };
+    assert!(matches!(cat.add_bytes(font(&spec("User Face", "Regular", 400)), Source::User, &few), Err(FontFileError::TooManyFaces { max: 1 })));
+    let file = root.join("elsewhere/UserFace.ttf");
+    write(&file, font(&spec("User Face", "Regular", 400)));
+    let user = cat.add_file(&file, Source::User, &limits).unwrap();
+    assert_eq!(user[0].path.as_deref(), Some(file.as_path()));
+    // A rescan keeps added faces; removing a source's faces brings back the installed face.
+    cat.rescan();
+    assert_eq!(cat.styles("User Face").len(), 1);
+    assert_eq!(cat.remove_added(Source::Document), 1);
+    assert_eq!(cat.resolve("Test Sans", "Bold").unwrap().0.source, Source::System);
+    assert!(matches!(cat.load(&bold), Err(FontFileError::Gone)));
+}
+
+#[test]
+fn the_scan_reads_only_what_it_may() {
+    let root = temp("bounded");
+    let path = root.join("Big.ttf");
+    let mut data = font(&spec("Big Face", "Regular", 400));
+    data.resize(data.len() + (1 << 20), 0);
+    write(&path, &data);
+    assert_eq!(crate::scan::file_faces(&path, 1 << 16, Source::System).len(), 1);
+    assert!(crate::scan::file_faces(&path, 64, Source::System).is_empty());
+    // A collection claiming more faces than it has gives the faces it has.
+    let mut ttc = collection(&[font(&spec("A Face", "Regular", 400))]);
+    ttc[8..12].copy_from_slice(&u32::MAX.to_be_bytes());
+    write(&root.join("Claims.ttc"), &ttc);
+    assert_eq!(crate::scan::file_faces(&root.join("Claims.ttc"), u64::MAX, Source::System).len(), 1);
+}
+
+#[test]
+fn suitcase_resources_are_read() {
+    let fonts = vec![font(&spec("Suit A", "Regular", 400)), font(&spec("Suit B", "Bold", 700))];
+    let fork = fork_of(&fonts);
+    let found = crate::suitcase::sfnt_resources(&fork);
+    assert_eq!(found, fonts.iter().map(Vec::as_slice).collect::<Vec<_>>());
+    assert!(crate::suitcase::sfnt_resources(&fork[..300]).is_empty());
+}
+
+fn fork_of(fonts: &[Vec<u8>]) -> Vec<u8> {
+    let mut data = Vec::new();
+    let mut offsets = Vec::new();
+    for body in fonts.iter().map(Vec::as_slice).chain([&b"1.0"[..]]) {
+        offsets.push(data.len() as u32);
+        data.extend_from_slice(&(body.len() as u32).to_be_bytes());
+        data.extend_from_slice(body);
+    }
+    let n = fonts.len();
+    // The type list: `vers` (1 resource) then `sfnt`, each entry pointing at its references.
+    let list = 2 + 2 * 8;
+    let mut types = Vec::new();
+    types.extend_from_slice(&1u16.to_be_bytes());
+    types.extend_from_slice(b"vers");
+    types.extend_from_slice(&0u16.to_be_bytes());
+    types.extend_from_slice(&(list as u16).to_be_bytes());
+    types.extend_from_slice(b"sfnt");
+    types.extend_from_slice(&((n - 1) as u16).to_be_bytes());
+    types.extend_from_slice(&((list + 12) as u16).to_be_bytes());
+    let reference = |id: i16, offset: u32| {
+        let mut r = Vec::new();
+        r.extend_from_slice(&id.to_be_bytes());
+        r.extend_from_slice(&0xFFFFu16.to_be_bytes());
+        r.extend_from_slice(&offset.to_be_bytes());
+        r.extend_from_slice(&[0; 4]);
+        r
+    };
+    types.extend(reference(1, offsets[n]));
+    for (i, o) in offsets[..n].iter().enumerate() {
+        types.extend(reference(5000 + i as i16, *o));
+    }
+    // The map: a copy of the header, a handle, attributes, then the offsets of the lists.
+    let mut map = vec![0; 24];
+    map.extend_from_slice(&28u16.to_be_bytes());
+    map.extend_from_slice(&((28 + types.len()) as u16).to_be_bytes());
+    map.extend(types);
+    let mut fork = Vec::new();
+    for v in [256u32, 256 + data.len() as u32, data.len() as u32, map.len() as u32] {
+        fork.extend_from_slice(&v.to_be_bytes());
+    }
+    fork.resize(256, 0);
+    fork.extend(data);
+    fork.extend(map);
+    fork
+}
diff --git a/crates/font-manager/Cargo.toml b/crates/font-manager/Cargo.toml
new file mode 100644
index 00000000..1bc9834c
--- /dev/null
+++ b/crates/font-manager/Cargo.toml
@@ -0,0 +1,41 @@
+[package]
+name = "craft-font-manager"
+description = "Craft Font Manager as a library: search and filters over the font indexes (Google Fonts, Noto, user-added sources), installed fonts by family, the font store interface, and the egui panel the launcher and the standalone app show."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+
+[features]
+default = []
+# `FontsPanel`: the whole interface as one egui panel.
+egui = ["dep:egui", "dep:craft-ui", "dep:serde", "dep:log"]
+
+[dependencies]
+craft-font-catalog = { workspace = true }
+craft-i18n = { workspace = true }
+# The pinned built-in indexes compiled in, for browsing offline.
+craft-font-store = { workspace = true, features = ["bundled-index"] }
+# egui's default faces lead the interface font stack.
+egui = { workspace = true, features = ["default_fonts"], optional = true }
+# A host that wants installed fonts for characters its interface faces lack (language names in
+# their own scripts in the language filter) enables craft-ui's `system_fonts` itself.
+craft-ui = { workspace = true, optional = true }
+serde = { workspace = true, optional = true }
+log = { version = "0.4", optional = true }
+
+[dev-dependencies]
+egui_kittest = { version = "0.37", features = ["wgpu", "snapshot"] }
+# Real fonts for the fake font store to install: egui's own Hack and Ubuntu Light.
+epaint_default_fonts = "0.37"
+image = { version = "0.25", default-features = false, features = ["png"] }
+# The system's fonts for the Japanese and Arabic screenshots.
+egui_system_font_provider = "0.37"
+
+[[test]]
+name = "flows"
+required-features = ["egui"]
+
+[lints]
+workspace = true
diff --git a/crates/font-manager/README.md b/crates/font-manager/README.md
new file mode 100644
index 00000000..5a8086ad
--- /dev/null
+++ b/crates/font-manager/README.md
@@ -0,0 +1,95 @@
+# craft-font-manager
+
+Craft Font Manager as a library: every font the suite's apps can use, and the font collections to
+add to them: Google Fonts, Noto, and index URLs the user adds. ArtCraft Launcher shows it as its
+Fonts tab; the standalone app
+([aiongg/craft-font-manager](https://github.com/aiongg/craft-font-manager)) shows it as its window.
+
+| Part | Feature | What it does |
+|---|---|---|
+| `filter` | always | Search over the index: family names ignoring case and accents, category, language (English name, autonym or id) and script |
+| `index` | always | The pinned built-in indexes (Google Fonts and Noto) compiled into [`craft-font-store`](../font-store/README.md) (`bundled`), each family's source (`source_label`: its name and whether it is curated), and the categories |
+| `installed` | always | The installed fonts [`craft-font-catalog`](../font-catalog/README.md) sees, grouped by family and source |
+| `store` | always | `Installer`, what the interface needs from the font store: the download consent, install, remove, downloads for a preview, the indexes (`indexes`, `fetch_indexes`) and the sources the user added (`user_sources`, `add_user_source`, `remove_user_source`). `SuiteStore` is craft-font-store's store, `FakeStore` a stand-in for tests, `NoStore` one for when the store folder is unknown |
+| `FontsPanel` | `egui` | The whole interface as one egui panel |
+
+## The panel
+
+The layout follows Adobe Fonts' and Google Fonts' browse pages.
+
+- **Across the top**: Browse and Installed, with their counts, and one search field.
+- **Filters** at the reading start, each under its label: category, language (searchable by its
+  English name or its own, "Japanese · 日本語"), script, source, and installed or not; each option
+  with its count.
+- **Family cards**, one per row: the name, style count, category and source on one line with the
+  card's state at its end (Install and Preview, Installed, a progress bar while downloading,
+  Couldn't install with Retry, "Not curated" for a source the user added), and a large sample in
+  the face below. The list is virtual: only the cards on screen are laid out, and their faces load
+  as they come into view. The arrow keys step through the cards and Enter opens one.
+- **Sample toolbar**: a preset (a sentence in the language filtered by, or in the family's own
+  script when it has no Latin; the alphabet; numerals), the sample text, and the size.
+- **Details sheet** over the list: every style in its own face with Install or Remove for each,
+  Install all and Remove all, the source, designer, licence, scripts and languages, and what a
+  preview downloads.
+- **Installed**: system and font store fonts as the same cards, filtered by source. Only font
+  store families can be removed; system fonts are removed with the system's own tools.
+- **Sources** (`sources_ui`, for a host's settings page): the built-in sources, the index URLs the
+  user added, marked not curated and flagged when the file at their address changed since it was
+  added, adding one, and Update sources.
+
+`FontsPanel` fills the `Ui` it is given and has no window, menu or interface fonts of its own; the
+host's `Look` gives it the host's colours and font families. The faces it draws samples in are egui
+font families of its own, added a few per frame and taken out again past 64, without touching the
+host's fonts. Right-to-left interfaces mirror through `craft_ui::direction`; sample text keeps its
+own direction.
+
+```rust
+let catalog = Arc::clone(Catalog::global());
+catalog.scan_in_background();
+let installer: Arc<dyn Installer> = match SuiteStore::for_user(Arc::clone(&catalog)) {
+    Some(store) => Arc::new(store),
+    None => Arc::new(NoStore),
+};
+let index = installer.indexes().map_err(|e| e.to_string());
+let options = Options { catalog, installer, index, runner: Runner::Thread };
+let mut panel = FontsPanel::new(options, Settings::default());
+// each frame
+panel.ui(ui);
+```
+
+| Call | Use |
+|---|---|
+| `set_look(look)` | The host's palettes (dark and light) and font families, and whether labels are set in capitals |
+| `settings()`, `settings_mut()` | What the host saves: the sample text, preset and size, and whether the downloads note was closed (`serde`) |
+| `downloads_allowed()`, `set_downloads_allowed(on)` | The download consent, for a host's settings page. It is the font store's own setting, shared by every Craft app |
+| `show_downloads_switch(false)` | For a host with the switch in its own settings |
+| `sources_ui(ui)` | The font sources, for a host's settings page |
+| `set_index(index)` | The indexes, after the host fetched them |
+| `set_language(tag)` | The interface language, the host's own; English when its catalog isn't embedded |
+| `install_interface_fonts(ctx, craft_faces)` | For a host without interface fonts of its own (the standalone app): craft-ui's font stack for the panel's language, craft-fonts' faces the app embeds with craft-fonts-build, and the interface direction |
+
+## Network use
+
+Nothing is downloaded until the user allows it. Downloads are off by default; the first Install or
+Preview asks first. Files come from each source's repositories at the commit or tag its index
+records, through jsDelivr (raw GitHub as the fallback), and each is checked against the index's
+size and sha256 before use. Previews stay in memory and are never installed. A source the user
+adds is an index at an https URL; its families are never curated.
+
+## Strings
+
+Every interface string goes through craft-i18n with the English text as the key. The panel embeds
+its own Japanese and Arabic catalogs (`src/panel/catalogs/`) until its rows are part of
+craft-i18n; style and weight names, licence names and product names stay in English.
+
+## Testing
+
+```sh
+cargo test -p craft-font-manager --all-features
+CRAFT_FONT_MANAGER_SNAPSHOTS=<dir> cargo test -p craft-font-manager --features egui --test flows screenshots -- --test-threads=1
+```
+
+`tests/flows.rs` drives the panel with `egui_kittest` against a small index, a font folder made per
+test and `FakeStore`. They install egui's Hack and Ubuntu Light faces into temporary folders. With
+`CRAFT_FONT_MANAGER_GOOGLE_FONTS=<google/fonts checkout>`, the fake store also "downloads" the
+index's files from the checkout, so screenshots show real previews.
diff --git a/crates/font-manager/src/filter.rs b/crates/font-manager/src/filter.rs
new file mode 100644
index 00000000..21a4f300
--- /dev/null
+++ b/crates/font-manager/src/filter.rs
@@ -0,0 +1,97 @@
+//! Searching the index: family names, category, language and script.
+
+use craft_i18n::Folder;
+
+use crate::index::{Category, Index, categories};
+
+/// What the catalogue shows.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Query {
+    /// Part of a family name, ignoring case and accents.
+    pub text: String,
+    pub category: Option<Category>,
+    /// A position in [`Index::languages`].
+    pub language: Option<usize>,
+    /// An ISO 15924 code.
+    pub script: Option<String>,
+}
+
+/// Search keys for one index, built once.
+pub struct Search {
+    folder: Folder,
+    families: Vec<String>,
+    /// Per language: its name, autonym and id, folded.
+    languages: Vec<String>,
+    /// Language positions sorted by name.
+    languages_by_name: Vec<usize>,
+    /// Script positions sorted by name.
+    scripts_by_name: Vec<usize>,
+}
+
+impl Search {
+    pub fn new(index: &Index) -> Search {
+        let folder = Folder::new("en");
+        let families = index.families().iter().map(|f| folder.key(&f.family)).collect();
+        let languages =
+            index.languages().iter().map(|l| folder.key(&format!("{}\n{}\n{}", l.name, l.autonym.as_deref().unwrap_or(""), l.id))).collect();
+        let mut languages_by_name: Vec<usize> = (0..index.languages().len()).collect();
+        languages_by_name.sort_by_cached_key(|&i| index.languages().get(i).map(|l| folder.key(&l.name)));
+        let mut scripts_by_name: Vec<usize> = (0..index.scripts().len()).collect();
+        scripts_by_name.sort_by_cached_key(|&i| index.scripts().get(i).map(|s| folder.key(&s.name)));
+        Search { folder, families, languages, languages_by_name, scripts_by_name }
+    }
+
+    /// The families `query` selects, as positions in [`Index::families`], in index order.
+    pub fn families(&self, index: &Index, query: &Query) -> Vec<usize> {
+        let text = self.folder.key(query.text.trim());
+        index
+            .families()
+            .iter()
+            .enumerate()
+            .filter(|(i, f)| {
+                (text.is_empty() || self.families.get(*i).is_some_and(|key| key.contains(&text)))
+                    && query.category.is_none_or(|c| categories(f).any(|fc| fc == c))
+                    && query.language.is_none_or(|l| f.languages.contains(&l))
+                    && query.script.as_ref().is_none_or(|s| f.scripts.contains(s))
+            })
+            .map(|(i, _)| i)
+            .collect()
+    }
+
+    /// Languages whose English name, autonym or id contains `text`, sorted by English name.
+    pub fn languages(&self, text: &str) -> Vec<usize> {
+        let text = self.folder.key(text.trim());
+        self.languages_by_name.iter().copied().filter(|&i| self.languages.get(i).is_some_and(|key| key.contains(&text))).collect()
+    }
+
+    /// Every script, sorted by English name.
+    pub fn scripts(&self) -> &[usize] {
+        &self.scripts_by_name
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn filters_combine() {
+        let index = crate::index::bundled().unwrap();
+        let search = Search::new(&index);
+        let names = |q: &Query| search.families(&index, q).into_iter().map(|i| index.families()[i].family.clone()).collect::<Vec<_>>();
+
+        let noto_jp = names(&Query { text: "noto sans jp".into(), ..Query::default() });
+        assert_eq!(noto_jp, ["Noto Sans JP"]);
+
+        let japanese = search.languages("日本語");
+        let ja = *japanese.first().unwrap();
+        assert_eq!(index.languages()[ja].id, "ja_Jpan");
+        let serif_ja = names(&Query { category: Some(Category::Serif), language: Some(ja), ..Query::default() });
+        assert!(serif_ja.contains(&"Noto Serif JP".to_owned()));
+        assert!(!serif_ja.contains(&"Noto Sans JP".to_owned()));
+
+        let arabic = names(&Query { script: Some("Arab".into()), ..Query::default() });
+        assert!(arabic.contains(&"Amiri".to_owned()));
+        assert!(!arabic.contains(&"Roboto".to_owned()));
+    }
+}
diff --git a/crates/font-manager/src/index.rs b/crates/font-manager/src/index.rs
new file mode 100644
index 00000000..bb958207
--- /dev/null
+++ b/crates/font-manager/src/index.rs
@@ -0,0 +1,70 @@
+//! The font indexes (aiongg/craft-font-index: Google Fonts, Noto, and sources the user adds), as
+//! craft-font-store reads them, and the categories the catalogue filters by.
+//!
+//! [`Index::families`] holds every source's families, sorted by name; a family's source is
+//! [`Index::source_of`] (its name, and whether it is curated: [`Family::is_curated`] is false for
+//! a source the user added). [`Index::problems`] lists the sources that couldn't be loaded.
+
+pub use craft_font_store::{Family, FontFile, FontSource, GOOGLE_FONTS, Index, IndexError, Language, Script, SourceProblem};
+
+/// The pinned built-in indexes compiled into craft-font-store, read without a request.
+pub fn bundled() -> Result<Index, IndexError> {
+    Index::bundled()
+}
+
+/// The display name of a family's source (`Google Fonts`, `Noto`), and whether it is curated.
+pub fn source_label<'a>(index: &'a Index, family: &'a Family) -> (&'a str, bool) {
+    index.source_of(family).map_or((family.source.as_str(), family.is_curated()), |s| (s.name.as_str(), s.curated))
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Category {
+    SansSerif,
+    Serif,
+    Display,
+    Handwriting,
+    Monospace,
+}
+
+impl Category {
+    /// The categories the filter offers, in Google Fonts' order.
+    pub const ALL: [Category; 5] = [Category::SansSerif, Category::Serif, Category::Display, Category::Handwriting, Category::Monospace];
+
+    /// The index's name for it (`SANS_SERIF`).
+    pub fn of(name: &str) -> Option<Category> {
+        match name {
+            "SANS_SERIF" => Some(Category::SansSerif),
+            "SERIF" => Some(Category::Serif),
+            "DISPLAY" => Some(Category::Display),
+            "HANDWRITING" => Some(Category::Handwriting),
+            "MONOSPACE" => Some(Category::Monospace),
+            _ => None,
+        }
+    }
+}
+
+/// A family's categories that this version knows.
+pub fn categories(family: &Family) -> impl Iterator<Item = Category> + '_ {
+    family.categories.iter().filter_map(|c| Category::of(c))
+}
+
+pub fn script_name<'a>(index: &'a Index, id: &str) -> Option<&'a str> {
+    index.scripts().iter().find(|s| s.id == id).map(|s| s.name.as_str())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn bundled_index_reads() {
+        let index = bundled().unwrap();
+        assert!(index.families().len() > 1000);
+        let roboto = index.family("roboto").unwrap();
+        assert_eq!(categories(roboto).collect::<Vec<_>>(), [Category::SansSerif]);
+        assert_eq!(script_name(&index, "Arab"), Some("Arabic"));
+        assert_eq!(source_label(&index, roboto), ("Google Fonts", true));
+        let cjk = index.family("Noto Sans CJK JP").unwrap();
+        assert_eq!(source_label(&index, cjk), ("Noto", true));
+    }
+}
diff --git a/crates/font-manager/src/installed.rs b/crates/font-manager/src/installed.rs
new file mode 100644
index 00000000..d9b2dd22
--- /dev/null
+++ b/crates/font-manager/src/installed.rs
@@ -0,0 +1,38 @@
+//! The installed fonts the catalog sees, grouped by family.
+
+use craft_font_catalog::{FaceInfo, Source};
+
+/// One family from one source: a family installed on the system and in the font store is two
+/// entries, since only the store's can be removed.
+#[derive(Clone, Debug)]
+pub struct InstalledFamily {
+    pub name: String,
+    pub source: Source,
+    /// Upright before italic, then by weight and width.
+    pub faces: Vec<FaceInfo>,
+}
+
+impl InstalledFamily {
+    pub fn removable(&self) -> bool {
+        self.source == Source::Store
+    }
+}
+
+/// System and font store faces by family, sorted by name ignoring case. Fonts other sources
+/// add (documents, the app's own) are left out.
+pub fn group(faces: &[FaceInfo]) -> Vec<InstalledFamily> {
+    let mut families: Vec<InstalledFamily> = Vec::new();
+    let mut sorted: Vec<&FaceInfo> = faces.iter().filter(|f| matches!(f.source, Source::System | Source::Store)).collect();
+    sorted.sort_by_cached_key(|f| (f.family.to_lowercase(), f.source == Source::Store));
+    for face in sorted {
+        match families.last_mut() {
+            Some(last) if last.source == face.source && last.name.eq_ignore_ascii_case(&face.family) => last.faces.push(face.clone()),
+            _ => families.push(InstalledFamily { name: face.family.clone(), source: face.source, faces: vec![face.clone()] }),
+        }
+    }
+    for family in &mut families {
+        family.faces.sort_by(|a, b| (a.italic, a.weight, a.width).partial_cmp(&(b.italic, b.weight, b.width)).unwrap_or(std::cmp::Ordering::Equal));
+        family.faces.dedup_by(|a, b| a.path == b.path && a.index == b.index && a.variations == b.variations);
+    }
+    families
+}
diff --git a/crates/font-manager/src/lib.rs b/crates/font-manager/src/lib.rs
new file mode 100644
index 00000000..b8582347
--- /dev/null
+++ b/crates/font-manager/src/lib.rs
@@ -0,0 +1,23 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+//! Craft Font Manager as a library: the bundled font indexes and searching them, the installed
+//! fonts by family, and the font store interface installs and removals go through.
+//!
+//! With the `egui` feature, [`FontsPanel`] is the whole interface as one panel that fills the `Ui`
+//! it is given, with no window, menu or eframe of its own, so ArtCraft Launcher can show it as its
+//! Fonts tab and the standalone app as its window. The host passes in the catalog, the store and
+//! the index ([`Options`]), saves [`Settings`], and reads or sets the download consent through the
+//! panel.
+
+pub mod filter;
+pub mod index;
+pub mod installed;
+pub mod store;
+
+#[cfg(feature = "egui")]
+mod panel;
+
+pub use craft_font_catalog;
+pub use craft_font_catalog::{Catalog, FaceInfo, FontEnv, Source};
+#[cfg(feature = "egui")]
+pub use panel::{FontsPanel, Look, Options, Palette, Preset, Runner, Settings, Tab, install_interface_fonts};
diff --git a/crates/font-manager/src/panel/app.rs b/crates/font-manager/src/panel/app.rs
new file mode 100644
index 00000000..66fd9b5a
--- /dev/null
+++ b/crates/font-manager/src/panel/app.rs
@@ -0,0 +1,731 @@
+//! The panel's state, what the host calls, and the frame: the tabs and search across the top,
+//! the filters at the reading start, the family cards, and the details sheet over them.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use crate::craft_font_catalog::{FontEnv, Limits, Os};
+use crate::filter::{Query, Search};
+use crate::index::{Category, Family, Index, categories, source_label};
+use crate::installed::{InstalledFamily, group};
+use crate::store::{Installer, RemoveRequest, StoreError};
+use crate::{Catalog, FaceInfo, Source};
+use craft_i18n::Folder;
+use craft_ui::direction;
+use craft_ui::fonts::{CraftFace, I18nScripts, UiFonts};
+use egui::{CentralPanel, Context, Frame, Margin, Panel, Ui};
+
+use crate::panel::faces::FaceFonts;
+use crate::panel::i18n::{self, I18N, LANGUAGES, fmt, tl};
+use crate::panel::jobs::{Finished, Jobs, Kind, Request, Runner};
+use crate::panel::look::{Look, Palette};
+use crate::panel::samples;
+use crate::panel::widgets::{self, Skin};
+
+/// Installs the standalone app's interface fonts in `ctx` and sets the interface direction: craft-ui's
+/// font stack for the panel's interface language, with `craft_faces` (craft-fonts' faces the app
+/// embeds with craft-fonts-build, or none) and the system's fonts for every other character. A host
+/// with its own fonts doesn't call it.
+pub fn install_interface_fonts(ctx: &Context, craft_faces: &[CraftFace]) {
+    let language = I18N.code(i18n::current()).to_owned();
+    UiFonts::new(&I18nScripts).languages(LANGUAGES).ui_language(&language).craft_faces(craft_faces).install(ctx);
+    direction::apply(ctx, direction::resolve(&language, direction::Setting::Language));
+}
+
+/// Preview downloads: at most this much per file, and this many faces in a session.
+const PREVIEW_LIMITS: Limits = Limits { max_file_bytes: 64 << 20, max_faces_per_file: 512, max_added_faces: 20_000 };
+
+/// How often the download consent is read again from the store's settings file, which another
+/// Craft app can change.
+const CONSENT_RECHECK_SECS: f64 = 3.0;
+
+/// What a sample shows when the user hasn't typed one.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub enum Preset {
+    /// A sentence in the language filtered by, or in the family's own script.
+    #[default]
+    Sentence,
+    Alphabet,
+    Numerals,
+}
+
+/// What the app keeps between runs.
+#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(default)]
+pub struct Settings {
+    /// The sample text; empty for the preset.
+    pub sample: String,
+    pub preset: Preset,
+    pub size: f32,
+    /// The user closed the note that downloads are off.
+    pub hide_download_note: bool,
+}
+
+impl Default for Settings {
+    fn default() -> Self {
+        Settings { sample: String::new(), preset: Preset::Sentence, size: 36.0, hide_download_note: false }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Tab {
+    Installed,
+    Catalogue,
+}
+
+/// Which catalogue families show by install state.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub(crate) enum Show {
+    #[default]
+    All,
+    Installed,
+    NotInstalled,
+}
+
+/// Which installed families show by where they come from.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub(crate) enum Origin {
+    #[default]
+    All,
+    System,
+    Store,
+}
+
+/// What the Installed tab's list was worked out for: the search, the source and the catalog's
+/// generation.
+type InstalledFilter = (String, Origin, Option<u64>);
+
+/// What the app is built from; tests pass their own catalog, store and index.
+pub struct Options {
+    pub catalog: Arc<Catalog>,
+    pub installer: Arc<dyn Installer>,
+    /// The Google Fonts index, or why it couldn't be read.
+    pub index: Result<Index, String>,
+    pub runner: Runner,
+}
+
+/// A download, waiting for the user's consent or to be tried again.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum Pending {
+    Install(usize),
+    /// One file of a family, by its path in the index.
+    InstallFile(usize, String),
+    Preview(usize),
+}
+
+impl Pending {
+    pub(crate) fn family(&self) -> usize {
+        match self {
+            Pending::Install(i) | Pending::InstallFile(i, _) | Pending::Preview(i) => *i,
+        }
+    }
+}
+
+/// The family the details sheet shows.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum Detail {
+    /// A family of the index, by position.
+    Family(usize),
+    /// An installed family, by name and source.
+    Installed(String, Source),
+}
+
+/// Why the last job for a family failed, and what Retry runs.
+#[derive(Clone, Debug)]
+pub(crate) struct Failure {
+    pub kind: Kind,
+    pub error: String,
+    pub retry: Option<Pending>,
+}
+
+pub(crate) struct Catalogue {
+    pub index: Arc<Index>,
+    pub search: Search,
+}
+
+pub struct FontsPanel {
+    pub(crate) settings: Settings,
+    pub(crate) tab: Tab,
+    pub(crate) look: Look,
+    pub(crate) skin: Skin,
+    /// The panel shows its own download switch; off when the host has one in its settings.
+    pub(crate) downloads_switch: bool,
+    pub(crate) catalog: Arc<Catalog>,
+    pub(crate) installer: Arc<dyn Installer>,
+    pub(crate) catalogue: Result<Catalogue, String>,
+    pub(crate) query: Query,
+    pub(crate) show: Show,
+    pub(crate) results: Vec<usize>,
+    results_for: Option<(Query, Show, Option<String>, Option<u64>)>,
+    /// Only this source's families (a source ID).
+    pub(crate) source: Option<String>,
+    /// Families per source, in [`Index::sources`] order, for the other filters as set.
+    pub(crate) source_counts: Vec<usize>,
+    /// The indexes being downloaded again (the sources' Update).
+    sources_job: Option<std::sync::mpsc::Receiver<Result<Index, StoreError>>>,
+    /// What the Sources settings show: the URL being typed, and the last problem.
+    pub(crate) source_url: String,
+    pub(crate) source_message: Option<(bool, String)>,
+    /// Families per category (all first) and per install state, for the other filters as set.
+    pub(crate) category_counts: [usize; 6],
+    pub(crate) show_counts: [usize; 3],
+    pub(crate) language_text: String,
+    pub(crate) installed: Vec<InstalledFamily>,
+    /// Installed faces by lower-case family name, every source together.
+    pub(crate) installed_by_name: HashMap<String, Vec<FaceInfo>>,
+    installed_generation: Option<u64>,
+    pub(crate) installed_text: String,
+    pub(crate) origin: Origin,
+    /// [`FontsPanel::installed_shown`] and what it was worked out for.
+    installed_shown: (Vec<usize>, Option<InstalledFilter>),
+    pub(crate) detail: Option<Detail>,
+    /// Downloaded preview files, never installed.
+    pub(crate) previews: Arc<Catalog>,
+    pub(crate) previewed: HashMap<String, Vec<FaceInfo>>,
+    pub(crate) faces: FaceFonts,
+    pub(crate) jobs: Jobs,
+    pub(crate) asking: Option<Pending>,
+    /// By lower-case family name.
+    pub(crate) failed: HashMap<String, Failure>,
+    /// A problem that belongs to no family (the download setting couldn't be saved).
+    pub(crate) notice: Option<String>,
+    focused: bool,
+    pub(crate) folder: Folder,
+    /// The download consent as last read, and when.
+    consent: Option<(bool, f64)>,
+    /// The card that has (or is to get) the keyboard focus, by row.
+    pub(crate) focus_row: Option<usize>,
+    /// Bring the focused row into view on the next frame.
+    pub(crate) scroll_to_focus: bool,
+    /// Give the focus row the keyboard focus on the next frame.
+    pub(crate) move_focus: bool,
+    /// Focus the search field on the next frame.
+    pub(crate) focus_search: bool,
+}
+
+/// A family's key in the panel's state: families of the same name can come from two sources.
+/// A removal goes by name alone (`source` empty).
+pub(crate) fn family_key(source: &str, family: &str) -> String {
+    format!("{source}\n{}", family.to_lowercase())
+}
+
+/// The host of an https URL.
+fn url_host(url: &str) -> Option<&str> {
+    url.strip_prefix("https://")?.split(['/', '?', '#']).next().filter(|h| !h.is_empty())
+}
+
+pub(crate) fn category_name(c: Category) -> &'static str {
+    match c {
+        Category::SansSerif => tl!("Sans serif"),
+        Category::Serif => tl!("Serif"),
+        Category::Display => tl!("Display"),
+        Category::Handwriting => tl!("Handwriting"),
+        Category::Monospace => tl!("Monospace"),
+    }
+}
+
+pub(crate) fn source_name(s: Source) -> &'static str {
+    match s {
+        Source::Store => tl!("Font store"),
+        _ => tl!("System"),
+    }
+}
+
+/// The face closest to an upright regular.
+pub(crate) fn regular(faces: &[FaceInfo]) -> Option<&FaceInfo> {
+    faces.iter().min_by_key(|f| (f.italic, ((f.weight - 400.0).abs() * 10.0) as i64, ((f.width - 100.0).abs() * 10.0) as i64))
+}
+
+pub(crate) fn style_name(face: &FaceInfo) -> &str {
+    if face.style.is_empty() { tl!("Regular") } else { &face.style }
+}
+
+/// How many styles a family of the index has: each static file one, a variable file one per
+/// hundred of weight its `wght` axis covers.
+pub(crate) fn style_count(family: &Family) -> usize {
+    family
+        .files
+        .iter()
+        .map(|f| match f.axes.iter().find(|a| a.tag == "wght") {
+            Some(a) => ((a.min / 100.0).ceil() as usize..=(a.max / 100.0).floor() as usize).count().max(1),
+            None => 1,
+        })
+        .sum()
+}
+
+pub(crate) fn category_label(family: &Family) -> String {
+    categories(family).map(category_name).collect::<Vec<_>>().join(", ")
+}
+
+impl FontsPanel {
+    pub fn new(options: Options, settings: Settings) -> FontsPanel {
+        let catalogue = options.index.map(|index| Catalogue { search: Search::new(&index), index: Arc::new(index) });
+        let previews = Arc::new(Catalog::new(FontEnv { os: Os::None, ..FontEnv::default() }).with_font_service(false));
+        let look = Look::default();
+        FontsPanel {
+            settings,
+            tab: Tab::Catalogue,
+            skin: Skin { p: Palette::from_visuals(&egui::Visuals::dark()), look: look.clone() },
+            look,
+            downloads_switch: true,
+            catalog: options.catalog,
+            installer: options.installer,
+            catalogue,
+            query: Query::default(),
+            show: Show::All,
+            results: Vec::new(),
+            results_for: None,
+            source: None,
+            source_counts: Vec::new(),
+            sources_job: None,
+            source_url: String::new(),
+            source_message: None,
+            category_counts: [0; 6],
+            show_counts: [0; 3],
+            language_text: String::new(),
+            installed: Vec::new(),
+            installed_by_name: HashMap::new(),
+            installed_generation: None,
+            installed_text: String::new(),
+            origin: Origin::All,
+            installed_shown: (Vec::new(), None),
+            detail: None,
+            previews,
+            previewed: HashMap::new(),
+            faces: FaceFonts::default(),
+            jobs: Jobs::new(options.runner),
+            asking: None,
+            failed: HashMap::new(),
+            notice: None,
+            focused: true,
+            folder: Folder::new("en"),
+            consent: None,
+            focus_row: None,
+            scroll_to_focus: false,
+            move_focus: false,
+            focus_search: false,
+        }
+    }
+
+    /// Shows `index` (after the host fetched the sources, say). The details sheet closes, as
+    /// family positions change.
+    pub fn set_index(&mut self, index: Result<Index, String>) {
+        self.catalogue = index.map(|index| Catalogue { search: Search::new(&index), index: Arc::new(index) });
+        self.results_for = None;
+        self.detail = None;
+        self.asking = None;
+        self.focus_row = None;
+        if let Ok(c) = &self.catalogue
+            && self.source.as_ref().is_some_and(|s| c.index.source(s).is_none())
+        {
+            self.source = None;
+        }
+    }
+
+    /// Reads the indexes again without a request: after a source was added or removed.
+    pub(crate) fn reload_index(&mut self) {
+        let index = self.installer.indexes().map_err(|e| e.0);
+        self.set_index(index);
+    }
+
+    /// Downloads every source's index again on a worker thread, when downloads are allowed.
+    pub(crate) fn fetch_sources(&mut self, ctx: &Context) {
+        if self.sources_job.is_some() || !self.downloads_allowed() {
+            return;
+        }
+        let (tx, rx) = std::sync::mpsc::channel();
+        let installer = Arc::clone(&self.installer);
+        let ctx = ctx.clone();
+        let spawned = std::thread::Builder::new().name("font-sources".into()).spawn(move || {
+            let _ = tx.send(installer.fetch_indexes());
+            ctx.request_repaint();
+        });
+        match spawned {
+            Ok(_) => self.sources_job = Some(rx),
+            Err(e) => self.source_message = Some((true, e.to_string())),
+        }
+    }
+
+    /// Whether the sources' indexes are being downloaded again.
+    pub fn fetching_sources(&self) -> bool {
+        self.sources_job.is_some()
+    }
+
+    pub(crate) fn poll_sources(&mut self) {
+        let Some(rx) = &self.sources_job else { return };
+        match rx.try_recv() {
+            Ok(Ok(index)) => {
+                self.sources_job = None;
+                self.source_message = None;
+                self.set_index(Ok(index));
+            }
+            Ok(Err(e)) => {
+                self.sources_job = None;
+                self.source_message = Some((true, e.0));
+            }
+            Err(std::sync::mpsc::TryRecvError::Empty) => {}
+            Err(std::sync::mpsc::TryRecvError::Disconnected) => self.sources_job = None,
+        }
+    }
+
+    /// Draws with the host's colours and font families.
+    pub fn set_look(&mut self, look: Look) {
+        self.look = look;
+    }
+
+    /// Whether the panel shows its own "Allow downloads" switch. A host with the switch in its
+    /// own settings turns it off; the panel still offers to allow downloads where one is needed.
+    pub fn show_downloads_switch(&mut self, show: bool) {
+        self.downloads_switch = show;
+    }
+
+    /// The panel's own settings, for the host to save.
+    pub fn settings(&self) -> &Settings {
+        &self.settings
+    }
+
+    pub fn settings_mut(&mut self) -> &mut Settings {
+        &mut self.settings
+    }
+
+    pub fn tab(&self) -> Tab {
+        self.tab
+    }
+
+    pub fn set_tab(&mut self, tab: Tab) {
+        self.tab = tab;
+        self.focus_row = None;
+    }
+
+    /// The installed families, as the Installed tab lists them.
+    pub fn installed(&self) -> &[InstalledFamily] {
+        &self.installed
+    }
+
+    /// The catalogue's families for the current search and filters.
+    pub fn results(&self) -> Vec<String> {
+        let Ok(c) = &self.catalogue else { return Vec::new() };
+        self.results.iter().filter_map(|&i| c.index.families().get(i)).map(|f| f.family.clone()).collect()
+    }
+
+    /// The family the details sheet shows.
+    pub fn details_family(&self) -> Option<String> {
+        match &self.detail {
+            Some(Detail::Family(i)) => self.catalogue.as_ref().ok()?.index.families().get(*i).map(|f| f.family.clone()),
+            Some(Detail::Installed(name, _)) => Some(name.clone()),
+            None => None,
+        }
+    }
+
+    /// Shows the interface in `language` (a tag such as `de` or `pt-BR`), the host's interface
+    /// language, when its catalog is embedded; English otherwise.
+    pub fn set_language(&mut self, language: &str) {
+        i18n::set_current(I18N.match_tag(language).unwrap_or(craft_i18n::Lang::EN));
+    }
+
+    /// Has the user allowed downloads from Google Fonts? A suite-wide setting of the font store,
+    /// off until they turn it on or confirm an install or preview.
+    pub fn downloads_allowed(&self) -> bool {
+        self.installer.downloads_allowed()
+    }
+
+    /// Turns downloads on or off, as the user's own action (a host's settings page, say). A
+    /// failure also shows in the panel.
+    pub fn set_downloads_allowed(&mut self, allowed: bool) -> Result<(), StoreError> {
+        let result = self.installer.allow_downloads(allowed);
+        self.consent = None;
+        self.notice = result.as_ref().err().map(|e| fmt("The download setting couldn't be saved: {error}", &[("error", &e.0)]));
+        result
+    }
+
+    /// The consent, read from the store at most every few seconds.
+    pub(crate) fn allowed(&mut self, now: f64) -> bool {
+        match self.consent {
+            Some((allowed, at)) if (0.0..CONSENT_RECHECK_SECS).contains(&(now - at)) => allowed,
+            _ => {
+                let allowed = self.installer.downloads_allowed();
+                self.consent = Some((allowed, now));
+                allowed
+            }
+        }
+    }
+
+    /// Draws the panel into `ui`, which it fills.
+    pub fn ui(&mut self, ui: &mut Ui) {
+        let ctx = ui.ctx().clone();
+        self.skin = Skin { p: self.look.palette(&ctx), look: self.look.clone() };
+        self.faces.begin_frame(&ctx);
+        self.poll_jobs();
+        let focused = ctx.input(|i| i.focused);
+        if focused && !self.focused {
+            if self.catalog.is_ready() {
+                self.catalog.rescan_if_changed();
+            }
+            self.consent = None;
+        }
+        self.focused = focused;
+        self.refresh_installed();
+        self.refresh_results();
+        self.keys(&ctx);
+
+        let area = ui.max_rect();
+        let p = self.skin.p;
+        let rtl = direction::is_rtl(ui);
+        let sides = |start: i8, end: i8| if rtl { (end, start) } else { (start, end) };
+        let top = Frame::new().fill(p.bg).inner_margin(Margin { left: 20, right: 20, top: 16, bottom: 14 });
+        Panel::top("craft-fonts.top").frame(top).resizable(false).show(ui, |ui| self.top_bar(ui));
+        let width = if area.width() < 860.0 { 212.0 } else { 248.0 };
+        let (left, right) = sides(20, 18);
+        let filters = Frame::new().fill(p.bg).inner_margin(Margin { left, right, top: 18, bottom: 12 });
+        direction::start_panel(ui, "craft-fonts.filters").frame(filters).resizable(false).exact_size(width).show(ui, |ui| self.sidebar(ui));
+        let main = Frame::new().fill(p.bg).inner_margin(Margin { left: 20, right: 20, top: 16, bottom: 0 });
+        CentralPanel::default().frame(main).show(ui, |ui| self.main(ui));
+        self.details(&ctx, area);
+        self.consent(&ctx);
+    }
+
+    fn keys(&mut self, ctx: &Context) {
+        let (find, escape) = ctx.input_mut(|i| (i.consume_key(egui::Modifiers::COMMAND, egui::Key::F), i.key_pressed(egui::Key::Escape)));
+        if find {
+            self.focus_search = true;
+        }
+        if escape && self.asking.is_none() && self.detail.is_some() {
+            self.detail = None;
+        }
+    }
+
+    fn poll_jobs(&mut self) {
+        for (job, result) in self.jobs.poll() {
+            let key = family_key(&job.source, &job.family);
+            match result {
+                Ok(Finished::Installed | Finished::Removed) => {
+                    self.failed.remove(&key);
+                }
+                Ok(Finished::Previewed(files)) => {
+                    self.failed.remove(&key);
+                    let mut faces = Vec::new();
+                    for file in files {
+                        match self.previews.add_bytes(file.bytes, Source::User, &PREVIEW_LIMITS) {
+                            Ok(added) => faces.extend(added),
+                            Err(e) => log::warn!("preview of {}: {e}", file.path),
+                        }
+                    }
+                    self.previewed.insert(key, faces);
+                }
+                Err(e) => {
+                    let position =
+                        self.catalogue.as_ref().ok().and_then(|c| {
+                            c.index.families().iter().position(|f| f.source == job.source && f.family.eq_ignore_ascii_case(&job.family))
+                        });
+                    let retry = position.and_then(|i| match job.kind {
+                        Kind::Install => Some(job.file.clone().map_or(Pending::Install(i), |path| Pending::InstallFile(i, path))),
+                        Kind::Preview => Some(Pending::Preview(i)),
+                        Kind::Remove => None,
+                    });
+                    log::warn!("{} ({:?}): {e}", job.family, job.kind);
+                    self.failed.insert(key, Failure { kind: job.kind, error: e.0, retry });
+                }
+            }
+        }
+        self.poll_sources();
+    }
+
+    fn refresh_installed(&mut self) {
+        if !self.catalog.is_ready() {
+            return;
+        }
+        let generation = self.catalog.generation();
+        if self.installed_generation == Some(generation) {
+            return;
+        }
+        self.installed_generation = Some(generation);
+        let faces = self.catalog.faces();
+        self.installed = group(&faces);
+        self.installed_by_name.clear();
+        for family in &self.installed {
+            self.installed_by_name.entry(family.name.to_lowercase()).or_default().extend(family.faces.iter().cloned());
+        }
+    }
+
+    fn refresh_results(&mut self) {
+        let Ok(c) = &self.catalogue else { return };
+        let key = (self.query.clone(), self.show, self.source.clone(), self.installed_generation);
+        if self.results_for.as_ref() == Some(&key) {
+            return;
+        }
+        let from = |i: usize, source: &Option<String>| source.as_ref().is_none_or(|s| c.index.families().get(i).is_some_and(|f| &f.source == s));
+        let installed = |i: usize| c.index.families().get(i).is_some_and(|f| self.installed_by_name.contains_key(&f.family.to_lowercase()));
+        let shows = |show: Show, i: usize| match show {
+            Show::All => true,
+            Show::Installed => installed(i),
+            Show::NotInstalled => !installed(i),
+        };
+        let any_category = Query { category: None, ..self.query.clone() };
+        let mut by_category = [0usize; 6];
+        let mut by_state = [0usize; 3];
+        let mut by_source: Vec<usize> = vec![0; c.index.sources().len()];
+        for i in c.search.families(&c.index, &any_category) {
+            let Some(f) = c.index.families().get(i) else { continue };
+            let in_category = self.query.category.is_none_or(|q| categories(f).any(|fc| fc == q));
+            if in_category
+                && shows(self.show, i)
+                && let Some(n) = c.index.sources().iter().position(|s| s.id == f.source).and_then(|n| by_source.get_mut(n))
+            {
+                *n += 1;
+            }
+            if !from(i, &self.source) {
+                continue;
+            }
+            if shows(self.show, i) {
+                by_category[0] += 1;
+                for fc in categories(f) {
+                    if let Some(pos) = Category::ALL.iter().position(|x| *x == fc) {
+                        by_category[pos + 1] += 1;
+                    }
+                }
+            }
+            if in_category {
+                by_state[0] += 1;
+                by_state[if installed(i) { 1 } else { 2 }] += 1;
+            }
+        }
+        self.category_counts = by_category;
+        self.show_counts = by_state;
+        self.source_counts = by_source;
+        self.results = c.search.families(&c.index, &self.query).into_iter().filter(|&i| shows(self.show, i) && from(i, &self.source)).collect();
+        self.results_for = Some(key);
+    }
+
+    /// The installed families the Installed tab shows, by position in [`FontsPanel::installed`].
+    pub(crate) fn installed_shown(&mut self) -> Vec<usize> {
+        let key = (self.installed_text.clone(), self.origin, self.installed_generation);
+        if self.installed_shown.1.as_ref() != Some(&key) {
+            let text = self.folder.key(self.installed_text.trim());
+            let shown = (0..self.installed.len())
+                .filter(|&i| {
+                    let Some(f) = self.installed.get(i) else { return false };
+                    let origin = match self.origin {
+                        Origin::All => true,
+                        Origin::System => f.source != Source::Store,
+                        Origin::Store => f.source == Source::Store,
+                    };
+                    origin && (text.is_empty() || self.folder.key(&f.name).contains(&text))
+                })
+                .collect();
+            self.installed_shown = (shown, Some(key));
+        }
+        self.installed_shown.0.clone()
+    }
+
+    /// The sample for a family with `scripts`: what the user typed, else the preset.
+    pub(crate) fn sample_for<'a>(&self, scripts: impl IntoIterator<Item = &'a str>) -> String {
+        if !self.settings.sample.trim().is_empty() {
+            return self.settings.sample.clone();
+        }
+        match self.settings.preset {
+            Preset::Alphabet => samples::ALPHABET.to_owned(),
+            Preset::Numerals => samples::NUMERALS.to_owned(),
+            Preset::Sentence => {
+                let language = self.catalogue.as_ref().ok().zip(self.query.language).and_then(|(c, l)| c.index.languages().get(l));
+                language.and_then(|l| samples::for_language(&l.id)).unwrap_or_else(|| samples::for_scripts(scripts)).to_owned()
+            }
+        }
+    }
+
+    /// Runs `pending` if downloads are allowed, or asks first.
+    pub(crate) fn ask(&mut self, ctx: &Context, pending: Pending) {
+        let now = ctx.input(|i| i.time);
+        if self.allowed(now) {
+            self.download(ctx, pending);
+        } else {
+            self.asking = Some(pending);
+        }
+    }
+
+    fn download(&mut self, ctx: &Context, pending: Pending) {
+        if !self.downloads_allowed() {
+            return;
+        }
+        let Ok(c) = &self.catalogue else { return };
+        let index = Arc::clone(&c.index);
+        if let Some(f) = index.families().get(pending.family()) {
+            self.failed.remove(&family_key(&f.source, &f.family));
+        }
+        let request = match pending {
+            Pending::Install(i) => Request::Install(index, i),
+            Pending::InstallFile(i, path) => Request::InstallFile(index, i, path),
+            Pending::Preview(i) => Request::Preview(index, i),
+        };
+        self.jobs.start(ctx, Arc::clone(&self.installer), Arc::clone(&self.catalog), request);
+    }
+
+    /// Removes store files: a whole family, or the files of some of its styles.
+    pub(crate) fn remove(&mut self, ctx: &Context, family: &str, faces: &[FaceInfo], whole: bool) {
+        let mut files: Vec<_> = faces.iter().filter(|f| f.source == Source::Store).filter_map(|f| f.path.clone()).collect();
+        files.sort();
+        files.dedup();
+        if files.is_empty() {
+            return;
+        }
+        self.failed.remove(&family_key("", family));
+        let request = RemoveRequest { family: family.to_owned(), files, whole };
+        self.jobs.start(ctx, Arc::clone(&self.installer), Arc::clone(&self.catalog), Request::Remove(request));
+    }
+
+    fn consent(&mut self, ctx: &Context) {
+        let Some(pending) = self.asking.clone() else { return };
+        let Ok(c) = &self.catalogue else { return };
+        let Some(family) = c.index.families().get(pending.family()) else { return };
+        let file = match &pending {
+            Pending::InstallFile(_, path) => family.files.iter().find(|f| &f.path == path),
+            _ => family.files.first(),
+        };
+        let size = match &pending {
+            Pending::InstallFile(..) => file.map_or(0, |f| f.size),
+            _ => family.size(),
+        };
+        let (source, curated) = source_label(&c.index, family);
+        // A curated source's files come through its repository's CDN; a source the user added
+        // can point anywhere, so the dialog names the server.
+        let host = file.filter(|_| !curated).and_then(|f| c.index.file_urls(family, f).first().and_then(|u| url_host(u)).map(str::to_owned));
+        let args = [("family", family.family.as_str()), ("size", &i18n::size(size)), ("source", source), ("host", host.as_deref().unwrap_or(""))];
+        let text = match &host {
+            None => fmt("Craft Font Manager downloads {family} ({size}) from {source}, and checks every file before using it.", &args),
+            Some(_) => fmt(
+                "Craft Font Manager downloads {family} ({size}) from {host}, the server of {source}, a source you added, and checks every file before using it.",
+                &args,
+            ),
+        };
+        let title = fmt("Download from {source}?", &[("source", source)]);
+        let s = self.skin.clone();
+        let mut allow = false;
+        let mut cancel = false;
+        let frame =
+            Frame::new().fill(s.p.bg).stroke(egui::Stroke::new(1.0, s.p.line_strong)).corner_radius(s.look.corner).inner_margin(Margin::same(24));
+        let response = egui::Modal::new(egui::Id::unique("craft-font-manager.consent")).frame(frame).show(ctx, |ui| {
+            ui.set_max_width(440.0);
+            ui.spacing_mut().item_spacing.y = 10.0;
+            let title = egui::RichText::new(&title).size(22.0).family(s.look.display.clone()).color(s.p.ink_strong);
+            ui.add(egui::Label::new(title).wrap());
+            ui.add(egui::Label::new(egui::RichText::new(text).color(s.p.ink)).wrap());
+            ui.add(egui::Label::new(egui::RichText::new(tl!("Downloads stay allowed until you turn them off.")).color(s.p.muted)).wrap());
+            ui.add_space(8.0);
+            direction::horizontal(ui, |ui| {
+                allow = widgets::button(ui, &s, tl!("Download"), widgets::Kind::Primary, s.h(), 0.0).clicked();
+                cancel = widgets::button(ui, &s, tl!("Cancel"), widgets::Kind::Secondary, s.h(), 0.0).clicked();
+            });
+        });
+        if allow {
+            self.asking = None;
+            if self.set_downloads_allowed(true).is_ok() {
+                self.download(ctx, pending);
+            }
+        } else if cancel || response.should_close() {
+            self.asking = None;
+        }
+    }
+
+    pub(crate) fn index(&self) -> Option<Arc<Index>> {
+        self.catalogue.as_ref().ok().map(|c| Arc::clone(&c.index))
+    }
+}
diff --git a/crates/font-manager/src/panel/browse.rs b/crates/font-manager/src/panel/browse.rs
new file mode 100644
index 00000000..9973ae3f
--- /dev/null
+++ b/crates/font-manager/src/panel/browse.rs
@@ -0,0 +1,673 @@
+//! The tabs and search, the filters, the sample toolbar and the list of family cards.
+
+use std::sync::Arc;
+
+use craft_ui::direction;
+use egui::{CornerRadius, FontFamily, FontId, Id, Rect, Role, Sense, StrokeKind, Ui, UiBuilder, WidgetInfo, pos2, vec2};
+
+use crate::index::{Category, Index, script_name, source_label};
+use crate::panel::app::{Detail, FontsPanel, Origin, Pending, Preset, Show, Tab, category_label, family_key, regular, source_name, style_count};
+use crate::panel::faces::{Owner, Shown};
+use crate::panel::i18n::{self, fmt, tl, tn};
+use crate::panel::jobs::Kind;
+use crate::panel::widgets::{self, Cell, Glyph, Skin};
+use crate::{FaceInfo, Source};
+
+/// Space round a card's contents.
+const CARD_PAD: f32 = 20.0;
+const CARD_TOP: f32 = 14.0;
+const CARD_GAP: f32 = 8.0;
+const CARD_BOTTOM: f32 = 18.0;
+
+/// What a card shows: `key` sets it apart from a family of the same name from another source.
+struct Card<'a> {
+    key: &'a str,
+    name: &'a str,
+    meta: &'a str,
+    sample: &'a str,
+    curated: bool,
+    index_position: Option<usize>,
+}
+
+/// What a card shows at its reading end.
+enum CardState {
+    Running(Kind, Option<f32>),
+    Failed(Kind, String, Option<Pending>),
+    Installed,
+    Removable(Vec<FaceInfo>),
+    System,
+    Offer { preview: bool },
+}
+
+impl FontsPanel {
+    pub(crate) fn top_bar(&mut self, ui: &mut Ui) {
+        let s = self.skin.clone();
+        ui.allocate_ui_with_layout(vec2(ui.available_width(), s.h()), direction::row(ui), |ui| {
+            ui.spacing_mut().item_spacing.x = 12.0;
+            let mut tab = self.tab;
+            let browse = self.catalogue.as_ref().map_or(0, |c| c.index.families().len());
+            let options = [
+                Cell { value: Tab::Catalogue, label: tl!("Browse"), count: Some(browse) },
+                Cell { value: Tab::Installed, label: tl!("Installed"), count: Some(self.installed.len()) },
+            ];
+            if widgets::cells_row(ui, &s, &mut tab, &options) {
+                self.set_tab(tab);
+            }
+            let (text, hint) = match self.tab {
+                Tab::Catalogue => (&mut self.query.text, tl!("Search fonts by name")),
+                Tab::Installed => (&mut self.installed_text, tl!("Search installed fonts")),
+            };
+            let field = widgets::field(ui, &s, text, hint, tl!("Search"), ui.available_width(), true);
+            if std::mem::take(&mut self.focus_search) {
+                field.request_focus();
+            }
+            if field.changed() {
+                self.focus_row = None;
+            }
+        });
+    }
+
+    pub(crate) fn sidebar(&mut self, ui: &mut Ui) {
+        let s = self.skin.clone();
+        egui::ScrollArea::vertical().id_salt("craft-fonts.filters").auto_shrink([false, false]).show(ui, |ui| {
+            ui.with_layout(direction::column(ui), |ui| {
+                ui.spacing_mut().item_spacing.y = 8.0;
+                match self.tab {
+                    Tab::Catalogue => self.catalogue_filters(ui, &s),
+                    Tab::Installed => self.installed_filters(ui, &s),
+                }
+                if self.downloads_switch {
+                    ui.add_space(14.0);
+                    ui.painter().hline(ui.max_rect().x_range(), ui.cursor().top(), s.hairline());
+                    ui.add_space(14.0);
+                    widgets::label(ui, &s, tl!("Downloads"), s.p.faint);
+                    let now = ui.input(|i| i.time);
+                    let mut allowed = self.allowed(now);
+                    if ui.checkbox(&mut allowed, tl!("Allow downloads")).changed() {
+                        let _ = self.set_downloads_allowed(allowed);
+                    }
+                    let note = tl!("From each font's source, only when you install or preview a font.");
+                    ui.add(egui::Label::new(egui::RichText::new(note).size(12.0).color(s.p.muted)).wrap());
+                }
+            });
+        });
+    }
+
+    fn catalogue_filters(&mut self, ui: &mut Ui, s: &Skin) {
+        let Ok(c) = &self.catalogue else { return };
+        let index = Arc::clone(&c.index);
+        let width = ui.available_width();
+        widgets::label(ui, s, tl!("Category"), s.p.faint);
+        let mut options = vec![Cell { value: None, label: tl!("All categories"), count: Some(self.category_counts[0]) }];
+        for (n, c) in Category::ALL.iter().enumerate() {
+            options.push(Cell { value: Some(*c), label: crate::panel::app::category_name(*c), count: self.category_counts.get(n + 1).copied() });
+        }
+        if widgets::cells_column(ui, s, &mut self.query.category, &options) {
+            self.focus_row = None;
+        }
+
+        ui.add_space(12.0);
+        widgets::label(ui, s, tl!("Language"), s.p.faint);
+        let language_label = |i: usize| {
+            index.languages().get(i).map_or_else(String::new, |l| match l.autonym.as_deref() {
+                Some(autonym) if autonym != l.name => format!("{} · {autonym}", l.name),
+                _ => l.name.clone(),
+            })
+        };
+        let selected = self.query.language.map_or_else(|| tl!("Any language").to_owned(), language_label);
+        let before = self.query.language;
+        let search = &c.search;
+        let language_text = &mut self.language_text;
+        let query = &mut self.query;
+        widgets::select(ui, "craft-fonts.language", tl!("Language"), &selected, width, |ui| {
+            let field =
+                widgets::field(ui, s, language_text, tl!("Name in English or in the language"), tl!("Find a language"), ui.available_width(), true);
+            if field.gained_focus() || ui.memory(|m| m.focused().is_none()) {
+                field.request_focus();
+            }
+            ui.add_space(4.0);
+            let matches = search.languages(language_text);
+            let row = ui.spacing().interact_size.y;
+            egui::ScrollArea::vertical().max_height(300.0).auto_shrink([false, true]).show_rows(ui, row, matches.len() + 1, |ui, range| {
+                for n in range {
+                    if n == 0 {
+                        ui.selectable_value(&mut query.language, None, tl!("Any language"));
+                    } else if let Some(&i) = matches.get(n - 1) {
+                        ui.selectable_value(&mut query.language, Some(i), language_label(i));
+                    }
+                }
+            });
+        });
+        if self.query.language != before {
+            self.focus_row = None;
+        }
+
+        ui.add_space(12.0);
+        widgets::label(ui, s, tl!("Script"), s.p.faint);
+        let any = tl!("Any script");
+        let selected = self.query.script.as_deref().and_then(|id| script_name(&index, id)).unwrap_or(any).to_owned();
+        let query = &mut self.query;
+        widgets::select(ui, "craft-fonts.script", tl!("Script"), &selected, width, |ui| {
+            ui.selectable_value(&mut query.script, None, any);
+            for &i in c.search.scripts() {
+                if let Some(script) = index.scripts().get(i) {
+                    ui.selectable_value(&mut query.script, Some(script.id.clone()), &script.name);
+                }
+            }
+        });
+
+        if index.sources().len() > 1 {
+            ui.add_space(12.0);
+            widgets::label(ui, s, tl!("Source"), s.p.faint);
+            let all: usize = self.source_counts.iter().sum();
+            let mut options = vec![Cell { value: None, label: tl!("All sources"), count: Some(all) }];
+            for (n, source) in index.sources().iter().enumerate() {
+                options.push(Cell { value: Some(source.id.clone()), label: &source.name, count: self.source_counts.get(n).copied() });
+            }
+            let mut chosen = self.source.clone();
+            if widgets::cells_column(ui, s, &mut chosen, &options) {
+                self.source = chosen;
+                self.focus_row = None;
+            }
+        }
+
+        ui.add_space(12.0);
+        widgets::label(ui, s, tl!("Show"), s.p.faint);
+        let options = [
+            Cell { value: Show::All, label: tl!("All fonts"), count: Some(self.show_counts[0]) },
+            Cell { value: Show::Installed, label: tl!("Installed"), count: Some(self.show_counts[1]) },
+            Cell { value: Show::NotInstalled, label: tl!("Not installed"), count: Some(self.show_counts[2]) },
+        ];
+        widgets::cells_column(ui, s, &mut self.show, &options);
+
+        let filtered = self.query.category.is_some()
+            || self.query.language.is_some()
+            || self.query.script.is_some()
+            || self.show != Show::All
+            || self.source.is_some();
+        if filtered {
+            ui.add_space(6.0);
+            if widgets::link(ui, s, tl!("Clear filters")).clicked() {
+                self.clear_filters();
+            }
+        }
+    }
+
+    fn clear_filters(&mut self) {
+        self.query.category = None;
+        self.query.language = None;
+        self.query.script = None;
+        self.source = None;
+        self.show = Show::All;
+        self.focus_row = None;
+    }
+
+    fn installed_filters(&mut self, ui: &mut Ui, s: &Skin) {
+        widgets::label(ui, s, tl!("Source"), s.p.faint);
+        let store = self.installed.iter().filter(|f| f.source == Source::Store).count();
+        let options = [
+            Cell { value: Origin::All, label: tl!("All sources"), count: Some(self.installed.len()) },
+            Cell { value: Origin::Store, label: tl!("Font store"), count: Some(store) },
+            Cell { value: Origin::System, label: tl!("System"), count: Some(self.installed.len() - store) },
+        ];
+        widgets::cells_column(ui, s, &mut self.origin, &options);
+        ui.add_space(8.0);
+        let note = tl!("Every Craft app uses the fonts in the font store. System fonts are added and removed with your system's own font tools.");
+        ui.add(egui::Label::new(egui::RichText::new(note).size(12.0).color(s.p.muted)).wrap());
+    }
+
+    pub(crate) fn main(&mut self, ui: &mut Ui) {
+        let s = self.skin.clone();
+        self.toolbar(ui, &s);
+        ui.add_space(12.0);
+        if let Some(notice) = self.notice.clone() {
+            widgets::note(ui, &s, |ui| {
+                ui.add(egui::Label::new(egui::RichText::new(notice).color(s.p.bad)).wrap());
+            });
+            ui.add_space(10.0);
+        }
+        match self.tab {
+            Tab::Catalogue => {
+                self.download_note(ui, &s);
+                self.catalogue_list(ui, &s);
+            }
+            Tab::Installed => self.installed_list(ui, &s),
+        }
+    }
+
+    fn toolbar(&mut self, ui: &mut Ui, s: &Skin) {
+        ui.allocate_ui_with_layout(vec2(ui.available_width(), s.h()), direction::row(ui), |ui| {
+            ui.spacing_mut().item_spacing.x = 10.0;
+            let preset = self.settings.preset;
+            let preset_name = |p: Preset| match p {
+                Preset::Sentence => tl!("Sentence"),
+                Preset::Alphabet => tl!("Alphabet"),
+                Preset::Numerals => tl!("Numerals"),
+            };
+            let settings = &mut self.settings;
+            widgets::select(ui, "craft-fonts.preset", tl!("Sample"), preset_name(preset), 128.0, |ui| {
+                for p in [Preset::Sentence, Preset::Alphabet, Preset::Numerals] {
+                    if ui.selectable_label(preset == p && settings.sample.is_empty(), preset_name(p)).clicked() {
+                        settings.preset = p;
+                        settings.sample.clear();
+                    }
+                }
+            });
+            // The size control at the reading end, the sample text filling the room between.
+            let size_w = 176.0;
+            let hint = self.sample_for(["Latn"]);
+            let field_w = (ui.available_width() - size_w - 10.0).max(120.0);
+            widgets::field(ui, s, &mut self.settings.sample, &hint, tl!("Sample text"), field_w, false);
+            ui.allocate_ui_with_layout(vec2(size_w, s.h()), direction::row(ui), |ui| {
+                ui.spacing_mut().item_spacing.x = 10.0;
+                widgets::slider(ui, s, &mut self.settings.size, 12.0..=120.0, 112.0, tl!("Size"));
+                let value = fmt("{size} px", &[("size", &i18n::number(self.settings.size.round() as u64))]);
+                widgets::label(ui, s, &value, s.p.muted);
+            });
+        });
+    }
+
+    fn download_note(&mut self, ui: &mut Ui, s: &Skin) {
+        let now = ui.input(|i| i.time);
+        if self.allowed(now) || self.settings.hide_download_note {
+            return;
+        }
+        let mut allow = false;
+        let mut hide = false;
+        let text = tl!("Fonts that aren't installed show a sample once you preview them. Nothing is downloaded until you allow it.");
+        widgets::note_with_actions(
+            ui,
+            s,
+            |ui| {
+                ui.label(egui::RichText::new(tl!("Downloads are off")).color(s.p.ink_strong));
+                ui.add(egui::Label::new(egui::RichText::new(text).size(12.5).color(s.p.muted)).wrap());
+            },
+            &[tl!("Allow downloads")],
+            |ui, n| match n {
+                0 => allow = widgets::button(ui, s, tl!("Allow downloads"), widgets::Kind::Secondary, 28.0, 0.0).clicked(),
+                _ => hide = widgets::glyph_button(ui, s, Glyph::Close, tl!("Hide this note"), 28.0).clicked(),
+            },
+            true,
+        );
+        ui.add_space(10.0);
+        if allow {
+            let _ = self.set_downloads_allowed(true);
+        }
+        if hide {
+            self.settings.hide_download_note = true;
+        }
+    }
+
+    fn row_height(&self) -> f32 {
+        CARD_TOP + self.skin.h() + CARD_GAP + self.settings.size * 1.32 + CARD_BOTTOM
+    }
+
+    /// The scroll area for `count` cards; `card` draws row `n` into the rect it is given.
+    fn cards(&mut self, ui: &mut Ui, count: usize, mut card: impl FnMut(&mut FontsPanel, &mut Ui, usize, Rect) -> egui::Response) {
+        let row = self.row_height();
+        let mut area = egui::ScrollArea::vertical().id_salt(("craft-fonts.cards", self.tab == Tab::Catalogue)).auto_shrink([false, false]);
+        let viewport_h = ui.available_height();
+        if std::mem::take(&mut self.scroll_to_focus)
+            && let Some(focus) = self.focus_row
+        {
+            let offset = ui.ctx().data(|d| d.get_temp::<f32>(Id::unique(("craft-fonts.offset", self.tab == Tab::Catalogue)))).unwrap_or(0.0);
+            let top = focus as f32 * row;
+            if top < offset {
+                area = area.vertical_scroll_offset(top);
+            } else if top + row > offset + viewport_h {
+                area = area.vertical_scroll_offset(top + row - viewport_h);
+            }
+        }
+        let output = area.show_rows(ui, row, count, |ui, range| {
+            ui.spacing_mut().item_spacing.y = 0.0;
+            let width = ui.available_width();
+            let mut stepped = false;
+            for n in range {
+                let (rect, _) = ui.allocate_exact_size(vec2(width, row), Sense::hover());
+                // Neighbouring cards share their hairline.
+                let rect = if n == 0 { rect } else { rect.with_min_y(rect.top() - 1.0) };
+                let resp = card(self, ui, n, rect);
+                if self.focus_row == Some(n) && self.move_focus {
+                    self.move_focus = false;
+                    resp.request_focus();
+                }
+                if resp.has_focus() && !stepped {
+                    // The arrow keys step through the cards here, not egui's spatial focus moves.
+                    let filter = egui::EventFilter { vertical_arrows: true, ..Default::default() };
+                    ui.memory_mut(|m| m.set_focus_lock_filter(resp.id, filter));
+                    self.focus_row = Some(n);
+                    let step = ui.input(|i| {
+                        if i.key_pressed(egui::Key::ArrowDown) {
+                            1
+                        } else if i.key_pressed(egui::Key::ArrowUp) {
+                            -1
+                        } else {
+                            0
+                        }
+                    });
+                    let next = n as i64 + step;
+                    if step != 0 && (0..count as i64).contains(&next) {
+                        self.focus_row = Some(next as usize);
+                        self.scroll_to_focus = true;
+                        self.move_focus = true;
+                        stepped = true;
+                        ui.ctx().request_repaint();
+                    }
+                }
+            }
+        });
+        ui.ctx().data_mut(|d| d.insert_temp(Id::unique(("craft-fonts.offset", self.tab == Tab::Catalogue)), output.state.clamped_offset().y));
+    }
+
+    fn empty(&mut self, ui: &mut Ui, s: &Skin, title: &str, body: &str, clear: bool) {
+        ui.add_space(48.0);
+        ui.vertical_centered(|ui| {
+            ui.spacing_mut().item_spacing.y = 10.0;
+            widgets::label(ui, s, title, s.p.muted);
+            ui.add(egui::Label::new(egui::RichText::new(body).color(s.p.faint)).wrap());
+            if clear {
+                ui.add_space(4.0);
+                if widgets::button(ui, s, tl!("Clear search and filters"), widgets::Kind::Secondary, s.h(), 0.0).clicked() {
+                    self.query.text.clear();
+                    self.clear_filters();
+                }
+            }
+        });
+    }
+
+    fn catalogue_list(&mut self, ui: &mut Ui, s: &Skin) {
+        let index = match &self.catalogue {
+            Ok(c) => Arc::clone(&c.index),
+            Err(e) => {
+                let e = e.clone();
+                widgets::note(ui, s, |ui| {
+                    let text = fmt("The font indexes can't be read: {error}", &[("error", &e)]);
+                    ui.add(egui::Label::new(egui::RichText::new(text).color(s.p.bad)).wrap());
+                });
+                return;
+            }
+        };
+        self.source_problems(ui, s, &index);
+        let count = tn(self.results.len() as u64, "{n} family", "{n} families");
+        widgets::label(ui, s, &count, s.p.faint);
+        ui.add_space(8.0);
+        if self.results.is_empty() {
+            self.empty(ui, s, tl!("No fonts match"), tl!("Try another name, or fewer filters."), true);
+            return;
+        }
+        let results = self.results.clone();
+        self.cards(ui, results.len(), |me, ui, n, rect| {
+            let i = results.get(n).copied().unwrap_or_default();
+            me.catalogue_card(ui, &index, i, rect)
+        });
+    }
+
+    /// Sources that couldn't be loaded, in a note above the list; the others show as usual.
+    fn source_problems(&mut self, ui: &mut Ui, s: &Skin, index: &Index) {
+        let problems = index.problems();
+        if problems.is_empty() {
+            return;
+        }
+        let now = ui.input(|i| i.time);
+        let allowed = self.allowed(now);
+        let fetching = self.fetching_sources();
+        let buttons: &[&str] = if allowed && !fetching { &[tl!("Try again")] } else { &[] };
+        let mut retry = false;
+        widgets::note_with_actions(
+            ui,
+            s,
+            |ui| {
+                let title = tn(problems.len() as u64, "{n} font source couldn't be loaded", "{n} font sources couldn't be loaded");
+                ui.label(egui::RichText::new(title).color(s.p.ink_strong));
+                for p in problems.iter().take(4) {
+                    let line = fmt("{source}: {error}", &[("source", &p.name), ("error", &p.error)]);
+                    ui.add(egui::Label::new(egui::RichText::new(line).size(12.5).color(s.p.muted)).wrap());
+                }
+            },
+            buttons,
+            |ui, _| retry = widgets::button(ui, s, tl!("Try again"), widgets::Kind::Secondary, 28.0, 0.0).clicked(),
+            false,
+        );
+        ui.add_space(10.0);
+        if retry {
+            let ctx = ui.ctx().clone();
+            self.fetch_sources(&ctx);
+        }
+    }
+
+    fn installed_list(&mut self, ui: &mut Ui, s: &Skin) {
+        if !self.catalog.is_ready() {
+            direction::horizontal(ui, |ui| {
+                ui.spinner();
+                ui.label(egui::RichText::new(tl!("Looking for installed fonts…")).color(s.p.muted));
+            });
+            ui.ctx().request_repaint();
+            return;
+        }
+        let shown = self.installed_shown();
+        let count = tn(shown.len() as u64, "{n} family", "{n} families");
+        widgets::label(ui, s, &count, s.p.faint);
+        ui.add_space(8.0);
+        if shown.is_empty() {
+            let body = if self.origin == Origin::Store && self.installed_text.trim().is_empty() {
+                tl!("Fonts you install from Browse go here, for every Craft app.")
+            } else {
+                tl!("Try another name.")
+            };
+            self.empty(ui, s, tl!("No installed fonts match"), body, false);
+            return;
+        }
+        self.cards(ui, shown.len(), |me, ui, n, rect| {
+            let i = shown.get(n).copied().unwrap_or_default();
+            me.installed_card(ui, i, rect)
+        });
+    }
+
+    fn catalogue_state(&self, source: &str, family: &str, faces_installed: bool) -> CardState {
+        let key = family_key(source, family);
+        if let Some(job) = self.jobs.of(source, family) {
+            return CardState::Running(job.kind, job.fraction());
+        }
+        if let Some(f) = self.failed.get(&key) {
+            return CardState::Failed(f.kind, f.error.clone(), f.retry.clone());
+        }
+        if faces_installed {
+            return CardState::Installed;
+        }
+        CardState::Offer { preview: !self.previewed.contains_key(&key) }
+    }
+
+    fn catalogue_card(&mut self, ui: &mut Ui, index: &Index, i: usize, rect: Rect) -> egui::Response {
+        let s = self.skin.clone();
+        let Some(family) = index.families().get(i) else { return ui.interact(rect, Id::unique(("craft-fonts.card", i)), Sense::hover()) };
+        let key = family_key(&family.source, &family.family);
+        let installed = self.installed_by_name.get(&family.family.to_lowercase()).and_then(|f| regular(f)).cloned();
+        let previewed = self.previewed.get(&key).and_then(|f| regular(f)).cloned();
+        let state = self.catalogue_state(&family.source, &family.family, installed.is_some());
+        let (source, curated) = source_label(index, family);
+        let meta = [tn(style_count(family) as u64, "{n} style", "{n} styles"), category_label(family), source.to_owned()].join(" · ");
+        let sample = self.sample_for(family.scripts.iter().map(String::as_str));
+        let face = match (installed, previewed) {
+            (Some(face), _) => Some((Owner::Installed, face)),
+            (None, Some(face)) => Some((Owner::Preview, face)),
+            (None, None) => None,
+        };
+        let card = Card { key: &key, name: &family.family, meta: &meta, sample: &sample, curated, index_position: Some(i) };
+        let resp = self.card(ui, &s, rect, card, face, state);
+        if resp.clicked() {
+            self.detail = Some(Detail::Family(i));
+        }
+        resp
+    }
+
+    fn installed_card(&mut self, ui: &mut Ui, i: usize, rect: Rect) -> egui::Response {
+        let s = self.skin.clone();
+        let Some(family) = self.installed.get(i).cloned() else { return ui.interact(rect, Id::unique(("craft-fonts.installed", i)), Sense::hover()) };
+        let meta = [tn(family.faces.len() as u64, "{n} style", "{n} styles"), source_name(family.source).to_owned()].join(" · ");
+        let state = match self.jobs.of("", &family.name) {
+            Some(job) => CardState::Running(job.kind, job.fraction()),
+            None => match self.failed.get(&family_key("", &family.name)) {
+                Some(f) => CardState::Failed(f.kind, f.error.clone(), None),
+                None if family.removable() => CardState::Removable(family.faces.clone()),
+                None => CardState::System,
+            },
+        };
+        let face = regular(&family.faces).cloned().map(|f| (Owner::Installed, f));
+        let scripts = self.index().and_then(|index| index.family(&family.name).map(|f| f.scripts.clone())).unwrap_or_default();
+        let sample = self.sample_for(scripts.iter().map(String::as_str));
+        let key = format!("{:?}\n{}", family.source, family.name);
+        let card = Card { key: &key, name: &family.name, meta: &meta, sample: &sample, curated: true, index_position: None };
+        let resp = self.card(ui, &s, rect, card, face, state);
+        if resp.clicked() {
+            let in_index = self.index().and_then(|index| index.families().iter().position(|f| f.family.eq_ignore_ascii_case(&family.name)));
+            self.detail = Some(match in_index {
+                Some(i) if family.source == Source::Store => Detail::Family(i),
+                _ => Detail::Installed(family.name.clone(), family.source),
+            });
+        }
+        resp
+    }
+
+    /// One family card: its name, styles and source on one line with its state at the end, and
+    /// a sample in the face below.
+    fn card(&mut self, ui: &mut Ui, s: &Skin, rect: Rect, card: Card<'_>, face: Option<(Owner, FaceInfo)>, state: CardState) -> egui::Response {
+        let Card { key, name, meta, sample, curated, index_position } = card;
+        let p = s.p;
+        let rtl = direction::is_rtl(ui);
+        let id = Id::unique(("craft-fonts.card", key));
+        // The whole card opens the details; added first, so the buttons on it keep their clicks.
+        let resp = ui.interact(rect, id, Sense::click());
+        resp.widget_info(|| WidgetInfo::labeled(Role::Button, true, name));
+        let hovered = ui.rect_contains_pointer(rect);
+        let lift = ui.ctx().animate_bool_with_time(id.with("hover"), hovered || resp.has_focus(), ui.style().animation_time * 2.0);
+        let painter = ui.painter_at(rect.expand(1.0));
+        painter.rect(rect, CornerRadius::ZERO, p.bg.lerp_to_gamma(p.sunken, 0.55 * lift), s.hairline(), StrokeKind::Inside);
+        if lift > 0.0 {
+            let inside = rect.shrink(1.0);
+            let w = inside.width() * lift;
+            let x = if rtl { inside.right() - w } else { inside.left() };
+            painter.rect_filled(Rect::from_min_size(pos2(x, inside.top()), vec2(w, 2.0)), CornerRadius::ZERO, p.accent);
+        }
+        widgets::focus_ring(ui, s, rect.shrink(1.0), &resp);
+
+        let inner = rect.shrink2(vec2(CARD_PAD, 0.0));
+        let header = Rect::from_min_size(pos2(inner.left(), rect.top() + CARD_TOP), vec2(inner.width(), s.h()));
+        let mut end = ui.new_child(UiBuilder::new().max_rect(header).layout(direction::trailing(ui)));
+        end.spacing_mut().item_spacing.x = 10.0;
+        self.card_state(&mut end, s, name, index_position, state);
+        if !curated {
+            widgets::badge(&mut end, s, tl!("Not curated"), s.p.warn, false)
+                .on_hover_text(tl!("This family comes from a source you added. Craft doesn't review it."));
+        }
+        let end_w = end.min_rect().width();
+
+        let name_galley = ui.painter().layout_no_wrap(name.to_owned(), FontId::new(16.0, s.look.strong.clone()), p.ink_strong);
+        let name_w = name_galley.size().x.min((header.width() - end_w - 24.0).max(0.0));
+        let start = direction::start_x(ui, header);
+        let f = direction::forward(ui);
+        let name_x = if rtl { start - name_w } else { start };
+        ui.painter().with_clip_rect(header).galley(pos2(name_x, header.center().y - name_galley.size().y / 2.0), name_galley, p.ink_strong);
+        let room = header.width() - name_w - end_w - 40.0;
+        if room > 24.0 {
+            let meta_galley = s.caps_galley(ui, meta, if s.look.caps { 10.5 } else { 12.0 }, s.look.label.clone(), p.faint, Some(room));
+            let x = start + f * (name_w + 14.0);
+            let x = if rtl { x - meta_galley.size().x } else { x };
+            ui.painter().galley(pos2(x, header.center().y - meta_galley.size().y / 2.0 + 1.0), meta_galley, p.faint);
+        }
+
+        let sample_rect = Rect::from_min_max(pos2(inner.left(), header.bottom() + CARD_GAP), pos2(inner.right(), rect.bottom() - CARD_BOTTOM + 4.0));
+        self.paint_sample(ui, s, sample_rect, face.as_ref(), sample);
+        resp
+    }
+
+    fn card_state(&mut self, ui: &mut Ui, s: &Skin, name: &str, index_position: Option<usize>, state: CardState) {
+        let p = s.p;
+        let h = s.h() - 4.0;
+        let ctx = ui.ctx().clone();
+        match state {
+            CardState::Running(kind, fraction) => {
+                let what = match kind {
+                    Kind::Install => tl!("Installing"),
+                    Kind::Remove => tl!("Removing"),
+                    Kind::Preview => tl!("Downloading"),
+                };
+                let text = match fraction {
+                    Some(f) => format!("{what} {}", fmt("{percent} %", &[("percent", &i18n::number((f * 100.0).round() as u64))])),
+                    None => format!("{what}…"),
+                };
+                let (rect, resp) = ui.allocate_exact_size(vec2(150.0, h), Sense::hover());
+                let galley = s.label_galley(ui, &text, p.muted);
+                widgets::paint_end(ui, rect.with_max_y(rect.bottom() - 8.0), galley, p.muted);
+                let bar = Rect::from_min_max(pos2(rect.left(), rect.bottom() - 3.0), rect.max);
+                widgets::progress_bar(ui, s, bar, fraction);
+                resp.widget_info(|| WidgetInfo::labeled(Role::ProgressIndicator, true, &text));
+            }
+            CardState::Failed(kind, error, retry) => {
+                if let Some(retry) = retry
+                    && widgets::button(ui, s, tl!("Retry"), widgets::Kind::Secondary, h, 0.0).clicked()
+                {
+                    self.ask(&ctx, retry);
+                }
+                let what = match kind {
+                    Kind::Install => tl!("Couldn't install"),
+                    Kind::Remove => tl!("Couldn't remove"),
+                    Kind::Preview => tl!("Couldn't download"),
+                };
+                widgets::label(ui, s, what, p.bad).on_hover_text(error);
+            }
+            CardState::Installed => {
+                widgets::badge(ui, s, tl!("Installed"), p.good, true);
+            }
+            CardState::System => {}
+            CardState::Removable(faces) => {
+                let remove = widgets::button(ui, s, tl!("Remove"), widgets::Kind::Danger, h, 0.0);
+                widgets::name(ui, &remove, &fmt("Remove {family}", &[("family", name)]));
+                if remove.clicked() {
+                    self.remove(&ctx, name, &faces, true);
+                }
+            }
+            CardState::Offer { preview } => {
+                let Some(i) = index_position else { return };
+                let install = widgets::button(ui, s, tl!("Install"), widgets::Kind::Secondary, h, 0.0);
+                widgets::name(ui, &install, &fmt("Install {family}", &[("family", name)]));
+                if install.clicked() {
+                    self.ask(&ctx, Pending::Install(i));
+                }
+                if preview {
+                    let button = widgets::link(ui, s, tl!("Preview"));
+                    widgets::name(ui, &button, &fmt("Preview {family}", &[("family", name)]));
+                    if button.clicked() {
+                        self.ask(&ctx, Pending::Preview(i));
+                    }
+                }
+            }
+        }
+    }
+
+    /// `text` in the face, on one line; the interface font in a faint ink where the face isn't
+    /// here (not installed and not previewed).
+    pub(crate) fn paint_sample(&mut self, ui: &mut Ui, s: &Skin, rect: Rect, face: Option<&(Owner, FaceInfo)>, text: &str) {
+        let size = self.settings.size;
+        let (family, color) = match face {
+            Some((owner, face)) => {
+                let catalog = match owner {
+                    Owner::Installed => Arc::clone(&self.catalog),
+                    Owner::Preview => Arc::clone(&self.previews),
+                };
+                match self.faces.family(ui.ctx(), &catalog, *owner, face) {
+                    Shown::Ready(family) => (family, s.p.ink),
+                    Shown::Loading => return,
+                    Shown::Unavailable => (FontFamily::Proportional, s.p.faint),
+                }
+            }
+            None => (FontFamily::Proportional, s.p.faint.gamma_multiply(0.8)),
+        };
+        let mut job = egui::text::LayoutJob::simple_singleline(text.to_owned(), FontId::new(size, family), color);
+        job.wrap = egui::text::TextWrapping::truncate_at_width(rect.width());
+        let galley = ui.painter().layout_job(job);
+        // Sample text keeps its own direction whatever the interface's.
+        let x = if craft_i18n::base_direction(text) == Some(craft_i18n::Direction::Rtl) { rect.right() - galley.size().x } else { rect.left() };
+        let y = rect.center().y - galley.size().y / 2.0;
+        ui.painter().with_clip_rect(rect.expand2(vec2(0.0, 6.0))).galley(pos2(x, y), galley, color);
+    }
+}
diff --git a/crates/font-manager/src/panel/catalogs/ar.tsv b/crates/font-manager/src/panel/catalogs/ar.tsv
new file mode 100644
index 00000000..2cd15ca9
--- /dev/null
+++ b/crates/font-manager/src/panel/catalogs/ar.tsv
@@ -0,0 +1,113 @@
+# Arabic (ar) catalog for Craft Font Manager's panel.
+# Format: context<TAB>source<TAB>translation; @plural rows list the locale's plural forms.
+# Style and weight names (Regular, Bold, Italic), licence names and product names stay in English.
+	All categories	كل الفئات
+	All fonts	كل الخطوط
+	All sources	كل المصادر
+	Allow downloads	السماح بالتنزيل
+	Alphabet	الأبجدية
+	Any language	أي لغة
+	Any script	أي نظام كتابة
+	Browse	تصفّح
+	Cancel	إلغاء
+	Category	الفئة
+	Clear filters	مسح عوامل التصفية
+	Clear search and filters	مسح البحث وعوامل التصفية
+	Close	إغلاق
+	Couldn't download	تعذّر التنزيل
+	Couldn't install	تعذّر التثبيت
+	Couldn't remove	تعذّرت الإزالة
+	Designer	المصمم
+	Display	عرض
+	Download from Google Fonts?	هل تريد التنزيل من Google Fonts؟
+	Download size	حجم التنزيل
+	Download	تنزيل
+	Downloading	جارٍ التنزيل
+	Downloads are off	التنزيل متوقف
+	Downloads stay allowed until you turn them off.	يبقى التنزيل مسموحًا حتى توقفه.
+	Downloads	التنزيلات
+	Every Craft app uses the fonts in the font store. System fonts are added and removed with your system's own font tools.	تستخدم كل تطبيقات Craft الخطوط الموجودة في متجر الخطوط. تُضاف خطوط النظام وتُزال بأدوات الخطوط في نظامك.
+	Files	الملفات
+	Find a language	ابحث عن لغة
+	Font store	متجر الخطوط
+	Fonts that aren't installed show a sample once you preview them. Nothing is downloaded until you allow it.	تظهر عينة الخط غير المثبّت بعد معاينته. لا يُنزَّل شيء حتى تسمح بذلك.
+	Fonts you install from Browse go here, for every Craft app.	تظهر هنا الخطوط التي تثبّتها من «تصفّح»، لكل تطبيقات Craft.
+	From Google Fonts' GitHub repository, only when you install or preview a font.	من مستودع Google Fonts على GitHub، فقط عند تثبيت خط أو معاينته.
+	Handwriting	خط اليد
+	Hide this note	إخفاء هذه الملاحظة
+	Install all	تثبيت الكل
+	Install	تثبيت
+	Installed on this system	مثبّت على هذا النظام
+	Installed	مثبّت
+	Installing	جارٍ التثبيت
+	Language	اللغة
+	Looking for installed fonts…	جارٍ البحث عن الخطوط المثبّتة…
+	Monospace	أحادي المسافة
+	Name in English or in the language	الاسم بالإنجليزية أو باللغة نفسها
+	No fonts match	لا توجد خطوط مطابقة
+	No installed fonts match	لا توجد خطوط مثبّتة مطابقة
+	Not installed	غير مثبّت
+	Numerals	الأرقام والرموز
+	Preview	معاينة
+	Remove all	إزالة الكل
+	Remove	إزالة
+	Removed with your system's font tools	يُزال بأدوات الخطوط في نظامك
+	Removing	جارٍ الإزالة
+	Retry	إعادة المحاولة
+	Sample text	نص العينة
+	Sample	العينة
+	Sans serif	بلا زوائد
+	Script	نظام الكتابة
+	Scripts	أنظمة الكتابة
+	Search fonts by name	ابحث في الخطوط بالاسم
+	Search installed fonts	ابحث في الخطوط المثبّتة
+	Search	بحث
+	Sentence	جملة
+	Serif	بزوائد
+	Show	إظهار
+	Size	الحجم
+	Source	المصدر
+	Styles	الأنماط
+	System fonts are removed with your system's own font tools.	تُزال خطوط النظام بأدوات الخطوط في نظامك.
+	System	النظام
+	Try another name, or fewer filters.	جرّب اسمًا آخر أو عوامل تصفية أقل.
+	Try another name.	جرّب اسمًا آخر.
+	Designed by {designer}	تصميم {designer}
+	Install {family}	تثبيت {family}
+	Install {style}	تثبيت {style}
+	Languages · {n}	اللغات · {n}
+	Preview downloads this font ({size}) for this session without installing it.	تنزّل المعاينة هذا الخط ({size}) لهذه الجلسة فقط دون تثبيته.
+	Preview {family}	معاينة {family}
+	Remove {family}	إزالة {family}
+	Remove {style}	إزالة {style}
+	The Google Fonts index can't be read: {error}	تتعذّر قراءة فهرس Google Fonts: {error}
+	The download setting couldn't be saved: {error}	تعذّر حفظ إعداد التنزيل: {error}
+	{list} and {n} more	{list} و{n} غيرها
+	{percent} %	{percent}٪
+	{size} download	تنزيل {size}
+	{size} px	{size} بكسل
+	Craft Font Manager downloads {family} ({size}) from Google Fonts' GitHub repository through jsDelivr, and checks every file before using it.	ينزّل Craft Font Manager الخط {family} ({size}) من مستودع Google Fonts على GitHub عبر jsDelivr، ويتحقق من كل ملف قبل استخدامه.
+@plural	{n} style|{n} styles	{n} نمط|{n} نمط|{n} نمط|{n} أنماط|{n} نمطًا|{n} نمط
+@plural	{n} style installed|{n} styles installed	{n} نمط مثبّت|{n} نمط مثبّت|{n} نمط مثبّت|{n} أنماط مثبّتة|{n} نمطًا مثبّتًا|{n} نمط مثبّت
+@plural	{n} family|{n} families	{n} عائلة|{n} عائلة|{n} عائلة|{n} عائلات|{n} عائلة|{n} عائلة
+	Licence	الترخيص
+	Try again	إعادة المحاولة
+	Not curated	غير مراجَع
+	This family comes from a source you added. Craft doesn't review it.	تأتي هذه العائلة من مصدر أضفته. لا يراجعها Craft.
+	The font indexes can't be read: {error}	تتعذّر قراءة فهارس الخطوط: {error}
+	{source}: {error}	{source}: {error}
+	This family comes from a source you added ({url}). Craft doesn't review its fonts or their licences.	تأتي هذه العائلة من مصدر أضفته ({url}). لا يراجع Craft خطوطه ولا تراخيصها.
+	Changed since added	تغيّر منذ إضافته
+	The index at this address isn't the one first downloaded from it. Check the source before installing from it.	الفهرس على هذا العنوان ليس الذي نُزِّل منه أول مرة. تحقّق من المصدر قبل التثبيت منه.
+	Add a source	إضافة مصدر
+	Add	إضافة
+	Index address	عنوان الفهرس
+	A source you add isn't reviewed: add only indexes you trust. Every font is still checked against its index before it is used.	المصدر الذي تضيفه لا يُراجَع: أضف فقط الفهارس التي تثق بها. يُتحقَّق من كل خط مقابل فهرسه قبل استخدامه.
+	Downloading the sources…	جارٍ تنزيل المصادر…
+	Update sources	تحديث المصادر
+	Allow downloads to update	اسمح بالتنزيل للتحديث
+	Added. It downloads once downloads are allowed.	أُضيف. يُنزَّل عند السماح بالتنزيل.
+	Remove {source}	إزالة {source}
+	The source couldn't be added: {error}	تعذّرت إضافة المصدر: {error}
+	The source couldn't be removed: {error}	تعذّرت إزالة المصدر: {error}
+@plural	{n} font source couldn't be loaded|{n} font sources couldn't be loaded	تعذّر تحميل {n} مصدر خطوط|تعذّر تحميل {n} مصدر خطوط|تعذّر تحميل {n} مصدر خطوط|تعذّر تحميل {n} مصادر خطوط|تعذّر تحميل {n} مصدرًا للخطوط|تعذّر تحميل {n} مصدر خطوط
diff --git a/crates/font-manager/src/panel/catalogs/ja.tsv b/crates/font-manager/src/panel/catalogs/ja.tsv
new file mode 100644
index 00000000..225bb795
--- /dev/null
+++ b/crates/font-manager/src/panel/catalogs/ja.tsv
@@ -0,0 +1,113 @@
+# Japanese (ja) catalog for Craft Font Manager's panel.
+# Format: context<TAB>source<TAB>translation; @plural rows list the locale's plural forms.
+# Style and weight names (Regular, Bold, Italic), licence names and product names stay in English.
+	All categories	すべてのカテゴリ
+	All fonts	すべてのフォント
+	All sources	すべての入手元
+	Allow downloads	ダウンロードを許可
+	Alphabet	アルファベット
+	Any language	すべての言語
+	Any script	すべての文字体系
+	Browse	探す
+	Cancel	キャンセル
+	Category	カテゴリ
+	Clear filters	絞り込みを解除
+	Clear search and filters	検索と絞り込みを解除
+	Close	閉じる
+	Couldn't download	ダウンロードできませんでした
+	Couldn't install	インストールできませんでした
+	Couldn't remove	削除できませんでした
+	Designer	デザイナー
+	Display	ディスプレイ
+	Download from Google Fonts?	Google Fonts からダウンロードしますか？
+	Download size	ダウンロードサイズ
+	Download	ダウンロード
+	Downloading	ダウンロード中
+	Downloads are off	ダウンロードはオフです
+	Downloads stay allowed until you turn them off.	ダウンロードは、オフにするまで許可されたままです。
+	Downloads	ダウンロード
+	Every Craft app uses the fonts in the font store. System fonts are added and removed with your system's own font tools.	フォントストアのフォントはすべての Craft アプリで使えます。システムフォントの追加と削除は、システムのフォント管理ツールで行います。
+	Files	ファイル
+	Find a language	言語を検索
+	Font store	フォントストア
+	Fonts that aren't installed show a sample once you preview them. Nothing is downloaded until you allow it.	インストールしていないフォントは、プレビューするとサンプルが表示されます。許可するまで何もダウンロードされません。
+	Fonts you install from Browse go here, for every Craft app.	「探す」からインストールしたフォントがここに表示され、すべての Craft アプリで使えます。
+	From Google Fonts' GitHub repository, only when you install or preview a font.	フォントをインストールまたはプレビューするときにだけ、Google Fonts の GitHub リポジトリからダウンロードします。
+	Handwriting	手書き
+	Hide this note	このお知らせを隠す
+	Install all	すべてインストール
+	Install	インストール
+	Installed on this system	このシステムにインストール済み
+	Installed	インストール済み
+	Installing	インストール中
+	Language	言語
+	Looking for installed fonts…	インストール済みのフォントを探しています…
+	Monospace	等幅
+	Name in English or in the language	英語名またはその言語での名前
+	No fonts match	一致するフォントはありません
+	No installed fonts match	一致するインストール済みフォントはありません
+	Not installed	未インストール
+	Numerals	数字と記号
+	Preview	プレビュー
+	Remove all	すべて削除
+	Remove	削除
+	Removed with your system's font tools	システムのフォントツールで削除します
+	Removing	削除中
+	Retry	再試行
+	Sample text	サンプルテキスト
+	Sample	サンプル
+	Sans serif	サンセリフ
+	Script	文字体系
+	Scripts	文字体系
+	Search fonts by name	フォントを名前で検索
+	Search installed fonts	インストール済みのフォントを検索
+	Search	検索
+	Sentence	文
+	Serif	セリフ
+	Show	表示
+	Size	サイズ
+	Source	入手元
+	Styles	スタイル
+	System fonts are removed with your system's own font tools.	システムフォントは、システムのフォント管理ツールで削除します。
+	System	システム
+	Try another name, or fewer filters.	別の名前を試すか、絞り込みを減らしてください。
+	Try another name.	別の名前を試してください。
+	Designed by {designer}	デザイン: {designer}
+	Install {family}	{family} をインストール
+	Install {style}	{style} をインストール
+	Languages · {n}	言語 · {n}
+	Preview downloads this font ({size}) for this session without installing it.	プレビューでは、このフォント ({size}) をこのセッションの間だけダウンロードし、インストールはしません。
+	Preview {family}	{family} をプレビュー
+	Remove {family}	{family} を削除
+	Remove {style}	{style} を削除
+	The Google Fonts index can't be read: {error}	Google Fonts の一覧を読み込めません: {error}
+	The download setting couldn't be saved: {error}	ダウンロードの設定を保存できませんでした: {error}
+	{list} and {n} more	{list} ほか {n} 言語
+	{percent} %	{percent}%
+	{size} download	ダウンロード {size}
+	{size} px	{size}px
+	Craft Font Manager downloads {family} ({size}) from Google Fonts' GitHub repository through jsDelivr, and checks every file before using it.	Craft Font Manager は {family} ({size}) を Google Fonts の GitHub リポジトリから jsDelivr 経由でダウンロードし、使う前にすべてのファイルを確認します。
+@plural	{n} style|{n} styles	{n} スタイル
+@plural	{n} style installed|{n} styles installed	インストール済み {n} スタイル
+@plural	{n} family|{n} families	{n} ファミリー
+	Licence	ライセンス
+	Try again	もう一度試す
+	Not curated	未審査
+	This family comes from a source you added. Craft doesn't review it.	このファミリーは追加したソースのものです。Craft は審査していません。
+	The font indexes can't be read: {error}	フォントの一覧を読み込めません: {error}
+	{source}: {error}	{source}: {error}
+	This family comes from a source you added ({url}). Craft doesn't review its fonts or their licences.	このファミリーは追加したソース ({url}) のものです。Craft はフォントもライセンスも審査していません。
+	Changed since added	追加後に変更あり
+	The index at this address isn't the one first downloaded from it. Check the source before installing from it.	このアドレスの一覧は、最初にダウンロードしたものと異なります。インストールする前にソースを確認してください。
+	Add a source	ソースを追加
+	Add	追加
+	Index address	一覧のアドレス
+	A source you add isn't reviewed: add only indexes you trust. Every font is still checked against its index before it is used.	追加したソースは審査されません。信頼できる一覧だけを追加してください。どのフォントも、使う前に一覧と照合されます。
+	Downloading the sources…	ソースをダウンロードしています…
+	Update sources	ソースを更新
+	Allow downloads to update	更新するにはダウンロードを許可してください
+	Added. It downloads once downloads are allowed.	追加しました。ダウンロードを許可するとダウンロードされます。
+	Remove {source}	{source} を削除
+	The source couldn't be added: {error}	ソースを追加できませんでした: {error}
+	The source couldn't be removed: {error}	ソースを削除できませんでした: {error}
+@plural	{n} font source couldn't be loaded|{n} font sources couldn't be loaded	{n} 件のフォントソースを読み込めませんでした
diff --git a/crates/font-manager/src/panel/details.rs b/crates/font-manager/src/panel/details.rs
new file mode 100644
index 00000000..daaaed52
--- /dev/null
+++ b/crates/font-manager/src/panel/details.rs
@@ -0,0 +1,532 @@
+//! The details sheet: a family's every style in its own face, its facts and languages, and
+//! installing or removing it whole or a style at a time.
+
+use std::sync::Arc;
+
+use craft_ui::direction;
+use egui::{
+    Align, Color32, Context, CornerRadius, FontFamily, FontId, Id, Layout, Margin, Order, Rect, RichText, Sense, Stroke, StrokeKind, Ui, UiBuilder,
+    vec2,
+};
+
+use crate::index::{Family, FontFile, Index, script_name, source_label};
+use crate::panel::app::{Detail, FontsPanel, Pending, category_label, family_key, regular, source_name, style_count, style_name};
+use crate::panel::faces::Owner;
+use crate::panel::i18n::{self, fmt, tl, tn};
+use crate::panel::jobs::Kind;
+use crate::panel::widgets::{self, Glyph, Skin};
+use crate::{FaceInfo, Source};
+
+/// From this width the sheet reads in two columns.
+const COLUMNS_FROM: f32 = 760.0;
+
+/// What a style row offers at its end.
+enum RowAction {
+    None,
+    Install(String),
+    Remove(Box<FaceInfo>),
+    Running(Option<f32>),
+}
+
+struct StyleRow {
+    label: String,
+    face: Option<(Owner, FaceInfo)>,
+    action: RowAction,
+}
+
+fn weight_name(weight: u16) -> &'static str {
+    match weight {
+        0..=149 => tl!("Thin"),
+        150..=249 => tl!("ExtraLight"),
+        250..=349 => tl!("Light"),
+        350..=449 => tl!("Regular"),
+        450..=549 => tl!("Medium"),
+        550..=649 => tl!("SemiBold"),
+        650..=749 => tl!("Bold"),
+        750..=849 => tl!("ExtraBold"),
+        _ => tl!("Black"),
+    }
+}
+
+/// "Bold Italic", or "Variable 100–900" for a variable file.
+fn file_label(file: &FontFile) -> String {
+    let base = match file.axes.iter().find(|a| a.tag == "wght") {
+        Some(a) => fmt("Variable {from}–{to}", &[("from", &(a.min.round() as u32).to_string()), ("to", &(a.max.round() as u32).to_string())]),
+        None => weight_name(file.weight).to_owned(),
+    };
+    match (file.is_italic(), file.weight) {
+        (true, 350..=449) if file.axes.is_empty() => tl!("Italic").to_owned(),
+        (true, _) => format!("{base} {}", tl!("Italic")),
+        (false, _) => base,
+    }
+}
+
+fn licence_name(id: &str) -> &str {
+    match id {
+        "OFL" => tl!("SIL Open Font License"),
+        "APACHE2" => tl!("Apache License 2.0"),
+        "UFL" => tl!("Ubuntu Font Licence"),
+        other => other,
+    }
+}
+
+fn file_name(face: &FaceInfo) -> Option<String> {
+    face.path.as_ref().and_then(|p| p.file_name()).map(|n| n.to_string_lossy().into_owned())
+}
+
+/// The index file a face comes from: by PostScript name, else by weight and slant.
+fn file_of<'a>(family: &'a Family, face: &FaceInfo) -> Option<&'a FontFile> {
+    let by_name = file_name(face).and_then(|n| family.files.iter().find(|f| f.file_name() == n));
+    let by_postscript = || face.postscript_name.as_ref().and_then(|ps| family.files.iter().find(|f| f.postscript.contains(ps)));
+    by_name.or_else(by_postscript).or_else(|| family.files.iter().find(|f| f.has_weight(face.weight.round() as u16, face.italic)))
+}
+
+impl FontsPanel {
+    pub(crate) fn details(&mut self, ctx: &Context, area: Rect) {
+        let open = self.detail.is_some();
+        let k = ctx.animate_bool_with_time(Id::unique("craft-fonts.sheet"), open, ctx.global_style().animation_time * 1.5);
+        let Some(detail) = self.detail.clone() else { return };
+        let s = self.skin.clone();
+        let dark = ctx.theme() == egui::Theme::Dark;
+        let width = (area.width() - 48.0).clamp(300.0, 1040.0).min(area.width());
+        let height = (area.height() - 32.0).max(200.0).min(area.height());
+        let sheet = Rect::from_center_size(area.center() + vec2(0.0, (1.0 - k) * 16.0), vec2(width, height));
+        let mut close = false;
+        egui::Area::new(Id::unique("craft-fonts.details")).order(Order::Foreground).fixed_pos(area.min).constrain(false).show(ctx, |ui| {
+            let (rect, scrim) = ui.allocate_exact_size(area.size(), Sense::click());
+            let alpha = if dark { 165.0 } else { 100.0 } * k;
+            ui.painter().rect_filled(rect, CornerRadius::ZERO, Color32::from_black_alpha(alpha.round() as u8));
+            close |= scrim.clicked();
+            // Clicks on the sheet's own empty space stay on the sheet.
+            let _ = ui.interact(sheet, Id::unique("craft-fonts.sheet-bg"), Sense::click());
+            let painter = ui.painter();
+            painter.add(
+                egui::epaint::Shadow { offset: [0, 8], blur: 24, spread: 0, color: Color32::from_black_alpha(if dark { 140 } else { 36 }) }
+                    .as_shape(sheet, s.look.corner),
+            );
+            painter.rect(sheet, s.look.corner, s.p.bg, Stroke::new(1.0, s.p.line_strong), StrokeKind::Inside);
+            let mut child = ui.new_child(UiBuilder::new().max_rect(sheet).layout(direction::column(ui)));
+            child.set_opacity(k.clamp(0.0, 1.0));
+            child.set_clip_rect(sheet);
+            egui::ScrollArea::vertical().id_salt(("craft-fonts.sheet-scroll", format!("{detail:?}"))).auto_shrink([false, false]).show(
+                &mut child,
+                |ui| {
+                    egui::Frame::new().inner_margin(Margin::same(24)).show(ui, |ui| {
+                        ui.set_width(ui.available_width());
+                        ui.with_layout(direction::column(ui), |ui| {
+                            ui.spacing_mut().item_spacing.y = 8.0;
+                            close |= match &detail {
+                                Detail::Family(i) => self.family_sheet(ui, &s, *i),
+                                Detail::Installed(name, source) => self.installed_sheet(ui, &s, name, *source),
+                            };
+                        });
+                    });
+                },
+            );
+        });
+        if close {
+            self.detail = None;
+        }
+    }
+
+    /// The eyebrow, the close button and the title; returns whether Close was clicked.
+    fn sheet_header(&mut self, ui: &mut Ui, s: &Skin, eyebrow: &str, title: &str, byline: Option<String>, face: Option<(Owner, FaceInfo)>) -> bool {
+        let mut close = false;
+        // "Aa" in the face, large, at the header's reading end under the close button.
+        if let Some((owner, face)) = face {
+            let catalog = match owner {
+                Owner::Installed => Arc::clone(&self.catalog),
+                Owner::Preview => Arc::clone(&self.previews),
+            };
+            if let crate::panel::faces::Shown::Ready(family) = self.faces.family(ui.ctx(), &catalog, owner, &face) {
+                let top = ui.cursor().top();
+                let end = direction::end_x(ui, ui.max_rect()) - direction::forward(ui) * (s.h() + 24.0);
+                let anchor = if direction::is_rtl(ui) { egui::Align2::LEFT_TOP } else { egui::Align2::RIGHT_TOP };
+                ui.painter().text(egui::pos2(end, top - 14.0), anchor, "Aa", FontId::new(96.0, family), s.p.ink_strong);
+            }
+        }
+        ui.allocate_ui_with_layout(vec2(ui.available_width(), s.h()), direction::row(ui), |ui| {
+            widgets::label(ui, s, eyebrow, s.p.faint);
+            ui.with_layout(direction::trailing(ui), |ui| {
+                close = widgets::glyph_button(ui, s, Glyph::Close, tl!("Close"), s.h()).clicked();
+            });
+        });
+        let title = RichText::new(title).size(30.0).family(s.look.display.clone()).color(s.p.ink_strong).extra_letter_spacing(-0.4);
+        ui.add(egui::Label::new(title).wrap());
+        if let Some(by) = byline {
+            ui.label(RichText::new(by).color(s.p.muted));
+        }
+        ui.add_space(6.0);
+        close
+    }
+
+    fn family_sheet(&mut self, ui: &mut Ui, s: &Skin, i: usize) -> bool {
+        let ctx = ui.ctx().clone();
+        let Some(index) = self.index() else { return true };
+        let Some(family) = index.families().get(i).cloned() else { return true };
+        let key = family_key(&family.source, &family.family);
+        let installed: Vec<FaceInfo> = self.installed_by_name.get(&family.family.to_lowercase()).cloned().unwrap_or_default();
+        let store: Vec<FaceInfo> = installed.iter().filter(|f| f.source == Source::Store).cloned().collect();
+        let on_system = !installed.is_empty() && store.is_empty();
+        let previewed = self.previewed.get(&key).cloned();
+        let job = self.jobs.of(&family.source, &family.family).map(|j| (j.kind, j.file.clone(), j.fraction()));
+        let (source, curated) = source_label(&index, &family);
+        let eyebrow = [source.to_owned(), category_label(&family)].join(" · ");
+        let by = (!family.designer.is_empty()).then(|| fmt("Designed by {designer}", &[("designer", &family.designer)]));
+        let hero = regular(&installed).cloned().map(|f| (Owner::Installed, f));
+        let hero = hero.or_else(|| previewed.as_deref().and_then(regular).cloned().map(|f| (Owner::Preview, f)));
+        let close = self.sheet_header(ui, s, &eyebrow, &family.family, by, hero);
+
+        // Install or remove the whole family.
+        let size = i18n::size(family.size());
+        let all_installed =
+            !installed.is_empty() && (on_system || family.files.iter().all(|f| store.iter().any(|x| file_name(x).as_deref() == Some(f.file_name()))));
+        ui.allocate_ui_with_layout(vec2(ui.available_width(), s.h()), direction::row(ui), |ui| {
+            ui.spacing_mut().item_spacing.x = 10.0;
+            match &job {
+                Some((kind, None, fraction)) => {
+                    let what = match kind {
+                        Kind::Install => tl!("Installing"),
+                        Kind::Remove => tl!("Removing"),
+                        Kind::Preview => tl!("Downloading"),
+                    };
+                    self.progress(ui, s, what, *fraction, 220.0);
+                }
+                _ => {
+                    if all_installed {
+                        widgets::badge(ui, s, if on_system { tl!("Installed on this system") } else { tl!("Installed") }, s.p.good, true);
+                    } else if widgets::button(ui, s, tl!("Install all"), widgets::Kind::Primary, s.h(), 0.0).clicked() {
+                        self.ask(&ctx, Pending::Install(i));
+                    }
+                    if !store.is_empty() && widgets::button(ui, s, tl!("Remove all"), widgets::Kind::Danger, s.h(), 0.0).clicked() {
+                        self.remove(&ctx, &family.family, &store, true);
+                    }
+                    if installed.is_empty()
+                        && previewed.is_none()
+                        && widgets::button(ui, s, tl!("Preview"), widgets::Kind::Secondary, s.h(), 0.0).clicked()
+                    {
+                        self.ask(&ctx, Pending::Preview(i));
+                    }
+                    widgets::label(ui, s, &fmt("{size} download", &[("size", &size)]), s.p.faint);
+                }
+            }
+        });
+        if installed.is_empty() && previewed.is_none() {
+            let note = fmt("Preview downloads this font ({size}) for this session without installing it.", &[("size", &size)]);
+            ui.label(RichText::new(note).size(12.5).color(s.p.muted));
+        }
+        if !curated {
+            ui.add_space(4.0);
+            let added = index.source_of(&family).and_then(|f| f.user_url.clone()).unwrap_or_default();
+            widgets::note(ui, s, |ui| {
+                ui.vertical(|ui| {
+                    ui.spacing_mut().item_spacing.y = 2.0;
+                    ui.label(RichText::new(tl!("Not curated")).color(s.p.warn));
+                    let text = fmt(
+                        "This family comes from a source you added ({url}). Craft doesn't review its fonts or their licences.",
+                        &[("url", &added)],
+                    );
+                    ui.add(egui::Label::new(RichText::new(text).size(12.5).color(s.p.muted)).wrap());
+                });
+            });
+        }
+        if let Some(failure) = self.failed.get(&key).cloned() {
+            ui.add_space(4.0);
+            let what = match failure.kind {
+                Kind::Install => tl!("Couldn't install"),
+                Kind::Remove => tl!("Couldn't remove"),
+                Kind::Preview => tl!("Couldn't download"),
+            };
+            let buttons: &[&str] = if failure.retry.is_some() { &[tl!("Retry")] } else { &[] };
+            let mut retry = false;
+            widgets::note_with_actions(
+                ui,
+                s,
+                |ui| {
+                    ui.label(RichText::new(what).color(s.p.bad));
+                    ui.add(egui::Label::new(RichText::new(&failure.error).size(12.5).color(s.p.muted)).wrap());
+                },
+                buttons,
+                |ui, _| retry = widgets::button(ui, s, tl!("Retry"), widgets::Kind::Secondary, 28.0, 0.0).clicked(),
+                false,
+            );
+            if retry && let Some(pending) = failure.retry.clone() {
+                self.ask(&ctx, pending);
+            }
+        }
+        ui.add_space(14.0);
+
+        let rows = self.family_rows(&family, &installed, &store, on_system, previewed.as_deref(), &job);
+        let mut facts = family_facts(&index, &family, &size);
+        let source_fact = if curated { source.to_owned() } else { format!("{source} · {}", tl!("Not curated")) };
+        facts.insert(0, (tl!("Source").to_owned(), source_fact));
+        // Most speakers first: the list is cut short.
+        let mut languages: Vec<_> = family.languages(&index).filter(|l| !l.historical).collect();
+        languages.sort_by(|a, b| b.population.cmp(&a.population).then_with(|| a.name.cmp(&b.name)));
+        let languages: Vec<String> = languages.into_iter().map(|l| l.name.clone()).collect();
+        self.sheet_body(ui, s, i, &family.family, &family.scripts, rows, facts, languages);
+        close
+    }
+
+    fn family_rows(
+        &self,
+        family: &Family,
+        installed: &[FaceInfo],
+        store: &[FaceInfo],
+        on_system: bool,
+        previewed: Option<&[FaceInfo]>,
+        job: &Option<(Kind, Option<String>, Option<f32>)>,
+    ) -> Vec<StyleRow> {
+        let running = |path: &str| match job {
+            Some((Kind::Install, Some(p), fraction)) if p == path => Some(*fraction),
+            _ => None,
+        };
+        let mut rows = Vec::new();
+        for face in installed {
+            let action = match job {
+                Some((Kind::Remove, Some(p), _)) if face.path.as_ref().is_some_and(|x| x.display().to_string() == *p) => RowAction::Running(None),
+                _ if face.source == Source::Store => RowAction::Remove(Box::new(face.clone())),
+                _ => RowAction::None,
+            };
+            rows.push(StyleRow { label: style_name(face).to_owned(), face: Some((Owner::Installed, face.clone())), action });
+        }
+        if on_system {
+            return rows;
+        }
+        for file in &family.files {
+            if store.iter().any(|x| file_name(x).as_deref() == Some(file.file_name())) {
+                continue;
+            }
+            let preview_faces: Vec<&FaceInfo> =
+                previewed.unwrap_or_default().iter().filter(|f| file_of(family, f).is_some_and(|x| x.path == file.path)).collect();
+            let action = match running(&file.path) {
+                Some(fraction) => RowAction::Running(fraction),
+                None => RowAction::Install(file.path.clone()),
+            };
+            if preview_faces.is_empty() {
+                rows.push(StyleRow { label: file_label(file), face: None, action });
+            } else {
+                for (n, face) in preview_faces.iter().enumerate() {
+                    // A variable file's instances install together: the file's action on its first.
+                    let action = if n == 0 { action_clone(&action) } else { RowAction::None };
+                    rows.push(StyleRow { label: style_name(face).to_owned(), face: Some((Owner::Preview, (*face).clone())), action });
+                }
+            }
+        }
+        rows
+    }
+
+    fn installed_sheet(&mut self, ui: &mut Ui, s: &Skin, name: &str, source: Source) -> bool {
+        let ctx = ui.ctx().clone();
+        let Some(family) = self.installed.iter().find(|f| f.name == name && f.source == source).cloned() else { return true };
+        let hero = regular(&family.faces).cloned().map(|f| (Owner::Installed, f));
+        let close = self.sheet_header(ui, s, source_name(source), &family.name, None, hero);
+        let job = self.jobs.of("", &family.name).map(|j| (j.kind, j.file.clone(), j.fraction()));
+        ui.allocate_ui_with_layout(vec2(ui.available_width(), s.h()), direction::row(ui), |ui| {
+            ui.spacing_mut().item_spacing.x = 10.0;
+            if let Some((Kind::Remove, None, _)) = &job {
+                self.progress(ui, s, tl!("Removing"), None, 220.0);
+                return;
+            }
+            let remove =
+                ui.add_enabled_ui(family.removable(), |ui| widgets::button(ui, s, tl!("Remove all"), widgets::Kind::Danger, s.h(), 0.0)).inner;
+            if !family.removable() {
+                let _ = remove.on_disabled_hover_text(tl!("System fonts are removed with your system's own font tools."));
+                widgets::label(ui, s, tl!("Removed with your system's font tools"), s.p.faint);
+            } else if remove.clicked() {
+                self.remove(&ctx, &family.name, &family.faces, true);
+            }
+        });
+        ui.add_space(14.0);
+        let rows = family
+            .faces
+            .iter()
+            .map(|face| StyleRow {
+                label: style_name(face).to_owned(),
+                face: Some((Owner::Installed, face.clone())),
+                action: if face.source == Source::Store { RowAction::Remove(Box::new(face.clone())) } else { RowAction::None },
+            })
+            .collect();
+        let mut files: Vec<_> = family.faces.iter().filter_map(|f| f.path.clone()).collect();
+        files.sort();
+        files.dedup();
+        let facts = vec![
+            (tl!("Source").to_owned(), source_name(source).to_owned()),
+            (tl!("Styles").to_owned(), i18n::number(family.faces.len() as u64)),
+            (tl!("Files").to_owned(), i18n::number(files.len() as u64)),
+        ];
+        let scripts = self.index().and_then(|index| index.family(&family.name).map(|f| f.scripts.clone())).unwrap_or_default();
+        self.sheet_body(ui, s, usize::MAX, &family.name, &scripts, rows, facts, Vec::new());
+        close
+    }
+
+    fn progress(&self, ui: &mut Ui, s: &Skin, what: &str, fraction: Option<f32>, width: f32) {
+        let text = match fraction {
+            Some(f) => format!("{what} {}", fmt("{percent} %", &[("percent", &i18n::number((f * 100.0).round() as u64))])),
+            None => format!("{what}…"),
+        };
+        let (rect, resp) = ui.allocate_exact_size(vec2(width, s.h()), Sense::hover());
+        let galley = s.label_galley(ui, &text, s.p.muted);
+        widgets::paint_start(ui, rect.with_max_y(rect.bottom() - 10.0), galley, s.p.muted);
+        widgets::progress_bar(ui, s, egui::Rect::from_min_max(egui::pos2(rect.left(), rect.bottom() - 4.0), rect.max), fraction);
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ProgressIndicator, true, &text));
+    }
+
+    /// The styles, and beside them (or below, when narrow) the facts and languages.
+    #[allow(clippy::too_many_arguments)]
+    fn sheet_body(
+        &mut self,
+        ui: &mut Ui,
+        s: &Skin,
+        family_index: usize,
+        family: &str,
+        scripts: &[String],
+        rows: Vec<StyleRow>,
+        facts: Vec<(String, String)>,
+        languages: Vec<String>,
+    ) {
+        let total = ui.available_width();
+        let wide = total >= COLUMNS_FROM;
+        let gap = 32.0;
+        let side_w = if wide { (total * 0.32).clamp(240.0, 320.0) } else { total };
+        let styles_w = if wide { total - side_w - gap } else { total };
+        let rtl = direction::is_rtl(ui);
+        let layout =
+            if wide { if rtl { Layout::right_to_left(Align::Min) } else { Layout::left_to_right(Align::Min) } } else { direction::column(ui) };
+        ui.allocate_ui_with_layout(vec2(total, 0.0), layout, |ui| {
+            ui.spacing_mut().item_spacing = vec2(gap, 14.0);
+            ui.allocate_ui_with_layout(vec2(styles_w, 0.0), direction::column(ui), |ui| {
+                ui.set_width(styles_w);
+                self.style_rows(ui, s, family_index, family, scripts, rows);
+            });
+            ui.allocate_ui_with_layout(vec2(side_w, 0.0), direction::column(ui), |ui| {
+                ui.set_width(side_w);
+                facts_box(ui, s, &facts);
+                if !languages.is_empty() {
+                    ui.add_space(8.0);
+                    let title = fmt("Languages · {n}", &[("n", &i18n::number(languages.len() as u64))]);
+                    widgets::label(ui, s, &title, s.p.faint);
+                    const SHOWN: usize = 60;
+                    let mut text = languages.iter().take(SHOWN).cloned().collect::<Vec<_>>().join(", ");
+                    if languages.len() > SHOWN {
+                        text = fmt("{list} and {n} more", &[("list", &text), ("n", &i18n::number((languages.len() - SHOWN) as u64))]);
+                    }
+                    ui.add(egui::Label::new(RichText::new(text).size(13.0).color(s.p.muted)).wrap());
+                }
+            });
+        });
+    }
+
+    fn style_rows(&mut self, ui: &mut Ui, s: &Skin, family_index: usize, family: &str, scripts: &[String], rows: Vec<StyleRow>) {
+        let ctx = ui.ctx().clone();
+        let installed = rows.iter().filter(|r| matches!(r.face, Some((Owner::Installed, _)))).count();
+        let title = if installed == rows.len() {
+            tn(rows.len() as u64, "{n} style installed", "{n} styles installed")
+        } else {
+            tn(rows.len() as u64, "{n} style", "{n} styles")
+        };
+        widgets::label(ui, s, &title, s.p.faint);
+        let sample = self.sample_for(scripts.iter().map(String::as_str));
+        let size = self.settings.size.max(24.0);
+        let width = ui.available_width();
+        for row in rows {
+            let top = ui.cursor().top();
+            ui.painter().hline(ui.max_rect().x_range(), top, s.hairline());
+            ui.add_space(10.0);
+            ui.allocate_ui_with_layout(vec2(width, 28.0), direction::row(ui), |ui| {
+                widgets::label(ui, s, &row.label, s.p.muted);
+                ui.with_layout(direction::trailing(ui), |ui| match &row.action {
+                    RowAction::None => {}
+                    RowAction::Running(fraction) => self.progress(ui, s, tl!("Installing"), *fraction, 140.0),
+                    RowAction::Install(path) => {
+                        let install = widgets::button(ui, s, tl!("Install"), widgets::Kind::Secondary, 28.0, 0.0);
+                        widgets::name(ui, &install, &fmt("Install {style}", &[("style", &row.label)]));
+                        if install.clicked() && family_index != usize::MAX {
+                            self.ask(&ctx, Pending::InstallFile(family_index, path.clone()));
+                        }
+                    }
+                    RowAction::Remove(face) => {
+                        let remove = widgets::button(ui, s, tl!("Remove"), widgets::Kind::Danger, 28.0, 0.0);
+                        widgets::name(ui, &remove, &fmt("Remove {style}", &[("style", &row.label)]));
+                        if remove.clicked() {
+                            self.remove(&ctx, family, std::slice::from_ref(face), false);
+                        }
+                    }
+                });
+            });
+            ui.add_space(2.0);
+            self.wrapped_sample(ui, s, row.face.as_ref(), &sample, size, width);
+            ui.add_space(12.0);
+        }
+    }
+
+    /// `text` in the face, wrapped to `width`; faint in the interface font when the face isn't here.
+    fn wrapped_sample(&mut self, ui: &mut Ui, s: &Skin, face: Option<&(Owner, FaceInfo)>, text: &str, size: f32, width: f32) {
+        let (family, color) = match face {
+            Some((owner, face)) => {
+                let catalog = match owner {
+                    Owner::Installed => Arc::clone(&self.catalog),
+                    Owner::Preview => Arc::clone(&self.previews),
+                };
+                match self.faces.family(ui.ctx(), &catalog, *owner, face) {
+                    crate::panel::faces::Shown::Ready(family) => (family, s.p.ink),
+                    crate::panel::faces::Shown::Loading => {
+                        ui.allocate_space(vec2(width, size * 1.3));
+                        return;
+                    }
+                    crate::panel::faces::Shown::Unavailable => (FontFamily::Proportional, s.p.faint),
+                }
+            }
+            None => (FontFamily::Proportional, s.p.faint),
+        };
+        let size = if face.is_some() { size } else { size.min(20.0) };
+        // Sample text keeps its own direction whatever the interface's.
+        let align = if craft_i18n::base_direction(text) == Some(craft_i18n::Direction::Rtl) { Align::Max } else { Align::Min };
+        ui.allocate_ui_with_layout(vec2(width, 0.0), Layout::top_down(align), |ui| {
+            ui.add(egui::Label::new(RichText::new(text).font(FontId::new(size, family)).color(color)).wrap());
+        });
+    }
+}
+
+fn action_clone(action: &RowAction) -> RowAction {
+    match action {
+        RowAction::None => RowAction::None,
+        RowAction::Install(p) => RowAction::Install(p.clone()),
+        RowAction::Remove(f) => RowAction::Remove(f.clone()),
+        RowAction::Running(f) => RowAction::Running(*f),
+    }
+}
+
+fn family_facts(index: &Index, family: &Family, size: &str) -> Vec<(String, String)> {
+    let scripts: Vec<&str> = family.scripts.iter().map(|id| script_name(index, id).unwrap_or(id)).collect();
+    let mut facts = Vec::new();
+    if !family.designer.is_empty() {
+        facts.push((tl!("Designer").to_owned(), family.designer.clone()));
+    }
+    facts.push((tl!("Licence").to_owned(), licence_name(&family.license).to_owned()));
+    facts.push((tl!("Styles").to_owned(), i18n::number(style_count(family) as u64)));
+    facts.push((tl!("Files").to_owned(), i18n::number(family.files.len() as u64)));
+    facts.push((tl!("Download size").to_owned(), size.to_owned()));
+    if !scripts.is_empty() {
+        facts.push((tl!("Scripts").to_owned(), scripts.join(", ")));
+    }
+    facts
+}
+
+/// Facts in a hairline box, each a small label over its value.
+fn facts_box(ui: &mut Ui, s: &Skin, facts: &[(String, String)]) {
+    egui::Frame::new().stroke(s.hairline()).corner_radius(s.look.corner).inner_margin(Margin::symmetric(14, 12)).show(ui, |ui| {
+        ui.set_width(ui.available_width());
+        ui.spacing_mut().item_spacing.y = 3.0;
+        for (n, (label, value)) in facts.iter().enumerate() {
+            if n > 0 {
+                ui.add_space(6.0);
+                let y = ui.cursor().top();
+                ui.painter().hline(ui.max_rect().x_range(), y, s.hairline());
+                ui.add_space(8.0);
+            }
+            widgets::label(ui, s, label, s.p.faint);
+            ui.add(egui::Label::new(RichText::new(value).color(s.p.ink)).wrap());
+        }
+    });
+}
diff --git a/crates/font-manager/src/panel/faces.rs b/crates/font-manager/src/panel/faces.rs
new file mode 100644
index 00000000..54f0f54c
--- /dev/null
+++ b/crates/font-manager/src/panel/faces.rs
@@ -0,0 +1,142 @@
+//! Drawing text in a font face itself: each face shown becomes an egui font family of its own.
+//!
+//! Adding a font makes egui rebuild its fonts, so faces are added a few per frame, and once more
+//! than [`MAX_REGISTERED`] are loaded the ones not drawn in the last frame are taken out again,
+//! which keeps memory to the faces on screen. Faces still on screen stay, however many there are,
+//! so a full screen doesn't load its faces again every frame. Only the panel's own faces are
+//! touched: the host's fonts stay as they are.
+
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+
+use crate::{Catalog, FaceInfo};
+use egui::epaint::text::{Blob, FontInsert, FontPriority, InsertFontFamily, VariationCoords};
+use egui::{Context, FontData, FontFamily, FontTweak};
+
+const MAX_REGISTERED: usize = 64;
+const PER_FRAME: usize = 6;
+/// Larger files are not drawn: a whole CJK family can be hundreds of megabytes.
+const MAX_FILE_BYTES: u64 = 48 << 20;
+
+/// Whose catalog a face belongs to.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Owner {
+    /// The installed fonts.
+    Installed,
+    /// Files downloaded for a preview.
+    Preview,
+}
+
+pub enum Shown {
+    Ready(FontFamily),
+    Loading,
+    Unavailable,
+}
+
+#[derive(Default)]
+pub struct FaceFonts {
+    /// Each face's family and the frame it was last drawn in.
+    registered: HashMap<String, (FontFamily, u64)>,
+    failed: HashSet<String>,
+    budget: usize,
+    frame: u64,
+}
+
+fn key(owner: Owner, face: &FaceInfo) -> String {
+    let file = match &face.path {
+        Some(path) => path.display().to_string(),
+        None => face.postscript_name.clone().or_else(|| face.full_name.clone()).unwrap_or_else(|| face.family.clone()),
+    };
+    let coords: String = face.variations.iter().map(|(tag, v)| format!(" {}={v}", String::from_utf8_lossy(tag))).collect();
+    format!("face:{owner:?}:{file}#{}{coords}", face.index)
+}
+
+impl FaceFonts {
+    pub fn begin_frame(&mut self, ctx: &Context) {
+        self.budget = PER_FRAME;
+        let stale = self.next_frame();
+        if !stale.is_empty() {
+            let mut definitions = ctx.fonts(|f| f.definitions().clone());
+            definitions.font_data.retain(|name, _| !stale.contains_key(name));
+            definitions.families.retain(|family, _| !stale.values().any(|f| f == family));
+            ctx.set_fonts(definitions);
+        }
+    }
+
+    /// Starts a frame, and once more than [`MAX_REGISTERED`] faces are registered takes out the
+    /// ones the last frame didn't draw, returning them.
+    fn next_frame(&mut self) -> HashMap<String, FontFamily> {
+        self.frame += 1;
+        if self.registered.len() <= MAX_REGISTERED {
+            return HashMap::new();
+        }
+        let last = self.frame - 1;
+        let stale: Vec<String> = self.registered.iter().filter(|(_, (_, used))| *used < last).map(|(k, _)| k.clone()).collect();
+        stale.into_iter().filter_map(|k| self.registered.remove(&k).map(|(family, _)| (k, family))).collect()
+    }
+
+    /// The family that draws `face`, once egui has loaded it.
+    pub fn family(&mut self, ctx: &Context, catalog: &Catalog, owner: Owner, face: &FaceInfo) -> Shown {
+        let key = key(owner, face);
+        if self.failed.contains(&key) {
+            return Shown::Unavailable;
+        }
+        if let Some((family, used)) = self.registered.get_mut(&key) {
+            *used = self.frame;
+            let loaded = ctx.fonts(|f| f.definitions().families.contains_key(family));
+            if loaded {
+                return Shown::Ready(family.clone());
+            }
+            ctx.request_repaint();
+            return Shown::Loading;
+        }
+        if self.budget == 0 {
+            ctx.request_repaint();
+            return Shown::Loading;
+        }
+        self.budget -= 1;
+        let too_large = face.path.as_ref().and_then(|p| std::fs::metadata(p).ok()).is_some_and(|m| m.len() > MAX_FILE_BYTES);
+        let data = if too_large { None } else { catalog.load(face).ok() };
+        let Some(data) = data else {
+            self.failed.insert(key);
+            return Shown::Unavailable;
+        };
+        let blob: Blob = Arc::new(data.bytes);
+        let tweak = FontTweak { coords: VariationCoords::new(face.variations.iter().map(|(tag, v)| (*tag, *v))), ..Default::default() };
+        let family = FontFamily::Name(key.as_str().into());
+        let insert = InsertFontFamily { family: family.clone(), priority: FontPriority::Highest };
+        ctx.add_font(FontInsert::new(&key, FontData::from_blob(blob, data.index).tweak(tweak), vec![insert]));
+        self.registered.insert(key, (family, self.frame));
+        ctx.request_repaint();
+        Shown::Loading
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_faces_off_screen_are_taken_out() {
+        let mut faces = FaceFonts::default();
+        let register = |faces: &mut FaceFonts, range: std::ops::Range<usize>| {
+            for n in range {
+                faces.registered.insert(format!("face:{n}"), (FontFamily::Name(format!("face:{n}").into()), faces.frame));
+            }
+        };
+        faces.next_frame();
+        register(&mut faces, 0..MAX_REGISTERED);
+        assert!(faces.next_frame().is_empty());
+        // A screen of more faces than the limit keeps them all, frame after frame.
+        register(&mut faces, 0..MAX_REGISTERED + 10);
+        assert!(faces.next_frame().is_empty());
+        register(&mut faces, 0..MAX_REGISTERED + 10);
+        assert!(faces.next_frame().is_empty());
+        // Scrolled on: the faces the last frame didn't draw go, and only those.
+        register(&mut faces, 20..MAX_REGISTERED + 20);
+        let stale = faces.next_frame();
+        assert_eq!(stale.len(), 20);
+        assert!(stale.keys().all(|k| k[5..].parse::<usize>().unwrap() < 20));
+        assert_eq!(faces.registered.len(), MAX_REGISTERED);
+    }
+}
diff --git a/crates/font-manager/src/panel/i18n.rs b/crates/font-manager/src/panel/i18n.rs
new file mode 100644
index 00000000..7e57a818
--- /dev/null
+++ b/crates/font-manager/src/panel/i18n.rs
@@ -0,0 +1,114 @@
+//! Interface strings through craft-i18n: the English text is the lookup key.
+
+use std::cell::Cell;
+use std::sync::LazyLock;
+
+use craft_i18n::{Embedded, FileSize, I18n, Lang};
+
+/// The embedded translation catalogs: the panel's own Japanese and Arabic rows, until its rows
+/// are part of craft-i18n.
+static CATALOGS: &Embedded = &[("ja", "", include_str!("catalogs/ja.tsv")), ("ar", "", include_str!("catalogs/ar.tsv"))];
+
+/// The interface languages offered, in menu order.
+pub const LANGUAGES: &[&str] = &["en", "ja", "ar"];
+
+pub static I18N: LazyLock<I18n> = LazyLock::new(|| {
+    let (i18n, problems) = I18n::new(CATALOGS, LANGUAGES);
+    for problem in problems {
+        log::warn!("translation catalog: {problem}; that string shows in English");
+    }
+    i18n
+});
+
+thread_local! {
+    static CURRENT: Cell<Lang> = const { Cell::new(Lang::EN) };
+}
+
+/// The interface language.
+pub fn current() -> Lang {
+    CURRENT.get()
+}
+
+pub fn set_current(lang: Lang) {
+    CURRENT.set(lang);
+}
+
+/// Translates a literal.
+macro_rules! tl {
+    ($s:expr) => {
+        $crate::panel::i18n::I18N.t($crate::panel::i18n::current(), $s)
+    };
+}
+pub(crate) use tl;
+
+/// Translates `template` and fills its `{name}` placeholders.
+pub fn fmt(template: &str, args: &[(&str, &str)]) -> String {
+    craft_i18n::fmt(I18N.t(current(), template), args)
+}
+
+/// A count with its noun, `{n}` in the English forms.
+pub fn tn(n: u64, one: &str, other: &str) -> String {
+    I18N.trn(current(), n, one, other)
+}
+
+/// A download size, `1.5 MB`.
+pub fn size(bytes: u64) -> String {
+    I18N.file_size(current(), bytes, FileSize::DECIMAL)
+}
+
+/// A count on its own, in the region's digits and grouping.
+pub fn number(n: u64) -> String {
+    I18N.format().integer(n)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Every row reads. The strings the panel shows without a row are listed (run with
+    /// `--nocapture`); they show in English, so a missing row never fails.
+    #[test]
+    fn catalogs_load_and_missing_rows_are_listed() {
+        let (_, problems) = I18n::new(CATALOGS, LANGUAGES);
+        assert!(problems.is_empty(), "{problems:#?}");
+        // English-only by design: style and weight names, licence and product names.
+        let english = [
+            "Thin",
+            "ExtraLight",
+            "Light",
+            "Regular",
+            "Medium",
+            "SemiBold",
+            "Bold",
+            "ExtraBold",
+            "Black",
+            "Italic",
+            "Variable {from}–{to}",
+            "SIL Open Font License",
+            "Apache License 2.0",
+            "Ubuntu Font Licence",
+            "Google Fonts",
+            "{source}: {error}",
+        ];
+        let sources = [include_str!("app.rs"), include_str!("browse.rs"), include_str!("details.rs"), include_str!("sources.rs")];
+        let mut keys = Vec::new();
+        for source in sources {
+            for marker in ["tl!(", "fmt("] {
+                for part in source.split(marker).skip(1) {
+                    if let Some(key) = part.trim_start().strip_prefix('"').and_then(|p| p.find('"').map(|end| &p[..end])) {
+                        keys.push(key.to_owned());
+                    }
+                }
+            }
+        }
+        keys.retain(|k| !english.contains(&k.as_str()));
+        assert!(keys.len() > 60, "{}", keys.len());
+        for lang in ["ja", "ar"] {
+            let lang = I18N.match_tag(lang).unwrap_or(Lang::EN);
+            let missing: Vec<_> = keys.iter().filter(|k| I18N.t(lang, k) == k.as_str()).collect();
+            if !missing.is_empty() {
+                println!("{} is missing {} strings: {missing:#?}", I18N.code(lang), missing.len());
+            }
+        }
+    }
+}
diff --git a/crates/font-manager/src/panel/jobs.rs b/crates/font-manager/src/panel/jobs.rs
new file mode 100644
index 00000000..2a688c02
--- /dev/null
+++ b/crates/font-manager/src/panel/jobs.rs
@@ -0,0 +1,175 @@
+//! Installs, removals and preview downloads, one at a time on a worker thread.
+
+use std::collections::BTreeMap;
+use std::sync::Arc;
+use std::sync::mpsc::{Receiver, Sender, channel};
+
+use crate::Catalog;
+use crate::index::Index;
+use crate::store::{Downloaded, Installer, Progress, RemoveRequest, StoreError};
+
+type Task = Box<dyn FnOnce() + Send>;
+
+/// Where jobs run.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Runner {
+    /// On a worker thread.
+    Thread,
+    /// Right away, on the calling thread (tests).
+    Inline,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Kind {
+    Install,
+    Remove,
+    Preview,
+}
+
+pub struct Running {
+    /// The family's source; empty for a removal, which goes by the installed files.
+    pub source: String,
+    pub family: String,
+    pub kind: Kind,
+    /// One file's index path or store path, when the job is for one style.
+    pub file: Option<String>,
+    pub progress: Progress,
+}
+
+impl Running {
+    /// How far along, when the size is known.
+    pub fn fraction(&self) -> Option<f32> {
+        (self.progress.total > 0).then(|| (self.progress.done as f32 / self.progress.total as f32).clamp(0.0, 1.0))
+    }
+}
+
+pub enum Finished {
+    Installed,
+    Removed,
+    Previewed(Vec<Downloaded>),
+}
+
+enum Msg {
+    Progress(u64, Progress),
+    Done(u64, Result<Finished, StoreError>),
+}
+
+pub enum Request {
+    /// A family of the index, by position.
+    Install(Arc<Index>, usize),
+    /// One file of a family of the index, by its path in the index.
+    InstallFile(Arc<Index>, usize, String),
+    Remove(RemoveRequest),
+    /// A family of the index, by position.
+    Preview(Arc<Index>, usize),
+}
+
+pub struct Jobs {
+    worker: Option<Sender<Task>>,
+    tx: Sender<Msg>,
+    rx: Receiver<Msg>,
+    next: u64,
+    running: BTreeMap<u64, Running>,
+}
+
+impl Jobs {
+    pub fn new(runner: Runner) -> Jobs {
+        let (tx, rx) = channel();
+        let worker = match runner {
+            Runner::Inline => None,
+            Runner::Thread => {
+                let (worker, tasks) = channel::<Task>();
+                let spawned = std::thread::Builder::new().name("font-jobs".into()).spawn(move || {
+                    for task in tasks {
+                        task();
+                    }
+                });
+                if let Err(e) = &spawned {
+                    log::warn!("no worker thread ({e}); font jobs run on the interface thread");
+                }
+                spawned.ok().map(|_| worker)
+            }
+        };
+        Jobs { worker, tx, rx, next: 0, running: BTreeMap::new() }
+    }
+
+    /// The job running for `family` of `source` (any source when empty), if any.
+    pub fn of(&self, source: &str, family: &str) -> Option<&Running> {
+        self.running.values().find(|r| r.family.eq_ignore_ascii_case(family) && (source.is_empty() || r.source.is_empty() || r.source == source))
+    }
+
+    /// Runs `request` through `installer`, then rescans `catalog` after an install or removal.
+    pub fn start(&mut self, ctx: &egui::Context, installer: Arc<dyn Installer>, catalog: Arc<Catalog>, request: Request) {
+        let id = self.next;
+        self.next += 1;
+        let (source, family, kind, file, total) = match &request {
+            Request::Install(index, i) | Request::Preview(index, i) => {
+                let Some(f) = index.families().get(*i) else { return };
+                let kind = if matches!(request, Request::Install(..)) { Kind::Install } else { Kind::Preview };
+                (f.source.clone(), f.family.clone(), kind, None, f.size())
+            }
+            Request::InstallFile(index, i, path) => {
+                let Some(f) = index.families().get(*i) else { return };
+                let size = f.files.iter().find(|x| &x.path == path).map_or(0, |x| x.size);
+                (f.source.clone(), f.family.clone(), Kind::Install, Some(path.clone()), size)
+            }
+            Request::Remove(r) => {
+                let file = if r.whole { None } else { r.files.first().map(|p| p.display().to_string()) };
+                (String::new(), r.family.clone(), Kind::Remove, file, 0)
+            }
+        };
+        self.running.insert(id, Running { source, family, kind, file, progress: Progress { done: 0, total } });
+        let tx = self.tx.clone();
+        let ctx = ctx.clone();
+        let task: Task = Box::new(move || {
+            let mut progress = |p: Progress| {
+                let _ = tx.send(Msg::Progress(id, p));
+                ctx.request_repaint();
+            };
+            let family = |index: &Index, i: usize| index.families().get(i).cloned().ok_or_else(|| StoreError("no such family".into()));
+            let result = match request {
+                Request::Install(index, i) => {
+                    family(&index, i).and_then(|f| installer.install(&index, &f, &mut progress)).map(|()| Finished::Installed)
+                }
+                Request::InstallFile(index, i, path) => {
+                    family(&index, i).and_then(|f| installer.install_file(&index, &f, &path, &mut progress)).map(|()| Finished::Installed)
+                }
+                Request::Remove(r) => installer.remove(&r).map(|()| Finished::Removed),
+                Request::Preview(index, i) => family(&index, i).and_then(|f| installer.download(&index, &f, &mut progress)).map(Finished::Previewed),
+            };
+            if matches!(result, Ok(Finished::Installed | Finished::Removed)) {
+                catalog.rescan();
+            }
+            let _ = tx.send(Msg::Done(id, result));
+            ctx.request_repaint();
+        });
+        match &self.worker {
+            Some(worker) => {
+                if let Err(e) = worker.send(task) {
+                    (e.0)();
+                }
+            }
+            None => task(),
+        }
+    }
+
+    /// Takes the progress reports, and returns the jobs that ended.
+    pub fn poll(&mut self) -> Vec<(Running, Result<Finished, StoreError>)> {
+        let mut done = Vec::new();
+        while let Ok(msg) = self.rx.try_recv() {
+            match msg {
+                Msg::Progress(id, p) => {
+                    if let Some(job) = self.running.get_mut(&id) {
+                        job.progress = p;
+                    }
+                }
+                Msg::Done(id, result) => {
+                    if let Some(job) = self.running.remove(&id) {
+                        done.push((job, result));
+                    }
+                }
+            }
+        }
+        done
+    }
+}
diff --git a/crates/font-manager/src/panel/look.rs b/crates/font-manager/src/panel/look.rs
new file mode 100644
index 00000000..019c7b53
--- /dev/null
+++ b/crates/font-manager/src/panel/look.rs
@@ -0,0 +1,111 @@
+//! The colours and type the panel draws with, so it reads as part of the app that shows it.
+
+use egui::{Color32, Context, CornerRadius, FontFamily, Stroke, Visuals};
+
+/// Colours for one appearance.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Palette {
+    /// Page and card surface.
+    pub bg: Color32,
+    /// Fields, wells, hovered rows.
+    pub sunken: Color32,
+    /// Body text.
+    pub ink: Color32,
+    /// Headings and family names.
+    pub ink_strong: Color32,
+    /// Secondary text.
+    pub muted: Color32,
+    /// Labels and tertiary text.
+    pub faint: Color32,
+    /// Hairlines.
+    pub line: Color32,
+    /// Outlined buttons and stronger rules.
+    pub line_strong: Color32,
+    /// Selection and progress.
+    pub accent: Color32,
+    /// The accent for text and focus rings.
+    pub accent_ink: Color32,
+    /// Primary buttons and the chosen option.
+    pub invert_bg: Color32,
+    pub invert_fg: Color32,
+    pub good: Color32,
+    pub warn: Color32,
+    pub bad: Color32,
+}
+
+impl Palette {
+    /// A palette from egui's own visuals, for a host that sets none.
+    pub fn from_visuals(v: &Visuals) -> Palette {
+        let ink = v.text_color();
+        Palette {
+            bg: v.panel_fill,
+            sunken: v.extreme_bg_color,
+            ink,
+            ink_strong: v.strong_text_color(),
+            muted: ink.gamma_multiply(0.75),
+            faint: ink.gamma_multiply(0.5),
+            line: v.widgets.noninteractive.bg_stroke.color,
+            line_strong: v.widgets.inactive.fg_stroke.color.gamma_multiply(0.6),
+            accent: v.selection.bg_fill,
+            accent_ink: v.hyperlink_color,
+            invert_bg: v.strong_text_color(),
+            invert_fg: v.panel_fill,
+            good: if v.dark_mode { Color32::from_rgb(0x3f, 0xd6, 0xb8) } else { Color32::from_rgb(0x0a, 0x75, 0x63) },
+            warn: v.warn_fg_color,
+            bad: v.error_fg_color,
+        }
+    }
+
+    pub fn hairline(&self) -> Stroke {
+        Stroke::new(1.0, self.line)
+    }
+}
+
+/// How the panel looks: the host's colours for both appearances and the font families it
+/// registered. [`Look::default`] follows egui's visuals and default families.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Look {
+    /// `None`: from the context's visuals.
+    pub dark: Option<Palette>,
+    pub light: Option<Palette>,
+    /// Page titles.
+    pub display: FontFamily,
+    /// Family names on cards.
+    pub strong: FontFamily,
+    /// Labels, counts and badges.
+    pub label: FontFamily,
+    /// Button text.
+    pub button: FontFamily,
+    /// Labels and buttons set upper case and spaced out.
+    pub caps: bool,
+    pub corner: CornerRadius,
+    /// Buttons, fields and option cells.
+    pub control_height: f32,
+}
+
+impl Default for Look {
+    fn default() -> Self {
+        Look {
+            dark: None,
+            light: None,
+            display: FontFamily::Proportional,
+            strong: FontFamily::Proportional,
+            label: FontFamily::Proportional,
+            button: FontFamily::Proportional,
+            caps: false,
+            corner: CornerRadius::same(3),
+            control_height: 30.0,
+        }
+    }
+}
+
+impl Look {
+    /// The palette for the context's current appearance.
+    pub fn palette(&self, ctx: &Context) -> Palette {
+        let dark = ctx.theme() == egui::Theme::Dark;
+        match if dark { self.dark } else { self.light } {
+            Some(p) => p,
+            None => Palette::from_visuals(&ctx.global_style().visuals),
+        }
+    }
+}
diff --git a/crates/font-manager/src/panel/mod.rs b/crates/font-manager/src/panel/mod.rs
new file mode 100644
index 00000000..740b5676
--- /dev/null
+++ b/crates/font-manager/src/panel/mod.rs
@@ -0,0 +1,18 @@
+//! The egui interface: the installed fonts, the Google Fonts catalogue, and installing and
+//! removing through the font store.
+
+mod i18n;
+
+mod app;
+mod browse;
+mod details;
+mod faces;
+mod jobs;
+mod look;
+mod samples;
+mod sources;
+mod widgets;
+
+pub use app::{FontsPanel, Options, Preset, Settings, Tab, install_interface_fonts};
+pub use jobs::Runner;
+pub use look::{Look, Palette};
diff --git a/crates/font-manager/src/panel/samples.rs b/crates/font-manager/src/panel/samples.rs
new file mode 100644
index 00000000..b5476481
--- /dev/null
+++ b/crates/font-manager/src/panel/samples.rs
@@ -0,0 +1,108 @@
+//! Sample text: a sentence in the language the catalogue is filtered by, or in a family's own
+//! script when it has no Latin, so a sample never comes out as boxes.
+
+/// The English pangram, the sample for Latin.
+pub const PANGRAM: &str = "The quick brown fox jumps over the lazy dog";
+pub const ALPHABET: &str = "ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz";
+pub const NUMERALS: &str = "0123456789 & ? ! @ # % ( ) [ ] { } $ € £ ¥";
+
+/// Sentences by language code (gflanguages' code before the script).
+const BY_LANGUAGE: &[(&str, &str)] = &[
+    ("ar", "صف خلق خود كمثل الشمس إذ بزغت يحظى الضجيع بها نجلاء معطار"),
+    ("bn", "সমস্ত মানুষ স্বাধীনভাবে সমান মর্যাদা এবং অধিকার নিয়ে জন্মগ্রহণ করে"),
+    ("cs", "Příliš žluťoučký kůň úpěl ďábelské ódy"),
+    ("de", "Victor jagt zwölf Boxkämpfer quer über den großen Sylter Deich"),
+    ("el", "Ξεσκεπάζω την ψυχοφθόρα βδελυγμία"),
+    ("en", PANGRAM),
+    ("es", "El veloz murciélago hindú comía feliz cardillo y kiwi"),
+    ("fa", "همه افراد بشر آزاد به دنیا می‌آیند"),
+    ("fr", "Portez ce vieux whisky au juge blond qui fume"),
+    ("he", "דג סקרן שט בים מאוכזב ולפתע מצא חברה"),
+    ("hi", "सभी मनुष्यों को गौरव और अधिकारों के मामले में जन्मजात स्वतन्त्रता प्राप्त है"),
+    ("hu", "Árvíztűrő tükörfúrógép"),
+    ("it", "Quel vituperabile xenofobo zelante assaggia il whisky ed esclama: alleluja!"),
+    ("ja", "いろはにほへと ちりぬるを 色は匂へど 散りぬるを"),
+    ("ko", "다람쥐 헌 쳇바퀴에 타고파"),
+    ("pl", "Pchnąć w tę łódź jeża lub ośm skrzyń fig"),
+    ("pt", "Luís argüia à Júlia que «brações, fé, chá, óxido, pôr, zângão» eram palavras do português"),
+    ("ru", "Съешь же ещё этих мягких французских булок, да выпей чаю"),
+    ("ta", "மனிதப் பிறவியினர் சகலரும் சுதந்திரமாகவே பிறக்கின்றனர்"),
+    ("th", "เป็นมนุษย์สุดประเสริฐเลิศคุณค่า"),
+    ("tr", "Pijamalı hasta yağız şoföre çabucak güvendi"),
+    ("uk", "Чуєш їх, доцю, га? Кумедна ж ти, прощайся без ґольфів!"),
+    ("ur", "تمام انسان آزاد اور حقوق و عزت کے اعتبار سے برابر پیدا ہوئے ہیں"),
+    ("vi", "Tôi có thể ăn thủy tinh mà không hại gì"),
+];
+
+const SIMPLIFIED: &str = "天地玄黄，宇宙洪荒。日月盈昃，辰宿列张。";
+const TRADITIONAL: &str = "天地玄黃，宇宙洪荒。日月盈昃，辰宿列張。";
+
+/// Sentences by ISO 15924 script.
+const BY_SCRIPT: &[(&str, &str)] = &[
+    ("Arab", "ar"),
+    ("Beng", "bn"),
+    ("Cyrl", "ru"),
+    ("Deva", "hi"),
+    ("Grek", "el"),
+    ("Hang", "ko"),
+    ("Hebr", "he"),
+    ("Jpan", "ja"),
+    ("Kana", "ja"),
+    ("Hira", "ja"),
+    ("Kore", "ko"),
+    ("Latn", "en"),
+    ("Taml", "ta"),
+    ("Thai", "th"),
+];
+
+fn language(code: &str) -> Option<&'static str> {
+    BY_LANGUAGE.iter().find(|(c, _)| *c == code).map(|(_, s)| *s)
+}
+
+/// A sentence in the language with gflanguages id `id` (`ja_Jpan`, `zh_Hant`), or in its script.
+pub fn for_language(id: &str) -> Option<&'static str> {
+    let mut parts = id.split('_');
+    let code = parts.next().unwrap_or(id);
+    let script = parts.next().unwrap_or("");
+    if code == "zh" {
+        return Some(if script == "Hant" { TRADITIONAL } else { SIMPLIFIED });
+    }
+    language(code).or_else(|| for_script(script))
+}
+
+/// A sentence in the ISO 15924 script `script`.
+pub fn for_script(script: &str) -> Option<&'static str> {
+    match script {
+        "Hans" | "Hani" => Some(SIMPLIFIED),
+        "Hant" => Some(TRADITIONAL),
+        _ => BY_SCRIPT.iter().find(|(s, _)| *s == script).and_then(|(_, code)| language(code)),
+    }
+}
+
+/// The sample for a family with `scripts`: the pangram when it has Latin, else a sentence in the
+/// first of its scripts there is one for.
+pub fn for_scripts<'a>(scripts: impl IntoIterator<Item = &'a str>) -> &'static str {
+    let mut first = None;
+    for script in scripts {
+        if script == "Latn" {
+            return PANGRAM;
+        }
+        first = first.or_else(|| for_script(script));
+    }
+    first.unwrap_or(PANGRAM)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn samples_follow_language_then_script() {
+        assert_eq!(for_language("ja_Jpan"), language("ja"));
+        assert_eq!(for_language("zh_Hant"), Some(TRADITIONAL));
+        assert_eq!(for_language("xx_Arab"), language("ar"));
+        assert_eq!(for_language("xx_Zzzz"), None);
+        assert_eq!(for_scripts(["Arab", "Latn"]), PANGRAM);
+        assert_eq!(for_scripts(["Zzzz", "Hebr"]), language("he").unwrap_or_default());
+    }
+}
diff --git a/crates/font-manager/src/panel/sources.rs b/crates/font-manager/src/panel/sources.rs
new file mode 100644
index 00000000..69e9fed7
--- /dev/null
+++ b/crates/font-manager/src/panel/sources.rs
@@ -0,0 +1,155 @@
+//! The font sources, for a host's settings page: the built-in ones, the index URLs the user
+//! added (never curated, and flagged when their file changed since it was added), adding one,
+//! and downloading them all again.
+
+use craft_ui::direction;
+use egui::{RichText, Ui, vec2};
+
+use crate::panel::app::FontsPanel;
+use crate::panel::i18n::{fmt, tl, tn};
+use crate::panel::widgets::{self, Skin};
+
+impl FontsPanel {
+    /// Draws the font sources into `ui`, in the panel's look: a host shows it in its settings.
+    pub fn sources_ui(&mut self, ui: &mut Ui) {
+        let ctx = ui.ctx().clone();
+        let s = Skin { p: self.look.palette(&ctx), look: self.look.clone() };
+        self.poll_sources();
+        let index = self.index();
+        let user = self.installer.user_sources();
+        let now = ui.input(|i| i.time);
+        let allowed = self.allowed(now);
+        let mut remove = None;
+
+        ui.spacing_mut().item_spacing.y = 6.0;
+        let width = ui.available_width();
+        egui::Frame::new().stroke(s.hairline()).corner_radius(s.look.corner).show(ui, |ui| {
+            ui.set_width(width);
+            ui.spacing_mut().item_spacing.y = 0.0;
+            let builtin = index.iter().flat_map(|i| i.sources().iter()).filter(|src| src.user_url.is_none());
+            let mut first = true;
+            for src in builtin {
+                row(ui, &s, &mut first, |ui| {
+                    ui.label(RichText::new(&src.name).color(s.p.ink_strong));
+                    widgets::label(ui, &s, &tn(src.families as u64, "{n} family", "{n} families"), s.p.faint);
+                });
+            }
+            for added in &user {
+                let source = index.iter().flat_map(|i| i.sources().iter()).find(|src| src.user_url.as_deref() == Some(added.url.as_str()));
+                let problem = index.iter().flat_map(|i| i.problems().iter()).find(|p| p.source == added.url);
+                row(ui, &s, &mut first, |ui| {
+                    ui.allocate_ui_with_layout(vec2(ui.available_width(), s.h() - 6.0), direction::row(ui), |ui| {
+                        ui.spacing_mut().item_spacing.x = 8.0;
+                        ui.label(RichText::new(source.map_or(added.url.as_str(), |src| src.name.as_str())).color(s.p.ink_strong));
+                        ui.with_layout(direction::trailing(ui), |ui| {
+                            let button = widgets::button(ui, &s, tl!("Remove"), widgets::Kind::Danger, 28.0, 0.0);
+                            widgets::name(ui, &button, &fmt("Remove {source}", &[("source", &added.url)]));
+                            if button.clicked() {
+                                remove = Some(added.url.clone());
+                            }
+                        });
+                    });
+                    ui.allocate_ui_with_layout(vec2(ui.available_width(), 24.0), direction::row(ui), |ui| {
+                        ui.spacing_mut().item_spacing.x = 6.0;
+                        widgets::badge(ui, &s, tl!("Not curated"), s.p.warn, false);
+                        if source.is_some_and(|src| src.changed) {
+                            widgets::badge(ui, &s, tl!("Changed since added"), s.p.bad, true).on_hover_text(tl!(
+                                "The index at this address isn't the one first downloaded from it. Check the source before installing from it."
+                            ));
+                        }
+                    });
+                    ui.label(RichText::new(&added.url).size(12.0).color(s.p.muted));
+                    match (source, problem) {
+                        (_, Some(p)) => {
+                            ui.label(RichText::new(&p.error).size(12.0).color(if p.error == "not downloaded yet" { s.p.faint } else { s.p.bad }));
+                        }
+                        (Some(src), None) => {
+                            widgets::label(ui, &s, &tn(src.families as u64, "{n} family", "{n} families"), s.p.faint);
+                        }
+                        (None, None) => {}
+                    }
+                });
+            }
+        });
+
+        ui.add_space(8.0);
+        widgets::label(ui, &s, tl!("Add a source"), s.p.faint);
+        let mut add = false;
+        ui.allocate_ui_with_layout(vec2(width, s.h()), direction::row(ui), |ui| {
+            ui.spacing_mut().item_spacing.x = 8.0;
+            let button_w = s.button_galley(ui, tl!("Add"), s.p.ink).size().x + 28.0;
+            let field = widgets::field(
+                ui,
+                &s,
+                &mut self.source_url,
+                "https://example.org/fonts/index.json",
+                tl!("Index address"),
+                ui.available_width() - button_w - 8.0,
+                false,
+            );
+            let enter = field.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
+            let enabled = !self.source_url.trim().is_empty();
+            let clicked = ui.add_enabled_ui(enabled, |ui| widgets::button(ui, &s, tl!("Add"), widgets::Kind::Secondary, s.h(), 0.0)).inner.clicked();
+            add = enabled && (clicked || enter);
+        });
+        let warning =
+            tl!("A source you add isn't reviewed: add only indexes you trust. Every font is still checked against its index before it is used.");
+        ui.add(egui::Label::new(RichText::new(warning).size(12.0).color(s.p.muted)).wrap());
+
+        ui.add_space(4.0);
+        ui.allocate_ui_with_layout(vec2(width, s.h()), direction::row(ui), |ui| {
+            ui.spacing_mut().item_spacing.x = 10.0;
+            if self.fetching_sources() {
+                ui.add(egui::Spinner::new().size(16.0).color(s.p.muted));
+                ui.label(RichText::new(tl!("Downloading the sources…")).color(s.p.muted));
+            } else {
+                let update =
+                    ui.add_enabled_ui(allowed, |ui| widgets::button(ui, &s, tl!("Update sources"), widgets::Kind::Secondary, s.h(), 0.0)).inner;
+                if !allowed {
+                    widgets::label(ui, &s, tl!("Allow downloads to update"), s.p.faint);
+                }
+                if update.clicked() {
+                    self.fetch_sources(&ctx);
+                }
+            }
+        });
+        if let Some((error, text)) = &self.source_message {
+            ui.add(egui::Label::new(RichText::new(text).size(12.0).color(if *error { s.p.bad } else { s.p.muted })).wrap());
+        }
+
+        if add {
+            let url = self.source_url.trim().to_owned();
+            match self.installer.add_user_source(&url) {
+                Ok(()) => {
+                    self.source_url.clear();
+                    self.source_message = (!allowed).then(|| (false, tl!("Added. It downloads once downloads are allowed.").to_owned()));
+                    self.reload_index();
+                    self.fetch_sources(&ctx);
+                }
+                Err(e) => self.source_message = Some((true, fmt("The source couldn't be added: {error}", &[("error", &e.0)]))),
+            }
+        }
+        if let Some(url) = remove {
+            match self.installer.remove_user_source(&url) {
+                Ok(()) => {
+                    self.source_message = None;
+                    self.reload_index();
+                }
+                Err(e) => self.source_message = Some((true, fmt("The source couldn't be removed: {error}", &[("error", &e.0)]))),
+            }
+        }
+    }
+}
+
+/// One source in the list: a hairline above every one but the first.
+fn row(ui: &mut Ui, s: &Skin, first: &mut bool, add: impl FnOnce(&mut Ui)) {
+    if !std::mem::take(first) {
+        let y = ui.cursor().top();
+        ui.painter().hline(ui.max_rect().x_range(), y, s.hairline());
+    }
+    egui::Frame::new().inner_margin(egui::Margin::symmetric(14, 10)).show(ui, |ui| {
+        ui.set_width(ui.available_width());
+        ui.spacing_mut().item_spacing.y = 3.0;
+        ui.with_layout(direction::column(ui), add);
+    });
+}
diff --git a/crates/font-manager/src/panel/widgets.rs b/crates/font-manager/src/panel/widgets.rs
new file mode 100644
index 00000000..bdd59358
--- /dev/null
+++ b/crates/font-manager/src/panel/widgets.rs
@@ -0,0 +1,482 @@
+//! The panel's controls, drawn in the host's [`Look`]: labels, buttons, option cells, badges,
+//! fields, progress and the few glyphs it needs (drawn, so no font has to carry them).
+
+use std::sync::Arc;
+
+use egui::text::{LayoutJob, TextWrapping};
+use egui::{
+    Align2, Color32, ComboBox, CursorIcon, FontFamily, FontId, Galley, Painter, Pos2, Rect, Response, Role, Sense, Stroke, StrokeKind, TextEdit,
+    TextFormat, Ui, Vec2, WidgetInfo, pos2, vec2,
+};
+
+use crate::panel::look::{Look, Palette};
+
+/// The look and this frame's palette.
+#[derive(Clone)]
+pub struct Skin {
+    pub look: Look,
+    pub p: Palette,
+}
+
+/// Letter spacing suits Latin, Greek, Cyrillic and CJK; it breaks up joined scripts.
+fn spaceable(text: &str) -> bool {
+    text.chars().all(|c| (c as u32) < 0x0590 || (c as u32) >= 0x2E80)
+}
+
+impl Skin {
+    pub fn h(&self) -> f32 {
+        self.look.control_height
+    }
+
+    /// `text` on one line, upper case and spaced out when the look says so.
+    pub fn caps_galley(&self, ui: &Ui, text: &str, size: f32, family: FontFamily, color: Color32, max_width: Option<f32>) -> Arc<Galley> {
+        // Small capitals and letter spacing suit Latin, Greek, Cyrillic and CJK; joined scripts
+        // get neither, and a size step up to read as well at label size.
+        let joined = !spaceable(text);
+        let size = if joined { size * 1.15 } else { size };
+        let (text, spacing) = if self.look.caps { (text.to_uppercase(), if joined { 0.0 } else { size * 0.14 }) } else { (text.to_owned(), 0.0) };
+        let format = TextFormat { font_id: FontId::new(size, family), color, extra_letter_spacing: spacing, ..Default::default() };
+        let mut job = LayoutJob::single_section(text, format);
+        if let Some(w) = max_width {
+            job.wrap = TextWrapping::truncate_at_width(w.max(0.0));
+        }
+        ui.painter().layout_job(job)
+    }
+
+    /// A small label: a section title, a count, a fact.
+    pub fn label_galley(&self, ui: &Ui, text: &str, color: Color32) -> Arc<Galley> {
+        self.caps_galley(ui, text, if self.look.caps { 11.0 } else { 12.0 }, self.look.label.clone(), color, None)
+    }
+
+    pub fn button_galley(&self, ui: &Ui, text: &str, color: Color32) -> Arc<Galley> {
+        self.caps_galley(ui, text, if self.look.caps { 11.0 } else { 13.0 }, self.look.button.clone(), color, None)
+    }
+
+    pub fn hairline(&self) -> Stroke {
+        self.p.hairline()
+    }
+}
+
+/// Paints `galley` at the reading start of `rect`, centred vertically.
+pub fn paint_start(ui: &Ui, rect: Rect, galley: Arc<Galley>, color: Color32) {
+    let x = if craft_ui::direction::is_rtl(ui) { rect.right() - galley.size().x } else { rect.left() };
+    ui.painter().galley_with_override_text_color(pos2(x, rect.center().y - galley.size().y / 2.0), galley, color);
+}
+
+/// Paints `galley` at the reading end of `rect`, centred vertically.
+pub fn paint_end(ui: &Ui, rect: Rect, galley: Arc<Galley>, color: Color32) {
+    let x = if craft_ui::direction::is_rtl(ui) { rect.left() } else { rect.right() - galley.size().x };
+    ui.painter().galley_with_override_text_color(pos2(x, rect.center().y - galley.size().y / 2.0), galley, color);
+}
+
+pub fn paint_centred(ui: &Ui, rect: Rect, galley: Arc<Galley>, color: Color32) {
+    ui.painter().galley_with_override_text_color(rect.center() - galley.size() / 2.0, galley, color);
+}
+
+/// A small label.
+pub fn label(ui: &mut Ui, s: &Skin, text: &str, color: Color32) -> Response {
+    let galley = s.label_galley(ui, text, color);
+    // Joined scripts can draw a pixel or two past their measured width: a little room each side.
+    let (rect, resp) = ui.allocate_exact_size(galley.size() + vec2(4.0, 0.0), Sense::hover());
+    paint_start(ui, rect.shrink2(vec2(2.0, 0.0)), galley, color);
+    resp.widget_info(|| WidgetInfo::labeled(Role::Label, true, text));
+    resp
+}
+
+/// A focus ring inside `rect`, while `resp` has the keyboard focus.
+pub fn focus_ring(ui: &Ui, s: &Skin, rect: Rect, resp: &Response) {
+    if resp.has_focus() {
+        ui.painter().rect_stroke(rect, s.look.corner, Stroke::new(2.0, s.p.accent_ink), StrokeKind::Inside);
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Kind {
+    /// Solid, in the inverted colours.
+    Primary,
+    /// Outlined.
+    Secondary,
+    /// Outlined in the error colour.
+    Danger,
+}
+
+/// A button `height` tall and at least `min_width` wide.
+pub fn button(ui: &mut Ui, s: &Skin, text: &str, kind: Kind, height: f32, min_width: f32) -> Response {
+    let p = s.p;
+    let probe = s.button_galley(ui, text, p.ink);
+    let size = vec2((probe.size().x + 28.0).max(min_width), height);
+    let (rect, resp) = ui.allocate_exact_size(size, Sense::click());
+    let enabled = ui.is_enabled();
+    let hovered = resp.hovered() && enabled;
+    let (fill, stroke, color) = match kind {
+        Kind::Primary => (p.invert_bg.gamma_multiply(if hovered { 0.82 } else { 1.0 }), Stroke::NONE, p.invert_fg),
+        Kind::Secondary if hovered => (p.invert_bg, Stroke::NONE, p.invert_fg),
+        Kind::Secondary => (Color32::TRANSPARENT, Stroke::new(1.0, p.line_strong), p.ink),
+        Kind::Danger if hovered => (p.bad, Stroke::NONE, Color32::WHITE),
+        Kind::Danger => (Color32::TRANSPARENT, Stroke::new(1.0, p.bad.gamma_multiply(0.7)), p.bad),
+    };
+    let fade = |c: Color32| if enabled { c } else { c.gamma_multiply(0.45) };
+    ui.painter().rect(rect, s.look.corner, fade(fill), Stroke::new(stroke.width, fade(stroke.color)), StrokeKind::Inside);
+    let galley = s.button_galley(ui, text, fade(color));
+    paint_centred(ui, rect, galley, fade(color));
+    focus_ring(ui, s, rect.expand(2.0), &resp);
+    resp.widget_info(|| WidgetInfo::labeled(Role::Button, enabled, text));
+    if enabled { resp.on_hover_cursor(CursorIcon::PointingHand) } else { resp }
+}
+
+/// A text-only action in the accent colour: "Clear filters", "Retry".
+pub fn link(ui: &mut Ui, s: &Skin, text: &str) -> Response {
+    let galley = s.label_galley(ui, text, s.p.accent_ink);
+    let (rect, resp) = ui.allocate_exact_size(galley.size() + vec2(4.0, 6.0), Sense::click());
+    let color = if resp.hovered() { s.p.ink_strong } else { s.p.accent_ink };
+    paint_start(ui, rect.shrink2(vec2(2.0, 0.0)), galley, color);
+    if resp.hovered() {
+        let y = rect.bottom() - 1.5;
+        ui.painter().hline(rect.x_range(), y, Stroke::new(1.0, color));
+    }
+    focus_ring(ui, s, rect.expand(3.0), &resp);
+    resp.widget_info(|| WidgetInfo::labeled(Role::Button, true, text));
+    resp.on_hover_cursor(CursorIcon::PointingHand)
+}
+
+/// One option in a group of cells: its value, its label and an optional count.
+pub struct Cell<'a, T> {
+    pub value: T,
+    pub label: &'a str,
+    pub count: Option<usize>,
+}
+
+fn count_text(n: usize) -> String {
+    crate::panel::i18n::number(n as u64)
+}
+
+/// Options stacked in a column of hairline cells the width of `ui`; the chosen one inverted.
+/// Returns whether the choice changed.
+pub fn cells_column<T: PartialEq + Clone>(ui: &mut Ui, s: &Skin, value: &mut T, options: &[Cell<'_, T>]) -> bool {
+    let p = s.p;
+    let mut changed = false;
+    let width = ui.available_width();
+    let h = s.h() - 2.0;
+    let mut rects = Vec::with_capacity(options.len());
+    ui.scope(|ui| {
+        ui.spacing_mut().item_spacing.y = 0.0;
+        for cell in options {
+            let on = *value == cell.value;
+            let (rect, resp) = ui.allocate_exact_size(vec2(width, h), Sense::click());
+            let (fill, ink, faint) = match (on, resp.hovered()) {
+                (true, _) => (p.invert_bg, p.invert_fg, p.invert_fg.gamma_multiply(0.6)),
+                (false, true) => (p.sunken, p.ink_strong, p.muted),
+                (false, false) => (Color32::TRANSPARENT, p.ink, p.faint),
+            };
+            ui.painter().rect_filled(rect, egui::CornerRadius::ZERO, fill);
+            let inner = rect.shrink2(vec2(12.0, 0.0));
+            let galley = s.label_galley(ui, cell.label, ink);
+            paint_start(ui, inner, galley, ink);
+            if let Some(n) = cell.count {
+                let g = s.label_galley(ui, &count_text(n), faint);
+                paint_end(ui, inner, g, faint);
+            }
+            focus_ring(ui, s, rect.shrink(1.0), &resp);
+            resp.widget_info(|| {
+                let mut info = WidgetInfo::selected(Role::RadioButton, true, on, cell.label);
+                info.value = cell.count.map(|n| n as f64);
+                info
+            });
+            if resp.on_hover_cursor(CursorIcon::PointingHand).clicked() && !on {
+                *value = cell.value.clone();
+                changed = true;
+            }
+            rects.push(rect);
+        }
+    });
+    if let (Some(first), Some(last)) = (rects.first(), rects.last()) {
+        let painter = ui.painter();
+        painter.rect_stroke(first.union(*last), s.look.corner, s.hairline(), StrokeKind::Inside);
+        for r in rects.iter().skip(1) {
+            painter.hline(r.x_range(), r.top(), s.hairline());
+        }
+    }
+    changed
+}
+
+/// Options side by side in hairline cells, in reading order; the chosen one inverted.
+pub fn cells_row<T: PartialEq + Clone>(ui: &mut Ui, s: &Skin, value: &mut T, options: &[Cell<'_, T>]) -> bool {
+    let p = s.p;
+    let mut changed = false;
+    let rtl = craft_ui::direction::is_rtl(ui) || ui.layout().prefer_right_to_left();
+    let mut rects = Vec::with_capacity(options.len());
+    ui.scope(|ui| {
+        ui.spacing_mut().item_spacing.x = 0.0;
+        for cell in options {
+            let on = *value == cell.value;
+            let (ink, faint) = if on { (p.invert_fg, p.invert_fg.gamma_multiply(0.6)) } else { (p.muted, p.faint) };
+            let label = s.label_galley(ui, cell.label, ink);
+            let count = cell.count.map(|n| s.label_galley(ui, &count_text(n), faint));
+            let w = label.size().x + count.as_ref().map_or(0.0, |g| g.size().x + 8.0) + 28.0;
+            let (rect, resp) = ui.allocate_exact_size(vec2(w, s.h()), Sense::click());
+            let fill = match (on, resp.hovered()) {
+                (true, _) => p.invert_bg,
+                (false, true) => p.sunken,
+                (false, false) => Color32::TRANSPARENT,
+            };
+            let ink = if !on && resp.hovered() { p.ink_strong } else { ink };
+            ui.painter().rect_filled(rect, egui::CornerRadius::ZERO, fill);
+            let inner = rect.shrink2(vec2(14.0, 0.0));
+            let label_w = label.size().x;
+            paint_start(ui, inner, label, ink);
+            if let Some(g) = count {
+                let rest = if rtl { inner.with_max_x(inner.right() - label_w - 8.0) } else { inner.with_min_x(inner.left() + label_w + 8.0) };
+                paint_start(ui, rest, g, faint);
+            }
+            focus_ring(ui, s, rect.shrink(1.0), &resp);
+            resp.widget_info(|| {
+                let mut info = WidgetInfo::selected(Role::Tab, true, on, cell.label);
+                info.value = cell.count.map(|n| n as f64);
+                info
+            });
+            if resp.on_hover_cursor(CursorIcon::PointingHand).clicked() && !on {
+                *value = cell.value.clone();
+                changed = true;
+            }
+            rects.push(rect);
+        }
+    });
+    if let (Some(first), Some(last)) = (rects.first(), rects.last()) {
+        let painter = ui.painter();
+        painter.rect_stroke(first.union(*last), s.look.corner, s.hairline(), StrokeKind::Inside);
+        for r in rects.iter().skip(1) {
+            let x = if rtl { r.right() } else { r.left() };
+            painter.vline(x, first.y_range(), s.hairline());
+        }
+    }
+    changed
+}
+
+/// A small square status label on the sunken surface, with an optional dot before it.
+pub fn badge(ui: &mut Ui, s: &Skin, text: &str, color: Color32, dot: bool) -> Response {
+    let galley = s.caps_galley(ui, text, 10.0, s.look.label.clone(), color, None);
+    let dot_w = if dot { 12.0 } else { 0.0 };
+    let (rect, resp) = ui.allocate_exact_size(vec2(galley.size().x + 16.0 + dot_w, 22.0), Sense::hover());
+    ui.painter().rect(rect, s.look.corner, s.p.sunken, s.hairline(), StrokeKind::Inside);
+    let rtl = craft_ui::direction::is_rtl(ui);
+    let inner = rect.shrink2(vec2(8.0, 0.0));
+    if dot {
+        let x = if rtl { inner.right() - 3.0 } else { inner.left() + 3.0 };
+        ui.painter().circle_filled(pos2(x, rect.center().y), 3.0, color);
+    }
+    let text_rect = if rtl { inner.with_max_x(inner.right() - dot_w) } else { inner.with_min_x(inner.left() + dot_w) };
+    paint_start(ui, text_rect, galley, color);
+    resp.widget_info(|| WidgetInfo::labeled(Role::Label, true, text));
+    resp
+}
+
+/// A slim bar along the bottom of `rect`: `fraction` done, or a moving segment when unknown.
+pub fn progress_bar(ui: &Ui, s: &Skin, rect: Rect, fraction: Option<f32>) {
+    let painter = ui.painter();
+    painter.rect_filled(rect, egui::CornerRadius::ZERO, s.p.line);
+    let rtl = craft_ui::direction::is_rtl(ui);
+    match fraction {
+        Some(f) => {
+            let w = rect.width() * f.clamp(0.0, 1.0);
+            let bar = if rtl {
+                Rect::from_min_max(pos2(rect.right() - w, rect.top()), rect.max)
+            } else {
+                Rect::from_min_size(rect.min, vec2(w, rect.height()))
+            };
+            painter.rect_filled(bar, egui::CornerRadius::ZERO, s.p.accent);
+        }
+        None => {
+            let w = rect.width();
+            let x = (ui.input(|i| i.time) * 0.8).fract() as f32 * w;
+            for left in [x, x - w] {
+                let seg = Rect::from_min_size(pos2(rect.left() + left, rect.top()), vec2(w * 0.3, rect.height())).intersect(rect);
+                if seg.is_positive() {
+                    painter.rect_filled(seg, egui::CornerRadius::ZERO, s.p.accent);
+                }
+            }
+            ui.ctx().request_repaint();
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Glyph {
+    Search,
+    Close,
+    Info,
+}
+
+/// Draws `glyph` centred on `c`, `size` across.
+pub fn glyph(painter: &Painter, glyph: Glyph, c: Pos2, size: f32, color: Color32) {
+    let stroke = Stroke::new(1.5, color);
+    let r = size / 2.0;
+    match glyph {
+        Glyph::Search => {
+            let centre = c + vec2(-r * 0.2, -r * 0.2);
+            painter.circle_stroke(centre, r * 0.6, stroke);
+            painter.line_segment([centre + vec2(r * 0.45, r * 0.45), c + vec2(r, r)], stroke);
+        }
+        Glyph::Close => {
+            let k = r * 0.75;
+            painter.line_segment([c + vec2(-k, -k), c + vec2(k, k)], stroke);
+            painter.line_segment([c + vec2(-k, k), c + vec2(k, -k)], stroke);
+        }
+        Glyph::Info => {
+            painter.circle_stroke(c, r * 0.85, Stroke::new(1.2, color));
+            painter.line_segment([c + vec2(0.0, -r * 0.05), c + vec2(0.0, r * 0.45)], Stroke::new(1.4, color));
+            painter.circle_filled(c + vec2(0.0, -r * 0.38), 1.0, color);
+        }
+    }
+}
+
+/// A square button with a drawn glyph, outlined, inverting on hover.
+pub fn glyph_button(ui: &mut Ui, s: &Skin, g: Glyph, tip: &str, size: f32) -> Response {
+    let (rect, resp) = ui.allocate_exact_size(Vec2::splat(size), Sense::click());
+    let hovered = resp.hovered();
+    let painter = ui.painter();
+    if hovered {
+        painter.rect_filled(rect, s.look.corner, s.p.invert_bg);
+    } else {
+        painter.rect_stroke(rect, s.look.corner, s.hairline(), StrokeKind::Inside);
+    }
+    let color = if hovered { s.p.invert_fg } else { s.p.muted };
+    glyph(painter, g, rect.center(), 12.0, color);
+    focus_ring(ui, s, rect, &resp);
+    resp.widget_info(|| WidgetInfo::labeled(Role::Button, true, tip));
+    resp.on_hover_text(tip).on_hover_cursor(CursorIcon::PointingHand)
+}
+
+/// Names a widget for screen readers (and kittest) where it has no label of its own.
+pub fn name(ui: &Ui, resp: &Response, label: &str) {
+    ui.ctx().accesskit_node_builder(resp.id, |node| node.set_label(label));
+}
+
+/// A single-line field `width` wide, named `label`, with a search glyph at its start when
+/// `search`.
+pub fn field(ui: &mut Ui, s: &Skin, text: &mut String, hint: &str, label: &str, width: f32, search: bool) -> Response {
+    let rtl = craft_ui::direction::is_rtl(ui);
+    let pad = if search { 34.0 } else { 10.0 };
+    let margin = if rtl {
+        egui::Margin { left: 10, right: pad as i8, top: 0, bottom: 0 }
+    } else {
+        egui::Margin { left: pad as i8, right: 10, top: 0, bottom: 0 }
+    };
+    let edit = TextEdit::singleline(text)
+        .hint_text(hint)
+        .desired_width(width)
+        .min_size(vec2(0.0, s.h()))
+        .align(if rtl { Align2::RIGHT_CENTER } else { Align2::LEFT_CENTER })
+        .margin(margin);
+    let resp = ui.add(edit);
+    if search {
+        let x = if rtl { resp.rect.right() - 18.0 } else { resp.rect.left() + 18.0 };
+        glyph(ui.painter(), Glyph::Search, pos2(x, resp.rect.center().y), 13.0, s.p.faint);
+    }
+    name(ui, &resp, label);
+    resp
+}
+
+/// A drop-down `width` wide showing `selected`, named `label`.
+pub fn select<R>(ui: &mut Ui, id_salt: &str, label: &str, selected: &str, width: f32, add: impl FnOnce(&mut Ui) -> R) -> Option<R> {
+    let inner = ComboBox::from_id_salt(id_salt).selected_text(selected).width(width).height(380.0).truncate().show_ui(ui, add);
+    name(ui, &inner.response, label);
+    inner.inner
+}
+
+/// An inline note in a sunken, hairline box: an info glyph, then `add`.
+pub fn note<R>(ui: &mut Ui, s: &Skin, add: impl FnOnce(&mut Ui) -> R) -> R {
+    egui::Frame::new()
+        .fill(s.p.sunken)
+        .stroke(s.hairline())
+        .corner_radius(s.look.corner)
+        .inner_margin(egui::Margin { left: 14, right: 12, top: 10, bottom: 10 })
+        .show(ui, |ui| {
+            ui.set_width(ui.available_width());
+            craft_ui::direction::horizontal(ui, |ui| {
+                let (rect, _) = ui.allocate_exact_size(vec2(16.0, s.h().min(28.0)), Sense::hover());
+                glyph(ui.painter(), Glyph::Info, rect.center(), 14.0, s.p.muted);
+                ui.add_space(4.0);
+                add(ui)
+            })
+            .inner
+        })
+        .inner
+}
+
+/// A [`note`] with `add` beside buttons at its reading end: one per label in `buttons`, then a
+/// close glyph when `closable`. `button(ui, n)` draws the `n`th, the close glyph last.
+pub fn note_with_actions(ui: &mut Ui, s: &Skin, add: impl FnOnce(&mut Ui), buttons: &[&str], mut button: impl FnMut(&mut Ui, usize), closable: bool) {
+    let gap = 10.0;
+    let actions_w: f32 =
+        buttons.iter().map(|b| s.button_galley(ui, b, s.p.ink).size().x + 28.0 + gap).sum::<f32>() + if closable { 28.0 + gap } else { 0.0 };
+    note(ui, s, |ui| {
+        let text_w = (ui.available_width() - actions_w - 8.0).max(120.0);
+        ui.allocate_ui_with_layout(vec2(text_w, 0.0), craft_ui::direction::column(ui), |ui| {
+            ui.spacing_mut().item_spacing.y = 2.0;
+            add(ui);
+        });
+        ui.allocate_ui_with_layout(vec2(ui.available_width(), 28.0), craft_ui::direction::trailing(ui), |ui| {
+            ui.spacing_mut().item_spacing.x = gap;
+            if closable {
+                button(ui, buttons.len());
+            }
+            for n in (0..buttons.len()).rev() {
+                button(ui, n);
+            }
+        });
+    });
+}
+
+/// A slim slider `width` wide for whole numbers in `range`, named `label`: drag or click the
+/// track, or step with the arrow keys (Shift for ten). It reads left to right in every interface
+/// direction, as sliders do.
+pub fn slider(ui: &mut Ui, s: &Skin, value: &mut f32, range: std::ops::RangeInclusive<f32>, width: f32, label: &str) -> Response {
+    let (lo, hi) = (*range.start(), *range.end());
+    let (rect, mut resp) = ui.allocate_exact_size(vec2(width, s.h()), Sense::click_and_drag());
+    let track = Rect::from_center_size(rect.center(), vec2(width - 14.0, 2.0));
+    let before = *value;
+    if let Some(pos) = resp.interact_pointer_pos() {
+        let t = ((pos.x - track.left()) / track.width()).clamp(0.0, 1.0);
+        *value = (lo + t * (hi - lo)).round();
+    }
+    if resp.has_focus() {
+        ui.memory_mut(|m| {
+            m.set_focus_lock_filter(resp.id, egui::EventFilter { horizontal_arrows: true, vertical_arrows: true, ..Default::default() })
+        });
+        let step = ui.input(|i| {
+            let n = if i.modifiers.shift { 10.0 } else { 1.0 };
+            let up = i.key_pressed(egui::Key::ArrowRight) || i.key_pressed(egui::Key::ArrowUp);
+            let down = i.key_pressed(egui::Key::ArrowLeft) || i.key_pressed(egui::Key::ArrowDown);
+            if up {
+                n
+            } else if down {
+                -n
+            } else {
+                0.0
+            }
+        });
+        *value = (*value + step).clamp(lo, hi);
+    }
+    if *value != before {
+        resp.mark_changed();
+    }
+    let t = ((*value - lo) / (hi - lo)).clamp(0.0, 1.0);
+    let x = track.left() + t * track.width();
+    let painter = ui.painter();
+    painter.rect_filled(track, egui::CornerRadius::ZERO, s.p.line_strong);
+    painter.rect_filled(Rect::from_min_max(track.min, pos2(x, track.bottom())), egui::CornerRadius::ZERO, s.p.ink);
+    let handle = Rect::from_center_size(pos2(x, rect.center().y), vec2(12.0, 12.0));
+    let hovered = resp.hovered() || resp.dragged();
+    painter.rect(
+        handle,
+        egui::CornerRadius::ZERO,
+        if hovered { s.p.ink_strong } else { s.p.invert_bg },
+        Stroke::new(2.0, s.p.bg),
+        StrokeKind::Outside,
+    );
+    if resp.has_focus() {
+        painter.rect_stroke(handle.expand(4.0), egui::CornerRadius::ZERO, Stroke::new(2.0, s.p.accent_ink), StrokeKind::Inside);
+    }
+    resp.widget_info(|| WidgetInfo::slider(true, f64::from(*value), label));
+    resp.on_hover_cursor(CursorIcon::ResizeHorizontal)
+}
diff --git a/crates/font-manager/src/store.rs b/crates/font-manager/src/store.rs
new file mode 100644
index 00000000..a001e5e4
--- /dev/null
+++ b/crates/font-manager/src/store.rs
@@ -0,0 +1,502 @@
+//! What Craft Font Manager needs from the suite's font store: the download consent, installing a
+//! family from the index, removing one, and downloading a family's files for a preview without
+//! installing them.
+//!
+//! [`SuiteStore`] is craft-font-store's store; [`FakeStore`] stands in for it in tests.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Condvar, Mutex};
+
+use craft_font_catalog::Catalog;
+pub use craft_font_store::UserSource;
+use craft_font_store::{Cancel, Client, Face, FontStore, Network, PINNED_INDEX, verify_font};
+
+use crate::index::{Family, Index};
+
+/// Store files to remove: a whole family, or some of its styles.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RemoveRequest {
+    pub family: String,
+    /// The files the catalog found for it in the font store.
+    pub files: Vec<PathBuf>,
+    /// The whole family, its licence included; otherwise only `files`.
+    pub whole: bool,
+}
+
+/// Bytes downloaded so far, of `total`.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct Progress {
+    pub done: u64,
+    pub total: u64,
+}
+
+/// A downloaded and verified file.
+#[derive(Clone, Debug)]
+pub struct Downloaded {
+    pub path: String,
+    pub bytes: Vec<u8>,
+}
+
+/// An error to show the user, in English.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct StoreError(pub String);
+
+impl std::fmt::Display for StoreError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl std::error::Error for StoreError {}
+
+fn err(e: impl std::fmt::Display) -> StoreError {
+    StoreError(e.to_string())
+}
+
+/// The font store. Calls block; the app makes the downloading ones on a worker thread.
+pub trait Installer: Send + Sync {
+    /// Has the user allowed downloads? The setting is the whole suite's.
+    fn downloads_allowed(&self) -> bool;
+
+    /// Turns downloads on or off, as the user's own action.
+    fn allow_downloads(&self, allowed: bool) -> Result<(), StoreError>;
+
+    /// Downloads, verifies and installs every file of `family`, with its licence.
+    fn install(&self, index: &Index, family: &Family, progress: &mut dyn FnMut(Progress)) -> Result<(), StoreError>;
+
+    /// Installs one file of `family` (`path` as the index has it), with the family's licence.
+    fn install_file(&self, index: &Index, family: &Family, path: &str, progress: &mut dyn FnMut(Progress)) -> Result<(), StoreError>;
+
+    /// Deletes a family's files from the store.
+    fn remove(&self, request: &RemoveRequest) -> Result<(), StoreError>;
+
+    /// Downloads and verifies `family`'s files without installing them.
+    fn download(&self, index: &Index, family: &Family, progress: &mut dyn FnMut(Progress)) -> Result<Vec<Downloaded>, StoreError>;
+
+    /// The indexes without a request: the built-in ones compiled in, and the sources the user
+    /// added as last fetched.
+    fn indexes(&self) -> Result<Index, StoreError> {
+        crate::index::bundled().map_err(err)
+    }
+
+    /// Downloads the indexes: the built-in ones at the pinned commit and the user's sources. A
+    /// source that fails is in [`Index::problems`]; the others load.
+    fn fetch_indexes(&self) -> Result<Index, StoreError> {
+        Err(StoreError(NO_FOLDER.into()))
+    }
+
+    /// The index URLs the user added as sources. Their families are never curated.
+    fn user_sources(&self) -> Vec<UserSource> {
+        Vec::new()
+    }
+
+    /// Adds an index URL (https, `.json` or `.json.gz`) as a source, as the user's own action.
+    /// The next [`Installer::fetch_indexes`] downloads it.
+    fn add_user_source(&self, _url: &str) -> Result<(), StoreError> {
+        Err(StoreError(NO_FOLDER.into()))
+    }
+
+    /// Removes a source the user added. Families installed from it stay installed.
+    fn remove_user_source(&self, _url: &str) -> Result<(), StoreError> {
+        Err(StoreError(NO_FOLDER.into()))
+    }
+}
+
+const NO_FOLDER: &str = "there is no folder for the font store";
+
+/// craft-font-store's store, in the user's font store folder.
+pub struct SuiteStore {
+    store: FontStore,
+    client: Client,
+}
+
+impl SuiteStore {
+    /// The store the catalog's environment names, rescanning `catalog` after each change.
+    pub fn for_user(catalog: Arc<Catalog>) -> Option<SuiteStore> {
+        let store = FontStore::for_user(catalog.env())?.with_catalog(catalog);
+        Some(SuiteStore { store, client: Client::default() })
+    }
+
+    /// The store's source and name for the family holding `files`, which can differ from the
+    /// name in the fonts themselves.
+    fn installed_name(&self, request: &RemoveRequest) -> Option<(String, String)> {
+        let dir = self.store.dir();
+        let installed = self.store.installed();
+        let lower = request.family.to_lowercase();
+        installed
+            .iter()
+            .find(|f| request.files.iter().any(|path| path.starts_with(dir.join(&f.dir))))
+            .or_else(|| installed.iter().find(|f| f.family.to_lowercase() == lower))
+            .map(|f| (f.source.clone(), f.family.clone()))
+    }
+}
+
+impl Installer for SuiteStore {
+    fn downloads_allowed(&self) -> bool {
+        self.store.network() == Network::On
+    }
+
+    fn allow_downloads(&self, allowed: bool) -> Result<(), StoreError> {
+        if allowed { self.store.enable_network() } else { self.store.disable_network() }.map_err(err)
+    }
+
+    fn install(&self, index: &Index, family: &Family, progress: &mut dyn FnMut(Progress)) -> Result<(), StoreError> {
+        let mut report = |p: craft_font_store::Progress| progress(Progress { done: p.done, total: p.total });
+        self.store.install_family(index, family, &Cancel::new(), &mut report).map(drop).map_err(err)
+    }
+
+    fn install_file(&self, index: &Index, family: &Family, path: &str, progress: &mut dyn FnMut(Progress)) -> Result<(), StoreError> {
+        let file = family.files.iter().find(|f| f.path == path).ok_or_else(|| StoreError(format!("{path} isn't in the index")))?;
+        let mut report = |p: craft_font_store::Progress| progress(Progress { done: p.done, total: p.total });
+        self.store.install_face(index, Face { family, file }, &Cancel::new(), &mut report).map(drop).map_err(err)
+    }
+
+    fn remove(&self, request: &RemoveRequest) -> Result<(), StoreError> {
+        let (source, name) = self.installed_name(request).ok_or_else(|| err(craft_font_store::Error::NotInstalled(request.family.clone())))?;
+        if request.whole {
+            return self.store.remove_family(&source, &name).map_err(err);
+        }
+        let files: Vec<String> = request.files.iter().filter_map(|f| f.file_name()).map(|f| f.to_string_lossy().into_owned()).collect();
+        self.store.remove_files(&source, &name, &files).map_err(err)
+    }
+
+    fn download(&self, index: &Index, family: &Family, progress: &mut dyn FnMut(Progress)) -> Result<Vec<Downloaded>, StoreError> {
+        if !self.downloads_allowed() {
+            return Err(err(craft_font_store::Error::NetworkOff));
+        }
+        let total = family.size();
+        let cancel = Cancel::new();
+        let mut before = 0u64;
+        let mut out = Vec::new();
+        for file in &family.files {
+            let mut reasons = Vec::new();
+            for url in index.file_urls(family, file) {
+                let mut on_bytes = |n: u64| progress(Progress { done: before.saturating_add(n), total });
+                match self.client.get(&url, file.size, &cancel, &mut on_bytes) {
+                    Ok(bytes) => match verify_font(file, &bytes) {
+                        Ok(()) => {
+                            out.push(Downloaded { path: file.path.clone(), bytes });
+                            reasons.clear();
+                            break;
+                        }
+                        Err(e) => reasons.push(format!("{url}: {e}")),
+                    },
+                    Err(e) => reasons.push(format!("{url}: {e}")),
+                }
+            }
+            if !reasons.is_empty() {
+                return Err(StoreError(format!("downloading {} failed: {}", file.file_name(), reasons.join("; "))));
+            }
+            before = before.saturating_add(file.size);
+        }
+        Ok(out)
+    }
+
+    fn indexes(&self) -> Result<Index, StoreError> {
+        Ok(self.store.offline_indexes())
+    }
+
+    fn fetch_indexes(&self) -> Result<Index, StoreError> {
+        self.store.fetch_indexes(&PINNED_INDEX, &Cancel::new()).map_err(err)
+    }
+
+    fn user_sources(&self) -> Vec<UserSource> {
+        self.store.user_sources()
+    }
+
+    fn add_user_source(&self, url: &str) -> Result<(), StoreError> {
+        self.store.add_user_source(url).map_err(err)
+    }
+
+    fn remove_user_source(&self, url: &str) -> Result<(), StoreError> {
+        self.store.remove_user_source(url).map_err(err)
+    }
+}
+
+/// The store when the system names no folder for it (no home folder): nothing installs.
+pub struct NoStore;
+
+impl Installer for NoStore {
+    fn downloads_allowed(&self) -> bool {
+        false
+    }
+
+    fn allow_downloads(&self, _: bool) -> Result<(), StoreError> {
+        Err(StoreError(NO_FOLDER.into()))
+    }
+
+    fn install(&self, _: &Index, _: &Family, _: &mut dyn FnMut(Progress)) -> Result<(), StoreError> {
+        Err(StoreError(NO_FOLDER.into()))
+    }
+
+    fn install_file(&self, _: &Index, _: &Family, _: &str, _: &mut dyn FnMut(Progress)) -> Result<(), StoreError> {
+        Err(StoreError(NO_FOLDER.into()))
+    }
+
+    fn remove(&self, _: &RemoveRequest) -> Result<(), StoreError> {
+        Err(StoreError(NO_FOLDER.into()))
+    }
+
+    fn download(&self, _: &Index, _: &Family, _: &mut dyn FnMut(Progress)) -> Result<Vec<Downloaded>, StoreError> {
+        Err(StoreError(NO_FOLDER.into()))
+    }
+}
+
+/// What a [`FakeStore`] was asked to do.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Call {
+    Install(String),
+    /// The family and the file's path in the index.
+    InstallFile(String, String),
+    Remove(String),
+    Download(String),
+}
+
+/// A font store without a network: "downloads" come from a table of file bytes by index path,
+/// and installs write them into a folder as the real store does, `<dir>/<family>/<file>`. It
+/// refuses to download while downloads are off, like the real one.
+pub struct FakeStore {
+    dir: PathBuf,
+    files: HashMap<String, Vec<u8>>,
+    allowed: AtomicBool,
+    calls: Mutex<Vec<Call>>,
+    failure: Mutex<Option<String>>,
+    /// A google/fonts checkout to read files missing from `files` from.
+    folder: Option<PathBuf>,
+    /// The built-in indexes; the bundled ones when not given.
+    builtin: Option<Index>,
+    /// Index files user sources "download", by URL.
+    served_indexes: HashMap<String, Vec<u8>>,
+    user: Mutex<Vec<UserSource>>,
+    /// User sources downloaded so far, and those whose file changed since.
+    fetched: Mutex<Vec<String>>,
+    changed: Mutex<Vec<String>>,
+    /// Downloads stop halfway while this is true.
+    held: (Mutex<bool>, Condvar),
+}
+
+impl FakeStore {
+    pub fn new(dir: impl Into<PathBuf>, files: HashMap<String, Vec<u8>>) -> FakeStore {
+        FakeStore {
+            dir: dir.into(),
+            files,
+            allowed: AtomicBool::new(false),
+            calls: Mutex::new(Vec::new()),
+            failure: Mutex::new(None),
+            folder: None,
+            builtin: None,
+            served_indexes: HashMap::new(),
+            user: Mutex::new(Vec::new()),
+            fetched: Mutex::new(Vec::new()),
+            changed: Mutex::new(Vec::new()),
+            held: (Mutex::new(false), Condvar::new()),
+        }
+    }
+
+    /// Uses `index` as the built-in indexes.
+    pub fn with_index(mut self, index: Index) -> FakeStore {
+        self.builtin = Some(index);
+        self
+    }
+
+    /// Has the index at `url` "download" as `bytes` once added as a source.
+    pub fn serving_index(mut self, url: &str, bytes: Vec<u8>) -> FakeStore {
+        self.served_indexes.insert(url.to_owned(), bytes);
+        self
+    }
+
+    /// The index at `url` now differs from the one first downloaded.
+    pub fn change_index(&self, url: &str) {
+        if let Ok(mut changed) = self.changed.lock() {
+            changed.push(url.to_owned());
+        }
+    }
+
+    /// Also "downloads" files from a google/fonts checkout, by their path in the index.
+    pub fn serving(mut self, checkout: impl Into<PathBuf>) -> FakeStore {
+        self.folder = Some(checkout.into());
+        self
+    }
+
+    /// The next download fails with `error`, as when the network is down.
+    pub fn fail_next(&self, error: &str) {
+        if let Ok(mut failure) = self.failure.lock() {
+            *failure = Some(error.to_owned());
+        }
+    }
+
+    /// Downloads report half their bytes, then wait until [`FakeStore::release`] (with
+    /// `Runner::Thread`).
+    pub fn hold(&self) {
+        if let Ok(mut held) = self.held.0.lock() {
+            *held = true;
+        }
+    }
+
+    pub fn release(&self) {
+        if let Ok(mut held) = self.held.0.lock() {
+            *held = false;
+        }
+        self.held.1.notify_all();
+    }
+
+    fn wait_while_held(&self) {
+        let Ok(mut held) = self.held.0.lock() else { return };
+        while *held {
+            match self.held.1.wait(held) {
+                Ok(h) => held = h,
+                Err(_) => return,
+            }
+        }
+    }
+
+    /// Everything asked of it, downloads refused for lack of consent included.
+    pub fn calls(&self) -> Vec<Call> {
+        self.calls.lock().map(|c| c.clone()).unwrap_or_default()
+    }
+
+    fn record(&self, call: Call) {
+        if let Ok(mut calls) = self.calls.lock() {
+            calls.push(call);
+        }
+    }
+
+    fn fetch(&self, family: &Family, only: Option<&str>, progress: &mut dyn FnMut(Progress)) -> Result<Vec<Downloaded>, StoreError> {
+        if !self.downloads_allowed() {
+            return Err(StoreError("downloading fonts is turned off".into()));
+        }
+        if let Some(error) = self.failure.lock().ok().and_then(|mut f| f.take()) {
+            return Err(StoreError(error));
+        }
+        let wanted: Vec<_> = family.files.iter().filter(|f| only.is_none_or(|p| p == f.path)).collect();
+        let total = wanted.iter().map(|f| f.size).sum();
+        progress(Progress { done: total / 2, total });
+        self.wait_while_held();
+        let mut done = 0u64;
+        let mut out = Vec::new();
+        for file in wanted {
+            let from_folder = || self.folder.as_ref().and_then(|dir| std::fs::read(dir.join(&file.path)).ok());
+            let bytes =
+                self.files.get(&file.path).cloned().or_else(from_folder).ok_or_else(|| StoreError(format!("{} isn't available", file.path)))?;
+            done = done.saturating_add(file.size);
+            progress(Progress { done, total });
+            out.push(Downloaded { path: file.path.clone(), bytes });
+        }
+        Ok(out)
+    }
+
+    fn write(&self, family: &Family, files: Vec<Downloaded>) -> Result<(), StoreError> {
+        let dir = self.dir.join(&family.family);
+        std::fs::create_dir_all(&dir).map_err(err)?;
+        for file in files {
+            let name = file.path.rsplit('/').next().unwrap_or(&file.path);
+            std::fs::write(dir.join(name), &file.bytes).map_err(err)?;
+        }
+        Ok(())
+    }
+
+    fn in_store(&self, path: &Path) -> bool {
+        path.starts_with(&self.dir)
+    }
+}
+
+impl Installer for FakeStore {
+    fn downloads_allowed(&self) -> bool {
+        self.allowed.load(Ordering::SeqCst)
+    }
+
+    fn allow_downloads(&self, allowed: bool) -> Result<(), StoreError> {
+        self.allowed.store(allowed, Ordering::SeqCst);
+        Ok(())
+    }
+
+    fn install(&self, _: &Index, family: &Family, progress: &mut dyn FnMut(Progress)) -> Result<(), StoreError> {
+        self.record(Call::Install(family.family.clone()));
+        let files = self.fetch(family, None, progress)?;
+        self.write(family, files)
+    }
+
+    fn install_file(&self, _: &Index, family: &Family, path: &str, progress: &mut dyn FnMut(Progress)) -> Result<(), StoreError> {
+        self.record(Call::InstallFile(family.family.clone(), path.to_owned()));
+        let files = self.fetch(family, Some(path), progress)?;
+        self.write(family, files)
+    }
+
+    fn remove(&self, request: &RemoveRequest) -> Result<(), StoreError> {
+        self.record(Call::Remove(request.family.clone()));
+        if let Some(outside) = request.files.iter().find(|f| !self.in_store(f)) {
+            return Err(StoreError(format!("{} isn't in the font store", outside.display())));
+        }
+        for file in &request.files {
+            std::fs::remove_file(file).map_err(err)?;
+        }
+        Ok(())
+    }
+
+    fn download(&self, _: &Index, family: &Family, progress: &mut dyn FnMut(Progress)) -> Result<Vec<Downloaded>, StoreError> {
+        self.record(Call::Download(family.family.clone()));
+        self.fetch(family, None, progress)
+    }
+
+    fn indexes(&self) -> Result<Index, StoreError> {
+        let builtin = match &self.builtin {
+            Some(index) => index.clone(),
+            None => crate::index::bundled().map_err(err)?,
+        };
+        let fetched = self.fetched.lock().map(|f| f.clone()).unwrap_or_default();
+        let changed = self.changed.lock().map(|c| c.clone()).unwrap_or_default();
+        let mut users = Vec::new();
+        let mut problems = Vec::new();
+        for source in self.user_sources() {
+            let problem = |error: String| craft_font_store::SourceProblem { source: source.url.clone(), name: source.url.clone(), error };
+            if !fetched.contains(&source.url) {
+                problems.push(problem("not downloaded yet".into()));
+                continue;
+            }
+            match self.served_indexes.get(&source.url).map(|bytes| Index::from_user_bytes(bytes, &source.url)) {
+                Some(Ok(mut index)) => {
+                    if changed.contains(&source.url) {
+                        index.mark_changed();
+                    }
+                    users.push(index);
+                }
+                Some(Err(e)) => problems.push(problem(e.to_string())),
+                None => problems.push(problem("nothing at this address".into())),
+            }
+        }
+        Ok(Index::merge(std::iter::once(builtin).chain(users)).with_problems(problems))
+    }
+
+    fn fetch_indexes(&self) -> Result<Index, StoreError> {
+        if !self.downloads_allowed() {
+            return Err(StoreError("downloading fonts is turned off".into()));
+        }
+        if let Ok(mut fetched) = self.fetched.lock() {
+            *fetched = self.user_sources().into_iter().map(|s| s.url).collect();
+        }
+        self.indexes()
+    }
+
+    fn user_sources(&self) -> Vec<UserSource> {
+        self.user.lock().map(|u| u.clone()).unwrap_or_default()
+    }
+
+    fn add_user_source(&self, url: &str) -> Result<(), StoreError> {
+        if !url.starts_with("https://") {
+            return Err(StoreError("an index address starts with https://".into()));
+        }
+        let mut user = self.user.lock().map_err(err)?;
+        if !user.iter().any(|s| s.url == url) {
+            user.push(UserSource { url: url.to_owned(), added_at: 0, last_sha256: None });
+        }
+        Ok(())
+    }
+
+    fn remove_user_source(&self, url: &str) -> Result<(), StoreError> {
+        self.user.lock().map_err(err)?.retain(|s| s.url != url);
+        Ok(())
+    }
+}
diff --git a/crates/font-manager/tests/flows.rs b/crates/font-manager/tests/flows.rs
new file mode 100644
index 00000000..620bc6b8
--- /dev/null
+++ b/crates/font-manager/tests/flows.rs
@@ -0,0 +1,462 @@
+//! The main flows against a small index, a font folder made per test and a fake font store.
+//! `CRAFT_FONT_MANAGER_SNAPSHOTS=<dir>` also saves screenshots; run that with
+//! `-- --test-threads=1`, as rendering on several threads at once can crash older Vulkan loaders.
+//! With `CRAFT_FONT_MANAGER_GOOGLE_FONTS=<google/fonts checkout>` the fake store also "downloads"
+//! the index's files from it.
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use craft_font_manager::craft_font_catalog::Os;
+use craft_font_manager::index::Index;
+use craft_font_manager::store::{Call, FakeStore, Installer};
+use craft_font_manager::{Catalog, FontEnv, Source};
+use craft_font_manager::{FontsPanel, Look, Options, Palette, Runner, Settings, Tab, install_interface_fonts};
+use egui::accesskit::Role;
+use egui_kittest::Harness;
+use egui_kittest::kittest::{By, NodeT, Queryable};
+
+const HACK: &str = "ofl/hack/Hack-Regular.ttf";
+const UBUNTU: &str = "ufl/ubuntu/Ubuntu-Light.ttf";
+
+fn index() -> Index {
+    let file = |path: &str, size: usize| {
+        format!(r#"{{"path":"{path}","size":{size},"sha256":"{}","style":"normal","weight":400,"axes":[],"postscript":[]}}"#, "0a".repeat(32))
+    };
+    let family = |name: &str, category: &str, languages: &str, scripts: &str, files: String| {
+        format!(
+            r#"{{"family":"{name}","designer":"","categories":["{category}"],"languages":[{languages}],"scripts":[{scripts}],"license":"OFL","license_path":null,"files":[{files}]}}"#
+        )
+    };
+    let json = format!(
+        r#"{{"schema":1,"version":"1.0","source":"google/fonts","commit":"45e3d5269e4a17d823f6d84470bc084dc5ae46f6","base_url":"https://cdn.jsdelivr.net/gh/google/fonts@45e3d5269e4a17d823f6d84470bc084dc5ae46f6/","fallback_base_url":"https://raw.githubusercontent.com/google/fonts/45e3d5269e4a17d823f6d84470bc084dc5ae46f6/",
+        "languages":[
+          {{"id":"ar_Arab","name":"Arabic","autonym":"العربية","script":"Arab","population":1,"historical":false}},
+          {{"id":"en_Latn","name":"English","autonym":"English","script":"Latn","population":1,"historical":false}},
+          {{"id":"ja_Jpan","name":"Japanese","autonym":"日本語","script":"Jpan","population":1,"historical":false}}],
+        "scripts":[{{"id":"Arab","name":"Arabic"}},{{"id":"Jpan","name":"Japanese"}},{{"id":"Latn","name":"Latin"}}],
+        "families":[{},{},{},{}]}}"#,
+        family("Amiri", "SERIF", "0,1", r#""Arab","Latn""#, file("ofl/amiri/Amiri-Regular.ttf", 1000)),
+        family("Hack", "MONOSPACE", "1", r#""Latn""#, file(HACK, epaint_default_fonts::HACK_REGULAR.len())),
+        family("Noto Sans JP", "SANS_SERIF", "1,2", r#""Jpan","Latn""#, file("ofl/notosansjp/NotoSansJP[wght].ttf", 1000)),
+        family("Ubuntu", "SANS_SERIF", "1", r#""Latn""#, file(UBUNTU, epaint_default_fonts::UBUNTU_LIGHT.len())),
+    );
+    Index::from_json(json.as_bytes()).unwrap()
+}
+
+/// A system with Ubuntu Light installed, an empty font store, and a fake store that can "download"
+/// Hack and Ubuntu Light.
+fn setup(name: &str, settings: Settings) -> (Harness<'static, FontsPanel>, Arc<FakeStore>) {
+    setup_with(name, settings, Runner::Inline, |_| {})
+}
+
+/// [`setup`] with a job runner and the context set up by `fonts` (the interface fonts and
+/// direction), at the launcher's window size less its header and footer.
+fn setup_with(
+    name: &str,
+    settings: Settings,
+    runner: Runner,
+    fonts: impl Fn(&egui::Context) + 'static,
+) -> (Harness<'static, FontsPanel>, Arc<FakeStore>) {
+    let root = PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join("flows").join(name);
+    let _ = std::fs::remove_dir_all(&root);
+    let system = root.join("usr/share/fonts");
+    std::fs::create_dir_all(&system).unwrap();
+    std::fs::write(system.join("Ubuntu-Light.ttf"), epaint_default_fonts::UBUNTU_LIGHT).unwrap();
+    let store_dir = root.join("store");
+    std::fs::create_dir_all(&store_dir).unwrap();
+    let env = FontEnv { os: Os::Unix, root: root.clone(), font_store: Some(store_dir.clone()), ..FontEnv::default() };
+    let catalog = Arc::new(Catalog::new(env).with_font_service(false));
+    catalog.rescan();
+    let files = HashMap::from([
+        (HACK.to_owned(), epaint_default_fonts::HACK_REGULAR.to_vec()),
+        (UBUNTU.to_owned(), epaint_default_fonts::UBUNTU_LIGHT.to_vec()),
+    ]);
+    let store = FakeStore::new(store_dir, files);
+    let store = Arc::new(match std::env::var_os("CRAFT_FONT_MANAGER_GOOGLE_FONTS") {
+        Some(checkout) => store.serving(checkout),
+        None => store,
+    });
+    let options = Options { catalog, installer: store.clone(), index: Ok(index()), runner };
+    let app = FontsPanel::new(options, settings);
+    let mut harness = Harness::builder()
+        .with_size([1120.0, 678.0])
+        // Autonyms such as العربية need fonts beyond egui's; the tests don't depend on the host's.
+        .allow_missing_glyphs()
+        .with_context_setup(move |ctx| {
+            install_interface_fonts(ctx, &[]);
+            fonts(ctx);
+        })
+        .build_ui_state(|ui, app: &mut FontsPanel| app.ui(ui), app);
+    harness.run_steps(4);
+    (harness, store)
+}
+
+fn settle(h: &mut Harness<'_, FontsPanel>) {
+    h.run_steps(4);
+}
+
+fn click(h: &mut Harness<'_, FontsPanel>, label: &str) {
+    h.get_all_by_label(label).next().unwrap_or_else(|| panic!("no {label:?}")).click();
+    settle(h);
+}
+
+/// Clicks the first node whose name has every one of `parts` (names with a placeholder are
+/// isolated for right-to-left text).
+fn click_parts(h: &mut Harness<'_, FontsPanel>, parts: &[&str]) {
+    let wanted: Vec<String> = parts.iter().map(|p| (*p).to_owned()).collect();
+    let by = By::new().predicate(move |n| n.label().is_some_and(|l| wanted.iter().all(|p| l.contains(p.as_str()))));
+    h.get_all(by).next().unwrap_or_else(|| panic!("no {parts:?}")).click();
+    settle(h);
+}
+
+fn click_role(h: &mut Harness<'_, FontsPanel>, role: Role, label: &str) {
+    h.get_by_role_and_label(role, label).click();
+    settle(h);
+}
+
+fn type_into(h: &mut Harness<'_, FontsPanel>, label: &str, text: &str) {
+    h.get_by_role_and_label(Role::TextInput, label).focus();
+    h.step();
+    h.get_by_role_and_label(Role::TextInput, label).type_text(text);
+    settle(h);
+}
+
+fn allow(h: &mut Harness<'_, FontsPanel>) {
+    h.state_mut().set_downloads_allowed(true).unwrap();
+    settle(h);
+}
+
+fn installed_tab(h: &mut Harness<'_, FontsPanel>) {
+    click_role(h, Role::Tab, "Installed");
+    assert_eq!(h.state().tab(), Tab::Installed);
+}
+
+fn has_installed(h: &Harness<'_, FontsPanel>, family: &str) -> bool {
+    h.state().installed().iter().any(|f| f.name == family)
+}
+
+#[test]
+fn search_and_filters_narrow_the_catalogue() {
+    let (mut h, _) = setup("search", Settings::default());
+    assert_eq!(h.state().tab(), Tab::Catalogue);
+    assert_eq!(h.state().results(), ["Amiri", "Hack", "Noto Sans JP", "Ubuntu"]);
+
+    type_into(&mut h, "Search", "noto");
+    assert_eq!(h.state().results(), ["Noto Sans JP"]);
+
+    type_into(&mut h, "Search", "XYZ");
+    assert!(h.state().results().is_empty());
+    assert!(h.query_by_label("No fonts match").is_some());
+    click(&mut h, "Clear search and filters");
+    assert_eq!(h.state().results().len(), 4);
+
+    click_role(&mut h, Role::RadioButton, "Serif");
+    assert_eq!(h.state().results(), ["Amiri"]);
+    click_role(&mut h, Role::RadioButton, "All categories");
+
+    // Ubuntu Light is installed on the system.
+    click_role(&mut h, Role::RadioButton, "Installed");
+    assert_eq!(h.state().results(), ["Ubuntu"]);
+    click_role(&mut h, Role::RadioButton, "Not installed");
+    assert_eq!(h.state().results(), ["Amiri", "Hack", "Noto Sans JP"]);
+    click(&mut h, "Clear filters");
+    assert_eq!(h.state().results().len(), 4);
+}
+
+#[test]
+fn language_filter_finds_languages_by_their_own_name() {
+    let (mut h, _) = setup("language", Settings::default());
+    click_role(&mut h, Role::ComboBox, "Language");
+    type_into(&mut h, "Find a language", "日本");
+    assert!(h.query_by_label("Arabic · العربية").is_none());
+    click(&mut h, "Japanese · 日本語");
+    assert_eq!(h.state().results(), ["Noto Sans JP"]);
+}
+
+#[test]
+fn install_a_family_then_remove_it_from_its_card() {
+    let (mut h, store) = setup("install", Settings::default());
+    assert!(!has_installed(&h, "Hack"));
+
+    click(&mut h, "Hack");
+    assert_eq!(h.state().details_family().as_deref(), Some("Hack"));
+    click(&mut h, "Install all");
+    click(&mut h, "Download");
+    assert_eq!(store.calls(), [Call::Install("Hack".into())]);
+    assert!(h.state().downloads_allowed());
+    let hack = h.state().installed().iter().find(|f| f.name == "Hack").cloned().expect("Hack is listed");
+    assert_eq!(hack.source, Source::Store);
+    assert!(h.query_by_label("Remove all").is_some());
+
+    h.key_press(egui::Key::Escape);
+    settle(&mut h);
+    assert!(h.state().details_family().is_none());
+    installed_tab(&mut h);
+    click(&mut h, "Remove Hack");
+    assert_eq!(store.calls().last(), Some(&Call::Remove("Hack".into())));
+    assert!(!has_installed(&h, "Hack"));
+}
+
+#[test]
+fn install_and_remove_one_style() {
+    let (mut h, store) = setup("style", Settings::default());
+    allow(&mut h);
+    click(&mut h, "Hack");
+    click(&mut h, "Install Regular");
+    assert_eq!(store.calls(), [Call::InstallFile("Hack".into(), HACK.into())]);
+    assert!(has_installed(&h, "Hack"));
+
+    click(&mut h, "Remove Regular");
+    assert_eq!(store.calls().last(), Some(&Call::Remove("Hack".into())));
+    assert!(!has_installed(&h, "Hack"));
+}
+
+#[test]
+fn system_fonts_cannot_be_removed() {
+    let (mut h, store) = setup("system", Settings::default());
+    installed_tab(&mut h);
+    let system = h.state().installed().first().cloned().expect("the system font is listed");
+    assert_eq!(system.source, Source::System);
+    assert!(h.query_by_label(&format!("Remove {}", system.name)).is_none());
+    click(&mut h, &system.name);
+    let remove = h.get_by_label("Remove all");
+    assert!(remove.accesskit_node().is_disabled());
+    remove.click();
+    settle(&mut h);
+    assert!(store.calls().is_empty());
+}
+
+#[test]
+fn nothing_downloads_without_consent() {
+    let (mut h, store) = setup("consent", Settings::default());
+    assert!(h.query_by_label("Downloads are off").is_some());
+    click(&mut h, "Hack");
+
+    click(&mut h, "Preview");
+    assert!(h.query_by_label("Download from Google Fonts?").is_some());
+    click(&mut h, "Cancel");
+    click(&mut h, "Install all");
+    click(&mut h, "Cancel");
+    assert!(store.calls().is_empty());
+    assert!(!h.state().downloads_allowed());
+    assert!(h.query_by_label("Download from Google Fonts?").is_none());
+    h.key_press(egui::Key::Escape);
+    settle(&mut h);
+
+    // Allowed from the note, a preview downloads without asking and installs nothing.
+    click_role(&mut h, Role::Button, "Allow downloads");
+    assert!(h.state().downloads_allowed());
+    assert!(h.query_by_label("Downloads are off").is_none());
+    click(&mut h, "Preview Hack");
+    assert_eq!(store.calls(), [Call::Download("Hack".into())]);
+    assert!(!has_installed(&h, "Hack"));
+}
+
+#[test]
+fn a_failed_install_offers_retry() {
+    let (mut h, store) = setup("retry", Settings::default());
+    allow(&mut h);
+    store.fail_next("network unreachable");
+    click(&mut h, "Install Hack");
+    assert!(h.query_by_label("Couldn't install").is_some());
+    assert!(!has_installed(&h, "Hack"));
+    click(&mut h, "Retry");
+    assert!(has_installed(&h, "Hack"));
+    assert!(h.query_by_label("Couldn't install").is_none());
+}
+
+#[test]
+fn arrow_keys_move_between_cards_and_enter_opens_one() {
+    let (mut h, _) = setup("keys", Settings::default());
+    h.get_by_role_and_label(Role::Button, "Amiri").focus();
+    settle(&mut h);
+    h.key_press(egui::Key::ArrowDown);
+    settle(&mut h);
+    h.key_press(egui::Key::Enter);
+    settle(&mut h);
+    assert_eq!(h.state().details_family().as_deref(), Some("Hack"));
+}
+
+const USER_INDEX: &str = "https://fonts.example.org/index.json";
+
+/// A source a user could add: another "Hack", from an index of its own.
+fn user_index() -> Vec<u8> {
+    format!(
+        r#"{{"schema":1,"version":"1.1","source":"examplefonts","commit":"{commit}",
+        "source_info":{{"id":"examplefonts","name":"Example Fonts","curated":true,"file_urls":["https://fonts.example.org/files/{{path}}"]}},
+        "languages":[{{"id":"en_Latn","name":"English","script":"Latn","population":1}}],
+        "scripts":[{{"id":"Latn","name":"Latin"}}],
+        "families":[{{"family":"Hack","source":"examplefonts","categories":["MONOSPACE"],"license":"OFL","license_path":null,"languages":[0],"scripts":["Latn"],
+          "files":[{{"path":"{HACK}","size":{size},"sha256":"{sha}","style":"normal","weight":400,"axes":[],"postscript":[]}}]}}]}}"#,
+        commit = "1".repeat(40),
+        size = epaint_default_fonts::HACK_REGULAR.len(),
+        sha = "0a".repeat(32),
+    )
+    .into_bytes()
+}
+
+/// The panel with its sources beside it, as a host's settings show them.
+fn sources_setup(name: &str) -> (Harness<'static, FontsPanel>, Arc<FakeStore>) {
+    let root = PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join("flows").join(name);
+    let _ = std::fs::remove_dir_all(&root);
+    let store_dir = root.join("store");
+    std::fs::create_dir_all(&store_dir).unwrap();
+    let env = FontEnv { os: Os::Unix, root: root.clone(), font_store: Some(store_dir.clone()), ..FontEnv::default() };
+    let catalog = Arc::new(Catalog::new(env).with_font_service(false));
+    catalog.rescan();
+    let store = Arc::new(FakeStore::new(store_dir, HashMap::new()).with_index(index()).serving_index(USER_INDEX, user_index()));
+    store.allow_downloads(true).unwrap();
+    let options = Options { catalog, installer: store.clone(), index: store.indexes().map_err(|e| e.0), runner: Runner::Inline };
+    let mut harness = Harness::builder()
+        .with_size([1400.0, 760.0])
+        .allow_missing_glyphs()
+        .with_context_setup(|ctx| install_interface_fonts(ctx, &[]))
+        .build_ui_state(
+            |ui, app: &mut FontsPanel| {
+                egui::Panel::left("sources").exact_size(420.0).show(ui, |ui| app.sources_ui(ui));
+                egui::CentralPanel::default().show(ui, |ui| app.ui(ui));
+            },
+            FontsPanel::new(options, Settings::default()),
+        );
+    harness.run_steps(4);
+    (harness, store)
+}
+
+/// Steps until `done`, for work on the panel's own threads.
+fn wait(h: &mut Harness<'_, FontsPanel>, done: impl Fn(&FontsPanel) -> bool) {
+    for _ in 0..200 {
+        if done(h.state()) {
+            settle(h);
+            return;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+        h.step();
+    }
+    panic!("timed out");
+}
+
+#[test]
+fn an_added_source_is_not_curated_and_can_be_removed() {
+    let (mut h, store) = sources_setup("sources");
+    assert_eq!(h.state().results().len(), 4);
+    type_into(&mut h, "Index address", USER_INDEX);
+    click_role(&mut h, Role::Button, "Add");
+    wait(&mut h, |p| p.results().len() == 5);
+    // Two families named Hack, one from each source, each with its own card.
+    assert_eq!(h.state().results().iter().filter(|f| *f == "Hack").count(), 2);
+    assert!(h.query_all_by_label("Not curated").count() >= 2, "a badge on the card and one in the sources");
+    assert!(h.query_by_label("Changed since added").is_none());
+
+    store.change_index(USER_INDEX);
+    click(&mut h, "Update sources");
+    wait(&mut h, |p| !p.fetching_sources());
+    assert!(h.query_by_label("Changed since added").is_some());
+
+    click_parts(&mut h, &["Remove", USER_INDEX]);
+    assert_eq!(h.state().results().len(), 4);
+    assert!(store.user_sources().is_empty());
+}
+
+/// The launcher's colours, for screenshots that look as the panel does there.
+fn launcher_look() -> Look {
+    let hex = |rgb: u32| egui::Color32::from_rgb((rgb >> 16) as u8, (rgb >> 8) as u8, rgb as u8);
+    let ink = |rgb: u32, a: u8| egui::Color32::from_rgba_unmultiplied((rgb >> 16) as u8, (rgb >> 8) as u8, rgb as u8, a);
+    let dark = Palette {
+        bg: hex(0x121316),
+        sunken: hex(0x060607),
+        ink: hex(0xf2f1ee),
+        ink_strong: hex(0xffffff),
+        muted: ink(0xf2f1ee, 153),
+        faint: ink(0xf2f1ee, 97),
+        line: ink(0xf2f1ee, 38),
+        line_strong: ink(0xf2f1ee, 102),
+        accent: hex(0x2d81ff),
+        accent_ink: hex(0x74aaff),
+        invert_bg: hex(0xffffff),
+        invert_fg: hex(0x0b0b0c),
+        good: hex(0x3fd6b8),
+        warn: hex(0xffc14d),
+        bad: hex(0xff6259),
+    };
+    Look { dark: Some(dark), caps: true, corner: egui::CornerRadius::ZERO, control_height: 34.0, ..Look::default() }
+}
+
+fn save(h: &mut Harness<'_, FontsPanel>, dir: &std::ffi::OsStr, name: &str) {
+    h.run_steps(8);
+    let image = h.render().unwrap();
+    std::fs::create_dir_all(dir).unwrap();
+    image.save(PathBuf::from(dir).join(format!("{name}.png"))).unwrap();
+}
+
+/// The interface fonts with the system's for the scripts egui's own faces lack.
+fn system_fonts(language: &'static str) -> impl Fn(&egui::Context) + 'static {
+    move |ctx| {
+        use craft_ui::fonts::{I18nScripts, UiFonts};
+        let provider = Arc::new(egui_system_font_provider::SystemFontProvider::new().with_locale(Some(language)));
+        UiFonts::new(&I18nScripts).languages(&["en", language]).ui_language(language).system_provider(provider).install(ctx);
+        craft_ui::direction::apply(ctx, craft_ui::direction::resolve(language, craft_ui::direction::Setting::Language));
+    }
+}
+
+/// `CRAFT_FONT_MANAGER_SNAPSHOTS=<dir>`: the panel's main states.
+#[test]
+fn screenshots() {
+    let Some(dir) = std::env::var_os("CRAFT_FONT_MANAGER_SNAPSHOTS") else { return };
+    let shot = |name: &str, language: &'static str, f: &dyn Fn(&mut Harness<'_, FontsPanel>, &FakeStore)| {
+        let (mut h, store) = setup_with(&format!("shot-{name}"), Settings::default(), Runner::Thread, system_fonts(language));
+        h.state_mut().set_look(launcher_look());
+        h.state_mut().set_language(language);
+        settle(&mut h);
+        f(&mut h, &store);
+        save(&mut h, &dir, name);
+        store.release();
+    };
+    shot("catalogue-downloads-off", "en", &|_, _| {});
+    shot("catalogue", "en", &|h, _| {
+        allow(h);
+        click(h, "Preview Hack");
+        h.run_steps(20);
+    });
+    shot("downloading", "en", &|h, store| {
+        allow(h);
+        store.hold();
+        click(h, "Install Hack");
+        h.run_steps(10);
+    });
+    shot("failed", "en", &|h, store| {
+        allow(h);
+        store.fail_next("couldn't reach cdn.jsdelivr.net or raw.githubusercontent.com");
+        click(h, "Install Hack");
+        h.run_steps(20);
+    });
+    shot("empty-search", "en", &|h, _| type_into(h, "Search", "Garamondish"));
+    shot("installed", "en", &|h, _| {
+        allow(h);
+        click(h, "Install Hack");
+        h.run_steps(20);
+        installed_tab(h);
+    });
+    shot("details", "en", &|h, _| {
+        allow(h);
+        click(h, "Preview Hack");
+        h.run_steps(20);
+        click(h, "Hack");
+    });
+    shot("details-not-installed", "en", &|h, _| click(h, "Noto Sans JP"));
+    shot("arabic", "ar", &|h, _| {
+        allow(h);
+        click_parts(h, &["معاينة", "Amiri"]);
+        h.run_steps(20);
+        click_role(h, Role::ComboBox, "اللغة");
+        type_into(h, "ابحث عن لغة", "Arabic");
+        click(h, "Arabic · العربية");
+    });
+    shot("arabic-details", "ar", &|h, _| {
+        allow(h);
+        click_parts(h, &["معاينة", "Amiri"]);
+        h.run_steps(20);
+        click(h, "Amiri");
+    });
+}
diff --git a/crates/font-store/Cargo.toml b/crates/font-store/Cargo.toml
new file mode 100644
index 00000000..5e3ed270
--- /dev/null
+++ b/crates/font-store/Cargo.toml
@@ -0,0 +1,35 @@
+[package]
+name = "craft-font-store"
+description = "The Craft apps' font store: the font indexes (Google Fonts, Noto, sources the user adds), exact font lookup, and verified installs into the suite's font folder."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+
+[features]
+default = []
+# The pinned built-in indexes compiled in (`Index::bundled`), about 620 KB gzipped, so an app can
+# look fonts up with no request at all.
+bundled-index = []
+
+[dependencies]
+flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
+serde = { workspace = true }
+serde_json = { workspace = true }
+sha2 = "0.10"
+skrifa = { version = "0.47", default-features = false, features = ["std"] }
+thiserror = { workspace = true }
+
+# The store and the network are native only; the web keeps fonts elsewhere.
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+craft-atomic = { workspace = true }
+craft-font-catalog = { workspace = true }
+# Blocking HTTPS with rustls and webpki roots: no async runtime, no OpenSSL.
+ureq = { version = "3", default-features = false, features = ["rustls", "gzip"] }
+
+[dev-dependencies]
+write-fonts = "0.54"
+
+[lints]
+workspace = true
diff --git a/crates/font-store/README.md b/crates/font-store/README.md
new file mode 100644
index 00000000..12216302
--- /dev/null
+++ b/crates/font-store/README.md
@@ -0,0 +1,122 @@
+# craft-font-store
+
+The suite's font store: the font indexes of every source, exact lookup of a missing font, and verified installs into the one folder every app's font catalog reads ([`craft-font-catalog`](../font-catalog/README.md)'s `font_store_dir`).
+
+The indexes are [aiongg/craft-font-index](https://github.com/aiongg/craft-font-index) (format 1.x), designed by @kntrttm for photocraft#1135 and #2453. Every font file and licence in an index has a size and a sha256, and only families under a licence that allows redistribution (OFL, Apache 2.0, Ubuntu Font Licence) are listed.
+
+## Sources
+
+| Source | ID | Curated | Fonts come from |
+|---|---|---|---|
+| Google Fonts | `google/fonts` | yes | [google/fonts](https://github.com/google/fonts) at the commit the index records |
+| Noto | `notofonts` | yes | [notofonts](https://github.com/notofonts) repositories at the commits and release tags the index records (the full CJK fonts from noto-cjk, and script families, widths and UI variants Google Fonts lacks) |
+| An index the user adds | `user:<host>/<id>` | never | wherever its URL templates point (https only) |
+
+The built-in sources are the indexes `sources.json` lists. `PINNED_INDEX` names a commit of the index repository and the sha256 of its `sources.json`; each index must have the size and sha256 `sources.json` gives it.
+
+A source the user adds is an index file at an https URL (`.json` or `.json.gz`). It is checked by the same rules as a built-in one, but:
+
+- it is never curated, whatever its file says, so the interface can mark its families "not curated";
+- its ID is prefixed with `user:<host>/`, so it can't stand in for a built-in source;
+- the sha256 of the file first fetched is kept, and a different file later shows as `FontSource::changed`;
+- only an app's own interface can add one (`add_user_source`); an agent gets `Error::NotAllowed`.
+
+## Network access
+
+| Rule | How |
+|---|---|
+| Off until the user turns it on | `FontStore::network()` is `Network::Off` until `enable_network()`. The setting is `settings.json` in the store folder, so it holds for every app. |
+| Only the user turns it on | `FontStore::for_user` is for the app's own interface; call `enable_network()` from a setting or from the user's Install click. `FontStore::for_agent` (MCP, CLI, scripting) gets `Error::NotAllowed`. An agent can install while the user has the network on. |
+| No requests at startup | Nothing in the crate makes a request on its own. Only `fetch_indexes` and the installs do, and they return `Error::NetworkOff` without one while the network is off. |
+| One HTTP client | `Client`: ureq with rustls and the webpki roots, HTTPS only, no cookies, `User-Agent: craft-font-store/<version>`. Timeouts: 15 s to connect, 30 s to the response headers, 10 minutes per file. |
+
+A file's URLs come from its source's URL templates, best first. Both built-in sources use `https://cdn.jsdelivr.net/gh/{repo}@{ref}/{path}`, then `https://raw.githubusercontent.com/{repo}/{ref}/{path}`. The store tries the next URL after any failure: a network error, an HTTP error (jsDelivr answers 403 for files over 20 MB, such as the Noto Serif CJK fonts), or bytes that don't verify.
+
+## The index
+
+`Index` holds the families of one or more sources. Families are sorted by name. Two sources can have a family of the same name (Google Fonts and Noto both have `Noto Serif Myanmar`, Noto's with more styles); lookups by name prefer the first source: the built-in ones in `sources.json` order, then the user's.
+
+| Call | What it does |
+|---|---|
+| `Index::bundled()` (feature `bundled-index`) | The pinned built-in indexes compiled in: about 620 KB gzipped, no request. |
+| `FontStore::offline_indexes()` (feature `bundled-index`) | The bundled indexes and the user's sources as last fetched. |
+| `FontStore::cached_indexes(&PINNED_INDEX)` | The indexes the last `fetch_indexes` saved, when its `sources.json` is the pin's and every built-in index matches it, with the user's sources. |
+| `FontStore::fetch_indexes(&PINNED_INDEX, &cancel)` | Downloads `sources.json`, every gzipped index it lists and every user source, checks them and saves them. An index that fails is reported in `Index::problems()`; the others load. Needs the network on. |
+| `Index::from_bytes(bytes)`, `Index::from_user_bytes(bytes, url)` | One index file, JSON or gzipped JSON. |
+| `Index::merge(indexes)` | One index of several. |
+
+Reading checks every entry: the version (a major version other than 1 is refused; unknown fields are ignored), https URL templates, safe relative paths (no empty, `.` or `..` segment, no `\`), safe and unique file names, `owner/name` repositories and refs, sha256s, sizes, weights and widths. A format 1.0 index is Google Fonts, with URLs from its `base_url` and `fallback_base_url`.
+
+| Call | What it gives |
+|---|---|
+| `index.sources()`, `index.source_of(family)` | Each source's name, homepage, curated flag, commit, and families left out with why. |
+| `family.source`, `family.is_curated()` | The family's source ID, and whether that source is curated. |
+| `index.file_urls(family, file)`, `index.license_urls(family)` | The URLs to try, best first. |
+
+## Exact matches only
+
+| Call | Matches |
+|---|---|
+| `index.family(name)` | The whole family name, ignoring case, from the first source that has it. `families_named(name)` gives every source's; `family_from(source, name)` one source's. |
+| `index.find_face(family, style)` | A style name (`Bold Italic`, `SemiBold`), a CSS weight (`700`) or a PostScript style (`BoldItalic`, `CondensedBold`). A variable file has every weight its `wght` axis reaches. A file of normal width is preferred. |
+| `index.find_postscript(name)` | The PostScript name, case included. A name that families of different names share is `Unavailable::Ambiguous`; look it up in the document's family with `Family::face_by_postscript`. |
+
+A family without the style asked for is `Unavailable::NoStyle`: the store never offers a nearer weight or a similar family. Substitution stays a separate choice in each app.
+
+## Installing
+
+```rust
+use craft_font_catalog::{Catalog, FontEnv};
+use craft_font_store::{Cancel, FontStore, Index};
+
+let store = FontStore::for_user(&FontEnv::from_process()).unwrap().with_catalog(Catalog::global().clone());
+let index = store.offline_indexes();
+let face = index.find_face("Lato", "Bold Italic")?;
+store.enable_network()?; // the user clicked Install
+let cancel = Cancel::new(); // cancel.cancel() from the UI thread stops the download
+store.install_face(&index, face, &cancel, &mut |p| println!("{} of {} bytes", p.done, p.total))?;
+```
+
+`install_family` installs every file of a family; `install_face` one file and the licence. Each file is:
+
+1. downloaded (at most its index size), with progress and cancellation;
+2. checked: its size, its sha256, then that every face in it parses and has outlines (`verify_font`);
+3. saved under `.staging/` as `<name>.part`, which no font scan picks up.
+
+The licence file (`OFL.txt`, `LICENSE`) is checked against its size and sha256 and goes beside the fonts. For a format 1.0 index, which has no sha256 for it, only its size is checked (1 MiB at most).
+
+When every file has passed, the store takes `.lock`, moves the files into the family's folder and writes `manifest.json` (written atomically through `craft-atomic`). If a move or the manifest fails, the files moved so far are taken back out and replaced files are restored. A failed or cancelled install leaves nothing behind. Files already installed with the same sha256 aren't downloaded again.
+
+## The store folder
+
+```text
+settings.json        the network setting and the sources the user added
+manifest.json        what is installed
+indexes/             the last indexes fetched: sources.json, <source>.json.gz, user-<hash>
+<family folder>/     the font files and the licence
+.staging/            downloads being installed
+.lock                held while the store changes
+```
+
+A Google Fonts family's folder is google/fonts' own folder name (`lato/`); another source's is `<source>/<family>` (`notofonts/noto-sans-cjk-jp/`, `user-fonts-example-org-myfonts-bfeb06e2/some-family/`).
+
+`manifest.json` lists each installed family: its name, source, folder, licence and licence file, and per file its name, path in its repository, size, sha256, the index commit it came from, and its PostScript names. An entry is one family of one source, so the same name from two sources is two entries. A manifest that can't be read is moved aside to `manifest.json.bad` and counts as empty.
+
+| Call | What it does |
+|---|---|
+| `installed()`, `installed_family(source, name)`, `is_installed(family, file)` | Read the manifest. |
+| `remove_family(source, name)` | Moves the family folder out at once, updates the manifest, then deletes the files and the licence. |
+| `verify()` | Reads every installed file and reports the missing, damaged and unparseable ones. |
+| `user_sources()`, `add_user_source(url)`, `remove_user_source(url)` | The sources the user added. Removing one leaves its installed families installed. |
+
+## Telling the catalog
+
+The catalog scans the store folder. With `with_catalog(catalog)`, every install and removal ends with `catalog.rescan()`, which reads only new and changed files, so the app sees the fonts at once. Other running apps notice through `Catalog::rescan_if_changed` (when their window is activated) or `Catalog::watch`.
+
+## Web
+
+The index, the lookups, `verify_font` and `IndexPin` build for `wasm32-unknown-unknown`. The store folder and the HTTP client are native only; the web keeps fonts elsewhere.
+
+## Tests
+
+`cargo test -p craft-font-store --all-features`. The store tests run a small HTTP server on 127.0.0.1 that stands in for jsDelivr, raw GitHub and a user's host; no test uses the network. One ignored test fetches the pinned indexes and installs a Noto family over the network: `cargo test -p craft-font-store --all-features -- --ignored`.
diff --git a/crates/font-store/index/indexes/google-fonts.json.gz b/crates/font-store/index/indexes/google-fonts.json.gz
new file mode 100644
index 00000000..9d4b9240
Binary files /dev/null and b/crates/font-store/index/indexes/google-fonts.json.gz differ
diff --git a/crates/font-store/index/indexes/noto.json.gz b/crates/font-store/index/indexes/noto.json.gz
new file mode 100644
index 00000000..bb40f475
Binary files /dev/null and b/crates/font-store/index/indexes/noto.json.gz differ
diff --git a/crates/font-store/index/sources.json b/crates/font-store/index/sources.json
new file mode 100644
index 00000000..e124d132
--- /dev/null
+++ b/crates/font-store/index/sources.json
@@ -0,0 +1,4 @@
+{"schema":1,"version":"1.1","indexes":[
+{"source":"google/fonts","name":"Google Fonts","curated":true,"path":"indexes/google-fonts.json","size":4724581,"sha256":"72ea418e43785d572e73350ad08e9e6601a5a12f93315805f92bd3e092618a63","gz_path":"indexes/google-fonts.json.gz","gz_size":596893,"gz_sha256":"62d1d5645417a691e4710f6d1b895f925284ea9c804de268a97432bd67e9c1f6","commit":"45e3d5269e4a17d823f6d84470bc084dc5ae46f6","families":2040,"files":3781},
+{"source":"notofonts","name":"Noto","curated":true,"path":"indexes/noto.json","size":117706,"sha256":"8243d697c407776ec4fb19fa892c089279a4a528eb4e04cd970ac6ec14ce142a","gz_path":"indexes/noto.json.gz","gz_size":18192,"gz_sha256":"0d467fb79bcd3afe10350ed3caba2ff57af02aedbc413292e06bc78c02994999","commit":"93fac8abebe6c7fed0c5b7d2456d8fa484fa146c","families":30,"files":130}
+]}
diff --git a/crates/font-store/src/http.rs b/crates/font-store/src/http.rs
new file mode 100644
index 00000000..94a6bdd8
--- /dev/null
+++ b/crates/font-store/src/http.rs
@@ -0,0 +1,201 @@
+//! The one HTTP client: blocking HTTPS GET through ureq with rustls, timeouts, a size cap,
+//! progress and cancellation.
+
+use std::io::Read;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::{self, RecvTimeoutError};
+use std::time::Duration;
+
+/// Cancels a download from another thread. Clones share the flag.
+#[derive(Clone, Debug, Default)]
+pub struct Cancel(Arc<AtomicBool>);
+
+impl Cancel {
+    /// A flag that isn't set.
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Asks the download to stop. It stops within a few tens of milliseconds, even while a
+    /// server sends nothing.
+    pub fn cancel(&self) {
+        self.0.store(true, Ordering::Relaxed);
+    }
+
+    /// Whether [`Cancel::cancel`] was called.
+    pub fn is_cancelled(&self) -> bool {
+        self.0.load(Ordering::Relaxed)
+    }
+}
+
+/// How long a request may take.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Timeouts {
+    /// Connecting: DNS, TCP and TLS.
+    pub connect: Duration,
+    /// From sending the request to the response's headers.
+    pub response: Duration,
+    /// The whole request, body included.
+    pub overall: Duration,
+}
+
+impl Default for Timeouts {
+    fn default() -> Self {
+        // Ten minutes moves the largest Google Fonts file (about 60 MB) over a 1 Mbit/s line.
+        Self { connect: Duration::from_secs(15), response: Duration::from_secs(30), overall: Duration::from_secs(600) }
+    }
+}
+
+/// Why a request failed.
+#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
+pub enum FetchError {
+    /// [`Cancel::cancel`] was called.
+    #[error("cancelled")]
+    Cancelled,
+    /// The body is larger than allowed.
+    #[error("the response is larger than {max} bytes")]
+    TooLarge {
+        /// The limit.
+        max: u64,
+    },
+    /// Anything else: connection, TLS, timeout, an HTTP status other than 2xx.
+    #[error("{0}")]
+    Failed(String),
+}
+
+/// The User-Agent every request sends: the crate and its version, nothing about the user.
+pub const USER_AGENT: &str = concat!("craft-font-store/", env!("CARGO_PKG_VERSION"));
+
+/// The HTTP client. HTTPS only; no cookies, no credentials.
+#[derive(Clone)]
+pub struct Client {
+    agent: ureq::Agent,
+    /// URL prefixes the tests serve from a local server.
+    #[cfg(test)]
+    pub(crate) rewrite: Vec<(String, String)>,
+}
+
+impl Default for Client {
+    fn default() -> Self {
+        Self::new(Timeouts::default())
+    }
+}
+
+impl std::fmt::Debug for Client {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("Client")
+    }
+}
+
+impl Client {
+    /// A client with these timeouts.
+    pub fn new(timeouts: Timeouts) -> Self {
+        Self::build(timeouts, true)
+    }
+
+    fn build(t: Timeouts, https_only: bool) -> Self {
+        let config = ureq::Agent::config_builder()
+            .https_only(https_only)
+            .user_agent(USER_AGENT)
+            .timeout_connect(Some(t.connect))
+            .timeout_recv_response(Some(t.response))
+            .timeout_global(Some(t.overall))
+            .max_redirects(3)
+            .http_status_as_error(true)
+            .build();
+        Self {
+            agent: ureq::Agent::new_with_config(config),
+            #[cfg(test)]
+            rewrite: Vec::new(),
+        }
+    }
+
+    /// Plain `http://` to a local test server, with `https://` prefixes mapped onto it.
+    #[cfg(test)]
+    pub(crate) fn for_tests(t: Timeouts, rewrite: Vec<(String, String)>) -> Self {
+        Self { rewrite, ..Self::build(t, false) }
+    }
+
+    fn url(&self, url: &str) -> String {
+        #[cfg(test)]
+        for (from, to) in &self.rewrite {
+            if let Some(rest) = url.strip_prefix(from.as_str()) {
+                return format!("{to}{rest}");
+            }
+        }
+        url.to_string()
+    }
+
+    /// GETs `url`, at most `max` bytes, calling `on_bytes` with the bytes read so far. The
+    /// request runs on a helper thread, so `cancel` stops it even while the server sends nothing.
+    pub fn get(&self, url: &str, max: u64, cancel: &Cancel, on_bytes: &mut dyn FnMut(u64)) -> Result<Vec<u8>, FetchError> {
+        if cancel.is_cancelled() {
+            return Err(FetchError::Cancelled);
+        }
+        let stop = Arc::new(AtomicBool::new(false));
+        let (tx, rx) = mpsc::channel();
+        let (agent, url, flag) = (self.agent.clone(), self.url(url), Arc::clone(&stop));
+        std::thread::Builder::new()
+            .name("font-store-fetch".into())
+            .spawn(move || {
+                let progress = tx.clone();
+                let result = download(&agent, &url, max, &flag, &mut |n| {
+                    let _ = progress.send(Msg::Bytes(n));
+                });
+                // After a cancel nobody receives this.
+                let _ = tx.send(Msg::Done(result));
+            })
+            .map_err(|e| FetchError::Failed(format!("can't start the download: {e}")))?;
+        loop {
+            match rx.recv_timeout(Duration::from_millis(20)) {
+                Ok(Msg::Bytes(n)) => on_bytes(n),
+                Ok(Msg::Done(r)) => return r,
+                Err(RecvTimeoutError::Timeout) => {}
+                Err(RecvTimeoutError::Disconnected) => return Err(FetchError::Failed("the download stopped unexpectedly".into())),
+            }
+            if cancel.is_cancelled() {
+                stop.store(true, Ordering::Relaxed);
+                return Err(FetchError::Cancelled);
+            }
+        }
+    }
+}
+
+enum Msg {
+    Bytes(u64),
+    Done(Result<Vec<u8>, FetchError>),
+}
+
+fn describe(e: &ureq::Error) -> String {
+    match e {
+        ureq::Error::StatusCode(code) => format!("HTTP {code}"),
+        ureq::Error::Timeout(_) => "timed out".into(),
+        other => other.to_string(),
+    }
+}
+
+fn download(agent: &ureq::Agent, url: &str, max: u64, stop: &AtomicBool, on_bytes: &mut dyn FnMut(u64)) -> Result<Vec<u8>, FetchError> {
+    let mut resp = agent.get(url).call().map_err(|e| FetchError::Failed(describe(&e)))?;
+    if resp.body().content_length().is_some_and(|n| n > max) {
+        return Err(FetchError::TooLarge { max });
+    }
+    // One byte over the cap is an error, not a truncated file.
+    let mut reader = resp.body_mut().with_config().limit(max.saturating_add(1)).reader();
+    let mut out: Vec<u8> = Vec::new();
+    let mut buf = vec![0u8; 64 * 1024];
+    loop {
+        if stop.load(Ordering::Relaxed) {
+            return Err(FetchError::Cancelled);
+        }
+        let n = reader.read(&mut buf).map_err(|e| FetchError::Failed(format!("reading the response failed: {e}")))?;
+        if n == 0 {
+            return Ok(out);
+        }
+        if (out.len() as u64).saturating_add(n as u64) > max {
+            return Err(FetchError::TooLarge { max });
+        }
+        out.extend_from_slice(buf.get(..n).unwrap_or_default());
+        on_bytes(out.len() as u64);
+    }
+}
diff --git a/crates/font-store/src/index.rs b/crates/font-store/src/index.rs
new file mode 100644
index 00000000..96585aa1
--- /dev/null
+++ b/crates/font-store/src/index.rs
@@ -0,0 +1,667 @@
+//! Font indexes (aiongg/craft-font-index, format 1.x): the families of every source in one
+//! [`Index`], and exact lookup.
+
+use std::collections::{BTreeMap, HashMap};
+
+use serde::Deserialize;
+
+use crate::source::{Origin, fill, parse};
+
+/// The largest index read.
+pub const MAX_INDEX_BYTES: usize = 32 << 20;
+/// The largest font file an index may list.
+pub const MAX_FILE_BYTES: u64 = 256 << 20;
+/// The largest licence file an index may list.
+pub const MAX_LICENSE_BYTES: u64 = 1 << 20;
+/// The index format's major version this crate reads.
+pub const MAJOR_VERSION: u32 = 1;
+/// The source ID of Google Fonts, and of every format 1.0 index.
+pub const GOOGLE_FONTS: &str = "google/fonts";
+/// The licences that allow redistribution. Families under any other are left out.
+pub const LICENSES: [&str; 3] = ["OFL", "APACHE2", "UFL"];
+
+/// Why an index can't be used.
+#[derive(Debug, thiserror::Error)]
+pub enum IndexError {
+    /// More than [`MAX_INDEX_BYTES`].
+    #[error("the font index is larger than {max} bytes")]
+    TooLarge {
+        /// The limit.
+        max: usize,
+    },
+    /// Not JSON, or a field has the wrong type.
+    #[error("the font index can't be read: {0}")]
+    Json(String),
+    /// A major version this crate doesn't know.
+    #[error("the font index has version {0}; this build reads version {MAJOR_VERSION}.x")]
+    Version(String),
+    /// An entry breaks the format's rules.
+    #[error("the font index has an invalid entry: {0}")]
+    Invalid(String),
+    /// A gzipped index that doesn't decompress.
+    #[error("the gzipped font index can't be read: {0}")]
+    Gzip(String),
+    /// The bytes aren't the pinned ones.
+    #[error("the font index doesn't have the sha256 this build expects")]
+    Checksum,
+}
+
+/// A language some family supports.
+#[derive(Clone, Debug, PartialEq, Deserialize)]
+pub struct Language {
+    /// gflanguages ID: `<ISO 639>_<ISO 15924>`, sometimes with `_<region>` (`vi_Latn`).
+    pub id: String,
+    /// English name.
+    pub name: String,
+    /// The name in the language itself.
+    #[serde(default)]
+    pub autonym: Option<String>,
+    /// ISO 15924 code.
+    #[serde(default)]
+    pub script: String,
+    /// Speakers; 0 when unknown.
+    #[serde(default)]
+    pub population: u64,
+    /// A historical language.
+    #[serde(default)]
+    pub historical: bool,
+}
+
+/// A script some family uses.
+#[derive(Clone, Debug, PartialEq, Deserialize)]
+pub struct Script {
+    /// ISO 15924 code (`Zmth`, `Zsym` and `Zsye` for maths, symbols and emoji).
+    pub id: String,
+    /// English name.
+    pub name: String,
+}
+
+/// A variation axis of a font file.
+#[derive(Clone, Debug, PartialEq, Deserialize)]
+pub struct Axis {
+    /// The axis tag (`wght`).
+    pub tag: String,
+    /// The smallest value.
+    pub min: f32,
+    /// The largest value.
+    pub max: f32,
+}
+
+/// One font file of a family.
+#[derive(Clone, Debug, PartialEq, Deserialize)]
+pub struct FontFile {
+    /// Path in the family's repository: the `{path}` of the source's URL templates.
+    pub path: String,
+    /// Bytes.
+    pub size: u64,
+    /// 64 lowercase hex characters.
+    pub sha256: String,
+    /// `normal` or `italic`.
+    #[serde(default = "normal")]
+    pub style: String,
+    /// CSS weight; for a variable font, the default instance's.
+    pub weight: u16,
+    /// CSS font-stretch percentage; for a variable font, the default instance's.
+    #[serde(default = "normal_width")]
+    pub width: f32,
+    /// Variation axes; empty for a static font.
+    #[serde(default)]
+    pub axes: Vec<Axis>,
+    /// PostScript names: the face's and, for a variable font, each named instance's.
+    #[serde(default)]
+    pub postscript: Vec<String>,
+    /// The repository holding the file, when not the family's.
+    #[serde(default)]
+    pub repo: Option<String>,
+    /// The commit or tag of `repo`, when not the family's.
+    #[serde(default, rename = "ref")]
+    pub git_ref: Option<String>,
+}
+
+fn normal() -> String {
+    "normal".into()
+}
+
+fn normal_width() -> f32 {
+    100.0
+}
+
+impl FontFile {
+    /// The file's name, the last part of its path.
+    pub fn file_name(&self) -> &str {
+        self.path.rsplit('/').next().unwrap_or(&self.path)
+    }
+
+    /// Whether the file's faces are italic.
+    pub fn is_italic(&self) -> bool {
+        self.style.eq_ignore_ascii_case("italic")
+    }
+
+    /// Whether it is a variable font.
+    pub fn is_variable(&self) -> bool {
+        !self.axes.is_empty()
+    }
+
+    fn axis(&self, tag: &str) -> Option<&Axis> {
+        self.axes.iter().find(|a| a.tag == tag)
+    }
+
+    /// Whether the file has the face of CSS `weight`, italic or not: its own weight, or a weight
+    /// its `wght` axis reaches.
+    pub fn has_weight(&self, weight: u16, italic: bool) -> bool {
+        let italic_ok = self.is_italic() == italic || self.axis("ital").is_some_and(|a| a.min <= 0.0 && a.max >= 1.0);
+        let w = f32::from(weight);
+        italic_ok && (self.weight == weight || self.axis("wght").is_some_and(|a| a.min <= w && w <= a.max))
+    }
+
+    /// Whether the file has the normal width (100%), as its own or on its `wdth` axis.
+    pub fn has_normal_width(&self) -> bool {
+        self.width == 100.0 || self.axis("wdth").is_some_and(|a| a.min <= 100.0 && 100.0 <= a.max)
+    }
+}
+
+/// A family's licence file.
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize)]
+pub struct LicenseFile {
+    /// Path in its repository.
+    pub path: String,
+    /// Bytes.
+    pub size: u64,
+    /// 64 lowercase hex characters.
+    pub sha256: String,
+    /// The repository holding it, when not the family's.
+    #[serde(default)]
+    pub repo: Option<String>,
+    /// The commit or tag of `repo`, when not the family's.
+    #[serde(default, rename = "ref")]
+    pub git_ref: Option<String>,
+}
+
+impl LicenseFile {
+    /// The file's name (`OFL.txt`, `LICENSE`).
+    pub fn file_name(&self) -> &str {
+        self.path.rsplit('/').next().unwrap_or(&self.path)
+    }
+}
+
+/// A font family of an index.
+#[derive(Clone, Debug, PartialEq, Deserialize)]
+pub struct Family {
+    /// The family name, unique in its source ignoring case. Two sources can have the same name.
+    pub family: String,
+    /// The ID of the family's source ([`FontSource::id`]).
+    #[serde(default)]
+    pub source: String,
+    /// The designer; empty when not given.
+    #[serde(default)]
+    pub designer: String,
+    /// `SANS_SERIF`, `SERIF`, `DISPLAY`, `HANDWRITING` or `MONOSPACE`.
+    #[serde(default)]
+    pub categories: Vec<String>,
+    /// google/fonts subsets (`latin`, `japanese`, ...); empty for other sources.
+    #[serde(default)]
+    pub subsets: Vec<String>,
+    /// Positions in [`Index::languages`].
+    #[serde(default)]
+    pub languages: Vec<usize>,
+    /// ISO 15924 codes.
+    #[serde(default)]
+    pub scripts: Vec<String>,
+    /// `OFL`, `APACHE2` or `UFL`.
+    #[serde(default)]
+    pub license: String,
+    /// Format 1.0: the licence file in google/fonts, beside the font files.
+    #[serde(default)]
+    pub license_path: Option<String>,
+    /// The licence file, with its size and sha256.
+    #[serde(default)]
+    pub license_file: Option<LicenseFile>,
+    /// The repository holding the files, when not the source's.
+    #[serde(default)]
+    pub repo: Option<String>,
+    /// The commit or tag of `repo`, when not the source's.
+    #[serde(default, rename = "ref")]
+    pub git_ref: Option<String>,
+    /// The font files, sorted by path.
+    pub files: Vec<FontFile>,
+    #[serde(skip)]
+    pub(crate) dir: String,
+    #[serde(skip)]
+    pub(crate) curated: bool,
+}
+
+impl Family {
+    /// The family's folder in the font store: google/fonts' folder name (`notosansjp`), or
+    /// `<source>/<family>` (`notofonts/noto-sans-cjk-jp`) for other sources.
+    pub fn dir(&self) -> &str {
+        &self.dir
+    }
+
+    /// Whether the family's source is curated: a built-in source, not one the user added.
+    pub fn is_curated(&self) -> bool {
+        self.curated
+    }
+
+    /// The licence file's name (`OFL.txt`, `LICENSE`).
+    pub fn license_file_name(&self) -> Option<&str> {
+        match &self.license_file {
+            Some(f) => Some(f.file_name()),
+            None => self.license_path.as_deref().and_then(|p| p.rsplit('/').next()),
+        }
+    }
+
+    /// The file with exactly this style: a style name (`Bold Italic`, `SemiBold`, `Regular`), a
+    /// CSS weight (`700`), or the part of a PostScript name after its `-` (`BoldItalic`,
+    /// `CondensedBold`). A variable font has every weight its `wght` axis reaches. A static file
+    /// of normal width is preferred. No nearer style is offered: a style the family doesn't have
+    /// is [`Unavailable::NoStyle`].
+    pub fn face(&self, style: &str) -> Result<&FontFile, Unavailable> {
+        let no_style = || Unavailable::NoStyle { family: self.family.clone(), style: style.to_string() };
+        if let Some((weight, italic)) = parse_style(style) {
+            let found: Vec<&FontFile> = self.files.iter().filter(|f| f.has_weight(weight, italic) && f.has_normal_width()).collect();
+            let exact = found.iter().find(|f| !f.is_variable() && f.weight == weight && f.is_italic() == italic && f.width == 100.0);
+            if let Some(f) = exact.or(found.first()) {
+                return Ok(f);
+            }
+        }
+        let wanted = squash(style);
+        if wanted.is_empty() {
+            return Err(no_style());
+        }
+        self.files.iter().find(|f| f.postscript.iter().any(|p| p.split_once('-').is_some_and(|(_, s)| squash(s) == wanted))).ok_or_else(no_style)
+    }
+
+    /// The file with this PostScript name, matched exactly.
+    pub fn face_by_postscript(&self, name: &str) -> Option<&FontFile> {
+        self.files.iter().find(|f| f.postscript.iter().any(|p| p == name))
+    }
+
+    /// The family's languages.
+    pub fn languages<'a>(&'a self, index: &'a Index) -> impl Iterator<Item = &'a Language> + 'a {
+        self.languages.iter().filter_map(|&i| index.languages.get(i))
+    }
+
+    /// The total size of the family's files.
+    pub fn size(&self) -> u64 {
+        self.files.iter().map(|f| f.size).sum()
+    }
+}
+
+/// Letters and digits only, lowercased: `Bold Italic`, `bold-italic` and `BoldItalic` are equal.
+fn squash(s: &str) -> String {
+    s.chars().filter(|c| c.is_alphanumeric()).flat_map(char::to_lowercase).collect()
+}
+
+/// A style name's CSS weight and whether it is italic: `Bold Italic` is (700, true), `Regular`
+/// and the empty style are (400, false), `300` is (300, false). `None` for names that aren't a
+/// weight (`Condensed Bold`).
+pub fn parse_style(style: &str) -> Option<(u16, bool)> {
+    let s = squash(style);
+    let (base, italic) = match s.strip_suffix("italic").or_else(|| s.strip_suffix("oblique")) {
+        Some(b) => (b, true),
+        None => (s.as_str(), false),
+    };
+    let weight = match base {
+        "" | "regular" | "normal" | "book" | "roman" => 400,
+        "thin" | "hairline" => 100,
+        "extralight" | "ultralight" => 200,
+        "light" => 300,
+        "medium" => 500,
+        "semibold" | "demibold" => 600,
+        "bold" => 700,
+        "extrabold" | "ultrabold" => 800,
+        "black" | "heavy" => 900,
+        n => n.parse::<u16>().ok().filter(|w| (1..=1000).contains(w))?,
+    };
+    Some((weight, italic))
+}
+
+/// Why the index has no exact match. Near matches are never offered as installable.
+#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
+pub enum Unavailable {
+    /// No family of this name.
+    #[error("{0} is not in the font index")]
+    NoFamily(String),
+    /// The family exists, without this style.
+    #[error("the font index has {family} but not its {style} style")]
+    NoStyle {
+        /// The family's name in the index.
+        family: String,
+        /// The style asked for.
+        style: String,
+    },
+    /// No file has this PostScript name.
+    #[error("no font in the index has the PostScript name {0}")]
+    NoPostScript(String),
+    /// Files of several families have this PostScript name.
+    #[error("the PostScript name {name} belongs to several families: {}", families.join(", "))]
+    Ambiguous {
+        /// The PostScript name.
+        name: String,
+        /// The families that have it.
+        families: Vec<String>,
+    },
+}
+
+/// An exact match: a family and the file that has the face.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Face<'a> {
+    /// The family.
+    pub family: &'a Family,
+    /// The file.
+    pub file: &'a FontFile,
+}
+
+/// A source of fonts: one index file.
+#[derive(Clone, Debug, PartialEq)]
+pub struct FontSource {
+    /// The ID its families carry: `google/fonts`, `notofonts`, or `user:<host>/<id>` for a
+    /// source the user added.
+    pub id: String,
+    /// Display name (`Google Fonts`, `Noto`).
+    pub name: String,
+    /// The source's web page.
+    pub homepage: Option<String>,
+    /// A built-in source. A source the user added is never curated, whatever its file says.
+    pub curated: bool,
+    /// The index format version, `"MAJOR.MINOR"`.
+    pub version: String,
+    /// The commit the index was generated from.
+    pub commit: String,
+    /// The URL a user-added source was added from.
+    pub user_url: Option<String>,
+    /// A user-added source whose file differs from the one first fetched.
+    pub changed: bool,
+    /// Families left out of the index and why (a licence that doesn't allow redistribution).
+    pub warnings: Vec<String>,
+    /// How many families it has.
+    pub families: usize,
+    pub(crate) templates: Vec<String>,
+    pub(crate) repo: Option<String>,
+    pub(crate) git_ref: Option<String>,
+}
+
+impl FontSource {
+    /// The URL templates of its files, best first.
+    pub fn file_url_templates(&self) -> &[String] {
+        &self.templates
+    }
+}
+
+/// A source that couldn't be loaded. The other sources still are.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SourceProblem {
+    /// The source's ID, or its URL for a user-added source.
+    pub source: String,
+    /// Its display name, or its URL.
+    pub name: String,
+    /// What went wrong.
+    pub error: String,
+}
+
+pub(crate) type Part = (FontSource, Vec<Language>, Vec<Script>, Vec<Family>);
+
+/// The checked indexes of one or more sources. Families are sorted by name; families of the same
+/// name are in source order (built-in sources in `sources.json` order, then the user's), and
+/// lookups by name prefer the first.
+#[derive(Clone, Debug, Default)]
+pub struct Index {
+    sources: Vec<FontSource>,
+    problems: Vec<SourceProblem>,
+    languages: Vec<Language>,
+    scripts: Vec<Script>,
+    families: Vec<Family>,
+    by_name: HashMap<String, Vec<usize>>,
+    by_postscript: HashMap<String, Vec<(usize, usize)>>,
+}
+
+impl Index {
+    /// Reads one source's index from its JSON, checking every entry. Its `curated` flag is
+    /// kept; a format 1.0 index is Google Fonts and curated.
+    pub fn from_json(bytes: &[u8]) -> Result<Self, IndexError> {
+        parse(bytes, Origin::Trusted)
+    }
+
+    /// Reads an index from gzipped JSON.
+    pub fn from_gzip(bytes: &[u8]) -> Result<Self, IndexError> {
+        Self::from_json(&gunzip(bytes, MAX_INDEX_BYTES)?)
+    }
+
+    /// Reads an index from JSON or gzipped JSON.
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, IndexError> {
+        if is_gzip(bytes) { Self::from_gzip(bytes) } else { Self::from_json(bytes) }
+    }
+
+    /// Reads an index the user added from `url` (JSON or gzipped JSON): not curated, its source
+    /// ID `user:<host>/<id>`, so it can't stand in for a built-in source.
+    pub fn from_user_bytes(bytes: &[u8], url: &str) -> Result<Self, IndexError> {
+        let json = if is_gzip(bytes) { gunzip(bytes, MAX_INDEX_BYTES)? } else { bytes.to_vec() };
+        parse(&json, Origin::User { url })
+    }
+
+    /// The built-in sources compiled into this build ([`crate::PINNED_INDEX`]): `sources.json`
+    /// and every index it lists, each checked against its sha256.
+    #[cfg(feature = "bundled-index")]
+    pub fn bundled() -> Result<Self, IndexError> {
+        crate::sources::bundled()
+    }
+
+    /// One index of every source in `parts`, in order. A source whose ID came earlier is left
+    /// out and reported in [`Index::problems`].
+    pub fn merge(parts: impl IntoIterator<Item = Index>) -> Self {
+        let mut list = Vec::new();
+        let mut problems = Vec::new();
+        for part in parts {
+            problems.extend(part.problems);
+            let mut families = part.families;
+            for source in part.sources {
+                let (mine, rest): (Vec<Family>, Vec<Family>) = families.into_iter().partition(|f| f.source == source.id);
+                families = rest;
+                list.push((source, part.languages.clone(), part.scripts.clone(), mine));
+            }
+        }
+        Self::assemble(list, problems)
+    }
+
+    /// The index with `problems` added, for sources that couldn't be loaded.
+    pub fn with_problems(mut self, problems: impl IntoIterator<Item = SourceProblem>) -> Self {
+        self.problems.extend(problems);
+        self
+    }
+
+    /// Marks every source as changed since the user added it.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn mark_changed(&mut self) {
+        for s in &mut self.sources {
+            s.changed = true;
+        }
+    }
+
+    pub(crate) fn assemble(parts: Vec<Part>, mut problems: Vec<SourceProblem>) -> Self {
+        let mut sources: Vec<FontSource> = Vec::new();
+        let mut languages: BTreeMap<String, Language> = BTreeMap::new();
+        let mut scripts: BTreeMap<String, Script> = BTreeMap::new();
+        let mut families: Vec<(Family, Vec<String>)> = Vec::new();
+        for (source, langs, scrs, fams) in parts {
+            if sources.iter().any(|s| s.id == source.id) {
+                problems.push(SourceProblem {
+                    source: source.user_url.clone().unwrap_or_else(|| source.id.clone()),
+                    name: source.name.clone(),
+                    error: format!("another source already has the ID {}", source.id),
+                });
+                continue;
+            }
+            for f in fams {
+                let ids = f.languages.iter().filter_map(|&i| langs.get(i)).map(|l| l.id.clone()).collect();
+                families.push((f, ids));
+            }
+            for l in langs {
+                languages.entry(l.id.clone()).or_insert(l);
+            }
+            for s in scrs {
+                scripts.entry(s.id.clone()).or_insert(s);
+            }
+            sources.push(source);
+        }
+        let position: HashMap<&str, usize> = languages.keys().enumerate().map(|(i, id)| (id.as_str(), i)).collect();
+        let mut merged: Vec<Family> = families
+            .into_iter()
+            .map(|(mut f, ids)| {
+                f.languages = ids.iter().filter_map(|id| position.get(id.as_str()).copied()).collect();
+                f
+            })
+            .collect();
+        let order: HashMap<&str, usize> = sources.iter().enumerate().map(|(i, s)| (s.id.as_str(), i)).collect();
+        merged.sort_by_cached_key(|f| (f.family.to_lowercase(), order.get(f.source.as_str()).copied().unwrap_or(usize::MAX)));
+        let mut by_name: HashMap<String, Vec<usize>> = HashMap::new();
+        let mut by_postscript: HashMap<String, Vec<(usize, usize)>> = HashMap::new();
+        for (fi, fam) in merged.iter().enumerate() {
+            by_name.entry(fam.family.to_lowercase()).or_default().push(fi);
+            for (xi, file) in fam.files.iter().enumerate() {
+                for ps in &file.postscript {
+                    let hits = by_postscript.entry(ps.clone()).or_default();
+                    if !hits.contains(&(fi, xi)) {
+                        hits.push((fi, xi));
+                    }
+                }
+            }
+        }
+        Index {
+            sources,
+            problems,
+            languages: languages.into_values().collect(),
+            scripts: scripts.into_values().collect(),
+            families: merged,
+            by_name,
+            by_postscript,
+        }
+    }
+
+    /// The sources, built-in ones first.
+    pub fn sources(&self) -> &[FontSource] {
+        &self.sources
+    }
+
+    /// The source with this ID.
+    pub fn source(&self, id: &str) -> Option<&FontSource> {
+        self.sources.iter().find(|s| s.id == id)
+    }
+
+    /// The source a family comes from.
+    pub fn source_of(&self, family: &Family) -> Option<&FontSource> {
+        self.source(&family.source)
+    }
+
+    /// The sources that couldn't be loaded, and why.
+    pub fn problems(&self) -> &[SourceProblem] {
+        &self.problems
+    }
+
+    /// Every family, sorted by name, then by source.
+    pub fn families(&self) -> &[Family] {
+        &self.families
+    }
+
+    /// Every language a family supports, sorted by ID.
+    pub fn languages(&self) -> &[Language] {
+        &self.languages
+    }
+
+    /// Every script a family uses, sorted by code.
+    pub fn scripts(&self) -> &[Script] {
+        &self.scripts
+    }
+
+    /// The family of this name, ignoring case, from the first source that has it. Only the whole
+    /// name matches.
+    pub fn family(&self, name: &str) -> Option<&Family> {
+        self.families_named(name).next()
+    }
+
+    /// Every family of this name, ignoring case, in source order.
+    pub fn families_named(&self, name: &str) -> impl Iterator<Item = &Family> + '_ {
+        self.by_name.get(&name.to_lowercase()).into_iter().flatten().filter_map(|&i| self.families.get(i))
+    }
+
+    /// The family of this name from one source.
+    pub fn family_from(&self, source: &str, name: &str) -> Option<&Family> {
+        self.families_named(name).find(|f| f.source == source)
+    }
+
+    /// The exact face for a family and style ([`Family::face`]), from the first source whose
+    /// family of that name has the style.
+    pub fn find_face(&self, family: &str, style: &str) -> Result<Face<'_>, Unavailable> {
+        let mut first_error = None;
+        for fam in self.families_named(family) {
+            match fam.face(style) {
+                Ok(file) => return Ok(Face { family: fam, file }),
+                Err(e) => {
+                    first_error.get_or_insert(e);
+                }
+            }
+        }
+        Err(first_error.unwrap_or_else(|| Unavailable::NoFamily(family.to_string())))
+    }
+
+    /// The face with this PostScript name, matched exactly (case included), from the first
+    /// source that has it. When families of different names have it, it is
+    /// [`Unavailable::Ambiguous`]: look it up in the document's family with
+    /// [`Family::face_by_postscript`].
+    pub fn find_postscript(&self, name: &str) -> Result<Face<'_>, Unavailable> {
+        let hits = self.by_postscript.get(name).map(Vec::as_slice).unwrap_or_default();
+        let mut names: Vec<&str> = Vec::new();
+        for &(fi, _) in hits {
+            if let Some(f) = self.families.get(fi)
+                && !names.iter().any(|n| n.to_lowercase() == f.family.to_lowercase())
+            {
+                names.push(&f.family);
+            }
+        }
+        match (names.len(), hits.first()) {
+            (1, Some(&(fi, xi))) => {
+                let family = self.families.get(fi).ok_or_else(|| Unavailable::NoPostScript(name.into()))?;
+                let file = family.files.get(xi).ok_or_else(|| Unavailable::NoPostScript(name.into()))?;
+                Ok(Face { family, file })
+            }
+            (0, _) | (_, None) => Err(Unavailable::NoPostScript(name.into())),
+            _ => Err(Unavailable::Ambiguous { name: name.into(), families: names.into_iter().map(str::to_string).collect() }),
+        }
+    }
+
+    /// The URLs of a font file of `family`, best first: the source's templates filled with the
+    /// file's path, repository and ref.
+    pub fn file_urls(&self, family: &Family, file: &FontFile) -> Vec<String> {
+        self.urls(family, &file.path, file.repo.as_deref(), file.git_ref.as_deref())
+    }
+
+    /// The URLs of `family`'s licence file, best first; empty when it has none.
+    pub fn license_urls(&self, family: &Family) -> Vec<String> {
+        match (&family.license_file, &family.license_path) {
+            (Some(f), _) => self.urls(family, &f.path, f.repo.as_deref(), f.git_ref.as_deref()),
+            (None, Some(path)) => self.urls(family, path, None, None),
+            (None, None) => Vec::new(),
+        }
+    }
+
+    fn urls(&self, family: &Family, path: &str, repo: Option<&str>, git_ref: Option<&str>) -> Vec<String> {
+        let Some(source) = self.source_of(family) else { return Vec::new() };
+        let repo = repo.or(family.repo.as_deref()).or(source.repo.as_deref());
+        let git_ref = git_ref.or(family.git_ref.as_deref()).or(source.git_ref.as_deref());
+        fill(&source.templates, path, repo, git_ref).unwrap_or_default()
+    }
+}
+
+pub(crate) fn is_gzip(bytes: &[u8]) -> bool {
+    bytes.starts_with(&[0x1f, 0x8b])
+}
+
+/// Decompresses at most `max` bytes; more is an error, not a truncated index.
+pub(crate) fn gunzip(bytes: &[u8], max: usize) -> Result<Vec<u8>, IndexError> {
+    use std::io::Read;
+    let mut out = Vec::new();
+    flate2::read::GzDecoder::new(bytes).take((max as u64).saturating_add(1)).read_to_end(&mut out).map_err(|e| IndexError::Gzip(e.to_string()))?;
+    if out.len() > max {
+        return Err(IndexError::TooLarge { max });
+    }
+    Ok(out)
+}
diff --git a/crates/font-store/src/lib.rs b/crates/font-store/src/lib.rs
new file mode 100644
index 00000000..bd79a3ab
--- /dev/null
+++ b/crates/font-store/src/lib.rs
@@ -0,0 +1,49 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+//! The suite's font store: the font indexes of every source (Google Fonts, Noto, indexes the user
+//! adds), exact lookup of a missing font, and verified installs into the one folder every app's
+//! font catalog reads.
+//!
+//! ```no_run
+//! # #[cfg(not(target_arch = "wasm32"))] {
+//! use craft_font_store::{Cancel, FontStore, Index, PINNED_INDEX};
+//! use craft_font_catalog::{Catalog, FontEnv};
+//!
+//! let store = FontStore::for_user(&FontEnv::from_process()).unwrap().with_catalog(Catalog::global().clone());
+//! let index = store.cached_indexes(&PINNED_INDEX).unwrap();
+//! if let Ok(face) = index.find_face("Lato", "Bold Italic") {
+//!     store.enable_network().unwrap(); // the user clicked Install
+//!     store.install_face(&index, face, &Cancel::new(), &mut |p| println!("{}/{}", p.done, p.total)).unwrap();
+//! }
+//! # }
+//! ```
+//!
+//! The index and its lookups, [`verify_font`] and [`IndexPin`] build on every target. The store
+//! and the HTTP client are native only.
+
+mod index;
+mod pin;
+mod source;
+mod sources;
+mod verify;
+
+#[cfg(not(target_arch = "wasm32"))]
+mod http;
+#[cfg(not(target_arch = "wasm32"))]
+mod store;
+
+pub use index::{
+    Axis, Face, Family, FontFile, FontSource, GOOGLE_FONTS, Index, IndexError, LICENSES, Language, LicenseFile, MAJOR_VERSION, MAX_FILE_BYTES,
+    MAX_INDEX_BYTES, MAX_LICENSE_BYTES, Script, SourceProblem, Unavailable, parse_style,
+};
+pub use pin::{IndexPin, PINNED_INDEX};
+pub use sources::{SourceEntry, SourcesFile};
+pub use verify::{VerifyError, is_font, sha256_hex, verify_font};
+
+#[cfg(not(target_arch = "wasm32"))]
+pub use http::{Cancel, Client, FetchError, Timeouts, USER_AGENT};
+#[cfg(not(target_arch = "wasm32"))]
+pub use store::{Caller, Error, FontStore, InstalledFamily, InstalledFile, Network, Problem, Progress, UserSource};
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/font-store/src/pin.rs b/crates/font-store/src/pin.rs
new file mode 100644
index 00000000..1ca035b1
--- /dev/null
+++ b/crates/font-store/src/pin.rs
@@ -0,0 +1,38 @@
+//! The built-in sources this build trusts: a commit of the index repository and the sha256 of its
+//! `sources.json`.
+
+use crate::source::encode_path;
+
+/// `sources.json` pinned by commit and sha256. The indexes it lists are checked against the
+/// sha256s in it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct IndexPin {
+    /// The GitHub repository holding the indexes (`owner/name`).
+    pub repo: &'static str,
+    /// The repository's commit.
+    pub commit: &'static str,
+    /// The sha256 of `sources.json` at that commit, lowercase hex.
+    pub sha256: &'static str,
+}
+
+impl IndexPin {
+    /// Where `sources.json` is downloaded from: jsDelivr, then raw GitHub.
+    pub fn urls(&self) -> Vec<String> {
+        self.file_urls("sources.json")
+    }
+
+    /// Where a file of the repository at the pinned commit is downloaded from (an index's
+    /// `path` or `gz_path`): jsDelivr, then raw GitHub.
+    pub fn file_urls(&self, path: &str) -> Vec<String> {
+        let (repo, commit, path) = (self.repo, self.commit, encode_path(path));
+        vec![format!("https://cdn.jsdelivr.net/gh/{repo}@{commit}/{path}"), format!("https://raw.githubusercontent.com/{repo}/{commit}/{path}")]
+    }
+}
+
+/// The built-in sources of this build: aiongg/craft-font-index at `5a9a7f8` (Google Fonts at
+/// google/fonts `45e3d52`, and Noto), the copy `Index::bundled` compiles in.
+pub const PINNED_INDEX: IndexPin = IndexPin {
+    repo: "aiongg/craft-font-index",
+    commit: "5a9a7f8038c8f3e2e1583a79c92a816e8e71b34f",
+    sha256: "4b0c2b9cdec1885027dc3316cdc013ccfbc0d63b6ed9950138d762afaff72e23",
+};
diff --git a/crates/font-store/src/source.rs b/crates/font-store/src/source.rs
new file mode 100644
index 00000000..977e33cc
--- /dev/null
+++ b/crates/font-store/src/source.rs
@@ -0,0 +1,497 @@
+//! Reading and checking one source's index file, and its URL templates.
+
+use std::collections::HashSet;
+
+use serde::Deserialize;
+
+use crate::index::{
+    Family, FontSource, GOOGLE_FONTS, Index, IndexError, LICENSES, Language, MAJOR_VERSION, MAX_FILE_BYTES, MAX_INDEX_BYTES, MAX_LICENSE_BYTES,
+    Script,
+};
+
+pub(crate) const MAX_STR: usize = 1024;
+const MAX_LIST: usize = 4096;
+const MAX_FAMILIES: usize = 50_000;
+const MAX_FILES: usize = 200_000;
+const MAX_SEGMENT: usize = 64;
+const MAX_FILE_NAME: usize = 200;
+const MAX_TEMPLATES: usize = 8;
+
+/// Where an index file comes from.
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum Origin<'a> {
+    /// A built-in source, or any file the app itself trusts: its `curated` flag is kept.
+    Trusted,
+    /// A source the user added by URL: never curated, its ID prefixed with `user:<host>/`.
+    User { url: &'a str },
+}
+
+#[derive(Deserialize)]
+struct RawSourceInfo {
+    #[serde(default)]
+    id: String,
+    #[serde(default)]
+    name: String,
+    #[serde(default)]
+    homepage: Option<String>,
+    #[serde(default)]
+    curated: bool,
+    #[serde(default)]
+    file_urls: Vec<String>,
+}
+
+#[derive(Deserialize)]
+struct Raw {
+    version: String,
+    #[serde(default)]
+    source: String,
+    commit: String,
+    #[serde(default)]
+    base_url: Option<String>,
+    #[serde(default)]
+    fallback_base_url: Option<String>,
+    #[serde(default)]
+    source_info: Option<RawSourceInfo>,
+    #[serde(default)]
+    repo: Option<String>,
+    #[serde(default, rename = "ref")]
+    git_ref: Option<String>,
+    #[serde(default)]
+    languages: Vec<Language>,
+    #[serde(default)]
+    scripts: Vec<Script>,
+    families: Vec<Family>,
+}
+
+pub(crate) fn invalid<T>(msg: impl Into<String>) -> Result<T, IndexError> {
+    Err(IndexError::Invalid(msg.into()))
+}
+
+fn short(s: &str) -> String {
+    s.chars().take(120).collect()
+}
+
+pub(crate) fn check_version(version: &str) -> Result<(), IndexError> {
+    let major = version.split_once('.').and_then(|(major, minor)| {
+        let major: u32 = major.parse().ok()?;
+        minor.parse::<u32>().ok()?;
+        Some(major)
+    });
+    if major == Some(MAJOR_VERSION) { Ok(()) } else { Err(IndexError::Version(version.chars().take(40).collect())) }
+}
+
+pub(crate) fn check_str(what: &str, s: &str) -> Result<(), IndexError> {
+    if s.len() > MAX_STR || s.chars().any(char::is_control) {
+        return invalid(format!("{what} is too long or has control characters"));
+    }
+    Ok(())
+}
+
+pub(crate) fn is_sha256(s: &str) -> bool {
+    s.len() == 64 && s.bytes().all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+}
+
+/// A git ref or a repository part: `[A-Za-z0-9._-]+`, not starting with `.`.
+pub(crate) fn is_ref(s: &str) -> bool {
+    !s.is_empty() && s.len() <= 128 && !s.starts_with('.') && s.bytes().all(|b| b.is_ascii_alphanumeric() || b"._-".contains(&b))
+}
+
+/// `owner/name` on GitHub.
+pub(crate) fn is_repo(s: &str) -> bool {
+    s.split_once('/').is_some_and(|(o, n)| is_ref(o) && is_ref(n))
+}
+
+fn check_repo_ref(what: &str, repo: Option<&str>, git_ref: Option<&str>) -> Result<(), IndexError> {
+    if let Some(r) = repo.filter(|r| !is_repo(r)) {
+        return invalid(format!("{what} has repo `{}`, not owner/name", short(r)));
+    }
+    if let Some(r) = git_ref.filter(|r| !is_ref(r)) {
+        return invalid(format!("{what} has ref `{}`", short(r)));
+    }
+    Ok(())
+}
+
+/// A file name the store can write on every platform.
+pub(crate) fn safe_file_name(name: &str) -> bool {
+    !name.is_empty()
+        && name.len() <= MAX_FILE_NAME
+        && !name.starts_with('.')
+        && !name.ends_with('.')
+        && name.bytes().all(|b| b.is_ascii_alphanumeric() || b"_-[],.+".contains(&b))
+}
+
+fn safe_segment(s: &str) -> bool {
+    !s.is_empty() && s.len() <= MAX_SEGMENT && s.bytes().all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'_' || b == b'-')
+}
+
+/// A family folder in the store: google/fonts' `[a-z0-9_-]+`, or `<source>/<family>` of the same
+/// characters.
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) fn safe_dir(dir: &str) -> bool {
+    let mut parts = dir.split('/');
+    match (parts.next(), parts.next(), parts.next()) {
+        (Some(a), None, None) => safe_segment(a),
+        (Some(a), Some(b), None) => safe_segment(a) && safe_segment(b),
+        _ => false,
+    }
+}
+
+/// Lowercase letters and digits, other runs as one `-`: `notofonts`, `google-fonts`,
+/// `noto-sans-cjk-jp`. A name with no ASCII letters or digits gets a hash of itself.
+pub(crate) fn slug(s: &str) -> String {
+    let mut out = String::new();
+    for c in s.chars() {
+        if c.is_ascii_alphanumeric() {
+            out.push(c.to_ascii_lowercase());
+        } else if !out.is_empty() && !out.ends_with('-') {
+            out.push('-');
+        }
+    }
+    out.truncate(MAX_SEGMENT);
+    let out = out.trim_end_matches('-').to_string();
+    if out.is_empty() { crate::verify::sha256_hex(s.as_bytes()).chars().take(16).collect() } else { out }
+}
+
+/// A user source's folder name: its ID's slug and a hash of the whole ID, since IDs that differ
+/// only in punctuation, case or past the slug's length share a slug.
+fn user_slug(id: &str) -> String {
+    let hash: String = crate::verify::sha256_hex(id.as_bytes()).chars().take(8).collect();
+    let mut s = slug(id);
+    s.truncate(MAX_SEGMENT - hash.len() - 1);
+    format!("{}-{hash}", s.trim_end_matches('-'))
+}
+
+/// A relative path in a repository: `/`-separated, no empty, `.` or `..` segment, no `\`, and a
+/// file name the store can write.
+pub(crate) fn check_path(path: &str) -> Result<&str, IndexError> {
+    let bad = path.is_empty()
+        || path.len() > MAX_STR
+        || path.contains('\\')
+        || path.chars().any(char::is_control)
+        || path.split('/').any(|s| s.is_empty() || s == "." || s == "..");
+    let name = path.rsplit('/').next().unwrap_or(path);
+    if bad || !safe_file_name(name) { invalid(format!("`{}` is not a safe relative path", short(path))) } else { Ok(name) }
+}
+
+/// Percent-encodes each `/`-separated segment, keeping the unreserved characters.
+pub(crate) fn encode_path(p: &str) -> String {
+    let mut out = String::with_capacity(p.len() + 8);
+    for b in p.bytes() {
+        if b.is_ascii_alphanumeric() || matches!(b, b'-' | b'.' | b'_' | b'~' | b'/') {
+            out.push(char::from(b));
+        } else {
+            out.push_str(&format!("%{b:02X}"));
+        }
+    }
+    out
+}
+
+fn check_template(t: &str) -> Result<(), IndexError> {
+    let rest = t.replace("{path}", "").replace("{repo}", "").replace("{ref}", "");
+    let ok = t.len() <= MAX_STR
+        && t.starts_with("https://")
+        && t.len() > "https://".len()
+        && t.contains("{path}")
+        && !rest.contains(['{', '}', '\\'])
+        && !t.chars().any(|c| c.is_control() || c.is_whitespace());
+    if ok { Ok(()) } else { invalid(format!("file URL template `{}` is not an https URL with {{path}}", short(t))) }
+}
+
+fn check_base_url(u: &str) -> Result<(), IndexError> {
+    let ok = u.len() <= MAX_STR
+        && u.len() > "https://".len()
+        && u.starts_with("https://")
+        && u.ends_with('/')
+        && !u.chars().any(|c| c.is_control() || c.is_whitespace() || matches!(c, '\\' | '{' | '}'));
+    if ok { Ok(()) } else { invalid(format!("base URL `{}` is not an https folder URL", short(u))) }
+}
+
+/// The URLs of `path`, filling each template in turn. `repo` and `ref` are needed only when a
+/// template names them.
+pub(crate) fn fill(templates: &[String], path: &str, repo: Option<&str>, git_ref: Option<&str>) -> Result<Vec<String>, IndexError> {
+    check_path(path)?;
+    let encoded = encode_path(path);
+    let mut urls = Vec::with_capacity(templates.len());
+    for t in templates {
+        let mut url = t.replace("{path}", &encoded);
+        for (key, value, ok) in [("{repo}", repo, is_repo as fn(&str) -> bool), ("{ref}", git_ref, is_ref)] {
+            if url.contains(key) {
+                match value {
+                    Some(v) if ok(v) => url = url.replace(key, v),
+                    _ => return invalid(format!("`{}` has no valid {key} for its URL", short(path))),
+                }
+            }
+        }
+        if !url.starts_with("https://") || url.contains('{') {
+            return invalid(format!("`{}` doesn't resolve to an https URL", short(path)));
+        }
+        urls.push(url);
+    }
+    Ok(urls)
+}
+
+/// The host of an https URL, lowercased: `fonts.example.org`.
+pub(crate) fn https_host(url: &str) -> Option<String> {
+    let rest = url.strip_prefix("https://")?;
+    let host = rest.split(['/', '?', '#']).next()?.to_ascii_lowercase();
+    let ok = !host.is_empty() && host.len() <= 253 && host.bytes().all(|b| b.is_ascii_alphanumeric() || b".-:[]".contains(&b));
+    ok.then_some(host)
+}
+
+/// Whether `url` is an https URL a user may add as a source.
+pub(crate) fn is_source_url(url: &str) -> bool {
+    url.len() <= MAX_STR && https_host(url).is_some() && !url.chars().any(|c| c.is_control() || c.is_whitespace() || c == '\\')
+}
+
+/// What [`check_family`] needs to know about the source.
+struct Ctx<'a> {
+    /// The ID the file declares.
+    declared: &'a str,
+    /// The ID the app uses (prefixed for a user source).
+    id: &'a str,
+    slug: &'a str,
+    google: bool,
+    curated: bool,
+    templates: &'a [String],
+    repo: Option<&'a str>,
+    git_ref: Option<&'a str>,
+    languages: usize,
+}
+
+/// Reads one source's index file.
+pub(crate) fn parse(bytes: &[u8], origin: Origin<'_>) -> Result<Index, IndexError> {
+    if bytes.len() > MAX_INDEX_BYTES {
+        return Err(IndexError::TooLarge { max: MAX_INDEX_BYTES });
+    }
+    let value: serde_json::Value = serde_json::from_slice(bytes).map_err(|e| IndexError::Json(e.to_string()))?;
+    // The version first: a newer major version may change any other field.
+    let version = value.get("version").and_then(|v| v.as_str()).ok_or_else(|| IndexError::Version("(none)".into()))?;
+    check_version(version)?;
+    let raw: Raw = serde_json::from_value(value).map_err(|e| IndexError::Json(e.to_string()))?;
+    check(raw, origin)
+}
+
+fn check(raw: Raw, origin: Origin<'_>) -> Result<Index, IndexError> {
+    check_str("commit", &raw.commit)?;
+    if raw.commit.len() != 40 || !raw.commit.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return invalid(format!("commit `{}` is not 40 hex characters", short(&raw.commit)));
+    }
+    let info_id = raw.source_info.as_ref().map(|i| i.id.as_str()).unwrap_or_default();
+    let declared = match (raw.source.as_str(), info_id) {
+        ("", "") => GOOGLE_FONTS,
+        (s, "") | ("", s) => s,
+        (s, i) if s == i => s,
+        _ => return invalid("source and source_info.id differ"),
+    }
+    .to_string();
+    if !declared.split('/').all(is_ref) || declared.len() > 128 {
+        return invalid(format!("source `{}` is not a valid ID", short(&declared)));
+    }
+    let host = match origin {
+        Origin::Trusted => None,
+        Origin::User { url } => Some(https_host(url).ok_or_else(|| IndexError::Invalid("the source's URL is not https".into()))?),
+    };
+    let id = host.as_ref().map_or_else(|| declared.clone(), |h| format!("user:{h}/{declared}"));
+    for u in raw.base_url.iter().chain(&raw.fallback_base_url) {
+        check_base_url(u)?;
+    }
+    check_repo_ref("the index", raw.repo.as_deref(), raw.git_ref.as_deref())?;
+    let (name, homepage, curated, templates) = match &raw.source_info {
+        Some(info) => {
+            check_str("source name", &info.name)?;
+            if info.file_urls.is_empty() || info.file_urls.len() > MAX_TEMPLATES {
+                return invalid("source_info.file_urls must list 1 to 8 templates");
+            }
+            for t in &info.file_urls {
+                check_template(t)?;
+            }
+            let homepage = info.homepage.clone().filter(|h| is_source_url(h));
+            let name = if info.name.trim().is_empty() { declared.clone() } else { info.name.clone() };
+            (name, homepage, info.curated, info.file_urls.clone())
+        }
+        None => {
+            let Some(base) = &raw.base_url else { return invalid("an index without source_info needs base_url") };
+            let templates = std::iter::once(base).chain(&raw.fallback_base_url).map(|b| format!("{b}{{path}}")).collect();
+            let name = host.clone().unwrap_or_else(|| "Google Fonts".into());
+            (name, None, true, templates)
+        }
+    };
+    let curated = curated && host.is_none();
+    if raw.families.len() > MAX_FAMILIES || raw.languages.len() > MAX_FAMILIES * 4 || raw.scripts.len() > MAX_LIST {
+        return invalid("too many families, languages or scripts");
+    }
+    for l in &raw.languages {
+        check_str("language", &l.id)?;
+    }
+    for s in &raw.scripts {
+        check_str("script", &s.id)?;
+    }
+    let slug = if host.is_some() { user_slug(&id) } else { slug(&id) };
+    let ctx = Ctx {
+        declared: &declared,
+        id: &id,
+        slug: &slug,
+        google: host.is_none() && declared == GOOGLE_FONTS,
+        curated,
+        templates: &templates,
+        repo: raw.repo.as_deref(),
+        git_ref: raw.git_ref.as_deref(),
+        languages: raw.languages.len(),
+    };
+    let mut warnings = Vec::new();
+    let mut families = Vec::with_capacity(raw.families.len());
+    let mut names = HashSet::new();
+    let mut dirs = HashSet::new();
+    let mut total = 0usize;
+    for mut fam in raw.families {
+        check_str("license", &fam.license)?;
+        if !LICENSES.contains(&fam.license.as_str()) {
+            warnings.push(format!("{} is left out: its licence `{}` doesn't allow redistribution", short(&fam.family), short(&fam.license)));
+            continue;
+        }
+        check_family(&mut fam, &ctx)?;
+        total = total.saturating_add(fam.files.len());
+        if total > MAX_FILES {
+            return invalid("too many files");
+        }
+        if !names.insert(fam.family.to_lowercase()) {
+            return invalid(format!("family `{}` is listed twice", fam.family));
+        }
+        if !dirs.insert(fam.dir.clone()) {
+            return invalid(format!("folder `{}` holds more than one family", fam.dir));
+        }
+        families.push(fam);
+    }
+    let source = FontSource {
+        id,
+        name,
+        homepage,
+        curated,
+        version: raw.version,
+        commit: raw.commit,
+        user_url: match origin {
+            Origin::Trusted => None,
+            Origin::User { url } => Some(url.to_string()),
+        },
+        changed: false,
+        warnings,
+        families: families.len(),
+        templates,
+        repo: raw.repo,
+        git_ref: raw.git_ref,
+    };
+    Ok(Index::assemble(vec![(source, raw.languages, raw.scripts, families)], Vec::new()))
+}
+
+/// The family folder in google/fonts: every file at `<ofl|apache|ufl>/<dir>/<file>`.
+fn google_dir(fam: &Family) -> Result<String, IndexError> {
+    let dir_of = |path: &str| -> Option<String> {
+        let mut parts = path.split('/');
+        match (parts.next(), parts.next(), parts.next(), parts.next()) {
+            (Some(lic), Some(dir), Some(_), None) if ["ofl", "apache", "ufl"].contains(&lic) && safe_segment(dir) => Some(dir.to_string()),
+            _ => None,
+        }
+    };
+    let mut dir: Option<String> = None;
+    for path in fam.files.iter().map(|f| f.path.as_str()).chain(fam.license_path.as_deref()) {
+        let d = dir_of(path).ok_or_else(|| IndexError::Invalid(format!("`{}` is not <ofl|apache|ufl>/<folder>/<file>", short(path))))?;
+        match &dir {
+            None => dir = Some(d),
+            Some(x) if *x == d => {}
+            Some(_) => return invalid(format!("the files of `{}` are in different folders", fam.family)),
+        }
+    }
+    dir.ok_or_else(|| IndexError::Invalid(format!("`{}` has no files", fam.family)))
+}
+
+fn check_family(fam: &mut Family, ctx: &Ctx<'_>) -> Result<(), IndexError> {
+    check_str("family name", &fam.family)?;
+    if fam.family.trim().is_empty() {
+        return invalid("a family has no name");
+    }
+    let name = fam.family.clone();
+    if !fam.source.is_empty() && fam.source != ctx.declared {
+        return invalid(format!("`{name}` is from source `{}`, not the index's", short(&fam.source)));
+    }
+    fam.source = ctx.id.to_string();
+    fam.curated = ctx.curated;
+    check_str("designer", &fam.designer)?;
+    if fam.files.is_empty() {
+        return invalid(format!("`{name}` has no files"));
+    }
+    let lists = [fam.categories.len(), fam.subsets.len(), fam.languages.len(), fam.scripts.len(), fam.files.len()];
+    if lists.iter().any(|&n| n > MAX_LIST) {
+        return invalid(format!("`{name}` has too many entries"));
+    }
+    for s in fam.categories.iter().chain(&fam.subsets).chain(&fam.scripts) {
+        check_str("category, subset or script", s)?;
+    }
+    if fam.languages.iter().any(|&i| i >= ctx.languages) {
+        return invalid(format!("`{name}` names a language the index doesn't have"));
+    }
+    check_repo_ref(&name, fam.repo.as_deref(), fam.git_ref.as_deref())?;
+    let (fam_repo, fam_ref) = (fam.repo.clone(), fam.git_ref.clone());
+    let repo = |own: Option<String>| own.or_else(|| fam_repo.clone()).or_else(|| ctx.repo.map(str::to_string));
+    let git_ref = |own: Option<String>| own.or_else(|| fam_ref.clone()).or_else(|| ctx.git_ref.map(str::to_string));
+    let mut names = HashSet::new();
+    for f in &fam.files {
+        let file = check_path(&f.path)?.to_ascii_lowercase();
+        if ![".ttf", ".otf", ".ttc", ".otc"].iter().any(|ext| file.ends_with(ext)) {
+            return invalid(format!("`{}` is not a font file", short(&f.path)));
+        }
+        if !names.insert(file) {
+            return invalid(format!("`{}` is listed twice", short(&f.path)));
+        }
+        if !is_sha256(&f.sha256) {
+            return invalid(format!("`{}` has a bad sha256", short(&f.path)));
+        }
+        if f.size == 0 || f.size > MAX_FILE_BYTES {
+            return invalid(format!("`{}` has size {}", short(&f.path), f.size));
+        }
+        if !(1..=1000).contains(&f.weight) {
+            return invalid(format!("`{}` has weight {}", short(&f.path), f.weight));
+        }
+        if !(f.width.is_finite() && f.width > 0.0 && f.width <= 1000.0) {
+            return invalid(format!("`{}` has width {}", short(&f.path), f.width));
+        }
+        check_str("style", &f.style)?;
+        if f.axes.len() > 64 || f.postscript.len() > MAX_LIST {
+            return invalid(format!("`{}` has too many axes or PostScript names", short(&f.path)));
+        }
+        for a in &f.axes {
+            if a.tag.len() != 4 || !a.tag.is_ascii() || !a.min.is_finite() || !a.max.is_finite() || a.min > a.max {
+                return invalid(format!("`{}` has a bad axis", short(&f.path)));
+            }
+        }
+        for ps in &f.postscript {
+            check_str("PostScript name", ps)?;
+            if ps.is_empty() {
+                return invalid(format!("`{}` has an empty PostScript name", short(&f.path)));
+            }
+        }
+        check_repo_ref(&f.path, f.repo.as_deref(), f.git_ref.as_deref())?;
+        fill(ctx.templates, &f.path, repo(f.repo.clone()).as_deref(), git_ref(f.git_ref.clone()).as_deref())?;
+    }
+    let beside = |path: &str| -> Result<(), IndexError> {
+        if names.contains(&check_path(path)?.to_ascii_lowercase()) {
+            return invalid(format!("the licence of `{name}` has a font file's name"));
+        }
+        Ok(())
+    };
+    if let Some(lf) = &fam.license_file {
+        beside(&lf.path)?;
+        if !is_sha256(&lf.sha256) || lf.size == 0 || lf.size > MAX_LICENSE_BYTES {
+            return invalid(format!("the licence of `{name}` has a bad sha256 or size"));
+        }
+        check_repo_ref(&lf.path, lf.repo.as_deref(), lf.git_ref.as_deref())?;
+        fill(ctx.templates, &lf.path, repo(lf.repo.clone()).as_deref(), git_ref(lf.git_ref.clone()).as_deref())?;
+    }
+    if let Some(lp) = &fam.license_path {
+        beside(lp)?;
+        if fam.license_file.is_none() {
+            fill(ctx.templates, lp, repo(None).as_deref(), git_ref(None).as_deref())?;
+        }
+    }
+    fam.dir = if ctx.google { google_dir(fam)? } else { format!("{}/{}", ctx.slug, slug(&fam.family)) };
+    Ok(())
+}
diff --git a/crates/font-store/src/sources.rs b/crates/font-store/src/sources.rs
new file mode 100644
index 00000000..3db03c51
--- /dev/null
+++ b/crates/font-store/src/sources.rs
@@ -0,0 +1,148 @@
+//! `sources.json`: the built-in indexes, each with its size and sha256.
+
+use std::collections::HashSet;
+
+use serde::Deserialize;
+
+use crate::index::{Index, IndexError, MAX_INDEX_BYTES, gunzip};
+use crate::source::{MAX_STR, check_path, check_str, check_version, invalid, is_sha256};
+use crate::verify::sha256_hex;
+
+/// The largest `sources.json` read.
+pub(crate) const MAX_SOURCES_BYTES: usize = 1 << 20;
+const MAX_SOURCES: usize = 64;
+
+/// One built-in index of `sources.json`.
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize)]
+pub struct SourceEntry {
+    /// The index's source ID.
+    pub source: String,
+    /// The source's display name.
+    #[serde(default)]
+    pub name: String,
+    /// Whether the source is curated.
+    #[serde(default)]
+    pub curated: bool,
+    /// The index, relative to `sources.json`.
+    pub path: String,
+    /// Bytes of the index.
+    pub size: u64,
+    /// sha256 of the index.
+    pub sha256: String,
+    /// The gzipped index, relative to `sources.json`.
+    #[serde(default)]
+    pub gz_path: Option<String>,
+    /// Bytes of the gzipped index.
+    #[serde(default)]
+    pub gz_size: Option<u64>,
+    /// sha256 of the gzipped index.
+    #[serde(default)]
+    pub gz_sha256: Option<String>,
+    /// The commit the index was generated from.
+    #[serde(default)]
+    pub commit: String,
+}
+
+impl SourceEntry {
+    /// The gzipped copy's path, size and sha256, when `sources.json` lists one.
+    pub fn gz(&self) -> Option<(&str, u64, &str)> {
+        match (&self.gz_path, self.gz_size, &self.gz_sha256) {
+            (Some(p), Some(n), Some(h)) => Some((p, n, h)),
+            _ => None,
+        }
+    }
+
+    /// The index from the bytes of its gzipped copy (when `gz`) or of the index itself, checked
+    /// against the sizes and sha256s listed here, and that it is this entry's source.
+    pub fn read(&self, bytes: &[u8], gz: bool) -> Result<Index, IndexError> {
+        let json = if gz {
+            let (_, size, sha256) = self.gz().ok_or(IndexError::Checksum)?;
+            if bytes.len() as u64 != size || sha256_hex(bytes) != sha256 {
+                return Err(IndexError::Checksum);
+            }
+            gunzip(bytes, MAX_INDEX_BYTES)?
+        } else {
+            bytes.to_vec()
+        };
+        if json.len() as u64 != self.size || sha256_hex(&json) != self.sha256 {
+            return Err(IndexError::Checksum);
+        }
+        let index = Index::from_json(&json)?;
+        if index.sources().iter().any(|s| s.id != self.source) {
+            return invalid(format!("the index at {} is not of source {}", self.path, self.source));
+        }
+        Ok(index)
+    }
+}
+
+/// `sources.json`.
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize)]
+pub struct SourcesFile {
+    /// `"MAJOR.MINOR"`.
+    pub version: String,
+    /// The built-in indexes, in the order a client lists them.
+    pub indexes: Vec<SourceEntry>,
+}
+
+impl SourcesFile {
+    /// Reads and checks `sources.json`.
+    pub fn from_json(bytes: &[u8]) -> Result<Self, IndexError> {
+        if bytes.len() > MAX_SOURCES_BYTES {
+            return Err(IndexError::TooLarge { max: MAX_SOURCES_BYTES });
+        }
+        let value: serde_json::Value = serde_json::from_slice(bytes).map_err(|e| IndexError::Json(e.to_string()))?;
+        let version = value.get("version").and_then(|v| v.as_str()).ok_or_else(|| IndexError::Version("(none)".into()))?;
+        check_version(version)?;
+        let file: SourcesFile = serde_json::from_value(value).map_err(|e| IndexError::Json(e.to_string()))?;
+        if file.indexes.len() > MAX_SOURCES {
+            return invalid("sources.json lists too many indexes");
+        }
+        let mut ids = HashSet::new();
+        for e in &file.indexes {
+            check_str("source", &e.source)?;
+            check_str("source name", &e.name)?;
+            check_str("commit", &e.commit)?;
+            if e.source.is_empty() || e.source.len() > MAX_STR || !ids.insert(e.source.as_str()) {
+                return invalid(format!("source `{}` is empty or listed twice", e.source));
+            }
+            check_path(&e.path)?;
+            if !is_sha256(&e.sha256) || e.size == 0 || e.size > MAX_INDEX_BYTES as u64 {
+                return invalid(format!("the index of `{}` has a bad sha256 or size", e.source));
+            }
+            if e.gz_path.is_some() || e.gz_size.is_some() || e.gz_sha256.is_some() {
+                let Some((p, n, h)) = e.gz() else { return invalid(format!("the gzipped index of `{}` is incomplete", e.source)) };
+                check_path(p)?;
+                if !is_sha256(h) || n == 0 || n > MAX_INDEX_BYTES as u64 {
+                    return invalid(format!("the gzipped index of `{}` has a bad sha256 or size", e.source));
+                }
+            }
+        }
+        Ok(file)
+    }
+}
+
+#[cfg(feature = "bundled-index")]
+const BUNDLED_SOURCES: &[u8] = include_bytes!("../index/sources.json");
+
+/// The gzipped indexes compiled in, by their path in `sources.json`.
+#[cfg(feature = "bundled-index")]
+const BUNDLED: [(&str, &[u8]); 2] = [
+    ("indexes/google-fonts.json.gz", include_bytes!("../index/indexes/google-fonts.json.gz")),
+    ("indexes/noto.json.gz", include_bytes!("../index/indexes/noto.json.gz")),
+];
+
+#[cfg(feature = "bundled-index")]
+pub(crate) fn bundled() -> Result<Index, IndexError> {
+    if sha256_hex(BUNDLED_SOURCES) != crate::PINNED_INDEX.sha256 {
+        return Err(IndexError::Checksum);
+    }
+    let sources = SourcesFile::from_json(BUNDLED_SOURCES)?;
+    let mut parts = Vec::new();
+    for entry in &sources.indexes {
+        let gz_path = entry.gz().map(|(p, _, _)| p);
+        let bytes = BUNDLED.iter().find(|(p, _)| Some(*p) == gz_path).map(|(_, b)| *b);
+        let bytes = bytes.ok_or_else(|| IndexError::Invalid(format!("{} is not compiled in", entry.source)))?;
+        parts.push(entry.read(bytes, true)?);
+    }
+    Ok(Index::merge(parts))
+}
diff --git a/crates/font-store/src/store.rs b/crates/font-store/src/store.rs
new file mode 100644
index 00000000..880d9857
--- /dev/null
+++ b/crates/font-store/src/store.rs
@@ -0,0 +1,920 @@
+//! The font store folder: consent, installs, the manifest, removal and checks.
+//!
+//! Layout of the folder ([`craft_font_catalog::font_store_dir`]):
+//!
+//! ```text
+//! settings.json        the consent setting and the sources the user added
+//! manifest.json        what is installed
+//! indexes/             the last indexes fetched: sources.json, one file per source
+//! <family dir>/        google/fonts' folder name, or <source>/<family>: the fonts and the licence
+//! .staging/            downloads being installed; nothing a font scan picks up
+//! .lock                held while the store changes
+//! ```
+
+use std::fs::File;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{Duration, SystemTime};
+
+use craft_font_catalog::{Catalog, FontEnv, font_store_dir};
+use serde::{Deserialize, Serialize};
+
+use crate::http::{Cancel, Client, FetchError};
+use crate::index::{Face, Family, FontFile, GOOGLE_FONTS, Index, IndexError, MAX_INDEX_BYTES, MAX_LICENSE_BYTES, SourceProblem, Unavailable};
+use crate::pin::IndexPin;
+use crate::source::{is_source_url, safe_dir, safe_file_name, slug};
+use crate::sources::{MAX_SOURCES_BYTES, SourceEntry, SourcesFile};
+use crate::verify::{VerifyError, is_font, sha256_hex, verify_font};
+
+const SETTINGS: &str = "settings.json";
+const MANIFEST: &str = "manifest.json";
+const INDEX_CACHE: &str = "indexes";
+const SOURCES_CACHE: &str = "sources.json";
+const STAGING: &str = ".staging";
+const LOCK: &str = ".lock";
+const MAX_MANIFEST_BYTES: u64 = 16 << 20;
+const MAX_SETTINGS_BYTES: u64 = 1 << 20;
+const MAX_USER_SOURCES: usize = 64;
+/// Staging folders older than this belong to an install that crashed.
+const STALE: Duration = Duration::from_secs(3600);
+
+/// Whether the store may download.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Network {
+    /// No requests. The default.
+    #[default]
+    Off,
+    /// The user allowed downloads from jsDelivr and GitHub.
+    On,
+}
+
+/// Who drives the store. Only a person in the app can turn the network on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Caller {
+    /// The app's own interface, acting on the user's click.
+    User,
+    /// An agent (MCP, the CLI, scripting): it can install when the user has turned the network
+    /// on, and can never turn it on.
+    Agent,
+}
+
+/// Why a store operation failed.
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    /// Downloading is off; the user turns it on in the app.
+    #[error("downloading fonts is turned off")]
+    NetworkOff,
+    /// An agent tried to turn the network on.
+    #[error("only the user can turn on downloading fonts")]
+    NotAllowed,
+    /// Not an https URL a source can be added from.
+    #[error("{0} is not an https URL")]
+    BadUrl(String),
+    /// No exact match in the index.
+    #[error(transparent)]
+    Unavailable(#[from] Unavailable),
+    /// The index can't be used.
+    #[error(transparent)]
+    Index(#[from] IndexError),
+    /// Every URL failed.
+    #[error("downloading {what} failed: {}", reasons.join("; "))]
+    Download {
+        /// The file.
+        what: String,
+        /// Each URL's failure.
+        reasons: Vec<String>,
+    },
+    /// The downloaded file isn't the one the index describes.
+    #[error("{file} was rejected: {error}")]
+    Verify {
+        /// The file.
+        file: String,
+        /// What was wrong.
+        error: VerifyError,
+    },
+    /// The family isn't installed.
+    #[error("{0} is not installed")]
+    NotInstalled(String),
+    /// The operation was cancelled.
+    #[error("cancelled")]
+    Cancelled,
+    /// Reading or writing the store failed.
+    #[error("{what}: {source}")]
+    Io {
+        /// What was being done.
+        what: String,
+        /// The error.
+        source: std::io::Error,
+    },
+}
+
+fn io(what: impl Into<String>) -> impl FnOnce(std::io::Error) -> Error {
+    let what = what.into();
+    move |source| Error::Io { what, source }
+}
+
+/// Download progress of an install.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Progress {
+    /// The file being downloaded, from 0.
+    pub file: usize,
+    /// Files to download.
+    pub files: usize,
+    /// Bytes downloaded, of all files.
+    pub done: u64,
+    /// Bytes of all files.
+    pub total: u64,
+}
+
+/// An installed font file.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct InstalledFile {
+    /// The file's name in the family folder.
+    pub name: String,
+    /// Its path in its source's repository.
+    pub path: String,
+    /// Bytes.
+    pub size: u64,
+    /// sha256, lowercase hex.
+    pub sha256: String,
+    /// The commit of the index it was installed from.
+    pub commit: String,
+    /// Its PostScript names.
+    #[serde(default)]
+    pub postscript: Vec<String>,
+}
+
+/// An installed family.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct InstalledFamily {
+    /// The family name.
+    pub family: String,
+    /// The ID of the source it was installed from.
+    #[serde(default = "google_fonts")]
+    pub source: String,
+    /// The folder in the store holding its files.
+    pub dir: String,
+    /// `OFL`, `APACHE2` or `UFL`.
+    pub license: String,
+    /// The licence file's name in the folder.
+    pub license_file: Option<String>,
+    /// The installed files: all of the family's, or some faces.
+    pub files: Vec<InstalledFile>,
+}
+
+#[derive(Default, Serialize, Deserialize)]
+struct Manifest {
+    version: u32,
+    families: Vec<InstalledFamily>,
+}
+
+fn google_fonts() -> String {
+    GOOGLE_FONTS.into()
+}
+
+/// A source the user added: an index file at an https URL, never curated.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UserSource {
+    /// The index file (format 1.x, JSON or gzipped JSON).
+    pub url: String,
+    /// When it was added, in seconds since 1970.
+    pub added_at: u64,
+    /// The sha256 of the file first fetched from it. A different file later shows as
+    /// [`crate::FontSource::changed`].
+    #[serde(default)]
+    pub last_sha256: Option<String>,
+}
+
+#[derive(Clone, Default, Serialize, Deserialize)]
+struct Settings {
+    #[serde(default)]
+    network: Network,
+    #[serde(default)]
+    user_sources: Vec<UserSource>,
+}
+
+/// Something [`FontStore::verify`] found wrong with an installed file.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Problem {
+    /// The family.
+    pub family: String,
+    /// The file.
+    pub file: String,
+    /// What is wrong; `None` when the file is missing.
+    pub error: Option<VerifyError>,
+}
+
+/// The suite's font store.
+///
+/// Nothing here touches the network on its own: only [`FontStore::fetch_index`] and the installs
+/// do, and only while the user has turned the network on.
+pub struct FontStore {
+    dir: PathBuf,
+    caller: Caller,
+    client: Client,
+    catalog: Option<Arc<Catalog>>,
+}
+
+impl std::fmt::Debug for FontStore {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("FontStore").field("dir", &self.dir).field("caller", &self.caller).finish_non_exhaustive()
+    }
+}
+
+impl FontStore {
+    /// The store for the app's own interface, in the folder every app reads.
+    /// `None` where there is no per-user folder.
+    pub fn for_user(env: &FontEnv) -> Option<Self> {
+        Some(Self::new(font_store_dir(env)?, Caller::User))
+    }
+
+    /// The store for an agent (MCP, CLI): it can never turn the network on.
+    pub fn for_agent(env: &FontEnv) -> Option<Self> {
+        Some(Self::new(font_store_dir(env)?, Caller::Agent))
+    }
+
+    /// A store in `dir`.
+    pub fn new(dir: PathBuf, caller: Caller) -> Self {
+        Self { dir, caller, client: Client::default(), catalog: None }
+    }
+
+    /// Uses `client` for downloads (other timeouts).
+    pub fn with_client(mut self, client: Client) -> Self {
+        self.client = client;
+        self
+    }
+
+    /// Rescans `catalog` after each install and removal, so the app sees the change at once.
+    /// Apps pass `Catalog::global().clone()`.
+    pub fn with_catalog(mut self, catalog: Arc<Catalog>) -> Self {
+        self.catalog = Some(catalog);
+        self
+    }
+
+    /// The store's folder.
+    pub fn dir(&self) -> &Path {
+        &self.dir
+    }
+
+    /// Who drives this store.
+    pub fn caller(&self) -> Caller {
+        self.caller
+    }
+
+    // ----- consent
+
+    /// The user's setting; [`Network::Off`] when it was never set or can't be read.
+    pub fn network(&self) -> Network {
+        self.settings().network
+    }
+
+    fn settings(&self) -> Settings {
+        read_limited(&self.dir.join(SETTINGS), MAX_SETTINGS_BYTES).and_then(|b| serde_json::from_slice::<Settings>(&b).ok()).unwrap_or_default()
+    }
+
+    /// Turns downloading on: call it only from the user's own action (a setting, an Install
+    /// click). [`Error::NotAllowed`] for an agent.
+    pub fn enable_network(&self) -> Result<(), Error> {
+        if self.caller != Caller::User {
+            return Err(Error::NotAllowed);
+        }
+        self.change_settings(|s| s.network = Network::On)
+    }
+
+    /// Turns downloading off. Anyone may.
+    pub fn disable_network(&self) -> Result<(), Error> {
+        self.change_settings(|s| s.network = Network::Off)
+    }
+
+    fn change_settings(&self, change: impl FnOnce(&mut Settings)) -> Result<(), Error> {
+        let _lock = self.lock()?;
+        let mut settings = self.settings();
+        change(&mut settings);
+        let bytes = serde_json::to_vec_pretty(&settings).map_err(|e| io("saving the setting")(std::io::Error::other(e)))?;
+        self.write_file(SETTINGS, &bytes)
+    }
+
+    // ----- sources the user added
+
+    /// The sources the user added, in the order added.
+    pub fn user_sources(&self) -> Vec<UserSource> {
+        self.settings().user_sources
+    }
+
+    /// Adds an index file at `url` as a source, from the user's own action; the next
+    /// [`FontStore::fetch_indexes`] downloads it. Its families are never curated.
+    /// [`Error::NotAllowed`] for an agent.
+    pub fn add_user_source(&self, url: &str) -> Result<(), Error> {
+        if self.caller != Caller::User {
+            return Err(Error::NotAllowed);
+        }
+        let url = url.trim();
+        if !is_source_url(url) {
+            return Err(Error::BadUrl(url.chars().take(200).collect()));
+        }
+        let added_at = SystemTime::now().duration_since(SystemTime::UNIX_EPOCH).map_or(0, |d| d.as_secs());
+        self.change_settings(|s| {
+            if !s.user_sources.iter().any(|u| u.url == url) && s.user_sources.len() < MAX_USER_SOURCES {
+                s.user_sources.push(UserSource { url: url.to_string(), added_at, last_sha256: None });
+            }
+        })
+    }
+
+    /// Removes a source the user added, and its cached index. Families installed from it stay
+    /// installed.
+    pub fn remove_user_source(&self, url: &str) -> Result<(), Error> {
+        self.change_settings(|s| s.user_sources.retain(|u| u.url != url))?;
+        let _ = std::fs::remove_file(self.user_cache(url));
+        Ok(())
+    }
+
+    fn user_cache(&self, url: &str) -> PathBuf {
+        let key: String = sha256_hex(url.as_bytes()).chars().take(16).collect();
+        self.dir.join(INDEX_CACHE).join(format!("user-{key}"))
+    }
+
+    fn require_network(&self) -> Result<(), Error> {
+        if self.network() == Network::On { Ok(()) } else { Err(Error::NetworkOff) }
+    }
+
+    // ----- index
+
+    /// The indexes saved by the last [`FontStore::fetch_indexes`], when its `sources.json` is
+    /// `pin`'s and every built-in index matches it, with the sources the user added.
+    pub fn cached_indexes(&self, pin: &IndexPin) -> Option<Index> {
+        let cache = self.dir.join(INDEX_CACHE);
+        let bytes = read_limited(&cache.join(SOURCES_CACHE), MAX_SOURCES_BYTES as u64)?;
+        if sha256_hex(&bytes) != pin.sha256 {
+            return None;
+        }
+        let sources = SourcesFile::from_json(&bytes).ok()?;
+        let mut parts = Vec::new();
+        for entry in &sources.indexes {
+            let bytes = read_limited(&cache.join(builtin_cache_name(entry)), MAX_INDEX_BYTES as u64)?;
+            parts.push(entry.read(&bytes, entry.gz().is_some()).ok()?);
+        }
+        let (users, problems) = self.cached_user_indexes();
+        Some(Index::merge(parts.into_iter().chain(users)).with_problems(problems))
+    }
+
+    /// The indexes without a request: the built-in ones compiled in, with the sources the user
+    /// added as last fetched.
+    #[cfg(feature = "bundled-index")]
+    pub fn offline_indexes(&self) -> Index {
+        let (users, mut problems) = self.cached_user_indexes();
+        let builtin = Index::bundled().unwrap_or_else(|e| {
+            problems.insert(0, SourceProblem { source: "sources.json".into(), name: "Built-in sources".into(), error: e.to_string() });
+            Index::default()
+        });
+        Index::merge(std::iter::once(builtin).chain(users)).with_problems(problems)
+    }
+
+    fn cached_user_indexes(&self) -> (Vec<Index>, Vec<SourceProblem>) {
+        let mut indexes = Vec::new();
+        let mut problems = Vec::new();
+        for user in self.user_sources() {
+            let problem = |error: String| SourceProblem { source: user.url.clone(), name: user.url.clone(), error };
+            let Some(bytes) = read_limited(&self.user_cache(&user.url), MAX_INDEX_BYTES as u64) else {
+                problems.push(problem("not downloaded yet".into()));
+                continue;
+            };
+            match user_index(&bytes, &user) {
+                Ok(index) => indexes.push(index),
+                Err(e) => problems.push(problem(e.to_string())),
+            }
+        }
+        (indexes, problems)
+    }
+
+    /// Downloads `sources.json` as `pin` names it, every index it lists and every source the user
+    /// added, checks them and saves them for [`FontStore::cached_indexes`]. Needs the network on.
+    ///
+    /// An index that fails leaves the others usable: it is reported in [`Index::problems`]. Only
+    /// a `sources.json` that can't be had fails the whole call.
+    pub fn fetch_indexes(&self, pin: &IndexPin, cancel: &Cancel) -> Result<Index, Error> {
+        self.require_network()?;
+        let check = |bytes: &[u8]| if sha256_hex(bytes) == pin.sha256 { Ok(()) } else { Err(VerifyError::Sha256) };
+        let bytes = self.fetch(&pin.urls(), MAX_SOURCES_BYTES as u64, "sources.json", cancel, &mut |_| {}, &check)?;
+        let sources = SourcesFile::from_json(&bytes)?;
+        let cache = self.dir.join(INDEX_CACHE);
+        std::fs::create_dir_all(&cache).map_err(io("creating the index folder"))?;
+        let mut parts = Vec::new();
+        let mut problems = Vec::new();
+        for entry in &sources.indexes {
+            match self.fetch_builtin(pin, entry, cancel) {
+                Ok(index) => parts.push(index),
+                Err(Error::Cancelled) => return Err(Error::Cancelled),
+                Err(e) => problems.push(SourceProblem { source: entry.source.clone(), name: entry.name.clone(), error: e.to_string() }),
+            }
+        }
+        self.write_file(&format!("{INDEX_CACHE}/{SOURCES_CACHE}"), &bytes)?;
+        for user in self.user_sources() {
+            match self.fetch_user(&user, cancel) {
+                Ok(index) => parts.push(index),
+                Err(Error::Cancelled) => return Err(Error::Cancelled),
+                Err(e) => problems.push(SourceProblem { source: user.url.clone(), name: user.url.clone(), error: e.to_string() }),
+            }
+        }
+        Ok(Index::merge(parts).with_problems(problems))
+    }
+
+    fn fetch_builtin(&self, pin: &IndexPin, entry: &SourceEntry, cancel: &Cancel) -> Result<Index, Error> {
+        let (path, size, sha256) = entry.gz().unwrap_or((&entry.path, entry.size, &entry.sha256));
+        let check = |bytes: &[u8]| {
+            if bytes.len() as u64 != size {
+                Err(VerifyError::Size { expected: size, actual: bytes.len() as u64 })
+            } else if sha256_hex(bytes) != sha256 {
+                Err(VerifyError::Sha256)
+            } else {
+                Ok(())
+            }
+        };
+        let bytes = self.fetch(&pin.file_urls(path), size, &entry.name, cancel, &mut |_| {}, &check)?;
+        let index = entry.read(&bytes, entry.gz().is_some())?;
+        self.write_file(&format!("{INDEX_CACHE}/{}", builtin_cache_name(entry)), &bytes)?;
+        Ok(index)
+    }
+
+    fn fetch_user(&self, user: &UserSource, cancel: &Cancel) -> Result<Index, Error> {
+        let bytes = self.fetch(std::slice::from_ref(&user.url), MAX_INDEX_BYTES as u64, &user.url, cancel, &mut |_| {}, &|_| Ok(()))?;
+        let index = user_index(&bytes, user)?;
+        if let Some(name) = self.user_cache(&user.url).file_name().and_then(|n| n.to_str()) {
+            self.write_file(&format!("{INDEX_CACHE}/{name}"), &bytes)?;
+        }
+        if user.last_sha256.is_none() {
+            let sha = sha256_hex(&bytes);
+            self.change_settings(|s| {
+                if let Some(u) = s.user_sources.iter_mut().find(|u| u.url == user.url && u.last_sha256.is_none()) {
+                    u.last_sha256 = Some(sha);
+                }
+            })?;
+        }
+        Ok(index)
+    }
+
+    // ----- install
+
+    /// Installs every file of `family`. Files already installed with the same sha256 aren't
+    /// downloaded again.
+    pub fn install_family(
+        &self,
+        index: &Index,
+        family: &Family,
+        cancel: &Cancel,
+        progress: &mut dyn FnMut(Progress),
+    ) -> Result<InstalledFamily, Error> {
+        let files: Vec<&FontFile> = family.files.iter().collect();
+        self.install(index, family, &files, cancel, progress)
+    }
+
+    /// Installs the file of one face (from [`Index::find_face`] or [`Index::find_postscript`]),
+    /// with the family's licence.
+    pub fn install_face(&self, index: &Index, face: Face<'_>, cancel: &Cancel, progress: &mut dyn FnMut(Progress)) -> Result<InstalledFamily, Error> {
+        self.install(index, face.family, &[face.file], cancel, progress)
+    }
+
+    fn install(
+        &self,
+        index: &Index,
+        family: &Family,
+        files: &[&FontFile],
+        cancel: &Cancel,
+        progress: &mut dyn FnMut(Progress),
+    ) -> Result<InstalledFamily, Error> {
+        let installed = self.installed_family(&family.source, &family.family);
+        let folder = self.dir.join(family.dir());
+        let have = |f: &FontFile| installed.as_ref().is_some_and(|i| i.files.iter().any(|x| x.name == f.file_name() && x.sha256 == f.sha256));
+        let wanted: Vec<&FontFile> = files.iter().copied().filter(|f| !have(f) || !folder.join(f.file_name()).is_file()).collect();
+        let license_missing = family.license_file_name().is_some_and(|name| !folder.join(name).is_file());
+        if wanted.is_empty() && !license_missing {
+            return installed.ok_or_else(|| Error::NotInstalled(family.family.clone()));
+        }
+        self.require_network()?;
+        std::fs::create_dir_all(&self.dir).map_err(io("creating the font store folder"))?;
+        self.sweep_staging();
+        let stage = Stage::new(&self.dir)?;
+
+        let total: u64 = wanted.iter().map(|f| f.size).sum();
+        let mut done_before = 0u64;
+        let mut staged: Vec<(String, PathBuf)> = Vec::new();
+        for (i, file) in wanted.iter().enumerate() {
+            let mut on_bytes = |n: u64| progress(Progress { file: i, files: wanted.len(), done: done_before + n, total });
+            let check = |bytes: &[u8]| verify_font(file, bytes);
+            let bytes = self.fetch(&index.file_urls(family, file), file.size, file.file_name(), cancel, &mut on_bytes, &check)?;
+            done_before += file.size;
+            staged.push((file.file_name().to_string(), stage.write(file.file_name(), &bytes)?));
+        }
+        if license_missing && let Some(name) = family.license_file_name() {
+            // A format 1.0 index has no size or sha256 for the licence: the size cap is the only
+            // check.
+            let max = family.license_file.as_ref().map_or(MAX_LICENSE_BYTES, |f| f.size);
+            let check = |bytes: &[u8]| match &family.license_file {
+                Some(f) if bytes.len() as u64 != f.size => Err(VerifyError::Size { expected: f.size, actual: bytes.len() as u64 }),
+                Some(f) if sha256_hex(bytes) != f.sha256 => Err(VerifyError::Sha256),
+                _ => Ok(()),
+            };
+            let bytes = self.fetch(&index.license_urls(family), max, name, cancel, &mut |_| {}, &check)?;
+            staged.push((name.to_string(), stage.write(name, &bytes)?));
+        }
+        if cancel.is_cancelled() {
+            return Err(Error::Cancelled);
+        }
+
+        let result = {
+            let _lock = self.lock()?;
+            let mut manifest = self.read_manifest();
+            let commit = Commit::apply(&folder, &stage.dir, &staged)?;
+            let entry = merge_entry(&mut manifest, index, family, &wanted);
+            match self.write_manifest(&manifest) {
+                Ok(()) => {
+                    commit.keep();
+                    Ok(entry)
+                }
+                Err(e) => {
+                    commit.undo();
+                    Err(e)
+                }
+            }
+        };
+        drop(stage);
+        self.rescan();
+        result
+    }
+
+    /// Downloads from each URL in turn until one gives bytes that pass `check`.
+    fn fetch(
+        &self,
+        urls: &[String],
+        max: u64,
+        what: &str,
+        cancel: &Cancel,
+        on_bytes: &mut dyn FnMut(u64),
+        check: &dyn Fn(&[u8]) -> Result<(), VerifyError>,
+    ) -> Result<Vec<u8>, Error> {
+        let mut reasons = Vec::new();
+        let mut rejected = None;
+        for url in urls {
+            match self.client.get(url, max, cancel, on_bytes) {
+                Ok(bytes) => match check(&bytes) {
+                    Ok(()) => return Ok(bytes),
+                    Err(e) => {
+                        reasons.push(format!("{}: {e}", host(url)));
+                        rejected.get_or_insert(e);
+                    }
+                },
+                Err(FetchError::Cancelled) => return Err(Error::Cancelled),
+                Err(e) => reasons.push(format!("{}: {e}", host(url))),
+            }
+        }
+        match rejected {
+            Some(error) => Err(Error::Verify { file: what.to_string(), error }),
+            None => Err(Error::Download { what: what.to_string(), reasons }),
+        }
+    }
+
+    // ----- installed fonts
+
+    /// The installed families, sorted by name.
+    pub fn installed(&self) -> Vec<InstalledFamily> {
+        self.read_manifest().families
+    }
+
+    /// The family of this name installed from `source`, ignoring case.
+    pub fn installed_family(&self, source: &str, name: &str) -> Option<InstalledFamily> {
+        self.installed().into_iter().find(|f| f.is(source, name))
+    }
+
+    /// Whether `file` is installed, with the index's sha256.
+    pub fn is_installed(&self, family: &Family, file: &FontFile) -> bool {
+        self.installed_family(&family.source, &family.family)
+            .is_some_and(|i| i.files.iter().any(|x| x.name == file.file_name() && x.sha256 == file.sha256))
+    }
+
+    /// Removes the family of this name installed from `source`: its files, its licence and its
+    /// manifest entry. Its folder disappears at once and is deleted after.
+    pub fn remove_family(&self, source: &str, name: &str) -> Result<(), Error> {
+        let result = {
+            let _lock = self.lock()?;
+            let mut manifest = self.read_manifest();
+            let pos = manifest.families.iter().position(|f| f.is(source, name)).ok_or_else(|| Error::NotInstalled(name.to_string()))?;
+            let entry = manifest.families.remove(pos);
+            let folder = self.dir.join(&entry.dir);
+            let stage = Stage::new(&self.dir)?;
+            let moved = stage.dir.join("removed");
+            let had_folder = folder.exists();
+            if had_folder {
+                std::fs::rename(&folder, &moved).map_err(io(format!("removing {}", entry.family)))?;
+            }
+            match self.write_manifest(&manifest) {
+                Ok(()) => Ok(()),
+                Err(e) => {
+                    if had_folder {
+                        let _ = std::fs::rename(&moved, &folder);
+                    }
+                    Err(e)
+                }
+            }
+        };
+        self.rescan();
+        result
+    }
+
+    /// Removes some files of an installed family (one style, say), by their names in its folder.
+    /// Taking out the last one removes the family. Names the family's manifest entry doesn't list
+    /// are left alone.
+    pub fn remove_files(&self, source: &str, name: &str, files: &[String]) -> Result<(), Error> {
+        let result = {
+            let _lock = self.lock()?;
+            let mut manifest = self.read_manifest();
+            let pos = manifest.families.iter().position(|f| f.is(source, name)).ok_or_else(|| Error::NotInstalled(name.to_string()))?;
+            let Some(entry) = manifest.families.get_mut(pos) else { return Err(Error::NotInstalled(name.to_string())) };
+            // Only listed, safe names become paths, so a request can't reach outside the folder.
+            let removing: Vec<String> = entry.files.iter().map(|f| f.name.clone()).filter(|n| safe_file_name(n) && files.contains(n)).collect();
+            if removing.is_empty() {
+                return Ok(());
+            }
+            entry.files.retain(|f| !removing.contains(&f.name));
+            let folder = self.dir.join(&entry.dir);
+            let stage = Stage::new(&self.dir)?;
+            let mut moving: Vec<(PathBuf, PathBuf)> = removing.iter().map(|f| (folder.join(f), stage.dir.join(f))).collect();
+            let last = entry.files.is_empty();
+            if last {
+                // The licence goes with the last style. Files the store didn't install stay, and
+                // keep the folder.
+                if let Some(licence) = entry.license_file.clone().filter(|n| safe_file_name(n) && !removing.contains(n)) {
+                    moving.push((folder.join(&licence), stage.dir.join(&licence)));
+                }
+                manifest.families.remove(pos);
+            }
+            let mut moved = Vec::new();
+            for (from, to) in &moving {
+                if from.exists() {
+                    std::fs::rename(from, to).map_err(io(format!("removing {}", from.display())))?;
+                    moved.push((from, to));
+                }
+            }
+            match self.write_manifest(&manifest) {
+                Ok(()) => {
+                    if last {
+                        let _ = std::fs::remove_dir(&folder);
+                    }
+                    Ok(())
+                }
+                Err(e) => {
+                    for (from, to) in moved {
+                        let _ = std::fs::rename(to, from);
+                    }
+                    Err(e)
+                }
+            }
+        };
+        self.rescan();
+        result
+    }
+
+    /// Checks every installed file against the manifest: present, the right size and sha256,
+    /// and a font.
+    pub fn verify(&self) -> Vec<Problem> {
+        let mut problems = Vec::new();
+        for fam in self.installed() {
+            for f in &fam.files {
+                let path = self.dir.join(&fam.dir).join(&f.name);
+                let problem = |error| Problem { family: fam.family.clone(), file: f.name.clone(), error };
+                let Ok(bytes) = std::fs::read(&path) else {
+                    problems.push(problem(None));
+                    continue;
+                };
+                let error = if bytes.len() as u64 != f.size {
+                    Some(VerifyError::Size { expected: f.size, actual: bytes.len() as u64 })
+                } else if sha256_hex(&bytes) != f.sha256 {
+                    Some(VerifyError::Sha256)
+                } else if !is_font(&bytes) {
+                    Some(VerifyError::NotAFont)
+                } else {
+                    None
+                };
+                if error.is_some() {
+                    problems.push(problem(error));
+                }
+            }
+        }
+        problems
+    }
+
+    // ----- folder
+
+    fn rescan(&self) {
+        if let Some(catalog) = &self.catalog {
+            catalog.rescan();
+        }
+    }
+
+    fn lock(&self) -> Result<File, Error> {
+        std::fs::create_dir_all(&self.dir).map_err(io("creating the font store folder"))?;
+        let file = File::options().create(true).truncate(false).write(true).open(self.dir.join(LOCK)).map_err(io("locking the font store"))?;
+        file.lock().map_err(io("locking the font store"))?;
+        Ok(file)
+    }
+
+    /// The manifest, without entries that aren't safe to act on. A manifest that can't be read
+    /// is kept aside as `manifest.json.bad` and counts as empty.
+    fn read_manifest(&self) -> Manifest {
+        let path = self.dir.join(MANIFEST);
+        let Some(bytes) = read_limited(&path, MAX_MANIFEST_BYTES) else { return Manifest::default() };
+        let Ok(mut manifest) = serde_json::from_slice::<Manifest>(&bytes) else {
+            let _ = std::fs::rename(&path, self.dir.join("manifest.json.bad"));
+            return Manifest::default();
+        };
+        manifest
+            .families
+            .retain(|f| safe_dir(&f.dir) && f.files.iter().all(|x| safe_file_name(&x.name)) && f.license_file.as_deref().is_none_or(safe_file_name));
+        manifest
+    }
+
+    fn write_manifest(&self, manifest: &Manifest) -> Result<(), Error> {
+        let manifest = Manifest { version: 1, families: manifest.families.clone() };
+        let bytes = serde_json::to_vec_pretty(&manifest).map_err(|e| io("saving the manifest")(std::io::Error::other(e)))?;
+        self.write_file(MANIFEST, &bytes)
+    }
+
+    fn write_file(&self, name: &str, bytes: &[u8]) -> Result<(), Error> {
+        std::fs::create_dir_all(&self.dir).map_err(io("creating the font store folder"))?;
+        craft_atomic::atomic_write(&self.dir.join(name), bytes).map_err(io(format!("saving {name}")))
+    }
+
+    fn sweep_staging(&self) {
+        for e in std::fs::read_dir(self.dir.join(STAGING)).into_iter().flatten().flatten() {
+            let old = e.metadata().and_then(|m| m.modified()).is_ok_and(|t| SystemTime::now().duration_since(t).is_ok_and(|d| d > STALE));
+            if old {
+                let _ = std::fs::remove_dir_all(e.path());
+            }
+        }
+    }
+}
+
+/// The family's manifest entry after installing `files`, merged into `manifest`.
+fn merge_entry(manifest: &mut Manifest, index: &Index, family: &Family, files: &[&FontFile]) -> InstalledFamily {
+    let pos = match manifest.families.iter().position(|f| f.is(&family.source, &family.family)) {
+        Some(p) => p,
+        None => {
+            manifest.families.push(InstalledFamily {
+                family: family.family.clone(),
+                source: family.source.clone(),
+                dir: family.dir().to_string(),
+                license: family.license.clone(),
+                license_file: None,
+                files: Vec::new(),
+            });
+            manifest.families.len() - 1
+        }
+    };
+    let Some(entry) = manifest.families.get_mut(pos) else { return InstalledFamily::empty() };
+    entry.license.clone_from(&family.license);
+    let commit = index.source_of(family).map(|s| s.commit.clone()).unwrap_or_default();
+    if let Some(name) = family.license_file_name() {
+        entry.license_file = Some(name.to_string());
+    }
+    for f in files {
+        entry.files.retain(|x| x.name != f.file_name());
+        entry.files.push(InstalledFile {
+            name: f.file_name().to_string(),
+            path: f.path.clone(),
+            size: f.size,
+            sha256: f.sha256.clone(),
+            commit: commit.clone(),
+            postscript: f.postscript.clone(),
+        });
+    }
+    entry.files.sort_by(|a, b| a.name.cmp(&b.name));
+    let entry = entry.clone();
+    manifest.families.sort_by_key(|f| (f.family.to_lowercase(), f.source.clone()));
+    entry
+}
+
+impl InstalledFamily {
+    fn empty() -> Self {
+        Self { family: String::new(), source: String::new(), dir: String::new(), license: String::new(), license_file: None, files: Vec::new() }
+    }
+
+    /// Whether this is the family `name` (ignoring case) from `source`.
+    pub fn is(&self, source: &str, name: &str) -> bool {
+        self.source == source && self.family.to_lowercase() == name.to_lowercase()
+    }
+}
+
+fn builtin_cache_name(entry: &SourceEntry) -> String {
+    format!("{}{}", slug(&entry.source), if entry.gz().is_some() { ".json.gz" } else { ".json" })
+}
+
+/// A user-added source's index from the bytes fetched from it.
+fn user_index(bytes: &[u8], user: &UserSource) -> Result<Index, IndexError> {
+    let mut index = Index::from_user_bytes(bytes, &user.url)?;
+    if user.last_sha256.as_ref().is_some_and(|h| *h != sha256_hex(bytes)) {
+        index.mark_changed();
+    }
+    Ok(index)
+}
+
+fn read_limited(path: &Path, max: u64) -> Option<Vec<u8>> {
+    if std::fs::metadata(path).ok()?.len() > max {
+        return None;
+    }
+    std::fs::read(path).ok()
+}
+
+fn host(url: &str) -> &str {
+    url.split("://").nth(1).and_then(|r| r.split('/').next()).unwrap_or(url)
+}
+
+/// A folder of downloads under `.staging`, deleted when dropped.
+struct Stage {
+    dir: PathBuf,
+}
+
+impl Stage {
+    fn new(store: &Path) -> Result<Self, Error> {
+        static N: AtomicU64 = AtomicU64::new(0);
+        let dir = store.join(STAGING).join(format!("{}-{}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).map_err(io("creating a download folder"))?;
+        Ok(Self { dir })
+    }
+
+    /// Writes a verified download as `<name>.part`, which no font scan picks up.
+    fn write(&self, name: &str, bytes: &[u8]) -> Result<PathBuf, Error> {
+        let path = self.dir.join(format!("{name}.part"));
+        let write = || -> std::io::Result<()> {
+            let mut f = File::options().write(true).create_new(true).open(&path)?;
+            f.write_all(bytes)?;
+            f.sync_all()
+        };
+        write().map_err(io(format!("saving {name}")))?;
+        Ok(path)
+    }
+}
+
+impl Drop for Stage {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.dir);
+    }
+}
+
+/// Staged files moved into a family folder, undone unless kept.
+struct Commit {
+    folder: PathBuf,
+    created_folder: bool,
+    /// Each file moved in, and where the file it replaced went.
+    moved: Vec<(PathBuf, Option<PathBuf>)>,
+    kept: bool,
+}
+
+impl Commit {
+    fn apply(folder: &Path, stage: &Path, staged: &[(String, PathBuf)]) -> Result<Self, Error> {
+        let created_folder = !folder.is_dir();
+        let mut commit = Self { folder: folder.to_path_buf(), created_folder, moved: Vec::new(), kept: false };
+        std::fs::create_dir_all(folder).map_err(io("creating the family folder"))?;
+        for (name, from) in staged {
+            let dest = folder.join(name);
+            let backup = if dest.exists() {
+                let b = stage.join(format!("{name}.old"));
+                std::fs::rename(&dest, &b).map_err(io(format!("replacing {name}")))?;
+                Some(b)
+            } else {
+                None
+            };
+            if let Err(e) = std::fs::rename(from, &dest) {
+                if let Some(b) = &backup {
+                    let _ = std::fs::rename(b, &dest);
+                }
+                return Err(io(format!("installing {name}"))(e));
+            }
+            commit.moved.push((dest, backup));
+        }
+        Ok(commit)
+    }
+
+    fn keep(mut self) {
+        self.kept = true;
+    }
+
+    fn undo(self) {}
+}
+
+impl Drop for Commit {
+    fn drop(&mut self) {
+        if self.kept {
+            return;
+        }
+        for (dest, backup) in self.moved.iter().rev() {
+            let _ = std::fs::remove_file(dest);
+            if let Some(b) = backup {
+                let _ = std::fs::rename(b, dest);
+            }
+        }
+        if self.created_folder {
+            let _ = std::fs::remove_dir(&self.folder);
+        }
+    }
+}
diff --git a/crates/font-store/src/tests.rs b/crates/font-store/src/tests.rs
new file mode 100644
index 00000000..de1aece8
--- /dev/null
+++ b/crates/font-store/src/tests.rs
@@ -0,0 +1,1035 @@
+use serde_json::json;
+
+use crate::*;
+
+const COMMIT: &str = "45e3d5269e4a17d823f6d84470bc084dc5ae46f6";
+
+/// A font with the tables a scan and [`is_font`] need: `name`, `OS/2` and an empty `glyf`.
+fn font(family: &str, style: &str, weight: u16) -> Vec<u8> {
+    use write_fonts::FontBuilder;
+    use write_fonts::tables::name::{Name, NameRecord};
+    use write_fonts::tables::os2::Os2;
+    use write_fonts::types::{NameId, Tag};
+    let ps = format!("{}-{}", family.replace(' ', ""), style.replace(' ', ""));
+    let mut records: Vec<NameRecord> = [(1, family.to_string()), (2, style.to_string()), (4, format!("{family} {style}")), (6, ps)]
+        .into_iter()
+        .map(|(id, text)| NameRecord::new(3, 1, 0x409, NameId::new(id), text.into()))
+        .collect();
+    records.sort_by_key(|r| r.name_id);
+    let mut builder = FontBuilder::new();
+    builder.add_table(&Name::new(records)).unwrap();
+    builder.add_table(&Os2 { us_weight_class: weight, ul_code_page_range_1: Some(1), ul_code_page_range_2: Some(0), ..Default::default() }).unwrap();
+    builder.add_raw(Tag::new(b"glyf"), vec![0u8; 4]);
+    builder.build()
+}
+
+/// An index and the files it lists, by their URL-encoded google/fonts paths.
+struct Fixture {
+    files: Vec<(String, Vec<u8>)>,
+    index: serde_json::Value,
+}
+
+fn file_entry(path: &str, bytes: &[u8], style: &str, weight: u16, axes: serde_json::Value, ps: &[&str]) -> serde_json::Value {
+    json!({"path": path, "size": bytes.len(), "sha256": sha256_hex(bytes), "style": style, "weight": weight, "axes": axes, "postscript": ps})
+}
+
+/// An index of four families, and the bytes of their files.
+fn fixture() -> Fixture {
+    let regular = font("Test Sans", "Regular", 400);
+    let bold = font("Test Sans", "Bold", 700);
+    let italic = font("Test Sans", "Italic", 400);
+    let var = font("Test Var", "Regular", 400);
+    let one = font("Shared One", "Regular", 400);
+    let two = font("Shared Two", "Regular", 400);
+    let index = json!({
+        "schema": 1, "version": "1.0", "source": "google/fonts", "commit": COMMIT,
+        "base_url": format!("https://cdn.jsdelivr.net/gh/google/fonts@{COMMIT}/"),
+        "fallback_base_url": format!("https://raw.githubusercontent.com/google/fonts/{COMMIT}/"),
+        "a_field_from_a_later_minor_version": true,
+        "languages": [{"id": "en_Latn", "name": "English", "autonym": "English", "script": "Latn", "population": 1, "historical": false}],
+        "scripts": [{"id": "Latn", "name": "Latin"}],
+        "families": [
+            {"family": "Shared One", "license": "OFL", "license_path": null, "languages": [0], "scripts": ["Latn"],
+             "files": [file_entry("ofl/sharedone/SharedOne-Regular.ttf", &one, "normal", 400, json!([]), &["Shared-Regular"])]},
+            {"family": "Shared Two", "license": "OFL", "license_path": null,
+             "files": [file_entry("ofl/sharedtwo/SharedTwo-Regular.ttf", &two, "normal", 400, json!([]), &["Shared-Regular"])]},
+            {"family": "Test Sans", "designer": "Someone", "categories": ["SANS_SERIF"], "license": "OFL", "license_path": "ofl/testsans/OFL.txt",
+             "languages": [0], "scripts": ["Latn"], "files": [
+                file_entry("ofl/testsans/TestSans-Bold.ttf", &bold, "normal", 700, json!([]), &["TestSans-Bold"]),
+                file_entry("ofl/testsans/TestSans-Italic.ttf", &italic, "italic", 400, json!([]), &["TestSans-Italic"]),
+                file_entry("ofl/testsans/TestSans-Regular.ttf", &regular, "normal", 400, json!([]), &["TestSans-Regular"])]},
+            {"family": "Test Var", "license": "APACHE2", "license_path": "apache/testvar/LICENSE.txt", "files": [
+                file_entry("apache/testvar/TestVar[wght].ttf", &var, "normal", 400, json!([{"tag": "wght", "min": 300.0, "max": 700.0}]),
+                    &["TestVar-Light", "TestVar-Regular", "TestVar-SemiBold", "TestVar-Bold"])]},
+        ]
+    });
+    let files = vec![
+        ("ofl/sharedone/SharedOne-Regular.ttf".into(), one),
+        ("ofl/sharedtwo/SharedTwo-Regular.ttf".into(), two),
+        ("ofl/testsans/TestSans-Bold.ttf".into(), bold),
+        ("ofl/testsans/TestSans-Italic.ttf".into(), italic),
+        ("ofl/testsans/TestSans-Regular.ttf".into(), regular),
+        ("ofl/testsans/OFL.txt".into(), b"SIL Open Font License".to_vec()),
+        ("apache/testvar/TestVar%5Bwght%5D.ttf".into(), var),
+        ("apache/testvar/LICENSE.txt".into(), b"Apache License".to_vec()),
+    ];
+    Fixture { files, index }
+}
+
+fn index_of(v: &serde_json::Value) -> Result<Index, IndexError> {
+    Index::from_json(v.to_string().as_bytes())
+}
+
+#[test]
+fn the_index_is_read_and_checked() {
+    let f = fixture();
+    let index = index_of(&f.index).unwrap();
+    let source = &index.sources()[0];
+    assert_eq!((source.version.as_str(), source.commit.as_str(), index.families().len()), ("1.0", COMMIT, 4));
+    // A format 1.0 index is Google Fonts, curated, with URLs from its base URLs.
+    assert_eq!((source.id.as_str(), source.name.as_str(), source.curated), (GOOGLE_FONTS, "Google Fonts", true));
+    let sans = index.family("test sans").unwrap();
+    assert_eq!((sans.dir(), sans.license_file_name(), sans.designer.as_str()), ("testsans", Some("OFL.txt"), "Someone"));
+    assert_eq!((sans.source.as_str(), sans.is_curated()), (GOOGLE_FONTS, true));
+    assert_eq!(sans.languages(&index).map(|l| l.id.as_str()).collect::<Vec<_>>(), ["en_Latn"]);
+
+    let with = |edit: &dyn Fn(&mut serde_json::Value)| {
+        let mut v = f.index.clone();
+        edit(&mut v);
+        index_of(&v)
+    };
+    assert!(with(&|v| v["version"] = json!("1.7")).is_ok(), "a later minor version only adds fields");
+    assert!(matches!(with(&|v| v["version"] = json!("2.0")), Err(IndexError::Version(_))));
+    assert!(matches!(with(&|v| v["version"] = json!("1")), Err(IndexError::Version(_))));
+    assert!(matches!(
+        with(&|v| {
+            v.as_object_mut().unwrap().remove("version");
+        }),
+        Err(IndexError::Version(_))
+    ));
+    // A version 2 index may change any other field: the version is checked first.
+    assert!(matches!(
+        with(&|v| {
+            v["version"] = json!("2.0");
+            v["families"] = json!("other");
+        }),
+        Err(IndexError::Version(_))
+    ));
+    let invalid = [
+        with(&|v| v["base_url"] = json!("http://cdn.jsdelivr.net/gh/google/fonts/")),
+        with(&|v| v["commit"] = json!("main")),
+        with(&|v| v["families"][2]["files"][0]["path"] = json!("ofl/../TestSans-Bold.ttf")),
+        with(&|v| v["families"][2]["files"][0]["path"] = json!("ofl/testsans/.hidden.ttf")),
+        with(&|v| v["families"][2]["files"][0]["path"] = json!("ofl/other/TestSans-Bold.ttf")),
+        with(&|v| v["families"][2]["files"][0]["sha256"] = json!("00")),
+        with(&|v| v["families"][2]["files"][0]["weight"] = json!(0)),
+        with(&|v| v["families"][2]["license_path"] = json!("ofl/elsewhere/OFL.txt")),
+        with(&|v| v["families"][2]["license_path"] = json!("ofl/testsans/TestSans-Bold.ttf")),
+        with(&|v| v["families"][2]["source"] = json!("notofonts")),
+        with(&|v| v["base_url"] = json!("https://cdn.jsdelivr.net/gh/{repo}/")),
+        with(&|v| v["families"][2]["languages"] = json!([5])),
+        with(&|v| v["families"][3]["family"] = json!("TEST SANS")),
+    ];
+    for (i, r) in invalid.into_iter().enumerate() {
+        assert!(matches!(r, Err(IndexError::Invalid(_))), "case {i}: {r:?}");
+    }
+    assert!(matches!(Index::from_json(b"{"), Err(IndexError::Json(_))));
+}
+
+#[cfg(feature = "bundled-index")]
+#[test]
+fn the_bundled_indexes_are_the_pinned_ones() {
+    assert_eq!(sha256_hex(include_bytes!("../index/sources.json")), PINNED_INDEX.sha256);
+    let index = Index::bundled().unwrap();
+    let ids: Vec<&str> = index.sources().iter().map(|s| s.id.as_str()).collect();
+    assert_eq!(ids, [GOOGLE_FONTS, "notofonts"]);
+    assert!(index.sources().iter().all(|s| s.curated && s.warnings.is_empty()));
+    assert!(index.problems().is_empty());
+    assert!(index.families().len() > 2000);
+    let face = index.find_face("Lato", "Bold Italic").unwrap();
+    assert_eq!((face.file.file_name(), face.family.dir()), ("Lato-BoldItalic.ttf", "lato"));
+
+    // Noto's own families, in folders of their own.
+    let cjk = index.family("Noto Sans CJK JP").unwrap();
+    assert_eq!((cjk.source.as_str(), cjk.dir(), cjk.license_file_name()), ("notofonts", "notofonts/noto-sans-cjk-jp", Some("LICENSE")));
+    assert!(index.file_urls(cjk, &cjk.files[0])[0].starts_with("https://cdn.jsdelivr.net/gh/notofonts/noto-cjk@Sans2.004/Sans/OTF/Japanese/"));
+    // A family in both sources: Google Fonts first, Noto's with more styles after it.
+    let both: Vec<&str> = index.families_named("Noto Serif Myanmar").map(|f| f.source.as_str()).collect();
+    assert_eq!(both, [GOOGLE_FONTS, "notofonts"]);
+    let noto = index.family_from("notofonts", "Noto Serif Myanmar").unwrap();
+    assert_eq!(
+        index.license_urls(noto),
+        [
+            "https://cdn.jsdelivr.net/gh/notofonts/myanmar@NotoSerifMyanmar-v2.106/OFL.txt",
+            "https://raw.githubusercontent.com/notofonts/myanmar/NotoSerifMyanmar-v2.106/OFL.txt"
+        ]
+    );
+    // Languages are merged: every family's positions name a language of the merged list.
+    let ja = index.languages().iter().position(|l| l.id == "ja_Jpan").unwrap();
+    assert!(cjk.languages.contains(&ja));
+    let gujarati_ui = index.family_from("notofonts", "Noto Sans Gujarati UI").unwrap();
+    assert!(gujarati_ui.files.iter().any(|f| f.width != 100.0));
+    assert!(gujarati_ui.face("Bold").unwrap().has_normal_width());
+}
+
+#[test]
+fn lookups_match_exactly_and_refuse_near_matches() {
+    let index = index_of(&fixture().index).unwrap();
+    let name = |family: &str, style: &str| index.find_face(family, style).map(|f| f.file.file_name().to_string());
+    assert_eq!(name("Test Sans", "Bold").unwrap(), "TestSans-Bold.ttf");
+    assert_eq!(name("test sans", "700").unwrap(), "TestSans-Bold.ttf");
+    assert_eq!(name("Test Sans", "Regular").unwrap(), "TestSans-Regular.ttf");
+    assert_eq!(name("Test Sans", "").unwrap(), "TestSans-Regular.ttf");
+    assert_eq!(name("Test Sans", "Italic").unwrap(), "TestSans-Italic.ttf");
+    // Near matches are not offered.
+    for style in ["Medium", "Bold Italic", "Light", "Condensed"] {
+        assert!(matches!(name("Test Sans", style), Err(Unavailable::NoStyle { .. })), "{style}");
+    }
+    assert!(matches!(name("Test San", "Bold"), Err(Unavailable::NoFamily(_))));
+    assert!(matches!(name("TestSans", "Bold"), Err(Unavailable::NoFamily(_))));
+    // A variable font has the weights its axis reaches, and no others.
+    assert_eq!(name("Test Var", "SemiBold").unwrap(), "TestVar[wght].ttf");
+    assert_eq!(name("Test Var", "Light").unwrap(), "TestVar[wght].ttf");
+    assert!(matches!(name("Test Var", "Thin"), Err(Unavailable::NoStyle { .. })));
+    assert!(matches!(name("Test Var", "Bold Italic"), Err(Unavailable::NoStyle { .. })));
+
+    assert_eq!(index.find_postscript("TestSans-Bold").unwrap().family.family, "Test Sans");
+    assert_eq!(index.find_postscript("TestVar-SemiBold").unwrap().file.file_name(), "TestVar[wght].ttf");
+    assert!(matches!(index.find_postscript("testsans-bold"), Err(Unavailable::NoPostScript(_))));
+    assert!(matches!(index.find_postscript("TestSans-Medium"), Err(Unavailable::NoPostScript(_))));
+    let Err(Unavailable::Ambiguous { families, .. }) = index.find_postscript("Shared-Regular") else { panic!("not ambiguous") };
+    assert_eq!(families, ["Shared One", "Shared Two"]);
+    assert!(index.family("Shared Two").unwrap().face_by_postscript("Shared-Regular").is_some());
+
+    assert_eq!(parse_style("Extra Bold Italic"), Some((800, true)));
+    assert_eq!(parse_style("semi-bold"), Some((600, false)));
+    assert_eq!(parse_style("Condensed Bold"), None);
+    let var = index.family("Test Var").unwrap();
+    assert_eq!(
+        index.file_urls(var, &var.files[0]),
+        [
+            format!("https://cdn.jsdelivr.net/gh/google/fonts@{COMMIT}/apache/testvar/TestVar%5Bwght%5D.ttf"),
+            format!("https://raw.githubusercontent.com/google/fonts/{COMMIT}/apache/testvar/TestVar%5Bwght%5D.ttf"),
+        ]
+    );
+}
+
+#[test]
+fn verification_checks_size_hash_and_font() {
+    let index = index_of(&fixture().index).unwrap();
+    let file = index.find_face("Test Sans", "Bold").unwrap().file;
+    let bytes = font("Test Sans", "Bold", 700);
+    assert_eq!(verify_font(file, &bytes), Ok(()));
+    let mut changed = bytes.clone();
+    *changed.last_mut().unwrap() ^= 1;
+    assert_eq!(verify_font(file, &changed), Err(VerifyError::Sha256));
+    assert!(matches!(verify_font(file, &bytes[1..]), Err(VerifyError::Size { .. })));
+    assert!(!is_font(b"not a font at all"));
+    assert!(is_font(&bytes));
+}
+
+const NOTO_COMMIT: &str = "93fac8abebe6c7fed0c5b7d2456d8fa484fa146c";
+const VAR_PATH: &str = "fonts/NotoSerifTest/full/variable-ttf/NotoSerifTest[wdth,wght].ttf";
+const CJK_PATH: &str = "Sans/OTF/Japanese/NotoSansCJKtest-Regular.otf";
+const CONDENSED_PATH: &str = "fonts/TestSans/full/ttf/TestSans-CondensedBold.ttf";
+
+/// A format 1.1 index of another source, as craft-font-index's Noto index has it: URL templates
+/// with `{repo}` and `{ref}`, a family in another repository at a tag, licences with a sha256
+/// (one in a third repository), and a family Google Fonts also has, in a width it lacks.
+fn noto_fixture() -> Fixture {
+    let var = font("Noto Serif Test", "Regular", 400);
+    let cjk = font("Noto Sans CJK Test", "Regular", 400);
+    let condensed = font("Test Sans", "Condensed Bold", 700);
+    let ofl = b"Noto OFL".to_vec();
+    let cjk_licence = b"noto-cjk LICENSE".to_vec();
+    let lic = |path: &str, bytes: &[u8]| json!({"path": path, "size": bytes.len(), "sha256": sha256_hex(bytes)});
+    let mut var_entry = file_entry(
+        VAR_PATH,
+        &var,
+        "normal",
+        400,
+        json!([{"tag": "wght", "min": 100.0, "max": 900.0}, {"tag": "wdth", "min": 62.5, "max": 100.0}]),
+        &["NotoSerifTest-Regular", "NotoSerifTest-Bold"],
+    );
+    var_entry["a_later_field"] = json!(1);
+    let mut condensed_entry = file_entry(CONDENSED_PATH, &condensed, "normal", 700, json!([]), &["TestSans-CondensedBold"]);
+    condensed_entry["width"] = json!(75.0);
+    let mut serif_licence = lic("OFL.txt", &ofl);
+    serif_licence["repo"] = json!("notofonts/serif-test");
+    serif_licence["ref"] = json!("NotoSerifTest-v2.106");
+    let index = json!({
+        "schema": 1, "version": "1.1", "source": "notofonts", "commit": NOTO_COMMIT,
+        "source_info": {"id": "notofonts", "name": "Noto", "homepage": "https://notofonts.github.io", "curated": true,
+            "file_urls": ["https://cdn.jsdelivr.net/gh/{repo}@{ref}/{path}", "https://raw.githubusercontent.com/{repo}/{ref}/{path}"]},
+        "repo": "notofonts/notofonts.github.io", "ref": NOTO_COMMIT,
+        "languages": [
+            {"id": "en_Latn", "name": "English", "script": "Latn", "population": 1},
+            {"id": "ja_Jpan", "name": "Japanese", "autonym": "日本語", "script": "Jpan", "population": 1}],
+        "scripts": [{"id": "Jpan", "name": "Japanese"}, {"id": "Latn", "name": "Latin"}],
+        "families": [
+            {"family": "Noto Sans CJK Test", "source": "notofonts", "license": "OFL", "license_path": null,
+             "license_file": lic("LICENSE", &cjk_licence), "repo": "notofonts/noto-cjk", "ref": "Sans2.004",
+             "languages": [0, 1], "scripts": ["Jpan", "Latn"],
+             "files": [file_entry(CJK_PATH, &cjk, "normal", 400, json!([]), &["NotoSansCJKtest-Regular"])]},
+            {"family": "Noto Serif Test", "source": "notofonts", "license": "OFL", "license_path": null,
+             "license_file": serif_licence, "languages": [0], "files": [var_entry]},
+            {"family": "Test Sans", "source": "notofonts", "license": "OFL", "license_path": null,
+             "license_file": lic("OFL.txt", &ofl), "files": [condensed_entry]},
+        ]
+    });
+    let files = vec![
+        (format!("notofonts/noto-cjk/Sans2.004/{CJK_PATH}"), cjk),
+        ("notofonts/noto-cjk/Sans2.004/LICENSE".into(), cjk_licence),
+        (format!("notofonts/notofonts.github.io/{NOTO_COMMIT}/fonts/NotoSerifTest/full/variable-ttf/NotoSerifTest%5Bwdth%2Cwght%5D.ttf"), var),
+        ("notofonts/serif-test/NotoSerifTest-v2.106/OFL.txt".into(), ofl.clone()),
+        (format!("notofonts/notofonts.github.io/{NOTO_COMMIT}/{CONDENSED_PATH}"), condensed),
+        (format!("notofonts/notofonts.github.io/{NOTO_COMMIT}/OFL.txt"), ofl),
+    ];
+    Fixture { files, index }
+}
+
+#[test]
+fn a_noto_index_resolves_urls_per_family_and_entry() {
+    let index = index_of(&noto_fixture().index).unwrap();
+    let source = &index.sources()[0];
+    assert_eq!((source.id.as_str(), source.name.as_str(), source.curated, source.commit.as_str()), ("notofonts", "Noto", true, NOTO_COMMIT));
+    // The top-level repo and ref, with each path segment percent-encoded.
+    let var = index.family("Noto Serif Test").unwrap();
+    assert_eq!(
+        index.file_urls(var, &var.files[0]),
+        [
+            format!(
+                "https://cdn.jsdelivr.net/gh/notofonts/notofonts.github.io@{NOTO_COMMIT}/fonts/NotoSerifTest/full/variable-ttf/NotoSerifTest%5Bwdth%2Cwght%5D.ttf"
+            ),
+            format!(
+                "https://raw.githubusercontent.com/notofonts/notofonts.github.io/{NOTO_COMMIT}/fonts/NotoSerifTest/full/variable-ttf/NotoSerifTest%5Bwdth%2Cwght%5D.ttf"
+            ),
+        ]
+    );
+    // The licence's own repository and ref.
+    assert_eq!(index.license_urls(var)[1], "https://raw.githubusercontent.com/notofonts/serif-test/NotoSerifTest-v2.106/OFL.txt");
+    // The family's repository and ref, for its files and its licence.
+    let cjk = index.family("Noto Sans CJK Test").unwrap();
+    assert_eq!(index.file_urls(cjk, &cjk.files[0])[0], format!("https://cdn.jsdelivr.net/gh/notofonts/noto-cjk@Sans2.004/{CJK_PATH}"));
+    assert_eq!(index.license_urls(cjk)[0], "https://cdn.jsdelivr.net/gh/notofonts/noto-cjk@Sans2.004/LICENSE");
+    assert_eq!((cjk.dir(), cjk.license_file_name(), cjk.license_path.as_deref()), ("notofonts/noto-sans-cjk-test", Some("LICENSE"), None));
+    assert_eq!(var.files[0].width, 100.0);
+
+    let with = |edit: &dyn Fn(&mut serde_json::Value)| {
+        let mut v = noto_fixture().index;
+        edit(&mut v);
+        index_of(&v)
+    };
+    let invalid = [
+        with(&|v| v["families"][1]["files"][0]["path"] = json!("../x.ttf")),
+        with(&|v| v["families"][1]["files"][0]["path"] = json!("/x.ttf")),
+        with(&|v| v["families"][1]["files"][0]["path"] = json!("a//b.ttf")),
+        with(&|v| v["families"][1]["files"][0]["path"] = json!("a/./b.ttf")),
+        with(&|v| v["families"][1]["files"][0]["path"] = json!("a\\b.ttf")),
+        with(&|v| v["families"][1]["ref"] = json!("a/../b")),
+        with(&|v| v["families"][1]["repo"] = json!("noslash")),
+        with(&|v| v["families"][0]["license_file"]["path"] = json!("Sans/OTF/Japanese/NotoSansCJKtest-Regular.otf")),
+        with(&|v| v["families"][0]["license_file"]["sha256"] = json!("00")),
+        with(&|v| v["families"][1]["files"][0]["width"] = json!(0.0)),
+        with(&|v| {
+            v.as_object_mut().unwrap().remove("repo");
+        }),
+        with(&|v| v["source_info"]["file_urls"] = json!(["http://cdn.jsdelivr.net/gh/{repo}@{ref}/{path}"])),
+        with(&|v| v["source_info"]["file_urls"] = json!(["https://cdn.jsdelivr.net/gh/{owner}/{path}"])),
+        with(&|v| v["source_info"]["file_urls"] = json!(["https://cdn.jsdelivr.net/gh/{repo}@{ref}/"])),
+        with(&|v| v["source_info"]["id"] = json!("other")),
+    ];
+    for (i, r) in invalid.into_iter().enumerate() {
+        assert!(matches!(r, Err(IndexError::Invalid(_))), "case {i}: {r:?}");
+    }
+    // Only licences that allow redistribution: other families are left out, with a warning.
+    let index = with(&|v| v["families"][1]["license"] = json!("Proprietary")).unwrap();
+    assert!(index.family("Noto Serif Test").is_none());
+    assert_eq!((index.families().len(), index.sources()[0].warnings.len()), (2, 1));
+}
+
+#[test]
+fn sources_merge_with_the_first_preferred() {
+    let index = Index::merge([index_of(&fixture().index).unwrap(), index_of(&noto_fixture().index).unwrap()]);
+    assert_eq!(index.sources().iter().map(|s| s.id.as_str()).collect::<Vec<_>>(), [GOOGLE_FONTS, "notofonts"]);
+    let names: Vec<(&str, &str)> = index.families().iter().map(|f| (f.family.as_str(), f.source.as_str())).collect();
+    assert_eq!(
+        names,
+        [
+            ("Noto Sans CJK Test", "notofonts"),
+            ("Noto Serif Test", "notofonts"),
+            ("Shared One", GOOGLE_FONTS),
+            ("Shared Two", GOOGLE_FONTS),
+            ("Test Sans", GOOGLE_FONTS),
+            ("Test Sans", "notofonts"),
+            ("Test Var", GOOGLE_FONTS),
+        ]
+    );
+    // The first source's family for a name; a style only another source has comes from it.
+    assert_eq!(index.family("test sans").unwrap().source, GOOGLE_FONTS);
+    assert_eq!(index.find_face("Test Sans", "Bold").unwrap().family.source, GOOGLE_FONTS);
+    let condensed = index.find_face("Test Sans", "Condensed Bold").unwrap();
+    assert_eq!((condensed.family.source.as_str(), condensed.family.dir()), ("notofonts", "notofonts/test-sans"));
+    assert_eq!(index.find_postscript("TestSans-CondensedBold").unwrap().family.source, "notofonts");
+    assert!(matches!(index.find_face("Test Sans", "Light"), Err(Unavailable::NoStyle { .. })));
+    // Languages of both, by ID, and every family's positions point into them.
+    assert_eq!(index.languages().iter().map(|l| l.id.as_str()).collect::<Vec<_>>(), ["en_Latn", "ja_Jpan"]);
+    let cjk = index.family("Noto Sans CJK Test").unwrap();
+    assert_eq!(cjk.languages(&index).map(|l| l.id.as_str()).collect::<Vec<_>>(), ["en_Latn", "ja_Jpan"]);
+    assert_eq!(index.family("Shared One").unwrap().languages(&index).map(|l| l.id.as_str()).collect::<Vec<_>>(), ["en_Latn"]);
+    // URLs stay per source.
+    assert!(index.file_urls(cjk, &cjk.files[0])[0].contains("noto-cjk@Sans2.004"));
+    // A second source with the same ID is left out and reported.
+    let twice = Index::merge([index_of(&noto_fixture().index).unwrap(), index_of(&noto_fixture().index).unwrap()]);
+    assert_eq!((twice.sources().len(), twice.families().len(), twice.problems().len()), (1, 3, 1));
+}
+
+#[test]
+fn a_user_index_is_never_curated_and_cant_shadow_a_built_in_source() {
+    let mut v = noto_fixture().index;
+    v["source_info"]["file_urls"] = json!(["https://fonts.example.org/files/{path}"]);
+    v["families"][1]["license"] = json!("Proprietary");
+    let url = "https://fonts.example.org/index.json";
+    let index = Index::from_user_bytes(v.to_string().as_bytes(), url).unwrap();
+    let source = &index.sources()[0];
+    assert_eq!((source.id.as_str(), source.curated, source.user_url.as_deref()), ("user:fonts.example.org/notofonts", false, Some(url)));
+    assert_eq!(source.warnings.len(), 1);
+    let cjk = index.family("Noto Sans CJK Test").unwrap();
+    assert!(!cjk.is_curated());
+    assert_eq!(cjk.dir(), "user-fonts-example-org-notofonts-6b687c53/noto-sans-cjk-test");
+    assert_eq!(index.file_urls(cjk, &cjk.files[0]), [format!("https://fonts.example.org/files/{CJK_PATH}")]);
+    // Merged after a built-in source of the ID it claims, it is a separate source.
+    let merged = Index::merge([index_of(&noto_fixture().index).unwrap(), index]);
+    assert_eq!(merged.sources().len(), 2);
+    assert!(merged.family("Noto Sans CJK Test").unwrap().is_curated());
+    assert!(Index::from_user_bytes(v.to_string().as_bytes(), "http://fonts.example.org/index.json").is_err());
+}
+
+#[test]
+fn user_sources_whose_ids_slug_alike_get_their_own_folders() {
+    let mut v = noto_fixture().index;
+    v["source_info"]["file_urls"] = json!(["https://fonts.example.org/files/{path}"]);
+    let dir = |url: &str| Index::from_user_bytes(v.to_string().as_bytes(), url).unwrap().family("Noto Sans CJK Test").unwrap().dir().to_string();
+    let (a, b) = (dir("https://fonts.example.org/index.json"), dir("https://fonts-example.org/index.json"));
+    assert_ne!(a, b);
+    assert!(a.split('/').all(|s| s.len() <= 64) && b.split('/').all(|s| s.len() <= 64));
+    let long = format!("https://{}.example.org/index.json", "a".repeat(60));
+    assert!(dir(&long).split('/').all(|s| s.len() <= 64));
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+mod store {
+    use std::collections::HashMap;
+    use std::io::{Read, Write};
+    use std::net::{TcpListener, TcpStream};
+    use std::path::{Path, PathBuf};
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::{Arc, Mutex};
+    use std::time::{Duration, Instant};
+
+    use craft_font_catalog::{Catalog, FontEnv, Os};
+
+    use super::*;
+
+    /// What the server answers for a path.
+    #[derive(Clone)]
+    enum Reply {
+        Ok(Vec<u8>),
+        Status(u16),
+        /// Sends headers and a few bytes, then nothing.
+        Stall,
+    }
+
+    /// A local HTTP server for `/cdn/` (jsDelivr) and `/raw/` (raw GitHub).
+    struct Server {
+        base: String,
+        routes: Arc<Mutex<HashMap<String, Reply>>>,
+        log: Arc<Mutex<Vec<String>>>,
+    }
+
+    impl Server {
+        fn start() -> Self {
+            let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+            let base = format!("http://{}/", listener.local_addr().unwrap());
+            let routes: Arc<Mutex<HashMap<String, Reply>>> = Arc::default();
+            let log: Arc<Mutex<Vec<String>>> = Arc::default();
+            let (r, l) = (routes.clone(), log.clone());
+            std::thread::spawn(move || {
+                for stream in listener.incoming() {
+                    let Ok(stream) = stream else { continue };
+                    let (r, l) = (r.clone(), l.clone());
+                    std::thread::spawn(move || answer(stream, &r, &l));
+                }
+            });
+            Self { base, routes, log }
+        }
+
+        fn serve(&self, prefix: &str, path: &str, reply: Reply) {
+            self.routes.lock().unwrap().insert(format!("/{prefix}/{path}"), reply);
+        }
+
+        /// The fixture's files on both hosts.
+        fn serve_fixture(&self, f: &Fixture) {
+            for (path, bytes) in &f.files {
+                self.serve("cdn", &format!("gh/google/fonts@{COMMIT}/{path}"), Reply::Ok(bytes.clone()));
+                self.serve("raw", &format!("google/fonts/{COMMIT}/{path}"), Reply::Ok(bytes.clone()));
+            }
+        }
+
+        /// A fixture whose files are keyed `<owner>/<name>/<ref>/<path>`, on both hosts.
+        fn serve_repos(&self, f: &Fixture) {
+            for (key, bytes) in &f.files {
+                let mut parts = key.splitn(4, '/');
+                let (owner, name, git_ref, path) = (parts.next().unwrap(), parts.next().unwrap(), parts.next().unwrap(), parts.next().unwrap());
+                self.serve("cdn", &format!("gh/{owner}/{name}@{git_ref}/{path}"), Reply::Ok(bytes.clone()));
+                self.serve("raw", &format!("{owner}/{name}/{git_ref}/{path}"), Reply::Ok(bytes.clone()));
+            }
+        }
+
+        fn requests(&self) -> Vec<String> {
+            self.log.lock().unwrap().clone()
+        }
+
+        fn client(&self) -> Client {
+            let t = Timeouts { connect: Duration::from_secs(2), response: Duration::from_secs(5), overall: Duration::from_secs(10) };
+            Client::for_tests(
+                t,
+                vec![
+                    ("https://cdn.jsdelivr.net/".into(), format!("{}cdn/", self.base)),
+                    ("https://raw.githubusercontent.com/".into(), format!("{}raw/", self.base)),
+                    ("https://fonts.example.org/".into(), format!("{}user/", self.base)),
+                ],
+            )
+        }
+    }
+
+    fn answer(mut s: TcpStream, routes: &Mutex<HashMap<String, Reply>>, log: &Mutex<Vec<String>>) {
+        let mut head = Vec::new();
+        let mut b = [0u8; 1];
+        while !head.ends_with(b"\r\n\r\n") {
+            match s.read(&mut b) {
+                Ok(1) => head.push(b[0]),
+                _ => return,
+            }
+        }
+        let text = String::from_utf8_lossy(&head).into_owned();
+        let path = text.split_whitespace().nth(1).unwrap_or("/").to_string();
+        log.lock().unwrap().push(path.clone());
+        let reply = routes.lock().unwrap().get(&path).cloned().unwrap_or(Reply::Status(404));
+        match reply {
+            Reply::Ok(body) => {
+                let _ = write!(s, "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n", body.len());
+                let _ = s.write_all(&body);
+            }
+            Reply::Status(code) => {
+                let _ = write!(s, "HTTP/1.1 {code} Nope\r\nContent-Length: 4\r\nConnection: close\r\n\r\nnope");
+            }
+            Reply::Stall => {
+                let _ = write!(s, "HTTP/1.1 200 OK\r\nContent-Length: 10\r\nConnection: close\r\n\r\nabc");
+                let _ = s.flush();
+                std::thread::sleep(Duration::from_secs(20));
+            }
+        }
+    }
+
+    fn temp(name: &str) -> PathBuf {
+        static N: AtomicUsize = AtomicUsize::new(0);
+        let d = std::env::temp_dir().join(format!("craft-font-store-{name}-{}-{}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    fn entries(dir: &Path) -> Vec<String> {
+        let mut v: Vec<String> =
+            std::fs::read_dir(dir).into_iter().flatten().flatten().map(|e| e.file_name().to_string_lossy().into_owned()).collect();
+        v.sort();
+        v
+    }
+
+    /// No font files, staged downloads or family folders anywhere in the store.
+    fn assert_no_family_files(dir: &Path) {
+        let mut stack = vec![dir.to_path_buf()];
+        while let Some(d) = stack.pop() {
+            for e in std::fs::read_dir(&d).into_iter().flatten().flatten() {
+                let p = e.path();
+                if p.is_dir() {
+                    stack.push(p);
+                } else {
+                    let name = e.file_name().to_string_lossy().into_owned();
+                    assert!(["settings.json", ".lock"].contains(&name.as_str()), "left behind: {}", p.display());
+                }
+            }
+        }
+        assert!(!dir.join("testsans").exists());
+        assert!(entries(&dir.join(".staging")).is_empty(), "{:?}", entries(&dir.join(".staging")));
+    }
+
+    fn user_store(server: &Server, dir: &Path) -> FontStore {
+        let store = FontStore::new(dir.to_path_buf(), Caller::User).with_client(server.client());
+        store.enable_network().unwrap();
+        store
+    }
+
+    fn none(_: Progress) {}
+
+    #[test]
+    fn consent_is_off_by_default_and_only_the_user_turns_it_on() {
+        let server = Server::start();
+        let f = fixture();
+        server.serve_fixture(&f);
+        let index = index_of(&f.index).unwrap();
+        let dir = temp("consent");
+        let user = FontStore::new(dir.clone(), Caller::User).with_client(server.client());
+        let agent = FontStore::new(dir.clone(), Caller::Agent).with_client(server.client());
+        assert_eq!((user.network(), agent.network()), (Network::Off, Network::Off));
+
+        let face = index.find_face("Test Sans", "Bold").unwrap();
+        assert!(matches!(user.install_face(&index, face, &Cancel::new(), &mut none), Err(Error::NetworkOff)));
+        assert!(matches!(agent.enable_network(), Err(Error::NotAllowed)));
+        assert_eq!(agent.network(), Network::Off);
+        assert!(matches!(agent.install_face(&index, face, &Cancel::new(), &mut none), Err(Error::NetworkOff)));
+        assert!(server.requests().is_empty(), "no request while the network is off");
+
+        // The user's setting is persisted in the store folder; an agent then may install.
+        user.enable_network().unwrap();
+        assert_eq!(FontStore::new(dir.clone(), Caller::Agent).network(), Network::On);
+        agent.install_face(&index, face, &Cancel::new(), &mut none).unwrap();
+        agent.disable_network().unwrap();
+        assert_eq!(user.network(), Network::Off);
+
+        // The agent constructor opens the same folder as the user's.
+        let env = FontEnv { os: Os::Unix, font_store: Some(dir.clone()), ..Default::default() };
+        assert_eq!(FontStore::for_agent(&env).unwrap().caller(), Caller::Agent);
+        assert!(matches!(FontStore::for_agent(&env).unwrap().enable_network(), Err(Error::NotAllowed)));
+        assert_eq!(FontStore::for_user(&env).unwrap().dir(), dir);
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn install_verify_and_remove_a_family() {
+        let server = Server::start();
+        let f = fixture();
+        server.serve_fixture(&f);
+        let index = index_of(&f.index).unwrap();
+        let dir = temp("install");
+        let root = temp("install-root");
+        let env = FontEnv { os: Os::Unix, root: root.clone(), font_store: Some(dir.clone()), ..Default::default() };
+        let catalog = Arc::new(Catalog::new(env).with_font_service(false));
+        catalog.rescan();
+        assert!(catalog.by_postscript_name("TestSans-Bold").is_none());
+        let store = user_store(&server, &dir).with_catalog(catalog.clone());
+
+        let mut seen = Vec::new();
+        let family = index.family("Test Sans").unwrap();
+        let installed = store.install_family(&index, family, &Cancel::new(), &mut |p| seen.push(p)).unwrap();
+        assert_eq!(entries(&dir.join("testsans")), ["OFL.txt", "TestSans-Bold.ttf", "TestSans-Italic.ttf", "TestSans-Regular.ttf"]);
+        assert_eq!(installed.files.len(), 3);
+        assert_eq!((installed.dir.as_str(), installed.license_file.as_deref()), ("testsans", Some("OFL.txt")));
+        assert!(installed.files.iter().all(|x| x.commit == COMMIT && x.sha256.len() == 64));
+        assert_eq!(store.installed(), std::slice::from_ref(&installed));
+        let last = seen.last().unwrap();
+        assert_eq!((last.done, last.total, last.files), (family.size(), family.size(), 3));
+        assert!(seen.windows(2).all(|w| w[0].done <= w[1].done));
+        // The catalog was rescanned.
+        assert_eq!(catalog.by_postscript_name("TestSans-Bold").unwrap().family, "Test Sans");
+        assert!(store.verify().is_empty());
+        assert!(store.is_installed(family, index.find_face("Test Sans", "Italic").unwrap().file));
+
+        // Installed files aren't downloaded again.
+        let before = server.requests().len();
+        store.install_face(&index, index.find_face("Test Sans", "Bold").unwrap(), &Cancel::new(), &mut none).unwrap();
+        assert_eq!(server.requests().len(), before);
+
+        // Damaged and missing files are reported.
+        std::fs::write(dir.join("testsans/TestSans-Italic.ttf"), b"damaged").unwrap();
+        std::fs::remove_file(dir.join("testsans/TestSans-Regular.ttf")).unwrap();
+        let problems = store.verify();
+        assert_eq!(problems.len(), 2);
+        assert!(problems.iter().any(|p| p.file == "TestSans-Italic.ttf" && matches!(p.error, Some(VerifyError::Size { .. }))));
+        assert!(problems.iter().any(|p| p.file == "TestSans-Regular.ttf" && p.error.is_none()));
+
+        // A single face of another family, with its licence.
+        let face = index.find_face("Test Var", "Bold").unwrap();
+        store.install_face(&index, face, &Cancel::new(), &mut none).unwrap();
+        assert_eq!(entries(&dir.join("testvar")), ["LICENSE.txt", "TestVar[wght].ttf"]);
+        assert_eq!(store.installed().iter().map(|f| f.family.as_str()).collect::<Vec<_>>(), ["Test Sans", "Test Var"]);
+
+        // One style out, then the last one takes its family with it.
+        store.remove_files(GOOGLE_FONTS, "Test Sans", &["TestSans-Bold.ttf".into()]).unwrap();
+        assert!(!dir.join("testsans/TestSans-Bold.ttf").exists());
+        assert_eq!(store.installed_family(GOOGLE_FONTS, "Test Sans").unwrap().files.len(), 2);
+        store.remove_files(GOOGLE_FONTS, "Test Var", &["TestVar[wght].ttf".into()]).unwrap();
+        assert!(!dir.join("testvar").exists());
+        assert!(store.installed_family(GOOGLE_FONTS, "Test Var").is_none());
+
+        store.remove_family(GOOGLE_FONTS, "test sans").unwrap();
+        assert!(!dir.join("testsans").exists());
+        assert!(store.installed().is_empty());
+        assert!(catalog.by_postscript_name("TestSans-Bold").is_none());
+        assert!(matches!(store.remove_family(GOOGLE_FONTS, "Test Sans"), Err(Error::NotInstalled(_))));
+        assert!(entries(&dir.join(".staging")).is_empty());
+        let _ = std::fs::remove_dir_all(dir);
+        let _ = std::fs::remove_dir_all(root);
+    }
+
+    #[test]
+    fn removing_files_touches_only_listed_names() {
+        let server = Server::start();
+        let f = fixture();
+        server.serve_fixture(&f);
+        let index = index_of(&f.index).unwrap();
+        let dir = temp("remove-listed");
+        let store = user_store(&server, &dir);
+        store.install_family(&index, index.family("Test Sans").unwrap(), &Cancel::new(), &mut none).unwrap();
+        std::fs::write(dir.join("outside.ttf"), b"x").unwrap();
+        std::fs::write(dir.join("testsans/Unlisted.ttf"), b"x").unwrap();
+
+        store.remove_files(GOOGLE_FONTS, "Test Sans", &["../outside.ttf".into(), "Unlisted.ttf".into()]).unwrap();
+        assert!(dir.join("outside.ttf").exists());
+        assert!(dir.join("testsans/Unlisted.ttf").exists());
+        assert_eq!(store.installed_family(GOOGLE_FONTS, "Test Sans").unwrap().files.len(), 3);
+
+        store.remove_files(GOOGLE_FONTS, "Test Sans", &["../outside.ttf".into(), "TestSans-Bold.ttf".into()]).unwrap();
+        assert!(dir.join("outside.ttf").exists());
+        assert!(!dir.join("testsans/TestSans-Bold.ttf").exists());
+        assert_eq!(store.installed_family(GOOGLE_FONTS, "Test Sans").unwrap().files.len(), 2);
+
+        // The last style takes the licence with it; the unlisted file and its folder stay.
+        let rest: Vec<String> = store.installed_family(GOOGLE_FONTS, "Test Sans").unwrap().files.iter().map(|f| f.name.clone()).collect();
+        store.remove_files(GOOGLE_FONTS, "Test Sans", &rest).unwrap();
+        assert!(store.installed_family(GOOGLE_FONTS, "Test Sans").is_none());
+        let left: Vec<_> = std::fs::read_dir(dir.join("testsans")).unwrap().map(|e| e.unwrap().file_name()).collect();
+        assert_eq!(left, ["Unlisted.ttf"]);
+
+        // A folder left empty goes.
+        std::fs::remove_file(dir.join("testsans/Unlisted.ttf")).unwrap();
+        store.install_face(&index, index.find_face("Test Sans", "Bold").unwrap(), &Cancel::new(), &mut none).unwrap();
+        store.remove_files(GOOGLE_FONTS, "Test Sans", &["TestSans-Bold.ttf".into()]).unwrap();
+        assert!(!dir.join("testsans").exists());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn jsdelivr_failures_fall_back_to_raw_github() {
+        let server = Server::start();
+        let f = fixture();
+        server.serve_fixture(&f);
+        let bold = format!("gh/google/fonts@{COMMIT}/ofl/testsans/TestSans-Bold.ttf");
+        server.serve("cdn", &bold, Reply::Status(503));
+        let index = index_of(&f.index).unwrap();
+        let dir = temp("fallback");
+        let store = user_store(&server, &dir);
+        store.install_face(&index, index.find_face("Test Sans", "Bold").unwrap(), &Cancel::new(), &mut none).unwrap();
+        let requests = server.requests();
+        assert_eq!(requests.first().map(String::as_str), Some(format!("/cdn/{bold}").as_str()));
+        assert_eq!(requests.get(1).map(String::as_str), Some(format!("/raw/google/fonts/{COMMIT}/ofl/testsans/TestSans-Bold.ttf").as_str()));
+        assert!(store.verify().is_empty());
+
+        // A corrupted copy on jsDelivr also falls back.
+        let italic = format!("gh/google/fonts@{COMMIT}/ofl/testsans/TestSans-Italic.ttf");
+        server.serve("cdn", &italic, Reply::Ok(font("Test Sans", "Bold", 700)));
+        store.install_face(&index, index.find_face("Test Sans", "Italic").unwrap(), &Cancel::new(), &mut none).unwrap();
+        assert!(store.verify().is_empty());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn corrupt_downloads_are_rejected_and_leave_nothing() {
+        let server = Server::start();
+        let f = fixture();
+        server.serve_fixture(&f);
+        let index = index_of(&f.index).unwrap();
+        let dir = temp("corrupt");
+        let store = user_store(&server, &dir);
+
+        // Wrong bytes of the right size on both hosts: rejected on the sha256.
+        let mut other = font("Test Sans", "Italic", 400);
+        *other.last_mut().unwrap() ^= 1;
+        for (host, path) in [("cdn", format!("gh/google/fonts@{COMMIT}")), ("raw", format!("google/fonts/{COMMIT}"))] {
+            server.serve(host, &format!("{path}/ofl/testsans/TestSans-Italic.ttf"), Reply::Ok(other.clone()));
+        }
+        let family = index.family("Test Sans").unwrap();
+        let r = store.install_family(&index, family, &Cancel::new(), &mut none);
+        assert!(matches!(r, Err(Error::Verify { error: VerifyError::Sha256, .. })), "{r:?}");
+        assert_no_family_files(&dir);
+        assert!(store.installed().is_empty());
+
+        // Bytes that match the index but aren't a font.
+        let junk = b"this is not a font file".to_vec();
+        let mut v = f.index.clone();
+        v["families"][2]["files"][0]["sha256"] = json!(sha256_hex(&junk));
+        v["families"][2]["files"][0]["size"] = json!(junk.len());
+        server.serve("cdn", &format!("gh/google/fonts@{COMMIT}/ofl/testsans/TestSans-Bold.ttf"), Reply::Ok(junk.clone()));
+        server.serve("raw", &format!("google/fonts/{COMMIT}/ofl/testsans/TestSans-Bold.ttf"), Reply::Ok(junk));
+        let junk_index = index_of(&v).unwrap();
+        let r = store.install_face(&junk_index, junk_index.find_face("Test Sans", "Bold").unwrap(), &Cancel::new(), &mut none);
+        assert!(matches!(r, Err(Error::Verify { error: VerifyError::NotAFont, .. })), "{r:?}");
+        assert_no_family_files(&dir);
+
+        // A file missing on both hosts, after others downloaded: nothing of the family is written.
+        server.serve_fixture(&f);
+        for (host, path) in [("cdn", format!("gh/google/fonts@{COMMIT}")), ("raw", format!("google/fonts/{COMMIT}"))] {
+            server.serve(host, &format!("{path}/ofl/testsans/TestSans-Regular.ttf"), Reply::Status(404));
+        }
+        let r = store.install_family(&index, family, &Cancel::new(), &mut none);
+        assert!(matches!(&r, Err(Error::Download { reasons, .. }) if reasons.len() == 2), "{r:?}");
+        assert_no_family_files(&dir);
+        assert!(!dir.join("manifest.json").exists());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_failed_commit_keeps_the_installed_files() {
+        use std::os::unix::fs::PermissionsExt;
+        let server = Server::start();
+        let f = fixture();
+        server.serve_fixture(&f);
+        let index = index_of(&f.index).unwrap();
+        let dir = temp("commit");
+        let store = user_store(&server, &dir);
+        store.install_face(&index, index.find_face("Test Sans", "Regular").unwrap(), &Cancel::new(), &mut none).unwrap();
+        let folder = dir.join("testsans");
+        let before = (store.installed(), entries(&folder));
+
+        std::fs::set_permissions(&folder, std::fs::Permissions::from_mode(0o555)).unwrap();
+        let writable = std::fs::File::create(folder.join("probe")).is_ok();
+        let r = store.install_family(&index, index.family("Test Sans").unwrap(), &Cancel::new(), &mut none);
+        std::fs::set_permissions(&folder, std::fs::Permissions::from_mode(0o755)).unwrap();
+        if writable {
+            return; // root ignores permissions
+        }
+        assert!(matches!(r, Err(Error::Io { .. })), "{r:?}");
+        assert_eq!((store.installed(), entries(&folder)), before);
+        assert!(entries(&dir.join(".staging")).is_empty());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn cancel_stops_a_stalled_install() {
+        let server = Server::start();
+        let f = fixture();
+        server.serve_fixture(&f);
+        server.serve("cdn", &format!("gh/google/fonts@{COMMIT}/ofl/testsans/TestSans-Bold.ttf"), Reply::Stall);
+        let index = index_of(&f.index).unwrap();
+        let dir = temp("cancel");
+        let store = user_store(&server, &dir);
+        let cancel = Cancel::new();
+        let c = cancel.clone();
+        std::thread::spawn(move || {
+            std::thread::sleep(Duration::from_millis(200));
+            c.cancel();
+        });
+        let t = Instant::now();
+        let r = store.install_family(&index, index.family("Test Sans").unwrap(), &cancel, &mut none);
+        assert!(matches!(r, Err(Error::Cancelled)), "{r:?}");
+        assert!(t.elapsed() < Duration::from_secs(3), "{:?}", t.elapsed());
+        assert_no_family_files(&dir);
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    fn gzip(bytes: &[u8]) -> Vec<u8> {
+        use flate2::write::GzEncoder;
+        let mut e = GzEncoder::new(Vec::new(), flate2::Compression::best());
+        e.write_all(bytes).unwrap();
+        e.finish().unwrap()
+    }
+
+    /// `sources.json` listing the Google Fonts fixture (gzipped) and the Noto fixture (plain
+    /// JSON), with the index bytes each path serves.
+    fn sources_fixture(noto_sha256: Option<&str>) -> (Vec<u8>, Vec<(String, Vec<u8>)>) {
+        let google = fixture().index.to_string().into_bytes();
+        let google_gz = gzip(&google);
+        let noto = noto_fixture().index.to_string().into_bytes();
+        let sources = json!({"schema": 1, "version": "1.1", "indexes": [
+            {"source": GOOGLE_FONTS, "name": "Google Fonts", "curated": true, "path": "indexes/google-fonts.json",
+             "size": google.len(), "sha256": sha256_hex(&google), "gz_path": "indexes/google-fonts.json.gz",
+             "gz_size": google_gz.len(), "gz_sha256": sha256_hex(&google_gz), "commit": COMMIT, "families": 4, "files": 6},
+            {"source": "notofonts", "name": "Noto", "curated": true, "path": "indexes/noto.json",
+             "size": noto.len(), "sha256": noto_sha256.map_or_else(|| sha256_hex(&noto), str::to_string), "commit": NOTO_COMMIT}
+        ]});
+        let files = vec![("indexes/google-fonts.json.gz".into(), google_gz), ("indexes/noto.json".into(), noto)];
+        (sources.to_string().into_bytes(), files)
+    }
+
+    fn pin_of(sources: &[u8]) -> IndexPin {
+        IndexPin { repo: "owner/index", commit: "abc", sha256: Box::leak(sha256_hex(sources).into_boxed_str()) }
+    }
+
+    fn serve_sources(server: &Server, sources: &[u8], files: &[(String, Vec<u8>)]) {
+        server.serve("cdn", "gh/owner/index@abc/sources.json", Reply::Status(500));
+        server.serve("raw", "owner/index/abc/sources.json", Reply::Ok(sources.to_vec()));
+        for (path, bytes) in files {
+            server.serve("cdn", &format!("gh/owner/index@abc/{path}"), Reply::Ok(bytes.clone()));
+        }
+    }
+
+    #[test]
+    fn the_indexes_are_fetched_only_with_consent_and_checked() {
+        let server = Server::start();
+        let (sources, files) = sources_fixture(None);
+        let pin = pin_of(&sources);
+        serve_sources(&server, &sources, &files);
+        let dir = temp("index");
+        let store = FontStore::new(dir.clone(), Caller::User).with_client(server.client());
+        assert!(store.cached_indexes(&pin).is_none());
+        assert!(matches!(store.fetch_indexes(&pin, &Cancel::new()), Err(Error::NetworkOff)));
+        assert!(server.requests().is_empty());
+
+        store.enable_network().unwrap();
+        let index = store.fetch_indexes(&pin, &Cancel::new()).unwrap();
+        assert!(index.problems().is_empty(), "{:?}", index.problems());
+        assert_eq!(index.sources().iter().map(|s| s.id.as_str()).collect::<Vec<_>>(), [GOOGLE_FONTS, "notofonts"]);
+        assert_eq!(index.families().len(), 7);
+        assert_eq!(entries(&dir.join("indexes")), ["google-fonts.json.gz", "notofonts.json", "sources.json"]);
+        let cached = store.cached_indexes(&pin).unwrap();
+        assert_eq!((cached.families().len(), cached.sources().len()), (7, 2));
+
+        let wrong = IndexPin { sha256: "0000000000000000000000000000000000000000000000000000000000000000", ..pin };
+        assert!(store.cached_indexes(&wrong).is_none());
+        assert!(matches!(store.fetch_indexes(&wrong, &Cancel::new()), Err(Error::Verify { error: VerifyError::Sha256, .. })));
+
+        // A cached index that was changed is not used.
+        std::fs::write(dir.join("indexes/notofonts.json"), b"{}").unwrap();
+        assert!(store.cached_indexes(&pin).is_none());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn an_index_with_the_wrong_sha256_fails_alone() {
+        let server = Server::start();
+        let (sources, files) = sources_fixture(Some("1111111111111111111111111111111111111111111111111111111111111111"));
+        let pin = pin_of(&sources);
+        serve_sources(&server, &sources, &files);
+        let dir = temp("one-bad-index");
+        let store = user_store(&server, &dir);
+        let index = store.fetch_indexes(&pin, &Cancel::new()).unwrap();
+        assert_eq!(index.sources().iter().map(|s| s.id.as_str()).collect::<Vec<_>>(), [GOOGLE_FONTS]);
+        assert_eq!(index.problems().iter().map(|p| p.source.as_str()).collect::<Vec<_>>(), ["notofonts"]);
+        assert!(index.family("Test Var").is_some() && index.family("Noto Sans CJK Test").is_none());
+        // Both hosts were tried for it.
+        assert_eq!(server.requests().iter().filter(|r| r.ends_with("indexes/noto.json")).count(), 2);
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn a_noto_family_installs_into_its_own_folder_after_a_jsdelivr_403() {
+        let server = Server::start();
+        let f = noto_fixture();
+        server.serve_repos(&f);
+        // jsDelivr refuses files over 20 MB with 403.
+        let cjk = format!("gh/notofonts/noto-cjk@Sans2.004/{CJK_PATH}");
+        server.serve("cdn", &cjk, Reply::Status(403));
+        let index = index_of(&f.index).unwrap();
+        let dir = temp("noto");
+        let store = user_store(&server, &dir);
+        let family = index.family("Noto Sans CJK Test").unwrap();
+        let installed = store.install_family(&index, family, &Cancel::new(), &mut none).unwrap();
+        assert_eq!(entries(&dir.join("notofonts/noto-sans-cjk-test")), ["LICENSE", "NotoSansCJKtest-Regular.otf"]);
+        assert_eq!((installed.source.as_str(), installed.dir.as_str()), ("notofonts", "notofonts/noto-sans-cjk-test"));
+        assert!(installed.files.iter().all(|x| x.commit == NOTO_COMMIT));
+        let requests = server.requests();
+        let at = requests.iter().position(|r| *r == format!("/cdn/{cjk}")).unwrap();
+        assert_eq!(requests[at + 1], format!("/raw/notofonts/noto-cjk/Sans2.004/{CJK_PATH}"));
+        assert!(store.verify().is_empty());
+
+        // The licence is checked against its sha256: a changed one fails the install.
+        let serif = index.family("Noto Serif Test").unwrap();
+        for (host, path) in
+            [("cdn", "gh/notofonts/serif-test@NotoSerifTest-v2.106/OFL.txt"), ("raw", "notofonts/serif-test/NotoSerifTest-v2.106/OFL.txt")]
+        {
+            server.serve(host, path, Reply::Ok(b"Noto OFX".to_vec()));
+        }
+        let r = store.install_family(&index, serif, &Cancel::new(), &mut none);
+        assert!(matches!(r, Err(Error::Verify { error: VerifyError::Sha256, .. })), "{r:?}");
+        assert!(!dir.join("notofonts/noto-serif-test").exists());
+        server.serve_repos(&f);
+        store.install_family(&index, serif, &Cancel::new(), &mut none).unwrap();
+        assert_eq!(entries(&dir.join("notofonts/noto-serif-test")), ["NotoSerifTest[wdth,wght].ttf", "OFL.txt"]);
+
+        // A family of the same name from Google Fonts is installed and removed separately.
+        let google = index_of(&fixture().index).unwrap();
+        let both = Index::merge([google, index]);
+        server.serve_fixture(&fixture());
+        store.install_family(&both, both.family_from(GOOGLE_FONTS, "Test Sans").unwrap(), &Cancel::new(), &mut none).unwrap();
+        store.install_family(&both, both.family_from("notofonts", "Test Sans").unwrap(), &Cancel::new(), &mut none).unwrap();
+        assert_eq!(entries(&dir.join("notofonts/test-sans")), ["OFL.txt", "TestSans-CondensedBold.ttf"]);
+        assert_eq!(store.installed().iter().filter(|f| f.family == "Test Sans").count(), 2);
+        store.remove_family("notofonts", "Test Sans").unwrap();
+        assert!(!dir.join("notofonts/test-sans").exists());
+        assert!(store.installed_family(GOOGLE_FONTS, "Test Sans").is_some() && dir.join("testsans").is_dir());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn user_sources_are_added_by_the_user_and_never_curated() {
+        let server = Server::start();
+        let (sources, files) = sources_fixture(None);
+        let pin = pin_of(&sources);
+        serve_sources(&server, &sources, &files);
+        let mut v = noto_fixture().index;
+        v["source_info"]["file_urls"] = json!(["https://fonts.example.org/files/{path}"]);
+        let url = "https://fonts.example.org/index.json.gz";
+        server.serve("user", "index.json.gz", Reply::Ok(gzip(v.to_string().as_bytes())));
+        let f = noto_fixture();
+        let cjk_bytes = f.files.iter().find(|(k, _)| k.ends_with(CJK_PATH)).unwrap().1.clone();
+        server.serve("user", &format!("files/{CJK_PATH}"), Reply::Ok(cjk_bytes));
+        server.serve("user", "files/LICENSE", Reply::Ok(b"noto-cjk LICENSE".to_vec()));
+
+        let dir = temp("user-source");
+        let store = user_store(&server, &dir);
+        let agent = FontStore::new(dir.clone(), Caller::Agent).with_client(server.client());
+        assert!(matches!(agent.add_user_source(url), Err(Error::NotAllowed)));
+        assert!(matches!(store.add_user_source("http://fonts.example.org/index.json"), Err(Error::BadUrl(_))));
+        store.add_user_source(url).unwrap();
+        store.add_user_source(url).unwrap();
+        assert_eq!(store.user_sources().len(), 1);
+        assert_eq!(store.network(), Network::On, "the setting is kept");
+
+        let index = store.fetch_indexes(&pin, &Cancel::new()).unwrap();
+        assert!(index.problems().is_empty(), "{:?}", index.problems());
+        let user = index.sources().last().unwrap();
+        assert_eq!((user.id.as_str(), user.curated, user.changed), ("user:fonts.example.org/notofonts", false, false));
+        let theirs: Vec<&Family> = index.families_named("Noto Sans CJK Test").collect();
+        assert_eq!(theirs.iter().map(|f| f.is_curated()).collect::<Vec<_>>(), [true, false]);
+        assert!(store.user_sources()[0].last_sha256.is_some());
+
+        // Installs from it are verified like any other.
+        let family = theirs[1];
+        let installed = store.install_family(&index, family, &Cancel::new(), &mut none).unwrap();
+        assert_eq!(installed.source, "user:fonts.example.org/notofonts");
+        assert!(dir.join("user-fonts-example-org-notofonts-6b687c53/noto-sans-cjk-test/LICENSE").is_file());
+
+        // A changed file shows as changed, from the network and from the cache.
+        v["families"][1]["designer"] = json!("Someone else");
+        server.serve("user", "index.json.gz", Reply::Ok(gzip(v.to_string().as_bytes())));
+        assert!(store.fetch_indexes(&pin, &Cancel::new()).unwrap().sources().last().unwrap().changed);
+        assert!(store.cached_indexes(&pin).unwrap().sources().last().unwrap().changed);
+
+        // Removing the source leaves its families installed.
+        store.remove_user_source(url).unwrap();
+        assert!(store.user_sources().is_empty());
+        assert_eq!(store.cached_indexes(&pin).unwrap().sources().len(), 2);
+        assert!(store.installed_family("user:fonts.example.org/notofonts", "Noto Sans CJK Test").is_some());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    /// Fetches the pinned indexes from jsDelivr and GitHub and installs a Noto family whose
+    /// licence is in another repository. `cargo test -p craft-font-store -- --ignored`.
+    #[test]
+    #[ignore = "uses the network"]
+    fn the_pinned_indexes_and_a_noto_family_download() {
+        let dir = temp("network");
+        let store = FontStore::new(dir.clone(), Caller::User);
+        store.enable_network().unwrap();
+        let index = store.fetch_indexes(&PINNED_INDEX, &Cancel::new()).unwrap();
+        assert!(index.problems().is_empty(), "{:?}", index.problems());
+        assert_eq!(index.sources().len(), 2);
+        let family = index.family_from("notofonts", "Noto Serif Myanmar").unwrap();
+        store.install_family(&index, family, &Cancel::new(), &mut none).unwrap();
+        assert!(dir.join("notofonts/noto-serif-myanmar/OFL.txt").is_file());
+        assert!(store.verify().is_empty());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+}
diff --git a/crates/font-store/src/verify.rs b/crates/font-store/src/verify.rs
new file mode 100644
index 00000000..ba976df1
--- /dev/null
+++ b/crates/font-store/src/verify.rs
@@ -0,0 +1,65 @@
+//! Checks a downloaded or installed file against its index entry.
+
+use sha2::{Digest, Sha256};
+use skrifa::raw::FileRef;
+
+use crate::index::FontFile;
+
+/// Tables of which a drawable face has at least one.
+const OUTLINE_TABLES: [&[u8; 4]; 4] = [b"glyf", b"CFF ", b"CFF2", b"VARC"];
+
+/// Why a file doesn't match its index entry.
+#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
+pub enum VerifyError {
+    /// The size differs.
+    #[error("the file is {actual} bytes, not {expected}")]
+    Size {
+        /// The index's size.
+        expected: u64,
+        /// The file's.
+        actual: u64,
+    },
+    /// The sha256 differs.
+    #[error("the file's sha256 doesn't match the font index")]
+    Sha256,
+    /// It doesn't parse as a font with outlines.
+    #[error("the file is not a font, or a damaged one")]
+    NotAFont,
+}
+
+/// The sha256 of `bytes`, in lowercase hex.
+pub fn sha256_hex(bytes: &[u8]) -> String {
+    Sha256::digest(bytes).iter().map(|b| format!("{b:02x}")).collect()
+}
+
+/// Checks `bytes` against `file`: its size, then its sha256, then that every face in it parses
+/// and has outlines.
+pub fn verify_font(file: &FontFile, bytes: &[u8]) -> Result<(), VerifyError> {
+    let actual = bytes.len() as u64;
+    if actual != file.size {
+        return Err(VerifyError::Size { expected: file.size, actual });
+    }
+    if sha256_hex(bytes) != file.sha256 {
+        return Err(VerifyError::Sha256);
+    }
+    if !is_font(bytes) {
+        return Err(VerifyError::NotAFont);
+    }
+    Ok(())
+}
+
+/// Whether `bytes` is a font file or collection whose every face has a `name` table and outlines.
+pub fn is_font(bytes: &[u8]) -> bool {
+    let Ok(file) = FileRef::new(bytes) else { return false };
+    let mut faces = 0usize;
+    for font in file.fonts() {
+        let Ok(font) = font else { return false };
+        let named = font.table_data(skrifa::Tag::new(b"name")).is_some();
+        let drawable = OUTLINE_TABLES.iter().any(|t| font.table_data(skrifa::Tag::new(t)).is_some());
+        if !named || !drawable {
+            return false;
+        }
+        faces += 1;
+    }
+    faces > 0
+}
diff --git a/crates/fonts-build/Cargo.toml b/crates/fonts-build/Cargo.toml
new file mode 100644
index 00000000..a2d9391d
--- /dev/null
+++ b/crates/fonts-build/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "craft-fonts-build"
+description = "Embeds the optional craft-fonts faces from an app's build.rs, plus the EmbeddedFace type the generated table uses."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+
+[features]
+# Cut the `role ui` faces to the catalogs' characters (`Embed::subset_to`). Enable it only in an
+# app's `[build-dependencies]`, so the subsetter stays out of the app itself.
+subset = ["dep:skera", "dep:skrifa"]
+
+[dependencies]
+skera = { version = "0.8", optional = true }
+skrifa = { version = "0.48", default-features = false, features = ["std"], optional = true }
+
+[dev-dependencies]
+craft-fonts-build-consumer = { path = "tests/consumer" }
+
+[lints]
+workspace = true
diff --git a/crates/fonts-build/README.md b/crates/fonts-build/README.md
new file mode 100644
index 00000000..941426b3
--- /dev/null
+++ b/crates/fonts-build/README.md
@@ -0,0 +1,202 @@
+# craft-fonts-build
+
+Embeds the optional [craft-fonts](https://github.com/storytold/craft-fonts) faces from an app's
+`build.rs`, and defines `EmbeddedFace`, the plain data type of the generated table. No
+dependencies without the `subset` feature, and no egui, so crates below the UI layer (text engines,
+exporters) can use it.
+
+Apps never list craft-fonts in `Cargo.toml`: Cargo would fetch the font repository for every
+build. The build reads a local checkout named by `CRAFT_FONTS_DIR` instead.
+
+| Environment | Result |
+|---|---|
+| `CRAFT_FONTS_DIR` unset or empty | Empty table. |
+| `CRAFT_FONTS_DIR` = a craft-fonts checkout | Every selected face of `fonts/manifest.txt`, embedded with `include_bytes!`. |
+| `CRAFT_FONTS_DIR` set, but no manifest or a missing font file | `cargo::warning`, empty table. |
+| `CRAFT_FONTS_REQUIRED=1` (exactly `1`; other values are ignored) | Error instead when the directory is unset, unreadable, has no selected face, or has no face for a script passed to `scripts`. |
+
+Give `CRAFT_FONTS_DIR` as an absolute path: Cargo runs build scripts in the package's directory.
+
+## Using it
+
+`Cargo.toml` (same `rev` as the app's other craft-libs crates). The `subset` feature goes on the
+build-dependency only: it brings in the subsetter ([skera](https://crates.io/crates/skera) and the
+fontations crates), which the app itself never needs. Cargo's resolver 2 and later (edition 2021
+and later) keep build-dependency features apart from the app's, so the dependency stays without
+it.
+
+```toml
+[dependencies]
+craft-fonts-build = { git = "https://github.com/storytold/craft-libs", rev = "…" }
+
+[build-dependencies]
+craft-fonts-build = { git = "https://github.com/storytold/craft-libs", rev = "…", features = ["subset"] }
+```
+
+`build.rs` (FilmCraft's `crates/text/build.rs`, in full):
+
+```rust
+use std::path::PathBuf;
+
+fn main() {
+    println!("cargo::rerun-if-changed=build.rs");
+    let wasm = craft_fonts_build::target_is_wasm();
+    let embedded = craft_fonts_build::Embed::new()
+        // CJK faces only as the interface faces, cut to the characters FilmCraft's catalogs use.
+        .subset_to(catalogs("filmcraft"))
+        // Web builds have a size budget: embed only the Japanese interface face there.
+        .filter(move |face| !wasm || face.has_script("Jpan"))
+        .write("craft_fonts.rs");
+    if let Err(e) = embedded {
+        println!("cargo::error={e}");
+    }
+}
+
+/// Every locale's shared and app catalog in the craft-i18n checkout `CRAFT_I18N_DIR` names, the
+/// files the app's translations embed; none when it is unset.
+fn catalogs(app: &str) -> Vec<PathBuf> {
+    println!("cargo::rerun-if-env-changed=CRAFT_I18N_DIR");
+    let Some(dir) = std::env::var_os("CRAFT_I18N_DIR").filter(|dir| !dir.is_empty()) else { return Vec::new() };
+    let locales = PathBuf::from(dir).join("locales");
+    println!("cargo::rerun-if-changed={}", locales.display());
+    let mut paths: Vec<PathBuf> = std::fs::read_dir(&locales)
+        .into_iter()
+        .flatten()
+        .flatten()
+        .flat_map(|locale| ["common.tsv".to_owned(), format!("{app}.tsv")].map(|file| locale.path().join(file)))
+        .filter(|path| path.is_file())
+        .collect();
+    paths.sort();
+    paths
+}
+```
+
+The crate:
+
+```rust
+use craft_fonts_build::EmbeddedFace;
+
+/// craft-fonts faces; empty unless built with `CRAFT_FONTS_DIR`.
+pub static CRAFT_FONTS: &[EmbeddedFace] = include!(concat!(env!("OUT_DIR"), "/craft_fonts.rs"));
+```
+
+`Embed::new()` selects every face except the sources of the interface faces (`role` `ui`, see
+below), and `Embed::documents(&["Noto Sans", …])` only the families it names (see
+[Document fonts](#document-fonts)). The builder narrows the set:
+
+- `scripts(&["Jpan", "Arab", "Hant"])` keeps faces with any of these script tags. A tag matches
+  itself and its region forms (`Hant` matches `Hant-HK`). With `CRAFT_FONTS_REQUIRED=1`, each tag
+  must match at least one face.
+- `filter(|entry| …)` keeps faces by any manifest field (family, style, licence, index).
+- `for_ui()` keeps CJK faces only as the interface faces (see below).
+- `subset_to(catalogs)` (feature `subset`) cuts the interface faces to the catalogs' characters;
+  it implies `for_ui()`.
+- `check_text(paths)` warns about characters in these files that no embedded face covers.
+- `embedded_elsewhere(&["Noto Sans Math", …])` names families another table of the app embeds,
+  so `check_text` and the catalog check count their characters as covered.
+- `dir(path)` and `required(bool)` override the two environment variables.
+
+`write` returns the embedded `ManifestEntry`s, for build-time checks such as "the interface face
+is present". The generated file is a slice expression of `EmbeddedFace { family, style, scripts,
+index, bytes }` literals; any struct with those fields and that name in scope works too.
+`EmbeddedFace` itself has `name()`, `has_script(tag)`, `is_cjk()` and `weight()`.
+
+## Document fonts
+
+An app that draws document text (titles, layouts, vector text) embeds the families its documents
+use, and only those, in a table of its own:
+
+```rust
+let embedded = craft_fonts_build::Embed::documents(&["Noto Sans", "Shippori Mincho"])
+    // The interface table holds the CJK cuts and the symbol faces.
+    .embedded_elsewhere(&["Noto Sans Math", "Noto Sans Symbols 2"])
+    .write("document_fonts.rs");
+```
+
+Each named family brings all its styles, as whole files: a CJK document face takes 5–17 MB, so a
+release embeds exactly the faces the app's documents need. A family named here is embedded even
+when it is also an interface face's source (`BIZ UDPGothic` brings its Regular too). A name the
+manifest lacks is an `Error::UnknownFamilies` listing the manifest's families: a build error with
+`CRAFT_FONTS_REQUIRED=1`, and a `cargo::warning` with an empty table otherwise, as for any
+checkout that can't be used. `scripts` and `filter` narrow the families further, for example to
+their Regular faces.
+
+## Serving the faces (web builds)
+
+`Embed::serve(dir, url_prefix)` copies the selected faces into `dir` instead of embedding them,
+and writes a table of `ServedFace { family, style, scripts, index, url, size, integrity, coverage }`
+literals for the app to fetch at run time (craft-ui's `fonts::UiFonts::served_faces` does). Each
+font file and its licence keep their path under the checkout's `fonts/` directory, and `url` is
+`url_prefix` plus that path: `serve("web/fonts", "fonts/")` copies
+`fonts/noto-sans-arabic/NotoSansArabic.ttf` to `web/fonts/noto-sans-arabic/NotoSansArabic.ttf`, with
+the URL `fonts/noto-sans-arabic/NotoSansArabic.ttf`. Faces of one collection share a file and a
+URL. `integrity` is the manifest's SHA-256 as a Subresource Integrity value. `coverage` holds the
+code points the face's `cmap` maps, as the `coverage` module encodes them (sorted ranges as LEB128
+gaps and lengths; `coverage::contains` reads them), so an app fetches a face only for characters
+it has: about 3 KB for a CJK interface face cut to an app's catalogs, under 1 KB for a full one.
+
+An interface face cut by `subset_to` is served from its cut in `OUT_DIR`, with the start of the
+cut's SHA-256 in its name (`web/fonts/ui/NotoSansTCUI-Regular.1234abcd5678ef90.ttf`) and the cut's
+own `integrity`, so changed catalogs give a new URL rather than a cached copy that fails its check.
+A relative `dir` is under the package directory. Files already there with the same bytes are not
+copied again, a deleted one is copied again on the next build, and files of faces no longer
+selected, and earlier cuts, stay.
+
+```rust
+// CJK faces only as the interface faces, cut to the app's catalogs (see below).
+let fonts = craft_fonts_build::Embed::new().subset_to(catalogs("filmcraft"));
+let written = if craft_fonts_build::target_is_wasm() {
+    fonts.serve("web/fonts", "fonts/").write("craft_fonts.rs")
+} else {
+    fonts.write("craft_fonts.rs")
+};
+```
+
+The crate includes the table as `&[ServedFace]` on wasm and `&[EmbeddedFace]` elsewhere. craft-ui's
+README shows a whole eframe web app, Trunk copy included.
+
+## Interface faces
+
+The full CJK faces take 5–17 MB each. For the interface, craft-fonts marks one Regular TrueType
+face per CJK script with the role `ui`: `Noto Sans SC UI` (`Hans`), `Noto Sans TC UI` (`Hant`),
+`Noto Sans HK UI` (`Hant-HK`), `Noto Sans KR UI` (`Kore`) and BIZ UDPGothic Regular (`Jpan`). The
+app's build cuts them to the characters its translation catalogs use; for FilmCraft's catalogs
+the five cuts take about 3 MB together.
+
+- `for_ui()` drops every face with a CJK script tag (`Hans`, `Hant`, `Hant-HK`, `Jpan`, `Kore`,
+  `Hani`) that is not an interface face, and keeps the rest. Document text embeds the full faces
+  it names with `Embed::documents` instead. Without `for_ui()` or `subset_to`, the interface
+  faces' sources are left out unless `Embed::documents` names their family.
+- `subset_to(catalogs)` cuts each interface face to the characters the catalogs use from U+2E80 up
+  (CJK and later blocks, without emoji, variation selectors and tags), plus CJK punctuation
+  (U+3000–303F), kana (U+3040–30FF, U+31F0–31FF) and full-width forms (U+FF00–FFEF), and keeps
+  every layout feature, so vertical forms (`vert`) still work. Every face gets the characters of
+  every catalog, so a Japanese label in a Chinese catalog still draws. The cuts are written to
+  `OUT_DIR/craft-fonts-ui/` and embedded from there; the same inputs give the same bytes, for
+  reproducible releases. Cutting all five faces takes well under a second.
+- Without `subset_to`, or with an empty catalog list, `for_ui()` leaves the interface faces out
+  with a `cargo::warning`: a full CJK face is never embedded for the interface by accident. A
+  checkout whose manifest has no interface face is a `cargo::warning` too. With `CRAFT_FONTS_REQUIRED=1` that
+  makes `scripts(&["Hant"])` an error; with catalogs, an interface face satisfies it.
+- An interface face with CFF outlines is an error (`Error::NotTrueType`), even when not required:
+  the subsetter cuts TrueType (`glyf`) faces correctly, but not CFF ones.
+
+The catalogs come from craft-i18n. An app's build reads them from the checkout `CRAFT_I18N_DIR`
+names (craft-i18n's `docs/integration.md`); the fonts build script reads the same variable, as in
+the example above. Catalogs kept in the app's own repository are passed by path, relative to the
+package directory.
+
+A character the faces lack still shows: craft-ui's system font provider draws it with an installed
+font. The build says so: for each catalog, and each file passed to `check_text`, it prints one
+`cargo::warning` with the count and the first few characters from U+2E80 up that no embedded face
+covers. Since the cuts hold every catalog character their sources have, these are the characters
+the sources lack. Faces the app embeds in another table count as covering their characters when
+named with `embedded_elsewhere`; they are read whole from the checkout, so a face cut elsewhere is
+exact only for the catalogs it was cut to. It also reruns the build script when a file changes.
+
+## The manifest
+
+One face per line, eight or nine fields separated by `" | "`; craft-fonts' `docs/integration.md`
+defines them. Lines starting with `#` are comments. A file field ending in `#<n>` names face `n` of
+a font collection (`fonts/noto-sans-cjk/NotoSansCJK.ttc#2`); without it the index is 0. The ninth
+field, `role`, is `ui` on interface faces and absent elsewhere. Fields after the ninth are ignored.
diff --git a/crates/fonts-build/src/cmap.rs b/crates/fonts-build/src/cmap.rs
new file mode 100644
index 00000000..b817b7ef
--- /dev/null
+++ b/crates/fonts-build/src/cmap.rs
@@ -0,0 +1,165 @@
+//! Just enough of an OpenType reader to ask which characters a face maps: the `cmap` table's
+//! Unicode subtables in formats 4 and 12, in a single font or one face of a collection.
+
+/// The Unicode character maps of one face.
+pub(crate) struct Cmap<'a> {
+    subtables: Vec<&'a [u8]>,
+}
+
+impl<'a> Cmap<'a> {
+    /// The cmap of face `index` of `font` (a `.ttf`/`.otf`, or a `.ttc` collection); `None` when the
+    /// file isn't a font or has no Unicode subtable in format 4 or 12.
+    pub(crate) fn read(font: &'a [u8], index: u32) -> Option<Self> {
+        let face = if font.get(0..4)? == b"ttcf" {
+            if index >= u32_at(font, 8)? {
+                return None;
+            }
+            usize::try_from(u32_at(font, 12 + 4 * usize::try_from(index).ok()?)?).ok()?
+        } else {
+            0
+        };
+        let tables = usize::from(u16_at(font, face + 4)?);
+        let record = (0..tables).map(|i| face + 12 + 16 * i).find(|&r| font.get(r..r + 4) == Some(b"cmap"))?;
+        let cmap = slice(font, u32_at(font, record + 8)?, u32_at(font, record + 12)?)?;
+        let mut subtables = Vec::new();
+        for i in 0..usize::from(u16_at(cmap, 2)?) {
+            let (platform, encoding) = (u16_at(cmap, 4 + 8 * i)?, u16_at(cmap, 6 + 8 * i)?);
+            // Unicode platform, or Windows Unicode BMP (1) and full repertoire (10).
+            if platform != 0 && !(platform == 3 && matches!(encoding, 1 | 10)) {
+                continue;
+            }
+            let start = usize::try_from(u32_at(cmap, 8 + 8 * i)?).ok()?;
+            let rest = cmap.get(start..)?;
+            // Bound each subtable by its own length so that reads can't stray into the next one.
+            // Some large CJK fonts declare a format 4 length past the end of the table, so that
+            // one is clamped; a format 12 length that doesn't fit is skipped.
+            let len = match u16_at(rest, 0) {
+                Some(4) => u16_at(rest, 2).map(|len| usize::from(len).min(rest.len())),
+                Some(12) => u32_at(rest, 4).and_then(|len| usize::try_from(len).ok()),
+                _ => None,
+            };
+            if let Some(subtable) = len.and_then(|len| rest.get(..len)) {
+                subtables.push(subtable);
+            }
+        }
+        (!subtables.is_empty()).then_some(Self { subtables })
+    }
+
+    /// Whether any Unicode subtable maps `c` to a glyph other than `.notdef`.
+    pub(crate) fn covers(&self, c: char) -> bool {
+        self.subtables.iter().any(|t| glyph(t, u32::from(c)).is_some_and(|g| g != 0))
+    }
+
+    /// Every character [`Self::covers`], as sorted, disjoint, non-adjacent inclusive ranges.
+    pub(crate) fn ranges(&self) -> Vec<(u32, u32)> {
+        let mut spans: Vec<(u32, u32)> = self.subtables.iter().flat_map(|t| spans(t)).collect();
+        spans.sort_unstable();
+        let mut ranges: Vec<(u32, u32)> = Vec::new();
+        let mut next = 0;
+        for (start, end) in spans {
+            for c in start.max(next)..=end {
+                if !char::from_u32(c).is_some_and(|c| self.covers(c)) {
+                    continue;
+                }
+                match ranges.last_mut() {
+                    Some(last) if last.1 + 1 == c => last.1 = c,
+                    _ => ranges.push((c, c)),
+                }
+            }
+            next = next.max(end.saturating_add(1));
+        }
+        ranges
+    }
+}
+
+/// The code point spans a subtable lists, mapped or not.
+fn spans(t: &[u8]) -> Vec<(u32, u32)> {
+    let mut spans = Vec::new();
+    match u16_at(t, 0) {
+        Some(4) => {
+            let seg_x2 = u16_at(t, 6).map_or(0, usize::from);
+            for i in 0..seg_x2 / 2 {
+                let (Some(end), Some(start)) = (u16_at(t, 14 + 2 * i), u16_at(t, 16 + seg_x2 + 2 * i)) else { break };
+                if start <= end {
+                    spans.push((u32::from(start), u32::from(end)));
+                }
+            }
+        }
+        Some(12) => {
+            for i in 0..u32_at(t, 12).and_then(|n| usize::try_from(n).ok()).unwrap_or(0) {
+                let (Some(start), Some(end)) = (u32_at(t, 16 + 12 * i), u32_at(t, 20 + 12 * i)) else { break };
+                if start <= end {
+                    spans.push((start, end.min(u32::from(char::MAX))));
+                }
+            }
+        }
+        _ => {}
+    }
+    spans
+}
+
+fn glyph(subtable: &[u8], c: u32) -> Option<u32> {
+    match u16_at(subtable, 0)? {
+        4 => format4(subtable, u16::try_from(c).ok()?),
+        12 => format12(subtable, c),
+        _ => None,
+    }
+}
+
+fn format4(t: &[u8], c: u16) -> Option<u32> {
+    let seg_x2 = usize::from(u16_at(t, 6)?);
+    let (ends, starts, deltas, range_offsets) = (14, 16 + seg_x2, 16 + 2 * seg_x2, 16 + 3 * seg_x2);
+    // End codes are sorted: the first segment ending at or after `c` is the only candidate.
+    let segments = seg_x2 / 2;
+    let i = partition_point(segments, |i| u16_at(t, ends + 2 * i).is_some_and(|end| end < c));
+    if i == segments {
+        return None;
+    }
+    let start = u16_at(t, starts + 2 * i)?;
+    if c < start {
+        return None;
+    }
+    let delta = u16_at(t, deltas + 2 * i)?;
+    let range_offset_at = range_offsets + 2 * i;
+    let range_offset = usize::from(u16_at(t, range_offset_at)?);
+    if range_offset == 0 {
+        return Some(u32::from(c.wrapping_add(delta)));
+    }
+    let g = u16_at(t, range_offset_at + range_offset + 2 * usize::from(c - start))?;
+    Some(if g == 0 { 0 } else { u32::from(g.wrapping_add(delta)) })
+}
+
+fn format12(t: &[u8], c: u32) -> Option<u32> {
+    let groups = usize::try_from(u32_at(t, 12)?).ok()?;
+    // Groups are sorted by start code and don't overlap.
+    let i = partition_point(groups, |i| u32_at(t, 16 + 12 * i + 4).is_some_and(|end| end < c));
+    if i == groups {
+        return None;
+    }
+    let g = 16 + 12 * i;
+    let (start, end, glyph) = (u32_at(t, g)?, u32_at(t, g + 4)?, u32_at(t, g + 8)?);
+    (start..=end).contains(&c).then(|| glyph.wrapping_add(c - start))
+}
+
+/// The first index in `0..len` for which `before` is false, given that it is true for a prefix.
+fn partition_point(len: usize, before: impl Fn(usize) -> bool) -> usize {
+    let (mut lo, mut hi) = (0, len);
+    while lo < hi {
+        let mid = lo + (hi - lo) / 2;
+        if before(mid) { lo = mid + 1 } else { hi = mid }
+    }
+    lo
+}
+
+fn slice(data: &[u8], offset: u32, len: u32) -> Option<&[u8]> {
+    let offset = usize::try_from(offset).ok()?;
+    data.get(offset..offset.checked_add(usize::try_from(len).ok()?)?)
+}
+
+fn u16_at(data: &[u8], at: usize) -> Option<u16> {
+    Some(u16::from_be_bytes(data.get(at..at.checked_add(2)?)?.try_into().ok()?))
+}
+
+fn u32_at(data: &[u8], at: usize) -> Option<u32> {
+    Some(u32::from_be_bytes(data.get(at..at.checked_add(4)?)?.try_into().ok()?))
+}
diff --git a/crates/fonts-build/src/coverage.rs b/crates/fonts-build/src/coverage.rs
new file mode 100644
index 00000000..4cc25a02
--- /dev/null
+++ b/crates/fonts-build/src/coverage.rs
@@ -0,0 +1,69 @@
+//! The characters a face maps, as [`ServedFace::coverage`](crate::ServedFace::coverage) stores
+//! them: its sorted, disjoint code point ranges, each as two unsigned LEB128 numbers, the gap from
+//! the end of the previous range (from 0 for the first) and the range's length minus one. A
+//! Chinese interface face cut to an app's catalogs takes about 3 KB.
+
+use crate::cmap::Cmap;
+
+/// The coverage of face `index` of `font` (a `.ttf`/`.otf`, or a `.ttc` collection); `None` when
+/// the file isn't a font or has no Unicode `cmap` subtable in format 4 or 12.
+pub fn of_face(font: &[u8], index: u32) -> Option<Vec<u8>> {
+    Some(encode(&Cmap::read(font, index)?.ranges()))
+}
+
+/// The coverage of inclusive code point ranges, sorted by start. Overlaps are dropped.
+pub fn encode(ranges: &[(u32, u32)]) -> Vec<u8> {
+    let mut out = Vec::new();
+    let mut next = 0;
+    for &(start, end) in ranges {
+        let start = start.max(next);
+        if end < start {
+            continue;
+        }
+        leb128(&mut out, start - next);
+        leb128(&mut out, end - start);
+        let Some(after) = end.checked_add(1) else { break };
+        next = after;
+    }
+    out
+}
+
+/// Whether `coverage` holds `c`.
+pub fn contains(coverage: &[u8], c: char) -> bool {
+    let c = u32::from(c);
+    let mut bytes = coverage.iter().copied();
+    let mut next = 0u32;
+    while let (Some(gap), Some(len)) = (read(&mut bytes), read(&mut bytes)) {
+        let Some(start) = next.checked_add(gap) else { return false };
+        let Some(end) = start.checked_add(len) else { return false };
+        if c < start {
+            return false;
+        }
+        if c <= end {
+            return true;
+        }
+        let Some(after) = end.checked_add(1) else { return false };
+        next = after;
+    }
+    false
+}
+
+fn leb128(out: &mut Vec<u8>, mut n: u32) {
+    while n >= 0x80 {
+        out.push((n & 0x7F) as u8 | 0x80);
+        n >>= 7;
+    }
+    out.push(n as u8);
+}
+
+fn read(bytes: &mut impl Iterator<Item = u8>) -> Option<u32> {
+    let mut n = 0u32;
+    for shift in (0..35).step_by(7) {
+        let byte = bytes.next()?;
+        n |= u32::from(byte & 0x7F).checked_shl(shift)?;
+        if byte & 0x80 == 0 {
+            return Some(n);
+        }
+    }
+    None
+}
diff --git a/crates/fonts-build/src/embed.rs b/crates/fonts-build/src/embed.rs
new file mode 100644
index 00000000..c6937ba5
--- /dev/null
+++ b/crates/fonts-build/src/embed.rs
@@ -0,0 +1,669 @@
+//! The build-script side: read `CRAFT_FONTS_DIR`, select faces, write the generated table.
+
+#[cfg(feature = "subset")]
+use std::collections::BTreeSet;
+use std::collections::HashSet;
+use std::ffi::OsString;
+use std::fmt::{self, Write as _};
+use std::io;
+use std::path::{Path, PathBuf};
+
+use crate::cmap::Cmap;
+use crate::manifest::{ManifestEntry, ParseError, parse_manifest, script_matches};
+
+const DIR_VAR: &str = "CRAFT_FONTS_DIR";
+const REQUIRED_VAR: &str = "CRAFT_FONTS_REQUIRED";
+const EMPTY_TABLE: &str = "&[]\n";
+
+/// Whether the build script is building for wasm32 (web builds usually embed fewer faces).
+pub fn target_is_wasm() -> bool {
+    std::env::var("CARGO_CFG_TARGET_ARCH").is_ok_and(|arch| arch == "wasm32")
+}
+
+type Filter = Box<dyn Fn(&ManifestEntry) -> bool>;
+
+/// Which faces to embed, and from where. [`Embed::write`] does the work.
+#[derive(Default)]
+pub struct Embed {
+    scripts: Option<Vec<String>>,
+    filter: Option<Filter>,
+    dir: Option<PathBuf>,
+    required: Option<bool>,
+    ui: bool,
+    catalogs: Option<Vec<PathBuf>>,
+    texts: Vec<PathBuf>,
+    families: Option<Vec<String>>,
+    elsewhere: Vec<String>,
+    serve: Option<Serve>,
+}
+
+/// Where [`Embed::serve`] copies the faces, and the URL prefix they are served under.
+struct Serve {
+    dir: PathBuf,
+    url_prefix: String,
+}
+
+/// A selected face and the file the table embeds it from.
+struct Face {
+    entry: ManifestEntry,
+    path: PathBuf,
+    index: u32,
+    /// An interface face to cut to the catalogs' characters before it is embedded.
+    cut: bool,
+    /// Hex SHA-256 of the file: the manifest's, or the cut's.
+    sha256: String,
+}
+
+impl Embed {
+    /// Every face except the interface faces' sources (`role` `ui`), from `CRAFT_FONTS_DIR`,
+    /// required when `CRAFT_FONTS_REQUIRED=1`. Narrow it with [`Embed::scripts`] and
+    /// [`Embed::filter`]; a table of document fonts starts from [`Embed::documents`] instead.
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Every face of these families, whole, and nothing else: an app's document fonts. A family
+    /// is named as the manifest spells it (`"Noto Sans"`, `"Shippori Mincho"`) and contributes all
+    /// its styles, interface faces included (`"BIZ UDPGothic"` brings its Regular as well).
+    /// A name the manifest lacks is an [`Error::UnknownFamilies`], so the build fails with
+    /// `CRAFT_FONTS_REQUIRED=1` and warns and embeds nothing otherwise. Narrow it further with
+    /// [`Embed::scripts`] and [`Embed::filter`].
+    pub fn documents(families: &[&str]) -> Self {
+        Self { families: Some(families.iter().map(|f| (*f).to_owned()).collect()), ..Self::default() }
+    }
+
+    /// Embed only faces with at least one of these script tags (see
+    /// [`ManifestEntry::has_script`]). With `CRAFT_FONTS_REQUIRED=1`, each tag must match a face.
+    pub fn scripts(mut self, tags: &[&str]) -> Self {
+        self.scripts = Some(tags.iter().map(|t| (*t).to_owned()).collect());
+        self
+    }
+
+    /// Embed only faces for which `keep` returns true (applied after [`Embed::scripts`]).
+    pub fn filter(mut self, keep: impl Fn(&ManifestEntry) -> bool + 'static) -> Self {
+        self.filter = Some(Box::new(keep));
+        self
+    }
+
+    /// Embed faces for an app's interface: CJK faces only as the interface faces (`role` `ui` in
+    /// the manifest), cut to the characters of the catalogs given to `Embed::subset_to`. Other
+    /// CJK faces are dropped and the rest are kept. Without catalogs the interface faces are left
+    /// out too, with a `cargo::warning`, so a full CJK face is never embedded for the interface.
+    /// A manifest with no interface face is also a `cargo::warning` when that drops a CJK face.
+    /// Combines with [`Embed::scripts`], [`Embed::filter`] and [`Embed::serve`]; with
+    /// `CRAFT_FONTS_REQUIRED=1`, an interface face satisfies its script tags.
+    pub fn for_ui(mut self) -> Self {
+        self.ui = true;
+        self
+    }
+
+    /// Cut the interface faces to the characters these translation catalogs use, and embed the
+    /// cut faces, written to `OUT_DIR`. Implies [`Embed::for_ui`]. An empty list counts as no
+    /// catalogs: the interface faces are left out, with a `cargo::warning`.
+    ///
+    /// The cut keeps the catalogs' characters from U+2E80 up (CJK and later blocks, without emoji,
+    /// variation selectors and tags), plus CJK punctuation (U+3000–303F), kana (U+3040–30FF,
+    /// U+31F0–31FF) and full-width forms (U+FF00–FFEF), with every layout feature. The same inputs
+    /// give the same bytes. A face with CFF outlines is an [`Error::NotTrueType`].
+    ///
+    /// The catalogs are also checked as by [`Embed::check_text`]. Relative paths are under the
+    /// package directory; an unreadable catalog is a `cargo::warning`.
+    #[cfg(feature = "subset")]
+    pub fn subset_to<P: Into<PathBuf>>(mut self, catalogs: impl IntoIterator<Item = P>) -> Self {
+        self.ui = true;
+        self.catalogs.get_or_insert_default().extend(catalogs.into_iter().map(Into::into));
+        self
+    }
+
+    /// Check that the embedded faces cover these text files, such as translation catalogs: one
+    /// `cargo::warning` per file that has characters from U+2E80 up (CJK and later blocks, without
+    /// emoji and variation selectors) that no embedded face maps. Those characters fall back to
+    /// system fonts at run time. Relative paths are under the package directory. The check runs
+    /// only when a checkout was read.
+    pub fn check_text<P: Into<PathBuf>>(mut self, paths: impl IntoIterator<Item = P>) -> Self {
+        self.texts.extend(paths.into_iter().map(Into::into));
+        self
+    }
+
+    /// Families the app embeds in another table, such as its interface faces next to its document
+    /// fonts: [`Embed::check_text`] and the catalog check count their characters as covered. Each
+    /// is read from the checkout whole, so for a face cut elsewhere this is exact only for the
+    /// catalogs it was cut to. A name the manifest lacks is a `cargo::warning`.
+    pub fn embedded_elsewhere(mut self, families: &[&str]) -> Self {
+        self.elsewhere.extend(families.iter().map(|f| (*f).to_owned()));
+        self
+    }
+
+    /// Read this checkout instead of `CRAFT_FONTS_DIR`.
+    pub fn dir(mut self, dir: impl Into<PathBuf>) -> Self {
+        self.dir = Some(dir.into());
+        self
+    }
+
+    /// Override `CRAFT_FONTS_REQUIRED` (required only when it is exactly `1`).
+    pub fn required(mut self, required: bool) -> Self {
+        self.required = Some(required);
+        self
+    }
+
+    /// Copy the selected faces into `dir` instead of embedding them, for a web build that serves
+    /// them beside its wasm, and write a table of [`ServedFace`](crate::ServedFace)s.
+    ///
+    /// Each font file and its licence file keep their path under the checkout's `fonts/`
+    /// directory (`noto-sans-arabic/NotoSansArabic.ttf`), and a face's `url` is `url_prefix`
+    /// followed by that path, so `serve("web/fonts", "fonts/")` suits a page that serves
+    /// `web/fonts` as `fonts/`. An interface face cut by `Embed::subset_to` is served from its cut,
+    /// with the start of the cut's SHA-256 in the file name (`ui/NotoSansTCUI-Regular.<hash>.ttf`)
+    /// and the cut's own integrity value. A relative `dir` is under the package directory, where
+    /// Cargo runs build scripts. Files already there with the same bytes are left as they are;
+    /// files of faces no longer selected, and earlier cuts, are not removed.
+    pub fn serve(mut self, dir: impl Into<PathBuf>, url_prefix: &str) -> Self {
+        self.serve = Some(Serve { dir: dir.into(), url_prefix: url_prefix.to_owned() });
+        self
+    }
+
+    /// Write the face table to `out_file` and print the `cargo::` lines; returns the faces
+    /// embedded.
+    ///
+    /// Without a checkout the table is empty. A checkout that can't be read is a
+    /// `cargo::warning` and an empty table, or an [`Error`] when required. The table is written
+    /// in every case, so on an error the build fails only on the message the caller prints.
+    pub fn write(&self, out_file: impl AsRef<Path>) -> Result<Vec<ManifestEntry>, Error> {
+        let env = Env { dir: std::env::var_os(DIR_VAR), required: std::env::var_os(REQUIRED_VAR), out_dir: std::env::var_os("OUT_DIR") };
+        let mut cargo = Vec::new();
+        let result = self.run(&env, out_file.as_ref(), &mut cargo);
+        for line in cargo {
+            println!("{line}");
+        }
+        result
+    }
+
+    pub(crate) fn run(&self, env: &Env, out_file: &Path, cargo: &mut Vec<String>) -> Result<Vec<ManifestEntry>, Error> {
+        cargo.push(format!("cargo::rerun-if-env-changed={DIR_VAR}"));
+        cargo.push(format!("cargo::rerun-if-env-changed={REQUIRED_VAR}"));
+        for text in self.checked_files() {
+            cargo.push(format!("cargo::rerun-if-changed={}", text.display()));
+        }
+        let out = match (out_file.is_absolute(), &env.out_dir) {
+            (true, _) => out_file.to_path_buf(),
+            (false, Some(out_dir)) => Path::new(out_dir).join(out_file),
+            (false, None) => return Err(Error::NoOutDir),
+        };
+        let required = self.required.unwrap_or_else(|| env.required.as_ref().is_some_and(|v| v == "1"));
+        let dir = self.dir.clone().or_else(|| env.dir.clone().filter(|d| !d.is_empty()).map(PathBuf::from));
+
+        let selected = match &dir {
+            None => Err(Error::NotSet),
+            Some(dir) => self.select(dir, cargo).and_then(|faces| if required { self.check_required(dir, faces) } else { Ok(faces) }),
+        };
+        let mut selected = selected;
+        if let Ok(faces) = &mut selected {
+            // A face that can't be cut is a broken manifest line: an error even when not required.
+            if let Err(e) = self.cut(faces, out.parent().unwrap_or(Path::new(""))) {
+                write(&out, EMPTY_TABLE)?;
+                return Err(e);
+            }
+            if let Some(dir) = &dir {
+                self.check_coverage(faces, dir, cargo);
+            }
+        }
+        let selected = match (selected, &self.serve, &dir) {
+            (Ok(faces), Some(serve), Some(dir)) => match serve.copy(dir, &faces, cargo) {
+                Ok(table) => Ok((table, faces)),
+                Err(e) => {
+                    write(&out, EMPTY_TABLE)?;
+                    return Err(e);
+                }
+            },
+            (selected, ..) => selected.and_then(|faces| Ok((table(&faces)?, faces))),
+        };
+        let (table, faces) = match selected {
+            Ok((table, faces)) => (table, faces.into_iter().map(|face| face.entry).collect()),
+            Err(e) if required => {
+                write(&out, EMPTY_TABLE)?;
+                return Err(e);
+            }
+            Err(Error::NotSet) => (EMPTY_TABLE.to_owned(), Vec::new()),
+            Err(e) => {
+                cargo.push(format!("cargo::warning=building without craft-fonts: {e}"));
+                (EMPTY_TABLE.to_owned(), Vec::new())
+            }
+        };
+        write(&out, &table)?;
+        Ok(faces)
+    }
+
+    /// The wanted manifest entries with their canonical file paths.
+    fn select(&self, dir: &Path, cargo: &mut Vec<String>) -> Result<Vec<Face>, Error> {
+        let manifest = dir.join("fonts/manifest.txt");
+        let text = std::fs::read_to_string(&manifest).map_err(|source| Error::Read { path: manifest.clone(), source })?;
+        // Cargo treats a missing watched file as changed, which would rerun the build every time.
+        cargo.push(format!("cargo::rerun-if-changed={}", manifest.display()));
+        let entries = parse_manifest(&text).map_err(|error| Error::Parse { manifest: manifest.clone(), error })?;
+        if let Some(families) = &self.families {
+            let unknown: Vec<String> = families.iter().filter(|f| !entries.iter().any(|e| &e.family == *f)).cloned().collect();
+            if !unknown.is_empty() {
+                let mut known: Vec<String> = Vec::new();
+                for entry in &entries {
+                    if !known.contains(&entry.family) {
+                        known.push(entry.family.clone());
+                    }
+                }
+                return Err(Error::UnknownFamilies { manifest, families: unknown, known });
+            }
+        }
+        let has_ui = entries.iter().any(ManifestEntry::is_ui);
+        let no_catalogs = self.catalogs.as_ref().is_none_or(Vec::is_empty);
+        let mut faces = Vec::new();
+        let mut uncut = Vec::new();
+        let mut dropped_cjk = false;
+        for entry in entries {
+            // Interface faces are the sources of the cuts: embedded whole only when named.
+            let named = match &self.families {
+                Some(families) => families.contains(&entry.family),
+                None => self.ui || !entry.is_ui(),
+            };
+            if !named {
+                continue;
+            }
+            let wanted = self.scripts.as_ref().is_none_or(|tags| tags.iter().any(|t| entry.has_script(t)));
+            let ui_dropped = self.ui && entry.is_cjk() && !entry.is_ui();
+            if !wanted || ui_dropped || self.filter.as_ref().is_some_and(|keep| !keep(&entry)) {
+                dropped_cjk |= wanted && ui_dropped;
+                continue;
+            }
+            let cut = self.ui && entry.is_ui();
+            // An empty list would cut the faces to kana and punctuation, so it counts as none.
+            if cut && no_catalogs {
+                uncut.push(format!("{} {}", entry.family, entry.style));
+                continue;
+            }
+            let file = dir.join(&entry.file);
+            // `include_bytes!` resolves relative paths from the including source file.
+            let path = file.canonicalize().map_err(|source| Error::Read { path: file, source })?;
+            cargo.push(format!("cargo::rerun-if-changed={}", path.display()));
+            let (index, sha256) = (entry.index, entry.sha256.clone());
+            faces.push(Face { entry, path, index, cut, sha256 });
+        }
+        if !uncut.is_empty() {
+            let why = if self.catalogs.is_some() { "Embed::subset_to was given no translation catalogs" } else { "no translation catalogs" };
+            cargo.push(format!(
+                "cargo::warning=craft-fonts: not embedding the interface faces {}: {why}; pass the catalogs to \
+                 Embed::subset_to (feature `subset`) to embed them cut to the catalogs' characters",
+                uncut.join(", ")
+            ));
+        }
+        if dropped_cjk && !has_ui {
+            cargo.push(format!(
+                "cargo::warning=craft-fonts: not embedding any CJK face for the interface: {} has no interface face \
+                 (role `ui`); use a craft-fonts checkout that has them",
+                manifest.display()
+            ));
+        }
+        Ok(faces)
+    }
+
+    /// Replace each interface face with its cut, written to `out_dir`.
+    #[cfg(feature = "subset")]
+    fn cut(&self, faces: &mut [Face], out_dir: &Path) -> Result<(), Error> {
+        let Some(catalogs) = &self.catalogs else { return Ok(()) };
+        // `select` leaves the faces to cut out when there are no catalogs.
+        if !faces.iter().any(|face| face.cut) {
+            return Ok(());
+        }
+        let mut chars = BTreeSet::new();
+        // An unreadable catalog adds nothing here; `check_coverage` reports it.
+        for text in catalogs.iter().filter_map(|path| std::fs::read_to_string(path).ok()) {
+            chars.extend(text.chars().filter(|&c| needs_glyph(c)));
+        }
+        for (start, end) in UI_RANGES {
+            chars.extend(start..=end);
+        }
+        let dir = out_dir.join("craft-fonts-ui");
+        std::fs::create_dir_all(&dir).map_err(|source| Error::Write { path: dir.clone(), source })?;
+        for face in faces.iter_mut().filter(|face| face.cut) {
+            let source = std::fs::read(&face.path).map_err(|source| Error::Read { path: face.path.clone(), source })?;
+            let bytes = crate::subset::subset(&source, face.index, &chars).map_err(|failure| match failure {
+                crate::subset::Failure::NotTrueType => Error::NotTrueType { path: face.path.clone() },
+                crate::subset::Failure::Other(reason) => Error::Subset { path: face.path.clone(), reason },
+            })?;
+            let name: String =
+                format!("{}-{}", face.entry.family, face.entry.style).chars().map(|c| if c.is_ascii_alphanumeric() { c } else { '-' }).collect();
+            let out = dir.join(format!("{name}.ttf"));
+            // Rewriting identical bytes would make Cargo rebuild the crate that embeds them.
+            if std::fs::read(&out).ok().as_deref() != Some(&bytes[..]) {
+                std::fs::write(&out, &bytes).map_err(|source| Error::Write { path: out.clone(), source })?;
+            }
+            face.path = out;
+            face.index = 0;
+            face.sha256 = crate::sha256::hex(&bytes);
+        }
+        Ok(())
+    }
+
+    /// Without the subsetter there are no catalogs, so [`Embed::select`] left out every face to cut.
+    #[cfg(not(feature = "subset"))]
+    fn cut(&self, _faces: &mut [Face], _out_dir: &Path) -> Result<(), Error> {
+        Ok(())
+    }
+
+    /// The catalogs, then the other [`Embed::check_text`] files.
+    fn checked_files(&self) -> Vec<&PathBuf> {
+        let mut files: Vec<&PathBuf> = self.catalogs.iter().flatten().collect();
+        for text in &self.texts {
+            if !files.contains(&text) {
+                files.push(text);
+            }
+        }
+        files
+    }
+
+    /// The manifest entries of the [`Embed::embedded_elsewhere`] families, with a
+    /// `cargo::warning` for a family the manifest lacks.
+    fn elsewhere(&self, dir: &Path, cargo: &mut Vec<String>) -> Vec<ManifestEntry> {
+        if self.elsewhere.is_empty() {
+            return Vec::new();
+        }
+        let manifest = dir.join("fonts/manifest.txt");
+        // `select` read and parsed this manifest already.
+        let entries = std::fs::read_to_string(&manifest).ok().and_then(|text| parse_manifest(&text).ok()).unwrap_or_default();
+        for family in self.elsewhere.iter().filter(|f| !entries.iter().any(|e| &e.family == *f)) {
+            cargo.push(format!("cargo::warning=craft-fonts: embedded_elsewhere names {family}, which {} lacks", manifest.display()));
+        }
+        entries.into_iter().filter(|e| self.elsewhere.contains(&e.family)).collect()
+    }
+
+    /// Warn about each catalog's and [`Embed::check_text`] file's characters that neither an
+    /// embedded face nor an [`Embed::embedded_elsewhere`] face covers.
+    fn check_coverage(&self, faces: &[Face], dir: &Path, cargo: &mut Vec<String>) {
+        let files = self.checked_files();
+        if files.is_empty() {
+            return;
+        }
+        let elsewhere = self.elsewhere(dir, cargo);
+        let fonts: Vec<(&ManifestEntry, u32, Option<Vec<u8>>)> = faces
+            .iter()
+            .map(|face| (&face.entry, face.index, std::fs::read(&face.path).ok()))
+            .chain(elsewhere.iter().map(|entry| (entry, entry.index, std::fs::read(dir.join(&entry.file)).ok())))
+            .collect();
+        let mut cmaps = Vec::new();
+        for (entry, index, bytes) in &fonts {
+            match bytes.as_deref().and_then(|bytes| Cmap::read(bytes, *index)) {
+                Some(cmap) => cmaps.push(cmap),
+                None => cargo
+                    .push(format!("cargo::warning=craft-fonts: cannot read the character map of {} {} ({})", entry.family, entry.style, entry.file)),
+            }
+        }
+        for path in files {
+            let text = match std::fs::read_to_string(path) {
+                Ok(text) => text,
+                Err(e) => {
+                    cargo.push(format!("cargo::warning=craft-fonts: cannot check {}: {e}", path.display()));
+                    continue;
+                }
+            };
+            let mut seen = HashSet::new();
+            let missing: Vec<char> = text.chars().filter(|&c| needs_glyph(c) && seen.insert(c) && !cmaps.iter().any(|cmap| cmap.covers(c))).collect();
+            if missing.is_empty() {
+                continue;
+            }
+            const SHOWN: usize = 8;
+            let shown: String = missing.iter().take(SHOWN).collect();
+            let more = if missing.len() > SHOWN { " …" } else { "" };
+            cargo.push(format!(
+                "cargo::warning=craft-fonts: {} has {} character{} no embedded face covers ({shown}{more}); system fonts will draw them.",
+                path.display(),
+                missing.len(),
+                if missing.len() == 1 { "" } else { "s" },
+            ));
+        }
+    }
+
+    fn check_required(&self, dir: &Path, faces: Vec<Face>) -> Result<Vec<Face>, Error> {
+        let manifest = dir.join("fonts/manifest.txt");
+        if faces.is_empty() {
+            return Err(Error::NoFaces { manifest });
+        }
+        let missing: Vec<String> = self
+            .scripts
+            .iter()
+            .flatten()
+            .filter(|tag| !faces.iter().any(|face| face.entry.scripts.iter().any(|s| script_matches(s, tag))))
+            .cloned()
+            .collect();
+        if missing.is_empty() { Ok(faces) } else { Err(Error::MissingScripts { manifest, scripts: missing }) }
+    }
+}
+
+/// Whether the interface faces need `c`: CJK and later blocks, except emoji and other pictographs
+/// (the emoji faces draw them), variation selectors, tags and a byte order mark.
+fn needs_glyph(c: char) -> bool {
+    c >= '\u{2E80}' && !matches!(c, '\u{FE00}'..='\u{FE0F}' | '\u{FEFF}' | '\u{1F000}'..='\u{1FFFF}' | '\u{E0000}'..)
+}
+
+/// Kept in every cut, whatever the catalogs use: CJK punctuation, kana and full-width forms.
+#[cfg(feature = "subset")]
+const UI_RANGES: [(char, char); 4] = [('\u{3000}', '\u{303F}'), ('\u{3040}', '\u{30FF}'), ('\u{31F0}', '\u{31FF}'), ('\u{FF00}', '\u{FFEF}')];
+
+/// The environment a build script sees, separated out for tests.
+pub(crate) struct Env {
+    pub dir: Option<OsString>,
+    pub required: Option<OsString>,
+    pub out_dir: Option<OsString>,
+}
+
+/// The generated source; `include_bytes!` takes a string, so a face under a path that isn't UTF-8
+/// is an error rather than a lossy path the consumer's build can't find.
+fn table(faces: &[Face]) -> Result<String, Error> {
+    let mut src = String::from("// Generated by craft-fonts-build. Do not edit.\n&[\n");
+    for Face { entry, path, index, .. } in faces {
+        let file = path.to_str().ok_or_else(|| Error::NonUtf8Path { path: path.clone() })?;
+        let scripts: Vec<String> = entry.scripts.iter().map(|s| format!("{s:?}")).collect();
+        let _ = writeln!(
+            src,
+            "    EmbeddedFace {{ family: {:?}, style: {:?}, scripts: &[{}], index: {}, bytes: include_bytes!({:?}) }},",
+            entry.family,
+            entry.style,
+            scripts.join(", "),
+            index,
+            file,
+        );
+    }
+    src.push_str("]\n");
+    Ok(src)
+}
+
+impl Serve {
+    /// Copy the faces' files and licences into the served directory; returns the table.
+    fn copy(&self, checkout: &Path, faces: &[Face], cargo: &mut Vec<String>) -> Result<String, Error> {
+        let mut copied: Vec<String> = Vec::new();
+        let mut src = String::from("// Generated by craft-fonts-build. Do not edit.\n&[\n");
+        for face in faces {
+            let (entry, path) = (&face.entry, &face.path);
+            let served = served_file(face);
+            let font = std::fs::read(path).map_err(|source| Error::Read { path: path.clone(), source })?;
+            let size = font.len();
+            if !copied.contains(&served) {
+                copied.push(served.clone());
+                copy_file(path, &self.dir.join(&served), cargo)?;
+                let licence = checkout.join(&entry.licence_file);
+                if entry.licence_file.is_empty() || !licence.is_file() {
+                    cargo.push(format!("cargo::warning=craft-fonts: no licence file beside {}", entry.file));
+                } else {
+                    copy_file(&licence, &self.dir.join(served_path(&entry.licence_file)), cargo)?;
+                }
+            }
+            let coverage = crate::coverage::of_face(&font, face.index).unwrap_or_else(|| {
+                cargo.push(format!("cargo::warning=craft-fonts: no character map in {}; the face is never fetched for a character", entry.file));
+                Vec::new()
+            });
+            let scripts: Vec<String> = entry.scripts.iter().map(|s| format!("{s:?}")).collect();
+            let _ = writeln!(
+                src,
+                "    ServedFace {{ family: {:?}, style: {:?}, scripts: &[{}], index: {}, url: {:?}, size: {size}, integrity: {:?}, coverage: {} }},",
+                entry.family,
+                entry.style,
+                scripts.join(", "),
+                face.index,
+                format!("{}{served}", self.url_prefix),
+                integrity(&face.sha256),
+                byte_string(&coverage),
+            );
+        }
+        src.push_str("]\n");
+        Ok(src)
+    }
+}
+
+/// A byte string literal, printable ASCII as itself.
+fn byte_string(bytes: &[u8]) -> String {
+    let mut out = String::from("b\"");
+    for &b in bytes {
+        match b {
+            b'"' | b'\\' => {
+                out.push('\\');
+                out.push(char::from(b));
+            }
+            0x20..=0x7E => out.push(char::from(b)),
+            _ => {
+                let _ = write!(out, "\\x{b:02x}");
+            }
+        }
+    }
+    out.push('"');
+    out
+}
+
+/// Where a face's file is served, under the served directory: its checkout path under `fonts/`.
+/// A cut adds the start of its SHA-256 before the extension (`ui/A.1234abcd5678ef90.ttf`), so a
+/// cut from changed catalogs gets a new URL instead of meeting a cached copy that fails its
+/// integrity check.
+fn served_file(face: &Face) -> String {
+    let file = served_path(&face.entry.file);
+    if !face.cut {
+        return file.to_owned();
+    }
+    let hash = face.sha256.get(..16).unwrap_or(&face.sha256);
+    match file.rsplit_once('.') {
+        Some((stem, extension)) if !extension.contains('/') => format!("{stem}.{hash}.{extension}"),
+        _ => format!("{file}.{hash}"),
+    }
+}
+
+/// A checkout path relative to the served directory: `fonts/a/A.ttf` → `a/A.ttf`.
+fn served_path(file: &str) -> &str {
+    file.strip_prefix("fonts/").unwrap_or(file)
+}
+
+/// Copy `from` unless `to` already holds the same bytes. The copy keeps `from`'s modification time
+/// and is watched, so the build copies it again once it is deleted, without running every build.
+fn copy_file(from: &Path, to: &Path, cargo: &mut Vec<String>) -> Result<(), Error> {
+    cargo.push(format!("cargo::rerun-if-changed={}", to.display()));
+    let write_error = |source| Error::Write { path: to.to_path_buf(), source };
+    let read_error = |source| Error::Read { path: from.to_path_buf(), source };
+    let bytes = std::fs::read(from).map_err(read_error)?;
+    if std::fs::read(to).is_ok_and(|old| old == bytes) {
+        return Ok(());
+    }
+    if let Some(parent) = to.parent() {
+        std::fs::create_dir_all(parent).map_err(write_error)?;
+    }
+    std::fs::write(to, &bytes).map_err(write_error)?;
+    // Cargo reruns a build script whose watched files are newer than its last run.
+    let modified = std::fs::metadata(from).and_then(|m| m.modified()).map_err(read_error)?;
+    std::fs::File::options().write(true).open(to).and_then(|f| f.set_modified(modified)).map_err(write_error)
+}
+
+/// The Subresource Integrity value (`sha256-<base64>`) of a hex SHA-256, or `""` for a value that
+/// isn't one.
+pub(crate) fn integrity(sha256: &str) -> String {
+    const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let digest: Option<Vec<u8>> =
+        (sha256.len() == 64).then(|| (0..32).map(|i| u8::from_str_radix(sha256.get(2 * i..2 * i + 2)?, 16).ok()).collect()).flatten();
+    let Some(digest) = digest else { return String::new() };
+    let mut out = String::from("sha256-");
+    for chunk in digest.chunks(3) {
+        let n = chunk.iter().enumerate().fold(0u32, |n, (i, b)| n | (u32::from(*b) << (16 - 8 * i)));
+        for i in 0..4 {
+            let c = if i <= chunk.len() { ALPHABET[((n >> (18 - 6 * i)) & 63) as usize] } else { b'=' };
+            out.push(char::from(c));
+        }
+    }
+    out
+}
+
+fn write(path: &Path, contents: &str) -> Result<(), Error> {
+    std::fs::write(path, contents).map_err(|source| Error::Write { path: path.to_path_buf(), source })
+}
+
+/// Why the faces could not be embedded. Print it as `cargo::error={error}`.
+#[derive(Debug)]
+#[non_exhaustive]
+pub enum Error {
+    /// `CRAFT_FONTS_REQUIRED=1` but `CRAFT_FONTS_DIR` is unset or empty.
+    NotSet,
+    /// The manifest or a font file it lists can't be read.
+    Read { path: PathBuf, source: io::Error },
+    /// The manifest has a malformed line.
+    Parse { manifest: PathBuf, error: ParseError },
+    /// Required, but no face in the manifest was selected.
+    NoFaces { manifest: PathBuf },
+    /// Required, but no face in the manifest has these requested script tags.
+    MissingScripts { manifest: PathBuf, scripts: Vec<String> },
+    /// The generated table can't be written.
+    Write { path: PathBuf, source: io::Error },
+    /// `out_file` is relative and `OUT_DIR` is unset (not running as a build script).
+    NoOutDir,
+    /// An interface face has CFF outlines, which can't be cut correctly; it must be TrueType.
+    NotTrueType { path: PathBuf },
+    /// An interface face can't be cut.
+    Subset { path: PathBuf, reason: String },
+    /// [`Embed::documents`] names families the manifest lacks; `known` lists the manifest's.
+    UnknownFamilies { manifest: PathBuf, families: Vec<String>, known: Vec<String> },
+    /// A face to embed has a path that isn't UTF-8, which `include_bytes!` can't name.
+    NonUtf8Path { path: PathBuf },
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::NotSet => {
+                write!(f, "{REQUIRED_VAR}=1 but {DIR_VAR} is not: set {DIR_VAR} to the absolute path of a storytold/craft-fonts checkout")
+            }
+            Self::Read { path, source } => {
+                write!(f, "cannot read {} ({DIR_VAR} must be the absolute path of a storytold/craft-fonts checkout): {source}", path.display())
+            }
+            Self::Parse { manifest, error } => write!(f, "{}: {error}", manifest.display()),
+            Self::NoFaces { manifest } => write!(f, "{REQUIRED_VAR}=1 but no face in {} was selected", manifest.display()),
+            Self::MissingScripts { manifest, scripts } => {
+                write!(f, "{REQUIRED_VAR}=1 but {} has no face for {}", manifest.display(), scripts.join(", "))
+            }
+            Self::Write { path, source } => write!(f, "cannot write {}: {source}", path.display()),
+            Self::NoOutDir => write!(f, "OUT_DIR is not set: call craft-fonts-build from a build script, or pass an absolute out_file"),
+            Self::NotTrueType { path } => write!(
+                f,
+                "{} has CFF outlines, which craft-fonts-build can't subset correctly: an interface face (role ui) must be a TrueType (glyf) font",
+                path.display()
+            ),
+            Self::Subset { path, reason } => write!(f, "cannot subset {}: {reason}", path.display()),
+            Self::UnknownFamilies { manifest, families, known } => write!(
+                f,
+                "{} has no family {}; Embed::documents names families as the manifest spells them: {}",
+                manifest.display(),
+                families.join(", "),
+                known.join(", ")
+            ),
+            Self::NonUtf8Path { path } => write!(f, "cannot embed {}: include_bytes! needs a UTF-8 path", path.display()),
+        }
+    }
+}
+
+impl std::error::Error for Error {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Read { source, .. } | Self::Write { source, .. } => Some(source),
+            Self::Parse { error, .. } => Some(error),
+            _ => None,
+        }
+    }
+}
diff --git a/crates/fonts-build/src/lib.rs b/crates/fonts-build/src/lib.rs
new file mode 100644
index 00000000..fffd8f09
--- /dev/null
+++ b/crates/fonts-build/src/lib.rs
@@ -0,0 +1,181 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+//! Embed the optional [craft-fonts](https://github.com/storytold/craft-fonts) faces from an app's
+//! `build.rs`.
+//!
+//! Apps never depend on craft-fonts in `Cargo.toml` (Cargo would fetch the font repository for
+//! every build). The build reads a local checkout named by `CRAFT_FONTS_DIR` instead:
+//!
+//! - **Unset or empty:** the table is empty and the app uses its own and system fonts.
+//! - **Set:** every selected face in `fonts/manifest.txt` is embedded with `include_bytes!`.
+//! - **Set, but not readable as a checkout:** a `cargo::warning` and an empty table.
+//! - **`CRAFT_FONTS_REQUIRED=1`** (release builds; any other value is ignored): a missing or
+//!   unreadable checkout, no selected face, or a requested script without a face is an [`Error`].
+//!
+//! Add this crate both as a build-dependency (for [`Embed`]) and as a dependency (for
+//! [`EmbeddedFace`]). The build-dependency enables the `subset` feature for `Embed::subset_to`,
+//! which cuts the CJK interface faces to the translation catalogs' characters; the dependency
+//! leaves it off, so the subsetter is not part of the app. In `build.rs`'s `main`:
+//!
+//! ```ignore
+//! println!("cargo::rerun-if-changed=build.rs");
+//! let wasm = craft_fonts_build::target_is_wasm();
+//! let catalogs: Vec<std::path::PathBuf> = /* the app's translation catalogs */;
+//! let embedded = craft_fonts_build::Embed::new()
+//!     // CJK faces only as the interface faces, cut to the characters the catalogs use.
+//!     .subset_to(catalogs)
+//!     // Web builds have a size budget: embed only the Japanese interface face there.
+//!     .filter(move |face| !wasm || face.has_script("Jpan"))
+//!     .write("craft_fonts.rs");
+//! if let Err(e) = embedded {
+//!     println!("cargo::error={e}");
+//! }
+//! ```
+//!
+//! and in the crate:
+//!
+//! ```ignore
+//! use craft_fonts_build::EmbeddedFace;
+//!
+//! pub static CRAFT_FONTS: &[EmbeddedFace] = include!(concat!(env!("OUT_DIR"), "/craft_fonts.rs"));
+//! ```
+//!
+//! The generated file is a slice expression of `EmbeddedFace { .. }` literals, so any struct with
+//! the same fields and that name in scope works too.
+//!
+//! An app's document fonts go in a table of their own that names its families,
+//! `Embed::documents(&["Noto Sans", "Shippori Mincho"])`: nothing is embedded for documents
+//! unless the app names it.
+//!
+//! Web builds can serve the faces beside the wasm instead: [`Embed::serve`] copies the selected
+//! files into a directory and writes a table of [`ServedFace`]s, which carry a URL in place of the
+//! bytes, for the app to fetch the faces it needs at run time.
+
+mod cmap;
+pub mod coverage;
+mod embed;
+mod manifest;
+#[cfg(feature = "subset")]
+mod sha256;
+#[cfg(feature = "subset")]
+mod subset;
+#[cfg(test)]
+mod tests;
+
+pub use embed::{Embed, Error, target_is_wasm};
+pub use manifest::{CJK_SCRIPTS, ManifestEntry, ParseError, UI_ROLE, parse_manifest};
+
+/// A craft-fonts face embedded by [`Embed`]: one line of `fonts/manifest.txt`.
+///
+/// [`Embed::serve`] writes [`ServedFace`]s instead.
+#[derive(Clone, Copy)]
+pub struct EmbeddedFace {
+    /// Family name, e.g. `"Noto Sans Arabic"`.
+    pub family: &'static str,
+    /// Style, e.g. `"Regular"` or `"Bold"`.
+    pub style: &'static str,
+    /// Script tags: ISO 15924 codes such as `Arab`, `Jpan`, `Hans`, `Hant`, optionally with a
+    /// region subtag (`Hant-HK` for Hong Kong forms, which have no ISO 15924 code).
+    pub scripts: &'static [&'static str],
+    /// Face index in a font collection (`.ttc`); `0` for a single font.
+    pub index: u32,
+    pub bytes: &'static [u8],
+}
+
+impl EmbeddedFace {
+    /// `"<family> <style>"`, e.g. `"Noto Sans Arabic Regular"`.
+    pub fn name(&self) -> String {
+        format!("{} {}", self.family, self.style)
+    }
+
+    /// Whether any script tag matches `tag`: `Hant` matches `Hant` and `Hant-HK`.
+    pub fn has_script(&self, tag: &str) -> bool {
+        self.scripts.iter().any(|s| manifest::script_matches(s, tag))
+    }
+
+    /// Whether the face has a CJK script tag ([`CJK_SCRIPTS`]).
+    pub fn is_cjk(&self) -> bool {
+        CJK_SCRIPTS.iter().any(|tag| self.has_script(tag))
+    }
+
+    /// CSS/OpenType weight implied by the style name (`Bold` → 700); 400 when it names none.
+    pub fn weight(&self) -> u16 {
+        let style = self.style.to_ascii_lowercase().replace([' ', '-'], "");
+        const WEIGHTS: [(&str, u16); 14] = [
+            ("extralight", 200),
+            ("ultralight", 200),
+            ("semibold", 600),
+            ("demibold", 600),
+            ("extrabold", 800),
+            ("ultrabold", 800),
+            ("thin", 100),
+            ("light", 300),
+            ("medium", 500),
+            ("bold", 700),
+            ("black", 900),
+            ("heavy", 900),
+            ("regular", 400),
+            ("book", 400),
+        ];
+        WEIGHTS.iter().find(|(name, _)| style.contains(name)).map_or(400, |(_, weight)| *weight)
+    }
+}
+
+/// A craft-fonts face that [`Embed::serve`] copied beside the app, to fetch at run time: one line
+/// of `fonts/manifest.txt`.
+#[derive(Clone, Copy, Debug)]
+pub struct ServedFace {
+    /// Family name, e.g. `"Noto Sans Arabic"`.
+    pub family: &'static str,
+    /// Style, e.g. `"Regular"` or `"Bold"`.
+    pub style: &'static str,
+    /// Script tags, as in [`EmbeddedFace::scripts`].
+    pub scripts: &'static [&'static str],
+    /// Face index in a font collection (`.ttc`); `0` for a single font. Faces of one collection
+    /// share a URL.
+    pub index: u32,
+    /// Where the file is served, relative to the page unless the prefix given to
+    /// [`Embed::serve`] makes it absolute.
+    pub url: &'static str,
+    /// File size in bytes.
+    pub size: u64,
+    /// Subresource Integrity value (`sha256-…`) from the manifest's hash; empty when the manifest
+    /// has none.
+    pub integrity: &'static str,
+    /// The characters the face maps, read from its `cmap` (see [`coverage`]).
+    pub coverage: &'static [u8],
+}
+
+impl ServedFace {
+    /// `"<family> <style>"`, e.g. `"Noto Sans Arabic Regular"`.
+    pub fn name(&self) -> String {
+        format!("{} {}", self.family, self.style)
+    }
+
+    /// Whether any script tag matches `tag`: `Hant` matches `Hant` and `Hant-HK`.
+    pub fn has_script(&self, tag: &str) -> bool {
+        self.scripts.iter().any(|s| manifest::script_matches(s, tag))
+    }
+
+    /// Whether the face has a CJK script tag ([`CJK_SCRIPTS`]).
+    pub fn is_cjk(&self) -> bool {
+        CJK_SCRIPTS.iter().any(|tag| self.has_script(tag))
+    }
+
+    /// Whether the face maps `c`.
+    pub fn covers(&self, c: char) -> bool {
+        coverage::contains(self.coverage, c)
+    }
+}
+
+impl std::fmt::Debug for EmbeddedFace {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("EmbeddedFace")
+            .field("family", &self.family)
+            .field("style", &self.style)
+            .field("scripts", &self.scripts)
+            .field("index", &self.index)
+            .field("bytes", &format_args!("[{} bytes]", self.bytes.len()))
+            .finish()
+    }
+}
diff --git a/crates/fonts-build/src/manifest.rs b/crates/fonts-build/src/manifest.rs
new file mode 100644
index 00000000..69c31959
--- /dev/null
+++ b/crates/fonts-build/src/manifest.rs
@@ -0,0 +1,127 @@
+//! craft-fonts' `fonts/manifest.txt`: one font face per line, eight or nine fields separated by
+//! `" | "`:
+//!
+//! ```text
+//! family | style | file | scripts | licence | licence file | sha256 | source [| role]
+//! ```
+//!
+//! Blank lines and lines starting with `#` are skipped. `file` is relative to the checkout and may
+//! end in `#<index>` to pick one face of a font collection (`.ttc`). The optional `role` is `ui` for
+//! an interface face: a full Regular TrueType face that an app's build cuts to the characters of its
+//! translation catalogs. Fields after the ninth are ignored, so a manifest that gains a field still
+//! embeds.
+
+use std::fmt;
+
+/// One face listed in the manifest.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ManifestEntry {
+    /// Family name, as the font's `name` table spells it (e.g. `Noto Sans Arabic`).
+    pub family: String,
+    /// Style within the family (e.g. `Regular`, `Bold`).
+    pub style: String,
+    /// Font file, relative to the checkout, without the `#<index>` suffix.
+    pub file: String,
+    /// Face index in a font collection; `0` when the file field has no `#<index>`.
+    pub index: u32,
+    /// Script tags: ISO 15924 codes (`Jpan`, `Arab`), optionally with a region (`Hant-HK`).
+    pub scripts: Vec<String>,
+    /// SPDX licence identifier.
+    pub licence: String,
+    /// Licence text, relative to the checkout.
+    pub licence_file: String,
+    /// Hex SHA-256 of the font file.
+    pub sha256: String,
+    /// Where the file came from.
+    pub source: String,
+    /// The optional ninth field: `Some("ui")` for an interface face, `None` when the line has no
+    /// role.
+    pub role: Option<String>,
+}
+
+impl ManifestEntry {
+    /// Whether any of the face's script tags matches `tag`. `Hant` matches `Hant` and `Hant-HK`;
+    /// `Hant-HK` matches only `Hant-HK`.
+    pub fn has_script(&self, tag: &str) -> bool {
+        self.scripts.iter().any(|s| script_matches(s, tag))
+    }
+
+    /// Whether the face is an interface face (`role` is `ui`).
+    pub fn is_ui(&self) -> bool {
+        self.role.as_deref() == Some(UI_ROLE)
+    }
+
+    /// Whether the face has a CJK script tag ([`CJK_SCRIPTS`]).
+    pub fn is_cjk(&self) -> bool {
+        CJK_SCRIPTS.iter().any(|tag| self.has_script(tag))
+    }
+}
+
+/// The `role` of an interface face.
+pub const UI_ROLE: &str = "ui";
+
+/// Script tags of the CJK faces, which craft-fonts also ships as interface faces. `Hant` covers
+/// `Hant-HK`.
+pub const CJK_SCRIPTS: &[&str] = &["Hans", "Hant", "Jpan", "Kore", "Hani"];
+
+/// `face_tag` is `wanted` or `wanted` plus a `-` subtag.
+pub(crate) fn script_matches(face_tag: &str, wanted: &str) -> bool {
+    face_tag.strip_prefix(wanted).is_some_and(|rest| rest.is_empty() || rest.starts_with('-'))
+}
+
+/// A manifest line that could not be read.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ParseError {
+    /// 1-based line number.
+    pub line: usize,
+    pub reason: String,
+}
+
+impl fmt::Display for ParseError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "manifest line {}: {}", self.line, self.reason)
+    }
+}
+
+impl std::error::Error for ParseError {}
+
+/// Parse a whole manifest.
+pub fn parse_manifest(text: &str) -> Result<Vec<ManifestEntry>, ParseError> {
+    let mut entries = Vec::new();
+    for (i, raw) in text.lines().enumerate() {
+        let line = i + 1;
+        let trimmed = raw.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+        let fields: Vec<&str> = trimmed.split(" | ").map(str::trim).collect();
+        let [family, style, file, scripts, licence, licence_file, sha256, source, rest @ ..] = fields.as_slice() else {
+            return Err(ParseError { line, reason: format!("expected 8 fields separated by \" | \", found {}", fields.len()) });
+        };
+        for (name, value) in [("family", family), ("style", style), ("file", file), ("scripts", scripts)] {
+            if value.is_empty() {
+                return Err(ParseError { line, reason: format!("the {name} field is empty") });
+            }
+        }
+        let (file, index) = match file.rsplit_once('#') {
+            Some((path, index)) => {
+                let index = index.parse().map_err(|_| ParseError { line, reason: format!("bad face index in {file:?}") })?;
+                (path, index)
+            }
+            None => (*file, 0),
+        };
+        entries.push(ManifestEntry {
+            family: (*family).to_owned(),
+            style: (*style).to_owned(),
+            file: file.to_owned(),
+            index,
+            scripts: scripts.split(',').map(str::trim).filter(|s| !s.is_empty()).map(str::to_owned).collect(),
+            licence: (*licence).to_owned(),
+            licence_file: (*licence_file).to_owned(),
+            sha256: (*sha256).to_owned(),
+            source: (*source).to_owned(),
+            role: rest.first().filter(|role| !role.is_empty()).map(|role| (*role).to_owned()),
+        });
+    }
+    Ok(entries)
+}
diff --git a/crates/fonts-build/src/sha256.rs b/crates/fonts-build/src/sha256.rs
new file mode 100644
index 00000000..b80f19a9
--- /dev/null
+++ b/crates/fonts-build/src/sha256.rs
@@ -0,0 +1,46 @@
+//! SHA-256 (FIPS 180-4) of a cut face, for its served file name and Subresource Integrity value.
+
+const K: [u32; 64] = [
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+];
+
+/// The lowercase hex SHA-256 of `data`, as craft-fonts' manifest writes it.
+pub(crate) fn hex(data: &[u8]) -> String {
+    let mut h: [u32; 8] = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
+    let mut message = data.to_vec();
+    message.push(0x80);
+    while message.len() % 64 != 56 {
+        message.push(0);
+    }
+    message.extend_from_slice(&(u64::try_from(data.len()).unwrap_or(u64::MAX).wrapping_mul(8)).to_be_bytes());
+    for block in message.as_chunks::<64>().0 {
+        let mut w = [0u32; 64];
+        for (i, word) in block.as_chunks::<4>().0.iter().enumerate() {
+            w[i] = u32::from_be_bytes(*word);
+        }
+        for i in 16..64 {
+            let s0 = w[i - 15].rotate_right(7) ^ w[i - 15].rotate_right(18) ^ (w[i - 15] >> 3);
+            let s1 = w[i - 2].rotate_right(17) ^ w[i - 2].rotate_right(19) ^ (w[i - 2] >> 10);
+            w[i] = w[i - 16].wrapping_add(s0).wrapping_add(w[i - 7]).wrapping_add(s1);
+        }
+        let [mut a, mut b, mut c, mut d, mut e, mut f, mut g, mut hh] = h;
+        for (k, w) in K.iter().zip(w) {
+            let t1 = hh
+                .wrapping_add(e.rotate_right(6) ^ e.rotate_right(11) ^ e.rotate_right(25))
+                .wrapping_add((e & f) ^ (!e & g))
+                .wrapping_add(*k)
+                .wrapping_add(w);
+            let t2 = (a.rotate_right(2) ^ a.rotate_right(13) ^ a.rotate_right(22)).wrapping_add((a & b) ^ (a & c) ^ (b & c));
+            (hh, g, f, e, d, c, b, a) = (g, f, e, d.wrapping_add(t1), c, b, a, t1.wrapping_add(t2));
+        }
+        for (h, v) in h.iter_mut().zip([a, b, c, d, e, f, g, hh]) {
+            *h = h.wrapping_add(v);
+        }
+    }
+    h.iter().map(|v| format!("{v:08x}")).collect()
+}
diff --git a/crates/fonts-build/src/subset.rs b/crates/fonts-build/src/subset.rs
new file mode 100644
index 00000000..9b4d3579
--- /dev/null
+++ b/crates/fonts-build/src/subset.rs
@@ -0,0 +1,45 @@
+//! Cutting an interface face down to the characters the translation catalogs use, with skera.
+
+use std::collections::BTreeSet;
+
+use skera::{Plan, SubsetFlags, subset_font};
+use skrifa::raw::collections::IntSet;
+use skrifa::raw::types::NameId;
+use skrifa::{FontRef, GlyphId, Tag};
+
+/// Why a face could not be cut.
+#[derive(Debug)]
+pub(crate) enum Failure {
+    /// The face has CFF outlines: skera's CFF output draws the wrong glyphs.
+    NotTrueType,
+    Other(String),
+}
+
+/// Face `index` of `font` with the glyphs of those `chars` it maps and the glyphs its layout tables
+/// reach from them (vertical forms, ligatures). Every layout feature and script is kept; the name
+/// table keeps IDs 0–6 in US English, as fonttools' subsetter does. The same input gives the same
+/// bytes.
+pub(crate) fn subset(font: &[u8], index: u32, chars: &BTreeSet<char>) -> Result<Vec<u8>, Failure> {
+    let font = FontRef::from_index(font, index).map_err(|e| Failure::Other(e.to_string()))?;
+    if font.table_data(Tag::new(b"glyf")).is_none() {
+        return Err(Failure::NotTrueType);
+    }
+    let mut unicodes = IntSet::<u32>::empty();
+    unicodes.extend(chars.iter().map(|&c| u32::from(c)));
+    let mut name_ids = IntSet::<NameId>::empty();
+    name_ids.insert_range(NameId::new(0)..=NameId::new(6));
+    let mut languages = IntSet::<u16>::empty();
+    languages.insert(0x0409);
+    let plan = Plan::new(
+        &IntSet::<GlyphId>::empty(),
+        &unicodes,
+        &font,
+        SubsetFlags::default(),
+        &IntSet::<Tag>::empty(),
+        &IntSet::<Tag>::all(),
+        &IntSet::<Tag>::all(),
+        &name_ids,
+        &languages,
+    );
+    subset_font(&font, &plan).map_err(|e| Failure::Other(e.to_string()))
+}
diff --git a/crates/fonts-build/src/tests.rs b/crates/fonts-build/src/tests.rs
new file mode 100644
index 00000000..f614dc6e
--- /dev/null
+++ b/crates/fonts-build/src/tests.rs
@@ -0,0 +1,694 @@
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use crate::cmap::Cmap;
+use crate::embed::Env;
+use crate::{Embed, EmbeddedFace, Error, parse_manifest};
+
+fn fixture() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixture/craft-fonts")
+}
+
+/// A fresh scratch directory under the system temp dir.
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new(name: &str) -> Self {
+        let dir = std::env::temp_dir().join(format!("craft-fonts-build-{}-{name}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        Self(dir)
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+struct Run {
+    result: Result<Vec<String>, Error>,
+    cargo: Vec<String>,
+    table: String,
+    /// `OUT_DIR`, which holds the table and the cut faces.
+    #[cfg_attr(not(feature = "subset"), expect(dead_code))]
+    out: Scratch,
+}
+
+/// Run `embed` with `CRAFT_FONTS_DIR` and `CRAFT_FONTS_REQUIRED` as given; returns the embedded
+/// face names, the cargo lines and the generated table.
+fn run(embed: Embed, dir: Option<&Path>, required: Option<&str>) -> Run {
+    static RUNS: AtomicUsize = AtomicUsize::new(0);
+    let scratch = Scratch::new(&format!("run-{}", RUNS.fetch_add(1, Ordering::Relaxed)));
+    let env = Env { dir: dir.map(OsString::from), required: required.map(OsString::from), out_dir: Some(scratch.0.clone().into()) };
+    let mut cargo = Vec::new();
+    let result = embed.run(&env, Path::new("craft_fonts.rs"), &mut cargo);
+    let table = std::fs::read_to_string(scratch.0.join("craft_fonts.rs")).unwrap();
+    Run { result: result.map(|faces| faces.iter().map(|f| format!("{} {}", f.family, f.style)).collect()), cargo, table, out: scratch }
+}
+
+#[test]
+fn parses_the_manifest_with_collection_indices() {
+    let text = std::fs::read_to_string(fixture().join("fonts/manifest.txt")).unwrap();
+    let entries = parse_manifest(&text).unwrap();
+    assert_eq!(entries.len(), 6);
+    assert_eq!((entries[0].family.as_str(), entries[0].style.as_str()), ("Sans JP", "Regular"));
+    assert_eq!(entries[0].scripts, ["Jpan", "Latn"]);
+    assert_eq!((entries[0].file.as_str(), entries[0].index), ("fonts/sans-jp/SansJP-Regular.ttf", 0));
+    assert_eq!((entries[4].file.as_str(), entries[4].index), ("fonts/sans-cjk/SansCJK.ttc", 3));
+    assert_eq!(entries[4].scripts, ["Hant-HK", "Latn"]);
+    assert_eq!(entries[4].licence, "OFL-1.1");
+
+    let short = "# comment\n\nA | Regular | a.ttf | Latn\n";
+    let err = parse_manifest(short).unwrap_err();
+    assert_eq!(err.line, 3);
+    assert!(err.to_string().contains("expected 8 fields"), "{err}");
+    let bad_index = "A | Regular | a.ttc#x | Latn | OFL-1.1 | OFL.txt | 00 | src\n";
+    assert!(parse_manifest(bad_index).unwrap_err().to_string().contains("face index"));
+    let ui = "A UI | Regular | a.ttf | Hant | OFL-1.1 | OFL.txt | 00 | src | ui | future field\nA | Regular | a.ttf | Hant | OFL-1.1 | OFL.txt | 00 | src |\n";
+    let entries = parse_manifest(ui).unwrap();
+    assert_eq!(entries[0].role.as_deref(), Some("ui"));
+    assert!(entries[0].is_ui() && entries[0].is_cjk());
+    assert_eq!(entries[1].role, None);
+    assert!(!entries[1].is_ui());
+    assert!(entries.iter().all(|e| e.role.is_none() || e.is_ui()));
+}
+
+#[test]
+fn unset_dir_writes_an_empty_table() {
+    let r = run(Embed::new(), None, None);
+    assert_eq!(r.result.unwrap(), Vec::<String>::new());
+    assert_eq!(r.table.trim(), "&[]");
+    assert!(r.cargo.contains(&"cargo::rerun-if-env-changed=CRAFT_FONTS_DIR".to_owned()));
+    assert!(r.cargo.contains(&"cargo::rerun-if-env-changed=CRAFT_FONTS_REQUIRED".to_owned()));
+    assert!(!r.cargo.iter().any(|l| l.starts_with("cargo::warning")));
+    // Only `1` means required.
+    for value in ["0", "true", "yes", " 1"] {
+        assert!(run(Embed::new(), None, Some(value)).result.is_ok(), "{value:?}");
+    }
+    assert!(run(Embed::new(), Some(Path::new("")), Some("")).result.is_ok());
+}
+
+#[test]
+fn required_fails_without_a_usable_checkout() {
+    for dir in [None, Some(Path::new(""))] {
+        let r = run(Embed::new(), dir, Some("1"));
+        assert!(matches!(r.result, Err(Error::NotSet)), "{dir:?}");
+        assert_eq!(r.table.trim(), "&[]");
+    }
+    let err = run(Embed::new(), None, Some("1")).result.unwrap_err().to_string();
+    assert!(err.contains("CRAFT_FONTS_DIR") && err.contains("CRAFT_FONTS_REQUIRED"), "{err}");
+
+    let missing = Path::new("/nonexistent/craft-fonts");
+    assert!(matches!(run(Embed::new(), Some(missing), Some("1")).result, Err(Error::Read { .. })));
+    let r = run(Embed::new(), Some(missing), None);
+    assert!(r.result.unwrap().is_empty());
+    // Watching a missing manifest would rerun the build script on every build.
+    assert!(!r.cargo.iter().any(|l| l.starts_with("cargo::rerun-if-changed")), "{:?}", r.cargo);
+    assert!(r.cargo.iter().any(|l| l.starts_with("cargo::warning=building without craft-fonts")), "{:?}", r.cargo);
+
+    let scratch = Scratch::new("missing-file");
+    std::fs::create_dir_all(scratch.0.join("fonts")).unwrap();
+    std::fs::write(scratch.0.join("fonts/manifest.txt"), "A | Regular | fonts/a.ttf | Latn | OFL-1.1 | OFL.txt | 00 | src\n").unwrap();
+    assert!(matches!(run(Embed::new(), Some(&scratch.0), Some("1")).result, Err(Error::Read { .. })));
+    std::fs::write(scratch.0.join("fonts/manifest.txt"), "# no faces\n").unwrap();
+    assert!(matches!(run(Embed::new(), Some(&scratch.0), Some("1")).result, Err(Error::NoFaces { .. })));
+}
+
+#[cfg(unix)]
+#[test]
+fn rejects_a_checkout_under_a_non_utf8_path() {
+    use std::os::unix::ffi::OsStrExt;
+    let scratch = Scratch::new("non-utf8");
+    let dir = scratch.0.join(std::ffi::OsStr::from_bytes(b"craft-fonts-\xff"));
+    std::fs::create_dir_all(dir.join("fonts")).unwrap();
+    std::fs::copy(fixture().join("fonts/sans-arabic/SansArabic.ttf"), dir.join("fonts/a.ttf")).unwrap();
+    std::fs::write(dir.join("fonts/manifest.txt"), "A | Regular | fonts/a.ttf | Arab | OFL-1.1 | OFL.txt | 00 | src\n").unwrap();
+    let r = run(Embed::new(), Some(&dir), Some("1"));
+    assert!(matches!(r.result, Err(Error::NonUtf8Path { .. })), "{:?}", r.result);
+    assert_eq!(r.table.trim(), "&[]");
+}
+
+#[test]
+fn embeds_the_selected_scripts() {
+    let r = run(Embed::new(), Some(&fixture()), Some("1"));
+    assert_eq!(r.result.unwrap().len(), 6);
+
+    let r = run(Embed::new().scripts(&["Jpan", "Hant"]), Some(&fixture()), Some("1"));
+    assert_eq!(r.result.unwrap(), ["Sans JP Regular", "Sans JP Bold", "Sans CJK TC Regular", "Sans CJK HK Regular"]);
+    let manifest = fixture().join("fonts/manifest.txt");
+    assert!(r.cargo.contains(&format!("cargo::rerun-if-changed={}", manifest.display())));
+    let jp = fixture().join("fonts/sans-jp/SansJP-Regular.ttf").canonicalize().unwrap();
+    assert!(r.cargo.contains(&format!("cargo::rerun-if-changed={}", jp.display())));
+    assert!(r.table.contains(&format!("include_bytes!({:?})", jp.display().to_string())), "{}", r.table);
+    assert!(r.table.contains("family: \"Sans CJK HK\", style: \"Regular\", scripts: &[\"Hant-HK\", \"Latn\"], index: 3"), "{}", r.table);
+
+    let r = run(Embed::new().scripts(&["Hant-HK"]).filter(|f| f.index != 0), Some(&fixture()), None);
+    assert_eq!(r.result.unwrap(), ["Sans CJK HK Regular"]);
+
+    let r = run(Embed::new().scripts(&["Arab", "Kore", "Geor"]), Some(&fixture()), Some("1"));
+    let Err(Error::MissingScripts { scripts, .. }) = r.result else { panic!("{:?}", r.result) };
+    assert_eq!(scripts, ["Kore", "Geor"]);
+    // Not required: whatever matched is embedded.
+    let r = run(Embed::new().scripts(&["Arab", "Kore"]), Some(&fixture()), None);
+    assert_eq!(r.result.unwrap(), ["Sans Arabic Regular"]);
+}
+
+#[test]
+fn embedded_face_helpers() {
+    let face = |style: &'static str| EmbeddedFace { family: "Sans", style, scripts: &["Hant-HK", "Latn"], index: 0, bytes: b"" };
+    assert_eq!(face("Regular").name(), "Sans Regular");
+    assert!(face("Regular").has_script("Hant") && face("Regular").has_script("Hant-HK") && !face("Regular").has_script("Han"));
+    let weights: Vec<u16> = ["Regular", "Bold", "SemiBold", "Extra Light", "Black Italic", "Italic"].map(|s| face(s).weight()).into();
+    assert_eq!(weights, [400, 700, 600, 200, 900, 400]);
+    assert!(face("Regular").is_cjk());
+    assert!(!EmbeddedFace { scripts: &["Arab"], ..face("Regular") }.is_cjk());
+}
+
+#[test]
+fn documents_embeds_only_the_named_families() {
+    let r = run(Embed::documents(&["Sans JP", "Sans Thai"]), Some(&fixture()), Some("1"));
+    assert_eq!(r.result.unwrap(), ["Sans JP Regular", "Sans JP Bold", "Sans Thai Regular"]);
+    let r = run(Embed::documents(&["Sans JP", "Sans Thai"]).filter(|f| f.style == "Bold"), Some(&fixture()), Some("1"));
+    assert_eq!(r.result.unwrap(), ["Sans JP Bold"]);
+    let r = run(Embed::documents(&[]), Some(&fixture()), None);
+    assert_eq!(r.result.unwrap(), Vec::<String>::new());
+
+    let r = run(Embed::documents(&["Sans JP", "Sans Jp", "Serif"]), Some(&fixture()), Some("1"));
+    let Err(Error::UnknownFamilies { families, .. }) = &r.result else { panic!("{:?}", r.result) };
+    assert_eq!(families, &["Sans Jp", "Serif"]);
+    let message = r.result.unwrap_err().to_string();
+    assert!(
+        message.contains("has no family Sans Jp, Serif") && message.ends_with("Sans JP, Sans Arabic, Sans CJK TC, Sans CJK HK, Sans Thai"),
+        "{message}"
+    );
+    assert_eq!(r.table.trim(), "&[]");
+    // Not required: a warning and an empty table, as for any checkout that can't be used.
+    let r = run(Embed::documents(&["Serif"]), Some(&fixture()), None);
+    assert!(r.result.as_ref().unwrap().is_empty());
+    assert!(warnings(&r).iter().any(|w| w.contains("building without craft-fonts") && w.contains("no family Serif")), "{:?}", r.cargo);
+}
+
+#[test]
+fn serve_copies_the_selected_faces_and_writes_urls() {
+    let scratch = Scratch::new("serve");
+    let served = scratch.0.join("dist/fonts");
+    let env = Env { dir: Some(fixture().into()), required: Some("1".into()), out_dir: Some(scratch.0.clone().into()) };
+    let embed = Embed::new().scripts(&["Jpan", "Hant"]).filter(|f| f.style == "Regular").serve(&served, "fonts/");
+    let mut cargo = Vec::new();
+    let names: Vec<String> =
+        embed.run(&env, Path::new("craft_fonts.rs"), &mut cargo).unwrap().iter().map(|f| format!("{} {}", f.family, f.style)).collect();
+    assert_eq!(names, ["Sans JP Regular", "Sans CJK TC Regular", "Sans CJK HK Regular"]);
+
+    let read = |path: &str| std::fs::read(served.join(path)).unwrap();
+    assert_eq!(read("sans-jp/SansJP-Regular.ttf"), std::fs::read(fixture().join("fonts/sans-jp/SansJP-Regular.ttf")).unwrap());
+    assert_eq!(read("sans-cjk/SansCJK.ttc").len(), 28);
+    assert_eq!(read("sans-jp/OFL.txt"), b"Fixture licence text.\n");
+    assert!(!served.join("sans-jp/SansJP-Bold.ttf").exists() && !served.join("sans-arabic").exists());
+    // Cargo copies a deleted file again, and doesn't rerun for files it just copied.
+    assert!(cargo.contains(&format!("cargo::rerun-if-changed={}", served.join("sans-jp/SansJP-Regular.ttf").display())), "{cargo:?}");
+    assert!(cargo.contains(&format!("cargo::rerun-if-changed={}", served.join("sans-jp/OFL.txt").display())), "{cargo:?}");
+    let modified = |path: &Path| std::fs::metadata(path).unwrap().modified().unwrap();
+    assert_eq!(modified(&served.join("sans-jp/SansJP-Regular.ttf")), modified(&fixture().join("fonts/sans-jp/SansJP-Regular.ttf")));
+
+    let table = std::fs::read_to_string(scratch.0.join("craft_fonts.rs")).unwrap();
+    assert!(!table.contains("include_bytes!"), "{table}");
+    assert!(
+        table.contains(
+            "ServedFace { family: \"Sans JP\", style: \"Regular\", scripts: &[\"Jpan\", \"Latn\"], index: 0, url: \"fonts/sans-jp/SansJP-Regular.ttf\", size: 24, integrity: \"sha256-ydCO8fxp8V6HzlK9qKnCRxTkEl2vflCkDtsaor4Q3/E=\", coverage: b\"\" }"
+        ),
+        "{table}"
+    );
+    // Both faces of the collection name the one served file.
+    assert_eq!(table.matches("url: \"fonts/sans-cjk/SansCJK.ttc\"").count(), 2, "{table}");
+
+    // Without a checkout the table is empty and nothing is copied.
+    let env = Env { dir: None, required: None, out_dir: Some(scratch.0.clone().into()) };
+    let empty = scratch.0.join("empty");
+    assert!(Embed::new().serve(&empty, "fonts/").run(&env, Path::new("craft_fonts.rs"), &mut cargo).unwrap().is_empty());
+    assert_eq!(std::fs::read_to_string(scratch.0.join("craft_fonts.rs")).unwrap().trim(), "&[]");
+    assert!(!empty.exists());
+}
+
+#[test]
+fn serve_replaces_a_stale_copy_of_the_same_size() {
+    let scratch = Scratch::new("serve-stale");
+    let served = scratch.0.join("served");
+    let source = std::fs::read(fixture().join("fonts/sans-jp/SansJP-Regular.ttf")).unwrap();
+    std::fs::create_dir_all(served.join("sans-jp")).unwrap();
+    std::fs::write(served.join("sans-jp/SansJP-Regular.ttf"), vec![0; source.len()]).unwrap();
+    let r = run(Embed::new().scripts(&["Jpan"]).filter(|f| f.style == "Regular").serve(&served, "fonts/"), Some(&fixture()), Some("1"));
+    r.result.unwrap();
+    assert_eq!(std::fs::read(served.join("sans-jp/SansJP-Regular.ttf")).unwrap(), source);
+}
+
+#[test]
+fn integrity_is_base64_of_the_hex_hash() {
+    use crate::embed::integrity;
+    assert_eq!(integrity("c9d08ef1fc69f15e87ce52bda8a9c24714e4125daf7e50a40edb1aa2be10dff1"), "sha256-ydCO8fxp8V6HzlK9qKnCRxTkEl2vflCkDtsaor4Q3/E=");
+    for bad in ["", "00", "zz08ef1fc69f15e87ce52bda8a9c24714e4125daf7e50a40edb1aa2be10dff1"] {
+        assert_eq!(integrity(bad), "", "{bad:?}");
+    }
+}
+
+/// A font with only a `cmap` table: a Windows format 4 subtable with `bmp` segments `(first,
+/// last, glyphs)`, mapped to glyphs 1.. when `glyphs` is `None` and through the glyph array
+/// otherwise, and a format 12 subtable with `groups` `(first, last)` when there are any.
+fn tiny_font(bmp: &[(u16, u16, Option<&[u16]>)], groups: &[(u32, u32)]) -> Vec<u8> {
+    let be16 = |v: &mut Vec<u8>, x: u16| v.extend_from_slice(&x.to_be_bytes());
+    let be32 = |v: &mut Vec<u8>, x: u32| v.extend_from_slice(&x.to_be_bytes());
+
+    let mut segments = bmp.to_vec();
+    segments.push((0xFFFF, 0xFFFF, None));
+    let n = u16::try_from(segments.len()).unwrap();
+    let (mut ends, mut starts, mut deltas, mut offsets, mut glyphs) = (vec![], vec![], vec![], vec![], vec![]);
+    for (i, &(first, last, ids)) in segments.iter().enumerate() {
+        be16(&mut ends, last);
+        be16(&mut starts, first);
+        match ids {
+            None => {
+                // The last segment maps 0xFFFF to glyph 0, as fonts do.
+                be16(&mut deltas, 1u16.wrapping_sub(if first == 0xFFFF { 0 } else { first }));
+                be16(&mut offsets, 0);
+            }
+            Some(ids) => {
+                be16(&mut deltas, 0);
+                be16(&mut offsets, 2 * (n - u16::try_from(i).unwrap()) + u16::try_from(glyphs.len()).unwrap());
+                ids.iter().for_each(|&g| be16(&mut glyphs, g));
+            }
+        }
+    }
+    let mut format4 = vec![];
+    for x in [4, 0, 0, 2 * n, 0, 0, 0] {
+        be16(&mut format4, x);
+    }
+    format4.extend(ends.iter().chain(&[0, 0]).chain(&starts).chain(&deltas).chain(&offsets).chain(&glyphs));
+    let len = u16::try_from(format4.len()).unwrap();
+    format4[2..4].copy_from_slice(&len.to_be_bytes());
+
+    let mut format12 = vec![];
+    be16(&mut format12, 12);
+    be16(&mut format12, 0);
+    be32(&mut format12, 16 + 12 * u32::try_from(groups.len()).unwrap());
+    be32(&mut format12, 0);
+    be32(&mut format12, u32::try_from(groups.len()).unwrap());
+    for &(first, last) in groups {
+        [first, last, 1].into_iter().for_each(|x| be32(&mut format12, x));
+    }
+
+    let subtables: Vec<(u16, Vec<u8>)> = [(1, format4), (10, format12)].into_iter().filter(|(enc, _)| *enc == 1 || !groups.is_empty()).collect();
+    let mut cmap = vec![];
+    be16(&mut cmap, 0);
+    be16(&mut cmap, u16::try_from(subtables.len()).unwrap());
+    let mut at = 4 + 8 * u32::try_from(subtables.len()).unwrap();
+    for (encoding, table) in &subtables {
+        [3, *encoding].into_iter().for_each(|x| be16(&mut cmap, x));
+        be32(&mut cmap, at);
+        at += u32::try_from(table.len()).unwrap();
+    }
+    subtables.iter().for_each(|(_, table)| cmap.extend(table));
+
+    let mut font = vec![];
+    be32(&mut font, 0x0001_0000);
+    for x in [1, 0, 0, 0] {
+        be16(&mut font, x);
+    }
+    font.extend_from_slice(b"cmap");
+    for x in [0, 28, u32::try_from(cmap.len()).unwrap()] {
+        be32(&mut font, x);
+    }
+    font.extend(cmap);
+    font
+}
+
+/// A `.ttc` of fonts made by [`tiny_font`].
+fn tiny_collection(fonts: &[Vec<u8>]) -> Vec<u8> {
+    let header = 12 + 4 * fonts.len();
+    let mut ttc = b"ttcf\0\x01\0\0".to_vec();
+    ttc.extend_from_slice(&u32::try_from(fonts.len()).unwrap().to_be_bytes());
+    let mut body = vec![];
+    for font in fonts {
+        let start = u32::try_from(header + body.len()).unwrap();
+        ttc.extend_from_slice(&start.to_be_bytes());
+        let mut font = font.clone();
+        // The table offsets of a collection's faces count from the start of the file.
+        let offset = u32::from_be_bytes(font[20..24].try_into().unwrap()) + start;
+        font[20..24].copy_from_slice(&offset.to_be_bytes());
+        body.extend(font);
+    }
+    ttc.extend(body);
+    ttc
+}
+
+#[test]
+fn cmap_reads_formats_4_and_12_and_collections() {
+    let font = tiny_font(&[(0x41, 0x5A, None), (0x4E00, 0x4E02, Some(&[5, 0, 7]))], &[(0x2_0000, 0x2_0001)]);
+    let cmap = Cmap::read(&font, 0).unwrap();
+    let covered: Vec<char> = "AZa一丁丂七\u{FFFF}\u{20000}\u{20001}\u{20002}".chars().filter(|&c| cmap.covers(c)).collect();
+    assert_eq!(covered, ['A', 'Z', '一', '丂', '\u{20000}', '\u{20001}']);
+
+    let bmp_in_format12 = tiny_font(&[], &[(0x4E00, 0x4E0F)]);
+    assert!(Cmap::read(&bmp_in_format12, 0).unwrap().covers('丁'));
+
+    let ttc = tiny_collection(&[tiny_font(&[(0x41, 0x41, None)], &[]), tiny_font(&[(0x4E00, 0x4E00, None)], &[])]);
+    let second = Cmap::read(&ttc, 1).unwrap();
+    assert!(second.covers('一') && !second.covers('A'));
+    assert!(Cmap::read(&ttc, 0).unwrap().covers('A'));
+    assert!(Cmap::read(&ttc, 2).is_none());
+    assert!(Cmap::read(b"fixture: Sans JP Regular", 0).is_none());
+    assert!(Cmap::read(&font[..40], 0).is_none());
+}
+
+#[test]
+fn cmap_reads_each_subtable_within_its_declared_length() {
+    // 'A' takes its glyph from an empty glyph array, so the read lands on the format 12 subtable
+    // that follows the format 4 one.
+    let font = tiny_font(&[(0x41, 0x41, Some(&[]))], &[(0x2_0000, 0x2_0000)]);
+    let cmap = Cmap::read(&font, 0).unwrap();
+    assert!(!cmap.covers('A') && cmap.covers('\u{20000}'));
+
+    // A format 4 length past the end of the table is clamped rather than rejected. The format 4
+    // subtable starts after the 28-byte font header, the 4-byte cmap header and two 8-byte encoding
+    // records.
+    let mut font = tiny_font(&[(0x41, 0x5A, None)], &[(0x2_0000, 0x2_0000)]);
+    let format4 = 28 + 4 + 2 * 8;
+    let format12 = format4 + usize::from(u16::from_be_bytes(font[format4 + 2..format4 + 4].try_into().unwrap()));
+    font[format4 + 2..format4 + 4].copy_from_slice(&u16::MAX.to_be_bytes());
+    assert!(Cmap::read(&font, 0).unwrap().covers('A'));
+
+    // A format 12 group past the declared length doesn't count.
+    font[format12 + 4..format12 + 8].copy_from_slice(&16u32.to_be_bytes());
+    let cmap = Cmap::read(&font, 0).unwrap();
+    assert!(cmap.covers('A') && !cmap.covers('\u{20000}'));
+}
+
+/// A craft-fonts checkout in `scratch` with these `(family, scripts, role, font)` faces, all
+/// Regular.
+fn checkout(scratch: &Scratch, faces: &[(&str, &str, &str, Vec<u8>)]) -> PathBuf {
+    let dir = scratch.0.join("craft-fonts");
+    std::fs::create_dir_all(dir.join("fonts")).unwrap();
+    let mut manifest = String::new();
+    for (i, (family, scripts, role, font)) in faces.iter().enumerate() {
+        std::fs::write(dir.join(format!("fonts/{i}.ttf")), font).unwrap();
+        manifest += &format!("{family} | Regular | fonts/{i}.ttf | {scripts} | OFL-1.1 | fonts/OFL.txt | 00 | src | {role}\n");
+    }
+    std::fs::write(dir.join("fonts/manifest.txt"), manifest).unwrap();
+    dir
+}
+
+fn warnings(r: &Run) -> Vec<String> {
+    r.cargo.iter().filter(|l| l.starts_with("cargo::warning")).cloned().collect()
+}
+
+#[test]
+fn for_ui_embeds_cjk_faces_only_as_cut_interface_faces() {
+    let scratch = Scratch::new("for-ui");
+    let latin = || tiny_font(&[(0x20, 0x7E, None)], &[]);
+    let dir = checkout(
+        &scratch,
+        &[
+            ("Noto Sans TC", "Hant,Latn", "", latin()),
+            ("Noto Sans TC UI", "Hant,Latn", "ui", latin()),
+            ("Noto Sans HK UI", "Hant-HK,Latn", "ui", latin()),
+            ("Noto Sans Arabic", "Arab", "", latin()),
+        ],
+    );
+    // Without catalogs to cut them to, the interface faces are left out too.
+    let r = run(Embed::new().for_ui(), Some(&dir), None);
+    assert_eq!(r.result.as_ref().unwrap(), &["Noto Sans Arabic Regular"]);
+    let w = warnings(&r);
+    assert_eq!(w.len(), 1, "{w:#?}");
+    assert!(w[0].contains("not embedding the interface faces Noto Sans TC UI Regular, Noto Sans HK UI Regular"), "{}", w[0]);
+    assert!(w[0].contains("Embed::subset_to"), "{}", w[0]);
+    // A manifest without interface faces loses every CJK face, which is worth a warning.
+    let r = run(Embed::new().for_ui(), Some(&fixture()), None);
+    assert!(r.cargo.contains(&format!("cargo::rerun-if-changed={}", fixture().join("fonts/manifest.txt").display())), "{:?}", r.cargo);
+    let w = warnings(&r);
+    assert_eq!(w.len(), 1, "{w:#?}");
+    assert!(w[0].contains("not embedding any CJK face for the interface") && w[0].contains("role `ui`"), "{}", w[0]);
+    let r = run(Embed::new().for_ui().scripts(&["Hant", "Arab"]), Some(&dir), Some("1"));
+    let Err(Error::MissingScripts { scripts, .. }) = r.result else { panic!("{:?}", r.result) };
+    assert_eq!(scripts, ["Hant"]);
+    assert_eq!(r.table.trim(), "&[]");
+    // Without `for_ui` the interface faces' sources are left out, unless a document table names them.
+    let r = run(Embed::new().scripts(&["Hant"]), Some(&dir), Some("1"));
+    assert_eq!(r.result.as_ref().unwrap(), &["Noto Sans TC Regular"]);
+    assert_eq!(warnings(&r), Vec::<String>::new());
+    let r = run(Embed::documents(&["Noto Sans TC UI", "Noto Sans TC"]), Some(&dir), Some("1"));
+    assert_eq!(r.result.as_ref().unwrap(), &["Noto Sans TC Regular", "Noto Sans TC UI Regular"]);
+    assert!(r.table.contains("fonts/1.ttf"), "{}", r.table);
+}
+
+#[test]
+fn check_text_warns_about_characters_no_face_covers() {
+    let scratch = Scratch::new("check-text");
+    let dir = checkout(
+        &scratch,
+        &[
+            ("Noto Sans TC", "Hant,Latn", "", tiny_font(&[(0x20, 0x7E, None), (0x4E00, 0x4E03, None)], &[])),
+            ("Noto Sans Arabic", "Arab", "", tiny_font(&[(0x600, 0x6FF, None)], &[])),
+            ("Noto Sans SC", "Hans,Latn", "", tiny_font(&[(0x20, 0x7E, None), (0x3000, 0x9FFF, None)], &[])),
+        ],
+    );
+    let catalogs = scratch.0.join("i18n");
+    std::fs::create_dir_all(&catalogs).unwrap();
+    std::fs::write(catalogs.join("zh-TW.ftl"), "\u{FEFF}open = 一丁万。\nclose = 丁万\u{FE0F} \u{1F600}\n").unwrap();
+    std::fs::write(catalogs.join("ar.ftl"), "open = فتح\nok = 一\n").unwrap();
+    let long: String = (0x4E10..0x4E20).filter_map(char::from_u32).collect();
+    std::fs::write(catalogs.join("long.ftl"), format!("x = {long}\n")).unwrap();
+    let paths = ["zh-TW.ftl", "ar.ftl", "long.ftl", "missing.ftl"].map(|f| catalogs.join(f));
+
+    let r = run(Embed::new().scripts(&["Hant", "Arab"]).check_text(paths.clone()), Some(&dir), None);
+    assert_eq!(r.result.as_ref().unwrap().len(), 2);
+    for path in &paths {
+        assert!(r.cargo.contains(&format!("cargo::rerun-if-changed={}", path.display())), "{:?}", r.cargo);
+    }
+    let w = warnings(&r);
+    assert_eq!(w.len(), 3, "{w:#?}");
+    assert!(w[0].contains("zh-TW.ftl has 2 characters no embedded face covers (万。); system fonts"), "{}", w[0]);
+    assert!(w[1].contains("long.ftl has 16 characters") && w[1].contains("(丐丑丒专且丕世丗 …)"), "{}", w[1]);
+    assert!(w[2].contains("cannot check") && w[2].contains("missing.ftl"), "{}", w[2]);
+
+    // The full face covers everything; without a checkout there is nothing to check.
+    let r = run(Embed::new().check_text(paths[..3].to_vec()), Some(&dir), None);
+    assert_eq!(warnings(&r), Vec::<String>::new());
+    let r = run(Embed::new().check_text(paths.clone()), None, None);
+    assert_eq!(warnings(&r), Vec::<String>::new());
+    assert!(r.cargo.contains(&format!("cargo::rerun-if-changed={}", paths[0].display())));
+
+    // Faces another table embeds count as covering their characters.
+    let r = run(Embed::new().scripts(&["Arab"]).embedded_elsewhere(&["Noto Sans SC"]).check_text(paths[..3].to_vec()), Some(&dir), None);
+    assert_eq!(warnings(&r), Vec::<String>::new());
+    let r = run(
+        Embed::new().scripts(&["Arab"]).embedded_elsewhere(&["Noto Sans TC", "Noto Sans Math"]).check_text(paths[..2].to_vec()),
+        Some(&dir),
+        None,
+    );
+    let w = warnings(&r);
+    assert_eq!(w.len(), 2, "{w:#?}");
+    assert!(w[0].contains("embedded_elsewhere names Noto Sans Math, which") && w[0].ends_with("manifest.txt lacks"), "{}", w[0]);
+    assert!(w[1].contains("zh-TW.ftl has 2 characters no embedded face covers (万。)"), "{}", w[1]);
+
+    // The fixture's "fonts" are text, so they cover nothing.
+    let r = run(Embed::new().scripts(&["Arab"]).check_text([&paths[1]]), Some(&fixture()), None);
+    let w = warnings(&r);
+    assert!(w[0].contains("cannot read the character map of Sans Arabic Regular"), "{w:#?}");
+    assert!(w[1].contains("ar.ftl has 1 character no embedded face covers (一)"), "{w:#?}");
+}
+
+#[cfg(feature = "subset")]
+mod subset {
+    use std::collections::BTreeSet;
+    use std::path::{Path, PathBuf};
+
+    use super::{Run, Scratch, checkout, run, tiny_font, warnings};
+    use crate::cmap::Cmap;
+    use crate::{Embed, Error};
+
+    /// `fixture/subset/make-fonts.py` writes these.
+    fn tiny(file: &str) -> Vec<u8> {
+        std::fs::read(Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixture/subset").join(file)).unwrap()
+    }
+
+    /// The BMP characters `font` maps.
+    fn mapped(font: &[u8]) -> Vec<u32> {
+        let cmap = Cmap::read(font, 0).unwrap();
+        ('\0'..='\u{FFFF}').filter(|&c| cmap.covers(c)).map(u32::from).collect()
+    }
+
+    fn table<'a>(font: &'a [u8], tag: &[u8; 4]) -> Option<&'a [u8]> {
+        let u16_at = |at: usize| usize::from(u16::from_be_bytes([font[at], font[at + 1]]));
+        let u32_at = |at: usize| usize::try_from(u32::from_be_bytes(font[at..at + 4].try_into().unwrap())).unwrap();
+        let record = (0..u16_at(4)).map(|i| 12 + 16 * i).find(|&r| &font[r..r + 4] == tag)?;
+        Some(&font[u32_at(record + 8)..][..u32_at(record + 12)])
+    }
+
+    /// The feature tags of a GSUB or GPOS table.
+    fn features(table: &[u8]) -> BTreeSet<String> {
+        let list = usize::from(u16::from_be_bytes([table[6], table[7]]));
+        let count = usize::from(u16::from_be_bytes([table[list], table[list + 1]]));
+        (0..count).map(|i| String::from_utf8_lossy(&table[list + 2 + 6 * i..][..4]).into_owned()).collect()
+    }
+
+    fn glyph_count(font: &[u8]) -> u16 {
+        let maxp = table(font, b"maxp").unwrap();
+        u16::from_be_bytes([maxp[4], maxp[5]])
+    }
+
+    fn cut_file(r: &Run, family: &str) -> PathBuf {
+        r.out.0.join("craft-fonts-ui").join(format!("{}-Regular.ttf", family.replace(' ', "-")))
+    }
+
+    #[test]
+    fn subset_to_cuts_interface_faces_to_the_catalogs() {
+        let scratch = Scratch::new("subset");
+        let latin = || tiny_font(&[(0x20, 0x7E, None)], &[]);
+        let dir = checkout(
+            &scratch,
+            &[
+                ("Noto Sans TC", "Hant,Latn", "", latin()),
+                ("Noto Sans TC UI", "Hant,Latn", "ui", tiny("Tiny-glyf.ttf")),
+                ("Noto Sans HK UI", "Hant-HK,Latn", "ui", tiny("Tiny-glyf.ttf")),
+                ("Noto Sans Arabic", "Arab", "", latin()),
+            ],
+        );
+        let tw = scratch.0.join("zh-TW.tsv");
+        std::fs::write(&tw, "Open\t一万\n").unwrap();
+        let ko = scratch.0.join("ko.tsv");
+        std::fs::write(&ko, "Open\t丁\u{FE0F} \u{1F600}\n").unwrap();
+
+        let r = run(Embed::new().subset_to([&tw]).scripts(&["Hant"]), Some(&dir), Some("1"));
+        assert_eq!(r.result.as_ref().unwrap(), &["Noto Sans TC UI Regular", "Noto Sans HK UI Regular"]);
+        let tc = cut_file(&r, "Noto Sans TC UI");
+        assert!(r.table.contains(&format!("index: 0, bytes: include_bytes!({:?})", tc.display().to_string())), "{}", r.table);
+        assert!(r.cargo.contains(&format!("cargo::rerun-if-changed={}", tw.display())), "{:?}", r.cargo);
+        let cut = std::fs::read(&tc).unwrap();
+        // The catalog's 一, plus the punctuation, kana and full-width forms the source has; not
+        // its Latin, nor the 丁 and 七 no catalog uses.
+        assert_eq!(mapped(&cut), [0x3001, 0x300C, 0x3042, 0x4E00, 0xFF01]);
+        assert!(table(&cut, b"glyf").is_some());
+        assert_eq!(features(table(&cut, b"GSUB").unwrap()), BTreeSet::from(["vert".to_owned()]));
+        // .notdef, five characters and the vertical form of U+300C.
+        assert_eq!(glyph_count(&cut), 7);
+        // The source lacks 万, so system fonts draw it.
+        let w = warnings(&r);
+        assert_eq!(w.len(), 1, "{w:#?}");
+        assert!(w[0].contains("zh-TW.tsv has 1 character no embedded face covers (万)"), "{}", w[0]);
+
+        // The same bytes on every run. Another catalog adds its characters, but no emoji or
+        // variation selector, and a `check_text` file is only checked.
+        let again = run(Embed::new().for_ui().subset_to([&tw]), Some(&dir), None);
+        assert_eq!(std::fs::read(cut_file(&again, "Noto Sans TC UI")).unwrap(), cut);
+        let r = run(Embed::new().subset_to([&tw, &ko]).check_text([scratch.0.join("zh-TW.tsv")]), Some(&dir), None);
+        assert_eq!(mapped(&std::fs::read(cut_file(&r, "Noto Sans TC UI")).unwrap()), [0x3001, 0x300C, 0x3042, 0x4E00, 0x4E01, 0xFF01]);
+        assert_eq!(warnings(&r).len(), 1, "{:#?}", warnings(&r));
+
+        // No catalogs (an app whose CRAFT_I18N_DIR is unset) leaves the faces out, not cut to kana.
+        let r = run(Embed::new().subset_to(Vec::<PathBuf>::new()), Some(&dir), None);
+        assert_eq!(r.result.as_ref().unwrap(), &["Noto Sans Arabic Regular"]);
+        let w = warnings(&r);
+        assert_eq!(w.len(), 1, "{w:#?}");
+        assert!(w[0].contains("Noto Sans TC UI Regular") && w[0].contains("given no translation catalogs"), "{}", w[0]);
+    }
+
+    #[test]
+    fn subset_to_rejects_cff_interface_faces() {
+        let scratch = Scratch::new("subset-cff");
+        let dir = checkout(&scratch, &[("Noto Sans SC UI", "Hans", "ui", tiny("Tiny-cff.otf"))]);
+        let catalog = scratch.0.join("zh-CN.tsv");
+        std::fs::write(&catalog, "Open\t一\n").unwrap();
+        for required in [None, Some("1")] {
+            let r = run(Embed::new().subset_to([&catalog]), Some(&dir), required);
+            let Err(e @ Error::NotTrueType { .. }) = r.result else { panic!("{:?}", r.result) };
+            assert!(e.to_string().contains("0.ttf has CFF outlines"), "{e}");
+            assert_eq!(r.table.trim(), "&[]");
+        }
+    }
+
+    #[test]
+    fn subset_to_serves_the_cut_under_its_hash() {
+        let scratch = Scratch::new("subset-serve");
+        let dir = checkout(&scratch, &[("Noto Sans TC UI", "Hant,Latn", "ui", tiny("Tiny-glyf.ttf"))]);
+        let catalog = scratch.0.join("zh-TW.tsv");
+        std::fs::write(&catalog, "Open\t一\n").unwrap();
+        let served = scratch.0.join("served");
+        let r = run(Embed::new().subset_to([&catalog]).serve(&served, "fonts/"), Some(&dir), Some("1"));
+        assert_eq!(r.result.as_ref().unwrap(), &["Noto Sans TC UI Regular"]);
+        let cut = std::fs::read(cut_file(&r, "Noto Sans TC UI")).unwrap();
+        let sha256 = crate::sha256::hex(&cut);
+        let file = format!("{}.{}.ttf", 0, &sha256[..16]);
+        assert_eq!(std::fs::read(served.join(&file)).unwrap(), cut);
+        assert!(!served.join("0.ttf").exists());
+        let line = format!("url: \"fonts/{file}\", size: {}, integrity: {:?}, coverage: ", cut.len(), crate::embed::integrity(&sha256));
+        assert!(r.table.contains(&line), "{}\n{line}", r.table);
+    }
+
+    #[test]
+    fn sha256_matches_the_standard_vectors() {
+        use crate::sha256::hex;
+        assert_eq!(hex(b""), "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
+        assert_eq!(hex(b"abc"), "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");
+        assert_eq!(
+            hex(b"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"),
+            "248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1"
+        );
+        assert_eq!(hex(&vec![b'a'; 1_000_000]), "cdc76e5c9914fb9281a1c7e284d73e67f1809a48a497200e046d39ccc7112cd0");
+    }
+
+    /// With `CRAFT_FONTS_DIR` set to a craft-fonts checkout, cut its BIZ UDPGothic Regular.
+    #[test]
+    fn cuts_biz_udpgothic() {
+        let Some(dir) = std::env::var_os("CRAFT_FONTS_DIR").filter(|dir| !dir.is_empty()) else { return };
+        let Ok(source) = std::fs::read(Path::new(&dir).join("fonts/biz-ud-pgothic/BIZUDPGothic-Regular.ttf")) else { return };
+        let chars: BTreeSet<char> = "ファイルを開く「新規」、保存。編集表示".chars().collect();
+        let cut = crate::subset::subset(&source, 0, &chars).unwrap();
+        let (source_cmap, cmap) = (Cmap::read(&source, 0).unwrap(), Cmap::read(&cut, 0).unwrap());
+        assert!(chars.iter().all(|&c| cmap.covers(c) == source_cmap.covers(c)));
+        assert!(!cmap.covers('A') && !cmap.covers('漢'));
+        assert!(features(table(&cut, b"GSUB").unwrap()).contains("vert"));
+        assert!(cut.len() < source.len() / 20, "{} of {} bytes", cut.len(), source.len());
+        assert_eq!(crate::subset::subset(&source, 0, &chars).unwrap(), cut);
+    }
+}
+
+#[test]
+fn for_ui_serves_no_whole_cjk_face() {
+    let scratch = Scratch::new("for-ui-serve");
+    let dir = checkout(
+        &scratch,
+        &[
+            ("Noto Sans TC", "Hant,Latn", "", b"full".to_vec()),
+            ("Noto Sans TC UI", "Hant,Latn", "ui", b"source".to_vec()),
+            ("Noto Sans Arabic", "Arab", "", b"arabic".to_vec()),
+        ],
+    );
+    let served = scratch.0.join("served");
+    let r = run(Embed::new().for_ui().serve(&served, "fonts/"), Some(&dir), None);
+    assert_eq!(r.result.unwrap(), ["Noto Sans Arabic Regular"]);
+    assert_eq!(std::fs::read(served.join("2.ttf")).unwrap(), b"arabic");
+    assert!(!served.join("0.ttf").exists() && !served.join("1.ttf").exists());
+}
+
+#[test]
+fn served_faces_carry_the_characters_their_cmap_maps() {
+    let font = tiny_font(&[(0x41, 0x5A, None), (0x4E00, 0x4E02, Some(&[5, 0, 7]))], &[(0x4E03, 0x4E03), (0x2_0000, 0x2_0001)]);
+    let coverage = crate::coverage::of_face(&font, 0).unwrap();
+    assert_eq!(Cmap::read(&font, 0).unwrap().ranges(), [(0x41, 0x5A), (0x4E00, 0x4E00), (0x4E02, 0x4E03), (0x2_0000, 0x2_0001)]);
+    let covered: Vec<char> =
+        "@AZ[一丁丂七丄\u{FFFF}\u{20000}\u{20001}\u{20002}".chars().filter(|&c| crate::coverage::contains(&coverage, c)).collect();
+    assert_eq!(covered, ['A', 'Z', '一', '丂', '七', '\u{20000}', '\u{20001}']);
+    assert!(!crate::coverage::contains(&[], 'A') && !crate::coverage::contains(&[0x80], 'A'));
+    assert_eq!(crate::coverage::encode(&[(0, 0x10_FFFF)]), [0, 0xFF, 0xFF, 0x43]);
+
+    let scratch = Scratch::new("serve-coverage");
+    let dir = checkout(&scratch, &[("Noto Sans", "Latn", "", font), ("Broken", "Latn", "", b"not a font".to_vec())]);
+    let r = run(Embed::new().serve(scratch.0.join("served"), "fonts/"), Some(&dir), None);
+    assert_eq!(r.result.as_ref().unwrap().len(), 2);
+    let table = &r.table;
+    // Gaps and lengths 0x41 0x19, 0x4DA5 0, 1 1, 0x1_B1FC 1 as LEB128.
+    assert!(table.contains(r#"coverage: b"A\x19\xa5\x9b\x01\x00\x01\x01\xfc\xe3\x06\x01" }"#), "{table}");
+    assert!(table.contains(r#"family: "Broken""#) && table.ends_with("coverage: b\"\" },\n]\n"), "{table}");
+    assert!(warnings(&r).iter().any(|w| w.contains("no character map in fonts/1.ttf")), "{:?}", warnings(&r));
+}
diff --git a/crates/fonts-build/tests/consumer/Cargo.toml b/crates/fonts-build/tests/consumer/Cargo.toml
new file mode 100644
index 00000000..f3890b40
--- /dev/null
+++ b/crates/fonts-build/tests/consumer/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "craft-fonts-build-consumer"
+description = "Test crate: a build.rs that embeds the craft-fonts-build fixture the way an app does."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+publish = false
+
+[dependencies]
+craft-fonts-build = { path = "../.." }
+
+[build-dependencies]
+craft-fonts-build = { path = "../.." }
+
+[lints]
+workspace = true
diff --git a/crates/fonts-build/tests/consumer/build.rs b/crates/fonts-build/tests/consumer/build.rs
new file mode 100644
index 00000000..b0eff6f6
--- /dev/null
+++ b/crates/fonts-build/tests/consumer/build.rs
@@ -0,0 +1,21 @@
+//! Embeds the fixture checkout in `../fixture/craft-fonts` the way an app's build.rs embeds
+//! `CRAFT_FONTS_DIR`, so the generated tables are compiled by a real `include!`: once embedded and
+//! once served from `OUT_DIR/served`.
+use std::path::PathBuf;
+
+fn main() {
+    let root = PathBuf::from(std::env::var_os("CARGO_MANIFEST_DIR").unwrap_or_default());
+    let out = PathBuf::from(std::env::var_os("OUT_DIR").unwrap_or_default());
+    let fonts = || {
+        craft_fonts_build::Embed::new()
+            .dir(root.join("../fixture/craft-fonts"))
+            .required(true)
+            .scripts(&["Jpan", "Hant"])
+            .filter(|face| face.style == "Regular")
+    };
+    let embedded = fonts().write("craft_fonts.rs");
+    let served = fonts().serve(out.join("served"), "fonts/").write("craft_fonts_served.rs");
+    if let Err(e) = embedded.and(served) {
+        println!("cargo::error={e}");
+    }
+}
diff --git a/crates/fonts-build/tests/consumer/src/lib.rs b/crates/fonts-build/tests/consumer/src/lib.rs
new file mode 100644
index 00000000..08903453
--- /dev/null
+++ b/crates/fonts-build/tests/consumer/src/lib.rs
@@ -0,0 +1,9 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+//! The fixture faces as an app's crate sees them; read by `craft-fonts-build`'s tests.
+
+use craft_fonts_build::{EmbeddedFace, ServedFace};
+
+pub static CRAFT_FONTS: &[EmbeddedFace] = include!(concat!(env!("OUT_DIR"), "/craft_fonts.rs"));
+
+pub static CRAFT_FONTS_SERVED: &[ServedFace] = include!(concat!(env!("OUT_DIR"), "/craft_fonts_served.rs"));
diff --git a/crates/fonts-build/tests/fixture/craft-fonts/fonts/manifest.txt b/crates/fonts-build/tests/fixture/craft-fonts/fonts/manifest.txt
new file mode 100644
index 00000000..6a69eb3c
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/craft-fonts/fonts/manifest.txt
@@ -0,0 +1,10 @@
+# Test fixture in the craft-fonts manifest format. The "font files" are short text files:
+# embedding copies bytes and never parses them.
+#   family | style | file | scripts | licence | licence file | sha256 | source
+
+Sans JP | Regular | fonts/sans-jp/SansJP-Regular.ttf | Jpan,Latn | OFL-1.1 | fonts/sans-jp/OFL.txt | c9d08ef1fc69f15e87ce52bda8a9c24714e4125daf7e50a40edb1aa2be10dff1 | https://example.invalid/sans-jp
+Sans JP | Bold | fonts/sans-jp/SansJP-Bold.ttf | Jpan,Latn | OFL-1.1 | fonts/sans-jp/OFL.txt | a135adabc1facd7a49fa4ef04771f74ffe69e67418e0e0f0b81a4cebba776e48 | https://example.invalid/sans-jp
+Sans Arabic | Regular | fonts/sans-arabic/SansArabic.ttf | Arab | OFL-1.1 | fonts/sans-arabic/OFL.txt | 318d7469dd372ff3ad458d46ea714c0ea969696675794d6100396f8a11103514 | https://example.invalid/sans-arabic
+Sans CJK TC | Regular | fonts/sans-cjk/SansCJK.ttc#2 | Hant,Latn | OFL-1.1 | fonts/sans-cjk/OFL.txt | 2fecde232d5dcda26a2299664dae1a2c50ad92b694575c5cfa70207010b339be | https://example.invalid/sans-cjk
+Sans CJK HK | Regular | fonts/sans-cjk/SansCJK.ttc#3 | Hant-HK,Latn | OFL-1.1 | fonts/sans-cjk/OFL.txt | 2fecde232d5dcda26a2299664dae1a2c50ad92b694575c5cfa70207010b339be | https://example.invalid/sans-cjk
+Sans Thai | Regular | fonts/sans-thai/SansThai.ttf | Thai | OFL-1.1 | fonts/sans-thai/OFL.txt | 5960276bcbad8e7949804d35651ebf42e17648f4d128c71ccdb76167a5337944 | https://example.invalid/sans-thai
diff --git a/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-arabic/OFL.txt b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-arabic/OFL.txt
new file mode 100644
index 00000000..3bee431c
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-arabic/OFL.txt
@@ -0,0 +1 @@
+Fixture licence text.
diff --git a/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-arabic/SansArabic.ttf b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-arabic/SansArabic.ttf
new file mode 100644
index 00000000..a6668de1
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-arabic/SansArabic.ttf
@@ -0,0 +1 @@
+fixture: Sans Arabic
\ No newline at end of file
diff --git a/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-cjk/OFL.txt b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-cjk/OFL.txt
new file mode 100644
index 00000000..3bee431c
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-cjk/OFL.txt
@@ -0,0 +1 @@
+Fixture licence text.
diff --git a/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-cjk/SansCJK.ttc b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-cjk/SansCJK.ttc
new file mode 100644
index 00000000..5c3ff9b4
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-cjk/SansCJK.ttc
@@ -0,0 +1 @@
+fixture: Sans CJK collection
\ No newline at end of file
diff --git a/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-jp/OFL.txt b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-jp/OFL.txt
new file mode 100644
index 00000000..3bee431c
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-jp/OFL.txt
@@ -0,0 +1 @@
+Fixture licence text.
diff --git a/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-jp/SansJP-Bold.ttf b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-jp/SansJP-Bold.ttf
new file mode 100644
index 00000000..be10af0a
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-jp/SansJP-Bold.ttf
@@ -0,0 +1 @@
+fixture: Sans JP Bold
\ No newline at end of file
diff --git a/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-jp/SansJP-Regular.ttf b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-jp/SansJP-Regular.ttf
new file mode 100644
index 00000000..433a7e1b
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-jp/SansJP-Regular.ttf
@@ -0,0 +1 @@
+fixture: Sans JP Regular
\ No newline at end of file
diff --git a/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-thai/OFL.txt b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-thai/OFL.txt
new file mode 100644
index 00000000..3bee431c
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-thai/OFL.txt
@@ -0,0 +1 @@
+Fixture licence text.
diff --git a/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-thai/SansThai.ttf b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-thai/SansThai.ttf
new file mode 100644
index 00000000..650469a6
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/craft-fonts/fonts/sans-thai/SansThai.ttf
@@ -0,0 +1 @@
+fixture: Sans Thai
\ No newline at end of file
diff --git a/crates/fonts-build/tests/fixture/subset/Tiny-cff.otf b/crates/fonts-build/tests/fixture/subset/Tiny-cff.otf
new file mode 100644
index 00000000..57c7dec8
Binary files /dev/null and b/crates/fonts-build/tests/fixture/subset/Tiny-cff.otf differ
diff --git a/crates/fonts-build/tests/fixture/subset/Tiny-glyf.ttf b/crates/fonts-build/tests/fixture/subset/Tiny-glyf.ttf
new file mode 100644
index 00000000..e40d2141
Binary files /dev/null and b/crates/fonts-build/tests/fixture/subset/Tiny-glyf.ttf differ
diff --git a/crates/fonts-build/tests/fixture/subset/make-fonts.py b/crates/fonts-build/tests/fixture/subset/make-fonts.py
new file mode 100755
index 00000000..ae29f3bd
--- /dev/null
+++ b/crates/fonts-build/tests/fixture/subset/make-fonts.py
@@ -0,0 +1,80 @@
+#!/usr/bin/env -S uv run --script
+# /// script
+# requires-python = ">=3.10"
+# dependencies = ["fonttools==4.67.0"]
+# ///
+"""Write the subsetting fixtures next to this script: Tiny-glyf.ttf (TrueType outlines) and
+Tiny-cff.otf (CFF outlines). Both map the same characters, have a `vert` feature that swaps
+U+300C for a vertical form, and draw every glyph as a square.
+"""
+
+from pathlib import Path
+
+from fontTools.feaLib.builder import addOpenTypeFeaturesFromString
+from fontTools.fontBuilder import FontBuilder
+from fontTools.pens.t2CharStringPen import T2CharStringPen
+from fontTools.pens.ttGlyphPen import TTGlyphPen
+
+HERE = Path(__file__).resolve().parent
+CMAP = {
+    0x20: "space",
+    0x41: "A",
+    0x3001: "uni3001",
+    0x300C: "uni300C",
+    0x3042: "uni3042",
+    0x4E00: "uni4E00",
+    0x4E01: "uni4E01",
+    0x4E03: "uni4E03",
+    0xFF01: "uniFF01",
+}
+GLYPHS = [".notdef", *CMAP.values(), "uni300C.vert"]
+FEATURES = "languagesystem DFLT dflt;\nfeature vert { sub uni300C by uni300C.vert; } vert;\n"
+# 2026-01-01, so the files are the same on every run.
+TIMESTAMP = 3_850_000_000
+
+
+def square(pen, size):
+    pen.moveTo((100, 0))
+    pen.lineTo((100, size))
+    pen.lineTo((100 + size, size))
+    pen.lineTo((100 + size, 0))
+    pen.closePath()
+
+
+def build(cff: bool) -> FontBuilder:
+    fb = FontBuilder(1000, isTTF=not cff)
+    fb.setupGlyphOrder(GLYPHS)
+    fb.setupCharacterMap(CMAP)
+    if cff:
+        charstrings = {}
+        for i, name in enumerate(GLYPHS):
+            pen = T2CharStringPen(1000, None)
+            square(pen, 100 + 10 * i)
+            charstrings[name] = pen.getCharString()
+        fb.setupCFF("Tiny-Regular", {"FullName": "Tiny Regular"}, charstrings, {})
+    else:
+        glyphs = {}
+        for i, name in enumerate(GLYPHS):
+            pen = TTGlyphPen(None)
+            square(pen, 100 + 10 * i)
+            glyphs[name] = pen.glyph()
+        fb.setupGlyf(glyphs)
+    fb.setupHorizontalMetrics({name: (1000, 100) for name in GLYPHS})
+    fb.setupHorizontalHeader(ascent=880, descent=-120)
+    fb.setupNameTable({"familyName": "Tiny", "styleName": "Regular"})
+    fb.setupOS2(sTypoAscender=880, sTypoDescender=-120, usWinAscent=880, usWinDescent=120)
+    fb.setupPost()
+    addOpenTypeFeaturesFromString(fb.font, FEATURES)
+    fb.font["head"].created = TIMESTAMP
+    fb.font["head"].modified = TIMESTAMP
+    fb.font.recalcTimestamp = False
+    return fb
+
+
+def main() -> None:
+    build(cff=False).save(HERE / "Tiny-glyf.ttf")
+    build(cff=True).save(HERE / "Tiny-cff.otf")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/crates/fonts-build/tests/generated.rs b/crates/fonts-build/tests/generated.rs
new file mode 100644
index 00000000..ff3214c1
--- /dev/null
+++ b/crates/fonts-build/tests/generated.rs
@@ -0,0 +1,33 @@
+//! The tables `craft-fonts-build-consumer`'s build.rs generated from the fixture compile and hold
+//! the selected faces' bytes.
+
+use craft_fonts_build_consumer::CRAFT_FONTS;
+
+#[test]
+fn generated_table_embeds_the_selected_faces() {
+    let names: Vec<String> = CRAFT_FONTS.iter().map(|f| f.name()).collect();
+    assert_eq!(names, ["Sans JP Regular", "Sans CJK TC Regular", "Sans CJK HK Regular"]);
+    assert_eq!(CRAFT_FONTS[0].bytes, include_bytes!("fixture/craft-fonts/fonts/sans-jp/SansJP-Regular.ttf"));
+    assert_eq!(CRAFT_FONTS[0].scripts, ["Jpan", "Latn"]);
+    let indices: Vec<u32> = CRAFT_FONTS.iter().map(|f| f.index).collect();
+    assert_eq!(indices, [0, 2, 3]);
+    assert_eq!(CRAFT_FONTS[2].bytes, include_bytes!("fixture/craft-fonts/fonts/sans-cjk/SansCJK.ttc"));
+    assert!(CRAFT_FONTS[2].has_script("Hant"));
+}
+
+#[test]
+fn served_table_names_urls_instead_of_bytes() {
+    use craft_fonts_build_consumer::CRAFT_FONTS_SERVED;
+    let faces: Vec<(String, &str, u64)> = CRAFT_FONTS_SERVED.iter().map(|f| (f.name(), f.url, f.size)).collect();
+    assert_eq!(
+        faces,
+        [
+            ("Sans JP Regular".to_owned(), "fonts/sans-jp/SansJP-Regular.ttf", 24),
+            ("Sans CJK TC Regular".to_owned(), "fonts/sans-cjk/SansCJK.ttc", 28),
+            ("Sans CJK HK Regular".to_owned(), "fonts/sans-cjk/SansCJK.ttc", 28),
+        ]
+    );
+    assert_eq!(CRAFT_FONTS_SERVED[2].index, 3);
+    assert!(CRAFT_FONTS_SERVED[2].has_script("Hant") && CRAFT_FONTS_SERVED[2].is_cjk());
+    assert!(CRAFT_FONTS_SERVED[0].integrity.starts_with("sha256-"));
+}
diff --git a/crates/i18n/Cargo.toml b/crates/i18n/Cargo.toml
index 99b64a7d..dbe1464b 100644
--- a/crates/i18n/Cargo.toml
+++ b/crates/i18n/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "craft-i18n"
-description = "Translations for the Craft apps: the embedded craft-i18n catalogs, lookup with fallback, plurals, language names and the system locale."
+description = "Translations for the Craft apps: the embedded craft-i18n catalogs, lookup with fallback, plurals, numbers for a region, language names, the system locale, search folding and locale sorting."
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -8,14 +8,39 @@ rust-version.workspace = true
 repository.workspace = true
 
 [dependencies]
-intl_pluralrules = "=7.0.2"
-unic-langid = "0.9"
+# Numbers and plural rules, on CLDR data (data/numbers.postcard) generated for one ICU4X minor
+# version, hence `~2.3`.
+fixed_decimal = { version = "0.7.2", default-features = false }
+icu_decimal = { version = "~2.3", default-features = false, features = ["serde"] }
+icu_locale_core = { version = "~2.3", default-features = false }
+icu_locale_fallback = { version = "~2.3", default-features = false, features = ["compiled_data"] }
+icu_plurals = { version = "~2.3", default-features = false, features = ["serde"] }
+icu_provider = { version = "~2.3", default-features = false, features = ["sync"] }
+icu_provider_adapters = { version = "~2.3", default-features = false }
+icu_provider_blob = { version = "~2.3", default-features = false }
+writeable = "0.6"
 log = "0.4"
 sys-locale = "0.3"
+icu_normalizer = "~2.3"
+icu_properties = "~2.3"
+# Generated data fits one ICU4X minor version; data/generate-collation.sh names its datagen.
+icu_collator = { version = "~2.3.1", default-features = false, features = ["serde"], optional = true }
 unicode-bidi = "0.3"
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 sys-locale = { version = "0.3", features = ["js"] }
 
+# The regional format (Region::system); safe registry reads, MIT OR Apache-2.0.
+[target.'cfg(windows)'.dependencies]
+windows-registry = "0.6"
+
+# The current locale (Region::system); already in the apps' Cargo.lock through eframe.
+[target.'cfg(target_vendor = "apple")'.dependencies]
+objc2-foundation = { version = "0.3.2", default-features = false, features = ["std", "NSDateFormatter", "NSFormatter", "NSLocale", "NSString"] }
+
+[features]
+# Locale sorting (`collate`), with ICU4X collation data for the suite's locales embedded.
+collate = ["dep:icu_collator", "icu_provider/serde", "icu_provider_blob/alloc"]
+
 [lints]
 workspace = true
diff --git a/crates/i18n/README.md b/crates/i18n/README.md
index 22ea77cf..1ea16d85 100644
--- a/crates/i18n/README.md
+++ b/crates/i18n/README.md
@@ -45,10 +45,21 @@ The app keeps its `tl!` macro, its language setting (`"auto"` → `I18N.system_l
   → `pt`, `zh-hant-hk` → `zh-hant`); `sr-latn` never falls back to Cyrillic `sr`. A missing
   translation never errors.
 - **Lookups:** `t` (plain), `tc` (with a context such as `menu` or `@msg`, else plain), `tid` (an
-  `@id` command id, else the English label), `trn` (a count, `@plural` rows, `{n}` filled), `get`
-  (one context along the locale chain, so `pt-br` can return a `pt` row, but never the plain row
+  `@id` command id, else the English label), `trn` and `trn_decimal` (a count, `@plural` rows,
+  `{n}` filled), `get` (one context along the locale chain, so `pt-br` can return a `pt` row, but never the plain row
   or English: a key cap's name under `key`, or "is there a translation?"), and `fmt` for `{name}`
   placeholders, filled in one pass.
+- **Isolation:** when a message or a value inserted into it has a right-to-left letter (bidi
+  class R or AL), or a value has a bidi control (LRE, RLE, PDF, LRO, RLO, LRI, RLI, FSI, PDI,
+  LRM, RLM, ALM), `fmt` wraps each inserted value in a first-strong isolate (FSI…PDI), and `trn`,
+  `file_size` and `measure` wrap `{n}` in a left-to-right one (LRI…PDI), so a Latin file name in an Arabic sentence, a
+  Hebrew name in an English one, or an ASCII file name with a right-to-left override can't
+  reorder the words around it. Embeddings, overrides and isolates a value opens are closed inside
+  its isolate, and a stray PDF or PDI in it is dropped. Wrap numbers, paths and codes in `ltr`
+  before passing them; a value that already is one isolate keeps it. Other text comes out
+  without marks, as if `fmt` didn't isolate at all. egui draws the marks as nothing. For text
+  that leaves the interface (file names, logs, terminals, text parsed later), use `fmt_plain` or
+  `strip_isolates`.
 - **Bad rows** (malformed, an unknown `@` context, a wrong plural form count, a row defined twice,
   of which the first is kept) and bad locales (`en`, `pseudo`, a code embedded twice in any case)
   are skipped; craft-i18n's CI rejects them before they ship. `I18n::new` parses nothing: it
@@ -56,10 +67,13 @@ The app keeps its `tl!` macro, its language setting (`"auto"` → `I18N.system_l
   `log::warn!`) on the first lookup that reaches it, including as a fallback. `I18n::check_all()`
   parses every locale and returns all problems (`<locale>/<common|app>: line N: …`), for a test.
 - **Plurals:** forms are listed in CLDR order (zero, one, two, few, many, other) for the categories
-  whole numbers 0 to 1000 reach, from `intl_pluralrules`; a count in any other category takes the
-  last form. CLDR's `pt` is Brazilian, so `pt` uses `pt-PT`'s rules (0 is plural) and `pt-br`
-  `pt`'s. `intl_pluralrules` is pinned to the version craft-i18n's checker uses, and
-  `plural_form_counts` holds the same counts.
+  whole numbers 0 to 1000 reach, from ICU4X's CLDR rules; `plural_form_counts` holds the counts
+  craft-i18n's checker expects. `trn_decimal` picks the form from the digits shown (ICU4X plural
+  operands), so English `1.0` is plural and French `1,5` singular. A count in a category integers
+  never reach takes the `few` form if there is one (Russian and Ukrainian decimals, `1,5 файла`),
+  else the last. Rules are per language, so `sr-latn` and `zh-hant` take `sr`'s and `zh`'s. CLDR's
+  `pt` is Brazilian, so `pt` uses `pt-PT`'s rules (0 is plural) and `pt-br` `pt`'s. A language
+  CLDR has no plural rules for shows English forms.
 - **Names:** a language's name comes from the app catalog's `@id language.name` row, else the
   shared catalog's, else its code; English is "English".
 - **Scripts and direction:** for any language tag, `scripts` lists the ISO 15924 scripts its
@@ -68,13 +82,71 @@ The app keeps its `tl!` macro, its language setting (`"auto"` → `I18N.system_l
   gives the regional forms of its Han characters for picking a CJK face: `zh-CN`/`zh-SG`/`zh-Hans` →
   SC, `zh-TW`/`zh-US`/`zh-Hant` → TC, `zh-HK`/`zh-MO` → HK, `ja` → JP, `ko` → KR. `I18n::rtl` is
   `direction` of the language's code; putting text into display order is the app's job.
+- **Reading numbers:** `Format::parse(text)` reads what the format writes (its digits, decimal
+  and grouping separators, the system's included) and what people type or paste: any Unicode
+  decimal digits (ASCII, Arabic-Indic, Persian, Devanagari, Bengali, Thai, full-width, …) from one
+  set; `٫` as a decimal mark everywhere; grouping by the locale's other mark of `.` and `,`, spaces
+  (NBSP, narrow NBSP), `'`, `’` or `٬`, in threes or the Indian 2-2-3; a leading `-`, `−` or `+`;
+  bidi marks ignored. A lone `.` in a comma locale is decimal when it can't be grouping (`1.5`,
+  `0.250`, `1234.5`), while `1.234` stays 1234 in German; the same holds for `,` in a point
+  locale. Percent signs and units (`50 %`, `12 px`) are not read: strip them first. Other input
+  that doesn't fit is an error, never a guess. `parse_number(text, locale)` is the same for
+  `Format::from_tag(locale)`.
 - **System locale:** `system_lang` matches the system's list once and caches it: on desktop Unix
   `LANGUAGE`, `LC_ALL`, `LC_MESSAGES` and `LANG`, read raw; elsewhere `sys-locale`'s (macOS and
   Windows preferred languages, the browser's on the web). `fr_CA.UTF-8` → `fr`, `zh-TW` → `zh-hant`,
   `pt-PT` → `pt-br` when that is the only Portuguese, `C`/`POSIX` → English. A script is never
   crossed: `sr_RS@latin` and `sr-Latn-RS` pick `sr-latn`, never `sr`, while `sr-Cyrl-RS` picks `sr`.
   A region that implies a script counts as that script: `pa-PK` picks `pa-arab`, not Gurmukhi `pa`.
+- **Sizes and units:** `file_size(lang, bytes, style)` writes `1.5 MB` or `512 bytes`; `FileSize`
+  picks steps of 1024 named KB (`BINARY`), 1024 named KiB (`IEC`) or 1000 named KB (`DECIMAL`),
+  the decimals per unit, no decimals from a given value up, the smallest and largest unit (below
+  the smallest, sizes round up), and `B` or words for bytes. `measure(lang, value, decimals,
+  "{n} px")` writes any other measure. Unit names are rows in context `unit`, keyed by the English
+  template (`{n} MB` → `{n} Mo`, `{n}%` → `{n} %`) and read with `get`, so a plain `B` row (bold)
+  is never used; bytes in words are the `@plural` row `{n} byte|{n} bytes`. Numbers are written
+  by `I18n::format`.
+- **Numbers:** `Format` writes numbers for a `Region` on ICU4X's decimal formatter: `integer`
+  (`1.234.567`, Indian `12,34,567`), `number(value, decimals)` and `percent(ratio, decimals)`
+  (`50 %`, Turkish `%50`). It follows the region, not the interface language, with the locale's
+  digits (`١٬٢٣٤٫٥` in Egypt, `۱٬۲۳۴` in Iran) or, with `Digits::Latin`, `0`–`9`. With Latin
+  digits, a decimal or grouping separator the system sets (Windows' and macOS's own settings)
+  replaces the locale's. `I18n::format` is the format `trn`, `file_size` and `measure` use: the
+  system region's until `I18n::set_format` (the user's region setting or digit choice), and again
+  after `I18n::reset_format`. A count in `trn` is therefore grouped and in the region's digits
+  (`1.234 Dateien`, `١٬٢٣٤ ملفًا`); for names written into documents or files (`Copy 1234`), use
+  `trn_plain`, which writes `0`–`9` without grouping or isolate marks.
+- **CLDR data:** decimal symbols, digits and plural rules (`data/numbers.postcard`, about 10 KB) and
+  percent patterns (`data/locales.rs`) cover every CLDR locale; `data/generate.sh` rebuilds both
+  from CLDR. The ICU4X crates are pinned to one minor version (`~2.3`), the one the data is
+  generated for. The ICU4X code and data add about 90 KB to a stripped release build and 80 KB to
+  wasm.
+- **Formatting region:** `Region` holds how numbers, times and measurements are written, apart
+  from the interface language: the number and time locales (BCP 47), metric or US measurement, A4
+  or Letter, and the decimal and grouping separators (or no grouping) and clock when the system
+  sets them; otherwise the number locale's CLDR data decides. `Region::system()` reads it once:
+  Windows' regional format with the user's changes (`HKCU\Control Panel\International`), Apple's
+  current locale (`en_PL`, `en_GB@rg=uszzzz`), `LC_ALL` or else `LC_NUMERIC`, `LC_TIME`,
+  `LC_MEASUREMENT` and `LC_PAPER` each on its own over `LANG` on Unix (`C` there is English on A4,
+  metric, with a `.` decimal and no grouping; `LANG=C` gives way to the preferred language), the
+  preferred language on the web and Android. `Region::from_setting` takes the app's saved choice
+  (`auto` or a tag like `pl-PL`). Paper and measurement follow CLDR's territory lists; tags may
+  carry `-u-ms-`, `-u-hc-`, `-u-rg-` and `-u-nu-` (Apple's `@numbers=`), and a chosen digit
+  system stays in the number locale.
+  Ported from WordCraft's `Region`.
 - **Pseudo locale** (`pseudo`, debug builds only, never in `languages()`): every lookup, `get`
   included, comes back as `⟦…⟧`, line by line, so text drawn without the marks never went through
   translation. `looked_up()` lists the source texts looked up so far, for an audit against a
   complete catalog.
+- **Search** (`Folder`): `Folder::new(locale).fold(text)` gives a key for case- and
+  accent-insensitive matching (`keep_accents()` makes accents count) and a map back to the original
+  text, so `Folded::find` returns the byte range to highlight. Compatibility forms fold to their
+  plain letters (`fi`, full-width `Ａ`), `ß` to `ss`, `ς` to `σ`, digits of every script to ASCII
+  (`Layer ١٢` finds `layer 12`); ignoring accents, Persian and Arabic letter forms match (`ک` and
+  `ك`, `ی` and `ي`, `ة` and `ه`, `أ` and `ا`); invisible format characters (soft hyphens, joiners,
+  bidi isolates) are dropped. Turkish and Azerbaijani fold `I` to `ı` when accents count; ignoring
+  accents, `I`, `i`, `İ` and `ı` all match.
+- **Sorting** (`Collator`, feature `collate`): ICU4X collation for the locales craft-i18n ships,
+  Persian and Hindi, with digits compared by value (`Layer 2` before `Layer 10`) and `-u-co-pinyin`
+  / `-u-co-stroke` for Chinese. The data (754 KB) is regenerated by `data/generate-collation.sh`;
+  the feature adds about 1 MB to a release binary or wasm module (320 KB gzipped).
diff --git a/crates/i18n/data/collation.postcard b/crates/i18n/data/collation.postcard
new file mode 100644
index 00000000..7eabc2f2
Binary files /dev/null and b/crates/i18n/data/collation.postcard differ
diff --git a/crates/i18n/data/generate-collation.sh b/crates/i18n/data/generate-collation.sh
new file mode 100755
index 00000000..35f605eb
--- /dev/null
+++ b/crates/i18n/data/generate-collation.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+# Regenerates the collation data `collate` embeds, a postcard blob for the locales craft-i18n
+# ships (its `locales/` directory) plus English, Persian and Hindi: each locale's default order,
+# and Chinese pinyin and stroke orders.
+# Needs icu4x-datagen at the version of the icu_collator dependency:
+#   cargo install icu4x-datagen --version 2.3.0 --locked
+set -eu
+cd "$(dirname "$0")"
+icu4x-datagen --format blob --overwrite --out collation.postcard --deduplication maximal \
+  --cldr-tag 48.2.1 --icuexport-tag release-78.1rc \
+  --attribute-filter 'collator=/^(stroke|pinyin)?$/' \
+  --markers CollationRootV1 CollationTailoringV1 CollationDiacriticsV1 CollationJamoV1 \
+    CollationMetadataV1 CollationReorderingV1 CollationSpecialPrimariesV1 \
+  --locales en ar bg cs da de el es et fa fi fr hi hr hu id it ja ka kk ko lt nl pl pt-BR ru sl \
+    sr sr-Latn sv te tr uk vi zh-Hans zh-Hant
diff --git a/crates/i18n/data/generate.sh b/crates/i18n/data/generate.sh
new file mode 100755
index 00000000..2fac15d7
--- /dev/null
+++ b/crates/i18n/data/generate.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Regenerates the number and plural data in this directory from Unicode CLDR, for every CLDR
+# locale: 10 KB, of which CLDR's modern-coverage locales alone would be 7 KB. Lookups fall back
+# at run time, so a locale whose data matches its parent's is left out.
+#
+# Needs `cargo install icu4x-datagen --version 2.3.0` (the ICU4X minor version in Cargo.toml)
+# and python3. Downloads CLDR's JSON release once into $CACHE.
+set -euo pipefail
+
+CLDR=48.2.1
+HERE=$(cd "$(dirname "$0")" && pwd)
+CACHE=${CACHE:-${XDG_CACHE_HOME:-$HOME/.cache}/craft-i18n-data}
+mkdir -p "$CACHE"
+
+TMPDIR=$CACHE icu4x-datagen --format blob --overwrite \
+    --cldr-tag "$CLDR" \
+    --markers DecimalSymbolsV1 DecimalDigitsV1 PluralsCardinalV1 \
+    --locales full --deduplication maximal \
+    --out "$HERE/numbers.postcard"
+
+ZIP=$CACHE/icu4x-source-cache/github.com/unicode-org/cldr-json/releases/download/$CLDR/cldr-$CLDR-json-full.zip
+python3 -I "$HERE/locales.py" "$ZIP" "$CLDR" > "$HERE/locales.rs.tmp"
+mv "$HERE/locales.rs.tmp" "$HERE/locales.rs"
diff --git a/crates/i18n/data/locales.py b/crates/i18n/data/locales.py
new file mode 100644
index 00000000..337bcfb9
--- /dev/null
+++ b/crates/i18n/data/locales.py
@@ -0,0 +1,70 @@
+"""Writes locales.rs from CLDR's JSON release: the languages with plural rules and every locale's
+percent affixes.
+
+Usage: locales.py <cldr-json-full.zip> <cldr version>
+"""
+
+import json
+import re
+import sys
+import zipfile
+
+
+def rust(s):
+    return '"' + "".join(c if " " <= c <= "~" and c not in '"\\' else f"\\u{{{ord(c):x}}}" for c in s) + '"'
+
+
+def affixes(numbers, numsys):
+    pattern = numbers[f"percentFormats-numberSystem-{numsys}"]["standard"].split(";")[0].replace("'", "")
+    sign = numbers[f"symbols-numberSystem-{numsys}"]["percentSign"]
+    number = re.search(r"[#0,.]+", pattern)
+    return pattern[: number.start()].replace("%", sign), pattern[number.end() :].replace("%", sign)
+
+
+def main():
+    path, version = sys.argv[1], sys.argv[2]
+    found = {}
+    with zipfile.ZipFile(path) as z:
+        plurals = json.loads(z.read("cldr-core/supplemental/plurals.json"))["supplemental"]["plurals-type-cardinal"]
+        languages = sorted(l for l in plurals if l != "root" and "-" not in l)
+        for name in z.namelist():
+            m = re.fullmatch(r"cldr-numbers-full/main/([^/]+)/numbers\.json", name)
+            if not m or m.group(1) == "root":
+                continue
+            locale = m.group(1)
+            numbers = json.loads(z.read(name))["main"][locale]["numbers"]
+            found[(locale, True)] = affixes(numbers, "latn")
+            default = numbers["defaultNumberingSystem"]
+            if default != "latn":
+                found[(locale, False)] = affixes(numbers, default)
+
+    # Kept only where the lookup by dropping trailing subtags would find something else.
+    kept = {}
+    for (locale, latin), value in sorted(found.items(), key=lambda e: (e[0][0].count("-"), e[0])):
+        parts = locale.split("-")
+        inherited = ("", "%")
+        for n in range(len(parts) - 1, 0, -1):
+            if ("-".join(parts[:n]), latin) in kept:
+                inherited = kept[("-".join(parts[:n]), latin)]
+                break
+        if value != inherited:
+            kept[(locale, latin)] = value
+
+    print(f"// @generated by generate.sh from Unicode CLDR {version} (Unicode License).")
+    print()
+    print("/// The languages CLDR has plural rules for; the baked data has them all.")
+    print("pub(crate) const PLURAL_LANGUAGES: &[&str] = &[")
+    for i in range(0, len(languages), 16):
+        print("    " + ", ".join(rust(l) for l in languages[i : i + 16]) + ",")
+    print("];")
+    print()
+    print("/// Percent signs around the number (CLDR's standard percent pattern and sign): locale, Latin")
+    print("/// digits or the locale's own, text before the number, text after it. A locale missing here")
+    print("/// takes its parent's by dropping trailing subtags, then `{n}%`.")
+    print("pub(crate) const PERCENT: &[(&str, bool, &str, &str)] = &[")
+    for (locale, latin), (before, after) in sorted(kept.items()):
+        print(f"    ({rust(locale)}, {str(latin).lower()}, {rust(before)}, {rust(after)}),")
+    print("];")
+
+
+main()
diff --git a/crates/i18n/data/locales.rs b/crates/i18n/data/locales.rs
new file mode 100644
index 00000000..205a9661
--- /dev/null
+++ b/crates/i18n/data/locales.rs
@@ -0,0 +1,144 @@
+// @generated by generate.sh from Unicode CLDR 48.2.1 (Unicode License).
+
+/// The languages CLDR has plural rules for; the baked data has them all.
+pub(crate) const PLURAL_LANGUAGES: &[&str] = &[
+    "af", "ak", "am", "an", "ar", "ars", "as", "asa", "ast", "az", "bal", "be", "bem", "bez", "bg", "bho",
+    "blo", "bm", "bn", "bo", "br", "brx", "bs", "ca", "ce", "ceb", "cgg", "chr", "ckb", "cs", "csw", "cv",
+    "cy", "da", "de", "doi", "dsb", "dv", "dz", "ee", "el", "en", "eo", "es", "et", "eu", "fa", "ff",
+    "fi", "fil", "fo", "fr", "fur", "fy", "ga", "gd", "gl", "gsw", "gu", "guw", "gv", "ha", "haw", "he",
+    "hi", "hnj", "hr", "hsb", "hu", "hy", "ia", "id", "ie", "ig", "ii", "io", "is", "it", "iu", "ja",
+    "jbo", "jgo", "jmc", "jv", "jw", "ka", "kab", "kaj", "kcg", "kde", "kea", "kk", "kkj", "kl", "km", "kn",
+    "ko", "kok", "ks", "ksb", "ksh", "ku", "kw", "ky", "lag", "lb", "lg", "lij", "lkt", "lld", "ln", "lo",
+    "lt", "lv", "mas", "mg", "mgo", "mk", "ml", "mn", "mo", "mr", "ms", "mt", "my", "nah", "naq", "nb",
+    "nd", "ne", "nl", "nn", "nnh", "no", "nqo", "nr", "nso", "ny", "nyn", "om", "or", "os", "osa", "pa",
+    "pap", "pcm", "pl", "prg", "ps", "pt", "rm", "ro", "rof", "ru", "rwk", "sah", "saq", "sat", "sc", "scn",
+    "sd", "sdh", "se", "seh", "ses", "sg", "sgs", "sh", "shi", "si", "sk", "sl", "sma", "smi", "smj", "smn",
+    "sms", "sn", "so", "sq", "sr", "ss", "ssy", "st", "su", "sv", "sw", "syr", "ta", "te", "teo", "th",
+    "ti", "tig", "tk", "tl", "tn", "to", "tpi", "tr", "ts", "tzm", "ug", "uk", "und", "ur", "uz", "ve",
+    "vec", "vi", "vo", "vun", "wa", "wae", "wo", "xh", "xog", "yi", "yo", "yue", "zh", "zu",
+];
+
+/// Percent signs around the number (CLDR's standard percent pattern and sign): locale, Latin
+/// digits or the locale's own, text before the number, text after it. A locale missing here
+/// takes its parent's by dropping trailing subtags, then `{n}%`.
+pub(crate) const PERCENT: &[(&str, bool, &str, &str)] = &[
+    ("ar", true, "", "\u{200e}%\u{200e}"),
+    ("ar-BH", false, "", "\u{66a}\u{61c}"),
+    ("ar-DJ", false, "", "\u{66a}\u{61c}"),
+    ("ar-EG", false, "", "\u{66a}\u{61c}"),
+    ("ar-ER", false, "", "\u{66a}\u{61c}"),
+    ("ar-IL", false, "", "\u{66a}\u{61c}"),
+    ("ar-IQ", false, "", "\u{66a}\u{61c}"),
+    ("ar-JO", false, "", "\u{66a}\u{61c}"),
+    ("ar-KM", false, "", "\u{66a}\u{61c}"),
+    ("ar-KW", false, "", "\u{66a}\u{61c}"),
+    ("ar-LB", false, "", "\u{66a}\u{61c}"),
+    ("ar-MR", false, "", "\u{66a}\u{61c}"),
+    ("ar-OM", false, "", "\u{66a}\u{61c}"),
+    ("ar-PS", false, "", "\u{66a}\u{61c}"),
+    ("ar-QA", false, "", "\u{66a}\u{61c}"),
+    ("ar-SA", false, "", "\u{66a}\u{61c}"),
+    ("ar-SA", true, "", "\u{66a}"),
+    ("ar-SD", false, "", "\u{66a}\u{61c}"),
+    ("ar-SO", false, "", "\u{66a}\u{61c}"),
+    ("ar-SO", true, "", "\u{66a}"),
+    ("ar-SS", false, "", "\u{66a}\u{61c}"),
+    ("ar-SY", false, "", "\u{66a}\u{61c}"),
+    ("ar-TD", false, "", "\u{66a}\u{61c}"),
+    ("ar-YE", false, "", "\u{66a}\u{61c}"),
+    ("az-Arab", false, "", "\u{66a}"),
+    ("bas", true, "", "\u{a0}%"),
+    ("be", true, "", "\u{a0}%"),
+    ("bgn", false, "", "\u{66a}"),
+    ("bgn", true, "", "\u{66a}"),
+    ("blo", true, "%\u{a0}", ""),
+    ("br", true, "", "\u{a0}%"),
+    ("bua", true, "", "\u{a0}%"),
+    ("ca", true, "", "\u{a0}%"),
+    ("ce", true, "", "\u{a0}%"),
+    ("ckb", false, "", "\u{a0}\u{66a}"),
+    ("cs", true, "", "\u{a0}%"),
+    ("cv", true, "", "\u{a0}%"),
+    ("da", true, "", "\u{a0}%"),
+    ("de", true, "", "\u{a0}%"),
+    ("de-CH", true, "", "%"),
+    ("de-LI", true, "", "%"),
+    ("dsb", true, "", "\u{a0}%"),
+    ("dua", true, "", "\u{a0}%"),
+    ("dz", false, "", "\u{a0}%"),
+    ("dz", true, "", "\u{a0}%"),
+    ("en-AT", true, "", "\u{a0}%"),
+    ("en-DE", true, "", "\u{a0}%"),
+    ("en-DK", true, "", "\u{a0}%"),
+    ("en-FI", true, "", "\u{a0}%"),
+    ("en-NO", true, "", "\u{a0}%"),
+    ("en-SE", true, "", "\u{a0}%"),
+    ("es", true, "", "\u{a0}%"),
+    ("es-419", true, "", "%"),
+    ("es-AR", true, "", "%"),
+    ("es-BO", true, "", "%"),
+    ("es-BR", true, "", "%"),
+    ("es-BZ", true, "", "%"),
+    ("es-CL", true, "", "%"),
+    ("es-CO", true, "", "%"),
+    ("es-CR", true, "", "%"),
+    ("es-CU", true, "", "%"),
+    ("es-DO", true, "", "%"),
+    ("es-EC", true, "", "%"),
+    ("es-GT", true, "", "%"),
+    ("es-HN", true, "", "%"),
+    ("es-MX", true, "", "%"),
+    ("es-NI", true, "", "%"),
+    ("es-PA", true, "", "%"),
+    ("es-PE", true, "", "%"),
+    ("es-PR", true, "", "%"),
+    ("es-PY", true, "", "%"),
+    ("es-SV", true, "", "%"),
+    ("es-US", true, "", "%"),
+    ("es-UY", true, "", "%"),
+    ("es-VE", true, "", "%"),
+    ("eu", true, "%\u{a0}", ""),
+    ("fa", false, "", "\u{66a}"),
+    ("fi", true, "", "\u{a0}%"),
+    ("fo", true, "", "\u{a0}%"),
+    ("fr", true, "", "\u{a0}%"),
+    ("fr-CH", true, "", "%"),
+    ("gl", true, "", "\u{a0}%"),
+    ("gsw", true, "", "\u{a0}%"),
+    ("hr", true, "", "\u{a0}%"),
+    ("hsb", true, "", "\u{a0}%"),
+    ("ht", true, "", "\u{a0}%"),
+    ("kl", true, "", "\u{a0}%"),
+    ("ks", false, "", "\u{66a}"),
+    ("ksh", true, "", "\u{a0}%"),
+    ("ku", true, "%", ""),
+    ("ku-Arab", true, "", "%"),
+    ("lb", true, "", "\u{a0}%"),
+    ("lrc", false, "", "\u{66a}"),
+    ("lt", true, "", "\u{a0}%"),
+    ("mk", true, "", "\u{a0}%"),
+    ("mzn", false, "", "\u{66a}"),
+    ("nb", true, "", "\u{a0}%"),
+    ("nds", true, "", "\u{a0}%"),
+    ("nn", true, "", "\u{a0}%"),
+    ("no", true, "", "\u{a0}%"),
+    ("oc", true, "", "\u{202f}%"),
+    ("pa-Arab", false, "", "\u{66a}"),
+    ("ps", false, "", "\u{66a}"),
+    ("qu", true, "", "\u{a0}%"),
+    ("rn", true, "", "\u{a0}%"),
+    ("ro", true, "", "\u{a0}%"),
+    ("ru", true, "", "\u{a0}%"),
+    ("sd", false, "", "\u{66a}\u{61c}"),
+    ("sdh", false, "", "\u{66a}\u{61c}"),
+    ("se", true, "", "\u{a0}%"),
+    ("sk", true, "", "\u{a0}%"),
+    ("sl", true, "", "\u{a0}%"),
+    ("smn", true, "", "\u{a0}%"),
+    ("sv", true, "", "\u{a0}%"),
+    ("tk", true, "", "\u{a0}%"),
+    ("tr", true, "%", ""),
+    ("tt", true, "", "\u{a0}%"),
+    ("uz-Arab", false, "", "\u{66a}"),
+    ("zgh", true, "", "\u{a0}%"),
+];
diff --git a/crates/i18n/data/numbers.postcard b/crates/i18n/data/numbers.postcard
new file mode 100644
index 00000000..5ee84e03
Binary files /dev/null and b/crates/i18n/data/numbers.postcard differ
diff --git a/crates/i18n/src/collate.rs b/crates/i18n/src/collate.rs
new file mode 100644
index 00000000..06d41789
--- /dev/null
+++ b/crates/i18n/src/collate.rs
@@ -0,0 +1,234 @@
+//! Locale sorting for lists people see: fonts, layers, presets, files.
+//!
+//! ICU4X collation with data embedded for the locales craft-i18n ships (regenerated by
+//! `data/generate-collation.sh`). A locale without data of its own sorts in the Unicode root
+//! order, which suits most languages that have no tailoring.
+
+use std::cmp::Ordering;
+
+use icu_collator::CollatorPreferences;
+use icu_collator::options::CollatorOptions;
+use icu_collator::preferences::CollationNumericOrdering;
+use icu_collator::provider::{
+    CollationDiacriticsV1, CollationJamoV1, CollationMetadataV1, CollationReorderingV1, CollationRootV1, CollationSpecialPrimariesV1,
+    CollationTailoringV1,
+};
+use icu_locale_core::Locale;
+use icu_locale_fallback::LocaleFallbacker;
+use icu_normalizer::provider::{NormalizerNfdDataV1, NormalizerNfdTablesV1};
+use icu_provider::buf::AsDeserializingBufferProvider;
+use icu_provider::prelude::*;
+use icu_provider_adapters::fallback::LocaleFallbackProvider;
+use icu_provider_blob::BlobDataProvider;
+
+/// Compares text in one locale's order, with runs of digits by their value: `Layer 2` before
+/// `Layer 10`.
+#[derive(Debug)]
+pub struct Collator(Option<icu_collator::Collator>);
+
+impl Collator {
+    /// Sorting for `locale`, a language code such as `sv`, `pt-br` or `zh-hant` (any case, `-`
+    /// or `_`, glibc forms such as `sv_SE.UTF-8` and `sr_RS@latin`). A BCP 47 collation type
+    /// picks another order where there is one: `zh-hant-u-co-pinyin`, `zh-hans-u-co-stroke`.
+    pub fn new(locale: &str) -> Collator {
+        let mut prefs: CollatorPreferences = Locale::try_from_str(&bcp47(locale)).unwrap_or(Locale::UNKNOWN).into();
+        prefs.numeric_ordering = Some(CollationNumericOrdering::True);
+        let options = CollatorOptions::default();
+        let collator = Data::new().ok().and_then(|data| {
+            icu_collator::Collator::try_new_unstable(&data, prefs, options)
+                .or_else(|_| icu_collator::Collator::try_new_unstable(&data, CollatorPreferences::default(), options))
+                .ok()
+        });
+        Collator(collator)
+    }
+
+    /// `a` against `b`. Text that differs only in case or accents still has an order, and text
+    /// the collation counts as equal (`Layer 2` and `Layer 02`) is in code point order, so a sort
+    /// doesn't depend on the input order. Without collation data (never with the embedded data)
+    /// this is code point order.
+    pub fn compare(&self, a: &str, b: &str) -> Ordering {
+        match &self.0 {
+            Some(c) => c.as_borrowed().compare(a, b).then_with(|| a.cmp(b)),
+            None => a.cmp(b),
+        }
+    }
+
+    /// Sort `items` by the text `key` gives each one.
+    pub fn sort_by_key<T>(&self, items: &mut [T], key: impl Fn(&T) -> &str) {
+        items.sort_by(|a, b| self.compare(key(a), key(b)));
+    }
+}
+
+/// `locale` as a BCP 47 tag: `_` → `-`, a glibc codeset dropped and its script modifier made a
+/// subtag (`sr_RS.UTF-8@latin` → `sr-latn-RS`).
+fn bcp47(locale: &str) -> String {
+    let locale = locale.trim();
+    let mut parts: Vec<&str> = locale.split(['.', '@']).next().unwrap_or_default().split(['-', '_']).collect();
+    let script = match locale.split_once('@').map(|(_, m)| m.to_ascii_lowercase()).as_deref() {
+        Some("latin") => Some("latn"),
+        Some("cyrillic") => Some("cyrl"),
+        _ => None,
+    };
+    let has_script = parts.get(1).is_some_and(|p| p.len() == 4 && p.bytes().all(|b| b.is_ascii_alphabetic()));
+    if let Some(script) = script
+        && !has_script
+    {
+        parts.insert(1.min(parts.len()), script);
+    }
+    parts.join("-")
+}
+
+/// The embedded collation data, with locale fallback, and the decomposition tables the collator
+/// also needs taken from `icu_normalizer`'s compiled data rather than embedded a second time.
+struct Data(LocaleFallbackProvider<BlobDataProvider>);
+
+impl Data {
+    fn new() -> Result<Data, DataError> {
+        let blob = BlobDataProvider::try_new_from_static_blob(include_bytes!("../data/collation.postcard"))?;
+        Ok(Data(LocaleFallbackProvider::new(blob, LocaleFallbacker::new().static_to_owned())))
+    }
+}
+
+macro_rules! from_blob {
+    ($($marker:ty),*) => {$(
+        impl DataProvider<$marker> for Data {
+            fn load(&self, req: DataRequest) -> Result<DataResponse<$marker>, DataError> {
+                self.0.as_deserializing().load(req)
+            }
+        }
+    )*};
+}
+
+from_blob!(
+    CollationRootV1,
+    CollationTailoringV1,
+    CollationDiacriticsV1,
+    CollationJamoV1,
+    CollationMetadataV1,
+    CollationReorderingV1,
+    CollationSpecialPrimariesV1
+);
+
+impl DataProvider<NormalizerNfdDataV1> for Data {
+    fn load(&self, req: DataRequest) -> Result<DataResponse<NormalizerNfdDataV1>, DataError> {
+        icu_normalizer::provider::Baked.load(req)
+    }
+}
+
+impl DataProvider<NormalizerNfdTablesV1> for Data {
+    fn load(&self, req: DataRequest) -> Result<DataResponse<NormalizerNfdTablesV1>, DataError> {
+        icu_normalizer::provider::Baked.load(req)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sorted<'a>(locale: &str, items: &[&'a str]) -> Vec<&'a str> {
+        let mut v = items.to_vec();
+        Collator::new(locale).sort_by_key(&mut v, |s| s);
+        v
+    }
+
+    /// Each tailored locale puts a pair in another order than the root collation does, which a
+    /// locale whose data is missing (it falls back to root) wouldn't.
+    #[test]
+    fn every_shipped_locale_has_its_data() {
+        let root = Collator::new("und");
+        for (locale, first, second) in [
+            ("ar", "ب", "a"),
+            ("bg", "б", "a"),
+            ("cs", "hrad", "chata"),
+            ("da", "zebra", "år"),
+            ("el", "β", "a"),
+            ("es", "nube", "ñu"),
+            ("et", "wc", "õun"),
+            ("fa", "ب", "a"),
+            ("fi", "zeta", "äiti"),
+            ("hi", "क", "a"),
+            ("hr", "cvijet", "čaj"),
+            ("hu", "cukor", "csak"),
+            ("ja", "亜", "一"),
+            ("ka", "ა", "a"),
+            ("kk", "б", "a"),
+            ("ko", "가", "a"),
+            ("lt", "yra", "jau"),
+            ("pl", "az", "ąb"),
+            ("ru", "б", "a"),
+            ("sl", "cvet", "čaj"),
+            ("sr", "б", "a"),
+            ("sr-latn", "cvijet", "čaj"),
+            ("sv", "zebra", "år"),
+            ("te", "క", "a"),
+            ("tr", "cz", "ça"),
+            ("uk", "б", "a"),
+            ("vi", "az", "ăn"),
+            ("zh-hans", "阿", "中"),
+            ("zh-hant", "人", "丈"),
+        ] {
+            assert_eq!(Collator::new(locale).compare(first, second), Ordering::Less, "{locale}: {first} < {second}");
+            assert_eq!(root.compare(first, second), Ordering::Greater, "root: {second} < {first}");
+        }
+        // CLDR doesn't tailor these: they sort in the root order.
+        for locale in ["en", "de", "fr", "id", "it", "nl", "pt-br", "not a locale"] {
+            let collator = Collator::new(locale);
+            assert!(collator.0.is_some(), "{locale}");
+            assert_eq!(collator.compare("čaj", "cvijet"), Ordering::Less, "{locale}");
+        }
+    }
+
+    #[test]
+    fn digits_sort_by_value() {
+        let layers = ["Layer 10", "Layer 2", "layer 1", "Layer 1", "Layer 2b", "Layer 02"];
+        assert_eq!(sorted("en", &layers), ["layer 1", "Layer 1", "Layer 02", "Layer 2", "Layer 2b", "Layer 10"]);
+        let reversed: Vec<&str> = layers.iter().rev().copied().collect();
+        assert_eq!(sorted("en", &reversed), sorted("en", &layers));
+        assert_eq!(sorted("de", &["Ebene ٣", "Ebene 10", "Ebene ２"]), ["Ebene ２", "Ebene ٣", "Ebene 10"]);
+    }
+
+    #[test]
+    fn locales_sort_their_own_letters() {
+        let words = ["öl", "zebra", "år", "äpple", "apa", "oxe"];
+        assert_eq!(sorted("sv", &words), ["apa", "oxe", "zebra", "år", "äpple", "öl"]);
+        assert_eq!(sorted("de", &words), ["apa", "äpple", "år", "öl", "oxe", "zebra"]);
+        assert_eq!(sorted("de", &["Muller", "Müller", "Mueller", "Mahler"]), ["Mahler", "Mueller", "Muller", "Müller"]);
+        assert_eq!(
+            sorted("tr", &["şeker", "sabun", "ılık", "iğne", "çay", "cam", "uzun", "üzüm"]),
+            ["cam", "çay", "ılık", "iğne", "sabun", "şeker", "uzun", "üzüm"]
+        );
+        assert_eq!(sorted("en", &["ılık", "iğne", "cam", "çay"]), ["cam", "çay", "iğne", "ılık"]);
+        assert_eq!(sorted("es", &["ñu", "nube", "oso"]), ["nube", "ñu", "oso"]);
+        // Japanese: Latin, then kana in gojūon order (hiragana and katakana together), then kanji.
+        assert_eq!(sorted("ja", &["漢字", "カメラ", "あめ", "いぬ", "Zoom"]), ["Zoom", "あめ", "いぬ", "カメラ", "漢字"]);
+    }
+
+    #[test]
+    fn glibc_locale_names() {
+        let words = ["öl", "zebra", "år", "äpple", "apa", "oxe"];
+        assert_eq!(sorted("sv_SE.UTF-8", &words), sorted("sv", &words));
+        assert_ne!(sorted("sv_SE.UTF-8", &words), sorted("en", &words));
+        let cities = ["天津", "北京", "上海"];
+        assert_eq!(sorted("zh_TW.UTF-8", &cities), sorted("zh-hant", &cities));
+        assert_eq!(sorted("zh_CN.UTF-8", &cities), sorted("zh-hans", &cities));
+        // Serbian Cyrillic sorts Cyrillic first; Latin Serbian sorts Latin first, `lj` after `lu`.
+        let mixed = ["ljubav", "lula", "абв"];
+        assert_eq!(sorted("sr_RS.UTF-8", &mixed), ["абв", "ljubav", "lula"]);
+        assert_eq!(sorted("sr_RS.UTF-8@latin", &mixed), ["lula", "ljubav", "абв"]);
+        assert_eq!(bcp47("sr_RS.UTF-8@latin"), "sr-latn-RS");
+        assert_eq!(bcp47("sr_Latn_RS@latin"), "sr-Latn-RS");
+        assert_eq!(bcp47("de_DE@euro"), "de-DE");
+    }
+
+    #[test]
+    fn chinese_sorts_by_pinyin_or_stroke() {
+        // 北 běi (5 strokes), 上 shàng (3), 天 tiān (4).
+        let cities = ["天津", "北京", "上海"];
+        let pinyin = ["北京", "上海", "天津"];
+        let stroke = ["上海", "天津", "北京"];
+        assert_eq!(sorted("zh-hans", &cities), pinyin);
+        assert_eq!(sorted("zh-hant", &cities), stroke);
+        assert_eq!(sorted("zh-hans-u-co-stroke", &cities), stroke);
+        assert_eq!(sorted("zh-hant-u-co-pinyin", &cities), pinyin);
+    }
+}
diff --git a/crates/i18n/src/fold.rs b/crates/i18n/src/fold.rs
new file mode 100644
index 00000000..8d2e256b
--- /dev/null
+++ b/crates/i18n/src/fold.rs
@@ -0,0 +1,424 @@
+//! Case- and accent-insensitive matching for search fields, with a map back to the original text
+//! for highlighting.
+//!
+//! [`Folder::fold`] turns text into a search key: compatibility forms decomposed (`fi` → `fi`,
+//! full-width `Ａ` → `a`, `㎏` → `kg`), lower case, `ß` → `ss`, final `ς` → `σ`, and with accents
+//! ignored (the default) combining accents, Hebrew points and Arabic vowel marks dropped and the
+//! few letters with built-in strokes mapped to their base (`ø`, `ł`, `đ`, `ı`, `æ` → `ae`), and
+//! Persian letter forms mapped to the Arabic ones (`ک` → `ك`, `ی` → `ي`, `ة` → `ه`). Decimal
+//! digits of every script fold to ASCII (`١٢` → `12`). Invisible format characters (soft
+//! hyphens, zero-width joiners, bidi isolates) are dropped too.
+//!
+//! Dotted and dotless i follow the locale when accents count. In Turkish and Azerbaijani, `I`
+//! folds to `ı` and `İ` to `i`; elsewhere both fold to `i` and `ı` stays a letter of its own.
+//! Ignoring accents, all four fold to `i`, so `istanbul` finds `İSTANBUL` and `irmak` finds
+//! `IRMAK` and `ırmak`. Plain `str::to_lowercase` follows no locale and turns `İ` into `i` plus a
+//! combining dot, which nothing typed would match.
+//!
+//! The Turkish i handling and sigma folding come from PdfCraft's `fold_case` (snipeTR,
+//! nevicia2010-hub).
+
+use std::ops::Range;
+
+use icu_normalizer::DecomposingNormalizerBorrowed;
+use icu_properties::props::{GraphemeExtend, HangulSyllableType};
+use icu_properties::{CodePointMapData, CodePointSetData};
+
+/// Folds text for one locale. Cheap to build and copy.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Folder {
+    turkic: bool,
+    accents: bool,
+}
+
+impl Folder {
+    /// Case- and accent-insensitive folding for `locale`, a language code such as `tr`, `pt-br`
+    /// or `zh-hant` (any case, `-` or `_`).
+    pub fn new(locale: &str) -> Folder {
+        let language = locale.split(['-', '_', '.', '@']).next().unwrap_or_default();
+        Folder { turkic: language.eq_ignore_ascii_case("tr") || language.eq_ignore_ascii_case("az"), accents: false }
+    }
+
+    /// Accents count: `é` no longer matches `e`, and a match can't end on a letter whose accent it
+    /// leaves out.
+    pub fn keep_accents(self) -> Folder {
+        Folder { accents: true, ..self }
+    }
+
+    /// `s` folded, with the map back to `s`.
+    pub fn fold(&self, s: &str) -> Folded {
+        let nfkd = DecomposingNormalizerBorrowed::new_nfkd();
+        let extend = CodePointSetData::new::<GraphemeExtend>();
+        let hangul = CodePointMapData::<HangulSyllableType>::new();
+        let mut text = String::with_capacity(s.len());
+        let mut starts = Vec::new();
+        // A cluster is a character and the combining marks after it, folded and mapped as one;
+        // conjoining jamo that spell one syllable are one cluster too.
+        let mut cluster_start = 0;
+        let mut chars = s.char_indices();
+        let mut prev = chars.next().map(|(_, c)| hangul.get(c));
+        for (i, c) in chars {
+            let kind = hangul.get(c);
+            if !extend.contains(c) && !prev.is_some_and(|p| continues_syllable(p, kind)) {
+                starts.push((text.len(), cluster_start));
+                self.fold_cluster(&nfkd.normalize(&s[cluster_start..i]), &mut text);
+                cluster_start = i;
+            }
+            prev = Some(kind);
+        }
+        if !s.is_empty() {
+            starts.push((text.len(), cluster_start));
+            self.fold_cluster(&nfkd.normalize(&s[cluster_start..]), &mut text);
+        }
+        starts.push((text.len(), s.len()));
+        Folded { text, starts }
+    }
+
+    /// `s` folded, without the map: a key to compare or store.
+    pub fn key(&self, s: &str) -> String {
+        self.fold(s).text
+    }
+
+    /// Whether `haystack` contains `needle`, both folded.
+    pub fn contains(&self, haystack: &str, needle: &str) -> bool {
+        self.fold(haystack).find(&self.fold(needle)).is_some()
+    }
+
+    /// One cluster, already in NFKD.
+    fn fold_cluster(&self, cluster: &str, out: &mut String) {
+        let mut chars = cluster.chars().peekable();
+        while let Some(c) = chars.next() {
+            match c {
+                // `İ` decomposes to `I` and a combining dot above: the dot of a lower-case `i`.
+                'I' if chars.peek() == Some(&'\u{307}') => {
+                    chars.next();
+                    out.push('i');
+                }
+                'I' if self.turkic && self.accents => out.push('ı'),
+                // Persian heh with hamza above (ۀ) decomposes to ae (ە) and hamza.
+                '\u{6D5}' if !self.accents && chars.peek() == Some(&'\u{654}') => {
+                    chars.next();
+                    out.push('ه');
+                }
+                'ß' | 'ẞ' => out.push_str("ss"),
+                c if let Some(d) = ascii_digit(c) => out.push(d),
+                'Σ' | 'σ' | 'ς' => out.push('σ'),
+                c if ignorable(c) || (!self.accents && accent(c)) => {}
+                c => {
+                    for l in c.to_lowercase() {
+                        match base_letter(l) {
+                            Some(base) if !self.accents => out.push_str(base),
+                            _ => out.push(l),
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// The base of a lower-case letter whose diacritic is built in rather than combining, and the
+/// Arabic form of a letter that Persian and Urdu write differently: keheh (ک) is kaf (ك), Farsi
+/// yeh (ی) and alef maksura (ى) are yeh (ي), teh marbuta (ة) is heh (ه), alef wasla (ٱ) is alef.
+fn base_letter(c: char) -> Option<&'static str> {
+    Some(match c {
+        'ک' => "ك",
+        'ی' | 'ى' => "ي",
+        'ة' => "ه",
+        'ٱ' => "ا",
+        'ı' => "i",
+        'ø' => "o",
+        'ł' => "l",
+        'đ' => "d",
+        'ħ' => "h",
+        'ŧ' => "t",
+        'æ' => "ae",
+        'œ' => "oe",
+        _ => return None,
+    })
+}
+
+/// Invisible characters that only steer layout: soft hyphen, Arabic letter mark, the kashida
+/// that stretches Arabic words, Mongolian variation selectors, zero-width space and joiners, direction marks, embeddings and isolates,
+/// word joiner, variation selectors, byte order mark and tags.
+fn ignorable(c: char) -> bool {
+    matches!(c,
+        '\u{AD}' | '\u{61C}' | '\u{640}' | '\u{180B}'..='\u{180F}' | '\u{200B}'..='\u{200F}' | '\u{202A}'..='\u{202E}'
+        | '\u{2060}'..='\u{206F}' | '\u{FE00}'..='\u{FE0F}' | '\u{FEFF}' | '\u{E0000}'..='\u{E0FFF}')
+}
+
+/// Marks that searching without accents ignores: Latin, Greek and Cyrillic combining diacritics,
+/// Hebrew points and cantillation, Arabic vowel marks.
+/// Kana voicing marks, Indic and Thai vowel signs are letters' parts, not accents, and stay.
+fn accent(c: char) -> bool {
+    matches!(c,
+        '\u{300}'..='\u{36F}' | '\u{1AB0}'..='\u{1AFF}' | '\u{1DC0}'..='\u{1DFF}' | '\u{20D0}'..='\u{20FF}'
+        | '\u{FE20}'..='\u{FE2F}'
+        | '\u{591}'..='\u{5BD}' | '\u{5BF}' | '\u{5C1}' | '\u{5C2}' | '\u{5C4}' | '\u{5C5}' | '\u{5C7}'
+        | '\u{610}'..='\u{61A}' | '\u{64B}'..='\u{65F}' | '\u{670}' | '\u{6D6}'..='\u{6DC}'
+        | '\u{6DF}'..='\u{6E4}' | '\u{6E7}' | '\u{6E8}' | '\u{6EA}'..='\u{6ED}')
+}
+
+/// The first code point of each run of ten Unicode decimal digits (general category Nd), Unicode
+/// 16.0.
+const ZEROS: [u32; 76] = [
+    0x30, 0x660, 0x6F0, 0x7C0, 0x966, 0x9E6, 0xA66, 0xAE6, 0xB66, 0xBE6, 0xC66, 0xCE6, 0xD66, 0xDE6, 0xE50, 0xED0, 0xF20, 0x1040, 0x1090, 0x17E0,
+    0x1810, 0x1946, 0x19D0, 0x1A80, 0x1A90, 0x1B50, 0x1BB0, 0x1C40, 0x1C50, 0xA620, 0xA8D0, 0xA900, 0xA9D0, 0xA9F0, 0xAA50, 0xABF0, 0xFF10, 0x104A0,
+    0x10D30, 0x10D40, 0x11066, 0x110F0, 0x11136, 0x111D0, 0x112F0, 0x11450, 0x114D0, 0x11650, 0x116C0, 0x116D0, 0x116DA, 0x11730, 0x118E0, 0x11950,
+    0x11BF0, 0x11C50, 0x11D50, 0x11DA0, 0x11F50, 0x16130, 0x16A60, 0x16AC0, 0x16B50, 0x16D70, 0x1CCF0, 0x1D7CE, 0x1D7D8, 0x1D7E2, 0x1D7EC, 0x1D7F6,
+    0x1E140, 0x1E2F0, 0x1E4F0, 0x1E5F1, 0x1E950, 0x1FBF0,
+];
+
+/// A decimal digit of any script as its ASCII digit: `١٢` and `१२` search as `12`.
+fn ascii_digit(c: char) -> Option<char> {
+    let c = u32::from(c);
+    let zero = match ZEROS.binary_search(&c) {
+        Ok(i) => ZEROS.get(i),
+        Err(i) => ZEROS.get(i.checked_sub(1)?),
+    }?;
+    let value = c - zero;
+    if value < 10 { char::from_digit(value, 10) } else { None }
+}
+
+/// Whether a conjoining jamo of kind `next` continues the syllable a character of kind `prev`
+/// ends: a vowel after a leading consonant, a final consonant after a vowel or an open syllable
+/// (`가` and `ᆨ` spell `각`).
+fn continues_syllable(prev: HangulSyllableType, next: HangulSyllableType) -> bool {
+    matches!(
+        (prev, next),
+        (HangulSyllableType::LeadingJamo, HangulSyllableType::VowelJamo)
+            | (HangulSyllableType::VowelJamo | HangulSyllableType::LVSyllable, HangulSyllableType::TrailingJamo)
+    )
+}
+
+/// Folded text and where each part came from.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Folded {
+    text: String,
+    /// One (folded offset, source offset) per source cluster, in order, then both lengths. A
+    /// cluster folds to the text up to the next entry's folded offset, possibly none.
+    starts: Vec<(usize, usize)>,
+}
+
+impl Folded {
+    /// The folded text.
+    pub fn as_str(&self) -> &str {
+        &self.text
+    }
+
+    /// The source byte range that folded bytes `range` came from, widened to whole source
+    /// characters with their accents: `ss` in the folding of `Straße` maps back to `ß`, `e` in
+    /// that of `é` to the whole `é`. An empty range maps to an empty one.
+    pub fn source_range(&self, range: Range<usize>) -> Range<usize> {
+        // The last cluster starting at or before `at` is the one holding it: clusters that fold to
+        // nothing share their offset with the next one.
+        let cluster = |at: usize| self.starts.partition_point(|&(f, _)| f <= at).saturating_sub(1);
+        if range.is_empty() {
+            let s = self.starts[cluster(range.start)].1;
+            return s..s;
+        }
+        let first = cluster(range.start);
+        let last = cluster(range.end - 1);
+        self.starts[first].1..self.starts[(last + 1).min(self.starts.len() - 1)].1
+    }
+
+    /// The first match of `needle` (folded the same way), as a byte range of the source text.
+    /// An empty needle matches at the start.
+    pub fn find(&self, needle: &Folded) -> Option<Range<usize>> {
+        self.matches(needle).next()
+    }
+
+    /// Every non-overlapping match of `needle` (folded the same way), as byte ranges of the
+    /// source text. A match may start or end inside an expansion (`ss` of `ß`, `fi` of `fi`) but
+    /// not leave out a mark that follows a letter, so `re` doesn't match `ré` when accents count.
+    pub fn matches<'a>(&'a self, needle: &'a Folded) -> impl Iterator<Item = Range<usize>> + 'a {
+        let extend = CodePointSetData::new::<GraphemeExtend>();
+        let hangul = CodePointMapData::<HangulSyllableType>::new();
+        // The vowel and final consonant of a decomposed Hangul syllable continue it, like a mark,
+        // but only inside one source cluster: standalone jamo (`ㅋㅠ`, `ㅠㅠ`) are letters.
+        let starts_mark = move |at: usize| {
+            let Some(c) = self.text[at..].chars().next() else { return false };
+            if extend.contains(c) {
+                return true;
+            }
+            let inside = self.starts.binary_search_by_key(&at, |&(f, _)| f).is_err();
+            inside && self.text[..at].chars().next_back().is_some_and(|p| continues_syllable(hangul.get(p), hangul.get(c)))
+        };
+        let n = needle.text.as_str();
+        let mut from = 0;
+        let mut done = false;
+        std::iter::from_fn(move || {
+            if done {
+                return None;
+            }
+            if n.is_empty() {
+                done = true;
+                return Some(0..0);
+            }
+            while let Some(i) = self.text.get(from..).and_then(|t| t.find(n)) {
+                let start = from + i;
+                let end = start + n.len();
+                if !starts_mark(start) && !starts_mark(end) {
+                    from = end;
+                    return Some(self.source_range(start..end));
+                }
+                from = start + self.text[start..].chars().next().map_or(1, char::len_utf8);
+            }
+            done = true;
+            None
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn key(locale: &str, s: &str) -> String {
+        Folder::new(locale).key(s)
+    }
+
+    fn key_accents(locale: &str, s: &str) -> String {
+        Folder::new(locale).keep_accents().key(s)
+    }
+
+    #[test]
+    fn folding_table() {
+        let nfd = |s: &str| DecomposingNormalizerBorrowed::new_nfd().normalize(s).into_owned();
+        // (locale, input, ignoring accents, keeping accents)
+        let table = [
+            ("en", "Hello WORLD", "hello world".to_owned(), "hello world".to_owned()),
+            ("en", "İSTANBUL", "istanbul".into(), "istanbul".into()),
+            ("tr", "İSTANBUL", "istanbul".into(), "istanbul".into()),
+            ("en", "IRMAK ırmak", "irmak irmak".into(), "irmak ırmak".into()),
+            ("tr", "IRMAK ırmak", "irmak irmak".into(), "ırmak ırmak".into()),
+            ("az", "İIıi", "iiii".into(), "iııi".into()),
+            ("tr-TR", "Şişli", "sisli".into(), nfd("şişli")),
+            ("de", "Straße STRAẞE", "strasse strasse".into(), "strasse strasse".into()),
+            ("el", "ΟΔΥΣΣΕΥΣ οδυσσευς", "οδυσσευσ οδυσσευσ".into(), "οδυσσευσ οδυσσευσ".into()),
+            ("el", "Ἀθῆναι", "αθηναι".into(), nfd("ἀθῆναι")),
+            ("fr", "Œuvre ÉTÉ", "oeuvre ete".into(), nfd("œuvre été")),
+            ("da", "Ærø", "aero".into(), nfd("ærø")),
+            ("pl", "Łódź", "lodz".into(), nfd("łódź")),
+            ("vi", "Đà Nẵng", "da nang".into(), nfd("đà nẵng")),
+            ("en", "final ff", "final ff".into(), "final ff".into()),
+            ("ja", "ＡＢＣ１２３　ｶﾞ", nfd("abc123 ガ"), nfd("abc123 ガ")),
+            ("ar", "مُحَمَّد أحمـــد", nfd("محمد احمد"), nfd("مُحَمَّد أحمد")),
+            ("he", "שָׁלוֹם", "שלום".into(), nfd("שָׁלוֹם")),
+            ("en", "soft\u{AD}ware \u{2068}name\u{2069}", "software name".into(), "software name".into()),
+            ("ru", "Ёлка", "елка".into(), nfd("ёлка")),
+            ("ar", "Layer ١٢ ۳۴ १२", "layer 12 34 12".into(), "layer 12 34 12".into()),
+            ("fa", "کتاب یک", "كتاب يك".into(), "کتاب یک".into()),
+            ("fa", "خانۀ", "خانه".into(), nfd("خانۀ")),
+            ("ar", "مدرسة على إسلام آمن", "مدرسه علي اسلام امن".into(), nfd("مدرسة على إسلام آمن")),
+        ];
+        for (locale, input, ignoring, keeping) in table {
+            assert_eq!(key(locale, input), ignoring, "{locale} {input}");
+            assert_eq!(key_accents(locale, input), keeping, "{locale} {input}, accents kept");
+        }
+    }
+
+    #[test]
+    fn turkish_i_depends_on_locale_when_accents_count() {
+        let tr = Folder::new("tr").keep_accents();
+        let en = Folder::new("en").keep_accents();
+        assert!(tr.contains("IRMAK", "ırmak") && !tr.contains("IRMAK", "irmak"));
+        assert!(en.contains("IRMAK", "irmak") && !en.contains("IRMAK", "ırmak"));
+        assert!(tr.contains("İSTANBUL", "istanbul") && en.contains("İSTANBUL", "istanbul"));
+        for locale in ["tr", "en"] {
+            let f = Folder::new(locale);
+            assert!(f.contains("IRMAK", "ırmak") && f.contains("ırmak", "IRMAK") && f.contains("İzmir", "izmir"));
+        }
+    }
+
+    #[test]
+    fn matches_map_back_to_the_source() {
+        let f = Folder::new("en");
+        fn find<'a>(f: Folder, haystack: &'a str, needle: &str) -> Option<&'a str> {
+            f.fold(haystack).find(&f.fold(needle)).map(|r| &haystack[r])
+        }
+        let find = |haystack, needle| find(f, haystack, needle);
+        assert_eq!(find("Große Straße", "strasse"), Some("Straße"));
+        assert_eq!(find("Große Straße", "SS"), Some("ß"));
+        assert_eq!(find("Große Straße", "sse"), Some("ße"));
+        assert_eq!(find("Café crème", "creme"), Some("crème"));
+        assert_eq!(find("Cafe\u{301} noir", "cafe"), Some("Cafe\u{301}"));
+        assert_eq!(find("Ｆｉｌｅ ２", "file 2"), Some("Ｆｉｌｅ ２"));
+        assert_eq!(find("the final cut", "fin"), Some("fin"));
+        assert_eq!(find("Layer \u{2068}İSTANBUL\u{2069}", "istanbul"), Some("İSTANBUL"));
+        assert_eq!(find("abc", "x"), None);
+        assert_eq!(find("abc", ""), Some(""));
+
+        let all: Vec<_> = f.fold("Ab ab AB").matches(&f.fold("ab")).collect();
+        assert_eq!(all, [0..2, 3..5, 6..8]);
+    }
+
+    #[test]
+    fn persian_and_arabic_letters_match() {
+        let f = Folder::new("fa");
+        // Persian keheh and Farsi yeh against Arabic kaf and yeh, and hamza forms of alef.
+        assert!(f.contains("كتاب عربي", "کتاب عربی"));
+        assert!(f.contains("کتاب عربی", "كتاب عربي"));
+        assert!(f.contains("أحمد إبراهيم", "احمد ابراهیم"));
+        assert!(f.contains("مدرسة", "مدرسه"));
+        assert_eq!(f.fold("Layer ١٢").find(&f.fold("layer 12")), Some(0.."Layer ١٢".len()));
+        assert!(Folder::new("en").keep_accents().contains("Layer ١٢", "layer 12"));
+        let digits = ZEROS.iter().map(|&zero| char::from_u32(zero + 7).unwrap());
+        assert!(digits.clone().all(|d| d.is_numeric() && ascii_digit(d) == Some('7')));
+        assert_eq!(ascii_digit('\u{1D800}'), None);
+        assert_eq!(ascii_digit('/'), None);
+    }
+
+    #[test]
+    fn accents_count_only_whole_letters() {
+        let f = Folder::new("fr").keep_accents();
+        assert!(!f.contains("ré", "re"));
+        assert!(f.contains("ré", "RÉ") && f.contains("re\u{301}", "ré"));
+        assert!(f.contains("ré", "é"));
+        // Kana voicing marks stay even with accents ignored: か doesn't find が.
+        assert!(!Folder::new("ja").contains("が", "か"));
+        // Nor does a Hangul syllable without its final consonant: 하 doesn't find 한.
+        let ko = Folder::new("ko");
+        assert!(!ko.contains("한국", "하") && !ko.keep_accents().contains("한국", "하"));
+        assert!(ko.contains("한국", "한") && ko.contains("하늘", "하"));
+        // Conjoining jamo spell the same syllable; compatibility jamo stand alone.
+        assert!(!ko.contains("\u{1112}\u{1161}\u{11AB}", "하") && ko.contains("\u{1112}\u{1161}\u{11AB}", "한"));
+        assert!(!ko.contains("하\u{11AB}", "하"));
+        for (haystack, needle) in [("ㅠㅠ", "ㅠ"), ("ㅠㅠ", "ㅠㅠ"), ("ㅋㅠ", "ㅋ"), ("ㅋㅠ", "ㅠ"), ("ㅋㅋㅋ", "ㅋㅋ"), ("ㄳ", "ㄳ"), ("값ㄳ", "ㄳ")]
+        {
+            assert!(ko.contains(haystack, needle), "{haystack} {needle}");
+        }
+        assert_eq!(ko.fold("ㅋㅠㅠ").find(&ko.fold("ㅠ")).map(|r| r.start), Some("ㅋ".len()));
+    }
+
+    #[test]
+    fn source_ranges_round_trip() {
+        let f = Folder::new("de");
+        for s in ["Straße", "ffi Ａ", "e\u{301}\u{AD}x", "", "İı", "\u{301}a"] {
+            let folded = f.fold(s);
+            let text = folded.as_str();
+            // A leading mark folds to nothing and has no part in any match.
+            let whole = if s.starts_with('\u{301}') { 2..s.len() } else { 0..s.len() };
+            assert_eq!(folded.source_range(0..text.len()), whole, "{s:?}");
+            // Every folded character maps to a non-empty source range that folds back to text
+            // containing it.
+            for (i, c) in text.char_indices() {
+                let r = folded.source_range(i..i + c.len_utf8());
+                assert!(!r.is_empty() && f.key(&s[r.clone()]).contains(c), "{s:?} {i} {r:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn folding_is_idempotent() {
+        // A folded query folds to itself, so a stored key can be searched with a fresh fold.
+        for locale in ["en", "tr"] {
+            for f in [Folder::new(locale), Folder::new(locale).keep_accents()] {
+                for c in ('\0'..='\u{FFFF}').chain('\u{1D400}'..='\u{1D7FF}') {
+                    let once = f.key(c.encode_utf8(&mut [0; 4]));
+                    assert_eq!(f.key(&once), once, "{locale} {:?} U+{:04X}", f, c as u32);
+                }
+            }
+        }
+    }
+}
diff --git a/crates/i18n/src/format.rs b/crates/i18n/src/format.rs
new file mode 100644
index 00000000..14eb8c10
--- /dev/null
+++ b/crates/i18n/src/format.rs
@@ -0,0 +1,392 @@
+//! Numbers, percentages and counts written for a formatting [`Region`], on ICU4X's decimal
+//! formatter with CLDR data for every CLDR locale (`data/generate.sh`).
+
+use std::fmt;
+
+use fixed_decimal::{Decimal, Sign};
+use icu_decimal::{DecimalFormatter, parts};
+use icu_locale_core::Locale;
+use icu_locale_core::extensions::unicode::{key, value};
+use writeable::{Part, PartsWrite, Writeable};
+
+use crate::Region;
+use crate::data::{self, PERCENT};
+use crate::number::Marks;
+
+/// Which digits numbers are written in.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub enum Digits {
+    /// The locale's own: Arabic-Indic in Egypt (`١٢٣`), Persian in Iran (`۱۲۳`), else `0`–`9`.
+    #[default]
+    Locale,
+    /// `0`–`9` everywhere, for users who read Arabic or Persian with Latin digits.
+    Latin,
+}
+
+/// How numbers are written in a formatting region: digits, decimal and grouping separators,
+/// grouping sizes (`1,234,567`, Indian `12,34,567`) and the percent sign. Build it once per region
+/// and keep it; [`crate::I18n`] holds one for counts, sizes and measures.
+#[derive(Debug)]
+pub struct Format {
+    /// `None` only if the data doesn't load: numbers are then written as Rust writes them.
+    decimal: Option<DecimalFormatter>,
+    /// The system's separators where they differ from the locale's; an empty `group` is none.
+    group: Option<String>,
+    point: Option<String>,
+    percent: (&'static str, &'static str),
+    /// The marks [`Format::parse`] reads.
+    pub(crate) marks: Marks,
+}
+
+impl Format {
+    /// The format for `region`'s number locale. With Latin digits, a decimal or grouping separator
+    /// the region carries (Windows' and macOS's own settings) replaces the locale's.
+    pub fn new(region: &Region, digits: Digits) -> Format {
+        let mut locale = Locale::try_from_str(&region.numbers).unwrap_or(Locale::UNKNOWN);
+        if digits == Digits::Latin {
+            locale.extensions.unicode.keywords.set(key!("nu"), value!("latn"));
+        }
+        let decimal = data::provider().and_then(|p| DecimalFormatter::try_new_with_buffer_provider(p, (&locale).into(), Default::default()).ok());
+        let mut format = Format { decimal, group: None, point: None, percent: ("", "%"), marks: Marks::default() };
+        // The locale's own separators and digits, read from a number that shows them all.
+        let probe = format.parts(&Decimal::try_from_str("-1234567.5").unwrap_or_default());
+        let latin = probe.integer.starts_with(|c: char| c.is_ascii_digit());
+        if latin {
+            if let Some(point) = region.decimal.map(String::from).filter(|p| *p != probe.point) {
+                format.point = Some(point);
+            }
+            if let Some(g) = region.grouping.map(|g| g.map(String::from).unwrap_or_default()).filter(|g| *g != probe.group) {
+                format.group = Some(g);
+            }
+            // A grouping mark equal to the decimal mark (`1,234,5`) wouldn't read back. With a
+            // decimal comma and the locale's grouping, `1,234.5` becomes `1.234,5`; a grouping
+            // comma the system sets as well (Windows always sets one) leaves no grouping.
+            let point = format.point.as_deref().unwrap_or(&probe.point);
+            if format.group.as_deref().unwrap_or(&probe.group) == point {
+                let swapped = region.grouping.is_none() && probe.point != point;
+                format.group = Some(if swapped { probe.point.clone() } else { String::new() });
+            }
+        }
+        format.percent = percent_affixes(&region.numbers, latin);
+        let point = format.point.clone().unwrap_or(probe.point);
+        let group = format.group.clone().unwrap_or(probe.group);
+        // Latin digits typed into an Arabic-Indic format take the locale's Latin marks.
+        let comma = match (latin, digits) {
+            (true, _) => point == "," || group == ".",
+            (false, Digits::Locale) => !Format::new(region, Digits::Latin).marks.point,
+            (false, Digits::Latin) => false,
+        };
+        format.marks = Marks::new(&point, &group, !comma);
+        format
+    }
+
+    /// The format for a locale tag (`de-CH`, `ar-EG`), with the locale's own digits.
+    pub fn from_tag(tag: &str) -> Format {
+        Format::new(&Region::from_tag(tag), Digits::Locale)
+    }
+
+    /// A whole number: `1,234,567`, `1.234.567`, `١٬٢٣٤٬٥٦٧`.
+    pub fn integer(&self, n: impl Into<i128>) -> String {
+        self.write(&Decimal::from(n.into()))
+    }
+
+    /// `value` rounded to `decimals` digits after the decimal separator; infinities and NaN are
+    /// `∞`, `-∞` and `NaN`.
+    pub fn number(&self, value: f64, decimals: usize) -> String {
+        match to_decimal(value, decimals) {
+            Some(d) => self.write(&d),
+            None => non_finite(value).to_owned(),
+        }
+    }
+
+    /// [`Self::number`] without grouping separators, for values such as pixel sizes and years:
+    /// `1920`, `١٩٢٠`, `1234,5`.
+    pub fn number_ungrouped(&self, value: f64, decimals: usize) -> String {
+        match to_decimal(value, decimals) {
+            Some(d) => {
+                let p = self.parts_with(&d, Some(""));
+                p.sign + &p.text
+            }
+            None => non_finite(value).to_owned(),
+        }
+    }
+
+    /// `ratio` as a percentage with `decimals` digits after the decimal separator: `0.5` is
+    /// `50%`, `50 %` (French, German), `%50` (Turkish), `٥٠٪؜` (Egyptian Arabic).
+    pub fn percent(&self, ratio: f64, decimals: usize) -> String {
+        let Some(d) = to_decimal(ratio * 100.0, decimals) else {
+            return format!("{}{}{}", self.percent.0, non_finite(ratio), self.percent.1);
+        };
+        let p = self.parts(&d);
+        format!("{}{}{}{}", p.sign, self.percent.0, p.text, self.percent.1)
+    }
+
+    /// `d` as text, the sign in place.
+    pub(crate) fn write(&self, d: &Decimal) -> String {
+        let p = self.parts(d);
+        p.sign + &p.text
+    }
+
+    fn parts(&self, d: &Decimal) -> Written {
+        self.parts_with(d, self.group.as_deref())
+    }
+
+    /// `d` taken apart, with `group` in place of the locale's grouping separator if set (`""`
+    /// drops it).
+    fn parts_with(&self, d: &Decimal, group: Option<&str>) -> Written {
+        let mut sink = Sink { group, point: self.point.as_deref(), into: Target::Text, w: Written::default() };
+        let written = match &self.decimal {
+            Some(f) => f.format(d).write_to_parts(&mut sink),
+            None => fmt::Write::write_str(&mut sink, &d.to_string()),
+        };
+        if written.is_err() {
+            return Written { text: d.to_string(), ..Written::default() };
+        }
+        sink.w
+    }
+}
+
+/// A formatted number taken apart: its sign, the rest, and the separators and integer digits as
+/// the locale wrote them.
+#[derive(Default)]
+struct Written {
+    sign: String,
+    text: String,
+    integer: String,
+    group: String,
+    point: String,
+}
+
+#[derive(Clone, Copy, PartialEq)]
+enum Target {
+    Text,
+    Sign,
+    /// A separator the region replaces; the locale's goes to `group` or `point` only.
+    Replaced,
+}
+
+/// Writes the formatter's parts into [`Written`], swapping in the region's separators.
+struct Sink<'a> {
+    group: Option<&'a str>,
+    point: Option<&'a str>,
+    into: Target,
+    w: Written,
+}
+
+impl fmt::Write for Sink<'_> {
+    fn write_str(&mut self, s: &str) -> fmt::Result {
+        match self.into {
+            Target::Text => self.w.text.push_str(s),
+            Target::Sign => self.w.sign.push_str(s),
+            Target::Replaced => {}
+        }
+        Ok(())
+    }
+}
+
+impl PartsWrite for Sink<'_> {
+    type SubPartsWrite = Self;
+
+    fn with_part(&mut self, part: Part, mut f: impl FnMut(&mut Self) -> fmt::Result) -> fmt::Result {
+        let outer = self.into;
+        let start = self.w.text.len();
+        let replacement = match part {
+            p if p == parts::GROUP => self.group,
+            p if p == parts::DECIMAL => self.point,
+            _ => None,
+        };
+        if let Some(r) = replacement {
+            self.w.text.push_str(r);
+            self.into = Target::Replaced;
+        } else if part == parts::MINUS_SIGN || part == parts::PLUS_SIGN {
+            self.into = Target::Sign;
+        }
+        let result = f(self);
+        self.into = outer;
+        if replacement.is_none() {
+            let written = self.w.text.get(start..).unwrap_or_default();
+            let slot = match part {
+                p if p == parts::GROUP => &mut self.w.group,
+                p if p == parts::DECIMAL => &mut self.w.point,
+                p if p == parts::INTEGER => &mut self.w.integer,
+                _ => return result,
+            };
+            if slot.is_empty() {
+                *slot = written.to_owned();
+            }
+        }
+        result
+    }
+}
+
+/// `value` rounded to `decimals` digits after the point; `None` for infinities and NaN. A value
+/// that rounds to zero has no sign.
+pub(crate) fn to_decimal(value: f64, decimals: usize) -> Option<Decimal> {
+    if !value.is_finite() {
+        return None;
+    }
+    let mut d = Decimal::try_from_str(&format!("{value:.decimals$}")).ok()?;
+    if d.absolute.is_zero() {
+        d.sign = Sign::None;
+    }
+    Some(d)
+}
+
+/// CLDR's root symbols for a value that isn't finite.
+fn non_finite(value: f64) -> &'static str {
+    match value {
+        f64::INFINITY => "∞",
+        f64::NEG_INFINITY => "-∞",
+        _ => "NaN",
+    }
+}
+
+/// The percent affixes for a number locale (`ar-EG`), found by dropping trailing subtags.
+fn percent_affixes(tag: &str, latin: bool) -> (&'static str, &'static str) {
+    let mut tag = tag;
+    loop {
+        if let Some((_, _, before, after)) = PERCENT.iter().find(|(l, lat, _, _)| *lat == latin && l.eq_ignore_ascii_case(tag)) {
+            return (before, after);
+        }
+        match tag.rsplit_once('-') {
+            Some((parent, _)) => tag = parent,
+            None => return ("", "%"),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn latin(tag: &str) -> Format {
+        Format::new(&Region::from_tag(tag), Digits::Latin)
+    }
+
+    #[test]
+    fn locale_digits_and_separators() {
+        for (tag, integer, number) in [
+            ("en", "1,234,567", "1,234.5"),
+            ("ja", "1,234,567", "1,234.5"),
+            ("de", "1.234.567", "1.234,5"),
+            ("fr", "1\u{202f}234\u{202f}567", "1\u{202f}234,5"),
+            ("hi", "12,34,567", "1,234.5"),
+            ("ar-EG", "١٬٢٣٤٬٥٦٧", "١٬٢٣٤٫٥"),
+            ("fa", "۱٬۲۳۴٬۵۶۷", "۱٬۲۳۴٫۵"),
+        ] {
+            let f = Format::from_tag(tag);
+            assert_eq!((f.integer(1_234_567), f.number(1234.5, 1)), (integer.into(), number.into()), "{tag}");
+        }
+        // CLDR writes Arabic without a region in Latin digits.
+        assert_eq!(Format::from_tag("ar").number(1234.5, 1), "1,234.5");
+    }
+
+    #[test]
+    fn ungrouped_numbers() {
+        for (tag, want) in [("en", "1920"), ("de", "-1234567,5"), ("hi", "1234567"), ("ar-EG", "١٩٢٠")] {
+            let value = if tag == "de" {
+                -1_234_567.5
+            } else if tag == "hi" {
+                1_234_567.0
+            } else {
+                1920.0
+            };
+            let decimals = usize::from(tag == "de");
+            assert_eq!(Format::from_tag(tag).number_ungrouped(value, decimals), want, "{tag}");
+        }
+        let mut region = Region::from_tag("en-US");
+        region.decimal = Some(',');
+        assert_eq!(Format::new(&region, Digits::Locale).number_ungrouped(1234.5, 1), "1234,5", "the system's decimal mark stays");
+        assert_eq!(Format::from_tag("en").number_ungrouped(f64::INFINITY, 0), "∞");
+    }
+
+    #[test]
+    fn forced_latin_digits() {
+        assert_eq!(latin("ar-EG").number(1234.5, 1), "1,234.5");
+        assert_eq!(latin("fa").integer(1_234_567), "1,234,567");
+        assert_eq!(latin("de").number(1234.5, 1), "1.234,5", "a Latin locale is unchanged");
+    }
+
+    #[test]
+    fn cldr_separators_for_every_region() {
+        for (tag, want) in [
+            ("en-PL", "1.234.567,5"),
+            ("en-DE", "1.234.567,5"),
+            ("ar-MA", "1.234.567,5"),
+            ("de-CH", "1'234'567.5"),
+            ("nb-NO", "1\u{a0}234\u{a0}567,5"),
+            ("sk-SK", "1\u{a0}234\u{a0}567,5"),
+            ("bn-BD", "১২,৩৪,৫৬৭.৫"),
+            ("he-IL", "1,234,567.5"),
+            ("km", "1,234,567.5"),
+            ("lo", "1.234.567,5"),
+        ] {
+            assert_eq!(Format::from_tag(tag).number(1_234_567.5, 1), want, "{tag}");
+        }
+    }
+
+    #[test]
+    fn system_separators() {
+        // A decimal comma the system sets moves the grouping out of its way.
+        let mut region = Region::from_tag("en-US");
+        region.decimal = Some(',');
+        assert_eq!(Format::new(&region, Digits::Locale).number(1234.5, 1), "1.234,5");
+        let mut region = Region::from_tag("de-DE");
+        region.grouping = Some(Some('\u{a0}'));
+        assert_eq!(Format::new(&region, Digits::Locale).number(1234.5, 1), "1\u{a0}234,5");
+        region.decimal = Some('.');
+        assert_eq!(Format::new(&region, Digits::Locale).number(1234.5, 1), "1\u{a0}234.5");
+        region.grouping = Some(None);
+        assert_eq!(Format::new(&region, Digits::Locale).integer(1_234_567), "1234567", "no grouping");
+        // A system's separators don't apply to Arabic-Indic digits.
+        let mut region = Region::from_tag("ar-EG");
+        region.grouping = Some(Some(','));
+        assert_eq!(Format::new(&region, Digits::Locale).number(1234.5, 1), "١٬٢٣٤٫٥");
+    }
+
+    /// Windows always sets `sThousand`, so a decimal comma the user picks arrives beside a grouping
+    /// comma: the numbers drop grouping rather than read `1,234,5`.
+    #[test]
+    fn a_system_grouping_mark_equal_to_the_decimal_mark_is_dropped() {
+        let reg = |pairs: &'static [(&'static str, &'static str)]| move |n: &str| pairs.iter().find(|(k, _)| *k == n).map(|(_, v)| v.to_string());
+        let region = crate::region::from_windows(reg(&[("LocaleName", "en-US"), ("sDecimal", ","), ("sThousand", ",")]), || None);
+        let format = Format::new(&region, Digits::Locale);
+        assert_eq!((format.number(1234.5, 1), format.integer(1_234_567)), ("1234,5".to_owned(), "1234567".to_owned()));
+        let region = crate::region::from_windows(reg(&[("LocaleName", "de-DE"), ("sDecimal", ","), ("sThousand", ",")]), || None);
+        assert_eq!(Format::new(&region, Digits::Locale).number(1234.5, 1), "1234,5");
+        let region = crate::region::from_windows(reg(&[("LocaleName", "en-US"), ("sDecimal", "."), ("sThousand", ".")]), || None);
+        assert_eq!(Format::new(&region, Digits::Locale).number(1234.5, 1), "1234.5");
+    }
+
+    #[test]
+    fn a_digit_system_the_region_names_is_used() {
+        assert_eq!(Format::new(&Region::from_tag("ar-EG-u-nu-latn"), Digits::Locale).number(1234.5, 1), "1,234.5");
+        assert_eq!(Format::new(&Region::from_tag("ar_EG@numbers=latn"), Digits::Locale).integer(5), "5");
+        assert_eq!(Format::new(&Region::from_tag("en-US-u-nu-arab"), Digits::Locale).integer(5), "٥");
+    }
+
+    #[test]
+    fn percentages() {
+        for (tag, want) in
+            [("en", "50%"), ("de", "50\u{a0}%"), ("fr", "12,5\u{a0}%"), ("tr", "%50"), ("ar-EG", "٥٠٪\u{61c}"), ("fa", "۵۰٪"), ("hi", "50%")]
+        {
+            let decimals = if tag == "fr" { 1 } else { 0 };
+            let ratio = if tag == "fr" { 0.125 } else { 0.5 };
+            assert_eq!(Format::from_tag(tag).percent(ratio, decimals), want, "{tag}");
+        }
+        assert_eq!(Format::from_tag("tr").percent(-0.2, 0), "-%20", "the sign leads the pattern");
+        assert_eq!(latin("fa").percent(0.5, 0), "50%");
+    }
+
+    #[test]
+    fn signs_and_odd_values() {
+        let en = Format::from_tag("en");
+        assert_eq!(en.number(-1234.5, 0), "-1,234");
+        assert_eq!(en.number(-0.04, 1), "0.0", "no sign on zero");
+        assert_eq!(en.number(f64::INFINITY, 1), "∞");
+        assert_eq!(en.number(f64::NEG_INFINITY, 1), "-∞");
+        assert_eq!(en.number(f64::NAN, 1), "NaN");
+        assert_eq!(Format::from_tag("de").percent(f64::NAN, 0), "NaN\u{a0}%");
+        assert_eq!(en.integer(-5_i64), "-5");
+    }
+}
diff --git a/crates/i18n/src/lib.rs b/crates/i18n/src/lib.rs
index 2d0e05a0..17b9eaa3 100644
--- a/crates/i18n/src/lib.rs
+++ b/crates/i18n/src/lib.rs
@@ -3,18 +3,60 @@
 //! An app embeds the [craft-i18n](https://github.com/benandez/craft-i18n) catalogs at build time
 //! as an [`Embedded`] static, builds one [`I18n`] from it, and looks English source text up in a
 //! [`Lang`]. A missing translation is the English itself; nothing here fails.
+//!
+//! Counts ([`I18n::trn`]), file sizes and measures write their numbers as the formatting
+//! [`Region`] does ([`I18n::format`]): grouped (`1.234`, `12,34,567`) and in the region's digits
+//! (`١٬٢٣٤`). Text that goes into documents or file names should use [`I18n::trn_plain`], which
+//! writes `0`–`9` without grouping.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 mod catalog;
+#[cfg(feature = "collate")]
+mod collate;
+mod fold;
+mod format;
+mod number;
+mod region;
 mod scripts;
+mod size;
+
+/// The CLDR number and plural data for every CLDR locale, from `data/generate.sh`.
+mod data {
+    use std::sync::OnceLock;
+
+    use icu_locale_fallback::LocaleFallbacker;
+    use icu_provider_adapters::fallback::LocaleFallbackProvider;
+    use icu_provider_blob::BlobDataProvider;
+
+    include!("../data/locales.rs");
+
+    /// The number and plural data, read once; `None` if the blob doesn't load.
+    pub(crate) fn provider() -> Option<&'static LocaleFallbackProvider<BlobDataProvider>> {
+        static PROVIDER: OnceLock<Option<LocaleFallbackProvider<BlobDataProvider>>> = OnceLock::new();
+        PROVIDER
+            .get_or_init(|| {
+                let blob = BlobDataProvider::try_new_from_static_blob(include_bytes!("../data/numbers.postcard")).ok()?;
+                Some(LocaleFallbackProvider::new(blob, LocaleFallbacker::new().static_to_owned()))
+            })
+            .as_ref()
+    }
+}
 
 use std::collections::{BTreeMap, BTreeSet, HashMap};
-use std::sync::{Mutex, OnceLock, PoisonError};
+use std::sync::{Arc, Mutex, OnceLock, PoisonError, RwLock};
 
-use intl_pluralrules::{PluralCategory, PluralRuleType, PluralRules};
-use unic_langid::LanguageIdentifier;
+use icu_locale_core::Locale as IcuLocale;
+use icu_plurals::{PluralCategory, PluralOperands, PluralRules};
+use unicode_bidi::{BidiClass, bidi_class};
 
+#[cfg(feature = "collate")]
+pub use collate::Collator;
+pub use fold::{Folded, Folder};
+pub use format::{Digits, Format};
+pub use number::{NumberError, parse_number};
+pub use region::{HourCycle, Measurement, Paper, Region};
 pub use scripts::{Direction, Han, Script, base_direction, direction, han, scripts};
+pub use size::{FileSize, SizeUnit};
 
 /// The catalogs an app embeds, one entry per locale: (locale, shared catalog, the app's catalog).
 /// A missing catalog is `""`.
@@ -104,6 +146,8 @@ pub struct I18n {
     pseudo: Mutex<BTreeMap<String, &'static str>>,
     /// [`I18n::system_lang`], read once.
     system: OnceLock<Lang>,
+    /// [`I18n::format`]; the system region's until [`I18n::set_format`].
+    format: RwLock<Option<Arc<Format>>>,
 }
 
 impl I18n {
@@ -147,7 +191,7 @@ impl I18n {
                 l.chain = chain;
             }
         }
-        (I18n { locales, pseudo: Mutex::default(), system: OnceLock::new() }, problems)
+        (I18n { locales, pseudo: Mutex::default(), system: OnceLock::new(), format: RwLock::default() }, problems)
     }
 
     /// Parse every locale and list every problem, `<locale>/<common|app>: line N: …`, for a test or
@@ -209,9 +253,36 @@ impl I18n {
         self.find(lang, &[("@id", id), ("", label)]).unwrap_or(label)
     }
 
-    /// A count's wording in `lang`, `{n}` filled in. `one` and `other` are the English forms;
-    /// they are also the key of the `@plural` row, and the fallback.
+    /// A count's wording in `lang`, `{n}` filled in as [`I18n::format`] writes numbers: grouped and
+    /// in the region's digits, as a left-to-right isolate ([`ltr`]) when the wording has a
+    /// right-to-left letter. `one` and `other` are the English forms; they are also the key of the
+    /// `@plural` row, and the fallback.
     pub fn trn(&self, lang: Lang, n: u64, one: &str, other: &str) -> String {
+        let format = self.format();
+        self.plural(lang, Some(PluralOperands::from(n)), n == 1, &format.integer(n), one, other)
+    }
+
+    /// [`I18n::trn`] with `{n}` in `0`–`9` without grouping (`Copy 1234`) and no isolate marks
+    /// ([`strip_isolates`]), for text that goes into documents, file names or anything read back
+    /// later.
+    pub fn trn_plain(&self, lang: Lang, n: u64, one: &str, other: &str) -> String {
+        strip_isolates(&self.plural(lang, Some(PluralOperands::from(n)), n == 1, &n.to_string(), one, other))
+    }
+
+    /// [`I18n::trn`] for a count with `decimals` digits after the decimal separator (`1.5 files`).
+    /// The plural form follows the digits shown, so `1.0` takes English `other`; infinities and NaN
+    /// (`∞`, `NaN`) take `other` too.
+    pub fn trn_decimal(&self, lang: Lang, n: f64, decimals: usize, one: &str, other: &str) -> String {
+        let format = self.format();
+        let Some(d) = format::to_decimal(n, decimals) else {
+            return self.plural(lang, None, false, &format.number(n, decimals), one, other);
+        };
+        let english_one = d.to_string() == "1";
+        self.plural(lang, Some(PluralOperands::from(&d)), english_one, &format.write(&d), one, other)
+    }
+
+    /// `operands` `None` is the `other` category.
+    fn plural(&self, lang: Lang, operands: Option<PluralOperands>, english_one: bool, n: &str, one: &str, other: &str) -> String {
         let key = format!("{one}|{other}");
         let chain = self.locale(lang).map_or(&[][..], |l| l.chain.as_slice());
         let text = chain
@@ -220,19 +291,45 @@ impl I18n {
                 let locale = self.locales.get(i)?;
                 let forms = locale.parsed().rows.get("@plural")?.get(&key)?;
                 let (rules, categories) = locale.plural.as_ref()?;
-                let category = rules.select(n).ok()?;
-                // A category whole numbers up to 1000 never reach (French `many`) takes the last form.
-                let index = categories.iter().position(|c| *c == category).unwrap_or(categories.len().saturating_sub(1));
+                let category = operands.map_or(PluralCategory::Other, |o| rules.category_for(o));
+                // A category whole numbers up to 1000 never reach has no form of its own. Russian
+                // and Ukrainian decimals (`other`) take the `few` form (`1,5 файла`); any other
+                // (French `many` for a million) takes the last.
+                let index = categories
+                    .iter()
+                    .position(|c| *c == category)
+                    .or_else(|| categories.iter().position(|c| *c == PluralCategory::Few))
+                    .unwrap_or(categories.len().saturating_sub(1));
                 forms.split('|').nth(index)
             })
-            .unwrap_or(if n == 1 { one } else { other });
-        let text = fmt(text, &[("n", &n.to_string())]);
+            .unwrap_or(if english_one { one } else { other });
+        let text = fmt(text, &[("n", &ltr(n))]);
         if lang == Lang::PSEUDO {
             return marked(&text);
         }
         text
     }
 
+    /// How counts, file sizes and measures write numbers: [`Region::system`]'s format with the
+    /// locale's digits until [`I18n::set_format`], and again after [`I18n::reset_format`].
+    pub fn format(&self) -> Arc<Format> {
+        if let Some(f) = self.format.read().unwrap_or_else(PoisonError::into_inner).as_ref() {
+            return Arc::clone(f);
+        }
+        let mut slot = self.format.write().unwrap_or_else(PoisonError::into_inner);
+        Arc::clone(slot.get_or_insert_with(|| Arc::new(Format::new(&Region::system(), Digits::Locale))))
+    }
+
+    /// Write numbers as `format` does from now on: the user's region setting, or Latin digits.
+    pub fn set_format(&self, format: Format) {
+        *self.format.write().unwrap_or_else(PoisonError::into_inner) = Some(Arc::new(format));
+    }
+
+    /// Write numbers as the system region does again, undoing [`I18n::set_format`].
+    pub fn reset_format(&self) {
+        *self.format.write().unwrap_or_else(PoisonError::into_inner) = None;
+    }
+
     /// The languages to offer: English first, then the offered locales by code. Never the
     /// pseudo locale.
     pub fn languages(&self) -> Vec<Lang> {
@@ -311,29 +408,168 @@ impl I18n {
     }
 }
 
-/// Fill `{name}` placeholders from `args` in one pass. Unknown placeholders stay as written, and
-/// inserted values are never read as templates, so a file name containing `{n}` stays intact.
+/// Fill `{name}` placeholders from `args` in one pass. When the template or an inserted value
+/// has a right-to-left letter (Hebrew, Arabic and the like), or a value has a bidi control
+/// (an embedding, override, isolate or mark), each value goes in as a first-strong isolate
+/// (FSI…PDI), so its direction can't reorder the sentence around it: a Latin file name in an
+/// Arabic message stays where the translator put it, and an override in a file name ends with
+/// the name. Embeddings, overrides and isolates a value opens are closed inside its isolate. A
+/// value that already is one isolate keeps it; pass numbers, paths and codes through [`ltr`].
+/// Other text gets no marks, and a value's own isolate is taken off. Unknown placeholders stay as written,
+/// and inserted values are never read as templates, so a file name containing `{n}` stays intact.
 pub fn fmt(template: &str, args: &[(&str, &str)]) -> String {
-    let mut out = String::with_capacity(template.len());
+    fill(template, args, true)
+}
+
+/// [`fmt`] without isolates, for text that goes where the marks would get in the way: file
+/// names, logs, terminals, text compared or parsed later. Every isolate mark is taken off, in
+/// the template and in the values.
+pub fn fmt_plain(template: &str, args: &[(&str, &str)]) -> String {
+    strip_isolates(&fill(template, args, false))
+}
+
+const LRI: char = '\u{2066}';
+const RLI: char = '\u{2067}';
+const FSI: char = '\u{2068}';
+const PDI: char = '\u{2069}';
+const LRE: char = '\u{202A}';
+const RLE: char = '\u{202B}';
+const PDF: char = '\u{202C}';
+const LRO: char = '\u{202D}';
+const RLO: char = '\u{202E}';
+const LRM: char = '\u{200E}';
+const RLM: char = '\u{200F}';
+const ALM: char = '\u{061C}';
+
+/// `value` as a first-strong isolate (FSI…PDI): it takes the direction of its first strong
+/// letter and can't reorder the text around it. What [`fmt`] does to each value in text with a
+/// right-to-left letter.
+pub fn isolate(value: &str) -> String {
+    wrap(FSI, value)
+}
+
+/// `value` as a left-to-right isolate (LRI…PDI), for numbers, paths, file sizes, timecodes and
+/// codes, which read left to right in every language. In an RTL first-strong isolate, the
+/// segments of `/home/مستخدم/file.txt` would run right to left. [`fmt`] takes the isolate off
+/// again in text with no right-to-left letter.
+pub fn ltr(value: &str) -> String {
+    wrap(LRI, value)
+}
+
+/// `text` without isolate marks (LRI, RLI, FSI, PDI): a [`fmt`] or [`I18n::trn`] result made fit
+/// for a file name, a log or a comparison.
+pub fn strip_isolates(text: &str) -> String {
+    text.chars().filter(|c| !matches!(*c, LRI | RLI | FSI | PDI)).collect()
+}
+
+/// `value` between `initiator` and PDI, with every embedding, override and isolate it opens
+/// closed inside: a stray PDF or PDI is dropped, and open ones are closed in order. Under the
+/// bidi algorithm the outer PDI alone would close them, but a renderer that handles only
+/// embeddings would let them run on into the rest of the text.
+fn wrap(initiator: char, value: &str) -> String {
+    let mut out = String::with_capacity(value.len() + 6);
+    out.push(initiator);
+    // One entry per open initiator: true for an isolate, false for an embedding or override.
+    let mut open: Vec<bool> = Vec::new();
+    for c in value.chars() {
+        match c {
+            LRI | RLI | FSI => open.push(true),
+            LRE | RLE | LRO | RLO => open.push(false),
+            PDF if open.last() == Some(&false) => {
+                open.pop();
+            }
+            PDF => continue,
+            PDI if open.contains(&true) => {
+                while open.pop() == Some(false) {
+                    out.push(PDF);
+                }
+            }
+            PDI => continue,
+            _ => {}
+        }
+        out.push(c);
+    }
+    while let Some(isolate) = open.pop() {
+        out.push(if isolate { PDI } else { PDF });
+    }
+    out.push(PDI);
+    out
+}
+
+/// Whether `value`, without its own isolate, has a bidi control: an embedding, override,
+/// isolate or mark that could reorder the text around it unless it is contained.
+fn has_bidi_control(value: &str) -> bool {
+    !value.is_ascii() && unwrap_isolate(value).chars().any(|c| matches!(c, LRE | RLE | PDF | LRO | RLO | LRI | RLI | FSI | PDI | LRM | RLM | ALM))
+}
+
+/// Whether `text` has a strong right-to-left character (bidi class R or AL): the text that needs
+/// isolates.
+fn has_rtl(text: &str) -> bool {
+    !text.is_ascii() && text.chars().any(|c| matches!(bidi_class(c), BidiClass::R | BidiClass::AL))
+}
+
+/// `value` without its isolate, if it is exactly one.
+fn unwrap_isolate(value: &str) -> &str {
+    if is_one_isolate(value) {
+        // The initiator and PDI are three bytes each in UTF-8.
+        value.get(3..value.len() - 3).unwrap_or(value)
+    } else {
+        value
+    }
+}
+
+/// Whether `value` is exactly one isolate: an initiator, then the PDI that closes it last.
+fn is_one_isolate(value: &str) -> bool {
+    let mut depth = 0_usize;
+    let mut chars = value.chars().peekable();
+    while let Some(c) = chars.next() {
+        match c {
+            LRI | RLI | FSI => depth += 1,
+            PDI if depth > 0 => {
+                depth -= 1;
+                if depth == 0 {
+                    return chars.peek().is_none();
+                }
+            }
+            _ if depth == 0 => return false,
+            _ => {}
+        }
+    }
+    false
+}
+
+fn fill(template: &str, args: &[(&str, &str)], isolated: bool) -> String {
+    let mut pieces: Vec<(&str, bool)> = Vec::new();
     let mut rest = template;
     while let Some((before, after_open)) = rest.split_once('{') {
-        out.push_str(before);
+        pieces.push((before, false));
         let Some((name, after_close)) = after_open.split_once('}') else {
-            out.push('{');
+            pieces.push(("{", false));
             rest = after_open;
             break;
         };
         match args.iter().find(|(k, _)| *k == name) {
-            Some((_, value)) => out.push_str(value),
-            None => {
-                out.push('{');
-                out.push_str(name);
-                out.push('}');
-            }
+            Some((_, value)) => pieces.push((value, true)),
+            None => pieces.extend([("{", false), (name, false), ("}", false)]),
         }
         rest = after_close;
     }
-    out.push_str(rest);
+    pieces.push((rest, false));
+    let isolated = isolated && pieces.iter().any(|(text, value)| has_rtl(text) || (*value && has_bidi_control(text)));
+    let mut out = String::with_capacity(template.len());
+    for (text, value) in pieces {
+        match (value, isolated) {
+            (false, _) => out.push_str(text),
+            (true, false) => out.push_str(unwrap_isolate(text)),
+            (true, true) if text.is_empty() => {}
+            // Rebuilt rather than copied, so what it opens inside is closed too.
+            (true, true) if is_one_isolate(text) => {
+                let initiator = text.chars().next().unwrap_or(FSI);
+                out.push_str(&wrap(initiator, unwrap_isolate(text)));
+            }
+            (true, true) => out.push_str(&isolate(text)),
+        }
+    }
     out
 }
 
@@ -437,17 +673,22 @@ fn bare(code: &str) -> Locale {
 }
 
 /// `code`'s CLDR cardinal rules and the categories whole numbers 0..=1000 reach, in CLDR order
-/// (zero, one, two, few, many, other): one `@plural` form each. Regional and scripted codes fall
-/// back to the language's rules. CLDR's `pt` is Brazilian (0 is singular), so Portuguese other
-/// than `pt-br` takes `pt-PT`'s.
+/// (zero, one, two, few, many, other): one `@plural` form each. The rules are looked up by
+/// language alone: CLDR's parent of `sr-Latn` and `zh-Hant` is the root, whose only category is
+/// `other`. CLDR's `pt` is Brazilian (0 is singular), so Portuguese other than `pt-br` takes
+/// `pt-PT`'s. `None` for a language CLDR has no plural rules for.
 fn plural_rules(code: &str) -> Option<(PluralRules, Vec<PluralCategory>)> {
-    let code = if code == "pt" || (code.starts_with("pt-") && code != "pt-br") { "pt-pt" } else { code };
-    let id: LanguageIdentifier = code.parse().ok()?;
-    let language = LanguageIdentifier::from_parts(id.language, None, None, &[]);
-    let rules = PluralRules::create(id, PluralRuleType::CARDINAL).or_else(|_| PluralRules::create(language, PluralRuleType::CARDINAL)).ok()?;
+    let id = IcuLocale::try_from_str(code).ok()?.id;
+    let language = id.language.as_str();
+    if !data::PLURAL_LANGUAGES.contains(&language) {
+        return None;
+    }
+    let brazil = id.region.is_some_and(|r| r.as_str() == "BR");
+    let locale = IcuLocale::try_from_str(if language == "pt" && !brazil { "pt-PT" } else { language }).ok()?;
+    let rules = PluralRules::try_new_cardinal_with_buffer_provider(data::provider()?, (&locale).into()).ok()?;
     let mut categories = Vec::new();
     for n in 0..=1000_u32 {
-        let c = rules.select(n).ok()?;
+        let c = rules.category_for(n);
         if !categories.contains(&c) {
             categories.push(c);
         }
@@ -458,12 +699,12 @@ fn plural_rules(code: &str) -> Option<(PluralRules, Vec<PluralCategory>)> {
 
 fn rank(c: &PluralCategory) -> u8 {
     match c {
-        PluralCategory::ZERO => 0,
-        PluralCategory::ONE => 1,
-        PluralCategory::TWO => 2,
-        PluralCategory::FEW => 3,
-        PluralCategory::MANY => 4,
-        PluralCategory::OTHER => 5,
+        PluralCategory::Zero => 0,
+        PluralCategory::One => 1,
+        PluralCategory::Two => 2,
+        PluralCategory::Few => 3,
+        PluralCategory::Many => 4,
+        PluralCategory::Other => 5,
     }
 }
 
@@ -487,10 +728,12 @@ mod tests {
         ("de", "\tBad\n@nope\tA\tB\n\tUndo\tRückgängig\n", ""),
     ];
 
-    /// `embedded`, offering every locale in it.
+    /// `embedded`, offering every locale in it, with `en-US` numbers rather than the machine's.
     fn all(embedded: &'static Embedded) -> (I18n, Vec<String>) {
         let codes: Vec<&str> = embedded.iter().map(|(c, _, _)| *c).collect();
-        I18n::new(embedded, &codes)
+        let (i, problems) = I18n::new(embedded, &codes);
+        i.set_format(Format::from_tag("en-US"));
+        (i, problems)
     }
 
     fn i18n() -> I18n {
@@ -561,6 +804,8 @@ mod tests {
         ("fr", "@plural\t{n} page|{n} pages\t{n} page|{n} pages\n", ""),
         ("ru", "@plural\t{n} file|{n} files\t{n} файл|{n} файла|{n} файлов\n", ""),
         ("ja", "@plural\t{n} file|{n} files\t{n} 個\n", ""),
+        ("ar", "@plural\t{n} file|{n} files\t{n} ملفات|{n} ملف واحد|{n} ملفان|{n} ملفات|{n} ملفًا|{n} ملف\n", ""),
+        ("fa", "@plural\t{n} page|{n} pages\t{n} صفحه|{n} صفحه\n", ""),
     ];
 
     #[test]
@@ -569,6 +814,76 @@ mod tests {
         assert_eq!(fmt("{z} {", &[]), "{z} {");
     }
 
+    #[test]
+    fn left_to_right_text_gets_no_marks() {
+        assert_eq!(fmt("Saved {name} in {dir}.", &[("name", "Report 2.pdf"), ("dir", &ltr("/home/sara"))]), "Saved Report 2.pdf in /home/sara.");
+        assert_eq!(fmt("{a}", &[("a", "x"), ("b", "שלום")]), "x", "an unused value doesn't count");
+        assert_eq!(fmt_plain("{a}", &[("a", &isolate("x"))]), "x");
+        assert_eq!(fmt_plain("\u{2066}{a} {b}", &[("a", "x\u{2069}"), ("b", &isolate(&ltr("y")))]), "x y");
+        let i = all(P).0;
+        assert_eq!(i.trn(Lang::EN, 2, "{n} page", "{n} pages"), "2 pages");
+    }
+
+    #[test]
+    fn right_to_left_text_isolates_values() {
+        let saved = fmt("تم حفظ {name} في {dir}.", &[("name", "Report 2.pdf"), ("dir", &ltr("/home/سارة/docs"))]);
+        assert_eq!(saved, "تم حفظ \u{2068}Report 2.pdf\u{2069} في \u{2066}/home/سارة/docs\u{2069}.");
+        assert_eq!(strip_isolates(&saved), "تم حفظ Report 2.pdf في /home/سارة/docs.");
+        assert_eq!(fmt("Opened {name}.", &[("name", "שלום.txt")]), "Opened \u{2068}שלום.txt\u{2069}.");
+        assert_eq!(fmt("[{a}] {b}", &[("a", ""), ("b", "ש")]), "[] \u{2068}ש\u{2069}");
+        let i = all(P).0;
+        assert_eq!(i.trn(lang(&i, "fa"), 3, "{n} page", "{n} pages"), "\u{2066}3\u{2069} صفحه");
+    }
+
+    #[test]
+    fn a_value_cannot_escape_its_isolate() {
+        assert_eq!(isolate("a\u{2069}b"), "\u{2068}ab\u{2069}");
+        assert_eq!(isolate("a\u{2067}b"), "\u{2068}a\u{2067}b\u{2069}\u{2069}");
+        let one = ltr("12");
+        assert_eq!(fmt("ש {n}", &[("n", &one)]), format!("ש {one}"));
+        // Two isolates side by side are not one, so they get wrapped.
+        assert_eq!(fmt("ש{v}", &[("v", "\u{2066}a\u{2069}\u{2066}b\u{2069}")]), "ש\u{2068}\u{2066}a\u{2069}\u{2066}b\u{2069}\u{2069}");
+    }
+
+    /// `text` in display order, as one line in a left-to-right paragraph, without bidi controls.
+    fn visual(text: &str) -> String {
+        let info = unicode_bidi::BidiInfo::new(text, Some(unicode_bidi::Level::ltr()));
+        let para = &info.paragraphs[0];
+        let shown = info.reorder_line(para, para.range.clone());
+        shown
+            .chars()
+            .filter(|c| bidi_class(*c) != BidiClass::BN && !"\u{202A}\u{202B}\u{202C}\u{202D}\u{202E}\u{2066}\u{2067}\u{2068}\u{2069}".contains(*c))
+            .collect()
+    }
+
+    #[test]
+    fn a_value_with_bidi_controls_cannot_reorder_the_sentence() {
+        let file_names = [
+            "\u{202E}fdp.exe",
+            "\u{202B}abc def",
+            "\u{202D}abc def",
+            "\u{2067}abc def",
+            "\u{2068}abc\u{2069}\u{202E}def",
+            "\u{202E}abc\u{2069}",
+            "x\u{200F}",
+            "x\u{061C}",
+        ];
+        for name in file_names {
+            let text = fmt("Open {name} -> {name} now?", &[("name", name)]);
+            let shown = visual(&text);
+            assert!(shown.starts_with("Open ") && shown.contains(" -> ") && shown.ends_with(" now?"), "{name:?}: {shown:?}");
+            let i = all(P).0;
+            let wording = i.trn(Lang::EN, 2, "{n} page in {name}, done", "{n} pages in {name}, done");
+            let shown = visual(&fmt(&wording, &[("name", name)]));
+            assert!(shown.starts_with("2 pages in ") && shown.ends_with(", done"), "{name:?}: {shown:?}");
+        }
+        // An override the value opens is closed inside its isolate, and a stray PDF dropped.
+        assert_eq!(fmt("Open {name}.", &[("name", "\u{202E}abc")]), "Open \u{2068}\u{202E}abc\u{202C}\u{2069}.");
+        assert_eq!(fmt("Open {name}.", &[("name", "a\u{202C}b")]), "Open \u{2068}ab\u{2069}.");
+        assert_eq!(fmt("Open {n}.", &[("n", &ltr("\u{202B}1"))]), "Open \u{2066}\u{202B}1\u{202C}\u{2069}.");
+        assert_eq!(isolate("\u{2067}a\u{202E}b\u{2069}c"), "\u{2068}\u{2067}a\u{202E}b\u{202C}\u{2069}c\u{2069}");
+    }
+
     #[test]
     fn one_other() {
         let (i, problems) = all(P);
@@ -603,7 +918,56 @@ mod tests {
     #[test]
     fn beyond_sweep() {
         let i = all(P).0;
-        assert_eq!(i.trn(lang(&i, "fr"), 1_000_000, "{n} page", "{n} pages"), "1000000 pages");
+        i.set_format(Format::from_tag("fr"));
+        assert_eq!(i.trn(lang(&i, "fr"), 1_000_000, "{n} page", "{n} pages"), "1\u{202f}000\u{202f}000 pages");
+    }
+
+    #[test]
+    fn counts_follow_the_region() {
+        let i = all(P).0;
+        i.set_format(Format::from_tag("ar-EG"));
+        assert_eq!(i.trn(lang(&i, "ar"), 1234, "{n} file", "{n} files"), "\u{2066}١٬٢٣٤\u{2069} ملفًا");
+        i.set_format(Format::new(&Region::from_tag("ar-EG"), Digits::Latin));
+        assert_eq!(i.trn(lang(&i, "ar"), 1234, "{n} file", "{n} files"), "\u{2066}1,234\u{2069} ملفًا");
+        // An English interface with a German region.
+        i.set_format(Format::from_tag("de-DE"));
+        assert_eq!(i.trn(Lang::EN, 12_345, "{n} file", "{n} files"), "12.345 files");
+    }
+
+    #[test]
+    fn plain_counts_and_the_system_format() {
+        let i = all(P).0;
+        i.set_format(Format::from_tag("ar-EG"));
+        assert_eq!(i.trn_plain(lang(&i, "ar"), 1234, "{n} file", "{n} files"), "1234 ملفًا");
+        i.set_format(Format::from_tag("de-DE"));
+        assert_eq!(i.trn_plain(Lang::EN, 12_345, "copy {n}", "copy {n}"), "copy 12345");
+        i.reset_format();
+        assert_eq!(
+            i.trn(Lang::EN, 5, "{n} file", "{n} files"),
+            fmt("{n} files", &[("n", &Format::new(&Region::system(), Digits::Locale).integer(5))])
+        );
+    }
+
+    #[test]
+    fn decimal_counts() {
+        let i = all(P).0;
+        i.set_format(Format::from_tag("en"));
+        assert_eq!(i.trn_decimal(Lang::EN, 1.5, 1, "{n} file", "{n} files"), "1.5 files");
+        assert_eq!(i.trn_decimal(Lang::EN, 1.0, 1, "{n} file", "{n} files"), "1.0 files", "visible decimals are plural");
+        assert_eq!(i.trn_decimal(Lang::EN, 1.0, 0, "{n} file", "{n} files"), "1 file");
+        // Russian decimals are `other`, which integers never reach: the `few` form.
+        i.set_format(Format::from_tag("ru"));
+        let ru = lang(&i, "ru");
+        assert_eq!(i.trn_decimal(ru, 1.5, 1, "{n} file", "{n} files"), "1,5 файла");
+        assert_eq!(i.trn_decimal(ru, 21.0, 0, "{n} file", "{n} files"), "21 файл");
+        // Arabic decimals are `other`.
+        i.set_format(Format::from_tag("ar-EG"));
+        let ar = lang(&i, "ar");
+        assert_eq!(i.trn_decimal(ar, 2.5, 1, "{n} file", "{n} files"), "\u{2066}٢٫٥\u{2069} ملف");
+        assert_eq!(i.trn_decimal(ar, 3.0, 0, "{n} file", "{n} files"), "\u{2066}٣\u{2069} ملفات");
+        // Not a number: the translated `other` form.
+        assert_eq!(i.trn_decimal(ru, f64::NAN, 1, "{n} file", "{n} files"), "NaN файла");
+        assert_eq!(i.trn_decimal(Lang::EN, f64::INFINITY, 1, "{n} file", "{n} files"), "∞ files");
     }
 
     static L: &Embedded =
@@ -770,15 +1134,31 @@ mod tests {
         assert_eq!(i.trn(lang(&i, "pt-br"), 0, "{n} file", "{n} files"), "0 arquivo");
     }
 
-    /// The same counts as craft-i18n's checker (`plural_form_counts`), which rejects a catalog
-    /// whose `@plural` rows list any other.
+    /// The counts craft-i18n's checker expects, which rejects a catalog whose `@plural` rows list
+    /// any other: every directory in craft-i18n's `locales/`, then languages it may add.
     #[test]
     fn plural_form_counts() {
-        for (locale, n) in
-            [("en", 2), ("fr", 2), ("ja", 1), ("vi", 1), ("ru", 3), ("pl", 3), ("cs", 3), ("sl", 4), ("ar", 6), ("pt", 2), ("pt-br", 2), ("tr", 2)]
-        {
+        #[rustfmt::skip]
+        let catalogs = [
+            ("ar", 6), ("bg", 2), ("cs", 3), ("da", 2), ("de", 2), ("el", 2), ("es", 2), ("et", 2),
+            ("fi", 2), ("fr", 2), ("hr", 3), ("hu", 2), ("id", 1), ("it", 2), ("ja", 1), ("ka", 2),
+            ("kk", 2), ("ko", 1), ("lt", 3), ("nl", 2), ("pl", 3), ("pt-br", 2), ("ru", 3), ("sl", 4),
+            ("sr", 3), ("sr-latn", 3), ("sv", 2), ("te", 2), ("tr", 2), ("uk", 3), ("vi", 1),
+            ("zh-hans", 1), ("zh-hant", 1),
+        ];
+        let more = [("en", 2), ("pt", 2), ("he", 3), ("ro", 3), ("nb", 2), ("ca", 2), ("sk", 3), ("th", 1), ("ms", 1), ("fa", 2), ("hi", 2)];
+        for (locale, n) in catalogs.into_iter().chain(more) {
             assert_eq!(plural_rules(locale).map(|(_, c)| c.len()), Some(n), "{locale}");
         }
+        assert!(plural_rules("tlh").is_none(), "no CLDR rules");
+    }
+
+    #[test]
+    fn serbian_latin_plurals() {
+        let i = all(&[("sr-latn", "@plural\t{n} file|{n} files\t{n} fajl|{n} fajla|{n} fajlova\n", "")]).0;
+        let sr = lang(&i, "sr-latn");
+        let files = |n| i.trn(sr, n, "{n} file", "{n} files");
+        assert_eq!((files(1), files(3), files(5)), ("1 fajl".into(), "3 fajla".into(), "5 fajlova".into()));
     }
 
     #[test]
diff --git a/crates/i18n/src/number.rs b/crates/i18n/src/number.rs
new file mode 100644
index 00000000..1120fbe8
--- /dev/null
+++ b/crates/i18n/src/number.rs
@@ -0,0 +1,395 @@
+//! Reading numbers people type or paste, in any digits and with their locale's separators.
+
+use std::fmt;
+
+use crate::Format;
+
+/// Why [`Format::parse`] rejected a text.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum NumberError {
+    /// No digits: empty, or only spaces and a sign.
+    Empty,
+    /// A character that isn't a digit, sign, decimal mark or grouping mark.
+    Unexpected(char),
+    /// Digits from more than one set (`1٢`).
+    MixedDigits,
+    /// A decimal or grouping mark where the locale puts none (`1.234,5` in English, `1,2.5` in
+    /// German).
+    Separator,
+    /// Too large for an `f64`.
+    TooLarge,
+}
+
+impl fmt::Display for NumberError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            NumberError::Empty => write!(f, "no digits"),
+            NumberError::Unexpected(c) => write!(f, "unexpected character {c:?}"),
+            NumberError::MixedDigits => write!(f, "digits from more than one script"),
+            NumberError::Separator => write!(f, "misplaced or ambiguous decimal or grouping mark"),
+            NumberError::TooLarge => write!(f, "number too large"),
+        }
+    }
+}
+
+impl std::error::Error for NumberError {}
+
+/// The marks a [`Format`] writes, as [`Format::parse`] reads them.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct Marks {
+    /// `.` is the decimal mark and `,` grouping; else the other way round. For a format in
+    /// Arabic-Indic digits, as the locale writes Latin ones.
+    pub(crate) point: bool,
+    /// The format's own decimal and grouping marks when they are neither `.` nor `,` (`٫`, `'`, a
+    /// mark the system sets).
+    decimal: Option<char>,
+    group: Option<char>,
+}
+
+impl Default for Marks {
+    fn default() -> Self {
+        Marks { point: true, decimal: None, group: None }
+    }
+}
+
+impl Marks {
+    pub(crate) fn new(decimal: &str, group: &str, point: bool) -> Marks {
+        let own = |s: &str| {
+            let mut chars = s.chars();
+            chars.next().filter(|c| !matches!(c, '.' | ',') && chars.next().is_none())
+        };
+        Marks { point, decimal: own(decimal), group: own(group) }
+    }
+}
+
+impl Format {
+    /// The number in `text`: what this format writes, and what people type or paste.
+    ///
+    /// - Digits: any Unicode decimal digits (ASCII, Arabic-Indic, Persian, Devanagari, Bengali,
+    ///   Thai, full-width, …), all from one set.
+    /// - Decimal mark: the format's, `٫` in every format, and the locale's `.` or `,` when Latin
+    ///   digits are typed into an Arabic-Indic format. A lone `.` in a comma locale is the decimal
+    ///   mark when it can't be grouping (`1.5`, `0.250`, `1234.5`, `.5`), but `1.234` and
+    ///   `1.234.567` stay grouped; the same holds for `,` in a point locale.
+    /// - Grouping: the format's, the other of `.` and `,`, spaces (NBSP, narrow NBSP, thin), `'`,
+    ///   `’` and `٬`, one kind per number, in groups of three or the Indian 2-2-3 (`12,34,567`).
+    ///   Never in the fraction.
+    /// - Sign: a leading `-`, `−` (U+2212), full-width `－` or `+`.
+    /// - Bidi marks and isolates (LRM, RLM, ALM, LRI…PDI) around or inside are ignored, so a
+    ///   number formatted for an RTL interface reads back.
+    ///
+    /// Percent signs, units and the space before a unit (`50 %`, `12 px`) are not read; strip them
+    /// first. Anything else is an error rather than a guess.
+    pub fn parse(&self, text: &str) -> Result<f64, NumberError> {
+        let marks = self.marks;
+        let text: String = text.chars().filter(|c| !is_bidi_mark(*c)).collect();
+        let mut rest = text.trim();
+        let negative = match rest.chars().next() {
+            Some(c @ ('-' | '−' | '－' | '+' | '＋')) => {
+                rest = rest.get(c.len_utf8()..).unwrap_or("");
+                matches!(c, '-' | '−' | '－')
+            }
+            _ => false,
+        };
+        let mut tokens = Vec::with_capacity(rest.len());
+        let mut zero = None;
+        for c in rest.chars() {
+            let token = match c {
+                c if Some(c) == marks.decimal => Token::Decimal,
+                c if Some(c) == marks.group => Token::Group(c),
+                '.' | '．' => Token::Point,
+                ',' | '，' => Token::Comma,
+                '٫' => Token::Decimal,
+                '٬' => Token::Group('٬'),
+                '\'' | '’' => Token::Group('\''),
+                ' ' | '\u{a0}' | '\u{202f}' | '\u{2009}' => Token::Group(' '),
+                _ => {
+                    let (z, d) = digit(c).ok_or(NumberError::Unexpected(c))?;
+                    if *zero.get_or_insert(z) != z {
+                        return Err(NumberError::MixedDigits);
+                    }
+                    Token::Digit(d)
+                }
+            };
+            tokens.push(token);
+        }
+        if zero.is_none() {
+            return Err(if tokens.is_empty() { NumberError::Empty } else { NumberError::Separator });
+        }
+        let point = if lone_decimal(&tokens, marks.point) { !marks.point } else { marks.point };
+        let digits = read(&tokens, point).ok_or(NumberError::Separator)?;
+        let value: f64 = digits.parse().map_err(|_| NumberError::Separator)?;
+        if !value.is_finite() {
+            return Err(NumberError::TooLarge);
+        }
+        Ok(if negative { -value } else { value })
+    }
+}
+
+/// The number in `text` as `locale` (a language tag, `de-CH`, `ar_EG.UTF-8`) writes it:
+/// [`Format::parse`] for [`Format::from_tag`]. Build the [`Format`] once to read many numbers. A
+/// locale CLDR doesn't know reads as CLDR's root does (`1,234.5`).
+pub fn parse_number(text: &str, locale: &str) -> Result<f64, NumberError> {
+    Format::from_tag(locale).parse(text)
+}
+
+#[derive(Clone, Copy, PartialEq)]
+enum Token {
+    Digit(u8),
+    Point,
+    Comma,
+    /// A decimal mark in every reading: `٫`, or the format's own.
+    Decimal,
+    /// A grouping mark in every reading, by kind (space, apostrophe, `٬`, the format's own).
+    Group(char),
+}
+
+/// Whether the locale's grouping mark of `.` and `,` (`.` when `point` is false) is the decimal
+/// mark here because it can't be grouping: it is the only mark of the two, there is one of it, and
+/// the digits before it are none, start with 0 or are more than three, or the digits after it
+/// aren't three.
+fn lone_decimal(tokens: &[Token], point: bool) -> bool {
+    let (group, decimal) = if point { (Token::Comma, Token::Point) } else { (Token::Point, Token::Comma) };
+    if tokens.contains(&decimal) || tokens.contains(&Token::Decimal) || tokens.iter().filter(|t| **t == group).count() != 1 {
+        return false;
+    }
+    let Some(at) = tokens.iter().position(|t| *t == group) else { return false };
+    let (int, frac) = (tokens.get(..at).unwrap_or_default(), tokens.get(at + 1..).unwrap_or_default());
+    int.is_empty() || int.first() == Some(&Token::Digit(0)) || int.len() > 3 || frac.len() != 3
+}
+
+/// The ASCII number `tokens` spell when the decimal mark is `.` (`point`) or `,`; `None` when the
+/// marks don't fit that reading.
+fn read(tokens: &[Token], point: bool) -> Option<String> {
+    let tokens: Vec<Token> = tokens
+        .iter()
+        .map(|t| match t {
+            Token::Point if point => Token::Decimal,
+            Token::Point => Token::Group('.'),
+            Token::Comma if point => Token::Group(','),
+            Token::Comma => Token::Decimal,
+            t => *t,
+        })
+        .collect();
+    let (int, frac) = match tokens.iter().position(|t| *t == Token::Decimal) {
+        Some(i) => (tokens.get(..i)?, tokens.get(i + 1..)?),
+        None => (&tokens[..], &[][..]),
+    };
+    let ascii =
+        |part: &[Token]| -> Option<String> { part.iter().map(|t| if let Token::Digit(d) = t { Some(char::from(b'0' + d)) } else { None }).collect() };
+    let frac = ascii(frac)?;
+    let mut group = None;
+    let mut groups = Vec::new();
+    for chunk in int.split(|t| matches!(t, Token::Group(_))) {
+        groups.push(ascii(chunk)?);
+    }
+    for t in int {
+        if let Token::Group(g) = t
+            && *group.get_or_insert(*g) != *g
+        {
+            return None;
+        }
+    }
+    if let [first, middle @ .., last] = groups.as_slice()
+        && group.is_some()
+    {
+        let width = middle.first().map_or(3, String::len);
+        let first_max = if width == 2 { 2 } else { 3 };
+        let fits = (1..=first_max).contains(&first.len())
+            && !first.starts_with('0')
+            && last.len() == 3
+            && middle.iter().all(|g| g.len() == width)
+            && (2..=3).contains(&width);
+        if !fits {
+            return None;
+        }
+    }
+    let int = groups.concat();
+    if int.is_empty() && frac.is_empty() {
+        return None;
+    }
+    Some(format!("{}.{}", if int.is_empty() { "0" } else { &int }, if frac.is_empty() { "0" } else { &frac }))
+}
+
+/// The first code point of each run of ten Unicode decimal digits (general category Nd), Unicode
+/// 16.0.
+const ZEROS: [u32; 76] = [
+    0x30, 0x660, 0x6F0, 0x7C0, 0x966, 0x9E6, 0xA66, 0xAE6, 0xB66, 0xBE6, 0xC66, 0xCE6, 0xD66, 0xDE6, 0xE50, 0xED0, 0xF20, 0x1040, 0x1090, 0x17E0,
+    0x1810, 0x1946, 0x19D0, 0x1A80, 0x1A90, 0x1B50, 0x1BB0, 0x1C40, 0x1C50, 0xA620, 0xA8D0, 0xA900, 0xA9D0, 0xA9F0, 0xAA50, 0xABF0, 0xFF10, 0x104A0,
+    0x10D30, 0x10D40, 0x11066, 0x110F0, 0x11136, 0x111D0, 0x112F0, 0x11450, 0x114D0, 0x11650, 0x116C0, 0x116D0, 0x116DA, 0x11730, 0x118E0, 0x11950,
+    0x11BF0, 0x11C50, 0x11D50, 0x11DA0, 0x11F50, 0x16130, 0x16A60, 0x16AC0, 0x16B50, 0x16D70, 0x1CCF0, 0x1D7CE, 0x1D7D8, 0x1D7E2, 0x1D7EC, 0x1D7F6,
+    0x1E140, 0x1E2F0, 0x1E4F0, 0x1E5F1, 0x1E950, 0x1FBF0,
+];
+
+/// `c`'s digit set (its zero) and value.
+fn digit(c: char) -> Option<(u32, u8)> {
+    let c = u32::from(c);
+    let zero = match ZEROS.binary_search(&c) {
+        Ok(i) => ZEROS.get(i),
+        Err(i) => ZEROS.get(i.checked_sub(1)?),
+    }?;
+    let value = c - zero;
+    u8::try_from(value).ok().filter(|v| *v < 10).map(|v| (*zero, v))
+}
+
+/// Marks bidi formatting adds around numbers: LRM, RLM, ALM, embeddings, overrides and isolates.
+fn is_bidi_mark(c: char) -> bool {
+    matches!(c, '\u{200e}' | '\u{200f}' | '\u{061c}' | '\u{202a}'..='\u{202e}' | '\u{2066}'..='\u{2069}')
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{Digits, Region};
+
+    #[test]
+    fn every_digit_set() {
+        for zero in ZEROS {
+            let d = |n: u32| char::from_u32(zero + n).unwrap();
+            let all: String = (0..10).rev().map(d).collect();
+            assert_eq!(parse_number(&all, "en"), Ok(9_876_543_210.0), "{zero:X}");
+            let grouped = format!("-{}{}{},{}{}{}.{}", d(1), d(2), d(3), d(4), d(5), d(6), d(7));
+            assert_eq!(parse_number(&grouped, "en"), Ok(-123_456.7), "{zero:X}");
+            assert!((0..10).all(|n| d(n).is_numeric()), "{zero:X}");
+        }
+        assert_eq!(digit('\u{1D800}'), None);
+        assert_eq!(digit('/'), None);
+    }
+
+    #[test]
+    fn locale_forms() {
+        for (text, locale, want) in [
+            ("1,234.5", "en", 1234.5),
+            ("1.234,5", "de", 1234.5),
+            ("1 234,5", "fr", 1234.5),
+            ("1\u{202f}234,5", "fr", 1234.5),
+            ("1\u{a0}234,5", "ru", 1234.5),
+            ("1’234.5", "de-CH", 1234.5),
+            ("1'234.5", "de_CH.UTF-8", 1234.5),
+            ("1,234", "en", 1234.0),
+            ("1,234", "de", 1.234),
+            ("1.234", "pt-br", 1234.0),
+            ("1,5", "es", 1.5),
+            ("1.5", "es-419", 1.5),
+            ("١٬٢٣٤٫٥", "ar", 1234.5),
+            ("١٢٫٥", "ar", 12.5),
+            ("12.5", "ar", 12.5),
+            ("12,5", "ar-MA", 12.5),
+            ("۱۲٫۵", "fa", 12.5),
+            ("−۴۲", "fa", -42.0),
+            ("１２３，４５６．７", "ja", 123_456.7),
+            ("－５", "ja", -5.0),
+            ("१२,३४,५६७.८९", "hi", 1_234_567.89),
+            ("১২,৩৪,৫৬৭", "bn", 1_234_567.0),
+            ("౧,౨౩,౪౫౬", "te", 123_456.0),
+            ("๑,๒๓๔.๕", "th", 1234.5),
+            ("1,234,567", "en", 1_234_567.0),
+            ("−3,5", "sv", -3.5),
+            ("+7", "en", 7.0),
+            (".5", "en", 0.5),
+            ("5.", "en", 5.0),
+            ("  42  ", "en", 42.0),
+            ("\u{2066}-1,5\u{2069}", "de", -1.5),
+            ("\u{061c}-١٢", "ar", -12.0),
+            ("1,234.5", "xx", 1234.5),
+            ("12", "xx", 12.0),
+            ("1,5", "en-PL", 1.5),
+            ("1.234,5", "en-DE", 1234.5),
+            ("1.234,5", "lo", 1234.5),
+            ("1,234.5", "km", 1234.5),
+        ] {
+            assert_eq!(parse_number(text, locale), Ok(want), "{text:?} in {locale}");
+        }
+    }
+
+    #[test]
+    fn errors_instead_of_guesses() {
+        for (text, locale, want) in [
+            ("", "en", NumberError::Empty),
+            ("  ", "en", NumberError::Empty),
+            ("-", "en", NumberError::Empty),
+            (",", "en", NumberError::Separator),
+            ("1.2.3", "en", NumberError::Separator),
+            ("1,,234", "en", NumberError::Separator),
+            ("1,234,", "en", NumberError::Separator),
+            ("1.234,5", "en", NumberError::Separator),
+            ("1 234'567", "en", NumberError::Separator),
+            ("1.234 567", "de", NumberError::Separator),
+            ("0.123,4", "de", NumberError::Separator),
+            ("1.5,2", "en", NumberError::Separator),
+            ("123,45,678", "hi", NumberError::Separator),
+            ("12٫3٫4", "ar", NumberError::Separator),
+            ("1٫5.2", "ar", NumberError::Separator),
+            ("1٢", "ar", NumberError::MixedDigits),
+            ("12abc", "en", NumberError::Unexpected('a')),
+            ("1e5", "en", NumberError::Unexpected('e')),
+            ("--5", "en", NumberError::Unexpected('-')),
+            ("5-", "en", NumberError::Unexpected('-')),
+            ("- 5", "en", NumberError::Separator),
+        ] {
+            assert_eq!(parse_number(text, locale), Err(want), "{text:?} in {locale}");
+        }
+        assert_eq!(parse_number(&"9".repeat(400), "en"), Err(NumberError::TooLarge));
+        for unit in ["50 %", "50%", "12 px", "1,5 MB"] {
+            assert!(parse_number(unit, "de").is_err(), "{unit}: units are the caller's to strip");
+        }
+    }
+
+    /// A lone mark that can't be grouping is the decimal mark; one that can stays grouping.
+    #[test]
+    fn lone_marks() {
+        for (text, locale, want) in [
+            ("1.5", "de", 1.5),
+            ("0.250", "de", 0.25),
+            ("1234.5", "de", 1234.5),
+            (".5", "de", 0.5),
+            ("-12.34", "ru", -12.34),
+            ("1.234", "de", 1234.0),
+            ("1.234.567", "de", 1_234_567.0),
+            ("1,5", "en", 1.5),
+            ("0,5", "en", 0.5),
+            ("12,34", "en", 12.34),
+            ("1234,567", "en", 1234.567),
+            ("1,234", "en", 1234.0),
+            ("12,345", "en", 12345.0),
+        ] {
+            assert_eq!(parse_number(text, locale), Ok(want), "{text:?} in {locale}");
+        }
+    }
+
+    /// What a format writes reads back, in its digits and with its separators, the system's
+    /// included.
+    #[test]
+    fn reads_what_format_writes() {
+        let mut formats: Vec<Format> = ["en", "de", "de-CH", "fr", "hi", "ar-EG", "fa", "bn-BD", "ar-MA", "en-PL", "nb", "pt-PT", "sv"]
+            .iter()
+            .flat_map(|t| [Format::from_tag(t), Format::new(&Region::from_tag(t), Digits::Latin)])
+            .collect();
+        for (tag, decimal, grouping) in [
+            ("en-US", Some(','), None),
+            ("en-US", Some('.'), Some(Some('\u{a0}'))),
+            ("en-US", None, Some(None)),
+            ("en-US", Some('·'), Some(Some('_'))),
+            ("de-DE", Some('·'), None),
+        ] {
+            let mut region = Region::from_tag(tag);
+            region.decimal = decimal;
+            region.grouping = grouping;
+            formats.push(Format::new(&region, Digits::Locale));
+        }
+        // Windows sets both marks: a decimal comma the user picks arrives beside a grouping comma.
+        let reg = |pairs: &'static [(&'static str, &'static str)]| move |n: &str| pairs.iter().find(|(k, _)| *k == n).map(|(_, v)| v.to_string());
+        let windows = crate::region::from_windows(reg(&[("LocaleName", "en-US"), ("sDecimal", ","), ("sThousand", ",")]), || None);
+        formats.push(Format::new(&windows, Digits::Locale));
+        formats.push(Format::new(&Region::from_tag("ar-EG-u-nu-latn"), Digits::Locale));
+        formats.push(Format::new(&Region::from_tag("C"), Digits::Locale));
+        for f in &formats {
+            for value in [0.0, 1.5, -1234.25, 1_234_567.89, 12.0, 1234.0] {
+                let text = f.number(value, 2);
+                assert_eq!(f.parse(&text), Ok(value), "{text:?} ({f:?})");
+            }
+            let text = f.integer(1_234_567);
+            assert_eq!(f.parse(&text), Ok(1_234_567.0), "{text:?}");
+        }
+    }
+}
diff --git a/crates/i18n/src/region.rs b/crates/i18n/src/region.rs
new file mode 100644
index 00000000..fcdffe8a
--- /dev/null
+++ b/crates/i18n/src/region.rs
@@ -0,0 +1,493 @@
+//! The formatting region: how numbers, times and measurements are written, apart from the
+//! interface language. An English interface in Poland still writes `2,54 cm` on A4.
+//!
+//! The territory lists come from Unicode CLDR's supplemental `measurementData` (Unicode License):
+//! `paperSize` US-Letter and `measurementSystem` US. Decimal and grouping separators come from
+//! the number locale's CLDR data ([`crate::Format`]); the region carries its own only where the
+//! system sets them.
+
+use std::sync::OnceLock;
+
+/// Territories whose default paper is US Letter (CLDR `paperSize type="US-Letter"`).
+const LETTER: &[&str] = &["BZ", "CA", "CL", "CO", "CR", "GT", "MX", "NI", "PA", "PH", "PR", "SV", "US", "VE"];
+
+/// Territories that measure in inches (CLDR `measurementSystem type="US"`).
+const INCHES: &[&str] = &["LR", "MM", "US"];
+
+/// How lengths, distances and weights are measured.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Measurement {
+    /// Centimetres, kilometres and kilograms (CLDR `metric` and `UK`).
+    Metric,
+    /// Inches, miles and pounds (CLDR `US`).
+    Us,
+}
+
+/// The paper a new document starts on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Paper {
+    A4,
+    Letter,
+}
+
+/// A clock the user chose, where the system says so apart from the locale.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum HourCycle {
+    /// 1 to 12 with AM and PM.
+    H12,
+    /// 0 to 23.
+    H23,
+}
+
+/// The conventions numbers, times and measurements follow. Read it with [`Region::system`] or,
+/// for the user's saved choice, [`Region::from_setting`]; the fields are public so an app can
+/// keep a separate choice of, say, measurement.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Region {
+    /// The locale numbers are written in, BCP 47 (`pl-PL`, `sr-Latn-RS`).
+    pub numbers: String,
+    /// The locale dates and times are written in, BCP 47.
+    pub time: String,
+    pub measurement: Measurement,
+    pub paper: Paper,
+    /// The decimal separator the system sets (Windows, macOS); `None` follows the locale.
+    pub decimal: Option<char>,
+    /// The grouping separator the system sets (Windows, macOS): `Some(None)` for none at all
+    /// (`1234567`); `None` follows the locale.
+    pub grouping: Option<Option<char>>,
+    /// The clock the system sets (Windows, macOS); `None` follows the locale.
+    pub hour_cycle: Option<HourCycle>,
+}
+
+impl Default for Region {
+    /// `en-US`: Letter, inches.
+    fn default() -> Self {
+        Region::from_parts(&Tag::default())
+    }
+}
+
+impl Region {
+    /// The region a BCP 47 or POSIX locale tag names (`pl-PL`, `de_AT.UTF-8@euro`, `zh-Hans-CN`,
+    /// `en-US-u-ms-metric`, Apple's `en_US@rg=plzzzz`). The Unicode extensions `ms` (measurement),
+    /// `hc` (clock), `rg` (region override) and `nu` (digits; Apple's `@numbers=`) are read, and
+    /// `nu` stays in the number and time locales (`ar-EG-u-nu-latn`). `C` and `POSIX` are the C
+    /// locale: English, A4, metric, a `.` decimal and no grouping. An empty or unreadable tag is
+    /// `en-US`; a bare `en` is the United States, any other bare language has no territory.
+    pub fn from_tag(tag: &str) -> Region {
+        match Tag::parse(tag) {
+            Some(tag) => Region::from_parts(&tag),
+            None if is_c_locale(tag) => {
+                Region { measurement: Measurement::Metric, paper: Paper::A4, decimal: Some('.'), grouping: Some(None), ..Region::default() }
+            }
+            None => Region::default(),
+        }
+    }
+
+    /// The region for an app's saved region setting: `""` or `auto` (any case) is
+    /// [`Region::system`], anything else a locale tag for [`Region::from_tag`].
+    pub fn from_setting(setting: &str) -> Region {
+        let setting = setting.trim();
+        if setting.is_empty() || setting.eq_ignore_ascii_case("auto") { Region::system() } else { Region::from_tag(setting) }
+    }
+
+    /// The system's region, read once, then cached:
+    ///
+    /// - Windows: the regional format and its customised separators, measurement system, paper
+    ///   and short time format (Settings › Time & language › Language & region).
+    /// - macOS and iOS: the current locale (its identifier carries the Region setting), its
+    ///   separators and metric setting, and its hour format.
+    /// - Linux and the BSDs: `LC_ALL`, else each of `LC_NUMERIC`, `LC_TIME`, `LC_MEASUREMENT` and
+    ///   `LC_PAPER` on its own, else `LANG`.
+    /// - The web and Android: the preferred language, the only locale they expose.
+    pub fn system() -> Region {
+        static SYSTEM: OnceLock<Region> = OnceLock::new();
+        SYSTEM.get_or_init(read_system).clone()
+    }
+
+    fn from_parts(tag: &Tag) -> Region {
+        let territory = tag.territory.as_str();
+        let measurement = tag.measurement.unwrap_or(if INCHES.contains(&territory) { Measurement::Us } else { Measurement::Metric });
+        Region {
+            numbers: tag.bcp47(),
+            time: tag.bcp47(),
+            measurement,
+            paper: if LETTER.contains(&territory) { Paper::Letter } else { Paper::A4 },
+            decimal: None,
+            grouping: None,
+            hour_cycle: tag.hour_cycle,
+        }
+    }
+}
+
+/// The parts of a locale tag the region uses.
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct Tag {
+    /// Lower case (`pl`).
+    language: String,
+    /// Title case (`Latn`); empty when the tag has none.
+    script: String,
+    /// Upper case (`PL`, or a UN M.49 number like `419`); empty when the tag has none.
+    territory: String,
+    measurement: Option<Measurement>,
+    hour_cycle: Option<HourCycle>,
+    /// The `nu` keyword (`latn`, `arab`); empty when the tag has none.
+    digits: String,
+}
+
+impl Default for Tag {
+    fn default() -> Self {
+        Tag { language: "en".into(), script: String::new(), territory: "US".into(), measurement: None, hour_cycle: None, digits: String::new() }
+    }
+}
+
+impl Tag {
+    fn parse(tag: &str) -> Option<Tag> {
+        // Locale tags are short; anything long is junk and only its start is read.
+        let tag: String = tag.chars().take(64).collect();
+        let (tag, modifier) = tag.split_once('@').unwrap_or((&tag, ""));
+        let tag = tag.split('.').next().unwrap_or_default().trim();
+        if is_c_locale(tag) {
+            return None;
+        }
+        let mut parts = tag.split(['-', '_']);
+        let language = parts.next().unwrap_or_default();
+        if !(2..=3).contains(&language.len()) || !language.chars().all(|c| c.is_ascii_alphabetic()) {
+            return None;
+        }
+        let mut out = Tag {
+            language: language.to_ascii_lowercase(),
+            script: String::new(),
+            territory: String::new(),
+            measurement: None,
+            hour_cycle: None,
+            digits: String::new(),
+        };
+        let mut extension = None;
+        for p in parts.by_ref() {
+            // A singleton starts the extensions (`-u-…`, `-x-…`).
+            if p.len() == 1 {
+                extension = Some(p.to_ascii_lowercase());
+                break;
+            }
+            if out.territory.is_empty() && out.script.is_empty() && p.len() == 4 && p.chars().all(|c| c.is_ascii_alphabetic()) {
+                out.script = title_case(p);
+            } else if out.territory.is_empty() && is_territory(p) {
+                out.territory = p.to_ascii_uppercase();
+            }
+        }
+        let mut keywords: Vec<(String, String)> = Vec::new();
+        if extension.as_deref() == Some("u") {
+            let mut key = String::new();
+            for p in parts {
+                if p.len() == 1 {
+                    break;
+                }
+                if p.len() == 2 {
+                    key = p.to_ascii_lowercase();
+                } else if !key.is_empty() {
+                    keywords.push((std::mem::take(&mut key), p.to_ascii_lowercase()));
+                }
+            }
+        }
+        // Apple's and ICU's `@rg=plzzzz;ms=metric` keywords, and glibc's `@latin` script modifier.
+        for m in modifier.split(';') {
+            match m.split_once('=') {
+                Some((k, v)) => keywords.push((k.trim().to_ascii_lowercase(), v.trim().to_ascii_lowercase())),
+                None if m.eq_ignore_ascii_case("latin") => out.script = "Latn".into(),
+                None if m.eq_ignore_ascii_case("cyrillic") => out.script = "Cyrl".into(),
+                None => {}
+            }
+        }
+        for (key, value) in keywords {
+            match (key.as_str(), value.as_str()) {
+                ("ms", "metric" | "uksystem") => out.measurement = Some(Measurement::Metric),
+                ("ms", "ussystem") => out.measurement = Some(Measurement::Us),
+                ("hc", "h11" | "h12") => out.hour_cycle = Some(HourCycle::H12),
+                ("hc", "h23" | "h24") => out.hour_cycle = Some(HourCycle::H23),
+                ("nu" | "numbers", v) if (3..=8).contains(&v.len()) && v.chars().all(|c| c.is_ascii_alphanumeric()) => out.digits = v.into(),
+                ("rg", v) if v.len() == 6 && v.ends_with("zzzz") && v.get(..2).is_some_and(is_territory) => {
+                    out.territory = v.get(..2).unwrap_or_default().to_ascii_uppercase();
+                }
+                _ => {}
+            }
+        }
+        if out.territory.is_empty() && out.language == "en" {
+            out.territory = "US".into();
+        }
+        Some(out)
+    }
+
+    fn bcp47(&self) -> String {
+        let tag = [self.language.as_str(), &self.script, &self.territory].into_iter().filter(|p| !p.is_empty()).collect::<Vec<_>>().join("-");
+        if self.digits.is_empty() { tag } else { format!("{tag}-u-nu-{}", self.digits) }
+    }
+}
+
+fn is_territory(p: &str) -> bool {
+    (p.len() == 2 && p.chars().all(|c| c.is_ascii_alphabetic())) || (p.len() == 3 && p.chars().all(|c| c.is_ascii_digit()))
+}
+
+fn title_case(p: &str) -> String {
+    let lower = p.to_ascii_lowercase();
+    let mut chars = lower.chars();
+    chars.next().map(|c| c.to_ascii_uppercase().to_string() + chars.as_str()).unwrap_or_default()
+}
+
+/// Whether a locale tag names the C locale (`C`, `C.UTF-8`, `POSIX`).
+fn is_c_locale(tag: &str) -> bool {
+    let tag = tag.split(['@', '.']).next().unwrap_or_default().trim();
+    tag.eq_ignore_ascii_case("c") || tag.eq_ignore_ascii_case("posix")
+}
+
+/// The region from the POSIX locale variables `var` reads. An empty variable is unset; `C` in
+/// `LC_ALL` or an `LC_*` variable is the C locale's conventions. `LANG` set to `C` or unset gives
+/// way to the platform's preferred locale.
+#[cfg(any(test, all(unix, not(any(target_vendor = "apple", target_os = "android")))))]
+fn from_posix(var: impl Fn(&str) -> Option<String>, platform: impl FnOnce() -> Option<String>) -> Region {
+    let var = |name: &str| var(name).filter(|v| !v.trim().is_empty());
+    if let Some(all) = var("LC_ALL") {
+        return Region::from_tag(&all);
+    }
+    let lang = var("LANG").filter(|v| !is_c_locale(v)).or_else(platform).unwrap_or_default();
+    let tag = |name: &str| var(name).unwrap_or_else(|| lang.clone());
+    let time = Region::from_tag(&tag("LC_TIME"));
+    Region {
+        time: time.time,
+        hour_cycle: time.hour_cycle,
+        measurement: Region::from_tag(&tag("LC_MEASUREMENT")).measurement,
+        paper: Region::from_tag(&tag("LC_PAPER")).paper,
+        ..Region::from_tag(&tag("LC_NUMERIC"))
+    }
+}
+
+/// The region from the values under `HKEY_CURRENT_USER\Control Panel\International` that `value`
+/// reads, where Windows keeps the regional format and the user's changes to it. `LocaleName` is
+/// the format (`pl-PL`), else the platform's preferred locale.
+#[cfg(any(test, windows))]
+pub(crate) fn from_windows(value: impl Fn(&str) -> Option<String>, platform: impl FnOnce() -> Option<String>) -> Region {
+    let mut region = Region::from_tag(&value("LocaleName").or_else(platform).unwrap_or_default());
+    region.decimal = value("sDecimal").as_deref().and_then(single_char);
+    region.grouping = value("sThousand").as_deref().and_then(grouping);
+    match value("iMeasure").as_deref().map(str::trim) {
+        Some("0") => region.measurement = Measurement::Metric,
+        Some("1") => region.measurement = Measurement::Us,
+        _ => {}
+    }
+    // DMPAPER_LETTER and DMPAPER_A4; other sizes keep the territory's.
+    match value("iPaperSize").as_deref().map(str::trim) {
+        Some("1") => region.paper = Paper::Letter,
+        Some("9") => region.paper = Paper::A4,
+        _ => {}
+    }
+    region.hour_cycle = value("sShortTime").as_deref().and_then(hour_cycle_of).or(region.hour_cycle);
+    region
+}
+
+/// The region from Apple's current locale: its identifier (`en_PL`, `en_GB@rg=uszzzz`), its
+/// metric setting and separators, and the hour format its `j` skeleton gives (`HH`, `h a`).
+#[cfg(any(test, target_vendor = "apple"))]
+fn from_apple(identifier: &str, metric: bool, decimal: &str, grouping: &str, hours: Option<&str>) -> Region {
+    let mut region = Region::from_tag(identifier);
+    region.measurement = if metric { Measurement::Metric } else { Measurement::Us };
+    region.decimal = single_char(decimal);
+    region.grouping = self::grouping(grouping);
+    region.hour_cycle = hours.and_then(hour_cycle_of).or(region.hour_cycle);
+    region
+}
+
+/// A grouping separator the system sets: none at all when empty (Windows' `sThousand` the user
+/// cleared), else one character.
+#[cfg(any(test, windows, target_vendor = "apple"))]
+fn grouping(s: &str) -> Option<Option<char>> {
+    if s.is_empty() { Some(None) } else { single_char(s).map(Some) }
+}
+
+/// A separator that is one character; Windows allows up to three, which the region can't carry.
+#[cfg(any(test, windows, target_vendor = "apple"))]
+fn single_char(s: &str) -> Option<char> {
+    let mut chars = s.chars();
+    let c = chars.next()?;
+    chars.next().is_none().then_some(c)
+}
+
+/// The clock a time pattern (`HH:mm`, `h:mm tt`, `h 'Uhr'`) uses; quoted literals are skipped.
+#[cfg(any(test, windows, target_vendor = "apple"))]
+fn hour_cycle_of(pattern: &str) -> Option<HourCycle> {
+    let mut quoted = false;
+    for c in pattern.chars() {
+        match c {
+            '\'' => quoted = !quoted,
+            'H' | 'k' if !quoted => return Some(HourCycle::H23),
+            'h' | 'K' if !quoted => return Some(HourCycle::H12),
+            _ => {}
+        }
+    }
+    None
+}
+
+#[cfg(windows)]
+fn read_system() -> Region {
+    let key = windows_registry::CURRENT_USER.open(r"Control Panel\International").ok();
+    from_windows(|name| key.as_ref()?.get_string(name).ok(), sys_locale::get_locale)
+}
+
+#[cfg(target_vendor = "apple")]
+fn read_system() -> Region {
+    use objc2_foundation::{NSDateFormatter, NSLocale, NSString};
+    let locale = NSLocale::currentLocale();
+    let hours = NSDateFormatter::dateFormatFromTemplate_options_locale(&NSString::from_str("j"), 0, Some(&locale)).map(|f| f.to_string());
+    from_apple(
+        &locale.localeIdentifier().to_string(),
+        locale.usesMetricSystem(),
+        &locale.decimalSeparator().to_string(),
+        &locale.groupingSeparator().to_string(),
+        hours.as_deref(),
+    )
+}
+
+#[cfg(all(unix, not(any(target_vendor = "apple", target_os = "android"))))]
+fn read_system() -> Region {
+    from_posix(|name| std::env::var(name).ok(), sys_locale::get_locale)
+}
+
+#[cfg(not(any(windows, unix)))]
+fn read_system() -> Region {
+    Region::from_tag(&sys_locale::get_locale().unwrap_or_default())
+}
+
+#[cfg(target_os = "android")]
+fn read_system() -> Region {
+    Region::from_tag(&sys_locale::get_locale().unwrap_or_default())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn conventions(r: &Region) -> (Paper, Measurement) {
+        (r.paper, r.measurement)
+    }
+
+    #[test]
+    fn reads_locale_tags() {
+        assert_eq!(Region::from_tag("pl-PL").numbers, "pl-PL");
+        assert_eq!(Region::from_tag("de_AT.UTF-8@euro").numbers, "de-AT");
+        assert_eq!(Region::from_tag("zh-hans-cn").numbers, "zh-Hans-CN");
+        assert_eq!(Region::from_tag("sr_RS@latin").numbers, "sr-Latn-RS");
+        assert_eq!(Region::from_tag("es-419").numbers, "es-419");
+        assert_eq!(Region::from_tag("fr").numbers, "fr");
+        assert_eq!(Region::from_tag("en").numbers, "en-US", "bare English is the US");
+        for junk in ["", "1234", "x", "--", "ünïcode-ÄÄ", &"a".repeat(10_000)] {
+            assert_eq!(Region::from_tag(junk), Region::default(), "{junk:?}");
+        }
+    }
+
+    /// glibc's C locale: A4 and metric (`C-paper.c`, `C-measurement.c`), `.` and no grouping.
+    #[test]
+    fn the_c_locale_is_a4_metric_and_ungrouped() {
+        for c in ["C", "POSIX", "C.UTF-8", "c.utf8", " C "] {
+            let r = Region::from_tag(c);
+            assert_eq!(
+                (r.numbers.as_str(), r.paper, r.measurement, r.decimal, r.grouping),
+                ("en-US", Paper::A4, Measurement::Metric, Some('.'), Some(None)),
+                "{c:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_chosen_digit_system_stays_in_the_locale() {
+        assert_eq!(Region::from_tag("ar-EG-u-nu-latn").numbers, "ar-EG-u-nu-latn");
+        let r = Region::from_tag("ar_EG@numbers=latn");
+        assert_eq!((r.numbers.as_str(), r.time.as_str()), ("ar-EG-u-nu-latn", "ar-EG-u-nu-latn"));
+        assert_eq!(Region::from_tag("en-US-u-nu-arab-ms-metric").numbers, "en-US-u-nu-arab");
+        assert_eq!(Region::from_tag("ar-EG-u-nu-x").numbers, "ar-EG", "not a numbering system");
+    }
+
+    #[test]
+    fn unicode_extensions_and_apple_keywords() {
+        let r = Region::from_tag("en-US-u-ms-metric-hc-h23");
+        assert_eq!((r.numbers.as_str(), r.measurement, r.hour_cycle), ("en-US", Measurement::Metric, Some(HourCycle::H23)));
+        assert_eq!(Region::from_tag("en-GB-u-hc-h12").hour_cycle, Some(HourCycle::H12));
+        assert_eq!(Region::from_tag("de-DE-x-ms-ussystem").measurement, Measurement::Metric, "private use isn't read");
+        let r = Region::from_tag("en_GB@rg=uszzzz");
+        assert_eq!((r.numbers.as_str(), r.paper, r.measurement), ("en-US", Paper::Letter, Measurement::Us));
+        assert_eq!(Region::from_tag("en_US@rg=plzzzz;ms=metric").numbers, "en-PL");
+    }
+
+    /// Paper and measurement follow the territory; separators are left to the number locale.
+    #[test]
+    fn conventions_follow_the_territory() {
+        assert_eq!(conventions(&Region::from_tag("pl-PL")), (Paper::A4, Measurement::Metric));
+        assert_eq!(conventions(&Region::from_tag("en-US")), (Paper::Letter, Measurement::Us));
+        assert_eq!(conventions(&Region::from_tag("fr-CA")), (Paper::Letter, Measurement::Metric));
+        assert_eq!(conventions(&Region::from_tag("en-GB")), (Paper::A4, Measurement::Metric));
+        let r = Region::from_tag("de-CH");
+        assert_eq!((r.decimal, r.grouping), (None, None));
+        assert_eq!(Region::from_tag("es-MX").paper, Paper::Letter);
+        assert_eq!(Region::from_tag("ja-JP").paper, Paper::A4);
+    }
+
+    #[test]
+    fn a_saved_setting_overrides_the_system() {
+        assert_eq!(Region::from_setting(" pl-PL "), Region::from_tag("pl-PL"));
+        assert_eq!(Region::from_setting("AUTO"), Region::system());
+        assert_eq!(Region::from_setting(""), Region::system());
+    }
+
+    #[test]
+    fn posix_variables_set_each_convention() {
+        let env = |pairs: &'static [(&'static str, &'static str)]| move |n: &str| pairs.iter().find(|(k, _)| *k == n).map(|(_, v)| v.to_string());
+        let none = || None;
+        let r = from_posix(env(&[("LANG", "en_US.UTF-8"), ("LC_NUMERIC", "pl_PL.UTF-8"), ("LC_TIME", "en_GB.UTF-8"), ("LC_PAPER", "de_DE")]), none);
+        assert_eq!((r.numbers.as_str(), r.time.as_str(), r.decimal), ("pl-PL", "en-GB", None));
+        assert_eq!((r.paper, r.measurement), (Paper::A4, Measurement::Us), "paper from LC_PAPER, measurement from LANG");
+        assert_eq!(from_posix(env(&[("LANG", "it_IT.UTF-8"), ("LC_ALL", "en_US"), ("LC_PAPER", "de_DE")]), none).paper, Paper::Letter);
+        assert_eq!(from_posix(env(&[("LANG", "en_US"), ("LC_MEASUREMENT", "it_IT")]), none).measurement, Measurement::Metric);
+        assert_eq!(from_posix(env(&[("LANG", "C.UTF-8"), ("LC_ALL", "")]), || Some("it-IT".into())).numbers, "it-IT");
+        assert_eq!(from_posix(env(&[]), none), Region::default());
+        // `C` in an LC_* variable is the C locale's conventions, not an unset variable.
+        let r = from_posix(env(&[("LANG", "de_DE.UTF-8"), ("LC_NUMERIC", "C"), ("LC_TIME", "C.UTF-8")]), none);
+        assert_eq!((r.numbers.as_str(), r.time.as_str(), r.paper), ("en-US", "en-US", Paper::A4));
+        assert_eq!(from_posix(env(&[("LANG", "de_DE.UTF-8"), ("LC_ALL", "C")]), none), Region::from_tag("C"));
+        let r = from_posix(env(&[("LANG", "en_US.UTF-8"), ("LC_PAPER", "C"), ("LC_MEASUREMENT", "C.UTF-8")]), none);
+        assert_eq!((r.paper, r.measurement, r.decimal), (Paper::A4, Measurement::Metric, None));
+        assert_eq!(from_posix(env(&[("LANG", "C"), ("LC_NUMERIC", "")]), || Some("it-IT".into())).numbers, "it-IT");
+    }
+
+    #[test]
+    fn windows_regional_format_and_its_changes() {
+        let reg = |pairs: &'static [(&'static str, &'static str)]| move |n: &str| pairs.iter().find(|(k, _)| *k == n).map(|(_, v)| v.to_string());
+        let r = from_windows(
+            reg(&[("LocaleName", "pl-PL"), ("sDecimal", ","), ("sThousand", "\u{a0}"), ("iMeasure", "0"), ("sShortTime", "HH:mm")]),
+            || None,
+        );
+        assert_eq!((r.numbers.as_str(), r.decimal, r.grouping, r.hour_cycle), ("pl-PL", Some(','), Some(Some('\u{a0}')), Some(HourCycle::H23)));
+        // An English format in the US with the user's metric and A4 choices and a decimal comma.
+        let r = from_windows(
+            reg(&[("LocaleName", "en-US"), ("sDecimal", ","), ("iMeasure", "0"), ("iPaperSize", "9"), ("sShortTime", "h:mm tt")]),
+            || None,
+        );
+        assert_eq!(
+            (r.decimal, r.grouping, r.measurement, r.paper, r.hour_cycle),
+            (Some(','), None, Measurement::Metric, Paper::A4, Some(HourCycle::H12))
+        );
+        let r = from_windows(reg(&[("sDecimal", "dec"), ("sThousand", "")]), || Some("de-DE".into()));
+        assert_eq!((r.numbers.as_str(), r.decimal), ("de-DE", None), "a separator longer than one character keeps the locale's");
+        assert_eq!(r.grouping, Some(None), "an empty grouping separator is no grouping");
+        assert_eq!(from_windows(reg(&[("sThousand", "abc")]), || None).grouping, None);
+    }
+
+    #[test]
+    fn apple_locale_values() {
+        let r = from_apple("en_PL", true, ",", "\u{a0}", Some("HH"));
+        assert_eq!(
+            (r.numbers.as_str(), r.paper, r.decimal, r.grouping, r.hour_cycle),
+            ("en-PL", Paper::A4, Some(','), Some(Some('\u{a0}')), Some(HourCycle::H23))
+        );
+        let r = from_apple("en_US", false, ".", ",", Some("h a"));
+        assert_eq!((r.measurement, r.hour_cycle), (Measurement::Us, Some(HourCycle::H12)));
+        assert_eq!(from_apple("de_DE", true, ",", ".", Some("H 'Uhr'")).hour_cycle, Some(HourCycle::H23));
+        assert_eq!(hour_cycle_of("'h' mm"), None, "quoted letters are text");
+    }
+}
diff --git a/crates/i18n/src/size.rs b/crates/i18n/src/size.rs
new file mode 100644
index 00000000..830c0957
--- /dev/null
+++ b/crates/i18n/src/size.rs
@@ -0,0 +1,266 @@
+//! File sizes and other measures with a unit, in the interface language.
+//!
+//! Unit names are catalog rows in context `unit`, keyed by the English template with the
+//! number as `{n}` (`{n} MB`, `{n} px`, `{n}%`), so a translation can change the symbol and its
+//! spacing (`{n} Mo`, `{n} %`). They are looked up with [`I18n::get`], never the plain row: a
+//! plain `B` row means bold. A byte count in words is the `@plural` row `{n} byte|{n} bytes`.
+
+use crate::{I18n, Lang, fmt, ltr};
+
+/// The context unit rows are in.
+const CONTEXT: &str = "unit";
+
+/// A file-size unit.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum SizeUnit {
+    Byte,
+    Kilo,
+    Mega,
+    Giga,
+    Tera,
+}
+
+impl SizeUnit {
+    const ALL: [SizeUnit; 5] = [SizeUnit::Byte, SizeUnit::Kilo, SizeUnit::Mega, SizeUnit::Giga, SizeUnit::Tera];
+}
+
+/// How [`I18n::file_size`] writes a byte count: the step between units, their names, and the
+/// digits after the decimal point. Start from [`FileSize::BINARY`], [`FileSize::IEC`] or
+/// [`FileSize::DECIMAL`] and adjust:
+///
+/// ```
+/// use craft_i18n::{FileSize, SizeUnit};
+/// // `12 MB`, `3.4 MB`, `640 KB`: decimal steps, whole kilobytes, no decimals from 10 MB.
+/// let style = FileSize::DECIMAL.smallest(SizeUnit::Kilo).largest(SizeUnit::Mega).unit_decimals(SizeUnit::Kilo, 0).whole_from(10);
+/// ```
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub struct FileSize {
+    step: u64,
+    iec: bool,
+    /// Per unit, in [`SizeUnit::ALL`] order; bytes are always whole.
+    decimals: [u8; 5],
+    whole_from: u32,
+    smallest: SizeUnit,
+    largest: SizeUnit,
+    byte_symbol: bool,
+}
+
+impl FileSize {
+    /// Steps of 1024 named KB, MB, GB and TB, as Windows Explorer shows sizes; one decimal, bytes
+    /// in words.
+    pub const BINARY: FileSize = FileSize {
+        step: 1024,
+        iec: false,
+        decimals: [0, 1, 1, 1, 1],
+        whole_from: 0,
+        smallest: SizeUnit::Byte,
+        largest: SizeUnit::Tera,
+        byte_symbol: false,
+    };
+    /// Steps of 1024 named KiB, MiB, GiB and TiB.
+    pub const IEC: FileSize = FileSize { iec: true, ..FileSize::BINARY };
+    /// Steps of 1000 named KB, MB, GB and TB, as macOS shows sizes and as download and disk sizes
+    /// are sold.
+    pub const DECIMAL: FileSize = FileSize { step: 1000, ..FileSize::BINARY };
+
+    /// `n` digits after the decimal point in every unit above bytes.
+    pub const fn decimals(mut self, n: u8) -> FileSize {
+        self.decimals = [0, n, n, n, n];
+        self
+    }
+
+    /// `n` digits after the decimal point in `unit` (`0` for whole kilobytes, `2` for gigabytes).
+    pub const fn unit_decimals(mut self, unit: SizeUnit, n: u8) -> FileSize {
+        if !matches!(unit, SizeUnit::Byte) {
+            self.decimals[unit as usize] = n;
+        }
+        self
+    }
+
+    /// No decimals from `n` of a unit up: `whole_from(10)` writes `9.5 MB` and `12 MB`. `0`, the
+    /// default, keeps them.
+    pub const fn whole_from(mut self, n: u32) -> FileSize {
+        self.whole_from = n;
+        self
+    }
+
+    /// The smallest unit shown. Sizes below it are written in it, rounded up, so a file that
+    /// isn't empty never reads `0 KB`.
+    pub const fn smallest(mut self, unit: SizeUnit) -> FileSize {
+        self.smallest = unit;
+        self
+    }
+
+    /// The largest unit shown; larger sizes are counted in it (`2048 GB`).
+    pub const fn largest(mut self, unit: SizeUnit) -> FileSize {
+        self.largest = unit;
+        self
+    }
+
+    /// Bytes as the symbol `B` (`512 B`) instead of words (`512 bytes`).
+    pub const fn byte_symbol(mut self) -> FileSize {
+        self.byte_symbol = true;
+        self
+    }
+
+    /// The unit `bytes` is written in, the number in it and its digits after the point.
+    fn parts(&self, bytes: u64) -> (SizeUnit, f64, usize) {
+        let (smallest, largest) = (self.smallest.min(self.largest), self.largest);
+        let mut unit = smallest;
+        for &u in SizeUnit::ALL.iter().filter(|u| (smallest..=largest).contains(u)) {
+            if bytes as f64 >= self.scale(u) {
+                unit = u;
+            }
+        }
+        loop {
+            let value = bytes as f64 / self.scale(unit);
+            let round = |decimals: u8| {
+                let factor = 10f64.powi(i32::from(decimals));
+                (if unit == smallest && bytes > 0 && value < 1.0 { (value * factor).ceil() } else { (value * factor).round() }) / factor
+            };
+            let mut decimals = if unit == SizeUnit::Byte { 0 } else { self.decimals.get(unit as usize).copied().unwrap_or(0) };
+            let mut rounded = round(decimals);
+            // After rounding, so 9.96 MB, which rounds to 10.0, is written 10 MB.
+            if self.whole_from > 0 && rounded >= f64::from(self.whole_from) {
+                decimals = 0;
+                rounded = round(0);
+            }
+            // 1023.96 KB rounds to 1024.0 KB: the next unit writes it as 1.0 MB.
+            if rounded >= self.step as f64
+                && let Some(&next) = SizeUnit::ALL.get(unit as usize + 1)
+                && next <= largest
+            {
+                unit = next;
+                continue;
+            }
+            return (unit, rounded, usize::from(decimals));
+        }
+    }
+
+    fn scale(&self, unit: SizeUnit) -> f64 {
+        (self.step as f64).powi(unit as i32)
+    }
+
+    /// The English template for `unit`, which is also its catalog key.
+    fn template(&self, unit: SizeUnit) -> &'static str {
+        match (unit, self.iec) {
+            (SizeUnit::Byte, _) => "{n} B",
+            (SizeUnit::Kilo, false) => "{n} KB",
+            (SizeUnit::Mega, false) => "{n} MB",
+            (SizeUnit::Giga, false) => "{n} GB",
+            (SizeUnit::Tera, false) => "{n} TB",
+            (SizeUnit::Kilo, true) => "{n} KiB",
+            (SizeUnit::Mega, true) => "{n} MiB",
+            (SizeUnit::Giga, true) => "{n} GiB",
+            (SizeUnit::Tera, true) => "{n} TiB",
+        }
+    }
+}
+
+impl I18n {
+    /// `bytes` as a file size in `lang`, written the way `style` says (`1.5 MB`, `512 bytes`), the
+    /// number as [`I18n::format`] writes it (`1,5 Mo`).
+    pub fn file_size(&self, lang: Lang, bytes: u64, style: FileSize) -> String {
+        let (unit, n, decimals) = style.parts(bytes);
+        if unit == SizeUnit::Byte && !style.byte_symbol {
+            return self.trn(lang, bytes, "{n} byte", "{n} bytes");
+        }
+        self.unit_text(lang, style.template(unit), &self.format().number(n, decimals))
+    }
+
+    /// `value` with `decimals` digits after the decimal separator in the unit template `unit`, an
+    /// English catalog key with the number as `{n}` (`{n} px`, `{n} dB`), the number as
+    /// [`I18n::format`] writes it. Percentages are [`crate::Format::percent`].
+    pub fn measure(&self, lang: Lang, value: f64, decimals: usize, unit: &str) -> String {
+        self.unit_text(lang, unit, &self.format().number(value, decimals))
+    }
+
+    fn unit_text(&self, lang: Lang, template: &str, n: &str) -> String {
+        fmt(self.get(lang, CONTEXT, template).unwrap_or(template), &[("n", &ltr(n))])
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{Embedded, Format};
+
+    static E: &Embedded = &[(
+        "fr",
+        "unit\t{n} KB\t{n} Ko\nunit\t{n} MB\t{n} Mo\nunit\t{n} B\t{n} o\nunit\t{n}%\t{n} %\n\tB\tG\n@plural\t{n} byte|{n} bytes\t{n} octet|{n} octets\n",
+        "",
+    )];
+
+    fn en(bytes: u64, style: FileSize) -> String {
+        let (i18n, _) = I18n::new(&[], &[]);
+        i18n.set_format(Format::from_tag("en-US"));
+        i18n.file_size(Lang::EN, bytes, style)
+    }
+
+    #[test]
+    fn binary_decimal_and_iec_steps() {
+        assert_eq!(en(512, FileSize::BINARY), "512 bytes");
+        assert_eq!(en(1023, FileSize::BINARY), "1,023 bytes");
+        assert_eq!(en(1, FileSize::BINARY), "1 byte");
+        assert_eq!(en(1536, FileSize::BINARY), "1.5 KB");
+        assert_eq!(en(1536, FileSize::IEC), "1.5 KiB");
+        assert_eq!(en(1500, FileSize::DECIMAL), "1.5 KB");
+        assert_eq!(en(3 << 30, FileSize::BINARY), "3.0 GB");
+        assert_eq!(en(5 << 40, FileSize::IEC.decimals(0)), "5 TiB");
+        assert_eq!(en(512, FileSize::BINARY.byte_symbol()), "512 B");
+    }
+
+    #[test]
+    fn precision_and_unit_range() {
+        // Rounding up to the next unit's step moves to that unit.
+        assert_eq!(en(1_048_575, FileSize::BINARY), "1.0 MB");
+        assert_eq!(en(999_999, FileSize::DECIMAL.decimals(0)), "1 MB");
+        assert_eq!(en(1_610_612_736, FileSize::BINARY.unit_decimals(SizeUnit::Giga, 2)), "1.50 GB");
+        // Lightcraft's denoise sizes: whole kilobytes, at least 1, no decimals from 10 MB.
+        let style = FileSize::DECIMAL.smallest(SizeUnit::Kilo).largest(SizeUnit::Mega).unit_decimals(SizeUnit::Kilo, 0).whole_from(10);
+        assert_eq!(en(1, style), "1 KB");
+        assert_eq!(en(0, style), "0 KB");
+        assert_eq!(en(640_400, style), "640 KB");
+        assert_eq!(en(3_400_000, style), "3.4 MB");
+        assert_eq!(en(12_600_000, style), "13 MB");
+        assert_eq!(en(9_960_000, style), "10 MB", "whole once rounded to 10");
+        assert_eq!(en(9_940_000, style), "9.9 MB");
+        assert_eq!(en(5_000_000_000, style), "5,000 MB");
+        // Only sizes below the smallest unit round up.
+        assert_eq!(en(1025, FileSize::BINARY.smallest(SizeUnit::Kilo).unit_decimals(SizeUnit::Kilo, 0)), "1 KB");
+        assert_eq!(en(100, FileSize::BINARY.smallest(SizeUnit::Kilo).unit_decimals(SizeUnit::Kilo, 0)), "1 KB");
+    }
+
+    #[test]
+    fn numbers_are_left_to_right_isolates_in_rtl_units() {
+        let (i18n, problems) = I18n::new(&[("ar", "unit\t{n} KB\t{n} ك.ب\n", "")], &["ar"]);
+        assert!(problems.is_empty(), "{problems:?}");
+        i18n.set_format(Format::from_tag("en-US"));
+        let ar = i18n.from_code("ar").unwrap();
+        assert_eq!(i18n.file_size(ar, 1536, FileSize::BINARY), "\u{2066}1.5\u{2069} ك.ب");
+        assert_eq!(en(1536, FileSize::BINARY), "1.5 KB", "no marks in left-to-right text");
+    }
+
+    #[test]
+    fn unit_names_are_catalog_rows() {
+        let (i18n, problems) = I18n::new(E, &["fr"]);
+        assert!(problems.is_empty(), "{problems:?}");
+        let fr = i18n.from_code("fr").unwrap();
+        i18n.set_format(Format::from_tag("fr-FR"));
+        assert_eq!(i18n.file_size(fr, 1536, FileSize::BINARY), "1,5 Ko");
+        assert_eq!(i18n.file_size(fr, 512, FileSize::BINARY), "512 octets");
+        assert_eq!(i18n.file_size(fr, 512, FileSize::BINARY.byte_symbol()), "512 o", "not the plain row B (bold)");
+        assert_eq!(i18n.file_size(fr, 3 << 30, FileSize::BINARY), "3,0 GB", "a missing row is English");
+        assert_eq!(i18n.measure(fr, 50.0, 0, "{n}%"), "50 %");
+        assert_eq!(i18n.measure(Lang::EN, 12.34, 1, "{n} px"), "12,3 px", "numbers follow the region, not the language");
+    }
+
+    #[test]
+    fn locale_digits() {
+        let (i18n, _) = I18n::new(&[], &[]);
+        i18n.set_format(Format::from_tag("ar-EG"));
+        assert_eq!(i18n.file_size(Lang::EN, 1536, FileSize::BINARY), "١٫٥ KB");
+        i18n.set_format(Format::from_tag("hi"));
+        assert_eq!(i18n.file_size(Lang::EN, 1_234_567, FileSize::DECIMAL.largest(SizeUnit::Byte).byte_symbol()), "12,34,567 B");
+    }
+}
diff --git a/crates/jpeg/Cargo.toml b/crates/jpeg/Cargo.toml
new file mode 100644
index 00000000..76806112
--- /dev/null
+++ b/crates/jpeg/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "craft-jpeg"
+description = "Clean-room decoder for 12-bit and arithmetic-coded JPEG (ITU-T T.81)."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+thiserror = { workspace = true }
+
+[dev-dependencies]
+# Reference encoder and baseline decoder for the comparison tests.
+jpeg-encoder = "0.6"
+zune-jpeg = "0.5"
diff --git a/crates/jpeg/README.md b/crates/jpeg/README.md
new file mode 100644
index 00000000..e88c5cd9
--- /dev/null
+++ b/crates/jpeg/README.md
@@ -0,0 +1,145 @@
+# craft-jpeg
+
+A clean-room JPEG decoder for the Craft apps, written from ITU-T T.81 (ISO/IEC 10918-1). It
+covers the processes that common Rust JPEG decoders skip: 12-bit samples and arithmetic coding.
+No `unsafe`, no panics on malformed input, and it builds for `wasm32-unknown-unknown`. The only
+dependency is `thiserror`.
+
+```toml
+craft-jpeg = { git = "https://github.com/storytold/craft-libs", rev = "<commit>" }
+```
+
+## What it decodes
+
+| Frame | Process | Precision |
+|---|---|---|
+| SOF0, SOF1 | sequential DCT, Huffman coded | 8 or 12-bit |
+| SOF9 | extended sequential DCT, arithmetic coded | 8 or 12-bit |
+| SOF10 | progressive DCT, arithmetic coded | 8 or 12-bit |
+
+Every other frame returns `Error::Unsupported`: progressive Huffman (SOF2), lossless (SOF3,
+SOF11), hierarchical (SOF5 to SOF7, SOF13 to SOF15), other precisions, more than one frame, and
+a height given only in a DNL marker. Images have 1, 3 or 4 components with any sampling factors
+and restart intervals.
+
+## Use
+
+```rust
+use craft_jpeg::{decode, Limits, Samples};
+
+let img = decode(&bytes, &Limits::default(), adobe_transform)?;
+match img.samples {
+    Samples::U8(px) => { /* 8-bit frames */ }
+    Samples::U16(px) => { /* 12-bit frames, scaled to 16 bits */ }
+}
+if img.damaged { /* warn: part of the image is missing */ }
+```
+
+- `decode(bytes, &Limits, adobe_transform: Option<u8>) -> Result<Decoded, Error>`.
+  `adobe_transform` is the transform byte of the APP14 `Adobe` segment, when the app found one.
+- `frame(bytes) -> Option<FrameKind>` reads the headers up to the first SOFn marker and returns
+  that marker and the declared sample precision, without decoding.
+- `Error` is `Malformed`, `Unsupported` or `LimitExceeded`, each with a message.
+
+## Output
+
+`Decoded` has `width`, `height`, `components`, `samples` and `damaged`.
+
+- `samples` is interleaved by pixel, rows top to bottom: `Samples::U8` for 8-bit frames,
+  `Samples::U16` for 12-bit frames, scaled to the full 16-bit range
+  (`round(v × 65535 / 4095)`).
+- `components` is 1 (gray), 3 (RGB) or 4 (CMYK).
+  - 3 components are converted from YCbCr to RGB (JFIF, T.871), unless the Adobe transform is
+    0 or the component IDs are `R`, `G`, `B`.
+  - 4 components are ink amounts (0 = no ink). The stored values are taken to follow Adobe's
+    inverted convention (maximum = no ink) and are inverted back. With Adobe transform 2 (YCCK),
+    C, M and Y are converted from YCbCr, which yields ink amounts directly, and K is inverted.
+- `damaged` is set when entropy-coded data was cut short or corrupt after at least one MCU had
+  decoded, or its scans would decode more than 64 passes over the frame's blocks. The rest of
+  that scan, and every scan past the budget, is left out; those blocks keep what earlier scans
+  decoded. A stream with no decodable image data is an error. Arithmetic-coded data that stops
+  early at a marker reads as the zero bytes encoders drop at the end of a scan (libjpeg-turbo
+  treats it the same way), so for arithmetic scans only data that runs to the end of the file
+  and a missing restart marker count as damage.
+
+## Limits
+
+`Limits` (fields `max_pixels`, `max_alloc`) is checked against the frame header before anything
+is allocated: `width × height` against `max_pixels`, and the output buffer plus the decoder's
+own coefficient and sample buffers, together, against `max_alloc`. The defaults are 2³⁰ pixels
+and 8 GiB on 64-bit targets, 1 GiB on 32-bit ones (wasm32). The struct is `#[non_exhaustive]`:
+start from the defaults and set the fields you change:
+
+```rust
+let mut limits = craft_jpeg::Limits::default();
+limits.max_alloc = 512 << 20;
+```
+
+A file of under a hundred bytes can declare a frame that fills the default limits, and
+decoding it still renders every sample. Callers that decode for a UI or for previews should
+pass a `max_alloc` well below the default.
+
+## Routing
+
+An app that decodes baseline JPEG with another decoder keeps its own rule for which files come
+here, built on `frame`. PhotoCraft sends arithmetic-coded files (SOF9 to SOF11) and SOF0/SOF1
+files whose precision is not 8 bits:
+
+```rust
+fn use_craft_jpeg(bytes: &[u8]) -> bool {
+    match craft_jpeg::frame(bytes) {
+        Some(f) if (0xC9..=0xCB).contains(&f.marker) => true,
+        Some(f) if matches!(f.marker, 0xC0 | 0xC1) => f.precision != 8,
+        _ => false,
+    }
+}
+```
+
+SOF11 (lossless) falls in that range and returns `Unsupported`.
+
+## Boundaries
+
+- In scope: decoding the frames above into samples.
+- Out of scope: metadata. The decoder skips every APPn and COM segment. ICC profiles, EXIF,
+  XMP, Photoshop resources, resolution and the APP14 `Adobe` segment are the app's to read.
+  Color management and encoding also stay in the apps.
+
+## Testing
+
+`cargo test -p craft-jpeg` runs:
+
+- unit tests in `src/tests.rs`: arithmetic-coded streams from a test-only encoder must decode to
+  the coefficients that went in, and Huffman streams are compared against `zune-jpeg`.
+- `tests/conformance.rs`, on libjpeg-turbo's test images in `tests/data` (provenance and how
+  the derived files were made: `tests/data/SOURCE.md`):
+  - `testimgari.jpg` (SOF9) decodes to exactly the samples of its jpegtran Huffman transcode.
+  - jpegtran's arithmetic and progressive arithmetic transcodes of `testorig.jpg` (one with
+    restarts) and `testorig12.jpg` decode to exactly the samples of their sources.
+  - `whitetail-ari.jpg` (SOF9 from cjpeg, a white lower part that decodes from the zeros
+    supplied at EOI) decodes undamaged and equal to its Huffman transcode.
+  - `testorig.jpg` matches `zune-jpeg`, and `testorig12.jpg` matches libjpeg-turbo's 12-bit
+    decode, within the float-against-integer IDCT difference (mean under 0.75, max 4).
+- `tests/mutation.rs`: a seeded mutation run (truncations, bit flips, byte and frame-header
+  overwrites, deleted and repeated spans) over the test images and the fuzz seeds. Decoding must
+  not panic and must stay within small `Limits`.
+
+`.github/workflows/jpeg.yml` runs fmt, clippy, the tests and a `wasm32-unknown-unknown` check on
+Linux.
+
+### Fuzzing
+
+`fuzz/` is a cargo-fuzz crate outside the workspace, with one target, `decode`. Its seeds in
+`fuzz/corpus/decode` are the test images plus small SOF9 (with restarts), 12-bit SOF9, SOF10
+and 12-bit SOF1 streams. With nightly and `cargo install cargo-fuzz`:
+
+```sh
+cd crates/jpeg/fuzz
+cargo +nightly fuzz run decode
+```
+
+Running it adds the inputs it finds to `fuzz/corpus/decode`; commit only seeds that cover
+something new.
+
+## Credits
+
+The decoder was written by Michael Higgins (Higgs32584) for PhotoCraft.
diff --git a/crates/jpeg/fuzz/.gitignore b/crates/jpeg/fuzz/.gitignore
new file mode 100644
index 00000000..d02230c0
--- /dev/null
+++ b/crates/jpeg/fuzz/.gitignore
@@ -0,0 +1,4 @@
+target
+artifacts
+coverage
+Cargo.lock
diff --git a/crates/jpeg/fuzz/Cargo.toml b/crates/jpeg/fuzz/Cargo.toml
new file mode 100644
index 00000000..c4881e66
--- /dev/null
+++ b/crates/jpeg/fuzz/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "craft-jpeg-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2024"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+craft-jpeg = { path = ".." }
+
+# Its own workspace: cargo-fuzz needs nightly and sanitizer flags, so this crate stays out of the
+# craft-libs workspace and its lockfile.
+[workspace]
+
+[[bin]]
+name = "decode"
+path = "fuzz_targets/decode.rs"
+test = false
+doc = false
+bench = false
diff --git a/crates/jpeg/fuzz/corpus/decode/sof1-12bit.jpg b/crates/jpeg/fuzz/corpus/decode/sof1-12bit.jpg
new file mode 100644
index 00000000..7c0e6860
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/sof1-12bit.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/sof10-progressive.jpg b/crates/jpeg/fuzz/corpus/decode/sof10-progressive.jpg
new file mode 100644
index 00000000..f29a0a3c
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/sof10-progressive.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/sof9-12bit.jpg b/crates/jpeg/fuzz/corpus/decode/sof9-12bit.jpg
new file mode 100644
index 00000000..dd053182
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/sof9-12bit.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/sof9-restart.jpg b/crates/jpeg/fuzz/corpus/decode/sof9-restart.jpg
new file mode 100644
index 00000000..c165ab46
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/sof9-restart.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/testimgari-huffman.jpg b/crates/jpeg/fuzz/corpus/decode/testimgari-huffman.jpg
new file mode 100644
index 00000000..2501c615
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/testimgari-huffman.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/testimgari.jpg b/crates/jpeg/fuzz/corpus/decode/testimgari.jpg
new file mode 100644
index 00000000..89664874
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/testimgari.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/testorig-ari-progressive-restart.jpg b/crates/jpeg/fuzz/corpus/decode/testorig-ari-progressive-restart.jpg
new file mode 100644
index 00000000..10c5081f
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/testorig-ari-progressive-restart.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/testorig-ari-progressive.jpg b/crates/jpeg/fuzz/corpus/decode/testorig-ari-progressive.jpg
new file mode 100644
index 00000000..e814c929
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/testorig-ari-progressive.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/testorig.jpg b/crates/jpeg/fuzz/corpus/decode/testorig.jpg
new file mode 100644
index 00000000..9816a0c6
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/testorig.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/testorig12-ari-progressive.jpg b/crates/jpeg/fuzz/corpus/decode/testorig12-ari-progressive.jpg
new file mode 100644
index 00000000..3a716ea7
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/testorig12-ari-progressive.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/testorig12-ari.jpg b/crates/jpeg/fuzz/corpus/decode/testorig12-ari.jpg
new file mode 100644
index 00000000..66478ad5
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/testorig12-ari.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/testorig12.jpg b/crates/jpeg/fuzz/corpus/decode/testorig12.jpg
new file mode 100644
index 00000000..861aff98
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/testorig12.jpg differ
diff --git a/crates/jpeg/fuzz/corpus/decode/whitetail-ari.jpg b/crates/jpeg/fuzz/corpus/decode/whitetail-ari.jpg
new file mode 100644
index 00000000..e7011fb6
Binary files /dev/null and b/crates/jpeg/fuzz/corpus/decode/whitetail-ari.jpg differ
diff --git a/crates/jpeg/fuzz/fuzz_targets/decode.rs b/crates/jpeg/fuzz/fuzz_targets/decode.rs
new file mode 100644
index 00000000..ed96fafe
--- /dev/null
+++ b/crates/jpeg/fuzz/fuzz_targets/decode.rs
@@ -0,0 +1,29 @@
+#![no_main]
+
+use craft_jpeg::{Limits, Samples, decode, frame};
+use libfuzzer_sys::fuzz_target;
+
+fn fuzz_limits() -> Limits {
+    let mut limits = Limits::default();
+    limits.max_pixels = 1 << 20;
+    limits.max_alloc = 64 << 20;
+    limits
+}
+
+fuzz_target!(|data: &[u8]| {
+    let limits = fuzz_limits();
+    let _ = frame(data);
+    // The input length picks the Adobe transform, so every color path is reached without
+    // changing the stream.
+    let adobe = [None, Some(0), Some(1), Some(2)][data.len() % 4];
+    if let Ok(img) = decode(data, &limits, adobe) {
+        let pixels = u64::from(img.width) * u64::from(img.height);
+        let (len, width) = match &img.samples {
+            Samples::U8(v) => (v.len() as u64, 1),
+            Samples::U16(v) => (v.len() as u64, 2),
+        };
+        assert!(pixels <= limits.max_pixels);
+        assert!(len * width <= limits.max_alloc);
+        assert_eq!(len, pixels * u64::from(img.components));
+    }
+});
diff --git a/crates/jpeg/src/lib.rs b/crates/jpeg/src/lib.rs
new file mode 100644
index 00000000..d9ef3bd3
--- /dev/null
+++ b/crates/jpeg/src/lib.rs
@@ -0,0 +1,1348 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+//! Clean-room decoder for the JPEG processes most Rust JPEG decoders don't handle, written from
+//! ITU-T T.81 (ISO/IEC 10918-1).
+//!
+//! [`decode`] supports these frames:
+//!
+//! - sequential DCT, Huffman coded, 8 or 12-bit samples (SOF0 and SOF1; SOF0 files that declare
+//!   12 bits are read as SOF1);
+//! - extended sequential DCT, arithmetic coded, 8 or 12-bit (SOF9);
+//! - progressive DCT, arithmetic coded, 8 or 12-bit (SOF10).
+//!
+//! Every other frame returns [`Error::Unsupported`]: progressive Huffman (SOF2), lossless (SOF3,
+//! SOF11) and hierarchical (SOF5–SOF7, SOF13–SOF15) files, and DCT precisions other than 8 and
+//! 12 bits.
+//!
+//! An app that also uses a baseline decoder routes each file with [`frame`], which reports the
+//! first frame marker and its precision without decoding. For example, to send this crate the
+//! arithmetic-coded files and the Huffman-coded ones that aren't 8-bit:
+//!
+//! ```
+//! fn use_craft_jpeg(bytes: &[u8]) -> bool {
+//!     match craft_jpeg::frame(bytes) {
+//!         Some(f) if (0xC9..=0xCB).contains(&f.marker) => true,
+//!         Some(f) if matches!(f.marker, 0xC0 | 0xC1) => f.precision != 8,
+//!         _ => false,
+//!     }
+//! }
+//! # assert!(!use_craft_jpeg(&[0xFF, 0xD8]));
+//! ```
+//!
+//! Every scan is decoded into a whole-image buffer of quantized coefficients (Annex F for the
+//! sequential scans, Annex G for the progressive ones; the arithmetic decoder of Annex D with the
+//! conditioning of `DAC`), then dequantized, inverse transformed in floating point (A.3.3),
+//! upsampled and color converted. 12-bit images come out as 16-bit samples (scaled, not
+//! truncated). Restart intervals, 1, 3 and 4 components and any sampling factors are supported.
+//! Metadata (ICC profiles, EXIF, XMP, Photoshop resources, resolution) is left to the caller,
+//! which also reads the APP14 `Adobe` segment and passes its transform byte to [`decode`].
+//!
+//! The decoder never panics on input: every read from the stream is bounds-checked, the work
+//! is bounded by 64 passes over the frame's blocks (`SCAN_PASSES`), and
+//! allocations are checked against the [`Limits`] first.
+//! Damaged entropy-coded data stops that scan; what was decoded is kept and the caller is told
+//! through [`Decoded::damaged`].
+
+/// Why a stream could not be decoded.
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+#[non_exhaustive]
+pub enum Error {
+    /// The stream breaks T.81 in a way the decoder cannot recover from.
+    #[error("malformed JPEG: {0}")]
+    Malformed(String),
+    /// A valid JPEG process or feature this decoder does not implement.
+    #[error("{0}")]
+    Unsupported(String),
+    /// Decoding would exceed the caller's [`Limits`].
+    #[error("limit exceeded: {0}")]
+    LimitExceeded(String),
+}
+
+fn err(m: impl std::fmt::Display) -> Error {
+    Error::Malformed(m.to_string())
+}
+
+fn unsupported(m: impl Into<String>) -> Error {
+    Error::Unsupported(m.into())
+}
+
+/// Decompression-bomb guards, checked against the frame header before any image buffer is
+/// allocated.
+///
+/// ```
+/// let mut limits = craft_jpeg::Limits::default();
+/// limits.max_alloc = 512 << 20;
+/// ```
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct Limits {
+    /// Maximum `width * height`.
+    pub max_pixels: u64,
+    /// Maximum bytes for the decoded output and the decoder's own coefficient and sample
+    /// buffers together. Totals above `isize::MAX` are rejected whatever this is set to.
+    pub max_alloc: u64,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        // 2^30 pixels (e.g. 32768²) and, on 64-bit targets, 8 GiB. On 32-bit targets (wasm32 has
+        // a 4 GiB address space shared with the rest of the app) 1 GiB is the most one buffer can
+        // safely ask for.
+        let max_alloc = if cfg!(target_pointer_width = "64") { 8 << 30 } else { 1 << 30 };
+        Limits { max_pixels: 1 << 30, max_alloc }
+    }
+}
+
+impl Limits {
+    /// Check an output buffer of `width × height` pixels of `bytes_per_pixel` bytes.
+    fn check(&self, width: usize, height: usize, bytes_per_pixel: u64) -> Result<(), Error> {
+        if width == 0 || height == 0 {
+            return Err(err(format!("zero-sized image {width}x{height}")));
+        }
+        let pixels = (width as u64).saturating_mul(height as u64);
+        if pixels > self.max_pixels {
+            return Err(Error::LimitExceeded(format!("{pixels} pixels exceed max {}", self.max_pixels)));
+        }
+        let bytes = pixels.saturating_mul(bytes_per_pixel);
+        if bytes > self.max_alloc {
+            return Err(Error::LimitExceeded(format!("{bytes} bytes exceed max_alloc {}", self.max_alloc)));
+        }
+        if usize::try_from(bytes).is_err() {
+            return Err(Error::LimitExceeded(format!("{bytes} bytes do not fit in memory")));
+        }
+        Ok(())
+    }
+}
+
+/// Zigzag scan position `k` → natural (row-major) coefficient index (Figure A.6).
+const ZIGZAG: [usize; 64] = [
+    0, 1, 8, 16, 9, 2, 3, 10, 17, 24, 32, 25, 18, 11, 4, 5, 12, 19, 26, 33, 40, 48, 41, 34, 27, 20, 13, 6, 7, 14, 21, 28, 35, 42, 49, 56, 57, 50, 43,
+    36, 29, 22, 15, 23, 30, 37, 44, 51, 58, 59, 52, 45, 38, 31, 39, 46, 53, 60, 61, 54, 47, 55, 62, 63,
+];
+
+/// The first frame header of a stream, as reported by [`frame`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FrameKind {
+    /// The second byte of the SOFn marker: `0xC0` (SOF0) to `0xCF` (SOF15), never `0xC4`,
+    /// `0xC8` or `0xCC`.
+    pub marker: u8,
+    /// The sample precision in bits (P in B.2.2), as declared; not validated.
+    pub precision: u8,
+}
+
+/// The first frame marker (SOFn) and its sample precision, found by walking the marker
+/// segments that precede it. `None` when the stream doesn't start with SOI or reaches a scan,
+/// EOI or the end of the data first. Reads only the headers, so it is cheap enough to route
+/// every JPEG an app opens.
+pub fn frame(b: &[u8]) -> Option<FrameKind> {
+    if b.get(..2) != Some(&[0xFF, 0xD8]) {
+        return None;
+    }
+    let mut i = 2;
+    loop {
+        if *b.get(i)? != 0xFF {
+            return None;
+        }
+        let m = *b.get(i + 1)?;
+        match m {
+            0xFF => i += 1,
+            0x01 | 0xD0..=0xD8 => i += 2,
+            0xD9 | 0xDA => return None,
+            _ => {
+                let len = usize::from(u16::from_be_bytes([*b.get(i + 2)?, *b.get(i + 3)?]));
+                if matches!(m, 0xC0..=0xCF) && !matches!(m, 0xC4 | 0xC8 | 0xCC) {
+                    return Some(FrameKind { marker: m, precision: *b.get(i + 4)? });
+                }
+                i = i.checked_add(2 + len)?;
+            }
+        }
+    }
+}
+
+/// Decoded samples, interleaved by pixel (`components` values per pixel), rows top to bottom.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Samples {
+    /// 8-bit frames: `0..=255`.
+    U8(Vec<u8>),
+    /// 12-bit frames, scaled to the full 16-bit range: `round(v × 65535 / 4095)`.
+    U16(Vec<u16>),
+}
+
+/// A decoded image.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Decoded {
+    pub width: u32,
+    pub height: u32,
+    /// Samples per pixel: 1 for gray, 3 for RGB, 4 for CMYK.
+    ///
+    /// Three-component frames are converted from YCbCr to RGB (JFIF, T.871) unless the Adobe
+    /// transform is 0 or the component IDs are `R`, `G`, `B`. Four-component samples are ink
+    /// amounts (0 = no ink): the stored values are taken to follow Adobe's convention, inverted
+    /// (maximum = no ink), and are inverted back. With Adobe transform 2 (YCCK) the first three
+    /// components are converted from YCbCr, which yields the ink amounts of C, M and Y directly,
+    /// and K is inverted.
+    pub components: u8,
+    pub samples: Samples,
+    /// Entropy-coded data was damaged or cut short: the rest of that scan, and any scans past
+    /// the decoder's cap, were left out, and those blocks keep what earlier scans decoded.
+    pub damaged: bool,
+}
+
+// ---------------------------------------------------------------------------------------------
+// Tables and frame
+
+/// A Huffman table in the decoding form of F.2.2.3 (`MAXCODE`, `VALPTR`, `MINCODE`).
+#[derive(Clone)]
+struct Huffman {
+    maxcode: [i32; 17],
+    valptr: [i32; 17],
+    mincode: [i32; 17],
+    values: Vec<u8>,
+}
+
+impl Huffman {
+    fn new(counts: &[u8], values: &[u8]) -> Result<Self, Error> {
+        let mut h = Huffman { maxcode: [-1; 17], valptr: [0; 17], mincode: [0; 17], values: values.to_vec() };
+        let mut code: i32 = 0;
+        let mut k: i32 = 0;
+        for (l, &n) in (1..=16usize).zip(counts) {
+            let n = i32::from(n);
+            if n > 0 {
+                h.valptr[l] = k;
+                h.mincode[l] = code;
+                code += n;
+                k += n;
+                h.maxcode[l] = code - 1;
+                if code > 1 << l {
+                    return Err(err("Huffman table has too many codes"));
+                }
+            }
+            code <<= 1;
+        }
+        Ok(h)
+    }
+
+    fn decode(&self, bits: &mut Bits) -> Result<u8, Error> {
+        let mut code: i32 = 0;
+        for l in 1..=16 {
+            code = (code << 1) | bits.bit() as i32;
+            if code <= self.maxcode[l] {
+                let idx = self.valptr[l] + code - self.mincode[l];
+                return usize::try_from(idx).ok().and_then(|i| self.values.get(i)).copied().ok_or_else(|| err("bad Huffman code"));
+            }
+        }
+        Err(err("bad Huffman code"))
+    }
+}
+
+struct Tables {
+    /// Quantization tables in zigzag order.
+    quant: [Option<[u16; 64]>; 4],
+    dc: [Option<Huffman>; 4],
+    ac: [Option<Huffman>; 4],
+    /// Arithmetic DC conditioning (L, U) and AC conditioning (Kx) per table (F.1.4.4; defaults
+    /// of B.2.4.3: L = 0, U = 1, Kx = 5).
+    dc_l: [u8; 4],
+    dc_u: [u8; 4],
+    ac_kx: [u8; 4],
+    restart: usize,
+}
+
+impl Default for Tables {
+    fn default() -> Self {
+        Tables { quant: [None; 4], dc: Default::default(), ac: Default::default(), dc_l: [0; 4], dc_u: [1; 4], ac_kx: [5; 4], restart: 0 }
+    }
+}
+
+struct Component {
+    id: u8,
+    h: usize,
+    v: usize,
+    tq: usize,
+    /// Samples in this component (B.2.2: ⌈X·H/Hmax⌉ × ⌈Y·V/Vmax⌉).
+    cw: usize,
+    ch: usize,
+    /// Blocks per line and block lines, padded to whole MCUs.
+    bw: usize,
+    bh: usize,
+    /// Quantized coefficients, one block per entry, in zigzag order.
+    coefs: Vec<[i32; 64]>,
+    /// Table `tq` as it was at the component's first scan. B.2.2 lets a DQT redefine the slot
+    /// once every scan of the component is done; libjpeg latches it the same way
+    /// (`latch_quant_tables`).
+    quant: Option<[u16; 64]>,
+}
+
+struct Frame {
+    arithmetic: bool,
+    progressive: bool,
+    precision: u8,
+    width: usize,
+    height: usize,
+    hmax: usize,
+    vmax: usize,
+    mcux: usize,
+    mcuy: usize,
+    comps: Vec<Component>,
+}
+
+fn be16(s: &[u8], at: usize) -> Result<u16, Error> {
+    match (s.get(at), s.get(at + 1)) {
+        (Some(&a), Some(&b)) => Ok(u16::from_be_bytes([a, b])),
+        _ => Err(err("segment too short")),
+    }
+}
+
+fn byte(s: &[u8], at: usize) -> Result<u8, Error> {
+    s.get(at).copied().ok_or_else(|| err("segment too short"))
+}
+
+fn parse_dqt(seg: &[u8], t: &mut Tables) -> Result<(), Error> {
+    let mut i = 0;
+    while i < seg.len() {
+        let pq_tq = byte(seg, i)?;
+        let (pq, tq) = (pq_tq >> 4, usize::from(pq_tq & 15));
+        i += 1;
+        let mut q = [0u16; 64];
+        for v in &mut q {
+            if pq == 0 {
+                *v = u16::from(byte(seg, i)?);
+                i += 1;
+            } else {
+                *v = be16(seg, i)?;
+                i += 2;
+            }
+        }
+        let slot = t.quant.get_mut(tq).ok_or_else(|| err("bad quantization table id"))?;
+        *slot = Some(q);
+    }
+    Ok(())
+}
+
+fn parse_dht(seg: &[u8], t: &mut Tables) -> Result<(), Error> {
+    let mut i = 0;
+    while i < seg.len() {
+        let tc_th = byte(seg, i)?;
+        let counts = seg.get(i + 1..i + 17).ok_or_else(|| err("Huffman table too short"))?;
+        let total: usize = counts.iter().map(|&c| usize::from(c)).sum();
+        let values = seg.get(i + 17..i + 17 + total).ok_or_else(|| err("Huffman table too short"))?;
+        let table = Huffman::new(counts, values)?;
+        let slot = match tc_th >> 4 {
+            0 => t.dc.get_mut(usize::from(tc_th & 15)),
+            1 => t.ac.get_mut(usize::from(tc_th & 15)),
+            _ => None,
+        };
+        *slot.ok_or_else(|| err("bad Huffman table id"))? = Some(table);
+        i += 17 + total;
+    }
+    Ok(())
+}
+
+fn parse_dac(seg: &[u8], t: &mut Tables) -> Result<(), Error> {
+    for pair in seg.chunks(2) {
+        let [tc_tb, cs] = *pair else { return Err(err("DAC segment too short")) };
+        let tb = usize::from(tc_tb & 15);
+        match tc_tb >> 4 {
+            0 => {
+                let (l, u) = (cs & 15, cs >> 4);
+                if l > u {
+                    return Err(err("DAC conditioning has L > U"));
+                }
+                *t.dc_l.get_mut(tb).ok_or_else(|| err("bad DAC table id"))? = l;
+                *t.dc_u.get_mut(tb).ok_or_else(|| err("bad DAC table id"))? = u;
+            }
+            1 => {
+                if !(1..=63).contains(&cs) {
+                    return Err(err("DAC Kx out of range"));
+                }
+                *t.ac_kx.get_mut(tb).ok_or_else(|| err("bad DAC table id"))? = cs;
+            }
+            _ => return Err(err("bad DAC table class")),
+        }
+    }
+    Ok(())
+}
+
+fn parse_frame(marker: u8, seg: &[u8], limits: &Limits) -> Result<Frame, Error> {
+    let (arithmetic, progressive) = match marker {
+        0xC0 | 0xC1 => (false, false),
+        0xC9 => (true, false),
+        0xCA => (true, true),
+        0xC2 => return Err(unsupported("progressive Huffman-coded JPEG is not supported")),
+        0xC3 | 0xCB => return Err(unsupported("lossless JPEG is not supported")),
+        _ => return Err(unsupported("hierarchical JPEG is not supported")),
+    };
+    let precision = byte(seg, 0)?;
+    if precision != 8 && precision != 12 {
+        return Err(unsupported(format!("{precision}-bit DCT JPEG is not supported")));
+    }
+    let height = usize::from(be16(seg, 1)?);
+    let width = usize::from(be16(seg, 3)?);
+    if height == 0 {
+        return Err(unsupported("JPEG with the height in a DNL marker is not supported"));
+    }
+    let nf = usize::from(byte(seg, 5)?);
+    if !matches!(nf, 1 | 3 | 4) {
+        return Err(unsupported(format!("JPEG with {nf} components is not supported")));
+    }
+    let mut raw = Vec::with_capacity(nf);
+    for c in 0..nf {
+        let at = 6 + 3 * c;
+        let (id, hv, tq) = (byte(seg, at)?, byte(seg, at + 1)?, byte(seg, at + 2)?);
+        let (h, v) = (usize::from(hv >> 4), usize::from(hv & 15));
+        if !(1..=4).contains(&h) || !(1..=4).contains(&v) || tq > 3 {
+            return Err(err("bad component sampling factors or table"));
+        }
+        raw.push((id, h, v, usize::from(tq)));
+    }
+    let hmax = raw.iter().map(|c| c.1).max().unwrap_or(1);
+    let vmax = raw.iter().map(|c| c.2).max().unwrap_or(1);
+    let bytes_per_pixel = nf as u64 * if precision > 8 { 2 } else { 1 };
+    limits.check(width, height, bytes_per_pixel)?;
+    let mcux = width.div_ceil(8 * hmax);
+    let mcuy = height.div_ceil(8 * vmax);
+    // `render` holds the coefficients (4 bytes) and the reconstructed plane (4 bytes) of every
+    // padded sample while it writes the output, so all three count against `max_alloc` together.
+    let mut total = (width as u64 * height as u64).saturating_mul(bytes_per_pixel);
+    for &(_, h, v, _) in &raw {
+        let samples = (mcux * h * 8) as u64 * (mcuy * v * 8) as u64;
+        total = total.saturating_add(samples.saturating_mul(8));
+    }
+    // No allocation may pass `isize::MAX` bytes, which matters on 32-bit targets when a caller
+    // raises `max_alloc`.
+    let cap = limits.max_alloc.min(isize::MAX as u64);
+    if total > cap {
+        return Err(Error::LimitExceeded(format!("{total} bytes of decoder buffers and output exceed the limit of {cap}")));
+    }
+    let mut comps = Vec::with_capacity(nf);
+    for (id, h, v, tq) in raw {
+        let (bw, bh) = (mcux * h, mcuy * v);
+        let blocks = bw.checked_mul(bh).ok_or_else(|| Error::LimitExceeded("too many blocks".into()))?;
+        comps.push(Component {
+            id,
+            h,
+            v,
+            tq,
+            cw: (width * h).div_ceil(hmax),
+            ch: (height * v).div_ceil(vmax),
+            bw,
+            bh,
+            coefs: vec![[0; 64]; blocks],
+            quant: None,
+        });
+    }
+    Ok(Frame { arithmetic, progressive, precision, width, height, hmax, vmax, mcux, mcuy, comps })
+}
+
+// ---------------------------------------------------------------------------------------------
+// Entropy-coded segments
+
+/// Where the entropy-coded data starting at `start` ends: the first marker that isn't a
+/// stuffed `FF 00`, a fill byte or a restart marker.
+fn scan_end(b: &[u8], start: usize) -> usize {
+    let mut i = start;
+    while let Some(p) = b.get(i..).and_then(|r| r.iter().position(|&v| v == 0xFF)) {
+        i += p;
+        match b.get(i + 1) {
+            Some(0x00 | 0xD0..=0xD7) => i += 2,
+            Some(0xFF) => i += 1,
+            Some(_) => return i,
+            None => return b.len(),
+        }
+    }
+    b.len()
+}
+
+/// Past the next restart marker at or after `pos`, and `true`; or at the next other marker
+/// (or the end) and `false`.
+fn skip_restart(d: &[u8], mut pos: usize) -> (usize, bool) {
+    while let Some(&v) = d.get(pos) {
+        if v != 0xFF {
+            pos += 1;
+            continue;
+        }
+        match d.get(pos + 1) {
+            Some(0xD0..=0xD7) => return (pos + 2, true),
+            Some(0x00) => pos += 2,
+            Some(0xFF) => pos += 1,
+            _ => return (pos, false),
+        }
+    }
+    (pos, false)
+}
+
+/// Next data byte for the decoders: `FF 00` is a data `FF`; at a marker (or the end) zeros
+/// are supplied and the marker is not consumed (D.2.6, F.2.2.5).
+fn next_byte(d: &[u8], pos: &mut usize) -> Option<u8> {
+    let &v = d.get(*pos)?;
+    if v != 0xFF {
+        *pos += 1;
+        return Some(v);
+    }
+    let mut p = *pos + 1;
+    while d.get(p) == Some(&0xFF) {
+        p += 1;
+    }
+    if d.get(p) == Some(&0x00) {
+        *pos = p + 1;
+        Some(0xFF)
+    } else {
+        *pos = p - 1;
+        None
+    }
+}
+
+/// Huffman bit reader (F.2.2.5).
+struct Bits<'a> {
+    d: &'a [u8],
+    pos: usize,
+    acc: u32,
+    n: u32,
+    /// How many of the `n` buffered bits (always the last ones) are zero padding supplied at
+    /// a marker or the end of the data, not real entropy-coded bits.
+    pad: u32,
+    /// Set once a read consumed padding: the scan's data ended before the scan did.
+    exhausted: bool,
+}
+
+impl<'a> Bits<'a> {
+    fn new(d: &'a [u8]) -> Self {
+        Bits { d, pos: 0, acc: 0, n: 0, pad: 0, exhausted: false }
+    }
+
+    fn fill(&mut self) {
+        while self.n <= 24 {
+            let v = match next_byte(self.d, &mut self.pos) {
+                Some(v) => v,
+                None => {
+                    self.pad += 8;
+                    0
+                }
+            };
+            self.acc |= u32::from(v) << (24 - self.n);
+            self.n += 8;
+        }
+    }
+
+    fn bit(&mut self) -> u32 {
+        self.get(1)
+    }
+
+    /// The next `n` (≤ 16) bits.
+    fn get(&mut self, n: u32) -> u32 {
+        if n == 0 {
+            return 0;
+        }
+        if self.n < n {
+            self.fill();
+        }
+        if n > self.n.saturating_sub(self.pad) {
+            self.exhausted = true;
+        }
+        let v = self.acc >> (32 - n);
+        self.acc <<= n;
+        self.n -= n;
+        self.pad = self.pad.min(self.n);
+        v
+    }
+
+    fn restart(&mut self) {
+        self.pos = skip_restart(self.d, self.pos).0;
+        self.acc = 0;
+        self.n = 0;
+        self.pad = 0;
+    }
+}
+
+/// `EXTEND` of F.2.2.1: the signed value of the `t`-bit magnitude `v`.
+fn extend(v: u32, t: u32) -> i32 {
+    let v = v as i32;
+    if t == 0 {
+        0
+    } else if v < 1 << (t - 1) {
+        v - (1 << t) + 1
+    } else {
+        v
+    }
+}
+
+/// Qe, next index after LPS, next index after MPS, MPS switch (Table D.2).
+#[rustfmt::skip]
+const QE: [(u32, u8, u8, bool); 113] = [
+    (0x5A1D, 1, 1, true), (0x2586, 14, 2, false), (0x1114, 16, 3, false), (0x080B, 18, 4, false),
+    (0x03D8, 20, 5, false), (0x01DA, 23, 6, false), (0x00E5, 25, 7, false), (0x006F, 28, 8, false),
+    (0x0036, 30, 9, false), (0x001A, 33, 10, false), (0x000D, 35, 11, false), (0x0006, 9, 12, false),
+    (0x0003, 10, 13, false), (0x0001, 12, 13, false), (0x5A7F, 15, 15, true), (0x3F25, 36, 16, false),
+    (0x2CF2, 38, 17, false), (0x207C, 39, 18, false), (0x17B9, 40, 19, false), (0x1182, 42, 20, false),
+    (0x0CEF, 43, 21, false), (0x09A1, 45, 22, false), (0x072F, 46, 23, false), (0x055C, 48, 24, false),
+    (0x0406, 49, 25, false), (0x0303, 51, 26, false), (0x0240, 52, 27, false), (0x01B1, 54, 28, false),
+    (0x0144, 56, 29, false), (0x00F5, 57, 30, false), (0x00B7, 59, 31, false), (0x008A, 60, 32, false),
+    (0x0068, 62, 33, false), (0x004E, 63, 34, false), (0x003B, 32, 35, false), (0x002C, 33, 9, false),
+    (0x5AE1, 37, 37, true), (0x484C, 64, 38, false), (0x3A0D, 65, 39, false), (0x2EF1, 67, 40, false),
+    (0x261F, 68, 41, false), (0x1F33, 69, 42, false), (0x19A8, 70, 43, false), (0x1518, 72, 44, false),
+    (0x1177, 73, 45, false), (0x0E74, 74, 46, false), (0x0BFB, 75, 47, false), (0x09F8, 77, 48, false),
+    (0x0861, 78, 49, false), (0x0706, 79, 50, false), (0x05CD, 48, 51, false), (0x04DE, 50, 52, false),
+    (0x040F, 50, 53, false), (0x0363, 51, 54, false), (0x02D4, 52, 55, false), (0x025C, 53, 56, false),
+    (0x01F8, 54, 57, false), (0x01A4, 55, 58, false), (0x0160, 56, 59, false), (0x0125, 57, 60, false),
+    (0x00F6, 58, 61, false), (0x00CB, 59, 62, false), (0x00AB, 61, 63, false), (0x008F, 61, 32, false),
+    (0x5B12, 65, 65, true), (0x4D04, 80, 66, false), (0x412C, 81, 67, false), (0x37D8, 82, 68, false),
+    (0x2FE8, 83, 69, false), (0x293C, 84, 70, false), (0x2379, 86, 71, false), (0x1EDF, 87, 72, false),
+    (0x1AA9, 87, 73, false), (0x174E, 72, 74, false), (0x1424, 72, 75, false), (0x119C, 74, 76, false),
+    (0x0F6B, 74, 77, false), (0x0D51, 75, 78, false), (0x0BB6, 77, 79, false), (0x0A40, 77, 48, false),
+    (0x5832, 80, 81, true), (0x4D1C, 88, 82, false), (0x438E, 89, 83, false), (0x3BDD, 90, 84, false),
+    (0x34EE, 91, 85, false), (0x2EAE, 92, 86, false), (0x299A, 93, 87, false), (0x2516, 86, 71, false),
+    (0x5570, 88, 89, true), (0x4CA9, 95, 90, false), (0x44D9, 96, 91, false), (0x3E22, 97, 92, false),
+    (0x3824, 99, 93, false), (0x32B4, 99, 94, false), (0x2E17, 93, 86, false), (0x56A8, 95, 96, true),
+    (0x4F46, 101, 97, false), (0x47E5, 102, 98, false), (0x41CF, 103, 99, false), (0x3C3D, 104, 100, false),
+    (0x375E, 99, 93, false), (0x5231, 105, 102, false), (0x4C0F, 106, 103, false), (0x4639, 107, 104, false),
+    (0x415E, 103, 99, false), (0x5627, 105, 106, true), (0x50E7, 108, 107, false), (0x4B85, 109, 103, false),
+    (0x5597, 110, 109, false), (0x504F, 111, 107, false), (0x5A10, 110, 111, true), (0x5522, 112, 109, false),
+    (0x59EB, 112, 111, true),
+];
+
+/// The arithmetic decoder of Annex D (D.2): `C` holds `Cx` in its high 16 bits, `A` the
+/// interval, `CT` the bits left before the next byte. A statistics bin is one byte: the
+/// Qe index in bits 0–6 and the MPS in bit 7.
+struct Arith<'a> {
+    d: &'a [u8],
+    /// `d` ends at a marker rather than at the end of the file.
+    at_marker: bool,
+    pos: usize,
+    c: u32,
+    a: u32,
+    ct: u32,
+    /// The decoder needed bytes past the end of the file.
+    eof: bool,
+    /// A restart was due but its marker was missing.
+    lost: bool,
+}
+
+impl<'a> Arith<'a> {
+    fn new(d: &'a [u8], at_marker: bool) -> Self {
+        let mut ar = Arith { d, at_marker, pos: 0, c: 0, a: 0, ct: 0, eof: false, lost: false };
+        ar.init();
+        ar
+    }
+
+    /// At a marker the decoder is fed zeros for as long as it asks (D.2.6): encoders drop
+    /// trailing zero bytes (libjpeg's `finish_pass` does, as D.1.8 allows), and a flat tail of
+    /// a few thousand blocks can decode entirely from those zeros. Running out at the end of
+    /// the file is damage.
+    fn byte_in(&mut self) {
+        let v = next_byte(self.d, &mut self.pos).unwrap_or_else(|| {
+            let at_restart = matches!(self.d.get(self.pos + 1), Some(0xD0..=0xD7));
+            self.eof |= !at_restart && !self.at_marker;
+            0
+        });
+        self.c = self.c.wrapping_add(u32::from(v) << 8);
+    }
+
+    /// The data ended without a marker, or a restart marker is missing.
+    fn exhausted(&self) -> bool {
+        self.lost || self.eof
+    }
+
+    /// INITDEC (D.2.7).
+    fn init(&mut self) {
+        self.a = 0x10000;
+        self.c = 0;
+        self.byte_in();
+        self.c <<= 8;
+        self.byte_in();
+        self.c <<= 8;
+        self.ct = 0;
+    }
+
+    /// DECODE (D.2.2–D.2.5) of one binary decision with the adaptive bin `st`.
+    fn decode(&mut self, st: &mut u8) -> u8 {
+        let mps = *st >> 7;
+        let (qe, nlps, nmps, switch) = QE.get(usize::from(*st & 0x7F)).copied().unwrap_or(QE[0]);
+        self.a = self.a.wrapping_sub(qe);
+        let d;
+        if (self.c >> 16) < self.a {
+            if self.a >= 0x8000 {
+                return mps;
+            }
+            // Conditional MPS exchange.
+            if self.a < qe {
+                d = 1 - mps;
+                *st = nlps | ((mps ^ u8::from(switch)) << 7);
+            } else {
+                d = mps;
+                *st = nmps | (mps << 7);
+            }
+        } else {
+            // Conditional LPS exchange.
+            self.c = self.c.wrapping_sub(self.a << 16);
+            if self.a < qe {
+                d = mps;
+                *st = nmps | (mps << 7);
+            } else {
+                d = 1 - mps;
+                *st = nlps | ((mps ^ u8::from(switch)) << 7);
+            }
+            self.a = qe;
+        }
+        // RENORM_D: A ≥ 1 (every Qe is), so this runs at most 16 times.
+        while self.a < 0x8000 {
+            if self.ct == 0 {
+                self.byte_in();
+                self.ct = 8;
+            }
+            self.a <<= 1;
+            self.c <<= 1;
+            self.ct -= 1;
+        }
+        d
+    }
+
+    /// A decision coded with the fixed estimate Qe = 0x5A1D (signs, DC refinement bits).
+    fn decode_fixed(&mut self) -> u8 {
+        let mut st = 0;
+        self.decode(&mut st)
+    }
+
+    fn restart(&mut self) {
+        let (pos, found) = skip_restart(self.d, self.pos);
+        self.pos = pos;
+        self.lost |= !found;
+        self.init();
+    }
+}
+
+fn bin(st: &mut [u8], i: usize) -> Result<&mut u8, Error> {
+    st.get_mut(i).ok_or_else(|| err("arithmetic statistics index out of range"))
+}
+
+/// One scan's decoding of a block, after a restart marker, or at its start.
+trait ScanDecoder {
+    fn restart(&mut self);
+    /// Decode one block of scan component `sc` into `blk` (zigzag order).
+    fn block(&mut self, sc: usize, blk: &mut [i32; 64]) -> Result<(), Error>;
+}
+
+/// The parameters of a scan header (B.2.3).
+struct Scan {
+    /// Frame component index of each scan component, with its DC and AC table ids.
+    comps: Vec<(usize, usize, usize)>,
+    ss: usize,
+    se: usize,
+    ah: u8,
+    al: u8,
+}
+
+/// Huffman sequential decoding (F.2.2).
+struct HuffmanScan<'a> {
+    bits: Bits<'a>,
+    tables: Vec<(&'a Huffman, &'a Huffman)>,
+    pred: [i32; 4],
+}
+
+impl ScanDecoder for HuffmanScan<'_> {
+    fn restart(&mut self) {
+        self.bits.restart();
+        self.pred = [0; 4];
+    }
+
+    fn block(&mut self, sc: usize, blk: &mut [i32; 64]) -> Result<(), Error> {
+        let &(dc, ac) = self.tables.get(sc).ok_or_else(|| err("bad scan component"))?;
+        let pred = self.pred.get_mut(sc).ok_or_else(|| err("bad scan component"))?;
+        let t = u32::from(dc.decode(&mut self.bits)?);
+        if t > 15 {
+            return Err(err("bad DC difference category"));
+        }
+        let diff = extend(self.bits.get(t), t);
+        *pred = pred.wrapping_add(diff);
+        blk[0] = *pred;
+        let mut k = 1;
+        while k < 64 {
+            let rs = ac.decode(&mut self.bits)?;
+            let (r, s) = (usize::from(rs >> 4), u32::from(rs & 15));
+            if s == 0 {
+                if r != 15 {
+                    break;
+                }
+                k += 16;
+                continue;
+            }
+            k += r;
+            let slot = blk.get_mut(k).ok_or_else(|| err("AC coefficient past the end of the block"))?;
+            *slot = extend(self.bits.get(s), s);
+            k += 1;
+        }
+        if self.bits.exhausted {
+            return Err(err("entropy-coded data ends before the scan does"));
+        }
+        Ok(())
+    }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum ArithMode {
+    Sequential,
+    DcFirst,
+    DcRefine,
+    AcFirst,
+    AcRefine,
+}
+
+/// Arithmetic decoding: sequential (F.2.4) and progressive (G.1.3).
+struct ArithScan<'a> {
+    ar: Arith<'a>,
+    mode: ArithMode,
+    ss: usize,
+    se: usize,
+    al: u8,
+    /// DC and AC table ids of each scan component.
+    ids: Vec<(usize, usize)>,
+    dc_stats: [[u8; 64]; 4],
+    ac_stats: [[u8; 256]; 4],
+    dc_l: [u8; 4],
+    dc_u: [u8; 4],
+    ac_kx: [u8; 4],
+    /// DC prediction and conditioning context (offset of S0) per scan component.
+    pred: [i32; 4],
+    ctx: [usize; 4],
+}
+
+impl ArithScan<'_> {
+    /// Decode_DC_DIFF (F.2.4.1, Figures F.19 and F.22).
+    fn dc_diff(&mut self, sc: usize, tbl: usize) -> Result<i32, Error> {
+        let st = self.dc_stats.get_mut(tbl).ok_or_else(|| err("bad DC table"))?;
+        let ctx = self.ctx.get_mut(sc).ok_or_else(|| err("bad scan component"))?;
+        let s0 = *ctx;
+        if self.ar.decode(bin(st, s0)?) == 0 {
+            *ctx = 0;
+            return Ok(0);
+        }
+        let sign = self.ar.decode(bin(st, s0 + 1)?);
+        let mut s = s0 + 2 + usize::from(sign);
+        let mut m: i32 = i32::from(self.ar.decode(bin(st, s)?));
+        if m != 0 {
+            // Magnitude category: X1 … X15 at bins 20 … 34.
+            s = 20;
+            while self.ar.decode(bin(st, s)?) != 0 {
+                m <<= 1;
+                s += 1;
+                if s > 34 {
+                    return Err(err("DC difference out of range"));
+                }
+            }
+        }
+        // Magnitude bits: M2 … M15 at bins 35 … 48.
+        let mut v = m;
+        let mut bit = m >> 1;
+        while bit != 0 {
+            if self.ar.decode(bin(st, s + 14)?) != 0 {
+                v |= bit;
+            }
+            bit >>= 1;
+        }
+        let magnitude = v + 1;
+        // Conditioning category of the next difference (F.1.4.4.1.2).
+        let l = self.dc_l.get(tbl).copied().unwrap_or(0);
+        let u = self.dc_u.get(tbl).copied().unwrap_or(1);
+        *ctx = if magnitude <= (1 << l) >> 1 {
+            0
+        } else if magnitude <= 1 << u {
+            4 + 4 * usize::from(sign)
+        } else {
+            12 + 4 * usize::from(sign)
+        };
+        Ok(if sign != 0 { -magnitude } else { magnitude })
+    }
+
+    /// Decode_AC_coefficients (F.2.4.2, Figures F.20 and F.24) over `ss..=se`, scaled by `al`.
+    fn ac_first(&mut self, tbl: usize, blk: &mut [i32; 64]) -> Result<(), Error> {
+        let kx = usize::from(self.ac_kx.get(tbl).copied().unwrap_or(5));
+        let st = self.ac_stats.get_mut(tbl).ok_or_else(|| err("bad AC table"))?;
+        let mut k = self.ss.max(1);
+        while k <= self.se {
+            if self.ar.decode(bin(st, 3 * (k - 1))?) != 0 {
+                break; // end of block
+            }
+            while self.ar.decode(bin(st, 3 * (k - 1) + 1)?) == 0 {
+                k += 1;
+                if k > self.se {
+                    return Err(err("AC coefficient past the end of the band"));
+                }
+            }
+            let sign = self.ar.decode_fixed();
+            let sp = 3 * (k - 1) + 2;
+            let mut m: i32 = i32::from(self.ar.decode(bin(st, sp)?));
+            let mut s = sp;
+            if m != 0 && self.ar.decode(bin(st, sp)?) != 0 {
+                m = 2;
+                s = if k <= kx { 189 } else { 217 };
+                let last = s + 13;
+                while self.ar.decode(bin(st, s)?) != 0 {
+                    m <<= 1;
+                    s += 1;
+                    if s > last {
+                        return Err(err("AC coefficient out of range"));
+                    }
+                }
+            }
+            let mut v = m;
+            let mut bit = m >> 1;
+            while bit != 0 {
+                if self.ar.decode(bin(st, s + 14)?) != 0 {
+                    v |= bit;
+                }
+                bit >>= 1;
+            }
+            let value = if sign != 0 { -(v + 1) } else { v + 1 };
+            *blk.get_mut(k).ok_or_else(|| err("bad AC index"))? = value << self.al;
+            k += 1;
+        }
+        Ok(())
+    }
+
+    /// Successive approximation of AC coefficients (G.1.3.3, Figure G.10).
+    fn ac_refine(&mut self, tbl: usize, blk: &mut [i32; 64]) -> Result<(), Error> {
+        let st = self.ac_stats.get_mut(tbl).ok_or_else(|| err("bad AC table"))?;
+        let p1: i32 = 1 << self.al;
+        let m1: i32 = -1 << self.al;
+        let (ss, se) = (self.ss.max(1), self.se);
+        // Past the last coefficient already non-zero, an end-of-block decision is coded.
+        let eob = (ss..=se).rev().find(|&k| blk.get(k).is_some_and(|&c| c != 0)).map_or(ss, |k| k + 1);
+        let mut k = ss;
+        while k <= se {
+            if k >= eob && self.ar.decode(bin(st, 3 * (k - 1))?) != 0 {
+                break;
+            }
+            loop {
+                let c = *blk.get(k).ok_or_else(|| err("bad AC index"))?;
+                if c != 0 {
+                    if self.ar.decode(bin(st, 3 * (k - 1) + 2)?) != 0 {
+                        *blk.get_mut(k).ok_or_else(|| err("bad AC index"))? = if c < 0 { c.wrapping_add(m1) } else { c.wrapping_add(p1) };
+                    }
+                    break;
+                }
+                if self.ar.decode(bin(st, 3 * (k - 1) + 1)?) != 0 {
+                    *blk.get_mut(k).ok_or_else(|| err("bad AC index"))? = if self.ar.decode_fixed() != 0 { m1 } else { p1 };
+                    break;
+                }
+                k += 1;
+                if k > se {
+                    return Err(err("AC coefficient past the end of the band"));
+                }
+            }
+            k += 1;
+        }
+        Ok(())
+    }
+}
+
+impl ScanDecoder for ArithScan<'_> {
+    fn restart(&mut self) {
+        self.ar.restart();
+        self.reset();
+    }
+
+    fn block(&mut self, sc: usize, blk: &mut [i32; 64]) -> Result<(), Error> {
+        let &(td, ta) = self.ids.get(sc).ok_or_else(|| err("bad scan component"))?;
+        match self.mode {
+            ArithMode::Sequential | ArithMode::DcFirst => {
+                let diff = self.dc_diff(sc, td)?;
+                let pred = self.pred.get_mut(sc).ok_or_else(|| err("bad scan component"))?;
+                *pred = pred.wrapping_add(diff);
+                blk[0] = pred.wrapping_shl(u32::from(self.al));
+                if self.mode == ArithMode::Sequential {
+                    self.ac_first(ta, blk)?;
+                }
+            }
+            ArithMode::DcRefine => {
+                if self.ar.decode_fixed() != 0 {
+                    blk[0] |= 1 << self.al;
+                }
+            }
+            ArithMode::AcFirst => self.ac_first(ta, blk)?,
+            ArithMode::AcRefine => self.ac_refine(ta, blk)?,
+        }
+        if self.ar.exhausted() {
+            return Err(err("entropy-coded data ends before the scan does"));
+        }
+        Ok(())
+    }
+}
+
+impl ArithScan<'_> {
+    fn reset(&mut self) {
+        self.dc_stats = [[0; 64]; 4];
+        self.ac_stats = [[0; 256]; 4];
+        self.pred = [0; 4];
+        self.ctx = [0; 4];
+    }
+}
+
+/// The scan's MCU grid (A.2): MCUs per line, MCU lines, and the blocks the scan decodes.
+fn scan_grid(frame: &Frame, scan: &Scan) -> Result<(usize, usize, usize), Error> {
+    if let [(ci, _, _)] = scan.comps[..] {
+        let c = frame.comps.get(ci).ok_or_else(|| err("bad scan component"))?;
+        let (mcux, mcuy) = (c.cw.div_ceil(8), c.ch.div_ceil(8));
+        return Ok((mcux, mcuy, mcux.saturating_mul(mcuy)));
+    }
+    let mut per_mcu = 0usize;
+    for &(ci, _, _) in &scan.comps {
+        let c = frame.comps.get(ci).ok_or_else(|| err("bad scan component"))?;
+        per_mcu += c.h * c.v;
+    }
+    Ok((frame.mcux, frame.mcuy, frame.mcux.saturating_mul(frame.mcuy).saturating_mul(per_mcu)))
+}
+
+/// Walk the scan's MCUs in order (A.2), handing each block to `dec`; counts decoded MCUs.
+fn walk_scan(frame: &mut Frame, scan: &Scan, restart: usize, dec: &mut dyn ScanDecoder, done: &mut usize) -> Result<(), Error> {
+    let single = scan.comps.len() == 1;
+    let (mcux, mcuy, _) = scan_grid(frame, scan)?;
+    let total = mcux.saturating_mul(mcuy);
+    for m in 0..total {
+        if restart > 0 && m > 0 && m % restart == 0 {
+            dec.restart();
+        }
+        let (mx, my) = (m % mcux, m / mcux);
+        for (sc, &(ci, _, _)) in scan.comps.iter().enumerate() {
+            let comp = frame.comps.get_mut(ci).ok_or_else(|| err("bad scan component"))?;
+            let (h, v) = if single { (1, 1) } else { (comp.h, comp.v) };
+            for by in my * v..(my + 1) * v {
+                for bx in mx * h..(mx + 1) * h {
+                    let idx = by * comp.bw + bx;
+                    let blk = comp.coefs.get_mut(idx).ok_or_else(|| err("block out of range"))?;
+                    dec.block(sc, blk)?;
+                }
+            }
+        }
+        *done += 1;
+    }
+    Ok(())
+}
+
+fn parse_scan(seg: &[u8], frame: &Frame) -> Result<Scan, Error> {
+    let ns = usize::from(byte(seg, 0)?);
+    if !(1..=4).contains(&ns) {
+        return Err(err("bad number of scan components"));
+    }
+    let mut comps = Vec::with_capacity(ns);
+    for s in 0..ns {
+        let (cs, t) = (byte(seg, 1 + 2 * s)?, byte(seg, 2 + 2 * s)?);
+        let ci = frame.comps.iter().position(|c| c.id == cs).ok_or_else(|| err("scan names an unknown component"))?;
+        let (td, ta) = (usize::from(t >> 4), usize::from(t & 15));
+        if td > 3 || ta > 3 {
+            return Err(err("bad entropy table id"));
+        }
+        comps.push((ci, td, ta));
+    }
+    let at = 1 + 2 * ns;
+    let (ss, se, a) = (usize::from(byte(seg, at)?), usize::from(byte(seg, at + 1)?), byte(seg, at + 2)?);
+    let (ah, al) = (a >> 4, a & 15);
+    if frame.progressive {
+        let ok = ss <= se && se <= 63 && (ss != 0 || se == 0) && (ss == 0 || ns == 1) && al <= 13;
+        if !ok {
+            return Err(err("bad progressive scan parameters"));
+        }
+        Ok(Scan { comps, ss, se, ah, al })
+    } else {
+        Ok(Scan { comps, ss: 0, se: 63, ah: 0, al: 0 })
+    }
+}
+
+/// Decode one scan's entropy-coded data `d`, counting the decoded MCUs in `done`.
+/// `at_marker` says whether a marker follows `d` (otherwise it runs to the end of the file).
+fn decode_scan(frame: &mut Frame, tables: &Tables, scan: &Scan, d: &[u8], at_marker: bool, done: &mut usize) -> Result<(), Error> {
+    for &(ci, _, _) in &scan.comps {
+        let comp = frame.comps.get_mut(ci).ok_or_else(|| err("bad scan component"))?;
+        if comp.quant.is_none() {
+            let q = tables.quant.get(comp.tq).copied().flatten().ok_or_else(|| err("scan uses an undefined quantization table"))?;
+            comp.quant = Some(q);
+        }
+    }
+    if frame.arithmetic {
+        let mode = match (frame.progressive, scan.ss, scan.ah) {
+            (false, _, _) => ArithMode::Sequential,
+            (true, 0, 0) => ArithMode::DcFirst,
+            (true, 0, _) => ArithMode::DcRefine,
+            (true, _, 0) => ArithMode::AcFirst,
+            (true, _, _) => ArithMode::AcRefine,
+        };
+        let mut dec = ArithScan {
+            ar: Arith::new(d, at_marker),
+            mode,
+            ss: scan.ss,
+            se: scan.se,
+            al: scan.al,
+            ids: scan.comps.iter().map(|&(_, td, ta)| (td, ta)).collect(),
+            dc_stats: [[0; 64]; 4],
+            ac_stats: [[0; 256]; 4],
+            dc_l: tables.dc_l,
+            dc_u: tables.dc_u,
+            ac_kx: tables.ac_kx,
+            pred: [0; 4],
+            ctx: [0; 4],
+        };
+        walk_scan(frame, scan, tables.restart, &mut dec, done)
+    } else {
+        let mut sel = Vec::with_capacity(scan.comps.len());
+        for &(_, td, ta) in &scan.comps {
+            let dc = tables.dc.get(td).and_then(Option::as_ref).ok_or_else(|| err("scan uses an undefined Huffman table"))?;
+            let ac = tables.ac.get(ta).and_then(Option::as_ref).ok_or_else(|| err("scan uses an undefined Huffman table"))?;
+            sel.push((dc, ac));
+        }
+        let mut dec = HuffmanScan { bits: Bits::new(d), tables: sel, pred: [0; 4] };
+        walk_scan(frame, scan, tables.restart, &mut dec, done)
+    }
+}
+
+/// The blocks decoded from one stream are capped at this many times the frame's blocks; the
+/// scan that would pass the cap and every later one are dropped, and the image is reported
+/// damaged. Every scan walks its whole MCU grid, so without a cap a small file repeating scan
+/// headers multiplies the work by the frame size. 64 passes allow a progressive file one scan
+/// per coefficient for every component; real files make about 10.
+const SCAN_PASSES: usize = 64;
+
+/// Parse the stream and decode every scan into coefficients.
+fn decode_coefficients(b: &[u8], limits: &Limits) -> Result<(Frame, Tables, bool), Error> {
+    if b.get(..2) != Some(&[0xFF, 0xD8]) {
+        return Err(err("not a JPEG stream"));
+    }
+    let mut tables = Tables::default();
+    let mut frame: Option<Frame> = None;
+    let mut damaged = false;
+    let mut mcus = 0usize;
+    let mut scans = 0usize;
+    let mut blocks = 0usize;
+    let mut i = 2;
+    while let Some(&v) = b.get(i) {
+        if v != 0xFF {
+            i += 1;
+            continue;
+        }
+        let Some(&m) = b.get(i + 1) else { break };
+        match m {
+            0xFF => {
+                i += 1;
+                continue;
+            }
+            0x00 | 0x01 | 0xD0..=0xD8 => {
+                i += 2;
+                continue;
+            }
+            0xD9 => break,
+            _ => {}
+        }
+        let Ok(len) = be16(b, i + 2) else { break };
+        let len = usize::from(len);
+        if len < 2 {
+            return Err(err("bad marker segment length"));
+        }
+        let Some(seg) = b.get(i + 4..i + 2 + len) else {
+            if frame.is_some() && scans > 0 {
+                damaged = true;
+                break;
+            }
+            return Err(err("marker segment runs past the end of the file"));
+        };
+        i += 2 + len;
+        match m {
+            0xDB => parse_dqt(seg, &mut tables)?,
+            0xC4 => parse_dht(seg, &mut tables)?,
+            0xCC => parse_dac(seg, &mut tables)?,
+            0xDD => tables.restart = usize::from(be16(seg, 0)?),
+            0xC0..=0xCF => {
+                if frame.is_some() {
+                    return Err(unsupported("JPEG with more than one frame is not supported"));
+                }
+                frame = Some(parse_frame(m, seg, limits)?);
+            }
+            0xDA => {
+                let f = frame.as_mut().ok_or_else(|| err("scan before the frame header"))?;
+                let scan = parse_scan(seg, f)?;
+                let budget = f.comps.iter().map(|c| c.coefs.len()).sum::<usize>().saturating_mul(SCAN_PASSES);
+                blocks = blocks.saturating_add(scan_grid(f, &scan)?.2);
+                if blocks > budget {
+                    damaged = true;
+                    break;
+                }
+                let end = scan_end(b, i);
+                let data = b.get(i..end).unwrap_or_default();
+                scans += 1;
+                if let Err(e) = decode_scan(f, &tables, &scan, data, end < b.len(), &mut mcus) {
+                    if mcus == 0 {
+                        return Err(e);
+                    }
+                    damaged = true;
+                }
+                i = end;
+            }
+            _ => {}
+        }
+    }
+    let frame = frame.ok_or_else(|| err("no frame header"))?;
+    if scans == 0 {
+        return Err(err("the file ends before any image data"));
+    }
+    Ok((frame, tables, damaged))
+}
+
+// ---------------------------------------------------------------------------------------------
+// Reconstruction
+
+/// `T[x][u] = C(u)/2 · cos((2x+1)uπ/16)`: one dimension of the inverse DCT (A.3.3).
+fn idct_basis() -> [[f32; 8]; 8] {
+    let mut t = [[0f32; 8]; 8];
+    for (x, row) in t.iter_mut().enumerate() {
+        for (u, v) in row.iter_mut().enumerate() {
+            let c = if u == 0 { std::f32::consts::FRAC_1_SQRT_2 } else { 1.0 };
+            *v = c / 2.0 * (((2 * x + 1) * u) as f32 * std::f32::consts::PI / 16.0).cos();
+        }
+    }
+    t
+}
+
+/// The component's samples (padded to whole blocks, row stride `bw * 8`), level-shifted and
+/// clamped to `0..=max`.
+fn reconstruct(comp: &Component, q: &[u16; 64], basis: &[[f32; 8]; 8], max: f32) -> Vec<f32> {
+    let stride = comp.bw * 8;
+    let mut plane = vec![0f32; stride * comp.bh * 8];
+    let shift = (max + 1.0) / 2.0;
+    for (n, blk) in comp.coefs.iter().enumerate() {
+        let (bx, by) = (n % comp.bw, n / comp.bw);
+        if blk[1..].iter().all(|&c| c == 0) {
+            // Only DC: every sample is T[y][0] · T[x][0] · F[0][0], the same products the full
+            // transform below sums (its other terms are zero), so the result is identical.
+            let t = basis[0][0];
+            let v = (t * (t * (blk[0] as f32 * f32::from(q[0]))) + shift).clamp(0.0, max);
+            for y in 0..8 {
+                let row = (by * 8 + y) * stride + bx * 8;
+                if let Some(out) = plane.get_mut(row..row + 8) {
+                    out.fill(v);
+                }
+            }
+            continue;
+        }
+        let mut f = [0f32; 64];
+        for (k, &c) in blk.iter().enumerate() {
+            f[ZIGZAG[k]] = c as f32 * f32::from(q[k]);
+        }
+        // Rows: r[v][x] = Σu T[x][u] F[v][u]; then columns: s[y][x] = Σv T[y][v] r[v][x].
+        let mut r = [0f32; 64];
+        for v in 0..8 {
+            for x in 0..8 {
+                r[v * 8 + x] = (0..8).map(|u| basis[x][u] * f[v * 8 + u]).sum();
+            }
+        }
+        for (y, ty) in basis.iter().enumerate() {
+            let row = (by * 8 + y) * stride + bx * 8;
+            if let Some(out) = plane.get_mut(row..row + 8) {
+                for (x, o) in out.iter_mut().enumerate() {
+                    let s: f32 = ty.iter().enumerate().map(|(v, t)| t * r[v * 8 + x]).sum();
+                    *o = (s + shift).clamp(0.0, max);
+                }
+            }
+        }
+    }
+    plane
+}
+
+/// For each output coordinate: the two neighboring component samples and the weight of the
+/// second (centered linear interpolation of a subsampled component).
+fn upsample_map(out: usize, samples: usize, factor: usize, fmax: usize) -> Vec<(usize, usize, f32)> {
+    let last = samples.saturating_sub(1);
+    (0..out)
+        .map(|x| {
+            let s = ((x as f32 + 0.5) * factor as f32 / fmax as f32 - 0.5).max(0.0);
+            let x0 = (s.floor() as usize).min(last);
+            ((x0), (x0 + 1).min(last), (s - x0 as f32).clamp(0.0, 1.0))
+        })
+        .collect()
+}
+
+/// Turn the coefficients into interleaved output samples.
+fn render(frame: Frame, tables: &Tables, adobe_transform: Option<u8>) -> Result<(u8, Samples), Error> {
+    let max = if frame.precision > 8 { 4095.0 } else { 255.0 };
+    let basis = idct_basis();
+    let (w, h) = (frame.width, frame.height);
+    let mut planes = Vec::with_capacity(frame.comps.len());
+    for comp in &frame.comps {
+        // A component no scan reached has only zero coefficients; any defined table will do.
+        let q = comp.quant.or_else(|| tables.quant.get(comp.tq).copied().flatten());
+        let q = q.ok_or_else(|| err("component uses an undefined quantization table"))?;
+        let plane = reconstruct(comp, &q, &basis, max);
+        let xs = upsample_map(w, comp.cw, comp.h, frame.hmax);
+        let ys = upsample_map(h, comp.ch, comp.v, frame.vmax);
+        planes.push((plane, comp.bw * 8, xs, ys));
+    }
+    let nc = planes.len();
+    let sixteen = frame.precision > 8;
+    let rgb_ids = frame.comps.iter().map(|c| c.id).eq(*b"RGB");
+    let ycc = match nc {
+        3 => adobe_transform != Some(0) && !rgb_ids,
+        4 => adobe_transform == Some(2),
+        _ => false,
+    };
+    let (mut wide, mut narrow) = (Vec::new(), Vec::new());
+    if sixteen {
+        wide.reserve_exact(w * h * nc);
+    } else {
+        narrow.reserve_exact(w * h * nc);
+    }
+    let mut px = [0f32; 4];
+    let center = (max + 1.0) / 2.0;
+    for y in 0..h {
+        for x in 0..w {
+            for (c, (plane, stride, xs, ys)) in planes.iter().enumerate() {
+                let (Some(&(x0, x1, fx)), Some(&(y0, y1, fy))) = (xs.get(x), ys.get(y)) else {
+                    return Err(err("sample map out of range"));
+                };
+                let at = |xx: usize, yy: usize| plane.get(yy * stride + xx).copied().unwrap_or(0.0);
+                let top = at(x0, y0) + (at(x1, y0) - at(x0, y0)) * fx;
+                let bottom = at(x0, y1) + (at(x1, y1) - at(x0, y1)) * fx;
+                if let Some(p) = px.get_mut(c) {
+                    *p = top + (bottom - top) * fy;
+                }
+            }
+            if ycc {
+                // YCbCr → RGB (JFIF / T.871); for YCCK the result is the inverted CMY of Adobe's
+                // convention, i.e. the ink amounts.
+                let (yy, cb, cr) = (px[0], px[1] - center, px[2] - center);
+                px[0] = yy + 1.402 * cr;
+                px[1] = yy - 0.344_136 * cb - 0.714_136 * cr;
+                px[2] = yy + 1.772 * cb;
+                if nc == 4 {
+                    px[3] = max - px[3];
+                }
+            } else if nc == 4 {
+                // Adobe-style CMYK is stored inverted (max = no ink).
+                for p in &mut px {
+                    *p = max - *p;
+                }
+            }
+            for &p in px.iter().take(nc) {
+                let p = p.clamp(0.0, max);
+                if sixteen {
+                    wide.push((p * 65535.0 / max).round() as u16);
+                } else {
+                    narrow.push(p.round() as u8);
+                }
+            }
+        }
+    }
+    let samples = if sixteen { Samples::U16(wide) } else { Samples::U8(narrow) };
+    Ok((nc as u8, samples))
+}
+
+/// Decode a JPEG stream of one of the frame types listed in the [crate docs](crate).
+///
+/// `adobe_transform` is the transform byte of the stream's APP14 `Adobe` segment, if the caller
+/// found one: it selects the color conversion of 3 and 4-component images (see
+/// [`Decoded::components`]). The decoder ignores every APPn segment itself.
+///
+/// Damaged entropy-coded data after at least one decoded MCU returns `Ok` with
+/// [`Decoded::damaged`] set; a stream that yields no image data returns an error.
+pub fn decode(bytes: &[u8], limits: &Limits, adobe_transform: Option<u8>) -> Result<Decoded, Error> {
+    let (frame, tables, damaged) = decode_coefficients(bytes, limits)?;
+    let (width, height) = (frame.width as u32, frame.height as u32);
+    let (components, samples) = render(frame, &tables, adobe_transform)?;
+    Ok(Decoded { width, height, components, samples, damaged })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/jpeg/src/tests.rs b/crates/jpeg/src/tests.rs
new file mode 100644
index 00000000..3398b0e7
--- /dev/null
+++ b/crates/jpeg/src/tests.rs
@@ -0,0 +1,833 @@
+use super::*;
+
+/// The test image decoded by `zune-jpeg`, as interleaved 8-bit samples, and its size.
+fn zune_decode(bytes: &[u8]) -> (Vec<u8>, (u32, u32)) {
+    let mut dec = zune_jpeg::JpegDecoder::new(zune_jpeg::zune_core::bytestream::ZCursor::new(bytes));
+    let px = dec.decode().unwrap();
+    let (w, h) = dec.dimensions().unwrap();
+    (px, (w as u32, h as u32))
+}
+
+fn decode_default(bytes: &[u8]) -> Result<Decoded, Error> {
+    decode(bytes, &Limits::default(), None)
+}
+
+fn u16_samples(img: &Decoded) -> &[u16] {
+    match &img.samples {
+        Samples::U16(v) => v,
+        Samples::U8(_) => panic!("8-bit samples"),
+    }
+}
+
+// --- A test-only arithmetic encoder (T.81 D.1, F.1.4 and G.1.3), mirroring the decoder ---
+
+struct Enc {
+    out: Vec<u8>,
+    c: u32,
+    a: u32,
+    ct: u32,
+    stacked: u32,
+    b: Option<u8>,
+}
+
+impl Enc {
+    fn new() -> Self {
+        Enc { out: Vec::new(), c: 0, a: 0x10000, ct: 11, stacked: 0, b: None }
+    }
+
+    fn emit(&mut self, v: u8) {
+        self.out.push(v);
+        if v == 0xFF {
+            self.out.push(0);
+        }
+    }
+
+    fn byte_out(&mut self) {
+        let t = self.c >> 19;
+        if t > 0xFF {
+            let b = self.b.unwrap() + 1;
+            self.emit(b);
+            for _ in 0..self.stacked {
+                self.emit(0);
+            }
+            self.stacked = 0;
+            self.b = Some((t & 0xFF) as u8);
+        } else if t == 0xFF {
+            self.stacked += 1;
+        } else {
+            if let Some(b) = self.b {
+                self.emit(b);
+            }
+            for _ in 0..self.stacked {
+                self.emit(0xFF);
+            }
+            self.stacked = 0;
+            self.b = Some(t as u8);
+        }
+        self.c &= 0x7FFFF;
+    }
+
+    fn renorm(&mut self) {
+        while self.a < 0x8000 {
+            self.a <<= 1;
+            self.c <<= 1;
+            self.ct -= 1;
+            if self.ct == 0 {
+                self.byte_out();
+                self.ct = 8;
+            }
+        }
+    }
+
+    fn code(&mut self, st: &mut u8, d: u8) {
+        let mps = *st >> 7;
+        let (qe, nlps, nmps, switch) = QE[usize::from(*st & 0x7F)];
+        self.a -= qe;
+        if d == mps {
+            if self.a < 0x8000 {
+                if self.a < qe {
+                    self.c += self.a;
+                    self.a = qe;
+                }
+                *st = nmps | (mps << 7);
+                self.renorm();
+            }
+        } else {
+            if self.a >= qe {
+                self.c += self.a;
+                self.a = qe;
+            }
+            *st = nlps | ((mps ^ u8::from(switch)) << 7);
+            self.renorm();
+        }
+    }
+
+    fn code_fixed(&mut self, d: u8) {
+        let mut st = 0;
+        self.code(&mut st, d);
+    }
+
+    fn finish(mut self) -> Vec<u8> {
+        let mut t = (self.c + self.a - 1) & 0xFFFF_0000;
+        if t < self.c {
+            t += 0x8000;
+        }
+        self.c = t << self.ct;
+        self.byte_out();
+        self.c <<= 8;
+        self.byte_out();
+        if let Some(b) = self.b {
+            self.emit(b);
+        }
+        for _ in 0..self.stacked {
+            self.emit(0xFF);
+        }
+        // Trailing zero bytes are dropped, as libjpeg's encoder does; the decoder supplies
+        // zeros at the marker. A zero right after `FF` is stuffing and stays.
+        while self.out.last() == Some(&0) && self.out.len().checked_sub(2).map(|i| self.out[i]) != Some(0xFF) {
+            self.out.pop();
+        }
+        self.out
+    }
+}
+
+/// Arithmetic conditioning of one entropy table: DC (L, U) and AC Kx (F.1.4.4).
+#[derive(Clone, Copy, PartialEq, Eq)]
+struct Cond {
+    l: u8,
+    u: u8,
+    kx: u8,
+}
+
+/// The conditioning in force without a DAC segment (B.2.4.3).
+const DEFAULT_COND: Cond = Cond { l: 0, u: 1, kx: 5 };
+
+/// Statistics per entropy table, DC prediction and context per scan component.
+struct EncScan {
+    dc: [[u8; 64]; 4],
+    ac: [[u8; 256]; 4],
+    ctx: [usize; 4],
+    pred: [i32; 4],
+    cond: [Cond; 4],
+}
+
+impl EncScan {
+    fn new(cond: [Cond; 4]) -> Self {
+        EncScan { dc: [[0; 64]; 4], ac: [[0; 256]; 4], ctx: [0; 4], pred: [0; 4], cond }
+    }
+
+    /// Encode_DC_DIFF of scan component `sc` with DC table `t`.
+    fn dc(&mut self, e: &mut Enc, sc: usize, t: usize, value: i32) {
+        let diff = value - self.pred[sc];
+        self.pred[sc] = value;
+        let st = &mut self.dc[t];
+        let s0 = self.ctx[sc];
+        if diff == 0 {
+            e.code(&mut st[s0], 0);
+            self.ctx[sc] = 0;
+            return;
+        }
+        e.code(&mut st[s0], 1);
+        let sign = u8::from(diff < 0);
+        e.code(&mut st[s0 + 1], sign);
+        let sp = s0 + 2 + usize::from(sign);
+        let sz = diff.unsigned_abs() - 1;
+        let mut m = 0u32;
+        if sz == 0 {
+            e.code(&mut st[sp], 0);
+        } else {
+            e.code(&mut st[sp], 1);
+            m = 1;
+            let mut s = 20;
+            while m << 1 <= sz {
+                e.code(&mut st[s], 1);
+                m <<= 1;
+                s += 1;
+            }
+            e.code(&mut st[s], 0);
+            let mut bit = m >> 1;
+            while bit != 0 {
+                e.code(&mut st[s + 14], u8::from(sz & bit != 0));
+                bit >>= 1;
+            }
+        }
+        // Conditioning category as libjpeg's jcarith.c computes it, from the magnitude
+        // category `m` rather than the difference.
+        let Cond { l, u, .. } = self.cond[t];
+        self.ctx[sc] = if m < (1 << l) >> 1 {
+            0
+        } else if m > (1 << u) >> 1 {
+            12 + 4 * usize::from(sign)
+        } else {
+            4 + 4 * usize::from(sign)
+        };
+    }
+
+    /// Encode_AC_coefficients with AC table `t` over `ss..=se` of the coefficients scaled down
+    /// by `al`.
+    fn ac(&mut self, e: &mut Enc, t: usize, blk: &[i32; 64], ss: usize, se: usize, al: u8) {
+        let kx = usize::from(self.cond[t].kx);
+        let st = &mut self.ac[t];
+        let v = |k: usize| if blk[k] < 0 { -((-blk[k]) >> al) } else { blk[k] >> al };
+        let last = (ss..=se).rev().find(|&k| v(k) != 0);
+        let mut k = ss;
+        while k <= se {
+            if last.is_none_or(|l| k > l) {
+                e.code(&mut st[3 * (k - 1)], 1);
+                return;
+            }
+            e.code(&mut st[3 * (k - 1)], 0);
+            while v(k) == 0 {
+                e.code(&mut st[3 * (k - 1) + 1], 0);
+                k += 1;
+            }
+            e.code(&mut st[3 * (k - 1) + 1], 1);
+            e.code_fixed(u8::from(v(k) < 0));
+            let sz = v(k).unsigned_abs() - 1;
+            let sp = 3 * (k - 1) + 2;
+            if sz == 0 {
+                e.code(&mut st[sp], 0);
+            } else {
+                e.code(&mut st[sp], 1);
+                if sz == 1 {
+                    e.code(&mut st[sp], 0);
+                } else {
+                    e.code(&mut st[sp], 1);
+                    let mut m = 2u32;
+                    let mut s = if k <= kx { 189 } else { 217 };
+                    while m << 1 <= sz {
+                        e.code(&mut st[s], 1);
+                        m <<= 1;
+                        s += 1;
+                    }
+                    e.code(&mut st[s], 0);
+                    let mut bit = m >> 1;
+                    while bit != 0 {
+                        e.code(&mut st[s + 14], u8::from(sz & bit != 0));
+                        bit >>= 1;
+                    }
+                }
+            }
+            k += 1;
+        }
+    }
+
+    /// Successive approximation of AC coefficients with table `t`: bit `al` of each (G.1.3.3).
+    fn ac_refine(&mut self, e: &mut Enc, t: usize, blk: &[i32; 64], ss: usize, se: usize, al: u8) {
+        let st = &mut self.ac[t];
+        let prior = |k: usize| blk[k].unsigned_abs() >> (al + 1) != 0;
+        let now = |k: usize| blk[k].unsigned_abs() >> al != 0;
+        let eob_prev = (ss..=se).rev().find(|&k| prior(k)).map_or(ss, |k| k + 1);
+        let eob_now = (ss..=se).rev().find(|&k| now(k)).map_or(ss, |k| k + 1);
+        let mut k = ss;
+        while k <= se {
+            if k >= eob_prev {
+                if k >= eob_now {
+                    e.code(&mut st[3 * (k - 1)], 1);
+                    return;
+                }
+                e.code(&mut st[3 * (k - 1)], 0);
+            }
+            loop {
+                if prior(k) {
+                    e.code(&mut st[3 * (k - 1) + 2], ((blk[k].unsigned_abs() >> al) & 1) as u8);
+                    break;
+                }
+                if now(k) {
+                    e.code(&mut st[3 * (k - 1) + 1], 1);
+                    e.code_fixed(u8::from(blk[k] < 0));
+                    break;
+                }
+                e.code(&mut st[3 * (k - 1) + 1], 0);
+                k += 1;
+            }
+            k += 1;
+        }
+    }
+}
+
+/// Deterministic pseudo-random coefficients: mostly small, zero runs, a few large.
+fn coefficients(n: usize, seed: u32, big: i32) -> Vec<[i32; 64]> {
+    let mut s = seed;
+    let mut next = move || {
+        s = s.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+        s >> 8
+    };
+    (0..n)
+        .map(|_| {
+            let mut b = [0i32; 64];
+            b[0] = (next() % (2 * big as u32 + 1)) as i32 - big;
+            for v in b.iter_mut().skip(1) {
+                let mag = match next() % 100 {
+                    0..=59 => 0,
+                    60..=89 => 1 + (next() % 4) as i32,
+                    90..=97 => 1 + (next() % 60) as i32,
+                    _ => 1 + (next() % big as u32) as i32,
+                };
+                *v = if next() % 2 == 0 { mag } else { -mag };
+            }
+            if next() % 3 == 0 {
+                for v in &mut b[20..] {
+                    *v = 0;
+                }
+            }
+            b
+        })
+        .collect()
+}
+
+fn segment(out: &mut Vec<u8>, marker: u8, body: &[u8]) {
+    out.extend_from_slice(&[0xFF, marker]);
+    out.extend_from_slice(&((body.len() + 2) as u16).to_be_bytes());
+    out.extend_from_slice(body);
+}
+
+/// A component of a test frame: id, sampling factors, quantization table slot, and the
+/// coefficients of its block grid padded to whole MCUs, row-major.
+struct TestComp {
+    id: u8,
+    h: usize,
+    v: usize,
+    tq: u8,
+    blocks: Vec<[i32; 64]>,
+}
+
+/// A scan of a test frame: frame component indexes, `(ss, se, ah, al)`, and segments
+/// written just before its header.
+struct TestScan {
+    comps: Vec<usize>,
+    band: (usize, usize, u8, u8),
+    before: Vec<u8>,
+}
+
+/// An arithmetic-coded frame (SOF9, or SOF10 when `progressive`). Component `ci` uses entropy
+/// tables `min(ci, 1)`, as libjpeg's defaults do; a DAC segment is written for the tables
+/// whose `cond` isn't the default, and quantization slot 0 holds all ones until a scan's
+/// `before` replaces it.
+struct TestFrame {
+    precision: u8,
+    progressive: bool,
+    width: usize,
+    height: usize,
+    comps: Vec<TestComp>,
+    cond: [Cond; 4],
+    ri: usize,
+    scans: Vec<TestScan>,
+}
+
+impl TestFrame {
+    fn encode(&self) -> Vec<u8> {
+        let mut s = vec![0xFF, 0xD8];
+        let mut dqt = vec![0u8];
+        dqt.extend([1u8; 64]);
+        segment(&mut s, 0xDB, &dqt);
+        let mut sof = vec![self.precision];
+        sof.extend((self.height as u16).to_be_bytes());
+        sof.extend((self.width as u16).to_be_bytes());
+        sof.push(self.comps.len() as u8);
+        for c in &self.comps {
+            sof.extend([c.id, (c.h << 4 | c.v) as u8, c.tq]);
+        }
+        segment(&mut s, if self.progressive { 0xCA } else { 0xC9 }, &sof);
+        let mut dac = Vec::new();
+        for (t, c) in self.cond.iter().enumerate().filter(|(_, c)| **c != DEFAULT_COND) {
+            dac.extend([t as u8, c.l | c.u << 4, 0x10 | t as u8, c.kx]);
+        }
+        if !dac.is_empty() {
+            segment(&mut s, 0xCC, &dac);
+        }
+        if self.ri > 0 {
+            segment(&mut s, 0xDD, &(self.ri as u16).to_be_bytes());
+        }
+        let hmax = self.comps.iter().map(|c| c.h).max().unwrap();
+        let vmax = self.comps.iter().map(|c| c.v).max().unwrap();
+        let mcux = self.width.div_ceil(8 * hmax);
+        let mcuy = self.height.div_ceil(8 * vmax);
+        for scan in &self.scans {
+            s.extend(&scan.before);
+            let (ss, se, ah, al) = scan.band;
+            let mut sos = vec![scan.comps.len() as u8];
+            for &ci in &scan.comps {
+                let t = ci.min(1) as u8;
+                sos.extend([self.comps[ci].id, t << 4 | t]);
+            }
+            sos.extend([ss as u8, se as u8, ah << 4 | al]);
+            segment(&mut s, 0xDA, &sos);
+            // Blocks in coding order (A.2): `(scan component, block)` for each MCU.
+            let mut mcus: Vec<Vec<(usize, &[i32; 64])>> = Vec::new();
+            if let [ci] = scan.comps[..] {
+                let c = &self.comps[ci];
+                let bw = mcux * c.h;
+                let (cw, ch) = ((self.width * c.h).div_ceil(hmax), (self.height * c.v).div_ceil(vmax));
+                for by in 0..ch.div_ceil(8) {
+                    for bx in 0..cw.div_ceil(8) {
+                        mcus.push(vec![(0, &c.blocks[by * bw + bx])]);
+                    }
+                }
+            } else {
+                for my in 0..mcuy {
+                    for mx in 0..mcux {
+                        let mut mcu = Vec::new();
+                        for (sc, &ci) in scan.comps.iter().enumerate() {
+                            let c = &self.comps[ci];
+                            for by in my * c.v..(my + 1) * c.v {
+                                for bx in mx * c.h..(mx + 1) * c.h {
+                                    mcu.push((sc, &c.blocks[by * mcux * c.h + bx]));
+                                }
+                            }
+                        }
+                        mcus.push(mcu);
+                    }
+                }
+            }
+            let mut e = Enc::new();
+            let mut st = EncScan::new(self.cond);
+            let mut rst = 0u8;
+            for (n, mcu) in mcus.iter().enumerate() {
+                if self.ri > 0 && n > 0 && n % self.ri == 0 {
+                    s.extend(std::mem::replace(&mut e, Enc::new()).finish());
+                    s.extend([0xFF, 0xD0 + rst]);
+                    rst = (rst + 1) & 7;
+                    st = EncScan::new(self.cond);
+                }
+                for &(sc, blk) in mcu {
+                    let t = scan.comps[sc].min(1);
+                    match (self.progressive, ss, ah) {
+                        (false, _, _) => {
+                            st.dc(&mut e, sc, t, blk[0]);
+                            st.ac(&mut e, t, blk, 1, 63, 0);
+                        }
+                        (true, 0, 0) => st.dc(&mut e, sc, t, blk[0] >> al),
+                        (true, 0, _) => e.code_fixed(((blk[0] >> al) & 1) as u8),
+                        (true, _, 0) => st.ac(&mut e, t, blk, ss, se, al),
+                        (true, _, _) => st.ac_refine(&mut e, t, blk, ss, se, al),
+                    }
+                }
+            }
+            s.extend(e.finish());
+        }
+        s.extend([0xFF, 0xD9]);
+        s
+    }
+}
+
+/// A gray SOF9 stream (SOF10 when there are several scans) holding `blocks` (`bw` × `bh`),
+/// with the scans `(ss, se, ah, al)` and restart interval `ri` (in MCUs).
+fn arith_stream(precision: u8, bw: usize, bh: usize, blocks: &[[i32; 64]], scans: &[(usize, usize, u8, u8)], ri: usize) -> Vec<u8> {
+    TestFrame {
+        precision,
+        progressive: scans.len() > 1,
+        width: bw * 8,
+        height: bh * 8,
+        comps: vec![TestComp { id: 1, h: 1, v: 1, tq: 0, blocks: blocks.to_vec() }],
+        cond: [DEFAULT_COND; 4],
+        ri,
+        scans: scans.iter().map(|&band| TestScan { comps: vec![0], band, before: Vec::new() }).collect(),
+    }
+    .encode()
+}
+
+fn decoded_blocks(stream: &[u8]) -> Vec<[i32; 64]> {
+    let (mut frame, _, damaged) = decode_coefficients(stream, &Limits::default()).unwrap();
+    assert!(!damaged);
+    std::mem::take(&mut frame.comps[0].coefs)
+}
+
+#[test]
+fn arithmetic_sequential_round_trips_coefficients() {
+    for (precision, big, ri) in [(8u8, 1000, 0usize), (12, 16000, 0), (8, 300, 1), (12, 3000, 5)] {
+        let blocks = coefficients(12, u32::from(precision) * 7 + ri as u32, big);
+        let stream = arith_stream(precision, 4, 3, &blocks, &[(0, 63, 0, 0)], ri);
+        assert_eq!(decoded_blocks(&stream), blocks, "P={precision} ri={ri}");
+    }
+}
+
+#[test]
+fn arithmetic_progressive_round_trips_coefficients() {
+    let blocks = coefficients(6, 99, 2000);
+    let scans = [(0, 0, 0, 1), (1, 5, 0, 2), (6, 63, 0, 1), (1, 5, 2, 1), (0, 0, 1, 0), (1, 5, 1, 0), (6, 63, 1, 0)];
+    for ri in [0, 2] {
+        let stream = arith_stream(8, 3, 2, &blocks, &scans, ri);
+        assert_eq!(decoded_blocks(&stream), blocks, "ri={ri}");
+    }
+}
+
+/// Every component's coefficients, and whether the stream was damaged.
+fn decoded_components(stream: &[u8]) -> (Vec<Vec<[i32; 64]>>, bool) {
+    let (frame, _, damaged) = decode_coefficients(stream, &Limits::default()).unwrap();
+    (frame.comps.into_iter().map(|c| c.coefs).collect(), damaged)
+}
+
+/// Non-default DC conditioning (L, U) and AC Kx from a DAC segment round-trip, and the decoder
+/// applies them: the same data read with the default conditioning comes out different.
+#[test]
+fn arithmetic_conditioning_from_dac_round_trips() {
+    let blocks = coefficients(12, 21, 1000);
+    for (l, u, kx) in [(2, 4, 2), (1, 1, 20), (0, 0, 1), (3, 7, 63), (5, 15, 40)] {
+        let cond = Cond { l, u, kx };
+        for progressive in [false, true] {
+            let bands: &[(usize, usize, u8, u8)] = if progressive { &[(0, 0, 0, 0), (1, 63, 0, 0)] } else { &[(0, 63, 0, 0)] };
+            let stream = TestFrame {
+                precision: 8,
+                progressive,
+                width: 32,
+                height: 24,
+                comps: vec![TestComp { id: 1, h: 1, v: 1, tq: 0, blocks: blocks.clone() }],
+                cond: [cond, DEFAULT_COND, DEFAULT_COND, DEFAULT_COND],
+                ri: 0,
+                scans: bands.iter().map(|&band| TestScan { comps: vec![0], band, before: Vec::new() }).collect(),
+            }
+            .encode();
+            assert_eq!(decoded_blocks(&stream), blocks, "L={l} U={u} Kx={kx} progressive={progressive}");
+            let dac = stream.windows(2).position(|p| p == [0xFF, 0xCC]).unwrap();
+            let len = usize::from(u16::from_be_bytes([stream[dac + 2], stream[dac + 3]]));
+            let mut without = stream.clone();
+            without.drain(dac..dac + 2 + len);
+            let differs = decode_coefficients(&without, &Limits::default()).map_or(true, |(f, _, _)| f.comps[0].coefs != blocks);
+            assert!(differs, "L={l} U={u} Kx={kx} progressive={progressive}: DAC ignored");
+        }
+    }
+}
+
+/// Interleaved scans of a subsampled frame (2×2 luma, two 1×1 chroma components sharing
+/// entropy table 1 with non-default conditioning), sequential with and without restarts, and
+/// progressive.
+#[test]
+fn arithmetic_interleaved_subsampled_round_trips() {
+    let comps = |seed: u32| {
+        vec![
+            TestComp { id: 1, h: 2, v: 2, tq: 0, blocks: coefficients(8, seed, 800) },
+            TestComp { id: 2, h: 1, v: 1, tq: 0, blocks: coefficients(2, seed + 1, 300) },
+            TestComp { id: 3, h: 1, v: 1, tq: 0, blocks: coefficients(2, seed + 2, 300) },
+        ]
+    };
+    let cond = [DEFAULT_COND, Cond { l: 1, u: 3, kx: 8 }, DEFAULT_COND, DEFAULT_COND];
+    let scan = |comps: &[usize], band| TestScan { comps: comps.to_vec(), band, before: Vec::new() };
+    let progressive = vec![
+        scan(&[0, 1, 2], (0, 0, 0, 1)),
+        scan(&[0], (1, 63, 0, 0)),
+        scan(&[2], (1, 63, 0, 0)),
+        scan(&[1], (1, 63, 0, 0)),
+        scan(&[0, 1, 2], (0, 0, 1, 0)),
+    ];
+    for (seed, ri, scans) in [(1, 0, vec![scan(&[0, 1, 2], (0, 63, 0, 0))]), (2, 1, vec![scan(&[0, 1, 2], (0, 63, 0, 0))]), (3, 0, progressive)] {
+        let frame = TestFrame { precision: 8, progressive: scans.len() > 1, width: 32, height: 16, comps: comps(seed), cond, ri, scans };
+        let (got, damaged) = decoded_components(&frame.encode());
+        assert!(!damaged, "seed {seed}");
+        for (c, want) in got.iter().zip(&frame.comps) {
+            assert_eq!(c, &want.blocks, "seed {seed} component {}", want.id);
+        }
+    }
+}
+
+/// Each component dequantizes with the table in its slot at its first scan, not the one the
+/// slot holds when the stream ends.
+#[test]
+fn quantization_tables_are_latched_at_the_first_scan() {
+    // DC-only blocks: sample = DC × q₀ / 8 + 128.
+    let mut blk = [0i32; 64];
+    blk[0] = 40;
+    let dqt = |q0: u8| {
+        let mut body = vec![0u8, q0];
+        body.extend([1u8; 63]);
+        let mut seg = Vec::new();
+        segment(&mut seg, 0xDB, &body);
+        seg
+    };
+    let stream = TestFrame {
+        precision: 8,
+        progressive: false,
+        width: 16,
+        height: 16,
+        comps: b"RGB".iter().map(|&id| TestComp { id, h: 1, v: 1, tq: 0, blocks: vec![blk; 4] }).collect(),
+        cond: [DEFAULT_COND; 4],
+        ri: 0,
+        scans: [2, 4, 8].iter().enumerate().map(|(ci, &q0)| TestScan { comps: vec![ci], band: (0, 63, 0, 0), before: dqt(q0) }).collect(),
+    }
+    .encode();
+    let img = decode_default(&stream).unwrap();
+    assert!(!img.damaged);
+    let Samples::U8(px) = &img.samples else { panic!("16-bit samples") };
+    assert!(px.chunks(3).all(|p| p == [138, 148, 168]), "{:?}", &px[..3]);
+}
+
+#[test]
+fn arithmetic_twelve_bit_flat_block_is_sixteen_bit() {
+    // DC only: sample = DC / 8 + 2048 with a quantizer of 1; 1000 → 2173.
+    let mut blk = [0i32; 64];
+    blk[0] = 1000;
+    let stream = arith_stream(12, 1, 1, &[blk], &[(0, 63, 0, 0)], 0);
+    assert_eq!(frame(&stream), Some(FrameKind { marker: 0xC9, precision: 12 }));
+    let img = decode_default(&stream).unwrap();
+    assert_eq!((img.width, img.height, img.components), (8, 8, 1));
+    let want = (2173.0f32 * 65535.0 / 4095.0).round() as u16;
+    assert!(u16_samples(&img).iter().all(|&v| v.abs_diff(want) <= 1));
+}
+
+/// A 12-bit SOF1 stream built by hand: one 8×8 gray block with only a DC coefficient. The DC
+/// table has one code (`0`, category 13), the AC table one (`0`, end of block).
+fn twelve_bit_huffman_block() -> Vec<u8> {
+    let mut s = vec![0xFF, 0xD8];
+    let mut dqt = vec![0u8];
+    dqt.extend([1u8; 64]);
+    segment(&mut s, 0xDB, &dqt);
+    segment(&mut s, 0xC1, &[12, 0, 8, 0, 8, 1, 1, 0x11, 0]);
+    let mut dht = vec![0x00, 1];
+    dht.extend([0u8; 15]);
+    dht.push(13);
+    dht.extend([0x10, 1]);
+    dht.extend([0u8; 15]);
+    dht.push(0x00);
+    segment(&mut s, 0xC4, &dht);
+    segment(&mut s, 0xDA, &[1, 1, 0x00, 0, 63, 0]);
+    // DC = 7616 → sample 7616 / 8 + 2048 = 3000. Bits: `0`, 7616 in 13 bits, `0`, one pad `1`.
+    let word: u16 = (7616 << 2) | 1;
+    s.extend(word.to_be_bytes());
+    s.extend([0xFF, 0xD9]);
+    s
+}
+
+#[test]
+fn twelve_bit_huffman_block_decodes_to_sixteen_bit() {
+    let stream = twelve_bit_huffman_block();
+    assert_eq!(frame(&stream), Some(FrameKind { marker: 0xC1, precision: 12 }));
+    let img = decode_default(&stream).unwrap();
+    assert_eq!((img.width, img.height), (8, 8));
+    let want = (3000.0f32 * 65535.0 / 4095.0).round() as u16;
+    let px = u16_samples(&img);
+    assert!(px.iter().all(|&v| v.abs_diff(want) <= 1), "{:?} vs {want}", &px[..4]);
+}
+
+/// APPn segments before the frame (here an APP13 `8BIM` block right after SOI) are skipped by
+/// the probe and the decoder alike; reading them is the caller's job.
+#[test]
+fn twelve_bit_jpeg_with_photoshop_resources_decodes() {
+    let resources = b"8BIM\x04\x04\0\0\0\0\0\0".to_vec();
+    let mut app13 = b"Photoshop 3.0\0".to_vec();
+    app13.extend_from_slice(&resources);
+    let stream = twelve_bit_huffman_block();
+    let mut with = stream[..2].to_vec();
+    segment(&mut with, 0xED, &app13);
+    with.extend_from_slice(&stream[2..]);
+    assert_eq!(frame(&with), frame(&stream));
+    assert_eq!(decode_default(&with).unwrap(), decode_default(&stream).unwrap());
+}
+
+/// Where the entropy-coded data of the last scan starts.
+fn last_scan_data(s: &[u8]) -> usize {
+    let sos = s.windows(2).rposition(|p| p == [0xFF, 0xDA]).unwrap();
+    sos + 2 + usize::from(u16::from_be_bytes([s[sos + 2], s[sos + 3]]))
+}
+
+/// A Huffman scan whose entropy data runs out is not a clean image, even with EOI present:
+/// the zero padding supplied at the marker must not be decoded as real coefficients.
+#[test]
+fn huffman_scan_out_of_data_is_not_clean() {
+    let full = twelve_bit_huffman_block();
+    let data = last_scan_data(&full);
+    for keep in 0..2 {
+        let mut s = full[..data + keep].to_vec();
+        s.extend([0xFF, 0xD9]);
+        assert!(decode_default(&s).is_err(), "keep {keep}");
+    }
+    // A multi-MCU scan cut in half, EOI kept, decodes as damaged.
+    let (w, h) = (64usize, 64usize);
+    let rgb: Vec<u8> = (0..w * h).flat_map(|i| [(i % w * 4) as u8, (i / w * 4) as u8, (i * 7) as u8]).collect();
+    let mut out = Vec::new();
+    jpeg_encoder::Encoder::new(&mut out, 90).encode(&rgb, w as u16, h as u16, jpeg_encoder::ColorType::Rgb).unwrap();
+    let sof = out.windows(2).position(|p| p == [0xFF, 0xC0]).unwrap();
+    out[sof + 1] = 0xC1;
+    let data = last_scan_data(&out);
+    let end = out.len() - 2;
+    let mut cut = out[..data + (end - data) / 2].to_vec();
+    if cut.last() == Some(&0xFF) {
+        cut.pop();
+    }
+    cut.extend([0xFF, 0xD9]);
+    assert!(!decode(&out, &Limits::default(), None).unwrap().damaged);
+    assert!(decode(&cut, &Limits::default(), None).unwrap().damaged);
+}
+
+/// Arithmetic data that runs to the end of the file, or loses a restart marker, is reported
+/// damaged, and the blocks before the cut are kept. Data cut short before EOI with no restart
+/// interval reads as dropped trailing zeros and can't be detected.
+#[test]
+fn arithmetic_scan_out_of_data_is_damaged() {
+    let blocks = coefficients(64, 11, 500);
+    for ri in [0, 2] {
+        let full = arith_stream(8, 8, 8, &blocks, &[(0, 63, 0, 0)], ri);
+        assert_eq!(decoded_blocks(&full), blocks, "ri={ri}");
+        let data = last_scan_data(&full);
+        let end = full.len() - 2;
+        for cut in [data + (end - data) / 2, data + 1] {
+            let mut s = full[..cut].to_vec();
+            if s.last() == Some(&0xFF) {
+                s.pop();
+            }
+            for eoi in [false, true] {
+                if eoi && ri == 0 {
+                    continue;
+                }
+                let mut s = s.clone();
+                if eoi {
+                    s.extend([0xFF, 0xD9]);
+                }
+                // With one byte of data the first MCU fails, which is an error, not damage.
+                match decode_coefficients(&s, &Limits::default()) {
+                    Ok((frame, _, damaged)) => {
+                        assert!(damaged, "ri={ri} eoi={eoi} cut at {}", cut - data);
+                        if cut > data + 1 {
+                            assert_eq!(frame.comps[0].coefs[0], blocks[0], "ri={ri} eoi={eoi}");
+                        }
+                    }
+                    Err(_) => assert_eq!(cut, data + 1, "ri={ri} eoi={eoi}"),
+                }
+            }
+        }
+    }
+}
+
+/// A baseline file from `jpeg-encoder`, relabeled SOF1, decodes like zune decodes the original.
+#[test]
+fn extended_huffman_matches_zune_on_baseline_data() {
+    let (w, h) = (37u16, 29u16);
+    let rgb: Vec<u8> = (0..usize::from(w) * usize::from(h))
+        .flat_map(|i| {
+            let (x, y) = (i % usize::from(w), i / usize::from(w));
+            [(x * 7) as u8, (y * 9) as u8, ((x + y) * 3) as u8]
+        })
+        .collect();
+    for (sampling, restart) in
+        [(jpeg_encoder::SamplingFactor::R_4_2_0, 0u16), (jpeg_encoder::SamplingFactor::R_4_4_4, 3), (jpeg_encoder::SamplingFactor::R_4_2_2, 1)]
+    {
+        let mut out = Vec::new();
+        let mut enc = jpeg_encoder::Encoder::new(&mut out, 90);
+        enc.set_sampling_factor(sampling);
+        if restart > 0 {
+            enc.set_restart_interval(restart);
+        }
+        enc.encode(&rgb, w, h, jpeg_encoder::ColorType::Rgb).unwrap();
+        let (zune, _) = zune_decode(&out);
+        let sof = out.windows(2).position(|p| p == [0xFF, 0xC0]).unwrap();
+        out[sof + 1] = 0xC1;
+        let ours = decode(&out, &Limits::default(), None).unwrap();
+        assert_eq!((ours.width, ours.height, ours.components), (u32::from(w), u32::from(h), 3));
+        assert!(!ours.damaged);
+        let Samples::U8(data) = &ours.samples else { panic!("16-bit samples") };
+        let mad = data.iter().zip(&zune).map(|(&a, &b)| f32::from(a.abs_diff(b))).sum::<f32>() / data.len() as f32;
+        assert!(mad < 1.5, "{sampling:?} restart {restart}: mean abs diff {mad}");
+    }
+}
+
+#[test]
+fn malformed_streams_return_errors_not_panics() {
+    let blocks = coefficients(6, 5, 500);
+    let mut streams = vec![
+        arith_stream(12, 3, 2, &blocks, &[(0, 63, 0, 0)], 2),
+        arith_stream(8, 3, 2, &blocks, &[(0, 0, 0, 1), (1, 63, 0, 0), (0, 0, 1, 0)], 0),
+        twelve_bit_huffman_block(),
+    ];
+    // Header damage: zero sizes, bad component counts, sampling factors and tables, bad DAC.
+    let base = arith_stream(8, 1, 1, &blocks[..1], &[(0, 63, 0, 0)], 0);
+    let sof = base.windows(2).position(|p| p == [0xFF, 0xC9]).unwrap();
+    for (offset, value) in [(4, 16u8), (6, 0), (8, 0), (9, 7), (10, 9), (11, 0x50), (12, 9)] {
+        let mut s = base.clone();
+        s[sof + offset] = value;
+        assert!(decode_default(&s).is_err(), "SOF byte {offset} = {value}");
+        streams.push(s);
+    }
+    let mut dac = base.clone();
+    dac.splice(2..2, [0xFF, 0xCC, 0, 4, 0x00, 0x13]);
+    assert!(decode_default(&dac).is_err());
+    streams.push(dac);
+    for s in &streams {
+        for cut in 0..s.len() {
+            let _ = decode_default(&s[..cut]);
+        }
+        for i in 2..s.len() {
+            for v in [0x00, 0xFF, 0x5A] {
+                let mut t = s.clone();
+                t[i] = v;
+                let _ = decode_default(&t);
+            }
+        }
+    }
+    assert!(decode_default(&streams[0][..40]).is_err());
+}
+
+/// Scans past the block budget (`SCAN_PASSES` passes over a one-block frame) aren't decoded:
+/// the image keeps what the earlier scans decoded and is reported damaged.
+#[test]
+fn scans_past_the_block_budget_are_not_decoded() {
+    let blocks = coefficients(1, 3, 500);
+    for (count, damaged) in [(SCAN_PASSES, false), (SCAN_PASSES + 1, true)] {
+        let stream = arith_stream(8, 1, 1, &blocks, &vec![(0, 0, 0, 0); count], 0);
+        let (frame, _, d) = decode_coefficients(&stream, &Limits::default()).unwrap();
+        assert_eq!(d, damaged, "{count} scans");
+        assert_eq!(frame.comps[0].coefs[0][0], blocks[0][0], "{count} scans");
+    }
+}
+
+#[test]
+fn limits_are_checked_before_allocating() {
+    let mut s = vec![0xFF, 0xD8];
+    segment(&mut s, 0xC9, &[8, 0xFF, 0xFF, 0xFF, 0xFF, 3, 1, 0x44, 0, 2, 0x11, 0, 3, 0x11, 0]);
+    let small = Limits { max_alloc: 1 << 20, ..Limits::default() };
+    assert!(matches!(decode(&s, &small, None), Err(Error::LimitExceeded(_))));
+    // 64×64 gray: 32 KiB of coefficients and plane plus 4 KiB of output, each under the limit
+    // alone but not together.
+    let stream = arith_stream(8, 8, 8, &coefficients(64, 1, 100), &[(0, 63, 0, 0)], 0);
+    for (max_alloc, ok) in [(36 << 10, true), ((36 << 10) - 1, false), (32 << 10, false)] {
+        let limits = Limits { max_alloc, ..Limits::default() };
+        assert_eq!(decode(&stream, &limits, None).is_ok(), ok, "max_alloc {max_alloc}");
+    }
+}
+
+#[test]
+fn frame_reports_the_marker_and_precision() {
+    let kind = |marker, precision| Some(FrameKind { marker, precision });
+    assert_eq!(frame(&[0xFF, 0xD8, 0xFF, 0xC0, 0, 11, 8, 0, 8, 0, 8, 1, 1, 0x11, 0]), kind(0xC0, 8));
+    assert_eq!(frame(&[0xFF, 0xD8, 0xFF, 0xC9, 0, 11, 8, 0, 8, 0, 8, 1, 1, 0x11, 0]), kind(0xC9, 8));
+    assert_eq!(frame(&[0xFF, 0xD8, 0xFF, 0xC1, 0, 11, 12, 0, 8, 0, 8, 1, 1, 0x11, 0]), kind(0xC1, 12));
+    assert_eq!(frame(&[0xFF, 0xD8]), None);
+}
diff --git a/crates/jpeg/tests/conformance.rs b/crates/jpeg/tests/conformance.rs
new file mode 100644
index 00000000..86b9dfb0
--- /dev/null
+++ b/crates/jpeg/tests/conformance.rs
@@ -0,0 +1,128 @@
+//! Decodes of the libjpeg-turbo test images (tests/data, see SOURCE.md there).
+
+use craft_jpeg::{Decoded, Limits, Samples, decode};
+
+fn fixture(name: &str) -> Vec<u8> {
+    let path = format!("{}/tests/data/{name}", env!("CARGO_MANIFEST_DIR"));
+    std::fs::read(&path).unwrap_or_else(|e| panic!("{path}: {e}"))
+}
+
+fn decode_clean(name: &str) -> Decoded {
+    let img = decode(&fixture(name), &Limits::default(), None).unwrap_or_else(|e| panic!("{name}: {e}"));
+    assert!(!img.damaged, "{name}");
+    img
+}
+
+fn decode_fixture(name: &str) -> Decoded {
+    let img = decode_clean(name);
+    assert_eq!((img.width, img.height, img.components), (227, 149, 3), "{name}");
+    img
+}
+
+/// Mean and maximum absolute difference.
+fn diff(a: impl Iterator<Item = f64>, b: impl Iterator<Item = f64>) -> (f64, f64) {
+    let (mut sum, mut max, mut n) = (0.0, 0.0f64, 0usize);
+    for (a, b) in a.zip(b) {
+        let d = (a - b).abs();
+        sum += d;
+        max = max.max(d);
+        n += 1;
+    }
+    (sum / n.max(1) as f64, max)
+}
+
+/// testimgari-huffman.jpg is testimgari.jpg transcoded by jpegtran: the same coefficients, only
+/// the entropy coding differs, so the samples must be identical.
+#[test]
+fn arithmetic_coded_image_matches_its_huffman_transcode() {
+    let huffman = decode_fixture("testimgari-huffman.jpg");
+    let arithmetic = decode_fixture("testimgari.jpg");
+    assert!(matches!(huffman.samples, Samples::U8(_)));
+    assert!(huffman.samples == arithmetic.samples, "testimgari.jpg decodes differently from testimgari-huffman.jpg");
+}
+
+/// The arithmetic and progressive arithmetic transcodes jpegtran made of testorig.jpg and
+/// testorig12.jpg hold their coefficients, so they decode to exactly the same samples.
+#[test]
+fn arithmetic_transcodes_match_their_huffman_sources() {
+    for (source, transcodes) in [
+        ("testorig.jpg", &["testorig-ari-progressive.jpg", "testorig-ari-progressive-restart.jpg"]),
+        ("testorig12.jpg", &["testorig12-ari.jpg", "testorig12-ari-progressive.jpg"]),
+    ] {
+        let reference = decode_fixture(source);
+        for name in transcodes {
+            assert!(decode_fixture(name).samples == reference.samples, "{name} decodes differently from {source}");
+        }
+    }
+}
+
+/// libjpeg's arithmetic encoder drops the trailing zero bytes of a scan, so the white lower
+/// part of whitetail-ari.jpg decodes from zeros supplied at the EOI marker. It must decode
+/// whole and match its Huffman transcode.
+#[test]
+fn arithmetic_white_tail_decodes_from_implied_zeros() {
+    let arithmetic = decode_clean("whitetail-ari.jpg");
+    assert_eq!((arithmetic.width, arithmetic.height, arithmetic.components), (512, 512, 1));
+    assert!(decode_clean("whitetail-huffman.jpg").samples == arithmetic.samples, "whitetail-ari.jpg decodes differently from whitetail-huffman.jpg");
+}
+
+/// The 8-bit path against zune-jpeg. Both use centered linear chroma upsampling; the residual is
+/// float against integer IDCT and color conversion.
+#[test]
+fn baseline_image_matches_zune_jpeg() {
+    let bytes = fixture("testorig.jpg");
+    let mut zune = zune_jpeg::JpegDecoder::new(zune_jpeg::zune_core::bytestream::ZCursor::new(&bytes[..]));
+    let reference = zune.decode().unwrap_or_else(|e| panic!("zune-jpeg: {e:?}"));
+    let img = decode_fixture("testorig.jpg");
+    let Samples::U8(px) = &img.samples else { panic!("testorig.jpg: expected 8-bit samples") };
+    assert_eq!(px.len(), reference.len());
+    let (mean, max) = diff(px.iter().map(|&v| f64::from(v)), reference.iter().map(|&v| f64::from(v)));
+    eprintln!("testorig.jpg vs zune-jpeg: mean {mean:.3}, max {max}");
+    assert!(mean < MAX_MEAN_8 && max <= MAX_ABS_8, "mean {mean}, max {max}");
+}
+
+// Observed: mean 0.52, max 3.
+const MAX_MEAN_8: f64 = 0.75;
+const MAX_ABS_8: f64 = 4.0;
+
+/// Parse a binary PPM with 16-bit big-endian samples.
+fn ppm16(bytes: &[u8]) -> (u32, u32, u32, Vec<u16>) {
+    let mut fields = Vec::new();
+    let mut at = 0;
+    while fields.len() < 4 {
+        while bytes.get(at).is_some_and(u8::is_ascii_whitespace) {
+            at += 1;
+        }
+        let start = at;
+        while bytes.get(at).is_some_and(|b| !b.is_ascii_whitespace()) {
+            at += 1;
+        }
+        fields.push(std::str::from_utf8(&bytes[start..at]).unwrap_or_default().to_owned());
+    }
+    assert_eq!(fields[0], "P6");
+    let num = |s: &str| s.parse::<u32>().unwrap_or_else(|e| panic!("PPM header {s}: {e}"));
+    let (w, h, maxval) = (num(&fields[1]), num(&fields[2]), num(&fields[3]));
+    let data = &bytes[at + 1..];
+    let px: Vec<u16> = data.as_chunks::<2>().0.iter().map(|&c| u16::from_be_bytes(c)).collect();
+    assert_eq!(px.len(), (w * h * 3) as usize);
+    (w, h, maxval, px)
+}
+
+/// testorig12.jpg against libjpeg-turbo's decode (testorig12.ppm, 12-bit RGB; SOURCE.md says how
+/// it was made). libjpeg-turbo uses an integer IDCT and integer color conversion, craft-jpeg
+/// floats; the comparison is on the 12-bit scale.
+#[test]
+fn twelve_bit_image_matches_libjpeg_turbo() {
+    let (w, h, maxval, reference) = ppm16(&fixture("testorig12.ppm"));
+    assert_eq!((w, h, maxval), (227, 149, 4095));
+    let img = decode_fixture("testorig12.jpg");
+    let Samples::U16(px) = &img.samples else { panic!("testorig12.jpg: expected 16-bit samples") };
+    assert_eq!(px.len(), reference.len());
+    let (mean, max) = diff(px.iter().map(|&v| f64::from(v) * 4095.0 / 65535.0), reference.iter().map(|&v| f64::from(v)));
+    eprintln!("testorig12.jpg vs libjpeg-turbo (12-bit units): mean {mean:.3}, max {max:.2}");
+    assert!(mean < MAX_MEAN_12 && max <= MAX_ABS_12, "mean {mean}, max {max}");
+}
+
+// Observed: mean 0.50, max 2.46 (of 4095).
+const MAX_MEAN_12: f64 = 0.75;
+const MAX_ABS_12: f64 = 4.0;
diff --git a/crates/jpeg/tests/data/README.ijg b/crates/jpeg/tests/data/README.ijg
new file mode 100644
index 00000000..8f376826
--- /dev/null
+++ b/crates/jpeg/tests/data/README.ijg
@@ -0,0 +1,258 @@
+libjpeg-turbo note:  This file has been modified by The libjpeg-turbo Project
+to include only information relevant to libjpeg-turbo, to wordsmith certain
+sections, and to remove impolitic language that existed in the libjpeg v8
+README.  It is included only for reference.  Please see README.md for
+information specific to libjpeg-turbo.
+
+
+The Independent JPEG Group's JPEG software
+==========================================
+
+This distribution contains a release of the Independent JPEG Group's free JPEG
+software.  You are welcome to redistribute this software and to use it for any
+purpose, subject to the conditions under LEGAL ISSUES, below.
+
+This software is the work of Tom Lane, Guido Vollbeding, Philip Gladstone,
+Bill Allombert, Jim Boucher, Lee Crocker, Bob Friesenhahn, Ben Jackson,
+Julian Minguillon, Luis Ortiz, George Phillips, Davide Rossi, Ge' Weijers,
+and other members of the Independent JPEG Group.
+
+IJG is not affiliated with the ISO/IEC JTC1/SC29/WG1 standards committee
+(also known as JPEG, together with ITU-T SG16).
+
+
+DOCUMENTATION ROADMAP
+=====================
+
+This file contains the following sections:
+
+OVERVIEW            General description of JPEG and the IJG software.
+LEGAL ISSUES        Copyright, lack of warranty, terms of distribution.
+REFERENCES          Where to learn more about JPEG.
+ARCHIVE LOCATIONS   Where to find newer versions of this software.
+FILE FORMAT WARS    Software *not* to get.
+TO DO               Plans for future IJG releases.
+
+Other documentation files in the distribution are:
+
+User documentation:
+  usage.txt         Usage instructions for cjpeg, djpeg, jpegtran,
+                    rdjpgcom, and wrjpgcom.
+  *.1               Unix-style man pages for programs (same info as usage.txt).
+  wizard.txt        Advanced usage instructions for JPEG wizards only.
+  change.log        Version-to-version change highlights.
+Programmer and internal documentation:
+  libjpeg.txt       How to use the JPEG library in your own programs.
+  example.c         Sample code for calling the JPEG library.
+  structure.txt     Overview of the JPEG library's internal structure.
+  coderules.txt     Coding style rules --- please read if you contribute code.
+
+Please read at least usage.txt.  Some information can also be found in the JPEG
+FAQ (Frequently Asked Questions) article.  See ARCHIVE LOCATIONS below to find
+out where to obtain the FAQ article.
+
+If you want to understand how the JPEG code works, we suggest reading one or
+more of the REFERENCES, then looking at the documentation files (in roughly
+the order listed) before diving into the code.
+
+
+OVERVIEW
+========
+
+This package contains C software to implement JPEG image encoding, decoding,
+and transcoding.  JPEG (pronounced "jay-peg") is a standardized compression
+method for full-color and grayscale images.  JPEG's strong suit is compressing
+photographic images or other types of images that have smooth color and
+brightness transitions between neighboring pixels.  Images with sharp lines or
+other abrupt features may not compress well with JPEG, and a higher JPEG
+quality may have to be used to avoid visible compression artifacts with such
+images.
+
+JPEG is normally lossy, meaning that the output pixels are not necessarily
+identical to the input pixels.  However, on photographic content and other
+"smooth" images, very good compression ratios can be obtained with no visible
+compression artifacts, and extremely high compression ratios are possible if
+you are willing to sacrifice image quality (by reducing the "quality" setting
+in the compressor.)
+
+This software implements JPEG baseline, extended-sequential, progressive, and
+lossless compression processes.  Provision is made for supporting all variants
+of these processes, although some uncommon parameter settings aren't
+implemented yet.  We have made no provision for supporting the hierarchical
+processes defined in the standard.
+
+We provide a set of library routines for reading and writing JPEG image files,
+plus two sample applications "cjpeg" and "djpeg", which use the library to
+perform conversion between JPEG and some other popular image file formats.
+The library is intended to be reused in other applications.
+
+In order to support file conversion and viewing software, we have included
+considerable functionality beyond the bare JPEG coding/decoding capability;
+for example, the color quantization modules are not strictly part of JPEG
+decoding, but they are essential for output to colormapped file formats or
+colormapped displays.  These extra functions can be compiled out of the
+library if not required for a particular application.
+
+We have also included "jpegtran", a utility for lossless transcoding between
+different JPEG processes, and "rdjpgcom" and "wrjpgcom", two simple
+applications for inserting and extracting textual comments in JFIF files.
+
+The emphasis in designing this software has been on achieving portability and
+flexibility, while also making it fast enough to be useful.  In particular,
+the software is not intended to be read as a tutorial on JPEG.  (See the
+REFERENCES section for introductory material.)  Rather, it is intended to
+be reliable, portable, industrial-strength code.  We do not claim to have
+achieved that goal in every aspect of the software, but we strive for it.
+
+We welcome the use of this software as a component of commercial products.
+No royalty is required, but we do ask for an acknowledgement in product
+documentation, as described under LEGAL ISSUES.
+
+
+LEGAL ISSUES
+============
+
+In plain English:
+
+1. We don't promise that this software works.  (But if you find any bugs,
+   please let us know!)
+2. You can use this software for whatever you want.  You don't have to pay us.
+3. You may not pretend that you wrote this software.  If you use it in a
+   program, you must acknowledge somewhere in your documentation that
+   you've used the IJG code.
+
+In legalese:
+
+The authors make NO WARRANTY or representation, either express or implied,
+with respect to this software, its quality, accuracy, merchantability, or
+fitness for a particular purpose.  This software is provided "AS IS", and you,
+its user, assume the entire risk as to its quality and accuracy.
+
+This software is copyright (C) 1991-2020, Thomas G. Lane, Guido Vollbeding.
+All Rights Reserved except as specified below.
+
+Permission is hereby granted to use, copy, modify, and distribute this
+software (or portions thereof) for any purpose, without fee, subject to these
+conditions:
+(1) If any part of the source code for this software is distributed, then this
+README file must be included, with this copyright and no-warranty notice
+unaltered; and any additions, deletions, or changes to the original files
+must be clearly indicated in accompanying documentation.
+(2) If only executable code is distributed, then the accompanying
+documentation must state that "this software is based in part on the work of
+the Independent JPEG Group".
+(3) Permission for use of this software is granted only if the user accepts
+full responsibility for any undesirable consequences; the authors accept
+NO LIABILITY for damages of any kind.
+
+These conditions apply to any software derived from or based on the IJG code,
+not just to the unmodified library.  If you use our work, you ought to
+acknowledge us.
+
+Permission is NOT granted for the use of any IJG author's name or company name
+in advertising or publicity relating to this software or products derived from
+it.  This software may be referred to only as "the Independent JPEG Group's
+software".
+
+We specifically permit and encourage the use of this software as the basis of
+commercial products, provided that all warranty or liability claims are
+assumed by the product vendor.
+
+
+REFERENCES
+==========
+
+We recommend reading one or more of these references before trying to
+understand the innards of the JPEG software.
+
+The best short technical introduction to the JPEG compression algorithm is
+        Wallace, Gregory K.  "The JPEG Still Picture Compression Standard",
+        Communications of the ACM, April 1991 (vol. 34 no. 4), pp. 30-44.
+(Adjacent articles in that issue discuss MPEG motion picture compression,
+applications of JPEG, and related topics.)  If you don't have the CACM issue
+handy, a PDF file containing a revised version of Wallace's article is
+available at http://www.ijg.org/files/Wallace.JPEG.pdf.  The file (actually
+a preprint for an article that appeared in IEEE Trans. Consumer Electronics)
+omits the sample images that appeared in CACM, but it includes corrections
+and some added material.  Note: the Wallace article is copyright ACM and IEEE,
+and it may not be used for commercial purposes.
+
+A somewhat less technical, more leisurely introduction to JPEG can be found in
+"The Data Compression Book" by Mark Nelson and Jean-loup Gailly, published by
+M&T Books (New York), 2nd ed. 1996, ISBN 1-55851-434-1.  This book provides
+good explanations and example C code for a multitude of compression methods
+including JPEG.  It is an excellent source if you are comfortable reading C
+code but don't know much about data compression in general.  The book's JPEG
+sample code is far from industrial-strength, but when you are ready to look
+at a full implementation, you've got one here...
+
+The best currently available description of JPEG is the textbook "JPEG Still
+Image Data Compression Standard" by William B. Pennebaker and Joan L.
+Mitchell, published by Van Nostrand Reinhold, 1993, ISBN 0-442-01272-1.
+Price US$59.95, 638 pp.  The book includes the complete text of the ISO JPEG
+standards (DIS 10918-1 and draft DIS 10918-2).
+
+The original JPEG standard is divided into two parts, Part 1 being the actual
+specification, while Part 2 covers compliance testing methods.  Part 1 is
+titled "Digital Compression and Coding of Continuous-tone Still Images,
+Part 1: Requirements and guidelines" and has document numbers ISO/IEC IS
+10918-1, ITU-T T.81.  Part 2 is titled "Digital Compression and Coding of
+Continuous-tone Still Images, Part 2: Compliance testing" and has document
+numbers ISO/IEC IS 10918-2, ITU-T T.83.
+
+The JPEG standard does not specify all details of an interchangeable file
+format.  For the omitted details, we follow the "JFIF" conventions, revision
+1.02.  JFIF version 1 has been adopted as ISO/IEC 10918-5 (05/2013) and
+Recommendation ITU-T T.871 (05/2011): Information technology - Digital
+compression and coding of continuous-tone still images: JPEG File Interchange
+Format (JFIF).  It is available as a free download in PDF file format from
+https://www.iso.org/standard/54989.html and http://www.itu.int/rec/T-REC-T.871.
+A PDF file of the older JFIF 1.02 specification is available at
+http://www.w3.org/Graphics/JPEG/jfif3.pdf.
+
+The TIFF 6.0 file format specification can be obtained from
+http://mirrors.ctan.org/graphics/tiff/TIFF6.ps.gz.  The JPEG incorporation
+scheme found in the TIFF 6.0 spec of 3-June-92 has a number of serious
+problems.  IJG does not recommend use of the TIFF 6.0 design (TIFF Compression
+tag 6).  Instead, we recommend the JPEG design proposed by TIFF Technical Note
+#2 (Compression tag 7).  Copies of this Note can be obtained from
+http://www.ijg.org/files/.  It is expected that the next revision
+of the TIFF spec will replace the 6.0 JPEG design with the Note's design.
+Although IJG's own code does not support TIFF/JPEG, the free libtiff library
+uses our library to implement TIFF/JPEG per the Note.
+
+
+ARCHIVE LOCATIONS
+=================
+
+The "official" archive site for this software is www.ijg.org.
+The most recent released version can always be found there in
+directory "files".
+
+The JPEG FAQ (Frequently Asked Questions) article is a source of some
+general information about JPEG.  It is available at
+http://www.faqs.org/faqs/jpeg-faq.
+
+
+FILE FORMAT COMPATIBILITY
+=========================
+
+This software implements ITU T.81 | ISO/IEC 10918 with some extensions from
+ITU T.871 | ISO/IEC 10918-5 (JPEG File Interchange Format-- see REFERENCES).
+Informally, the term "JPEG image" or "JPEG file" most often refers to JFIF or
+a subset thereof, but there are other formats containing the name "JPEG" that
+are incompatible with the original JPEG standard or with JFIF (for instance,
+JPEG 2000 and JPEG XR).  This software therefore does not support these
+formats.  Indeed, one of the original reasons for developing this free software
+was to help force convergence on a common, interoperable format standard for
+JPEG files.
+
+JFIF is a minimal or "low end" representation.  TIFF/JPEG (TIFF revision 6.0 as
+modified by TIFF Technical Note #2) can be used for "high end" applications
+that need to record a lot of additional data about an image.
+
+
+TO DO
+=====
+
+Please send bug reports, offers of help, etc. to jpeg-info@jpegclub.org.
diff --git a/crates/jpeg/tests/data/SHA256SUMS b/crates/jpeg/tests/data/SHA256SUMS
new file mode 100644
index 00000000..19c71c54
--- /dev/null
+++ b/crates/jpeg/tests/data/SHA256SUMS
@@ -0,0 +1,11 @@
+4672c7f08864cd0a8c73a4fa4b66ca32b635d38464551c1ecf06564ae8c89b38  testimgari.jpg
+491679b8057739b3c8e5bacd1e918efb1691d271cbbd69820ff8d480dcb90963  testimgari-huffman.jpg
+acc6ec555d41d15b368320edaa3b20958ee6fa97cb6e4a18d1213d5ae8bec73b  testorig.jpg
+34790770f76db8e60a7765b52ca4edf5f16bc21bcb8c6045ca2efef39a8a013e  testorig12.jpg
+62d182ed042e243544d3d753c440ada1a6992464717311fe6efd546632f44dc4  testorig12.ppm
+0031b82a06300b5b5d19ef5553cc39d3fafafa4fbc474199e6cfbc7818312a87  whitetail-ari.jpg
+0f6e17a44be7a005d6610e66f91fa119388dc6b8438e95cb8816b6db58f8c365  whitetail-huffman.jpg
+7e7edd9d9825c2eca1e6ff6dfafeaddec39e2464fc5d6d1ce4a378a59ec3f716  testorig-ari-progressive.jpg
+cb0a2c60e6a89c68ef8cf48854dc09c77c26ffb27ac62e17d343d98f1424cc77  testorig-ari-progressive-restart.jpg
+c4942c4b704d20e27c4cd3e613c6ef975dd7cfe53a756e2c209fa3ad033d8b51  testorig12-ari.jpg
+18df0394115d9f8751939fb9f45a0d330df2ca849e9f8b07d0af76c09b90fcdb  testorig12-ari-progressive.jpg
diff --git a/crates/jpeg/tests/data/SOURCE.md b/crates/jpeg/tests/data/SOURCE.md
new file mode 100644
index 00000000..bc15d764
--- /dev/null
+++ b/crates/jpeg/tests/data/SOURCE.md
@@ -0,0 +1,81 @@
+# Test images
+
+The JPEG files come from libjpeg-turbo 3.0.0, `testimages/`
+(https://github.com/libjpeg-turbo/libjpeg-turbo/tree/3.0.0/testimages), under the IJG License
+(README.ijg in this directory). The other files are derived from them, or made with
+libjpeg-turbo's tools, as described below.
+`SHA256SUMS` lists every file.
+
+| File | What it is |
+|---|---|
+| `testorig.jpg` | 227×149 YCbCr, 2×2 luma sampling, baseline Huffman (SOF0) |
+| `testimgari.jpg` | the same image, arithmetic coded (SOF9), one interleaved scan |
+| `testimgari-huffman.jpg` | `testimgari.jpg` losslessly transcoded to baseline Huffman (SOF0) |
+| `testorig12.jpg` | 227×149 YCbCr, 12-bit extended sequential Huffman (SOF1) |
+| `testorig12.ppm` | libjpeg-turbo's decode of `testorig12.jpg`: 12-bit RGB, binary PPM, maxval 4095 |
+| `testorig-ari-progressive.jpg` | `testorig.jpg` transcoded to progressive arithmetic (SOF10) |
+| `testorig-ari-progressive-restart.jpg` | the same with a restart interval of 3 MCU rows |
+| `testorig12-ari.jpg` | `testorig12.jpg` transcoded to 12-bit arithmetic (SOF9) |
+| `testorig12-ari-progressive.jpg` | `testorig12.jpg` transcoded to 12-bit progressive arithmetic (SOF10) |
+| `whitetail-ari.jpg` | 512×512 gray, arithmetic coded (SOF9), noise in the top 16 rows, white below |
+| `whitetail-huffman.jpg` | `whitetail-ari.jpg` losslessly transcoded to baseline Huffman (SOF0) |
+
+`testimgari.jpg` and `testorig.jpg` share their quantization tables but not their coefficients:
+libjpeg-turbo decodes them to different pixels. `testimgari-huffman.jpg` holds exactly the
+coefficients of `testimgari.jpg`, so the two must decode to identical samples. The same holds
+for each jpegtran transcode below and its source.
+
+## How the derived files were made
+
+`testimgari-huffman.jpg`, with jpegtran from libjpeg-turbo 3.1.0 (Alpine 3.22,
+`libjpeg-turbo-utils-3.1.0-r0`):
+
+```sh
+jpegtran -copy none testimgari.jpg > testimgari-huffman.jpg
+```
+
+The arithmetic transcodes of `testorig.jpg` and `testorig12.jpg`, with jpegtran from
+libjpeg-turbo 3.1.3 (Alpine 3.24, `libjpeg-turbo-utils`):
+
+```sh
+jpegtran -copy none -arithmetic -progressive testorig.jpg > testorig-ari-progressive.jpg
+jpegtran -copy none -arithmetic -progressive -restart 3 testorig.jpg > testorig-ari-progressive-restart.jpg
+jpegtran -copy none -arithmetic testorig12.jpg > testorig12-ari.jpg
+jpegtran -copy none -arithmetic -progressive testorig12.jpg > testorig12-ari-progressive.jpg
+```
+
+`testorig12.ppm`, with libjpeg-turbo 3.2.0 through imagecodecs 2026.10.10 (default settings:
+integer IDCT `JDCT_ISLOW`, fancy upsampling), run as
+`uv run --with imagecodecs --with numpy python make.py testorig12.jpg testorig12.ppm`:
+
+```python
+import sys, imagecodecs, numpy as np
+src, dst = sys.argv[1], sys.argv[2]
+a = imagecodecs.jpeg8_decode(open(src, "rb").read())
+h, w, c = a.shape
+assert c == 3 and a.dtype == np.uint16 and a.max() <= 4095
+with open(dst, "wb") as f:
+    f.write(b"P6\n%d %d\n4095\n" % (w, h))
+    f.write(a.astype(">u2").tobytes())
+```
+
+`djpeg -dct int testorig12.jpg` from libjpeg-turbo 3.1.0 writes a byte-identical file.
+
+`whitetail-ari.jpg` and `whitetail-huffman.jpg`, with cjpeg and jpegtran from libjpeg-turbo 3.1.3
+(Alpine 3.24, `libjpeg-turbo-utils`). libjpeg's arithmetic encoder drops the trailing zero bytes
+of a scan, so the white rows decode almost entirely from zeros supplied at the EOI marker.
+`python3 whitetail.py whitetail.pgm` writes the source image:
+
+```python
+import sys
+w, h, top = 512, 512, 16
+px = bytes(((x * 3 + y * 5) ^ (x * y)) & 0xFF if y < top else 255 for y in range(h) for x in range(w))
+open(sys.argv[1], "wb").write(b"P5\n%d %d\n255\n" % (w, h) + px)
+```
+
+```sh
+cjpeg -arithmetic -quality 75 whitetail.pgm > whitetail-ari.jpg
+jpegtran -copy none whitetail-ari.jpg > whitetail-huffman.jpg
+```
+
+"This software is based in part on the work of the Independent JPEG Group."
diff --git a/crates/jpeg/tests/data/testimgari-huffman.jpg b/crates/jpeg/tests/data/testimgari-huffman.jpg
new file mode 100644
index 00000000..2501c615
Binary files /dev/null and b/crates/jpeg/tests/data/testimgari-huffman.jpg differ
diff --git a/crates/jpeg/tests/data/testimgari.jpg b/crates/jpeg/tests/data/testimgari.jpg
new file mode 100644
index 00000000..89664874
Binary files /dev/null and b/crates/jpeg/tests/data/testimgari.jpg differ
diff --git a/crates/jpeg/tests/data/testorig-ari-progressive-restart.jpg b/crates/jpeg/tests/data/testorig-ari-progressive-restart.jpg
new file mode 100644
index 00000000..10c5081f
Binary files /dev/null and b/crates/jpeg/tests/data/testorig-ari-progressive-restart.jpg differ
diff --git a/crates/jpeg/tests/data/testorig-ari-progressive.jpg b/crates/jpeg/tests/data/testorig-ari-progressive.jpg
new file mode 100644
index 00000000..e814c929
Binary files /dev/null and b/crates/jpeg/tests/data/testorig-ari-progressive.jpg differ
diff --git a/crates/jpeg/tests/data/testorig.jpg b/crates/jpeg/tests/data/testorig.jpg
new file mode 100644
index 00000000..9816a0c6
Binary files /dev/null and b/crates/jpeg/tests/data/testorig.jpg differ
diff --git a/crates/jpeg/tests/data/testorig12-ari-progressive.jpg b/crates/jpeg/tests/data/testorig12-ari-progressive.jpg
new file mode 100644
index 00000000..3a716ea7
Binary files /dev/null and b/crates/jpeg/tests/data/testorig12-ari-progressive.jpg differ
diff --git a/crates/jpeg/tests/data/testorig12-ari.jpg b/crates/jpeg/tests/data/testorig12-ari.jpg
new file mode 100644
index 00000000..66478ad5
Binary files /dev/null and b/crates/jpeg/tests/data/testorig12-ari.jpg differ
diff --git a/crates/jpeg/tests/data/testorig12.jpg b/crates/jpeg/tests/data/testorig12.jpg
new file mode 100644
index 00000000..861aff98
Binary files /dev/null and b/crates/jpeg/tests/data/testorig12.jpg differ
diff --git a/crates/jpeg/tests/data/testorig12.ppm b/crates/jpeg/tests/data/testorig12.ppm
new file mode 100644
index 00000000..df60fe91
Binary files /dev/null and b/crates/jpeg/tests/data/testorig12.ppm differ
diff --git a/crates/jpeg/tests/data/whitetail-ari.jpg b/crates/jpeg/tests/data/whitetail-ari.jpg
new file mode 100644
index 00000000..e7011fb6
Binary files /dev/null and b/crates/jpeg/tests/data/whitetail-ari.jpg differ
diff --git a/crates/jpeg/tests/data/whitetail-huffman.jpg b/crates/jpeg/tests/data/whitetail-huffman.jpg
new file mode 100644
index 00000000..888cc1b6
Binary files /dev/null and b/crates/jpeg/tests/data/whitetail-huffman.jpg differ
diff --git a/crates/jpeg/tests/mutation.rs b/crates/jpeg/tests/mutation.rs
new file mode 100644
index 00000000..41d403d2
--- /dev/null
+++ b/crates/jpeg/tests/mutation.rs
@@ -0,0 +1,131 @@
+//! Deterministic mutation run over the test images and fuzz seeds: decoding corrupted input never panics and
+//! stays within the caller's limits.
+
+use craft_jpeg::{Limits, Samples, decode, frame};
+
+/// Inputs and mutation counts. The 227×149 test images take tens of milliseconds each to decode
+/// in a debug build; the small fuzz seeds (SOF9 with restarts, 12-bit SOF9, SOF10, 12-bit SOF1)
+/// take microseconds and get most of the cases.
+const INPUTS: [(&str, usize); 8] = [
+    ("tests/data/testorig.jpg", 12),
+    ("tests/data/testimgari.jpg", 12),
+    ("tests/data/testimgari-huffman.jpg", 12),
+    ("tests/data/testorig12.jpg", 12),
+    ("fuzz/corpus/decode/sof9-restart.jpg", 75),
+    ("fuzz/corpus/decode/sof9-12bit.jpg", 75),
+    ("fuzz/corpus/decode/sof10-progressive.jpg", 75),
+    ("fuzz/corpus/decode/sof1-12bit.jpg", 75),
+];
+
+/// Room for the 227×149 fixtures, too little for a mutated frame header that grows them much.
+fn test_limits() -> Limits {
+    let mut limits = Limits::default();
+    limits.max_pixels = 1 << 16;
+    limits.max_alloc = 1 << 20;
+    limits
+}
+
+struct Rng(u64);
+
+impl Rng {
+    fn next(&mut self) -> u64 {
+        // xorshift64*
+        self.0 ^= self.0 >> 12;
+        self.0 ^= self.0 << 25;
+        self.0 ^= self.0 >> 27;
+        self.0.wrapping_mul(0x2545_F491_4F6C_DD1D)
+    }
+
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+
+    fn byte(&mut self) -> u8 {
+        self.next() as u8
+    }
+}
+
+/// Offset of the first SOFn segment's body, if any.
+fn sof_body(b: &[u8]) -> Option<usize> {
+    (2..b.len().saturating_sub(1))
+        .find(|&i| b[i] == 0xFF && matches!(b[i + 1], 0xC0..=0xCF) && !matches!(b[i + 1], 0xC4 | 0xC8 | 0xCC))
+        .map(|i| i + 4)
+}
+
+fn mutate(rng: &mut Rng, original: &[u8]) -> Vec<u8> {
+    let mut b = original.to_vec();
+    match rng.below(6) {
+        0 => b.truncate(rng.below(original.len())),
+        1 => {
+            for _ in 0..1 + rng.below(8) {
+                let at = rng.below(b.len());
+                b[at] ^= 1 << rng.below(8);
+            }
+        }
+        2 => {
+            for _ in 0..1 + rng.below(4) {
+                let at = rng.below(b.len());
+                b[at] = rng.byte();
+            }
+        }
+        3 => {
+            // Frame header fields: precision, height, width, component count and the
+            // per-component sampling and table selectors.
+            if let Some(body) = sof_body(&b) {
+                for _ in 0..1 + rng.below(3) {
+                    let at = body + rng.below(15);
+                    if let Some(v) = b.get_mut(at) {
+                        *v = rng.byte();
+                    }
+                }
+            }
+        }
+        4 => {
+            let at = rng.below(b.len());
+            let len = rng.below(64).min(b.len() - at);
+            b.drain(at..at + len);
+        }
+        _ => {
+            // Repeat a span, e.g. a marker segment or part of the entropy-coded data.
+            let at = rng.below(b.len());
+            let len = rng.below(256).min(b.len() - at);
+            let span = b[at..at + len].to_vec();
+            let to = rng.below(b.len());
+            b.splice(to..to, span);
+        }
+    }
+    b
+}
+
+#[test]
+fn mutated_streams_never_panic_and_stay_within_limits() {
+    let mut rng = Rng(0x9E37_79B9_7F4A_7C15);
+    let limits = test_limits();
+    let (mut ok, mut errors) = (0, 0);
+    for (name, cases) in INPUTS {
+        let path = format!("{}/{name}", env!("CARGO_MANIFEST_DIR"));
+        let original = std::fs::read(&path).unwrap_or_else(|e| panic!("{path}: {e}"));
+        assert!(decode(&original, &limits, None).is_ok(), "{name} must decode within the test limits");
+        for case in 0..cases {
+            let bytes = mutate(&mut rng, &original);
+            let _ = frame(&bytes);
+            match decode(&bytes, &limits, None) {
+                Ok(img) => {
+                    let pixels = u64::from(img.width) * u64::from(img.height);
+                    let (len, width) = match &img.samples {
+                        Samples::U8(v) => (v.len() as u64, 1),
+                        Samples::U16(v) => (v.len() as u64, 2),
+                    };
+                    assert!(pixels <= limits.max_pixels, "{name} case {case}: {pixels} pixels");
+                    assert!(len * width <= limits.max_alloc, "{name} case {case}: {} bytes", len * width);
+                    assert_eq!(len, pixels * u64::from(img.components), "{name} case {case}");
+                    ok += 1;
+                }
+                Err(_) => errors += 1,
+            }
+        }
+    }
+    eprintln!("{ok} decoded, {errors} rejected");
+    // A mutation run that only produces errors would no longer reach the entropy decoders.
+    assert!(ok > 50 && errors > 50, "{ok} decoded, {errors} rejected");
+}
diff --git a/crates/keymap/Cargo.toml b/crates/keymap/Cargo.toml
new file mode 100644
index 00000000..292ffe94
--- /dev/null
+++ b/crates/keymap/Cargo.toml
@@ -0,0 +1,35 @@
+[package]
+name = "craft-keymap"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+description = "Keyboard bindings for the Craft suite: chords, keymaps, conflicts, overrides and shortcut-set import"
+
+[lints]
+workspace = true
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+egui = { workspace = true, optional = true }
+craft-ui = { workspace = true, optional = true }
+craft-i18n = { workspace = true, optional = true }
+
+[dev-dependencies]
+# `serde` for setting `RawInput` fields only the suite's egui fork has; `default_fonts` for the
+# dialog's tests.
+egui = { workspace = true, features = ["serde", "default_fonts"] }
+craft-settings = { workspace = true }
+tempfile = "3"
+sha2 = "0.10"
+egui_kittest = "0.37"
+image = { version = "0.25", default-features = false, features = ["png"] }
+
+[features]
+egui = ["dep:egui"]
+# The Keyboard Shortcuts dialog.
+ui = ["egui", "dep:craft-ui", "dep:craft-i18n"]
+# Screenshots of the dialog for review (tests/ui_snapshot.rs; needs a GPU or software adapter).
+snapshot = ["ui", "egui_kittest/wgpu"]
diff --git a/crates/keymap/README.md b/crates/keymap/README.md
new file mode 100644
index 00000000..44a98c24
--- /dev/null
+++ b/crates/keymap/README.md
@@ -0,0 +1,489 @@
+# Craft Keymap
+
+`craft-keymap` holds the data and logic for keyboard bindings in the Craft apps: chords and their
+text forms, bindings from chords to commands, scopes, conflicts, user overrides, named sets, an
+import pipeline for other applications' shortcut sets, and an editor model. Each application
+supplies its command catalog, its file-format readers and its UI.
+
+## Boundaries
+
+- Data and logic, plus a shared Keyboard Shortcuts dialog behind the `ui` feature. The apps keep
+  the command catalog (ids, labels, menu paths, defaults), the readers for other applications'
+  files, file dialogs and running the commands.
+- Never crashes: no panics, no `unsafe`. Loading settings never fails; what cannot be used is
+  kept or reported (`Keymap::problems`, the import report).
+- Hostile input is capped: commands, bindings per command, text lengths, import entries, keys,
+  path segments and fuzzy suggestions (the `MAX_*` constants). What is cut is counted.
+- Reserved chords are opt-in. A keymap reserves no chord unless the app passes a list to
+  `Keymap::with_reserved`, e.g. `reserved::system(platform)` for the operating system's window
+  switching and closing chords. A reserved chord cannot be assigned or bound.
+- Dependencies: `serde` and `serde_json`; `egui` with the `egui` feature; `craft-ui` and
+  `craft-i18n` with the `ui` feature.
+
+## A catalog and dispatch
+
+A command with parameters has the key `window.panel {"panel":"layers"}` in settings and reports.
+Tools of one group share a key and cycle. A binding can name a scope other than the command's
+home scope.
+
+```rust
+use craft_keymap::{Active, Bindable, Binding, Chord, CommandRef, Keymap, Kind, Lookup, Platform, Scope, Scopes};
+use serde_json::json;
+
+let key = |text: &str| Binding::parse(text).unwrap();
+let layers = CommandRef::with_params("window.panel", json!({"panel": "layers"}));
+let select = Kind::Tool { group: Some("select".into()) };
+let catalog = vec![
+    Bindable::new("file.save", "Save", Scope::app()).with_path(vec!["File".into(), "Save".into()]).with_default(key("Cmd+S")),
+    Bindable::new(layers.clone(), "Layers", Scope::app()).with_path(vec!["Window".into(), "Layers".into()]).with_default(key("F7")),
+    Bindable::new("tool.marquee", "Marquee Tool", Scope::app()).with_kind(select.clone()).with_default(key("M")),
+    Bindable::new("tool.ellipse", "Elliptical Marquee Tool", Scope::app()).with_kind(select).with_default(key("M")),
+    // Home scope: the Timeline panel, where it wins over the app's L.
+    Bindable::new("timeline.loop", "Loop", Scope::new("Timeline").unwrap()).with_default(key("L")),
+    Bindable::new("layer.lock", "Lock Layer", Scope::app()).with_default(key("L")),
+    // An app command whose binding works only in the Text context.
+    Bindable::new("type.bold", "Bold", Scope::app()).with_default(key("Text: Cmd+B")),
+];
+let keymap = Keymap::new(catalog, Scopes::new().with_panel("Timeline").with_context("Text"), Platform::Mac);
+
+// Dispatch: the chord pressed, whether it is a double press, and what has the keyboard.
+let press = |text: &str, active: &Active| keymap.lookup(&Chord::parse(text).unwrap(), false, active);
+assert_eq!(press("F7", &Active::NONE), Lookup::Run(layers));
+assert_eq!(press("L", &Active::panel("Timeline")), Lookup::Run("timeline.loop".into()));
+assert_eq!(press("L", &Active::NONE), Lookup::Run("layer.lock".into()));
+assert_eq!(press("M", &Active::NONE), Lookup::Cycle(vec!["tool.marquee".into(), "tool.ellipse".into()]));
+let editing = Active { contexts: &["Text"], typing: true, ..Active::NONE };
+assert_eq!(press("Cmd+B", &editing), Lookup::Run("type.bold".into()));
+assert_eq!(press("M", &editing), Lookup::None, "plain keys go to the text field");
+```
+
+While a text field has the keyboard (`Active::typing`), the keymap's `TypingRule` decides which
+app and panel bindings wait: plain keys (the default), everything without the command modifier,
+or everything. Under every rule, the platform's text-editing chords (`text_editing_chords`) go
+to the field too: undo and redo, select all, and moving and deleting by word, line and text
+(Cmd+Z, Alt+Left and Cmd+Backspace on macOS; Ctrl+Z, Ctrl+Y, Ctrl+Left and Ctrl+Home
+elsewhere). Other command chords, such as Cmd+S, still fire. Bindings in an active context
+always fire, so `Text: Cmd+B` works while typing, and a `Text: Cmd+Z` binding takes undo from
+the field.
+
+With the `egui` feature, `egui::Dispatcher` does this for a frame's key events (see Features).
+
+## Chords
+
+A [`Chord`](src/chord.rs) is a key plus the modifiers `cmd`, `ctrl`, `alt` and `shift`. `cmd` is
+the command modifier: ⌘ on macOS, Ctrl on Windows and Linux. `ctrl` is the Mac Control key; off
+macOS it folds into `cmd` (`Chord::effective`).
+
+- Canonical text, as stored and sent: `Cmd+Ctrl+Alt+Shift+K`, `Cmd++` for Plus, `A A` for a
+  double press.
+- `Chord::parse` also reads common aliases (`⇧⌘Z`, `opt+left`, `Ctrl+Cmd+M`).
+- `Chord::display(Platform)` gives `⇧⌘Z` on macOS and `Ctrl+Shift+Z` elsewhere.
+- `chord::foreign::read_foreign` reads key text written by other applications (Windows or Mac
+  modifier names, numeric keypad keys).
+
+## Keyboard layouts
+
+[`layout`](src/layout.rs) decides which chord a key press means, the same way for matching
+(`Layout::candidates`), the shortcut recorder (`Layout::resolve`) and labels
+(`Chord::display_for`):
+
+1. Letters A–Z: the layout's Latin letter for the key. On a layout that is not Latin (Russian,
+   Arabic, Hebrew, Greek, Thai), the suite's egui reports the Latin layout's character for each
+   key: Ctrl+С on Dvorak + Russian is Dvorak's Ctrl+J, and Ctrl+Й, `'` on Dvorak, runs no letter
+   binding. Without that report, the letter the toolkit reports for shortcuts, else the key's
+   position. On a Latin layout (Dvorak, AZERTY), the letter typed. Arabic Ctrl+Shift+D is
+   Ctrl+Shift+D, not the `]` it types.
+2. Digits: the digit typed, else the key's position (AZERTY's `&é"` row). A digit-row key that
+   types punctuation also matches its digit when the punctuation has no binding.
+3. Punctuation: the character typed, without Shift when the layout needs Shift for it: German
+   `/` is ⇧7, so ⇧⌘7 runs ⌘/.
+4. Whether a layout is Latin is decided for the layout, not per key.
+5. With Shift held on a Latin layout, a press that egui reports as the letter at its own
+   position, because the character typed has no key (Dvorak's ⇧, types `<`), runs nothing when
+   that position has been seen typing something other than its letter: once a `,` has been
+   typed, Ctrl+Shift+, never runs Ctrl+Shift+W. A change in the reported Latin status clears
+   what the positions typed; an app that learns of a layout switch itself calls
+   `Layout::forget_letters`.
+6. Labels show letters and digits by name, and a punctuation key as the character the layout
+   types at its position when that character has no key of its own (`Ctrl+Ü` for Ctrl+[ on
+   German).
+
+A `KeyInput` holds what the toolkit reports for one press: modifiers, the key typed, the
+physical key, and, when the platform reports them, the layout's Latin letter (Windows
+virtual-key code, macOS ⌘ table, Linux Latin layout group) and whether Shift was needed. A
+`Layout` holds whether the layout is Latin, as the platform reports it or as plain typing shows
+it (`Layout::observe`), and the characters it types at punctuation positions.
+
+## Storing overrides
+
+`Overrides` is a field of the app's settings type. It is stored as a map of one text per command
+(`{ "file.save": "Cmd+Alt+S", "edit.copy": "" }`, `""` for no shortcut) while no command has more
+than one binding, so apps that stored that map before keep reading it in older builds. Once a
+command has several bindings it is stored as an array of `{ command, keys }` tables
+(`[{ command = "file.save", keys = ["Cmd+Alt+S", "F12"] }]`). Both forms load, and in the map form
+a list of texts loads too.
+
+In a craft-settings type, put `#[serde(with = "craft_keymap::keymap::overrides_list")]` on the
+field, which always writes the array: craft-settings merges tables key by key with what the file
+holds but replaces an array whole, so only the array lets a reset command (an entry removed) stay
+removed after saving. Hand-written `[[shortcuts]]` blocks load as the array.
+
+Texts the keymap cannot use (a key name from a newer version, an unknown scope, a reserved chord)
+stay in the entry when the command is edited, unless the edit leaves it without bindings.
+`Keymap::problems` lists them.
+
+```rust
+use craft_keymap::{Binding, Keymap, Overrides, Platform, Policy, Scopes};
+use craft_settings::{Location, Settings, SettingsStore};
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Default, Clone, PartialEq)]
+#[serde(default)]
+struct Prefs {
+    #[serde(with = "craft_keymap::keymap::overrides_list")]
+    shortcuts: Overrides,
+}
+
+impl Settings for Prefs {
+    const APP_ID: &'static str = "acmecraft";
+    const SCHEMA_VERSION: u32 = 1;
+}
+
+// `catalog` is the app's Vec<Bindable>.
+let (mut store, _report) = SettingsStore::<Prefs>::open(Location::Auto);
+let mut keymap = Keymap::new(catalog, Scopes::new(), Platform::current()).with_overrides(store.get().shortcuts.clone());
+// Entries for unknown commands and texts that do not parse are kept and listed here.
+let _problems = keymap.problems();
+
+// After each change in the shortcut editor:
+keymap.set_bindings(&"file.save".into(), vec![Binding::parse("Cmd+Alt+S").unwrap()], Policy::Steal).ok();
+store.update(|p| p.shortcuts = keymap.overrides().clone());
+```
+
+## Editing
+
+- `set_bindings(&command, bindings, policy)` replaces a command's bindings. An editor with one
+  shortcut per command calls it with the one binding (`vec![binding]`); `assign` adds a binding
+  to those the command has.
+- `remove` takes one binding away, `clear` leaves the command without shortcuts, `reset` gives it
+  its defaults back and `reset_all` does so for every command.
+- `Policy` says what happens to other commands holding the chord: `Steal` takes it from them,
+  `Keep` lets both keep it and reports the clash, `Refuse` changes nothing and returns
+  `AssignError::Taken`.
+- `conflicts()` lists every pair of commands on one chord; `conflicts_with(&command)` lists the
+  commands that share one command's chords, with that command as `a`.
+
+## Shortcut sets
+
+`Profiles` holds the user's named sets of overrides and which one is active. The app's built-in
+sets (`&[(&str, Overrides)]`, the first one the default) are passed to each call and never change.
+An app with sets stores only `Profiles`, in place of the `Overrides` field above: the keymap's
+overrides are the active set's, and the dialog's OK stores them there. The sets, and each set's
+overrides, are stored as arrays, so a deleted set or entry leaves a craft-settings file.
+
+```rust
+use craft_keymap::{Keymap, Platform, Profiles, Scopes};
+use craft_settings::{Location, SettingsStore};
+
+#[derive(Serialize, Deserialize, Default, Clone, PartialEq)]
+#[serde(default)]
+struct Prefs {
+    shortcut_sets: Profiles,
+}
+
+// `builtins` is the app's &[(&str, Overrides)], the first set the default.
+let (mut store, _report) = SettingsStore::<Prefs>::open(Location::Auto);
+let mut sets = store.get().shortcut_sets.clone();
+sets.reconcile(&builtins);
+let keymap = Keymap::new(catalog, Scopes::new(), Platform::current()).with_overrides(sets.active_overrides(&builtins).clone());
+
+// The dialog edits `sets` and `keymap`. On Outcome::Ok (or Changed, to save live):
+store.update(|p| p.shortcut_sets = sets.clone());
+```
+
+- `names`, `get`, `active_name`, `active_overrides` (hand them to `Keymap::set_overrides`);
+  `sets` (the user's sets) and `active` (the stored name, which `active_name` resolves to a set).
+- `select` switches sets; `duplicate(from, to)` copies a built-in or user set; `save_as`,
+  `rename` and `delete` work on user sets only.
+- `store(overrides, builtins, copy_name)` saves the editor's result to the active set. Editing a
+  built-in set makes a user copy named after `copy_name`, which becomes active.
+- New names are made unique (`Custom 2`, `Custom 3`) and compare without case. A user set named
+  like a built-in added later is renamed by `reconcile`.
+- `export(name)` writes one set as JSON
+  (`{"format":"craft-keymap","version":1,"name":…,"overrides":…}`); `import(text)` reads it into
+  a new set. A file from a newer version is refused (`ProfileError::NewerVersion`).
+- Loading never fails. `problems()` lists what loading dropped: sets with a bad or repeated name,
+  overrides that are neither a list nor a map, sets past `MAX_SETS`, and a `version` newer than
+  this crate writes. The app shows them before the next save writes the sets without them.
+  Stored `Profiles` carry `version = 1`; a file without it reads as version 1.
+- `import_plan(&plan, &keymap, name)` applies an import plan (see Importing a shortcut set) to a
+  copy of the keymap and keeps the result as a new set, so another application's set becomes one
+  the user can switch to and away from.
+
+```rust
+use craft_keymap::{Overrides, Profiles};
+
+let mut classic = Overrides::new();
+classic.insert("edit.copy", vec!["Cmd+Shift+C".into()]);
+let builtins = [("Craft", Overrides::new()), ("Classic", classic)];
+let mut sets = Profiles::default();
+assert_eq!(sets.active_name(&builtins), "Craft");
+
+sets.duplicate("Classic", "Mine", &builtins).unwrap();
+let text = sets.export("Mine", &builtins).unwrap();
+assert_eq!(sets.import(&text, &builtins), Ok("Mine 2".into()));
+assert_eq!(sets.active_overrides(&builtins), sets.get("Mine", &builtins).unwrap());
+```
+
+## Importing a shortcut set
+
+The app's reader turns a file (an InDesign Show Set, an Illustrator `.kys`) into an
+[`import::ForeignSet`](src/import.rs): entries with a menu, a path and keys read by
+`ForeignKey::read`. The reader builds it with `ForeignSet::new(entries)`, `with_name` and
+`with_truncated`; the struct is `#[non_exhaustive]`, so struct literals outside the crate do not
+compile. `import::plan` matches each entry to one command and changes nothing;
+`ImportPlan::apply` applies the plan and returns an `ImportReport` (serde, camelCase). Report
+rows carry the entry's `item` (its path) and `line`.
+
+```rust
+use craft_keymap::{Bindable, Binding, ContextRule, Flavor, ForeignEntry, ForeignKey, ForeignSet, ImportOptions, Keymap, Platform};
+use craft_keymap::{Scope, Scopes, plan};
+
+let save = Bindable::new("file.save", "Save", Scope::app())
+    .with_path(vec!["File".into(), "Save".into()])
+    .with_default(Binding::parse("Cmd+S").unwrap());
+let mut keymap = Keymap::new(vec![save], Scopes::new(), Platform::Windows);
+
+let read = |text: &str| ForeignKey::read(Some("Default"), text, Flavor::Windows);
+let set = ForeignSet::new(vec![
+    ForeignEntry::new(Some("File"), ["Save"]).with_key(read("Ctrl+Alt+S")).at_line(12),
+    ForeignEntry::new(Some("File"), ["Frobnicate"]).with_key(read("Ctrl+F")).at_line(13),
+])
+.with_name("My Set");
+let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], ..ImportOptions::default() };
+let planned = plan(&set, &keymap, &options);
+// A review UI can show planned.commands and planned.report here.
+let report = planned.apply(&mut keymap);
+assert_eq!(report.changed[0].to, ["Cmd+Alt+S"]);
+assert_eq!((report.unmatched[0].item.as_str(), report.unmatched[0].line), ("File > Frobnicate", Some(13)));
+```
+
+- Matching, most specific first, each step needing exactly one command: the user's remembered
+  answers, the full menu path, the joined submenu segments as a label or alias in that menu, the
+  label in that menu, the joined segments as a label or alias anywhere, the label anywhere. An
+  entry with no menu and several segments matches only by its full path, unless the reader marks
+  it `in_panel_menu()`. Tool entries match only tools.
+- Names are compared after `import::normalize_label`: case, `…`, `...`, `&`, colons and extra
+  spaces aside, so the alias `Preferences: General…` matches `Edit > Preferences > General...`.
+  Aliases (`Bindable::with_alias`) count wherever labels do, and import paths
+  (`Bindable::with_import_path`, such as `["Tools", label]` for a tool) wherever menu paths do;
+  the dialog makes no areas or groups from import paths.
+- Panel menus: sources list panel-menu items with the panel's name in front (InDesign's Panel
+  Menus area writes `Character: All Caps`; Illustrator and Photoshop sets have similar areas).
+  The reader splits the name into segments and marks the entry `ForeignEntry::in_panel_menu()`.
+  Such an entry also matches a catalog path that ends with its segments (with the command's
+  label or the path's last segment last), and its last segment alone as a label. The last
+  segment alone counts only when the first segment, the panel, is a segment of some catalog
+  path, so `History: New Document` matches nothing in an app without a History panel. An entry
+  without keys that matched only these ways leaves the command's shortcuts alone and is listed
+  in `matched_without_change` (reason `PanelMenu`).
+- Show/Hide: a source often lists one toggle as two items, `Show Rulers` and `Hide Rulers`. Names
+  are matched as written first. When no step finds a command, the steps run again on commands
+  marked `Bindable::toggle()`, with a leading `Show `, `Hide ` or `Show/Hide ` dropped from the
+  entry's label and from the command's label, aliases and path labels. A command not marked as a
+  toggle never matches through a dropped prefix, so `Hide Conveyor` does not match `Conveyor`.
+- `ImportOptions.contexts` says what each source context becomes (home scope, another scope, the
+  home scope only without a home entry, or skipped).
+- The set wins: a chord it gives to a command is taken from commands outside it (except twins
+  sharing it as a default), a later entry takes a chord from an earlier one (as when the entries
+  are applied in file order; the earlier key is listed in `skipped`), and an entry without keys
+  can clear its command. It clears it only when no entry matched to the same command has keys,
+  whatever the order of the entries.
+- Keys read approximately (a numeric keypad key bound as the main key) are listed in
+  `approximated`.
+- With `ImportOptions.suggest`, unmatched entries get fuzzy candidates (`import::namematch`);
+  they are reported, never applied. Only the first 200 unmatched entries with keys get them, and
+  only the first 200 characters of a name are compared. Keys in `ContextRule::Skip` contexts do
+  not count: an unmatched entry with only such keys counts in `unmatched_without_shortcut`.
+- `truncated` counts what was cut at the caps (`MAX_IMPORT_ENTRIES` and the others), plus the
+  entries the app's reader dropped at its own limits, which it passes as `ForeignSet.truncated`.
+
+## Editor
+
+`editor` is the model behind a shortcut dialog; the app draws it.
+
+- `EditSession::begin(&keymap)` when the dialog opens. Each change is one undo step:
+  `assign`, `replace` (record over one key of a command), `remove`, `clear`, `reset`, `reset_all`,
+  or any keymap edit through `session.edit(&mut keymap, |km| …)`. `undo`, `redo`, `cancel` (back
+  to the state at open) and `is_modified`.
+- Conflicts: `editor::holders(&keymap, &command, &binding)` lists the commands that hold the key
+  while the user records; `Keymap::conflicts_with(&command)` marks the rows whose keys are
+  shared after a `Keep`. Assigning with `Policy::Refuse` returns `AssignError::Taken` and changes
+  nothing; the user's answer is a second call with `Policy::Steal` or `Policy::Keep`.
+- `Recorder::press(chord, time)` gives `Single`, `Double` (the same chord again within
+  `DOUBLE_PRESS`, 0.6 s) or `Cancel` (Escape).
+- `editor::search(&keymap, query, platform)` filters the catalog by label, alias, menu path,
+  command id and key text, canonical or as shown on `platform`.
+
+```rust
+use craft_keymap::editor::holders;
+use craft_keymap::{AssignError, Binding, Chord, EditSession, Policy, Recorded, Recorder};
+
+// `keymap` is the app's Keymap, `now` the input time in seconds.
+let mut session = EditSession::begin(&keymap);
+let mut recorder = Recorder::new();
+let save = "file.save".into();
+// The user presses Cmd+C in the shortcut field of Save.
+if let Recorded::Single(trigger) = recorder.press(Chord::parse("Cmd+C").unwrap(), now) {
+    let binding = Binding::new(trigger);
+    let _shown = holders(&keymap, &save, &binding);
+    if let Err(AssignError::Taken(_)) = session.assign(&mut keymap, &save, binding.clone(), Policy::Refuse) {
+        // The user chose to take the key from Copy.
+        session.assign(&mut keymap, &save, binding, Policy::Steal).ok();
+    }
+}
+// OK: store `keymap.overrides()` (`Profiles::store` for sets). Cancel:
+session.cancel(&mut keymap);
+```
+
+## Shortcuts dialog
+
+With the `ui` feature, `ui::ShortcutsDialog` draws the Keyboard Shortcuts dialog over a `Keymap`
+and, optionally, `Profiles`: a table of the catalog grouped by menu, recording, conflicts, undo,
+named sets, import review and a summary. It edits the keymap in place, so menus show new keys at
+once, and Cancel puts everything back as it was when the dialog opened.
+
+Adopt it in three steps:
+
+1. Build the `Keymap` from the catalog and keep the built-in sets (`Builtins`), as above.
+2. While the dialog is open, keep a `DialogState` and call `show` (a window) or `ui` (the body,
+   for the app's own modal or preferences page) every frame.
+3. Act on the `Outcome` it returns, and drop the state when `is_open()` turns false.
+
+Apps that import other applications' sets read each file into a `ForeignSet` built with
+`ForeignSet::new` ([Importing a shortcut set](#importing-a-shortcut-set)).
+
+```rust,ignore
+use craft_keymap::ui::{DialogState, I18nText, Options, Outcome, ShortcutsDialog};
+
+// "Keyboard Shortcuts…" opens it; "Edit Shortcut…" also calls `state.select(&command)`.
+self.shortcuts = Some(DialogState::new());
+
+// Every frame, before the app's own dispatch:
+if let Some(state) = &mut self.shortcuts {
+    let text = I18nText { i18n: &self.i18n, lang: self.lang };
+    let dialog = ShortcutsDialog::new(&mut self.keymap, &text).options(&self.shortcut_options);
+    let dialog = dialog.sets(&mut self.settings.shortcut_sets, &BUILTINS);
+    match dialog.show(ctx, state) {
+        Some(Outcome::Ok) => self.save_settings(),
+        // After each edit, and after a Cancel that undid edits.
+        Some(Outcome::Changed) => self.rebuild_menus(),
+        Some(Outcome::Import { formats }) => self.pick_import_file(formats),
+        Some(Outcome::Export { name, json }) => self.save_file(&name, json),
+        Some(Outcome::Summary { name, html, .. }) => self.show_summary(&name, html),
+        Some(Outcome::Remembered(answers)) => self.settings.import_answers.extend(answers),
+        _ => {}
+    }
+    if !state.is_open() {
+        self.shortcuts = None;
+    }
+}
+```
+
+Outcomes:
+
+| Outcome | The app |
+|---|---|
+| `Ok` | Saves `Profiles` (with sets) or `keymap.overrides()`. |
+| `Cancel` | Nothing to save: the keymap and the sets are as they were at open. When Cancel undid edits, `Changed` follows. |
+| `Changed` | Updates its menus, or saves at once if it saves live. It comes after each edit and after a Cancel that undid edits. When a frame also has another outcome, `Changed` comes on the next frame; `is_open()` stays true until it has. |
+| `Import { formats }` | Opens a file of one of the formats, then calls `import_json` (craft-keymap JSON, `ui::JSON_FORMAT`) or reads it into a `ForeignSet` and calls `review_import`. |
+| `Export { name, json }`, `ExportAs { format, name, keymap }` | Writes the set where the user chooses (a download on the web). |
+| `Summary { name, html, text }` | Shows, saves or prints the summary. |
+| `Remembered(answers)` | Keeps the user's import answers for the next import (`ImportOptions::remembered`). |
+
+The crate never opens a file dialog or touches the file system. When the app's own step fails
+while the dialog is open (a file it cannot read), `state.show_error(text)` shows the translated
+message under the table until the user dismisses it or the next action replaces it.
+
+Key dispatch while the dialog is open:
+
+- Skip `Dispatcher::dispatch` while `DialogState::is_open()` is true. The dialog takes the
+  frame's key, text and clipboard events itself while it records, so the chord the user presses
+  reaches the recorder and runs nothing.
+- A native macOS menu handles its key equivalents before egui sees them, so Cmd+Q, Cmd+, and
+  the other menu chords never reach the recorder. While `is_recording()` is true, pause them:
+  feed them to egui as key presses, or rebuild the menu without accelerators.
+
+Words come from `ui::Text`. Apps on craft-i18n pass `I18nText`; others implement `ui` and
+`plural` over their own lookup, and `rtl` and `visual` (the app's bidi reordering) for
+right-to-left languages, which mirror the layout. Chord text is never reordered. `ui::STRINGS`
+and `ui::PLURALS` list every string the dialog looks up, for the translation catalog.
+`Options` sets the conflict mode, double-press recording, area tabs, the on-screen keyboard,
+read-only rows for keys outside the catalog, the app's import and export formats, an `accept`
+rule for which keys a command may get, and a `visible` rule for which catalog entries the table
+lists (hidden entries keep their keys and still count in conflicts).
+
+## Features
+
+- `egui`: conversions to and from egui keys and modifiers; `KeyInput::from_egui`;
+  `egui::matches`, which accepts the shifted key egui reports for a Shift binding (`Shift+;`
+  matches `:`); and `egui::Dispatcher`, which runs a frame's key presses against the keymap,
+  reading them by the layout it learns from typing or is given (`with_layout`, `layout()`):
+
+  ```rust,ignore
+  let hits = ctx.input_mut(|i| dispatcher.dispatch(i, &keymap, &active));
+  for hit in hits {
+      app.run(&hit.command);
+  }
+  ```
+
+  A press that runs a command is removed from egui's events, with the text it typed, so widgets
+  do not see it too. Each `Hit` carries the `trigger` that matched and `exact`, which is false
+  when the press matched through a stand-in (`:` for `Shift+;`, `+` for `=`).
+  `dispatch_filtered` takes a predicate that can decline a hit, for example a chord the native
+  menu has already handled: the press and its text then stay in egui's events, in their place.
+  While a text field has the keyboard, plain clipboard key presses and presses that typed text in the
+  same frame stay with it. That covers AltGr, which a browser on Windows reports as Ctrl+Alt
+  followed by the text; a Ctrl+Alt press that types nothing is a command chord.
+  `Dispatcher::new().with_repeat(true)` also runs commands on key repeats (held arrows).
+
+  On the desktop, egui-winit sends egui's Copy, Cut and Paste events in place of the key press
+  for any chord of Cmd with C, X or V (Ctrl off macOS); the web build sends the press and then
+  the event. For the plain chords Cmd+C, Cmd+X and Cmd+V (and Cmd+Insert, Shift+Delete,
+  Shift+Insert), the events stay with the app by default, so a binding on those chords runs only
+  with `with_clipboard_events(true)`. Then the events count as their chords outside text fields,
+  and a Paste event's text moves to `Hit::pasted`. On the web, the press runs the command and
+  takes the event, with its text, along. An app whose paste command asks egui for a paste gets a
+  Paste event back, which runs that command again; such an app keeps the default. A clipboard
+  event with more modifiers held (Cmd+Shift+V, Cmd+Alt+C) always counts as its chord, also while
+  typing, and stays when that chord has no binding. egui-winit sends no Paste event when the
+  clipboard is empty or holds an image, so a binding on a Cmd+V chord cannot run then on the
+  desktop.
+
+- `ui`: the Shortcuts dialog (see above). Implies `egui`.
+- `snapshot` (development): `tests/ui_snapshot.rs` writes PNGs of the dialog to
+  `CRAFT_KEYMAP_SNAPSHOT_DIR` for review, using the same font input as the dialog tests.
+
+### Fonts for UI tests
+
+Apps own their runtime font setup, including coverage of the Mac key symbols displayed by the
+Shortcuts dialog. The library does not install or replace an app's fonts.
+
+UI tests need an absolute `CRAFT_FONTS_DIR` pointing to a checkout of
+[`craft-fonts`](https://github.com/storytold/craft-fonts) at
+`b076417b5880bd4154bd22f00695b1d28c6bea83`. For example, after preparing that checkout:
+
+```sh
+CRAFT_FONTS_DIR=/absolute/path/to/craft-fonts cargo test -p craft-keymap --features ui --locked
+```
+
+Dialog tests and requested snapshots share a helper that verifies the SHA256 of
+`fonts/noto-sans-symbols/NotoSansSymbols.ttf` and
+`fonts/noto-sans-symbols-2/NotoSansSymbols2-Regular.ttf`, then appends these and egui's bundled
+Hack as fallbacks before the first layout pass. It checks printable ASCII, the full key-symbol
+and dialog-icon repertoire, and the accented pseudolocale in both default font families.
+Missing inputs, changed bytes and missing glyphs fail the tests; no system font probing or tofu
+fallback is used. Linux, macOS and Windows keymap CI supply this exact checkout. The WASM
+compile-only job needs no runtime font files. Optional screenshots still require their output
+directory and a graphics adapter; they are review images, not golden comparisons.
diff --git a/crates/keymap/src/chord.rs b/crates/keymap/src/chord.rs
new file mode 100644
index 00000000..df1ecb51
--- /dev/null
+++ b/crates/keymap/src/chord.rs
@@ -0,0 +1,681 @@
+//! Keys, modifiers, chords and their text forms.
+//!
+//! Canonical text is `Cmd+Ctrl+Alt+Shift+Key`, written by [`Chord`]'s `Display` and read back by
+//! [`Chord::parse`]. A double press is the chord twice, separated by a space: `A A`.
+
+use std::fmt;
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+use crate::layout::Layout;
+
+pub mod foreign;
+
+/// The longest chord or trigger text [`Chord::parse`] and [`Trigger::parse`] accept, in bytes.
+pub const MAX_CHORD_TEXT: usize = 64;
+
+/// The platform a keymap is used on. It decides display text and whether `ctrl` folds into `cmd`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+#[non_exhaustive]
+pub enum Platform {
+    Mac,
+    Windows,
+    Linux,
+}
+
+impl Platform {
+    /// The platform this build runs on. Web builds count as Linux; with the `egui` feature,
+    /// `egui::platform` gives the browser's operating system.
+    pub const fn current() -> Platform {
+        if cfg!(target_os = "macos") {
+            Platform::Mac
+        } else if cfg!(target_os = "windows") {
+            Platform::Windows
+        } else {
+            Platform::Linux
+        }
+    }
+
+    pub const fn is_mac(self) -> bool {
+        matches!(self, Platform::Mac)
+    }
+}
+
+macro_rules! keys {
+    ($($variant:ident => $name:literal),* $(,)?) => {
+        /// A key on the keyboard, independent of any UI toolkit.
+        ///
+        /// Digits are the main row; numeric keypad keys map to the same keys.
+        #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+        #[non_exhaustive]
+        pub enum Key {
+            $($variant),*
+        }
+
+        impl Key {
+            /// Every key, in declaration order.
+            pub const ALL: &'static [Key] = &[$(Key::$variant),*];
+
+            /// The canonical name: `K`, `5`, `F5`, `PageUp`, `;`.
+            pub const fn name(self) -> &'static str {
+                match self {
+                    $(Key::$variant => $name),*
+                }
+            }
+
+            // The Rust variant name, which is also egui's `Key` variant name except for arrows.
+            const fn variant_name(self) -> &'static str {
+                match self {
+                    $(Key::$variant => stringify!($variant)),*
+                }
+            }
+        }
+    };
+}
+
+keys! {
+    A => "A", B => "B", C => "C", D => "D", E => "E", F => "F", G => "G", H => "H", I => "I",
+    J => "J", K => "K", L => "L", M => "M", N => "N", O => "O", P => "P", Q => "Q", R => "R",
+    S => "S", T => "T", U => "U", V => "V", W => "W", X => "X", Y => "Y", Z => "Z",
+    Num0 => "0", Num1 => "1", Num2 => "2", Num3 => "3", Num4 => "4",
+    Num5 => "5", Num6 => "6", Num7 => "7", Num8 => "8", Num9 => "9",
+    F1 => "F1", F2 => "F2", F3 => "F3", F4 => "F4", F5 => "F5", F6 => "F6", F7 => "F7",
+    F8 => "F8", F9 => "F9", F10 => "F10", F11 => "F11", F12 => "F12", F13 => "F13",
+    F14 => "F14", F15 => "F15", F16 => "F16", F17 => "F17", F18 => "F18", F19 => "F19",
+    F20 => "F20", F21 => "F21", F22 => "F22", F23 => "F23", F24 => "F24", F25 => "F25",
+    F26 => "F26", F27 => "F27", F28 => "F28", F29 => "F29", F30 => "F30", F31 => "F31",
+    F32 => "F32", F33 => "F33", F34 => "F34", F35 => "F35",
+    Escape => "Escape", Tab => "Tab", Backspace => "Backspace", Enter => "Enter",
+    Space => "Space", Insert => "Insert", Delete => "Delete", Home => "Home", End => "End",
+    PageUp => "PageUp", PageDown => "PageDown",
+    Up => "Up", Down => "Down", Left => "Left", Right => "Right",
+    Minus => "-", Equals => "=", Plus => "+", OpenBracket => "[", CloseBracket => "]",
+    Backslash => "\\", Semicolon => ";", Quote => "'", Backtick => "`",
+    Comma => ",", Period => ".", Slash => "/",
+    Colon => ":", Pipe => "|", Questionmark => "?", Exclamationmark => "!",
+    OpenCurlyBracket => "{", CloseCurlyBracket => "}",
+}
+
+/// Key aliases beyond the canonical and egui variant names. Matched without regard to ASCII case.
+const KEY_ALIASES: &[(&str, Key)] = &[
+    ("esc", Key::Escape),
+    ("⎋", Key::Escape),
+    ("return", Key::Enter),
+    ("⏎", Key::Enter),
+    ("↩", Key::Enter),
+    ("del", Key::Delete),
+    ("⌦", Key::Delete),
+    ("⌫", Key::Backspace),
+    ("⇥", Key::Tab),
+    ("pgup", Key::PageUp),
+    ("pgdn", Key::PageDown),
+    ("page up", Key::PageUp),
+    ("page down", Key::PageDown),
+    ("arrowup", Key::Up),
+    ("arrowdown", Key::Down),
+    ("arrowleft", Key::Left),
+    ("arrowright", Key::Right),
+    ("↑", Key::Up),
+    ("↓", Key::Down),
+    ("←", Key::Left),
+    ("→", Key::Right),
+    ("spacebar", Key::Space),
+    ("ins", Key::Insert),
+    ("equal", Key::Equals),
+    ("grave", Key::Backtick),
+    ("backquote", Key::Backtick),
+    ("apostrophe", Key::Quote),
+    // The minus sign menus and docs print (U+2212), not the hyphen-minus the key types.
+    ("−", Key::Minus),
+];
+
+impl Key {
+    /// Reads a key name: canonical (`K`, `PageUp`, `;`), egui variant names (`ArrowUp`, `Num5`,
+    /// `Semicolon`) and the aliases `esc`, `return`, `del`, `pgup`, `pgdn`, `spacebar`, `ins`,
+    /// the Mac key glyphs and the minus sign `−`. Case does not matter.
+    pub fn parse(name: &str) -> Option<Key> {
+        Key::ALL
+            .iter()
+            .copied()
+            .find(|k| k.name().eq_ignore_ascii_case(name) || k.variant_name().eq_ignore_ascii_case(name))
+            .or_else(|| KEY_ALIASES.iter().find(|(alias, _)| alias.eq_ignore_ascii_case(name)).map(|&(_, k)| k))
+    }
+
+    /// `A` to `Z`.
+    pub const fn is_letter(self) -> bool {
+        matches!(
+            self,
+            Key::A
+                | Key::B
+                | Key::C
+                | Key::D
+                | Key::E
+                | Key::F
+                | Key::G
+                | Key::H
+                | Key::I
+                | Key::J
+                | Key::K
+                | Key::L
+                | Key::M
+                | Key::N
+                | Key::O
+                | Key::P
+                | Key::Q
+                | Key::R
+                | Key::S
+                | Key::T
+                | Key::U
+                | Key::V
+                | Key::W
+                | Key::X
+                | Key::Y
+                | Key::Z
+        )
+    }
+
+    /// `0` to `9`.
+    pub const fn is_digit(self) -> bool {
+        matches!(self, Key::Num0 | Key::Num1 | Key::Num2 | Key::Num3 | Key::Num4 | Key::Num5 | Key::Num6 | Key::Num7 | Key::Num8 | Key::Num9)
+    }
+
+    /// Punctuation and symbol keys: `-`, `=`, `+`, brackets, `\`, `;`, `'`, `` ` ``, `,`, `.`,
+    /// `/` and the shifted symbols `:`, `|`, `?`, `!`, `{`, `}`.
+    pub const fn is_symbol(self) -> bool {
+        matches!(
+            self,
+            Key::Minus
+                | Key::Equals
+                | Key::Plus
+                | Key::OpenBracket
+                | Key::CloseBracket
+                | Key::Backslash
+                | Key::Semicolon
+                | Key::Quote
+                | Key::Backtick
+                | Key::Comma
+                | Key::Period
+                | Key::Slash
+                | Key::Colon
+                | Key::Pipe
+                | Key::Questionmark
+                | Key::Exclamationmark
+                | Key::OpenCurlyBracket
+                | Key::CloseCurlyBracket
+        )
+    }
+
+    /// The letter, digit or symbol key for a typed character, ignoring case.
+    pub fn from_char(c: char) -> Option<Key> {
+        let mut buf = [0; 4];
+        let text: &str = c.encode_utf8(&mut buf);
+        Key::ALL.iter().copied().find(|k| (k.is_letter() || k.is_digit() || k.is_symbol()) && k.name().eq_ignore_ascii_case(text))
+    }
+
+    /// `F1` to `F35`.
+    pub const fn is_function_key(self) -> bool {
+        matches!(
+            self,
+            Key::F1
+                | Key::F2
+                | Key::F3
+                | Key::F4
+                | Key::F5
+                | Key::F6
+                | Key::F7
+                | Key::F8
+                | Key::F9
+                | Key::F10
+                | Key::F11
+                | Key::F12
+                | Key::F13
+                | Key::F14
+                | Key::F15
+                | Key::F16
+                | Key::F17
+                | Key::F18
+                | Key::F19
+                | Key::F20
+                | Key::F21
+                | Key::F22
+                | Key::F23
+                | Key::F24
+                | Key::F25
+                | Key::F26
+                | Key::F27
+                | Key::F28
+                | Key::F29
+                | Key::F30
+                | Key::F31
+                | Key::F32
+                | Key::F33
+                | Key::F34
+                | Key::F35
+        )
+    }
+
+    /// The key as macOS menus show it: arrows and editing keys as glyphs.
+    pub(crate) fn mac_symbol(self) -> &'static str {
+        match self {
+            Key::Up => "↑",
+            Key::Down => "↓",
+            Key::Left => "←",
+            Key::Right => "→",
+            Key::Enter => "⏎",
+            Key::Backspace => "⌫",
+            Key::Delete => "⌦",
+            Key::Escape => "⎋",
+            Key::Tab => "⇥",
+            k => k.text_name(),
+        }
+    }
+
+    /// The key as Windows and Linux show it.
+    pub(crate) fn text_name(self) -> &'static str {
+        match self {
+            Key::PageUp => "Page Up",
+            Key::PageDown => "Page Down",
+            k => k.name(),
+        }
+    }
+}
+
+impl fmt::Display for Key {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(self.name())
+    }
+}
+
+impl Serialize for Key {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(self.name())
+    }
+}
+
+impl<'de> Deserialize<'de> for Key {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Key, D::Error> {
+        let text = <std::borrow::Cow<'de, str>>::deserialize(deserializer)?;
+        if text.len() > MAX_CHORD_TEXT {
+            return Err(serde::de::Error::custom(ParseError::TooLong));
+        }
+        Key::parse(&text).ok_or_else(|| serde::de::Error::custom(ParseError::UnknownKey(text.into_owned())))
+    }
+}
+
+/// Modifier keys held with a chord's key.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
+pub struct Mods {
+    /// The command modifier: ⌘ on macOS, Ctrl on Windows and Linux.
+    pub cmd: bool,
+    /// The Control key on macOS. Off macOS it folds into `cmd`.
+    pub ctrl: bool,
+    /// Alt, Option on macOS.
+    pub alt: bool,
+    pub shift: bool,
+}
+
+impl Mods {
+    pub const NONE: Mods = Mods { cmd: false, ctrl: false, alt: false, shift: false };
+    pub const CMD: Mods = Mods { cmd: true, ctrl: false, alt: false, shift: false };
+    pub const CTRL: Mods = Mods { cmd: false, ctrl: true, alt: false, shift: false };
+    pub const ALT: Mods = Mods { cmd: false, ctrl: false, alt: true, shift: false };
+    pub const SHIFT: Mods = Mods { cmd: false, ctrl: false, alt: false, shift: true };
+
+    pub const fn is_none(self) -> bool {
+        !(self.cmd || self.ctrl || self.alt || self.shift)
+    }
+
+    /// The modifiers as `platform` sees them: off macOS `ctrl` becomes `cmd`.
+    pub const fn effective(self, platform: Platform) -> Mods {
+        if platform.is_mac() || !self.ctrl { self } else { Mods { cmd: true, ctrl: false, ..self } }
+    }
+}
+
+/// A key with modifiers.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct Chord {
+    pub mods: Mods,
+    pub key: Key,
+}
+
+/// Why chord or trigger text was refused.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum ParseError {
+    Empty,
+    /// Longer than [`MAX_CHORD_TEXT`].
+    TooLong,
+    /// Modifiers with no key, or a trailing `+`.
+    MissingKey,
+    UnknownKey(String),
+    UnknownModifier(String),
+    DuplicateModifier(String),
+    /// Two different chords: key sequences are not supported.
+    Sequence,
+}
+
+impl fmt::Display for ParseError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            ParseError::Empty => f.write_str("empty shortcut"),
+            ParseError::TooLong => write!(f, "shortcut longer than {MAX_CHORD_TEXT} bytes"),
+            ParseError::MissingKey => f.write_str("shortcut has no key"),
+            ParseError::UnknownKey(k) => write!(f, "unknown key `{k}`"),
+            ParseError::UnknownModifier(m) => write!(f, "unknown modifier `{m}`"),
+            ParseError::DuplicateModifier(m) => write!(f, "modifier `{m}` given twice"),
+            ParseError::Sequence => f.write_str("key sequences are not supported"),
+        }
+    }
+}
+
+impl std::error::Error for ParseError {}
+
+#[derive(Clone, Copy)]
+enum Modifier {
+    Cmd,
+    Ctrl,
+    Alt,
+    Shift,
+}
+
+fn modifier_named(name: &str) -> Option<Modifier> {
+    const NAMES: &[(&str, Modifier)] = &[
+        ("cmd", Modifier::Cmd),
+        ("command", Modifier::Cmd),
+        ("meta", Modifier::Cmd),
+        ("super", Modifier::Cmd),
+        ("mod", Modifier::Cmd),
+        ("⌘", Modifier::Cmd),
+        ("ctrl", Modifier::Ctrl),
+        ("control", Modifier::Ctrl),
+        ("ctl", Modifier::Ctrl),
+        ("⌃", Modifier::Ctrl),
+        ("alt", Modifier::Alt),
+        ("opt", Modifier::Alt),
+        ("option", Modifier::Alt),
+        ("⌥", Modifier::Alt),
+        ("shift", Modifier::Shift),
+        ("⇧", Modifier::Shift),
+    ];
+    NAMES.iter().find(|(n, _)| n.eq_ignore_ascii_case(name)).map(|&(_, m)| m)
+}
+
+/// A modifier glyph at the start of `text`, and the text after it.
+fn strip_glyph(text: &str) -> Option<(Modifier, &str)> {
+    let mut chars = text.chars();
+    let m = match chars.next()? {
+        '⌘' => Modifier::Cmd,
+        '⌃' => Modifier::Ctrl,
+        '⌥' => Modifier::Alt,
+        '⇧' => Modifier::Shift,
+        _ => return None,
+    };
+    Some((m, chars.as_str()))
+}
+
+fn add_modifier(mods: &mut Mods, m: Modifier, written: &str) -> Result<(), ParseError> {
+    let slot = match m {
+        Modifier::Cmd => &mut mods.cmd,
+        Modifier::Ctrl => &mut mods.ctrl,
+        Modifier::Alt => &mut mods.alt,
+        Modifier::Shift => &mut mods.shift,
+    };
+    if *slot {
+        return Err(ParseError::DuplicateModifier(written.to_owned()));
+    }
+    *slot = true;
+    Ok(())
+}
+
+impl Chord {
+    pub const fn new(mods: Mods, key: Key) -> Chord {
+        Chord { mods, key }
+    }
+
+    /// The key with no modifiers.
+    pub const fn plain(key: Key) -> Chord {
+        Chord { mods: Mods::NONE, key }
+    }
+
+    /// Reads canonical text (`Cmd+Shift+Z`) and the common aliases: modifier words in any order
+    /// and case (`cmd command meta super mod`, `ctrl control ctl`, `alt opt option`, `shift`),
+    /// Mac glyphs, glued (`⇧⌘Z`) or with `+`, and the key names [`Key::parse`] reads. `Cmd++` is
+    /// Cmd with the Plus key.
+    pub fn parse(text: &str) -> Result<Chord, ParseError> {
+        if text.len() > MAX_CHORD_TEXT {
+            return Err(ParseError::TooLong);
+        }
+        let mut rest = text.trim();
+        if rest.is_empty() {
+            return Err(ParseError::Empty);
+        }
+        let mut mods = Mods::NONE;
+        // Each pass consumes at least one byte, so the loop ends within MAX_CHORD_TEXT passes.
+        loop {
+            if let Some((m, after)) = strip_glyph(rest) {
+                add_modifier(&mut mods, m, rest.get(..rest.len() - after.len()).unwrap_or_default())?;
+                // `⌘+K` and `⌘K` are the same; in `⌘+` the `+` is the key.
+                rest = match after.strip_prefix('+') {
+                    Some(r) if !r.is_empty() => r,
+                    _ => after,
+                };
+                if rest.trim().is_empty() {
+                    return Err(ParseError::MissingKey);
+                }
+                continue;
+            }
+            // A `+` in first position is the Plus key, never a separator.
+            let first = rest.chars().next().map_or(0, char::len_utf8);
+            let separator = rest.get(first..).and_then(|r| r.find('+')).map(|i| i + first);
+            match separator {
+                Some(i) => {
+                    let token = rest.get(..i).unwrap_or_default().trim();
+                    let after = rest.get(i + 1..).unwrap_or_default();
+                    if after.trim().is_empty() {
+                        return Err(ParseError::MissingKey);
+                    }
+                    let m = modifier_named(token).ok_or_else(|| ParseError::UnknownModifier(token.to_owned()))?;
+                    add_modifier(&mut mods, m, token)?;
+                    rest = after;
+                }
+                None => {
+                    let token = rest.trim();
+                    if modifier_named(token).is_some() {
+                        return Err(ParseError::MissingKey);
+                    }
+                    let key = Key::parse(token).ok_or_else(|| ParseError::UnknownKey(token.to_owned()))?;
+                    return Ok(Chord { mods, key });
+                }
+            }
+        }
+    }
+
+    /// Canonical text, the same as `to_string()`: `Cmd+Ctrl+Alt+Shift+Key`.
+    pub fn portable(&self) -> String {
+        self.to_string()
+    }
+
+    /// The chord as `platform` sees it: off macOS `ctrl` folds into `cmd`. Lookups and conflict
+    /// checks compare effective chords.
+    pub const fn effective(self, platform: Platform) -> Chord {
+        Chord { mods: self.mods.effective(platform), key: self.key }
+    }
+
+    /// Text for menus and settings: `⌃⌥⇧⌘K` on macOS, `Ctrl+Alt+Shift+K` elsewhere.
+    pub fn display(&self, platform: Platform) -> String {
+        self.display_key(platform, None)
+    }
+
+    /// [`display`](Self::display) for the keys of `layout`: a punctuation key shows the character
+    /// the layout types at its position when that character has no key of its own (`Ctrl+Ü` for
+    /// Ctrl+[ on German). Letters and digits show as in `display`.
+    pub fn display_for(&self, platform: Platform, layout: &Layout) -> String {
+        self.display_key(platform, layout.key_label(self.key).as_deref())
+    }
+
+    fn display_key(&self, platform: Platform, key_text: Option<&str>) -> String {
+        let m = self.mods.effective(platform);
+        let mut s = String::new();
+        if platform.is_mac() {
+            for (on, glyph) in [(m.ctrl, "⌃"), (m.alt, "⌥"), (m.shift, "⇧"), (m.cmd, "⌘")] {
+                if on {
+                    s.push_str(glyph);
+                }
+            }
+            s.push_str(key_text.unwrap_or(self.key.mac_symbol()));
+        } else {
+            for (on, name) in [(m.cmd, "Ctrl+"), (m.alt, "Alt+"), (m.shift, "Shift+")] {
+                if on {
+                    s.push_str(name);
+                }
+            }
+            s.push_str(key_text.unwrap_or(self.key.text_name()));
+        }
+        s
+    }
+
+    pub const fn is_function_key(&self) -> bool {
+        self.key.is_function_key()
+    }
+
+    /// No cmd, ctrl or alt. Shift alone still counts as plain: such chords are tool keys that
+    /// typing in a text field would trigger.
+    pub const fn is_plain(&self) -> bool {
+        !(self.mods.cmd || self.mods.ctrl || self.mods.alt)
+    }
+
+    /// Holds the command modifier: cmd, or ctrl (Control on macOS, folded into cmd elsewhere).
+    pub const fn has_command(&self) -> bool {
+        self.mods.cmd || self.mods.ctrl
+    }
+}
+
+impl From<Key> for Chord {
+    fn from(key: Key) -> Chord {
+        Chord::plain(key)
+    }
+}
+
+impl fmt::Display for Chord {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        for (on, name) in [(self.mods.cmd, "Cmd+"), (self.mods.ctrl, "Ctrl+"), (self.mods.alt, "Alt+"), (self.mods.shift, "Shift+")] {
+            if on {
+                f.write_str(name)?;
+            }
+        }
+        f.write_str(self.key.name())
+    }
+}
+
+impl std::str::FromStr for Chord {
+    type Err = ParseError;
+    fn from_str(s: &str) -> Result<Chord, ParseError> {
+        Chord::parse(s)
+    }
+}
+
+impl Serialize for Chord {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.collect_str(self)
+    }
+}
+
+impl<'de> Deserialize<'de> for Chord {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Chord, D::Error> {
+        let text = <std::borrow::Cow<'de, str>>::deserialize(deserializer)?;
+        Chord::parse(&text).map_err(serde::de::Error::custom)
+    }
+}
+
+/// What starts a command: a chord, pressed once or twice in a row.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct Trigger {
+    pub chord: Chord,
+    /// The chord pressed twice.
+    pub double: bool,
+}
+
+impl Trigger {
+    pub const fn single(chord: Chord) -> Trigger {
+        Trigger { chord, double: false }
+    }
+
+    pub const fn double(chord: Chord) -> Trigger {
+        Trigger { chord, double: true }
+    }
+
+    /// Reads a chord as [`Chord::parse`] does, or the same chord twice separated by whitespace
+    /// (`A A`) as a double press. Two different chords are [`ParseError::Sequence`].
+    pub fn parse(text: &str) -> Result<Trigger, ParseError> {
+        if text.len() > MAX_CHORD_TEXT {
+            return Err(ParseError::TooLong);
+        }
+        let single = match Chord::parse(text) {
+            Ok(chord) => return Ok(Trigger::single(chord)),
+            Err(e) => e,
+        };
+        let mut parts = text.split_whitespace();
+        match (parts.next(), parts.next(), parts.next()) {
+            (Some(first), Some(second), None) => {
+                let (first, second) = (Chord::parse(first)?, Chord::parse(second)?);
+                if first == second { Ok(Trigger::double(first)) } else { Err(ParseError::Sequence) }
+            }
+            _ => Err(single),
+        }
+    }
+
+    /// Canonical text, the same as `to_string()`.
+    pub fn portable(&self) -> String {
+        self.to_string()
+    }
+
+    pub const fn effective(self, platform: Platform) -> Trigger {
+        Trigger { chord: self.chord.effective(platform), double: self.double }
+    }
+
+    /// [`Chord::display`], twice with a space between for a double press.
+    pub fn display(&self, platform: Platform) -> String {
+        let one = self.chord.display(platform);
+        if self.double { format!("{one} {one}") } else { one }
+    }
+
+    /// [`Chord::display_for`], twice with a space between for a double press.
+    pub fn display_for(&self, platform: Platform, layout: &Layout) -> String {
+        let one = self.chord.display_for(platform, layout);
+        if self.double { format!("{one} {one}") } else { one }
+    }
+}
+
+impl From<Chord> for Trigger {
+    fn from(chord: Chord) -> Trigger {
+        Trigger::single(chord)
+    }
+}
+
+impl fmt::Display for Trigger {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        if self.double { write!(f, "{0} {0}", self.chord) } else { write!(f, "{}", self.chord) }
+    }
+}
+
+impl std::str::FromStr for Trigger {
+    type Err = ParseError;
+    fn from_str(s: &str) -> Result<Trigger, ParseError> {
+        Trigger::parse(s)
+    }
+}
+
+impl Serialize for Trigger {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.collect_str(self)
+    }
+}
+
+impl<'de> Deserialize<'de> for Trigger {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Trigger, D::Error> {
+        let text = <std::borrow::Cow<'de, str>>::deserialize(deserializer)?;
+        Trigger::parse(&text).map_err(serde::de::Error::custom)
+    }
+}
diff --git a/crates/keymap/src/chord/foreign.rs b/crates/keymap/src/chord/foreign.rs
new file mode 100644
index 00000000..0c3a2a73
--- /dev/null
+++ b/crates/keymap/src/chord/foreign.rs
@@ -0,0 +1,196 @@
+//! Key text as other applications write it in their shortcut files and menus.
+//!
+//! Windows sets name the command modifier `Ctrl`; Mac sets name it `Cmd` and use `Ctrl` for the
+//! Control key. [`read_foreign`] reads either into a [`Trigger`], tolerating separators
+//! (`+`, `-`, space), spelled-out key names (`Page Down`, `Up Arrow`) and numeric keypad keys.
+
+use serde::{Deserialize, Serialize};
+
+use super::{Chord, Key, MAX_CHORD_TEXT, Mods, Trigger};
+
+/// Which modifier naming a shortcut set uses.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Flavor {
+    /// `Ctrl` is the command modifier.
+    Windows,
+    /// `Cmd` is the command modifier and `Ctrl` the Control key.
+    Mac,
+}
+
+impl Flavor {
+    /// Mac when any text names cmd, command, opt or option, or uses ⌘ or ⌥; Windows otherwise.
+    pub fn detect<I, S>(texts: I) -> Flavor
+    where
+        I: IntoIterator<Item = S>,
+        S: AsRef<str>,
+    {
+        let mac = texts.into_iter().any(|t| {
+            let t = t.as_ref();
+            t.contains(['⌘', '⌥']) || {
+                let lower = t.to_ascii_lowercase();
+                lower.contains("cmd") || lower.contains("command") || lower.contains("opt")
+            }
+        });
+        if mac { Flavor::Mac } else { Flavor::Windows }
+    }
+}
+
+/// Something [`read_foreign`] changed while reading that an import report may mention.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum ReadNote {
+    /// A numeric keypad key was read as the main key of the same name.
+    Numpad,
+}
+
+/// Why foreign key text could not be read.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum ForeignError {
+    Empty,
+    /// Longer than [`MAX_CHORD_TEXT`].
+    TooLong,
+    UnknownKey(String),
+    /// A modifier with no counterpart here, such as the Windows key.
+    UnsupportedModifier(String),
+}
+
+impl std::fmt::Display for ForeignError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ForeignError::Empty => f.write_str("empty shortcut"),
+            ForeignError::TooLong => write!(f, "shortcut longer than {MAX_CHORD_TEXT} bytes"),
+            ForeignError::UnknownKey(k) => write!(f, "unknown key `{k}`"),
+            ForeignError::UnsupportedModifier(m) => write!(f, "unsupported modifier `{m}`"),
+        }
+    }
+}
+
+impl std::error::Error for ForeignError {}
+
+#[derive(Clone, Copy)]
+enum Word {
+    Command,
+    Control,
+    Alt,
+    Shift,
+    Unsupported,
+}
+
+const GLYPHS: &[(char, Word)] = &[('⌘', Word::Command), ('⌃', Word::Control), ('⌥', Word::Alt), ('⇧', Word::Shift)];
+
+// Longer words first where one is a prefix of another.
+const WORDS: &[(&str, Word)] = &[
+    ("command", Word::Command),
+    ("cmd", Word::Command),
+    ("control", Word::Control),
+    ("ctrl", Word::Control),
+    ("option", Word::Alt),
+    ("opt", Word::Alt),
+    ("alt", Word::Alt),
+    ("shift", Word::Shift),
+    ("windows", Word::Unsupported),
+    ("win", Word::Unsupported),
+    ("meta", Word::Unsupported),
+    ("super", Word::Unsupported),
+];
+
+/// Key names some applications use that [`Key::parse`] does not read. Compared after removing
+/// whitespace and lower-casing.
+const FOREIGN_KEYS: &[(&str, Key)] = &[
+    ("uparrow", Key::Up),
+    ("downarrow", Key::Down),
+    ("leftarrow", Key::Left),
+    ("rightarrow", Key::Right),
+    ("pageup", Key::PageUp),
+    ("pagedown", Key::PageDown),
+    ("⇞", Key::PageUp),
+    ("⇟", Key::PageDown),
+    ("↖", Key::Home),
+    ("↘", Key::End),
+    ("⌤", Key::Enter),
+    ("forwarddelete", Key::Delete),
+    ("help", Key::Insert),
+];
+
+/// Reads one shortcut as another application writes it: `Shift+Ctrl+S`, `Ctrl+Num 5`,
+/// `Page Down`, `⇧⌘S`, `Opt-Left`. `flavor` decides what `Ctrl` means. The notes say what was
+/// approximated.
+pub fn read_foreign(text: &str, flavor: Flavor) -> Result<(Trigger, Vec<ReadNote>), ForeignError> {
+    if text.len() > MAX_CHORD_TEXT {
+        return Err(ForeignError::TooLong);
+    }
+    let mut rest = text.trim();
+    if rest.is_empty() {
+        return Err(ForeignError::Empty);
+    }
+    let mut mods = Mods::NONE;
+    // Each pass consumes at least one byte.
+    'strip: loop {
+        for &(glyph, word) in GLYPHS {
+            if let Some(after) = rest.strip_prefix(glyph) {
+                apply(&mut mods, word, flavor, rest.get(..glyph.len_utf8()).unwrap_or_default())?;
+                let after = after.trim_start();
+                rest = match after.strip_prefix('+') {
+                    Some(r) if !r.trim().is_empty() => r.trim_start(),
+                    _ => after,
+                };
+                continue 'strip;
+            }
+        }
+        for &(name, word) in WORDS {
+            let (Some(head), Some(after)) = (rest.get(..name.len()), rest.get(name.len()..)) else { continue };
+            // A modifier word needs a separator and a key after it: `Alt` alone is a key name.
+            let mut chars = after.chars();
+            if head.eq_ignore_ascii_case(name) && matches!(chars.next(), Some('+' | '-' | ' ')) && !chars.as_str().trim().is_empty() {
+                apply(&mut mods, word, flavor, head)?;
+                rest = after_separator(chars.as_str());
+                continue 'strip;
+            }
+        }
+        break;
+    }
+    let (key, numpad) = foreign_key(rest).ok_or_else(|| ForeignError::UnknownKey(rest.trim().to_owned()))?;
+    let notes = if numpad { vec![ReadNote::Numpad] } else { Vec::new() };
+    Ok((Trigger::single(Chord::new(mods, key)), notes))
+}
+
+/// The text after a modifier word and its first separator; `Ctrl + S` reads like `Ctrl+S`.
+fn after_separator(after: &str) -> &str {
+    let after = after.trim_start();
+    match after.strip_prefix(['+', '-']) {
+        Some(r) if !r.trim().is_empty() => r.trim_start(),
+        _ => after,
+    }
+}
+
+fn apply(mods: &mut Mods, word: Word, flavor: Flavor, written: &str) -> Result<(), ForeignError> {
+    match word {
+        Word::Command => mods.cmd = true,
+        Word::Control if flavor == Flavor::Mac => mods.ctrl = true,
+        Word::Control => mods.cmd = true,
+        Word::Alt => mods.alt = true,
+        Word::Shift => mods.shift = true,
+        Word::Unsupported => return Err(ForeignError::UnsupportedModifier(written.to_owned())),
+    }
+    Ok(())
+}
+
+/// The key a foreign key name stands for, and whether it was on the numeric keypad.
+fn foreign_key(name: &str) -> Option<(Key, bool)> {
+    let squashed: String = name.chars().filter(|c| !c.is_whitespace()).collect::<String>().to_ascii_lowercase();
+    if squashed.is_empty() {
+        return None;
+    }
+    // egui reports keypad keys as the main keys, so `Num 5` binds `5`.
+    let keypad = squashed.strip_prefix("numpad").or_else(|| squashed.strip_prefix("num")).filter(|r| !r.is_empty() && *r != "lock");
+    let (n, numpad) = match keypad {
+        Some(r) => (r, true),
+        None => (squashed.as_str(), false),
+    };
+    let key = FOREIGN_KEYS.iter().find(|(alias, _)| *alias == n).map(|&(_, k)| k).or_else(|| Key::parse(n))?;
+    Some((key, numpad))
+}
diff --git a/crates/keymap/src/command.rs b/crates/keymap/src/command.rs
new file mode 100644
index 00000000..d297e7bc
--- /dev/null
+++ b/crates/keymap/src/command.rs
@@ -0,0 +1,127 @@
+//! Commands with parameters and their binding keys.
+
+use std::fmt;
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+/// Longest binding key [`CommandRef::parse_key`] accepts, in bytes.
+pub const MAX_KEY: usize = 256;
+
+/// A command id with the parameters a binding runs it with.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CommandRef {
+    pub id: String,
+    /// `Null` for no parameters.
+    #[serde(default)]
+    pub params: Value,
+}
+
+impl CommandRef {
+    /// A command without parameters.
+    pub fn new(id: impl Into<String>) -> CommandRef {
+        CommandRef { id: id.into(), params: Value::Null }
+    }
+
+    pub fn with_params(id: impl Into<String>, params: Value) -> CommandRef {
+        CommandRef { id: id.into(), params }
+    }
+
+    /// The binding key: the id, or `id {json}` with object keys sorted and no spaces. `Null` and
+    /// an empty object give the bare id.
+    pub fn key(&self) -> String {
+        match &self.params {
+            Value::Null => self.id.clone(),
+            Value::Object(m) if m.is_empty() => self.id.clone(),
+            p => {
+                let mut out = String::with_capacity(self.id.len() + 16);
+                out.push_str(&self.id);
+                out.push(' ');
+                write_canonical(p, &mut out);
+                out
+            }
+        }
+    }
+
+    /// Reads a binding key: the id up to the first space, then JSON parameters. `None` for an
+    /// empty id, a key over [`MAX_KEY`] bytes or parameters that are not JSON.
+    pub fn parse_key(key: &str) -> Option<CommandRef> {
+        if key.len() > MAX_KEY {
+            return None;
+        }
+        let (id, params) = match key.split_once(' ') {
+            Some((id, rest)) => (id, serde_json::from_str(rest).ok()?),
+            None => (key, Value::Null),
+        };
+        if id.is_empty() || id.chars().any(char::is_whitespace) {
+            return None;
+        }
+        Some(CommandRef { id: id.to_string(), params })
+    }
+}
+
+impl fmt::Display for CommandRef {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.key())
+    }
+}
+
+impl From<&str> for CommandRef {
+    fn from(id: &str) -> CommandRef {
+        CommandRef::new(id)
+    }
+}
+
+// Written by hand so the key does not depend on serde_json's map order: an app's dependency graph
+// may turn on `preserve_order`.
+fn write_canonical(v: &Value, out: &mut String) {
+    match v {
+        Value::Null => out.push_str("null"),
+        Value::Bool(b) => out.push_str(if *b { "true" } else { "false" }),
+        Value::Number(n) => out.push_str(&n.to_string()),
+        Value::String(s) => write_string(s, out),
+        Value::Array(items) => {
+            out.push('[');
+            for (i, item) in items.iter().enumerate() {
+                if i > 0 {
+                    out.push(',');
+                }
+                write_canonical(item, out);
+            }
+            out.push(']');
+        }
+        Value::Object(map) => {
+            let mut keys: Vec<&String> = map.keys().collect();
+            keys.sort();
+            out.push('{');
+            for (i, k) in keys.into_iter().enumerate() {
+                if i > 0 {
+                    out.push(',');
+                }
+                write_string(k, out);
+                out.push(':');
+                if let Some(item) = map.get(k) {
+                    write_canonical(item, out);
+                }
+            }
+            out.push('}');
+        }
+    }
+}
+
+fn write_string(s: &str, out: &mut String) {
+    out.push('"');
+    for c in s.chars() {
+        match c {
+            '"' => out.push_str("\\\""),
+            '\\' => out.push_str("\\\\"),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            c if (c as u32) < 0x20 => out.push_str(&format!("\\u{:04x}", c as u32)),
+            c => out.push(c),
+        }
+    }
+    out.push('"');
+}
diff --git a/crates/keymap/src/editor.rs b/crates/keymap/src/editor.rs
new file mode 100644
index 00000000..e71f687c
--- /dev/null
+++ b/crates/keymap/src/editor.rs
@@ -0,0 +1,254 @@
+//! The model behind a shortcut editor: an edit session with undo, a chord recorder, conflict
+//! queries and search.
+//!
+//! A shortcut dialog drives it like this:
+//!
+//! ```
+//! use craft_keymap::editor::holders;
+//! use craft_keymap::{AssignError, Bindable, Binding, Chord, EditSession, Keymap, Platform, Policy, Recorded, Recorder, Scope, Scopes};
+//!
+//! let catalog = vec![
+//!     Bindable::new("file.save", "Save", Scope::app()).with_default(Binding::parse("Cmd+S").unwrap()),
+//!     Bindable::new("edit.copy", "Copy", Scope::app()).with_default(Binding::parse("Cmd+C").unwrap()),
+//! ];
+//! let mut keymap = Keymap::new(catalog, Scopes::new(), Platform::Mac);
+//! let now = 12.5;
+//!
+//! let mut session = EditSession::begin(&keymap);
+//! let mut recorder = Recorder::new();
+//! let save = "file.save".into();
+//! // The user presses Cmd+C in the shortcut field of Save.
+//! if let Recorded::Single(trigger) = recorder.press(Chord::parse("Cmd+C").unwrap(), now) {
+//!     let binding = Binding::new(trigger);
+//!     assert_eq!(holders(&keymap, &save, &binding)[0].command, "edit.copy".into());
+//!     if let Err(AssignError::Taken(_)) = session.assign(&mut keymap, &save, binding.clone(), Policy::Refuse) {
+//!         // The user chose to take the key from Copy.
+//!         session.assign(&mut keymap, &save, binding, Policy::Steal).ok();
+//!     }
+//! }
+//! assert!(keymap.bindings(&"edit.copy".into()).is_empty());
+//! // OK: store `keymap.overrides()` (`Profiles::store` for sets). Cancel:
+//! session.cancel(&mut keymap);
+//! assert_eq!(keymap.bindings(&"edit.copy".into()), [Binding::parse("Cmd+C").unwrap()]);
+//! ```
+
+use std::collections::VecDeque;
+
+use crate::chord::{Chord, Key, Platform, Trigger};
+use crate::command::CommandRef;
+use crate::keymap::{AssignError, Assigned, Bindable, Binding, Holder, Keymap, Overrides, Policy};
+
+/// Undo steps an [`EditSession`] keeps; older ones are dropped.
+pub const MAX_UNDO: usize = 500;
+/// Most bytes of undo snapshots an [`EditSession`] keeps (keys and texts, plus a fixed estimate
+/// per entry and per text for their allocations); older steps are dropped, though the latest one
+/// always stays.
+pub const MAX_UNDO_BYTES: usize = 64 << 20;
+
+/// Seconds within which a second press of the same chord counts as a double press.
+pub const DOUBLE_PRESS: f64 = 0.6;
+
+/// One opening of a shortcut editor: the overrides it started from, and undo and redo as
+/// snapshots of [`Overrides`].
+#[derive(Clone, Debug)]
+pub struct EditSession {
+    start: Overrides,
+    /// Snapshots with their [`size`].
+    undo: VecDeque<(Overrides, usize)>,
+    undo_bytes: usize,
+    redo: Vec<Overrides>,
+}
+
+/// Heap bytes a snapshot entry costs beyond its strings' bytes: the key's `String`, the list and
+/// the map node, estimated.
+const ENTRY_OVERHEAD: usize = size_of::<String>() + 64;
+/// Bytes a text costs beyond its own: its `String` and allocator rounding, estimated.
+const TEXT_OVERHEAD: usize = size_of::<String>() + 16;
+
+/// The estimated bytes of a snapshot, so many short texts count as more than their length.
+fn size(o: &Overrides) -> usize {
+    o.iter().map(|(k, texts)| ENTRY_OVERHEAD + k.len() + texts.iter().map(|t| TEXT_OVERHEAD + t.len()).sum::<usize>()).sum()
+}
+
+impl EditSession {
+    /// Starts a session on `keymap`'s current overrides; [`cancel`](Self::cancel) returns to them.
+    pub fn begin(keymap: &Keymap) -> EditSession {
+        EditSession { start: keymap.overrides().clone(), undo: VecDeque::new(), undo_bytes: 0, redo: Vec::new() }
+    }
+
+    /// Runs one edit. When it changes the overrides it becomes an undo step and clears redo.
+    pub fn edit<R>(&mut self, keymap: &mut Keymap, f: impl FnOnce(&mut Keymap) -> R) -> R {
+        let before = keymap.overrides().clone();
+        let out = f(keymap);
+        if *keymap.overrides() != before {
+            self.push_undo(before);
+            self.redo.clear();
+        }
+        out
+    }
+
+    /// Adds a binding as one undo step. With [`Policy::Refuse`] a chord other commands hold gives
+    /// [`AssignError::Taken`] and changes nothing, so the dialog can ask whether to steal or keep;
+    /// the answer is a second call with [`Policy::Steal`] or [`Policy::Keep`].
+    pub fn assign(&mut self, keymap: &mut Keymap, command: &CommandRef, binding: Binding, policy: Policy) -> Result<Assigned, AssignError> {
+        self.edit(keymap, |km| km.assign(command, binding, policy))
+    }
+
+    /// Replaces one binding of a command with another as one undo step, as when the user records
+    /// over a key in the list. Conflicts follow `policy` as in [`EditSession::assign`].
+    pub fn replace(
+        &mut self,
+        keymap: &mut Keymap,
+        command: &CommandRef,
+        old: &Binding,
+        new: Binding,
+        policy: Policy,
+    ) -> Result<Assigned, AssignError> {
+        let list: Vec<Binding> = keymap.bindings(command).into_iter().map(|b| if b == *old { new.clone() } else { b }).collect();
+        self.edit(keymap, |km| km.set_bindings(command, list, policy))
+    }
+
+    /// Removes one binding of a command as one undo step.
+    pub fn remove(&mut self, keymap: &mut Keymap, command: &CommandRef, binding: &Binding) -> bool {
+        self.edit(keymap, |km| km.remove(command, binding))
+    }
+
+    /// Leaves a command without bindings as one undo step.
+    pub fn clear(&mut self, keymap: &mut Keymap, command: &CommandRef) -> bool {
+        self.edit(keymap, |km| km.clear(command))
+    }
+
+    /// Gives a command its default bindings back as one undo step.
+    pub fn reset(&mut self, keymap: &mut Keymap, command: &CommandRef) -> bool {
+        self.edit(keymap, |km| km.reset(command))
+    }
+
+    /// Gives every command its defaults as one undo step.
+    pub fn reset_all(&mut self, keymap: &mut Keymap) {
+        self.edit(keymap, Keymap::reset_all);
+    }
+
+    fn push_undo(&mut self, snapshot: Overrides) {
+        let bytes = size(&snapshot);
+        self.undo.push_back((snapshot, bytes));
+        self.undo_bytes += bytes;
+        while self.undo.len() > 1 && (self.undo.len() > MAX_UNDO || self.undo_bytes > MAX_UNDO_BYTES) {
+            if let Some((_, b)) = self.undo.pop_front() {
+                self.undo_bytes -= b;
+            }
+        }
+    }
+
+    /// Reverts the last edit; false when there is none.
+    pub fn undo(&mut self, keymap: &mut Keymap) -> bool {
+        let Some((previous, bytes)) = self.undo.pop_back() else { return false };
+        self.undo_bytes -= bytes;
+        self.redo.push(keymap.overrides().clone());
+        keymap.set_overrides(previous);
+        true
+    }
+
+    /// Applies the last undone edit again; false when there is none.
+    pub fn redo(&mut self, keymap: &mut Keymap) -> bool {
+        let Some(next) = self.redo.pop() else { return false };
+        self.push_undo(keymap.overrides().clone());
+        keymap.set_overrides(next);
+        true
+    }
+
+    pub fn can_undo(&self) -> bool {
+        !self.undo.is_empty()
+    }
+
+    pub fn can_redo(&self) -> bool {
+        !self.redo.is_empty()
+    }
+
+    /// Restores the overrides the session started with and forgets its undo history.
+    pub fn cancel(&mut self, keymap: &mut Keymap) {
+        keymap.set_overrides(self.start.clone());
+        self.undo.clear();
+        self.undo_bytes = 0;
+        self.redo.clear();
+    }
+
+    /// Whether `keymap`'s overrides differ from those the session started with.
+    pub fn is_modified(&self, keymap: &Keymap) -> bool {
+        *keymap.overrides() != self.start
+    }
+}
+
+/// The other commands whose bindings clash with `binding` given to `command`: what
+/// [`Policy::Steal`] would take and [`Policy::Keep`] would leave clashing. Tools of the command's
+/// group and twins sharing a default key are not listed. A dialog shows these while the user
+/// records, before anything is assigned.
+pub fn holders(keymap: &Keymap, command: &CommandRef, binding: &Binding) -> Vec<Holder> {
+    keymap.clashing(command, std::slice::from_ref(binding))
+}
+
+/// What a press means to the recorder.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Recorded {
+    Single(Trigger),
+    /// The chord just recorded, pressed again within [`DOUBLE_PRESS`]: it replaces that single.
+    Double(Trigger),
+    /// Escape without modifiers: stop recording.
+    Cancel,
+}
+
+/// Turns the presses of a shortcut field into triggers.
+#[derive(Clone, Debug, Default)]
+pub struct Recorder {
+    last: Option<(Chord, f64)>,
+}
+
+impl Recorder {
+    pub fn new() -> Recorder {
+        Recorder::default()
+    }
+
+    /// Records a press at `now_secs` (any monotonic clock, such as egui's `input.time`).
+    pub fn press(&mut self, chord: Chord, now_secs: f64) -> Recorded {
+        if chord.key == Key::Escape && chord.mods.is_none() {
+            self.last = None;
+            return Recorded::Cancel;
+        }
+        // After a double the next press starts over, so a third press is a single again.
+        if let Some((last, at)) = self.last.take()
+            && last == chord
+            && now_secs >= at
+            && now_secs - at < DOUBLE_PRESS
+        {
+            return Recorded::Double(Trigger::double(chord));
+        }
+        self.last = Some((chord, now_secs));
+        Recorded::Single(Trigger::single(chord))
+    }
+
+    /// Forgets the last press, so the next one cannot become a double.
+    pub fn reset(&mut self) {
+        self.last = None;
+    }
+}
+
+/// The bindables matching `query`, in catalog order: a case-insensitive substring of the label,
+/// an alias, a menu path segment, the command id, or a binding's canonical or `platform` display
+/// text. An empty query matches everything.
+pub fn search<'a>(keymap: &'a Keymap, query: &str, platform: Platform) -> Vec<&'a Bindable> {
+    let q = query.trim().to_lowercase();
+    keymap
+        .catalog()
+        .iter()
+        .filter(|b| {
+            if q.is_empty() {
+                return true;
+            }
+            let hit = |s: &str| s.to_lowercase().contains(&q);
+            hit(&b.label)
+                || b.aliases.iter().any(|a| hit(a))
+                || b.paths.iter().flatten().any(|s| hit(s))
+                || hit(&b.command.id)
+                || keymap.bindings(&b.command).iter().any(|binding| hit(&binding.trigger.to_string()) || hit(&binding.trigger.display(platform)))
+        })
+        .collect()
+}
diff --git a/crates/keymap/src/egui.rs b/crates/keymap/src/egui.rs
new file mode 100644
index 00000000..16a28ddb
--- /dev/null
+++ b/crates/keymap/src/egui.rs
@@ -0,0 +1,598 @@
+//! Conversions between the crate's keys and egui's, matching egui key presses to chords, and a
+//! [`Dispatcher`] that turns a frame's key events into the commands they run. [`platform`] gives
+//! the platform to build a keymap for, the browser's operating system included on the web.
+
+use ::egui::os::OperatingSystem;
+use ::egui::{Context, Event, InputState, Key as EguiKey, KeyboardShortcut, Modifiers};
+
+use crate::chord::{Chord, Key, Mods, Platform, Trigger};
+use crate::command::CommandRef;
+use crate::keymap::{Keymap, Lookup};
+use crate::layout::{KeyInput, Layout};
+use crate::scope::Active;
+
+/// The platform to build a keymap for in this context. Unlike [`Platform::current`], a web build
+/// gets the browser's operating system, which eframe reads from the user agent, so a Mac browser
+/// shows and matches Cmd shortcuts. eframe sets it before the first frame; an app that builds its
+/// keymap earlier rebuilds it when this differs.
+pub fn platform(ctx: &Context) -> Platform {
+    Platform::from(ctx.os())
+}
+
+/// iOS counts as Mac; Android and unknown systems count as Linux.
+impl From<OperatingSystem> for Platform {
+    fn from(os: OperatingSystem) -> Platform {
+        match os {
+            OperatingSystem::Mac | OperatingSystem::IOS => Platform::Mac,
+            OperatingSystem::Windows => Platform::Windows,
+            OperatingSystem::Nix | OperatingSystem::Android | OperatingSystem::Unknown => Platform::Linux,
+        }
+    }
+}
+
+// Both matches are generated from one list so that a key added to `Key` without an egui
+// counterpart fails to compile.
+macro_rules! egui_keys {
+    ($($ours:ident = $theirs:ident),* ; $($same:ident),* $(,)?) => {
+        impl Key {
+            /// The key for an egui key. `None` for modifier keys, Copy, Cut, Paste, BrowserBack
+            /// and IntlBackslash.
+            pub fn from_egui(key: EguiKey) -> Option<Key> {
+                match key {
+                    $(EguiKey::$theirs => Some(Key::$ours),)*
+                    $(EguiKey::$same => Some(Key::$same),)*
+                    _ => None,
+                }
+            }
+
+            pub fn to_egui(self) -> EguiKey {
+                match self {
+                    $(Key::$ours => EguiKey::$theirs,)*
+                    $(Key::$same => EguiKey::$same,)*
+                }
+            }
+        }
+    };
+}
+
+egui_keys! {
+    Up = ArrowUp, Down = ArrowDown, Left = ArrowLeft, Right = ArrowRight;
+    A, B, C, D, E, F, G, H, I, J, K, L, M, N, O, P, Q, R, S, T, U, V, W, X, Y, Z,
+    Num0, Num1, Num2, Num3, Num4, Num5, Num6, Num7, Num8, Num9,
+    F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, F11, F12, F13, F14, F15, F16, F17, F18, F19, F20,
+    F21, F22, F23, F24, F25, F26, F27, F28, F29, F30, F31, F32, F33, F34, F35,
+    Escape, Tab, Backspace, Enter, Space, Insert, Delete, Home, End, PageUp, PageDown,
+    Minus, Equals, Plus, OpenBracket, CloseBracket, Backslash, Semicolon, Quote, Backtick,
+    Comma, Period, Slash, Colon, Pipe, Questionmark, Exclamationmark, OpenCurlyBracket, CloseCurlyBracket,
+}
+
+impl Mods {
+    /// The modifiers egui reports, read for `platform`. On macOS cmd is ⌘ and ctrl the Control
+    /// key; elsewhere Ctrl is cmd and ctrl stays false.
+    pub fn from_egui(mods: &Modifiers, platform: Platform) -> Mods {
+        if platform.is_mac() {
+            // egui sets `command` together with `mac_cmd` on macOS; synthetic events may set
+            // only one of them.
+            Mods { cmd: mods.mac_cmd || mods.command, ctrl: mods.ctrl, alt: mods.alt, shift: mods.shift }
+        } else {
+            Mods { cmd: mods.ctrl || mods.command, ctrl: false, alt: mods.alt, shift: mods.shift }
+        }
+    }
+}
+
+impl Chord {
+    /// The egui shortcut for this chord, for egui's own shortcut text and `consume_shortcut`.
+    /// cmd becomes egui's `command` and ctrl its `ctrl`, which egui folds the same way off
+    /// macOS.
+    pub fn to_egui_shortcut(&self) -> KeyboardShortcut {
+        let m = self.mods;
+        KeyboardShortcut::new(Modifiers { alt: m.alt, ctrl: m.ctrl, shift: m.shift, mac_cmd: false, command: m.cmd }, self.key.to_egui())
+    }
+}
+
+impl KeyInput {
+    /// What an egui key press reports: the logical key as typed and the physical key. On a layout
+    /// that is not Latin, the suite's egui-winit reports the Latin layout's letter as the logical
+    /// key (Linux, Windows, and macOS with ⌘ held), and crates.io egui the physical key, so
+    /// [`Layout::resolve`] takes a letter there before the position. The Latin layout's character
+    /// comes from the frame's input ([`Dispatcher::dispatch`] fills it in). egui reports no Shift
+    /// level, so [`Layout`] infers it. `None` for events other than key presses and releases.
+    pub fn from_egui(event: &Event, platform: Platform) -> Option<KeyInput> {
+        let Event::Key { key, physical_key, modifiers, .. } = event else { return None };
+        let mut input = KeyInput::new(Mods::from_egui(modifiers, platform));
+        input.typed = Key::from_egui(*key);
+        input.physical = physical_key.and_then(Key::from_egui);
+        Some(input)
+    }
+}
+
+/// Whether a key press egui reported triggers `binding` on `platform`, on a layout about which
+/// nothing is known, for a press whose physical key is unknown. [`Layout::matches`] takes the
+/// whole press and the layout.
+///
+/// Besides an exact match:
+/// - Shift with a base key matches the shifted key egui reports (`Shift+;` matches `:`).
+/// - A shifted symbol bound without Shift matches when Shift is held to type it (`?`).
+/// - A binding on `=` matches `+` with or without Shift, and a binding on `+` matches
+///   `Shift+=`, so zoom keys work with and without Shift.
+pub fn matches(binding: &Chord, key: EguiKey, mods: &Modifiers, platform: Platform) -> bool {
+    let Some(pressed) = Key::from_egui(key) else { return false };
+    Layout::new().matches(binding, &KeyInput::new(Mods::from_egui(mods, platform)).with_typed(pressed), platform)
+}
+
+pub use crate::editor::DOUBLE_PRESS;
+
+/// A command a key press runs.
+#[derive(Clone, Debug, PartialEq)]
+#[non_exhaustive]
+pub struct Hit {
+    /// The command to run; for tools sharing the chord, the first of `cycle`.
+    pub command: CommandRef,
+    /// Tools of one group sharing the chord, in catalog order (the app picks the next one);
+    /// empty for a plain command.
+    pub cycle: Vec<CommandRef>,
+    /// The chord whose binding matched, with `double` set when the double binding ran.
+    pub trigger: Trigger,
+    /// Whether `trigger` is the chord the press means ([`Layout::resolve`]), the one the shortcut
+    /// recorder records. `false` when the press matched through a stand-in: a Shift binding on the
+    /// US base key (`Shift+;` for `:`), `+` and `=` standing for each other, or a digit-row
+    /// position's digit.
+    pub exact: bool,
+    /// The text of the Paste event that ran the command, or on the web of the Paste event that
+    /// came with the press that ran it.
+    pub pasted: Option<String>,
+}
+
+impl Hit {
+    fn from_lookup(lookup: Lookup, trigger: Trigger, exact: bool) -> Option<Hit> {
+        let (command, cycle) = match lookup {
+            Lookup::None => return None,
+            Lookup::Run(command) => (command, Vec::new()),
+            Lookup::Cycle(cycle) => (cycle.first()?.clone(), cycle),
+        };
+        Some(Hit { command, cycle, trigger, exact, pasted: None })
+    }
+}
+
+#[derive(Clone, Debug)]
+struct LastPress {
+    chord: Chord,
+    at: f64,
+    ran_double: bool,
+    /// The focused panel: a press in another panel never completes the pair.
+    panel: Option<String>,
+}
+
+/// Runs a keymap against egui's input, one call per frame before the UI reads its keys.
+///
+/// It reads key presses (repeats only when [`with_repeat`](Self::with_repeat) is on). A press
+/// that runs a command is removed from the events, together with the text it typed when it has
+/// no command modifier, so no widget sees it too. Other events stay.
+///
+/// On the desktop, egui-winit sends egui's Copy, Cut and Paste events in place of the key press
+/// for any chord of Cmd with C, X or V (Ctrl off macOS; on Windows also Shift+Delete, Ctrl+Insert
+/// and Shift+Insert). The web build sends the key press and then the event. For the plain
+/// clipboard chords (Cmd+C, Cmd+X, Cmd+V, Cmd+Insert, Shift+Delete, Shift+Insert), the events and
+/// their presses stay with the app unless [`with_clipboard_events`](Self::with_clipboard_events)
+/// is on, so bindings on those chords run only with it on. An event with more modifiers held
+/// counts as its chord, read from the frame's modifiers (Cmd+Shift+V), and runs that chord's
+/// binding; without one, it stays. On Windows, egui-winit also sends Cut for Ctrl+Shift+Delete
+/// and Copy for Ctrl+Shift+Insert, which read as Cmd+Shift+X and Cmd+Shift+C.
+///
+/// egui-winit sends no Paste event when the clipboard is empty or holds no text (an image), so a
+/// binding on Cmd+V, or on Cmd and V with more modifiers, cannot run then on the desktop.
+///
+/// While [`Active::typing`], the text field keeps, without lookup:
+/// - the plain clipboard chords' events and presses (other clipboard chords are looked up);
+/// - a press with a Text event of its own in the frame, since it typed that text. This covers
+///   AltGr: the browser on Windows reports AltGr+Q (`@` on a German layout) as Ctrl+Alt+Q, and
+///   the web build's text agent sends the `@` after it. egui-winit reports AltGr with neither Ctrl
+///   nor Alt. A Ctrl+Alt press without text is a command chord.
+///
+/// Other presses are looked up; the keymap's [`TypingRule`](crate::TypingRule) and
+/// [`text_editing_chords`](crate::text_editing_chords) leave plain keys and the text-editing chords
+/// (Cmd+Z, word moves) to the field.
+#[derive(Clone, Debug)]
+pub struct Dispatcher {
+    last: Option<LastPress>,
+    repeat: bool,
+    clipboard: bool,
+    /// Whether a press's Text event comes before it when no text field has focus, as eframe's
+    /// web build sends them.
+    text_first: bool,
+    layout: Layout,
+    /// Whether right Alt is held. egui-winit reports AltGr with neither Ctrl nor Alt, so its
+    /// presses would otherwise teach the layout as plain ones.
+    right_alt: bool,
+}
+
+/// eframe's web build sends a press's Text event first when no text field has focus.
+const TEXT_FIRST: bool = cfg!(target_arch = "wasm32");
+
+impl Default for Dispatcher {
+    fn default() -> Dispatcher {
+        Dispatcher { last: None, repeat: false, clipboard: false, text_first: TEXT_FIRST, layout: Layout::new(), right_alt: false }
+    }
+}
+
+impl Dispatcher {
+    pub fn new() -> Dispatcher {
+        Dispatcher::default()
+    }
+
+    /// Whether held keys run their command again on each repeat (off by default), so a held
+    /// arrow can nudge. Repeats never count toward a double press.
+    pub fn with_repeat(mut self, on: bool) -> Dispatcher {
+        self.repeat = on;
+        self
+    }
+
+    /// Whether egui's Copy, Cut and Paste events for the plain clipboard chords count as those
+    /// chords (Cmd+C, Cmd+X, Cmd+V; Shift+Delete and Shift+Insert for Cut and Paste with Shift
+    /// alone) outside text fields. Off by default: the events stay in egui's input for the app's
+    /// own handlers. With it on, an event that runs a command is removed, and a Paste event's text
+    /// moves to [`Hit::pasted`]. On the web, the key press runs the command and its clipboard
+    /// event goes with it the same way; when the press runs nothing, or the hit is declined, both
+    /// stay. An app that asks egui for a paste (`ViewportCommand::RequestPaste`) to run its paste
+    /// command gets a Paste event back, which with this on runs that command again.
+    pub fn with_clipboard_events(mut self, on: bool) -> Dispatcher {
+        self.clipboard = on;
+        self
+    }
+
+    /// Starts from what the platform reports about the keyboard layout. The dispatcher also
+    /// learns from what plain presses type ([`Layout::observe`]), and takes whether the layout
+    /// is Latin from egui when the integration reports it (egui-winit on Linux, with the suite's
+    /// egui).
+    pub fn with_layout(mut self, layout: Layout) -> Dispatcher {
+        self.layout = layout;
+        self
+    }
+
+    /// The keyboard layout as known so far, for the shortcut recorder and labels
+    /// ([`Chord::display_for`]).
+    pub fn layout(&self) -> &Layout {
+        &self.layout
+    }
+
+    /// For reporting a layout switch ([`Layout::set_latin`]).
+    pub fn layout_mut(&mut self) -> &mut Layout {
+        &mut self.layout
+    }
+
+    /// The commands this frame's key presses run with `active` focus, in press order.
+    ///
+    /// A chord pressed again within [`DOUBLE_PRESS`] in the same panel runs its double binding
+    /// when it has one; the first press has already run the single binding. The press after a
+    /// double starts over.
+    pub fn dispatch(&mut self, input: &mut InputState, keymap: &Keymap, active: &Active) -> Vec<Hit> {
+        self.dispatch_filtered(input, keymap, active, |_| true)
+    }
+
+    /// [`dispatch`](Self::dispatch), with `accept` deciding each hit before its event is removed.
+    /// A declined hit is left out of the result and its event, with any text it typed, stays in
+    /// egui's input in its place. A declined press still counts toward a double press.
+    pub fn dispatch_filtered(&mut self, input: &mut InputState, keymap: &Keymap, active: &Active, mut accept: impl FnMut(&Hit) -> bool) -> Vec<Hit> {
+        let platform = keymap.platform();
+        let now = input.time;
+        let frame_mods = Mods::from_egui(&input.modifiers, platform);
+        let mut hits = Vec::new();
+        let mut kept = Vec::with_capacity(input.events.len());
+        let events = std::mem::take(&mut input.events);
+        let text_of = text_of_press(&events, self.text_first && !active.typing);
+        self.report_latin(input.keyboard_layout_is_latin());
+        self.learn(&events, &text_of, platform);
+        let mut drop = vec![false; events.len()];
+        // The web build sends both a clipboard key press and the clipboard event it causes. The
+        // press decides: its event goes with it when it runs a command and stays otherwise.
+        let causes = clipboard_event_follows(&events, &self.layout, platform, input);
+        let mut caused_taken: Vec<Option<bool>> = vec![None; events.len()];
+        for (i, event) in events.into_iter().enumerate() {
+            match &event {
+                Event::Key { pressed: true, repeat, .. } if !*repeat || self.repeat => {
+                    let input = key_input(&event, platform, input);
+                    let held = input.mods;
+                    if let Some(chord) = self.layout.resolve(&input) {
+                        let plain_clip = is_plain_clipboard(chord.key, chord.mods);
+                        let keep =
+                            if active.typing { text_of[i].is_some() || plain_clip } else { !self.clipboard && plain_clip && causes[i].is_some() };
+                        if keep {
+                            if let Some((j, _)) = causes[i] {
+                                caused_taken[j] = Some(false);
+                            }
+                            kept.push((i, event));
+                            continue;
+                        }
+                        let caused = causes[i].clone();
+                        let hit = self.press(&input, *repeat, now, keymap, active).map(|mut hit| {
+                            hit.pasted = caused.as_ref().and_then(|(_, text)| text.clone());
+                            hit
+                        });
+                        let hit = hit.filter(&mut accept);
+                        if let Some((j, _)) = caused {
+                            caused_taken[j] = Some(hit.is_some());
+                        }
+                        if let Some(hit) = hit {
+                            hits.push(hit);
+                            if let Some(j) = text_of[i].filter(|_| !(held.cmd || held.ctrl)) {
+                                drop[j] = true;
+                            }
+                            continue;
+                        }
+                    }
+                }
+                // A repeat that does not run leaves its clipboard event in place with it.
+                Event::Key { pressed: true, repeat: true, .. } => {
+                    if let Some((j, _)) = causes[i] {
+                        caused_taken[j] = Some(false);
+                    }
+                }
+                // Desktop clipboard events, and web ones whose press stayed or ran nothing.
+                Event::Copy | Event::Cut | Event::Paste(_) => match caused_taken[i] {
+                    Some(true) => continue,
+                    Some(false) => {}
+                    None => {
+                        let (key, held, _) = clipboard_chord(&event, frame_mods);
+                        // A focused text field copies and pastes on the plain chords itself.
+                        let look = !is_plain_clipboard(key, held) || (self.clipboard && !active.typing);
+                        let hit = if look { self.press(&KeyInput::new(held).with_typed(key), false, now, keymap, active) } else { None };
+                        if let Some(mut hit) = hit {
+                            if let Event::Paste(text) = &event {
+                                hit.pasted = Some(text.clone());
+                            }
+                            if accept(&hit) {
+                                hits.push(hit);
+                                continue;
+                            }
+                        }
+                    }
+                },
+                _ => {}
+            }
+            kept.push((i, event));
+        }
+        input.events = kept.into_iter().filter(|(i, _)| !drop[*i]).map(|(_, e)| e).collect();
+        hits
+    }
+
+    /// Takes the platform's answer on whether the layout is Latin. `None` (not reported) leaves
+    /// the layout as it is, so an earlier report or typing decides.
+    fn report_latin(&mut self, reported: Option<bool>) {
+        if reported.is_some() {
+            self.layout.set_latin(reported);
+        }
+    }
+
+    /// Teaches the layout what this frame's presses typed.
+    fn learn(&mut self, events: &[Event], text_of: &[Option<usize>], platform: Platform) {
+        for (event, text) in events.iter().zip(text_of) {
+            match event {
+                Event::Key { physical_key: Some(EguiKey::AltRight), pressed, .. } => self.right_alt = *pressed,
+                Event::WindowFocused(false) => self.right_alt = false,
+                _ => {}
+            }
+            if self.right_alt {
+                continue;
+            }
+            let Some(Event::Text(text)) = text.and_then(|j| events.get(j)) else { continue };
+            if let Some(KeyInput { mods, physical: Some(physical), .. }) = KeyInput::from_egui(event, platform) {
+                self.layout.observe(physical, mods, text);
+            }
+        }
+    }
+
+    fn press(&mut self, input: &KeyInput, repeat: bool, now: f64, keymap: &Keymap, active: &Active) -> Option<Hit> {
+        let chords = self.layout.candidates(input);
+        let first = *chords.first()?;
+        let find = |double: bool| {
+            chords.iter().find_map(|&chord| Hit::from_lookup(keymap.lookup(&chord, double, active), Trigger { chord, double }, chord == first))
+        };
+        if repeat {
+            return find(false);
+        }
+        let again = self
+            .last
+            .as_ref()
+            .is_some_and(|l| l.chord == first && !l.ran_double && l.panel.as_deref() == active.panel && now >= l.at && now - l.at < DOUBLE_PRESS);
+        let double = if again { find(true) } else { None };
+        self.last = Some(LastPress { chord: first, at: now, ran_double: double.is_some(), panel: active.panel.map(str::to_owned) });
+        double.or_else(|| find(false))
+    }
+}
+
+/// A clipboard event: Copy, Cut or Paste.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Clip {
+    Copy,
+    Cut,
+    Paste,
+}
+
+/// For each clipboard key press whose clipboard event comes later in the frame, as the web build
+/// sends them: the index of that event, and the text of a Paste event.
+/// The suite's egui fork has an inherent `InputState::keyboard_layout_is_latin`; crates.io egui
+/// has neither the method nor the field. A method call picks an inherent method over a trait
+/// method of the same name, so [`Dispatcher::dispatch`] reaches egui's method on the fork and
+/// this `None` everywhere else.
+#[allow(dead_code, reason = "unused when egui has the inherent method")]
+trait KeyboardLayoutIsLatin {
+    fn keyboard_layout_is_latin(&self) -> Option<bool> {
+        None
+    }
+}
+
+impl KeyboardLayoutIsLatin for InputState {}
+
+/// The suite's egui fork has an inherent `InputState::latin_layout_char`, the character a key
+/// pressed this frame types on the Latin layout shortcuts follow; crates.io egui reports none.
+/// Reached as [`KeyboardLayoutIsLatin`] is.
+#[allow(dead_code, reason = "unused when egui has the inherent method")]
+trait LatinLayoutChar {
+    fn latin_layout_char(&self, _physical_key: EguiKey) -> Option<char> {
+        None
+    }
+}
+
+impl LatinLayoutChar for InputState {}
+
+/// A press as [`KeyInput::from_egui`] reads it, with the Latin layout's character `input` reports
+/// for its key.
+fn key_input(event: &Event, platform: Platform, input: &InputState) -> KeyInput {
+    let mut key = KeyInput::from_egui(event, platform).unwrap_or_default();
+    if let Event::Key { physical_key: Some(physical), .. } = event {
+        key.latin = input.latin_layout_char(*physical);
+    }
+    key
+}
+
+fn clipboard_event_follows(events: &[Event], layout: &Layout, platform: Platform, input: &InputState) -> Vec<Option<(usize, Option<String>)>> {
+    let mut out = vec![None; events.len()];
+    let mut ahead: [Option<usize>; 3] = [None; 3];
+    for (i, event) in events.iter().enumerate().rev() {
+        if let Some(seen) = event_clip(event).and_then(|c| ahead.get_mut(c as usize)) {
+            *seen = Some(i);
+        } else if let Event::Key { pressed: true, .. } = event {
+            let chord = layout.resolve(&key_input(event, platform, input));
+            let clip = chord.and_then(|c| clipboard_kind(c.key, c.mods));
+            if let Some(j) = clip.and_then(|c| ahead.get_mut(c as usize)).and_then(Option::take) {
+                let text = if let Some(Event::Paste(text)) = events.get(j) { Some(text.clone()) } else { None };
+                out[i] = Some((j, text));
+            }
+        }
+    }
+    out
+}
+
+/// For each key press, the index of the Text event it typed. egui-winit, and eframe's web text
+/// agent while a text field has focus, send the Text after the press, before the next one.
+/// With `text_first`, eframe's web build with no text field focused, the Text comes right before
+/// its press, and only for a press without Ctrl or Cmd.
+fn text_of_press(events: &[Event], text_first: bool) -> Vec<Option<usize>> {
+    let is_text = |e: Option<&Event>| matches!(e, Some(Event::Text(t)) if !t.is_empty());
+    let mut out = vec![None; events.len()];
+    if text_first {
+        for (i, event) in events.iter().enumerate().skip(1) {
+            if let Event::Key { pressed: true, modifiers, .. } = event
+                && !(modifiers.ctrl || modifiers.command || modifiers.mac_cmd)
+                && is_text(events.get(i - 1))
+            {
+                out[i] = Some(i - 1);
+            }
+        }
+        return out;
+    }
+    let mut text_ahead = None;
+    for (i, event) in events.iter().enumerate().rev() {
+        match event {
+            Event::Key { pressed: true, .. } => out[i] = text_ahead.take(),
+            _ if is_text(Some(event)) => text_ahead = Some(i),
+            _ => {}
+        }
+    }
+    out
+}
+
+fn event_clip(event: &Event) -> Option<Clip> {
+    match event {
+        Event::Copy => Some(Clip::Copy),
+        Event::Cut => Some(Clip::Cut),
+        Event::Paste(_) => Some(Clip::Paste),
+        _ => None,
+    }
+}
+
+/// The clipboard event a backend sends for a press, if any.
+pub(crate) fn clipboard_kind(key: Key, held: Mods) -> Option<Clip> {
+    match key {
+        Key::C if held.cmd => Some(Clip::Copy),
+        Key::X if held.cmd => Some(Clip::Cut),
+        Key::V if held.cmd => Some(Clip::Paste),
+        Key::Delete if held.shift => Some(Clip::Cut),
+        Key::Insert if held.shift => Some(Clip::Paste),
+        Key::Insert if held.cmd || held.ctrl => Some(Clip::Copy),
+        _ => None,
+    }
+}
+
+/// Whether a chord is one of the plain clipboard chords, which egui's text fields act on: Cmd+C,
+/// Cmd+X, Cmd+V, Cmd+Insert, Shift+Delete and Shift+Insert.
+fn is_plain_clipboard(key: Key, held: Mods) -> bool {
+    match key {
+        Key::C | Key::X | Key::V => held == Mods::CMD,
+        Key::Insert => held == Mods::CMD || held == Mods::SHIFT,
+        Key::Delete => held == Mods::SHIFT,
+        _ => false,
+    }
+}
+
+/// The press a clipboard event stands for, with the modifiers held, and the event's kind. Off
+/// macOS egui-winit also sends Cut for Shift+Delete and Paste for Shift+Insert.
+pub(crate) fn clipboard_chord(event: &Event, held: Mods) -> (Key, Mods, Clip) {
+    let with_cmd = Mods { cmd: true, ..held };
+    let shift_only = held.shift && !held.cmd;
+    match event {
+        Event::Cut if shift_only => (Key::Delete, held, Clip::Cut),
+        Event::Cut => (Key::X, with_cmd, Clip::Cut),
+        Event::Paste(_) if shift_only => (Key::Insert, held, Clip::Paste),
+        Event::Paste(_) => (Key::V, with_cmd, Clip::Paste),
+        _ => (Key::C, with_cmd, Clip::Copy),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{Bindable, Binding, Scope, Scopes};
+
+    #[test]
+    fn web_text_before_its_press_goes_with_that_press() {
+        let km = Keymap::new(
+            vec![Bindable::new("tool.marquee", "Marquee", Scope::app()).with_default(Binding::parse("M").unwrap())],
+            Scopes::new(),
+            Platform::Windows,
+        );
+        let press = |key| Event::Key { key, physical_key: Some(key), pressed: true, repeat: false, modifiers: Modifiers::NONE };
+        let mut input = InputState::default();
+        input.events = vec![Event::Text("m".into()), press(EguiKey::M), Event::Text("q".into()), press(EguiKey::Q)];
+        let mut d = Dispatcher { text_first: true, ..Dispatcher::new() };
+        let hits = d.dispatch(&mut input, &km, &Active::NONE);
+        assert_eq!(hits.len(), 1);
+        assert_eq!(input.events, [Event::Text("q".into()), press(EguiKey::Q)]);
+    }
+
+    #[test]
+    fn the_platforms_latin_report_overrides_typing() {
+        /// Stands in for the fork's `InputState`, whose inherent method wins over the fallback.
+        struct ForkInput(Option<bool>);
+        impl ForkInput {
+            fn keyboard_layout_is_latin(&self) -> Option<bool> {
+                self.0
+            }
+        }
+        impl KeyboardLayoutIsLatin for ForkInput {}
+
+        let km = Keymap::new(vec![], Scopes::new(), Platform::Windows);
+        let typing = |text: &str| {
+            let mut input = InputState::default();
+            let key = Event::Key { key: EguiKey::C, physical_key: Some(EguiKey::C), pressed: true, repeat: false, modifiers: Modifiers::NONE };
+            input.events = vec![key, Event::Text(text.into())];
+            input
+        };
+
+        // crates.io egui reports nothing, so typing decides.
+        let mut d = Dispatcher::new();
+        assert_eq!(InputState::default().keyboard_layout_is_latin(), None);
+        d.dispatch(&mut typing("с"), &km, &Active::NONE);
+        assert!(!d.layout().is_latin());
+
+        // A report wins over typing, and frames without one keep it.
+        d.report_latin(ForkInput(Some(true)).keyboard_layout_is_latin());
+        assert!(d.layout().is_latin());
+        d.report_latin(ForkInput(None).keyboard_layout_is_latin());
+        d.dispatch(&mut typing("с"), &km, &Active::NONE);
+        assert!(d.layout().is_latin());
+        d.report_latin(ForkInput(Some(false)).keyboard_layout_is_latin());
+        d.dispatch(&mut typing("c"), &km, &Active::NONE);
+        assert!(!d.layout().is_latin());
+    }
+}
diff --git a/crates/keymap/src/import.rs b/crates/keymap/src/import.rs
new file mode 100644
index 00000000..2cb03ddc
--- /dev/null
+++ b/crates/keymap/src/import.rs
@@ -0,0 +1,1059 @@
+//! Importing another application's shortcut set.
+//!
+//! The app's reader turns a file into a [`ForeignSet`]. [`plan`] matches its entries to the
+//! keymap's commands without changing anything, and [`ImportPlan::apply`] applies the plan and
+//! returns an [`ImportReport`]. Matching and the apply rules are ported from the DesignCraft
+//! InDesign importer (#1180).
+
+pub mod namematch;
+
+use std::collections::{BTreeMap, HashMap, HashSet};
+
+use serde::{Deserialize, Serialize};
+
+use crate::chord::Trigger;
+use crate::chord::foreign::{Flavor, ForeignError, ReadNote, read_foreign};
+use crate::command::CommandRef;
+use crate::keymap::{Bindable, Binding, Keymap, Kind, MAX_BINDINGS, Policy};
+use crate::scope::Scope;
+
+/// Most entries of a set read; the rest are ignored and counted in [`ImportReport::truncated`].
+pub const MAX_IMPORT_ENTRIES: usize = 20_000;
+/// Most keys read per entry.
+pub const MAX_KEYS_PER_ENTRY: usize = 64;
+/// Longest text field read, in chars; longer ones are cut.
+pub const MAX_IMPORT_TEXT: usize = 1024;
+/// Most path segments read per entry; the label (last segment) is always kept.
+pub const MAX_PATH_SEGMENTS: usize = 32;
+/// Most unmatched entries [`ImportOptions::suggest`] looks for commands for; the rest are counted
+/// in [`ImportReport::truncated`]. Entries without keys get no suggestion and do not count.
+pub const MAX_SUGGESTIONS: usize = 200;
+
+/// A shortcut set as an app's reader found it. Build it with [`ForeignSet::new`].
+#[derive(Clone, Debug, Default, PartialEq)]
+#[non_exhaustive]
+pub struct ForeignSet {
+    pub name: Option<String>,
+    pub entries: Vec<ForeignEntry>,
+    /// Entries the reader dropped at its own limits; [`plan`] counts them in
+    /// [`ImportReport::truncated`].
+    pub truncated: usize,
+}
+
+/// One item of a foreign set.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct ForeignEntry {
+    /// The top menu or product area as the source names it, without decoration such as a
+    /// trailing " Menu".
+    pub menu: Option<String>,
+    /// Submenu segments and the item label; the label is last.
+    pub path: Vec<String>,
+    /// Empty when the source says the item has no shortcut.
+    pub keys: Vec<ForeignKey>,
+    pub line: Option<usize>,
+    /// The item selects a tool.
+    pub is_tool: bool,
+    /// The entry belongs to a panel menu: its leading path segments name the panel, not a
+    /// submenu of [`ForeignEntry::menu`], which is usually `None`. Sources write such items as
+    /// `Character: All Caps` (InDesign's Panel Menus area, the panel-menu areas of Illustrator and
+    /// Photoshop sets); the reader splits them into segments. Such an entry also matches a
+    /// catalog path that ends with its path, and its last segment alone when its first segment
+    /// is a segment of some catalog path. Without keys, an entry matched only these ways
+    /// changes nothing ([`ImportReport::matched_without_change`]).
+    pub panel_menu: bool,
+}
+
+impl ForeignSet {
+    /// A set without a name.
+    pub fn new(entries: Vec<ForeignEntry>) -> ForeignSet {
+        ForeignSet { entries, ..ForeignSet::default() }
+    }
+
+    /// The set's name as the source gives it.
+    pub fn with_name(mut self, name: impl Into<String>) -> ForeignSet {
+        self.name = Some(name.into());
+        self
+    }
+
+    /// Entries the reader dropped at its own limits ([`ForeignSet::truncated`]).
+    pub fn with_truncated(mut self, truncated: usize) -> ForeignSet {
+        self.truncated = truncated;
+        self
+    }
+}
+
+impl ForeignEntry {
+    /// An entry without keys.
+    pub fn new<S: Into<String>>(menu: Option<&str>, path: impl IntoIterator<Item = S>) -> ForeignEntry {
+        ForeignEntry { menu: menu.map(str::to_string), path: path.into_iter().map(Into::into).collect(), ..ForeignEntry::default() }
+    }
+
+    /// Marks the entry as selecting a tool.
+    pub fn tool(mut self) -> ForeignEntry {
+        self.is_tool = true;
+        self
+    }
+
+    /// Marks the entry as an item of a panel menu ([`ForeignEntry::panel_menu`]).
+    pub fn in_panel_menu(mut self) -> ForeignEntry {
+        self.panel_menu = true;
+        self
+    }
+
+    /// Adds a key after the others.
+    pub fn with_key(mut self, key: ForeignKey) -> ForeignEntry {
+        self.keys.push(key);
+        self
+    }
+
+    /// The entry's line in the source file.
+    pub fn at_line(mut self, line: usize) -> ForeignEntry {
+        self.line = Some(line);
+        self
+    }
+
+    /// The source's own path, menu first, joined with ` > `: the `item` of report rows.
+    pub fn item(&self) -> String {
+        self.menu.iter().chain(&self.path).map(String::as_str).collect::<Vec<_>>().join(" > ")
+    }
+
+    /// The key of [`ImportOptions::remembered`] for this entry: the normalized menu and path
+    /// joined by U+001F.
+    pub fn remember_key(&self) -> String {
+        self.menu.iter().chain(&self.path).map(|s| normalize_label(s)).collect::<Vec<_>>().join("\u{1f}")
+    }
+}
+
+/// One shortcut of an entry.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ForeignKey {
+    /// The context the source gives (InDesign's `Default`, `Text`, …); `None` reads as a
+    /// [`ContextRule::Home`] context.
+    pub context: Option<String>,
+    /// The key text as written, for reports.
+    pub text: String,
+    pub trigger: Result<Trigger, ForeignError>,
+    /// What reading the text approximated, reported in [`ImportReport::approximated`].
+    pub notes: Vec<ReadNote>,
+}
+
+impl ForeignKey {
+    /// Reads `text` with [`read_foreign`].
+    pub fn read(context: Option<&str>, text: &str, flavor: Flavor) -> ForeignKey {
+        let (trigger, notes) = match read_foreign(text, flavor) {
+            Ok((t, notes)) => (Ok(t), notes),
+            Err(e) => (Err(e), Vec::new()),
+        };
+        ForeignKey { context: context.map(str::to_string), text: text.to_string(), trigger, notes }
+    }
+}
+
+/// What keys in a source context become.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ContextRule {
+    /// Bindings in the command's home scope.
+    Home,
+    /// Bindings in this scope.
+    Scope(Scope),
+    /// Bindings in the home scope, only when the entry has no key in a [`ContextRule::Home`]
+    /// context (DesignCraft reads InDesign's `Text` context this way).
+    HomeWithoutHomeEntry,
+    /// Ignored without a report row.
+    Skip,
+}
+
+/// What an import starts from.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Start {
+    /// The keymap's bindings as they are.
+    #[default]
+    Current,
+    /// Every command's defaults; other overrides are dropped.
+    Defaults,
+}
+
+/// What an entry without keys does to its command.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum NoneDefined {
+    /// The command loses its shortcuts, unless another entry matched to it has keys or the entry
+    /// matched only through a panel-menu rule ([`NoChangeReason::PanelMenu`]).
+    #[default]
+    Clear,
+    /// The command keeps its shortcuts.
+    Keep,
+}
+
+/// How [`plan`] reads a set and how [`ImportPlan::apply`] applies it.
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", default)]
+pub struct ImportOptions {
+    /// Source contexts by name, compared case-insensitively. Keys in other contexts are reported
+    /// as [`UnmatchedReason::Context`].
+    pub contexts: Vec<(String, ContextRule)>,
+    /// Earlier answers of the user, by [`ForeignEntry::remember_key`]. They are tried first.
+    pub remembered: BTreeMap<String, CommandRef>,
+    pub start: Start,
+    pub none_defined: NoneDefined,
+    /// Look for likely commands for unmatched entries ([`ImportReport::suggestions`]).
+    pub suggest: bool,
+}
+
+/// One planned binding, with the entry it came from.
+#[derive(Clone, Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct PlannedBinding {
+    pub binding: Binding,
+    pub item: String,
+    pub line: Option<usize>,
+    /// The entry's position in the set: a later entry takes a chord from an earlier one.
+    pub order: usize,
+}
+
+/// What the set says about one command, over every entry matched to it.
+#[derive(Clone, Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Planned {
+    pub command: CommandRef,
+    /// The first entry matched to it, and its line.
+    pub item: String,
+    pub line: Option<usize>,
+    pub bindings: Vec<PlannedBinding>,
+    /// Every matched entry had no keys, so [`NoneDefined::Clear`] clears the command. One entry
+    /// with keys, in any order, keeps an entry without keys from clearing them.
+    pub none_defined: bool,
+}
+
+/// The result of [`plan`]: what would change, and the report rows known before applying.
+///
+/// Serializable for a review UI; it does not deserialize, so every plan applied comes from
+/// [`plan`] and keeps its caps.
+#[derive(Clone, Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct ImportPlan {
+    /// In the order of their first entry.
+    pub commands: Vec<Planned>,
+    pub start: Start,
+    pub none_defined: NoneDefined,
+    /// `unmatched`, `unreadable`, `approximated`, `suggestions`, `matched_without_change` and the
+    /// counts;
+    /// [`ImportPlan::apply`] adds the rest.
+    pub report: ImportReport,
+}
+
+/// A command whose bindings the import changed. Shortcuts are binding texts.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Changed {
+    pub command: CommandRef,
+    pub label: String,
+    /// The first entry matched to the command, and its line.
+    pub item: String,
+    pub line: Option<usize>,
+    pub from: Vec<String>,
+    pub to: Vec<String>,
+}
+
+/// A binding taken from a command outside the set.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Cleared {
+    pub command: CommandRef,
+    pub label: String,
+    pub shortcut: String,
+}
+
+/// Why a key of the set was not bound.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum SkipReason {
+    /// A later entry of the set takes the chord.
+    Taken,
+    /// The system takes the chord.
+    Reserved,
+    /// The binding's scope ([`ContextRule::Scope`]) is not one the keymap knows
+    /// ([`Keymap::knows_scope`]).
+    UnknownScope,
+}
+
+/// A key of the set that was not bound.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Skipped {
+    pub command: CommandRef,
+    pub item: String,
+    pub line: Option<usize>,
+    pub shortcut: String,
+    /// The command of the later entry that takes the chord ([`SkipReason::Taken`]).
+    pub kept_by: Option<CommandRef>,
+    pub reason: SkipReason,
+}
+
+/// A change [`ImportPlan::apply`] could not make, so the command keeps the bindings it had. The
+/// overrides had no room for another changed command ([`AssignError::Full`]), or the keymap lacks
+/// the command (a plan applied to a keymap it was not made from).
+///
+/// [`AssignError::Full`]: crate::AssignError::Full
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Failed {
+    pub command: CommandRef,
+    pub label: String,
+    pub change: FailedChange,
+    /// The set's shortcuts for [`FailedChange::Bind`]; empty for [`FailedChange::Clear`].
+    pub shortcuts: Vec<String>,
+}
+
+/// What a [`Failed`] change was.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum FailedChange {
+    /// Giving the command the set's bindings, or taking one of them from another command.
+    Bind,
+    /// Leaving the command without shortcuts: the set has it without keys and
+    /// [`NoneDefined::Clear`] applies.
+    Clear,
+}
+
+/// Why keys of an entry were not used.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum UnmatchedReason {
+    NoMatch,
+    /// Several commands fit and no match step picked one.
+    Ambiguous,
+    /// The keys are in contexts [`ImportOptions::contexts`] does not list.
+    Context,
+    /// Only a command of the other kind fits: a tool entry naming a command, or the other way round.
+    Tool,
+}
+
+/// An entry with keys that was not used, or keys of a matched entry in unlisted contexts.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Unmatched {
+    pub item: String,
+    pub line: Option<usize>,
+    /// The keys as written, `<context>: <keys>` joined with `, `.
+    pub keys: String,
+    pub reason: UnmatchedReason,
+}
+
+/// Keys of a matched entry that could not be read.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Unreadable {
+    pub item: String,
+    pub line: Option<usize>,
+    pub keys: String,
+    /// Why the first of them could not be read.
+    pub reason: ForeignError,
+}
+
+/// An entry without keys that matched a command and left its shortcuts alone.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct MatchedWithoutChange {
+    pub command: CommandRef,
+    pub label: String,
+    pub item: String,
+    pub line: Option<usize>,
+    pub reason: NoChangeReason,
+}
+
+/// Why a [`MatchedWithoutChange`] entry did not clear its command.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum NoChangeReason {
+    /// The entry matched only through a panel-menu rule (a catalog path ending with its
+    /// segments, or its last segment alone). Such a match is close enough to bind the entry's
+    /// keys, not to take a command's shortcuts away.
+    PanelMenu,
+}
+
+/// Likely commands for an unmatched entry, best first. Never applied.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Suggestion {
+    pub item: String,
+    pub line: Option<usize>,
+    pub candidates: Vec<CommandRef>,
+}
+
+/// Keys of a matched entry that were read approximately, such as a numeric keypad key bound as
+/// the main key of the same name.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Approximated {
+    pub item: String,
+    pub line: Option<usize>,
+    /// The keys with this note, as written: `<context>: <keys>` joined with `, `.
+    pub keys: String,
+    pub note: ReadNote,
+}
+
+/// What an import did. Shortcuts are canonical binding texts; `item` is the source's path and
+/// `line` the entry's [`ForeignEntry::line`].
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct ImportReport {
+    pub set: Option<String>,
+    /// Commands of the set whose bindings changed.
+    pub imported: usize,
+    pub changed: Vec<Changed>,
+    pub conflicts_cleared: Vec<Cleared>,
+    pub skipped: Vec<Skipped>,
+    #[serde(default)]
+    pub failed: Vec<Failed>,
+    /// Entries without keys that matched a command and changed nothing.
+    #[serde(default)]
+    pub matched_without_change: Vec<MatchedWithoutChange>,
+    pub unmatched: Vec<Unmatched>,
+    /// Entries that matched no command and have no keys, or keys only in
+    /// [`ContextRule::Skip`] contexts.
+    pub unmatched_without_shortcut: usize,
+    pub unreadable: Vec<Unreadable>,
+    pub approximated: Vec<Approximated>,
+    pub suggestions: Vec<Suggestion>,
+    /// Entries, keys, path segments, bindings and text fields cut at the caps, unmatched entries
+    /// past [`MAX_SUGGESTIONS`] that got no suggestion, and [`ForeignSet::truncated`].
+    pub truncated: usize,
+}
+
+/// The matching form of a label or menu name: lower case, no `…`, `...` or `&`, a colon read as
+/// a space (so the alias `Preferences: General…` matches the path `Preferences > General...`),
+/// single spaces.
+pub fn normalize_label(s: &str) -> String {
+    let s = s.replace('…', "").replace("...", "").replace('&', "").replace(':', " ");
+    s.split_whitespace().collect::<Vec<_>>().join(" ").to_lowercase()
+}
+
+/// A normalized name without a leading `show/hide `, `show ` or `hide ` when something remains:
+/// sources name a toggle by what choosing it does now. Only toggle commands
+/// ([`Bindable::is_toggle`]) are matched by this form.
+fn toggle_name(s: &str) -> String {
+    ["show/hide ", "show ", "hide "].iter().find_map(|p| s.strip_prefix(p).filter(|r| !r.is_empty())).unwrap_or(s).to_string()
+}
+
+/// Matches `set` to the keymap's commands. Pure: the keymap is not changed.
+pub fn plan(set: &ForeignSet, keymap: &Keymap, options: &ImportOptions) -> ImportPlan {
+    let mut cut = 0usize;
+    let mut report = ImportReport { set: set.name.as_deref().map(|n| cap_text(n, &mut cut)), ..ImportReport::default() };
+    cut = cut.saturating_add(set.entries.len().saturating_sub(MAX_IMPORT_ENTRIES)).saturating_add(set.truncated);
+    let index = Index::new(keymap);
+    let contexts: Vec<(String, &ContextRule)> = options.contexts.iter().map(|(n, r)| (n.to_lowercase(), r)).collect();
+    let mut commands: Vec<Planned> = Vec::new();
+    let mut planned_at: HashMap<usize, usize> = HashMap::new();
+    let mut to_suggest: Vec<ToSuggest> = Vec::new();
+
+    let rule_of = |k: &ForeignKey| -> Option<&ContextRule> {
+        match &k.context {
+            None => Some(&ContextRule::Home),
+            Some(c) => {
+                let c = c.to_lowercase();
+                contexts.iter().find(|(n, _)| *n == c).map(|(_, r)| *r)
+            }
+        }
+    };
+
+    for (order, raw) in set.entries.iter().take(MAX_IMPORT_ENTRIES).enumerate() {
+        let entry = capped(raw, &mut cut);
+        let item = entry.item();
+        let found = index.find(&entry, entry.is_tool, &options.remembered);
+        let Found::One(i, by_panel) = found else {
+            // Keys in skipped contexts would bind nothing, so they neither make a row nor count
+            // toward the suggestion cap.
+            let keys: Vec<&ForeignKey> = entry.keys.iter().filter(|k| rule_of(k) != Some(&ContextRule::Skip)).collect();
+            if keys.is_empty() {
+                report.unmatched_without_shortcut += 1;
+                continue;
+            }
+            let reason = match found {
+                Found::Many => UnmatchedReason::Ambiguous,
+                _ if matches!(index.find(&entry, !entry.is_tool, &BTreeMap::new()), Found::One(..)) => UnmatchedReason::Tool,
+                _ => UnmatchedReason::NoMatch,
+            };
+            if options.suggest && reason != UnmatchedReason::Tool {
+                if to_suggest.len() < MAX_SUGGESTIONS {
+                    let label = entry.path.last().cloned().unwrap_or_default();
+                    to_suggest.push(ToSuggest { item: item.clone(), line: entry.line, label, tool: entry.is_tool });
+                } else {
+                    cut += 1;
+                }
+            }
+            report.unmatched.push(Unmatched { item, line: entry.line, keys: keys_text(keys.into_iter()), reason });
+            continue;
+        };
+
+        if by_panel && entry.keys.is_empty() {
+            let (command, label) =
+                keymap.catalog().get(i).map(|b| (b.command.clone(), b.label.clone())).unwrap_or_else(|| (CommandRef::new(""), String::new()));
+            report.matched_without_change.push(MatchedWithoutChange { command, label, item, line: entry.line, reason: NoChangeReason::PanelMenu });
+            continue;
+        }
+
+        let has_home = entry.keys.iter().any(|k| rule_of(k) == Some(&ContextRule::Home));
+        let mut unlisted = Vec::new();
+        let mut unreadable = Vec::new();
+        let mut approximated: Vec<(ReadNote, Vec<&ForeignKey>)> = Vec::new();
+        let mut bindings = Vec::new();
+        for k in &entry.keys {
+            let scope = match rule_of(k) {
+                None => {
+                    unlisted.push(k);
+                    continue;
+                }
+                Some(ContextRule::Skip) => continue,
+                Some(ContextRule::HomeWithoutHomeEntry) if has_home => continue,
+                Some(ContextRule::Home | ContextRule::HomeWithoutHomeEntry) => None,
+                Some(ContextRule::Scope(s)) => Some(s.clone()),
+            };
+            match &k.trigger {
+                Ok(t) => bindings.push(Binding { trigger: *t, scope }),
+                Err(e) => unreadable.push((k, e)),
+            }
+            for &note in &k.notes {
+                match approximated.iter_mut().find(|(n, _)| *n == note) {
+                    Some((_, keys)) => keys.push(k),
+                    None => approximated.push((note, vec![k])),
+                }
+            }
+        }
+        let line = entry.line;
+        if !unlisted.is_empty() {
+            report.unmatched.push(Unmatched { item: item.clone(), line, keys: keys_text(unlisted.into_iter()), reason: UnmatchedReason::Context });
+        }
+        if let Some((_, e)) = unreadable.first() {
+            let reason = (*e).clone();
+            report.unreadable.push(Unreadable { item: item.clone(), line, keys: keys_text(unreadable.iter().map(|(k, _)| *k)), reason });
+        }
+        for (note, keys) in approximated {
+            report.approximated.push(Approximated { item: item.clone(), line, keys: keys_text(keys.into_iter()), note });
+        }
+
+        let at = *planned_at.entry(i).or_insert_with(|| {
+            let command = keymap.catalog().get(i).map(|b| b.command.clone()).unwrap_or_else(|| CommandRef::new(""));
+            commands.push(Planned { command, item: item.clone(), line, bindings: Vec::new(), none_defined: true });
+            commands.len() - 1
+        });
+        let Some(p) = commands.get_mut(at) else { continue };
+        p.none_defined &= entry.keys.is_empty();
+        for binding in bindings {
+            if p.bindings.iter().any(|b| b.binding == binding) {
+                continue;
+            }
+            if p.bindings.len() >= MAX_BINDINGS {
+                cut += 1;
+                continue;
+            }
+            p.bindings.push(PlannedBinding { binding, item: item.clone(), line, order });
+        }
+    }
+
+    if !to_suggest.is_empty() {
+        report.suggestions = suggest(keymap, &to_suggest);
+    }
+    report.truncated = cut;
+    ImportPlan { commands, start: options.start, none_defined: options.none_defined, report }
+}
+
+impl ImportPlan {
+    /// Applies the plan to `keymap`, which should be the one it was made from. The set wins: a
+    /// chord it gives to a command is taken from other commands (except twins sharing it as a
+    /// default). Within the set, a later entry takes a chord from an earlier one, as when the
+    /// entries are applied in file order; the earlier entry's key is reported in
+    /// [`ImportReport::skipped`].
+    ///
+    /// A change that finds the overrides full is left out and reported in
+    /// [`ImportReport::failed`]; the others still apply, and a chord it would have taken from an
+    /// earlier entry stays with that entry. That includes taking a chord from another command,
+    /// or from a command whose own change failed: both commands keep the bindings they had. With
+    /// [`Start::Defaults`] that cannot happen.
+    pub fn apply(&self, keymap: &mut Keymap) -> ImportReport {
+        let before: Vec<Vec<Binding>> = self.commands.iter().map(|p| keymap.bindings(&p.command)).collect();
+        // Dropping every entry leaves room for all of them: each catalog command takes at most one
+        // entry, and the catalog holds at most `MAX_COMMANDS`.
+        if self.start == Start::Defaults {
+            keymap.reset_all();
+        }
+        let start = keymap.clone();
+        // Commands whose bindings found the overrides full after taking a chord from an earlier
+        // entry. They are left out of the claims and the plan is applied again, so the earlier
+        // entry keeps the chord, as when the entries are applied in file order.
+        let mut dropped: HashMap<usize, Failed> = HashMap::new();
+        'attempt: loop {
+            let mut report = self.report.clone();
+            let (accepted, displaced) = self.resolve(keymap, &dropped, &mut report);
+            let home_of = |km: &Keymap, c: &CommandRef| km.bindable(c).map_or_else(Scope::app, |b| b.scope.clone());
+            let label_of = |km: &Keymap, c: &CommandRef| km.bindable(c).map(|b| b.label.clone()).unwrap_or_default();
+            let mut decided: HashSet<String> = HashSet::new();
+            // Commands whose change failed keep the bindings they had, whatever later changes free.
+            let mut failed_here: HashSet<String> = HashSet::new();
+            for (c, (p, list)) in self.commands.iter().zip(&accepted).enumerate() {
+                let failed =
+                    |km: &Keymap, change, shortcuts| Failed { command: p.command.clone(), label: label_of(km, &p.command), change, shortcuts };
+                if let Some(f) = dropped.get(&c) {
+                    report.failed.push(f.clone());
+                    failed_here.insert(p.command.key());
+                    continue;
+                }
+                if !list.is_empty() {
+                    let list = in_default_order(keymap, &p.command, list);
+                    if keymap.set_bindings(&p.command, list.clone(), Policy::Keep).is_err() {
+                        let home = home_of(keymap, &p.command);
+                        let f = failed(keymap, FailedChange::Bind, list.iter().map(|b| b.text(&home)).collect());
+                        if displaced.contains(&c) {
+                            dropped.insert(c, f);
+                            *keymap = start.clone();
+                            continue 'attempt;
+                        }
+                        report.failed.push(f);
+                        failed_here.insert(p.command.key());
+                        continue;
+                    }
+                } else if p.none_defined && self.none_defined == NoneDefined::Clear {
+                    if !keymap.clear(&p.command) {
+                        report.failed.push(failed(keymap, FailedChange::Clear, Vec::new()));
+                        failed_here.insert(p.command.key());
+                        continue;
+                    }
+                } else {
+                    continue;
+                }
+                decided.insert(p.command.key());
+            }
+
+            // A command that cannot take a chord from another command is dropped, so both keep
+            // the bindings they had. That includes a command whose own change failed: freeing an
+            // entry later must not take its chord away.
+            let mut unbind_failed = false;
+            for (c, (p, list)) in self.commands.iter().zip(&accepted).enumerate() {
+                if list.is_empty() || !decided.contains(&p.command.key()) {
+                    continue;
+                }
+                for h in keymap.clashing(&p.command, list) {
+                    if decided.contains(&h.command.key()) {
+                        continue;
+                    }
+                    let home = home_of(keymap, &h.command);
+                    let label = label_of(keymap, &h.command);
+                    let shortcut = h.binding.text(&home);
+                    if !failed_here.contains(&h.command.key()) && keymap.remove(&h.command, &h.binding) {
+                        report.conflicts_cleared.push(Cleared { command: h.command, label, shortcut });
+                    } else {
+                        let home = home_of(keymap, &p.command);
+                        let list = in_default_order(keymap, &p.command, list);
+                        let shortcuts = list.iter().map(|b| b.text(&home)).collect();
+                        dropped.insert(
+                            c,
+                            Failed { command: p.command.clone(), label: label_of(keymap, &p.command), change: FailedChange::Bind, shortcuts },
+                        );
+                        unbind_failed = true;
+                        break;
+                    }
+                }
+            }
+            if unbind_failed {
+                *keymap = start.clone();
+                continue 'attempt;
+            }
+
+            for (p, from) in self.commands.iter().zip(&before) {
+                if !decided.contains(&p.command.key()) {
+                    continue;
+                }
+                let to = keymap.bindings(&p.command);
+                if to == *from {
+                    continue;
+                }
+                let home = home_of(keymap, &p.command);
+                let texts = |l: &[Binding]| l.iter().map(|b| b.text(&home)).collect::<Vec<_>>();
+                report.changed.push(Changed {
+                    command: p.command.clone(),
+                    label: label_of(keymap, &p.command),
+                    item: p.item.clone(),
+                    line: p.line,
+                    from: texts(from),
+                    to: texts(&to),
+                });
+            }
+            report.imported = report.changed.len();
+            return report;
+        }
+    }
+
+    /// Settles which command each claimed chord goes to, in entry order, leaving out the claims of
+    /// `dropped` commands. Returns each command's accepted bindings and the commands that took a
+    /// chord from an earlier entry; skipped keys go to `report`.
+    fn resolve(&self, keymap: &Keymap, dropped: &HashMap<usize, Failed>, report: &mut ImportReport) -> (Vec<Vec<Binding>>, HashSet<usize>) {
+        let home_of = |c: &CommandRef| keymap.bindable(c).map_or_else(Scope::app, |b| b.scope.clone());
+        let mut claims: Vec<(usize, &PlannedBinding)> =
+            self.commands.iter().enumerate().flat_map(|(c, p)| p.bindings.iter().map(move |b| (c, b))).collect();
+        claims.sort_by_key(|(_, b)| b.order);
+        let platform = keymap.platform();
+        let mut taken: HashMap<Trigger, Vec<TakenGroup>> = HashMap::new();
+        let mut accepted: Vec<Vec<&PlannedBinding>> = vec![Vec::new(); self.commands.len()];
+        let mut displaced: HashSet<usize> = HashSet::new();
+        for (c, pb) in claims {
+            let Some(p) = self.commands.get(c) else { continue };
+            let shortcut = || pb.binding.text(&home_of(&p.command));
+            let skip =
+                |reason| Skipped { command: p.command.clone(), item: pb.item.clone(), line: pb.line, shortcut: shortcut(), kept_by: None, reason };
+            if keymap.is_reserved(&pb.binding.trigger.chord) {
+                report.skipped.push(skip(SkipReason::Reserved));
+                continue;
+            }
+            if pb.binding.scope.as_ref().is_some_and(|s| !keymap.knows_scope(s)) {
+                report.skipped.push(skip(SkipReason::UnknownScope));
+                continue;
+            }
+            if dropped.contains_key(&c) {
+                continue;
+            }
+            let effective = pb.binding.trigger.effective(platform);
+            let (scope, tools) = match keymap.bindable(&p.command) {
+                Some(b) => (pb.binding.scope_or(&b.scope).clone(), if let Kind::Tool { group } = &b.kind { Some(group.clone()) } else { None }),
+                None => (pb.binding.scope.clone().unwrap_or_else(Scope::app), None),
+            };
+            let groups = taken.entry(effective).or_default();
+            let mut lost: Vec<(usize, &PlannedBinding)> = Vec::new();
+            for g in groups.iter_mut().filter(|g| !(tools.is_some() && g.tools == tools) && keymap.scopes().relation(&g.scope, &scope) == Some(true))
+            {
+                g.holders.retain(|&(k, earlier)| {
+                    let clash =
+                        self.commands.get(k).is_some_and(|other| keymap.pair_clashes(&other.command, &earlier.binding, &p.command, &pb.binding));
+                    if clash {
+                        lost.push((k, earlier));
+                    }
+                    !clash
+                });
+            }
+            if !lost.is_empty() {
+                displaced.insert(c);
+            }
+            for (k, earlier) in lost {
+                if let Some(list) = accepted.get_mut(k) {
+                    list.retain(|b| !std::ptr::eq(*b, earlier));
+                }
+                let Some(other) = self.commands.get(k) else { continue };
+                report.skipped.push(Skipped {
+                    command: other.command.clone(),
+                    item: earlier.item.clone(),
+                    line: earlier.line,
+                    shortcut: earlier.binding.text(&home_of(&other.command)),
+                    kept_by: Some(p.command.clone()),
+                    reason: SkipReason::Taken,
+                });
+            }
+            match groups.iter_mut().find(|g| g.scope == scope && g.tools == tools) {
+                Some(g) => g.holders.push((c, pb)),
+                None => groups.push(TakenGroup { scope, tools, holders: vec![(c, pb)] }),
+            }
+            if let Some(list) = accepted.get_mut(c) {
+                list.push(pb);
+            }
+        }
+        let accepted = accepted.into_iter().map(|l| l.into_iter().map(|b| b.binding.clone()).collect()).collect();
+        (accepted, displaced)
+    }
+}
+
+/// Claims of one chord that [`ImportPlan::apply`] accepted, with one scope and tool group (as
+/// [`Keymap::conflicts`] groups them), so a claim is compared only with groups it can clash with.
+struct TakenGroup<'a> {
+    scope: Scope,
+    /// The tool group, for tools.
+    tools: Option<Option<String>>,
+    /// Plan command index and claim.
+    holders: Vec<(usize, &'a PlannedBinding)>,
+}
+
+/// `list` in the order of the command's defaults when it holds the same bindings, so an import
+/// equal to the defaults leaves no override.
+fn in_default_order(keymap: &Keymap, command: &CommandRef, list: &[Binding]) -> Vec<Binding> {
+    let Some(home) = keymap.bindable(command).map(|b| b.scope.clone()) else { return list.to_vec() };
+    let key = |b: &Binding| (b.trigger, b.scope_or(&home).clone());
+    let defaults = keymap.default_bindings(command);
+    let mut a: Vec<_> = list.iter().map(key).collect();
+    let mut d: Vec<_> = defaults.iter().map(key).collect();
+    a.sort();
+    d.sort();
+    if a == d { defaults } else { list.to_vec() }
+}
+
+fn keys_text<'a>(keys: impl Iterator<Item = &'a ForeignKey>) -> String {
+    keys.map(|k| match &k.context {
+        Some(c) => format!("{c}: {}", k.text),
+        None => k.text.clone(),
+    })
+    .collect::<Vec<_>>()
+    .join(", ")
+}
+
+/// `s` cut to [`MAX_IMPORT_TEXT`] chars, counting a cut in `cut`.
+fn cap_text(s: &str, cut: &mut usize) -> String {
+    match s.char_indices().nth(MAX_IMPORT_TEXT) {
+        Some((end, _)) => {
+            *cut += 1;
+            s.get(..end).unwrap_or_default().to_string()
+        }
+        None => s.to_string(),
+    }
+}
+
+/// A copy of `e` within the caps.
+fn capped(e: &ForeignEntry, cut: &mut usize) -> ForeignEntry {
+    let mut path: Vec<String> = e.path.iter().take(MAX_PATH_SEGMENTS.saturating_sub(1)).map(|s| cap_text(s, cut)).collect();
+    if e.path.len() > MAX_PATH_SEGMENTS {
+        *cut += e.path.len() - MAX_PATH_SEGMENTS;
+    }
+    if let Some(last) = e.path.get(path.len()..).and_then(<[String]>::last) {
+        path.push(cap_text(last, cut));
+    }
+    *cut += e.keys.len().saturating_sub(MAX_KEYS_PER_ENTRY);
+    let keys = e
+        .keys
+        .iter()
+        .take(MAX_KEYS_PER_ENTRY)
+        .map(|k| ForeignKey {
+            context: k.context.as_deref().map(|c| cap_text(c, cut)),
+            text: cap_text(&k.text, cut),
+            trigger: match &k.trigger {
+                Ok(t) => Ok(*t),
+                Err(ForeignError::UnknownKey(s)) => Err(ForeignError::UnknownKey(cap_text(s, cut))),
+                Err(ForeignError::UnsupportedModifier(s)) => Err(ForeignError::UnsupportedModifier(cap_text(s, cut))),
+                Err(other) => Err(other.clone()),
+            },
+            notes: k.notes.iter().fold(Vec::new(), |mut notes, n| {
+                if !notes.contains(n) {
+                    notes.push(*n);
+                }
+                notes
+            }),
+        })
+        .collect();
+    ForeignEntry { menu: e.menu.as_deref().map(|m| cap_text(m, cut)), path, keys, line: e.line, is_tool: e.is_tool, panel_menu: e.panel_menu }
+}
+
+enum Found {
+    /// The command, and whether only a panel-menu step found it.
+    One(usize, bool),
+    Many,
+    None,
+}
+
+/// Catalog names in one form, for the match steps.
+#[derive(Default)]
+struct Names {
+    /// Normalized paths joined by U+001F.
+    paths: HashMap<String, Vec<usize>>,
+    /// The last two or more segments of paths, also with the label as the last one, joined by
+    /// U+001F: for panel-menu entries.
+    ends: HashMap<String, Vec<usize>>,
+    /// (top menu, label, alias or path label) at any depth of that menu.
+    in_menu: HashMap<(String, String), Vec<usize>>,
+    /// Labels, aliases and path labels anywhere.
+    anywhere: HashMap<String, Vec<usize>>,
+}
+
+fn add<K: std::hash::Hash + Eq>(map: &mut HashMap<K, Vec<usize>>, key: K, i: usize) {
+    let list = map.entry(key).or_default();
+    if list.last() != Some(&i) {
+        list.push(i);
+    }
+}
+
+impl Names {
+    /// Adds command `i`, its label, aliases and the last segment of each path passed through `form`.
+    fn add(&mut self, i: usize, b: &Bindable, form: fn(&str) -> String) {
+        let label = form(&normalize_label(&b.label));
+        let names: Vec<String> = std::iter::once(label.clone()).chain(b.aliases.iter().map(|a| form(&normalize_label(a)))).collect();
+        for name in &names {
+            add(&mut self.anywhere, name.clone(), i);
+        }
+        for path in b.paths.iter().chain(&b.import_paths) {
+            let mut segs: Vec<String> = path.iter().map(|s| normalize_label(s)).collect();
+            if let [_, .., last] = segs.as_mut_slice() {
+                *last = form(last);
+            }
+            add(&mut self.paths, segs.join("\u{1f}"), i);
+            let Some(top) = segs.first() else { continue };
+            for name in &names {
+                add(&mut self.in_menu, (top.clone(), name.clone()), i);
+            }
+            let [_, .., last] = segs.as_slice() else { continue };
+            add(&mut self.in_menu, (top.clone(), last.clone()), i);
+            add(&mut self.anywhere, last.clone(), i);
+            let mut with_label = segs.clone();
+            if let Some(l) = with_label.last_mut() {
+                *l = label.clone();
+            }
+            for variant in [&segs, &with_label] {
+                for start in 0..variant.len().saturating_sub(1) {
+                    if let Some(end) = variant.get(start..) {
+                        add(&mut self.ends, end.join("\u{1f}"), i);
+                    }
+                }
+            }
+        }
+    }
+
+    /// The lists the match steps look up for an entry's normalized menu and path, most specific
+    /// first, each with whether it is a panel-menu step. `panel` is `Some(known)` for a panel-menu
+    /// entry, `known` saying whether the catalog has its panel; only then does its last segment
+    /// alone match.
+    fn steps(&self, menu: Option<&String>, segs: &[String], panel: Option<bool>) -> Vec<(Option<&Vec<usize>>, bool)> {
+        let Some(last) = segs.last() else { return Vec::new() };
+        let full = menu.into_iter().chain(segs).map(String::as_str).collect::<Vec<_>>().join("\u{1f}");
+        let mut steps = vec![(self.paths.get(&full), false)];
+        let joined = (segs.len() > 1).then(|| segs.join(" "));
+        if let Some(m) = menu {
+            if let Some(j) = &joined {
+                steps.push((self.in_menu.get(&(m.clone(), j.clone())), false));
+            }
+            steps.push((self.in_menu.get(&(m.clone(), last.clone())), false));
+        }
+        if panel.is_some() && segs.len() > 1 {
+            steps.push((self.ends.get(&segs.join("\u{1f}")), true));
+        }
+        if let Some(j) = &joined {
+            steps.push((self.anywhere.get(j), false));
+        }
+        if menu.is_some() || segs.len() == 1 {
+            steps.push((self.anywhere.get(last), false));
+        } else if panel == Some(true) {
+            steps.push((self.anywhere.get(last), true));
+        }
+        steps
+    }
+}
+
+/// The catalog by normalized path and label, for the match steps.
+struct Index {
+    tool: Vec<bool>,
+    /// Binding keys, for remembered answers.
+    keys: HashMap<String, usize>,
+    names: Names,
+    /// Toggle commands by their names without a leading Show/Hide ([`toggle_name`]).
+    toggles: Names,
+    /// Every normalized segment of every catalog path: the panels and menus the app has.
+    segments: HashSet<String>,
+}
+
+impl Index {
+    fn new(keymap: &Keymap) -> Index {
+        let mut ix = Index { tool: Vec::new(), keys: HashMap::new(), names: Names::default(), toggles: Names::default(), segments: HashSet::new() };
+        for (i, b) in keymap.catalog().iter().enumerate() {
+            ix.tool.push(matches!(b.kind, Kind::Tool { .. }));
+            ix.keys.insert(b.command.key(), i);
+            ix.names.add(i, b, str::to_string);
+            ix.segments.extend(b.paths.iter().chain(&b.import_paths).flatten().map(|s| normalize_label(s)));
+            if b.is_toggle {
+                ix.toggles.add(i, b, toggle_name);
+            }
+        }
+        ix
+    }
+
+    fn pick(&self, list: Option<&Vec<usize>>, tool: bool) -> Found {
+        let mut fits = list.into_iter().flatten().filter(|i| self.tool.get(**i) == Some(&tool));
+        match (fits.next(), fits.next()) {
+            (Some(i), None) => Found::One(*i, false),
+            (Some(_), Some(_)) => Found::Many,
+            _ => Found::None,
+        }
+    }
+
+    /// The match steps in order; the first that finds exactly one command decides. The steps run
+    /// on the names as written, then on toggle commands with the entry's label and theirs
+    /// without a leading Show/Hide. A panel-menu entry's last segment alone matches only when
+    /// its first segment, the panel, is a segment of some catalog path.
+    fn find(&self, entry: &ForeignEntry, tool: bool, remembered: &BTreeMap<String, CommandRef>) -> Found {
+        if let Some(c) = remembered.get(&entry.remember_key())
+            && let Some(&i) = self.keys.get(&c.key())
+            && self.tool.get(i) == Some(&tool)
+        {
+            return Found::One(i, false);
+        }
+        let segs: Vec<String> = entry.path.iter().map(|s| normalize_label(s)).collect();
+        let mut toggle_segs = segs.clone();
+        if let Some(last) = toggle_segs.last_mut() {
+            *last = toggle_name(last);
+        }
+        let menu = entry.menu.as_deref().map(normalize_label);
+        let panel = entry.panel_menu.then(|| segs.first().is_some_and(|p| self.segments.contains(p)));
+        let steps = self.names.steps(menu.as_ref(), &segs, panel);
+        let toggle_steps = self.toggles.steps(menu.as_ref(), &toggle_segs, panel);
+        let mut many = false;
+        for (list, by_panel) in steps.into_iter().chain(toggle_steps) {
+            match self.pick(list, tool) {
+                Found::One(i, _) => return Found::One(i, by_panel),
+                Found::Many => many = true,
+                Found::None => {}
+            }
+        }
+        if many { Found::Many } else { Found::None }
+    }
+}
+
+/// An unmatched entry to look for likely commands for.
+struct ToSuggest {
+    item: String,
+    line: Option<usize>,
+    label: String,
+    tool: bool,
+}
+
+/// Fuzzy candidates for unmatched entries, among commands of the same kind.
+fn suggest(keymap: &Keymap, entries: &[ToSuggest]) -> Vec<Suggestion> {
+    let pool = |tool: bool| -> Vec<&Bindable> { keymap.catalog().iter().filter(|b| matches!(b.kind, Kind::Tool { .. }) == tool).collect() };
+    let matcher = |pool: &[&Bindable]| {
+        let candidates: Vec<namematch::Candidate> = pool
+            .iter()
+            .map(|b| {
+                let labels = std::iter::once(&b.label)
+                    .chain(&b.aliases)
+                    .chain(b.paths.iter().chain(&b.import_paths).filter_map(|p| p.last()))
+                    .cloned()
+                    .collect();
+                namematch::Candidate { id: b.command.id.clone(), labels }
+            })
+            .collect();
+        namematch::Matcher::new(&candidates)
+    };
+    let pools = [pool(false), pool(true)];
+    let mut matchers: [Option<namematch::Matcher>; 2] = [None, None];
+    let mut out = Vec::new();
+    for ToSuggest { item, line, label, tool } in entries {
+        let k = usize::from(*tool);
+        let (Some(pool), Some(slot)) = (pools.get(k), matchers.get_mut(k)) else { continue };
+        let picks = match slot.get_or_insert_with(|| matcher(pool)).propose(label) {
+            namematch::Proposal::Match(i, _) => vec![i],
+            namematch::Proposal::Choice(v) => v,
+        };
+        let candidates: Vec<CommandRef> = picks.iter().filter_map(|i| pool.get(*i)).map(|b| b.command.clone()).collect();
+        if !candidates.is_empty() {
+            out.push(Suggestion { item: item.clone(), line: *line, candidates });
+        }
+    }
+    out
+}
diff --git a/crates/keymap/src/import/namematch.rs b/crates/keymap/src/import/namematch.rs
new file mode 100644
index 00000000..e889d118
--- /dev/null
+++ b/crates/keymap/src/import/namematch.rs
@@ -0,0 +1,351 @@
+//! Fuzzy matching of a name another application's file writes (a shortcut set's item label)
+//! against an app's commands, by their ids and labels only. A match is proposed when one candidate
+//! scores well and clearly ahead of the next; otherwise the best few are offered to choose from.
+//!
+//! From VectorCraft `crates/engine/src/namematch.rs`: Dice coefficients over words and over
+//! character pairs.
+
+use std::collections::HashMap;
+
+/// A command a name can stand for.
+#[derive(Clone, Debug)]
+pub struct Candidate {
+    /// A command id such as `select.all`; a `tool:` or `panel:` prefix is ignored.
+    pub id: String,
+    /// Its labels: the English one, the one in the interface language, other names.
+    pub labels: Vec<String>,
+}
+
+/// What a name stands for, as far as [`propose`] can tell.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Proposal {
+    /// The candidate at this index of the list, with its score (0 to 1).
+    Match(usize, f64),
+    /// The best candidates, best first, when none stands out.
+    Choice(Vec<usize>),
+}
+
+/// The lowest score [`Proposal::Match`] proposes.
+pub const THRESHOLD: f64 = 0.6;
+/// How far the best score must lead the next one to be proposed.
+pub const MARGIN: f64 = 0.1;
+/// The most candidates a [`Proposal::Choice`] lists.
+pub const CHOICES: usize = 5;
+/// The lowest score a [`Proposal::Choice`] lists.
+pub const CHOICE_FLOOR: f64 = 0.3;
+/// How many characters of a name or label are compared; the rest is ignored, so a long name
+/// costs no more than this.
+pub const MAX_NAME_CHARS: usize = 200;
+
+/// The first [`MAX_NAME_CHARS`] characters of `s`.
+fn head(s: &str) -> &str {
+    s.char_indices().nth(MAX_NAME_CHARS).and_then(|(end, _)| s.get(..end)).unwrap_or(s)
+}
+
+/// `s` with only its letters and digits, lowercased.
+fn folded(s: &str) -> String {
+    s.chars().filter(|c| c.is_alphanumeric()).flat_map(char::to_lowercase).collect()
+}
+
+/// The words of `s`, lowercased: runs of letters and digits, split where a lowercase letter or a digit
+/// meets an uppercase one (`selectAll`: `select`, `all`).
+fn words(s: &str) -> Vec<String> {
+    let mut out = vec![];
+    let mut word = String::new();
+    let mut prev_lower = false;
+    for c in s.chars() {
+        if !c.is_alphanumeric() {
+            if !word.is_empty() {
+                out.push(std::mem::take(&mut word));
+            }
+            prev_lower = false;
+            continue;
+        }
+        if c.is_uppercase() && prev_lower && !word.is_empty() {
+            out.push(std::mem::take(&mut word));
+        }
+        prev_lower = c.is_lowercase() || c.is_ascii_digit();
+        word.extend(c.to_lowercase());
+    }
+    if !word.is_empty() {
+        out.push(word);
+    }
+    out
+}
+
+/// The words of a candidate's id: its segments after any `tool:` or `panel:`, split as [`words`].
+fn id_words(id: &str) -> Vec<String> {
+    let id = id.strip_prefix("tool:").or_else(|| id.strip_prefix("panel:")).unwrap_or(id);
+    id.split('.').flat_map(words).collect()
+}
+
+/// How many words `a` and `b` share, each word counted once, as a Dice coefficient (0 to 1).
+fn word_overlap(a: &[String], b: &[String]) -> f64 {
+    if a.is_empty() || b.is_empty() {
+        return 0.0;
+    }
+    let mut rest: Vec<&String> = b.iter().collect();
+    let mut shared = 0usize;
+    for w in a {
+        if let Some(i) = rest.iter().position(|x| *x == w) {
+            rest.swap_remove(i);
+            shared += 1;
+        }
+    }
+    (2 * shared) as f64 / (a.len() + b.len()) as f64
+}
+
+/// The pairs of neighboring characters in `s`.
+fn pairs(s: &str) -> Vec<(char, char)> {
+    let c: Vec<char> = s.chars().collect();
+    c.windows(2).filter_map(|w| Some((*w.first()?, *w.get(1)?))).collect()
+}
+
+/// How many character pairs `a` and `b` (each sorted) share, as a Dice coefficient (0 to 1): for
+/// names written without spaces. Linear in their lengths, so long names in a file stay quick.
+fn pair_similarity(a: &[(char, char)], b: &[(char, char)]) -> f64 {
+    if a.is_empty() || b.is_empty() {
+        return 0.0;
+    }
+    let (mut i, mut j, mut shared) = (0usize, 0usize, 0usize);
+    while let (Some(p), Some(q)) = (a.get(i), b.get(j)) {
+        match p.cmp(q) {
+            std::cmp::Ordering::Less => i += 1,
+            std::cmp::Ordering::Greater => j += 1,
+            std::cmp::Ordering::Equal => {
+                shared += 1;
+                i += 1;
+                j += 1;
+            }
+        }
+    }
+    (2 * shared) as f64 / (a.len() + b.len()) as f64
+}
+
+/// A name or label as the scores compare it: its letters and digits (lowercased), its words and the
+/// character pairs of the former (sorted).
+struct Text {
+    folded: String,
+    words: Vec<String>,
+    pairs: Vec<(char, char)>,
+}
+
+impl Text {
+    fn of(s: &str) -> Self {
+        let s = head(s);
+        let folded = folded(s);
+        let mut pairs = pairs(&folded);
+        pairs.sort_unstable();
+        Self { pairs, words: words(s), folded }
+    }
+}
+
+/// A candidate as the scores compare it.
+struct Prepared {
+    /// Its id's words, and those joined.
+    id_words: Vec<String>,
+    id: String,
+    labels: Vec<Text>,
+}
+
+impl Prepared {
+    fn of(c: &Candidate) -> Self {
+        let id_words = id_words(&c.id);
+        Self { id: id_words.concat(), id_words, labels: c.labels.iter().map(|l| Text::of(l)).collect() }
+    }
+
+    /// See [`score`].
+    fn score(&self, name: &Text) -> f64 {
+        if name.folded.is_empty() {
+            return 0.0;
+        }
+        if name.folded == self.id || self.labels.iter().any(|l| l.folded == name.folded) {
+            return 1.0;
+        }
+        let by_words = self.labels.iter().map(|l| word_overlap(&name.words, &l.words)).fold(word_overlap(&name.words, &self.id_words), f64::max);
+        let by_pairs = self.labels.iter().map(|l| pair_similarity(&name.pairs, &l.pairs)).fold(0.0, f64::max);
+        by_words.max(by_pairs * 0.9)
+    }
+}
+
+/// How well `name` fits `candidate` (0 to 1): 1 when it equals a label or the id, its letters and
+/// digits compared without case; else the best of word overlap and character-pair similarity, the
+/// latter counted a little lower. Only the first [`MAX_NAME_CHARS`] characters of the name and
+/// of each label count.
+pub fn score(name: &str, candidate: &Candidate) -> f64 {
+    Prepared::of(candidate).score(&Text::of(name))
+}
+
+/// The candidate `name` stands for, when one scores at least 0.6 and 0.1 ahead of every other; else
+/// the best five that score at least 0.3, to choose from.
+pub fn propose(name: &str, candidates: &[Candidate]) -> Proposal {
+    Matcher::new(candidates).propose(name)
+}
+
+/// [`propose`] for many names against the same candidates: each candidate's words and character
+/// pairs are worked out once, and a name is scored only against the candidates that share a word or
+/// a character pair with it (the others score 0).
+pub struct Matcher {
+    prepared: Vec<Prepared>,
+    /// Candidates by their joined id words and their labels' letters and digits.
+    exact: HashMap<String, Vec<usize>>,
+    /// Candidates by a word of their id or labels.
+    by_word: HashMap<String, Vec<usize>>,
+    /// Candidates by a character pair of their labels.
+    by_pair: HashMap<(char, char), Vec<usize>>,
+}
+
+impl Matcher {
+    /// Prepares `candidates` once for many [`Matcher::propose`] calls.
+    pub fn new(candidates: &[Candidate]) -> Self {
+        let prepared: Vec<Prepared> = candidates.iter().map(Prepared::of).collect();
+        let (mut exact, mut by_word, mut by_pair) = (HashMap::new(), HashMap::new(), HashMap::new());
+        fn add<K: std::hash::Hash + Eq>(map: &mut HashMap<K, Vec<usize>>, key: K, i: usize) {
+            let list = map.entry(key).or_default();
+            if list.last() != Some(&i) {
+                list.push(i);
+            }
+        }
+        for (i, p) in prepared.iter().enumerate() {
+            add(&mut exact, p.id.clone(), i);
+            for l in &p.labels {
+                add(&mut exact, l.folded.clone(), i);
+            }
+            for w in p.id_words.iter().chain(p.labels.iter().flat_map(|l| &l.words)) {
+                add(&mut by_word, w.clone(), i);
+            }
+            for pair in p.labels.iter().flat_map(|l| &l.pairs) {
+                add(&mut by_pair, *pair, i);
+            }
+        }
+        Self { prepared, exact, by_word, by_pair }
+    }
+
+    /// See [`propose`].
+    pub fn propose(&self, name: &str) -> Proposal {
+        let text = Text::of(name);
+        let mut seen = vec![false; self.prepared.len()];
+        let lists = self
+            .exact
+            .get(&text.folded)
+            .into_iter()
+            .chain(text.words.iter().filter_map(|w| self.by_word.get(w)))
+            // Each pair looked up once (they are sorted).
+            .chain(text.pairs.chunk_by(|a, b| a == b).filter_map(|c| self.by_pair.get(c.first()?)));
+        let mut scored: Vec<(usize, f64)> = vec![];
+        for &i in lists.flatten() {
+            if let Some(s) = seen.get_mut(i)
+                && !*s
+            {
+                *s = true;
+                let score = self.prepared.get(i).map_or(0.0, |p| p.score(&text));
+                if score >= CHOICE_FLOOR {
+                    scored.push((i, score));
+                }
+            }
+        }
+        scored.sort_by(|a, b| b.1.total_cmp(&a.1).then(a.0.cmp(&b.0)));
+        match (scored.first(), scored.get(1)) {
+            (Some(&(i, best)), next) if best >= THRESHOLD && next.is_none_or(|n| best - n.1 >= MARGIN) => Proposal::Match(i, best),
+            _ => Proposal::Choice(scored.iter().take(CHOICES).map(|(i, _)| *i).collect()),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn candidates(list: &[(&str, &str)]) -> Vec<Candidate> {
+        list.iter().map(|(id, label)| Candidate { id: id.to_string(), labels: vec![label.to_string()] }).collect()
+    }
+
+    fn proposed<'a>(name: &str, list: &'a [Candidate]) -> Option<&'a str> {
+        match propose(name, list) {
+            Proposal::Match(i, _) => list.get(i).map(|c| c.id.as_str()),
+            Proposal::Choice(_) => None,
+        }
+    }
+
+    #[test]
+    fn extra_words_still_find_the_tool() {
+        let tools = candidates(&[
+            ("tool:rectangle", "Rectangle Tool"),
+            ("tool:roundedRectangle", "Rounded Rectangle Tool"),
+            ("tool:rectangularGrid", "Rectangular Grid Tool"),
+            ("tool:ellipse", "Ellipse Tool"),
+        ]);
+        assert_eq!(proposed("Acme Rectangle Tool", &tools), Some("tool:rectangle"));
+        assert_eq!(proposed("Rounded Rectangle", &tools), Some("tool:roundedRectangle"));
+        assert_eq!(proposed("ellipse tool", &tools), Some("tool:ellipse"), "case aside, the label itself");
+    }
+
+    #[test]
+    fn letters_only_names_match_ids() {
+        let commands = candidates(&[("acme.copyAll", "Everything"), ("acme.copyAllOnPage", "Everything on This Page"), ("acme.clear", "Clear Out")]);
+        assert_eq!(proposed("acmecopyall", &commands), Some("acme.copyAll"));
+        assert_eq!(proposed("Acme Copy All On Page", &commands), Some("acme.copyAllOnPage"));
+        assert_eq!(proposed("clear out", &commands), Some("acme.clear"));
+    }
+
+    #[test]
+    fn ties_need_a_choice() {
+        let tools = candidates(&[("tool:rectangle", "Rectangle Tool"), ("tool:ellipse", "Ellipse Tool"), ("tool:star", "Star Tool")]);
+        assert_eq!(propose("Tool", &tools), Proposal::Choice(vec![0, 1, 2]));
+        assert_eq!(propose("Nothing Alike", &tools), Proposal::Choice(vec![]));
+        assert_eq!(propose("", &tools), Proposal::Choice(vec![]));
+    }
+
+    #[test]
+    fn names_without_spaces_match_by_character_pairs() {
+        let list = vec![
+            Candidate { id: "tool:rectangle".into(), labels: vec!["Rectangle Tool".into(), "長方形ツール".into()] },
+            Candidate { id: "tool:ellipse".into(), labels: vec!["Ellipse Tool".into(), "楕円形ツール".into()] },
+        ];
+        assert_eq!(proposed("長方形ツール", &list), Some("tool:rectangle"));
+        assert_eq!(proposed("楕円形 ツール", &list), Some("tool:ellipse"), "spaces and punctuation aside");
+        assert_eq!(proposed("楕円形ツール2", &list), Some("tool:ellipse"), "most character pairs shared");
+    }
+
+    #[test]
+    fn the_index_finds_what_scoring_every_candidate_finds() {
+        let list = candidates(&[
+            ("tool:rectangle", "Rectangle Tool"),
+            ("tool:roundedRectangle", "Rounded Rectangle Tool"),
+            ("tool:ellipse", "Ellipse Tool"),
+            ("select.all", "All"),
+            ("select.none", "Deselect"),
+            ("edit.undo", "Undo"),
+            ("foo.bar", "Zzz"),
+            ("panel:layers", "Layers"),
+        ]);
+        let matcher = Matcher::new(&list);
+        for name in ["Acme Rectangle Tool", "rounded", "acmecopyall", "foobar", "zz", "Lay", "Undo Redo", "ツール", "", "e"] {
+            let mut scored: Vec<(usize, f64)> =
+                list.iter().enumerate().map(|(i, c)| (i, score(name, c))).filter(|(_, s)| *s >= CHOICE_FLOOR).collect();
+            scored.sort_by(|a, b| b.1.total_cmp(&a.1).then(a.0.cmp(&b.0)));
+            let every = match (scored.first(), scored.get(1)) {
+                (Some(&(i, best)), next) if best >= THRESHOLD && next.is_none_or(|n| best - n.1 >= MARGIN) => Proposal::Match(i, best),
+                _ => Proposal::Choice(scored.iter().take(CHOICES).map(|(i, _)| *i).collect()),
+            };
+            assert_eq!(matcher.propose(name), every, "{name}");
+        }
+        assert_eq!(proposed("foobar", &list), Some("foo.bar"), "the id alone, sharing no word or pair with the label");
+    }
+
+    #[test]
+    fn only_the_head_of_a_long_name_counts() {
+        let label: String = "ä€𝄞b".repeat(50);
+        let candidate = Candidate { id: "acme.long".into(), labels: vec![label.clone()] };
+        assert_eq!(head(&label).chars().count(), MAX_NAME_CHARS);
+        assert_eq!(score(&format!("{label}and more words after the head"), &candidate), 1.0);
+        assert_eq!(head("short"), "short");
+    }
+
+    #[test]
+    fn words_split_camel_case_and_separators() {
+        assert_eq!(words("selectAll_onArtboard 2x"), ["select", "all", "on", "artboard", "2x"]);
+        assert_eq!(words("Acme\u{a0}Lasso-Tool"), ["acme", "lasso", "tool"]);
+        assert_eq!(id_words("tool:roundedRectangle"), ["rounded", "rectangle"]);
+    }
+}
diff --git a/crates/keymap/src/keymap.rs b/crates/keymap/src/keymap.rs
new file mode 100644
index 00000000..33028d6f
--- /dev/null
+++ b/crates/keymap/src/keymap.rs
@@ -0,0 +1,1115 @@
+//! A command catalog with default bindings, the user's overrides, dispatch and conflicts.
+
+pub(crate) mod overrides;
+
+use std::collections::{BTreeSet, HashMap, HashSet};
+use std::fmt;
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+use crate::chord::{Chord, Key, Mods, ParseError, Platform, Trigger};
+use crate::command::{CommandRef, MAX_KEY};
+use crate::scope::{Active, Scope, ScopeKind, Scopes};
+
+pub use overrides::Overrides;
+pub use overrides::list as overrides_list;
+
+/// Most commands a catalog or an [`Overrides`] holds.
+pub const MAX_COMMANDS: usize = 4096;
+/// Most bindings per command.
+pub const MAX_BINDINGS: usize = 16;
+/// Longest binding text, in bytes.
+pub const MAX_BINDING_TEXT: usize = 128;
+/// Most entries [`Keymap::conflicts`] returns.
+pub const MAX_CONFLICTS: usize = 4096;
+
+/// What a binding does when pressed.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum Kind {
+    #[default]
+    Command,
+    /// Selects a tool. Tools of one group share keys and cycle; tools without a group name form one
+    /// group together.
+    Tool { group: Option<String> },
+}
+
+/// A trigger in a scope. `scope: None` is the command's home scope.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct Binding {
+    pub trigger: Trigger,
+    pub scope: Option<Scope>,
+}
+
+/// Why binding text was refused.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum BindingError {
+    TooLong,
+    /// The part before `": "` is not a scope name.
+    Scope,
+    Trigger(ParseError),
+}
+
+impl fmt::Display for BindingError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            BindingError::TooLong => write!(f, "binding text over {MAX_BINDING_TEXT} bytes"),
+            BindingError::Scope => f.write_str("bad scope name"),
+            BindingError::Trigger(e) => e.fmt(f),
+        }
+    }
+}
+
+impl std::error::Error for BindingError {}
+
+impl Binding {
+    /// A binding in the command's home scope.
+    pub fn new(trigger: impl Into<Trigger>) -> Binding {
+        Binding { trigger: trigger.into(), scope: None }
+    }
+
+    pub fn in_scope(trigger: impl Into<Trigger>, scope: Scope) -> Binding {
+        Binding { trigger: trigger.into(), scope: Some(scope) }
+    }
+
+    /// Reads `<trigger>` or `<Scope>: <trigger>`. The whole text is tried as a trigger first, so
+    /// `Cmd+: Cmd+:` is the Colon chord pressed twice; otherwise it is split at the first `": "`.
+    pub fn parse(text: &str) -> Result<Binding, BindingError> {
+        if text.len() > MAX_BINDING_TEXT {
+            return Err(BindingError::TooLong);
+        }
+        let whole = match Trigger::parse(text.trim()) {
+            Ok(trigger) => return Ok(Binding::new(trigger)),
+            Err(e) => e,
+        };
+        match text.split_once(": ") {
+            Some((scope, trigger)) => {
+                let scope = Scope::new(scope.trim()).ok_or(BindingError::Scope)?;
+                let trigger = Trigger::parse(trigger.trim()).map_err(BindingError::Trigger)?;
+                Ok(Binding::in_scope(trigger, scope))
+            }
+            None => Err(BindingError::Trigger(whole)),
+        }
+    }
+
+    /// The binding text for a command whose home scope is `home`: the scope is written only when
+    /// it differs.
+    pub fn text(&self, home: &Scope) -> String {
+        match &self.scope {
+            Some(s) if s != home => format!("{s}: {}", self.trigger),
+            _ => self.trigger.to_string(),
+        }
+    }
+
+    /// The scope, `home` when unset.
+    pub fn scope_or<'a>(&'a self, home: &'a Scope) -> &'a Scope {
+        self.scope.as_ref().unwrap_or(home)
+    }
+}
+
+impl fmt::Display for Binding {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match &self.scope {
+            Some(s) => write!(f, "{s}: {}", self.trigger),
+            None => write!(f, "{}", self.trigger),
+        }
+    }
+}
+
+impl Serialize for Binding {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.collect_str(self)
+    }
+}
+
+impl<'de> Deserialize<'de> for Binding {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Binding, D::Error> {
+        let text = <std::borrow::Cow<'de, str>>::deserialize(deserializer)?;
+        Binding::parse(&text).map_err(serde::de::Error::custom)
+    }
+}
+
+/// A command the user can bind, as the app describes it.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Bindable {
+    pub command: CommandRef,
+    pub label: String,
+    /// Menu paths, the main one first; used by search and import.
+    #[serde(default)]
+    pub paths: Vec<Vec<String>>,
+    /// Paths only import matching reads: where foreign sets file the command and the app's menus
+    /// do not, such as `["Tools", label]` for a tool. They make no areas or groups in the dialog.
+    #[serde(default)]
+    pub import_paths: Vec<Vec<String>>,
+    /// Other names: labels in other UI languages, older names.
+    #[serde(default)]
+    pub aliases: Vec<String>,
+    /// Home scope.
+    pub scope: Scope,
+    #[serde(default)]
+    pub kind: Kind,
+    /// The command shows and hides something (a panel, guides, rulers). Import matching reads a
+    /// foreign name without a leading `Show`, `Hide` or `Show/Hide` only for such commands.
+    #[serde(default)]
+    pub is_toggle: bool,
+    #[serde(default)]
+    pub defaults: Vec<Binding>,
+}
+
+impl Bindable {
+    /// A command in `scope` without default bindings.
+    pub fn new(command: impl Into<CommandRef>, label: impl Into<String>, scope: Scope) -> Bindable {
+        Bindable {
+            command: command.into(),
+            label: label.into(),
+            paths: Vec::new(),
+            import_paths: Vec::new(),
+            aliases: Vec::new(),
+            scope,
+            kind: Kind::Command,
+            is_toggle: false,
+            defaults: Vec::new(),
+        }
+    }
+
+    /// Marks the command as showing and hiding something ([`Bindable::is_toggle`]).
+    pub fn toggle(mut self) -> Bindable {
+        self.is_toggle = true;
+        self
+    }
+
+    pub fn with_kind(mut self, kind: Kind) -> Bindable {
+        self.kind = kind;
+        self
+    }
+
+    pub fn with_default(mut self, binding: Binding) -> Bindable {
+        self.defaults.push(binding);
+        self
+    }
+
+    pub fn with_path(mut self, path: Vec<String>) -> Bindable {
+        self.paths.push(path);
+        self
+    }
+
+    /// Adds a path only import matching reads ([`Bindable::import_paths`]).
+    pub fn with_import_path(mut self, path: Vec<String>) -> Bindable {
+        self.import_paths.push(path);
+        self
+    }
+
+    pub fn with_alias(mut self, alias: impl Into<String>) -> Bindable {
+        self.aliases.push(alias.into());
+        self
+    }
+}
+
+/// Which chords work while a text field has the keyboard. Under every rule, the
+/// [`text_editing_chords`] go to the text field too. Bindings in an active context always work: a
+/// `Text: Cmd+B` binding is meant for typing.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum TypingRule {
+    /// Plain chords (no cmd, ctrl or alt) go to the text; function keys still fire.
+    #[default]
+    PlainKeysWait,
+    /// Only chords with the command modifier and function keys fire.
+    CommandKeysOnly,
+    /// Nothing fires.
+    AllWait,
+}
+
+impl TypingRule {
+    /// Whether `chord` may fire while typing on `platform`.
+    pub fn fires(self, chord: &Chord, platform: Platform) -> bool {
+        if text_editing_chords(platform).contains(&chord.effective(platform)) {
+            return false;
+        }
+        match self {
+            TypingRule::PlainKeysWait => !chord.is_plain() || chord.is_function_key(),
+            TypingRule::CommandKeysOnly => chord.has_command() || chord.is_function_key(),
+            TypingRule::AllWait => false,
+        }
+    }
+}
+
+const CMD: Mods = Mods::CMD;
+const CMD_SHIFT: Mods = Mods { shift: true, ..Mods::CMD };
+const ALT: Mods = Mods::ALT;
+const ALT_SHIFT: Mods = Mods { shift: true, ..Mods::ALT };
+const CTRL: Mods = Mods::CTRL;
+
+// The chords egui's TextEdit acts on that follow the platform's conventions. egui also takes
+// Ctrl+H, Ctrl+K, Ctrl+U and Ctrl+W everywhere, but off macOS those are app commands.
+const MAC_EDITING: &[Chord] = &[
+    // Undo, redo, select all.
+    Chord::new(CMD, Key::Z),
+    Chord::new(CMD_SHIFT, Key::Z),
+    Chord::new(CMD, Key::A),
+    // Words.
+    Chord::new(ALT, Key::Left),
+    Chord::new(ALT, Key::Right),
+    Chord::new(ALT_SHIFT, Key::Left),
+    Chord::new(ALT_SHIFT, Key::Right),
+    Chord::new(ALT, Key::Backspace),
+    Chord::new(ALT, Key::Delete),
+    // Line start and end.
+    Chord::new(CMD, Key::Left),
+    Chord::new(CMD, Key::Right),
+    Chord::new(CMD_SHIFT, Key::Left),
+    Chord::new(CMD_SHIFT, Key::Right),
+    Chord::new(CMD, Key::Backspace),
+    Chord::new(CMD, Key::Delete),
+    // Text start and end.
+    Chord::new(CMD, Key::Up),
+    Chord::new(CMD, Key::Down),
+    Chord::new(CMD_SHIFT, Key::Up),
+    Chord::new(CMD_SHIFT, Key::Down),
+    // The Control keys of Cocoa text fields: line start and end, character and line moves,
+    // deletion.
+    Chord::new(CTRL, Key::A),
+    Chord::new(CTRL, Key::E),
+    Chord::new(CTRL, Key::B),
+    Chord::new(CTRL, Key::F),
+    Chord::new(CTRL, Key::P),
+    Chord::new(CTRL, Key::N),
+    Chord::new(CTRL, Key::H),
+    Chord::new(CTRL, Key::K),
+    Chord::new(CTRL, Key::U),
+    Chord::new(CTRL, Key::W),
+];
+
+const PC_EDITING: &[Chord] = &[
+    // Undo, redo, select all.
+    Chord::new(CMD, Key::Z),
+    Chord::new(CMD, Key::Y),
+    Chord::new(CMD_SHIFT, Key::Z),
+    Chord::new(CMD, Key::A),
+    // Words.
+    Chord::new(CMD, Key::Left),
+    Chord::new(CMD, Key::Right),
+    Chord::new(CMD_SHIFT, Key::Left),
+    Chord::new(CMD_SHIFT, Key::Right),
+    Chord::new(CMD, Key::Backspace),
+    Chord::new(CMD, Key::Delete),
+    // Text start and end.
+    Chord::new(CMD, Key::Home),
+    Chord::new(CMD, Key::End),
+    Chord::new(CMD_SHIFT, Key::Home),
+    Chord::new(CMD_SHIFT, Key::End),
+    Chord::new(CMD, Key::Up),
+    Chord::new(CMD, Key::Down),
+    Chord::new(CMD_SHIFT, Key::Up),
+    Chord::new(CMD_SHIFT, Key::Down),
+];
+
+/// The chords with modifiers that edit text on `platform`, as effective chords: undo, redo,
+/// select all, and moving and deleting by word, line and text. While typing they go to the text
+/// field under every [`TypingRule`]; only a binding in an active context takes one. Plain keys
+/// (arrows, Home, End, Backspace, Delete, with or without Shift) are not listed, since every rule
+/// holds them already. The `egui` dispatcher keeps the clipboard chords for the field itself.
+pub fn text_editing_chords(platform: Platform) -> &'static [Chord] {
+    if platform.is_mac() { MAC_EDITING } else { PC_EDITING }
+}
+
+/// What a key press runs.
+#[derive(Clone, Debug, PartialEq)]
+#[non_exhaustive]
+pub enum Lookup {
+    None,
+    Run(CommandRef),
+    /// Tools of one group share the chord: the app picks the next one (catalog order).
+    Cycle(Vec<CommandRef>),
+}
+
+/// What to do with other commands that hold a chord being assigned.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Policy {
+    /// Remove the chord from them.
+    #[default]
+    Steal,
+    /// Assign anyway; both keep it.
+    Keep,
+    /// Do not assign.
+    Refuse,
+}
+
+/// A command's binding.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Holder {
+    pub command: CommandRef,
+    pub binding: Binding,
+}
+
+/// The result of an assignment.
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Assigned {
+    /// Bindings removed from other commands ([`Policy::Steal`]).
+    pub taken_from: Vec<Holder>,
+    /// Bindings of other commands that now clash ([`Policy::Keep`]).
+    pub clashes: Vec<Holder>,
+}
+
+/// Why an assignment was refused.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum AssignError {
+    UnknownCommand,
+    /// The system takes this chord.
+    Reserved(Trigger),
+    /// More than [`MAX_BINDINGS`] bindings.
+    TooMany,
+    /// Other commands hold the chord ([`Policy::Refuse`]).
+    Taken(Vec<Holder>),
+    /// A scope that is neither registered in [`Scopes`] nor used by the catalog.
+    UnknownScope(Scope),
+    /// The change needs a new [`Overrides`] entry and it already holds [`MAX_COMMANDS`].
+    Full,
+}
+
+impl fmt::Display for AssignError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            AssignError::UnknownCommand => f.write_str("unknown command"),
+            AssignError::Reserved(t) => write!(f, "{t} is reserved by the system"),
+            AssignError::TooMany => write!(f, "more than {MAX_BINDINGS} bindings"),
+            AssignError::Taken(h) => write!(f, "in use by {} other command(s)", h.len()),
+            AssignError::UnknownScope(s) => write!(f, "unknown scope {s}"),
+            AssignError::Full => write!(f, "more than {MAX_COMMANDS} changed commands"),
+        }
+    }
+}
+
+impl std::error::Error for AssignError {}
+
+/// Why loading dropped part of an [`Overrides`] entry.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum DropReason {
+    KeyTooLong,
+    /// The value is not a list of texts.
+    NotAList,
+    /// Items of the list that are not text.
+    NotText,
+    TextTooLong,
+    /// Texts past [`MAX_BINDINGS`].
+    TooManyBindings,
+}
+
+/// Something wrong in the stored overrides. Load reports these instead of failing.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum Problem {
+    /// No command in the catalog has this key; the entry is kept.
+    UnknownCommand { key: String },
+    /// A text that does not parse; the entry keeps it.
+    BadBinding { key: String, text: String, error: BindingError },
+    /// A reserved chord; not bound.
+    Reserved { key: String, text: String },
+    /// A scope that is neither registered in [`Scopes`] nor used by the catalog; not bound.
+    UnknownScope { key: String, text: String },
+    /// Another entry names the same command; this one is ignored.
+    DuplicateKey { key: String },
+    /// Part of an entry dropped while loading.
+    Dropped { key: String, reason: DropReason },
+    /// Entries past [`MAX_COMMANDS`] dropped while loading.
+    TooManyCommands { ignored: usize },
+}
+
+/// How two bindings on one chord relate.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum ConflictKind {
+    /// Only one of the two can run.
+    Clash,
+    /// Both work: the nearer scope runs where it applies, the other elsewhere.
+    Shadow,
+}
+
+/// Two commands on one chord.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct Conflict {
+    /// The effective trigger on the keymap's platform.
+    pub chord: Trigger,
+    pub a: (CommandRef, Binding),
+    pub b: (CommandRef, Binding),
+    pub kind: ConflictKind,
+    /// Both bindings are defaults.
+    pub in_defaults: bool,
+}
+
+/// A binding with its scope resolved.
+type Bound = (Trigger, Scope);
+
+/// A command's bindings on one chord grouped by scope and tool group, for [`Keymap::conflicts`].
+struct Group<'a> {
+    scope: &'a Scope,
+    /// The tool group for tools, `None` for other commands.
+    tools: Option<&'a Option<String>>,
+    /// (position in the chord's list, command, binding).
+    items: Vec<(usize, usize, &'a Bound)>,
+}
+
+/// Two holders of one chord: their positions in the chord's list, whether they clash, and each
+/// one's command and binding.
+type Pair<'a> = (usize, usize, bool, (usize, &'a Bound), (usize, &'a Bound));
+
+/// The catalog, the scope registry, the platform and the user's overrides.
+#[derive(Clone, Debug)]
+pub struct Keymap {
+    catalog: Vec<Bindable>,
+    keys: Vec<String>,
+    index: HashMap<String, usize>,
+    defaults: Vec<Vec<Bound>>,
+    current: Vec<Vec<Bound>>,
+    /// Effective trigger → (command, position in its `current` list), kept in step with `current`.
+    by_trigger: HashMap<Trigger, BTreeSet<(usize, usize)>>,
+    /// The overrides entry each command reads, when it has one.
+    stored: Vec<Option<String>>,
+    /// Whether the overrides hold a hand-written variant of a command's key
+    /// (`window.panel { "panel": "layers" }`); only loading adds them.
+    variants: bool,
+    /// Home and default scopes of the catalog.
+    catalog_scopes: HashSet<Scope>,
+    scopes: Scopes,
+    platform: Platform,
+    typing: TypingRule,
+    reserved: Vec<Chord>,
+    overrides: Overrides,
+}
+
+impl Keymap {
+    /// A keymap with default bindings. Entries past [`MAX_COMMANDS`], with a key over
+    /// [`MAX_KEY`] bytes, or repeating an earlier key are left out.
+    pub fn new(catalog: Vec<Bindable>, scopes: Scopes, platform: Platform) -> Keymap {
+        let mut km = Keymap {
+            catalog: Vec::new(),
+            keys: Vec::new(),
+            index: HashMap::new(),
+            defaults: Vec::new(),
+            current: Vec::new(),
+            by_trigger: HashMap::new(),
+            stored: Vec::new(),
+            variants: false,
+            catalog_scopes: HashSet::new(),
+            scopes,
+            platform,
+            typing: TypingRule::default(),
+            reserved: Vec::new(),
+            overrides: Overrides::new(),
+        };
+        for b in catalog {
+            let key = b.command.key();
+            if km.catalog.len() >= MAX_COMMANDS || key.len() > MAX_KEY || km.index.contains_key(&key) {
+                continue;
+            }
+            let defaults = km.normalize(b.defaults.iter().cloned(), &b.scope);
+            km.catalog_scopes.insert(b.scope.clone());
+            km.catalog_scopes.extend(defaults.iter().map(|(_, s)| s.clone()));
+            km.index.insert(key.clone(), km.catalog.len());
+            km.keys.push(key);
+            km.current.push(defaults.clone());
+            km.defaults.push(defaults);
+            km.stored.push(None);
+            km.catalog.push(b);
+        }
+        km.rebuild_index();
+        km
+    }
+
+    pub fn with_typing_rule(mut self, rule: TypingRule) -> Keymap {
+        self.typing = rule;
+        self
+    }
+
+    /// Chords that cannot be assigned or bound, e.g. [`reserved::system`](crate::reserved::system).
+    /// Without this call the keymap reserves no chord.
+    pub fn with_reserved(mut self, chords: Vec<Chord>) -> Keymap {
+        self.reserved = chords;
+        self.reload();
+        self
+    }
+
+    pub fn with_overrides(mut self, overrides: Overrides) -> Keymap {
+        self.set_overrides(overrides);
+        self
+    }
+
+    pub fn set_overrides(&mut self, overrides: Overrides) {
+        self.overrides = overrides;
+        self.reload();
+    }
+
+    pub fn overrides(&self) -> &Overrides {
+        &self.overrides
+    }
+
+    pub fn platform(&self) -> Platform {
+        self.platform
+    }
+
+    pub fn scopes(&self) -> &Scopes {
+        &self.scopes
+    }
+
+    pub fn typing_rule(&self) -> TypingRule {
+        self.typing
+    }
+
+    pub fn catalog(&self) -> &[Bindable] {
+        &self.catalog
+    }
+
+    pub fn bindable(&self, command: &CommandRef) -> Option<&Bindable> {
+        self.find(command).map(|i| &self.catalog[i])
+    }
+
+    /// The effective bindings of a command; empty for an unknown one.
+    pub fn bindings(&self, command: &CommandRef) -> Vec<Binding> {
+        self.find(command).map(|i| self.current[i].iter().map(|b| self.public(i, b)).collect()).unwrap_or_default()
+    }
+
+    /// The default bindings of a command; empty for an unknown one.
+    pub fn default_bindings(&self, command: &CommandRef) -> Vec<Binding> {
+        self.find(command).map(|i| self.defaults[i].iter().map(|b| self.public(i, b)).collect()).unwrap_or_default()
+    }
+
+    pub fn is_reserved(&self, chord: &Chord) -> bool {
+        let c = chord.effective(self.platform);
+        self.reserved.iter().any(|r| r.effective(self.platform) == c)
+    }
+
+    /// Whether bindings may use `scope`: the application, a scope registered in [`Scopes`], or a
+    /// home or default scope of the catalog.
+    pub fn knows_scope(&self, scope: &Scope) -> bool {
+        scope.is_app() || self.scopes.knows(scope) || self.catalog_scopes.contains(scope)
+    }
+
+    /// The command `chord` (pressed twice when `double`) runs with `active` focus.
+    pub fn lookup(&self, chord: &Chord, double: bool, active: &Active) -> Lookup {
+        let want = Trigger { chord: chord.effective(self.platform), double };
+        let held = active.typing && !self.typing.fires(&want.chord, self.platform);
+        let Some(holders) = self.by_trigger.get(&want) else { return Lookup::None };
+        // Each command's nearest rank; `holders` is in catalog order.
+        let mut ranks: Vec<(usize, u8)> = Vec::new();
+        for &(i, k) in holders {
+            let Some(r) = self.at(i, k).and_then(|(_, s)| self.scopes.rank(s, active)) else { continue };
+            // The typing rule holds back everything except bindings of an active context (rank 0).
+            if held && r != 0 {
+                continue;
+            }
+            match ranks.last_mut() {
+                Some((j, best)) if *j == i => *best = (*best).min(r),
+                _ => ranks.push((i, r)),
+            }
+        }
+        let Some(best) = ranks.iter().map(|(_, r)| *r).min() else { return Lookup::None };
+        let winners: Vec<usize> = ranks.iter().filter(|(_, r)| *r == best).map(|(i, _)| *i).collect();
+        match winners.as_slice() {
+            [] => Lookup::None,
+            [i] => Lookup::Run(self.catalog[*i].command.clone()),
+            [first, rest @ ..] => {
+                if rest.iter().all(|j| self.same_group(*first, *j)) {
+                    Lookup::Cycle(winners.iter().map(|i| self.catalog[*i].command.clone()).collect())
+                } else {
+                    Lookup::Run(self.catalog[*first].command.clone())
+                }
+            }
+        }
+    }
+
+    /// Adds a binding to a command.
+    pub fn assign(&mut self, command: &CommandRef, binding: Binding, policy: Policy) -> Result<Assigned, AssignError> {
+        let i = self.find(command).ok_or(AssignError::UnknownCommand)?;
+        let new = self.bound(i, &binding);
+        if self.current[i].iter().any(|b| self.same(b, &new)) {
+            return Ok(Assigned::default());
+        }
+        let mut list = self.current[i].clone();
+        list.push(new.clone());
+        self.apply(i, list, &[new], policy)
+    }
+
+    /// Replaces all bindings of a command.
+    pub fn set_bindings(&mut self, command: &CommandRef, bindings: Vec<Binding>, policy: Policy) -> Result<Assigned, AssignError> {
+        let i = self.find(command).ok_or(AssignError::UnknownCommand)?;
+        if bindings.len() > MAX_BINDINGS {
+            return Err(AssignError::TooMany);
+        }
+        let home = self.catalog[i].scope.clone();
+        let list = self.normalize(bindings, &home);
+        let new: Vec<Bound> = list.iter().filter(|b| !self.current[i].iter().any(|c| self.same(c, b))).cloned().collect();
+        self.apply(i, list, &new, policy)
+    }
+
+    /// Removes one binding (matched by effective trigger and scope). `false` when the command does
+    /// not have it, or when the change needs a new [`Overrides`] entry and the overrides are full
+    /// ([`AssignError::Full`]); nothing changes then.
+    pub fn remove(&mut self, command: &CommandRef, binding: &Binding) -> bool {
+        let Some(i) = self.find(command) else { return false };
+        let gone = self.bound(i, binding);
+        let before = self.current[i].len();
+        let list: Vec<Bound> = self.current[i].iter().filter(|b| !self.same(b, &gone)).cloned().collect();
+        list.len() != before && self.commit(vec![(i, list)]).is_ok()
+    }
+
+    /// Leaves a command without shortcuts, in every scope. `false` for an unknown command, or when
+    /// the overrides are full as for [`Keymap::remove`].
+    pub fn clear(&mut self, command: &CommandRef) -> bool {
+        let Some(i) = self.find(command) else { return false };
+        self.commit(vec![(i, Vec::new())]).is_ok()
+    }
+
+    /// Gives a command its default bindings back.
+    pub fn reset(&mut self, command: &CommandRef) -> bool {
+        let Some(i) = self.find(command) else { return false };
+        // The whole entry goes, texts this build cannot use included.
+        self.remove_entries(i);
+        self.set_current(i, self.defaults[i].clone());
+        true
+    }
+
+    /// Every command gets its defaults; unknown entries go too.
+    pub fn reset_all(&mut self) {
+        self.overrides.clear();
+        self.reload();
+    }
+
+    /// Pairs of commands on one chord, at most [`MAX_CONFLICTS`], in chord order, then in
+    /// catalog order. Tools of one group and bindings of panels that are never active together
+    /// are left out; with panel fallthrough two unrelated panels on one chord tie in a third panel,
+    /// which is reported as a [`ConflictKind::Shadow`].
+    ///
+    /// When the cap cuts a chord's pairs, the pairs kept are the first found comparing the
+    /// chord's holders grouped by scope and tool group, group by group in the order each group
+    /// first appears in the catalog; the kept pairs are still returned in chord order, then
+    /// catalog order.
+    pub fn conflicts(&self) -> Vec<Conflict> {
+        let mut chords: Vec<(&Trigger, &BTreeSet<(usize, usize)>)> = self.by_trigger.iter().filter(|(_, h)| h.len() > 1).collect();
+        chords.sort_by_key(|(t, _)| **t);
+        let mut out = Vec::new();
+        for (chord, holders) in chords {
+            if !self.chord_conflicts(*chord, holders, &mut out) {
+                break;
+            }
+        }
+        out
+    }
+
+    /// The conflicts [`Keymap::conflicts`] reports for one command's bindings, with that command
+    /// as `a`, in the order of its bindings, then catalog order. Empty for an unknown command.
+    pub fn conflicts_with(&self, command: &CommandRef) -> Vec<Conflict> {
+        let Some(i) = self.find(command) else { return Vec::new() };
+        let mut out = Vec::new();
+        for a in &self.current[i] {
+            let chord = a.0.effective(self.platform);
+            let Some(holders) = self.by_trigger.get(&chord) else { continue };
+            for &(j, k) in holders {
+                if j == i || self.same_group(i, j) {
+                    continue;
+                }
+                let Some(b) = self.at(j, k) else { continue };
+                let Some(clash) = self.conflict_relation(&a.1, &b.1) else { continue };
+                out.push(Conflict {
+                    chord,
+                    a: (self.catalog[i].command.clone(), self.public(i, a)),
+                    b: (self.catalog[j].command.clone(), self.public(j, b)),
+                    kind: if clash { ConflictKind::Clash } else { ConflictKind::Shadow },
+                    in_defaults: self.defaults[i].contains(a) && self.defaults[j].contains(b),
+                });
+            }
+        }
+        out
+    }
+
+    /// What is wrong with the stored overrides: load notes, unknown commands, texts that do not
+    /// parse, reserved chords, unknown scopes, duplicate entries.
+    pub fn problems(&self) -> Vec<Problem> {
+        let mut out = self.overrides.load_notes().to_vec();
+        for (key, texts) in self.overrides.iter() {
+            let Some(i) = self.resolve_key(key) else {
+                out.push(Problem::UnknownCommand { key: key.to_string() });
+                continue;
+            };
+            if self.stored[i].as_deref() != Some(key) {
+                out.push(Problem::DuplicateKey { key: key.to_string() });
+                continue;
+            }
+            let home = &self.catalog[i].scope;
+            for text in texts {
+                let (key, text) = (key.to_string(), text.clone());
+                match Binding::parse(&text) {
+                    Err(error) => out.push(Problem::BadBinding { key, text, error }),
+                    Ok(b) if self.is_reserved(&b.trigger.chord) => out.push(Problem::Reserved { key, text }),
+                    Ok(b) if !self.usable_scope(b.scope_or(home), home) => out.push(Problem::UnknownScope { key, text }),
+                    Ok(_) => {}
+                }
+            }
+        }
+        out
+    }
+
+    /// Bindings of other commands that only one of them and `bindings` on `command` could run,
+    /// leaving out tools of the same group and twins (as [`Policy::Steal`] does).
+    pub(crate) fn clashing(&self, command: &CommandRef, bindings: &[Binding]) -> Vec<Holder> {
+        let Some(i) = self.find(command) else { return Vec::new() };
+        let new: Vec<Bound> = bindings.iter().map(|b| self.bound(i, b)).collect();
+        self.clashes(i, &new).into_iter().map(|(j, b)| Holder { command: self.catalog[j].command.clone(), binding: self.public(j, &b) }).collect()
+    }
+
+    /// Whether binding `x` of command `a` and binding `y` of another command `b` clash, by the
+    /// rules of [`Keymap::clashing`].
+    pub(crate) fn pair_clashes(&self, a: &CommandRef, x: &Binding, b: &CommandRef, y: &Binding) -> bool {
+        let (Some(i), Some(j)) = (self.find(a), self.find(b)) else { return false };
+        if i == j || self.same_group(i, j) {
+            return false;
+        }
+        let (bx, by) = (self.bound(i, x), self.bound(j, y));
+        let t = bx.0.effective(self.platform);
+        t == by.0.effective(self.platform) && !self.twins(i, j, t) && self.scopes.relation(&bx.1, &by.1) == Some(true)
+    }
+
+    /// Whether both commands of `conflict` have its chord among their defaults, so they share it by
+    /// design and [`Keymap::clashing`] leaves them out.
+    #[cfg(feature = "ui")]
+    pub(crate) fn twins_in(&self, conflict: &Conflict) -> bool {
+        let (Some(i), Some(j)) = (self.find(&conflict.a.0), self.find(&conflict.b.0)) else { return false };
+        self.twins(i, j, conflict.chord)
+    }
+
+    fn find(&self, command: &CommandRef) -> Option<usize> {
+        self.index.get(&command.key()).copied()
+    }
+
+    fn resolve_key(&self, key: &str) -> Option<usize> {
+        self.index.get(key).or_else(|| CommandRef::parse_key(key).and_then(|c| self.index.get(&c.key()))).copied()
+    }
+
+    fn at(&self, i: usize, k: usize) -> Option<&Bound> {
+        self.current.get(i).and_then(|l| l.get(k))
+    }
+
+    fn bound(&self, i: usize, binding: &Binding) -> Bound {
+        (binding.trigger, binding.scope_or(&self.catalog[i].scope).clone())
+    }
+
+    fn public(&self, i: usize, (trigger, scope): &Bound) -> Binding {
+        let scope = (*scope != self.catalog[i].scope).then(|| scope.clone());
+        Binding { trigger: *trigger, scope }
+    }
+
+    fn same(&self, a: &Bound, b: &Bound) -> bool {
+        a.1 == b.1 && a.0.effective(self.platform) == b.0.effective(self.platform)
+    }
+
+    /// Whether a stored binding of a command with home scope `home` may use `scope`.
+    fn usable_scope(&self, scope: &Scope, home: &Scope) -> bool {
+        scope == home || self.knows_scope(scope)
+    }
+
+    /// Resolves scopes, drops repeats and caps the count.
+    fn normalize(&self, bindings: impl IntoIterator<Item = Binding>, home: &Scope) -> Vec<Bound> {
+        let mut out: Vec<Bound> = Vec::new();
+        for b in bindings {
+            let bound = (b.trigger, b.scope_or(home).clone());
+            if out.len() < MAX_BINDINGS && !out.contains(&bound) {
+                out.push(bound);
+            }
+        }
+        out
+    }
+
+    fn same_group(&self, i: usize, j: usize) -> bool {
+        match (&self.catalog[i].kind, &self.catalog[j].kind) {
+            (Kind::Tool { group: a }, Kind::Tool { group: b }) => a == b,
+            _ => false,
+        }
+    }
+
+    /// Both commands have `trigger` among their defaults: they share it by design.
+    fn twins(&self, i: usize, j: usize, trigger: Trigger) -> bool {
+        let has = |k: usize| self.defaults[k].iter().any(|(t, _)| t.effective(self.platform) == trigger);
+        has(i) && has(j)
+    }
+
+    /// Bindings of other commands that only one of `new` and them could run.
+    fn clashes(&self, i: usize, new: &[Bound]) -> Vec<(usize, Bound)> {
+        let mut out = Vec::new();
+        let mut seen: HashSet<(usize, usize)> = HashSet::new();
+        for (t, s) in new {
+            let t = t.effective(self.platform);
+            let Some(holders) = self.by_trigger.get(&t) else { continue };
+            for &(j, k) in holders {
+                if j == i || self.same_group(i, j) || self.twins(i, j, t) {
+                    continue;
+                }
+                let Some(b) = self.at(j, k) else { continue };
+                if self.scopes.relation(s, &b.1) == Some(true) && seen.insert((j, k)) {
+                    out.push((j, b.clone()));
+                }
+            }
+        }
+        out
+    }
+
+    /// How two scopes on one chord relate for [`Keymap::conflicts`]: [`Scopes::relation`], and with
+    /// panel fallthrough two unrelated panels shadow (they tie in any third panel).
+    fn conflict_relation(&self, a: &Scope, b: &Scope) -> Option<bool> {
+        self.scopes.relation(a, b).or_else(|| {
+            let panels = self.scopes.kind(a) == ScopeKind::Panel && self.scopes.kind(b) == ScopeKind::Panel;
+            (panels && self.scopes.panel_fallthrough()).then_some(false)
+        })
+    }
+
+    /// Adds the conflicts on one chord to `out`; `false` once `out` is full.
+    ///
+    /// The holders are grouped by scope and tool group, and only groups that relate are compared,
+    /// so pairs that are left out (unrelated panels, tools of one group) cost nothing per pair.
+    fn chord_conflicts(&self, chord: Trigger, holders: &BTreeSet<(usize, usize)>, out: &mut Vec<Conflict>) -> bool {
+        let mut groups: Vec<Group> = Vec::new();
+        let mut group_of: HashMap<(&Scope, Option<&Option<String>>), usize> = HashMap::new();
+        for (pos, &(i, k)) in holders.iter().enumerate() {
+            let Some(b) = self.at(i, k) else { continue };
+            let tools = match &self.catalog[i].kind {
+                Kind::Tool { group } => Some(group),
+                _ => None,
+            };
+            let g = *group_of.entry((&b.1, tools)).or_insert_with(|| {
+                groups.push(Group { scope: &b.1, tools, items: Vec::new() });
+                groups.len() - 1
+            });
+            if let Some(group) = groups.get_mut(g) {
+                group.items.push((pos, i, b));
+            }
+        }
+        let room = MAX_CONFLICTS.saturating_sub(out.len());
+        let mut found: Vec<Pair> = Vec::new();
+        'groups: for (n, g) in groups.iter().enumerate() {
+            for (m, h) in groups.iter().enumerate().skip(n) {
+                if g.tools.is_some() && g.tools == h.tools {
+                    continue;
+                }
+                let Some(clash) = self.conflict_relation(g.scope, h.scope) else { continue };
+                let same = m == n;
+                for (x, &(pa, i, a)) in g.items.iter().enumerate() {
+                    let rest = if same { g.items.get(x + 1..).unwrap_or_default() } else { &h.items };
+                    for &(pb, j, b) in rest {
+                        if i == j {
+                            continue;
+                        }
+                        if found.len() >= room {
+                            break 'groups;
+                        }
+                        let pair = if pa < pb { (pa, pb, clash, (i, a), (j, b)) } else { (pb, pa, clash, (j, b), (i, a)) };
+                        found.push(pair);
+                    }
+                }
+            }
+        }
+        found.sort_by_key(|(pa, pb, ..)| (*pa, *pb));
+        for (_, _, clash, (i, a), (j, b)) in found {
+            out.push(Conflict {
+                chord,
+                a: (self.catalog[i].command.clone(), self.public(i, a)),
+                b: (self.catalog[j].command.clone(), self.public(j, b)),
+                kind: if clash { ConflictKind::Clash } else { ConflictKind::Shadow },
+                in_defaults: self.defaults[i].contains(a) && self.defaults[j].contains(b),
+            });
+        }
+        out.len() < MAX_CONFLICTS
+    }
+
+    fn apply(&mut self, i: usize, list: Vec<Bound>, new: &[Bound], policy: Policy) -> Result<Assigned, AssignError> {
+        if list.len() > MAX_BINDINGS {
+            return Err(AssignError::TooMany);
+        }
+        if let Some((t, _)) = new.iter().find(|(t, _)| self.is_reserved(&t.chord)) {
+            return Err(AssignError::Reserved(*t));
+        }
+        let home = &self.catalog[i].scope;
+        if let Some((_, s)) = new.iter().find(|(_, s)| !self.usable_scope(s, home)) {
+            return Err(AssignError::UnknownScope(s.clone()));
+        }
+        let clashes = self.clashes(i, new);
+        let holders: Vec<Holder> =
+            clashes.iter().map(|(j, b)| Holder { command: self.catalog[*j].command.clone(), binding: self.public(*j, b) }).collect();
+        let mut done = Assigned::default();
+        let mut writes: Vec<(usize, Vec<Bound>)> = Vec::new();
+        match policy {
+            Policy::Refuse if !holders.is_empty() => return Err(AssignError::Taken(holders)),
+            Policy::Refuse => {}
+            Policy::Keep => done.clashes = holders,
+            Policy::Steal => {
+                let mut victims: Vec<usize> = Vec::new();
+                let mut gone: HashMap<usize, Vec<&Bound>> = HashMap::new();
+                for (j, b) in &clashes {
+                    let list = gone.entry(*j).or_default();
+                    if list.is_empty() {
+                        victims.push(*j);
+                    }
+                    list.push(b);
+                }
+                for j in victims {
+                    let gone = gone.get(&j).map(Vec::as_slice).unwrap_or_default();
+                    let rest: Vec<Bound> = self.current[j].iter().filter(|o| !gone.contains(o)).cloned().collect();
+                    writes.push((j, rest));
+                }
+                done.taken_from = holders;
+            }
+        }
+        writes.push((i, list));
+        self.commit(writes)?;
+        Ok(done)
+    }
+
+    /// Stores several commands' bindings, or none of them when the overrides lack room for the
+    /// new entries.
+    fn commit(&mut self, writes: Vec<(usize, Vec<Bound>)>) -> Result<(), AssignError> {
+        let needed = writes.iter().filter(|(i, list)| self.stored[*i].is_none() && !self.is_default(*i, list)).count();
+        if self.overrides.len() + needed > MAX_COMMANDS {
+            return Err(AssignError::Full);
+        }
+        for (i, list) in writes {
+            self.store(i, list);
+        }
+        Ok(())
+    }
+
+    /// Writes a command's bindings to the overrides, dropping the entry when they equal the
+    /// defaults. Texts of the old entry this build cannot use stay in it, after the bindings and up
+    /// to [`MAX_BINDINGS`], unless the command is left without bindings: an entry of only such
+    /// texts loads as the defaults. Callers check for room first ([`Keymap::commit`]); texts always
+    /// fit, since a scope name, `": "` and the longest double press stay under
+    /// [`MAX_BINDING_TEXT`].
+    fn store(&mut self, i: usize, list: Vec<Bound>) {
+        let mut kept = if list.is_empty() { Vec::new() } else { self.unusable_texts(i) };
+        kept.truncate(MAX_BINDINGS.saturating_sub(list.len()));
+        self.remove_entries(i);
+        if !kept.is_empty() || !self.is_default(i, &list) {
+            let home = &self.catalog[i].scope;
+            let mut texts: Vec<String> = list.iter().map(|b| self.public(i, b).text(home)).collect();
+            texts.extend(kept);
+            if self.overrides.insert(self.keys[i].clone(), texts) {
+                self.stored[i] = Some(self.keys[i].clone());
+            }
+        }
+        self.set_current(i, list);
+    }
+
+    /// Removes a command's overrides entries: the one it reads and hand-written variants of its
+    /// key, which would take effect on the next load.
+    fn remove_entries(&mut self, i: usize) {
+        if let Some(old) = self.stored[i].take() {
+            self.overrides.remove(&old);
+        }
+        if !self.variants {
+            return;
+        }
+        let keys: Vec<String> = self.overrides.iter().map(|(k, _)| k).filter(|k| self.resolve_key(k) == Some(i)).map(str::to_string).collect();
+        for key in keys {
+            self.overrides.remove(&key);
+        }
+    }
+
+    /// Whether `list` is the command's defaults, comparing effective triggers.
+    fn is_default(&self, i: usize, list: &[Bound]) -> bool {
+        let defaults = &self.defaults[i];
+        list.len() == defaults.len() && list.iter().zip(defaults).all(|(a, b)| self.same(a, b))
+    }
+
+    /// Whether a stored binding of a command with home scope `home` works here.
+    fn usable(&self, binding: &Binding, home: &Scope) -> bool {
+        !self.is_reserved(&binding.trigger.chord) && self.usable_scope(binding.scope_or(home), home)
+    }
+
+    /// The texts of a command's overrides entry this build cannot use: a key name from a newer
+    /// version, a scope this app lacks, a chord this platform reserves.
+    fn unusable_texts(&self, i: usize) -> Vec<String> {
+        let Some(texts) = self.stored[i].as_deref().and_then(|key| self.overrides.get(key)) else { return Vec::new() };
+        let home = &self.catalog[i].scope;
+        texts.iter().filter(|t| !Binding::parse(t).is_ok_and(|b| self.usable(&b, home))).cloned().collect()
+    }
+
+    fn set_current(&mut self, i: usize, list: Vec<Bound>) {
+        self.unindex(i);
+        if let Some(c) = self.current.get_mut(i) {
+            *c = list;
+        }
+        self.index_command(i);
+    }
+
+    fn index_command(&mut self, i: usize) {
+        let Some(list) = self.current.get(i) else { return };
+        for (k, (t, _)) in list.iter().enumerate() {
+            self.by_trigger.entry(t.effective(self.platform)).or_default().insert((i, k));
+        }
+    }
+
+    fn unindex(&mut self, i: usize) {
+        let Some(list) = self.current.get(i) else { return };
+        for (k, (t, _)) in list.iter().enumerate() {
+            let t = t.effective(self.platform);
+            if let Some(holders) = self.by_trigger.get_mut(&t) {
+                holders.remove(&(i, k));
+                if holders.is_empty() {
+                    self.by_trigger.remove(&t);
+                }
+            }
+        }
+    }
+
+    fn rebuild_index(&mut self) {
+        self.by_trigger.clear();
+        for i in 0..self.current.len() {
+            self.index_command(i);
+        }
+    }
+
+    /// Recomputes every command's bindings from the defaults and the overrides.
+    fn reload(&mut self) {
+        self.stored.iter_mut().for_each(|s| *s = None);
+        self.current.clone_from(&self.defaults);
+        // Exact keys first, so a canonical entry wins over a hand-written variant of it.
+        let mut entries: Vec<(&str, &[String])> = self.overrides.iter().collect();
+        entries.sort_by_key(|(k, _)| !self.index.contains_key(*k));
+        let mut found: Vec<(usize, String, Vec<Bound>)> = Vec::new();
+        let mut taken: HashSet<usize> = HashSet::new();
+        self.variants = false;
+        for (key, texts) in entries {
+            let Some(i) = self.resolve_key(key) else { continue };
+            self.variants |= !self.index.contains_key(key);
+            if !taken.insert(i) {
+                continue;
+            }
+            let home = &self.catalog[i].scope;
+            let usable = texts.iter().filter_map(|t| Binding::parse(t).ok()).filter(|b| self.usable(b, home));
+            let list = self.normalize(usable, home);
+            // An entry none of whose texts is usable here (a key name from a newer version, a scope
+            // this app lacks, a chord this platform reserves) keeps the defaults; `[]` means no
+            // shortcut.
+            let list = if list.is_empty() && !texts.is_empty() { self.defaults[i].clone() } else { list };
+            found.push((i, key.to_string(), list));
+        }
+        for (i, key, list) in found {
+            self.stored[i] = Some(key);
+            self.current[i] = list;
+        }
+        self.rebuild_index();
+    }
+}
diff --git a/crates/keymap/src/keymap/overrides.rs b/crates/keymap/src/keymap/overrides.rs
new file mode 100644
index 00000000..518581b5
--- /dev/null
+++ b/crates/keymap/src/keymap/overrides.rs
@@ -0,0 +1,370 @@
+use std::collections::BTreeMap;
+use std::fmt;
+
+use serde::de::{self, IgnoredAny, MapAccess, SeqAccess, Visitor};
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+use serde_json::Value;
+
+use super::{DropReason, MAX_BINDING_TEXT, MAX_BINDINGS, MAX_COMMANDS, Problem};
+use crate::command::MAX_KEY;
+
+// Load notes are kept for `Keymap::problems`; a hostile file must not grow them without bound.
+const MAX_NOTES: usize = 64;
+
+/// The user's changes to the default bindings: binding key → the full list of binding texts
+/// that replaces the command's defaults (`[]` = no shortcut).
+///
+/// Stored in key order as a map of one text per command (`{ "<key>": "Cmd+K" }`, `""` for no
+/// shortcut) while no entry has more than one text, and otherwise as an array of
+/// `{ command, keys }` items. [`list`] always writes the array, for craft-settings files. Both
+/// forms load, and in the map form a list of texts loads too. Loading never fails:
+/// entries for unknown commands and texts that do not parse are kept verbatim; values that are not
+/// text, overlong keys and texts, repeated keys (the first entry stays) and entries past the caps
+/// are dropped, and a value that is neither a list nor a map loads as no overrides. All of these
+/// are reported by [`Keymap::problems`](super::Keymap::problems).
+#[derive(Clone, Debug, Default)]
+pub struct Overrides {
+    map: BTreeMap<String, Vec<String>>,
+    notes: Vec<Problem>,
+}
+
+impl PartialEq for Overrides {
+    fn eq(&self, other: &Overrides) -> bool {
+        self.map == other.map
+    }
+}
+
+impl Eq for Overrides {}
+
+impl Overrides {
+    pub const fn new() -> Overrides {
+        Overrides { map: BTreeMap::new(), notes: Vec::new() }
+    }
+
+    pub fn get(&self, key: &str) -> Option<&[String]> {
+        self.map.get(key).map(Vec::as_slice)
+    }
+
+    pub fn iter(&self) -> impl Iterator<Item = (&str, &[String])> {
+        self.map.iter().map(|(k, v)| (k.as_str(), v.as_slice()))
+    }
+
+    pub fn len(&self) -> usize {
+        self.map.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.map.is_empty()
+    }
+
+    /// Sets an entry verbatim. `false` (and nothing stored) for a key over [`MAX_KEY`] bytes, a
+    /// list over [`MAX_BINDINGS`], a text over [`MAX_BINDING_TEXT`] bytes, or a new key past
+    /// [`MAX_COMMANDS`] entries.
+    pub fn insert(&mut self, key: impl Into<String>, texts: Vec<String>) -> bool {
+        let key = key.into();
+        let fits = key.len() <= MAX_KEY
+            && texts.len() <= MAX_BINDINGS
+            && texts.iter().all(|t| t.len() <= MAX_BINDING_TEXT)
+            && (self.map.contains_key(&key) || self.map.len() < MAX_COMMANDS);
+        if fits {
+            self.map.insert(key, texts);
+        }
+        fits
+    }
+
+    pub fn remove(&mut self, key: &str) -> Option<Vec<String>> {
+        self.map.remove(key)
+    }
+
+    /// Removes every entry: all commands get their defaults.
+    pub fn clear(&mut self) {
+        self.map.clear();
+        self.notes.clear();
+    }
+
+    /// What loading dropped.
+    pub fn load_notes(&self) -> &[Problem] {
+        &self.notes
+    }
+
+    fn note(&mut self, problem: Problem) {
+        if self.notes.len() < MAX_NOTES {
+            self.notes.push(problem);
+        }
+    }
+}
+
+// The map form is what apps that store one text per command read, so a file stays readable by
+// their older builds while no command has more than one binding.
+impl Serialize for Overrides {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        if self.map.values().all(|keys| single(keys).is_some()) {
+            serializer.collect_map(self.map.iter().map(|(command, keys)| (command, single(keys).unwrap_or_default())))
+        } else {
+            list::serialize(self, serializer)
+        }
+    }
+}
+
+/// An entry's text in the map form: `""` for no shortcut. `None` for several texts, and for one
+/// blank text, which the map form reads as no shortcut.
+fn single(keys: &[String]) -> Option<&str> {
+    match keys {
+        [] => Some(""),
+        [text] if !text.trim().is_empty() => Some(text.as_str()),
+        _ => None,
+    }
+}
+
+/// Serializes [`Overrides`] always as an array of `{ command, keys }` items, for
+/// `#[serde(with = "craft_keymap::keymap::overrides_list")]`. craft-settings merges a table key
+/// by key with what the file holds but replaces an array whole, so in a craft-settings file only
+/// this form lets a reset command (an entry removed) stay removed after saving.
+pub mod list {
+    use serde::{Deserialize, Deserializer, Serializer};
+
+    use super::{Item, Overrides};
+
+    pub fn serialize<S: Serializer>(overrides: &Overrides, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.collect_seq(overrides.map.iter().map(|(command, keys)| Item { command, keys }))
+    }
+
+    pub fn deserialize<'de, D: Deserializer<'de>>(deserializer: D) -> Result<Overrides, D::Error> {
+        Overrides::deserialize(deserializer)
+    }
+}
+
+#[derive(Serialize)]
+struct Item<'a> {
+    command: &'a str,
+    keys: &'a [String],
+}
+
+impl<'de> Deserialize<'de> for Overrides {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Overrides, D::Error> {
+        deserializer.deserialize_any(OverridesVisitor)
+    }
+}
+
+struct OverridesVisitor;
+
+/// Collects entries with the caps applied.
+#[derive(Default)]
+struct Builder {
+    out: Overrides,
+    ignored: usize,
+}
+
+impl Builder {
+    /// Whether an entry for `key` can be stored; notes why not.
+    fn admits(&mut self, key: &str) -> bool {
+        if key.len() > MAX_KEY {
+            self.out.note(Problem::Dropped { key: clip(key, MAX_KEY), reason: DropReason::KeyTooLong });
+            return false;
+        }
+        if self.out.map.len() >= MAX_COMMANDS && !self.out.map.contains_key(key) {
+            self.ignored += 1;
+            return false;
+        }
+        true
+    }
+
+    /// Stores an entry; a second entry for the same key is ignored and noted.
+    fn add(&mut self, key: String, value: Lenient) {
+        let out = &mut self.out;
+        if out.map.contains_key(&key) {
+            out.note(Problem::DuplicateKey { key });
+            return;
+        }
+        let texts = match value {
+            Lenient::List { texts, other, extra } => {
+                if other {
+                    out.note(Problem::Dropped { key: key.clone(), reason: DropReason::NotText });
+                }
+                if extra > 0 {
+                    out.note(Problem::Dropped { key: key.clone(), reason: DropReason::TooManyBindings });
+                }
+                texts
+            }
+            Lenient::Text(t) => vec![t],
+            Lenient::Other => {
+                out.note(Problem::Dropped { key, reason: DropReason::NotAList });
+                return;
+            }
+        };
+        let (texts, long): (Vec<String>, Vec<String>) = texts.into_iter().partition(|t| t.len() <= MAX_BINDING_TEXT);
+        if !long.is_empty() {
+            out.note(Problem::Dropped { key: key.clone(), reason: DropReason::TextTooLong });
+        }
+        out.map.insert(key, texts);
+    }
+
+    fn finish(mut self) -> Overrides {
+        if self.ignored > 0 {
+            let ignored = self.ignored;
+            self.out.note(Problem::TooManyCommands { ignored });
+        }
+        self.out
+    }
+}
+
+/// No overrides, with a note that the value was not a list or map.
+fn not_a_list() -> Overrides {
+    let mut out = Overrides::new();
+    out.note(Problem::Dropped { key: String::new(), reason: DropReason::NotAList });
+    out
+}
+
+macro_rules! not_a_list {
+    ($($name:ident: $t:ty),*) => {
+        $(fn $name<E: de::Error>(self, _: $t) -> Result<Overrides, E> {
+            Ok(not_a_list())
+        })*
+    };
+}
+
+impl<'de> Visitor<'de> for OverridesVisitor {
+    type Value = Overrides;
+
+    fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        f.write_str("a list of `{ command, keys }` items or a map of binding keys to binding texts")
+    }
+
+    not_a_list!(visit_bool: bool, visit_i64: i64, visit_u64: u64, visit_i128: i128, visit_u128: u128, visit_f64: f64, visit_str: &str, visit_bytes: &[u8], visit_char: char);
+
+    fn visit_unit<E: de::Error>(self) -> Result<Overrides, E> {
+        Ok(not_a_list())
+    }
+
+    fn visit_none<E: de::Error>(self) -> Result<Overrides, E> {
+        Ok(not_a_list())
+    }
+
+    fn visit_some<D: Deserializer<'de>>(self, deserializer: D) -> Result<Overrides, D::Error> {
+        deserializer.deserialize_any(OverridesVisitor)
+    }
+
+    /// The array form, `[{ command = "…", keys = […] }, …]`.
+    fn visit_seq<A: SeqAccess<'de>>(self, mut access: A) -> Result<Overrides, A::Error> {
+        let mut b = Builder::default();
+        while let Some(item) = access.next_element::<Value>()? {
+            let command = item.get("command").and_then(Value::as_str);
+            let keys = item.get("keys").map(Lenient::deserialize).and_then(Result::ok);
+            match (command, keys) {
+                (Some(command), Some(keys)) => {
+                    if b.admits(command) {
+                        b.add(command.to_string(), keys);
+                    }
+                }
+                (command, _) => {
+                    let key = clip(command.unwrap_or_default(), MAX_KEY);
+                    b.out.note(Problem::Dropped { key, reason: DropReason::NotAList });
+                }
+            }
+        }
+        Ok(b.finish())
+    }
+
+    /// The map form, binding key → texts (hand edits, older files). An empty text means no
+    /// shortcut, as in the apps that store one text per command and `""` for a removed shortcut.
+    fn visit_map<A: MapAccess<'de>>(self, mut access: A) -> Result<Overrides, A::Error> {
+        let mut b = Builder::default();
+        while let Some(key) = access.next_key::<String>()? {
+            if b.admits(&key) {
+                let value = match access.next_value::<Lenient>()? {
+                    Lenient::Text(t) if t.trim().is_empty() => Lenient::List { texts: Vec::new(), other: false, extra: 0 },
+                    Lenient::List { mut texts, other, extra } => {
+                        texts.retain(|t| !t.trim().is_empty());
+                        Lenient::List { texts, other, extra }
+                    }
+                    value => value,
+                };
+                b.add(key, value);
+            } else {
+                access.next_value::<IgnoredAny>()?;
+            }
+        }
+        Ok(b.finish())
+    }
+}
+
+/// Cuts `s` to at most `max` bytes on a char boundary.
+pub(crate) fn clip(s: &str, max: usize) -> String {
+    let mut end = s.len().min(max);
+    while !s.is_char_boundary(end) {
+        end -= 1;
+    }
+    s[..end].to_string()
+}
+
+/// An entry's value as found: a list (texts kept up to the cap), one text, or anything else.
+enum Lenient {
+    List { texts: Vec<String>, other: bool, extra: usize },
+    Text(String),
+    Other,
+}
+
+impl<'de> Deserialize<'de> for Lenient {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Lenient, D::Error> {
+        deserializer.deserialize_any(LenientVisitor)
+    }
+}
+
+struct LenientVisitor;
+
+macro_rules! other {
+    ($($name:ident: $t:ty),*) => {
+        $(fn $name<E: de::Error>(self, _: $t) -> Result<Lenient, E> {
+            Ok(Lenient::Other)
+        })*
+    };
+}
+
+impl<'de> Visitor<'de> for LenientVisitor {
+    type Value = Lenient;
+
+    fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        f.write_str("a list of binding texts")
+    }
+
+    fn visit_str<E: de::Error>(self, v: &str) -> Result<Lenient, E> {
+        Ok(Lenient::Text(v.to_string()))
+    }
+
+    fn visit_string<E: de::Error>(self, v: String) -> Result<Lenient, E> {
+        Ok(Lenient::Text(v))
+    }
+
+    other!(visit_bool: bool, visit_i64: i64, visit_u64: u64, visit_i128: i128, visit_u128: u128, visit_f64: f64, visit_bytes: &[u8], visit_char: char);
+
+    fn visit_unit<E: de::Error>(self) -> Result<Lenient, E> {
+        Ok(Lenient::Other)
+    }
+
+    fn visit_none<E: de::Error>(self) -> Result<Lenient, E> {
+        Ok(Lenient::Other)
+    }
+
+    fn visit_some<D: Deserializer<'de>>(self, deserializer: D) -> Result<Lenient, D::Error> {
+        deserializer.deserialize_any(LenientVisitor)
+    }
+
+    fn visit_map<A: MapAccess<'de>>(self, mut access: A) -> Result<Lenient, A::Error> {
+        while access.next_entry::<IgnoredAny, IgnoredAny>()?.is_some() {}
+        Ok(Lenient::Other)
+    }
+
+    fn visit_seq<A: SeqAccess<'de>>(self, mut access: A) -> Result<Lenient, A::Error> {
+        let mut texts = Vec::new();
+        let mut other = false;
+        let mut extra = 0usize;
+        while let Some(item) = access.next_element::<Lenient>()? {
+            match item {
+                Lenient::Text(t) if texts.len() < MAX_BINDINGS => texts.push(t),
+                Lenient::Text(_) => extra += 1,
+                _ => other = true,
+            }
+        }
+        Ok(Lenient::List { texts, other, extra })
+    }
+}
diff --git a/crates/keymap/src/layout.rs b/crates/keymap/src/layout.rs
new file mode 100644
index 00000000..ba8c9eee
--- /dev/null
+++ b/crates/keymap/src/layout.rs
@@ -0,0 +1,306 @@
+//! Which chord a key press means on the active keyboard layout, and the layout's own characters
+//! for labels.
+//!
+//! One rule decides matching ([`Layout::candidates`]), recording ([`Layout::resolve`]) and labels
+//! ([`Chord::display_for`]):
+//! 1. **Letters A–Z:** the layout's Latin letter for the key, from [`KeyInput::latin`] when the
+//!    platform reports the Latin layout's character: on Dvorak + Russian the `с` key is Dvorak's
+//!    J, and the `й` key, `'` on Dvorak, runs no letter binding. Without a report, on a layout
+//!    that is not Latin, the letter the toolkit reports as typed, else the key's position (the
+//!    Russian `с` key is C, the Hebrew `/` key is Q); on a Latin layout (Dvorak, AZERTY), the
+//!    letter typed.
+//! 2. **Digits:** the digit typed, else the key's position (AZERTY's `&é"` row types no digit
+//!    without Shift). A digit-row press that types punctuation also matches its position's digit,
+//!    after the punctuation: AZERTY's `-` key runs Ctrl+- and, when that has no binding, Ctrl+6.
+//! 3. **Punctuation:** the character typed, without Shift when the layout needs Shift for it
+//!    (German `/` is ⇧7, so ⇧⌘7 is ⌘/; US `:` is ⇧;, so ⇧; is `:`). A Shift binding on a US
+//!    base key also matches the same press (`Shift+;` matches `:`), and `=` and `+` stand for
+//!    each other so zoom keys work with and without Shift.
+//! 4. **Whether a layout is Latin** is decided for the whole layout ([`Layout::is_latin`]), never
+//!    per key: Dvorak's `'` key on the Q position stays `'`.
+//! 5. **No position fallback for unnamed characters on moved keys:** egui reports a character
+//!    that has no key (Dvorak's ⇧, types `<`) as the key's position, W. With Shift held on a
+//!    Latin layout, such a press at a letter position that has been seen typing something other
+//!    than its letter resolves to nothing, so Ctrl+Shift+, never runs Ctrl+Shift+W once a `,`
+//!    has been typed. A change in the reported Latin status, or [`Layout::forget_letters`],
+//!    clears what the positions typed.
+//! 6. **Labels** show letters and digits by name, and a punctuation key as the character the
+//!    layout types at its position when that character has no key of its own: Ctrl+[ is `Ctrl+Ü`
+//!    on German and `Ctrl+Х` on Russian.
+//!
+//! [`KeyInput`] carries what the toolkit reports for one press; toolkits that learn more from the
+//! platform fill more of it. [`Layout`] holds what is known about the layout itself, reported by
+//! the platform or learned from what plain typing produces ([`Layout::observe`]).
+
+use std::collections::BTreeMap;
+
+use crate::chord::{Chord, Key, Mods, Platform};
+
+/// What the toolkit reports about one key press.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct KeyInput {
+    /// The modifiers held, read for the platform as [`Mods`] describes.
+    pub mods: Mods,
+    /// The key for the character the layout typed with `mods` held, when there is one (egui's
+    /// logical key).
+    pub typed: Option<Key>,
+    /// The key at the same position on a US QWERTY keyboard (winit's physical key, the web's
+    /// `code`).
+    pub physical: Option<Key>,
+    /// The character this key types on the layout the platform takes shortcut letters from, when
+    /// it reports one: the layout's ⌘ table on macOS, the first Latin layout group on Linux. A
+    /// letter makes the press that letter; any other character means the key has no Latin letter,
+    /// so the press runs no letter binding (Dvorak's `'` on the key Russian types `й` on is no
+    /// Ctrl+Q).
+    pub latin: Option<char>,
+    /// Whether the layout needs Shift to type `typed`, when the platform reports it. Otherwise
+    /// Shift counts as needed when `typed` differs from `physical`, and without `physical` when
+    /// `typed` is a shifted symbol on a US layout (`:`, `?`, `+`). Only punctuation drops Shift.
+    pub shift_needed: Option<bool>,
+}
+
+impl KeyInput {
+    pub const fn new(mods: Mods) -> KeyInput {
+        KeyInput { mods, typed: None, physical: None, latin: None, shift_needed: None }
+    }
+
+    pub const fn with_typed(mut self, key: Key) -> KeyInput {
+        self.typed = Some(key);
+        self
+    }
+
+    pub const fn with_physical(mut self, key: Key) -> KeyInput {
+        self.physical = Some(key);
+        self
+    }
+
+    pub const fn with_latin(mut self, c: char) -> KeyInput {
+        self.latin = Some(c);
+        self
+    }
+
+    pub const fn with_shift_needed(mut self, needed: bool) -> KeyInput {
+        self.shift_needed = Some(needed);
+        self
+    }
+
+    fn needs_shift(&self, typed: Key) -> bool {
+        // A shifted symbol is no key position (egui's numeric keypad Plus is the one physical
+        // key among them), so it says nothing about the Shift level.
+        self.shift_needed.unwrap_or(match self.physical {
+            Some(physical) if us_base(physical).is_none() => physical != typed,
+            _ => us_base(typed).is_some(),
+        })
+    }
+}
+
+/// The active keyboard layout, as far as the platform reports it or typing has shown it.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Layout {
+    reported_latin: Option<bool>,
+    seen_latin: Option<bool>,
+    /// The character typed without modifiers at each punctuation position.
+    chars: BTreeMap<Key, char>,
+    /// The character, lower case, typed without Cmd, Ctrl or Alt at each letter position.
+    letters: BTreeMap<Key, char>,
+}
+
+/// US base keys and the key egui reports for them with Shift held.
+const SHIFTED: &[(Key, Key)] = &[
+    (Key::Semicolon, Key::Colon),
+    (Key::Slash, Key::Questionmark),
+    (Key::Backslash, Key::Pipe),
+    (Key::OpenBracket, Key::OpenCurlyBracket),
+    (Key::CloseBracket, Key::CloseCurlyBracket),
+    (Key::Equals, Key::Plus),
+    (Key::Num1, Key::Exclamationmark),
+];
+
+fn us_base(shifted: Key) -> Option<Key> {
+    SHIFTED.iter().find(|&&(_, s)| s == shifted).map(|&(b, _)| b)
+}
+
+const fn without_shift(m: Mods) -> Mods {
+    Mods { shift: false, ..m }
+}
+
+/// Letters of the Latin script: ASCII, Latin-1, Latin Extended-A and -B, Latin Extended
+/// Additional.
+fn is_latin_letter(c: char) -> bool {
+    c.is_alphabetic() && matches!(c, 'A'..='Z' | 'a'..='z' | '\u{00C0}'..='\u{024F}' | '\u{1E00}'..='\u{1EFF}')
+}
+
+impl Layout {
+    /// Nothing known yet: the layout counts as Latin until the platform or typing says otherwise.
+    pub fn new() -> Layout {
+        Layout::default()
+    }
+
+    /// Whether the layout is Latin, as the platform reports it.
+    pub fn with_latin(mut self, latin: bool) -> Layout {
+        self.reported_latin = Some(latin);
+        self
+    }
+
+    /// Whether the layout is Latin, as the platform reports it; `None` when it cannot tell, so
+    /// that typing decides. Call again when the user switches layouts. A report that differs
+    /// from the last one means another layout, so what letter positions typed is forgotten
+    /// ([`forget_letters`](Self::forget_letters)).
+    pub fn set_latin(&mut self, latin: Option<bool>) {
+        if latin != self.reported_latin {
+            self.forget_letters();
+        }
+        self.reported_latin = latin;
+    }
+
+    /// Forgets what each letter position has been seen typing, for an app that learns of a
+    /// layout switch the platform does not report: until typing shows the new layout, Shift
+    /// presses at letter positions resolve as their letters again (rule 5).
+    pub fn forget_letters(&mut self) {
+        self.letters.clear();
+    }
+
+    /// Whether letters are read as typed (rule 1): what the platform reported, else what a letter
+    /// key typed last, else true.
+    pub fn is_latin(&self) -> bool {
+        self.reported_latin.or(self.seen_latin).unwrap_or(true)
+    }
+
+    /// The character the layout types without modifiers at the punctuation position `physical`.
+    pub fn with_char(mut self, physical: Key, typed: char) -> Layout {
+        self.set_char(physical, typed);
+        self
+    }
+
+    /// See [`with_char`](Self::with_char). Positions other than punctuation are ignored.
+    pub fn set_char(&mut self, physical: Key, typed: char) {
+        if physical.is_symbol() {
+            self.chars.insert(physical, typed);
+        }
+    }
+
+    /// The character known to be typed without modifiers at the punctuation position `physical`.
+    pub fn char_at(&self, physical: Key) -> Option<char> {
+        self.chars.get(&physical).copied()
+    }
+
+    /// Learns from a press at `physical` with `mods` held that typed `text`: a letter typed at a
+    /// letter position tells whether the layout is Latin, and a character typed without
+    /// modifiers at a punctuation position is that position's label. Presses with Cmd, Ctrl or
+    /// Alt, and text longer than one character, teach nothing.
+    pub fn observe(&mut self, physical: Key, mods: Mods, text: &str) {
+        let mut chars = text.chars();
+        let (Some(c), None) = (chars.next(), chars.next()) else { return };
+        if mods.cmd || mods.ctrl || mods.alt {
+            return;
+        }
+        if physical.is_letter() {
+            // ª, µ and º are Latin-1 symbols on Latin layouts, no sign of another script.
+            if c.is_alphabetic() && !matches!(c, 'ª' | 'µ' | 'º') {
+                self.seen_latin = Some(is_latin_letter(c));
+            }
+            if !c.is_control() {
+                self.letters.insert(physical, c.to_lowercase().next().unwrap_or(c));
+            }
+        } else if !mods.shift && !c.is_control() {
+            self.set_char(physical, c);
+        }
+    }
+
+    /// The chord a press means, as the shortcut recorder records it and lookups try first.
+    /// `None` when the press names no key.
+    pub fn resolve(&self, input: &KeyInput) -> Option<Chord> {
+        let held = input.mods;
+        let latin = input.latin.map(|c| Key::from_char(c).filter(|k| k.is_letter()));
+        if let Some(Some(letter)) = latin {
+            return Some(Chord::new(held, letter));
+        }
+        // A letter typed on a layout that is not Latin is the toolkit's letter for shortcuts, or
+        // egui standing in the position for a letter it has no key for.
+        if latin.is_none()
+            && !self.is_latin()
+            && let Some(letter) = input.typed.filter(|k| k.is_letter()).or(input.physical).filter(|k| k.is_letter())
+        {
+            return Some(Chord::new(held, letter));
+        }
+        if held.shift
+            && let Some(position) = input.physical.filter(|k| k.is_letter())
+            && input.typed.is_none_or(|typed| typed == position)
+            && !self.types_own_letter(position)
+        {
+            return None;
+        }
+        let mut key = input.typed.or(input.physical)?;
+        // The Latin layout has no letter here, so a letter egui reports is its position: the
+        // press is the Latin layout's key, or nothing.
+        if let (Some(c), true) = (input.latin, key.is_letter()) {
+            key = Key::from_char(c)?;
+        }
+        let drop_shift = held.shift && key.is_symbol() && input.needs_shift(key);
+        Some(Chord::new(if drop_shift { without_shift(held) } else { held }, key))
+    }
+
+    /// Rule 5: whether a press reported as the letter at its own position can be that letter:
+    /// no only when the position has been seen typing something else, so the press likely typed
+    /// a character egui has no key for.
+    fn types_own_letter(&self, position: Key) -> bool {
+        self.letters.get(&position).is_none_or(|&c| Key::from_char(c) == Some(position))
+    }
+
+    /// The chords a press can run, most specific first: [`resolve`](Self::resolve)'s chord, the
+    /// same press written as Shift with a US base key (`Shift+;` for `:`), `=` for `+` and `+`
+    /// for Shift+`=`, and on the digit row the position's digit.
+    pub fn candidates(&self, input: &KeyInput) -> Vec<Chord> {
+        let Some(first) = self.resolve(input) else { return Vec::new() };
+        let mut out = Vec::with_capacity(4);
+        let mut push = |chord: Chord| {
+            if !out.contains(&chord) {
+                out.push(chord);
+            }
+        };
+        push(first);
+        if input.mods.shift
+            && !first.mods.shift
+            && let Some(base) = us_base(first.key)
+        {
+            push(Chord::new(input.mods, base));
+        }
+        match first.key {
+            Key::Plus => push(Chord::new(first.mods, Key::Equals)),
+            Key::Equals if first.mods.shift => push(Chord::new(without_shift(first.mods), Key::Plus)),
+            _ => {}
+        }
+        if let Some(digit) = input.physical.filter(|k| k.is_digit())
+            && first.key.is_symbol()
+        {
+            push(Chord::new(input.mods, digit));
+        }
+        out
+    }
+
+    /// Whether a press runs `binding` on `platform`: one of its [`candidates`](Self::candidates)
+    /// is the binding.
+    pub fn matches(&self, binding: &Chord, input: &KeyInput, platform: Platform) -> bool {
+        let want = binding.effective(platform);
+        self.candidates(input).iter().any(|c| c.effective(platform) == want)
+    }
+
+    /// Rule 6: the layout's character for the punctuation key `key`, when pressing that position
+    /// means `key` and the layout types `key`'s own character nowhere else that is known.
+    pub(crate) fn key_label(&self, key: Key) -> Option<String> {
+        let typed = self.char_at(key)?;
+        if Key::from_char(typed).is_some() {
+            return None;
+        }
+        let own = key.name().chars().next()?;
+        if self.chars.values().any(|&c| c == own) {
+            return None;
+        }
+        let mut upper = typed.to_uppercase();
+        Some(match (upper.next(), upper.next()) {
+            (Some(u), None) => u.to_string(),
+            _ => typed.to_string(),
+        })
+    }
+}
diff --git a/crates/keymap/src/lib.rs b/crates/keymap/src/lib.rs
new file mode 100644
index 00000000..f121091d
--- /dev/null
+++ b/crates/keymap/src/lib.rs
@@ -0,0 +1,163 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+//! Keyboard bindings for the Craft suite.
+//!
+//! [`chord`] holds the key and modifier types, the canonical text form that settings and control
+//! protocols store, display text per platform, and a reader for other applications' key text.
+//! [`command`] names what a binding runs, [`scope`] where it works, and [`keymap`] holds an app's
+//! catalog with default bindings, the user's [`Overrides`], dispatch ([`Keymap::lookup`]),
+//! editing and conflicts. [`profiles`] keeps named sets of overrides; [`reserved`] lists the
+//! chords each operating system takes, and a keymap reserves no chord unless the app opts in with
+//! [`Keymap::with_reserved`], e.g. `with_reserved(reserved::system(platform))`. [`import`] brings
+//! in other applications' shortcut sets. [`layout`] decides which chord a key press means on the
+//! user's keyboard layout, for matching, recording and labels. [`editor`] is the model of a
+//! shortcut editor: undo, a chord recorder, conflict queries and search. With the `egui` feature,
+//! the `egui` module
+//! converts to and from egui keys, matches key presses against bindings and dispatches a frame's
+//! key events.
+//!
+//! ```
+//! use craft_keymap::{Chord, Platform};
+//!
+//! let chord = Chord::parse("⇧⌘Z").unwrap();
+//! assert_eq!(chord.to_string(), "Cmd+Shift+Z");
+//! assert_eq!(chord.display(Platform::Mac), "⇧⌘Z");
+//! assert_eq!(chord.display(Platform::Windows), "Ctrl+Shift+Z");
+//! ```
+//!
+//! # A catalog and dispatch
+//!
+//! The app lists every command it can bind. A command with parameters has the key
+//! `window.panel {"panel":"layers"}` in settings and reports. Tools of one group share a key and
+//! cycle. A binding can name a scope other than the command's home scope.
+//!
+//! ```
+//! use craft_keymap::{Active, Bindable, Binding, Chord, CommandRef, Keymap, Kind, Lookup, Platform, Scope, Scopes};
+//! use serde_json::json;
+//!
+//! let key = |text: &str| Binding::parse(text).unwrap();
+//! let layers = CommandRef::with_params("window.panel", json!({"panel": "layers"}));
+//! let select = Kind::Tool { group: Some("select".into()) };
+//! let catalog = vec![
+//!     Bindable::new("file.save", "Save", Scope::app()).with_path(vec!["File".into(), "Save".into()]).with_default(key("Cmd+S")),
+//!     Bindable::new(layers.clone(), "Layers", Scope::app()).with_path(vec!["Window".into(), "Layers".into()]).with_default(key("F7")),
+//!     Bindable::new("tool.marquee", "Marquee Tool", Scope::app()).with_kind(select.clone()).with_default(key("M")),
+//!     Bindable::new("tool.ellipse", "Elliptical Marquee Tool", Scope::app()).with_kind(select).with_default(key("M")),
+//!     // Home scope: the Timeline panel, where it wins over the app's L.
+//!     Bindable::new("timeline.loop", "Loop", Scope::new("Timeline").unwrap()).with_default(key("L")),
+//!     Bindable::new("layer.lock", "Lock Layer", Scope::app()).with_default(key("L")),
+//!     // An app command whose binding works only in the Text context.
+//!     Bindable::new("type.bold", "Bold", Scope::app()).with_default(key("Text: Cmd+B")),
+//! ];
+//! let keymap = Keymap::new(catalog, Scopes::new().with_panel("Timeline").with_context("Text"), Platform::Mac);
+//! assert_eq!(layers.key(), r#"window.panel {"panel":"layers"}"#);
+//!
+//! // Dispatch: the chord pressed, whether it is a double press, and what has the keyboard.
+//! let press = |text: &str, active: &Active| keymap.lookup(&Chord::parse(text).unwrap(), false, active);
+//! assert_eq!(press("F7", &Active::NONE), Lookup::Run(layers));
+//! assert_eq!(press("L", &Active::panel("Timeline")), Lookup::Run("timeline.loop".into()));
+//! assert_eq!(press("L", &Active::NONE), Lookup::Run("layer.lock".into()));
+//! assert_eq!(press("M", &Active::NONE), Lookup::Cycle(vec!["tool.marquee".into(), "tool.ellipse".into()]));
+//! let editing = Active { contexts: &["Text"], typing: true, ..Active::NONE };
+//! assert_eq!(press("Cmd+B", &editing), Lookup::Run("type.bold".into()));
+//! assert_eq!(press("M", &editing), Lookup::None, "plain keys go to the text field");
+//! ```
+//!
+//! With the `egui` feature, `egui::Dispatcher` does this for a frame's key events.
+//!
+//! # Storing overrides
+//!
+//! [`Overrides`] is a field of the app's craft-settings type, marked
+//! `#[serde(with = "craft_keymap::keymap::overrides_list")]` so that it is stored as an array of
+//! `{ command, keys }` tables. craft-settings merges tables key by key with what the file holds,
+//! but replaces an array whole, so a reset command (an entry removed) stays removed after saving.
+//! Without the attribute, overrides with at most one text per command are written as a table.
+//!
+//! ```no_run
+//! use craft_keymap::{Binding, Keymap, Overrides, Platform, Policy, Scopes};
+//! use craft_settings::{Location, Settings, SettingsStore};
+//! use serde::{Deserialize, Serialize};
+//!
+//! #[derive(Serialize, Deserialize, Default, Clone, PartialEq)]
+//! #[serde(default)]
+//! struct Prefs {
+//!     #[serde(with = "craft_keymap::keymap::overrides_list")]
+//!     shortcuts: Overrides,
+//! }
+//!
+//! impl Settings for Prefs {
+//!     const APP_ID: &'static str = "acmecraft";
+//!     const SCHEMA_VERSION: u32 = 1;
+//! }
+//!
+//! # let catalog = Vec::new();
+//! let (mut store, _report) = SettingsStore::<Prefs>::open(Location::Auto);
+//! let mut keymap = Keymap::new(catalog, Scopes::new(), Platform::current()).with_overrides(store.get().shortcuts.clone());
+//! // Entries for unknown commands and texts that do not parse are kept and listed here.
+//! let _problems = keymap.problems();
+//!
+//! // After each change in the shortcut editor:
+//! keymap.assign(&"file.save".into(), Binding::parse("Cmd+Alt+S").unwrap(), Policy::Steal).ok();
+//! store.update(|p| p.shortcuts = keymap.overrides().clone());
+//! ```
+//!
+//! An app with named sets stores only [`Profiles`] in place of the `Overrides` field and builds
+//! the keymap from the active set:
+//! `with_overrides(prefs.shortcut_sets.active_overrides(&builtins).clone())`.
+//!
+//! # Importing a shortcut set
+//!
+//! The app's reader builds a [`ForeignSet`]; [`plan`] matches it without changing anything, so a
+//! review UI can show [`ImportPlan::commands`] and the report first.
+//!
+//! ```
+//! use craft_keymap::{Bindable, Binding, ContextRule, Flavor, ForeignEntry, ForeignKey, ForeignSet, ImportOptions, Keymap, Platform};
+//! use craft_keymap::{Scope, Scopes, plan};
+//!
+//! let save = Bindable::new("file.save", "Save", Scope::app())
+//!     .with_path(vec!["File".into(), "Save".into()])
+//!     .with_default(Binding::parse("Cmd+S").unwrap());
+//! let mut keymap = Keymap::new(vec![save], Scopes::new(), Platform::Windows);
+//!
+//! let read = |text: &str| ForeignKey::read(Some("Default"), text, Flavor::Windows);
+//! let set = ForeignSet::new(vec![
+//!     ForeignEntry::new(Some("File"), ["Save"]).with_key(read("Ctrl+Alt+S")).at_line(12),
+//!     ForeignEntry::new(Some("File"), ["Frobnicate"]).with_key(read("Ctrl+F")).at_line(13),
+//! ])
+//! .with_name("My Set");
+//! let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], ..ImportOptions::default() };
+//! let planned = plan(&set, &keymap, &options);
+//! assert_eq!(planned.commands.len(), 1);
+//!
+//! let report = planned.apply(&mut keymap);
+//! assert_eq!(report.changed[0].to, ["Cmd+Alt+S"]);
+//! assert_eq!((report.unmatched[0].item.as_str(), report.unmatched[0].line), ("File > Frobnicate", Some(13)));
+//! assert_eq!(keymap.bindings(&"file.save".into()), [Binding::parse("Cmd+Alt+S").unwrap()]);
+//! ```
+
+pub mod chord;
+pub mod command;
+pub mod editor;
+#[cfg(feature = "egui")]
+pub mod egui;
+pub mod import;
+pub mod keymap;
+pub mod layout;
+pub mod profiles;
+pub mod reserved;
+pub mod scope;
+#[cfg(feature = "ui")]
+pub mod ui;
+
+pub use chord::foreign::Flavor;
+pub use chord::{Chord, Key, MAX_CHORD_TEXT, Mods, ParseError, Platform, Trigger};
+pub use command::{CommandRef, MAX_KEY};
+pub use editor::{DOUBLE_PRESS, EditSession, MAX_UNDO, MAX_UNDO_BYTES, Recorded, Recorder};
+pub use import::{ContextRule, ForeignEntry, ForeignKey, ForeignSet, ImportOptions, ImportPlan, ImportReport, NoneDefined, Start, plan};
+pub use keymap::{
+    AssignError, Assigned, Bindable, Binding, BindingError, Conflict, ConflictKind, DropReason, Holder, Keymap, Kind, Lookup, MAX_BINDING_TEXT,
+    MAX_BINDINGS, MAX_COMMANDS, MAX_CONFLICTS, Overrides, Policy, Problem, TypingRule, text_editing_chords,
+};
+pub use layout::{KeyInput, Layout};
+pub use profiles::{Builtins, MAX_EXPORT_BYTES, MAX_SET_NAME, MAX_SETS, ProfileError, Profiles, SetProblem};
+pub use scope::{Active, MAX_SCOPE_NAME, Scope, ScopeKind, Scopes};
diff --git a/crates/keymap/src/profiles.rs b/crates/keymap/src/profiles.rs
new file mode 100644
index 00000000..df9634db
--- /dev/null
+++ b/crates/keymap/src/profiles.rs
@@ -0,0 +1,562 @@
+//! Named sets of overrides: the app's built-in sets (read only) and the user's own.
+//!
+//! ```
+//! use craft_keymap::{Overrides, Profiles};
+//!
+//! let mut classic = Overrides::new();
+//! classic.insert("edit.copy", vec!["Cmd+Shift+C".into()]);
+//! let builtins = [("Craft", Overrides::new()), ("Classic", classic)];
+//! let mut sets = Profiles::default();
+//! assert_eq!(sets.active_name(&builtins), "Craft");
+//!
+//! sets.duplicate("Classic", "Mine", &builtins).unwrap();
+//! let text = sets.export("Mine", &builtins).unwrap();
+//! assert_eq!(sets.import(&text, &builtins), Ok("Mine 2".into()));
+//! assert_eq!(sets.active_overrides(&builtins), sets.get("Mine", &builtins).unwrap());
+//! ```
+
+use std::collections::BTreeMap;
+use std::fmt;
+
+use serde::de::{self, IgnoredAny, MapAccess, SeqAccess, Visitor};
+use serde::ser::SerializeStruct;
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+use serde_json::{Value, json};
+
+use crate::import::{ImportPlan, ImportReport};
+use crate::keymap::{Keymap, Overrides};
+
+/// Most user sets.
+pub const MAX_SETS: usize = 64;
+/// Longest set name, in chars.
+pub const MAX_SET_NAME: usize = 64;
+/// Largest export document [`Profiles::import`] reads, in bytes.
+pub const MAX_EXPORT_BYTES: usize = 4 << 20;
+
+const FORMAT: &str = "craft-keymap";
+const VERSION: u64 = 1;
+/// The version stored [`Profiles`] carry; stored profiles without one read as version 1.
+const STORE_VERSION: u64 = 1;
+// Load notes are kept for `Profiles::problems`; a hostile file must not grow them without bound.
+const MAX_NOTES: usize = 64;
+const IMPORTED: &str = "Imported";
+
+/// The app's built-in sets: name and overrides against the catalog defaults.
+pub type Builtins<'a> = [(&'a str, Overrides)];
+
+/// Why a set operation was refused.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum ProfileError {
+    /// Empty, over [`MAX_SET_NAME`] chars, or with control characters.
+    BadName,
+    NameTaken,
+    NotFound,
+    /// Built-in sets cannot be changed, renamed or deleted.
+    BuiltIn,
+    /// [`MAX_SETS`] user sets exist.
+    TooMany,
+    /// Not a JSON export document.
+    BadFile,
+    /// A `format` other than `craft-keymap`.
+    WrongFormat,
+    /// A `version` newer than this crate reads.
+    NewerVersion(u64),
+    /// Over [`MAX_EXPORT_BYTES`].
+    TooLarge,
+}
+
+impl fmt::Display for ProfileError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let s = match self {
+            ProfileError::BadName => "bad set name",
+            ProfileError::NameTaken => "a set with this name exists",
+            ProfileError::NotFound => "no such set",
+            ProfileError::BuiltIn => "built-in sets are read only",
+            ProfileError::TooMany => "too many sets",
+            ProfileError::BadFile => "not a shortcut set file",
+            ProfileError::WrongFormat => "not a craft-keymap file",
+            ProfileError::NewerVersion(v) => return write!(f, "shortcut set file version {v} is newer than this app reads"),
+            ProfileError::TooLarge => "shortcut set file too large",
+        };
+        f.write_str(s)
+    }
+}
+
+impl std::error::Error for ProfileError {}
+
+/// Something loading dropped from stored [`Profiles`]; [`Profiles::problems`] lists them.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum SetProblem {
+    /// A set without a valid name: none, empty, over [`MAX_SET_NAME`] chars, with control
+    /// characters or with spaces around it. `name` is what was stored, cut to [`MAX_SET_NAME`]
+    /// chars.
+    BadName { name: String },
+    /// A second set of this name; the first one stays.
+    Duplicate { name: String },
+    /// Overrides that are neither a list nor a map.
+    BadOverrides { name: String },
+    /// Sets past [`MAX_SETS`].
+    TooMany { ignored: usize },
+    /// Stored by a newer craft-keymap; what this version reads is loaded.
+    NewerVersion(u64),
+}
+
+/// The user's sets and which set is active. The built-in sets are passed to each call.
+///
+/// An active name that matches no set means the first built-in set (or no overrides when the app
+/// has none).
+///
+/// A user set may carry a built-in's name, for instance after an update adds that built-in. Until
+/// [`Profiles::reconcile`] renames it, the user set is the one that name reads and writes. Call
+/// `reconcile` after loading; every method that changes the profiles calls it first.
+///
+/// Stored as `{ version, active, sets }`. Loading never fails: what it drops is listed by
+/// [`Profiles::problems`], and the next save writes the profiles without it.
+#[derive(Clone, Debug, Default)]
+pub struct Profiles {
+    active: String,
+    sets: BTreeMap<String, Overrides>,
+    notes: Vec<SetProblem>,
+}
+
+impl PartialEq for Profiles {
+    fn eq(&self, other: &Profiles) -> bool {
+        self.active == other.active && self.sets == other.sets
+    }
+}
+
+impl Eq for Profiles {}
+
+static NO_OVERRIDES: Overrides = Overrides::new();
+
+/// A name as given, trimmed; `None` when empty, too long or with control characters.
+pub fn set_name(name: &str) -> Option<String> {
+    let n = name.trim();
+    let ok = !n.is_empty() && n.chars().count() <= MAX_SET_NAME && !n.chars().any(char::is_control);
+    ok.then(|| n.to_string())
+}
+
+impl Profiles {
+    /// The stored active name, which may match no set; [`active_name`](Self::active_name) is the
+    /// set in use.
+    pub fn active(&self) -> &str {
+        &self.active
+    }
+
+    /// The user's sets.
+    pub fn sets(&self) -> &BTreeMap<String, Overrides> {
+        &self.sets
+    }
+
+    /// What loading dropped.
+    pub fn problems(&self) -> &[SetProblem] {
+        &self.notes
+    }
+
+    /// Built-in names first, then the user's sets.
+    pub fn names(&self, builtins: &Builtins) -> Vec<String> {
+        builtins.iter().map(|(n, _)| n.to_string()).chain(self.sets.keys().cloned()).collect()
+    }
+
+    pub fn is_builtin(name: &str, builtins: &Builtins) -> bool {
+        builtins.iter().any(|(n, _)| *n == name)
+    }
+
+    /// The name of the set in use.
+    pub fn active_name<'a>(&'a self, builtins: &'a Builtins) -> &'a str {
+        if self.sets.contains_key(&self.active) || Self::is_builtin(&self.active, builtins) {
+            &self.active
+        } else {
+            builtins.first().map_or("", |(n, _)| n)
+        }
+    }
+
+    /// The overrides of the set in use, to hand to [`Keymap::set_overrides`](crate::Keymap::set_overrides).
+    pub fn active_overrides<'a>(&'a self, builtins: &'a Builtins) -> &'a Overrides {
+        self.get(self.active_name(builtins), builtins).unwrap_or(&NO_OVERRIDES)
+    }
+
+    pub fn get<'a>(&'a self, name: &str, builtins: &'a Builtins) -> Option<&'a Overrides> {
+        self.sets.get(name).or_else(|| builtins.iter().find(|(n, _)| *n == name).map(|(_, o)| o))
+    }
+
+    /// Renames user sets whose name matches a built-in's (ignoring case) to a free name; `active`
+    /// follows. Returns whether anything was renamed.
+    pub fn reconcile(&mut self, builtins: &Builtins) -> bool {
+        let clashing: Vec<String> = self.sets.keys().filter(|k| self.builtin_like(k, builtins)).cloned().collect();
+        let mut renamed = false;
+        for old in clashing {
+            let Some(set) = self.sets.remove(&old) else { continue };
+            // `unique` cannot fail here: a set was just removed, so there is room and the
+            // candidate names outnumber the sets.
+            let name = self.unique(&old, builtins).unwrap_or_else(|_| old.clone());
+            if self.active == old {
+                self.active = name.clone();
+            }
+            renamed |= name != old;
+            self.sets.insert(name, set);
+        }
+        renamed
+    }
+
+    pub fn select(&mut self, name: &str, builtins: &Builtins) -> Result<(), ProfileError> {
+        self.reconcile(builtins);
+        if self.get(name, builtins).is_none() {
+            return Err(ProfileError::NotFound);
+        }
+        self.active = name.to_string();
+        Ok(())
+    }
+
+    /// Saves edited overrides to the set in use. A built-in set is not changed: the edit goes to a
+    /// new set named after `copy_name` (made unique), which becomes active and is returned. The
+    /// new name is returned too when [`Profiles::reconcile`] renamed the set in use.
+    pub fn store(&mut self, overrides: Overrides, builtins: &Builtins, copy_name: &str) -> Result<Option<String>, ProfileError> {
+        let was = self.active_name(builtins).to_string();
+        self.reconcile(builtins);
+        let active = self.active_name(builtins).to_string();
+        if let Some(set) = self.sets.get_mut(&active) {
+            *set = overrides;
+            return Ok((active != was).then_some(active));
+        }
+        if self.get(&active, builtins) == Some(&overrides) || (active.is_empty() && overrides.is_empty()) {
+            return Ok(None);
+        }
+        let base = set_name(copy_name).ok_or(ProfileError::BadName)?;
+        self.add(&base, overrides, builtins).map(Some)
+    }
+
+    /// Saves `overrides` as a user set (replacing one of that name) and makes it active.
+    pub fn save_as(&mut self, name: &str, overrides: Overrides, builtins: &Builtins) -> Result<String, ProfileError> {
+        self.reconcile(builtins);
+        let name = set_name(name).ok_or(ProfileError::BadName)?;
+        if self.builtin_like(&name, builtins) {
+            return Err(ProfileError::BuiltIn);
+        }
+        if !self.sets.contains_key(&name) {
+            if self.sets.keys().any(|k| k.to_lowercase() == name.to_lowercase()) {
+                return Err(ProfileError::NameTaken);
+            }
+            if self.sets.len() >= MAX_SETS {
+                return Err(ProfileError::TooMany);
+            }
+        }
+        self.sets.insert(name.clone(), overrides);
+        self.active = name.clone();
+        Ok(name)
+    }
+
+    pub fn rename(&mut self, from: &str, to: &str, builtins: &Builtins) -> Result<String, ProfileError> {
+        self.reconcile(builtins);
+        if Self::is_builtin(from, builtins) {
+            return Err(ProfileError::BuiltIn);
+        }
+        let to = set_name(to).ok_or(ProfileError::BadName)?;
+        if !self.sets.contains_key(from) {
+            return Err(ProfileError::NotFound);
+        }
+        // A settings file can hold names that differ only in case, so a case-only rename still
+        // checks the other sets.
+        let lower = to.to_lowercase();
+        let clash = self.sets.keys().any(|k| k != from && k.to_lowercase() == lower);
+        if to != from && (clash || (self.builtin_like(&to, builtins) && lower != from.to_lowercase())) {
+            return Err(ProfileError::NameTaken);
+        }
+        if let Some(set) = self.sets.remove(from) {
+            self.sets.insert(to.clone(), set);
+        }
+        if self.active == from {
+            self.active = to.clone();
+        }
+        Ok(to)
+    }
+
+    pub fn delete(&mut self, name: &str, builtins: &Builtins) -> Result<(), ProfileError> {
+        self.reconcile(builtins);
+        if Self::is_builtin(name, builtins) {
+            return Err(ProfileError::BuiltIn);
+        }
+        self.sets.remove(name).ok_or(ProfileError::NotFound)?;
+        if self.active == name {
+            self.active = builtins.first().map_or(String::new(), |(n, _)| n.to_string());
+        }
+        Ok(())
+    }
+
+    /// Copies a set (built-in or user) to a new user set named `to` (made unique), which becomes
+    /// active. Returns its name.
+    pub fn duplicate(&mut self, from: &str, to: &str, builtins: &Builtins) -> Result<String, ProfileError> {
+        self.reconcile(builtins);
+        let overrides = self.get(from, builtins).ok_or(ProfileError::NotFound)?.clone();
+        let base = set_name(to).ok_or(ProfileError::BadName)?;
+        self.add(&base, overrides, builtins)
+    }
+
+    /// A set as a JSON document: `{"format":"craft-keymap","version":1,"name":…,"overrides":…}`,
+    /// overrides as [`Overrides`] serializes them.
+    pub fn export(&self, name: &str, builtins: &Builtins) -> Result<String, ProfileError> {
+        let overrides = self.get(name, builtins).ok_or(ProfileError::NotFound)?;
+        let doc = json!({"format": FORMAT, "version": VERSION, "name": name, "overrides": overrides});
+        serde_json::to_string_pretty(&doc).map_err(|_| ProfileError::BadFile)
+    }
+
+    /// Reads an exported set into a new user set (renamed when the name is taken) and makes it
+    /// active. Returns its name.
+    pub fn import(&mut self, text: &str, builtins: &Builtins) -> Result<String, ProfileError> {
+        if text.len() > MAX_EXPORT_BYTES {
+            return Err(ProfileError::TooLarge);
+        }
+        let doc: Value = serde_json::from_str(text).map_err(|_| ProfileError::BadFile)?;
+        if doc.get("format").and_then(Value::as_str) != Some(FORMAT) {
+            return Err(ProfileError::WrongFormat);
+        }
+        match doc.get("version").and_then(Value::as_u64) {
+            Some(VERSION) => {}
+            Some(v) if v > VERSION => return Err(ProfileError::NewerVersion(v)),
+            _ => return Err(ProfileError::BadFile),
+        }
+        let overrides = match doc.get("overrides") {
+            Some(v @ (Value::Object(_) | Value::Array(_))) => Overrides::deserialize(v).map_err(|_| ProfileError::BadFile)?,
+            None => Overrides::new(),
+            Some(_) => return Err(ProfileError::BadFile),
+        };
+        self.reconcile(builtins);
+        let base = doc.get("name").and_then(Value::as_str).and_then(set_name).unwrap_or_else(|| IMPORTED.to_string());
+        self.add(&base, overrides, builtins)
+    }
+
+    /// Applies an import plan to a copy of `keymap` (the keymap the plan was made from) and keeps
+    /// the resulting overrides as a new user set, which becomes active; `keymap` is not changed.
+    /// The set is named `name`, else the foreign set's name, else `Imported`, made unique.
+    /// Returns its name and the report of [`ImportPlan::apply`].
+    pub fn import_plan(
+        &mut self,
+        plan: &ImportPlan,
+        keymap: &Keymap,
+        name: Option<&str>,
+        builtins: &Builtins,
+    ) -> Result<(String, ImportReport), ProfileError> {
+        self.reconcile(builtins);
+        if self.sets.len() >= MAX_SETS {
+            return Err(ProfileError::TooMany);
+        }
+        let mut copy = keymap.clone();
+        let report = plan.apply(&mut copy);
+        let base = name.or(plan.report.set.as_deref()).and_then(set_name).unwrap_or_else(|| IMPORTED.to_string());
+        let name = self.add(&base, copy.overrides().clone(), builtins)?;
+        Ok((name, report))
+    }
+
+    /// Adds a user set under a unique name from `base` and makes it active.
+    fn add(&mut self, base: &str, overrides: Overrides, builtins: &Builtins) -> Result<String, ProfileError> {
+        let name = self.unique(base, builtins)?;
+        self.sets.insert(name.clone(), overrides);
+        self.active = name.clone();
+        Ok(name)
+    }
+
+    fn builtin_like(&self, name: &str, builtins: &Builtins) -> bool {
+        let lower = name.to_lowercase();
+        builtins.iter().any(|(n, _)| n.to_lowercase() == lower)
+    }
+
+    /// Whether `name` matches a built-in or user set, ignoring case.
+    pub(crate) fn taken(&self, name: &str, builtins: &Builtins) -> bool {
+        let lower = name.to_lowercase();
+        self.builtin_like(name, builtins) || self.sets.keys().any(|k| k.to_lowercase() == lower)
+    }
+
+    /// `base`, or `base 2`, `base 3`… cut to fit [`MAX_SET_NAME`].
+    fn unique(&self, base: &str, builtins: &Builtins) -> Result<String, ProfileError> {
+        if self.sets.len() >= MAX_SETS {
+            return Err(ProfileError::TooMany);
+        }
+        if !self.taken(base, builtins) {
+            return Ok(base.to_string());
+        }
+        // `Custom 2` taken: try `Custom 3`, not `Custom 2 2`.
+        let base = match base.rsplit_once(' ') {
+            Some((stem, n)) if !stem.is_empty() && (1..=3).contains(&n.len()) && n.bytes().all(|b| b.is_ascii_digit()) => stem,
+            _ => base,
+        };
+        for n in 2..(MAX_SETS + builtins.len() + 3) {
+            let suffix = format!(" {n}");
+            let keep = MAX_SET_NAME.saturating_sub(suffix.chars().count());
+            let name: String = base.chars().take(keep).collect::<String>().trim_end().to_string() + &suffix;
+            if !self.taken(&name, builtins) {
+                return Ok(name);
+            }
+        }
+        Err(ProfileError::NameTaken)
+    }
+}
+
+impl Serialize for Profiles {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let mut s = serializer.serialize_struct("Profiles", 3)?;
+        s.serialize_field("version", &STORE_VERSION)?;
+        s.serialize_field("active", &self.active)?;
+        s.serialize_field("sets", &SetList(&self.sets))?;
+        s.end()
+    }
+}
+
+impl<'de> Deserialize<'de> for Profiles {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Profiles, D::Error> {
+        #[derive(Deserialize, Default)]
+        #[serde(default)]
+        struct Stored {
+            #[serde(deserialize_with = "lenient_version")]
+            version: Option<u64>,
+            #[serde(deserialize_with = "lenient_name")]
+            active: String,
+            #[serde(deserialize_with = "capped_sets")]
+            sets: Loaded,
+        }
+        let Stored { version, active, sets: Loaded { sets, mut notes, .. } } = Stored::deserialize(deserializer)?;
+        if let Some(v) = version.filter(|v| *v > STORE_VERSION) {
+            notes.insert(0, SetProblem::NewerVersion(v));
+            notes.truncate(MAX_NOTES);
+        }
+        Ok(Profiles { active, sets, notes })
+    }
+}
+
+fn lenient_name<'de, D: Deserializer<'de>>(deserializer: D) -> Result<String, D::Error> {
+    let v = Value::deserialize(deserializer)?;
+    Ok(v.as_str().and_then(set_name).unwrap_or_default())
+}
+
+fn lenient_version<'de, D: Deserializer<'de>>(deserializer: D) -> Result<Option<u64>, D::Error> {
+    Ok(Value::deserialize(deserializer)?.as_u64())
+}
+
+// An array of `{ name, overrides }` rather than a table, and each set's overrides in their array
+// form, so that craft-settings (which replaces arrays whole) drops a deleted set or entry from the
+// file.
+struct SetList<'a>(&'a BTreeMap<String, Overrides>);
+
+impl Serialize for SetList<'_> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        #[derive(Serialize)]
+        struct Set<'a> {
+            name: &'a str,
+            #[serde(serialize_with = "crate::keymap::overrides_list::serialize")]
+            overrides: &'a Overrides,
+        }
+        serializer.collect_seq(self.0.iter().map(|(name, overrides)| Set { name, overrides }))
+    }
+}
+
+/// The sets that loaded, and notes on the ones that did not.
+#[derive(Default)]
+struct Loaded {
+    sets: BTreeMap<String, Overrides>,
+    notes: Vec<SetProblem>,
+    ignored: usize,
+}
+
+impl Loaded {
+    fn note(&mut self, problem: SetProblem) {
+        if self.notes.len() < MAX_NOTES {
+            self.notes.push(problem);
+        }
+    }
+
+    /// Keeps a set with a valid name, stored as written, that is new and fits under [`MAX_SETS`];
+    /// notes why not otherwise.
+    fn add(&mut self, name: &str, overrides: Option<Overrides>) {
+        let shown = || name.chars().take(MAX_SET_NAME).collect::<String>();
+        if !set_name(name).is_some_and(|n| n == name) {
+            self.note(SetProblem::BadName { name: shown() });
+        } else if self.sets.contains_key(name) {
+            self.note(SetProblem::Duplicate { name: shown() });
+        } else if self.sets.len() >= MAX_SETS {
+            self.ignored += 1;
+        } else if let Some(o) = overrides {
+            self.sets.insert(name.to_string(), o);
+        } else {
+            self.note(SetProblem::BadOverrides { name: shown() });
+        }
+    }
+
+    fn done(mut self) -> Loaded {
+        if self.ignored > 0 {
+            let ignored = std::mem::take(&mut self.ignored);
+            self.note(SetProblem::TooMany { ignored });
+        }
+        self
+    }
+}
+
+fn capped_sets<'de, D: Deserializer<'de>>(deserializer: D) -> Result<Loaded, D::Error> {
+    deserializer.deserialize_any(SetsVisitor)
+}
+
+struct SetsVisitor;
+
+// Anything other than a list or a map loads as no sets, so the rest of `Profiles` still loads.
+macro_rules! no_sets {
+    ($($name:ident: $t:ty),*) => {
+        $(fn $name<E: de::Error>(self, _: $t) -> Result<Self::Value, E> {
+            Ok(Loaded::default())
+        })*
+    };
+}
+
+impl<'de> Visitor<'de> for SetsVisitor {
+    type Value = Loaded;
+
+    fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        f.write_str("a list of `{ name, overrides }` items or a map of set names to overrides")
+    }
+
+    no_sets!(visit_bool: bool, visit_i64: i64, visit_u64: u64, visit_i128: i128, visit_u128: u128, visit_f64: f64, visit_str: &str, visit_bytes: &[u8], visit_char: char);
+
+    fn visit_unit<E: de::Error>(self) -> Result<Self::Value, E> {
+        Ok(Loaded::default())
+    }
+
+    fn visit_none<E: de::Error>(self) -> Result<Self::Value, E> {
+        Ok(Loaded::default())
+    }
+
+    fn visit_some<D: Deserializer<'de>>(self, deserializer: D) -> Result<Self::Value, D::Error> {
+        deserializer.deserialize_any(SetsVisitor)
+    }
+
+    fn visit_seq<A: SeqAccess<'de>>(self, mut access: A) -> Result<Self::Value, A::Error> {
+        let mut out = Loaded::default();
+        while let Some(item) = access.next_element::<Value>()? {
+            let name = item.get("name").and_then(Value::as_str).unwrap_or_default();
+            out.add(name, item.get("overrides").and_then(overrides_of));
+        }
+        Ok(out.done())
+    }
+
+    fn visit_map<A: MapAccess<'de>>(self, mut access: A) -> Result<Self::Value, A::Error> {
+        let mut out = Loaded::default();
+        while let Some(key) = access.next_key::<String>()? {
+            if out.sets.len() >= MAX_SETS && !out.sets.contains_key(&key) {
+                access.next_value::<IgnoredAny>()?;
+                out.ignored += 1;
+            } else {
+                let overrides = overrides_of(&access.next_value::<Value>()?);
+                out.add(&key, overrides);
+            }
+        }
+        Ok(out.done())
+    }
+}
+
+/// A set's overrides: a list or a map, anything else is no set.
+fn overrides_of(v: &Value) -> Option<Overrides> {
+    match v {
+        Value::Object(_) | Value::Array(_) => Overrides::deserialize(v).ok(),
+        _ => None,
+    }
+}
diff --git a/crates/keymap/src/reserved.rs b/crates/keymap/src/reserved.rs
new file mode 100644
index 00000000..4d64d36a
--- /dev/null
+++ b/crates/keymap/src/reserved.rs
@@ -0,0 +1,40 @@
+//! Chords the operating system takes before the app sees them.
+//!
+//! A keymap reserves these only when the app passes them to
+//! [`Keymap::with_reserved`](crate::Keymap::with_reserved).
+
+use crate::chord::{Chord, Platform};
+
+// from photocraft crates/engine/src/prefs.rs `reserved_shortcut`
+const MAC: &[&str] = &["Cmd+Tab", "Cmd+Shift+Tab", "Cmd+Alt+Escape", "Cmd+`"];
+const WINDOWS: &[&str] = &["Alt+Tab", "Alt+Shift+Tab", "Alt+F4", "Cmd+Alt+Delete", "Cmd+Escape", "Cmd+Shift+Escape"];
+// Linux and the BSDs: window switching and closing, and the virtual consoles.
+const LINUX: &[&str] = &[
+    "Alt+Tab",
+    "Alt+Shift+Tab",
+    "Alt+F4",
+    "Cmd+Alt+Delete",
+    "Cmd+Alt+F1",
+    "Cmd+Alt+F2",
+    "Cmd+Alt+F3",
+    "Cmd+Alt+F4",
+    "Cmd+Alt+F5",
+    "Cmd+Alt+F6",
+    "Cmd+Alt+F7",
+    "Cmd+Alt+F8",
+    "Cmd+Alt+F9",
+    "Cmd+Alt+F10",
+    "Cmd+Alt+F11",
+    "Cmd+Alt+F12",
+];
+
+/// The window switching, closing and session chords of `platform`, for
+/// [`Keymap::with_reserved`](crate::Keymap::with_reserved).
+pub fn system(platform: Platform) -> Vec<Chord> {
+    let list = match platform {
+        Platform::Mac => MAC,
+        Platform::Windows => WINDOWS,
+        Platform::Linux => LINUX,
+    };
+    list.iter().filter_map(|t| Chord::parse(t).ok()).collect()
+}
diff --git a/crates/keymap/src/scope.rs b/crates/keymap/src/scope.rs
new file mode 100644
index 00000000..90b29e1e
--- /dev/null
+++ b/crates/keymap/src/scope.rs
@@ -0,0 +1,206 @@
+//! Where a binding works: the whole application, one panel, or a context such as text editing.
+
+use std::fmt;
+
+use serde::{Deserialize, Deserializer, Serialize};
+
+/// Longest scope name, in bytes.
+pub const MAX_SCOPE_NAME: usize = 64;
+
+const APP: &str = "Application";
+
+/// The name of a scope. Never empty, at most [`MAX_SCOPE_NAME`] bytes, without `:` or outer
+/// whitespace.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize)]
+#[serde(transparent)]
+pub struct Scope(String);
+
+impl Scope {
+    /// `None` for an empty name, one over [`MAX_SCOPE_NAME`] bytes, one with `:` or a control
+    /// character, or one with whitespace at either end, which binding text would lose.
+    pub fn new(name: impl Into<String>) -> Option<Scope> {
+        let name = name.into();
+        let ok = !name.is_empty() && name.len() <= MAX_SCOPE_NAME && name.trim() == name && !name.chars().any(|c| c == ':' || c.is_control());
+        ok.then_some(Scope(name))
+    }
+
+    /// The application scope, `Application`.
+    pub fn app() -> Scope {
+        Scope(APP.to_string())
+    }
+
+    pub fn is_app(&self) -> bool {
+        self.0 == APP
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl fmt::Display for Scope {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl<'de> Deserialize<'de> for Scope {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Scope, D::Error> {
+        let name = String::deserialize(deserializer)?;
+        Scope::new(name).ok_or_else(|| serde::de::Error::custom("bad scope name"))
+    }
+}
+
+/// What kind of scope a name is.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ScopeKind {
+    Application,
+    /// Works while the panel has the keyboard. Names that are not registered count as panels.
+    Panel,
+    /// Works only while the context is active, in any panel.
+    Context,
+}
+
+/// The scope registry: contexts, panels and the pairs of panels that share their shortcuts.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Scopes {
+    panels: Vec<String>,
+    contexts: Vec<String>,
+    shares: Vec<(String, String)>,
+    panel_fallthrough: bool,
+}
+
+impl Default for Scopes {
+    fn default() -> Scopes {
+        Scopes { panels: Vec::new(), contexts: Vec::new(), shares: Vec::new(), panel_fallthrough: true }
+    }
+}
+
+/// What has the keyboard: the focused panel, the active contexts, and whether a text field is
+/// being typed in.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct Active<'a> {
+    pub panel: Option<&'a str>,
+    pub contexts: &'a [&'a str],
+    pub typing: bool,
+}
+
+impl<'a> Active<'a> {
+    /// No panel focused, no context, not typing.
+    pub const NONE: Active<'static> = Active { panel: None, contexts: &[], typing: false };
+
+    pub const fn panel(panel: &'a str) -> Active<'a> {
+        Active { panel: Some(panel), contexts: &[], typing: false }
+    }
+}
+
+impl Scopes {
+    pub fn new() -> Scopes {
+        Scopes::default()
+    }
+
+    /// Registers a panel (used by [`Scopes::panels`]; unknown names rank as panels anyway).
+    pub fn with_panel(mut self, name: &str) -> Scopes {
+        if !self.panels.iter().any(|p| p == name) {
+            self.panels.push(name.to_string());
+        }
+        self
+    }
+
+    pub fn with_context(mut self, name: &str) -> Scopes {
+        if !self.contexts.iter().any(|c| c == name) {
+            self.contexts.push(name.to_string());
+        }
+        self
+    }
+
+    /// Two panels that show the same thing and share their shortcuts (EffectCraft's Timeline and
+    /// Composition).
+    pub fn with_share(mut self, a: &str, b: &str) -> Scopes {
+        if !self.shares(a, b) {
+            self.shares.push((a.to_string(), b.to_string()));
+        }
+        self
+    }
+
+    /// Whether another panel's shortcut still runs when nothing nearer claims the chord. On by
+    /// default.
+    pub fn with_panel_fallthrough(mut self, on: bool) -> Scopes {
+        self.panel_fallthrough = on;
+        self
+    }
+
+    pub fn panels(&self) -> &[String] {
+        &self.panels
+    }
+
+    pub fn contexts(&self) -> &[String] {
+        &self.contexts
+    }
+
+    pub fn panel_fallthrough(&self) -> bool {
+        self.panel_fallthrough
+    }
+
+    /// Whether `scope` is the application or a registered panel, context or sharing panel.
+    pub fn knows(&self, scope: &Scope) -> bool {
+        let name = scope.as_str();
+        scope.is_app()
+            || self.panels.iter().any(|p| p == name)
+            || self.contexts.iter().any(|c| c == name)
+            || self.shares.iter().any(|(a, b)| a == name || b == name)
+    }
+
+    pub fn kind(&self, scope: &Scope) -> ScopeKind {
+        self.kind_of(scope.as_str())
+    }
+
+    fn kind_of(&self, name: &str) -> ScopeKind {
+        if name == APP {
+            ScopeKind::Application
+        } else if self.contexts.iter().any(|c| c == name) {
+            ScopeKind::Context
+        } else {
+            ScopeKind::Panel
+        }
+    }
+
+    /// Whether panels `a` and `b` (in either order) share their shortcuts.
+    pub fn shares(&self, a: &str, b: &str) -> bool {
+        self.shares.iter().any(|(x, y)| (x == a && y == b) || (x == b && y == a))
+    }
+
+    /// How strongly a binding in `scope` claims a chord: lower wins, `None` does not run. An active
+    /// context 0, the focused panel 1, a panel sharing with it 2, the application 3, any other
+    /// panel 4 with fallthrough on. An inactive context never runs.
+    // from effectcraft#1266 `scope_rank`
+    pub fn rank(&self, scope: &Scope, active: &Active) -> Option<u8> {
+        let name = scope.as_str();
+        match self.kind_of(name) {
+            ScopeKind::Context => active.contexts.contains(&name).then_some(0),
+            ScopeKind::Application => Some(3),
+            ScopeKind::Panel => match active.panel {
+                Some(p) if p == name => Some(1),
+                Some(p) if self.shares(p, name) => Some(2),
+                _ => self.panel_fallthrough.then_some(4),
+            },
+        }
+    }
+
+    /// Whether the same chord in `a` and `b` makes only one of them work: the same scope, two
+    /// panels that share, or two different contexts (both can be active at once). Other pairs that
+    /// can be active together shadow (`Some(false)`): a context over anything else, a panel over
+    /// the application. `None`: never active together (two unrelated panels).
+    pub(crate) fn relation(&self, a: &Scope, b: &Scope) -> Option<bool> {
+        if a == b {
+            return Some(true);
+        }
+        match (self.kind(a), self.kind(b)) {
+            (ScopeKind::Context, ScopeKind::Context) => Some(true),
+            (ScopeKind::Context, _) | (_, ScopeKind::Context) => Some(false),
+            (ScopeKind::Application, _) | (_, ScopeKind::Application) => Some(false),
+            (ScopeKind::Panel, ScopeKind::Panel) => self.shares(a.as_str(), b.as_str()).then_some(true),
+        }
+    }
+}
diff --git a/crates/keymap/src/ui/capture.rs b/crates/keymap/src/ui/capture.rs
new file mode 100644
index 00000000..612458fc
--- /dev/null
+++ b/crates/keymap/src/ui/capture.rs
@@ -0,0 +1,102 @@
+//! Taking a frame's key input while the dialog records, before the app's dispatcher or egui's
+//! widgets see it.
+
+use ::egui::{Event, EventFilter, Id, InputState, Ui};
+
+use crate::chord::{Chord, Key, Mods, Platform};
+use crate::egui::{Clip, clipboard_chord, clipboard_kind};
+
+/// The keys a recording widget keeps from egui's focus navigation, so Tab, arrows and Escape are
+/// recorded instead of moving focus.
+pub(crate) const FOCUS_LOCK: EventFilter = EventFilter { tab: true, horizontal_arrows: true, vertical_arrows: true, escape: true };
+
+/// Holds egui's focus on `id` with [`FOCUS_LOCK`]; call each frame the widget records.
+pub(crate) fn lock_focus(ui: &Ui, id: Id) {
+    ui.memory_mut(|m| m.set_focus_lock_filter(id, FOCUS_LOCK));
+}
+
+/// Gives Tab, arrows and Escape back to egui's focus navigation. egui keeps a focused widget's
+/// filter until focus moves, so a widget that recorded calls this each frame it has focus and
+/// does not record.
+pub(crate) fn unlock_focus(ui: &Ui, id: Id) {
+    ui.memory_mut(|m| m.set_focus_lock_filter(id, EventFilter::default()));
+}
+
+/// Removes every key, text, IME and clipboard event from `input` and returns the chords pressed,
+/// in order. Repeats, releases and modifier-only presses give no chord. Copy, Cut and Paste
+/// count as the presses that cause them (Cmd+C, Cmd+X, Cmd+V, or Shift+Delete and Shift+Insert),
+/// once when a backend sends both the press and the event.
+pub(crate) fn take(input: &mut InputState, platform: Platform) -> Vec<Chord> {
+    let frame_mods = Mods::from_egui(&input.modifiers, platform);
+    let mut chords = Vec::new();
+    let mut kept = Vec::with_capacity(input.events.len());
+    let mut clipboard_press: Option<Clip> = None;
+    for event in std::mem::take(&mut input.events) {
+        match &event {
+            Event::Key { key, pressed, repeat, modifiers, .. } => {
+                let Some(key) = Key::from_egui(*key) else { continue };
+                if *pressed && !*repeat {
+                    let held = Mods::from_egui(modifiers, platform);
+                    if let Some(clip) = clipboard_kind(key, held) {
+                        clipboard_press = Some(clip);
+                    }
+                    chords.push(Chord::new(held, key));
+                }
+            }
+            Event::Copy | Event::Cut | Event::Paste(_) => {
+                let (key, held, clip) = clipboard_chord(&event, frame_mods);
+                if clipboard_press == Some(clip) {
+                    clipboard_press = None;
+                } else {
+                    chords.push(Chord::new(held, key));
+                }
+            }
+            Event::Text(_) | Event::Ime(_) => {}
+            _ => kept.push(event),
+        }
+    }
+    input.events = kept;
+    chords
+}
+
+#[cfg(test)]
+mod tests {
+    use ::egui::{Context, Key as EguiKey, Modifiers, RawInput};
+
+    use super::*;
+
+    fn run(events: Vec<Event>) -> (Vec<String>, usize) {
+        let ctx = Context::default();
+        let mut out = (Vec::new(), 0);
+        let mut full = ctx.run_ui(RawInput { events, ..RawInput::default() }, |ui| {
+            let chords = ui.ctx().input_mut(|i| take(i, Platform::Mac));
+            out = (chords.iter().map(Chord::to_string).collect(), ui.ctx().input(|i| i.events.len()));
+        });
+        full.textures_delta.clear();
+        out
+    }
+
+    fn press(key: EguiKey, modifiers: Modifiers) -> Event {
+        Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers }
+    }
+
+    #[test]
+    fn takes_presses_and_clipboard_events_and_leaves_nothing() {
+        let cmd = Modifiers::MAC_CMD;
+        let events = vec![
+            press(EguiKey::E, cmd),
+            Event::Text("e".into()),
+            Event::Key { key: EguiKey::E, physical_key: None, pressed: false, repeat: false, modifiers: cmd },
+            press(EguiKey::Tab, Modifiers::NONE),
+            // The web build: the press, then the event it causes, counted once.
+            press(EguiKey::C, cmd),
+            Event::Copy,
+            // egui-winit: only the event.
+            Event::Paste("x".into()),
+            Event::PointerGone,
+        ];
+        let (chords, left) = run(events);
+        assert_eq!(chords, ["Cmd+E", "Tab", "Cmd+C", "Cmd+V"]);
+        assert_eq!(left, 1, "only the pointer event stays");
+    }
+}
diff --git a/crates/keymap/src/ui/keyboard.rs b/crates/keymap/src/ui/keyboard.rs
new file mode 100644
index 00000000..edf8aedf
--- /dev/null
+++ b/crates/keymap/src/ui/keyboard.rs
@@ -0,0 +1,645 @@
+//! The on-screen keyboard pane (§2.9 of the dialog plan, `Options::keyboard`): a US ANSI layout
+//! colored by who holds each key with the chosen modifiers, modifier toggles that also follow the
+//! held modifiers, the shortcuts of the clicked key, and Assign to Selected.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use egui::text::{LayoutJob, TextFormat, TextWrapping};
+use egui::{
+    Align, Button, Color32, CornerRadius, FontId, Layout, Rect, RichText, Role, ScrollArea, Sense, Stroke, StrokeKind, Ui, WidgetInfo, pos2, vec2,
+};
+
+use super::{Draw, fill};
+use crate::chord::{Chord, Key, Mods, Trigger};
+use crate::command::CommandRef;
+use crate::keymap::{Binding, Holder, Keymap, Overrides};
+use crate::scope::Scope;
+
+/// The keyboard's width and height in key units: 15 for the main block, a gap, 3 for the
+/// navigation cluster; six rows and the gap under the function row.
+const UNITS_W: f32 = 18.5;
+const UNITS_H: f32 = 6.25;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Mod {
+    Cmd,
+    Ctrl,
+    Alt,
+    Shift,
+}
+
+impl Mod {
+    fn id(self) -> &'static str {
+        match self {
+            Mod::Cmd => "cmd",
+            Mod::Ctrl => "ctrl",
+            Mod::Alt => "alt",
+            Mod::Shift => "shift",
+        }
+    }
+
+    fn get(self, m: Mods) -> bool {
+        match self {
+            Mod::Cmd => m.cmd,
+            Mod::Ctrl => m.ctrl,
+            Mod::Alt => m.alt,
+            Mod::Shift => m.shift,
+        }
+    }
+
+    fn flip(self, m: &mut Mods) {
+        match self {
+            Mod::Cmd => m.cmd = !m.cmd,
+            Mod::Ctrl => m.ctrl = !m.ctrl,
+            Mod::Alt => m.alt = !m.alt,
+            Mod::Shift => m.shift = !m.shift,
+        }
+    }
+}
+
+/// A keycap: a key, a modifier, a key the dialog does not bind (Caps Lock, Win), or a gap.
+#[derive(Clone, Copy)]
+enum Cap {
+    Key(Key),
+    Mod(Mod),
+    CapsLock,
+    /// Win on Windows, Super on Linux; a Mac has none.
+    System,
+    Gap,
+}
+
+type Row = &'static [(Cap, f32)];
+
+const fn k(key: Key) -> (Cap, f32) {
+    (Cap::Key(key), 1.0)
+}
+
+const MAIN_ROWS: [Row; 5] = [
+    &[
+        (Cap::Key(Key::Backtick), 1.0),
+        k(Key::Num1),
+        k(Key::Num2),
+        k(Key::Num3),
+        k(Key::Num4),
+        k(Key::Num5),
+        k(Key::Num6),
+        k(Key::Num7),
+        k(Key::Num8),
+        k(Key::Num9),
+        k(Key::Num0),
+        k(Key::Minus),
+        k(Key::Equals),
+        (Cap::Key(Key::Backspace), 2.0),
+    ],
+    &[
+        (Cap::Key(Key::Tab), 1.5),
+        k(Key::Q),
+        k(Key::W),
+        k(Key::E),
+        k(Key::R),
+        k(Key::T),
+        k(Key::Y),
+        k(Key::U),
+        k(Key::I),
+        k(Key::O),
+        k(Key::P),
+        k(Key::OpenBracket),
+        k(Key::CloseBracket),
+        (Cap::Key(Key::Backslash), 1.5),
+    ],
+    &[
+        (Cap::CapsLock, 1.75),
+        k(Key::A),
+        k(Key::S),
+        k(Key::D),
+        k(Key::F),
+        k(Key::G),
+        k(Key::H),
+        k(Key::J),
+        k(Key::K),
+        k(Key::L),
+        k(Key::Semicolon),
+        k(Key::Quote),
+        (Cap::Key(Key::Enter), 2.25),
+    ],
+    &[
+        (Cap::Mod(Mod::Shift), 2.25),
+        k(Key::Z),
+        k(Key::X),
+        k(Key::C),
+        k(Key::V),
+        k(Key::B),
+        k(Key::N),
+        k(Key::M),
+        k(Key::Comma),
+        k(Key::Period),
+        k(Key::Slash),
+        (Cap::Mod(Mod::Shift), 2.75),
+    ],
+    &[],
+];
+
+const FUNCTION_ROW: Row = &[
+    k(Key::Escape),
+    (Cap::Gap, 1.0),
+    k(Key::F1),
+    k(Key::F2),
+    k(Key::F3),
+    k(Key::F4),
+    (Cap::Gap, 0.5),
+    k(Key::F5),
+    k(Key::F6),
+    k(Key::F7),
+    k(Key::F8),
+    (Cap::Gap, 0.5),
+    k(Key::F9),
+    k(Key::F10),
+    k(Key::F11),
+    k(Key::F12),
+];
+
+const MAC_BOTTOM: Row = &[
+    (Cap::Mod(Mod::Ctrl), 1.5),
+    (Cap::Mod(Mod::Alt), 1.25),
+    (Cap::Mod(Mod::Cmd), 1.5),
+    (Cap::Key(Key::Space), 6.5),
+    (Cap::Mod(Mod::Cmd), 1.5),
+    (Cap::Mod(Mod::Alt), 1.25),
+    (Cap::Mod(Mod::Ctrl), 1.5),
+];
+
+/// Off macOS the Ctrl keys are the command modifier.
+const PC_BOTTOM: Row = &[
+    (Cap::Mod(Mod::Cmd), 1.5),
+    (Cap::System, 1.25),
+    (Cap::Mod(Mod::Alt), 1.5),
+    (Cap::Key(Key::Space), 6.5),
+    (Cap::Mod(Mod::Alt), 1.5),
+    (Cap::System, 1.25),
+    (Cap::Mod(Mod::Cmd), 1.5),
+];
+
+/// The navigation cluster: (row, column in units, key). Row 0 is the function row.
+const NAV: &[(usize, f32, Key)] = &[
+    (1, 0.0, Key::Insert),
+    (1, 1.0, Key::Home),
+    (1, 2.0, Key::PageUp),
+    (2, 0.0, Key::Delete),
+    (2, 1.0, Key::End),
+    (2, 2.0, Key::PageDown),
+    (4, 1.0, Key::Up),
+    (5, 0.0, Key::Left),
+    (5, 1.0, Key::Down),
+    (5, 2.0, Key::Right),
+];
+
+/// A binding on a key and the scope it works in.
+#[derive(Clone, Debug)]
+pub(crate) struct KeyHolder {
+    pub holder: Holder,
+    pub scope: Scope,
+}
+
+/// Who holds a key with given modifiers.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Class {
+    Free,
+    App,
+    Scoped,
+    Both,
+}
+
+fn class(holders: &[KeyHolder]) -> Class {
+    match (holders.iter().any(|h| h.scope.is_app()), holders.iter().any(|h| !h.scope.is_app())) {
+        (false, false) => Class::Free,
+        (true, false) => Class::App,
+        (false, true) => Class::Scoped,
+        (true, true) => Class::Both,
+    }
+}
+
+/// The pane's state between frames.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct KeyboardState {
+    /// Hidden with the header's Keyboard toggle.
+    pub hidden: bool,
+    /// The modifiers toggled on; the held ones are added each frame.
+    pub mods: Mods,
+    /// The key whose shortcuts are listed.
+    pub key: Option<Key>,
+    /// Every binding by effective chord, rebuilt when the overrides change.
+    index: Option<Arc<(Overrides, Index)>>,
+}
+
+type Index = HashMap<Chord, Vec<KeyHolder>>;
+
+impl KeyboardState {
+    fn index(&mut self, keymap: &Keymap) -> Arc<(Overrides, Index)> {
+        if let Some(i) = self.index.as_ref().filter(|i| i.0 == *keymap.overrides()) {
+            return i.clone();
+        }
+        let platform = keymap.platform();
+        let mut map: HashMap<Chord, Vec<KeyHolder>> = HashMap::new();
+        for b in keymap.catalog() {
+            for binding in keymap.bindings(&b.command) {
+                let scope = binding.scope_or(&b.scope).clone();
+                let holder = Holder { command: b.command.clone(), binding };
+                map.entry(holder.binding.trigger.chord.effective(platform)).or_default().push(KeyHolder { holder, scope });
+            }
+        }
+        let index = Arc::new((keymap.overrides().clone(), map));
+        self.index = Some(index.clone());
+        index
+    }
+}
+
+fn mod_glyph(m: Mod) -> &'static str {
+    match m {
+        Mod::Cmd => "⌘",
+        Mod::Ctrl => "⌃",
+        Mod::Alt => "⌥",
+        Mod::Shift => "⇧",
+    }
+}
+
+/// The English legend printed on a key: Apple's words on macOS, PC words elsewhere.
+fn cap_name(key: Key, mac: bool) -> &'static str {
+    match (key, mac) {
+        (Key::Escape, true) => "esc",
+        (Key::Escape, false) => "Esc",
+        (Key::Backspace, true) => "delete",
+        (Key::Delete, true) => "fwd del",
+        (Key::Insert, true) => "ins",
+        (Key::Enter, true) => "return",
+        (Key::Tab, true) => "tab",
+        (Key::PageUp, true) => "page up",
+        (Key::PageDown, true) => "page down",
+        (Key::Home, true) => "home",
+        (Key::End, true) => "end",
+        (Key::Insert, false) => "Ins",
+        (Key::PageUp, false) => "PgUp",
+        (Key::PageDown, false) => "PgDn",
+        (Key::Delete, false) => "Del",
+        (Key::Space, true) => "",
+        (Key::Up | Key::Down | Key::Left | Key::Right, _) => key.mac_symbol(),
+        (k, _) => k.text_name(),
+    }
+}
+
+fn union(a: Mods, b: Mods) -> Mods {
+    Mods { cmd: a.cmd || b.cmd, ctrl: a.ctrl || b.ctrl, alt: a.alt || b.alt, shift: a.shift || b.shift }
+}
+
+/// Black or white, whichever reads better on `fill`.
+fn ink(fill: Color32) -> Color32 {
+    let l = 0.299 * f32::from(fill.r()) + 0.587 * f32::from(fill.g()) + 0.114 * f32::from(fill.b());
+    if l > 150.0 { Color32::from_gray(24) } else { Color32::from_gray(240) }
+}
+
+/// What a frame of the pane asked for.
+#[derive(Default)]
+struct Clicks {
+    key: Option<Key>,
+    toggle: Option<Mod>,
+    go: Option<CommandRef>,
+    assign: bool,
+}
+
+impl Draw<'_, '_> {
+    /// The pane's height for a middle area of `height`, or `None` when it is off or does not fit.
+    pub(super) fn keyboard_height(&self, height: f32) -> Option<f32> {
+        if !self.env.options.keyboard || self.state.keyboard.hidden {
+            return None;
+        }
+        let h = (height * 0.45).min(320.0).min(height - 160.0);
+        (h >= 120.0).then_some(h)
+    }
+
+    /// The header's toggle that shows and hides the pane.
+    pub(super) fn keyboard_toggle(&mut self, ui: &mut Ui) {
+        if !self.env.options.keyboard {
+            return;
+        }
+        let label = self.ui("Keyboard");
+        let r = ui.add(Button::selectable(!self.state.keyboard.hidden, self.vis(&label)));
+        self.tag(|| "shortcuts.keyboard".into(), r.rect, &label);
+        if r.clicked() {
+            self.state.keyboard.hidden = !self.state.keyboard.hidden;
+        }
+    }
+
+    fn mods_shown(&self) -> &'static [Mod] {
+        if self.env.keymap.platform().is_mac() { &[Mod::Cmd, Mod::Ctrl, Mod::Alt, Mod::Shift] } else { &[Mod::Cmd, Mod::Alt, Mod::Shift] }
+    }
+
+    /// A modifier's name, with its glyph on macOS.
+    fn mod_name(&self, m: Mod) -> String {
+        let word = self.mod_word(m);
+        if self.env.keymap.platform().is_mac() { format!("{} {word}", mod_glyph(m)) } else { word }
+    }
+
+    /// The key's name on its cap: the app's localized name, else the glyph on macOS.
+    fn cap_legend(&self, key: Key) -> String {
+        let p = self.env.keymap.platform();
+        self.env.text.key(key, p).unwrap_or_else(|| cap_name(key, p.is_mac()).to_string())
+    }
+
+    /// A modifier cap's word, without the glyph (which goes above it on macOS).
+    fn mod_word(&self, m: Mod) -> String {
+        match (m, self.env.keymap.platform().is_mac()) {
+            (Mod::Cmd, true) => self.ui("Command"),
+            (Mod::Ctrl, true) => self.ui("Control"),
+            (Mod::Alt, true) => self.ui("Option"),
+            (Mod::Cmd | Mod::Ctrl, false) => self.ui("Ctrl"),
+            (Mod::Alt, false) => self.ui("Alt"),
+            (Mod::Shift, _) => self.ui("Shift"),
+        }
+    }
+
+    /// The key's spoken name: the app's localized name, else the name Windows and Linux show.
+    fn key_name(&self, key: Key) -> String {
+        self.env.text.key(key, self.env.keymap.platform()).unwrap_or_else(|| key.text_name().to_string())
+    }
+
+    /// The holder's label, with its scope when that is not Application.
+    fn holder_text(&self, h: &KeyHolder) -> String {
+        let label = self.label_of(&h.holder.command);
+        if h.scope.is_app() { label } else { fill(self.ui("{label} ({scope})"), &[("label", &label), ("scope", &self.scope_name(&h.scope))]) }
+    }
+
+    pub(super) fn keyboard_pane(&mut self, ui: &mut Ui) {
+        let platform = self.env.keymap.platform();
+        let held = if self.state.recording.is_none() { ui.input(|i| Mods::from_egui(&i.modifiers, platform)) } else { Mods::NONE };
+        let mut clicks = Clicks::default();
+        let rect = ui.max_rect();
+        ui.painter().hline(rect.x_range(), rect.min.y, ui.visuals().widgets.noninteractive.bg_stroke);
+        ui.add_space(4.0);
+        ui.horizontal_wrapped(|ui| {
+            let layout = if platform.is_mac() { self.ui("Keyboard: US (macOS)") } else { self.ui("Keyboard: US") };
+            ui.label(RichText::new(self.vis(&layout)).color(self.style.dim));
+            ui.add_space(8.0);
+            for &m in self.mods_shown() {
+                let name = self.mod_name(m);
+                let on = m.get(union(self.state.keyboard.mods, held));
+                let r = ui.add(Button::selectable(on, self.vis(&name)));
+                self.tag(|| format!("shortcuts.mod.{}", m.id()), r.rect, &name);
+                if r.clicked() {
+                    clicks.toggle = Some(m);
+                }
+            }
+            ui.add_space(12.0);
+            self.keyboard_legend(ui);
+        });
+        let mods = union(self.state.keyboard.mods, held);
+        let body = ui.available_rect_before_wrap();
+        let gap = 12.0;
+        let list_w = (body.width() * 0.3).clamp(160.0, 320.0).min(body.width() / 2.0);
+        let rtl = self.env.text.rtl();
+        let (kb, list) = if rtl {
+            (
+                Rect::from_min_max(pos2(body.min.x + list_w + gap, body.min.y), body.max),
+                Rect::from_min_max(body.min, pos2(body.min.x + list_w, body.max.y)),
+            )
+        } else {
+            (
+                Rect::from_min_max(body.min, pos2(body.max.x - list_w - gap, body.max.y)),
+                Rect::from_min_max(pos2(body.max.x - list_w, body.min.y), body.max),
+            )
+        };
+        self.keys_drawn(ui, kb, mods, &mut clicks);
+        self.child(ui, list, |d, ui| d.key_list(ui, mods, &mut clicks));
+        ui.advance_cursor_after_rect(body);
+
+        let kb_state = &mut self.state.keyboard;
+        if let Some(m) = clicks.toggle {
+            // A held modifier is on anyway; clicking it turns the toggle off.
+            if m.get(held) {
+                let mut off = kb_state.mods;
+                if m.get(off) {
+                    m.flip(&mut off);
+                }
+                kb_state.mods = off;
+            } else {
+                m.flip(&mut kb_state.mods);
+            }
+        }
+        if let Some(key) = clicks.key {
+            kb_state.key = Some(key);
+        }
+        if let Some(c) = clicks.go {
+            self.state.go_to(&c);
+        }
+        if clicks.assign
+            && let (Some(command), Some(key)) = (self.state.selected.clone(), self.state.keyboard.key)
+        {
+            let trigger = Trigger::single(Chord { mods, key });
+            let binding = match &self.state.context {
+                Some(scope) => Binding::in_scope(trigger, scope.clone()),
+                None => Binding::new(trigger),
+            };
+            self.state.stop_recording();
+            self.state.commit(self.env, &command, None, binding);
+        }
+    }
+
+    fn keyboard_legend(&self, ui: &mut Ui) {
+        let s = &self.style;
+        for (color, text) in [
+            (s.app_key, self.ui("Application")),
+            (s.scoped_key, self.ui("Panel or context")),
+            (s.both_key, self.ui("Both")),
+            (s.modifier_key, self.ui("Modifier on")),
+        ] {
+            let (r, _) = ui.allocate_exact_size(vec2(12.0, 12.0), Sense::hover());
+            ui.painter().rect_filled(r, 2.0, color);
+            ui.label(RichText::new(self.vis(&text)).color(self.style.dim));
+        }
+    }
+
+    /// The keycaps in `area`, scaled to fit.
+    fn keys_drawn(&mut self, ui: &mut Ui, area: Rect, mods: Mods, clicks: &mut Clicks) {
+        let mac = self.env.keymap.platform().is_mac();
+        let u = (area.width() / UNITS_W).min(area.height() / UNITS_H).max(1.0);
+        let origin = area.min;
+        let row_y = |row: usize| origin.y + row as f32 * u + if row > 0 { 0.25 * u } else { 0.0 };
+        let index = self.state.keyboard.index(self.env.keymap);
+        let index = &index.1;
+        let bottom = if mac { MAC_BOTTOM } else { PC_BOTTOM };
+        let rows = std::iter::once(FUNCTION_ROW).chain(MAIN_ROWS[..4].iter().copied()).chain(std::iter::once(bottom));
+        for (r, row) in rows.enumerate() {
+            let mut x = origin.x;
+            for &(cap, w) in row {
+                let rect = Rect::from_min_size(pos2(x, row_y(r)), vec2(w * u, u));
+                x += w * u;
+                self.cap(ui, rect, cap, u, mods, index, clicks);
+            }
+        }
+        let nav_x = origin.x + 15.5 * u;
+        for &(r, col, key) in NAV {
+            let rect = Rect::from_min_size(pos2(nav_x + col * u, row_y(r)), vec2(u, u));
+            self.cap(ui, rect, Cap::Key(key), u, mods, index, clicks);
+        }
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    /// Draw one key cap, modifier, Caps Lock or System cap at `rect`.
+    ///
+    /// `Cap::Gap` is a no-op with no hit target. A key cap is colored by its holder class, selects
+    /// the application-wide holder as visible title when present, and sets `clicks.key` on click;
+    /// it exposes the selected state and a description naming the class. Modifier caps toggle into
+    /// `clicks.toggle`, while Caps Lock and System caps are only painted. Sizing derives from `u`;
+    /// a key's hover text lists every holder label.
+    fn cap(&mut self, ui: &mut Ui, rect: Rect, cap: Cap, u: f32, mods: Mods, index: &Index, clicks: &mut Clicks) {
+        if matches!(cap, Cap::Gap) {
+            return;
+        }
+        let r = rect.shrink((u * 0.05).clamp(1.0, 2.0));
+        let font = FontId::proportional((u * 0.26).clamp(7.0, 12.0));
+        let s = self.style;
+        let (bg, legend, title) = match cap {
+            Cap::Key(key) => {
+                let holders = index.get(&Chord { mods, key }.effective(self.env.keymap.platform())).map_or(&[][..], Vec::as_slice);
+                let bg = match class(holders) {
+                    Class::Free => s.free_key,
+                    Class::App => s.app_key,
+                    Class::Scoped => s.scoped_key,
+                    Class::Both => s.both_key,
+                };
+                // The application-wide holder names the key; a scoped one when there is none.
+                let first = holders.iter().find(|h| h.scope.is_app()).or(holders.first());
+                (bg, self.cap_legend(key), first.map(|h| self.label_of(&h.holder.command)))
+            }
+            Cap::Mod(m) => {
+                let glyph = self.env.keymap.platform().is_mac().then(|| mod_glyph(m).to_string());
+                (if m.get(mods) { s.modifier_key } else { s.free_key }, self.mod_word(m), glyph)
+            }
+            Cap::CapsLock => (s.free_key.gamma_multiply(0.7), self.ui("Caps Lock"), None),
+            Cap::System => {
+                let name = if self.env.keymap.platform() == crate::chord::Platform::Windows { self.ui("Win") } else { self.ui("Super") };
+                (s.free_key.gamma_multiply(0.7), name, None)
+            }
+            Cap::Gap => return,
+        };
+        let ink = ink(bg);
+        ui.painter().rect_filled(r, CornerRadius::same(3), bg);
+        let pad = (u * 0.1).clamp(2.0, 4.0);
+        let text_w = (r.width() - 2.0 * pad).max(1.0);
+        let lines = |text: &str, rows: usize, color: Color32| {
+            let mut job = LayoutJob::single_section(text.to_string(), TextFormat::simple(font.clone(), color));
+            job.wrap = TextWrapping { max_width: text_w, max_rows: rows, break_anywhere: false, overflow_character: Some('…') };
+            ui.painter().layout_job(job)
+        };
+        if let Some(t) = &title {
+            let rows = if r.height() > 4.0 * font.size { 2 } else { 1 };
+            let g = lines(&self.vis(t), rows, ink);
+            ui.painter().galley(r.min + vec2(pad, pad * 0.5), g, ink);
+        }
+        // A cap without a command name has room for a two-line legend ("page up").
+        let legend_rows = if title.is_none() && r.height() > 3.0 * font.size { 2 } else { 1 };
+        let g = lines(&self.vis(&legend), legend_rows, ink.gamma_multiply(0.85));
+        ui.painter().galley(pos2(r.min.x + pad, r.max.y - pad * 0.5 - g.size().y), g, ink);
+
+        let Cap::Key(key) = cap else {
+            if let Cap::Mod(m) = cap {
+                // Modifier caps toggle like the buttons above; the buttons are their accessible form.
+                let resp = ui.interact(r, self.base.with(("kbmod", m.id(), r.min.x as i32)), Sense::CLICK);
+                if resp.clicked() {
+                    clicks.toggle = Some(m);
+                }
+                if resp.hovered() {
+                    ui.painter().rect_stroke(r, CornerRadius::same(3), Stroke::new(1.5, ink), StrokeKind::Inside);
+                }
+            }
+            return;
+        };
+        let holders = index.get(&Chord { mods, key }.effective(self.env.keymap.platform())).map_or(&[][..], Vec::as_slice);
+        let chord = self.chord(&Trigger::single(Chord { mods, key }));
+        let spoken = if mods.is_none() { self.key_name(key) } else { chord };
+        let mut names: Vec<String> = Vec::new();
+        for h in holders {
+            let t = self.holder_text(h);
+            if !names.contains(&t) {
+                names.push(t);
+            }
+        }
+        let a11y = if names.is_empty() { spoken } else { fill(self.ui("{chord}: {label}"), &[("chord", &spoken), ("label", &names.join(", "))]) };
+        let selected = self.state.keyboard.key == Some(key);
+        let resp = ui.interact(r, self.base.with(("key", key.name())), Sense::click());
+        resp.widget_info(|| WidgetInfo::selected(Role::Button, true, selected, &a11y));
+        let description = match class(holders) {
+            Class::Free => self.ui("Not assigned"),
+            Class::App => self.ui("Application"),
+            Class::Scoped => self.ui("Panel or context"),
+            Class::Both => self.ui("Both"),
+        };
+        ui.ctx().accesskit_node_builder(resp.id, |node| node.set_description(description));
+        self.tag(|| format!("shortcuts.key.{}", key.name()), r, &a11y);
+        let v = ui.visuals();
+        if selected {
+            ui.painter().rect_stroke(r, CornerRadius::same(3), Stroke::new(2.0, v.strong_text_color()), StrokeKind::Outside);
+        } else if resp.has_focus() {
+            ui.painter().rect_stroke(r, CornerRadius::same(3), v.selection.stroke, StrokeKind::Outside);
+        } else if resp.hovered() {
+            ui.painter().rect_stroke(r, CornerRadius::same(3), Stroke::new(1.5, ink), StrokeKind::Inside);
+        }
+        if resp.clicked() {
+            clicks.key = Some(key);
+        }
+        if !names.is_empty() {
+            resp.on_hover_text(self.vis(&names.join("\n")));
+        }
+    }
+
+    /// The clicked key's shortcuts with any modifiers, and Assign to Selected.
+    fn key_list(&mut self, ui: &mut Ui, mods: Mods, clicks: &mut Clicks) {
+        let Some(key) = self.state.keyboard.key else {
+            ui.label(RichText::new(self.vis(&self.ui("Click a key to see its shortcuts"))).color(self.style.dim));
+            return;
+        };
+        let platform = self.env.keymap.platform();
+        let title = fill(self.ui("Key: {key}"), &[("key", &self.key_name(key))]);
+        ui.label(RichText::new(self.vis(&title)).strong());
+        if self.env.options.editable {
+            let chord = self.chord(&Trigger::single(Chord { mods, key }));
+            let selected = self.state.selected.clone().filter(|c| self.env.keymap.bindable(c).is_some());
+            let label = self.ui("Assign to Selected");
+            let r = ui.add_enabled(selected.is_some(), Button::new(self.vis(&label)));
+            self.tag(|| "shortcuts.assignKey".into(), r.rect, &label);
+            let r = match &selected {
+                Some(c) => r.on_hover_text(
+                    self.vis_chord(&fill(self.ui("Assign {chord} to {label}"), &[("chord", &chord), ("label", &self.label_of(c))]), &chord),
+                ),
+                None => r.on_disabled_hover_text(self.vis(&self.ui("Select a command first"))),
+            };
+            if r.clicked() {
+                clicks.assign = true;
+            }
+        }
+        let index = self.state.keyboard.index(self.env.keymap);
+        let mut entries: Vec<(Chord, KeyHolder)> =
+            index.1.iter().filter(|(c, _)| c.key == key).flat_map(|(c, hs)| hs.iter().map(|h| (*c, h.clone()))).collect();
+        entries.sort_by(|a, b| a.0.cmp(&b.0).then_with(|| a.1.holder.command.id.cmp(&b.1.holder.command.id)));
+        if entries.is_empty() {
+            ui.label(RichText::new(self.vis(&self.ui("Nothing uses this key"))).color(self.style.dim));
+            return;
+        }
+        let current = Chord { mods, key }.effective(platform);
+        let chord_w = 72.0;
+        let chord_layout = if self.env.text.rtl() { Layout::right_to_left(Align::Center) } else { Layout::left_to_right(Align::Center) };
+        ScrollArea::vertical().id_salt(self.base.with("keylist")).auto_shrink([false, false]).show(ui, |ui| {
+            for (c, h) in &entries {
+                ui.horizontal(|ui| {
+                    let mut text = RichText::new(self.chord(&h.holder.binding.trigger));
+                    if *c == current {
+                        text = text.strong();
+                    }
+                    ui.allocate_ui_with_layout(vec2(chord_w, ui.spacing().interact_size.y), chord_layout, |ui| ui.label(text));
+                    if ui.link(self.vis(&self.holder_text(h))).clicked() {
+                        clicks.go = Some(h.holder.command.clone());
+                    }
+                });
+            }
+        });
+    }
+}
diff --git a/crates/keymap/src/ui/mod.rs b/crates/keymap/src/ui/mod.rs
new file mode 100644
index 00000000..e32cb077
--- /dev/null
+++ b/crates/keymap/src/ui/mod.rs
@@ -0,0 +1,311 @@
+//! The Keyboard Shortcuts dialog (feature `ui`): a table of the catalog with recording,
+//! conflicts, undo, named sets and import review, over [`Keymap`] and optionally [`Profiles`].
+//!
+//! The app keeps a [`DialogState`] while the dialog is open and calls [`ShortcutsDialog::show`]
+//! (or [`ShortcutsDialog::ui`] inside its own container) every frame. While
+//! [`DialogState::is_open`] is true the app skips its own key dispatch; the dialog takes the
+//! frame's key events itself while it records. The app saves on [`Outcome::Ok`] (or on
+//! [`Outcome::Changed`] for live saving) and drops the state once it is closed.
+
+use std::collections::BTreeMap;
+
+use crate::chord::Trigger;
+use crate::command::CommandRef;
+use crate::import::{ForeignSet, ImportOptions};
+use crate::keymap::{Bindable, Binding, Keymap};
+use crate::profiles::{Builtins, ProfileError, Profiles};
+
+mod capture;
+mod rows;
+mod state;
+mod style;
+pub mod summary;
+mod text;
+mod view;
+
+pub use state::DialogState;
+pub use style::DialogStyle;
+pub use text::{English, I18nText, PLURALS, STRINGS, Text, trigger_text};
+
+use state::Env;
+
+/// What the dialog reports for a frame.
+#[derive(Clone, Debug)]
+#[non_exhaustive]
+pub enum Outcome {
+    /// Closed with OK: save `Profiles` (with sets) or `keymap.overrides()`.
+    Ok,
+    /// Closed with Cancel: the keymap and profiles are back as they were when it opened. When that
+    /// undid edits, `Changed` follows on the next frame.
+    Cancel,
+    /// An edit (for live menus and live saving). When a frame also has another outcome, such as
+    /// `Import` after the Save changes prompt, `Changed` follows on the next frame.
+    Changed,
+    /// The user asked to import: the app opens a file of one of these formats and calls
+    /// [`ShortcutsDialog::import_json`] or [`ShortcutsDialog::review_import`].
+    Import { formats: Vec<&'static str> },
+    /// A set as craft-keymap JSON, for the app to write.
+    Export { name: String, json: String },
+    /// A set in one of [`Options::export_formats`], for the app to write.
+    ExportAs { format: &'static str, name: String, keymap: Box<Keymap> },
+    /// The shortcut summary, for the app to show, save or print.
+    Summary { name: String, html: String, text: String },
+    /// Import answers the user gave (item → command), for the app to keep for later imports.
+    Remembered(BTreeMap<String, CommandRef>),
+}
+
+/// What happens when a recorded chord is held by other commands.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum ConflictMode {
+    /// Ask with the conflict bar: Take It, Take It and Go to Conflict, Keep Both, Cancel. Assign
+    /// in the detail pane takes the chord without asking, as Steal does: the pane has already
+    /// listed its holders under "Currently assigned to".
+    #[default]
+    Ask,
+    /// Take the chord from the other commands, then say so.
+    Steal,
+    /// Keep both bindings, then say so.
+    Keep,
+}
+
+/// An app's own Show entry.
+#[derive(Clone, Copy, Debug)]
+pub struct Area {
+    pub id: &'static str,
+    pub label: &'static str,
+    pub rows: fn(&Bindable) -> bool,
+}
+
+/// A read-only row for a key outside the catalog.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct FixedRow {
+    pub group: String,
+    pub label: String,
+    /// The keys as shown.
+    pub keys: String,
+    /// The trigger, when the row has one, so a catalog binding on it can be pointed out.
+    pub chord: Option<Trigger>,
+}
+
+/// A file format an app reads or writes itself.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Format {
+    pub id: &'static str,
+    pub label: &'static str,
+    pub extensions: &'static [&'static str],
+}
+
+/// A rule an app adds for which bindings a command may get; `Err` carries the message shown.
+pub type Accept = Box<dyn Fn(&Bindable, &Binding) -> Result<(), String>>;
+/// Called for every control once per frame with (automation id, rect, label).
+pub type OnWidget = Box<dyn Fn(&str, egui::Rect, &str)>;
+
+/// How the dialog looks and behaves. [`Options::default`] gives the defaults noted on each field;
+/// set fields on it, or with [`Options::with`].
+#[non_exhaustive]
+pub struct Options {
+    /// "Keyboard Shortcuts": the window title [`ShortcutsDialog::show`] draws, and the summary's
+    /// heading. [`ShortcutsDialog::ui`] draws no title; the host's container shows its own.
+    pub title: &'static str,
+    /// true; false shows the table read-only with Close and Summarize.
+    pub editable: bool,
+    /// "Custom": the name edits of a built-in set are saved under.
+    pub custom_set_name: &'static str,
+    /// Ask.
+    pub conflicts: ConflictMode,
+    /// true: Keep Both is offered.
+    pub allow_keep: bool,
+    /// false: a recorded chord waits [`DOUBLE_PRESS`](crate::DOUBLE_PRESS) for a second press.
+    pub double_press: bool,
+    /// false: Backspace or Delete without modifiers removes the binding being recorded over.
+    pub backspace_clears: bool,
+    /// false: Enter when idle is OK.
+    pub enter_is_ok: bool,
+    /// false: rows sort by translated label instead of catalog order.
+    pub sort_by_label: bool,
+    /// false: Show as tabs instead of a dropdown.
+    pub area_tabs: bool,
+    /// The app's own Show entries.
+    pub areas: Vec<Area>,
+    /// `None`: every catalog entry is listed. Otherwise the table, its Show entries and search
+    /// list only the entries it returns true for; the others keep their bindings and still count
+    /// in conflicts.
+    pub visible: Option<fn(&Bindable) -> bool>,
+    /// false: the on-screen keyboard pane.
+    pub keyboard: bool,
+    pub fixed: Vec<FixedRow>,
+    pub import_formats: Vec<Format>,
+    pub export_formats: Vec<Format>,
+    /// true: Summarize is offered.
+    pub summary: bool,
+    pub accept: Option<Accept>,
+    pub on_widget: Option<OnWidget>,
+    /// `None`: [`DialogStyle::from_visuals`].
+    pub style: Option<DialogStyle>,
+}
+
+impl Default for Options {
+    fn default() -> Options {
+        Options {
+            title: "Keyboard Shortcuts",
+            editable: true,
+            custom_set_name: "Custom",
+            conflicts: ConflictMode::Ask,
+            allow_keep: true,
+            double_press: false,
+            backspace_clears: false,
+            enter_is_ok: false,
+            sort_by_label: false,
+            area_tabs: false,
+            areas: Vec::new(),
+            visible: None,
+            keyboard: false,
+            fixed: Vec::new(),
+            import_formats: Vec::new(),
+            export_formats: Vec::new(),
+            summary: true,
+            accept: None,
+            on_widget: None,
+            style: None,
+        }
+    }
+}
+
+impl Options {
+    /// `self` with `f` applied, for options built in one expression:
+    /// `Options::default().with(|o| o.keyboard = true)`.
+    pub fn with(mut self, f: impl FnOnce(&mut Options)) -> Options {
+        f(&mut self);
+        self
+    }
+}
+
+/// The format id of craft-keymap's own JSON in [`Outcome::Import`].
+pub const JSON_FORMAT: &str = "craft-keymap";
+
+/// The dialog for one frame: what it edits, borrowed, and how it looks.
+pub struct ShortcutsDialog<'a> {
+    keymap: &'a mut Keymap,
+    text: &'a dyn Text,
+    sets: Option<(&'a mut Profiles, &'a Builtins<'a>)>,
+    options: Option<&'a Options>,
+}
+
+impl<'a> ShortcutsDialog<'a> {
+    pub fn new(keymap: &'a mut Keymap, text: &'a dyn Text) -> Self {
+        ShortcutsDialog { keymap, text, sets: None, options: None }
+    }
+
+    /// Shows and edits named sets.
+    pub fn sets(mut self, profiles: &'a mut Profiles, builtins: &'a Builtins<'a>) -> Self {
+        self.sets = Some((profiles, builtins));
+        self
+    }
+
+    pub fn options(mut self, options: &'a Options) -> Self {
+        self.options = Some(options);
+        self
+    }
+
+    fn with_env<R>(self, f: impl FnOnce(&mut Env) -> R) -> R {
+        let fallback;
+        let options = match self.options {
+            Some(o) => o,
+            None => {
+                fallback = Options::default();
+                &fallback
+            }
+        };
+        let mut env = Env { keymap: self.keymap, sets: self.sets, options, text: self.text };
+        f(&mut env)
+    }
+
+    /// A window with title, body and Cancel/OK, sized to the screen (at least 640×480 where the
+    /// screen allows, at most 1320×900). Closing it with × is Cancel.
+    pub fn show(self, ctx: &egui::Context, state: &mut DialogState) -> Option<Outcome> {
+        self.with_env(|env| {
+            if !state.is_showing() {
+                return state.finish();
+            }
+            let title = env.text.visual(&env.text.ui(env.options.title));
+            let screen = ctx.content_rect().size();
+            let max = egui::vec2(1320.0, 900.0).min(screen - egui::vec2(16.0, 16.0)).max(egui::vec2(240.0, 180.0));
+            let min = egui::vec2(640.0, 480.0).min(max);
+            let mut open = true;
+            let mut out = None;
+            egui::Window::new(title)
+                .id(egui::Id::unique("craft_keymap.shortcuts"))
+                .collapsible(false)
+                .resizable(true)
+                .open(&mut open)
+                .default_size((screen * 0.8).clamp(min, max))
+                .min_size(min)
+                .max_size(max)
+                .show(ctx, |ui| out = frame(ui, env, state));
+            if !open && state.is_showing() {
+                state.cancel(env);
+                out = state.finish();
+            }
+            if state.change_pending() {
+                ctx.request_repaint();
+            }
+            out
+        })
+    }
+
+    /// The body only, for a host's own modal, preferences page or backstage, which draws the
+    /// title. It fills the available rectangle.
+    pub fn ui(self, ui: &mut egui::Ui, state: &mut DialogState) -> Option<Outcome> {
+        self.with_env(|env| frame(ui, env, state))
+    }
+
+    /// OK, for hosts that draw their own button.
+    pub fn ok(self, state: &mut DialogState) {
+        self.with_env(|env| {
+            state.begin(env);
+            state.ok(env);
+        });
+    }
+
+    /// Cancel, for hosts that draw their own button.
+    pub fn cancel(self, state: &mut DialogState) {
+        self.with_env(|env| {
+            state.begin(env);
+            state.cancel(env);
+        });
+    }
+
+    /// Reads a craft-keymap JSON set the app loaded after [`Outcome::Import`]. With sets it becomes
+    /// a new set, which is loaded; without, its overrides replace the keymap's as one undo step.
+    /// Returns the set's name.
+    pub fn import_json(self, state: &mut DialogState, text: &str) -> Result<String, ProfileError> {
+        self.with_env(|env| {
+            state.begin(env);
+            state.import_json(env, text)
+        })
+    }
+
+    /// Opens the review of a foreign set the app read: what will change, what did not match and
+    /// why, with suggestions to pick from.
+    pub fn review_import(self, state: &mut DialogState, set: ForeignSet, options: ImportOptions) {
+        self.with_env(|env| {
+            state.begin(env);
+            state.review_import(env, set, options);
+        });
+    }
+}
+
+/// One frame: take recorded keys before anything else sees them, draw, report.
+fn frame(ui: &mut egui::Ui, env: &mut Env, state: &mut DialogState) -> Option<Outcome> {
+    state.begin(env);
+    state.input(env, ui.ctx());
+    if state.is_showing() {
+        view::body(ui, env, state);
+    }
+    let out = state.finish();
+    if state.change_pending() {
+        ui.ctx().request_repaint();
+    }
+    out
+}
diff --git a/crates/keymap/src/ui/review.rs b/crates/keymap/src/ui/review.rs
new file mode 100644
index 00000000..231bafeb
--- /dev/null
+++ b/crates/keymap/src/ui/review.rs
@@ -0,0 +1,388 @@
+//! The foreign import review (§2.7 of the dialog plan). It takes the place of the table and
+//! detail pane: what the set will change, what did not match and why, suggestions to pick from,
+//! and after the import the report of what was skipped, taken or failed.
+
+use egui::text::{LayoutJob, TextFormat};
+use egui::{ComboBox, Label, Rect, RichText, ScrollArea, TextEdit, TextStyle, Ui};
+
+use super::{Draw, FIELD_W, fill};
+use crate::chord::foreign::{ForeignError, ReadNote};
+use crate::command::CommandRef;
+use crate::import::{FailedChange, ImportPlan, ImportReport, NoChangeReason, SkipReason, UnmatchedReason};
+
+/// One list row: the item, its line, its keys and a note.
+struct Entry {
+    item: String,
+    line: Option<usize>,
+    keys: String,
+    note: String,
+    /// The note is what the item becomes (Will change), drawn in the text color, not dimmed.
+    to: bool,
+    /// Chord text inside the note, kept out of bidi reordering.
+    note_chord: String,
+}
+
+enum Act {
+    Pick(usize, usize),
+    Import,
+    Close,
+    Copy(String),
+}
+
+impl Draw<'_, '_> {
+    /// Draws the review in `rect` while one is open; returns whether it drew.
+    pub(super) fn review(&mut self, ui: &mut Ui, rect: Rect) -> bool {
+        let Some(r) = self.state.review.as_ref() else { return false };
+        let (plan, name, done) = (r.plan.clone(), r.name.clone(), r.done.clone());
+        let mut act = None;
+        self.child(ui, rect, |d, ui| {
+            act = match &done {
+                Some((set, report)) => d.after_report(ui, set, report),
+                None => d.plan_view(ui, &plan, name),
+            };
+        });
+        match act {
+            Some(Act::Pick(s, c)) => self.state.pick_suggestion(self.env, s, c),
+            Some(Act::Import) => self.state.import_reviewed(self.env),
+            Some(Act::Close) => self.state.close_review(),
+            Some(Act::Copy(text)) => ui.ctx().copy_text(text),
+            None => {}
+        }
+        true
+    }
+
+    fn line_text(&self, line: Option<usize>) -> Option<String> {
+        line.map(|n| fill(self.ui("line {n}"), &[("n", &n.to_string())]))
+    }
+
+    /// "item · line n · keys — note" on one wrapping line, the item in the strong color.
+    fn entry(&self, ui: &mut Ui, e: &Entry) {
+        let font = TextStyle::Body.resolve(ui.style());
+        let strong = ui.visuals().strong_text_color();
+        let dim = self.style.dim;
+        let text = ui.visuals().text_color();
+        let mut parts = vec![(self.vis(&e.item), strong)];
+        if let Some(line) = self.line_text(e.line) {
+            parts.extend([(" · ".to_string(), dim), (self.vis(&line), dim)]);
+        }
+        if !e.keys.is_empty() {
+            parts.extend([(" · ".to_string(), dim), (e.keys.clone(), text)]);
+        }
+        if !e.note.is_empty() {
+            let color = if e.to { text } else { dim };
+            parts.extend([(" — ".to_string(), color), (self.vis_chord(&e.note, &e.note_chord), color)]);
+        }
+        let mut job = LayoutJob::default();
+        for (s, color) in self.ordered(parts) {
+            job.append(&s, 0.0, TextFormat::simple(font.clone(), color));
+        }
+        ui.add(Label::new(job).wrap());
+    }
+
+    fn section(&self, ui: &mut Ui, title: &str, entries: &[Entry]) {
+        if entries.is_empty() {
+            return;
+        }
+        ui.add_space(4.0);
+        ui.label(RichText::new(self.vis(&fill(self.ui("{title} ({n})"), &[("title", title), ("n", &entries.len().to_string())]))).strong());
+        for e in entries {
+            self.entry(ui, e);
+        }
+    }
+
+    fn unmatched_reason(&self, r: UnmatchedReason) -> String {
+        match r {
+            UnmatchedReason::NoMatch => self.ui("no command has this name"),
+            UnmatchedReason::Ambiguous => self.ui("more than one command fits"),
+            UnmatchedReason::Context => self.ui("in a context that is not imported"),
+            UnmatchedReason::Tool => self.ui("only a command of the other kind fits (tool or menu command)"),
+        }
+    }
+
+    fn foreign_error(&self, e: &ForeignError) -> String {
+        match e {
+            ForeignError::Empty => self.ui("empty shortcut"),
+            ForeignError::TooLong => self.ui("the shortcut is too long"),
+            ForeignError::UnknownKey(k) => fill(self.ui("unknown key {key}"), &[("key", k)]),
+            ForeignError::UnsupportedModifier(m) => fill(self.ui("unsupported modifier {key}"), &[("key", m)]),
+        }
+    }
+
+    /// Translate the note shown for an approximated imported shortcut; currently
+    /// only the numeric-keypad read-as-main-key note exists.
+    fn read_note(&self, n: ReadNote) -> String {
+        match n {
+            ReadNote::Numpad => self.ui("numeric keypad key read as main key"),
+        }
+    }
+
+    /// Draw the import review and return the chosen action.
+    ///
+    /// The set name defaults to a translated "Imported"; it is only considered valid when no set
+    /// catalog exists or `set_name` accepts it, but the raw text is stored in `state.review.name`
+    /// even when invalid. Import is offered independently of the command count. The summary counts
+    /// changed commands plus unmatched, shortcutless, unreadable, approximated and truncated report
+    /// entries. Returns `Act::Import`, `Act::Close`, or `Act::Pick` when a suggestion is chosen; the
+    /// caller applies the action.
+    fn plan_view(&mut self, ui: &mut Ui, plan: &ImportPlan, mut name: String) -> Option<Act> {
+        let mut act = None;
+        let report = &plan.report;
+        let set = report.set.clone().unwrap_or_else(|| self.ui("Imported"));
+        ui.label(RichText::new(self.vis(&fill(self.ui("Import “{set}”"), &[("set", &set)]))).strong());
+
+        let t = self.env.text;
+        let mut counts = vec![t.plural(plan.commands.len() as u64, "{n} command will change", "{n} commands will change")];
+        let more = [
+            (report.unmatched.len(), t.plural(report.unmatched.len() as u64, "{n} item not matched", "{n} items not matched")),
+            (
+                report.unmatched_without_shortcut,
+                t.plural(report.unmatched_without_shortcut as u64, "{n} item without a shortcut", "{n} items without a shortcut"),
+            ),
+            (report.unreadable.len(), t.plural(report.unreadable.len() as u64, "{n} item could not be read", "{n} items could not be read")),
+            (report.approximated.len(), t.plural(report.approximated.len() as u64, "{n} key read approximately", "{n} keys read approximately")),
+            (report.truncated, t.plural(report.truncated as u64, "{n} entry cut at a limit", "{n} entries cut at a limit")),
+        ];
+        counts.extend(more.into_iter().filter(|(n, _)| *n > 0).map(|(_, s)| s));
+        ui.label(RichText::new(self.vis(&counts.join(" · "))).color(self.style.dim));
+
+        ui.horizontal_wrapped(|ui| {
+            let name_label = self.ui("Set name:");
+            let l = ui.label(self.vis(&name_label));
+            let edit = ui.add(TextEdit::singleline(&mut name).id(self.base.with("import_name")).desired_width(FIELD_W)).labelled_by(l.id);
+            self.text_field(&edit);
+            self.tag(|| "shortcuts.import.name".into(), edit.rect, &name_label);
+            let import = if self.env.sets.is_some() { self.ui("Import as New Set") } else { self.ui("Import") };
+            let valid = self.env.sets.is_none() || crate::profiles::set_name(&name).is_some();
+            if self.button(ui, valid, &import, "shortcuts.import.ok") {
+                act = Some(Act::Import);
+            }
+            if self.button(ui, true, &self.ui("Cancel Import"), "shortcuts.import.cancel") {
+                act = Some(Act::Close);
+            }
+        });
+        if let Some(r) = self.state.review.as_mut() {
+            r.name = name;
+        }
+
+        ScrollArea::vertical().id_salt(self.base.with("review")).auto_shrink([false, false]).show(ui, |ui| {
+            let chord_list = |d: &Self, c: &crate::import::Planned| -> String {
+                let home = d.env.keymap.bindable(&c.command).map(|b| b.scope.clone());
+                if c.bindings.is_empty() {
+                    return d.ui("None");
+                }
+                c.bindings.iter().map(|b| d.binding_text(&b.binding, home.as_ref())).collect::<Vec<_>>().join(", ")
+            };
+            let changes: Vec<Entry> = plan
+                .commands
+                .iter()
+                .map(|c| {
+                    let chords = chord_list(self, c);
+                    Entry {
+                        item: c.item.clone(),
+                        line: c.line,
+                        keys: String::new(),
+                        note: fill(self.ui("{label}: {chord}"), &[("label", &self.label_of(&c.command)), ("chord", &chords)]),
+                        to: true,
+                        note_chord: chords,
+                    }
+                })
+                .collect();
+            self.section(ui, &self.ui("Will change"), &changes);
+
+            if !report.suggestions.is_empty() {
+                ui.add_space(4.0);
+                let title = fill(self.ui("Suggestions ({n})"), &[("n", &report.suggestions.len().to_string())]);
+                ui.label(RichText::new(self.vis(&title)).strong());
+                for (si, s) in report.suggestions.iter().enumerate() {
+                    ui.horizontal_wrapped(|ui| {
+                        self.entry(
+                            ui,
+                            &Entry {
+                                item: s.item.clone(),
+                                line: s.line,
+                                keys: String::new(),
+                                note: String::new(),
+                                to: false,
+                                note_chord: String::new(),
+                            },
+                        );
+                        let label = fill(self.ui("Command for {item}"), &[("item", &s.item)]);
+                        let choose = self.ui("Choose a command…");
+                        let combo = ComboBox::from_id_salt(self.base.with(("suggestion", si))).selected_text(self.vis(&choose)).show_ui(ui, |ui| {
+                            for (ci, c) in s.candidates.iter().enumerate() {
+                                if ui.selectable_label(false, self.vis(&self.label_of(c))).clicked() {
+                                    act = Some(Act::Pick(si, ci));
+                                }
+                            }
+                        });
+                        let resp = combo.response.on_hover_text(self.vis(&label));
+                        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ComboBox, true, &label));
+                        self.tag(|| format!("shortcuts.import.suggestion.{si}"), resp.rect, &label);
+                    });
+                }
+            }
+
+            let unmatched: Vec<Entry> = report
+                .unmatched
+                .iter()
+                .map(|u| Entry {
+                    item: u.item.clone(),
+                    line: u.line,
+                    keys: u.keys.clone(),
+                    note: self.unmatched_reason(u.reason),
+                    to: false,
+                    note_chord: String::new(),
+                })
+                .collect();
+            self.section(ui, &self.ui("Not matched"), &unmatched);
+            let unreadable: Vec<Entry> = report
+                .unreadable
+                .iter()
+                .map(|u| Entry {
+                    item: u.item.clone(),
+                    line: u.line,
+                    keys: u.keys.clone(),
+                    note: self.foreign_error(&u.reason),
+                    to: false,
+                    note_chord: String::new(),
+                })
+                .collect();
+            self.section(ui, &self.ui("Unreadable"), &unreadable);
+            let approximated: Vec<Entry> = report
+                .approximated
+                .iter()
+                .map(|a| Entry {
+                    item: a.item.clone(),
+                    line: a.line,
+                    keys: a.keys.clone(),
+                    note: self.read_note(a.note),
+                    to: false,
+                    note_chord: String::new(),
+                })
+                .collect();
+            self.section(ui, &self.ui("Approximated"), &approximated);
+            let kept: Vec<Entry> = report
+                .matched_without_change
+                .iter()
+                .map(|m| Entry {
+                    item: m.item.clone(),
+                    line: m.line,
+                    keys: String::new(),
+                    note: match m.reason {
+                        NoChangeReason::PanelMenu => {
+                            fill(self.ui("{label} keeps its shortcuts (matched by a panel menu name)"), &[("label", &self.label_of(&m.command))])
+                        }
+                    },
+                    to: false,
+                    note_chord: String::new(),
+                })
+                .collect();
+            self.section(ui, &self.ui("Matched without change"), &kept);
+        });
+        act
+    }
+
+    fn skip_note(&self, reason: SkipReason, kept_by: Option<&CommandRef>) -> String {
+        match (reason, kept_by) {
+            (SkipReason::Taken, Some(c)) => fill(self.ui("taken by {label}"), &[("label", &self.label_of(c))]),
+            (SkipReason::Taken, None) => self.ui("taken by a later entry"),
+            (SkipReason::Reserved, _) => self.ui("reserved by the system"),
+            (SkipReason::UnknownScope, _) => self.ui("the scope is unknown"),
+        }
+    }
+
+    fn failed_note(&self, change: FailedChange) -> String {
+        match change {
+            FailedChange::Bind => self.ui("the set's shortcuts could not be added"),
+            FailedChange::Clear => self.ui("the shortcuts could not be removed"),
+        }
+    }
+
+    /// The report's lists: skipped keys, shortcuts taken from other commands, failed changes.
+    fn report_lists(&self, report: &ImportReport) -> [(String, Vec<Entry>); 3] {
+        let skipped = report
+            .skipped
+            .iter()
+            .map(|s| Entry {
+                item: s.item.clone(),
+                line: s.line,
+                keys: s.shortcut.clone(),
+                note: self.skip_note(s.reason, s.kept_by.as_ref()),
+                to: false,
+                note_chord: String::new(),
+            })
+            .collect();
+        let cleared = report
+            .conflicts_cleared
+            .iter()
+            .map(|c| Entry {
+                item: self.label_of(&c.command),
+                line: None,
+                keys: c.shortcut.clone(),
+                note: String::new(),
+                to: false,
+                note_chord: String::new(),
+            })
+            .collect();
+        let failed = report
+            .failed
+            .iter()
+            .map(|f| Entry {
+                item: self.label_of(&f.command),
+                line: None,
+                keys: f.shortcuts.join(", "),
+                note: self.failed_note(f.change),
+                to: false,
+                note_chord: String::new(),
+            })
+            .collect();
+        [(self.ui("Skipped"), skipped), (self.ui("Taken from other commands"), cleared), (self.ui("Not changed"), failed)]
+    }
+
+    fn after_report(&mut self, ui: &mut Ui, set: &str, report: &ImportReport) -> Option<Act> {
+        let mut act = None;
+        let heading = fill(self.ui("Imported as “{set}”"), &[("set", set)]);
+        ui.label(RichText::new(self.vis(&heading)).strong());
+        let changed = self.env.text.plural(report.imported as u64, "{n} command changed", "{n} commands changed");
+        ui.label(RichText::new(self.vis(&changed)).color(self.style.dim));
+        let lists = self.report_lists(report);
+        ui.horizontal_wrapped(|ui| {
+            if self.button(ui, true, &self.ui("Copy Report"), "shortcuts.import.copy") {
+                act = Some(Act::Copy(self.report_text(&heading, &changed, &lists)));
+            }
+            if self.button(ui, true, &self.ui("Done"), "shortcuts.import.done") {
+                act = Some(Act::Close);
+            }
+        });
+        ScrollArea::vertical().id_salt(self.base.with("report")).auto_shrink([false, false]).show(ui, |ui| {
+            for (title, entries) in &lists {
+                self.section(ui, title, entries);
+            }
+        });
+        act
+    }
+
+    /// The report as plain text for Copy Report (logical order).
+    fn report_text(&self, heading: &str, changed: &str, lists: &[(String, Vec<Entry>)]) -> String {
+        let mut out = format!("{heading}\n{changed}\n");
+        for (title, entries) in lists.iter().filter(|(_, e)| !e.is_empty()) {
+            out.push_str(&format!("\n{title}\n"));
+            for e in entries {
+                let mut line = format!("  {}", e.item);
+                for part in [self.line_text(e.line).unwrap_or_default(), e.keys.clone()] {
+                    if !part.is_empty() {
+                        line.push_str(" · ");
+                        line.push_str(&part);
+                    }
+                }
+                if !e.note.is_empty() {
+                    line.push_str(" — ");
+                    line.push_str(&e.note);
+                }
+                out.push_str(&line);
+                out.push('\n');
+            }
+        }
+        out
+    }
+}
diff --git a/crates/keymap/src/ui/rows.rs b/crates/keymap/src/ui/rows.rs
new file mode 100644
index 00000000..6b17b67f
--- /dev/null
+++ b/crates/keymap/src/ui/rows.rs
@@ -0,0 +1,692 @@
+//! The table's model: areas (Show), filters, search, group headers, sorting and the cached list of
+//! lines the table draws.
+
+use std::collections::{BTreeSet, HashMap, HashSet};
+
+use crate::chord::{Platform, Trigger};
+use crate::command::CommandRef;
+use crate::keymap::{Bindable, Binding, ConflictKind, Keymap, Kind, Overrides};
+use crate::ui::Options;
+use crate::ui::text::{Text, trigger_text, visual_around};
+
+/// One entry of the Show menu.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub(crate) enum AreaId {
+    All,
+    /// A top menu, `paths[0][0]`.
+    Menu(String),
+    Tools,
+    /// A panel scope, by name.
+    Panel(String),
+    /// Commands with no path that are not tools.
+    Other,
+    /// An app area from [`Options::areas`], by id.
+    App(&'static str),
+    /// [`Options::fixed`].
+    Fixed,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct AreaEntry {
+    pub id: AreaId,
+    pub label: String,
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub(crate) enum Filter {
+    #[default]
+    All,
+    WithShortcut,
+    /// An overrides entry exists for the command.
+    Changed,
+    /// The command is in a [`ConflictKind::Clash`].
+    Conflicts,
+}
+
+impl Filter {
+    pub(crate) const ALL: [Filter; 4] = [Filter::All, Filter::WithShortcut, Filter::Changed, Filter::Conflicts];
+
+    pub(crate) fn label(self, text: &dyn Text) -> String {
+        match self {
+            Filter::All => text.ui("All"),
+            Filter::WithShortcut => text.ui("With Shortcut"),
+            Filter::Changed => text.ui("Changed"),
+            Filter::Conflicts => text.ui("Conflicts"),
+        }
+        .into_owned()
+    }
+}
+
+/// A binding as a row shows it.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Chip {
+    pub binding: Binding,
+    /// Trigger text, plus ` (Scope)` for a scope other than the command's home scope (display order).
+    pub text: String,
+    /// Not one of the command's defaults.
+    pub changed: bool,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Row {
+    /// Position in the catalog.
+    pub index: usize,
+    pub command: CommandRef,
+    /// [`CommandRef::key`], for automation ids and the overrides.
+    pub key: String,
+    /// The translated label.
+    pub label: String,
+    /// Translated path parts between the group header and the label, shown dim before it.
+    pub prefix: Vec<String>,
+    pub chips: Vec<Chip>,
+    /// An overrides entry exists.
+    pub changed: bool,
+    /// A tool sharing a key with another tool of its group.
+    pub cycles: bool,
+    /// In a clash.
+    pub conflict: bool,
+}
+
+/// A read-only row from [`Options::fixed`].
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct FixedLine {
+    pub label: String,
+    pub keys: String,
+    /// The label of a catalog command now bound to the row's chord: drawn struck through.
+    pub now_used_by: Option<String>,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum Line {
+    Header { name: String, collapsed: bool },
+    Row(Row),
+    Fixed(FixedLine),
+}
+
+/// The lines for one query, area, filter and set of overrides.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(crate) struct Built {
+    pub lines: Vec<Line>,
+    /// Command and fixed rows shown (headers not counted); 0 shows "No matching commands".
+    pub matches: usize,
+    /// Clash pairs in the whole keymap.
+    pub clashes: usize,
+    /// Shadow pairs in the whole keymap, shown as an information line.
+    pub shadows: usize,
+}
+
+impl Built {
+    /// The line index of a command's row.
+    pub(crate) fn position(&self, command: &CommandRef) -> Option<usize> {
+        self.lines.iter().position(|l| matches!(l, Line::Row(r) if r.command == *command))
+    }
+}
+
+/// What the lines were built from.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct View<'a> {
+    pub query: &'a str,
+    pub area: &'a AreaId,
+    pub filter: Filter,
+    pub collapsed: &'a BTreeSet<String>,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+struct Key {
+    query: String,
+    area: AreaId,
+    filter: Filter,
+    collapsed: BTreeSet<String>,
+    overrides: Overrides,
+    platform: Platform,
+}
+
+/// The built lines, rebuilt only when the view or the keymap's overrides change.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct RowCache {
+    key: Option<Key>,
+    built: Built,
+}
+
+impl RowCache {
+    pub(crate) fn get(&mut self, keymap: &Keymap, options: &Options, text: &dyn Text, view: &View) -> &Built {
+        let fresh = self.key.as_ref().is_some_and(|k| {
+            k.query == view.query
+                && k.area == *view.area
+                && k.filter == view.filter
+                && k.collapsed == *view.collapsed
+                && k.platform == keymap.platform()
+                && k.overrides == *keymap.overrides()
+        });
+        if !fresh {
+            self.built = build(keymap, options, text, view);
+            self.key = Some(Key {
+                query: view.query.to_string(),
+                area: view.area.clone(),
+                filter: view.filter,
+                collapsed: view.collapsed.clone(),
+                overrides: keymap.overrides().clone(),
+                platform: keymap.platform(),
+            });
+        }
+        &self.built
+    }
+
+    /// The lines last built.
+    pub(crate) fn built(&self) -> &Built {
+        &self.built
+    }
+}
+
+fn top_menu(b: &Bindable) -> Option<&str> {
+    b.paths.first().and_then(|p| p.first()).map(String::as_str)
+}
+
+fn is_tool(b: &Bindable) -> bool {
+    matches!(b.kind, Kind::Tool { .. })
+}
+
+/// The catalog entries the table lists ([`Options::visible`]).
+fn listed<'k>(keymap: &'k Keymap, options: &Options) -> impl Iterator<Item = &'k Bindable> + Clone {
+    let visible = options.visible;
+    keymap.catalog().iter().filter(move |b| visible.is_none_or(|f| f(b)))
+}
+
+/// The Show entries, in catalog order, leaving out areas with no rows.
+pub(crate) fn areas(keymap: &Keymap, options: &Options, text: &dyn Text) -> Vec<AreaEntry> {
+    let catalog = listed(keymap, options);
+    let mut out = vec![AreaEntry { id: AreaId::All, label: text.ui("All Commands").into_owned() }];
+    let mut menus: Vec<&str> = Vec::new();
+    for m in catalog.clone().filter_map(top_menu) {
+        if !menus.contains(&m) {
+            menus.push(m);
+        }
+    }
+    for m in menus {
+        let label = craft_i18n::fmt(&text.ui("{menu} Menu"), &[("menu", &text.segment(m))]);
+        out.push(AreaEntry { id: AreaId::Menu(m.to_string()), label });
+    }
+    if catalog.clone().any(is_tool) {
+        out.push(AreaEntry { id: AreaId::Tools, label: text.ui("Tools").into_owned() });
+    }
+    let mut panels: Vec<&str> = keymap.scopes().panels().iter().map(String::as_str).collect();
+    for b in catalog.clone().filter(|b| !b.scope.is_app()) {
+        if !panels.contains(&b.scope.as_str()) {
+            panels.push(b.scope.as_str());
+        }
+    }
+    for p in panels.into_iter().filter(|p| catalog.clone().any(|b| b.scope.as_str() == *p)) {
+        out.push(AreaEntry { id: AreaId::Panel(p.to_string()), label: panel_label(text, p) });
+    }
+    if catalog.clone().any(|b| top_menu(b).is_none() && !is_tool(b)) {
+        out.push(AreaEntry { id: AreaId::Other, label: text.ui("Other").into_owned() });
+    }
+    for a in options.areas.iter().filter(|a| catalog.clone().any(a.rows)) {
+        out.push(AreaEntry { id: AreaId::App(a.id), label: text.segment(a.label).into_owned() });
+    }
+    if !options.fixed.is_empty() {
+        out.push(AreaEntry { id: AreaId::Fixed, label: text.ui("Fixed Keys").into_owned() });
+    }
+    out
+}
+
+fn panel_label(text: &dyn Text, panel: &str) -> String {
+    craft_i18n::fmt(&text.ui("{panel} Panel"), &[("panel", &text.segment(panel))])
+}
+
+fn in_area(area: &AreaId, b: &Bindable, options: &Options) -> bool {
+    match area {
+        AreaId::All => true,
+        AreaId::Menu(m) => top_menu(b) == Some(m.as_str()),
+        AreaId::Tools => is_tool(b),
+        AreaId::Panel(p) => b.scope.as_str() == p,
+        AreaId::Other => top_menu(b).is_none() && !is_tool(b),
+        AreaId::App(id) => options.areas.iter().any(|a| a.id == *id && (a.rows)(b)),
+        AreaId::Fixed => false,
+    }
+}
+
+/// The first id segment, capitalized: `layer.lock` → `Layer`.
+fn id_group(id: &str) -> String {
+    let first = id.split('.').next().unwrap_or(id);
+    let mut chars = first.chars();
+    chars.next().map(|c| c.to_uppercase().chain(chars).collect()).unwrap_or_default()
+}
+
+/// A row's group header (`None`: no header) with its rank among groups, and how many path parts
+/// the header stands for.
+pub(crate) fn group(area: &AreaId, b: &Bindable, submenus: bool, text: &dyn Text) -> (u8, Option<String>, usize) {
+    let path = b.paths.first().map(Vec::as_slice).unwrap_or_default();
+    let menu = |depth| path.first().map(|m| (0, Some(text.segment(m).into_owned()), depth));
+    match area {
+        AreaId::All => menu(1).unwrap_or_else(|| {
+            if let Kind::Tool { .. } = b.kind {
+                (1, Some(text.ui("Tools").into_owned()), 0)
+            } else if !b.scope.is_app() {
+                (2, Some(panel_label(text, b.scope.as_str())), 0)
+            } else {
+                (3, Some(text.ui("Other").into_owned()), 0)
+            }
+        }),
+        AreaId::Menu(_) if submenus && path.len() >= 3 => (0, path.get(1).map(|s| text.segment(s).into_owned()), 2),
+        AreaId::Menu(_) => (0, None, 1),
+        AreaId::Tools => match &b.kind {
+            Kind::Tool { group: Some(g) } => (0, Some(text.segment(g).into_owned()), usize::MAX),
+            _ => (0, None, usize::MAX),
+        },
+        AreaId::Other => (0, Some(id_group(&b.command.id)), usize::MAX),
+        AreaId::Panel(_) | AreaId::App(_) | AreaId::Fixed => menu(1).unwrap_or((0, None, usize::MAX)),
+    }
+}
+
+/// What a query asks for: lowercase text, and the trigger it spells, if any.
+struct Query {
+    text: String,
+    trigger: Option<Trigger>,
+}
+
+impl Query {
+    fn new(q: &str, platform: Platform) -> Query {
+        let text = q.trim().to_lowercase();
+        let trigger = Trigger::parse(q.trim()).ok().map(|t| t.effective(platform));
+        Query { text, trigger }
+    }
+
+    fn hit(&self, s: &str) -> bool {
+        s.to_lowercase().contains(&self.text)
+    }
+
+    /// Label, aliases, path parts and id, as written and translated; then the bindings: the same
+    /// effective trigger when the query spells one, else their canonical or display text. A query
+    /// that spells a chord (`cmd+s`, `⌘S`) does not also match longer chords containing its text.
+    fn matches(&self, b: &Bindable, bindings: &[Binding], text: &dyn Text, platform: Platform) -> bool {
+        if self.text.is_empty() {
+            return true;
+        }
+        let named = self.hit(&b.label)
+            || self.hit(&text.command(b))
+            || b.aliases.iter().any(|a| self.hit(a))
+            || b.paths.iter().flatten().any(|s| self.hit(s) || self.hit(&text.segment(s)))
+            || self.hit(&b.command.id);
+        named
+            || match self.trigger {
+                Some(t) => bindings.iter().any(|x| x.trigger.effective(platform) == t),
+                None => bindings.iter().any(|x| {
+                    self.hit(&x.trigger.to_string()) || self.hit(&x.trigger.display(platform)) || self.hit(&trigger_text(text, &x.trigger, platform))
+                }),
+            }
+    }
+}
+
+fn build(keymap: &Keymap, options: &Options, text: &dyn Text, view: &View) -> Built {
+    let platform = keymap.platform();
+    let catalog = keymap.catalog();
+    let mut built = Built::default();
+    let mut clashing: HashSet<String> = HashSet::new();
+    for c in keymap.conflicts().into_iter().filter(|c| !keymap.twins_in(c)) {
+        match c.kind {
+            ConflictKind::Clash => {
+                built.clashes += 1;
+                clashing.insert(c.a.0.key());
+                clashing.insert(c.b.0.key());
+            }
+            ConflictKind::Shadow => built.shadows += 1,
+        }
+    }
+    let query = Query::new(view.query, platform);
+    if *view.area == AreaId::Fixed {
+        build_fixed(keymap, options, text, view, &query, &mut built);
+        return built;
+    }
+
+    let bindings: Vec<Vec<Binding>> = catalog.iter().map(|b| keymap.bindings(&b.command)).collect();
+    // How many tools of a group hold each effective trigger.
+    let mut tool_keys: HashMap<(Option<&str>, Trigger), usize> = HashMap::new();
+    for (b, list) in catalog.iter().zip(&bindings) {
+        if let Kind::Tool { group } = &b.kind {
+            for x in list {
+                *tool_keys.entry((group.as_deref(), x.trigger.effective(platform))).or_default() += 1;
+            }
+        }
+    }
+    let submenus = match view.area {
+        AreaId::Menu(m) => listed(keymap, options).any(|b| top_menu(b) == Some(m.as_str()) && b.paths.first().is_some_and(|p| p.len() >= 3)),
+        _ => false,
+    };
+
+    // Groups in first-seen order within their rank.
+    let mut groups: Vec<(u8, Option<String>, Vec<Row>)> = Vec::new();
+    for (index, (b, list)) in catalog.iter().zip(&bindings).enumerate() {
+        let hidden = options.visible.is_some_and(|f| !f(b));
+        if hidden || !in_area(view.area, b, options) || !query.matches(b, list, text, platform) {
+            continue;
+        }
+        let key = b.command.key();
+        let changed = keymap.overrides().get(&key).is_some();
+        let conflict = clashing.contains(&key);
+        let keep = match view.filter {
+            Filter::All => true,
+            Filter::WithShortcut => !list.is_empty(),
+            Filter::Changed => changed,
+            Filter::Conflicts => conflict,
+        };
+        if !keep {
+            continue;
+        }
+        let (rank, header, depth) = group(view.area, b, submenus, text);
+        let path = b.paths.first().map(Vec::as_slice).unwrap_or_default();
+        let prefix = path.get(depth..path.len().saturating_sub(1)).unwrap_or_default().iter().map(|s| text.segment(s).into_owned()).collect();
+        let defaults = &b.defaults;
+        let chips = list
+            .iter()
+            .map(|x| {
+                let mut t = trigger_text(text, &x.trigger, platform);
+                if x.scope_or(&b.scope) != &b.scope {
+                    let scope = text.segment(x.scope_or(&b.scope).as_str());
+                    let s = craft_i18n::fmt(&text.ui("{chord} ({scope})"), &[("chord", &t), ("scope", &scope)]);
+                    t = visual_around(text, &s, &t);
+                }
+                Chip { binding: x.clone(), text: t, changed: !defaults.contains(x) }
+            })
+            .collect();
+        let cycles = match &b.kind {
+            Kind::Tool { group } => list.iter().any(|x| tool_keys.get(&(group.as_deref(), x.trigger.effective(platform))).is_some_and(|n| *n > 1)),
+            Kind::Command => false,
+        };
+        let row = Row { index, command: b.command.clone(), key, label: text.command(b).into_owned(), prefix, chips, changed, cycles, conflict };
+        match groups.iter_mut().find(|(r, h, _)| *r == rank && *h == header) {
+            Some((_, _, rows)) => rows.push(row),
+            None => groups.push((rank, header, vec![row])),
+        }
+    }
+    groups.sort_by_key(|(rank, _, _)| *rank);
+    for (_, header, mut rows) in groups {
+        if options.sort_by_label {
+            rows.sort_by_cached_key(|r| r.label.to_lowercase());
+        }
+        built.matches += rows.len();
+        let collapsed = header.as_ref().is_some_and(|h| view.collapsed.contains(h));
+        if let Some(name) = header {
+            built.lines.push(Line::Header { name, collapsed });
+        }
+        if !collapsed {
+            built.lines.extend(rows.into_iter().map(Line::Row));
+        }
+    }
+    built
+}
+
+fn build_fixed(keymap: &Keymap, options: &Options, text: &dyn Text, view: &View, query: &Query, built: &mut Built) {
+    if matches!(view.filter, Filter::Changed | Filter::Conflicts) {
+        return;
+    }
+    let platform = keymap.platform();
+    let mut groups: Vec<(&str, Vec<FixedLine>)> = Vec::new();
+    for f in &options.fixed {
+        if !query.text.is_empty()
+            && !(query.hit(&f.label)
+                || query.hit(&f.keys)
+                || query.hit(&f.group)
+                || query.trigger.is_some_and(|t| f.chord.is_some_and(|c| c.effective(platform) == t)))
+        {
+            continue;
+        }
+        let now_used_by = f.chord.and_then(|c| {
+            let c = c.effective(platform);
+            keymap
+                .catalog()
+                .iter()
+                .find(|b| keymap.bindings(&b.command).iter().any(|x| x.trigger.effective(platform) == c))
+                .map(|b| text.command(b).into_owned())
+        });
+        let line = FixedLine { label: f.label.clone(), keys: f.keys.clone(), now_used_by };
+        match groups.iter_mut().find(|(g, _)| *g == f.group) {
+            Some((_, lines)) => lines.push(line),
+            None => groups.push((&f.group, vec![line])),
+        }
+    }
+    for (name, lines) in groups {
+        built.matches += lines.len();
+        let collapsed = view.collapsed.contains(name);
+        built.lines.push(Line::Header { name: name.to_string(), collapsed });
+        if !collapsed {
+            built.lines.extend(lines.into_iter().map(Line::Fixed));
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use std::borrow::Cow;
+
+    use super::*;
+    use crate::keymap::Bindable;
+    use crate::scope::{Scope, Scopes};
+    use crate::ui::text::English;
+    use crate::ui::{Area, FixedRow};
+
+    fn key(text: &str) -> Binding {
+        Binding::parse(text).unwrap_or_else(|_| Binding::new(Trigger::single(crate::Chord::from(crate::Key::F35))))
+    }
+
+    /// The fixture of the dialog tests: Save, Save As, Export, Arrange › Bring to Front, two
+    /// tools sharing M, Timeline Loop, Bold in the Text context.
+    pub(crate) fn fixture(platform: Platform) -> Keymap {
+        let tool = Kind::Tool { group: Some("Marquee".into()) };
+        let path = |p: &[&str]| p.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        let timeline = Scope::new("Timeline").unwrap_or_else(Scope::app);
+        let catalog = vec![
+            Bindable::new("file.save", "Save", Scope::app()).with_path(path(&["File", "Save"])).with_default(key("Cmd+S")),
+            Bindable::new("file.saveAs", "Save As…", Scope::app()).with_path(path(&["File", "Save As…"])).with_default(key("Cmd+Shift+S")),
+            Bindable::new("file.export", "Export…", Scope::app()).with_path(path(&["File", "Export…"])).with_default(key("Cmd+E")),
+            Bindable::new("object.front", "Bring to Front", Scope::app()).with_path(path(&["Object", "Arrange", "Bring to Front"])),
+            Bindable::new("tool.marquee", "Marquee Tool", Scope::app()).with_kind(tool.clone()).with_default(key("M")),
+            Bindable::new("tool.ellipse", "Elliptical Marquee Tool", Scope::app()).with_kind(tool).with_default(key("M")),
+            Bindable::new("timeline.loop", "Loop", timeline).with_default(key("L")),
+            Bindable::new("type.bold", "Bold", Scope::app()).with_default(key("Text: Cmd+B")),
+        ];
+        Keymap::new(catalog, Scopes::new().with_panel("Timeline").with_context("Text"), platform)
+    }
+
+    fn view<'a>(query: &'a str, area: &'a AreaId, filter: Filter, collapsed: &'a BTreeSet<String>) -> View<'a> {
+        View { query, area, filter, collapsed }
+    }
+
+    fn labels(built: &Built) -> Vec<String> {
+        built
+            .lines
+            .iter()
+            .map(|l| match l {
+                Line::Header { name, .. } => format!("# {name}"),
+                Line::Row(r) => {
+                    let chips: Vec<&str> = r.chips.iter().map(|c| c.text.as_str()).collect();
+                    let cycles = if r.cycles { " (cycles)" } else { "" };
+                    format!("{}{}: {}{cycles}", r.prefix.iter().map(|p| format!("{p} › ")).collect::<String>(), r.label, chips.join(", "))
+                }
+                Line::Fixed(f) => format!("{} = {}{}", f.label, f.keys, f.now_used_by.as_ref().map(|l| format!(" (now {l})")).unwrap_or_default()),
+            })
+            .collect()
+    }
+
+    fn lines(km: &Keymap, options: &Options, text: &dyn Text, query: &str, area: AreaId, filter: Filter) -> Vec<String> {
+        let none = BTreeSet::new();
+        labels(&build(km, options, text, &view(query, &area, filter, &none)))
+    }
+
+    #[test]
+    fn areas_follow_paths_kind_and_scope() {
+        let km = fixture(Platform::Mac);
+        let options = Options { areas: vec![Area { id: "type", label: "Type", rows: |b| b.command.id.starts_with("type.") }], ..Options::default() };
+        let names: Vec<String> = areas(&km, &options, &English).into_iter().map(|a| a.label).collect();
+        assert_eq!(names, ["All Commands", "File Menu", "Object Menu", "Tools", "Timeline Panel", "Other", "Type"]);
+
+        let all = lines(&km, &options, &English, "", AreaId::All, Filter::All);
+        assert_eq!(
+            all,
+            [
+                "# File",
+                "Save: ⌘S",
+                "Save As…: ⇧⌘S",
+                "Export…: ⌘E",
+                "# Object",
+                "Arrange › Bring to Front: ",
+                "# Tools",
+                "Marquee Tool: M (cycles)",
+                "Elliptical Marquee Tool: M (cycles)",
+                "# Timeline Panel",
+                "Loop: L",
+                "# Other",
+                "Bold: ⌘B (Text)",
+            ]
+        );
+        assert_eq!(lines(&km, &options, &English, "", AreaId::Menu("Object".into()), Filter::All), ["# Arrange", "Bring to Front: "]);
+        assert_eq!(lines(&km, &options, &English, "", AreaId::Panel("Timeline".into()), Filter::All), ["Loop: L"]);
+        assert_eq!(lines(&km, &options, &English, "", AreaId::Other, Filter::All), ["# Timeline", "Loop: L", "# Type", "Bold: ⌘B (Text)"]);
+    }
+
+    #[test]
+    fn sort_by_label_and_collapsed_groups() {
+        let km = fixture(Platform::Mac);
+        let options = Options { sort_by_label: true, ..Options::default() };
+        let area = AreaId::Menu("File".into());
+        let none = BTreeSet::new();
+        assert_eq!(labels(&build(&km, &options, &English, &view("", &area, Filter::All, &none))), ["Export…: ⌘E", "Save: ⌘S", "Save As…: ⇧⌘S"]);
+        let collapsed: BTreeSet<String> = ["File".to_string()].into();
+        let built = build(&km, &options, &English, &view("", &AreaId::All, Filter::All, &collapsed));
+        assert_eq!(built.lines.first(), Some(&Line::Header { name: "File".into(), collapsed: true }));
+        assert!(matches!(built.lines.get(1), Some(Line::Header { .. })));
+    }
+
+    struct Spanish;
+    impl Text for Spanish {
+        fn ui<'a>(&'a self, source: &'a str) -> Cow<'a, str> {
+            source.into()
+        }
+        fn plural(&self, n: u64, one: &str, other: &str) -> String {
+            English.plural(n, one, other)
+        }
+        fn command<'a>(&'a self, b: &'a Bindable) -> Cow<'a, str> {
+            if b.command.id == "file.export" { "Exportar…".into() } else { b.label.as_str().into() }
+        }
+    }
+
+    #[test]
+    fn search_by_name_translation_or_chord() {
+        let km = fixture(Platform::Mac);
+        let o = Options::default();
+        let find = |q: &str| -> Vec<String> {
+            let none = BTreeSet::new();
+            build(&km, &o, &Spanish, &view(q, &AreaId::All, Filter::All, &none))
+                .lines
+                .into_iter()
+                .filter_map(|l| if let Line::Row(r) = l { Some(r.key) } else { None })
+                .collect()
+        };
+        assert_eq!(find("save"), ["file.save", "file.saveAs"]);
+        assert_eq!(find("exportar"), ["file.export"]);
+        assert_eq!(find("cmd+s"), ["file.save"]);
+        assert_eq!(find("⌘S"), ["file.save"]);
+        assert_eq!(find("⇧⌘S"), ["file.saveAs"]);
+        assert_eq!(find("Text: Cmd+B"), Vec::<String>::new(), "a binding text with a scope is not a trigger");
+        assert_eq!(find("cmd+b"), ["type.bold"], "a trigger matches in any scope");
+        assert_eq!(find("arrange"), ["object.front"]);
+        assert!(find("zzz").is_empty());
+    }
+
+    #[test]
+    fn filters_and_conflict_counts() -> Result<(), crate::AssignError> {
+        let mut km = fixture(Platform::Windows);
+        let o = Options::default();
+        km.assign(&"file.export".into(), key("Cmd+S"), crate::Policy::Keep)?;
+        assert_eq!(lines(&km, &o, &English, "", AreaId::All, Filter::Changed), ["# File", "Export…: Ctrl+E, Ctrl+S"]);
+        assert_eq!(lines(&km, &o, &English, "", AreaId::All, Filter::Conflicts), ["# File", "Save: Ctrl+S", "Export…: Ctrl+E, Ctrl+S"]);
+        assert_eq!(lines(&km, &o, &English, "", AreaId::Menu("Object".into()), Filter::WithShortcut), Vec::<String>::new());
+        let none = BTreeSet::new();
+        let built = build(&km, &o, &English, &view("", &AreaId::All, Filter::All, &none));
+        assert_eq!((built.clashes, built.matches), (1, 8));
+        Ok(())
+    }
+
+    #[test]
+    fn import_paths_make_no_areas_or_groups() {
+        let tool = |id: &str, label: &str| {
+            Bindable::new(id, label, Scope::app())
+                .with_kind(Kind::Tool { group: None })
+                .with_import_path(vec!["Tools".into(), label.into()])
+                .with_default(key("P"))
+        };
+        let km = Keymap::new(vec![tool("tool.pen", "Pen Tool")], Scopes::new(), Platform::Mac);
+        let o = Options::default();
+        let names: Vec<String> = areas(&km, &o, &English).into_iter().map(|a| a.label).collect();
+        assert_eq!(names, ["All Commands", "Tools"]);
+        assert_eq!(lines(&km, &o, &English, "", AreaId::All, Filter::All), ["# Tools", "Pen Tool: P"]);
+    }
+
+    #[test]
+    fn hidden_entries_are_not_listed_but_still_conflict() -> Result<(), crate::AssignError> {
+        let mut km = fixture(Platform::Mac);
+        let o = Options { visible: Some(|b| b.command.id != "file.export" && !b.command.id.starts_with("timeline.")), ..Options::default() };
+        let names: Vec<String> = areas(&km, &o, &English).into_iter().map(|a| a.label).collect();
+        assert_eq!(names, ["All Commands", "File Menu", "Object Menu", "Tools", "Other"]);
+        assert_eq!(lines(&km, &o, &English, "", AreaId::Menu("File".into()), Filter::All), ["Save: ⌘S", "Save As…: ⇧⌘S"]);
+        assert!(lines(&km, &o, &English, "export", AreaId::All, Filter::All).is_empty());
+
+        km.assign(&"file.save".into(), key("Cmd+E"), crate::Policy::Keep)?;
+        let none = BTreeSet::new();
+        assert_eq!(build(&km, &o, &English, &view("", &AreaId::All, Filter::All, &none)).clashes, 1);
+        assert_eq!(lines(&km, &o, &English, "", AreaId::All, Filter::Conflicts), ["# File", "Save: ⌘S, ⌘E"]);
+        Ok(())
+    }
+
+    #[test]
+    fn commands_sharing_a_default_key_are_no_conflict() -> Result<(), crate::AssignError> {
+        let menu = Bindable::new("app.characterPanel", "Character", Scope::app()).with_path(vec!["Window".into(), "Character".into()]);
+        let catalog = vec![
+            menu.with_default(key("Cmd+T")),
+            Bindable::new("panel.character", "Character Panel", Scope::app()).with_default(key("Cmd+T")),
+            Bindable::new("file.save", "Save", Scope::app()).with_default(key("Cmd+S")),
+        ];
+        let mut km = Keymap::new(catalog, Scopes::new(), Platform::Mac);
+        let o = Options::default();
+        let none = BTreeSet::new();
+        let built = build(&km, &o, &English, &view("", &AreaId::All, Filter::All, &none));
+        assert_eq!((built.clashes, built.shadows), (0, 0));
+        assert!(lines(&km, &o, &English, "", AreaId::All, Filter::Conflicts).is_empty());
+
+        km.assign(&"file.save".into(), key("Cmd+T"), crate::Policy::Keep)?;
+        let built = build(&km, &o, &English, &view("", &AreaId::All, Filter::All, &none));
+        assert_eq!(built.clashes, 2, "Save clashes with both twins");
+        let flagged: Vec<String> =
+            built.lines.iter().filter_map(|l| if let Line::Row(r) = l { r.conflict.then(|| r.key.clone()) } else { None }).collect();
+        assert_eq!(flagged, ["app.characterPanel", "panel.character", "file.save"]);
+        Ok(())
+    }
+
+    #[test]
+    fn fixed_rows_strike_through_when_a_command_takes_their_chord() {
+        let km = fixture(Platform::Mac);
+        let fixed = |label: &str, keys: &str, chord: Option<&str>| FixedRow {
+            group: "Rating".into(),
+            label: label.into(),
+            keys: keys.into(),
+            chord: chord.and_then(|c| Trigger::parse(c).ok()),
+        };
+        let o = Options { fixed: vec![fixed("Rate 1", "1", Some("1")), fixed("Loop", "L", Some("L"))], ..Options::default() };
+        assert_eq!(lines(&km, &o, &English, "", AreaId::Fixed, Filter::All), ["# Rating", "Rate 1 = 1", "Loop = L (now Loop)"]);
+    }
+
+    #[test]
+    fn cache_rebuilds_on_overrides_and_view_changes() -> Result<(), crate::AssignError> {
+        let mut km = fixture(Platform::Mac);
+        let o = Options::default();
+        let mut cache = RowCache::default();
+        let none = BTreeSet::new();
+        let area = AreaId::Menu("File".into());
+        let before = cache.get(&km, &o, &English, &view("", &area, Filter::All, &none)).clone();
+        km.assign(&"file.save".into(), key("F2"), crate::Policy::Steal)?;
+        let after = cache.get(&km, &o, &English, &view("", &area, Filter::All, &none)).clone();
+        assert_ne!(before, after);
+        assert_eq!(cache.get(&km, &o, &English, &view("save as", &area, Filter::All, &none)).matches, 1);
+        Ok(())
+    }
+}
diff --git a/crates/keymap/src/ui/sets.rs b/crates/keymap/src/ui/sets.rs
new file mode 100644
index 00000000..7b4cd479
--- /dev/null
+++ b/crates/keymap/src/ui/sets.rs
@@ -0,0 +1,212 @@
+//! The set row (§2.6 of the dialog plan): the set picker, then New Set…, Rename…, Delete, Save,
+//! Revert Set, Export, Import… and Summarize…; actions that do not fit go into a More menu. New
+//! Set… and Rename… open an inline form under the row.
+
+use craft_ui::layout::fit_toolbar;
+use egui::{ComboBox, Key as EguiKey, RichText, TextEdit, Ui};
+
+use super::{Draw, FIELD_W};
+use crate::profiles::{Profiles, set_name};
+use crate::ui::state::{DialogState, SetForm, SetFormKind};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Act {
+    New,
+    Rename,
+    Delete,
+    Save,
+    Revert,
+    /// Export as craft-keymap JSON; with app formats the item is a menu.
+    Export,
+    ExportAs(&'static str),
+    Import,
+    Summarize,
+}
+
+struct Item {
+    act: Act,
+    text: String,
+    id: &'static str,
+    enabled: bool,
+}
+
+impl Draw<'_, '_> {
+    /// Drawn above the header when the app passes sets and the dialog is editable.
+    pub(super) fn sets_row(&mut self, ui: &mut Ui) {
+        if !self.env.options.editable {
+            return;
+        }
+        let Some((p, b)) = self.env.sets.as_ref() else { return };
+        let names = p.names(b);
+        let active = p.active_name(b).to_string();
+        let builtin = Profiles::is_builtin(&active, b);
+        let modified = DialogState::is_modified(self.env);
+        let items = self.set_items(builtin, modified);
+        let mut act = None;
+        ui.add_enabled_ui(!self.state.modal(), |ui| {
+            ui.horizontal(|ui| {
+                let set_label = self.ui("Set:");
+                let l = ui.label(self.vis(&set_label));
+                let mut pick = None;
+                self.combo(ui, "set", &l, &set_label, &active, |ui| {
+                    for n in &names {
+                        if ui.selectable_label(*n == active, self.vis(n)).clicked() {
+                            pick = Some(n.clone());
+                        }
+                    }
+                });
+                if modified {
+                    ui.label(RichText::new(self.vis(&self.ui("(modified)"))).color(self.style.dim));
+                }
+                if let Some(n) = pick.filter(|n| *n != active) {
+                    self.state.set_form = None;
+                    self.state.switch_set(self.env, &n);
+                }
+                act = self.set_toolbar(ui, &items);
+            });
+            self.set_form(ui);
+        });
+        if let Some(a) = act {
+            self.set_act(a, &active);
+        }
+    }
+
+    fn set_items(&self, builtin: bool, modified: bool) -> Vec<Item> {
+        let item = |act, text: &str, id, enabled| Item { act, text: self.ui(text), id, enabled };
+        let export = if self.env.options.export_formats.is_empty() { "Export…" } else { "Export" };
+        let mut items = vec![
+            item(Act::New, "New Set…", "shortcuts.set.new", true),
+            item(Act::Rename, "Rename…", "shortcuts.set.rename", !builtin),
+            item(Act::Delete, "Delete", "shortcuts.set.delete", !builtin),
+            item(Act::Save, "Save", "shortcuts.set.save", modified),
+            item(Act::Revert, "Revert Set", "shortcuts.set.revert", modified),
+            item(Act::Export, export, "shortcuts.set.export", true),
+            item(Act::Import, "Import…", "shortcuts.set.import", true),
+        ];
+        if self.env.options.summary {
+            items.push(item(Act::Summarize, "Summarize…", "shortcuts.summarize", true));
+        }
+        items
+    }
+
+    /// The actions that fit in the row's remaining width, then More with the rest.
+    fn set_toolbar(&self, ui: &mut Ui, items: &[Item]) -> Option<Act> {
+        let more = self.ui("More");
+        let natural: Vec<f32> = items.iter().map(|i| self.button_width(ui, &i.text)).collect();
+        let spacing = ui.spacing().item_spacing.x;
+        let (shown, overflow): (Vec<usize>, Vec<usize>) = match fit_toolbar(&natural, ui.available_width(), spacing, self.button_width(ui, &more)) {
+            Some(fit) => (fit.shown.iter().map(|&(i, _)| i).collect(), fit.overflow),
+            None => (Vec::new(), (0..items.len()).collect()),
+        };
+        let mut act = None;
+        for i in shown {
+            act = act.or(self.set_item(ui, &items[i]));
+        }
+        if !overflow.is_empty() {
+            let r = ui.menu_button(self.vis(&more), |ui| {
+                for &i in &overflow {
+                    act = act.or(self.set_item(ui, &items[i]));
+                }
+            });
+            self.tag(|| "shortcuts.set.more".into(), r.response.rect, &more);
+        }
+        act
+    }
+
+    fn set_item(&self, ui: &mut Ui, item: &Item) -> Option<Act> {
+        if item.act == Act::Export && !self.env.options.export_formats.is_empty() {
+            let mut act = None;
+            let r = ui.menu_button(self.vis(&item.text), |ui| {
+                if self.button(ui, true, &self.ui("Keyboard Shortcuts (JSON)"), "shortcuts.set.export.json") {
+                    act = Some(Act::Export);
+                }
+                for f in &self.env.options.export_formats {
+                    let label = self.env.text.ui(f.label).into_owned();
+                    if self.button(ui, true, &label, &format!("shortcuts.set.export.{}", f.id)) {
+                        act = Some(Act::ExportAs(f.id));
+                    }
+                }
+            });
+            self.tag(|| item.id.into(), r.response.rect, &item.text);
+            return act;
+        }
+        self.button(ui, item.enabled, &item.text, item.id).then_some(item.act)
+    }
+
+    fn set_act(&mut self, act: Act, active: &str) {
+        let form = |kind, name: &str| Some(SetForm { kind, name: name.to_string(), focus: true });
+        match act {
+            Act::New => self.state.set_form = form(SetFormKind::New { based_on: None }, ""),
+            Act::Rename => self.state.set_form = form(SetFormKind::Rename, active),
+            Act::Delete => self.state.ask_delete_set(self.env),
+            Act::Save => self.state.save_set(self.env),
+            Act::Revert => self.state.revert_set(self.env),
+            Act::Export => self.state.export_set(self.env),
+            Act::ExportAs(f) => self.state.export_as(self.env, f),
+            Act::Import => self.state.request_import(self.env),
+            Act::Summarize => self.state.summarize(self.env),
+        }
+    }
+
+    /// New Set… (Name, Based on) or Rename… (Name), under the set row.
+    fn set_form(&mut self, ui: &mut Ui) {
+        let Some(mut form) = self.state.set_form.clone() else { return };
+        let names = self.env.sets.as_ref().map(|(p, b)| p.names(b)).unwrap_or_default();
+        let (mut submit, mut cancel) = (false, false);
+        ui.horizontal_wrapped(|ui| {
+            let name_label = self.ui("Name:");
+            let l = ui.label(self.vis(&name_label));
+            let edit = ui.add(TextEdit::singleline(&mut form.name).id(self.base.with("set_name")).desired_width(FIELD_W)).labelled_by(l.id);
+            self.text_field(&edit);
+            self.tag(|| "shortcuts.setForm.name".into(), edit.rect, &name_label);
+            if std::mem::take(&mut form.focus) {
+                edit.request_focus();
+            }
+            if edit.lost_focus() {
+                let (enter, escape) = ui.input(|i| (i.key_pressed(EguiKey::Enter), i.key_pressed(EguiKey::Escape)));
+                submit |= enter;
+                cancel |= escape;
+            }
+            if let SetFormKind::New { based_on } = &mut form.kind {
+                let based_label = self.ui("Based on:");
+                let l = ui.label(self.vis(&based_label));
+                let current = self.ui("Current shortcuts");
+                let shown = based_on.clone().unwrap_or_else(|| current.clone());
+                let combo = ComboBox::from_id_salt(self.base.with("based_on")).selected_text(self.vis(&shown)).show_ui(ui, |ui| {
+                    if ui.selectable_label(based_on.is_none(), self.vis(&current)).clicked() {
+                        *based_on = None;
+                    }
+                    for n in &names {
+                        if ui.selectable_label(based_on.as_ref() == Some(n), self.vis(n)).clicked() {
+                            *based_on = Some(n.clone());
+                        }
+                    }
+                });
+                let combo = combo.response.labelled_by(l.id);
+                self.tag(|| "shortcuts.setForm.basedOn".into(), combo.rect, &based_label);
+            }
+            let ok = match form.kind {
+                SetFormKind::New { .. } => self.ui("Create"),
+                SetFormKind::Rename => self.ui("Rename"),
+            };
+            submit |= self.button(ui, set_name(&form.name).is_some(), &ok, "shortcuts.setForm.ok");
+            cancel |= self.button(ui, true, &self.ui("Cancel"), "shortcuts.setForm.cancel");
+        });
+        if cancel {
+            self.state.set_form = None;
+            return;
+        }
+        if !submit || set_name(&form.name).is_none() {
+            self.state.set_form = Some(form);
+            return;
+        }
+        self.state.message = None;
+        match &form.kind {
+            SetFormKind::New { based_on } => self.state.new_set(self.env, &form.name, based_on.as_deref()),
+            SetFormKind::Rename => self.state.rename_set(self.env, &form.name),
+        }
+        // A refused name keeps the form open for another try.
+        let refused = self.state.message.as_ref().is_some_and(|m| m.refused);
+        self.state.set_form = refused.then_some(form);
+    }
+}
diff --git a/crates/keymap/src/ui/state.rs b/crates/keymap/src/ui/state.rs
new file mode 100644
index 00000000..b06db1b2
--- /dev/null
+++ b/crates/keymap/src/ui/state.rs
@@ -0,0 +1,1573 @@
+//! The dialog's persistent state and every action it takes, as calls on [`EditSession`],
+//! [`Recorder`], [`editor::holders`] and [`Profiles`].
+
+use std::collections::BTreeSet;
+
+use crate::chord::{Chord, Key, ParseError, Trigger};
+use crate::command::CommandRef;
+use crate::editor::{self, DOUBLE_PRESS, EditSession, Recorded, Recorder};
+use crate::import::{self, ForeignSet, ImportOptions, ImportPlan, ImportReport};
+use crate::keymap::{AssignError, Assigned, Binding, BindingError, Holder, Keymap, MAX_BINDINGS, Overrides, Policy};
+use crate::profiles::{Builtins, ProfileError, Profiles, set_name};
+use crate::scope::Scope;
+use crate::ui::rows::{AreaEntry, AreaId, Built, Filter, RowCache, View};
+use crate::ui::text::{Text, trigger_text};
+use crate::ui::view::keyboard::KeyboardState;
+use crate::ui::{ConflictMode, JSON_FORMAT, Options, Outcome, capture, summary};
+
+/// What the dialog edits this frame.
+pub(crate) struct Env<'e> {
+    pub keymap: &'e mut Keymap,
+    pub sets: Option<(&'e mut Profiles, &'e Builtins<'e>)>,
+    pub options: &'e Options,
+    pub text: &'e dyn Text,
+}
+
+impl Env<'_> {
+    fn chord_text(&self, t: &Trigger) -> String {
+        trigger_text(self.text, t, self.keymap.platform())
+    }
+
+    fn label(&self, command: &CommandRef) -> String {
+        self.keymap.bindable(command).map_or_else(|| command.id.clone(), |b| self.text.command(b).into_owned())
+    }
+
+    /// `label (Scope)` for each holder, joined.
+    fn holder_labels(&self, holders: &[Holder]) -> String {
+        let mut out: Vec<String> = Vec::new();
+        for h in holders {
+            let label = self.label(&h.command);
+            let s = match &h.binding.scope {
+                Some(scope) => self.ui("{label} ({scope})", &[("label", &label), ("scope", &self.text.segment(scope.as_str()))]),
+                None => label,
+            };
+            if !out.contains(&s) {
+                out.push(s);
+            }
+        }
+        out.join(", ")
+    }
+
+    fn ui(&self, source: &str, args: &[(&str, &str)]) -> String {
+        craft_i18n::fmt(&self.text.ui(source), args)
+    }
+}
+
+/// Where a recording goes.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum Target {
+    /// A row's shortcut cell: replaces `old`, or adds when `None`. Commits at once.
+    Cell { command: CommandRef, old: Option<Binding> },
+    /// The detail pane's New Shortcut field: the chord waits for Assign.
+    Field { command: CommandRef },
+    /// Search by key: the chord's text becomes the query.
+    Search,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Recording {
+    pub target: Target,
+    /// With [`Options::double_press`]: a single press waiting [`DOUBLE_PRESS`] for its second press.
+    pub waiting: Option<(Trigger, f64)>,
+}
+
+/// The New Shortcut field's chord, waiting for Assign.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct FieldChord {
+    pub command: CommandRef,
+    pub binding: Binding,
+    /// Commands whose bindings would clash ("Currently assigned to").
+    pub holders: Vec<Holder>,
+    /// Commands with the same trigger in another scope that do not clash ("both work").
+    pub shadows: Vec<Holder>,
+}
+
+/// The conflict bar, for one pending chord.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct ConflictBar {
+    pub command: CommandRef,
+    pub old: Option<Binding>,
+    pub binding: Binding,
+    pub holders: Vec<Holder>,
+    /// "⚠ {chord} is used by {label}".
+    pub text: String,
+}
+
+/// A line under the table after an action.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Message {
+    pub text: String,
+    /// Nothing changed: shown with ⚠.
+    pub refused: bool,
+    /// Offers Go to Conflict.
+    pub goto: Option<CommandRef>,
+    /// Offers Undo.
+    pub undo: bool,
+    /// The chord text inside `text`, which is never put through `Text::visual`.
+    pub chord: Option<String>,
+}
+
+/// What to do after the Save changes prompt.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum Then {
+    Switch(String),
+    NewSet { name: String, based_on: Option<String> },
+    Import,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum Prompt {
+    /// "Restore every default shortcut in this set?"
+    ResetAll,
+    /// "Delete the set “{set}”?"
+    DeleteSet(String),
+    /// "Save changes to “{set}”?" with Save, Don't Save and Cancel.
+    SaveChanges { set: String, then: Then },
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Answer {
+    /// Save, or confirm.
+    Yes,
+    /// Don't Save.
+    No,
+    Cancel,
+}
+
+/// A foreign set under review.
+#[derive(Clone, Debug)]
+pub(crate) struct Review {
+    pub set: ForeignSet,
+    pub options: ImportOptions,
+    pub plan: ImportPlan,
+    /// The new set's name.
+    pub name: String,
+    /// After Import as New Set: the set's name and the report.
+    pub done: Option<(String, ImportReport)>,
+}
+
+/// The set row's inline form: New Set… or Rename….
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct SetForm {
+    pub kind: SetFormKind,
+    pub name: String,
+    /// Focus the name field on the next frame.
+    pub focus: bool,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum SetFormKind {
+    /// `None`: based on the current shortcuts.
+    New {
+        based_on: Option<String>,
+    },
+    Rename,
+}
+
+#[derive(Clone, Debug)]
+struct Opened {
+    profiles: Option<Profiles>,
+    overrides: Overrides,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Phase {
+    New,
+    Open,
+    Closed,
+}
+
+/// The dialog's state between frames. Keep it while [`is_open`](Self::is_open) is true.
+#[derive(Clone, Debug)]
+pub struct DialogState {
+    phase: Phase,
+    opened: Option<Opened>,
+    session: Option<EditSession>,
+    recorder: Recorder,
+    pub(crate) selected: Option<CommandRef>,
+    /// Scroll the selected row into view on the next frame.
+    pub(crate) reveal: bool,
+    pub(crate) areas: Vec<AreaEntry>,
+    pub(crate) area: AreaId,
+    pub(crate) filter: Filter,
+    pub(crate) query: String,
+    pub(crate) collapsed: BTreeSet<String>,
+    /// The detail pane's Context: `None` is the command's home scope.
+    pub(crate) context: Option<Scope>,
+    pub(crate) recording: Option<Recording>,
+    pub(crate) field: Option<FieldChord>,
+    pub(crate) conflict: Option<ConflictBar>,
+    pub(crate) prompt: Option<Prompt>,
+    pub(crate) message: Option<Message>,
+    pub(crate) review: Option<Review>,
+    rows: RowCache,
+    changed: bool,
+    outcome: Option<Outcome>,
+    // ---- The view's own state ----
+    /// The table's share of the table/detail split.
+    pub(crate) split: f32,
+    /// The chip of the selected row that Enter and Delete act on.
+    pub(crate) chip: usize,
+    /// Typed entry in the detail pane, and the parse error shown under it.
+    pub(crate) typing: Option<String>,
+    pub(crate) type_error: Option<String>,
+    /// Height of the bars and footer under the table, measured last frame.
+    pub(crate) bottom_h: f32,
+    /// One of the dialog's text fields had focus at the end of last frame.
+    pub(crate) text_focus: bool,
+    /// The table lines drawn last frame.
+    pub(crate) visible: std::ops::Range<usize>,
+    pub(crate) set_form: Option<SetForm>,
+    pub(crate) keyboard: KeyboardState,
+}
+
+impl Default for DialogState {
+    fn default() -> DialogState {
+        DialogState::new()
+    }
+}
+
+impl DialogState {
+    /// A dialog about to open; it takes its snapshot on the first frame.
+    pub fn new() -> DialogState {
+        DialogState {
+            phase: Phase::New,
+            opened: None,
+            session: None,
+            recorder: Recorder::new(),
+            selected: None,
+            reveal: false,
+            areas: Vec::new(),
+            area: AreaId::All,
+            filter: Filter::All,
+            query: String::new(),
+            collapsed: BTreeSet::new(),
+            context: None,
+            recording: None,
+            field: None,
+            conflict: None,
+            prompt: None,
+            message: None,
+            review: None,
+            rows: RowCache::default(),
+            changed: false,
+            outcome: None,
+            split: 0.62,
+            chip: 0,
+            typing: None,
+            type_error: None,
+            bottom_h: 0.0,
+            text_focus: false,
+            visible: 0..0,
+            set_form: None,
+            keyboard: KeyboardState::default(),
+        }
+    }
+
+    /// False once the dialog has closed with OK or Cancel and reported its last outcome: drop the
+    /// state then. After a Cancel that undid edits it stays true for the frame that reports
+    /// [`Outcome::Changed`].
+    pub fn is_open(&self) -> bool {
+        self.phase != Phase::Closed || self.changed
+    }
+
+    /// Whether the dialog is drawn: not yet closed with OK or Cancel.
+    pub(crate) fn is_showing(&self) -> bool {
+        self.phase != Phase::Closed
+    }
+
+    /// While true the app also pauses native menu key equivalents.
+    pub fn is_recording(&self) -> bool {
+        self.recording.is_some()
+    }
+
+    /// Selects a command and scrolls to it, as when the dialog opens from "Edit Shortcut…".
+    pub fn select(&mut self, command: &CommandRef) {
+        self.selected = Some(command.clone());
+        self.reveal = true;
+        self.context = None;
+        self.field = None;
+    }
+
+    /// Shows `text`, already translated, as a warning under the table until the user dismisses it
+    /// or the next action's message replaces it: for the app's own errors while the dialog is
+    /// open, such as an import file it could not read.
+    pub fn show_error(&mut self, text: impl Into<String>) {
+        self.message = Some(Message { text: text.into(), refused: true, goto: None, undo: false, chord: None });
+    }
+
+    // ---- Frame ----
+
+    /// The first frame: snapshot for Cancel, an edit session, the Show entries.
+    pub(crate) fn begin(&mut self, env: &mut Env) {
+        if self.phase != Phase::New {
+            return;
+        }
+        self.phase = Phase::Open;
+        self.opened = Some(Opened { profiles: env.sets.as_ref().map(|(p, _)| (**p).clone()), overrides: env.keymap.overrides().clone() });
+        self.session = Some(EditSession::begin(env.keymap));
+        self.areas = crate::ui::rows::areas(env.keymap, env.options, env.text);
+    }
+
+    /// Takes this frame's key input while recording and commits a double-press wait that ended.
+    pub(crate) fn input(&mut self, env: &mut Env, ctx: &egui::Context) {
+        let now = ctx.input(|i| i.time);
+        self.tick(env, now);
+        if self.is_recording() {
+            let platform = env.keymap.platform();
+            let chords = ctx.input_mut(|i| capture::take(i, platform));
+            self.feed(env, &chords, now);
+        }
+        if let Some((_, at)) = self.recording.as_ref().and_then(|r| r.waiting) {
+            ctx.request_repaint_after(std::time::Duration::from_secs_f64((at + DOUBLE_PRESS - now).max(0.0)));
+        }
+    }
+
+    /// The frame's outcome: a closing or file outcome first, else Changed after an edit. An edit
+    /// that comes with another outcome stays pending and is reported by the next call.
+    pub(crate) fn finish(&mut self) -> Option<Outcome> {
+        self.outcome.take().or_else(|| std::mem::take(&mut self.changed).then_some(Outcome::Changed))
+    }
+
+    /// Whether an edit waits for the next [`finish`](Self::finish).
+    pub(crate) fn change_pending(&self) -> bool {
+        self.changed
+    }
+
+    /// The table's lines for the current view.
+    pub(crate) fn lines(&mut self, env: &Env) -> &Built {
+        let view = View { query: &self.query, area: &self.area, filter: self.filter, collapsed: &self.collapsed };
+        self.rows.get(env.keymap, env.options, env.text, &view)
+    }
+
+    /// The table's lines as last built by [`lines`](Self::lines).
+    pub(crate) fn lines_cached(&self) -> &[crate::ui::rows::Line] {
+        &self.rows.built().lines
+    }
+
+    // ---- Selection and view ----
+
+    pub(crate) fn select_row(&mut self, command: &CommandRef) {
+        if self.selected.as_ref() != Some(command) {
+            self.selected = Some(command.clone());
+            self.context = None;
+            self.field = None;
+            self.chip = 0;
+            self.typing = None;
+            self.type_error = None;
+        }
+    }
+
+    pub(crate) fn set_area(&mut self, area: AreaId) {
+        self.area = area;
+    }
+
+    pub(crate) fn set_filter(&mut self, filter: Filter) {
+        self.filter = filter;
+    }
+
+    pub(crate) fn set_query(&mut self, query: String) {
+        self.query = query;
+    }
+
+    pub(crate) fn toggle_group(&mut self, name: &str) {
+        if !self.collapsed.remove(name) {
+            self.collapsed.insert(name.to_string());
+        }
+    }
+
+    /// Selects a command and shows its row: area All, no search, no filter.
+    pub(crate) fn go_to(&mut self, command: &CommandRef) {
+        self.select_row(command);
+        self.area = AreaId::All;
+        self.query.clear();
+        self.filter = Filter::All;
+        self.collapsed.clear();
+        self.reveal = true;
+    }
+
+    /// The Context entries for a command: its home scope (`None`, shown as Default), Application,
+    /// every panel and every context.
+    pub(crate) fn contexts(env: &Env, command: &CommandRef) -> Vec<Option<Scope>> {
+        let home = env.keymap.bindable(command).map(|b| b.scope.clone());
+        let scopes = env.keymap.scopes();
+        let mut out = vec![None];
+        let names = std::iter::once(Scope::app()).chain(scopes.panels().iter().chain(scopes.contexts()).filter_map(|s| Scope::new(s.as_str())));
+        for s in names {
+            if Some(&s) != home.as_ref() && !out.contains(&Some(s.clone())) {
+                out.push(Some(s));
+            }
+        }
+        out
+    }
+
+    pub(crate) fn set_context(&mut self, env: &Env, scope: Option<Scope>) {
+        self.context = scope;
+        if let Some(f) = self.field.take() {
+            self.set_field(env, f.command, f.binding.trigger);
+        }
+    }
+
+    // ---- Recording ----
+
+    /// Starts recording; drops the conflict bar and any message.
+    pub(crate) fn record(&mut self, env: &Env, target: Target) {
+        if !env.options.editable && target != Target::Search {
+            return;
+        }
+        self.conflict = None;
+        self.message = None;
+        self.recorder.reset();
+        if let Target::Cell { command, .. } | Target::Field { command } = &target {
+            self.select_row(command);
+        }
+        self.recording = Some(Recording { target, waiting: None });
+    }
+
+    pub(crate) fn stop_recording(&mut self) {
+        self.recording = None;
+        self.recorder.reset();
+    }
+
+    /// Commits a single press whose double-press window has ended.
+    pub(crate) fn tick(&mut self, env: &mut Env, now: f64) {
+        let expired = self.recording.as_ref().and_then(|r| r.waiting).filter(|(_, at)| now < *at || now - *at >= DOUBLE_PRESS);
+        if let Some((trigger, _)) = expired {
+            self.commit_recorded(env, trigger);
+        }
+    }
+
+    /// Feeds captured presses to the recorder.
+    pub(crate) fn feed(&mut self, env: &mut Env, chords: &[Chord], now: f64) {
+        for &chord in chords {
+            self.tick(env, now);
+            let Some(rec) = &mut self.recording else { return };
+            if env.options.backspace_clears && chord.mods.is_none() && matches!(chord.key, Key::Backspace | Key::Delete) {
+                let target = rec.target.clone();
+                self.stop_recording();
+                match target {
+                    Target::Cell { command, old: Some(old) } => self.remove(env, &command, &old),
+                    Target::Field { .. } => self.field = None,
+                    _ => {}
+                }
+                continue;
+            }
+            match self.recorder.press(chord, now) {
+                Recorded::Cancel => self.stop_recording(),
+                Recorded::Single(t) if env.options.double_press => rec.waiting = Some((t, now)),
+                Recorded::Single(t) | Recorded::Double(t) => self.commit_recorded(env, t),
+            }
+        }
+    }
+
+    /// The recorded trigger is final: ends the recording and sends it where it belongs.
+    fn commit_recorded(&mut self, env: &mut Env, trigger: Trigger) {
+        let Some(rec) = self.recording.take() else { return };
+        self.recorder.reset();
+        match rec.target {
+            Target::Search => self.query = env.chord_text(&trigger),
+            Target::Cell { command, old } => {
+                let binding = match old.as_ref().and_then(|o| o.scope.clone()) {
+                    Some(scope) => Binding::in_scope(trigger, scope),
+                    None => Binding::new(trigger),
+                };
+                self.commit(env, &command, old, binding);
+            }
+            Target::Field { command } => self.set_field(env, command, trigger),
+        }
+    }
+
+    /// Puts a chord into the New Shortcut field with the chosen Context, and finds who holds it.
+    pub(crate) fn set_field(&mut self, env: &Env, command: CommandRef, trigger: Trigger) {
+        let binding = match &self.context {
+            Some(scope) => Binding::in_scope(trigger, scope.clone()),
+            None => Binding::new(trigger),
+        };
+        let holders = editor::holders(env.keymap, &command, &binding);
+        let platform = env.keymap.platform();
+        let want = trigger.effective(platform);
+        let mut shadows = Vec::new();
+        for b in env.keymap.catalog() {
+            if b.command == command {
+                continue;
+            }
+            for x in env.keymap.bindings(&b.command) {
+                if x.trigger.effective(platform) == want && !holders.iter().any(|h| h.command == b.command && h.binding == x) {
+                    shadows.push(Holder { command: b.command.clone(), binding: x });
+                }
+            }
+        }
+        self.field = Some(FieldChord { command, binding, holders, shadows });
+    }
+
+    /// Assign in the detail pane: adds the field's chord to the command. The pane already lists
+    /// its holders under "Currently assigned to", so Assign takes it from them without the
+    /// conflict bar (one undo step), or keeps both with [`ConflictMode::Keep`].
+    pub(crate) fn assign_field(&mut self, env: &mut Env) {
+        if let Some(f) = self.field.take() {
+            let mode = if env.options.conflicts == ConflictMode::Keep { ConflictMode::Keep } else { ConflictMode::Steal };
+            self.commit_with(env, &f.command, None, f.binding, mode);
+        }
+    }
+
+    /// Typed entry: the text as [`Binding::parse`] reads it, committed like a recorded chord.
+    /// `Err` is the parse error for under the field, translated.
+    pub(crate) fn type_binding(&mut self, env: &mut Env, command: &CommandRef, text: &str) -> Result<(), String> {
+        let binding = Binding::parse(text).map_err(|e| binding_error(env, &e))?;
+        self.select_row(command);
+        if let Some(scope) = binding.scope.clone() {
+            self.context = Some(scope);
+        }
+        self.set_field(env, command.clone(), binding.trigger);
+        Ok(())
+    }
+
+    // ---- Commit and conflicts ----
+
+    /// Reserved chord, then the app's rule, then holders: assign at once, or by
+    /// [`Options::conflicts`].
+    pub(crate) fn commit(&mut self, env: &mut Env, command: &CommandRef, old: Option<Binding>, binding: Binding) {
+        let mode = env.options.conflicts;
+        self.commit_with(env, command, old, binding, mode);
+    }
+
+    fn commit_with(&mut self, env: &mut Env, command: &CommandRef, old: Option<Binding>, binding: Binding, mode: ConflictMode) {
+        self.conflict = None;
+        self.message = None;
+        let chord = env.chord_text(&binding.trigger);
+        if env.keymap.is_reserved(&binding.trigger.chord) {
+            self.refuse_chord(env.ui("{chord} is reserved by the system", &[("chord", &chord)]), chord);
+            return;
+        }
+        if let (Some(accept), Some(b)) = (&env.options.accept, env.keymap.bindable(command))
+            && let Err(text) = accept(b, &binding)
+        {
+            self.refuse(text);
+            return;
+        }
+        let holders = editor::holders(env.keymap, command, &binding);
+        if holders.is_empty() {
+            self.apply(env, command, old, binding, Policy::Steal);
+            return;
+        }
+        match mode {
+            ConflictMode::Ask => {
+                let text = env.ui("⚠ {chord} is used by {label}", &[("chord", &chord), ("label", &env.holder_labels(&holders))]);
+                self.conflict = Some(ConflictBar { command: command.clone(), old, binding, holders, text });
+            }
+            ConflictMode::Steal => self.apply_and_say(env, command, old, binding, Policy::Steal),
+            ConflictMode::Keep => self.apply_and_say(env, command, old, binding, Policy::Keep),
+        }
+    }
+
+    fn refuse(&mut self, text: String) {
+        self.message = Some(Message { text, refused: true, goto: None, undo: false, chord: None });
+    }
+
+    fn refuse_chord(&mut self, text: String, chord: String) {
+        self.message = Some(Message { text, refused: true, goto: None, undo: false, chord: Some(chord) });
+    }
+
+    fn apply(&mut self, env: &mut Env, command: &CommandRef, old: Option<Binding>, binding: Binding, policy: Policy) -> Option<Assigned> {
+        let chord = env.chord_text(&binding.trigger);
+        let km = &mut *env.keymap;
+        let session = self.session.get_or_insert_with(|| EditSession::begin(km));
+        let result = match &old {
+            Some(o) => session.replace(km, command, o, binding, policy),
+            None => session.assign(km, command, binding, policy),
+        };
+        match result {
+            Ok(a) => {
+                self.edited(env);
+                Some(a)
+            }
+            Err(e) => {
+                let text = assign_error(env, &e);
+                self.refuse_chord(text, chord);
+                None
+            }
+        }
+    }
+
+    /// Applies with Steal or Keep and says what it did, with Go to Conflict (and Undo for Steal).
+    fn apply_and_say(&mut self, env: &mut Env, command: &CommandRef, old: Option<Binding>, binding: Binding, policy: Policy) {
+        let chord = env.chord_text(&binding.trigger);
+        let Some(a) = self.apply(env, command, old, binding, policy) else { return };
+        let (holders, text) =
+            if policy == Policy::Steal { (&a.taken_from, "{chord} was removed from {label}") } else { (&a.clashes, "Also used by {label}") };
+        if holders.is_empty() {
+            return;
+        }
+        let text = env.ui(text, &[("chord", &chord), ("label", &env.holder_labels(holders))]);
+        let goto = holders.first().map(|h| h.command.clone());
+        self.message = Some(Message { text, refused: false, goto, undo: policy == Policy::Steal, chord: Some(chord) });
+    }
+
+    /// Take It.
+    pub(crate) fn take_it(&mut self, env: &mut Env) {
+        if let Some(c) = self.conflict.take() {
+            self.apply_and_say(env, &c.command, c.old, c.binding, Policy::Steal);
+        }
+    }
+
+    /// Take It and Go to Conflict.
+    pub(crate) fn take_it_and_go(&mut self, env: &mut Env) {
+        if let Some(c) = self.conflict.take() {
+            let first = c.holders.first().map(|h| h.command.clone());
+            self.apply_and_say(env, &c.command, c.old, c.binding, Policy::Steal);
+            if let Some(holder) = first {
+                self.go_to(&holder);
+            }
+        }
+    }
+
+    /// Keep Both.
+    pub(crate) fn keep_both(&mut self, env: &mut Env) {
+        if !env.options.allow_keep {
+            return;
+        }
+        if let Some(c) = self.conflict.take() {
+            self.apply_and_say(env, &c.command, c.old, c.binding, Policy::Keep);
+        }
+    }
+
+    /// ✕ on the conflict bar: nothing was applied, so nothing changes.
+    pub(crate) fn dismiss_conflict(&mut self) {
+        self.conflict = None;
+    }
+
+    // ---- Edits ----
+
+    /// After any edit: drop the conflict bar, refresh the field's holders, report Changed.
+    fn edited(&mut self, env: &Env) {
+        self.changed = true;
+        self.conflict = None;
+        if let Some(f) = self.field.take() {
+            self.set_field(env, f.command, f.binding.trigger);
+        }
+    }
+
+    /// Runs one session edit; true when it changed something.
+    fn edit(&mut self, env: &mut Env, f: impl FnOnce(&mut EditSession, &mut Keymap) -> bool) -> bool {
+        self.message = None;
+        let km = &mut *env.keymap;
+        let done = f(self.session.get_or_insert_with(|| EditSession::begin(km)), km);
+        if done {
+            self.edited(env);
+        }
+        done
+    }
+
+    /// × on a chip, or Remove.
+    pub(crate) fn remove(&mut self, env: &mut Env, command: &CommandRef, binding: &Binding) {
+        self.edit(env, |s, km| s.remove(km, command, binding));
+    }
+
+    /// Clear: no shortcut.
+    pub(crate) fn clear(&mut self, env: &mut Env, command: &CommandRef) {
+        self.edit(env, |s, km| s.clear(km, command));
+    }
+
+    /// Use Default, ↺.
+    pub(crate) fn use_default(&mut self, env: &mut Env, command: &CommandRef) {
+        self.edit(env, |s, km| s.reset(km, command));
+    }
+
+    /// Whether Use Default does anything.
+    pub(crate) fn can_use_default(env: &Env, command: &CommandRef) -> bool {
+        env.keymap.overrides().get(&command.key()).is_some()
+    }
+
+    /// Reset All…: asks first.
+    pub(crate) fn ask_reset_all(&mut self) {
+        self.prompt = Some(Prompt::ResetAll);
+    }
+
+    fn reset_all(&mut self, env: &mut Env) {
+        self.edit(env, |s, km| {
+            let before = km.overrides().clone();
+            s.reset_all(km);
+            *km.overrides() != before
+        });
+    }
+
+    pub(crate) fn undo(&mut self, env: &mut Env) {
+        self.edit(env, |s, km| s.undo(km));
+    }
+
+    pub(crate) fn redo(&mut self, env: &mut Env) {
+        self.edit(env, |s, km| s.redo(km));
+    }
+
+    pub(crate) fn can_undo(&self) -> bool {
+        self.session.as_ref().is_some_and(EditSession::can_undo)
+    }
+
+    pub(crate) fn can_redo(&self) -> bool {
+        self.session.as_ref().is_some_and(EditSession::can_redo)
+    }
+
+    // ---- OK, Cancel, Escape, Enter ----
+
+    /// OK: with sets, stores the overrides (a built-in's edits become a copy), then closes.
+    pub(crate) fn ok(&mut self, env: &mut Env) {
+        if let Err(e) = self.store(env) {
+            let text = profile_error(env, &e);
+            self.refuse(text);
+            return;
+        }
+        self.close(Outcome::Ok);
+    }
+
+    /// Cancel, window ×, or Escape when idle: everything back as it was when the dialog opened.
+    /// When that undoes edits, Changed follows, so the app rebuilds its menus (and saves, if it
+    /// saved the edits live).
+    pub(crate) fn cancel(&mut self, env: &mut Env) {
+        let mut undone = false;
+        if let Some(opened) = self.opened.take() {
+            undone = *env.keymap.overrides() != opened.overrides;
+            env.keymap.set_overrides(opened.overrides);
+            if let (Some((p, _)), Some(profiles)) = (env.sets.as_mut(), opened.profiles) {
+                undone |= **p != profiles;
+                **p = profiles;
+            }
+        }
+        self.close(Outcome::Cancel);
+        self.changed = undone;
+    }
+
+    fn close(&mut self, outcome: Outcome) {
+        self.phase = Phase::Closed;
+        self.recording = None;
+        self.conflict = None;
+        self.prompt = None;
+        // Ok and Cancel cover every edit.
+        self.changed = false;
+        self.outcome = Some(outcome);
+    }
+
+    /// Escape when nothing records: closes the innermost open thing (conflict bar, prompt, import
+    /// review, the field's chord), else cancels. Rename fields and dropdowns are the view's.
+    pub(crate) fn escape(&mut self, env: &mut Env) {
+        if self.recording.is_some() {
+            self.stop_recording();
+        } else if self.conflict.is_some() {
+            self.conflict = None;
+        } else if self.prompt.is_some() {
+            self.prompt = None;
+        } else if self.set_form.is_some() {
+            self.set_form = None;
+        } else if self.review.is_some() {
+            self.review = None;
+        } else if self.field.is_some() {
+            self.field = None;
+        } else {
+            self.cancel(env);
+        }
+    }
+
+    /// Enter when idle and no text field has focus: OK with [`Options::enter_is_ok`].
+    pub(crate) fn enter(&mut self, env: &mut Env) {
+        if env.options.enter_is_ok && self.recording.is_none() && self.prompt.is_none() {
+            self.ok(env);
+        }
+    }
+}
+
+impl DialogState {
+    // ---- Sets ----
+
+    /// Whether the keymap's overrides differ from the stored active set.
+    pub(crate) fn is_modified(env: &Env) -> bool {
+        env.sets.as_ref().is_some_and(|(p, b)| p.active_overrides(b) != env.keymap.overrides())
+    }
+
+    fn custom_name(env: &Env) -> String {
+        env.text.ui(env.options.custom_set_name).into_owned()
+    }
+
+    /// Stores the overrides in the active set; a built-in's edits become a new set.
+    fn store(&mut self, env: &mut Env) -> Result<(), ProfileError> {
+        let custom = Self::custom_name(env);
+        if let Some((p, b)) = env.sets.as_mut()
+            && p.active_overrides(b) != env.keymap.overrides()
+        {
+            p.store(env.keymap.overrides().clone(), b, &custom)?;
+            self.changed = true;
+        }
+        Ok(())
+    }
+
+    /// Makes `name` active and loads it, with a fresh undo history.
+    fn load_set(&mut self, env: &mut Env, name: &str) -> Result<(), ProfileError> {
+        let Some((p, b)) = env.sets.as_mut() else { return Err(ProfileError::NotFound) };
+        p.select(name, b)?;
+        self.load_active(env);
+        Ok(())
+    }
+
+    /// Loads the active set (no overrides when none is left), with a fresh undo history.
+    fn load_active(&mut self, env: &mut Env) {
+        if let Some((p, b)) = env.sets.as_ref() {
+            env.keymap.set_overrides(p.active_overrides(b).clone());
+        }
+        self.session = Some(EditSession::begin(env.keymap));
+        self.recording = None;
+        self.conflict = None;
+        self.field = None;
+        self.prompt = None;
+        self.changed = true;
+    }
+
+    /// A prompt or the import review is open: the set row, the table and the edit actions wait.
+    pub(crate) fn modal(&self) -> bool {
+        self.prompt.is_some() || self.review.is_some()
+    }
+
+    fn report(&mut self, env: &Env, result: Result<(), ProfileError>) {
+        match result {
+            Ok(()) => self.message = None,
+            Err(e) => self.refuse(profile_error(env, &e)),
+        }
+    }
+
+    /// The set picker. With unsaved edits it asks to save them first.
+    pub(crate) fn switch_set(&mut self, env: &mut Env, name: &str) {
+        self.prompt = None;
+        self.after_save_prompt(env, Then::Switch(name.to_string()));
+    }
+
+    /// New Set…: a copy of the current shortcuts (`based_on: None`) or of a set. A name that is
+    /// taken (ignoring case) is refused, before any prompt to save.
+    pub(crate) fn new_set(&mut self, env: &mut Env, name: &str, based_on: Option<&str>) {
+        if Self::name_taken(env, name) {
+            self.refuse(profile_error(env, &ProfileError::NameTaken));
+            return;
+        }
+        let then = Then::NewSet { name: name.to_string(), based_on: based_on.map(str::to_string) };
+        if based_on.is_none() {
+            self.run(env, then);
+        } else {
+            self.after_save_prompt(env, then);
+        }
+    }
+
+    /// Import…: asks to save unsaved edits first, then asks the app for a file.
+    pub(crate) fn request_import(&mut self, env: &mut Env) {
+        self.after_save_prompt(env, Then::Import);
+    }
+
+    fn after_save_prompt(&mut self, env: &mut Env, then: Then) {
+        if Self::is_modified(env)
+            && let Some((p, b)) = env.sets.as_ref()
+        {
+            self.prompt = Some(Prompt::SaveChanges { set: p.active_name(b).to_string(), then });
+            return;
+        }
+        self.run(env, then);
+    }
+
+    fn run(&mut self, env: &mut Env, then: Then) {
+        let result = match then {
+            Then::Switch(name) => self.load_set(env, &name),
+            Then::NewSet { name, based_on } => {
+                // Saving edits to a built-in first can have made a set of this name.
+                let taken = Self::name_taken(env, &name);
+                let made = match (env.sets.as_mut(), based_on) {
+                    _ if taken => Err(ProfileError::NameTaken),
+                    (None, _) => Err(ProfileError::NotFound),
+                    (Some((p, b)), None) => p.save_as(&name, env.keymap.overrides().clone(), b),
+                    (Some((p, b)), Some(from)) => p.duplicate(&from, &name, b),
+                };
+                made.and_then(|n| self.load_set(env, &n))
+            }
+            Then::Import => {
+                let formats = std::iter::once(JSON_FORMAT).chain(env.options.import_formats.iter().map(|f| f.id)).collect();
+                self.outcome = Some(Outcome::Import { formats });
+                Ok(())
+            }
+        };
+        self.report(env, result);
+    }
+
+    fn name_taken(env: &Env, name: &str) -> bool {
+        let (Some((p, b)), Some(name)) = (env.sets.as_ref(), set_name(name)) else { return false };
+        p.taken(&name, b)
+    }
+
+    /// Rename… (not for built-ins).
+    pub(crate) fn rename_set(&mut self, env: &mut Env, to: &str) {
+        let result = match env.sets.as_mut() {
+            Some((p, b)) => {
+                let from = p.active_name(b).to_string();
+                p.rename(&from, to, b).map(|_| ())
+            }
+            None => Err(ProfileError::NotFound),
+        };
+        if result.is_ok() {
+            self.changed = true;
+        }
+        self.report(env, result);
+    }
+
+    /// Delete: asks first.
+    pub(crate) fn ask_delete_set(&mut self, env: &Env) {
+        if let Some((p, b)) = env.sets.as_ref() {
+            let name = p.active_name(b);
+            if !Profiles::is_builtin(name, b) {
+                self.prompt = Some(Prompt::DeleteSet(name.to_string()));
+            }
+        }
+    }
+
+    /// Deletes a user set. Deleting the active set loads the one that becomes active, or no
+    /// overrides when no set is left.
+    fn delete_set(&mut self, env: &mut Env, name: &str) {
+        let result = match env.sets.as_mut() {
+            Some((p, b)) => {
+                let was_active = p.active_name(b) == name;
+                p.delete(name, b).map(|()| was_active)
+            }
+            None => Err(ProfileError::NotFound),
+        };
+        match result {
+            Ok(true) => self.load_active(env),
+            Ok(false) => self.changed = true,
+            Err(_) => {}
+        }
+        self.report(env, result.map(|_| ()));
+    }
+
+    /// Save: stores the edits; a built-in's become a copy. The undo history stays.
+    pub(crate) fn save_set(&mut self, env: &mut Env) {
+        let result = self.store(env);
+        self.report(env, result);
+    }
+
+    /// Revert Set: back to the stored set, as one undo step.
+    pub(crate) fn revert_set(&mut self, env: &mut Env) {
+        let Some(stored) = env.sets.as_ref().map(|(p, b)| p.active_overrides(b).clone()) else { return };
+        self.edit(env, |s, km| {
+            let before = km.overrides().clone();
+            s.edit(km, |k| k.set_overrides(stored));
+            *km.overrides() != before
+        });
+    }
+
+    /// Export ▾ → Keyboard Shortcuts (JSON): the set as shown, edits included.
+    pub(crate) fn export_set(&mut self, env: &mut Env) {
+        let custom = Self::custom_name(env);
+        let result = match env.sets.as_ref() {
+            Some((p, b)) => {
+                let mut tmp = (**p).clone();
+                tmp.store(env.keymap.overrides().clone(), b, &custom).and_then(|_| {
+                    let name = tmp.active_name(b).to_string();
+                    tmp.export(&name, b).map(|json| (name, json))
+                })
+            }
+            None => {
+                let mut tmp = Profiles::default();
+                tmp.save_as(&custom, env.keymap.overrides().clone(), &[]).and_then(|name| tmp.export(&name, &[]).map(|json| (name, json)))
+            }
+        };
+        match result {
+            Ok((name, json)) => self.outcome = Some(Outcome::Export { name, json }),
+            Err(e) => self.refuse(profile_error(env, &e)),
+        }
+    }
+
+    /// Export ▾ → an app format.
+    pub(crate) fn export_as(&mut self, env: &Env, format: &'static str) {
+        let name = match env.sets.as_ref() {
+            Some((p, b)) => p.active_name(b).to_string(),
+            None => Self::custom_name(env),
+        };
+        self.outcome = Some(Outcome::ExportAs { format, name, keymap: Box::new(env.keymap.clone()) });
+    }
+
+    /// A craft-keymap JSON set the app read: a new set, loaded; without sets its overrides replace
+    /// the keymap's as one undo step.
+    pub(crate) fn import_json(&mut self, env: &mut Env, text: &str) -> Result<String, ProfileError> {
+        let result = match env.sets.as_mut() {
+            Some((p, b)) => p.import(text, b).and_then(|name| self.load_set(env, &name).map(|()| name)),
+            None => {
+                let mut tmp = Profiles::default();
+                let name = tmp.import(text, &[]);
+                if name.is_ok() {
+                    let overrides = tmp.active_overrides(&[]).clone();
+                    self.edit(env, |s, km| {
+                        s.edit(km, |k| k.set_overrides(overrides));
+                        true
+                    });
+                }
+                name
+            }
+        };
+        if let Err(e) = &result {
+            self.refuse(profile_error(env, e));
+        }
+        result
+    }
+
+    /// Summarize…: every command with a shortcut, as HTML and plain text.
+    pub(crate) fn summarize(&mut self, env: &Env) {
+        let title = env.text.ui(env.options.title).into_owned();
+        let (name, heading) = match env.sets.as_ref() {
+            Some((p, b)) => {
+                let name = p.active_name(b).to_string();
+                let heading = env.ui("{title}: {set}", &[("title", &title), ("set", &name)]);
+                (name, heading)
+            }
+            None => (title.clone(), title),
+        };
+        let html = summary::html(env.keymap, env.text, &heading);
+        let text = summary::text(env.keymap, env.text, &heading);
+        self.outcome = Some(Outcome::Summary { name, html, text });
+    }
+
+    /// Answers the open prompt.
+    pub(crate) fn answer(&mut self, env: &mut Env, answer: Answer) {
+        let Some(prompt) = self.prompt.take() else { return };
+        match (prompt, answer) {
+            (_, Answer::Cancel) => {}
+            (Prompt::ResetAll, Answer::Yes) => self.reset_all(env),
+            (Prompt::DeleteSet(name), Answer::Yes) => self.delete_set(env, &name),
+            (Prompt::SaveChanges { then, .. }, Answer::Yes) => match self.store(env) {
+                Ok(()) => self.run(env, then),
+                Err(e) => self.refuse(profile_error(env, &e)),
+            },
+            // Don't Save reloads the stored set first, so an import does not start from the edits.
+            (Prompt::SaveChanges { set, then }, Answer::No) => match self.load_set(env, &set) {
+                Ok(()) => self.run(env, then),
+                Err(e) => self.refuse(profile_error(env, &e)),
+            },
+            (Prompt::ResetAll | Prompt::DeleteSet(_), Answer::No) => {}
+        }
+    }
+
+    // ---- Import review ----
+
+    pub(crate) fn review_import(&mut self, env: &mut Env, set: ForeignSet, options: ImportOptions) {
+        let plan = import::plan(&set, env.keymap, &options);
+        let name = plan.report.set.clone().unwrap_or_else(|| env.text.ui("Imported").into_owned());
+        self.stop_recording();
+        self.conflict = None;
+        self.review = Some(Review { set, options, plan, name, done: None });
+    }
+
+    /// Picks candidate `candidate` for suggestion `suggestion`, re-plans, and reports the answers
+    /// for the app to keep.
+    pub(crate) fn pick_suggestion(&mut self, env: &Env, suggestion: usize, candidate: usize) {
+        let Some(r) = &mut self.review else { return };
+        let Some(s) = r.plan.report.suggestions.get(suggestion) else { return };
+        let Some(command) = s.candidates.get(candidate).cloned() else { return };
+        let Some(entry) = r.set.entries.iter().find(|e| e.item() == s.item && e.line == s.line) else { return };
+        r.options.remembered.insert(entry.remember_key(), command);
+        r.plan = import::plan(&r.set, env.keymap, &r.options);
+        self.outcome = Some(Outcome::Remembered(r.options.remembered.clone()));
+    }
+
+    /// Import as New Set (with sets), else applies the plan to the keymap as one undo step.
+    pub(crate) fn import_reviewed(&mut self, env: &mut Env) {
+        let Some(mut r) = self.review.take() else { return };
+        let result = match env.sets.as_mut() {
+            Some((p, b)) => p.import_plan(&r.plan, env.keymap, Some(&r.name), b),
+            None => {
+                let plan = &r.plan;
+                let mut report = None;
+                self.edit(env, |s, km| {
+                    report = Some(s.edit(km, |k| plan.apply(k)));
+                    true
+                });
+                Ok((r.name.clone(), report.unwrap_or_default()))
+            }
+        };
+        match result {
+            Ok((name, report)) => {
+                if env.sets.is_some()
+                    && let Err(e) = self.load_set(env, &name)
+                {
+                    self.refuse(profile_error(env, &e));
+                }
+                r.done = Some((name, report));
+            }
+            Err(e) => self.refuse(profile_error(env, &e)),
+        }
+        self.review = Some(r);
+    }
+
+    pub(crate) fn close_review(&mut self) {
+        self.review = None;
+    }
+}
+
+fn assign_error(env: &Env, e: &AssignError) -> String {
+    match e {
+        AssignError::Reserved(t) => env.ui("{chord} is reserved by the system", &[("chord", &env.chord_text(t))]),
+        AssignError::TooMany => env.ui("A command can have at most {n} shortcuts", &[("n", &MAX_BINDINGS.to_string())]),
+        AssignError::UnknownScope(s) => env.ui("The scope {scope} is unknown", &[("scope", s.as_str())]),
+        AssignError::Full => env.ui("Too many shortcuts are assigned", &[]),
+        AssignError::UnknownCommand => env.ui("This command is unknown", &[]),
+        AssignError::Taken(holders) => env.ui("Also used by {label}", &[("label", &env.holder_labels(holders))]),
+    }
+}
+
+/// Why a binding text does not parse, translated.
+pub(crate) fn binding_error(env: &Env, e: &BindingError) -> String {
+    match e {
+        BindingError::TooLong => env.ui("the shortcut is too long", &[]),
+        BindingError::Scope => env.ui("the scope name is not valid", &[]),
+        BindingError::Trigger(e) => match e {
+            ParseError::Empty => env.ui("empty shortcut", &[]),
+            ParseError::TooLong => env.ui("the shortcut is too long", &[]),
+            ParseError::MissingKey => env.ui("the shortcut has no key", &[]),
+            ParseError::UnknownKey(k) => env.ui("unknown key {key}", &[("key", k)]),
+            ParseError::UnknownModifier(m) => env.ui("unknown modifier {key}", &[("key", m)]),
+            ParseError::DuplicateModifier(m) => env.ui("modifier {key} given twice", &[("key", m)]),
+            ParseError::Sequence => env.ui("key sequences are not supported", &[]),
+        },
+    }
+}
+
+fn profile_error(env: &Env, e: &ProfileError) -> String {
+    match e {
+        ProfileError::BadName => env.ui("The name is empty, too long or has control characters", &[]),
+        ProfileError::NameTaken => env.ui("A set with this name exists", &[]),
+        ProfileError::NotFound => env.ui("The set was not found", &[]),
+        ProfileError::BuiltIn => env.ui("Built-in sets cannot be changed", &[]),
+        ProfileError::TooMany => env.ui("There are too many sets", &[]),
+        ProfileError::BadFile => env.ui("This is not a shortcut set file", &[]),
+        ProfileError::WrongFormat => env.ui("This is not a craft-keymap file", &[]),
+        ProfileError::NewerVersion(v) => env.ui("This file is from a newer version (format {n})", &[("n", &v.to_string())]),
+        ProfileError::TooLarge => env.ui("The file is too large", &[]),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::chord::Platform;
+    use crate::keymap::ConflictKind;
+    use crate::ui::rows::Line;
+    use crate::ui::rows::tests::fixture;
+    use crate::ui::text::English;
+
+    struct Fx {
+        km: Keymap,
+        p: Profiles,
+        b: Vec<(&'static str, Overrides)>,
+        o: Options,
+        sets: bool,
+    }
+
+    impl Fx {
+        fn new(o: Options) -> Fx {
+            Fx { km: fixture(Platform::Mac), p: Profiles::default(), b: vec![("Fixture Defaults", Overrides::new())], o, sets: true }
+        }
+
+        fn env(&mut self) -> Env<'_> {
+            let sets = if self.sets { Some((&mut self.p, &self.b[..])) } else { None };
+            Env { keymap: &mut self.km, sets, options: &self.o, text: &English }
+        }
+
+        fn keys(&self, id: &str) -> Vec<String> {
+            self.km.bindings(&id.into()).iter().map(ToString::to_string).collect()
+        }
+    }
+
+    fn c(s: &str) -> Chord {
+        Chord::parse(s).unwrap_or(Chord::from(Key::F35))
+    }
+
+    fn b(s: &str) -> Binding {
+        Binding::parse(s).unwrap_or(Binding::new(Chord::from(Key::F35)))
+    }
+
+    fn open(fx: &mut Fx) -> DialogState {
+        let mut st = DialogState::new();
+        st.begin(&mut fx.env());
+        st
+    }
+
+    /// Records `chords` into `target` at time 0.
+    fn record(st: &mut DialogState, fx: &mut Fx, target: Target, chords: &[&str]) {
+        let mut env = fx.env();
+        st.record(&env, target);
+        let chords: Vec<Chord> = chords.iter().map(|s| c(s)).collect();
+        st.feed(&mut env, &chords, 0.0);
+    }
+
+    fn add(command: &str) -> Target {
+        Target::Cell { command: command.into(), old: None }
+    }
+
+    #[test]
+    fn recording_takes_the_frames_keys_before_the_app() {
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        st.record(&fx.env(), Target::Cell { command: "file.save".into(), old: Some(b("Cmd+S")) });
+        let ctx = egui::Context::default();
+        let press = egui::Event::Key { key: egui::Key::E, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::MAC_CMD };
+        let input = egui::RawInput { events: vec![press, egui::Event::Text("e".into())], ..egui::RawInput::default() };
+        let mut left = usize::MAX;
+        let mut full = ctx.run_ui(input, |ui| {
+            st.input(&mut fx.env(), ui.ctx());
+            left = ui.ctx().input(|i| i.events.len());
+        });
+        full.textures_delta.clear();
+        assert_eq!(left, 0);
+        assert!(!st.is_recording());
+        assert_eq!(st.conflict.as_ref().map(|c| c.text.as_str()), Some("⚠ ⌘E is used by Export…"));
+        assert_eq!(fx.keys("file.save"), ["Cmd+S"], "nothing changes before the answer");
+    }
+
+    #[test]
+    fn recording_takes_tab_and_shift_escape_and_escape_cancels_only_the_recording() {
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, add("object.front"), &["Tab"]);
+        record(&mut st, &mut fx, add("object.front"), &["Shift+Escape"]);
+        assert_eq!(fx.keys("object.front"), ["Tab", "Shift+Escape"]);
+
+        record(&mut st, &mut fx, add("object.front"), &["Escape"]);
+        assert!(!st.is_recording() && st.is_open());
+        assert_eq!(fx.keys("object.front").len(), 2);
+        assert!(matches!(st.finish(), Some(Outcome::Changed)));
+        st.escape(&mut fx.env());
+        assert!(matches!(st.finish(), Some(Outcome::Cancel)));
+        assert!(fx.keys("object.front").is_empty(), "Cancel restores the opening keymap");
+        assert!(st.is_open() && matches!(st.finish(), Some(Outcome::Changed)), "Changed follows, for the app's menus");
+        assert!(!st.is_open());
+    }
+
+    #[test]
+    fn double_press_records_k_k_within_the_window() {
+        let mut fx = Fx::new(Options { double_press: true, ..Options::default() });
+        let mut st = open(&mut fx);
+        let mut env = fx.env();
+        st.record(&env, add("object.front"));
+        st.feed(&mut env, &[c("K")], 0.0);
+        assert!(st.is_recording(), "a single waits for a second press");
+        st.feed(&mut env, &[c("K")], 0.3);
+        assert!(!st.is_recording());
+        assert_eq!(fx.keys("object.front"), ["K K"]);
+
+        let mut env = fx.env();
+        st.record(&env, add("type.bold"));
+        st.feed(&mut env, &[c("K")], 1.0);
+        st.feed(&mut env, &[c("K")], 1.9);
+        assert_eq!(fx.keys("type.bold"), ["Text: Cmd+B", "K"]);
+    }
+
+    #[test]
+    fn conflict_take_it_steals_and_undo_restores() {
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, add("file.export"), &["Cmd+S"]);
+        assert_eq!(st.conflict.as_ref().map(|c| c.text.as_str()), Some("⚠ ⌘S is used by Save"));
+        st.take_it(&mut fx.env());
+        assert_eq!((fx.keys("file.save"), fx.keys("file.export")), (vec![], vec!["Cmd+E".to_string(), "Cmd+S".to_string()]));
+        assert!(st.message.as_ref().is_some_and(|m| m.undo && m.goto == Some("file.save".into())));
+        st.undo(&mut fx.env());
+        assert_eq!((fx.keys("file.save"), fx.keys("file.export")), (vec!["Cmd+S".to_string()], vec!["Cmd+E".to_string()]));
+        st.redo(&mut fx.env());
+        assert!(fx.keys("file.save").is_empty());
+    }
+
+    #[test]
+    fn conflict_keep_both_lists_the_clash_and_cancel_changes_nothing() {
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, add("file.export"), &["Cmd+S"]);
+        st.dismiss_conflict();
+        assert_eq!(fx.keys("file.export"), ["Cmd+E"]);
+        record(&mut st, &mut fx, add("file.export"), &["Cmd+S"]);
+        st.keep_both(&mut fx.env());
+        let clashes = fx.km.conflicts().into_iter().filter(|c| c.kind == ConflictKind::Clash).count();
+        assert_eq!(clashes, 1);
+        st.set_filter(Filter::Conflicts);
+        let env = fx.env();
+        let rows: Vec<String> = st.lines(&env).lines.iter().filter_map(|l| if let Line::Row(r) = l { Some(r.key.clone()) } else { None }).collect();
+        assert_eq!(rows, ["file.save", "file.export"]);
+    }
+
+    #[test]
+    fn go_to_conflict_selects_and_reveals_the_holder() {
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        st.set_area(AreaId::Tools);
+        st.set_query("marquee".into());
+        record(&mut st, &mut fx, add("tool.marquee"), &["Cmd+S"]);
+        st.take_it_and_go(&mut fx.env());
+        assert_eq!((&st.area, st.query.as_str(), st.selected.clone(), st.reveal), (&AreaId::All, "", Some("file.save".into()), true));
+    }
+
+    #[test]
+    fn steal_and_keep_modes_apply_and_say_so() {
+        let mut fx = Fx::new(Options { conflicts: ConflictMode::Steal, ..Options::default() });
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, add("file.export"), &["Cmd+S"]);
+        assert_eq!(st.message.as_ref().map(|m| m.text.as_str()), Some("⌘S was removed from Save"));
+        let mut fx = Fx::new(Options { conflicts: ConflictMode::Keep, ..Options::default() });
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, add("file.export"), &["Cmd+S"]);
+        assert_eq!(st.message.as_ref().map(|m| (m.text.as_str(), m.undo)), Some(("Also used by Save", false)));
+        assert_eq!(fx.keys("file.save"), ["Cmd+S"]);
+    }
+
+    #[test]
+    fn reserved_chord_and_app_rule_refuse() {
+        let mut fx = Fx::new(Options {
+            accept: Some(Box::new(|bindable, binding| match bindable.kind {
+                crate::Kind::Tool { .. } if !binding.trigger.chord.mods.is_none() => Err("Tools take single keys".into()),
+                _ => Ok(()),
+            })),
+            ..Options::default()
+        });
+        fx.km = fx.km.clone().with_reserved(vec![c("Cmd+Tab")]);
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, add("object.front"), &["Cmd+Tab"]);
+        assert_eq!(st.message.as_ref().map(|m| (m.text.as_str(), m.refused)), Some(("⌘⇥ is reserved by the system", true)));
+        record(&mut st, &mut fx, add("tool.marquee"), &["Cmd+J"]);
+        assert_eq!(st.message.as_ref().map(|m| m.text.as_str()), Some("Tools take single keys"));
+        assert!(fx.km.overrides().is_empty());
+        assert!(st.finish().is_none());
+    }
+
+    #[test]
+    fn backspace_clears_the_binding_being_replaced() {
+        let mut fx = Fx::new(Options { backspace_clears: true, ..Options::default() });
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, Target::Cell { command: "file.save".into(), old: Some(b("Cmd+S")) }, &["Backspace"]);
+        assert!(fx.keys("file.save").is_empty());
+    }
+
+    #[test]
+    fn field_waits_for_assign_lists_holders_and_takes() {
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, Target::Field { command: "file.save".into() }, &["Cmd+B"]);
+        let f = st.field.clone();
+        assert_eq!(f.as_ref().map(|f| (f.holders.len(), f.shadows.len())), Some((0, 1)), "Bold's Text: Cmd+B only shadows");
+        st.set_context(&fx.env(), Scope::new("Text"));
+        assert_eq!(st.field.as_ref().map(|f| f.holders.len()), Some(1), "in Text it clashes");
+        st.assign_field(&mut fx.env());
+        assert!(st.conflict.is_none(), "Assign takes the chord without asking");
+        assert_eq!(fx.keys("file.save"), ["Cmd+S", "Text: Cmd+B"]);
+        assert!(fx.keys("type.bold").is_empty());
+
+        st.set_context(&fx.env(), None);
+        assert_eq!(st.type_binding(&mut fx.env(), &"file.save".into(), "F7 F7"), Ok(()));
+        st.assign_field(&mut fx.env());
+        assert_eq!(fx.keys("file.save"), ["Cmd+S", "Text: Cmd+B", "F7 F7"]);
+        assert_eq!(st.type_binding(&mut fx.env(), &"file.save".into(), "Cmd+Nope"), Err("unknown key Nope".into()));
+    }
+
+    #[test]
+    fn new_set_refuses_a_taken_name_and_keeps_the_set() {
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        st.new_set(&mut fx.env(), "Mine", None);
+        record(&mut st, &mut fx, add("object.front"), &["F2"]);
+        st.save_set(&mut fx.env());
+        let kept = fx.p.sets()["Mine"].clone();
+        assert!(!kept.is_empty());
+        st.switch_set(&mut fx.env(), "Fixture Defaults");
+        for name in ["Mine", " mine ", "fixture defaults"] {
+            for based_on in [None, Some("Fixture Defaults")] {
+                st.new_set(&mut fx.env(), name, based_on);
+                assert!(st.message.as_ref().is_some_and(|m| m.refused), "{name:?} from {based_on:?}");
+                assert_eq!((fx.p.sets().len(), fx.p.active()), (1, "Fixture Defaults"));
+                assert_eq!(fx.p.sets()["Mine"], kept);
+            }
+        }
+        st.new_set(&mut fx.env(), "Other", None);
+        st.rename_set(&mut fx.env(), "MINE");
+        assert!(st.message.as_ref().is_some_and(|m| m.refused));
+        assert_eq!(fx.p.sets()["Mine"], kept);
+    }
+
+    #[test]
+    fn cancel_restores_keymap_and_sets() {
+        let mut fx = Fx::new(Options::default());
+        fx.p.save_as("Mine", Overrides::new(), &fx.b).ok();
+        let (km0, p0) = (fx.km.overrides().clone(), fx.p.clone());
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, add("object.front"), &["F2"]);
+        st.new_set(&mut fx.env(), "Other", None);
+        assert_eq!(fx.p.active(), "Other");
+        st.ask_delete_set(&fx.env());
+        assert_eq!(st.prompt, Some(Prompt::DeleteSet("Other".into())));
+        st.answer(&mut fx.env(), Answer::Yes);
+        assert!(!fx.p.sets().contains_key("Other"));
+        st.cancel(&mut fx.env());
+        assert_eq!((fx.km.overrides(), &fx.p), (&km0, &p0));
+    }
+
+    #[test]
+    fn a_stale_delete_prompt_neither_reloads_nor_drops_edits() {
+        let mut fx = Fx::new(Options::default());
+        fx.p.save_as("Mine", Overrides::new(), &fx.b).ok();
+        fx.p.save_as("Other", Overrides::new(), &fx.b).ok();
+        let mut st = open(&mut fx);
+        st.ask_delete_set(&fx.env());
+        assert!(st.modal());
+        st.switch_set(&mut fx.env(), "Mine");
+        assert_eq!((st.prompt.clone(), fx.p.active()), (None, "Mine"), "switching closes the prompt");
+
+        record(&mut st, &mut fx, add("object.front"), &["F2"]);
+        st.prompt = Some(Prompt::DeleteSet("Other".into()));
+        st.answer(&mut fx.env(), Answer::Yes);
+        assert!(!fx.p.sets().contains_key("Other"));
+        assert_eq!((fx.p.active(), fx.keys("object.front")), ("Mine", vec!["F2".to_string()]), "the active set keeps its edits");
+        assert!(st.can_undo());
+    }
+
+    #[test]
+    fn deleting_the_last_set_without_builtins_loads_no_overrides() {
+        let mut fx = Fx::new(Options::default());
+        fx.b.clear();
+        let mut mine = Overrides::new();
+        mine.insert("object.front", vec!["F2".into()]);
+        fx.p.save_as("Mine", mine.clone(), &fx.b).ok();
+        fx.km.set_overrides(mine);
+        let mut st = open(&mut fx);
+        st.ask_delete_set(&fx.env());
+        st.answer(&mut fx.env(), Answer::Yes);
+        assert!(st.message.is_none(), "{:?}", st.message);
+        assert!(fx.p.sets().is_empty() && fx.km.overrides().is_empty() && !st.can_undo());
+        st.ok(&mut fx.env());
+        assert!(fx.p.sets().is_empty(), "OK stores no copy of the deleted set");
+    }
+
+    #[test]
+    fn ok_stores_edits_of_a_builtin_as_a_copy() {
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, add("object.front"), &["F2"]);
+        assert!(DialogState::is_modified(&fx.env()));
+        st.ok(&mut fx.env());
+        assert!(matches!(st.finish(), Some(Outcome::Ok)));
+        assert_eq!(fx.p.active(), "Custom");
+        assert_eq!(fx.p.get("Custom", &fx.b).and_then(|o| o.get("object.front")), Some(&["F2".to_string()][..]));
+    }
+
+    #[test]
+    fn switching_a_modified_set_asks_to_save() {
+        let mut fx = Fx::new(Options::default());
+        fx.p.save_as("Mine", Overrides::new(), &fx.b).ok();
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, add("object.front"), &["F2"]);
+        st.switch_set(&mut fx.env(), "Fixture Defaults");
+        assert!(matches!(&st.prompt, Some(Prompt::SaveChanges { set, .. }) if set == "Mine"));
+        st.answer(&mut fx.env(), Answer::No);
+        assert_eq!(fx.p.active(), "Fixture Defaults");
+        assert!(fx.km.overrides().is_empty() && !st.can_undo(), "the set loads with a fresh undo history");
+        assert!(fx.p.get("Mine", &fx.b).is_some_and(Overrides::is_empty), "Don't Save keeps the stored set");
+    }
+
+    #[test]
+    fn dont_save_before_import_drops_the_edits() {
+        use crate::import::{ContextRule, ForeignEntry, ForeignKey};
+        let mut fx = Fx::new(Options::default());
+        fx.p.save_as("Mine", Overrides::new(), &fx.b).ok();
+        let mut st = open(&mut fx);
+        record(&mut st, &mut fx, add("object.front"), &["F2"]);
+        st.request_import(&mut fx.env());
+        st.answer(&mut fx.env(), Answer::No);
+        assert!(matches!(st.finish(), Some(Outcome::Import { .. })));
+        assert!(fx.km.overrides().is_empty() && !st.can_undo());
+        let read = |text: &str| ForeignKey::read(Some("Default"), text, crate::Flavor::Windows);
+        let set = ForeignSet::new(vec![ForeignEntry::new(Some("File"), ["Save"]).with_key(read("Ctrl+Alt+S"))]).with_name("Theirs");
+        let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], ..ImportOptions::default() };
+        st.review_import(&mut fx.env(), set, options);
+        st.import_reviewed(&mut fx.env());
+        assert_eq!(fx.p.active(), "Theirs");
+        assert_eq!(fx.p.get("Theirs", &fx.b).and_then(|o| o.get("object.front")), None);
+        assert!(fx.p.get("Mine", &fx.b).is_some_and(Overrides::is_empty));
+    }
+
+    #[test]
+    fn save_prompt_before_import_reports_changed_after_import() {
+        for answer in [Answer::No, Answer::Yes] {
+            let mut fx = Fx::new(Options::default());
+            fx.p.save_as("Mine", Overrides::new(), &fx.b).ok();
+            let mut st = open(&mut fx);
+            record(&mut st, &mut fx, add("object.front"), &["F2"]);
+            assert!(matches!(st.finish(), Some(Outcome::Changed)));
+            st.request_import(&mut fx.env());
+            st.answer(&mut fx.env(), answer);
+            assert!(matches!(st.finish(), Some(Outcome::Import { .. })), "{answer:?}");
+            assert!(matches!(st.finish(), Some(Outcome::Changed)), "{answer:?}");
+            assert!(st.finish().is_none());
+        }
+    }
+
+    #[test]
+    fn set_export_import_round_trip() {
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        st.new_set(&mut fx.env(), "Name", None);
+        record(&mut st, &mut fx, add("object.front"), &["F2"]);
+        st.export_set(&mut fx.env());
+        let (name, json) = match st.finish() {
+            Some(Outcome::Export { name, json }) => (name, json),
+            _ => (String::new(), String::new()),
+        };
+        assert_eq!(name, "Name");
+        let edited = fx.km.overrides().clone();
+
+        let mut fresh = Fx::new(Options::default());
+        fresh.p = fx.p.clone();
+        let mut st = open(&mut fresh);
+        assert_eq!(st.import_json(&mut fresh.env(), &json), Ok("Name 2".into()));
+        assert_eq!(fresh.km.overrides(), &edited);
+        assert!(st.import_json(&mut fresh.env(), "{}").is_err());
+        assert!(st.message.as_ref().is_some_and(|m| m.refused));
+
+        let mut no_sets = Fx::new(Options::default());
+        no_sets.sets = false;
+        let mut st = open(&mut no_sets);
+        assert!(st.import_json(&mut no_sets.env(), &json).is_ok());
+        assert_eq!(no_sets.km.overrides(), &edited);
+        assert!(st.can_undo());
+    }
+
+    #[test]
+    fn import_request_and_reset_all() {
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        st.request_import(&mut fx.env());
+        assert!(matches!(st.finish(), Some(Outcome::Import { formats }) if formats == [JSON_FORMAT]));
+        record(&mut st, &mut fx, add("object.front"), &["F2"]);
+        st.ask_reset_all();
+        st.answer(&mut fx.env(), Answer::Yes);
+        assert!(fx.km.overrides().is_empty());
+        st.undo(&mut fx.env());
+        assert_eq!(fx.keys("object.front"), ["F2"]);
+    }
+
+    #[test]
+    fn foreign_import_review_makes_a_new_set() {
+        use crate::import::{ContextRule, ForeignEntry, ForeignKey};
+        let mut fx = Fx::new(Options::default());
+        let mut st = open(&mut fx);
+        let read = |text: &str| ForeignKey::read(Some("Default"), text, crate::Flavor::Windows);
+        let set = ForeignSet::new(vec![
+            ForeignEntry::new(Some("File"), ["Save"]).with_key(read("Ctrl+Alt+S")).at_line(3),
+            ForeignEntry::new(Some("File"), ["Frobnicate"]).with_key(read("Ctrl+F")).at_line(4),
+        ])
+        .with_name("Theirs");
+        let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], ..ImportOptions::default() };
+        st.review_import(&mut fx.env(), set, options);
+        let r = st.review.as_ref();
+        assert_eq!(r.map(|r| (r.name.as_str(), r.plan.commands.len(), r.plan.report.unmatched.len())), Some(("Theirs", 1, 1)));
+        assert!(fx.km.overrides().is_empty(), "review changes nothing");
+        st.import_reviewed(&mut fx.env());
+        assert_eq!(fx.p.active(), "Theirs");
+        assert_eq!(fx.keys("file.save"), ["Cmd+Alt+S"]);
+        assert!(st.review.as_ref().is_some_and(|r| r.done.is_some()));
+        st.escape(&mut fx.env());
+        assert!(st.review.is_none() && st.is_open());
+    }
+}
diff --git a/crates/keymap/src/ui/style.rs b/crates/keymap/src/ui/style.rs
new file mode 100644
index 00000000..5abfc97c
--- /dev/null
+++ b/crates/keymap/src/ui/style.rs
@@ -0,0 +1,54 @@
+//! The dialog's colors and the icon-button style built from them.
+
+use craft_ui::buttons::{ButtonVisuals, IconButtonStyle};
+use craft_ui::layout::ResizeHandleStyle;
+use egui::{Color32, Stroke, Visuals};
+
+/// The dialog's colors.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct DialogStyle {
+    pub accent: Color32,
+    pub warning: Color32,
+    pub dim: Color32,
+    pub changed: Color32,
+    pub app_key: Color32,
+    pub scoped_key: Color32,
+    pub both_key: Color32,
+    pub modifier_key: Color32,
+    pub free_key: Color32,
+}
+
+impl DialogStyle {
+    pub fn from_visuals(v: &Visuals) -> DialogStyle {
+        let accent = v.selection.bg_fill;
+        DialogStyle {
+            accent,
+            warning: v.warn_fg_color,
+            dim: v.weak_text_color(),
+            changed: accent,
+            app_key: accent,
+            scoped_key: v.warn_fg_color,
+            both_key: v.error_fg_color,
+            modifier_key: v.widgets.active.bg_fill,
+            free_key: v.widgets.inactive.bg_fill,
+        }
+    }
+}
+
+/// Icon buttons (+, ×, ↺, ⌨, ✕) in the colors of the app's visuals.
+pub(crate) fn icon_buttons(v: &Visuals) -> IconButtonStyle {
+    let w = &v.widgets;
+    IconButtonStyle {
+        normal: ButtonVisuals { fill: Color32::TRANSPARENT, stroke: Stroke::NONE, icon: w.inactive.fg_stroke.color },
+        hovered: ButtonVisuals { fill: w.hovered.weak_bg_fill, stroke: w.hovered.bg_stroke, icon: w.hovered.fg_stroke.color },
+        pressed: Some(ButtonVisuals { fill: w.active.weak_bg_fill, stroke: w.active.bg_stroke, icon: w.active.fg_stroke.color }),
+        selected: ButtonVisuals { fill: v.selection.bg_fill, stroke: Stroke::NONE, icon: v.selection.stroke.color },
+        corner_radius: w.inactive.corner_radius,
+        focus_stroke: v.selection.stroke,
+    }
+}
+
+/// The table/detail divider.
+pub(crate) fn divider(v: &Visuals) -> ResizeHandleStyle {
+    ResizeHandleStyle { hovered: v.widgets.hovered.bg_fill, dragged: v.widgets.active.bg_fill, focused: v.selection.bg_fill }
+}
diff --git a/crates/keymap/src/ui/summary.rs b/crates/keymap/src/ui/summary.rs
new file mode 100644
index 00000000..01603962
--- /dev/null
+++ b/crates/keymap/src/ui/summary.rs
@@ -0,0 +1,113 @@
+//! The shortcut summary behind Summarize…: every command that has a shortcut, grouped as in the
+//! dialog's All Commands view, as an HTML page and as plain text. Apps can also call these for a
+//! cheat sheet outside the dialog.
+
+use std::fmt::Write as _;
+
+use crate::keymap::{Binding, Keymap};
+use crate::scope::Scope;
+use crate::ui::rows::{AreaId, group};
+use crate::ui::text::{Text, trigger_text};
+
+struct Group {
+    rank: u8,
+    name: String,
+    /// (label, shortcuts as shown)
+    rows: Vec<(String, Vec<String>)>,
+}
+
+fn binding_text(km: &Keymap, text: &dyn Text, b: &Binding, home: &Scope) -> String {
+    let chord = trigger_text(text, &b.trigger, km.platform());
+    match &b.scope {
+        Some(s) if s != home => {
+            let scope = if s.is_app() { text.ui("Application").into_owned() } else { text.segment(s.as_str()).into_owned() };
+            craft_i18n::fmt(&text.ui("{chord} ({scope})"), &[("chord", &chord), ("scope", &scope)])
+        }
+        _ => chord,
+    }
+}
+
+/// Groups in the table's order; commands in catalog order within a group.
+fn groups(km: &Keymap, text: &dyn Text) -> Vec<Group> {
+    let mut out: Vec<Group> = Vec::new();
+    for b in km.catalog() {
+        let bindings = km.bindings(&b.command);
+        if bindings.is_empty() {
+            continue;
+        }
+        let keys = bindings.iter().map(|x| binding_text(km, text, x, &b.scope)).collect();
+        let (rank, name, _) = group(&AreaId::All, b, false, text);
+        let name = name.unwrap_or_default();
+        let row = (text.command(b).into_owned(), keys);
+        match out.iter_mut().find(|g| g.rank == rank && g.name == name) {
+            Some(g) => g.rows.push(row),
+            None => out.push(Group { rank, name, rows: vec![row] }),
+        }
+    }
+    out.sort_by_key(|g| g.rank);
+    out
+}
+
+/// Text for HTML element content and attribute values.
+pub fn escape_html(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&#39;"),
+            c => out.push(c),
+        }
+    }
+    out
+}
+
+/// One line of plain text: control characters (line breaks, tabs) become spaces, so a label
+/// cannot break the layout.
+fn one_line(s: &str) -> String {
+    s.chars().map(|c| if c.is_control() { ' ' } else { c }).collect()
+}
+
+const CSS: &str = "body{font-family:system-ui,sans-serif;margin:2em;color:#111;background:#fff}\
+h1{font-size:1.4em}h2{font-size:1.1em;margin-top:1.5em;border-bottom:1px solid #ccc}\
+table{border-collapse:collapse;width:100%}th,td{padding:.2em .6em;vertical-align:top}\
+th{font-weight:normal;text-align:start;width:60%}tr:nth-child(even){background:#f4f4f4}\
+kbd{font-family:inherit;border:1px solid #bbb;border-radius:3px;padding:0 .3em;margin-inline-end:.3em;white-space:nowrap}\
+@media print{body{margin:0}tr{break-inside:avoid}}";
+
+/// A standalone HTML page titled `title`. Chords are marked left to right so a right-to-left page
+/// keeps them as written.
+pub fn html(km: &Keymap, text: &dyn Text, title: &str) -> String {
+    let dir = if text.rtl() { "rtl" } else { "ltr" };
+    let title = escape_html(title);
+    let mut s = String::new();
+    let _ = write!(
+        s,
+        "<!DOCTYPE html>\n<html dir=\"{dir}\">\n<head>\n<meta charset=\"utf-8\">\n<title>{title}</title>\n<style>{CSS}</style>\n</head>\n<body>\n<h1>{title}</h1>\n"
+    );
+    for g in groups(km, text) {
+        let _ = writeln!(s, "<h2>{}</h2>\n<table>", escape_html(&g.name));
+        for (label, keys) in &g.rows {
+            let keys: String = keys.iter().map(|k| format!("<kbd dir=\"ltr\">{}</kbd>", escape_html(k))).collect();
+            let _ = writeln!(s, "<tr><th scope=\"row\">{}</th><td>{keys}</td></tr>", escape_html(label));
+        }
+        s.push_str("</table>\n");
+    }
+    s.push_str("</body>\n</html>\n");
+    s
+}
+
+/// Plain text titled `title`: a line per group, then `  label<TAB>shortcuts` per command.
+pub fn text(km: &Keymap, text: &dyn Text, title: &str) -> String {
+    let mut s = one_line(title);
+    s.push('\n');
+    for g in groups(km, text) {
+        let _ = write!(s, "\n{}\n", one_line(&g.name));
+        for (label, keys) in &g.rows {
+            let _ = writeln!(s, "  {}\t{}", one_line(label), one_line(&keys.join(", ")));
+        }
+    }
+    s
+}
diff --git a/crates/keymap/src/ui/text.rs b/crates/keymap/src/ui/text.rs
new file mode 100644
index 00000000..12dd0941
--- /dev/null
+++ b/crates/keymap/src/ui/text.rs
@@ -0,0 +1,388 @@
+//! The dialog's words: its own strings, command labels, menu path parts, key names and text
+//! direction, all supplied by the app through [`Text`].
+
+use std::borrow::Cow;
+
+use crate::chord::{Key, Platform, Trigger};
+use crate::keymap::Bindable;
+
+/// Where the dialog gets its words. Apps on craft-i18n pass [`I18nText`]; others implement the two
+/// required methods with their own lookup.
+pub trait Text {
+    /// The dialog's own strings, by English source text (listed in [`STRINGS`]). Placeholders
+    /// (`{chord}`, `{label}`, `{set}`, `{n}`) are filled after the lookup.
+    fn ui<'a>(&'a self, source: &'a str) -> Cow<'a, str>;
+    /// A count's wording with `{n}` filled in. `one` and `other` are the English forms.
+    fn plural(&self, n: u64, one: &str, other: &str) -> String;
+    /// A command's label.
+    fn command<'a>(&'a self, b: &'a Bindable) -> Cow<'a, str> {
+        b.label.as_str().into()
+    }
+    /// A menu path part or a scope name.
+    fn segment<'a>(&'a self, s: &'a str) -> Cow<'a, str> {
+        s.into()
+    }
+    /// Extra lines for a command's tooltip.
+    fn hint(&self, _b: &Bindable) -> Option<String> {
+        None
+    }
+    /// A key cap's name on `platform` (`Strg`, `Umschalt`); `None` keeps the crate's name.
+    fn key(&self, _k: Key, _p: Platform) -> Option<String> {
+        None
+    }
+    /// Whether the interface language is written right to left.
+    fn rtl(&self) -> bool {
+        false
+    }
+    /// A label or message put into display order (the app's bidi reordering). Chord text is never
+    /// passed here.
+    fn visual(&self, s: &str) -> String {
+        s.to_string()
+    }
+}
+
+/// [`Text`] over a craft-i18n catalog.
+pub struct I18nText<'a> {
+    pub i18n: &'a craft_i18n::I18n,
+    pub lang: craft_i18n::Lang,
+}
+
+impl Text for I18nText<'_> {
+    fn ui<'a>(&'a self, source: &'a str) -> Cow<'a, str> {
+        self.i18n.t(self.lang, source).into()
+    }
+
+    fn plural(&self, n: u64, one: &str, other: &str) -> String {
+        self.i18n.trn(self.lang, n, one, other)
+    }
+
+    fn command<'a>(&'a self, b: &'a Bindable) -> Cow<'a, str> {
+        self.i18n.tid(self.lang, &b.command.id, &b.label).into()
+    }
+
+    fn segment<'a>(&'a self, s: &'a str) -> Cow<'a, str> {
+        self.i18n.t(self.lang, s).into()
+    }
+
+    fn key(&self, k: Key, p: Platform) -> Option<String> {
+        // Glyphs (⌫, ↑) need no translation.
+        if p.is_mac() && k.mac_symbol() != k.text_name() {
+            return None;
+        }
+        self.i18n.get(self.lang, "key", k.text_name()).map(str::to_string)
+    }
+
+    fn rtl(&self) -> bool {
+        self.i18n.rtl(self.lang)
+    }
+}
+
+/// English [`Text`]: every string as written.
+pub struct English;
+
+impl Text for English {
+    fn ui<'a>(&'a self, source: &'a str) -> Cow<'a, str> {
+        source.into()
+    }
+
+    fn plural(&self, n: u64, one: &str, other: &str) -> String {
+        craft_i18n::fmt(if n == 1 { one } else { other }, &[("n", &n.to_string())])
+    }
+}
+
+/// A trigger as `platform` shows it, with key names from [`Text::key`]. Modifiers come in the
+/// order of [`Chord::display`](crate::Chord::display).
+pub fn trigger_text(text: &dyn Text, trigger: &Trigger, platform: Platform) -> String {
+    let key = trigger.chord.key;
+    let Some(name) = text.key(key, platform) else { return trigger.display(platform) };
+    let base = if platform.is_mac() { key.mac_symbol() } else { key.text_name() };
+    let one = trigger.chord.display(platform);
+    let one = match one.strip_suffix(base) {
+        Some(mods) => format!("{mods}{name}"),
+        None => one,
+    };
+    if trigger.double { format!("{one} {one}") } else { one }
+}
+
+/// `s` in display order with `chord`, text inside it, left as it is: chord text never goes
+/// through [`Text::visual`]. Right to left, the parts before and after the chord change sides.
+pub(crate) fn visual_around(text: &dyn Text, s: &str, chord: &str) -> String {
+    let Some(i) = s.find(chord).filter(|_| !chord.is_empty()) else { return text.visual(s) };
+    let (before, rest) = s.split_at(i);
+    let (before, after) = (text.visual(before), text.visual(&rest[chord.len()..]));
+    if text.rtl() { format!("{after}{chord}{before}") } else { format!("{before}{chord}{after}") }
+}
+
+/// Plural forms the dialog looks up, as `one|other`, the key of craft-i18n's `@plural` rows.
+pub const PLURALS: &[(&str, &str)] = &[
+    ("{n} shortcut is assigned more than once", "{n} shortcuts are assigned more than once"),
+    ("{n} saved shortcut could not be used", "{n} saved shortcuts could not be used"),
+    ("{n} command will change", "{n} commands will change"),
+    ("{n} item without a shortcut", "{n} items without a shortcut"),
+    ("{n} item not matched", "{n} items not matched"),
+    ("{n} item could not be read", "{n} items could not be read"),
+    ("{n} key read approximately", "{n} keys read approximately"),
+    ("{n} entry cut at a limit", "{n} entries cut at a limit"),
+    ("{n} command changed", "{n} commands changed"),
+    ("{n} shortcut also works in another scope", "{n} shortcuts also work in another scope"),
+    ("{n} entry was ignored: too many commands", "{n} entries were ignored: too many commands"),
+];
+
+/// Every source string the dialog looks up with [`Text::ui`], for the shared catalog.
+pub const STRINGS: &[&str] = &[
+    // Window and footer.
+    "Keyboard Shortcuts",
+    "Custom",
+    "OK",
+    "Cancel",
+    "Close",
+    "Undo",
+    "Redo",
+    "Reset All…",
+    "Restore every default shortcut in this set?",
+    "Reset All",
+    // Header.
+    "Show:",
+    "Filter:",
+    "Search:",
+    "Search by key",
+    "All Commands",
+    "{menu} Menu",
+    "Tools",
+    "{panel} Panel",
+    "Other",
+    "Fixed Keys",
+    "All",
+    "With Shortcut",
+    "Changed",
+    "Conflicts",
+    "No matching commands",
+    "(cycles)",
+    "{label} (cycles)",
+    "{label} (Changed)",
+    // Table and detail pane.
+    "Command",
+    "Commands",
+    "Detail pane size",
+    "Select a command to see and change its shortcuts",
+    "Shortcut",
+    "Default",
+    "{chord} (Default)",
+    "{chord} ({scope})",
+    "{label} ({scope})",
+    "Application",
+    "Current shortcuts:",
+    "New shortcut:",
+    "New shortcut: {chord}",
+    "press keys",
+    "{chord} (press again for a double press)",
+    "Type…",
+    "Context:",
+    "Assign",
+    "Use Default",
+    "Clear",
+    "Default: {chord}",
+    "None",
+    "Currently assigned to:",
+    "Not assigned",
+    "{label} ({scope}, both work)",
+    "Add a shortcut to {label}",
+    "Remove {chord} from {label}",
+    "Restore the default for {label}",
+    "{label}: {chord}",
+    "{label}: press keys",
+    "Now used by {label}",
+    "{label}: {chord} (Now used by {holder})",
+    // Typed shortcuts and saved texts that do not parse.
+    "the shortcut has no key",
+    "unknown modifier {key}",
+    "modifier {key} given twice",
+    "key sequences are not supported",
+    "the scope name is not valid",
+    // On-screen keyboard.
+    "Keyboard",
+    "Keyboard: US",
+    "Keyboard: US (macOS)",
+    "Control",
+    "Option",
+    "Shift",
+    "Ctrl",
+    "Alt",
+    "Caps Lock",
+    "Win",
+    "Super",
+    "Panel or context",
+    "Both",
+    "Modifier on",
+    "{chord}: {label}",
+    "Click a key to see its shortcuts",
+    "Key: {key}",
+    "Assign to Selected",
+    "Assign {chord} to {label}",
+    "Select a command first",
+    "Nothing uses this key",
+    // Messages and conflicts.
+    "⚠ {chord} is used by {label}",
+    "{chord} was removed from {label}",
+    "Also used by {label}",
+    "{chord} is reserved by the system",
+    "A command can have at most {n} shortcuts",
+    "The scope {scope} is unknown",
+    "Too many shortcuts are assigned",
+    "This command is unknown",
+    "Take It",
+    "Take It and Go to Conflict",
+    "Keep Both",
+    "Go to Conflict",
+    "Cancel the new shortcut",
+    "Dismiss",
+    // Saved shortcuts that could not be used.
+    "{key}: no command has this name",
+    "{key}: “{text}” is not a shortcut ({error})",
+    "{key}: {text} is reserved by the system",
+    "{key}: the scope in “{text}” is unknown",
+    "{key}: listed more than once",
+    "{key}: part of the entry was dropped",
+    // Sets.
+    "Set:",
+    "(modified)",
+    "New Set…",
+    "Rename…",
+    "Delete",
+    "Save",
+    "Revert Set",
+    "Import…",
+    "Export",
+    "Export…",
+    "Summarize…",
+    "{title}: {set}",
+    "Create",
+    "Rename",
+    "More",
+    "Name:",
+    "Based on:",
+    "Current shortcuts",
+    "Save changes to “{set}”?",
+    "Don't Save",
+    "Delete the set “{set}”?",
+    "Keyboard Shortcuts (JSON)",
+    "The name is empty, too long or has control characters",
+    "A set with this name exists",
+    "The set was not found",
+    "Built-in sets cannot be changed",
+    "There are too many sets",
+    "This is not a shortcut set file",
+    "This is not a craft-keymap file",
+    "This file is from a newer version (format {n})",
+    "The file is too large",
+    // Import review.
+    "Import “{set}”",
+    "Set name:",
+    "Import",
+    "Cancel Import",
+    "line {n}",
+    "Will change",
+    "Not matched",
+    "Unreadable",
+    "Approximated",
+    "{title} ({n})",
+    "Suggestions ({n})",
+    "numeric keypad key read as main key",
+    "Matched without change",
+    "Command for {item}",
+    "Choose a command…",
+    "no command has this name",
+    "more than one command fits",
+    "in a context that is not imported",
+    "only a command of the other kind fits (tool or menu command)",
+    "empty shortcut",
+    "the shortcut is too long",
+    "unknown key {key}",
+    "unsupported modifier {key}",
+    "{label} keeps its shortcuts (matched by a panel menu name)",
+    "Import as New Set",
+    "Imported",
+    "Imported as “{set}”",
+    "Skipped",
+    "Taken from other commands",
+    "Not changed",
+    "taken by {label}",
+    "taken by a later entry",
+    "reserved by the system",
+    "the scope is unknown",
+    "the set's shortcuts could not be added",
+    "the shortcuts could not be removed",
+    "Copy Report",
+    "Done",
+];
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::chord::Chord;
+
+    struct German;
+    impl Text for German {
+        fn ui<'a>(&'a self, source: &'a str) -> Cow<'a, str> {
+            source.into()
+        }
+        fn plural(&self, n: u64, _one: &str, other: &str) -> String {
+            other.replace("{n}", &n.to_string())
+        }
+        fn key(&self, k: Key, _p: Platform) -> Option<String> {
+            (k == Key::Delete).then(|| "Entf".to_string())
+        }
+    }
+
+    #[test]
+    fn trigger_text_uses_localized_key_names() -> Result<(), crate::ParseError> {
+        let t = Trigger::parse("Cmd+Shift+Delete")?;
+        assert_eq!(trigger_text(&German, &t, Platform::Windows), "Ctrl+Shift+Entf");
+        assert_eq!(trigger_text(&German, &Trigger::parse("F7 F7")?, Platform::Windows), "F7 F7");
+        assert_eq!(trigger_text(&English, &Trigger::single(Chord::parse("⇧⌘Z")?), Platform::Mac), "⇧⌘Z");
+        Ok(())
+    }
+
+    /// Every `ui("…")` and `plural(n, "…", "…")` literal in the dialog's sources is listed.
+    #[test]
+    fn every_looked_up_string_is_listed() {
+        let sources = [
+            include_str!("mod.rs"),
+            include_str!("state.rs"),
+            include_str!("rows.rs"),
+            include_str!("capture.rs"),
+            include_str!("view.rs"),
+            include_str!("keyboard.rs"),
+            include_str!("style.rs"),
+            include_str!("sets.rs"),
+            include_str!("review.rs"),
+            include_str!("summary.rs"),
+        ];
+        let mut missing = Vec::new();
+        for src in sources {
+            let src = src.split("#[cfg(test)]").next().unwrap_or(src);
+            for (i, open) in src.match_indices(".ui(\"") {
+                let rest = &src[i + open.len()..];
+                if let Some(end) = rest.find('"') {
+                    let s = &rest[..end];
+                    if !STRINGS.contains(&s) {
+                        missing.push(s.to_string());
+                    }
+                }
+            }
+            for (i, _) in src.match_indices(".plural(") {
+                let quoted: Vec<&str> = src[i..].split('"').skip(1).step_by(2).take(2).collect();
+                if let [one, other] = quoted[..]
+                    && !PLURALS.contains(&(one, other))
+                {
+                    missing.push(format!("{one}|{other}"));
+                }
+            }
+        }
+        assert!(missing.is_empty(), "not in STRINGS or PLURALS: {missing:?}");
+        let mut sorted = STRINGS.to_vec();
+        sorted.sort_unstable();
+        sorted.dedup();
+        assert_eq!(sorted.len(), STRINGS.len(), "STRINGS has duplicates");
+    }
+}
diff --git a/crates/keymap/src/ui/view.rs b/crates/keymap/src/ui/view.rs
new file mode 100644
index 00000000..56b65c6d
--- /dev/null
+++ b/crates/keymap/src/ui/view.rs
@@ -0,0 +1,1517 @@
+//! Drawing the dialog: header, table, detail pane, conflict bar, messages and footer.
+//!
+//! Widgets are created in focus order (§2.10 of the dialog plan): set row, Show, Filter, Search,
+//! ⌨, table, detail pane, conflict bar, footer. egui's Tab order is creation order, so the bars
+//! under the table are drawn last even though their height is needed first: the view uses last
+//! frame's height and asks egui to discard a frame whose height changed.
+
+use std::ops::Range;
+use std::sync::Arc;
+
+use craft_ui::buttons::{IconButton, IconButtonStyle};
+use craft_ui::layout::{ResizeHandle, SplitAxis, SplitSize, split_rect};
+use craft_ui::tabs::{self, Tab};
+use egui::Galley;
+use egui::accesskit::Live;
+use egui::text::{LayoutJob, TextFormat, TextWrapping};
+use egui::{
+    Align, Button, Color32, ComboBox, EventFilter, Id, Key as EguiKey, Label, Layout, Modifiers, Painter, Rect, Response, RichText, Role, ScrollArea,
+    Sense, Stroke, StrokeKind, TextEdit, TextStyle, Ui, UiBuilder, Vec2, WidgetInfo, WidgetText, pos2, vec2,
+};
+
+use crate::chord::Trigger;
+use crate::command::CommandRef;
+use crate::keymap::{Binding, MAX_BINDINGS, Problem};
+use crate::scope::Scope;
+use crate::ui::capture;
+use crate::ui::rows::{AreaId, Filter, FixedLine, Line, Row};
+use crate::ui::state::{Answer, DialogState, Env, Prompt, Recording, Target, binding_error};
+use crate::ui::style::{self, DialogStyle};
+use crate::ui::text::{trigger_text, visual_around};
+
+#[path = "keyboard.rs"]
+pub(crate) mod keyboard;
+#[path = "review.rs"]
+mod review;
+#[path = "sets.rs"]
+mod sets;
+
+/// Below this width the detail pane goes under the table.
+const NARROW: f32 = 720.0;
+/// Smallest table or detail pane when dragging the divider.
+const SPLIT_MIN: f32 = 120.0;
+/// Icon buttons in rows and bars.
+const ICON: f32 = 20.0;
+/// Padding inside a chip.
+const CHIP_PAD: f32 = 5.0;
+const CHIP_GAP: f32 = 4.0;
+/// The detail pane's New Shortcut field.
+const FIELD_W: f32 = 160.0;
+/// The widest Show, Filter or Set combo box; longer names are cut with "…".
+const COMBO_MAX: f32 = 200.0;
+/// Search field width.
+const SEARCH_MIN: f32 = 120.0;
+const SEARCH_MAX: f32 = 240.0;
+
+/// One frame of the dialog body inside `ui`'s available rectangle.
+pub(crate) fn body(ui: &mut Ui, env: &mut Env, state: &mut DialogState) {
+    let style = env.options.style.unwrap_or_else(|| DialogStyle::from_visuals(ui.visuals()));
+    let icons = style::icon_buttons(ui.visuals());
+    let row_h = ui.text_style_height(&TextStyle::Body) + 6.0;
+    let base = ui.scope_id().with("craft_keymap_shortcuts");
+    let mut d = Draw { env, state, style, icons, base, row_h };
+    d.keys(ui);
+    d.layout(ui);
+}
+
+struct Draw<'s, 'e> {
+    env: &'s mut Env<'e>,
+    state: &'s mut DialogState,
+    style: DialogStyle,
+    icons: IconButtonStyle,
+    base: Id,
+    row_h: f32,
+}
+
+fn fill(source: String, args: &[(&str, &str)]) -> String {
+    craft_i18n::fmt(&source, args)
+}
+
+/// What a click in the table asked for, applied after the rows are drawn.
+enum RowAction {
+    Select(CommandRef),
+    Record(CommandRef, Option<Binding>, usize),
+    Reset(CommandRef),
+    Toggle(String),
+}
+
+impl Draw<'_, '_> {
+    // ---- Text ----
+
+    /// The dialog's string, translated (logical order: for accessibility labels and `fill`).
+    fn ui(&self, source: &str) -> String {
+        self.env.text.ui(source).into_owned()
+    }
+
+    /// Display order for drawn text.
+    fn vis(&self, s: &str) -> String {
+        self.env.text.visual(s)
+    }
+
+    fn rtl(&self) -> bool {
+        self.env.text.rtl()
+    }
+
+    /// Parts in logical order, each already in display order, put into display order: reversed in
+    /// a right-to-left interface, where the path separator ` › ` becomes ` ‹ `.
+    fn ordered<T>(&self, mut parts: Vec<(String, T)>) -> Vec<(String, T)> {
+        if self.rtl() {
+            parts.reverse();
+            for (s, _) in &mut parts {
+                if s == PATH_SEP {
+                    *s = " ‹ ".into();
+                }
+            }
+        }
+        parts
+    }
+
+    /// [`ordered`](Self::ordered) parts as one string.
+    fn joined(&self, parts: Vec<String>) -> String {
+        self.ordered(parts.into_iter().map(|s| (s, ())).collect()).into_iter().map(|(s, ())| s).collect()
+    }
+
+    /// Display-order `parts` on one line within `width`, cut with "…" when they do not fit: at
+    /// the end, or at the start in a right-to-left interface, where the logical end of the text is
+    /// on the left. Returns the galley and whether it was cut.
+    fn one_line(&self, painter: &Painter, parts: &[(String, TextFormat)], width: f32) -> (Arc<Galley>, bool) {
+        let width = width.max(0.0);
+        let job = |skip: usize| {
+            let mut job = LayoutJob::default();
+            if let (true, Some((_, f))) = (skip > 0, parts.first()) {
+                job.append("…", 0.0, f.clone());
+            }
+            let mut left = skip;
+            for (s, f) in parts {
+                let n = s.chars().count();
+                if left >= n {
+                    left -= n;
+                    continue;
+                }
+                let start = s.char_indices().nth(left).map_or(s.len(), |(i, _)| i);
+                left = 0;
+                job.append(&s[start..], 0.0, f.clone());
+            }
+            job
+        };
+        let full = painter.layout_job(job(0));
+        if full.size().x <= width + 0.5 {
+            return (full, false);
+        }
+        if !self.rtl() {
+            let mut cut = job(0);
+            cut.wrap = TextWrapping::truncate_at_width(width);
+            return (painter.layout_job(cut), true);
+        }
+        // The fewest characters to drop from the start so that "…" and the rest fit.
+        let total: usize = parts.iter().map(|(s, _)| s.chars().count()).sum();
+        let (mut lo, mut hi) = (1, total);
+        while lo < hi {
+            let mid = (lo + hi) / 2;
+            if painter.layout_job(job(mid)).size().x <= width + 0.5 { hi = mid } else { lo = mid + 1 }
+        }
+        (painter.layout_job(job(lo)), true)
+    }
+
+    /// `s` in display order with `chord`, text inside it, left as it is: chord text never goes
+    /// through [`Text::visual`](crate::ui::Text::visual).
+    fn vis_chord(&self, s: &str, chord: &str) -> String {
+        visual_around(self.env.text, s, chord)
+    }
+
+    /// `text` after a ⚠, in display order.
+    fn warned(&self, text: String) -> String {
+        self.joined(vec!["⚠".into(), " ".into(), text])
+    }
+
+    /// Horizontal placement inside `rect`, mirrored in a right-to-left interface.
+    fn mirror(&self, rect: Rect) -> Mirror {
+        Mirror { on: self.rtl(), sum: rect.min.x + rect.max.x }
+    }
+
+    fn chord(&self, t: &Trigger) -> String {
+        trigger_text(self.env.text, t, self.env.keymap.platform())
+    }
+
+    fn scope_name(&self, s: &Scope) -> String {
+        if s.is_app() { self.ui("Application") } else { self.env.text.segment(s.as_str()).into_owned() }
+    }
+
+    /// A binding as text, with its scope when that is not the command's home scope.
+    fn binding_text(&self, b: &Binding, home: Option<&Scope>) -> String {
+        let chord = self.chord(&b.trigger);
+        match &b.scope {
+            Some(s) if Some(s) != home => fill(self.ui("{chord} ({scope})"), &[("chord", &chord), ("scope", &self.scope_name(s))]),
+            _ => chord,
+        }
+    }
+
+    /// A menu path in display order: "File › Export", "Export ‹ File" right to left.
+    fn path_text(&self, path: &[String]) -> String {
+        let mut parts = Vec::new();
+        for (i, s) in path.iter().enumerate() {
+            if i > 0 {
+                parts.push(PATH_SEP.to_string());
+            }
+            parts.push(self.vis(&self.env.text.segment(s)));
+        }
+        self.joined(parts)
+    }
+
+    fn label_of(&self, command: &CommandRef) -> String {
+        self.env.keymap.bindable(command).map_or_else(|| command.id.clone(), |b| self.env.text.command(b).into_owned())
+    }
+
+    /// "press keys", or the chord waiting for a second press.
+    fn recording_text(&self) -> String {
+        match self.state.recording.as_ref().and_then(|r| r.waiting.as_ref()) {
+            Some((t, _)) => {
+                let chord = self.chord(t);
+                self.vis_chord(&fill(self.ui("{chord} (press again for a double press)"), &[("chord", &chord)]), &chord)
+            }
+            None => self.ui("press keys"),
+        }
+    }
+
+    /// Reports a control to [`Options::on_widget`](crate::ui::Options::on_widget).
+    fn tag(&self, id: impl FnOnce() -> String, rect: Rect, label: &str) {
+        if let Some(f) = &self.env.options.on_widget {
+            f(&id(), rect, label);
+        }
+    }
+
+    fn button(&self, ui: &mut Ui, enabled: bool, text: &str, id: &str) -> bool {
+        let r = ui.add_enabled(enabled, Button::new(self.vis(text)));
+        self.tag(|| id.to_string(), r.rect, text);
+        r.clicked()
+    }
+
+    /// The width a [`Button`] with `text` takes.
+    fn button_width(&self, ui: &Ui, text: &str) -> f32 {
+        let pad = ui.spacing().button_padding.x * 2.0;
+        let g = WidgetText::from(self.vis(text)).into_galley(ui, Some(egui::TextWrapMode::Extend), f32::INFINITY, TextStyle::Button);
+        (g.size().x + pad).max(ui.spacing().interact_size.x)
+    }
+
+    fn icon_button(&self, ui: &mut Ui, label: &str, selected: bool, paint: fn(&Painter, Rect, Color32)) -> Response {
+        IconButton::new(label, Vec2::splat(ICON), &self.icons).selected(selected).show(ui, |ui, rect, color| paint(ui.painter(), rect, color))
+    }
+
+    /// A row control: clickable and labeled but not a Tab stop (the table is one).
+    fn row_button(&self, ui: &mut Ui, rect: Rect, id: Id, label: &str, enabled: bool, paint: fn(&Painter, Rect, Color32)) -> Response {
+        let resp = ui.interact(rect, id, if enabled { Sense::CLICK } else { Sense::hover() });
+        resp.widget_info(|| WidgetInfo::labeled(Role::Button, enabled, label));
+        let v = if !enabled {
+            self.icons.normal
+        } else if resp.is_pointer_button_down_on() {
+            self.icons.pressed.unwrap_or(self.icons.hovered)
+        } else if resp.hovered() {
+            self.icons.hovered
+        } else {
+            self.icons.normal
+        };
+        if v.fill != Color32::TRANSPARENT {
+            ui.painter().rect_filled(rect, self.icons.corner_radius, v.fill);
+        }
+        let color = if enabled { v.icon } else { self.style.dim.gamma_multiply(0.6) };
+        paint(ui.painter(), rect, color);
+        resp
+    }
+
+    /// Marks a text field of the dialog, so Escape, Enter, Undo and Delete leave it alone.
+    fn text_field(&mut self, r: &Response) {
+        if r.has_focus() {
+            self.state.text_focus = true;
+        }
+    }
+
+    fn recording_target(&self) -> Option<&Target> {
+        self.state.recording.as_ref().map(|r: &Recording| &r.target)
+    }
+
+    // ---- Keys when nothing records ----
+
+    /// Escape, Undo/Redo and Enter (§2.5). Keys while recording were taken by `DialogState::input`.
+    fn keys(&mut self, ui: &Ui) {
+        if self.state.is_recording() {
+            return;
+        }
+        let text_focus = self.state.text_focus;
+        let popup = egui::Popup::is_any_open(ui.ctx());
+        if !text_focus && !popup && ui.input_mut(|i| i.consume_key(Modifiers::NONE, EguiKey::Escape)) {
+            if self.state.typing.take().is_some() {
+                self.state.type_error = None;
+            } else {
+                self.state.escape(self.env);
+            }
+            return;
+        }
+        if text_focus || !self.env.options.editable || self.state.modal() {
+            return;
+        }
+        let mac = self.env.keymap.platform().is_mac();
+        let (undo, redo) = ui.input_mut(|i| {
+            let redo = i.consume_key(Modifiers::COMMAND | Modifiers::SHIFT, EguiKey::Z) || (!mac && i.consume_key(Modifiers::COMMAND, EguiKey::Y));
+            let undo = !redo && i.consume_key(Modifiers::COMMAND, EguiKey::Z);
+            (undo, redo)
+        });
+        if redo {
+            self.state.redo(self.env);
+        } else if undo {
+            self.state.undo(self.env);
+        }
+        if self.env.options.enter_is_ok
+            && self.state.prompt.is_none()
+            && ui.memory(|m| m.focused().is_none())
+            && ui.input_mut(|i| i.consume_key(Modifiers::NONE, EguiKey::Enter))
+        {
+            self.state.enter(self.env);
+        }
+    }
+
+    // ---- Layout ----
+
+    fn layout(&mut self, ui: &mut Ui) {
+        let avail = ui.available_rect_before_wrap();
+        let size = |v: f32, or: f32| if v.is_finite() { v.clamp(0.0, 4096.0) } else { or };
+        let full = Rect::from_min_size(avail.min, vec2(size(avail.width(), 800.0), size(avail.height(), 600.0)));
+        self.state.text_focus = false;
+        let gap = ui.spacing().item_spacing.y;
+        let column = self.column();
+        ui.scope_builder(UiBuilder::new().max_rect(full).layout(column), |ui| {
+            self.sets_row(ui);
+            // Show, Filter and Search act on the table, which the import review replaces.
+            ui.add_enabled_ui(self.state.review.is_none(), |ui| self.header(ui));
+            let rest = ui.available_rect_before_wrap();
+            let bottom_h = self.state.bottom_h.clamp(0.0, rest.height());
+            let mid_bottom = (rest.max.y - bottom_h - gap).max(rest.min.y);
+            let mid = Rect::from_min_max(rest.min, pos2(rest.max.x, mid_bottom));
+            if !self.review(ui, mid) {
+                let prompt = self.state.prompt.is_some();
+                ui.scope(|ui| {
+                    if prompt {
+                        ui.disable();
+                    }
+                    self.middle(ui, mid);
+                });
+            }
+            let top = (mid.max.y + gap).min(rest.max.y);
+            let bottom = Rect::from_min_max(pos2(rest.min.x, top), rest.max);
+            let used = ui.scope_builder(UiBuilder::new().max_rect(bottom).layout(column), |ui| self.bottom(ui)).response.rect.height();
+            if (used - self.state.bottom_h).abs() > 0.5 {
+                self.state.bottom_h = used;
+                ui.ctx().request_discard("shortcuts dialog: height of the bars under the table");
+            }
+        });
+        ui.advance_cursor_after_rect(full);
+    }
+
+    /// Top to bottom, aligned to the reading side. In a right-to-left interface egui's
+    /// `horizontal` rows inside such a column also run right to left.
+    fn column(&self) -> Layout {
+        Layout::top_down(if self.env.text.rtl() { Align::Max } else { Align::Min })
+    }
+
+    fn child(&mut self, ui: &mut Ui, rect: Rect, f: impl FnOnce(&mut Self, &mut Ui)) {
+        let column = self.column();
+        ui.scope_builder(UiBuilder::new().max_rect(rect).layout(column), |ui| {
+            ui.set_clip_rect(rect.intersect(ui.clip_rect()));
+            f(self, ui);
+        });
+    }
+
+    // ---- Header: Show, Filter, Search ----
+
+    fn area_key(id: &AreaId) -> String {
+        match id {
+            AreaId::All => "all".into(),
+            AreaId::Menu(m) => format!("menu.{m}"),
+            AreaId::Tools => "tools".into(),
+            AreaId::Panel(p) => format!("panel.{p}"),
+            AreaId::Other => "other".into(),
+            AreaId::App(a) => (*a).to_string(),
+            AreaId::Fixed => "fixed".into(),
+        }
+    }
+
+    fn header(&mut self, ui: &mut Ui) {
+        if self.env.options.area_tabs {
+            self.area_tabs(ui);
+        }
+        // Show and Filter, then Search, ⌨ and Keyboard; Search goes to a row of its own when the
+        // two do not fit side by side.
+        let gap = ui.spacing().item_spacing.x;
+        let text_w = |d: &Self, ui: &Ui, s: &str| d.button_width(ui, s) - ui.spacing().button_padding.x * 2.0;
+        let mut first = text_w(self, ui, &self.ui("Filter:")) + COMBO_MAX + 2.0 * gap;
+        if !self.env.options.area_tabs {
+            first += text_w(self, ui, &self.ui("Show:")) + COMBO_MAX + 2.0 * gap;
+        }
+        let toggle = if self.env.options.keyboard { self.button_width(ui, &self.ui("Keyboard")) + gap } else { 0.0 };
+        let second = text_w(self, ui, &self.ui("Search:")) + SEARCH_MIN + ICON + toggle + 3.0 * gap;
+        let one_row = first + second <= ui.available_width();
+        ui.horizontal(|ui| {
+            if !self.env.options.area_tabs {
+                self.area_combo(ui);
+            }
+            self.filter_combo(ui);
+            if one_row {
+                self.search(ui, toggle);
+            }
+        });
+        if !one_row {
+            ui.horizontal(|ui| self.search(ui, toggle));
+        }
+    }
+
+    /// A combo box at most [`COMBO_MAX`] wide, its text cut with "…" and shown in full on hover.
+    fn combo(&self, ui: &mut Ui, salt: &str, label: &Response, title: &str, current: &str, items: impl FnOnce(&mut Ui)) -> Response {
+        let full = self.vis(current);
+        let natural = self.button_width(ui, &full) + ui.spacing().icon_width + ui.spacing().icon_spacing;
+        let width = natural.clamp(ui.spacing().combo_width, COMBO_MAX);
+        let r = ui
+            .allocate_ui(vec2(width, ui.spacing().interact_size.y), |ui| {
+                ComboBox::from_id_salt(self.base.with(salt)).width(width).truncate().selected_text(full.clone()).show_ui(ui, items).response
+            })
+            .inner
+            .labelled_by(label.id);
+        self.tag(|| format!("shortcuts.{salt}"), r.rect, title);
+        if natural > width { r.on_hover_text(full) } else { r }
+    }
+
+    fn filter_combo(&mut self, ui: &mut Ui) {
+        let filter_label = self.ui("Filter:");
+        let l = ui.label(self.vis(&filter_label));
+        let current = self.state.filter.label(self.env.text);
+        let mut pick = None;
+        self.combo(ui, "filter", &l, &filter_label, &current, |ui| {
+            for f in Filter::ALL {
+                let label = f.label(self.env.text);
+                if ui.selectable_label(self.state.filter == f, self.vis(&label)).clicked() {
+                    pick = Some(f);
+                }
+            }
+        });
+        if let Some(f) = pick {
+            self.state.set_filter(f);
+        }
+    }
+
+    /// Search, search by key and the keyboard pane's toggle (`toggle` wide, 0 without it).
+    fn search(&mut self, ui: &mut Ui, toggle: f32) {
+        let search_label = self.ui("Search:");
+        let l = ui.label(self.vis(&search_label));
+        let mut q = self.state.query.clone();
+        let gap = ui.spacing().item_spacing.x;
+        let width = (ui.available_width() - ICON - toggle - 2.0 * gap).clamp(SEARCH_MIN.min(ui.available_width()), SEARCH_MAX);
+        let edit = ui.add(TextEdit::singleline(&mut q).id(self.base.with("search")).desired_width(width)).labelled_by(l.id);
+        self.text_field(&edit);
+        self.tag(|| "shortcuts.search".into(), edit.rect, &search_label);
+        if edit.changed() {
+            self.state.set_query(q);
+        }
+
+        let key_label = self.ui("Search by key");
+        let searching = self.recording_target() == Some(&Target::Search);
+        let r = self.icon_button(ui, &key_label, searching, paint_keyboard).on_hover_text(self.vis(&key_label));
+        self.tag(|| "shortcuts.searchKey".into(), r.rect, &key_label);
+        if r.clicked() {
+            if searching {
+                self.state.stop_recording();
+            } else {
+                self.state.record(self.env, Target::Search);
+                r.request_focus();
+            }
+        }
+        if self.recording_target() == Some(&Target::Search) {
+            if r.lost_focus() {
+                self.state.stop_recording();
+            } else if r.has_focus() || r.clicked() {
+                capture::lock_focus(ui, r.id);
+            }
+        } else if r.has_focus() {
+            capture::unlock_focus(ui, r.id);
+        }
+        self.keyboard_toggle(ui);
+    }
+
+    fn area_combo(&mut self, ui: &mut Ui) {
+        let show = self.ui("Show:");
+        let l = ui.label(self.vis(&show));
+        let current = self.state.areas.iter().find(|a| a.id == self.state.area).map_or_else(String::new, |a| a.label.clone());
+        let mut pick = None;
+        let areas = self.state.areas.clone();
+        self.combo(ui, "area", &l, &show, &current, |ui| {
+            for a in &areas {
+                let r = ui.selectable_label(a.id == self.state.area, self.vis(&a.label));
+                self.tag(|| format!("shortcuts.area.{}", Self::area_key(&a.id)), r.rect, &a.label);
+                if r.clicked() {
+                    pick = Some(a.id.clone());
+                }
+            }
+        });
+        if let Some(a) = pick {
+            self.state.set_area(a);
+        }
+    }
+
+    /// Show as tabs, with the ones that do not fit in a menu.
+    fn area_tabs(&mut self, ui: &mut Ui) {
+        let areas = self.state.areas.clone();
+        let pad = ui.spacing().button_padding.x * 2.0;
+        let font = TextStyle::Button.resolve(ui.style());
+        let natural: Vec<f32> =
+            areas.iter().map(|a| ui.painter().layout_no_wrap(self.vis(&a.label), font.clone(), Color32::WHITE).size().x + pad).collect();
+        let selected = areas.iter().position(|a| a.id == self.state.area).unwrap_or(0);
+        let (rect, _) = ui.allocate_exact_size(vec2(ui.available_width(), ui.spacing().interact_size.y + 4.0), Sense::hover());
+        let fit = tabs::fit(&natural, selected, rect.width(), 48.0, ICON + 8.0);
+        let m = self.mirror(rect);
+        let mut x = rect.min.x;
+        let mut pick = None;
+        for &(i, w) in &fit.shown {
+            let Some(a) = areas.get(i) else { continue };
+            let r = m.rect(Rect::from_min_size(pos2(x, rect.min.y), vec2(w, rect.height())));
+            x += w;
+            let on = i == selected;
+            let id = self.base.with(("area", i));
+            let text = self.vis(&a.label);
+            let accent = self.style.accent;
+            let resp = Tab::new(id, &a.label, on).show_at(ui, r, |ui, resp| {
+                let v = ui.visuals();
+                let color = if on { v.strong_text_color() } else { v.text_color() };
+                if resp.hovered() && !on {
+                    ui.painter().rect_filled(r, 2.0, v.widgets.hovered.weak_bg_fill);
+                }
+                if on {
+                    ui.painter().line_segment([r.left_bottom(), r.right_bottom()], Stroke::new(2.0, accent));
+                }
+                let (g, _) = self.one_line(ui.painter(), &[(text, TextFormat::simple(font.clone(), color))], r.width() - 4.0);
+                ui.painter().galley(r.center() - g.size() / 2.0, g, color);
+            });
+            self.tag(|| format!("shortcuts.area.{}", Self::area_key(&a.id)), resp.rect, &a.label);
+            if resp.clicked() {
+                pick = Some(a.id.clone());
+            }
+        }
+        if !fit.overflow.is_empty() {
+            let r = m.rect(Rect::from_min_size(pos2(rect.max.x - fit.overflow_width, rect.min.y), vec2(fit.overflow_width, rect.height())));
+            let more = self.ui("More");
+            ui.scope_builder(UiBuilder::new().max_rect(r), |ui| {
+                ui.menu_button(self.vis(&more), |ui| {
+                    for &i in &fit.overflow {
+                        if let Some(a) = areas.get(i)
+                            && ui.button(self.vis(&a.label)).clicked()
+                        {
+                            pick = Some(a.id.clone());
+                        }
+                    }
+                });
+            });
+        }
+        if let Some(a) = pick {
+            self.state.set_area(a);
+        }
+    }
+
+    // ---- Table and detail pane ----
+
+    /// The table and detail pane, with the keyboard pane under both when it is on.
+    fn middle(&mut self, ui: &mut Ui, mid: Rect) {
+        let Some(kb_h) = self.keyboard_height(mid.height()) else {
+            self.table_and_detail(ui, mid);
+            return;
+        };
+        let gap = ui.spacing().item_spacing.y;
+        let top = Rect::from_min_max(mid.min, pos2(mid.max.x, mid.max.y - kb_h - gap));
+        let pane = Rect::from_min_max(pos2(mid.min.x, mid.max.y - kb_h), mid.max);
+        self.table_and_detail(ui, top);
+        self.child(ui, pane, |d, ui| d.keyboard_pane(ui));
+    }
+
+    fn table_and_detail(&mut self, ui: &mut Ui, mid: Rect) {
+        let wide = mid.width() >= NARROW;
+        let axis = if wide { SplitAxis::Horizontal } else { SplitAxis::Vertical };
+        // Right to left: the detail pane goes on the left.
+        let swap = wide && self.env.text.rtl();
+        let ratio = if swap { 1.0 - self.state.split } else { self.state.split };
+        let extent = if wide { mid.width() } else { mid.height() };
+        let Some(split) = split_rect(mid, axis, SplitSize::Ratio(ratio), 8.0, SPLIT_MIN.min(extent / 3.0)) else { return };
+        let (table, detail) = if swap { (split.second, split.first) } else { (split.first, split.second) };
+        self.child(ui, table, |d, ui| d.table(ui));
+        let label = self.ui("Detail pane size");
+        let resp = ResizeHandle::new(self.base.with("split"), axis, split.divider, &label, style::divider(ui.visuals()))
+            .value(split.first_size(), 0.0..=split.available())
+            .show(ui);
+        let line = ui.visuals().widgets.noninteractive.bg_stroke;
+        let c = split.divider.center();
+        let ends = if wide {
+            [pos2(c.x, split.divider.min.y), pos2(c.x, split.divider.max.y)]
+        } else {
+            [pos2(split.divider.min.x, c.y), pos2(split.divider.max.x, c.y)]
+        };
+        ui.painter().line_segment(ends, line);
+        if resp.delta != 0.0
+            && let Some(SplitSize::Ratio(r)) = split.resized(SplitSize::Ratio(ratio), resp.delta, SPLIT_MIN)
+        {
+            self.state.split = if swap { 1.0 - r } else { r };
+        }
+        self.child(ui, detail, |d, ui| d.detail(ui));
+    }
+
+    /// Width of the shortcut column: the widest row of chips plus "+", within 40 % of the table.
+    fn shortcut_width(&self, ui: &Ui, width: f32) -> f32 {
+        let font = TextStyle::Body.resolve(ui.style());
+        let chip_w = |text: &str| ui.painter().layout_no_wrap(text.to_string(), font.clone(), Color32::WHITE).size().x + 2.0 * CHIP_PAD + CHIP_GAP;
+        let chips = self
+            .state
+            .lines_cached()
+            .iter()
+            .filter_map(|l| if let Line::Row(r) = l { Some(r.chips.iter().map(|c| chip_w(&c.text)).sum::<f32>()) } else { None })
+            .fold(0.0, f32::max);
+        (chips + ICON + CHIP_GAP).max(110.0).min(width * 0.4)
+    }
+
+    /// Draw the command table and own its keyboard focus and row navigation.
+    ///
+    /// The table is a focusable non-interactive region. While focused and not recording, arrow,
+    /// Home/End, Enter and Delete are consumed by `table_keys`; while a shortcut cell is recording,
+    /// focus uses `FOCUS_LOCK` so the recording receives keys, and losing focus stops recording.
+    /// Rows are built from the cached lines, reveal scrolling centers the selected row when needed,
+    /// and the selected rendered row becomes the active accessibility descendant. Dispatched row
+    /// actions select, record, reset or toggle a group; group toggles keep focus, other actions
+    /// refocus the table.
+    fn table(&mut self, ui: &mut Ui) {
+        let rect = ui.max_rect();
+        let table_id = self.base.with("table");
+        let focus = ui.interact(rect, table_id, Sense::focusable_noninteractive());
+        let commands = self.ui("Commands");
+        focus.widget_info(|| WidgetInfo::labeled(Role::Unknown, true, &commands));
+        let has_focus = focus.has_focus();
+        if has_focus && !self.state.is_recording() {
+            self.table_keys(ui);
+        }
+        let recording_cell = matches!(self.recording_target(), Some(Target::Cell { .. }));
+        if recording_cell && focus.lost_focus() {
+            self.state.stop_recording();
+        }
+        if has_focus {
+            let filter = if recording_cell {
+                capture::FOCUS_LOCK
+            } else {
+                EventFilter { vertical_arrows: true, horizontal_arrows: true, tab: false, escape: false }
+            };
+            ui.memory_mut(|m| m.set_focus_lock_filter(table_id, filter));
+        }
+
+        let selected = self.state.selected.clone();
+        let built = self.state.lines(self.env);
+        let (count, matches) = (built.lines.len(), built.matches);
+        let position = selected.as_ref().and_then(|c| built.position(c));
+        let row_h = self.row_h;
+        let shortcut_w = self.shortcut_width(ui, rect.width());
+
+        // Column titles.
+        let (head, _) = ui.allocate_exact_size(vec2(rect.width(), row_h), Sense::hover());
+        let font = TextStyle::Body.resolve(ui.style());
+        let dim = self.style.dim;
+        let m = self.mirror(head);
+        let key_x = head.max.x - shortcut_w - ICON - 4.0;
+        let titles = [(self.ui("Command"), head.min.x + 6.0, key_x - head.min.x - 12.0), (self.ui("Shortcut"), key_x, shortcut_w)];
+        for (title, x, w) in titles {
+            let (g, _) = self.one_line(ui.painter(), &[(self.vis(&title), TextFormat::simple(font.clone(), dim))], w);
+            ui.painter().galley(pos2(m.x(x, g.size().x), head.center().y - g.size().y / 2.0), g, dim);
+        }
+        ui.painter().line_segment([head.left_bottom(), head.right_bottom()], ui.visuals().widgets.noninteractive.bg_stroke);
+
+        if matches == 0 {
+            ui.add_space(8.0);
+            ui.label(RichText::new(self.vis(&self.ui("No matching commands"))).color(dim));
+        }
+
+        let mut scroll = ScrollArea::vertical().id_salt(self.base.with("rows")).auto_shrink([false, false]);
+        if std::mem::take(&mut self.state.reveal)
+            && let Some(pos) = position
+        {
+            let inside = self.state.visible.start < pos && pos + 1 < self.state.visible.end;
+            if !inside {
+                let view = ui.available_height();
+                scroll = scroll.vertical_scroll_offset((pos as f32 * row_h - (view - row_h) / 2.0).max(0.0));
+            }
+        }
+        let mut action = None;
+        let mut shown = 0..0;
+        ui.scope(|ui| {
+            ui.spacing_mut().item_spacing.y = 0.0;
+            scroll.show_rows(ui, row_h, count, |ui, range| {
+                shown = range.clone();
+                action = self.rows(ui, range, shortcut_w, has_focus);
+            });
+        });
+        // Screen readers follow the selected row while the table has focus.
+        let row_id = position.filter(|p| shown.contains(p)).and_then(|p| match self.state.lines_cached().get(p) {
+            Some(Line::Row(r)) => Some(self.base.with(("row", &r.key))),
+            _ => None,
+        });
+        if let Some(id) = row_id {
+            ui.ctx().accesskit_node_builder(table_id, |node| node.set_active_descendant(id.accesskit_id()));
+        }
+        self.state.visible = shown;
+        if has_focus {
+            ui.painter().rect_stroke(rect, 2.0, ui.visuals().selection.stroke, StrokeKind::Inside);
+        }
+
+        if let Some(a) = action {
+            // A group header is a Tab stop of its own and keeps focus.
+            if !matches!(a, RowAction::Toggle(_)) {
+                focus.request_focus();
+            }
+            match a {
+                RowAction::Select(c) => self.state.select_row(&c),
+                RowAction::Record(c, old, chip) => {
+                    self.state.record(self.env, Target::Cell { command: c, old });
+                    self.state.chip = chip;
+                }
+                RowAction::Reset(c) => {
+                    self.state.select_row(&c);
+                    self.state.use_default(self.env, &c);
+                }
+                RowAction::Toggle(name) => self.state.toggle_group(&name),
+            }
+            if self.state.is_recording() {
+                ui.memory_mut(|m| m.set_focus_lock_filter(table_id, capture::FOCUS_LOCK));
+            }
+        }
+    }
+
+    /// Up/Down, Home/End, Left/Right between chips, Enter records, Delete removes (§2.10).
+    fn table_keys(&mut self, ui: &Ui) {
+        let keys = [
+            EguiKey::ArrowUp,
+            EguiKey::ArrowDown,
+            EguiKey::Home,
+            EguiKey::End,
+            EguiKey::ArrowLeft,
+            EguiKey::ArrowRight,
+            EguiKey::Enter,
+            EguiKey::Delete,
+        ];
+        let pressed = ui.input_mut(|i| keys.map(|k| i.consume_key(Modifiers::NONE, k)));
+        let [up, down, home, end, left, right, enter, delete] = pressed;
+        if !pressed.contains(&true) {
+            return;
+        }
+        let rows: Vec<(CommandRef, Vec<Binding>)> = self
+            .state
+            .lines(self.env)
+            .lines
+            .iter()
+            .filter_map(|l| if let Line::Row(r) = l { Some((r.command.clone(), r.chips.iter().map(|c| c.binding.clone()).collect())) } else { None })
+            .collect();
+        let at = self.state.selected.as_ref().and_then(|s| rows.iter().position(|(c, _)| c == s));
+        let to = if up {
+            Some(at.map_or(0, |i| i.saturating_sub(1)))
+        } else if down {
+            Some(at.map_or(0, |i| (i + 1).min(rows.len().saturating_sub(1))))
+        } else if home {
+            Some(0)
+        } else if end {
+            Some(rows.len().saturating_sub(1))
+        } else {
+            None
+        };
+        if let Some((command, _)) = to.and_then(|i| rows.get(i)) {
+            self.state.select_row(command);
+            self.state.reveal = true;
+            return;
+        }
+        let Some((command, bindings)) = at.and_then(|i| rows.get(i)) else { return };
+        let chip = self.state.chip.min(bindings.len().saturating_sub(1));
+        if left {
+            self.state.chip = chip.saturating_sub(1);
+        } else if right {
+            self.state.chip = (chip + 1).min(bindings.len().saturating_sub(1));
+        } else if enter && self.env.options.editable {
+            self.state.record(self.env, Target::Cell { command: command.clone(), old: bindings.get(chip).cloned() });
+            self.state.chip = chip;
+        } else if delete
+            && self.env.options.editable
+            && let Some(b) = bindings.get(chip)
+        {
+            self.state.remove(self.env, command, b);
+            self.state.chip = chip.saturating_sub(1);
+        }
+    }
+
+    fn rows(&mut self, ui: &mut Ui, range: Range<usize>, shortcut_w: f32, focused: bool) -> Option<RowAction> {
+        let lines: Vec<Line> = self.state.lines(self.env).lines.get(range).map(<[Line]>::to_vec).unwrap_or_default();
+        let mut action = None;
+        for line in lines {
+            let (_, rect) = ui.allocate_space(vec2(ui.available_width(), self.row_h));
+            let a = match &line {
+                Line::Header { name, collapsed } => self.group_header(ui, rect, name, *collapsed),
+                Line::Row(r) => self.row(ui, rect, r, shortcut_w, focused),
+                Line::Fixed(f) => {
+                    self.fixed_row(ui, rect, f, shortcut_w);
+                    None
+                }
+            };
+            action = action.or(a);
+        }
+        action
+    }
+
+    /// A group's header; a Tab stop, toggled with Enter or Space.
+    fn group_header(&self, ui: &mut Ui, rect: Rect, name: &str, collapsed: bool) -> Option<RowAction> {
+        let resp = ui.interact(rect, self.base.with(("group", name)), Sense::click());
+        resp.widget_info(|| WidgetInfo::labeled(Role::DisclosureTriangle, true, name));
+        ui.ctx().accesskit_node_builder(resp.id, |node| node.set_expanded(!collapsed));
+        if resp.has_focus() {
+            ui.painter().rect_stroke(rect, 2.0, ui.visuals().selection.stroke, StrokeKind::Inside);
+        }
+        let v = ui.visuals();
+        let color = v.strong_text_color();
+        let m = self.mirror(rect);
+        let tri = m.rect(Rect::from_center_size(pos2(rect.min.x + 10.0, rect.center().y), Vec2::splat(8.0)));
+        let points = match (collapsed, m.on) {
+            (true, false) => vec![tri.left_top(), tri.right_center(), tri.left_bottom()],
+            (true, true) => vec![tri.right_top(), tri.right_bottom(), tri.left_center()],
+            (false, _) => vec![tri.left_top(), tri.right_top(), tri.center_bottom()],
+        };
+        ui.painter().add(egui::Shape::convex_polygon(points, color, Stroke::NONE));
+        let font = TextStyle::Body.resolve(ui.style());
+        let (g, cut) = self.one_line(ui.painter(), &[(self.vis(name), TextFormat::simple(font, color))], rect.width() - 24.0);
+        ui.painter().galley(pos2(m.x(rect.min.x + 20.0, g.size().x), rect.center().y - g.size().y / 2.0), g, color);
+        let clicked = resp.clicked();
+        if cut {
+            resp.on_hover_text(self.vis(name));
+        }
+        clicked.then(|| RowAction::Toggle(name.to_string()))
+    }
+
+    /// Draw one command row and return at most one action.
+    ///
+    /// The row always senses clicks and can be selected even when the dialog is read-only;
+    /// `editable` additionally enables shortcut-cell hit testing and the add/reset controls. The
+    /// accessibility label gains "(cycles)" and "(Changed)" suffixes, and the visual row uses
+    /// selected/focused and RTL-mirrored styling. A recording cell for this command shows the
+    /// recording text; clicking a chip records that binding, clicking an empty cell records the
+    /// first binding, and the plus button records an appended binding. The final fallback action is
+    /// selecting the clicked row.
+    fn row(&self, ui: &mut Ui, rect: Rect, r: &Row, shortcut_w: f32, focused: bool) -> Option<RowAction> {
+        let editable = self.env.options.editable;
+        let selected = self.state.selected.as_ref() == Some(&r.command);
+        let resp = ui.interact(rect, self.base.with(("row", &r.key)), Sense::CLICK);
+        let mut a11y = r.label.clone();
+        if r.cycles {
+            a11y = fill(self.ui("{label} (cycles)"), &[("label", &a11y)]);
+        }
+        if r.changed {
+            a11y = fill(self.ui("{label} (Changed)"), &[("label", &a11y)]);
+        }
+        resp.widget_info(|| WidgetInfo::selected(Role::Button, true, selected, &a11y));
+        ui.ctx().accesskit_node_builder(resp.id, |node| node.set_selected(selected));
+        self.tag(|| format!("shortcuts.row.{}", r.key), rect, &r.label);
+        let v = ui.visuals();
+        if selected {
+            let fill = if focused { v.selection.bg_fill } else { v.selection.bg_fill.gamma_multiply(0.5) };
+            ui.painter().rect_filled(rect, 0.0, fill);
+        } else if resp.hovered() {
+            ui.painter().rect_filled(rect, 0.0, v.widgets.hovered.weak_bg_fill);
+        }
+        let m = self.mirror(rect);
+        if r.changed {
+            ui.painter().rect_filled(m.rect(Rect::from_min_size(rect.min + vec2(1.0, 3.0), vec2(3.0, rect.height() - 6.0))), 1.0, self.style.changed);
+        }
+        let text_color = if selected { v.strong_text_color() } else { v.text_color() };
+        let strong = v.strong_text_color();
+        let dim = self.style.dim;
+        let font = TextStyle::Body.resolve(ui.style());
+
+        // Label column.
+        let label_w = (rect.width() - shortcut_w - ICON - 12.0).max(0.0);
+        let fmt = |c: Color32| TextFormat::simple(font.clone(), c);
+        let mut parts = Vec::new();
+        if r.conflict {
+            parts.extend([("⚠".to_string(), fmt(self.style.warning)), (" ".into(), fmt(dim))]);
+        }
+        for p in &r.prefix {
+            parts.extend([(self.vis(p), fmt(dim)), (PATH_SEP.into(), fmt(dim))]);
+        }
+        parts.push((self.vis(&r.label), fmt(if r.changed { strong } else { text_color })));
+        if r.cycles {
+            parts.extend([(" ".into(), fmt(dim)), (self.vis(&self.ui("(cycles)")), fmt(dim))]);
+        }
+        let (g, _) = self.one_line(ui.painter(), &self.ordered(parts), label_w);
+        ui.painter().galley(pos2(m.x(rect.min.x + 8.0, g.size().x), rect.center().y - g.size().y / 2.0), g, text_color);
+
+        // Shortcut column: chips, then "+".
+        let mut action = None;
+        let col = Rect::from_min_max(pos2(rect.max.x - shortcut_w - ICON - 4.0, rect.min.y), pos2(rect.max.x - ICON - 4.0, rect.max.y));
+        let painter = ui.painter_at(m.rect(col));
+        let mut x = col.min.x;
+        let rec = match self.recording_target() {
+            Some(Target::Cell { command, old }) if *command == r.command => Some(old.clone()),
+            _ => None,
+        };
+        let chip_h = rect.height() - 4.0;
+        let mut cells: Vec<(Option<Binding>, String, bool)> =
+            r.chips.iter().map(|c| (Some(c.binding.clone()), c.text.clone(), rec.as_ref() == Some(&Some(c.binding.clone())))).collect();
+        if rec == Some(None) {
+            cells.push((None, String::new(), true));
+        }
+        for (n, (binding, text, recording)) in cells.iter().enumerate() {
+            let shown = if *recording { self.recording_text() } else { text.clone() };
+            let g = painter.layout_no_wrap(shown.clone(), font.clone(), text_color);
+            let w = g.size().x + 2.0 * CHIP_PAD;
+            let chip = m.rect(Rect::from_min_size(pos2(x, rect.min.y + 2.0), vec2(w, chip_h)));
+            x += w + CHIP_GAP;
+            let changed = r.chips.get(n).is_some_and(|c| c.changed);
+            let stroke = if *recording {
+                Stroke::new(1.5, self.style.accent)
+            } else if changed {
+                Stroke::new(1.0, self.style.changed)
+            } else {
+                v.widgets.inactive.bg_stroke
+            };
+            let current_chip = selected && focused && n == self.state.chip;
+            painter.rect(chip, 3.0, v.widgets.inactive.weak_bg_fill, if current_chip { v.selection.stroke } else { stroke }, StrokeKind::Inside);
+            painter.galley(pos2(chip.min.x + CHIP_PAD, chip.center().y - g.size().y / 2.0), g, v.text_color());
+            let waiting = self.state.recording.as_ref().is_some_and(|r| r.waiting.is_some());
+            let label = if *recording && waiting {
+                fill(self.ui("{label}: {chord}"), &[("label", &r.label), ("chord", &shown)])
+            } else if *recording {
+                fill(self.ui("{label}: press keys"), &[("label", &r.label)])
+            } else {
+                fill(self.ui("{label}: {chord}"), &[("label", &r.label), ("chord", text)])
+            };
+            let resp =
+                ui.interact(chip.intersect(m.rect(col)), self.base.with(("cell", &r.key, n)), if editable { Sense::CLICK } else { Sense::hover() });
+            resp.widget_info(|| WidgetInfo::labeled(Role::Button, editable, &label));
+            self.tag(|| format!("shortcuts.cell.{}.{n}", r.key), chip, &label);
+            if resp.clicked() {
+                action = Some(RowAction::Record(r.command.clone(), binding.clone(), n));
+            }
+        }
+        if cells.is_empty() {
+            // An empty cell to click for the first shortcut.
+            let cell = m.rect(Rect::from_min_max(pos2(col.min.x, rect.min.y), pos2(col.max.x - ICON - CHIP_GAP, rect.max.y)));
+            let label = fill(self.ui("{label}: {chord}"), &[("label", &r.label), ("chord", &self.ui("None"))]);
+            let resp = ui.interact(cell, self.base.with(("cell", &r.key, 0)), if editable { Sense::CLICK } else { Sense::hover() });
+            resp.widget_info(|| WidgetInfo::labeled(Role::Button, editable, &label));
+            self.tag(|| format!("shortcuts.cell.{}.0", r.key), cell, &label);
+            if resp.clicked() {
+                action = Some(RowAction::Record(r.command.clone(), None, 0));
+            }
+            x = col.min.x;
+        }
+        if editable && r.chips.len() < MAX_BINDINGS && rec != Some(None) {
+            let plus = m.rect(Rect::from_min_size(pos2(x.min(col.max.x - ICON), rect.center().y - ICON / 2.0), Vec2::splat(ICON)));
+            let label = fill(self.ui("Add a shortcut to {label}"), &[("label", &r.label)]);
+            let resp = self.row_button(ui, plus, self.base.with(("add", &r.key)), &label, true, paint_plus);
+            self.tag(|| format!("shortcuts.add.{}", r.key), plus, &label);
+            if resp.clicked() {
+                action = Some(RowAction::Record(r.command.clone(), None, r.chips.len()));
+            }
+        }
+        if editable {
+            let reset = m.rect(Rect::from_min_size(pos2(rect.max.x - ICON - 2.0, rect.center().y - ICON / 2.0), Vec2::splat(ICON)));
+            let label = fill(self.ui("Restore the default for {label}"), &[("label", &r.label)]);
+            let resp = self.row_button(ui, reset, self.base.with(("reset", &r.key)), &label, r.changed, paint_reset);
+            self.tag(|| format!("shortcuts.reset.{}", r.key), reset, &label);
+            if resp.clicked() {
+                action = Some(RowAction::Reset(r.command.clone()));
+            }
+        }
+
+        let clicked = resp.clicked();
+        let mut tip = vec![self.vis(&r.label)];
+        if let Some(b) = self.env.keymap.bindable(&r.command) {
+            if let Some(path) = b.paths.first().filter(|p| !p.is_empty()) {
+                tip.push(self.path_text(path));
+            }
+            if let Some(h) = self.env.text.hint(b) {
+                tip.push(self.vis(&h));
+            }
+        }
+        resp.on_hover_text(tip.join("\n"));
+        action.or_else(|| clicked.then(|| RowAction::Select(r.command.clone())))
+    }
+
+    /// A read-only row from `Options::fixed`, struck through when a command took its chord.
+    fn fixed_row(&self, ui: &mut Ui, rect: Rect, f: &FixedLine, shortcut_w: f32) {
+        let v = ui.visuals();
+        let font = TextStyle::Body.resolve(ui.style());
+        let color = if f.now_used_by.is_some() { self.style.dim } else { v.text_color() };
+        let mut fmt = TextFormat::simple(font.clone(), color);
+        if f.now_used_by.is_some() {
+            fmt.strikethrough = Stroke::new(1.0, color);
+        }
+        let m = self.mirror(rect);
+        let label_w = rect.width() - shortcut_w - ICON - 12.0;
+        let (g, cut) = self.one_line(ui.painter(), &[(self.vis(&f.label), fmt.clone())], label_w);
+        ui.painter().galley(pos2(m.x(rect.min.x + 8.0, g.size().x), rect.center().y - g.size().y / 2.0), g, color);
+        let (keys, _) = self.one_line(ui.painter(), &[(f.keys.clone(), fmt)], shortcut_w);
+        ui.painter().galley(pos2(m.x(rect.max.x - shortcut_w - ICON - 4.0, keys.size().x), rect.center().y - keys.size().y / 2.0), keys, color);
+        let resp = ui.interact(rect, self.base.with(("fixed", &f.label, &f.keys)), Sense::hover());
+        let mut tip = Vec::new();
+        if cut {
+            tip.push(self.vis(&f.label));
+        }
+        match &f.now_used_by {
+            Some(by) => {
+                let label = fill(self.ui("{label}: {chord} (Now used by {holder})"), &[("label", &f.label), ("chord", &f.keys), ("holder", by)]);
+                resp.widget_info(|| WidgetInfo::labeled(Role::Label, true, &label));
+                tip.push(self.vis(&fill(self.ui("Now used by {label}"), &[("label", by)])));
+            }
+            None => {
+                let label = fill(self.ui("{label}: {chord}"), &[("label", &f.label), ("chord", &f.keys)]);
+                resp.widget_info(|| WidgetInfo::labeled(Role::Label, true, &label));
+            }
+        }
+        if !tip.is_empty() {
+            resp.on_hover_text(tip.join("\n"));
+        }
+    }
+
+    fn detail(&mut self, ui: &mut Ui) {
+        ScrollArea::vertical().id_salt(self.base.with("detail")).auto_shrink([false, false]).show(ui, |ui| {
+            ui.add_space(4.0);
+            let Some(command) = self.state.selected.clone().filter(|c| self.env.keymap.bindable(c).is_some()) else {
+                ui.label(RichText::new(self.vis(&self.ui("Select a command to see and change its shortcuts"))).color(self.style.dim));
+                return;
+            };
+            self.detail_of(ui, &command);
+        });
+    }
+
+    fn detail_of(&mut self, ui: &mut Ui, command: &CommandRef) {
+        let Some(b) = self.env.keymap.bindable(command).cloned() else { return };
+        let editable = self.env.options.editable;
+        let label = self.env.text.command(&b).into_owned();
+        let home = Some(&b.scope);
+        let dim = self.style.dim;
+        ui.add(Label::new(RichText::new(self.vis(&label)).strong().size(ui.text_style_height(&TextStyle::Body) * 1.15)).wrap());
+        let path: Vec<String> = b.paths.first().map(|p| p.iter().filter(|s| !s.is_empty()).cloned().collect()).unwrap_or_default();
+        let place =
+            if path.is_empty() { b.command.id.clone() } else { self.joined(vec![self.path_text(&path), " · ".into(), b.command.id.clone()]) };
+        ui.add(Label::new(RichText::new(place).color(dim)).wrap());
+        if let Some(h) = self.env.text.hint(&b) {
+            ui.add(Label::new(RichText::new(self.vis(&h)).color(dim)).wrap());
+        }
+        ui.add_space(6.0);
+
+        // Current shortcuts, each with Remove.
+        ui.label(self.vis(&self.ui("Current shortcuts:")));
+        let bindings = self.env.keymap.bindings(command);
+        let defaults = self.env.keymap.default_bindings(command);
+        if bindings.is_empty() {
+            ui.label(RichText::new(self.vis(&self.ui("None"))).color(dim));
+        }
+        let mut remove = None;
+        for (n, binding) in bindings.iter().enumerate() {
+            let text = self.binding_text(binding, home);
+            ui.horizontal(|ui| {
+                ui.add_space(8.0);
+                let shown = if defaults.contains(binding) { fill(self.ui("{chord} (Default)"), &[("chord", &text)]) } else { text.clone() };
+                ui.label(self.vis_chord(&shown, &self.chord(&binding.trigger)));
+                if editable {
+                    let a11y = fill(self.ui("Remove {chord} from {label}"), &[("chord", &text), ("label", &label)]);
+                    let r = self.icon_button(ui, &a11y, false, paint_cross).on_hover_text(self.vis(&a11y));
+                    self.tag(|| format!("shortcuts.remove.{n}"), r.rect, &a11y);
+                    if r.clicked() {
+                        remove = Some(binding.clone());
+                    }
+                }
+            });
+        }
+        if let Some(binding) = remove {
+            self.state.remove(self.env, command, &binding);
+        }
+        if !editable {
+            self.defaults_line(ui, &defaults, home);
+            return;
+        }
+        ui.add_space(6.0);
+        self.new_shortcut(ui, command, home);
+        self.context(ui, command);
+        self.holders(ui);
+        ui.add_space(6.0);
+        ui.horizontal_wrapped(|ui| {
+            if self.button(ui, self.state.field.is_some(), &self.ui("Assign"), "shortcuts.assign") {
+                self.state.assign_field(self.env);
+            }
+            if self.button(ui, DialogState::can_use_default(self.env, command), &self.ui("Use Default"), "shortcuts.useDefault") {
+                self.state.use_default(self.env, command);
+            }
+            if self.button(ui, !bindings.is_empty(), &self.ui("Clear"), "shortcuts.clear") {
+                self.state.clear(self.env, command);
+            }
+        });
+        self.defaults_line(ui, &defaults, home);
+    }
+
+    fn defaults_line(&self, ui: &mut Ui, defaults: &[Binding], home: Option<&Scope>) {
+        let chords =
+            if defaults.is_empty() { self.ui("None") } else { defaults.iter().map(|d| self.binding_text(d, home)).collect::<Vec<_>>().join(", ") };
+        let text = self.vis_chord(&fill(self.ui("Default: {chord}"), &[("chord", &chords)]), &chords);
+        ui.add(Label::new(RichText::new(text).color(self.style.dim)).wrap());
+    }
+
+    /// New Shortcut: a field that records when focused or clicked, or typed entry.
+    fn new_shortcut(&mut self, ui: &mut Ui, command: &CommandRef, home: Option<&Scope>) {
+        let title = self.ui("New shortcut:");
+        let title_id = ui.label(self.vis(&title)).id;
+        let field_id = self.base.with("new");
+        let recording = matches!(self.recording_target(), Some(Target::Field { command: c }) if c == command);
+        if let Some(mut typed) = self.state.typing.clone() {
+            let type_id = self.base.with("type");
+            let edit = ui.add(TextEdit::singleline(&mut typed).id(type_id).desired_width(FIELD_W).hint_text("Cmd+Shift+K"));
+            let edit = edit.labelled_by(title_id);
+            // Focus once, on the frame after Type… was clicked.
+            if ui.data_mut(|d| d.remove_temp::<bool>(type_id)).is_some() {
+                edit.request_focus();
+            }
+            self.text_field(&edit);
+            self.tag(|| "shortcuts.type".into(), edit.rect, &title);
+            let enter = edit.lost_focus() && ui.input(|i| i.key_pressed(EguiKey::Enter));
+            self.state.typing = Some(typed.clone());
+            if enter {
+                match self.state.type_binding(self.env, command, &typed) {
+                    Ok(()) => {
+                        self.state.typing = None;
+                        self.state.type_error = None;
+                    }
+                    Err(e) => self.state.type_error = Some(e),
+                }
+            }
+            if let Some(e) = &self.state.type_error {
+                ui.add(Label::new(RichText::new(self.warned(self.vis(e))).color(self.style.warning)).wrap());
+            }
+            return;
+        }
+        ui.horizontal(|ui| {
+            let shown = if recording {
+                self.recording_text()
+            } else {
+                self.state.field.as_ref().filter(|f| f.command == *command).map_or_else(String::new, |f| self.binding_text(&f.binding, home))
+            };
+            let size = vec2(FIELD_W, ui.spacing().interact_size.y);
+            let (rect, _) = ui.allocate_exact_size(size, Sense::hover());
+            let resp = ui.interact(rect, field_id, Sense::click());
+            let value = if shown.is_empty() { self.ui("None") } else { shown.clone() };
+            let a11y = fill(self.ui("New shortcut: {chord}"), &[("chord", &value)]);
+            resp.widget_info(|| WidgetInfo::labeled(Role::Button, true, &a11y));
+            let v = ui.visuals();
+            let stroke = if recording || resp.has_focus() { v.selection.stroke } else { v.widgets.inactive.bg_stroke };
+            ui.painter().rect(rect, 3.0, v.extreme_bg_color, stroke, StrokeKind::Inside);
+            let color = if recording { self.style.dim } else { v.text_color() };
+            ui.painter().text(rect.left_center() + vec2(6.0, 0.0), egui::Align2::LEFT_CENTER, shown, TextStyle::Body.resolve(ui.style()), color);
+            self.tag(|| "shortcuts.new".into(), rect, &title);
+            if !recording && (resp.clicked() || resp.gained_focus()) {
+                self.state.record(self.env, Target::Field { command: command.clone() });
+                resp.request_focus();
+                capture::lock_focus(ui, field_id);
+            } else if recording {
+                if resp.lost_focus() {
+                    self.state.stop_recording();
+                } else {
+                    capture::lock_focus(ui, field_id);
+                }
+            } else if resp.has_focus() {
+                capture::unlock_focus(ui, field_id);
+            }
+            if ui.link(self.vis(&self.ui("Type…"))).clicked() {
+                self.state.stop_recording();
+                self.state.typing = Some(String::new());
+                self.state.type_error = None;
+                let type_id = self.base.with("type");
+                ui.data_mut(|d| d.insert_temp(type_id, true));
+            }
+        });
+    }
+
+    fn context(&mut self, ui: &mut Ui, command: &CommandRef) {
+        let contexts = DialogState::contexts(self.env, command);
+        let name = |s: &Option<Scope>| match s {
+            None => self.ui("Default"),
+            Some(s) => self.scope_name(s),
+        };
+        let current = name(&self.state.context);
+        let names: Vec<String> = contexts.iter().map(name).collect();
+        let title = self.ui("Context:");
+        let mut pick = None;
+        ui.horizontal(|ui| {
+            let l = ui.label(self.vis(&title));
+            let combo = ComboBox::from_id_salt(self.base.with("context")).selected_text(self.vis(&current)).show_ui(ui, |ui| {
+                for (s, n) in contexts.iter().zip(&names) {
+                    if ui.selectable_label(*s == self.state.context, self.vis(n)).clicked() {
+                        pick = Some(s.clone());
+                    }
+                }
+            });
+            let combo = combo.response.labelled_by(l.id);
+            self.tag(|| "shortcuts.context".into(), combo.rect, &title);
+        });
+        if let Some(s) = pick {
+            self.state.set_context(self.env, s);
+        }
+    }
+
+    /// "Currently assigned to:" for the field's chord, with links to the holders.
+    fn holders(&mut self, ui: &mut Ui) {
+        let Some(f) = self.state.field.clone() else { return };
+        if f.holders.is_empty() && f.shadows.is_empty() {
+            ui.label(RichText::new(self.vis(&self.ui("Not assigned"))).color(self.style.dim));
+            return;
+        }
+        ui.label(self.vis(&self.ui("Currently assigned to:")));
+        let mut go = None;
+        for h in &f.holders {
+            let label = self.label_of(&h.command);
+            let home = self.env.keymap.bindable(&h.command).map(|b| b.scope.clone());
+            let text = match &h.binding.scope {
+                Some(s) if Some(s) != home.as_ref() => fill(self.ui("{label} ({scope})"), &[("label", &label), ("scope", &self.scope_name(s))]),
+                _ => label,
+            };
+            ui.horizontal(|ui| {
+                ui.add_space(8.0);
+                if ui.link(self.warned(self.vis(&text))).clicked() {
+                    go = Some(h.command.clone());
+                }
+            });
+        }
+        for h in &f.shadows {
+            let label = self.label_of(&h.command);
+            let home = self.env.keymap.bindable(&h.command).map(|b| b.scope.clone()).unwrap_or_else(Scope::app);
+            let scope = self.scope_name(h.binding.scope_or(&home));
+            let text = fill(self.ui("{label} ({scope}, both work)"), &[("label", &label), ("scope", &scope)]);
+            ui.horizontal(|ui| {
+                ui.add_space(8.0);
+                if ui.link(self.vis(&text)).clicked() {
+                    go = Some(h.command.clone());
+                }
+            });
+        }
+        if let Some(c) = go {
+            self.state.go_to(&c);
+        }
+    }
+
+    // ---- Under the table ----
+
+    fn bottom(&mut self, ui: &mut Ui) {
+        self.prompt(ui);
+        self.conflict_bar(ui);
+        self.message(ui);
+        self.info(ui);
+        self.footer(ui);
+    }
+
+    fn prompt(&mut self, ui: &mut Ui) {
+        let Some(p) = self.state.prompt.clone() else { return };
+        let (text, yes, no) = match &p {
+            Prompt::ResetAll => (self.ui("Restore every default shortcut in this set?"), self.ui("Reset All"), None),
+            Prompt::DeleteSet(set) => (fill(self.ui("Delete the set “{set}”?"), &[("set", set)]), self.ui("Delete"), None),
+            Prompt::SaveChanges { set, .. } => {
+                (fill(self.ui("Save changes to “{set}”?"), &[("set", set)]), self.ui("Save"), Some(self.ui("Don't Save")))
+            }
+        };
+        ui.add(Label::new(RichText::new(self.vis(&text)).strong()).wrap());
+        let mut answer = None;
+        ui.horizontal_wrapped(|ui| {
+            if self.button(ui, true, &yes, "shortcuts.prompt.yes") {
+                answer = Some(Answer::Yes);
+            }
+            if let Some(no) = &no
+                && self.button(ui, true, no, "shortcuts.prompt.no")
+            {
+                answer = Some(Answer::No);
+            }
+            if self.button(ui, true, &self.ui("Cancel"), "shortcuts.prompt.cancel") {
+                answer = Some(Answer::Cancel);
+            }
+        });
+        if let Some(a) = answer {
+            self.state.answer(self.env, a);
+        }
+    }
+
+    fn conflict_bar(&mut self, ui: &mut Ui) {
+        let Some(c) = self.state.conflict.clone() else { return };
+        let text = self.vis_chord(&c.text, &self.chord(&c.binding.trigger));
+        let r = ui.add(Label::new(RichText::new(text).color(self.style.warning)).wrap());
+        ui.ctx().accesskit_node_builder(r.id, |node| node.set_live(Live::Polite));
+        let mut act = 0;
+        ui.horizontal_wrapped(|ui| {
+            if self.button(ui, true, &self.ui("Take It"), "shortcuts.conflict.take") {
+                act = 1;
+            }
+            if self.button(ui, true, &self.ui("Take It and Go to Conflict"), "shortcuts.conflict.goto") {
+                act = 2;
+            }
+            if self.env.options.allow_keep && self.button(ui, true, &self.ui("Keep Both"), "shortcuts.conflict.keep") {
+                act = 3;
+            }
+            let label = self.ui("Cancel the new shortcut");
+            let r = self.icon_button(ui, &label, false, paint_cross).on_hover_text(self.vis(&label));
+            self.tag(|| "shortcuts.conflict.cancel".into(), r.rect, &label);
+            if r.clicked() {
+                act = 4;
+            }
+        });
+        match act {
+            1 => self.state.take_it(self.env),
+            2 => self.state.take_it_and_go(self.env),
+            3 => self.state.keep_both(self.env),
+            4 => self.state.dismiss_conflict(),
+            _ => {}
+        }
+    }
+
+    fn message(&mut self, ui: &mut Ui) {
+        let Some(m) = self.state.message.clone() else { return };
+        let mut act = 0;
+        ui.horizontal_wrapped(|ui| {
+            let text = self.vis_chord(&m.text, m.chord.as_deref().unwrap_or_default());
+            let text = if m.refused { self.warned(text) } else { text };
+            let color = if m.refused { self.style.warning } else { ui.visuals().text_color() };
+            let r = ui.add(Label::new(RichText::new(text).color(color)).wrap());
+            ui.ctx().accesskit_node_builder(r.id, |node| node.set_live(Live::Polite));
+            if m.goto.is_some() && self.button(ui, true, &self.ui("Go to Conflict"), "shortcuts.message.goto") {
+                act = 1;
+            }
+            if m.undo && self.button(ui, self.state.can_undo() && !self.state.modal(), &self.ui("Undo"), "shortcuts.message.undo") {
+                act = 2;
+            }
+            let label = self.ui("Dismiss");
+            let r = self.icon_button(ui, &label, false, paint_cross).on_hover_text(self.vis(&label));
+            self.tag(|| "shortcuts.message.dismiss".into(), r.rect, &label);
+            if r.clicked() {
+                act = 3;
+            }
+        });
+        match (act, &m.goto) {
+            (1, Some(c)) => self.state.go_to(c),
+            (2, _) => self.state.undo(self.env),
+            (3, _) => self.state.message = None,
+            _ => {}
+        }
+    }
+
+    /// Clashes, shadows and problems in the keymap as a whole.
+    fn info(&mut self, ui: &mut Ui) {
+        let built = self.state.lines(self.env);
+        let (clashes, shadows) = (built.clashes, built.shadows);
+        let problems = self.env.keymap.problems();
+        if clashes == 0 && shadows == 0 && problems.is_empty() {
+            return;
+        }
+        let mut conflicts = false;
+        ui.horizontal_wrapped(|ui| {
+            if clashes > 0 {
+                let n = clashes as u64;
+                let text = self.env.text.plural(n, "{n} shortcut is assigned more than once", "{n} shortcuts are assigned more than once");
+                conflicts = ui.link(self.warned(self.vis(&text))).clicked();
+            }
+            if shadows > 0 {
+                let n = shadows as u64;
+                let text = self.env.text.plural(n, "{n} shortcut also works in another scope", "{n} shortcuts also work in another scope");
+                ui.label(RichText::new(self.vis(&text)).color(self.style.dim));
+            }
+        });
+        if conflicts {
+            self.state.set_filter(Filter::Conflicts);
+        }
+        if !problems.is_empty() {
+            let n = problems.len() as u64;
+            let title = self.env.text.plural(n, "{n} saved shortcut could not be used", "{n} saved shortcuts could not be used");
+            egui::CollapsingHeader::new(self.vis(&title)).id_salt(self.base.with("problems")).show(ui, |ui| {
+                ScrollArea::vertical().max_height(self.row_h * 4.0).show(ui, |ui| {
+                    for p in &problems {
+                        ui.add(Label::new(self.vis(&self.problem(p))).wrap());
+                    }
+                });
+            });
+        }
+    }
+
+    fn problem(&self, p: &Problem) -> String {
+        match p {
+            Problem::UnknownCommand { key } => fill(self.ui("{key}: no command has this name"), &[("key", key)]),
+            Problem::BadBinding { key, text, error } => {
+                let error = binding_error(self.env, error);
+                fill(self.ui("{key}: “{text}” is not a shortcut ({error})"), &[("key", key), ("text", text), ("error", &error)])
+            }
+            Problem::Reserved { key, text } => fill(self.ui("{key}: {text} is reserved by the system"), &[("key", key), ("text", text)]),
+            Problem::UnknownScope { key, text } => fill(self.ui("{key}: the scope in “{text}” is unknown"), &[("key", key), ("text", text)]),
+            Problem::DuplicateKey { key } => fill(self.ui("{key}: listed more than once"), &[("key", key)]),
+            Problem::Dropped { key, .. } => fill(self.ui("{key}: part of the entry was dropped"), &[("key", key)]),
+            Problem::TooManyCommands { ignored } => {
+                self.env.text.plural(*ignored as u64, "{n} entry was ignored: too many commands", "{n} entries were ignored: too many commands")
+            }
+        }
+    }
+
+    fn footer(&mut self, ui: &mut Ui) {
+        let editable = self.env.options.editable;
+        let right: Vec<(String, &str)> = if editable {
+            vec![(self.ui("Cancel"), "shortcuts.cancel"), (self.ui("OK"), "shortcuts.ok")]
+        } else {
+            vec![(self.ui("Close"), "shortcuts.close")]
+        };
+        let idle = !self.state.modal();
+        ui.horizontal(|ui| {
+            if editable {
+                if self.button(ui, idle && self.state.can_undo(), &self.ui("Undo"), "shortcuts.undo") {
+                    self.state.undo(self.env);
+                }
+                if self.button(ui, idle && self.state.can_redo(), &self.ui("Redo"), "shortcuts.redo") {
+                    self.state.redo(self.env);
+                }
+                if self.button(ui, idle && !self.env.keymap.overrides().is_empty(), &self.ui("Reset All…"), "shortcuts.resetAll") {
+                    self.state.ask_reset_all();
+                }
+            }
+            // With sets, Summarize… is in the set row, which a read-only dialog does not show.
+            if (self.env.sets.is_none() || !editable) && self.env.options.summary {
+                let label = self.ui("Summarize…");
+                if self.button(ui, true, &label, "shortcuts.summarize") {
+                    self.state.summarize(self.env);
+                }
+            }
+            let gap = ui.spacing().item_spacing.x;
+            let width: f32 = right.iter().map(|(t, _)| self.button_width(ui, t) + gap).sum();
+            ui.add_space((ui.available_width() - width).max(0.0));
+            for (text, id) in &right {
+                // OK waits for the open prompt or review; Cancel and Close never do.
+                if self.button(ui, idle || *id != "shortcuts.ok", text, id) {
+                    if editable && *id == "shortcuts.ok" {
+                        self.state.ok(self.env);
+                    } else {
+                        self.state.cancel(self.env);
+                    }
+                }
+            }
+        });
+    }
+}
+
+/// Separator between menu path parts, mirrored by [`Draw::ordered`].
+const PATH_SEP: &str = " › ";
+
+/// Places rectangles laid out left to right inside a span, mirrored in a right-to-left interface.
+#[derive(Clone, Copy)]
+struct Mirror {
+    on: bool,
+    /// The span's left plus right edge.
+    sum: f32,
+}
+
+impl Mirror {
+    fn rect(self, r: Rect) -> Rect {
+        if self.on { Rect::from_x_y_ranges((self.sum - r.max.x)..=(self.sum - r.min.x), r.y_range()) } else { r }
+    }
+
+    /// The left edge of something `width` wide whose left-to-right left edge is `x`.
+    fn x(self, x: f32, width: f32) -> f32 {
+        if self.on { self.sum - x - width } else { x }
+    }
+}
+
+// ---- Icons, drawn so they do not depend on the app's fonts ----
+
+fn square(r: Rect, f: f32) -> Rect {
+    Rect::from_center_size(r.center(), Vec2::splat(r.width().min(r.height()) * f))
+}
+
+fn paint_plus(p: &Painter, r: Rect, c: Color32) {
+    let r = square(r, 0.5);
+    let s = Stroke::new(1.5, c);
+    p.line_segment([r.center_top(), r.center_bottom()], s);
+    p.line_segment([r.left_center(), r.right_center()], s);
+}
+
+fn paint_cross(p: &Painter, r: Rect, c: Color32) {
+    let r = square(r, 0.45);
+    let s = Stroke::new(1.5, c);
+    p.line_segment([r.left_top(), r.right_bottom()], s);
+    p.line_segment([r.right_top(), r.left_bottom()], s);
+}
+
+fn paint_reset(p: &Painter, r: Rect, c: Color32) {
+    let r = square(r, 0.55);
+    let (center, radius) = (r.center(), r.width() / 2.0);
+    let s = Stroke::new(1.5, c);
+    let at = |a: f32| center + radius * Vec2::angled(a);
+    let start = -std::f32::consts::FRAC_PI_2;
+    let points: Vec<_> = (0..=12).map(|i| at(start + i as f32 / 12.0 * 1.6 * std::f32::consts::PI)).collect();
+    p.add(egui::Shape::line(points, s));
+    let tip = at(start);
+    p.line_segment([tip, tip + vec2(radius * 0.6, -radius * 0.35)], s);
+    p.line_segment([tip, tip + vec2(radius * 0.5, radius * 0.45)], s);
+}
+
+fn paint_keyboard(p: &Painter, r: Rect, c: Color32) {
+    let r = Rect::from_center_size(r.center(), vec2(r.width() * 0.7, r.height() * 0.5));
+    p.rect_stroke(r, 2.0, Stroke::new(1.2, c), StrokeKind::Inside);
+    for row in 0..2 {
+        for col in 0..4 {
+            let x = r.min.x + r.width() * (col as f32 + 0.75) / 4.5;
+            let y = r.min.y + r.height() * (row as f32 + 1.0) / 4.0;
+            p.circle_filled(pos2(x, y), 0.9, c);
+        }
+    }
+    p.line_segment(
+        [pos2(r.min.x + r.width() * 0.3, r.max.y - r.height() * 0.22), pos2(r.max.x - r.width() * 0.3, r.max.y - r.height() * 0.22)],
+        Stroke::new(1.2, c),
+    );
+}
diff --git a/crates/keymap/tests/chord.rs b/crates/keymap/tests/chord.rs
new file mode 100644
index 00000000..4a8440d7
--- /dev/null
+++ b/crates/keymap/tests/chord.rs
@@ -0,0 +1,196 @@
+use craft_keymap::chord::foreign::{Flavor, ForeignError, ReadNote, read_foreign};
+use craft_keymap::{Chord, Key, MAX_CHORD_TEXT, Mods, ParseError, Platform, Trigger};
+
+fn chord(text: &str) -> Chord {
+    Chord::parse(text).unwrap_or_else(|e| panic!("{text}: {e}"))
+}
+
+fn mods(cmd: bool, ctrl: bool, alt: bool, shift: bool) -> Mods {
+    Mods { cmd, ctrl, alt, shift }
+}
+
+#[test]
+fn canonical_text_round_trips_for_every_key_and_modifier_set() {
+    for &key in Key::ALL {
+        for bits in 0..16u8 {
+            let c = Chord::new(mods(bits & 1 != 0, bits & 2 != 0, bits & 4 != 0, bits & 8 != 0), key);
+            let text = c.to_string();
+            assert_eq!(Chord::parse(&text), Ok(c), "{text}");
+            assert_eq!(Trigger::parse(&format!("{text} {text}")), Ok(Trigger::double(c)), "{text} double");
+            let json = serde_json::to_string(&Trigger::single(c)).unwrap();
+            assert_eq!(serde_json::from_str::<Trigger>(&json).unwrap(), Trigger::single(c));
+            // macOS display text reads back as the same chord.
+            assert_eq!(Chord::parse(&c.display(Platform::Mac)), Ok(c), "{}", c.display(Platform::Mac));
+        }
+    }
+    assert_eq!(chord("Cmd+Ctrl+Alt+Shift+K").to_string(), "Cmd+Ctrl+Alt+Shift+K");
+    assert_eq!(serde_json::to_string(&chord("shift+cmd+k")).unwrap(), "\"Cmd+Shift+K\"");
+}
+
+#[test]
+fn plus_and_minus_keys_parse_from_their_glyphs() {
+    assert_eq!(Key::parse("+"), Some(Key::Plus));
+    assert_eq!(Key::parse("-"), Some(Key::Minus));
+    assert_eq!(Key::parse("−"), Some(Key::Minus), "U+2212");
+}
+
+#[test]
+fn arrow_glyphs_parse_as_arrow_keys() {
+    for (glyph, key) in [("←", Key::Left), ("→", Key::Right), ("↑", Key::Up), ("↓", Key::Down)] {
+        assert_eq!(Key::parse(glyph), Some(key), "{glyph}");
+    }
+    assert_eq!(Chord::parse("⌘←").unwrap().to_string(), "Cmd+Left");
+    assert_eq!(Chord::parse("Alt+Shift+→").unwrap().to_string(), "Alt+Shift+Right");
+}
+
+#[test]
+fn aliases_parse_to_canonical_chords() {
+    let cases = [
+        ("cmd+shift+z", "Cmd+Shift+Z"),
+        ("Shift+Command+Z", "Cmd+Shift+Z"),
+        ("meta+z", "Cmd+Z"),
+        ("Super+Z", "Cmd+Z"),
+        ("mod+z", "Cmd+Z"),
+        ("⌘⇧Z", "Cmd+Shift+Z"),
+        ("⌃⌥⇧⌘K", "Cmd+Ctrl+Alt+Shift+K"),
+        ("⌘+K", "Cmd+K"),
+        ("⌘Shift+K", "Cmd+Shift+K"),
+        ("control+opt+left", "Ctrl+Alt+Left"),
+        ("ctl+option+ArrowUp", "Ctrl+Alt+Up"),
+        // craft-menu writes Ctrl before Cmd.
+        ("Ctrl+Cmd+Alt+Shift+M", "Cmd+Ctrl+Alt+Shift+M"),
+        ("Ctrl+Cmd+F", "Cmd+Ctrl+F"),
+        ("Cmd++", "Cmd++"),
+        ("⌘+", "Cmd++"),
+        ("+", "+"),
+        ("Cmd+Plus", "Cmd++"),
+        ("cmd+Equals", "Cmd+="),
+        ("Cmd+-", "Cmd+-"),
+        ("Cmd+−", "Cmd+-"),
+        ("⌘−", "Cmd+-"),
+        ("Cmd + K", "Cmd+K"),
+        ("esc", "Escape"),
+        ("return", "Enter"),
+        ("del", "Delete"),
+        ("pgup", "PageUp"),
+        ("pgdn", "PageDown"),
+        ("arrowdown", "Down"),
+        ("spacebar", "Space"),
+        ("ins", "Insert"),
+        ("f12", "F12"),
+        ("Num5", "5"),
+        ("Semicolon", ";"),
+        ("Questionmark", "?"),
+        ("OpenCurlyBracket", "{"),
+        ("Backtick", "`"),
+        ("⌘⌫", "Cmd+Backspace"),
+    ];
+    for (text, canonical) in cases {
+        assert_eq!(chord(text).to_string(), canonical, "{text}");
+    }
+}
+
+#[test]
+fn hostile_text_is_refused() {
+    let long = "Cmd+".repeat(MAX_CHORD_TEXT / 4) + "K";
+    assert!(long.len() > MAX_CHORD_TEXT);
+    let cases: &[(&str, ParseError)] = &[
+        ("", ParseError::Empty),
+        ("   ", ParseError::Empty),
+        (&long, ParseError::TooLong),
+        ("+++", ParseError::UnknownModifier("+".into())),
+        ("++", ParseError::MissingKey),
+        ("Cmd+", ParseError::MissingKey),
+        ("Cmd", ParseError::MissingKey),
+        ("⌘", ParseError::MissingKey),
+        ("Shift+Alt", ParseError::MissingKey),
+        ("Cmd+Command+K", ParseError::DuplicateModifier("Command".into())),
+        ("⌘⌘K", ParseError::DuplicateModifier("⌘".into())),
+        ("Cmd+é", ParseError::UnknownKey("é".into())),
+        ("Ctrl+ж+K", ParseError::UnknownModifier("ж".into())),
+        ("Hyper+K", ParseError::UnknownModifier("Hyper".into())),
+        ("A B", ParseError::Sequence),
+        ("Cmd+K Cmd+J", ParseError::Sequence),
+        ("A A A", ParseError::UnknownKey("A A A".into())),
+    ];
+    for (text, err) in cases {
+        assert_eq!(Trigger::parse(text).as_ref(), Err(err), "{text:?}");
+    }
+    let wide = "⌘".repeat(30);
+    assert_eq!(Chord::parse(&wide), Err(ParseError::TooLong));
+    assert!(serde_json::from_str::<Chord>("\"Cmd+Nope\"").is_err());
+}
+
+#[test]
+fn display_follows_the_platform() {
+    let c = chord("Cmd+Ctrl+Alt+Shift+K");
+    assert_eq!(c.display(Platform::Mac), "⌃⌥⇧⌘K");
+    assert_eq!(c.display(Platform::Windows), "Ctrl+Alt+Shift+K");
+    assert_eq!(chord("Ctrl+Up").display(Platform::Mac), "⌃↑");
+    assert_eq!(chord("Ctrl+Up").display(Platform::Linux), "Ctrl+Up");
+    assert_eq!(chord("Cmd+Enter").display(Platform::Mac), "⌘⏎");
+    assert_eq!(chord("Shift+Tab").display(Platform::Mac), "⇧⇥");
+    assert_eq!(chord("Space").display(Platform::Mac), "Space");
+    assert_eq!(chord("Alt+PageDown").display(Platform::Windows), "Alt+Page Down");
+    assert_eq!(Trigger::parse("Cmd+K Cmd+K").unwrap().display(Platform::Mac), "⌘K ⌘K");
+    assert_eq!(Trigger::parse("A A").unwrap().to_string(), "A A");
+}
+
+#[test]
+fn ctrl_folds_into_cmd_off_macos() {
+    let ctrl = chord("Ctrl+S");
+    let cmd = chord("Cmd+S");
+    assert_ne!(ctrl.effective(Platform::Mac), cmd.effective(Platform::Mac));
+    for p in [Platform::Windows, Platform::Linux] {
+        assert_eq!(ctrl.effective(p), cmd);
+        assert_eq!(chord("Cmd+Ctrl+S").effective(p), cmd);
+    }
+    assert!(ctrl.has_command() && cmd.has_command());
+    assert!(chord("Shift+B").is_plain() && !chord("Alt+B").is_plain());
+    assert!(chord("Shift+F35").is_function_key() && !chord("F").is_function_key());
+}
+
+#[test]
+fn foreign_windows_text() {
+    let read = |t: &str| read_foreign(t, Flavor::Windows);
+    let ok = |t: &str| read(t).unwrap_or_else(|e| panic!("{t}: {e}"));
+    assert_eq!(ok("Shift+Ctrl+S"), (Trigger::single(chord("Cmd+Shift+S")), vec![]));
+    assert_eq!(ok("Ctrl+,").0, Trigger::single(chord("Cmd+,")));
+    assert_eq!(ok(",").0, Trigger::single(chord(",")));
+    assert_eq!(ok("Ctrl++").0, Trigger::single(chord("Cmd++")));
+    assert_eq!(ok("Ctrl+-").0, Trigger::single(chord("Cmd+-")));
+    assert_eq!(ok("Alt-F4").0, Trigger::single(chord("Alt+F4")));
+    assert_eq!(ok("Ctrl + S").0, Trigger::single(chord("Cmd+S")));
+    assert_eq!(ok("Shift + Ctrl + S").0, Trigger::single(chord("Cmd+Shift+S")));
+    assert_eq!(ok("Ctrl + +").0, Trigger::single(chord("Cmd++")));
+    assert_eq!(ok("Alt - F4").0, Trigger::single(chord("Alt+F4")));
+    assert_eq!(ok("Ctrl Page Down").0, Trigger::single(chord("Cmd+PageDown")));
+    assert_eq!(ok("Shift+Up Arrow").0, Trigger::single(chord("Shift+Up")));
+    assert_eq!(ok("Num +"), (Trigger::single(chord("+")), vec![ReadNote::Numpad]));
+    assert_eq!(ok("Ctrl+Num /"), (Trigger::single(chord("Cmd+/")), vec![ReadNote::Numpad]));
+    assert_eq!(ok("Numpad 5"), (Trigger::single(chord("5")), vec![ReadNote::Numpad]));
+    assert_eq!(ok("Num Enter"), (Trigger::single(chord("Enter")), vec![ReadNote::Numpad]));
+    assert_eq!(read("Win+E"), Err(ForeignError::UnsupportedModifier("Win".into())));
+    assert_eq!(read("Meta+E"), Err(ForeignError::UnsupportedModifier("Meta".into())));
+    assert_eq!(read(""), Err(ForeignError::Empty));
+    assert_eq!(read(&"x".repeat(MAX_CHORD_TEXT + 1)), Err(ForeignError::TooLong));
+    assert_eq!(read("Ctrl+Num Lock"), Err(ForeignError::UnknownKey("Num Lock".into())));
+    assert_eq!(read("Alt"), Err(ForeignError::UnknownKey("Alt".into())));
+}
+
+#[test]
+fn foreign_mac_text() {
+    let texts = ["Shift+Cmd+S", "Ctrl+Opt+Left"];
+    assert_eq!(Flavor::detect(texts), Flavor::Mac);
+    assert_eq!(Flavor::detect(["Shift+Ctrl+S", "Alt+F4"]), Flavor::Windows);
+    assert_eq!(Flavor::detect(["⌥⌘K"]), Flavor::Mac);
+    let ok = |t: &str| read_foreign(t, Flavor::Mac).unwrap_or_else(|e| panic!("{t}: {e}")).0;
+    assert_eq!(ok("Shift+Cmd+S"), Trigger::single(chord("Cmd+Shift+S")));
+    assert_eq!(ok("Ctrl+Opt+Left"), Trigger::single(chord("Ctrl+Alt+Left")));
+    assert_eq!(ok("Control-Option-Space"), Trigger::single(chord("Ctrl+Alt+Space")));
+    assert_eq!(ok("⇧⌘S"), Trigger::single(chord("Cmd+Shift+S")));
+    assert_eq!(ok("⌃⌥⇞"), Trigger::single(chord("Ctrl+Alt+PageUp")));
+    assert_eq!(ok("Cmd+,"), Trigger::single(chord("Cmd+,")));
+    // In a Windows set the same ⌃ is the command modifier.
+    assert_eq!(read_foreign("⌃S", Flavor::Windows).map(|r| r.0), Ok(Trigger::single(chord("Cmd+S"))));
+}
diff --git a/crates/keymap/tests/editor.rs b/crates/keymap/tests/editor.rs
new file mode 100644
index 00000000..02a44052
--- /dev/null
+++ b/crates/keymap/tests/editor.rs
@@ -0,0 +1,200 @@
+use craft_keymap::editor::{MAX_UNDO_BYTES, holders, search};
+use craft_keymap::{
+    AssignError, Bindable, Binding, Chord, CommandRef, DOUBLE_PRESS, EditSession, Holder, Keymap, MAX_BINDING_TEXT, MAX_BINDINGS, MAX_COMMANDS,
+    MAX_UNDO, Overrides, Platform, Policy, Recorded, Recorder, Scope, Scopes, Trigger,
+};
+
+fn chord(text: &str) -> Chord {
+    Chord::parse(text).unwrap_or_else(|e| panic!("{text}: {e}"))
+}
+
+fn b(text: &str) -> Binding {
+    Binding::parse(text).unwrap_or_else(|e| panic!("{text}: {e}"))
+}
+
+fn keymap(platform: Platform) -> Keymap {
+    let catalog = vec![
+        Bindable::new("file.save", "Save", Scope::app()).with_default(b("Cmd+S")).with_path(vec!["File".into(), "Save".into()]),
+        Bindable::new("edit.copy", "Copy", Scope::app()).with_default(b("Cmd+C")).with_alias("Kopieren"),
+        Bindable::new("view.zoomIn", "Zoom In", Scope::app()).with_default(b("Cmd+=")),
+        Bindable::new("tool.brush", "Brush", Scope::app()).with_default(b("B")).with_path(vec!["Tools".into(), "Paint".into()]),
+    ];
+    Keymap::new(catalog, Scopes::new(), platform)
+}
+
+fn keys(km: &Keymap, id: &str) -> Vec<String> {
+    km.bindings(&CommandRef::new(id)).iter().map(|b| b.to_string()).collect()
+}
+
+#[test]
+fn edits_undo_redo_and_cancel() {
+    let mut km = keymap(Platform::Windows);
+    let mut session = EditSession::begin(&km);
+    let save = CommandRef::new("file.save");
+
+    let assigned = session.edit(&mut km, |km| km.assign(&save, b("Cmd+Shift+S"), Policy::Steal));
+    assert!(assigned.is_ok());
+    session.edit(&mut km, |km| km.clear(&CommandRef::new("edit.copy")));
+    assert_eq!(keys(&km, "file.save"), ["Cmd+S", "Cmd+Shift+S"]);
+    assert!(keys(&km, "edit.copy").is_empty());
+    assert!(session.is_modified(&km));
+
+    // An edit that changes nothing is no undo step.
+    session.edit(&mut km, |km| km.reset(&CommandRef::new("tool.brush")));
+
+    assert!(session.undo(&mut km));
+    assert_eq!(keys(&km, "edit.copy"), ["Cmd+C"]);
+    assert!(session.undo(&mut km));
+    assert_eq!(keys(&km, "file.save"), ["Cmd+S"]);
+    assert!(!session.undo(&mut km));
+    assert!(!session.is_modified(&km));
+
+    assert!(session.redo(&mut km));
+    assert_eq!(keys(&km, "file.save"), ["Cmd+S", "Cmd+Shift+S"]);
+    // A new edit drops what could be redone.
+    session.edit(&mut km, |km| km.clear(&CommandRef::new("tool.brush")));
+    assert!(!session.redo(&mut km));
+
+    session.cancel(&mut km);
+    assert!(!session.is_modified(&km));
+    assert_eq!(keys(&km, "file.save"), ["Cmd+S"]);
+    assert_eq!(keys(&km, "tool.brush"), ["B"]);
+    assert!(!session.can_undo());
+}
+
+#[test]
+fn undo_keeps_the_newest_steps() {
+    let mut km = keymap(Platform::Windows);
+    let mut session = EditSession::begin(&km);
+    let brush = CommandRef::new("tool.brush");
+    // Each edit changes the key: N, B, N, … (B is the default).
+    let edits = MAX_UNDO + 11;
+    for i in 0..edits {
+        let key = if i % 2 == 0 { "N" } else { "B" };
+        assert!(session.edit(&mut km, |km| km.set_bindings(&brush, vec![b(key)], Policy::Keep)).is_ok());
+    }
+    let mut steps = 0;
+    while session.undo(&mut km) {
+        steps += 1;
+    }
+    assert_eq!(steps, MAX_UNDO);
+    // The 11 oldest steps are gone: undo stops after the 11th edit, which set N.
+    assert_eq!(keys(&km, "tool.brush"), ["N"]);
+    assert!(session.is_modified(&km));
+}
+
+#[test]
+fn undo_history_is_capped_by_size() {
+    let mut km = keymap(Platform::Windows);
+    let mut session = EditSession::begin(&km);
+    // Full-size snapshots of entries for commands the catalog does not have.
+    let big = |tag: char| {
+        let mut o = Overrides::new();
+        for n in 0..MAX_COMMANDS {
+            assert!(o.insert(format!("junk.{n}"), vec![tag.to_string().repeat(MAX_BINDING_TEXT); MAX_BINDINGS]));
+        }
+        o
+    };
+    let (a, b) = (big('a'), big('b'));
+    let string = size_of::<String>();
+    let per = a.iter().map(|(k, t)| string + 64 + k.len() + t.iter().map(|t| string + 16 + t.len()).sum::<usize>()).sum::<usize>();
+    let edits = 2 * MAX_UNDO_BYTES / per + 4;
+    for n in 0..edits {
+        let next = if n % 2 == 0 { a.clone() } else { b.clone() };
+        session.edit(&mut km, |km| km.set_overrides(next));
+    }
+    let mut steps = 0;
+    while session.undo(&mut km) {
+        steps += 1;
+    }
+    assert!(steps >= 2 && steps <= MAX_UNDO_BYTES / per, "{steps} steps of {per} bytes");
+}
+
+#[test]
+fn recorder_turns_presses_into_triggers() {
+    let mut r = Recorder::new();
+    let a = chord("A");
+    assert_eq!(r.press(a, 1.0), Recorded::Single(Trigger::single(a)));
+    assert_eq!(r.press(a, 1.0 + DOUBLE_PRESS / 2.0), Recorded::Double(Trigger::double(a)));
+    // The press after a double starts over.
+    assert_eq!(r.press(a, 1.4), Recorded::Single(Trigger::single(a)));
+    // Too late for a double.
+    assert_eq!(r.press(a, 1.4 + DOUBLE_PRESS + 0.1), Recorded::Single(Trigger::single(a)));
+    // Another chord in between.
+    assert_eq!(r.press(chord("B"), 3.0), Recorded::Single(Trigger::single(chord("B"))));
+    assert_eq!(r.press(a, 3.1), Recorded::Single(Trigger::single(a)));
+
+    assert_eq!(r.press(chord("Escape"), 3.2), Recorded::Cancel);
+    let shift_escape = chord("Shift+Escape");
+    assert_eq!(r.press(shift_escape, 3.3), Recorded::Single(Trigger::single(shift_escape)));
+    // Two presses in one egui frame share its time.
+    assert_eq!(r.press(a, 4.0), Recorded::Single(Trigger::single(a)));
+    assert_eq!(r.press(a, 4.0), Recorded::Double(Trigger::double(a)));
+}
+
+#[test]
+fn search_reads_labels_aliases_paths_ids_and_keys() {
+    let ids = |km: &Keymap, q: &str, p: Platform| search(km, q, p).iter().map(|b| b.command.id.clone()).collect::<Vec<_>>();
+    let win = keymap(Platform::Windows);
+    let mac = keymap(Platform::Mac);
+    assert_eq!(ids(&win, "zoom", Platform::Windows), ["view.zoomIn"]);
+    assert_eq!(ids(&win, "KOPIEREN", Platform::Windows), ["edit.copy"]);
+    assert_eq!(ids(&win, "paint", Platform::Windows), ["tool.brush"]);
+    assert_eq!(ids(&win, "file.sa", Platform::Windows), ["file.save"]);
+    assert_eq!(ids(&win, "ctrl+s", Platform::Windows), ["file.save"]);
+    assert_eq!(ids(&win, "cmd+c", Platform::Windows), ["edit.copy"]);
+    assert_eq!(ids(&mac, "⌘s", Platform::Mac), ["file.save"]);
+    assert_eq!(ids(&mac, "⌘s", Platform::Windows), Vec::<String>::new());
+    assert_eq!(ids(&mac, "  ", Platform::Mac).len(), 4);
+}
+
+#[test]
+fn a_dialog_asks_before_stealing_and_undoes_each_answer() {
+    let mut km = keymap(Platform::Mac);
+    let mut session = EditSession::begin(&km);
+    let save = CommandRef::new("file.save");
+    let copy = CommandRef::new("edit.copy");
+    let held = vec![Holder { command: copy.clone(), binding: b("Cmd+C") }];
+
+    // While recording: who else has the key.
+    assert_eq!(holders(&km, &save, &b("Cmd+C")), held);
+    assert!(holders(&km, &copy, &b("Cmd+C")).is_empty(), "its own key");
+    assert_eq!(session.assign(&mut km, &save, b("Cmd+C"), Policy::Refuse), Err(AssignError::Taken(held.clone())));
+    assert!(!session.can_undo(), "a refused assignment changes nothing");
+
+    // Keep: both hold it.
+    let kept = session.assign(&mut km, &save, b("Cmd+C"), Policy::Keep).unwrap();
+    assert_eq!(kept.clashes, held);
+    assert_eq!(keys(&km, "edit.copy"), ["Cmd+C"]);
+    assert!(session.undo(&mut km));
+
+    // Steal: the other command loses it.
+    let stolen = session.assign(&mut km, &save, b("Cmd+C"), Policy::Steal).unwrap();
+    assert_eq!(stolen.taken_from, held);
+    assert!(keys(&km, "edit.copy").is_empty());
+    assert_eq!(keys(&km, "file.save"), ["Cmd+S", "Cmd+C"]);
+
+    // Recording over one key of the list replaces it in place.
+    session.replace(&mut km, &save, &b("Cmd+S"), b("Cmd+Shift+S"), Policy::Refuse).unwrap();
+    assert_eq!(keys(&km, "file.save"), ["Cmd+Shift+S", "Cmd+C"]);
+    assert!(session.remove(&mut km, &save, &b("Cmd+C")));
+    assert!(session.clear(&mut km, &CommandRef::new("tool.brush")));
+
+    assert!(session.reset(&mut km, &save));
+    assert_eq!(keys(&km, "file.save"), ["Cmd+S"]);
+    session.reset_all(&mut km);
+    assert!(km.overrides().is_empty());
+    assert!(!session.is_modified(&km));
+
+    // One undo per action, back to the steal.
+    for _ in 0..5 {
+        assert!(session.undo(&mut km));
+    }
+    assert_eq!(keys(&km, "file.save"), ["Cmd+S", "Cmd+C"]);
+    assert!(session.undo(&mut km));
+    assert!(!session.can_undo());
+
+    session.redo(&mut km);
+    session.cancel(&mut km);
+    assert!(km.overrides().is_empty(), "cancel restores the state at open");
+}
diff --git a/crates/keymap/tests/egui.rs b/crates/keymap/tests/egui.rs
new file mode 100644
index 00000000..e5364518
--- /dev/null
+++ b/crates/keymap/tests/egui.rs
@@ -0,0 +1,573 @@
+#![cfg(feature = "egui")]
+
+use craft_keymap::egui::{Dispatcher, Hit, matches, platform};
+use craft_keymap::{Active, Bindable, Binding, Chord, CommandRef, Key, KeyInput, Keymap, Kind, Layout, Mods, Platform, Scope, Scopes, Trigger};
+use egui::{Event, InputState, Key as EguiKey, Modifiers};
+
+fn chord(text: &str) -> Chord {
+    Chord::parse(text).unwrap_or_else(|e| panic!("{text}: {e}"))
+}
+
+#[test]
+fn a_browser_on_a_mac_gets_the_mac_keymap() {
+    let ctx = egui::Context::default();
+    ctx.set_os(egui::os::OperatingSystem::from_user_agent("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15"));
+    assert_eq!(platform(&ctx), Platform::Mac);
+    ctx.set_os(egui::os::OperatingSystem::from_user_agent("Mozilla/5.0 (Windows NT 10.0; Win64; x64)"));
+    assert_eq!(platform(&ctx), Platform::Windows);
+}
+
+#[test]
+fn every_key_converts_both_ways() {
+    for &key in Key::ALL {
+        assert_eq!(Key::from_egui(key.to_egui()), Some(key), "{key}");
+    }
+    for k in [EguiKey::Copy, EguiKey::Cut, EguiKey::Paste, EguiKey::BrowserBack, EguiKey::ShiftLeft, EguiKey::IntlBackslash] {
+        assert_eq!(Key::from_egui(k), None);
+    }
+}
+
+#[test]
+fn modifiers_and_shortcuts_follow_the_platform() {
+    let ctrl = Modifiers { ctrl: true, command: true, ..Modifiers::NONE };
+    assert_eq!(Mods::from_egui(&ctrl, Platform::Windows), Mods::CMD);
+    assert_eq!(Mods::from_egui(&Modifiers::CTRL, Platform::Mac), Mods::CTRL);
+    assert_eq!(Mods::from_egui(&Modifiers::MAC_CMD, Platform::Mac), Mods::CMD);
+
+    assert!(matches(&chord("Ctrl+S"), EguiKey::S, &ctrl, Platform::Windows));
+    assert!(matches(&chord("Cmd+S"), EguiKey::S, &ctrl, Platform::Windows));
+    assert!(!matches(&chord("Cmd+S"), EguiKey::S, &Modifiers::CTRL, Platform::Mac));
+
+    let shortcut = chord("Cmd+Shift+Z").to_egui_shortcut();
+    assert_eq!(shortcut.logical_key, EguiKey::Z);
+    assert!(Modifiers { mac_cmd: true, command: true, shift: true, ..Modifiers::NONE }.matches_exact(shortcut.modifiers));
+}
+
+#[test]
+fn shifted_symbols_match_their_bindings() {
+    let p = Platform::Windows;
+    let shift = Modifiers::SHIFT;
+    let none = Modifiers::NONE;
+    let cmd = Modifiers { ctrl: true, command: true, ..Modifiers::NONE };
+    let cmd_shift = Modifiers { shift: true, ..cmd };
+
+    // Shift+base matches the shifted key egui reports, but the base key alone does not.
+    assert!(matches(&chord("Shift+;"), EguiKey::Colon, &shift, p));
+    assert!(!matches(&chord("Shift+;"), EguiKey::Semicolon, &none, p));
+    assert!(!matches(&chord(";"), EguiKey::Colon, &shift, p));
+    assert!(matches(&chord("Shift+/"), EguiKey::Questionmark, &shift, p));
+    assert!(matches(&chord("Cmd+Shift+]"), EguiKey::CloseCurlyBracket, &cmd_shift, p));
+    assert!(matches(&chord("Shift+1"), EguiKey::Exclamationmark, &shift, p));
+    // A shifted symbol bound directly matches while Shift is held to type it.
+    assert!(matches(&chord("?"), EguiKey::Questionmark, &shift, p));
+    assert!(matches(&chord(":"), EguiKey::Colon, &none, p));
+
+    // Zoom keys: `=` also matches `+`, with or without Shift; `+` matches Shift+`=`.
+    assert!(matches(&chord("Cmd+="), EguiKey::Plus, &cmd, p));
+    assert!(matches(&chord("Cmd+="), EguiKey::Plus, &cmd_shift, p));
+    assert!(matches(&chord("Cmd+="), EguiKey::Equals, &cmd, p));
+    assert!(matches(&chord("Cmd++"), EguiKey::Equals, &cmd_shift, p));
+    assert!(matches(&chord("Cmd++"), EguiKey::Plus, &cmd_shift, p));
+    assert!(!matches(&chord("Cmd++"), EguiKey::Equals, &cmd, p));
+    assert!(!matches(&chord("Cmd+="), EguiKey::Plus, &none, p));
+    assert!(!matches(&chord("Cmd+="), EguiKey::Minus, &cmd, p));
+}
+
+const CTRL: Modifiers = Modifiers { ctrl: true, command: true, ..Modifiers::NONE };
+
+fn dispatch_keymap() -> Keymap {
+    let app = |id: &str, keys: &[&str]| keys.iter().fold(Bindable::new(id, id, Scope::app()), |e, k| e.with_default(Binding::parse(k).unwrap()));
+    let tool = |id: &str| app(id, &["M"]).with_kind(Kind::Tool { group: Some("select".into()) });
+    let catalog = vec![
+        app("edit.copy", &["Cmd+C", "Cmd+Insert"]),
+        app("edit.paste", &["Cmd+V", "Shift+Insert"]),
+        app("edit.pasteInPlace", &["Cmd+Shift+V"]),
+        app("edit.copyMerged", &["Cmd+Shift+C"]),
+        app("app.quit", &["Cmd+Alt+Q"]),
+        app("type.pageNumber", &["Cmd+Alt+Shift+N"]),
+        app("view.refresh", &["Cmd+Alt+F5"]),
+        app("file.save", &["Cmd+S"]),
+        app("view.zoomIn", &["="]),
+        app("help.find", &["Shift+;"]),
+        app("tool.brush", &["B"]),
+        app("app.loop", &["L"]),
+        Bindable::new("timeline.loop", "Loop", Scope::new("Timeline").unwrap()).with_default(Binding::parse("L").unwrap()),
+        tool("tool.marquee"),
+        tool("tool.ellipse"),
+        app("reveal.one", &["U"]),
+        app("reveal.all", &["U U"]),
+    ];
+    Keymap::new(catalog, Scopes::new().with_panel("Timeline"), Platform::Windows)
+}
+
+fn press(key: EguiKey, modifiers: Modifiers) -> Event {
+    Event::Key { key, physical_key: Some(key), pressed: true, repeat: false, modifiers }
+}
+
+fn frame(time: f64, modifiers: Modifiers, events: Vec<Event>) -> InputState {
+    let mut input = InputState::default();
+    input.time = time;
+    input.modifiers = modifiers;
+    input.events = events;
+    input
+}
+
+/// Dispatches one frame and returns the ids that ran and the events left.
+fn run(d: &mut Dispatcher, km: &Keymap, active: &Active, mut input: InputState) -> (Vec<String>, Vec<Event>) {
+    let hits = d.dispatch(&mut input, km, active);
+    (hits.into_iter().map(|h| h.command.id).collect(), input.events)
+}
+
+#[test]
+fn a_bound_press_runs_once_and_is_removed_with_its_text() {
+    let km = dispatch_keymap();
+    let events = vec![
+        press(EguiKey::B, Modifiers::NONE),
+        Event::Text("b".into()),
+        Event::Key { key: EguiKey::B, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE },
+        press(EguiKey::Q, Modifiers::NONE),
+        Event::Text("q".into()),
+    ];
+    let (ran, left) = run(&mut Dispatcher::new(), &km, &Active::NONE, frame(1.0, Modifiers::NONE, events));
+    assert_eq!(ran, ["tool.brush"]);
+    // The release and the unbound Q with its text stay.
+    assert_eq!(left.len(), 3);
+    assert!(matches!(left[0], Event::Key { key: EguiKey::B, pressed: false, .. }));
+    assert!(matches!(left[1], Event::Key { key: EguiKey::Q, pressed: true, .. }));
+    assert_eq!(left[2], Event::Text("q".into()));
+}
+
+#[test]
+fn shifted_symbols_and_zoom_keys_reach_their_bindings() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    let shift = Modifiers::SHIFT;
+    let (ran, left) = run(&mut d, &km, &Active::NONE, frame(1.0, shift, vec![press(EguiKey::Colon, shift), Event::Text(":".into())]));
+    assert_eq!(ran, ["help.find"]);
+    assert!(left.is_empty());
+    let (ran, _) = run(&mut d, &km, &Active::NONE, frame(2.0, Modifiers::NONE, vec![press(EguiKey::Plus, Modifiers::NONE)]));
+    assert_eq!(ran, ["view.zoomIn"]);
+    let (ran, _) = run(&mut d, &km, &Active::NONE, frame(3.0, shift, vec![press(EguiKey::Plus, shift)]));
+    assert_eq!(ran, ["view.zoomIn"]);
+}
+
+#[test]
+fn clipboard_events_stay_with_the_app_by_default() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    // egui-winit sends these in place of the Ctrl+C and Ctrl+V presses.
+    let events = vec![Event::Copy, Event::Paste("text".into())];
+    let (ran, left) = run(&mut d, &km, &Active::NONE, frame(1.0, CTRL, events.clone()));
+    assert!(ran.is_empty(), "{ran:?}");
+    assert_eq!(left, events);
+    // The web build sends the press and then the event: both stay.
+    let events = vec![press(EguiKey::C, CTRL), Event::Copy, press(EguiKey::S, CTRL)];
+    let (ran, left) = run(&mut d, &km, &Active::NONE, frame(2.0, CTRL, events.clone()));
+    assert_eq!(ran, ["file.save"]);
+    assert_eq!(left, events[..2]);
+    // A clipboard press with no clipboard event after it is an ordinary press.
+    let (ran, _) = run(&mut d, &km, &Active::NONE, frame(3.0, CTRL, vec![press(EguiKey::Insert, CTRL)]));
+    assert_eq!(ran, ["edit.copy"]);
+}
+
+#[test]
+fn clipboard_chords_with_more_modifiers_run_their_bindings() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    let typing = Active { typing: true, ..Active::NONE };
+    let ctrl_shift = Modifiers { shift: true, ..CTRL };
+    // The desktop: egui-winit sends the Paste event in place of Ctrl+Shift+V.
+    let mut input = frame(1.0, ctrl_shift, vec![Event::Paste("text".into())]);
+    let hits = d.dispatch(&mut input, &km, &Active::NONE);
+    let ran: Vec<_> = hits.iter().map(|h| (h.command.id.as_str(), h.pasted.as_deref())).collect();
+    assert_eq!(ran, [("edit.pasteInPlace", Some("text"))]);
+    assert!(input.events.is_empty());
+    let (ran, left) = run(&mut d, &km, &typing, frame(2.0, ctrl_shift, vec![Event::Copy]));
+    assert_eq!(ran, ["edit.copyMerged"]);
+    assert!(left.is_empty());
+    // Ctrl+Shift+X has no binding: the event stays.
+    let (ran, left) = run(&mut d, &km, &Active::NONE, frame(3.0, ctrl_shift, vec![Event::Cut]));
+    assert!(ran.is_empty());
+    assert_eq!(left, [Event::Cut]);
+
+    // The web: the press decides for itself and its event, also while typing.
+    for (time, active) in [(4.0, &Active::NONE), (5.0, &typing)] {
+        let events = vec![press(EguiKey::C, ctrl_shift), Event::Copy];
+        let (ran, left) = run(&mut d, &km, active, frame(time, ctrl_shift, events));
+        assert_eq!(ran, ["edit.copyMerged"]);
+        assert!(left.is_empty(), "{left:?}");
+    }
+    let events = vec![press(EguiKey::X, ctrl_shift), Event::Cut];
+    let (ran, left) = run(&mut d, &km, &Active::NONE, frame(6.0, ctrl_shift, events.clone()));
+    assert!(ran.is_empty());
+    assert_eq!(left, events);
+}
+
+#[test]
+fn clipboard_events_run_their_chords_outside_text_fields_when_turned_on() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new().with_clipboard_events(true);
+    let mut input = frame(1.0, CTRL, vec![Event::Copy, Event::Paste("text".into())]);
+    let hits = d.dispatch(&mut input, &km, &Active::NONE);
+    let ran: Vec<_> = hits.iter().map(|h| (h.command.id.as_str(), h.pasted.as_deref())).collect();
+    assert_eq!(ran, [("edit.copy", None), ("edit.paste", Some("text"))]);
+    assert!(input.events.is_empty());
+
+    let typing = Active { typing: true, ..Active::NONE };
+    let (ran, left) = run(&mut d, &km, &typing, frame(2.0, CTRL, vec![Event::Copy]));
+    assert!(ran.is_empty());
+    assert_eq!(left, [Event::Copy]);
+
+    // The web build sends the key press and the clipboard event it causes: one run each.
+    for (time, key, mods, event, id) in [
+        (3.0, EguiKey::C, CTRL, Event::Copy, "edit.copy"),
+        (4.0, EguiKey::Insert, CTRL, Event::Copy, "edit.copy"),
+        (5.0, EguiKey::Insert, Modifiers::SHIFT, Event::Paste("text".into()), "edit.paste"),
+    ] {
+        let (ran, _) = run(&mut d, &km, &Active::NONE, frame(time, mods, vec![press(key, mods), event]));
+        assert_eq!(ran, [id], "{key:?}");
+    }
+}
+
+#[test]
+fn a_web_paste_carries_its_text_and_takes_its_event() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new().with_clipboard_events(true);
+    // The web build sends the Cmd+V press and then the Paste event with the clipboard text.
+    let events = vec![press(EguiKey::V, CTRL), Event::Paste("text".into()), press(EguiKey::C, CTRL), Event::Copy];
+    let mut input = frame(1.0, CTRL, events.clone());
+    let mut seen = Vec::new();
+    let hits = d.dispatch_filtered(&mut input, &km, &Active::NONE, |hit| {
+        seen.push(hit.pasted.clone());
+        true
+    });
+    let ran: Vec<_> = hits.iter().map(|h| (h.command.id.as_str(), h.pasted.as_deref())).collect();
+    assert_eq!(ran, [("edit.paste", Some("text")), ("edit.copy", None)]);
+    assert_eq!(seen, [Some("text".to_string()), None], "the filter sees the pasted text");
+    assert!(input.events.is_empty(), "{:?}", input.events);
+
+    // A declined press leaves the press and its event in place, and the event does not run again.
+    let mut input = frame(2.0, CTRL, events.clone());
+    let hits = d.dispatch_filtered(&mut input, &km, &Active::NONE, |hit| hit.command.id != "edit.paste");
+    let ran: Vec<_> = hits.iter().map(|h| h.command.id.as_str()).collect();
+    assert_eq!(ran, ["edit.copy"]);
+    assert_eq!(input.events, events[..2]);
+}
+
+#[test]
+fn a_held_web_paste_runs_once_when_repeats_are_off() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new().with_clipboard_events(true);
+    let repeat = Event::Key { key: EguiKey::V, physical_key: Some(EguiKey::V), pressed: true, repeat: true, modifiers: CTRL };
+    let paste = || Event::Paste("text".into());
+    let events = vec![press(EguiKey::V, CTRL), paste(), repeat.clone(), paste()];
+    let (ran, left) = run(&mut d, &km, &Active::NONE, frame(1.0, CTRL, events));
+    assert_eq!(ran, ["edit.paste"]);
+    assert_eq!(left, [repeat, paste()], "the repeat and its event stay in egui's input");
+}
+
+#[test]
+fn declined_hits_leave_their_events_in_order() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    let shift = Modifiers::SHIFT;
+    let events = vec![
+        press(EguiKey::B, Modifiers::NONE),
+        Event::Text("b".into()),
+        press(EguiKey::S, CTRL),
+        press(EguiKey::Colon, shift),
+        Event::Text(":".into()),
+        press(EguiKey::Equals, Modifiers::NONE),
+    ];
+    let mut input = frame(1.0, Modifiers::NONE, events.clone());
+    let mut seen = Vec::new();
+    let hits = d.dispatch_filtered(&mut input, &km, &Active::NONE, |hit| {
+        seen.push((hit.command.id.clone(), hit.trigger.chord.to_string(), hit.exact));
+        hit.command.id != "file.save" && hit.command.id != "tool.brush"
+    });
+    let s = |id: &str, chord: &str, exact| (id.to_string(), chord.to_string(), exact);
+    assert_eq!(seen, [s("tool.brush", "B", true), s("file.save", "Cmd+S", true), s("help.find", "Shift+;", false), s("view.zoomIn", "=", true)]);
+    let ran: Vec<_> = hits.iter().map(|h| h.command.id.as_str()).collect();
+    assert_eq!(ran, ["help.find", "view.zoomIn"]);
+    assert_eq!(input.events, events[..3], "the declined B keeps its text, and Ctrl+S stays in its place");
+}
+
+#[test]
+fn clipboard_presses_stay_with_the_text_field() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    let typing = Active { typing: true, ..Active::NONE };
+    // The web build's Cmd+C press and its Copy event both reach the text field.
+    let events = vec![press(EguiKey::C, CTRL), Event::Copy, press(EguiKey::Insert, CTRL)];
+    let (ran, left) = run(&mut d, &km, &typing, frame(1.0, CTRL, events.clone()));
+    assert!(ran.is_empty(), "{ran:?}");
+    assert_eq!(left, events);
+    let (ran, _) = run(&mut d, &km, &Active::NONE, frame(2.0, CTRL, vec![press(EguiKey::Insert, CTRL)]));
+    assert_eq!(ran, ["edit.copy"]);
+}
+
+#[test]
+fn a_press_that_types_text_stays_with_the_text_field() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    let typing = Active { typing: true, ..Active::NONE };
+    // A press the web build's text agent follows with the text it typed.
+    let events = vec![press(EguiKey::B, Modifiers::NONE), Event::Text("b".into())];
+    let (ran, left) = run(&mut d, &km, &typing, frame(1.0, Modifiers::NONE, events.clone()));
+    assert!(ran.is_empty(), "{ran:?}");
+    assert_eq!(left, events);
+}
+
+#[test]
+fn ctrl_alt_is_left_to_the_text_field_only_when_it_types() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    let typing = Active { typing: true, ..Active::NONE };
+    // AltGr+Q on a German layout types `@`: the browser on Windows reports Ctrl+Alt+Q and the text
+    // agent sends the text after it.
+    let alt_gr = Modifiers { alt: true, ..CTRL };
+    let events = vec![press(EguiKey::Q, alt_gr), Event::Text("@".into())];
+    let (ran, left) = run(&mut d, &km, &typing, frame(1.0, alt_gr, events.clone()));
+    assert!(ran.is_empty(), "{ran:?}");
+    assert_eq!(left, events);
+    // A real Ctrl+Alt chord types nothing, so it runs while typing.
+    let all = Modifiers { shift: true, ..alt_gr };
+    let (ran, left) = run(&mut d, &km, &typing, frame(2.0, all, vec![press(EguiKey::N, all)]));
+    assert_eq!(ran, ["type.pageNumber"]);
+    assert!(left.is_empty());
+    let (ran, _) = run(&mut d, &km, &typing, frame(3.0, alt_gr, vec![press(EguiKey::Q, alt_gr)]));
+    assert_eq!(ran, ["app.quit"]);
+}
+
+#[test]
+fn typing_blocks_plain_keys_but_not_command_chords() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    let typing = Active { typing: true, ..Active::NONE };
+    let events = vec![press(EguiKey::B, Modifiers::NONE), Event::Text("b".into()), press(EguiKey::S, CTRL)];
+    let (ran, left) = run(&mut d, &km, &typing, frame(1.0, CTRL, events));
+    assert_eq!(ran, ["file.save"]);
+    assert_eq!(left.len(), 2);
+    assert_eq!(left[1], Event::Text("b".into()));
+}
+
+#[test]
+fn undo_goes_to_the_text_field_and_save_still_runs() {
+    let km = Keymap::new(
+        vec![
+            Bindable::new("edit.undo", "Undo", Scope::app()).with_default(Binding::parse("Cmd+Z").unwrap()),
+            Bindable::new("file.save", "Save", Scope::app()).with_default(Binding::parse("Cmd+S").unwrap()),
+        ],
+        Scopes::new(),
+        Platform::Windows,
+    );
+    let typing = Active { typing: true, ..Active::NONE };
+    let events = vec![press(EguiKey::Z, CTRL), press(EguiKey::S, CTRL)];
+    let (ran, left) = run(&mut Dispatcher::new(), &km, &typing, frame(1.0, CTRL, events));
+    assert_eq!(ran, ["file.save"]);
+    assert_eq!(left, [press(EguiKey::Z, CTRL)]);
+}
+
+#[test]
+fn the_focused_panel_wins_and_tool_groups_cycle() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    let l = || frame(1.0, Modifiers::NONE, vec![press(EguiKey::L, Modifiers::NONE)]);
+    assert_eq!(run(&mut d, &km, &Active::panel("Timeline"), l()).0, ["timeline.loop"]);
+    assert_eq!(run(&mut d, &km, &Active::NONE, l()).0, ["app.loop"]);
+
+    let mut input = frame(2.0, Modifiers::NONE, vec![press(EguiKey::M, Modifiers::NONE)]);
+    let hits = d.dispatch(&mut input, &km, &Active::NONE);
+    let tools = vec![CommandRef::new("tool.marquee"), CommandRef::new("tool.ellipse")];
+    let trigger = Trigger::single(chord("M"));
+    let got: Vec<_> = hits.iter().map(|h: &Hit| (&h.command, &h.cycle, h.trigger, h.exact, h.pasted.as_deref())).collect();
+    assert_eq!(got, [(&tools[0], &tools, trigger, true, None)]);
+}
+
+#[test]
+fn a_second_press_runs_the_double_binding() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    let key = |d: &mut Dispatcher, k: EguiKey, t: f64| run(d, &km, &Active::NONE, frame(t, Modifiers::NONE, vec![press(k, Modifiers::NONE)])).0;
+    let u = |d: &mut Dispatcher, t: f64| key(d, EguiKey::U, t);
+    assert_eq!(u(&mut d, 1.0), ["reveal.one"]);
+    assert_eq!(u(&mut d, 1.3), ["reveal.all"]);
+    // The press after a double starts over.
+    assert_eq!(u(&mut d, 1.5), ["reveal.one"]);
+    assert_eq!(u(&mut d, 2.5), ["reveal.one"]);
+    // B in between breaks the pair.
+    key(&mut d, EguiKey::B, 2.6);
+    assert_eq!(u(&mut d, 2.7), ["reveal.one"]);
+}
+
+#[test]
+fn a_double_press_needs_both_presses_in_one_panel() {
+    let km = Keymap::new(
+        vec![
+            Bindable::new("x.one", "One", Scope::new("X").unwrap()).with_default(Binding::parse("A").unwrap()),
+            Bindable::new("y.one", "One", Scope::new("Y").unwrap()).with_default(Binding::parse("A").unwrap()),
+            Bindable::new("y.two", "Two", Scope::new("Y").unwrap()).with_default(Binding::parse("A A").unwrap()),
+        ],
+        Scopes::new().with_panel("X").with_panel("Y").with_panel_fallthrough(false),
+        Platform::Windows,
+    );
+    let mut d = Dispatcher::new();
+    let a = |d: &mut Dispatcher, panel, t| run(d, &km, &Active::panel(panel), frame(t, Modifiers::NONE, vec![press(EguiKey::A, Modifiers::NONE)])).0;
+    assert_eq!(a(&mut d, "X", 1.0), ["x.one"]);
+    assert_eq!(a(&mut d, "Y", 1.2), ["y.one"]);
+    assert_eq!(a(&mut d, "Y", 1.4), ["y.two"]);
+}
+
+#[test]
+fn two_presses_in_one_frame_make_a_double() {
+    let km = dispatch_keymap();
+    let mut d = Dispatcher::new();
+    let u = press(EguiKey::U, Modifiers::NONE);
+    let (ran, left) = run(&mut d, &km, &Active::NONE, frame(4.0, Modifiers::NONE, vec![u.clone(), u]));
+    assert_eq!(ran, ["reveal.one", "reveal.all"]);
+    assert!(left.is_empty(), "{left:?}");
+}
+
+#[test]
+fn key_repeats_run_only_when_turned_on() {
+    let km = Keymap::new(
+        vec![
+            Bindable::new("nudge.right", "Nudge", Scope::app()).with_default(Binding::parse("Right").unwrap()),
+            Bindable::new("jump.right", "Jump", Scope::app()).with_default(Binding::parse("Right Right").unwrap()),
+        ],
+        Scopes::new(),
+        Platform::Windows,
+    );
+    let held = |repeat: bool| Event::Key { key: EguiKey::ArrowRight, physical_key: None, pressed: true, repeat, modifiers: Modifiers::NONE };
+    let events = || vec![held(false), held(true), held(true)];
+
+    let mut on = Dispatcher::new().with_repeat(true);
+    let (ran, left) = run(&mut on, &km, &Active::NONE, frame(1.0, Modifiers::NONE, events()));
+    assert_eq!(ran, ["nudge.right", "nudge.right", "nudge.right"]);
+    assert!(left.is_empty());
+    // Repeats neither made nor broke a double: the next press within the window is one.
+    let (ran, _) = run(&mut on, &km, &Active::NONE, frame(1.3, Modifiers::NONE, vec![held(false)]));
+    assert_eq!(ran, ["jump.right"]);
+
+    let (ran, left) = run(&mut Dispatcher::new(), &km, &Active::NONE, frame(1.0, Modifiers::NONE, events()));
+    assert_eq!(ran, ["nudge.right"]);
+    assert_eq!(left, [held(true), held(true)]);
+}
+
+#[test]
+fn the_dispatcher_reads_presses_by_the_layout() {
+    let app = |id: &str, key: &str| Bindable::new(id, id, Scope::app()).with_default(Binding::parse(key).unwrap());
+    let km = Keymap::new(
+        vec![app("edit.duplicate", "Cmd+Shift+D"), app("tab.next", "Cmd+Shift+]"), app("edit.comment", "Cmd+/")],
+        Scopes::new(),
+        Platform::Windows,
+    );
+    let at = |key, physical, modifiers| Event::Key { key, physical_key: Some(physical), pressed: true, repeat: false, modifiers };
+    let ctrl_shift = Modifiers { shift: true, ..CTRL };
+
+    // Arabic 101: typing ي on the D key shows the layout is not Latin, so ⌃⇧D (which types ]) is
+    // Ctrl+Shift+D.
+    let mut d = Dispatcher::new();
+    let typed = vec![at(EguiKey::D, EguiKey::D, Modifiers::NONE), Event::Text("ي".into())];
+    run(&mut d, &km, &Active::NONE, frame(1.0, Modifiers::NONE, typed));
+    assert!(!d.layout().is_latin());
+    let (ran, _) = run(&mut d, &km, &Active::NONE, frame(2.0, ctrl_shift, vec![at(EguiKey::CloseBracket, EguiKey::D, ctrl_shift)]));
+    assert_eq!(ran, ["edit.duplicate"]);
+
+    // German: ⇧7 types /, so Ctrl+Shift+7 runs Ctrl+/; the ü key's label is learned from typing.
+    let mut d = Dispatcher::new();
+    let typed = vec![at(EguiKey::OpenBracket, EguiKey::OpenBracket, Modifiers::NONE), Event::Text("ü".into())];
+    run(&mut d, &km, &Active::NONE, frame(1.0, Modifiers::NONE, typed));
+    assert_eq!(chord("Cmd+[").display_for(Platform::Windows, d.layout()), "Ctrl+Ü");
+    let (ran, _) = run(&mut d, &km, &Active::NONE, frame(2.0, ctrl_shift, vec![at(EguiKey::Slash, EguiKey::Num7, ctrl_shift)]));
+    assert_eq!(ran, ["edit.comment"]);
+
+    // German on egui-winit: AltGr+M types µ and AltGr+] types ~ with no modifiers reported, so
+    // presses while right Alt is held teach nothing and Ctrl+Z stays Ctrl+Z on the Y position.
+    let mut d = Dispatcher::new();
+    let typed = vec![at(EguiKey::Plus, EguiKey::CloseBracket, Modifiers::NONE), Event::Text("+".into())];
+    run(&mut d, &km, &Active::NONE, frame(1.0, Modifiers::NONE, typed));
+    let right_alt =
+        |pressed| Event::Key { key: EguiKey::AltRight, physical_key: Some(EguiKey::AltRight), pressed, repeat: false, modifiers: Modifiers::NONE };
+    run(&mut d, &km, &Active::NONE, frame(2.0, Modifiers::NONE, vec![right_alt(true)]));
+    let alt_graph = vec![
+        at(EguiKey::M, EguiKey::M, Modifiers::NONE),
+        Event::Text("µ".into()),
+        at(EguiKey::CloseBracket, EguiKey::CloseBracket, Modifiers::NONE),
+        Event::Text("~".into()),
+        right_alt(false),
+    ];
+    run(&mut d, &km, &Active::NONE, frame(3.0, Modifiers::NONE, alt_graph));
+    assert!(d.layout().is_latin());
+    assert_eq!(d.layout().char_at(Key::CloseBracket), Some('+'));
+    assert_eq!(d.layout().resolve(&KeyInput::new(Mods::CMD).with_typed(Key::Z).with_physical(Key::Y)), Some(chord("Cmd+Z")));
+
+    // A layout the platform reports applies from the first press.
+    let mut d = Dispatcher::new().with_layout(Layout::new().with_latin(false));
+    let (ran, _) = run(&mut d, &km, &Active::NONE, frame(1.0, ctrl_shift, vec![at(EguiKey::CloseBracket, EguiKey::D, ctrl_shift)]));
+    assert_eq!(ran, ["edit.duplicate"]);
+}
+
+#[test]
+fn letters_follow_the_latin_layout_from_egui_winit_to_the_dispatcher() {
+    let app = |id: &str, key: &str| Bindable::new(id, id, Scope::app()).with_default(Binding::parse(key).unwrap());
+    let km = Keymap::new(vec![app("d", "Cmd+D"), app("e", "Cmd+E")], Scopes::new(), Platform::Linux);
+    let at = |key, modifiers| Event::Key { key, physical_key: Some(EguiKey::D), pressed: true, repeat: false, modifiers };
+
+    // The QWERTY D key, as the suite's egui-winit reports it: on a layout that is not Latin, the
+    // logical key is the Latin layout's letter (Dvorak types e there), and the text is Cyrillic.
+    // (layout, logical key, text typed, platform report, command Ctrl runs)
+    let cases = [
+        ("Dvorak + Russian", EguiKey::E, "в", Some(false), "e"),
+        ("QWERTY + Russian", EguiKey::D, "в", Some(false), "d"),
+        ("Dvorak", EguiKey::E, "e", Some(true), "e"),
+        ("QWERTY", EguiKey::D, "d", Some(true), "d"),
+    ];
+    for (name, key, text, latin, expected) in cases {
+        // The layout learned from typing.
+        let mut d = Dispatcher::new();
+        run(&mut d, &km, &Active::NONE, frame(1.0, Modifiers::NONE, vec![at(key, Modifiers::NONE), Event::Text(text.into())]));
+        assert_eq!(Some(d.layout().is_latin()), latin, "{name}");
+        let (ran, _) = run(&mut d, &km, &Active::NONE, frame(2.0, CTRL, vec![at(key, CTRL)]));
+        assert_eq!(ran, [expected], "{name}, learned");
+
+        // The layout the platform reports, before anything is typed.
+        let mut d = Dispatcher::new().with_layout(Layout::new().with_latin(latin == Some(true)));
+        let (ran, _) = run(&mut d, &km, &Active::NONE, frame(1.0, CTRL, vec![at(key, CTRL)]));
+        assert_eq!(ran, [expected], "{name}, reported");
+    }
+}
+
+/// `input` with the Latin layout characters the suite's egui-winit reports per physical key, set
+/// through serde because crates.io egui has no such field; `None` there.
+fn with_latin_layout_chars(mut input: InputState, chars: &[(EguiKey, char)]) -> Option<InputState> {
+    let mut raw = serde_json::to_value(&input.raw).unwrap();
+    raw.get("latin_layout_chars")?;
+    raw["latin_layout_chars"] = serde_json::to_value(chars).unwrap();
+    input.raw = serde_json::from_value(raw).unwrap();
+    Some(input)
+}
+
+#[test]
+fn a_key_without_a_latin_letter_runs_no_letter_binding() {
+    let app = |id: &str, key: &str| Bindable::new(id, id, Scope::app()).with_default(Binding::parse(key).unwrap());
+    let km = Keymap::new(vec![app("quit", "Cmd+Q"), app("quote", "Cmd+'"), app("j", "Cmd+J")], Scopes::new(), Platform::Linux);
+    let at = |key, physical| Event::Key { key, physical_key: Some(physical), pressed: true, repeat: false, modifiers: CTRL };
+
+    // Dvorak + Russian. The QWERTY Q key types й, and Dvorak ' there: egui-winit reports the key
+    // as ', and egui without a key for the character as its position, Q. The QWERTY C key types
+    // с, and Dvorak j.
+    let latin = [(EguiKey::Q, '\''), (EguiKey::C, 'j')];
+    let cases = [(at(EguiKey::Quote, EguiKey::Q), "quote"), (at(EguiKey::Q, EguiKey::Q), "quote"), (at(EguiKey::J, EguiKey::C), "j")];
+    for (press, expected) in cases {
+        let mut d = Dispatcher::new().with_layout(Layout::new().with_latin(false));
+        let Some(input) = with_latin_layout_chars(frame(1.0, CTRL, vec![press.clone()]), &latin) else {
+            // crates.io egui reports no Latin layout, so the position decides: Ctrl+Q.
+            let (ran, _) = run(&mut d, &km, &Active::NONE, frame(1.0, CTRL, vec![at(EguiKey::Q, EguiKey::Q)]));
+            assert_eq!(ran, ["quit"]);
+            return;
+        };
+        let (ran, _) = run(&mut d, &km, &Active::NONE, input);
+        assert_eq!(ran, [expected], "{press:?}");
+    }
+}
diff --git a/crates/keymap/tests/import.rs b/crates/keymap/tests/import.rs
new file mode 100644
index 00000000..60a9f321
--- /dev/null
+++ b/crates/keymap/tests/import.rs
@@ -0,0 +1,838 @@
+//! Import of synthetic shortcut sets written for these tests.
+
+use std::collections::BTreeMap;
+
+use craft_keymap::chord::foreign::ReadNote;
+use craft_keymap::chord::foreign::{Flavor, ForeignError};
+use craft_keymap::import::{
+    Failed, FailedChange, MAX_IMPORT_ENTRIES, MAX_IMPORT_TEXT, MAX_KEYS_PER_ENTRY, MAX_SUGGESTIONS, NoChangeReason, SkipReason, Skipped,
+    UnmatchedReason, normalize_label,
+};
+use craft_keymap::{
+    Bindable, Binding, CommandRef, ContextRule, ForeignEntry, ForeignKey, ForeignSet, ImportOptions, ImportReport, Keymap, Kind, MAX_COMMANDS,
+    NoneDefined, Overrides, Platform, Scope, Scopes, Start, plan, reserved,
+};
+use serde_json::json;
+
+fn b(text: &str) -> Binding {
+    Binding::parse(text).unwrap_or_else(|e| panic!("{text}: {e}"))
+}
+
+fn bindings(texts: &[&str]) -> Vec<Binding> {
+    texts.iter().map(|t| b(t)).collect()
+}
+
+fn command(id: impl Into<CommandRef>, label: &str, path: &[&str], keys: &[&str]) -> Bindable {
+    let mut out = Bindable::new(id, label, Scope::app());
+    if !path.is_empty() {
+        out = out.with_path(path.iter().map(|s| s.to_string()).collect());
+    }
+    keys.iter().fold(out, |e, k| e.with_default(b(k)))
+}
+
+fn panel(name: &str) -> CommandRef {
+    CommandRef::with_params("window.panel", json!({ "panel": name }))
+}
+
+fn catalog() -> Vec<Bindable> {
+    vec![
+        command("file.new", "Document…", &["File", "New", "Document…"], &["Cmd+N"]),
+        command("dialog.newDocument", "New Document Dialog", &[], &["Cmd+N"]),
+        command("file.close", "Close", &["File", "Close"], &["Cmd+W"]),
+        command("file.save", "Save", &["File", "Save"], &["Cmd+S"]),
+        command("file.exit", "Exit", &["File", "Exit"], &[]),
+        command("edit.paste", "Paste", &["Edit", "Paste"], &["Cmd+V"]),
+        command("edit.clear", "Clear", &["Edit", "Clear"], &[]),
+        command("edit.duplicate", "Duplicate", &["Edit", "Duplicate"], &["Cmd+Alt+Shift+D"]),
+        command("edit.checkSpelling", "Check Spelling…", &["Edit", "Proofing", "Check Spelling…"], &[]),
+        command("edit.pen", "Pen", &["Edit", "Preferences", "Pen"], &[]),
+        command("app.palette", "Command Palette", &[], &["Cmd+Alt+K"]),
+        command(panel("layers"), "Layers", &["Window", "Layers"], &["F7"]),
+        command(panel("pages"), "Pages", &["Window", "Pages"], &["F12"]),
+        command("view.guides", "Guides", &["View", "Grids & Guides", "Guides"], &["Cmd+;"]).toggle(),
+        command("view.goToPage", "Go to Page…", &["View", "Go to Page…"], &["Cmd+J"]),
+        command("view.zoomIn", "Zoom In", &["View", "Zoom In"], &["Cmd+="]),
+        command("object.textFrameOptions", "Text Frame Options…", &["Object", "Text Frame Options…"], &["Cmd+B"]),
+        command("type.break", "Break", &["Type", "Breaks", "Break"], &[]),
+        command("type.columnBreak", "Insert Break", &["Type", "Column", "Insert Break"], &[]),
+        command("type.frameBreak", "Insert Break", &["Type", "Frame", "Insert Break"], &[]),
+        command("type.bold", "Bold", &["Type", "Style", "Bold"], &[]),
+        command("type.italic", "Italic", &["Type", "Style", "Italic"], &[]),
+        command("tool.pen", "Pen Tool", &[], &["P"]).with_kind(Kind::Tool { group: None }).with_alias("Pen"),
+        command("tool.type", "Type Tool", &[], &["T"]).with_kind(Kind::Tool { group: None }),
+        command("scripts.run", "Run Script", &[], &[]),
+    ]
+}
+
+fn keymap(platform: Platform) -> Keymap {
+    Keymap::new(catalog(), Scopes::new().with_context("Text"), platform).with_reserved(reserved::system(platform))
+}
+
+fn key(flavor: Flavor, context: &str, text: &str) -> ForeignKey {
+    ForeignKey::read(Some(context), text, flavor)
+}
+
+fn entry(menu: Option<&str>, path: &[&str], keys: &[(&str, &str)], flavor: Flavor) -> ForeignEntry {
+    keys.iter().fold(ForeignEntry::new(menu, path.iter().copied()), |e, (c, t)| e.with_key(key(flavor, c, t)))
+}
+
+fn win(menu: &str, path: &[&str], keys: &[(&str, &str)]) -> ForeignEntry {
+    entry(Some(menu), path, keys, Flavor::Windows)
+}
+
+/// An InDesign-like Windows set, one entry per match rule or apply rule.
+fn windows_set() -> ForeignSet {
+    let d = "Default";
+    let entries = vec![
+        win("File", &["New", "Document..."], &[(d, "Ctrl+N")]),
+        win("File", &["Close"], &[(d, "Ctrl+W"), (d, "Ctrl+F4")]),
+        win("File", &["Save"], &[(d, "Ctrl+Hyperspace")]),
+        win("File", &["Exit"], &[(d, "Alt+F4")]),
+        win("Edit", &["Paste"], &[(d, "Ctrl+E")]),
+        win("Edit", &["Clear"], &[(d, "Ctrl+E")]),
+        win("Edit", &["Duplicate"], &[]),
+        win("Edit", &["Duplicate"], &[]),
+        win("Edit", &["Spelling", "Check Spelling..."], &[(d, "Ctrl+Alt+K"), ("Text", "F7")]),
+        win("Edit", &["Frobnicate Everything"], &[(d, "Ctrl+F12")]),
+        win("Edit", &["Never Heard Of It"], &[]),
+        win("Window", &["Layers"], &[(d, "F7")]),
+        win("Window", &["Pages"], &[(d, "Shift+F12")]),
+        win("View", &["Grids & Guides", "SHOW/HIDE   Guides"], &[(d, "Ctrl+Alt+;")]),
+        win("Layout", &["Go To Page"], &[(d, "Ctrl+Alt+J")]),
+        win("Object", &["Text Frame", "Options"], &[(d, "Ctrl+Alt+B")]),
+        win("Type", &["Insert", "Break"], &[(d, "Ctrl+Alt+Enter")]),
+        win("Type", &["Insert Break"], &[(d, "Shift+Enter")]),
+        win("Type", &["Style", "Bold"], &[("Text", "Shift+Ctrl+B")]),
+        win("Type", &["Style", "Italic"], &[(d, "Ctrl+I"), ("Table", "Ctrl+Alt+I")]),
+        win("Tools", &["Pen"], &[(d, "Shift+P")]).tool(),
+        win("Tools", &["Zoom In"], &[(d, "Z")]).tool(),
+        entry(None, &["Zoom In"], &[(d, "Ctrl+Alt+I")], Flavor::Windows),
+        entry(None, &["Somewhere", "Zoom In"], &[(d, "Ctrl+F11")], Flavor::Windows),
+        win("Scripts", &["Frobnicate"], &[(d, "Ctrl+Alt+R")]),
+    ];
+    ForeignSet::new(entries).with_name("My Set")
+}
+
+fn numpad_set() -> ForeignSet {
+    ForeignSet::new(vec![win("Window", &["Layers"], &[("Default", "Num 7")]).at_line(2)])
+}
+
+fn windows_options() -> ImportOptions {
+    let mut remembered = BTreeMap::new();
+    remembered.insert(ForeignEntry::new(Some("Scripts"), ["Frobnicate"]).remember_key(), CommandRef::new("scripts.run"));
+    ImportOptions {
+        contexts: vec![("default".into(), ContextRule::Home), ("TEXT".into(), ContextRule::HomeWithoutHomeEntry)],
+        remembered,
+        ..ImportOptions::default()
+    }
+}
+
+fn import_windows() -> (Keymap, ImportReport) {
+    let mut km = keymap(Platform::Windows);
+    let report = plan(&windows_set(), &km, &windows_options()).apply(&mut km);
+    (km, report)
+}
+
+fn has(km: &Keymap, id: impl Into<CommandRef>, texts: &[&str]) {
+    let c = id.into();
+    assert_eq!(km.bindings(&c), bindings(texts), "{}", c.key());
+}
+
+#[test]
+fn labels_normalize_for_matching() {
+    assert_eq!(normalize_label("Check Spelling..."), "check spelling");
+    assert_eq!(normalize_label("Check  Spelling…"), "check spelling");
+    assert_eq!(normalize_label("Grids && Guides"), "grids guides");
+    assert_eq!(normalize_label("SHOW/HIDE  Guides"), "show/hide guides");
+    assert_eq!(normalize_label("Preferences: General…"), "preferences general");
+    assert_eq!(normalize_label("ÄRGER"), "ärger");
+}
+
+#[test]
+fn every_match_step_finds_its_command() {
+    let (km, r) = import_windows();
+    assert_eq!(r.set.as_deref(), Some("My Set"));
+    // 1: full path, with `&`, case and spacing normalized, and Show/Hide dropped for a toggle.
+    has(&km, "view.guides", &["Cmd+Alt+;"]);
+    // 2: joined segments `Text Frame Options` in Object.
+    has(&km, "object.textFrameOptions", &["Cmd+Alt+B"]);
+    // 2 is ambiguous (two `Insert Break` in Type), 3 finds `Break`.
+    has(&km, "type.break", &["Cmd+Alt+Enter"]);
+    // 3: last segment in the menu, under another submenu.
+    has(&km, "edit.checkSpelling", &["Cmd+Alt+K"]);
+    // 4: the label anywhere; also with no menu for a one-segment path.
+    has(&km, "view.goToPage", &["Cmd+Alt+J"]);
+    has(&km, "view.zoomIn", &["Cmd+Alt+I"]);
+    // 0: a remembered answer.
+    has(&km, "scripts.run", &["Cmd+Alt+R"]);
+    // A command with parameters, by its path.
+    has(&km, panel("pages"), &["Shift+F12"]);
+    // A tool entry matches the tool, not the command with the same label.
+    has(&km, "tool.pen", &["Shift+P"]);
+    has(&km, "edit.pen", &[]);
+
+    let unmatched: Vec<(&str, UnmatchedReason)> = r.unmatched.iter().map(|u| (u.item.as_str(), u.reason)).collect();
+    assert_eq!(
+        unmatched,
+        [
+            ("Edit > Frobnicate Everything", UnmatchedReason::NoMatch),
+            ("Type > Insert Break", UnmatchedReason::Ambiguous),
+            ("Type > Style > Italic", UnmatchedReason::Context),
+            ("Tools > Zoom In", UnmatchedReason::Tool),
+            ("Somewhere > Zoom In", UnmatchedReason::NoMatch),
+        ]
+    );
+    assert_eq!(r.unmatched[2].keys, "Table: Ctrl+Alt+I");
+    assert_eq!(r.unmatched_without_shortcut, 1);
+    assert_eq!(r.unreadable.len(), 1);
+    assert_eq!(r.unreadable[0].item, "File > Save");
+    assert_eq!(r.unreadable[0].keys, "Default: Ctrl+Hyperspace");
+    assert!(matches!(r.unreadable[0].reason, ForeignError::UnknownKey(_)));
+    assert!(r.suggestions.is_empty(), "not asked for");
+    assert_eq!(r.truncated, 0);
+}
+
+#[test]
+fn the_set_wins_and_the_report_says_how() {
+    let (km, r) = import_windows();
+    // Two keys for one command, both kept in order.
+    has(&km, "file.close", &["Cmd+W", "Cmd+F4"]);
+    // The Text context counts only without a Default key.
+    has(&km, "type.bold", &["Cmd+Shift+B"]);
+    has(&km, "type.italic", &["Cmd+I"]);
+    has(&km, panel("layers"), &["F7"]);
+    // A later entry takes a chord from an earlier one; the earlier command keeps what it had.
+    has(&km, "edit.paste", &["Cmd+V"]);
+    has(&km, "edit.clear", &["Cmd+E"]);
+    let skipped: Vec<_> = r.skipped.iter().map(|s| (s.command.id.as_str(), s.shortcut.as_str(), s.kept_by.clone(), s.reason)).collect();
+    assert_eq!(
+        skipped,
+        [("file.exit", "Alt+F4", None, SkipReason::Reserved), ("edit.paste", "Cmd+E", Some(CommandRef::new("edit.clear")), SkipReason::Taken)]
+    );
+    // Taken from a command outside the set; the twin keeps its shared default.
+    has(&km, "app.palette", &[]);
+    has(&km, "dialog.newDocument", &["Cmd+N"]);
+    let cleared: Vec<_> = r.conflicts_cleared.iter().map(|c| (c.command.id.as_str(), c.label.as_str(), c.shortcut.as_str())).collect();
+    assert_eq!(cleared, [("app.palette", "Command Palette", "Cmd+Alt+K")]);
+    // None defined clears; an unreadable key leaves the command as it was.
+    has(&km, "edit.duplicate", &[]);
+    has(&km, "file.save", &["Cmd+S"]);
+    // Bindings equal to the defaults leave no override.
+    let o = km.overrides();
+    assert_eq!(o.get("file.new"), None);
+    assert_eq!(o.get(&panel("layers").key()), None);
+    assert_eq!(o.get("edit.duplicate"), Some(&[][..]));
+    assert_eq!(o.get("file.close"), Some(&["Cmd+W".to_string(), "Cmd+F4".to_string()][..]));
+
+    let changed: Vec<&str> = r.changed.iter().map(|c| c.command.id.as_str()).collect();
+    assert_eq!(
+        changed,
+        [
+            "file.close",
+            "edit.clear",
+            "edit.duplicate",
+            "edit.checkSpelling",
+            "window.panel",
+            "view.guides",
+            "view.goToPage",
+            "object.textFrameOptions",
+            "type.break",
+            "type.bold",
+            "type.italic",
+            "tool.pen",
+            "view.zoomIn",
+            "scripts.run",
+        ]
+    );
+    assert_eq!(r.imported, changed.len());
+    let close = &r.changed[0];
+    assert_eq!((close.label.as_str(), close.item.as_str()), ("Close", "File > Close"));
+    assert_eq!((close.from.clone(), close.to.clone()), (vec!["Cmd+W".to_string()], vec!["Cmd+W".to_string(), "Cmd+F4".to_string()]));
+}
+
+#[test]
+fn a_mac_set_reads_its_modifiers_and_scopes_text_keys() {
+    let mut km = keymap(Platform::Mac);
+    let mac = |menu: &str, path: &[&str], keys: &[(&str, &str)]| entry(Some(menu), path, keys, Flavor::Mac);
+    let set = ForeignSet::new(vec![
+        mac("File", &["Save"], &[("Default", "⇧⌘S")]),
+        mac("Edit", &["Paste"], &[("Default", "Cmd+Ctrl+V")]),
+        mac("Type", &["Style", "Italic"], &[("Text", "Shift+Cmd+I")]),
+        mac("Type", &["Style", "Bold"], &[("Default", "Cmd+B"), ("Tables", "Cmd+Opt+B")]),
+    ])
+    .with_name("Mac");
+    let text = Scope::new("Text").unwrap();
+    let options = ImportOptions {
+        contexts: vec![("Default".into(), ContextRule::Home), ("Text".into(), ContextRule::Scope(text))],
+        ..ImportOptions::default()
+    };
+    let r = plan(&set, &km, &options).apply(&mut km);
+    has(&km, "file.save", &["Cmd+Shift+S"]);
+    has(&km, "edit.paste", &["Cmd+Ctrl+V"]);
+    has(&km, "type.italic", &["Text: Cmd+Shift+I"]);
+    has(&km, "type.bold", &["Cmd+B"]);
+    has(&km, "object.textFrameOptions", &[]);
+    assert_eq!(r.conflicts_cleared[0].command.id, "object.textFrameOptions");
+    assert_eq!(r.unmatched.len(), 1);
+    assert_eq!((r.unmatched[0].keys.as_str(), r.unmatched[0].reason), ("Tables: Cmd+Opt+B", UnmatchedReason::Context));
+    assert_eq!(r.changed.iter().find(|c| c.command.id == "type.italic").map(|c| c.to.clone()), Some(vec!["Text: Cmd+Shift+I".to_string()]));
+}
+
+#[test]
+fn start_and_none_defined_options() {
+    let set = ForeignSet::new(vec![win("File", &["Close"], &[("Default", "Ctrl+Q")]), win("Edit", &["Duplicate"], &[])]);
+    let user = || {
+        let mut o = Overrides::new();
+        o.insert("file.save", vec!["Cmd+Alt+S".into()]);
+        o
+    };
+    let options = |start, none_defined| ImportOptions {
+        contexts: vec![("Default".into(), ContextRule::Home)],
+        start,
+        none_defined,
+        ..ImportOptions::default()
+    };
+
+    let mut km = keymap(Platform::Windows).with_overrides(user());
+    plan(&set, &km, &options(Start::Current, NoneDefined::Keep)).apply(&mut km);
+    has(&km, "file.save", &["Cmd+Alt+S"]);
+    has(&km, "file.close", &["Cmd+Q"]);
+    has(&km, "edit.duplicate", &["Cmd+Alt+Shift+D"]);
+
+    let mut km = keymap(Platform::Windows).with_overrides(user());
+    let r = plan(&set, &km, &options(Start::Defaults, NoneDefined::Clear)).apply(&mut km);
+    has(&km, "file.save", &["Cmd+S"]);
+    has(&km, "file.close", &["Cmd+Q"]);
+    has(&km, "edit.duplicate", &[]);
+    assert_eq!(r.imported, 2);
+}
+
+#[test]
+fn a_failed_change_keeps_its_shortcut_when_a_later_change_frees_room() {
+    // Save's change finds the overrides full. Close's change then frees an entry, and Zoom In
+    // takes Cmd+S. Removing Cmd+S from Save would fit now, but Save's import failed, so Save
+    // keeps it and Zoom In stays as it was.
+    let set = ForeignSet::new(vec![
+        win("File", &["Save"], &[("Default", "Ctrl+Alt+S")]),
+        win("File", &["Close"], &[("Default", "Ctrl+W")]),
+        win("View", &["Zoom In"], &[("Default", "Ctrl+S")]),
+    ]);
+    let mut o = Overrides::new();
+    o.insert("file.close", vec!["Cmd+Q".into()]);
+    o.insert("view.zoomIn", vec!["Cmd+Alt+Z".into()]);
+    for n in 2..MAX_COMMANDS {
+        o.insert(format!("junk.{n}"), vec!["Cmd+K".into()]);
+    }
+    assert_eq!(o.len(), MAX_COMMANDS);
+    let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], ..ImportOptions::default() };
+    let mut km = keymap(Platform::Windows).with_overrides(o);
+    let r = plan(&set, &km, &options).apply(&mut km);
+    has(&km, "file.save", &["Cmd+S"]);
+    has(&km, "file.close", &["Cmd+W"]);
+    has(&km, "view.zoomIn", &["Cmd+Alt+Z"]);
+    let failed: Vec<(&str, FailedChange)> = r.failed.iter().map(|f| (f.command.id.as_str(), f.change)).collect();
+    assert_eq!(failed, [("file.save", FailedChange::Bind), ("view.zoomIn", FailedChange::Bind)]);
+    assert!(r.conflicts_cleared.is_empty(), "{:?}", r.conflicts_cleared);
+    assert_eq!(r.imported, 1);
+}
+
+#[test]
+fn changes_that_find_the_overrides_full_are_reported() {
+    let set = ForeignSet::new(vec![
+        win("File", &["Close"], &[("Default", "Ctrl+J")]),
+        win("File", &["Save"], &[("Default", "Ctrl+Alt+S")]),
+        win("Edit", &["Duplicate"], &[]),
+    ]);
+    let full = || {
+        let mut o = Overrides::new();
+        o.insert("file.close", vec!["Cmd+Q".into()]);
+        for n in 1..MAX_COMMANDS {
+            o.insert(format!("junk.{n}"), vec!["Cmd+K".into()]);
+        }
+        assert_eq!(o.len(), MAX_COMMANDS);
+        o
+    };
+    let options = |start| ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], start, ..ImportOptions::default() };
+
+    // file.close has an entry to rewrite, but taking Cmd+J from view.goToPage needs a new one, so
+    // both stay as they were. The other changes each need a new entry too.
+    let mut km = keymap(Platform::Windows).with_overrides(full());
+    let r = plan(&set, &km, &options(Start::Current)).apply(&mut km);
+    has(&km, "file.close", &["Cmd+Q"]);
+    has(&km, "view.goToPage", &["Cmd+J"]);
+    has(&km, "file.save", &["Cmd+S"]);
+    has(&km, "edit.duplicate", &["Cmd+Alt+Shift+D"]);
+    let rows = |failed: &[Failed]| -> Vec<(String, String, FailedChange, Vec<String>)> {
+        failed.iter().map(|f| (f.command.id.clone(), f.label.clone(), f.change, f.shortcuts.clone())).collect()
+    };
+    let row = |id: &str, label: &str, change, shortcuts: &[&str]| {
+        (id.to_string(), label.to_string(), change, shortcuts.iter().map(|s| s.to_string()).collect::<Vec<_>>())
+    };
+    assert_eq!(
+        rows(&r.failed),
+        [
+            row("file.close", "Close", FailedChange::Bind, &["Cmd+J"]),
+            row("file.save", "Save", FailedChange::Bind, &["Cmd+Alt+S"]),
+            row("edit.duplicate", "Duplicate", FailedChange::Clear, &[]),
+        ]
+    );
+    assert_eq!(r.imported, 0);
+    assert!(r.conflicts_cleared.is_empty());
+    let v = serde_json::to_value(&r).unwrap();
+    assert_eq!(
+        v["failed"][1],
+        json!({"command": {"id": "file.save", "params": null}, "label": "Save", "change": "bind", "shortcuts": ["Cmd+Alt+S"]})
+    );
+
+    // Starting from the defaults drops the entries, so everything fits.
+    let mut km = keymap(Platform::Windows).with_overrides(full());
+    let r = plan(&set, &km, &options(Start::Defaults)).apply(&mut km);
+    assert!(r.failed.is_empty(), "{:?}", r.failed);
+    has(&km, "file.close", &["Cmd+J"]);
+    has(&km, "view.goToPage", &[]);
+    has(&km, "file.save", &["Cmd+Alt+S"]);
+    has(&km, "edit.duplicate", &[]);
+
+    // A later entry whose change finds the overrides full leaves the chord with the earlier one.
+    let set = ForeignSet::new(vec![win("File", &["Close"], &[("Default", "Ctrl+Alt+J")]), win("File", &["Save"], &[("Default", "Ctrl+Alt+J")])]);
+    let mut km = keymap(Platform::Windows).with_overrides(full());
+    let r = plan(&set, &km, &options(Start::Current)).apply(&mut km);
+    has(&km, "file.close", &["Cmd+Alt+J"]);
+    has(&km, "file.save", &["Cmd+S"]);
+    assert_eq!(rows(&r.failed), [row("file.save", "Save", FailedChange::Bind, &["Cmd+Alt+J"])]);
+    assert!(r.skipped.is_empty(), "{:?}", r.skipped);
+    assert_eq!(r.imported, 1);
+}
+
+#[test]
+fn keys_in_unknown_scopes_are_skipped_and_the_rest_apply() {
+    let set = ForeignSet::new(vec![win("File", &["Close"], &[("Default", "Ctrl+Q"), ("Story", "Ctrl+K"), ("Text", "Ctrl+L")])]);
+    let options = ImportOptions {
+        contexts: vec![
+            ("Default".into(), ContextRule::Home),
+            ("Story".into(), ContextRule::Scope(Scope::new("Story").unwrap())),
+            ("Text".into(), ContextRule::Scope(Scope::new("Text").unwrap())),
+        ],
+        ..ImportOptions::default()
+    };
+    let mut km = keymap(Platform::Windows);
+    let r = plan(&set, &km, &options).apply(&mut km);
+    has(&km, "file.close", &["Cmd+Q", "Text: Cmd+L"]);
+    let skipped: Vec<_> = r
+        .skipped
+        .iter()
+        .map(|s: &Skipped| (s.command.id.as_str(), s.item.as_str(), s.line, s.shortcut.as_str(), s.kept_by.clone(), s.reason))
+        .collect();
+    assert_eq!(skipped, [("file.close", "File > Close", None, "Story: Cmd+K", None, SkipReason::UnknownScope)]);
+    assert_eq!(serde_json::to_value(r.skipped[0].reason).unwrap(), "unknownScope");
+}
+
+#[test]
+fn suggestions_are_reported_never_applied() {
+    let mut km = keymap(Platform::Windows);
+    let set = ForeignSet::new(vec![win("Edit", &["Chek Spelling Now"], &[("Default", "Ctrl+K")])]);
+    let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], suggest: true, ..ImportOptions::default() };
+    let p = plan(&set, &km, &options);
+    assert!(p.commands.is_empty());
+    let r = p.apply(&mut km);
+    assert_eq!(r.suggestions.len(), 1);
+    assert_eq!(r.suggestions[0].item, "Edit > Chek Spelling Now");
+    assert!(r.suggestions[0].candidates.contains(&CommandRef::new("edit.checkSpelling")), "{:?}", r.suggestions);
+    has(&km, "edit.checkSpelling", &[]);
+    assert!(km.overrides().is_empty());
+    assert_eq!(r.imported, 0);
+}
+
+#[test]
+fn entries_the_reader_dropped_count_as_truncated() {
+    let set = ForeignSet::new(vec![win("File", &["Close"], &[("Default", "Ctrl+Q")])]).with_truncated(7);
+    assert_eq!(plan(&set, &keymap(Platform::Windows), &default_context()).report.truncated, 7);
+}
+
+#[test]
+fn hostile_sets_are_capped_and_counted() {
+    let mut km = keymap(Platform::Windows);
+    let long: String = "ä€𝄞 x".repeat(MAX_IMPORT_TEXT);
+    let mut big = ForeignEntry::new(Some(long.as_str()), std::iter::repeat_n(long.clone(), 100));
+    for _ in 0..MAX_KEYS_PER_ENTRY + 10 {
+        let trigger = Err(ForeignError::UnknownKey(long.clone()));
+        big = big.with_key(ForeignKey { context: Some(long.clone()), text: long.clone(), trigger, notes: vec![ReadNote::Numpad; 1000] });
+    }
+    // Unmatched entries with keys, more than the suggestions take.
+    let near = win("Edit", &["Chek Spelling Now"], &[("Default", "Ctrl+F12")]);
+    let mut entries: Vec<ForeignEntry> = std::iter::repeat_n(near, MAX_SUGGESTIONS + 10).collect();
+    entries.push(big);
+    entries.push(win("Edit", &["Paste"], &[("Default", &long), ("Default", "Ctrl+\u{0}"), ("Default", "Win+E")]));
+    // Entries without keys fill the set to the cap and 500 past it.
+    let keyless = MAX_IMPORT_ENTRIES - entries.len();
+    entries.extend(std::iter::repeat_n(ForeignEntry::new(None, Vec::<String>::new()), keyless + 500));
+    let set = ForeignSet::new(entries).with_name(long.clone());
+    let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], suggest: true, ..ImportOptions::default() };
+    let r = plan(&set, &km, &options).apply(&mut km);
+    assert_eq!(r.suggestions.len(), MAX_SUGGESTIONS);
+    // The set name, entries and keys past the caps, and suggestions past the cap (with the big entry's).
+    assert!(r.truncated >= 1 + 500 + 10 + 11, "{}", r.truncated);
+    assert_eq!(r.set.as_ref().map(|s| s.chars().count()), Some(MAX_IMPORT_TEXT));
+    let row = r.unmatched.iter().find(|u| u.item.starts_with('ä')).unwrap();
+    assert!(row.item.chars().count() <= MAX_IMPORT_TEXT * 34, "item of capped segments");
+    assert!(row.keys.chars().count() <= (2 * MAX_IMPORT_TEXT + 4) * MAX_KEYS_PER_ENTRY);
+    assert_eq!(r.unreadable.len(), 1, "Paste's keys");
+    has(&km, "edit.paste", &["Cmd+V"]);
+    // Entries past the cap are left out.
+    assert_eq!(r.unmatched_without_shortcut, keyless);
+}
+
+#[test]
+#[ignore = "worst-case timing; run with --ignored"]
+fn hostile_sets_finish_in_time() {
+    // A full catalog whose labels share words with every unmatched entry below, so each
+    // suggestion scores every command.
+    let mut catalog = catalog();
+    let filler = MAX_COMMANDS - catalog.len();
+    catalog.extend((0..filler).map(|i| command(format!("filler.c{i}").as_str(), &format!("Filler Command {i}"), &[], &[])));
+    let mut km = Keymap::new(catalog, Scopes::new().with_context("Text"), Platform::Windows).with_reserved(reserved::system(Platform::Windows));
+    let long: String = "ä€𝄞 x".repeat(MAX_IMPORT_TEXT);
+    // Odd entries have keys and long labels that match nothing, so they reach the suggestions:
+    // words in the whole label, or two words and symbols, which score high enough to suggest.
+    let wordy = "Filler Command ä€𝄞 ".repeat(MAX_IMPORT_TEXT / 8);
+    let symbols = format!("Filler Command {}", "€𝄞 ".repeat(MAX_IMPORT_TEXT));
+    let filler_entry = |i: usize| match i % 4 {
+        1 => win("Edit", &[&symbols], &[("Default", "Ctrl+F12")]),
+        3 => win("Edit", &[&format!("{wordy}{i}")], &[("Default", "Ctrl+F12")]),
+        _ => win("Edit", &[&format!("Item {i}")], &[]),
+    };
+    let mut entries: Vec<ForeignEntry> = (0..MAX_IMPORT_ENTRIES + 500).map(filler_entry).collect();
+    let mut big = ForeignEntry::new(Some(long.as_str()), std::iter::repeat_n(long.clone(), 100));
+    for _ in 0..MAX_KEYS_PER_ENTRY + 10 {
+        let trigger = Err(ForeignError::UnknownKey(long.clone()));
+        big = big.with_key(ForeignKey { context: Some(long.clone()), text: long.clone(), trigger, notes: vec![ReadNote::Numpad; 1000] });
+    }
+    entries.insert(0, big);
+    entries.insert(1, win("Edit", &["Paste"], &[("Default", &long), ("Default", "Ctrl+\u{0}"), ("Default", "Win+E")]));
+    let set = ForeignSet::new(entries).with_name(long.clone());
+    let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], suggest: true, ..ImportOptions::default() };
+    let started = std::time::Instant::now();
+    let r = plan(&set, &km, &options).apply(&mut km);
+    assert!(started.elapsed() < std::time::Duration::from_secs(240), "{:?}", started.elapsed());
+    // Read filler entries are those before the cap, after the two inserted ones.
+    let read = MAX_IMPORT_ENTRIES - 2;
+    let keyed = read / 2;
+    assert!(!r.suggestions.is_empty() && r.suggestions.len() <= MAX_SUGGESTIONS, "{}", r.suggestions.len());
+    assert!(r.truncated >= 500 + 10 + keyed + 1 - MAX_SUGGESTIONS, "{}", r.truncated);
+    assert_eq!(r.set.as_ref().map(|s| s.chars().count()), Some(MAX_IMPORT_TEXT));
+    let row = r.unmatched.iter().find(|u| u.item.starts_with('ä')).unwrap();
+    assert!(row.item.chars().count() <= MAX_IMPORT_TEXT * 34, "item of capped segments");
+    assert!(row.keys.chars().count() <= (2 * MAX_IMPORT_TEXT + 4) * MAX_KEYS_PER_ENTRY);
+    assert_eq!(r.unreadable.len(), 1, "Paste's keys");
+    has(&km, "edit.paste", &["Cmd+V"]);
+    // Entries past the cap are left out.
+    assert_eq!(r.unmatched_without_shortcut, read - keyed);
+}
+
+#[test]
+fn rows_carry_source_lines_and_approximated_keys() {
+    let mut km = keymap(Platform::Windows);
+    let d = "Default";
+    let set = ForeignSet::new(vec![
+        win("Window", &["Layers"], &[(d, "Ctrl+Num 5"), (d, "Num 7")]).at_line(3),
+        win("Window", &["Layers"], &[(d, "Shift+F7")]).at_line(4),
+        win("Edit", &["Paste"], &[(d, "Ctrl+Num 5")]).at_line(5),
+        win("Edit", &["Chek Spelling Now"], &[(d, "Ctrl+K")]).at_line(8),
+        win("File", &["Save"], &[(d, "Ctrl+Hyperspace")]).at_line(9),
+    ]);
+    let options = ImportOptions { contexts: vec![(d.into(), ContextRule::Home)], suggest: true, ..ImportOptions::default() };
+    let r = plan(&set, &km, &options).apply(&mut km);
+    // A keypad key binds the main key and is reported. Paste, a later entry, takes Cmd+5.
+    has(&km, panel("layers"), &["7", "Shift+F7"]);
+    has(&km, "edit.paste", &["Cmd+5"]);
+    let approximated: Vec<_> = r.approximated.iter().map(|a| (a.item.as_str(), a.line, a.keys.as_str(), a.note)).collect();
+    assert_eq!(
+        approximated,
+        [
+            ("Window > Layers", Some(3), "Default: Ctrl+Num 5, Default: Num 7", ReadNote::Numpad),
+            ("Edit > Paste", Some(5), "Default: Ctrl+Num 5", ReadNote::Numpad)
+        ]
+    );
+    // Merged entries report the first one's line.
+    let layers = r.changed.iter().find(|c| c.command == panel("layers")).unwrap();
+    assert_eq!(layers.line, Some(3));
+    assert_eq!((r.skipped[0].item.as_str(), r.skipped[0].line), ("Window > Layers", Some(3)));
+    assert_eq!(r.unmatched[0].line, Some(8));
+    assert_eq!(r.suggestions[0].line, Some(8));
+    assert_eq!(r.unreadable[0].line, Some(9));
+}
+
+#[test]
+fn report_json_uses_camel_case_names() {
+    let mut km = keymap(Platform::Windows);
+    let mut options = windows_options();
+    options.suggest = true;
+    let r = plan(&windows_set(), &km, &options).apply(&mut km);
+    let v = serde_json::to_value(&r).unwrap();
+    let names = |v: &serde_json::Value| v.as_object().unwrap().keys().cloned().collect::<Vec<_>>();
+    let mut top = names(&v);
+    top.sort();
+    assert_eq!(
+        top,
+        [
+            "approximated",
+            "changed",
+            "conflictsCleared",
+            "failed",
+            "imported",
+            "matchedWithoutChange",
+            "set",
+            "skipped",
+            "suggestions",
+            "truncated",
+            "unmatched",
+            "unmatchedWithoutShortcut",
+            "unreadable"
+        ]
+    );
+    let sorted = |v: &serde_json::Value| {
+        let mut n = names(v);
+        n.sort();
+        n
+    };
+    assert_eq!(sorted(&v["changed"][0]), ["command", "from", "item", "label", "line", "to"]);
+    assert_eq!(sorted(&v["conflictsCleared"][0]), ["command", "label", "shortcut"]);
+    assert_eq!(sorted(&v["skipped"][1]), ["command", "item", "keptBy", "line", "reason", "shortcut"]);
+    assert_eq!(v["skipped"][1]["keptBy"], json!({"id": "edit.clear", "params": null}));
+    assert_eq!(v["skipped"][0]["reason"], "reserved");
+    assert_eq!(sorted(&v["unmatched"][0]), ["item", "keys", "line", "reason"]);
+    let reasons: Vec<&str> = v["unmatched"].as_array().unwrap().iter().filter_map(|u| u["reason"].as_str()).collect();
+    assert_eq!(reasons, ["noMatch", "ambiguous", "context", "tool", "noMatch"]);
+    assert_eq!(sorted(&v["unreadable"][0]), ["item", "keys", "line", "reason"]);
+    assert_eq!(sorted(&v["suggestions"][0]), ["candidates", "item", "line"]);
+    let mut approximated = ImportReport::default();
+    approximated.approximated = plan(&numpad_set(), &km, &options).report.approximated;
+    let a = serde_json::to_value(&approximated).unwrap();
+    assert_eq!(sorted(&a["approximated"][0]), ["item", "keys", "line", "note"]);
+    assert_eq!(a["approximated"][0]["note"], "numpad");
+    assert_eq!(v["changed"][0]["from"], json!(["Cmd+W"]));
+}
+
+fn import_into(catalog: Vec<Bindable>, entries: Vec<ForeignEntry>, options: &ImportOptions) -> (Keymap, ImportReport) {
+    let mut km = Keymap::new(catalog, Scopes::new(), Platform::Windows);
+    let report = plan(&ForeignSet::new(entries), &km, options).apply(&mut km);
+    (km, report)
+}
+
+fn default_context() -> ImportOptions {
+    ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], ..ImportOptions::default() }
+}
+
+fn unmatched(r: &ImportReport) -> Vec<(&str, UnmatchedReason)> {
+    r.unmatched.iter().map(|u| (u.item.as_str(), u.reason)).collect()
+}
+
+#[test]
+fn panel_menu_entries_match_by_path_end_or_label() {
+    let catalog = vec![
+        command("type.allCaps", "All Caps", &["Panels", "Character", "All Caps"], &[]),
+        command("pages.overrideAll", "Override All Parent Items", &["Pages", "Override All Parent Page Items"], &[]),
+        command("paragraph.justification", "Justification…", &[], &[]),
+        command("swatches.new", "New Swatch", &["Swatches", "New Swatch"], &[]),
+        command("gradient.new", "New Swatch", &["Gradient", "New Swatch"], &[]),
+        command("character.smallCaps", "Small Caps", &[], &[]).with_alias("Character: Small Caps"),
+        // The app has Paragraph and Color panels.
+        command(panel("paragraph"), "Paragraph", &["Window", "Paragraph"], &[]),
+        command(panel("color"), "Color", &["Window", "Color"], &[]),
+    ];
+    let d = "Default";
+    let panel_entry = |path: &[&str], key: &str| entry(None, path, &[(d, key)], Flavor::Windows).in_panel_menu();
+    let entries = vec![
+        // The end of a path, label last.
+        panel_entry(&["Character", "All Caps"], "Ctrl+F1"),
+        // The end of a path whose last segment differs from the label.
+        panel_entry(&["Pages", "Override All Parent Page Items"], "Ctrl+F2"),
+        // The last segment alone, as one command's label, for a panel the app has.
+        panel_entry(&["Paragraph", "Justification..."], "Ctrl+F3"),
+        // The last segment alone matches nothing for a panel the app lacks.
+        panel_entry(&["History", "Justification..."], "Ctrl+F8"),
+        // The panel picks one of two commands with the label.
+        panel_entry(&["Swatches", "New Swatch"], "Ctrl+F4"),
+        // The joined segments as an alias.
+        panel_entry(&["Character", "Small Caps"], "Ctrl+F5"),
+        // No path end fits and the label alone fits two commands.
+        panel_entry(&["Color", "New Swatch"], "Ctrl+F6"),
+        // Without the mark, a path with no menu matches only a whole catalog path.
+        entry(None, &["Character", "All Caps"], &[(d, "Ctrl+F7")], Flavor::Windows),
+    ];
+    let (km, r) = import_into(catalog, entries, &default_context());
+    has(&km, "type.allCaps", &["Cmd+F1"]);
+    has(&km, "pages.overrideAll", &["Cmd+F2"]);
+    has(&km, "paragraph.justification", &["Cmd+F3"]);
+    has(&km, "swatches.new", &["Cmd+F4"]);
+    has(&km, "character.smallCaps", &["Cmd+F5"]);
+    has(&km, "gradient.new", &[]);
+    assert_eq!(
+        unmatched(&r),
+        [
+            ("History > Justification...", UnmatchedReason::NoMatch),
+            ("Color > New Swatch", UnmatchedReason::Ambiguous),
+            ("Character > All Caps", UnmatchedReason::NoMatch)
+        ]
+    );
+}
+
+#[test]
+fn aliases_match_like_labels() {
+    let catalog = vec![
+        command("app.quit", "Quit DesignCraft", &["File", "Quit DesignCraft"], &[]).with_alias("Exit"),
+        command("app.preferences", "Preferences…", &["Edit", "Preferences…"], &[]).with_alias("Preferences: General…"),
+        command("type.bold", "Bold", &["Type", "Style", "Bold"], &[]).with_alias("Apply bold"),
+        command("edit.paste", "Paste", &["Edit", "Paste"], &[]).with_alias("Einfügen"),
+    ];
+    let d = "Default";
+    let entries = vec![
+        win("File", &["Exit"], &[(d, "Ctrl+Q")]),
+        win("Edit", &["Preferences", "General..."], &[(d, "Ctrl+K")]),
+        entry(None, &["Apply Bold"], &[(d, "Ctrl+Shift+B")], Flavor::Windows),
+        win("Bearbeiten", &["Einfügen"], &[(d, "Ctrl+Shift+V")]),
+    ];
+    let (km, r) = import_into(catalog, entries, &default_context());
+    has(&km, "app.quit", &["Cmd+Q"]);
+    has(&km, "app.preferences", &["Cmd+K"]);
+    has(&km, "type.bold", &["Cmd+Shift+B"]);
+    has(&km, "edit.paste", &["Cmd+Shift+V"]);
+    assert!(r.unmatched.is_empty(), "{:?}", r.unmatched);
+}
+
+#[test]
+fn import_paths_match_like_menu_paths() {
+    let catalog = vec![
+        command("object.color", "Apply Color", &["Object", "Apply Color"], &[]),
+        command("color.applyColor", "Apply Color", &[], &[]).with_import_path(vec!["Tools".into(), "Apply Color".into()]),
+    ];
+    let d = "Default";
+    let entries = vec![win("Tools", &["Apply Color"], &[(d, "Ctrl+,")])];
+    let (km, r) = import_into(catalog, entries, &default_context());
+    has(&km, "color.applyColor", &["Cmd+,"]);
+    has(&km, "object.color", &[]);
+    assert!(r.unmatched.is_empty(), "{:?}", r.unmatched);
+}
+
+#[test]
+fn show_and_hide_are_read_off_only_for_toggles() {
+    let catalog = vec![
+        command(panel("conveyor"), "Conveyor", &["Window", "Conveyor"], &[]),
+        command("view.rulers", "Rulers", &["View", "Rulers"], &[]).toggle(),
+        command("view.frameEdges", "Show Frame Edges", &["View", "Extras", "Show Frame Edges"], &[]).toggle(),
+        command("view.hiddenCharacters", "Show Hidden Characters", &["Type", "Show Hidden Characters"], &[]),
+    ];
+    let d = "Default";
+    let entries = vec![
+        // Not a toggle: the name must fit as written.
+        win("View", &["Extras", "Hide Conveyor"], &[(d, "Ctrl+F1")]),
+        // One toggle for both of the source's items.
+        win("View", &["Show Rulers"], &[(d, "Ctrl+R")]),
+        win("View", &["Hide Rulers"], &[(d, "Ctrl+Shift+R")]),
+        win("View", &["Extras", "Hide Frame Edges"], &[(d, "Ctrl+H")]),
+        // Exact names match any command.
+        win("Type", &["Show Hidden Characters"], &[(d, "Ctrl+Alt+I")]),
+        win("Type", &["Hide Hidden Characters"], &[(d, "Ctrl+Alt+H")]),
+    ];
+    let (km, r) = import_into(catalog, entries, &default_context());
+    has(&km, panel("conveyor"), &[]);
+    has(&km, "view.rulers", &["Cmd+R", "Cmd+Shift+R"]);
+    has(&km, "view.frameEdges", &["Cmd+H"]);
+    has(&km, "view.hiddenCharacters", &["Cmd+Alt+I"]);
+    assert_eq!(
+        unmatched(&r),
+        [("View > Extras > Hide Conveyor", UnmatchedReason::NoMatch), ("Type > Hide Hidden Characters", UnmatchedReason::NoMatch)]
+    );
+}
+
+#[test]
+fn only_entries_with_keys_to_bind_count_toward_suggestions() {
+    let catalog = vec![command("edit.checkSpelling", "Check Spelling…", &["Edit", "Check Spelling…"], &[])];
+    let d = "Default";
+    // Twice the cap of unmatched entries without keys, or with keys only in a skipped context,
+    // before one with a key.
+    let mut entries: Vec<ForeignEntry> = (0..MAX_SUGGESTIONS)
+        .flat_map(|i| [win("Edit", &[&format!("Nothing {i}")], &[]), win("Edit", &[&format!("Tables {i}")], &[("Table", "Ctrl+T")])])
+        .collect();
+    entries.push(win("Edit", &["Chek Spelling Now"], &[(d, "Ctrl+K"), ("Table", "Ctrl+T")]));
+    let options = ImportOptions {
+        contexts: vec![(d.into(), ContextRule::Home), ("Table".into(), ContextRule::Skip)],
+        suggest: true,
+        ..ImportOptions::default()
+    };
+    let (_, r) = import_into(catalog, entries, &options);
+    assert_eq!(r.unmatched_without_shortcut, 2 * MAX_SUGGESTIONS);
+    assert_eq!(r.unmatched.len(), 1);
+    assert_eq!(r.unmatched[0].keys, "Default: Ctrl+K", "keys in a skipped context are left out");
+    assert_eq!(r.suggestions.len(), 1);
+    assert_eq!(r.suggestions[0].candidates, [CommandRef::new("edit.checkSpelling")]);
+    assert_eq!(r.truncated, 0);
+}
+
+fn pages_catalog() -> Vec<Bindable> {
+    vec![
+        command("app.newDocumentDialog", "New Document…", &["File", "New Document…"], &["Cmd+N"]),
+        command("layout.pages.insert", "Insert Pages…", &["Layout", "Pages", "Insert Pages…"], &["Cmd+Shift+P"]),
+        command("file.close", "Close", &["File", "Close"], &["Cmd+W"]),
+    ]
+}
+
+#[test]
+fn panel_menu_entries_without_keys_change_nothing() {
+    let none = |path: &[&str]| ForeignEntry::new(None, path.iter().copied()).in_panel_menu();
+    let entries = vec![
+        // The app has no History panel, so the last segment alone does not match.
+        none(&["History", "New Document"]),
+        // A path end matches, but without keys the command keeps its shortcuts.
+        none(&["Pages", "Insert Pages..."]),
+        // The same for the last segment alone, with a panel the app has.
+        none(&["Pages", "New Document"]),
+    ];
+    let (km, r) = import_into(pages_catalog(), entries, &default_context());
+    has(&km, "app.newDocumentDialog", &["Cmd+N"]);
+    has(&km, "layout.pages.insert", &["Cmd+Shift+P"]);
+    assert!(r.changed.is_empty(), "{:?}", r.changed);
+    assert_eq!(r.unmatched_without_shortcut, 1);
+    let rows: Vec<(&str, &str, NoChangeReason)> =
+        r.matched_without_change.iter().map(|m| (m.item.as_str(), m.command.id.as_str(), m.reason)).collect();
+    assert_eq!(
+        rows,
+        [
+            ("Pages > Insert Pages...", "layout.pages.insert", NoChangeReason::PanelMenu),
+            ("Pages > New Document", "app.newDocumentDialog", NoChangeReason::PanelMenu)
+        ]
+    );
+    let v = serde_json::to_value(&r).unwrap();
+    let mut fields: Vec<String> = v["matchedWithoutChange"][0].as_object().unwrap().keys().cloned().collect();
+    fields.sort();
+    assert_eq!(fields, ["command", "item", "label", "line", "reason"]);
+    assert_eq!(v["matchedWithoutChange"][0]["reason"], "panelMenu");
+}
+
+#[test]
+fn an_entry_without_keys_never_clears_keys_another_entry_gives() {
+    let d = "Default";
+    let keyed = || win("Layout", &["Pages", "Insert Pages..."], &[(d, "Ctrl+Alt+P")]);
+    let keyless = || win("Layout", &["Insert Pages..."], &[]);
+    for entries in [vec![keyed(), keyless()], vec![keyless(), keyed()]] {
+        let (km, _) = import_into(pages_catalog(), entries, &default_context());
+        has(&km, "layout.pages.insert", &["Cmd+Alt+P"]);
+    }
+
+    // A panel-menu entry without keys, and the menu entry with the command's keys.
+    let entries = vec![
+        ForeignEntry::new(None, ["Pages", "Insert Pages..."]).in_panel_menu(),
+        win("Layout", &["Pages", "Insert Pages..."], &[(d, "Ctrl+Shift+P")]),
+    ];
+    let (km, r) = import_into(pages_catalog(), entries, &default_context());
+    has(&km, "layout.pages.insert", &["Cmd+Shift+P"]);
+    assert_eq!(r.matched_without_change.len(), 1);
+
+    // The later entry still takes the chord from another command; the entry without keys does
+    // not clear the command that lost it.
+    let entries = vec![keyless(), keyed(), win("File", &["Close"], &[(d, "Ctrl+Alt+P")])];
+    let (km, r) = import_into(pages_catalog(), entries, &default_context());
+    has(&km, "file.close", &["Cmd+Alt+P"]);
+    has(&km, "layout.pages.insert", &["Cmd+Shift+P"]);
+    assert_eq!(r.skipped.iter().map(|s| (s.command.id.as_str(), s.reason)).collect::<Vec<_>>(), [("layout.pages.insert", SkipReason::Taken)]);
+}
diff --git a/crates/keymap/tests/keymap.rs b/crates/keymap/tests/keymap.rs
new file mode 100644
index 00000000..58a904b0
--- /dev/null
+++ b/crates/keymap/tests/keymap.rs
@@ -0,0 +1,665 @@
+use std::time::{Duration, Instant};
+
+use craft_keymap::{
+    Active, AssignError, Bindable, Binding, Chord, CommandRef, ConflictKind, DropReason, Key, Keymap, Kind, Lookup, MAX_BINDINGS, MAX_COMMANDS,
+    MAX_CONFLICTS, Mods, Overrides, Platform, Policy, Problem, Scope, Scopes, Trigger, TypingRule, reserved,
+};
+use serde_json::json;
+
+fn chord(text: &str) -> Chord {
+    Chord::parse(text).unwrap_or_else(|e| panic!("{text}: {e}"))
+}
+
+fn scope(name: &str) -> Scope {
+    Scope::new(name).unwrap()
+}
+
+fn b(text: &str) -> Binding {
+    Binding::parse(text).unwrap_or_else(|e| panic!("{text}: {e}"))
+}
+
+fn cmd(id: &str) -> CommandRef {
+    CommandRef::new(id)
+}
+
+fn app(id: &str, keys: &[&str]) -> Bindable {
+    keys.iter().fold(Bindable::new(id, id, Scope::app()), |e, k| e.with_default(b(k)))
+}
+
+fn in_scope(id: &str, home: &str, keys: &[&str]) -> Bindable {
+    keys.iter().fold(Bindable::new(id, id, scope(home)), |e, k| e.with_default(b(k)))
+}
+
+fn run(id: &str) -> Lookup {
+    Lookup::Run(cmd(id))
+}
+
+fn scopes() -> Scopes {
+    Scopes::new().with_panel("Timeline").with_panel("Composition").with_share("Timeline", "Composition").with_context("Text")
+}
+
+fn press(km: &Keymap, text: &str, active: &Active) -> Lookup {
+    km.lookup(&chord(text), false, active)
+}
+
+#[test]
+fn command_keys_are_canonical_whatever_the_map_order() {
+    let c = CommandRef::with_params("window.panel", json!({"z": [1, "a b"], "panel": "layers"}));
+    assert_eq!(c.key(), r#"window.panel {"panel":"layers","z":[1,"a b"]}"#);
+    assert_eq!(CommandRef::parse_key(&c.key()), Some(c));
+    assert_eq!(CommandRef::with_params("edit.copy", json!({})).key(), "edit.copy");
+    assert_eq!(CommandRef::parse_key("x {bad"), None);
+    assert_eq!(CommandRef::parse_key(&"x".repeat(300)), None);
+}
+
+#[test]
+fn lookup_picks_the_nearest_scope() {
+    let catalog = vec![
+        app("edit.copy", &["Cmd+C"]),
+        in_scope("timeline.copy", "Timeline", &["Cmd+C"]),
+        app("file.bake", &["Cmd+B"]),
+        in_scope("text.bold", "Text", &["Cmd+B", "Cmd+I"]),
+        in_scope("timeline.loop", "Timeline", &["L"]),
+    ];
+    let km = Keymap::new(catalog.clone(), scopes(), Platform::Mac);
+    let text = ["Text"];
+    assert_eq!(press(&km, "Cmd+C", &Active::NONE), run("edit.copy"));
+    assert_eq!(press(&km, "Cmd+C", &Active::panel("Timeline")), run("timeline.copy"));
+    assert_eq!(press(&km, "Cmd+C", &Active::panel("Composition")), run("timeline.copy"), "sharing panel");
+    assert_eq!(press(&km, "Cmd+C", &Active::panel("Effects")), run("edit.copy"));
+    assert_eq!(press(&km, "Cmd+B", &Active::panel("Timeline")), run("file.bake"));
+    assert_eq!(press(&km, "Cmd+B", &Active { panel: Some("Timeline"), contexts: &text, typing: false }), run("text.bold"));
+    assert_eq!(press(&km, "Cmd+I", &Active::NONE), Lookup::None, "inactive context");
+    assert_eq!(press(&km, "L", &Active::panel("Effects")), run("timeline.loop"), "fallthrough");
+    assert_eq!(km.lookup(&chord("L"), true, &Active::panel("Timeline")), Lookup::None, "double press is its own trigger");
+
+    let strict = Keymap::new(catalog, scopes().with_panel_fallthrough(false), Platform::Mac);
+    assert_eq!(press(&strict, "L", &Active::panel("Effects")), Lookup::None);
+    assert_eq!(press(&strict, "L", &Active::panel("Timeline")), run("timeline.loop"));
+}
+
+#[test]
+fn typing_rules_decide_what_fires_in_a_text_field() {
+    let catalog = vec![app("tool.brush", &["B"]), app("edit.copy", &["Cmd+C"]), app("help", &["F1"]), app("view.alt", &["Alt+V"])];
+    let typing = Active { panel: None, contexts: &[], typing: true };
+    let cases = [
+        (TypingRule::PlainKeysWait, [false, true, true, true]),
+        (TypingRule::CommandKeysOnly, [false, true, true, false]),
+        (TypingRule::AllWait, [false, false, false, false]),
+    ];
+    for (rule, fires) in cases {
+        let km = Keymap::new(catalog.clone(), Scopes::new(), Platform::Windows).with_typing_rule(rule);
+        for ((key, id), fire) in [("B", "tool.brush"), ("Cmd+C", "edit.copy"), ("F1", "help"), ("Alt+V", "view.alt")].into_iter().zip(fires) {
+            let want = if fire { run(id) } else { Lookup::None };
+            assert_eq!(press(&km, key, &typing), want, "{rule:?} {key}");
+            assert_eq!(press(&km, key, &Active::NONE), run(id), "{rule:?} {key} not typing");
+        }
+    }
+}
+
+#[test]
+fn text_editing_chords_go_to_the_text_field_under_every_rule() {
+    let catalog = vec![app("edit.undo", &["Cmd+Z"]), app("file.save", &["Cmd+S"]), app("nav.word", &["Alt+Left"]), app("nav.start", &["Cmd+Home"])];
+    let typing = Active { typing: true, ..Active::NONE };
+    for rule in [TypingRule::PlainKeysWait, TypingRule::CommandKeysOnly] {
+        for platform in [Platform::Mac, Platform::Windows] {
+            let km = Keymap::new(catalog.clone(), Scopes::new(), platform).with_typing_rule(rule);
+            assert_eq!(press(&km, "Cmd+Z", &typing), Lookup::None, "{rule:?} {platform:?}");
+            assert_eq!(press(&km, "Cmd+Z", &Active::NONE), run("edit.undo"));
+            assert_eq!(press(&km, "Cmd+S", &typing), run("file.save"), "{rule:?} {platform:?}");
+        }
+    }
+    // Word and line keys follow the platform.
+    let mac = Keymap::new(catalog.clone(), Scopes::new(), Platform::Mac);
+    let windows = Keymap::new(catalog.clone(), Scopes::new(), Platform::Windows);
+    assert_eq!(press(&mac, "Alt+Left", &typing), Lookup::None);
+    assert_eq!(press(&windows, "Alt+Left", &typing), run("nav.word"));
+    assert_eq!(press(&windows, "Ctrl+Home", &typing), Lookup::None);
+    assert_eq!(press(&mac, "Cmd+Home", &typing), run("nav.start"));
+
+    // A binding in an active context takes the chord from the field.
+    let catalog = vec![app("edit.undo", &["Cmd+Z"]), app("text.undo", &["Text: Cmd+Z"])];
+    let km = Keymap::new(catalog, scopes(), Platform::Windows);
+    let editing = Active { contexts: &["Text"], typing: true, ..Active::NONE };
+    assert_eq!(press(&km, "Cmd+Z", &editing), run("text.undo"));
+    assert_eq!(press(&km, "Cmd+Z", &typing), Lookup::None);
+    assert!(!TypingRule::PlainKeysWait.fires(&chord("Ctrl+Z"), Platform::Linux));
+}
+
+#[test]
+fn bindings_of_an_active_context_fire_while_typing_under_every_rule() {
+    let catalog = vec![
+        app("text.bold", &["Text: Cmd+B", "Text: B"]),
+        app("file.bake", &["Cmd+B"]),
+        in_scope("timeline.cut", "Timeline", &["Cmd+K"]),
+        app("file.save", &["Cmd+S"]),
+    ];
+    let editing = Active { panel: Some("Timeline"), contexts: &["Text"], typing: true };
+    let elsewhere = Active { contexts: &[], ..editing };
+    let km = Keymap::new(catalog, scopes(), Platform::Mac).with_typing_rule(TypingRule::AllWait);
+    assert_eq!(press(&km, "Cmd+B", &editing), run("text.bold"));
+    assert_eq!(press(&km, "B", &editing), run("text.bold"));
+    assert_eq!(press(&km, "Cmd+K", &editing), Lookup::None, "panel bindings wait");
+    assert_eq!(press(&km, "Cmd+S", &editing), Lookup::None, "app bindings wait");
+    assert_eq!(press(&km, "Cmd+B", &elsewhere), Lookup::None, "the app binding waits when the context is not active");
+}
+
+#[test]
+fn tools_of_one_group_cycle_and_keep_their_shared_key() {
+    let tool = |id: &str, group: &str| app(id, &["B"]).with_kind(Kind::Tool { group: Some(group.into()) });
+    let mut km =
+        Keymap::new(vec![tool("tool.brush", "brush"), tool("tool.pencil", "brush"), tool("tool.mixer", "brush")], Scopes::new(), Platform::Mac);
+    assert_eq!(press(&km, "B", &Active::NONE), Lookup::Cycle(vec![cmd("tool.brush"), cmd("tool.pencil"), cmd("tool.mixer")]));
+    assert!(km.conflicts().is_empty());
+
+    km.clear(&cmd("tool.mixer"));
+    let done = km.assign(&cmd("tool.mixer"), b("B"), Policy::Steal).unwrap();
+    assert!(done.taken_from.is_empty());
+    assert_eq!(km.bindings(&cmd("tool.brush")), vec![b("B")]);
+
+    let mixed = Keymap::new(vec![tool("tool.brush", "brush"), app("layer.bake", &["B"]), tool("tool.pencil", "brush")], Scopes::new(), Platform::Mac);
+    assert_eq!(press(&mixed, "B", &Active::NONE), run("tool.brush"));
+}
+
+#[test]
+fn steal_keep_and_refuse() {
+    let catalog = vec![app("edit.copy", &["Cmd+C"]), app("edit.duplicate", &["Cmd+D"]), in_scope("timeline.copy", "Timeline", &[])];
+    let mut km = Keymap::new(catalog, scopes(), Platform::Mac);
+    let dup = cmd("edit.duplicate");
+
+    let err = km.assign(&dup, b("Cmd+C"), Policy::Refuse).unwrap_err();
+    let AssignError::Taken(holders) = err else { panic!("{err:?}") };
+    assert_eq!(holders[0].command, cmd("edit.copy"));
+    assert_eq!(km.bindings(&dup), vec![b("Cmd+D")]);
+
+    let done = km.assign(&dup, b("Cmd+C"), Policy::Keep).unwrap();
+    assert_eq!(done.clashes.len(), 1);
+    assert_eq!(km.bindings(&cmd("edit.copy")), vec![b("Cmd+C")]);
+    assert_eq!(km.bindings(&dup), vec![b("Cmd+D"), b("Cmd+C")]);
+
+    km.reset_all();
+    let done = km.assign(&dup, b("Cmd+C"), Policy::Steal).unwrap();
+    assert_eq!(done.taken_from[0].command, cmd("edit.copy"));
+    assert!(km.bindings(&cmd("edit.copy")).is_empty());
+    assert_eq!(km.overrides().get("edit.copy"), Some(&[][..]));
+    assert_eq!(press(&km, "Cmd+C", &Active::NONE), run("edit.duplicate"));
+
+    // A panel binding shadows the application one; nothing is taken.
+    let done = km.assign(&cmd("timeline.copy"), b("Cmd+D"), Policy::Refuse).unwrap();
+    assert!(done.taken_from.is_empty() && done.clashes.is_empty());
+    assert_eq!(km.assign(&cmd("nope"), b("Cmd+D"), Policy::Steal), Err(AssignError::UnknownCommand));
+}
+
+#[test]
+fn twins_keep_their_shared_default_key() {
+    let mut km = Keymap::new(vec![app("file.close", &["Cmd+W"]), app("sequence.close", &["Cmd+W"])], Scopes::new(), Platform::Mac);
+    km.clear(&cmd("sequence.close"));
+    let done = km.assign(&cmd("sequence.close"), b("Cmd+W"), Policy::Refuse).unwrap();
+    assert!(done.taken_from.is_empty());
+    assert_eq!(km.bindings(&cmd("file.close")), vec![b("Cmd+W")]);
+    assert!(km.overrides().is_empty(), "back to the defaults");
+}
+
+#[test]
+fn clearing_a_command_frees_its_panel_copies() {
+    // filmcraft#1333: New Bin holds Cmd+B in the application and in the Project panel.
+    let catalog = vec![app("project.newBin", &["Cmd+B", "Project: Cmd+B"]), app("clip.bold", &[])];
+    let mut km = Keymap::new(catalog, Scopes::new().with_panel("Project"), Platform::Mac);
+    assert_eq!(press(&km, "Cmd+B", &Active::panel("Project")), run("project.newBin"));
+    assert!(km.clear(&cmd("project.newBin")));
+    assert!(km.bindings(&cmd("project.newBin")).is_empty());
+    assert_eq!(press(&km, "Cmd+B", &Active::panel("Project")), Lookup::None);
+    assert!(km.assign(&cmd("clip.bold"), b("Project: Cmd+B"), Policy::Refuse).is_ok());
+}
+
+#[test]
+fn reserved_chords_are_refused() {
+    let catalog = vec![app("view.next", &[])];
+    let mut mac = Keymap::new(catalog.clone(), Scopes::new(), Platform::Mac).with_reserved(reserved::system(Platform::Mac));
+    let err = mac.assign(&cmd("view.next"), b("Cmd+Tab"), Policy::Steal).unwrap_err();
+    assert_eq!(err, AssignError::Reserved(Trigger::parse("Cmd+Tab").unwrap()));
+
+    let mut win = Keymap::new(catalog.clone(), Scopes::new(), Platform::Windows).with_reserved(reserved::system(Platform::Windows));
+    assert!(matches!(win.assign(&cmd("view.next"), b("Ctrl+Alt+Delete"), Policy::Steal), Err(AssignError::Reserved(_))));
+    assert!(reserved::system(Platform::Linux).contains(&chord("Cmd+Alt+F12")));
+
+    let mut o = Overrides::new();
+    o.insert("view.next", vec!["Alt+F4".into()]);
+    let linux = Keymap::new(catalog, Scopes::new(), Platform::Linux).with_reserved(reserved::system(Platform::Linux)).with_overrides(o);
+    assert!(linux.bindings(&cmd("view.next")).is_empty());
+    assert_eq!(linux.problems(), vec![Problem::Reserved { key: "view.next".into(), text: "Alt+F4".into() }]);
+}
+
+#[test]
+fn conflicts_tell_clashes_from_shadows() {
+    let catalog = vec![
+        app("edit.copy", &["Cmd+C"]),
+        app("color.copy", &["Cmd+C"]),
+        in_scope("timeline.copy", "Timeline", &["Cmd+C"]),
+        in_scope("text.cut", "Text", &["Cmd+X"]),
+        app("edit.cut", &["Cmd+X"]),
+        app("edit.find", &["Cmd+F"]),
+        in_scope("tab.find", "Effects", &["Cmd+F"]),
+        in_scope("render.find", "Render", &["Cmd+R"]),
+        in_scope("effects.render", "Effects", &["Cmd+R"]),
+    ];
+    let mut km = Keymap::new(catalog, scopes(), Platform::Mac);
+    let summary = |km: &Keymap| -> Vec<(String, String, String, ConflictKind, bool)> {
+        km.conflicts().into_iter().map(|c| (c.chord.to_string(), c.a.0.id, c.b.0.id, c.kind, c.in_defaults)).collect()
+    };
+    let s = |a: &str, x: &str, y: &str, k, d| (a.to_string(), x.to_string(), y.to_string(), k, d);
+    let mut want = vec![
+        s("Cmd+C", "edit.copy", "color.copy", ConflictKind::Clash, true),
+        s("Cmd+C", "edit.copy", "timeline.copy", ConflictKind::Shadow, true),
+        s("Cmd+C", "color.copy", "timeline.copy", ConflictKind::Shadow, true),
+        s("Cmd+X", "text.cut", "edit.cut", ConflictKind::Shadow, true),
+        s("Cmd+F", "edit.find", "tab.find", ConflictKind::Shadow, true),
+        // Fallthrough: in a third panel the two tie.
+        s("Cmd+R", "render.find", "effects.render", ConflictKind::Shadow, true),
+    ];
+    let sort = |mut v: Vec<(String, String, String, ConflictKind, bool)>| {
+        v.sort();
+        v
+    };
+    assert_eq!(sort(summary(&km)), sort(want.clone()));
+
+    km.assign(&cmd("edit.find"), b("Cmd+D"), Policy::Steal).unwrap();
+    km.assign(&cmd("edit.cut"), b("Cmd+D"), Policy::Keep).unwrap();
+    want.push(s("Cmd+D", "edit.cut", "edit.find", ConflictKind::Clash, false));
+    assert_eq!(sort(summary(&km)), sort(want.clone()));
+
+    let order: Vec<_> = summary(&km).into_iter().map(|(c, a, b, ..)| (c, a, b)).collect();
+    let chords: Vec<Trigger> = km.conflicts().iter().map(|c| c.chord).collect();
+    assert!(chords.is_sorted(), "{order:?}");
+    let c = |x: &str, y: &str| order.iter().position(|(_, a, b)| a == x && b == y);
+    assert!(c("edit.copy", "color.copy") < c("edit.copy", "timeline.copy"), "{order:?}");
+    assert!(c("edit.copy", "timeline.copy") < c("color.copy", "timeline.copy"), "{order:?}");
+
+    // One command's conflicts, with that command as `a`.
+    let with = |id: &str| -> Vec<(String, String, ConflictKind)> {
+        km.conflicts_with(&cmd(id)).into_iter().map(|c| (c.chord.to_string(), c.b.0.id, c.kind)).collect()
+    };
+    let w = |chord: &str, other: &str, kind| (chord.to_string(), other.to_string(), kind);
+    assert_eq!(with("edit.copy"), [w("Cmd+C", "color.copy", ConflictKind::Clash), w("Cmd+C", "timeline.copy", ConflictKind::Shadow)]);
+    assert_eq!(with("edit.cut"), [w("Cmd+X", "text.cut", ConflictKind::Shadow), w("Cmd+D", "edit.find", ConflictKind::Clash)]);
+    assert!(with("nope").is_empty());
+    for entry in km.catalog() {
+        let id = entry.command.id.as_str();
+        let mut direct: Vec<_> =
+            km.conflicts_with(&entry.command).into_iter().map(|c| (c.chord, c.a.0.id, c.b.0.id, c.kind, c.in_defaults)).collect();
+        let mut filtered: Vec<_> = km
+            .conflicts()
+            .into_iter()
+            .filter(|c| c.a.0.id == id || c.b.0.id == id)
+            .map(|c| {
+                if c.a.0.id == id {
+                    (c.chord, c.a.0.id, c.b.0.id, c.kind, c.in_defaults)
+                } else {
+                    (c.chord, c.b.0.id, c.a.0.id, c.kind, c.in_defaults)
+                }
+            })
+            .collect();
+        direct.sort();
+        filtered.sort();
+        assert_eq!(direct, filtered, "{id}");
+    }
+
+    let strict = Keymap::new(km.catalog().to_vec(), scopes().with_panel_fallthrough(false), Platform::Mac);
+    assert!(!strict.conflicts().iter().any(|c| c.chord.to_string() == "Cmd+R"));
+}
+
+/// `commands` commands, each with 16 bindings on one chord in 16 panels.
+fn crowded(commands: usize, scopes: Scopes, kind: Kind) -> (Keymap, Overrides) {
+    let catalog: Vec<Bindable> = (0..commands).map(|n| app(&format!("c.{n}"), &[]).with_kind(kind.clone())).collect();
+    let mut o = Overrides::new();
+    for n in 0..commands {
+        assert!(o.insert(format!("c.{n}"), (1..=MAX_BINDINGS).map(|p| format!("P{p}: K")).collect()));
+    }
+    (Keymap::new(catalog, scopes, Platform::Mac), o)
+}
+
+fn panels(n: usize) -> Scopes {
+    (1..=n).fold(Scopes::new(), |s, p| s.with_panel(&format!("P{p}")))
+}
+
+#[test]
+fn crowded_chords_are_capped() {
+    // Panels the app never registered are not bound.
+    let (km, o) = crowded(2, Scopes::new(), Kind::Command);
+    let km = km.with_overrides(o);
+    assert!(km.conflicts().is_empty());
+    assert!(km.bindings(&cmd("c.0")).is_empty());
+    assert_eq!(km.overrides().get("c.0").map(<[String]>::len), Some(MAX_BINDINGS), "kept verbatim");
+    assert!(km.problems().contains(&Problem::UnknownScope { key: "c.0".into(), text: "P1: K".into() }));
+
+    // Registered panels that never share: 32 commands make 16 × 496 pairs, capped.
+    let (km, o) = crowded(32, panels(MAX_BINDINGS).with_panel_fallthrough(false), Kind::Command);
+    assert_eq!(km.with_overrides(o).conflicts().len(), MAX_CONFLICTS);
+
+    // Tools of one group: no conflicts.
+    let (km, o) = crowded(32, panels(MAX_BINDINGS), Kind::Tool { group: None });
+    assert!(km.with_overrides(o).conflicts().is_empty());
+}
+
+#[test]
+#[ignore = "worst-case timing; run with --ignored"]
+fn crowded_chords_stay_fast() {
+    let limit = Duration::from_secs(8);
+
+    // Panels the app never registered are not bound.
+    let (km, o) = crowded(MAX_COMMANDS, Scopes::new(), Kind::Command);
+    let km = km.with_overrides(o);
+    let t = Instant::now();
+    assert!(km.conflicts().is_empty());
+    assert!(t.elapsed() < limit, "{:?}", t.elapsed());
+    assert!(km.bindings(&cmd("c.0")).is_empty());
+    assert_eq!(km.overrides().get("c.0").map(<[String]>::len), Some(MAX_BINDINGS), "kept verbatim");
+    assert!(km.problems().contains(&Problem::UnknownScope { key: "c.0".into(), text: "P1: K".into() }));
+
+    // Registered panels that never share: many conflicts, capped.
+    let (km, o) = crowded(MAX_COMMANDS, panels(MAX_BINDINGS).with_panel_fallthrough(false), Kind::Command);
+    let km = km.with_overrides(o);
+    let t = Instant::now();
+    assert_eq!(km.conflicts().len(), MAX_CONFLICTS);
+    assert!(t.elapsed() < limit, "{:?}", t.elapsed());
+
+    // Tools of one group: no conflicts, and no pair is compared.
+    let (km, o) = crowded(MAX_COMMANDS, panels(MAX_BINDINGS), Kind::Tool { group: None });
+    let km = km.with_overrides(o);
+    let t = Instant::now();
+    assert!(km.conflicts().is_empty());
+    assert!(t.elapsed() < limit, "{:?}", t.elapsed());
+}
+
+#[test]
+fn assigning_many_commands_stays_fast() {
+    let catalog: Vec<Bindable> = (0..MAX_COMMANDS).map(|n| app(&format!("c.{n}"), &[])).collect();
+    let mut km = Keymap::new(catalog, panels(MAX_BINDINGS), Platform::Mac);
+    let list: Vec<Binding> = (1..=MAX_BINDINGS).map(|p| b(&format!("P{p}: K"))).collect();
+    let t = Instant::now();
+    for n in 0..MAX_COMMANDS {
+        let done = km.set_bindings(&cmd(&format!("c.{n}")), list.clone(), Policy::Steal).unwrap();
+        assert_eq!(done.taken_from.len(), if n == 0 { 0 } else { MAX_BINDINGS });
+    }
+    assert!(t.elapsed() < Duration::from_secs(8), "{:?}", t.elapsed());
+    assert_eq!(km.bindings(&cmd(&format!("c.{}", MAX_COMMANDS - 1))), list);
+    assert!(km.bindings(&cmd("c.0")).is_empty());
+    assert_eq!(press(&km, "K", &Active::panel("P3")), run(&format!("c.{}", MAX_COMMANDS - 1)));
+}
+
+#[test]
+fn binding_text_round_trips_for_every_key() {
+    let panel = scope("Timeline");
+    for &key in Key::ALL {
+        for mods in [Mods::NONE, Mods { cmd: true, ctrl: true, alt: true, shift: true }] {
+            let chord = Chord::new(mods, key);
+            for trigger in [Trigger::single(chord), Trigger::double(chord)] {
+                for binding in [Binding::new(trigger), Binding::in_scope(trigger, panel.clone())] {
+                    let text = binding.to_string();
+                    assert_eq!(Binding::parse(&text).as_ref(), Ok(&binding), "{text}");
+                }
+            }
+        }
+    }
+    assert_eq!(Binding::parse(": :"), Ok(Binding::new(Trigger::double(Chord::plain(Key::Colon)))));
+}
+
+#[test]
+fn scope_names_with_outer_whitespace_are_refused() {
+    for name in [" Timeline", "Timeline ", "\u{a0}Timeline", ""] {
+        assert_eq!(Scope::new(name), None, "{name:?}");
+    }
+    assert_eq!(Scope::new("Time line").map(|s| s.to_string()).as_deref(), Some("Time line"));
+    assert_eq!(Binding::parse(" Timeline :  K").map(|b| b.scope), Ok(Some(scope("Timeline"))));
+}
+
+#[test]
+fn edits_are_refused_when_the_overrides_are_full() {
+    let catalog = vec![app("edit.copy", &["Cmd+C"]), app("edit.duplicate", &["Cmd+D"]), app("edit.cut", &[])];
+    let mut o = Overrides::new();
+    o.insert("edit.cut", vec!["Cmd+X".into()]);
+    for n in 1..MAX_COMMANDS {
+        o.insert(format!("junk.{n}"), vec![]);
+    }
+    assert_eq!(o.len(), MAX_COMMANDS);
+    let mut km = Keymap::new(catalog, Scopes::new(), Platform::Mac).with_overrides(o.clone());
+    let (copy, dup, cut) = (cmd("edit.copy"), cmd("edit.duplicate"), cmd("edit.cut"));
+
+    assert_eq!(km.assign(&dup, b("Cmd+K"), Policy::Steal), Err(AssignError::Full));
+    assert_eq!(km.set_bindings(&dup, vec![], Policy::Steal), Err(AssignError::Full));
+    assert!(!km.clear(&copy));
+    assert!(!km.remove(&copy, &b("Cmd+C")));
+    // Taking Cmd+C from edit.copy would need an entry for it too.
+    assert_eq!(km.assign(&cut, b("Cmd+C"), Policy::Steal), Err(AssignError::Full));
+    assert_eq!(km.bindings(&copy), vec![b("Cmd+C")]);
+    assert_eq!(km.bindings(&cut), vec![b("Cmd+X")]);
+    assert_eq!(km.overrides(), &o);
+
+    // Commands that have an entry still change, and back to the defaults frees one.
+    assert!(km.assign(&cut, b("Cmd+Shift+X"), Policy::Steal).is_ok());
+    assert!(km.reset(&cut));
+    assert!(km.assign(&dup, b("Cmd+K"), Policy::Steal).is_ok());
+}
+
+#[test]
+fn bindings_in_unknown_scopes_are_refused() {
+    let catalog = vec![app("edit.copy", &["Cmd+C"]), in_scope("timeline.mark", "Timeline", &["M"])];
+    let mut km = Keymap::new(catalog, Scopes::new().with_context("Text"), Platform::Mac);
+    let copy = cmd("edit.copy");
+    assert_eq!(km.assign(&copy, b("Nowhere: Cmd+K"), Policy::Steal), Err(AssignError::UnknownScope(scope("Nowhere"))));
+    assert!(km.assign(&copy, b("Timeline: Cmd+K"), Policy::Steal).is_ok(), "a catalog scope");
+    assert!(km.assign(&copy, b("Text: Cmd+K"), Policy::Steal).is_ok(), "a registered scope");
+
+    let mut o = Overrides::new();
+    o.insert("edit.copy", vec!["Nowhere: Cmd+K".into(), "Cmd+J".into()]);
+    km.set_overrides(o);
+    assert_eq!(km.bindings(&copy), vec![b("Cmd+J")]);
+    assert_eq!(km.problems(), vec![Problem::UnknownScope { key: "edit.copy".into(), text: "Nowhere: Cmd+K".into() }]);
+}
+
+#[test]
+fn unreadable_entries_keep_the_defaults() {
+    let catalog = vec![app("edit.copy", &["Cmd+C"]), app("edit.paste", &["Cmd+V"])];
+    let mut o = Overrides::new();
+    o.insert("edit.copy", vec!["Cmd+Nope".into()]);
+    o.insert("edit.paste", vec![]);
+    let mut km = Keymap::new(catalog, Scopes::new(), Platform::Mac).with_overrides(o);
+    assert_eq!(km.bindings(&cmd("edit.copy")), vec![b("Cmd+C")]);
+    assert!(km.bindings(&cmd("edit.paste")).is_empty());
+    assert_eq!(km.overrides().get("edit.copy"), Some(&["Cmd+Nope".to_string()][..]), "verbatim");
+    assert!(km.reset(&cmd("edit.copy")));
+    assert_eq!(km.overrides().get("edit.copy"), None);
+}
+
+#[test]
+fn entries_with_nothing_usable_keep_the_defaults() {
+    let catalog = vec![app("edit.copy", &["Cmd+C"]), app("edit.cut", &["Cmd+X"]), app("edit.paste", &["Cmd+V"]), app("edit.undo", &["Cmd+Z"])];
+    let mut o = Overrides::new();
+    o.insert("edit.copy", vec!["Nowhere: Cmd+K".into()]);
+    o.insert("edit.cut", vec!["Alt+F4".into()]);
+    o.insert("edit.paste", vec!["Nowhere: Cmd+K".into(), "Alt+F4".into(), "Cmd+J".into()]);
+    o.insert("edit.undo", vec![]);
+    let km = Keymap::new(catalog, Scopes::new(), Platform::Linux).with_reserved(reserved::system(Platform::Linux)).with_overrides(o);
+    assert_eq!(km.bindings(&cmd("edit.copy")), vec![b("Cmd+C")], "only an unknown scope");
+    assert_eq!(km.bindings(&cmd("edit.cut")), vec![b("Cmd+X")], "only a reserved chord");
+    assert_eq!(km.bindings(&cmd("edit.paste")), vec![b("Cmd+J")]);
+    assert!(km.bindings(&cmd("edit.undo")).is_empty());
+}
+
+#[test]
+fn overrides_hold_only_what_differs_from_the_defaults() {
+    let catalog = vec![app("edit.copy", &["Cmd+C"]), in_scope("timeline.mark", "Timeline", &["M"])];
+    let mut km = Keymap::new(catalog, scopes(), Platform::Mac);
+    let copy = cmd("edit.copy");
+    km.assign(&copy, b("Timeline: Cmd+K"), Policy::Steal).unwrap();
+    assert_eq!(km.overrides().get("edit.copy"), Some(&["Cmd+C".to_string(), "Timeline: Cmd+K".to_string()][..]));
+    assert_eq!(km.bindings(&copy)[1], Binding::in_scope(Trigger::parse("Cmd+K").unwrap(), scope("Timeline")));
+    assert!(km.remove(&copy, &b("Timeline: Cmd+K")));
+    assert!(km.overrides().is_empty());
+
+    km.set_bindings(&cmd("timeline.mark"), vec![b("Timeline: M")], Policy::Steal).unwrap();
+    assert!(km.overrides().is_empty(), "the home scope written out is the same binding");
+    km.set_bindings(&copy, vec![b("Cmd+Shift+C")], Policy::Steal).unwrap();
+    assert!(km.reset(&copy));
+    assert!(km.overrides().is_empty());
+}
+
+#[test]
+fn edits_keep_the_texts_this_build_cannot_use() {
+    let catalog = vec![app("file.quit", &["Cmd+Q"]), app("file.close", &["Cmd+W"]), app("file.save", &["Cmd+S"])];
+    let mut o = Overrides::new();
+    o.insert("file.quit", vec!["Cmd+Q".into(), "Cmd+FutureKey".into(), "Nowhere: Cmd+J".into()]);
+    let mut km = Keymap::new(catalog.clone(), scopes(), Platform::Mac).with_overrides(o);
+    let quit = cmd("file.quit");
+    let texts = |km: &Keymap| km.overrides().get("file.quit").map(<[String]>::to_vec);
+    let strings = |t: &[&str]| Some(t.iter().map(|s| s.to_string()).collect::<Vec<_>>());
+
+    km.assign(&quit, b("Cmd+W"), Policy::Steal).unwrap();
+    assert_eq!(texts(&km), strings(&["Cmd+Q", "Cmd+W", "Cmd+FutureKey", "Nowhere: Cmd+J"]));
+    km.assign(&cmd("file.save"), b("Cmd+Q"), Policy::Steal).unwrap();
+    assert_eq!(texts(&km), strings(&["Cmd+W", "Cmd+FutureKey", "Nowhere: Cmd+J"]), "taken by a Steal");
+    let reloaded = Keymap::new(catalog, scopes(), Platform::Mac).with_overrides(km.overrides().clone());
+    assert_eq!(reloaded.bindings(&quit), vec![b("Cmd+W")]);
+
+    // An entry of only such texts would load as the defaults, so a cleared command drops them.
+    assert!(km.clear(&quit));
+    assert_eq!(texts(&km), strings(&[]));
+    assert!(km.reset(&quit));
+    assert_eq!(texts(&km), None);
+}
+
+#[test]
+fn an_override_equal_to_the_defaults_on_this_platform_is_not_stored() {
+    let mut km = Keymap::new(vec![app("file.save", &["Cmd+S"])], Scopes::new(), Platform::Windows);
+    km.set_bindings(&cmd("file.save"), vec![b("Ctrl+S")], Policy::Steal).unwrap();
+    assert!(km.overrides().is_empty());
+    assert_eq!(press(&km, "Ctrl+S", &Active::NONE), run("file.save"));
+}
+
+#[test]
+fn an_empty_text_in_the_map_form_removes_the_shortcut() {
+    let catalog = vec![app("edit.copy", &["Cmd+C"]), app("edit.paste", &["Cmd+V"]), app("edit.cut", &["Cmd+X"])];
+    let o: Overrides = serde_json::from_str(r#"{"edit.copy": "", "edit.paste": [""], "edit.cut": "Cmd+K"}"#).unwrap();
+    assert!(o.load_notes().is_empty(), "{:?}", o.load_notes());
+    let km = Keymap::new(catalog.clone(), Scopes::new(), Platform::Mac).with_overrides(o);
+    assert!(km.bindings(&cmd("edit.copy")).is_empty(), "a removed default stays removed");
+    assert!(km.bindings(&cmd("edit.paste")).is_empty());
+    assert_eq!(km.bindings(&cmd("edit.cut")), vec![b("Cmd+K")]);
+    assert!(km.problems().is_empty());
+
+    let saved = serde_json::to_string(km.overrides()).unwrap();
+    let again = Keymap::new(catalog, Scopes::new(), Platform::Mac).with_overrides(serde_json::from_str(&saved).unwrap());
+    assert!(again.bindings(&cmd("edit.copy")).is_empty(), "{saved}");
+}
+
+#[test]
+fn overrides_write_the_map_form_unless_a_command_has_several_keys() {
+    let mut o = Overrides::new();
+    o.insert("edit.copy", vec!["Cmd+K".into()]);
+    o.insert("edit.paste", vec![]);
+    let text = serde_json::to_string(&o).unwrap();
+    assert_eq!(text, r#"{"edit.copy":"Cmd+K","edit.paste":""}"#, "older builds read one text per command");
+    assert_eq!(serde_json::from_str::<Overrides>(&text).unwrap(), o);
+
+    o.insert("edit.cut", vec!["Cmd+X".into(), "Shift+Delete".into()]);
+    let text = serde_json::to_string(&o).unwrap();
+    assert!(text.starts_with(r#"[{"command":"edit.copy","keys":["Cmd+K"]},"#), "{text}");
+    assert_eq!(serde_json::from_str::<Overrides>(&text).unwrap(), o);
+
+    // A blank text is kept verbatim (it loads as the defaults), which the map form cannot say.
+    let mut blank = Overrides::new();
+    blank.insert("edit.copy", vec![" ".into()]);
+    let text = serde_json::to_string(&blank).unwrap();
+    assert!(text.starts_with('['), "{text}");
+    assert_eq!(serde_json::from_str::<Overrides>(&text).unwrap(), blank);
+
+    #[derive(serde::Serialize)]
+    struct Prefs {
+        #[serde(with = "craft_keymap::keymap::overrides_list")]
+        shortcuts: Overrides,
+    }
+    let mut single = Overrides::new();
+    single.insert("edit.copy", vec!["Cmd+K".into()]);
+    let text = serde_json::to_string(&Prefs { shortcuts: single }).unwrap();
+    assert_eq!(text, r#"{"shortcuts":[{"command":"edit.copy","keys":["Cmd+K"]}]}"#);
+}
+
+#[test]
+fn ctrl_folds_into_cmd_off_macos() {
+    let catalog = vec![app("edit.cut", &["Cmd+X"]), app("mac.cut", &["Ctrl+X"])];
+    let win = Keymap::new(catalog.clone(), Scopes::new(), Platform::Windows);
+    let mac = Keymap::new(catalog, Scopes::new(), Platform::Mac);
+    let conflicts = win.conflicts();
+    assert_eq!(conflicts.len(), 1);
+    assert_eq!((conflicts[0].kind, conflicts[0].chord.to_string()), (ConflictKind::Clash, "Cmd+X".to_string()));
+    assert!(mac.conflicts().is_empty());
+    assert_eq!(press(&win, "Ctrl+X", &Active::NONE), run("edit.cut"));
+    assert_eq!(press(&mac, "Ctrl+X", &Active::NONE), run("mac.cut"));
+}
+
+#[test]
+fn hostile_overrides_load_without_panic_and_report_problems() {
+    let mut doc = serde_json::Map::new();
+    for i in 0..(MAX_COMMANDS + 100) {
+        doc.insert(format!("junk.{i}"), json!(["Cmd+Z"]));
+    }
+    doc.insert("edit.copy".into(), json!(["Cmd+Nope", "x".repeat(10_000), 7, "Shift+C"]));
+    doc.insert("a".into(), json!(["Shift+A"]));
+    doc.insert("é".repeat(300), json!([]));
+    doc.insert("b".into(), json!({"deep": [[[[1]]]]}));
+    let o: Overrides = serde_json::from_value(serde_json::Value::Object(doc)).unwrap();
+    assert!(o.len() <= MAX_COMMANDS);
+
+    let km = Keymap::new(vec![app("edit.copy", &["Cmd+C"]), app("a", &[])], Scopes::new(), Platform::Linux).with_overrides(o.clone());
+    assert_eq!(km.bindings(&cmd("edit.copy")), vec![b("Shift+C")]);
+    assert_eq!(km.overrides().get("edit.copy"), Some(&["Cmd+Nope".to_string(), "Shift+C".to_string()][..]), "verbatim");
+    let problems = km.problems();
+    assert!(problems.iter().any(|p| matches!(p, Problem::TooManyCommands { .. })));
+    assert!(problems.contains(&Problem::Dropped { key: "edit.copy".into(), reason: DropReason::TextTooLong }));
+    assert!(problems.contains(&Problem::Dropped { key: "edit.copy".into(), reason: DropReason::NotText }));
+    assert!(problems.iter().any(|p| matches!(p, Problem::Dropped { reason: DropReason::KeyTooLong, .. })));
+    assert!(problems.iter().any(|p| matches!(p, Problem::BadBinding { text, .. } if text == "Cmd+Nope")));
+    assert!(problems.iter().any(|p| matches!(p, Problem::UnknownCommand { key } if key == "junk.0")));
+
+    let text = serde_json::to_string(&o).unwrap();
+    let again: Overrides = serde_json::from_str(&text).unwrap();
+    assert_eq!(again, o);
+    assert!(text.starts_with(r#"[{"command":"a","keys":["Shift+A"]},"#), "{}", &text[..80]);
+    assert!(serde_json::from_str::<Overrides>(r#"{"x": {"y": 1}, "z": true, "w": null, "v": "Cmd+V"}"#).is_ok());
+    let items: Overrides =
+        serde_json::from_str(r#"[{"command": "v", "keys": "Cmd+V"}, {"command": "x"}, {"keys": []}, 3, [], {"command": "y", "keys": [1]}]"#).unwrap();
+    assert_eq!(items.iter().collect::<Vec<_>>(), [("v", &["Cmd+V".to_string()][..]), ("y", &[][..])]);
+    assert_eq!(items.load_notes().len(), 5);
+
+    let twice: Overrides = serde_json::from_str(r#"[{"command": "v", "keys": ["Cmd+V"]}, {"command": "v", "keys": []}]"#).unwrap();
+    assert_eq!(twice.get("v"), Some(&["Cmd+V".to_string()][..]), "the first entry stays");
+    assert_eq!(twice.load_notes(), [Problem::DuplicateKey { key: "v".into() }]);
+    for text in [r#""x""#, "5", "true", "null"] {
+        let o: Overrides = serde_json::from_str(text).unwrap();
+        assert!(o.is_empty(), "{text}");
+        assert_eq!(o.load_notes(), [Problem::Dropped { key: String::new(), reason: DropReason::NotAList }], "{text}");
+    }
+}
+
+#[test]
+fn reset_removes_hand_written_variants_of_a_key() {
+    let layers = CommandRef::with_params("window.panel", json!({"panel": "layers"}));
+    let catalog = vec![Bindable::new(layers.clone(), "Layers", Scope::app()).with_default(b("F7"))];
+    let load = || {
+        let mut o = Overrides::new();
+        o.insert(r#"window.panel {"panel":"layers"}"#, vec!["Cmd+L".into()]);
+        o.insert(r#"window.panel { "panel": "layers" }"#, vec!["Cmd+K".into()]);
+        Keymap::new(catalog.clone(), Scopes::new(), Platform::Mac).with_overrides(o)
+    };
+    let mut km = load();
+    assert_eq!(km.bindings(&layers), vec![b("Cmd+L")], "the canonical entry wins");
+    km.reset(&layers);
+    assert!(km.overrides().is_empty(), "{:?}", km.overrides());
+
+    // Setting the defaults drops the entries too.
+    let mut km = load();
+    km.set_bindings(&layers, vec![b("F7")], Policy::Steal).unwrap();
+    assert!(km.overrides().is_empty(), "{:?}", km.overrides());
+    let again = Keymap::new(catalog.clone(), Scopes::new(), Platform::Mac).with_overrides(km.overrides().clone());
+    assert_eq!(again.bindings(&layers), vec![b("F7")]);
+}
diff --git a/crates/keymap/tests/layout.rs b/crates/keymap/tests/layout.rs
new file mode 100644
index 00000000..46ff8876
--- /dev/null
+++ b/crates/keymap/tests/layout.rs
@@ -0,0 +1,226 @@
+use craft_keymap::{Chord, Key, KeyInput, Layout, Mods, Platform};
+
+fn chord(text: &str) -> Chord {
+    Chord::parse(text).unwrap_or_else(|e| panic!("{text}: {e}"))
+}
+
+/// A press as egui reports it at the US position `physical`: the modifiers held and the logical
+/// key, which is the physical key when the character typed has no key (`ф`, `é`, `ข`).
+fn at(reported: &str, physical: Key) -> KeyInput {
+    let c = chord(reported);
+    KeyInput::new(c.mods).with_typed(c.key).with_physical(physical)
+}
+
+fn texts(chords: &[Chord]) -> Vec<String> {
+    chords.iter().map(Chord::to_string).collect()
+}
+
+#[test]
+fn each_layout_resolves_presses_by_the_rule() {
+    let latin = Layout::new();
+    let other = Layout::new().with_latin(false);
+    let rows: &[(&str, &Layout, KeyInput, &str)] = &[
+        // Russian: letters type Cyrillic, which egui reports as the physical key.
+        ("Russian ⌘С", &other, at("Cmd+C", Key::C), "Cmd+C"),
+        ("Russian ⌘Х", &other, at("Cmd+[", Key::OpenBracket), "Cmd+["),
+        ("Russian / key types .", &other, at("Cmd+.", Key::Slash), "Cmd+."),
+        ("Russian ⇧7 types ?", &other, at("Shift+?", Key::Num7), "?"),
+        // Arabic 101: ⇧D types ].
+        ("Arabic ⌃⇧D", &other, at("Cmd+Shift+]", Key::D), "Cmd+Shift+D"),
+        ("Arabic ⌃V", &other, at("Cmd+V", Key::V), "Cmd+V"),
+        // Hebrew: Q types /, W types ', the / position types ..
+        ("Hebrew ⌃Q", &other, at("Cmd+/", Key::Q), "Cmd+Q"),
+        ("Hebrew ⌃W", &other, at("Cmd+'", Key::W), "Cmd+W"),
+        ("Hebrew / key types .", &other, at("Cmd+.", Key::Slash), "Cmd+."),
+        // Greek: Q types ;.
+        ("Greek ⌃Q", &other, at("Cmd+;", Key::Q), "Cmd+Q"),
+        ("Greek ⌃Z", &other, at("Cmd+Z", Key::Z), "Cmd+Z"),
+        // Dvorak + Russian, as the suite's egui-winit reports them: the Latin layout's character
+        // for each key. Dvorak types ' on the Q position, which egui reports as Q or as '.
+        ("Dvorak + Russian ⌃С", &other, at("Cmd+J", Key::C).with_latin('j'), "Cmd+J"),
+        ("Dvorak + Russian ⌃Й", &other, at("Cmd+Q", Key::Q).with_latin('\''), "Cmd+'"),
+        ("Dvorak + Russian ⌃Й as '", &other, at("Cmd+'", Key::Q).with_latin('\''), "Cmd+'"),
+        ("Dvorak + Russian / key types .", &other, at("Cmd+.", Key::Slash).with_latin('z'), "Cmd+Z"),
+        // Dvorak + Hebrew: the Q position types / and has no Dvorak letter.
+        ("Dvorak + Hebrew ⌃Q", &other, at("Cmd+/", Key::Q).with_latin('\''), "Cmd+/"),
+        // Thai Kedmanee: 2 types /, - types ข, D types ก.
+        ("Thai 2 key types /", &other, at("Cmd+/", Key::Num2), "Cmd+/"),
+        ("Thai - key types ข", &other, at("Cmd+-", Key::Minus), "Cmd+-"),
+        ("Thai ⌃D", &other, at("Cmd+D", Key::D), "Cmd+D"),
+        // AZERTY.
+        ("AZERTY A", &latin, at("Cmd+A", Key::Q), "Cmd+A"),
+        ("AZERTY M", &latin, at("Cmd+M", Key::Semicolon), "Cmd+M"),
+        ("AZERTY M key types ,", &latin, at("Cmd+,", Key::M), "Cmd+,"),
+        ("AZERTY & key", &latin, at("Cmd+1", Key::Num1), "Cmd+1"),
+        ("AZERTY ⇧& types 1", &latin, at("Cmd+Shift+1", Key::Num1), "Cmd+Shift+1"),
+        ("AZERTY 6 key types -", &latin, at("Cmd+-", Key::Num6), "Cmd+-"),
+        ("AZERTY ⇧; types .", &latin, at("Shift+.", Key::Comma), "."),
+        // Dvorak.
+        ("Dvorak O", &latin, at("Cmd+O", Key::S), "Cmd+O"),
+        ("Dvorak ⇧O keeps Shift", &latin, at("Cmd+Shift+O", Key::S), "Cmd+Shift+O"),
+        ("Dvorak Q key types '", &latin, at("Cmd+'", Key::Q), "Cmd+'"),
+        ("Dvorak W key types ,", &latin, at("Cmd+,", Key::W), "Cmd+,"),
+        // QWERTZ (German).
+        ("QWERTZ ⇧⌘7 types /", &latin, at("Cmd+Shift+/", Key::Num7), "Cmd+/"),
+        ("QWERTZ Z", &latin, at("Cmd+Z", Key::Y), "Cmd+Z"),
+        ("QWERTZ ⇧ß types ?", &latin, at("Cmd+Shift+?", Key::Minus), "Cmd+?"),
+        ("QWERTZ + key", &latin, at("Cmd++", Key::CloseBracket), "Cmd++"),
+        ("QWERTZ ⇧, types ;", &latin, at("Cmd+Shift+;", Key::Comma), "Cmd+;"),
+        // US.
+        ("US ⇧;", &latin, at("Shift+:", Key::Semicolon), ":"),
+        ("US ⇧⌘=", &latin, at("Cmd+Shift++", Key::Equals), "Cmd++"),
+        ("US ⇧- types _, which has no key", &latin, at("Shift+-", Key::Minus), "Shift+-"),
+        // macOS "Dvorak – QWERTY ⌘": with ⌘ held the layout's ⌘ table is QWERTY, while the
+        // logical key egui reports is Dvorak's K.
+        ("Dvorak – QWERTY ⌘ ⌘V", &latin, at("Cmd+K", Key::V).with_latin('v'), "Cmd+V"),
+        // A Shift level the platform reports wins over the inference.
+        ("reported Shift level", &latin, at("Cmd+Shift+/", Key::Num7).with_shift_needed(false), "Cmd+Shift+/"),
+    ];
+    for (name, layout, input, want) in rows {
+        assert_eq!(layout.resolve(input).map(|c| c.to_string()).as_deref(), Some(*want), "{name}");
+    }
+}
+
+#[test]
+fn reported_cases_match_only_the_chord_the_press_means() {
+    let p = Platform::Windows;
+    let arabic = Layout::new().with_latin(false);
+    let ctrl_shift_d = at("Cmd+Shift+]", Key::D);
+    assert!(arabic.matches(&chord("Ctrl+Shift+D"), &ctrl_shift_d, p));
+    assert!(!arabic.matches(&chord("Ctrl+Shift+]"), &ctrl_shift_d, p), "Arabic Ctrl+Shift+D must not run Ctrl+Shift+]");
+
+    let dvorak_russian_q = at("Cmd+Q", Key::Q).with_latin('\'');
+    assert!(!Layout::new().with_latin(false).matches(&chord("Ctrl+Q"), &dvorak_russian_q, p), "Dvorak + Russian й must not quit");
+
+    let qwerty_cmd = at("Cmd+K", Key::V).with_latin('v');
+    assert!(Layout::new().matches(&chord("Cmd+V"), &qwerty_cmd, Platform::Mac));
+    assert!(!Layout::new().matches(&chord("Cmd+K"), &qwerty_cmd, Platform::Mac), "⌘V must not open the command palette");
+
+    let german = Layout::new();
+    let slash = at("Cmd+Shift+/", Key::Num7);
+    assert_eq!(texts(&german.candidates(&slash)), ["Cmd+/", "Cmd+Shift+7"]);
+    assert!(german.matches(&chord("⌘/"), &slash, Platform::Mac));
+    // A US-written ⌘? binding is reached with German's ⇧ß, not with ⇧7.
+    assert!(!german.matches(&chord("Cmd+Shift+/"), &slash, p));
+    assert_eq!(texts(&german.candidates(&at("Cmd+Shift+?", Key::Minus))), ["Cmd+?", "Cmd+Shift+/"]);
+    // German Ctrl+; is Ctrl+Shift+, and must not run a Ctrl+Shift+, (font size) binding.
+    let semicolon = at("Cmd+Shift+;", Key::Comma);
+    assert!(german.matches(&chord("Ctrl+;"), &semicolon, p));
+    assert!(!german.matches(&chord("Ctrl+Shift+,"), &semicolon, p));
+
+    // AZERTY's 6 key types -: Ctrl+- first, then Ctrl+6.
+    assert_eq!(texts(&Layout::new().candidates(&at("Cmd+-", Key::Num6))), ["Cmd+-", "Cmd+6"]);
+    // Zoom keys: + also runs =, and Shift+= runs +.
+    assert_eq!(texts(&Layout::new().candidates(&at("Cmd+Shift++", Key::Equals))), ["Cmd++", "Cmd+Shift+=", "Cmd+="]);
+    assert_eq!(texts(&Layout::new().candidates(&KeyInput::new(Mods::SHIFT).with_typed(Key::Equals))), ["Shift+=", "+"]);
+}
+
+#[test]
+fn typing_decides_whether_the_layout_is_latin() {
+    let mut layout = Layout::new();
+    assert!(layout.is_latin(), "nothing known counts as Latin");
+    let ctrl_shift_d = at("Cmd+Shift+]", Key::D);
+    // Read as punctuation until the layout is known: ] needs Shift on the D key.
+    assert_eq!(layout.resolve(&ctrl_shift_d), Some(chord("Cmd+]")));
+
+    layout.observe(Key::D, Mods::NONE, "ي");
+    assert!(!layout.is_latin());
+    assert_eq!(layout.resolve(&ctrl_shift_d), Some(chord("Cmd+Shift+D")));
+
+    // Punctuation on a letter key says nothing: Hebrew Q and Dvorak Q both type a symbol.
+    layout.observe(Key::Q, Mods::NONE, "/");
+    assert!(!layout.is_latin());
+    layout.observe(Key::A, Mods::SHIFT, "A");
+    assert!(layout.is_latin());
+    layout.observe(Key::W, Mods::NONE, "ς");
+    assert!(!layout.is_latin());
+    layout.observe(Key::S, Mods::CMD, "s");
+    assert!(!layout.is_latin(), "a command chord teaches nothing");
+    layout.observe(Key::S, Mods::NONE, "š");
+    assert!(layout.is_latin(), "Latin letters beyond ASCII count as Latin");
+    layout.observe(Key::M, Mods::NONE, "µ");
+    assert!(layout.is_latin(), "Latin-1 symbols that count as letters say nothing");
+
+    // What the platform reports wins.
+    let mut reported = Layout::new().with_latin(false);
+    reported.observe(Key::A, Mods::NONE, "a");
+    assert!(!reported.is_latin());
+    reported.set_latin(None);
+    assert!(reported.is_latin());
+}
+
+#[test]
+fn dvorak_shift_punctuation_never_runs_its_position() {
+    // Dvorak's , key sits on W and types < with Shift, which egui has no key for, so egui
+    // reports the press as W.
+    let ctrl_shift_lt = at("Cmd+Shift+W", Key::W);
+    let mut dvorak = Layout::new();
+    assert_eq!(dvorak.resolve(&ctrl_shift_lt), Some(chord("Cmd+Shift+W")), "nothing known yet");
+
+    dvorak.observe(Key::S, Mods::NONE, "o");
+    assert_eq!(dvorak.resolve(&ctrl_shift_lt), Some(chord("Cmd+Shift+W")), "the W position is unseen");
+    dvorak.observe(Key::W, Mods::NONE, ",");
+    assert_eq!(dvorak.resolve(&ctrl_shift_lt), None);
+    assert!(!dvorak.matches(&chord("Ctrl+Shift+W"), &ctrl_shift_lt, Platform::Windows));
+    // Without Shift, and for letters typed where they sit (Dvorak's A) or elsewhere, presses
+    // resolve as before.
+    assert_eq!(dvorak.resolve(&at("Cmd+W", Key::W)), Some(chord("Cmd+W")));
+    dvorak.observe(Key::A, Mods::NONE, "a");
+    assert_eq!(dvorak.resolve(&at("Cmd+Shift+A", Key::A)), Some(chord("Cmd+Shift+A")));
+    assert_eq!(dvorak.resolve(&at("Cmd+Shift+O", Key::S)), Some(chord("Cmd+Shift+O")));
+
+    // AZERTY: A is moved, but the unseen E position still runs Ctrl+Shift+E.
+    let mut azerty = Layout::new();
+    azerty.observe(Key::Q, Mods::NONE, "a");
+    assert_eq!(azerty.resolve(&at("Cmd+Shift+E", Key::E)), Some(chord("Cmd+Shift+E")));
+
+    // QWERTY: a position typing its own letter keeps the position fallback.
+    let mut qwerty = Layout::new();
+    qwerty.observe(Key::S, Mods::NONE, "s");
+    qwerty.observe(Key::W, Mods::SHIFT, "W");
+    assert_eq!(qwerty.resolve(&ctrl_shift_lt), Some(chord("Cmd+Shift+W")));
+    assert_eq!(qwerty.resolve(&at("Cmd+Shift+E", Key::E)), Some(chord("Cmd+Shift+E")));
+}
+
+#[test]
+fn a_layout_switch_forgets_what_letter_positions_typed() {
+    // On Dvorak the W position types `,`; after a switch to QWERTY, Ctrl+Shift+W is W again.
+    let ctrl_shift_w = at("Cmd+Shift+W", Key::W);
+    let mut layout = Layout::new().with_latin(true);
+    layout.observe(Key::W, Mods::NONE, ",");
+    assert_eq!(layout.resolve(&ctrl_shift_w), None);
+    layout.set_latin(Some(true));
+    assert_eq!(layout.resolve(&ctrl_shift_w), None, "the same report is the same layout");
+
+    // Dvorak, then Russian, then QWERTY, as the platform reports them.
+    layout.set_latin(Some(false));
+    layout.set_latin(Some(true));
+    assert_eq!(layout.resolve(&ctrl_shift_w), Some(chord("Cmd+Shift+W")));
+
+    // An app that learns of a switch itself.
+    let mut unreported = Layout::new();
+    unreported.observe(Key::W, Mods::NONE, ",");
+    assert_eq!(unreported.resolve(&ctrl_shift_w), None);
+    unreported.forget_letters();
+    assert_eq!(unreported.resolve(&ctrl_shift_w), Some(chord("Cmd+Shift+W")));
+}
+
+#[test]
+fn labels_show_the_layouts_own_punctuation() {
+    let mut german = Layout::new().with_char(Key::OpenBracket, 'ü').with_char(Key::Slash, '-').with_char(Key::CloseBracket, '+');
+    german.observe(Key::Minus, Mods::NONE, "ß");
+    let label = |layout: &Layout, text: &str, p| chord(text).display_for(p, layout);
+    assert_eq!(label(&german, "Cmd+[", Platform::Windows), "Ctrl+Ü");
+    assert_eq!(label(&german, "Cmd+[", Platform::Mac), "⌘Ü");
+    // German types - at the / position, so Ctrl+- shows -; its + key types a key of its own.
+    assert_eq!(label(&german, "Cmd+-", Platform::Windows), "Ctrl+-");
+    assert_eq!(label(&german, "Cmd+]", Platform::Windows), "Ctrl+]");
+    assert_eq!(label(&german, "Cmd+Z", Platform::Windows), "Ctrl+Z");
+    assert_eq!(label(&german, "Cmd+1", Platform::Windows), "Ctrl+1");
+
+    let russian = Layout::new().with_latin(false).with_char(Key::OpenBracket, 'х');
+    assert_eq!(label(&russian, "Cmd+[", Platform::Linux), "Ctrl+Х");
+    assert_eq!(label(&russian, "Cmd+C", Platform::Linux), "Ctrl+C");
+    assert_eq!(craft_keymap::Trigger::double(chord("[")).display_for(Platform::Linux, &russian), "Х Х");
+    assert_eq!(label(&Layout::new(), "Cmd+[", Platform::Linux), "Ctrl+[");
+}
diff --git a/crates/keymap/tests/profiles.rs b/crates/keymap/tests/profiles.rs
new file mode 100644
index 00000000..e3b789b8
--- /dev/null
+++ b/crates/keymap/tests/profiles.rs
@@ -0,0 +1,210 @@
+use craft_keymap::{
+    Bindable, Binding, CommandRef, ContextRule, Flavor, ForeignEntry, ForeignKey, ForeignSet, ImportOptions, Keymap, MAX_SETS, Overrides, Platform,
+    Policy, ProfileError, Profiles, Scope, Scopes, SetProblem, Start, plan,
+};
+use serde_json::json;
+
+fn b(text: &str) -> Binding {
+    Binding::parse(text).unwrap_or_else(|e| panic!("{text}: {e}"))
+}
+
+fn keymap() -> Keymap {
+    let catalog = vec![
+        Bindable::new("file.save", "Save", Scope::app()).with_path(vec!["File".into(), "Save".into()]).with_default(b("Cmd+S")),
+        Bindable::new("edit.copy", "Copy", Scope::app()).with_path(vec!["Edit".into(), "Copy".into()]).with_default(b("Cmd+C")),
+        Bindable::new(CommandRef::with_params("window.panel", json!({"panel": "layers"})), "Layers", Scope::app()).with_default(b("F7")),
+        Bindable::new("timeline.loop", "Loop", Scope::new("Timeline").unwrap()).with_default(b("L")),
+    ];
+    Keymap::new(catalog, Scopes::new().with_panel("Timeline"), Platform::Mac)
+}
+
+#[test]
+fn profiles_copy_built_ins_on_edit_and_round_trip_as_json() {
+    let mut classic = Overrides::new();
+    classic.insert("edit.copy", vec!["Cmd+Shift+C".into()]);
+    let builtins = [("Craft", Overrides::new()), ("Classic", classic.clone())];
+    let mut p = Profiles::default();
+    assert_eq!(p.active_name(&builtins), "Craft");
+
+    let mut edited = Overrides::new();
+    edited.insert("edit.copy", vec![]);
+    assert_eq!(p.store(edited.clone(), &builtins, "Custom"), Ok(Some("Custom".into())));
+    assert_eq!(p.active_name(&builtins), "Custom");
+    assert_eq!(p.store(Overrides::new(), &builtins, "Custom"), Ok(None), "a user set is edited in place");
+    assert!(p.active_overrides(&builtins).is_empty());
+
+    p.select("Classic", &builtins).unwrap();
+    assert_eq!(p.active_overrides(&builtins), &classic);
+    assert_eq!(p.store(classic.clone(), &builtins, "Custom"), Ok(None), "no change, no copy");
+    assert_eq!(p.store(edited.clone(), &builtins, "Custom"), Ok(Some("Custom 2".into())));
+    assert_eq!(builtins[1].1, classic);
+
+    let exported = p.export("Custom 2", &builtins).unwrap();
+    assert_eq!(p.import(&exported, &builtins), Ok("Custom 3".into()));
+    assert_eq!(p.active_overrides(&builtins), &edited);
+
+    assert_eq!(p.delete("Classic", &builtins), Err(ProfileError::BuiltIn));
+    assert_eq!(p.rename("Custom 3", "classic", &builtins), Err(ProfileError::NameTaken));
+    assert_eq!(p.rename("Custom 3", "Mine", &builtins), Ok("Mine".into()));
+    assert_eq!(p.active(), "Mine");
+    assert_eq!(p.save_as(&"x".repeat(65), Overrides::new(), &builtins), Err(ProfileError::BadName));
+    p.delete("Mine", &builtins).unwrap();
+    assert_eq!(p.active_name(&builtins), "Craft");
+
+    let wrong = exported.replace("craft-keymap", "other");
+    assert_eq!(p.import(&wrong, &builtins), Err(ProfileError::WrongFormat));
+    let newer = exported.replace("\"version\": 1", "\"version\": 2");
+    assert_eq!(p.import(&newer, &builtins), Err(ProfileError::NewerVersion(2)));
+
+    let text = serde_json::to_string(&p).unwrap();
+    assert_eq!(serde_json::from_str::<Profiles>(&text).unwrap(), p);
+    let junk: Profiles = serde_json::from_str(r#"{"active": 5, "sets": {"": {}, "ok": {"a": ["A"]}, "bad": 3}}"#).unwrap();
+    assert_eq!(junk.sets().keys().collect::<Vec<_>>(), ["ok"]);
+    let junk: Profiles =
+        serde_json::from_str(r#"{"sets": [{"name": "ok", "overrides": [{"command": "a", "keys": ["A"]}, 4]}, {"name": ""}, 7]}"#).unwrap();
+    assert_eq!(junk.sets()["ok"].get("a"), Some(&["A".to_string()][..]));
+    assert!(text.contains(r#""overrides":[{"command":"edit.copy","keys":[]}]"#), "{text}");
+}
+
+#[test]
+fn rename_keeps_a_set_whose_name_differs_only_in_case() {
+    let builtins = [("Craft", Overrides::new())];
+    let mut p: Profiles = serde_json::from_str(r#"{"sets": {"Mine": {"a": "A"}, "mine": {"b": "B"}}}"#).unwrap();
+    assert_eq!(p.rename("Mine", "mine", &builtins), Err(ProfileError::NameTaken));
+    assert_eq!(p.sets()["mine"].get("b"), Some(&["B".to_string()][..]));
+    assert_eq!(p.rename("Mine", "MINE", &builtins), Err(ProfileError::NameTaken));
+    p.delete("mine", &builtins).unwrap();
+    assert_eq!(p.rename("Mine", "MINE", &builtins), Ok("MINE".into()));
+}
+
+#[test]
+fn sets_that_are_not_a_list_or_map_load_as_none() {
+    for text in [r#"{"active": "Mine", "sets": 5}"#, r#"{"active": "Mine", "sets": null}"#, r#"{"active": "Mine", "sets": "x"}"#] {
+        let p: Profiles = serde_json::from_str(text).unwrap_or_else(|e| panic!("{text}: {e}"));
+        assert!(p.sets().is_empty(), "{text}");
+        assert_eq!(p.active(), "Mine", "{text}");
+    }
+}
+
+#[test]
+fn a_user_set_named_like_a_new_built_in_keeps_its_edits() {
+    let mut mine = Overrides::new();
+    mine.insert("edit.copy", vec!["Cmd+K".into()]);
+    let mut p = Profiles::default();
+    p.save_as("Classic", mine.clone(), &[("Craft", Overrides::new())]).unwrap();
+
+    // An update adds a built-in of that name.
+    let mut classic = Overrides::new();
+    classic.insert("edit.copy", vec!["Cmd+Shift+C".into()]);
+    let builtins = [("Craft", Overrides::new()), ("Classic", classic.clone())];
+    assert_eq!(p.active_overrides(&builtins), &mine, "the user set is what the name reads");
+
+    let mut edited = mine.clone();
+    edited.insert("edit.paste", vec![]);
+    assert_eq!(p.store(edited.clone(), &builtins, "Custom"), Ok(Some("Classic 2".into())));
+    assert_eq!(p.active_name(&builtins), "Classic 2");
+    assert_eq!(p.active_overrides(&builtins), &edited);
+    assert_eq!(p.get("Classic", &builtins), Some(&classic));
+    assert_eq!(builtins[1].1, classic);
+
+    let mut q: Profiles =
+        serde_json::from_value(json!({"active": "CRAFT", "sets": [{"name": "CRAFT", "overrides": {"edit.copy": "Cmd+K"}}]})).unwrap();
+    assert!(q.reconcile(&builtins));
+    assert_eq!(q.active_name(&builtins), "CRAFT 2");
+    assert_eq!(q.active_overrides(&builtins), &mine);
+    assert!(!q.reconcile(&builtins));
+}
+
+#[test]
+fn an_exported_set_imports_as_a_new_set_with_the_same_keymap() {
+    let mut km = keymap();
+    km.assign(&"file.save".into(), b("Cmd+Alt+S"), Policy::Steal).unwrap();
+    km.assign(&CommandRef::with_params("window.panel", json!({"panel": "layers"})), b("Timeline: Cmd+L"), Policy::Steal).unwrap();
+    km.clear(&"edit.copy".into());
+    let builtins = [("Craft", Overrides::new())];
+    let mut p = Profiles::default();
+    p.save_as("Mine", km.overrides().clone(), &builtins).unwrap();
+
+    let text = p.export("Mine", &builtins).unwrap();
+    assert_eq!(p.import(&text, &builtins), Ok("Mine 2".into()));
+    assert_eq!(p.active(), "Mine 2");
+
+    let mut again = keymap();
+    again.set_overrides(p.active_overrides(&builtins).clone());
+    for bindable in km.catalog() {
+        assert_eq!(again.bindings(&bindable.command), km.bindings(&bindable.command), "{}", bindable.command.key());
+    }
+    assert_eq!(again.overrides(), km.overrides());
+}
+
+#[test]
+fn duplicate_copies_built_in_and_user_sets() {
+    let mut classic = Overrides::new();
+    classic.insert("edit.copy", vec!["Cmd+Shift+C".into()]);
+    let builtins = [("Craft", Overrides::new()), ("Classic", classic.clone())];
+    let mut p = Profiles::default();
+
+    assert_eq!(p.duplicate("Classic", "Classic", &builtins), Ok("Classic 2".into()));
+    assert_eq!(p.active(), "Classic 2");
+    assert_eq!(p.active_overrides(&builtins), &classic);
+    assert_eq!(p.duplicate("Classic 2", " Mine ", &builtins), Ok("Mine".into()));
+    assert_eq!(p.duplicate("Mine", "mine", &builtins), Ok("mine 2".into()), "names compare without case");
+    assert_eq!(p.duplicate("Nope", "X", &builtins), Err(ProfileError::NotFound));
+    assert_eq!(p.duplicate("Craft", "", &builtins), Err(ProfileError::BadName));
+
+    while p.sets().len() < MAX_SETS {
+        p.duplicate("Craft", "Spare", &builtins).unwrap();
+    }
+    assert_eq!(p.duplicate("Craft", "Spare", &builtins), Err(ProfileError::TooMany));
+}
+
+#[test]
+fn a_foreign_set_imports_as_a_new_set_and_leaves_the_keymap_alone() {
+    let km = keymap();
+    let read = |text: &str| ForeignKey::read(Some("Default"), text, Flavor::Mac);
+    let set = ForeignSet::new(vec![ForeignEntry::new(Some("File"), ["Save"]).with_key(read("Cmd+Shift+S"))]).with_name("Other App");
+    let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], start: Start::Defaults, ..ImportOptions::default() };
+    let planned = plan(&set, &km, &options);
+    let builtins = [("Craft", Overrides::new())];
+    let mut p = Profiles::default();
+
+    let (name, report) = p.import_plan(&planned, &km, None, &builtins).unwrap();
+    assert_eq!(name, "Other App");
+    assert_eq!(report.changed.len(), 1);
+    assert!(km.overrides().is_empty());
+    assert_eq!(p.active(), "Other App");
+    let mut imported = keymap();
+    imported.set_overrides(p.active_overrides(&builtins).clone());
+    assert_eq!(imported.bindings(&"file.save".into()), [b("Cmd+Shift+S")]);
+
+    let (name, _) = p.import_plan(&planned, &km, Some("Craft"), &builtins).unwrap();
+    assert_eq!(name, "Craft 2", "a built-in's name is not reused");
+}
+
+#[test]
+fn loading_lists_the_sets_it_drops_and_the_store_has_a_version() {
+    let text = r#"{"version": 2, "active": "ok", "sets": [
+        {"name": "ok", "overrides": {}}, {"name": " pad ", "overrides": {}}, {"name": "ok", "overrides": {"a": "A"}}, {"name": "bad", "overrides": 3}
+    ]}"#;
+    let p: Profiles = serde_json::from_str(text).unwrap();
+    assert_eq!(p.sets().keys().collect::<Vec<_>>(), ["ok"]);
+    assert!(p.sets()["ok"].is_empty(), "the first of two sets with one name stays");
+    let name = |n: &str| n.to_string();
+    assert_eq!(
+        p.problems(),
+        [
+            SetProblem::NewerVersion(2),
+            SetProblem::BadName { name: name(" pad ") },
+            SetProblem::Duplicate { name: name("ok") },
+            SetProblem::BadOverrides { name: name("bad") }
+        ]
+    );
+
+    let many: Vec<_> = (0..MAX_SETS + 3).map(|i| json!({"name": format!("s{i}"), "overrides": {}})).collect();
+    let p: Profiles = serde_json::from_value(json!({ "sets": many })).unwrap();
+    assert_eq!((p.sets().len(), p.problems()), (MAX_SETS, &[SetProblem::TooMany { ignored: 3 }][..]));
+
+    assert_eq!(serde_json::to_value(&p).unwrap()["version"], 1);
+    let unversioned: Profiles = serde_json::from_str(r#"{"active": "x", "sets": []}"#).unwrap();
+    assert!(unversioned.problems().is_empty());
+}
diff --git a/crates/keymap/tests/settings.rs b/crates/keymap/tests/settings.rs
new file mode 100644
index 00000000..2361693e
--- /dev/null
+++ b/crates/keymap/tests/settings.rs
@@ -0,0 +1,146 @@
+use std::time::Duration;
+
+use craft_keymap::{Bindable, Binding, CommandRef, DropReason, Keymap, Overrides, Platform, Policy, Problem, Profiles, Scope, Scopes};
+use craft_settings::{Location, OpenOptions, Probe, Settings, SettingsStore};
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+
+#[derive(Serialize, Deserialize, Default, Clone, PartialEq, Debug)]
+#[serde(default)]
+struct Prefs {
+    general: General,
+    #[serde(with = "craft_keymap::keymap::overrides_list")]
+    shortcuts: Overrides,
+    profiles: Profiles,
+}
+
+#[derive(Serialize, Deserialize, Default, Clone, PartialEq, Debug)]
+#[serde(default)]
+struct General {
+    language: String,
+}
+
+impl Settings for Prefs {
+    const APP_ID: &'static str = "keymaptest";
+    const SCHEMA_VERSION: u32 = 1;
+}
+
+fn open(dir: &std::path::Path) -> SettingsStore<Prefs> {
+    let probe = Probe { env: Box::new(|_| None), exe_dir: None, platform_config_dir: None };
+    let options = OpenOptions::new(Location::Dir(dir.to_path_buf())).probe(probe).debounce(Duration::from_millis(10));
+    let (store, report) = SettingsStore::open_with(options);
+    assert!(report.section_errors.is_empty(), "{report:?}");
+    store
+}
+
+fn keymap(overrides: Overrides) -> Keymap {
+    let catalog = vec![
+        Bindable::new(CommandRef::with_params("window.panel", json!({"panel": "layers"})), "Layers", Scope::app()),
+        Bindable::new("text.bold", "Bold", Scope::app()),
+        Bindable::new("edit.copy", "Copy", Scope::app()).with_default(Binding::parse("Cmd+C").unwrap()),
+        Bindable::new("edit.paste", "Paste", Scope::app()).with_default(Binding::parse("Cmd+V").unwrap()),
+    ];
+    Keymap::new(catalog, Scopes::new().with_context("Text"), Platform::Mac).with_overrides(overrides)
+}
+
+#[test]
+fn overrides_round_trip_through_craft_settings() {
+    let tmp = tempfile::tempdir().unwrap();
+    let mut km = keymap(Overrides::new());
+    let layers = CommandRef::with_params("window.panel", json!({"panel": "layers"}));
+    km.assign(&layers, Binding::parse("Cmd+Shift+L").unwrap(), Policy::Steal).unwrap();
+    km.assign(&"text.bold".into(), Binding::parse("Text: Cmd+B").unwrap(), Policy::Steal).unwrap();
+    km.clear(&"edit.copy".into());
+
+    let mut store = open(tmp.path());
+    store.update(|p| {
+        p.shortcuts = km.overrides().clone();
+        p.profiles.save_as("Mine", km.overrides().clone(), &[]).unwrap();
+        p.profiles.save_as("Spare", Overrides::new(), &[]).unwrap();
+    });
+    store.flush().unwrap();
+
+    // A hand edit: one text that does not parse, one value that is not a list.
+    let path = tmp.path().join("config.toml");
+    let text = std::fs::read_to_string(&path).unwrap();
+    let edit = r#"shortcuts = [{ command = "edit.paste", keys = ["Cmd+Nope"] }, { command = "edit.cut", keys = 5 }, "#;
+    assert!(text.contains("shortcuts = ["), "{text}");
+    std::fs::write(&path, text.replacen("shortcuts = [", edit, 1)).unwrap();
+
+    let mut store = open(tmp.path());
+    let mut km = keymap(store.get().shortcuts.clone());
+    assert_eq!(km.bindings(&layers), vec![Binding::parse("Cmd+Shift+L").unwrap()]);
+    assert_eq!(km.bindings(&"text.bold".into()), vec![Binding::parse("Text: Cmd+B").unwrap()]);
+    assert!(km.bindings(&"edit.copy".into()).is_empty());
+    assert_eq!(km.bindings(&"edit.paste".into()), vec![Binding::parse("Cmd+V").unwrap()], "nothing readable: the defaults");
+    assert_eq!(km.overrides().get("edit.paste"), Some(&["Cmd+Nope".to_string()][..]));
+    let problems = km.problems();
+    assert!(problems.contains(&Problem::Dropped { key: "edit.cut".into(), reason: DropReason::NotAList }), "{problems:?}");
+    assert!(problems.iter().any(|p| matches!(p, Problem::BadBinding { text, .. } if text == "Cmd+Nope")), "{problems:?}");
+    assert_eq!(store.get().profiles.sets().len(), 2);
+
+    store.update(|p| p.general.language = "de".into());
+    store.flush().unwrap();
+    let text = std::fs::read_to_string(&path).unwrap();
+    assert!(text.contains("keys = [\"Cmd+Nope\"]"), "{text}");
+    assert!(
+        text.contains(r#"command = "window.panel {\"panel\":\"layers\"}""#) || text.contains(r#"command = 'window.panel {"panel":"layers"}'"#),
+        "{text}"
+    );
+    assert_eq!(open(tmp.path()).get().shortcuts, store.get().shortcuts);
+
+    // Removals reach the file.
+    km.reset(&layers);
+    store.update(|p| {
+        p.shortcuts = km.overrides().clone();
+        p.profiles.delete("Spare", &[]).unwrap();
+    });
+    store.flush().unwrap();
+    let text = std::fs::read_to_string(&path).unwrap();
+    let line = text.lines().find(|l| l.starts_with("shortcuts = ")).unwrap();
+    assert!(!line.contains("window.panel") && !text.contains("Spare"), "{text}");
+    let reloaded = open(tmp.path());
+    assert!(keymap(reloaded.get().shortcuts.clone()).bindings(&layers).is_empty());
+    assert_eq!(reloaded.get().profiles.sets().keys().collect::<Vec<_>>(), ["Mine"]);
+    assert_eq!(reloaded.get().profiles.sets()["Mine"].get("text.bold"), Some(&["Text: Cmd+B".to_string()][..]));
+}
+
+#[test]
+fn hand_written_array_of_tables_and_map_forms_load() {
+    for text in [
+        "schema_version = 1\n\n[[shortcuts]]\ncommand = \"edit.copy\"\nkeys = [\"Cmd+K\"]\n\n[[shortcuts]]\ncommand = \"edit.paste\"\nkeys = []\n",
+        "schema_version = 1\n\n[shortcuts]\n\"edit.copy\" = [\"Cmd+K\"]\n\"edit.paste\" = []\n",
+    ] {
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::write(tmp.path().join("config.toml"), text).unwrap();
+        let km = keymap(open(tmp.path()).get().shortcuts.clone());
+        assert_eq!(km.bindings(&"edit.copy".into()), vec![Binding::parse("Cmd+K").unwrap()], "{text}");
+        assert!(km.bindings(&"edit.paste".into()).is_empty(), "{text}");
+    }
+}
+
+#[test]
+fn a_shortcuts_value_that_is_not_a_list_loads_as_no_overrides() {
+    for value in ["\"x\"", "5", "true"] {
+        let tmp = tempfile::tempdir().unwrap();
+        let text = format!("schema_version = 1\nshortcuts = {value}\n\n[general]\nlanguage = \"de\"\n");
+        std::fs::write(tmp.path().join("config.toml"), text).unwrap();
+        let store = open(tmp.path());
+        assert!(store.get().shortcuts.is_empty(), "{value}");
+        assert_eq!(store.get().general.language, "de", "{value}");
+        let problems = keymap(store.get().shortcuts.clone()).problems();
+        assert_eq!(problems, vec![Problem::Dropped { key: String::new(), reason: DropReason::NotAList }], "{value}");
+    }
+}
+
+#[test]
+fn a_sets_value_that_is_not_a_list_keeps_the_rest_of_the_profiles() {
+    for value in ["\"x\"", "5", "true"] {
+        let tmp = tempfile::tempdir().unwrap();
+        let text = format!("schema_version = 1\n\n[profiles]\nactive = \"Mine\"\nsets = {value}\n");
+        std::fs::write(tmp.path().join("config.toml"), text).unwrap();
+        let store = open(tmp.path());
+        assert_eq!(store.get().profiles.active(), "Mine", "{value}");
+        assert!(store.get().profiles.sets().is_empty(), "{value}");
+    }
+}
diff --git a/crates/keymap/tests/support/fonts.rs b/crates/keymap/tests/support/fonts.rs
new file mode 100644
index 00000000..a6845650
--- /dev/null
+++ b/crates/keymap/tests/support/fonts.rs
@@ -0,0 +1,68 @@
+//! Deterministic app-supplied fonts for dialog tests, including their first layout pass.
+
+use std::path::PathBuf;
+use std::sync::{Arc, OnceLock};
+
+use egui::{FontData, FontDefinitions, FontId};
+use sha2::{Digest, Sha256};
+
+// Assets from craft-fonts b076417b5880bd4154bd22f00695b1d28c6bea83. Keep the
+// input outside this repository; do not fall back to machine-installed fonts.
+const INPUTS: [(&str, &str, &str); 2] = [
+    ("keymap-symbols", "fonts/noto-sans-symbols/NotoSansSymbols.ttf", "f7e7e04b4a24b6c78893d50cbfd2b2f6cae49617ab047bfef668d252adb128f7"),
+    (
+        "keymap-symbols-2",
+        "fonts/noto-sans-symbols-2/NotoSansSymbols2-Regular.ttf",
+        "7d5fb73b7ca67a6798101741f5d280a3d016a56a197afcd4199dbb57b4b82a21",
+    ),
+];
+
+/// Load the pinned craft-fonts inputs once for all dialog tests.
+///
+/// Requires an absolute `CRAFT_FONTS_DIR`, verifies the SHA-256 of both symbol faces, refuses any
+/// installed-font fallback, and appends the two pinned faces plus egui's Hack to every family.
+fn definitions() -> FontDefinitions {
+    static FONTS: OnceLock<FontDefinitions> = OnceLock::new();
+    FONTS
+        .get_or_init(|| {
+            let root = PathBuf::from(std::env::var_os("CRAFT_FONTS_DIR").unwrap_or_else(|| {
+                panic!("UI tests require absolute CRAFT_FONTS_DIR at craft-fonts b076417b5880bd4154bd22f00695b1d28c6bea83; see README.md")
+            }));
+            assert!(root.is_absolute(), "CRAFT_FONTS_DIR must be absolute: {}", root.display());
+            let mut fonts = FontDefinitions::default();
+            assert!(fonts.font_data.contains_key("Hack"), "UI tests require egui default_fonts");
+            for (name, relative, expected) in INPUTS {
+                let path = root.join(relative);
+                let bytes = std::fs::read(&path).unwrap_or_else(|e| panic!("required font {}: {e}", path.display()));
+                assert_eq!(format!("{:x}", Sha256::digest(&bytes)), expected, "unreviewed font input: {}", path.display());
+                fonts.font_data.insert(name.into(), Arc::new(FontData::from_owned(bytes)));
+            }
+            for family in fonts.families.values_mut() {
+                for name in ["keymap-symbols", "keymap-symbols-2", "Hack"] {
+                    if !family.iter().any(|existing| existing == name) {
+                        family.push(name.into());
+                    }
+                }
+            }
+            fonts
+        })
+        .clone()
+}
+
+/// Install the deterministic fonts on `ctx` before its first layout pass.
+pub fn configure(ctx: &egui::Context) {
+    ctx.set_fonts(definitions());
+}
+
+/// All printable ASCII plus the key symbols, dialog icons and accented pseudolocale
+/// repertoire. Direction marks are intentionally invisible, rather than drawn glyphs.
+pub fn assert_coverage(ctx: &egui::Context) {
+    const SYMBOLS: &str = "×·—“”…‹›←↑→↓↩↺⇥⇧⌃⌘⌥⌦⌫⎋⏎⌨▾⚠✕⟦⟧ÅÉØáëïöüÜ";
+    ctx.fonts_mut(|fonts| {
+        for font in [FontId::proportional(16.0), FontId::monospace(16.0)] {
+            for c in (' '..='~').chain(SYMBOLS.chars()) {
+                assert!(fonts.has_glyph(&font, c), "test font {:?} lacks {c} (U+{:04X})", font.family, u32::from(c));
+            }
+        }
+    });
+}
diff --git a/crates/keymap/tests/ui_dialog.rs b/crates/keymap/tests/ui_dialog.rs
new file mode 100644
index 00000000..1187b613
--- /dev/null
+++ b/crates/keymap/tests/ui_dialog.rs
@@ -0,0 +1,1049 @@
+#![cfg(feature = "ui")]
+//! The Keyboard Shortcuts dialog driven through egui_kittest: recording, conflicts, search, areas,
+//! platform display, accessibility labels, small windows, sets, import review and the summary.
+
+use std::borrow::Cow;
+
+use craft_keymap::ui::{ConflictMode, DialogState, English, FixedRow, Options, Outcome, ShortcutsDialog, Text};
+use craft_keymap::{
+    Active, Bindable, Binding, Chord, CommandRef, ConflictKind, ContextRule, Flavor, ForeignEntry, ForeignKey, ForeignSet, ImportOptions, Keymap,
+    Kind, Lookup, Overrides, Platform, Profiles, Scope, Scopes, Trigger,
+};
+use egui::accesskit::Role;
+use egui::{Event, Key as EguiKey, Modifiers, Vec2, vec2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use ui_fixture::{Pseudo, fixture, with_long_label};
+
+#[path = "support/fonts.rs"]
+mod test_fonts;
+mod ui_fixture;
+
+struct Fx {
+    km: Keymap,
+    options: Options,
+    state: DialogState,
+    text: Box<dyn Text>,
+    window: bool,
+    /// Profiles and built-in sets, when the dialog shows sets.
+    sets: Option<(Profiles, Vec<(&'static str, Overrides)>)>,
+    outcomes: Vec<Outcome>,
+    /// A key press was still in the frame's input after the dialog ran.
+    keys_left: bool,
+}
+
+/// The dialog of `fx` for a call outside the frame (import_json, review_import).
+fn dialog(fx: &mut Fx) -> (ShortcutsDialog<'_>, &mut DialogState) {
+    let Fx { km, options, state, text, sets, .. } = fx;
+    let d = ShortcutsDialog::new(km, &**text).options(options);
+    let d = match sets {
+        Some((p, b)) => d.sets(p, b),
+        None => d,
+    };
+    (d, state)
+}
+
+impl Fx {
+    fn new(km: Keymap) -> Fx {
+        Fx {
+            km,
+            options: Options::default(),
+            state: DialogState::new(),
+            text: Box::new(English),
+            window: false,
+            sets: None,
+            outcomes: Vec::new(),
+            keys_left: false,
+        }
+    }
+
+    fn bindings(&self, id: &str) -> Vec<String> {
+        self.km.bindings(&CommandRef::from(id)).iter().map(|b| b.to_string()).collect()
+    }
+
+    /// Whether any outcome recorded by the dialog harness is `Outcome::Cancel`.
+    fn canceled(&self) -> bool {
+        self.outcomes.iter().any(|o| matches!(o, Outcome::Cancel))
+    }
+}
+
+/// Build an egui_kittest harness around `Fx`.
+///
+/// Installs and checks the pinned fonts every frame, selects window or inline dialog mode, records
+/// emitted outcomes, and flags any key press still present after the dialog ran.
+fn harness(fx: Fx, size: Vec2) -> Harness<'static, Fx> {
+    let mut h = Harness::builder().with_size(size).with_context_setup(test_fonts::configure).build_ui_state(
+        |ui, fx: &mut Fx| {
+            test_fonts::assert_coverage(ui.ctx());
+            let Fx { km, options, state, text, window, sets, outcomes, keys_left } = fx;
+            let dialog = ShortcutsDialog::new(km, text.as_ref()).options(options);
+            let dialog = match sets {
+                Some((p, b)) => dialog.sets(p, b),
+                None => dialog,
+            };
+            let out = if *window { dialog.show(ui.ctx(), state) } else { dialog.ui(ui, state) };
+            outcomes.extend(out);
+            *keys_left |= ui.input(|i| i.events.iter().any(|e| matches!(e, Event::Key { pressed: true, .. })));
+        },
+        fx,
+    );
+    h.run();
+    h
+}
+
+fn open(fx: Fx) -> Harness<'static, Fx> {
+    harness(fx, vec2(1000.0, 700.0))
+}
+
+fn mac() -> Harness<'static, Fx> {
+    open(Fx::new(fixture(Platform::Mac)))
+}
+
+fn click(h: &mut Harness<'_, Fx>, label: &str) {
+    h.get_by_label(label).click();
+    h.run();
+}
+
+fn press(h: &mut Harness<'_, Fx>, modifiers: Modifiers, key: EguiKey) {
+    h.key_press_modifiers(modifiers, key);
+    h.run();
+}
+
+fn raw_key(h: &mut Harness<'_, Fx>, key: EguiKey, time: f64) {
+    h.input_mut().time = Some(time);
+    h.event(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    h.step();
+    h.input_mut().time = Some(time + 0.01);
+    h.event(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
+    h.step();
+}
+
+fn has(h: &Harness<'_, Fx>, label: &str) -> bool {
+    h.query_by_label(label).is_some()
+}
+
+/// The table itself has focus (a screen reader sees its selected row, the active descendant).
+fn table_focused(h: &Harness<'_, Fx>) -> bool {
+    h.get_by_label("Commands").accesskit_node().is_focused_in_tree()
+}
+
+fn chord(text: &str, platform: Platform) -> String {
+    Trigger::parse(text).unwrap_or_else(|e| panic!("{text}: {e}")).display(platform)
+}
+
+// ---- Recording ----
+
+#[test]
+fn recording_captures_a_chord_another_command_would_run() {
+    let mut h = mac();
+    click(&mut h, "Save: ⌘S");
+    assert!(has(&h, "Save: press keys"));
+    h.state_mut().keys_left = false;
+    press(&mut h, Modifiers::COMMAND, EguiKey::E);
+    assert!(!h.state().keys_left, "the dialog took the key press");
+    assert!(has(&h, "⚠ ⌘E is used by Export…"));
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S"], "nothing applied before an answer");
+}
+
+#[test]
+fn recording_takes_tab_arrows_and_shift_escape() {
+    let mut h = mac();
+    click(&mut h, "Save: ⌘S");
+    press(&mut h, Modifiers::NONE, EguiKey::Tab);
+    assert_eq!(h.state().bindings("file.save"), ["Tab"]);
+    assert!(table_focused(&h), "Tab did not move focus");
+
+    click(&mut h, &format!("Save: {}", chord("Tab", Platform::Mac)));
+    press(&mut h, Modifiers::NONE, EguiKey::ArrowDown);
+    assert_eq!(h.state().bindings("file.save"), ["Down"]);
+
+    click(&mut h, &format!("Save: {}", chord("Down", Platform::Mac)));
+    press(&mut h, Modifiers::SHIFT, EguiKey::Escape);
+    assert_eq!(h.state().bindings("file.save"), ["Shift+Escape"]);
+    assert!(table_focused(&h));
+    assert!(h.state().state.is_open());
+}
+
+#[test]
+fn escape_cancels_recording_only() {
+    let mut h = mac();
+    click(&mut h, "Save: ⌘S");
+    press(&mut h, Modifiers::NONE, EguiKey::Escape);
+    assert!(h.state().state.is_open());
+    assert!(!h.state().state.is_recording());
+    assert!(!h.state().canceled());
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S"]);
+    press(&mut h, Modifiers::NONE, EguiKey::Escape);
+    assert!(h.state().canceled());
+    assert!(!h.state().state.is_open());
+}
+
+#[test]
+fn copy_event_records_cmd_c() {
+    let mut h = mac();
+    click(&mut h, "Save: ⌘S");
+    h.event(Event::Copy);
+    h.run();
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+C"]);
+}
+
+#[test]
+fn double_press_records_k_k() {
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.options.double_press = true;
+    let mut h = open(fx);
+    click(&mut h, "Save: ⌘S");
+    raw_key(&mut h, EguiKey::K, 10.0);
+    assert!(has(&h, "Save: K (press again for a double press)"));
+    raw_key(&mut h, EguiKey::K, 10.3);
+    assert_eq!(h.state().bindings("file.save"), ["K K"]);
+
+    click(&mut h, "Save: K K");
+    raw_key(&mut h, EguiKey::K, 20.0);
+    raw_key(&mut h, EguiKey::K, 20.9);
+    assert_eq!(h.state().bindings("file.save"), ["K"]);
+}
+
+#[test]
+fn the_new_shortcut_field_waits_for_assign() {
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.options.conflicts = ConflictMode::Keep;
+    let mut h = open(fx);
+    h.get_by_label("Save").click();
+    h.run();
+    click(&mut h, "New shortcut: None");
+    press(&mut h, Modifiers::COMMAND, EguiKey::E);
+    assert!(has(&h, "Currently assigned to:"));
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S"]);
+    click(&mut h, "Assign");
+    assert!(has(&h, "Also used by Export…"), "Keep mode keeps both");
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S", "Cmd+E"]);
+    assert_eq!(h.state().bindings("file.export"), ["Cmd+E"]);
+}
+
+/// Presses Tab until the control labeled `label` has focus; false after `max` presses.
+fn tab_to(h: &mut Harness<'_, Fx>, label: &str, max: usize) -> bool {
+    for _ in 0..max {
+        press(h, Modifiers::NONE, EguiKey::Tab);
+        if h.get_by_label(label).is_focused() {
+            return true;
+        }
+    }
+    false
+}
+
+#[test]
+fn tab_leaves_the_new_shortcut_field_after_recording() {
+    let mut h = mac();
+    h.get_by_label("Save").click();
+    h.run();
+    click(&mut h, "New shortcut: None");
+    press(&mut h, Modifiers::NONE, EguiKey::F7);
+    assert!(!h.state().state.is_recording());
+    assert!(h.get_by_label("New shortcut: F7").is_focused());
+    assert!(tab_to(&mut h, "Assign", 6), "Tab moves on to Assign");
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S"], "Tab is not recorded");
+}
+
+#[test]
+fn tab_leaves_search_by_key_after_recording() {
+    let mut h = mac();
+    click(&mut h, "Search by key");
+    press(&mut h, Modifiers::COMMAND, EguiKey::S);
+    assert!(!h.state().state.is_recording());
+    assert!(h.get_by_label("Search by key").is_focused());
+    press(&mut h, Modifiers::NONE, EguiKey::Tab);
+    assert!(table_focused(&h), "Tab moves on to the table");
+}
+
+// ---- Conflicts ----
+
+#[test]
+fn conflict_take_it_steals_and_undo_restores() {
+    let mut h = mac();
+    click(&mut h, "Export…: ⌘E");
+    press(&mut h, Modifiers::COMMAND, EguiKey::S);
+    click(&mut h, "Take It");
+    assert_eq!(h.state().bindings("file.save"), Vec::<String>::new());
+    assert_eq!(h.state().bindings("file.export"), ["Cmd+S"]);
+    assert!(has(&h, "⌘S was removed from Save"));
+
+    // The footer's Undo is after the message's.
+    let undo = h.get_all_by_label("Undo").last().map(|n| n.rect());
+    let Some(undo) = undo else { panic!("no Undo") };
+    h.get_all_by_label("Undo").filter(|n| n.rect() == undo).for_each(|n| n.click());
+    h.run();
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S"]);
+    assert_eq!(h.state().bindings("file.export"), ["Cmd+E"]);
+    click(&mut h, "Redo");
+    assert_eq!(h.state().bindings("file.export"), ["Cmd+S"]);
+    press(&mut h, Modifiers::COMMAND, EguiKey::Z);
+    assert_eq!(h.state().bindings("file.export"), ["Cmd+E"], "Cmd+Z undoes when no text field has focus");
+}
+
+#[test]
+fn conflict_keep_both_lists_the_clash() {
+    let mut h = mac();
+    click(&mut h, "Export…: ⌘E");
+    press(&mut h, Modifiers::COMMAND, EguiKey::S);
+    click(&mut h, "Keep Both");
+    let clashes = h.state().km.conflicts().into_iter().filter(|c| c.kind == ConflictKind::Clash).count();
+    assert_eq!(clashes, 1);
+    assert!(has(&h, "Also used by Save"));
+    click(&mut h, "⚠ 1 shortcut is assigned more than once");
+    assert!(has(&h, "Save: ⌘S"));
+    assert!(has(&h, "Export…: ⌘S"));
+    assert!(!has(&h, "Save As…: ⇧⌘S"), "the Conflicts filter shows only the clash");
+}
+
+#[test]
+fn assign_takes_a_held_shortcut_and_keeps_the_others() {
+    let key = |text: &str| Binding::parse(text).unwrap_or_else(|e| panic!("{e}"));
+    let catalog = vec![
+        Bindable::new("file.print", "Print…", Scope::app()).with_default(key("Cmd+P")),
+        Bindable::new("type.paragraphStyles", "Paragraph Styles", Scope::app()).with_default(key("Cmd+F11")),
+    ];
+    let mut h = open(Fx::new(Keymap::new(catalog, Scopes::new(), Platform::Mac)));
+    h.get_by_label("Paragraph Styles").click();
+    h.run();
+    click(&mut h, "New shortcut: None");
+    press(&mut h, Modifiers::COMMAND, EguiKey::P);
+    assert!(has(&h, "Currently assigned to:"));
+    assert!(has(&h, "⚠ Print…"), "the holder is listed under the field");
+    click(&mut h, "Assign");
+    assert!(has(&h, "⌘P was removed from Print…"));
+    click(&mut h, "OK");
+    assert!(h.state().outcomes.iter().any(|o| matches!(o, Outcome::Ok)));
+
+    let km = &h.state().km;
+    let run = |text: &str| km.lookup(&Chord::parse(text).unwrap_or_else(|e| panic!("{e}")), false, &Active::NONE);
+    assert_eq!(run("Cmd+P"), Lookup::Run("type.paragraphStyles".into()));
+    assert_eq!(run("Cmd+F11"), Lookup::Run("type.paragraphStyles".into()));
+    assert!(h.state().bindings("file.print").is_empty());
+}
+
+#[test]
+fn steal_mode_says_what_it_took() {
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.options.conflicts = ConflictMode::Steal;
+    let mut h = open(fx);
+    click(&mut h, "Export…: ⌘E");
+    press(&mut h, Modifiers::COMMAND, EguiKey::S);
+    assert!(has(&h, "⌘S was removed from Save"));
+    click(&mut h, "Go to Conflict");
+    assert!(selected(&h, "Save (Changed)"));
+}
+
+/// Whether a row with this label reports itself selected.
+fn selected(h: &Harness<'_, Fx>, label: &str) -> bool {
+    h.get_all_by_label(label).any(|n| n.accesskit_node().is_selected() == Some(true))
+}
+
+#[test]
+fn go_to_conflict_selects_and_reveals_the_holder() {
+    let mut h = mac();
+    choose_area(&mut h, "Tools");
+    search(&mut h, "marquee");
+    assert!(!has(&h, "Save: ⌘S"));
+    click(&mut h, "Marquee Tool: M");
+    press(&mut h, Modifiers::COMMAND, EguiKey::S);
+    click(&mut h, "Take It and Go to Conflict");
+    assert_eq!(h.state().bindings("tool.marquee"), ["Cmd+S"]);
+    assert!(selected(&h, "Save (Changed)"), "the holder is selected");
+    assert_eq!(h.get_by_label("Search:").value().unwrap_or_default(), "");
+    assert!(has(&h, "Export…: ⌘E"), "area All, no filter");
+}
+
+#[test]
+fn reserved_chord_is_refused() {
+    let km = fixture(Platform::Mac).with_reserved(vec![Chord::parse("Cmd+Tab").unwrap_or_else(|e| panic!("{e}"))]);
+    let mut h = open(Fx::new(km));
+    click(&mut h, "Save: ⌘S");
+    press(&mut h, Modifiers::COMMAND, EguiKey::Tab);
+    assert!(has(&h, &format!("⚠ {} is reserved by the system", chord("Cmd+Tab", Platform::Mac))));
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S"]);
+}
+
+#[test]
+fn app_rule_refuses() {
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.options.accept = Some(Box::new(|b, binding| {
+        if matches!(b.kind, Kind::Tool { .. }) && !binding.trigger.chord.mods.is_none() {
+            Err("Tools take keys without modifiers".into())
+        } else {
+            Ok(())
+        }
+    }));
+    let mut h = open(fx);
+    click(&mut h, "Marquee Tool: M");
+    press(&mut h, Modifiers::COMMAND, EguiKey::K);
+    assert!(has(&h, "⚠ Tools take keys without modifiers"));
+    assert_eq!(h.state().bindings("tool.marquee"), ["M"]);
+}
+
+// ---- Search, areas, display ----
+
+fn search(h: &mut Harness<'_, Fx>, text: &str) {
+    let field = h.get_by_label("Search:");
+    field.focus();
+    h.run();
+    h.key_press_modifiers(Modifiers::COMMAND, EguiKey::A);
+    h.run();
+    h.get_by_label("Search:").type_text(text);
+    h.run();
+}
+
+fn choose_area(h: &mut Harness<'_, Fx>, area: &str) {
+    h.get_by_role_and_label(Role::ComboBox, "Show:").click();
+    h.run();
+    // The popup's item, after a group header of the same name.
+    h.get_all_by_role_and_label(Role::Button, area).last().unwrap_or_else(|| panic!("{area}")).click();
+    h.run();
+}
+
+struct German;
+impl Text for German {
+    fn ui<'a>(&'a self, source: &'a str) -> Cow<'a, str> {
+        source.into()
+    }
+    fn plural(&self, n: u64, one: &str, other: &str) -> String {
+        if n == 1 { one } else { other }.replace("{n}", &n.to_string())
+    }
+    fn command<'a>(&'a self, b: &'a Bindable) -> Cow<'a, str> {
+        if b.command.id == "file.save" { "Sichern".into() } else { b.label.as_str().into() }
+    }
+}
+
+#[test]
+fn search_by_name_translation_or_chord() {
+    let mut h = mac();
+    search(&mut h, "save");
+    assert!(has(&h, "Save: ⌘S") && has(&h, "Save As…: ⇧⌘S"));
+    assert!(!has(&h, "Export…: ⌘E"));
+    search(&mut h, "cmd+s");
+    assert!(has(&h, "Save: ⌘S") && !has(&h, "Save As…: ⇧⌘S"));
+    search(&mut h, "⌘S");
+    assert!(has(&h, "Save: ⌘S") && !has(&h, "Save As…: ⇧⌘S"));
+    search(&mut h, "zzz");
+    assert!(has(&h, "No matching commands"));
+
+    click(&mut h, "Search by key");
+    press(&mut h, Modifiers::COMMAND | Modifiers::SHIFT, EguiKey::S);
+    assert_eq!(h.get_by_label("Search:").value().unwrap_or_default(), "⇧⌘S");
+    assert!(has(&h, "Save As…: ⇧⌘S") && !has(&h, "Save: ⌘S"));
+
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.text = Box::new(German);
+    let mut h = open(fx);
+    search(&mut h, "sichern");
+    assert!(has(&h, "Sichern: ⌘S") && !has(&h, "Save As…: ⇧⌘S"));
+}
+
+#[test]
+fn areas_follow_paths_kind_and_scope() {
+    let mut h = mac();
+    h.get_by_role_and_label(Role::ComboBox, "Show:").click();
+    h.run();
+    for area in ["All Commands", "File Menu", "Object Menu", "Tools", "Timeline Panel", "Other"] {
+        assert!(h.get_all_by_label(area).count() >= 1, "{area}");
+    }
+    h.get_all_by_role_and_label(Role::Button, "Tools").last().expect("the Tools item").click();
+    h.run();
+    assert!(has(&h, "Marquee Tool: M") && has(&h, "Elliptical Marquee Tool: M"));
+    assert!(!has(&h, "Save: ⌘S"));
+    choose_area(&mut h, "Timeline Panel");
+    assert!(has(&h, "Loop: L") && !has(&h, "Marquee Tool: M"));
+}
+
+#[test]
+fn display_follows_the_keymap_platform() {
+    let h = mac();
+    assert!(has(&h, "Save As…: ⇧⌘S"));
+    assert!(has(&h, "Bold: ⌘B (Text)"), "a scope other than home is named");
+    let h = open(Fx::new(fixture(Platform::Windows)));
+    assert!(has(&h, "Save As…: Ctrl+Shift+S"));
+}
+
+// ---- Labels, focus, small windows, RTL ----
+
+#[test]
+fn every_control_has_a_label() {
+    let mut h = mac();
+    h.get_by_label("Save").click();
+    h.run();
+    click(&mut h, "Export…: ⌘E");
+    press(&mut h, Modifiers::COMMAND, EguiKey::S);
+    assert!(has(&h, "Take It"));
+    let mut seen = 0;
+    for node in h.root().children_recursive() {
+        let n = node.accesskit_node();
+        if matches!(n.role(), Role::Button | Role::Tab | Role::TextInput | Role::ComboBox) {
+            seen += 1;
+            assert!(n.label().is_some_and(|l| !l.trim().is_empty()), "{:?} without a label at {:?}", n.role(), node.rect());
+        }
+    }
+    assert!(seen > 20, "{seen} controls");
+}
+
+#[test]
+fn table_keys_move_record_and_delete() {
+    let mut h = mac();
+    h.get_by_label("Save").click();
+    h.run();
+    assert!(table_focused(&h));
+    press(&mut h, Modifiers::NONE, EguiKey::ArrowDown);
+    assert!(selected(&h, "Save As…"));
+    press(&mut h, Modifiers::NONE, EguiKey::Delete);
+    assert_eq!(h.state().bindings("file.saveAs"), Vec::<String>::new());
+    press(&mut h, Modifiers::NONE, EguiKey::Enter);
+    assert!(h.state().state.is_recording());
+    press(&mut h, Modifiers::NONE, EguiKey::F7);
+    assert_eq!(h.state().bindings("file.saveAs"), ["F7"]);
+}
+
+#[test]
+fn group_headers_take_focus_and_toggle_with_enter() {
+    let mut h = mac();
+    h.get_by_label("Save").click();
+    h.run();
+    assert!(tab_to(&mut h, "File", 3));
+    press(&mut h, Modifiers::NONE, EguiKey::Enter);
+    assert!(!has(&h, "Export…: ⌘E"), "File is collapsed");
+    assert!(h.get_by_label("File").is_focused());
+    press(&mut h, Modifiers::NONE, EguiKey::Enter);
+    assert!(has(&h, "Export…: ⌘E"));
+}
+
+#[test]
+fn table_names_the_selected_row_and_messages_are_live() {
+    let mut h = mac();
+    h.get_by_label("Save").click();
+    h.run();
+    let row = h.get_by_role_and_label(Role::Button, "Save").accesskit_node().id();
+    assert_eq!(h.get_by_label("Commands").accesskit_node().active_descendant().map(|n| n.id()), Some(row));
+    click(&mut h, "Export…: ⌘E");
+    press(&mut h, Modifiers::COMMAND, EguiKey::S);
+    assert_eq!(h.get_by_label("⚠ ⌘S is used by Save").accesskit_node().live(), egui::accesskit::Live::Polite);
+}
+
+#[test]
+fn small_window_keeps_ok_and_long_labels_truncate() {
+    let long = "A very long command label ".repeat(12);
+    let mut km = fixture(Platform::Mac);
+    let mut catalog = km.catalog().to_vec();
+    catalog.insert(0, Bindable::new("file.long", long.trim(), Scope::app()).with_path(vec!["File".into(), long.trim().into()]));
+    km = Keymap::new(catalog, Scopes::new().with_panel("Timeline").with_context("Text"), Platform::Mac);
+    let mut fx = Fx::new(km);
+    fx.window = true;
+    let size = vec2(480.0, 360.0);
+    let mut h = harness(fx, size);
+    let screen = egui::Rect::from_min_size(egui::Pos2::ZERO, size);
+    let ok = h.get_by_label("OK").rect();
+    assert!(screen.contains_rect(ok), "OK at {ok:?}");
+    let row = h.get_by_label(long.trim());
+    assert!(row.rect().max.x <= size.x + 0.5, "the row stays inside: {:?}", row.rect());
+    row.hover();
+    h.run();
+    assert!(h.query_all_by_label_contains(long.trim()).count() >= 2, "the tooltip has the full label");
+    click(&mut h, "OK");
+    assert!(h.state().outcomes.iter().any(|o| matches!(o, Outcome::Ok)));
+}
+
+#[test]
+fn window_close_is_cancel() {
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.window = true;
+    let mut h = open(fx);
+    click(&mut h, "Save: ⌘S");
+    press(&mut h, Modifiers::NONE, EguiKey::F2);
+    assert_eq!(h.state().bindings("file.save"), ["F2"]);
+    click(&mut h, "Cancel");
+    assert!(h.state().canceled());
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S"]);
+    let after: Vec<bool> = h.state().outcomes.iter().skip_while(|o| !matches!(o, Outcome::Cancel)).map(|o| matches!(o, Outcome::Changed)).collect();
+    assert_eq!(after, [false, true], "Changed follows Cancel, which undid an edit");
+    assert!(!h.state().state.is_open());
+}
+
+#[test]
+fn automation_ids_are_reported() {
+    let seen = std::rc::Rc::new(std::cell::RefCell::new(Vec::<String>::new()));
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.options.keyboard = true;
+    let sink = seen.clone();
+    fx.options.on_widget = Some(Box::new(move |id, rect, label| {
+        assert!(rect.is_finite() && !label.is_empty(), "{id}");
+        sink.borrow_mut().push(id.to_string());
+    }));
+    let mut h = open(fx);
+    h.get_by_label("Save").click();
+    h.run();
+    let ids = seen.borrow();
+    for id in [
+        "shortcuts.area",
+        "shortcuts.filter",
+        "shortcuts.search",
+        "shortcuts.searchKey",
+        "shortcuts.row.file.save",
+        "shortcuts.cell.file.save.0",
+        "shortcuts.add.file.save",
+        "shortcuts.reset.file.save",
+        "shortcuts.remove.0",
+        "shortcuts.new",
+        "shortcuts.context",
+        "shortcuts.assign",
+        "shortcuts.clear",
+        "shortcuts.undo",
+        "shortcuts.redo",
+        "shortcuts.resetAll",
+        "shortcuts.cancel",
+        "shortcuts.ok",
+        "shortcuts.keyboard",
+        "shortcuts.mod.cmd",
+        "shortcuts.key.F7",
+    ] {
+        assert!(ids.iter().any(|s| s == id), "{id} not reported");
+    }
+}
+
+#[test]
+fn typed_entry_parses_and_shows_errors() {
+    let mut h = mac();
+    h.get_by_label("Save").click();
+    h.run();
+    click(&mut h, "Type…");
+    h.get_by_role_and_label(Role::TextInput, "New shortcut:").type_text("Cmd+Nope");
+    h.run();
+    press(&mut h, Modifiers::NONE, EguiKey::Enter);
+    assert!(has(&h, "⚠ unknown key Nope"));
+    h.get_by_role_and_label(Role::TextInput, "New shortcut:").focus();
+    h.run();
+    press(&mut h, Modifiers::COMMAND, EguiKey::A);
+    h.get_by_role_and_label(Role::TextInput, "New shortcut:").type_text("Cmd+Shift+K");
+    h.run();
+    press(&mut h, Modifiers::NONE, EguiKey::Enter);
+    assert!(!has(&h, "⚠ unknown key Nope"));
+    click(&mut h, "Assign");
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S", "Cmd+Shift+K"]);
+}
+
+struct Rtl;
+impl Text for Rtl {
+    fn ui<'a>(&'a self, source: &'a str) -> Cow<'a, str> {
+        source.into()
+    }
+    fn plural(&self, _n: u64, _one: &str, other: &str) -> String {
+        other.to_string()
+    }
+    fn rtl(&self) -> bool {
+        true
+    }
+}
+
+#[test]
+fn rtl_puts_the_detail_pane_left_and_keeps_chords() {
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.text = Box::new(Rtl);
+    let h = open(fx);
+    let table = h.get_by_label("Commands").rect();
+    assert!(table.min.x > 300.0, "table on the right: {table:?}");
+    let chip = h.get_by_label("Save As…: ⇧⌘S").rect();
+    assert!(chip.center().x < table.center().x, "shortcut column on the table's left: {chip:?} in {table:?}");
+}
+
+// ---- Sets ----
+
+fn with_sets(profiles: Profiles) -> Harness<'static, Fx> {
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.sets = Some((profiles, vec![("Fixture Defaults", Overrides::new())]));
+    open(fx)
+}
+
+fn profiles<'h>(h: &'h Harness<'_, Fx>) -> &'h Profiles {
+    &h.state().sets.as_ref().expect("sets").0
+}
+
+/// The last control with this label: a prompt's button rather than the set row's.
+fn click_last(h: &mut Harness<'_, Fx>, label: &str) {
+    h.get_all_by_label(label).last().unwrap_or_else(|| panic!("{label}")).click();
+    h.run();
+}
+
+fn new_set(h: &mut Harness<'_, Fx>, name: &str) {
+    click(h, "New Set…");
+    h.get_by_role_and_label(Role::TextInput, "Name:").type_text(name);
+    h.run();
+    click(h, "Create");
+}
+
+#[test]
+fn cancel_restores_keymap_and_sets() {
+    let mut p = Profiles::default();
+    p.save_as("Mine", Overrides::new(), &[("Fixture Defaults", Overrides::new())]).expect("save_as");
+    let before = p.clone();
+    let mut h = with_sets(p);
+    click(&mut h, "Set:");
+    click_last(&mut h, "Mine");
+    assert_eq!(profiles(&h).active(), "Mine");
+    click(&mut h, "Save: ⌘S");
+    press(&mut h, Modifiers::NONE, EguiKey::F2);
+    assert!(has(&h, "(modified)"));
+    new_set(&mut h, "Other");
+    assert_eq!(profiles(&h).active(), "Other");
+    assert_eq!(h.state().bindings("file.save"), ["F2"], "based on the current shortcuts");
+    click(&mut h, "Delete");
+    assert!(has(&h, "Delete the set “Other”?"));
+    click_last(&mut h, "Delete");
+    assert!(!profiles(&h).sets().contains_key("Other"));
+    click(&mut h, "Cancel");
+    assert!(h.state().canceled());
+    assert_eq!(profiles(&h), &before);
+    assert!(h.state().km.overrides().is_empty());
+}
+
+#[test]
+fn an_open_prompt_holds_the_set_row_table_and_edit_actions() {
+    let mut h = with_sets(Profiles::default());
+    click(&mut h, "Save: ⌘S");
+    press(&mut h, Modifiers::NONE, EguiKey::F2);
+    new_set(&mut h, "Other");
+    click(&mut h, "Delete");
+    assert!(has(&h, "Delete the set “Other”?"));
+    for label in ["Set:", "New Set…", "Save: F2", "Undo", "Reset All…", "OK"] {
+        assert!(h.get_by_label(label).accesskit_node().is_disabled(), "{label}");
+    }
+    assert!(h.get_all_by_label("Cancel").all(|n| !n.accesskit_node().is_disabled()), "the prompt's and the dialog's");
+    h.get_all_by_label("Cancel").next().expect("the prompt's Cancel").click();
+    h.run();
+    assert!(h.state().state.is_open());
+    assert!(!h.get_by_label("OK").accesskit_node().is_disabled());
+}
+
+#[test]
+fn ok_stores_edits_of_a_builtin_as_a_copy() {
+    let mut h = with_sets(Profiles::default());
+    assert!(h.get_by_label("Rename…").accesskit_node().is_disabled(), "built-ins cannot be renamed");
+    click(&mut h, "Save: ⌘S");
+    press(&mut h, Modifiers::NONE, EguiKey::F2);
+    click(&mut h, "OK");
+    assert!(h.state().outcomes.iter().any(|o| matches!(o, Outcome::Ok)));
+    let p = profiles(&h);
+    assert_eq!(p.active(), "Custom");
+    assert_eq!(p.sets().get("Custom").and_then(|o| o.get("file.save")), Some(&["F2".to_string()][..]));
+}
+
+#[test]
+fn set_export_import_round_trip() {
+    let mut h = with_sets(Profiles::default());
+    new_set(&mut h, "Name");
+    click(&mut h, "Save: ⌘S");
+    press(&mut h, Modifiers::NONE, EguiKey::F2);
+    h.get_all_by_label("Export…").next().expect("the set row's Export…").click();
+    h.run();
+    let (name, json) = h
+        .state()
+        .outcomes
+        .iter()
+        .find_map(|o| if let Outcome::Export { name, json } = o { Some((name.clone(), json.clone())) } else { None })
+        .expect("Outcome::Export");
+    assert_eq!(name, "Name");
+    let edited = h.state().km.overrides().clone();
+
+    let mut fresh = with_sets(profiles(&h).clone());
+    let (d, state) = dialog(fresh.state_mut());
+    assert_eq!(d.import_json(state, &json), Ok("Name 2".into()));
+    fresh.run();
+    assert_eq!(profiles(&fresh).active(), "Name 2");
+    assert_eq!(fresh.state().km.overrides(), &edited);
+    assert_eq!(fresh.get_by_label("Set:").accesskit_node().value().as_deref(), Some("Name 2"), "the picker shows it");
+}
+
+fn foreign_set() -> ForeignSet {
+    let read = |text: &str| ForeignKey::read(Some("Default"), text, Flavor::Windows);
+    ForeignSet::new(vec![
+        ForeignEntry::new(Some("File"), ["Save"]).with_key(read("Ctrl+Alt+S")).at_line(3),
+        ForeignEntry::new(Some("File"), ["Frobnicate"]).with_key(read("Ctrl+F")).at_line(4),
+        ForeignEntry::new(Some("File"), ["Export…"]).with_key(read("Ctrl+Blorp")).at_line(5),
+        ForeignEntry::new(Some("Object"), ["Arrange", "Bring to Front"]).with_key(read("Num 7")).at_line(6),
+        ForeignEntry::new(Some("File"), ["Sve Az"]).with_key(read("Ctrl+F9")).at_line(7),
+    ])
+    .with_name("Theirs")
+}
+
+fn review(h: &mut Harness<'_, Fx>) {
+    let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], suggest: true, ..ImportOptions::default() };
+    let (d, state) = dialog(h.state_mut());
+    d.review_import(state, foreign_set(), options);
+    h.run();
+}
+
+#[test]
+fn foreign_import_review_lists_skipped_and_unreadable() {
+    let mut h = with_sets(Profiles::default());
+    review(&mut h);
+    assert!(has(&h, "Import “Theirs”"));
+    for (item, line) in [("File > Save", 3), ("File > Frobnicate", 4), ("File > Export…", 5), ("Object > Arrange > Bring to Front", 6)] {
+        let found = h.query_all_by_label_contains(item).any(|n| n.accesskit_node().value().is_some_and(|l| l.contains(&format!("line {line}"))));
+        assert!(found, "{item} with line {line}");
+    }
+    assert!(h.query_by_label_contains("unknown key").is_some(), "the unreadable key says why");
+    assert!(h.query_by_label_contains("numeric keypad key read as main key").is_some());
+    assert!(h.state().km.overrides().is_empty(), "the review changes nothing");
+    click(&mut h, "Import as New Set");
+    assert_eq!(profiles(&h).active(), "Theirs");
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+Alt+S"]);
+    assert!(has(&h, "Imported as “Theirs”"));
+    click(&mut h, "Done");
+    assert!(h.state().state.is_open() && has(&h, "Commands"));
+}
+
+#[test]
+fn picking_a_suggestion_replans_and_is_remembered() {
+    let mut h = with_sets(Profiles::default());
+    review(&mut h);
+    assert!(h.query_by_label_contains("3 commands will change").is_some());
+    click(&mut h, "Command for File > Sve Az");
+    click_last(&mut h, "Save As…");
+    let remembered = h.state().outcomes.iter().find_map(|o| if let Outcome::Remembered(m) = o { Some(m.clone()) } else { None });
+    assert!(remembered.is_some_and(|m| m.values().any(|c| c.id == "file.saveAs")));
+    assert!(h.query_by_label_contains("4 commands will change").is_some());
+    assert!(h.query_by_label_contains("File > Sve Az · line 7 — Save As…: ").is_some(), "the pick moved to Will change");
+    assert!(h.query_by_label("Command for File > Sve Az").is_none());
+}
+
+// ---- Summary ----
+
+#[test]
+fn summary_escapes_html_and_keeps_text_lines() {
+    let mut km = fixture(Platform::Mac);
+    let mut catalog = km.catalog().to_vec();
+    let label = "<b>\"Tom\" & 'Jerry'</b>\nNext";
+    catalog.push(
+        Bindable::new("edit.tricky", label, Scope::app())
+            .with_path(vec!["Edit".into(), "Tricky".into()])
+            .with_default(craft_keymap::Binding::parse("F6").expect("F6")),
+    );
+    km = Keymap::new(catalog, Scopes::new().with_panel("Timeline").with_context("Text"), Platform::Mac);
+    let mut h = open(Fx::new(km));
+    click(&mut h, "Summarize…");
+    let (html, text) = h
+        .state()
+        .outcomes
+        .iter()
+        .find_map(|o| if let Outcome::Summary { html, text, .. } = o { Some((html.clone(), text.clone())) } else { None })
+        .expect("Outcome::Summary");
+    assert!(html.contains("&lt;b&gt;&quot;Tom&quot; &amp; &#39;Jerry&#39;&lt;/b&gt;"), "{html}");
+    assert!(!html.contains("<b>"));
+    assert!(html.contains("<kbd dir=\"ltr\">⌘S</kbd>"));
+    assert!(text.lines().any(|l| l == "  <b>\"Tom\" & 'Jerry'</b> Next\tF6"), "{text}");
+    assert!(text.lines().any(|l| l == "  Save\t⌘S"), "{text}");
+}
+
+#[test]
+fn narrow_set_row_moves_actions_into_more() {
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.sets = Some((Profiles::default(), vec![("Fixture Defaults", Overrides::new())]));
+    let mut h = harness(fx, vec2(560.0, 600.0));
+    assert!(h.query_by_label("Summarize…").is_none(), "Summarize… is in More");
+    click(&mut h, "More");
+    click(&mut h, "Summarize…");
+    assert!(h.state().outcomes.iter().any(|o| matches!(o, Outcome::Summary { name, .. } if name == "Fixture Defaults")));
+}
+
+// ---- On-screen keyboard, fixed rows, read-only ----
+
+fn with_keyboard(options: impl FnOnce(&mut Fx)) -> Harness<'static, Fx> {
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    fx.options.keyboard = true;
+    options(&mut fx);
+    open(fx)
+}
+
+/// What a key's color means, as its accessibility description says it.
+fn holders_class(h: &Harness<'_, Fx>, key: &str) -> String {
+    h.get_by_role_and_label(Role::Button, key).accesskit_node().description().unwrap_or_default().to_string()
+}
+
+#[test]
+fn keyboard_colors_keys_and_assigns_to_the_selected_command() {
+    let mut h = with_keyboard(|_| {});
+    assert_eq!(holders_class(&h, "M: Marquee Tool, Elliptical Marquee Tool"), "Application");
+    assert_eq!(holders_class(&h, "L: Loop (Timeline)"), "Panel or context");
+    assert_eq!(holders_class(&h, "F7"), "Not assigned");
+
+    click(&mut h, "⌘ Command");
+    assert_eq!(holders_class(&h, "⌘S: Save"), "Application");
+    assert_eq!(holders_class(&h, "⌘B: Bold (Text)"), "Panel or context");
+    // Held modifiers add to the toggles.
+    h.event(Event::ModifiersChanged(Modifiers::SHIFT));
+    h.run();
+    assert!(has(&h, "⇧⌘S: Save As…"));
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.run();
+    click(&mut h, "⌘ Command");
+
+    click(&mut h, "L: Loop (Timeline)");
+    assert!(has(&h, "Key: L"));
+    assert!(h.get_by_label("Assign to Selected").accesskit_node().is_disabled(), "no command selected");
+    click(&mut h, "Save");
+    click(&mut h, "Assign to Selected");
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S", "L"]);
+    assert_eq!(holders_class(&h, "L: Save, Loop (Timeline)"), "Both");
+
+    // A holder in the key list selects its command.
+    click(&mut h, "Loop (Timeline)");
+    assert!(selected(&h, "Loop"));
+}
+
+#[test]
+fn fixed_rows_are_struck_through_when_a_command_takes_their_key() {
+    let mut fx = Fx::new(fixture(Platform::Mac));
+    let row = |label: &str, keys: &str, chord: Option<&str>| FixedRow {
+        group: "Rating".into(),
+        label: label.into(),
+        keys: keys.into(),
+        chord: chord.map(|c| Trigger::parse(c).unwrap_or_else(|e| panic!("{c}: {e}"))),
+    };
+    fx.options.fixed = vec![row("Rate 1", "1", Some("1")), row("Rate 2", "2", Some("2")), row("Pan", "Space (hold)", None)];
+    let mut h = open(fx);
+    choose_area(&mut h, "Fixed Keys");
+    assert!(has(&h, "Rate 1: 1"));
+    assert!(has(&h, "Pan: Space (hold)"));
+
+    choose_area(&mut h, "All Commands");
+    click(&mut h, "Save: ⌘S");
+    press(&mut h, Modifiers::NONE, EguiKey::Num1);
+    assert_eq!(h.state().bindings("file.save"), ["1"]);
+    choose_area(&mut h, "Fixed Keys");
+    assert!(has(&h, "Rate 1: 1 (Now used by Save)"));
+    assert!(has(&h, "Rate 2: 2"));
+}
+
+#[test]
+fn read_only_has_no_edit_controls() {
+    let mut h = with_keyboard(|fx| {
+        fx.options.editable = false;
+        fx.sets = Some((Profiles::default(), vec![("Fixture Defaults", Overrides::new())]));
+    });
+    click(&mut h, "Save");
+    click(&mut h, "Save: ⌘S");
+    assert!(!has(&h, "Save: press keys"), "no recording");
+    click(&mut h, "S");
+    assert!(has(&h, "Key: S"));
+    for label in [
+        "Undo",
+        "Redo",
+        "Reset All…",
+        "OK",
+        "Cancel",
+        "Set:",
+        "New Set…",
+        "Import…",
+        "Add a shortcut to Save",
+        "Restore the default for Save",
+        "Remove ⌘S from Save",
+        "New shortcut:",
+        "Context:",
+        "Assign",
+        "Use Default",
+        "Clear",
+        "Assign to Selected",
+    ] {
+        assert!(!has(&h, label), "{label} is shown");
+    }
+    press(&mut h, Modifiers::COMMAND, EguiKey::Z);
+    assert_eq!(h.state().bindings("file.save"), ["Cmd+S"]);
+    click(&mut h, "Summarize…");
+    assert!(h.state().outcomes.iter().any(|o| matches!(o, Outcome::Summary { .. })));
+    click(&mut h, "Close");
+    assert!(h.state().canceled());
+}
+
+// ---- Pseudo locale ----
+
+/// Text a test put there or read from a foreign file, which no lookup translates.
+const RAW: &[&str] = &["Theirs", "Frobnicate", "Sve Az", "Blorp", "Num", "Name 2"];
+
+/// Every control inside the `width` px dialog, and every label with words marked by `Pseudo`.
+fn check_pseudo(h: &Harness<'_, Fx>, width: f32, step: &str) {
+    let mut seen = 0;
+    for node in h.root().children_recursive() {
+        let n = node.accesskit_node();
+        let Some(label) = n.label() else { continue };
+        seen += 1;
+        let r = node.rect();
+        assert!(r.min.x >= -1.0 && r.max.x <= width + 1.0, "{step}: {:?} {label:?} at {r:?} leaves the {width} px dialog", n.role());
+        let mut rest = String::new();
+        let mut depth = 0usize;
+        for c in label.chars() {
+            match c {
+                '⟦' => depth += 1,
+                '⟧' => depth = depth.saturating_sub(1),
+                _ if depth == 0 => rest.push(c),
+                _ => {}
+            }
+        }
+        for raw in RAW {
+            rest = rest.replace(raw, "");
+        }
+        let words = rest.split(|c: char| !c.is_ascii_lowercase()).any(|w| w.len() > 1);
+        assert!(!words, "{step}: {label:?} has text that did not go through Text");
+    }
+    assert!(seen > 15, "{step}: {seen} labeled nodes");
+}
+
+#[test]
+fn pseudo_locale_marks_every_string_and_fits() {
+    let p = Pseudo::mark;
+    // Each direction at one width: the narrow layout left to right, the wide one right to left.
+    for (rtl, width) in [(false, 560.0), (true, 1100.0)] {
+        let unlisted = std::rc::Rc::default();
+        let mut fx = Fx::new(with_long_label(fixture(Platform::Mac)));
+        fx.text = Box::new(Pseudo { unlisted: std::rc::Rc::clone(&unlisted), rtl });
+        fx.options.keyboard = true;
+        fx.sets = Some((Profiles::default(), vec![("Fixture Defaults", Overrides::new())]));
+        let mut h = harness(fx, vec2(width, 720.0));
+        let step = |s: &str| format!("{} {width}: {s}", if rtl { "rtl" } else { "ltr" });
+        check_pseudo(&h, width, &step("opened"));
+        h.state_mut().state.select(&CommandRef::from("object.distribute"));
+        h.run();
+        check_pseudo(&h, width, &step("long label selected"));
+        let export = craft_i18n::fmt(&p("{label}: {chord}"), &[("label", &p("Export…")), ("chord", "⌘E")]);
+        click(&mut h, &export);
+        press(&mut h, Modifiers::COMMAND, EguiKey::S);
+        assert!(has(&h, &p("Take It")), "{}", step("conflict bar"));
+        check_pseudo(&h, width, &step("conflict"));
+        click(&mut h, &p("Keep Both"));
+        check_pseudo(&h, width, &step("kept both"));
+        click(&mut h, &p("Keyboard"));
+        check_pseudo(&h, width, &step("keyboard hidden"));
+        review(&mut h);
+        check_pseudo(&h, width, &step("review"));
+        assert!(unlisted.borrow().is_empty(), "looked up but not in STRINGS or PLURALS: {:?}", unlisted.borrow());
+    }
+}
+
+#[test]
+fn an_app_error_shows_until_dismissed() {
+    let mut h = mac();
+    h.state_mut().state.show_error("The file could not be read");
+    h.run();
+    assert!(has(&h, "⚠ The file could not be read"));
+    click(&mut h, "Dismiss");
+    assert!(!has(&h, "⚠ The file could not be read"));
+}
+
+#[test]
+fn one_pointer_click_on_a_chip_of_another_row_records() {
+    let mut h = mac();
+    click(&mut h, "Save");
+    let at = h.get_by_label("Export…: ⌘E").rect().center();
+    h.event(Event::PointerMoved(at));
+    h.run();
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.step();
+    }
+    h.run();
+    assert!(has(&h, "Export…: press keys"));
+}
diff --git a/crates/keymap/tests/ui_fixture/mod.rs b/crates/keymap/tests/ui_fixture/mod.rs
new file mode 100644
index 00000000..f2f930cc
--- /dev/null
+++ b/crates/keymap/tests/ui_fixture/mod.rs
@@ -0,0 +1,156 @@
+//! The catalog the dialog tests and screenshots use.
+
+use std::borrow::Cow;
+use std::cell::RefCell;
+use std::collections::BTreeSet;
+use std::rc::Rc;
+
+use craft_keymap::ui::{PLURALS, STRINGS, Text};
+use craft_keymap::{Bindable, Binding, Key, Keymap, Kind, Platform, Scope, Scopes};
+
+fn binding(text: &str) -> Binding {
+    Binding::parse(text).unwrap_or_else(|e| panic!("{text}: {e}"))
+}
+
+pub fn fixture(platform: Platform) -> Keymap {
+    let tool = Kind::Tool { group: Some("Marquee".into()) };
+    let path = |p: &[&str]| p.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+    let timeline = Scope::new("Timeline").unwrap_or_else(Scope::app);
+    let catalog = vec![
+        Bindable::new("file.save", "Save", Scope::app()).with_path(path(&["File", "Save"])).with_default(binding("Cmd+S")),
+        Bindable::new("file.saveAs", "Save As…", Scope::app()).with_path(path(&["File", "Save As…"])).with_default(binding("Cmd+Shift+S")),
+        Bindable::new("file.export", "Export…", Scope::app()).with_path(path(&["File", "Export…"])).with_default(binding("Cmd+E")),
+        Bindable::new("object.front", "Bring to Front", Scope::app()).with_path(path(&["Object", "Arrange", "Bring to Front"])),
+        Bindable::new("tool.marquee", "Marquee Tool", Scope::app()).with_kind(tool.clone()).with_default(binding("M")),
+        Bindable::new("tool.ellipse", "Elliptical Marquee Tool", Scope::app()).with_kind(tool).with_default(binding("M")),
+        Bindable::new("timeline.loop", "Loop", timeline).with_default(binding("L")),
+        Bindable::new("type.bold", "Bold", Scope::app()).with_default(binding("Text: Cmd+B")),
+    ];
+    Keymap::new(catalog, Scopes::new().with_panel("Timeline").with_context("Text"), platform)
+}
+
+/// `km` with a command whose label and menu path are far too long for a row.
+#[allow(dead_code)]
+pub fn with_long_label(km: Keymap) -> Keymap {
+    let long = "Distribute Selected Objects Evenly Along the Active Guide Path and Keep Their Spacing".to_string();
+    let mut catalog = km.catalog().to_vec();
+    catalog.insert(
+        3,
+        Bindable::new("object.distribute", long.as_str(), Scope::app())
+            .with_path(vec!["Object".into(), "Arrange and Distribute Along a Path".into(), long.clone()])
+            .with_default(binding("Cmd+Alt+Shift+D"))
+            .with_default(binding("Ctrl+Alt+Shift+F12")),
+    );
+    Keymap::new(catalog, Scopes::new().with_panel("Timeline").with_context("Text"), km.platform())
+}
+
+/// A pseudo translation: every string about 40 % longer, accented, between right-to-left marks and
+/// in `⟦…⟧`, so text drawn without the marks never went through [`Text`]. Placeholders stay as
+/// they are. Labels and path parts are marked too. Looked-up dialog strings missing from
+/// `STRINGS` or `PLURALS` are collected in `unlisted`.
+#[allow(dead_code)]
+#[derive(Default)]
+pub struct Pseudo {
+    pub unlisted: Rc<RefCell<BTreeSet<String>>>,
+    /// Lay the dialog out right to left.
+    pub rtl: bool,
+}
+
+#[allow(dead_code)]
+impl Pseudo {
+    pub fn mark(source: &str) -> String {
+        let mut out = String::from("⟦\u{200F}");
+        let mut in_placeholder = false;
+        let mut letters = 0;
+        for c in source.chars() {
+            match c {
+                '{' => in_placeholder = true,
+                '}' => in_placeholder = false,
+                _ => {}
+            }
+            let accented = match c {
+                _ if in_placeholder => c,
+                'a' => 'á',
+                'e' => 'ë',
+                'i' => 'ï',
+                'o' => 'ö',
+                'u' => 'ü',
+                'A' => 'Å',
+                'E' => 'É',
+                'O' => 'Ø',
+                _ => c,
+            };
+            if !in_placeholder && c.is_alphabetic() {
+                letters += 1;
+            }
+            out.push(accented);
+        }
+        out.extend(std::iter::repeat_n('~', letters * 2 / 5));
+        out.push_str("\u{200F}⟧");
+        out
+    }
+}
+
+impl Text for Pseudo {
+    fn ui<'a>(&'a self, source: &'a str) -> Cow<'a, str> {
+        if !STRINGS.contains(&source) {
+            self.unlisted.borrow_mut().insert(source.to_string());
+        }
+        Pseudo::mark(source).into()
+    }
+
+    fn plural(&self, n: u64, one: &str, other: &str) -> String {
+        if !PLURALS.contains(&(one, other)) {
+            self.unlisted.borrow_mut().insert(format!("{one}|{other}"));
+        }
+        Pseudo::mark(if n == 1 { one } else { other }).replace("{n}", &n.to_string())
+    }
+
+    fn command<'a>(&'a self, b: &'a Bindable) -> Cow<'a, str> {
+        Pseudo::mark(&b.label).into()
+    }
+
+    fn segment<'a>(&'a self, s: &'a str) -> Cow<'a, str> {
+        Pseudo::mark(s).into()
+    }
+
+    /// Key names spelled out in words (Escape, Space), on every platform.
+    fn key(&self, k: Key, _p: Platform) -> Option<String> {
+        let name = k.to_string();
+        name.chars().any(|c| c.is_ascii_lowercase()).then(|| Pseudo::mark(&name))
+    }
+
+    fn rtl(&self) -> bool {
+        self.rtl
+    }
+}
+
+/// English laid out right to left, to look at the mirrored layout.
+#[allow(dead_code)]
+pub struct EnglishRtl;
+
+impl Text for EnglishRtl {
+    fn ui<'a>(&'a self, source: &'a str) -> Cow<'a, str> {
+        source.into()
+    }
+
+    fn plural(&self, n: u64, one: &str, other: &str) -> String {
+        (if n == 1 { one } else { other }).replace("{n}", &n.to_string())
+    }
+
+    fn rtl(&self) -> bool {
+        true
+    }
+
+    /// The words stay in English order; spaces at either end change sides, as in a right-to-left
+    /// paragraph.
+    fn visual(&self, s: &str) -> String {
+        let core = s.trim();
+        if core.is_empty() {
+            return s.to_string();
+        }
+        let start = s.len() - s.trim_start().len();
+        let end = s.trim_end().len();
+        format!("{}{core}{}", &s[end..], &s[..start])
+    }
+}
diff --git a/crates/keymap/tests/ui_snapshot.rs b/crates/keymap/tests/ui_snapshot.rs
new file mode 100644
index 00000000..c9779cda
--- /dev/null
+++ b/crates/keymap/tests/ui_snapshot.rs
@@ -0,0 +1,250 @@
+#![cfg(feature = "snapshot")]
+//! Screenshots of the Keyboard Shortcuts dialog for review, not a golden comparison. With
+//! `CRAFT_KEYMAP_SNAPSHOT_DIR` set, writes PNGs of a few states in light and dark at 1× and 2×;
+//! without it the test does nothing.
+//!
+//! `CRAFT_KEYMAP_SNAPSHOT_DIR=/tmp/shots cargo test -p craft-keymap --features snapshot --test ui_snapshot`
+//!
+//! Uses the same hash-verified `CRAFT_FONTS_DIR` input as ui_dialog (see README.md).
+//! Fonts are installed before the first layout pass; missing glyphs remain errors.
+
+use std::path::PathBuf;
+
+use craft_keymap::ui::{DialogState, English, Options, ShortcutsDialog, Text};
+use craft_keymap::{ContextRule, Flavor, ForeignEntry, ForeignKey, ForeignSet, ImportOptions, Keymap, Overrides, Platform, Profiles};
+use egui::{Key as EguiKey, Modifiers, Theme, Vec2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use ui_fixture::{EnglishRtl, Pseudo, fixture, with_long_label};
+
+#[path = "support/fonts.rs"]
+mod test_fonts;
+mod ui_fixture;
+
+struct Fx {
+    km: Keymap,
+    text: Box<dyn Text>,
+    options: Options,
+    state: DialogState,
+    sets: Option<(Profiles, Vec<(&'static str, Overrides)>)>,
+}
+
+impl Fx {
+    fn dialog(&mut self) -> (ShortcutsDialog<'_>, &mut DialogState) {
+        let Fx { km, text, options, state, sets } = self;
+        let d = ShortcutsDialog::new(km, &**text).options(options);
+        let d = match sets {
+            Some((p, b)) => d.sets(p, b),
+            None => d,
+        };
+        (d, state)
+    }
+}
+
+/// A named state of the dialog: window size and what to do before the picture.
+struct Case {
+    name: &'static str,
+    size: Vec2,
+    platform: Platform,
+    /// Show named sets.
+    sets: bool,
+    /// Show the on-screen keyboard.
+    keyboard: bool,
+    words: Words,
+    /// Add a command with a very long label and name the user set at length.
+    long: bool,
+    act: fn(&mut Harness<'_, Fx>),
+}
+
+#[derive(Clone, Copy)]
+enum Words {
+    English,
+    /// English laid out right to left.
+    Rtl,
+    /// The pseudo translation of the tests, left to right.
+    Pseudo,
+}
+
+impl Case {
+    const fn new(name: &'static str, width: f32, height: f32, act: fn(&mut Harness<'_, Fx>)) -> Case {
+        Case { name, size: Vec2::new(width, height), platform: Platform::Mac, sets: false, keyboard: false, words: Words::English, long: false, act }
+    }
+
+    const fn windows(mut self) -> Case {
+        self.platform = Platform::Windows;
+        self
+    }
+
+    const fn sets(mut self) -> Case {
+        self.sets = true;
+        self
+    }
+
+    const fn keyboard(mut self) -> Case {
+        self.keyboard = true;
+        self
+    }
+
+    const fn words(mut self, words: Words) -> Case {
+        self.words = words;
+        self
+    }
+
+    const fn long(mut self) -> Case {
+        self.long = true;
+        self
+    }
+}
+
+fn foreign_review(h: &mut Harness<'_, Fx>) {
+    let read = |text: &str| ForeignKey::read(Some("Default"), text, Flavor::Windows);
+    let set = ForeignSet::new(vec![
+        ForeignEntry::new(Some("File"), ["Save"]).with_key(read("Ctrl+Alt+S")).at_line(3),
+        ForeignEntry::new(Some("File"), ["Frobnicate"]).with_key(read("Ctrl+F")).at_line(4),
+        ForeignEntry::new(Some("File"), ["Export…"]).with_key(read("Ctrl+Blorp")).at_line(5),
+        ForeignEntry::new(Some("Object"), ["Arrange", "Bring to Front"]).with_key(read("Num 7")).at_line(6),
+        ForeignEntry::new(Some("File"), ["Sve Az"]).with_key(read("Ctrl+F9")).at_line(7),
+    ])
+    .with_name("Theirs");
+    let options = ImportOptions { contexts: vec![("Default".into(), ContextRule::Home)], suggest: true, ..ImportOptions::default() };
+    let (d, state) = h.state_mut().dialog();
+    d.review_import(state, set, options);
+    h.run();
+}
+
+fn click(h: &mut Harness<'_, Fx>, label: &str) {
+    h.get_by_label(label).click();
+    h.run();
+}
+
+/// Click the widget carrying `label` and run a frame; used to put a command row
+/// into the snapshot's selected state.
+fn select(h: &mut Harness<'_, Fx>, label: &str) {
+    h.get_by_label(label).click();
+    h.run();
+}
+
+const CASES: &[Case] = &[
+    Case::new("selected", 1000.0, 640.0, |h| select(h, "Save As…")),
+    Case::new("conflict", 1000.0, 640.0, |h| {
+        click(h, "Export…: ⌘E");
+        h.key_press_modifiers(Modifiers::COMMAND, EguiKey::S);
+        h.run();
+    }),
+    Case::new("recording", 1000.0, 640.0, |h| click(h, "Save: Ctrl+S")).windows(),
+    Case::new("narrow", 560.0, 640.0, |h| select(h, "Save")),
+    Case::new("sets", 1000.0, 640.0, |h| {
+        click(h, "Save: ⌘S");
+        h.key_press(EguiKey::F2);
+        h.run();
+        click(h, "New Set…");
+    })
+    .sets(),
+    Case::new("sets-narrow", 560.0, 640.0, |h| click(h, "More")).sets(),
+    Case::new("keyboard", 1100.0, 720.0, |h| {
+        click(h, "Save As…");
+        click(h, "⌘ Command");
+        click(h, "⌘S: Save");
+    })
+    .keyboard(),
+    Case::new("keyboard-windows", 860.0, 640.0, |h| click(h, "L: Loop (Timeline)")).windows().keyboard(),
+    Case::new("review", 1000.0, 640.0, foreign_review).sets(),
+    Case::new("long", 1000.0, 640.0, |h| {
+        let state = &mut h.state_mut().state;
+        state.select(&craft_keymap::CommandRef::from("object.distribute"));
+        h.run();
+    })
+    .sets()
+    .long(),
+    Case::new("long-narrow", 560.0, 640.0, |h| {
+        h.state_mut().state.select(&craft_keymap::CommandRef::from("object.distribute"));
+        h.run();
+    })
+    .sets()
+    .long(),
+    Case::new("rtl", 1000.0, 640.0, |h| {
+        click(h, "Export…: ⌘E");
+        h.key_press_modifiers(Modifiers::COMMAND, EguiKey::S);
+        h.run();
+    })
+    .sets()
+    .long()
+    .words(Words::Rtl),
+    Case::new("rtl-narrow", 560.0, 640.0, |h| select(h, "Bold")).words(Words::Rtl).long(),
+    Case::new("rtl-keyboard", 1100.0, 720.0, |h| click(h, "L: Loop (Timeline)")).keyboard().words(Words::Rtl),
+    Case::new("rtl-review", 1000.0, 640.0, foreign_review).sets().words(Words::Rtl),
+    Case::new("pseudo", 1100.0, 720.0, |h| {
+        h.state_mut().state.select(&craft_keymap::CommandRef::from("file.save"));
+        h.run();
+    })
+    .sets()
+    .keyboard()
+    .long()
+    .words(Words::Pseudo),
+    Case::new("pseudo-narrow", 560.0, 640.0, |h| {
+        h.state_mut().state.select(&craft_keymap::CommandRef::from("object.distribute"));
+        h.run();
+    })
+    .sets()
+    .long()
+    .words(Words::Pseudo),
+];
+
+#[test]
+/// Write review screenshots when `CRAFT_KEYMAP_SNAPSHOT_DIR` is set.
+///
+/// For every case whose name starts with `CRAFT_KEYMAP_SNAPSHOT_ONLY`, renders light and dark at
+/// 1× and 2× with the pinned fonts, optional sets and long labels, after running the case action.
+/// Without the directory variable the test does nothing; these are not golden comparisons.
+fn dialog_screenshots() {
+    let Some(dir) = std::env::var_os("CRAFT_KEYMAP_SNAPSHOT_DIR").map(PathBuf::from) else { return };
+    std::fs::create_dir_all(&dir).unwrap_or_else(|e| panic!("{}: {e}", dir.display()));
+    // `CRAFT_KEYMAP_SNAPSHOT_ONLY=keyboard` renders only the cases whose name starts with it.
+    let only = std::env::var("CRAFT_KEYMAP_SNAPSHOT_ONLY").unwrap_or_default();
+    for case in CASES.iter().filter(|c| c.name.starts_with(&only)) {
+        for (theme_name, theme) in [("light", Theme::Light), ("dark", Theme::Dark)] {
+            for scale in [1.0, 2.0] {
+                let sets = case.sets.then(|| {
+                    let mut p = Profiles::default();
+                    let builtins = vec![("Fixture Defaults", Overrides::new())];
+                    if case.long {
+                        let name = "My Shortcuts for Long Evenings of Retouching Photographs";
+                        if let Err(e) = p.save_as(name, Overrides::new(), &builtins).and_then(|n| p.select(&n, &builtins)) {
+                            panic!("{name}: {e}");
+                        }
+                    }
+                    (p, builtins)
+                });
+                let options = Options::default().with(|o| o.keyboard = case.keyboard);
+                let km = if case.long { with_long_label(fixture(case.platform)) } else { fixture(case.platform) };
+                let text: Box<dyn Text> = match case.words {
+                    Words::English => Box::new(English),
+                    Words::Rtl => Box::new(EnglishRtl),
+                    Words::Pseudo => Box::new(Pseudo::default()),
+                };
+                let fx = Fx { km, text, options, state: DialogState::new(), sets };
+                let mut h = Harness::builder()
+                    .with_size(case.size)
+                    .with_pixels_per_point(scale)
+                    .with_theme(theme)
+                    .with_context_setup(test_fonts::configure)
+                    .wgpu()
+                    .build_ui_state(
+                        |ui, fx: &mut Fx| {
+                            test_fonts::assert_coverage(ui.ctx());
+                            egui::Frame::central_panel(ui.style()).show(ui, |ui| {
+                                let (d, state) = fx.dialog();
+                                d.ui(ui, state);
+                            });
+                        },
+                        fx,
+                    );
+                h.run();
+                (case.act)(&mut h);
+                let image = h.render().unwrap_or_else(|e| panic!("render {}: {e}", case.name));
+                let path = dir.join(format!("shortcuts-{}-{theme_name}@{scale}x.png", case.name));
+                image.save(&path).unwrap_or_else(|e| panic!("{}: {e}", path.display()));
+            }
+        }
+    }
+}
diff --git a/crates/menu/Cargo.toml b/crates/menu/Cargo.toml
new file mode 100644
index 00000000..cac69ca2
--- /dev/null
+++ b/crates/menu/Cargo.toml
@@ -0,0 +1,27 @@
+[package]
+name = "craft-menu"
+description = "A Craft app's menus: layouts for macOS, Windows, Linux and the web, shortcuts from craft-keymap, a macOS backend, and key equivalents fed back to egui."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+
+[dependencies]
+craft-keymap = { workspace = true, default-features = false, features = ["egui"] }
+craft-quit = { workspace = true, features = ["egui"] }
+egui = { workspace = true }
+
+# Already in the apps' Cargo.lock: muda through craft-quit's `menu` feature, objc2 and objc2-app-kit
+# through eframe.
+[target.'cfg(target_os = "macos")'.dependencies]
+muda = { version = "0.21.2", default-features = false }
+objc2 = { version = "0.6.4", default-features = false, features = ["std"] }
+objc2-app-kit = { version = "0.3.2", default-features = false, features = ["std", "NSApplication", "NSEvent", "NSMenu", "NSMenuItem", "NSResponder"] }
+
+[dev-dependencies]
+# `default_fonts` so that the bar's tests lay out text.
+egui = { workspace = true, features = ["default_fonts"] }
+
+[lints]
+workspace = true
diff --git a/crates/menu/README.md b/crates/menu/README.md
new file mode 100644
index 00000000..063c2d0e
--- /dev/null
+++ b/crates/menu/README.md
@@ -0,0 +1,280 @@
+# craft-menu
+
+A Craft app's menus, laid out for macOS, Windows, Linux and the web. The app supplies its menu
+tree and runs its commands; this crate lays the menus out the way each platform's apps do, takes
+shortcuts from craft-keymap, drives a platform `Backend`, and turns the menu's key
+equivalents back into the input egui would have had without it. It depends on egui,
+[`craft-keymap`](../keymap/src/lib.rs) (commands and chords) and [`craft-quit`](../quit/src/lib.rs),
+and on no app. Everything but the macOS backend
+(`craft_menu::mac`, built on muda) is platform-free and also builds for `wasm32`. The layout and driver come from PhotoCraft's `native_menu.rs`, the egui bar from its `menu_nav.rs` and in-window menu bar.
+
+## The menus
+
+Build a `MenuBar` directly, or from the flat rows an in-window bar draws (`from_items`, with
+`Row { path, command, label, shortcut, enabled, kind }`, `---` for a separator). Give each menu
+its role (`MenuRole::{App, File, Edit, View, Window, Help, Other}`), then tag what macOS puts in
+fixed places:
+
+```rust
+let mut bar = craft_menu::from_items(&["File", "Edit", "View", "Window", "Help"], &rows);
+bar.tag_menu("File", MenuRole::File);
+bar.tag_menu("Edit", MenuRole::Edit);
+bar.tag_menu("View", MenuRole::View);
+bar.tag_menu("Window", MenuRole::Window);
+bar.tag_menu("Help", MenuRole::Help);
+bar.tag_item(&"help.about".into(), ItemRole::About);
+bar.tag_item(&"file.exit".into(), ItemRole::Quit); // the app's quit, with its unsaved-changes prompt
+bar.tag_submenu(MenuRole::Edit, "Preferences", ItemRole::Settings);
+bar.tag_submenu(MenuRole::View, "Theme", ItemRole::Appearance);
+```
+
+Each item runs a `craft_keymap::CommandRef`, and a click reports it. A command that takes a
+parameter carries it in the `CommandRef`:
+`CommandRef::with_params("file.open_recent", json!({"index": 3}))`. Items built directly use
+`Item::new(command, label)` with `.shortcut(chord)`, `.enabled(..)`, `.check(..)` or
+`.radio(..)` (the item's `ItemKind`), `.role(..)` and `.platforms(..)`; submenus use
+`Node::submenu(label, children)`, with `.role(..)` for a tagged one. A shortcut is a
+`craft_keymap::Chord`: `cmd` is ⌘ and `ctrl` the Control key. macOS shows radio items as check
+items. The app's open documents go in `MenuBar::documents` (`Document::new(command, name)`,
+`.active(..)` for the one in front, `hidden` for one kept open but not listed), and the layouts
+list them in the Window menu. The items the
+layout adds itself run a `Builtin` command (Hide, Hide Others, Minimize, Quit), which the crate
+handles.
+
+## Layouts
+
+`layout(&bar, target, &LayoutOptions::new("PhotoCraft"))` lays the menus out for a `Target`
+(`Mac`, `Windows`, `Linux`, `Web`; `Target::current()` for this build) and returns the bar and
+the clashes it resolved. Every layout first drops the items and submenus whose `.platforms(..)`
+leave the target out, and lists the open documents (but the hidden ones) last in the Window menu
+as radio items, the one in front selected. A submenu left empty goes; for an empty dynamic list
+(no recent files) the app supplies a disabled placeholder item, which keeps the submenu.
+
+| Target | About | Settings | Quit | Also |
+|---|---|---|---|---|
+| `Mac` | app menu | app menu, Settings… (⌘,) | app menu, ⌘Q | Services, Hide, Minimize, Zoom, Close Window |
+| `Windows` | last in Help | last in Edit, Preferences… | last in File, Exit | |
+| `Linux` | last in Help | last in Edit, Preferences… | last in File, Quit | |
+| `Web` | last in Help | last in Edit, Preferences… | none | browser shortcuts removed |
+
+The layouts find these items by role, never by title, and add a File, Edit, Window or Help menu
+when the app has none to put them in. Language and Appearance stay where the app put them off
+macOS, and the Windows, Linux and web layouts keep the app's shortcuts. The browser keeps Ctrl or
+⌘ with W, N, T and Q, and with Shift+N, Shift+T and Shift+W, for its tabs and windows, so the
+web layout takes those shortcuts off the items and reports each as a `Clash`.
+
+`mac_layout(&bar, &LayoutOptions::new("PhotoCraft"))` returns the Mac menu bar and the clashes
+it resolved:
+
+- **App menu:** About, Settings (⌘,), Language, Appearance, Services, Hide (⌘H), Hide Others
+  (⌥⌘H), Show All, Quit (⌘Q). The tagged items leave their old menus. Without a tagged Quit item
+  the layout adds one with `craft_quit::QUIT_MENU_ID`. A menu the app tagged `MenuRole::App` is
+  merged in: its other items follow Appearance.
+- **Window:** Minimize, Zoom, the app's own Window items, Bring All to Front, then the open
+  documents. A Window menu is added if the app has none. **File** gets Close Window (⌘W).
+- **Clashes:** when the app binds ⌘H, ⌥⌘H, ⌘M, ⌘W, ⌘, or ⌘Q to a command, the command keeps
+  it. Hide and Minimize move to ⌃⌘H and ⌃⌘M, the others go without a shortcut, and each case is
+  reported as a `Clash`. Shortcuts bound outside the menus (tool and canvas keys) count when the
+  app lists them: `LayoutOptions::new("PhotoCraft").extra_shortcuts(&[(chord, command), ..])`.
+
+The labels the layouts write (`About {app}`, `Preferences…`, `Exit`, `Window`, `Minimize`, …)
+are English. To translate them, pass `LayoutOptions { label, ..LayoutOptions::new(app_name) }`,
+where `label` maps an English label such as `"Quit {app}"` to the app's translation; the crate
+substitutes `{app}`.
+
+## Keymap
+
+`apply_keymap(&mut bar, &keymap)` gives each item the shortcut its command has in the app's
+`craft_keymap::Keymap`, the user's overrides included: the first single-press binding, one in
+the command's home scope first. A command the keymap knows but binds to nothing loses its
+shortcut; an item whose command the keymap doesn't know keeps its own. Items of toggle commands
+(`Bindable::toggle`) become check items, keeping their checked state; radio items stay radio
+items.
+
+Each frame, `apply_state(&mut bar, |command| ItemState { enabled, checked })` sets enabled and
+checked from the app's state. `checked: Some(..)` makes a plain item a check item and selects or
+clears a radio item; `None` leaves the kind as it is. The built-in items and the open documents
+are left alone. Both run on the app's bar, before the layout.
+
+## Windows, Linux and web: the egui bar
+
+`MenuBarUi` draws a laid-out bar with egui, in a top panel, and returns the commands chosen that
+frame:
+
+```rust
+let laid_out = craft_menu::layout(&menu_bar, Target::current(), &LayoutOptions::new("PhotoCraft")).bar;
+egui::Panel::top("menu-bar").show(ui, |ui| {
+    let gate = Gate { modal: dialog_open, recording_shortcut, text_editing: ui.ctx().text_edit_focused() };
+    for command in MenuBarUi::new(&laid_out).gate(gate).label(&tr).show(ui) {
+        app.run(&command);
+    }
+});
+```
+
+- **Mouse:** a press on a title opens its menu and releasing over an item runs it; a click on
+  the title again, Esc or a click outside closes it. While a menu is open, moving onto another
+  title opens that one. Submenus open on hover and stay open while the pointer heads for them
+  across other rows. A menu taller than the window scrolls, with the wheel or by resting on the
+  ▲ and ▼ arrows.
+- **Keys, while a menu is open:** ↑ and ↓ move the highlight, → opens a submenu or the next
+  menu, ← closes the submenu or opens the previous menu, ↩ and Space run the item, Esc closes.
+  `craft_menu::bar::is_open(ctx)` tells the app's shortcut handling to wait meanwhile.
+- **Keyboard access (Windows, Linux, web):** a tap on Alt alone, or F10, puts the keyboard on
+  the bar: the first title is lit, ← and → move along the titles, ↓, ↩ and Space open the lit
+  menu, Esc, a second tap or a click leaves. Alt+letter opens the menu with that mnemonic, and
+  in an open menu a letter runs the row with that mnemonic or opens its submenu. Mnemonics are
+  underlined while Alt is held, while the bar has the keyboard, and in a menu opened from the
+  keyboard. Each menu level assigns them from the labels as shown, so translated: unique within
+  the level, the first unused letter, word starts first; `.mnemonics(&[("View", 'W'),
+  ("file.open", 'P')])` names preferred letters by title as shown or by command id. A label
+  without an ASCII letter or digit shows its English label's letter after it, "文件(F)", before a
+  trailing ellipsis ("開く(O)…"), when `.english(&hook)` returns that English label for the
+  `Labeled::Command` or `Labeled::Title`; without one it has no mnemonic. While the bar has the keyboard the app's shortcuts wait, as
+  for an open menu (`craft_menu::bar::is_focused(ctx)`); call
+  `craft_menu::bar::leave_for_shortcut(ctx)` before them so that a command shortcut (Ctrl+S,
+  F7) leaves the bar and runs. While a dialog is open or a shortcut is being recorded (`Gate`),
+  Alt, F10 and the letters leave the bar alone. While a text field has the keys, a tap on Alt
+  still focuses the bar, as on Windows, but a letter without Alt goes on to the field (and takes
+  the keyboard off the bar) unless a menu is open. On `Target::Mac`, and on `Target::Web` in a
+  browser on a Mac (`ctx.os()`), the bar has no mnemonics and Alt does nothing: Option is a typing
+  key there.
+- **Items:** disabled items, and the items the `Gate` forbids (`Gate::allows`), are greyed and
+  never run. Check items show ✓, the selected radio item a dot, and the shortcut column shows
+  every shortcut, the display-only ones too, in the target's names (⌘ glyphs on `Target::Mac`,
+  Ctrl names on Windows and Linux, the browser's system's names on the web; `.target(..)` to
+  choose).
+- **Narrow windows:** the menus that don't fit move into a trailing `⋯` menu; when not even the
+  first fits, one `Menu` title holds them all. `.label(&tr)` translates `⋯`, `Menu` and the
+  scroll arrows' names, with the same hook as `LayoutOptions::label`. The bar fills its row;
+  `.shrink_to_fit(max_width)` makes it take only the width its titles need, up to `max_width`,
+  so other controls can share the row, and the menus past that overflow.
+- **Quit:** without an app Quit item, the Windows and Linux layouts add `Builtin::Quit`
+  (`craft_quit::QUIT_MENU_ID`). The bar runs it itself through `craft_quit::on_menu_event`,
+  which asks the window to close so the unsaved-changes check runs, and doesn't return it; the
+  same goes for `Builtin::Minimize`.
+- **Accessibility:** AccessKit sees a menu bar of menu items, the open menus, check and radio
+  items with their state, disabled items, and each item's shortcut and mnemonic (`access_key`).
+- **Style:** `BarStyle::from_style(ui.style())` by default; `.style(..)` sets title padding and
+  color, the menu width, separator room and the check and radio marks.
+
+## macOS
+
+Install the menu bar once, on the main thread, in eframe's creator closure (so winit's default
+menu doesn't stay up). `None` means AppKit refused the menus: keep the in-window ones.
+
+```rust
+#[cfg(target_os = "macos")]
+let native_menu = craft_menu::mac::install(&cc.egui_ctx, &craft_menu::mac_layout(&menu_bar, &LayoutOptions::new("PhotoCraft")).bar);
+```
+
+An app without a `MenuBar` yet installs the minimal app menu instead: About, Services, Hide,
+Hide Others, Show All and Quit, where Quit asks the app first.
+
+```rust
+#[cfg(target_os = "macos")]
+craft_menu::mac::install_app_menu(&cc.egui_ctx, "WordCraft")?;
+```
+
+craft-menu owns muda's menu event handler. muda keeps the first one set per process, so the
+crate sets it once and both `mac::install` and `mac::install_app_menu` use it; a later
+`mac::install` replaces the minimal app menu, and a second `mac::install` returns `None`.
+`craft_quit::install_app_menu` is deprecated in favor of `mac::install_app_menu`: it sets its own
+handler, so an app calls it or craft-menu's installers, never both. Called first, it leaves
+craft-menu's menus without events; called after, it replaces their menu bar. Quit is
+never AppKit's predefined Quit: it is the app's item tagged `ItemRole::Quit`, or the item with
+`craft_quit::QUIT_MENU_ID`, which runs `craft_quit::on_menu_event` (the window is asked to close,
+so the app's unsaved-changes prompt runs). Each menu event wakes egui, so a chosen item runs at
+once rather than with the next input event.
+
+The backend calls AppKit's Window and Help menu hooks for the menus with `MenuRole::Window` and
+`MenuRole::Help`; it never looks at titles. Services is AppKit's own submenu. AppKit's Window
+menu lists the app's windows after the menu's own items. An app that keeps its documents in one
+window and lists them in the Window menu itself (`MenuBar::documents`) would see each twice, so it
+installs with
+`mac::install_with(ctx, &bar, MacOptions::default().window_list(false))`.
+
+Only shortcuts with ⌘ or ⌃ become key equivalents. The others (`B`, `⇧B`, `⌥B`, a bare `F5`) are
+tool keys the app handles itself; as key equivalents AppKit would take them from text fields.
+The native menu does not show them: muda 0.21 gives no access to the `NSMenuItem`, and its
+`set_attributed_title` needs an `NSAttributedString` with a font and a right tab stop, which
+objc2 builds only through `unsafe` calls, and the workspace forbids unsafe code. The egui bar
+shows them in its shortcut column.
+
+Check and radio items are AppKit check items. AppKit flips one when it is chosen; the next sync
+sets it back to the app's state, so the app's state always wins.
+
+While a menu is open, a click or Escape in the window closes it and does not reach egui (no
+canvas gesture, no tool action); pointer moves pass through. Only one click is kept this way
+until the menu reports closed, so a menu wrongly reported open costs one click. Menu updates wait
+until the menu closes. A rebuild that fails keeps the menus as they were.
+
+## Per frame
+
+Key equivalents stay with egui: the backend reports them as `Event::Key`, and `raw_input` feeds
+each one to egui as egui-winit would have, so the app's own key handling (text fields, dialogs,
+tool-specific undo) runs as without a native menu. ⌘C, ⌘X and ⌘V become egui's Copy, Cut and
+Paste (`ClipboardKeys::Egui`, the default), so text fields copy and paste; an app that runs its
+clipboard commands from the keys itself sets `menu.clipboard_keys(ClipboardKeys::Raw)` to get
+key presses. A shortcut the layout assigned (⌘Q on the app's Quit item, ⌘, on Settings) comes
+back as a click instead, since the app's key handling doesn't bind it.
+
+The app tells the menu what may run with a `Gate`, every frame (`set_gate`):
+
+| Gate field | Effect on the native menu |
+| --- | --- |
+| `modal` | The app's items are greyed (updated in place) and their clicks dropped, also clicks that arrived before the dialog opened. Hide, Hide Others, Minimize and Quit stay, and so do the items whose shortcut a text field handles (Undo, Copy, Select All): AppKit doesn't pass a disabled item's key equivalent on, so ⌘C and ⌘Z would die in the dialog's fields. |
+| `recording_shortcut` | As `modal`, and every key equivalent reaches egui as the plain key press (⌘Q, ⌘H, ⌘C included), so the recorder sees it. |
+| `text_editing` | A key equivalent comes back as a click (⌘S saves while typing), except the keys the field handles itself: ⌘C, ⌘X and ⌘V (as `ClipboardKeys` says) and `craft_keymap::text_editing_chords` (⌘A, ⌘Z, ⇧⌘Z, ⌘←, …). A mouse click on one of those items (Edit › Copy, Undo) is a press and release of its shortcut, so it acts on the field. |
+
+Each frame, in this order:
+
+1. `raw_input`, before egui reads the input (`eframe::App::raw_input_hook`). It uses the gate
+   from the last `set_gate`.
+2. `set_gate`, with the app's state for this frame.
+3. `take_clicks`, and run the commands it returns: the clicks since the last frame that the gate
+   allows now. Minimize and Quit are already handled.
+4. `sync_with`, which lays the menus out again only when the app's state changed or a menu event
+   arrived, and re-syncs them in place when the gate changed.
+
+```rust
+// eframe::App::raw_input_hook, before egui reads the input:
+if let Some(menu) = &mut self.native_menu {
+    menu.raw_input(raw_input);
+}
+
+// In the frame:
+if let Some(menu) = &mut self.native_menu {
+    menu.set_gate(Gate {
+        modal: self.dialog.is_some(),
+        recording_shortcut: self.shortcut_editor.is_recording(),
+        text_editing: ctx.wants_keyboard_input(),
+    });
+    for command in menu.take_clicks(ctx) {
+        self.run_command(ctx, &command);
+    }
+    let state = self.menu_state_hash(craft_menu::had_input(ctx).then_some(ctx.cumulative_frame_nr()));
+    for c in menu.sync_with(state, || craft_menu::mac_layout(&self.menu_bar(), &LayoutOptions::new("PhotoCraft"))) {
+        log::info!("menu: {} is {} on macOS and {} in the app; {}", c.shortcut, c.system, c.command, c.resolution);
+    }
+}
+```
+
+`sync_with` builds the layout only when `state` changed or a menu event arrived, because
+building the rows usually walks every command's enabled state. The backend then updates labels,
+enabled and checked in place and rebuilds only when `structure_key` (or, for the open
+documents, `window_key`) changes. Adding or removing an item in a dynamic list (recent files,
+workspaces, plugins) changes `structure_key`; relabelling one doesn't. An item that was a check
+item once stays one, unchecked, when the app's state stops giving it a checked state, so that
+doesn't rebuild the menus.
+
+`state` must cover everything the menus show. A change that comes without input, such as a load
+or save finishing on a worker or a timer, leaves the menus stale until the next input or menu
+event unless it is in the hash. An app that can't keep the hash complete calls
+`menu.sync(layout)` instead, with the layout built every frame: it is compared with the last
+one and synced only when it differs.
+
+An app that needs a click while egui is idle (to wake its own loop, or hand the command to a
+worker) sets `menu.on_command(Box::new(|command| ..))`. The hook runs from the menu event
+handler as the click arrives, on the main thread, for the app commands the gate allows; key
+equivalents reported as key presses and the built-in items don't reach it. It returns `true`
+when it ran the command; `take_clicks` leaves those out and returns the others.
diff --git a/crates/menu/src/bar/keys.rs b/crates/menu/src/bar/keys.rs
new file mode 100644
index 00000000..ba79290b
--- /dev/null
+++ b/crates/menu/src/bar/keys.rs
@@ -0,0 +1,414 @@
+//! The bar from the keyboard, as a Windows menu bar: a tap on Alt (or F10) puts the keyboard on
+//! the bar (the first title lit; ← / → move along it, ↓ / ↩ / Space open the lit menu, Esc or a
+//! click leaves), Alt+letter opens the menu with that mnemonic straight away, and in an open menu
+//! a letter runs the row with that mnemonic (or opens its submenu).
+//!
+//! Mnemonics are underlined while Alt is held, the bar is focused or a menu was opened from the
+//! keyboard; a menu opened with the mouse shows none until Alt is pressed, as Windows does.
+//! They are assigned per menu level from the labels as shown (so translated), unique within
+//! the level: the app's preferred letter where the label has it, else the first unused letter,
+//! word starts first. Only ASCII letters and digits are keys the keyboard reports as such, so a
+//! label without one (Japanese, Chinese…) shows its English label's letter after it, as Windows
+//! menus do in those languages: "文件(F)" ([`localized`]).
+//!
+//! On a Mac target none of this runs: Option is a typing key there.
+
+use egui::{Color32, Event, Id, Key, Modifiers, Stroke, TextFormat};
+
+use craft_keymap::CommandRef;
+
+use super::nav::{Nav, is_open};
+use crate::Gate;
+
+/// Keyboard state of the bar between frames.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct Keys {
+    /// The title the keyboard is on with no menu open, in screen order (Alt tap, F10).
+    pub focus: Option<usize>,
+    /// Underline the mnemonics: the bar is focused or a menu was opened from the keyboard.
+    pub underline: bool,
+    /// Alt is down (from its key events, whatever the platform reports as modifiers).
+    alt_down: bool,
+    /// Alt went down and nothing else was pressed since: releasing it is a tap.
+    alt_tap: bool,
+    /// The mouse buttons that are down, one bit each, from the button events in order (the
+    /// frame's pointer state is its end state, which a whole click within one frame doesn't show).
+    buttons_held: u8,
+    /// A menu was just opened from the keyboard: light its first row once it is drawn.
+    first_row: bool,
+}
+
+fn focus_id() -> Id {
+    Id::unique("craft-menu-bar-focus")
+}
+
+fn leave_id() -> Id {
+    Id::unique("craft-menu-bar-leave")
+}
+
+/// Whether the keyboard is on the bar (Alt tap or F10, no menu open yet). The app's shortcuts
+/// leave the keys to it meanwhile, as they do for an open menu ([`super::is_open`]): ← / → / ↓ /
+/// ↩ / Esc and the letters drive the bar. Call [`leave_for_shortcut`] first so that a command
+/// shortcut still runs.
+pub fn is_focused(ctx: &egui::Context) -> bool {
+    let pass = ctx.cumulative_pass_nr();
+    ctx.data(|d| d.get_temp::<u64>(focus_id())).is_some_and(|seen| seen + 2 >= pass)
+}
+
+/// A command shortcut pressed while the keyboard is on the bar with no menu open (Ctrl+S, F7…)
+/// takes it off the bar, so the shortcut runs in the same press, as in a native menu bar. Keys
+/// the bar uses (arrows, ↩, Esc, letters, Alt+letter, F10) keep driving it, and an open menu
+/// still holds the keys. True when the bar was left: [`is_focused`] is false from then on.
+pub fn leave_for_shortcut(ctx: &egui::Context) -> bool {
+    if !is_focused(ctx) || is_open(ctx) {
+        return false;
+    }
+    let shortcut =
+        ctx.input(|i| i.events.iter().any(|e| matches!(e, Event::Key { key, pressed: true, modifiers, .. } if is_command_key(*key, *modifiers))));
+    if !shortcut {
+        return false;
+    }
+    ctx.data_mut(|d| {
+        d.remove::<u64>(focus_id());
+        d.insert_temp(leave_id(), true);
+    });
+    ctx.request_repaint();
+    true
+}
+
+/// A key press that is a command shortcut rather than a key of the bar: Cmd / Ctrl with a key
+/// (not the modifier keys themselves), or a function key other than F10 (which toggles the bar).
+pub(crate) fn is_command_key(key: Key, mods: Modifiers) -> bool {
+    let modifier_key = matches!(
+        key,
+        Key::ShiftLeft | Key::ShiftRight | Key::ControlLeft | Key::ControlRight | Key::AltLeft | Key::AltRight | Key::SuperLeft | Key::SuperRight
+    );
+    if modifier_key {
+        return false;
+    }
+    let function_key = key != Key::F10 && key.name().strip_prefix('F').is_some_and(|n| !n.is_empty() && n.bytes().all(|b| b.is_ascii_digit()));
+    mods.command || mods.ctrl || mods.mac_cmd || function_key
+}
+
+/// The mnemonic a key press stands for: the letter or digit of a plain key.
+pub(crate) fn key_char(key: Key) -> Option<char> {
+    let name = key.name();
+    let mut chars = name.chars();
+    match (chars.next(), chars.next()) {
+        (Some(c), None) if c.is_ascii_alphanumeric() => Some(c.to_ascii_uppercase()),
+        _ => None,
+    }
+}
+
+/// Mnemonics for `labels`, unique within the group: the preferred letter when the label has it,
+/// else the first unused ASCII letter or digit, trying the first character of each word before
+/// the others. Compared case-insensitively; the returned letter is upper case.
+pub(crate) fn assign(labels: &[&str], preferred: &[Option<char>]) -> Vec<Option<char>> {
+    let mut used: Vec<char> = Vec::new();
+    let mut out = Vec::with_capacity(labels.len());
+    for (i, label) in labels.iter().enumerate() {
+        let upper: Vec<char> = label.chars().map(|c| c.to_ascii_uppercase()).collect();
+        let has = |c: char| upper.contains(&c.to_ascii_uppercase());
+        let mut pick = preferred.get(i).copied().flatten().map(|c| c.to_ascii_uppercase()).filter(|&c| has(c) && !used.contains(&c));
+        if pick.is_none() {
+            let starts = label.split(|c: char| !c.is_alphanumeric()).filter_map(|w| w.chars().next());
+            let rest = label.chars();
+            pick = starts.chain(rest).filter(char::is_ascii_alphanumeric).map(|c| c.to_ascii_uppercase()).find(|c| !used.contains(c));
+        }
+        if let Some(c) = pick {
+            used.push(c);
+        }
+        out.push(pick);
+    }
+    out
+}
+
+/// The labels to show and their mnemonics for `labels` as the app shows them, whose English
+/// originals are `english` (same order; `None` when the app gave none). A label with an ASCII
+/// letter or digit keeps its text and is assigned as [`assign`] does. One without (Chinese,
+/// Japanese, Korean…) can't be typed on its own, so it shows its English label's letter after it
+/// in parentheses and takes that letter, as Windows menus do in those languages ("文件(F)").
+/// Without an English label it keeps its text and gets no mnemonic. Mnemonics stay unique within
+/// the group, and a shown "(F)" is always the row's key.
+pub(crate) fn localized(labels: &[&str], english: &[Option<String>], preferred: &[Option<char>]) -> (Vec<String>, Vec<Option<char>>) {
+    let typed = |l: &str| l.chars().any(|c| c.is_ascii_alphanumeric());
+    // The key goes before a trailing ellipsis, as Windows writes it: "新建(N)…".
+    let with_key = |l: &str, k: char| match l.strip_suffix('…').map(|b| (b, "…")).or_else(|| l.strip_suffix("...").map(|b| (b, "..."))) {
+        Some((base, tail)) => format!("{base}({k}){tail}"),
+        None => format!("{l}({k})"),
+    };
+    // Labels without an English one take part with a letterless stand-in, so the others keep
+    // their places.
+    let english: Vec<&str> = english.iter().map(|e| e.as_deref().unwrap_or("")).collect();
+    let english_keys = assign(&english, preferred);
+    let mut shown = Vec::with_capacity(labels.len());
+    let mut pref = Vec::with_capacity(labels.len());
+    for (i, label) in labels.iter().enumerate() {
+        match english_keys.get(i).copied().flatten().filter(|_| !typed(label)) {
+            Some(k) => {
+                shown.push(with_key(label, k));
+                pref.push(Some(k));
+            }
+            None => {
+                shown.push((*label).to_owned());
+                pref.push(preferred.get(i).copied().flatten());
+            }
+        }
+    }
+    // The suffixed labels take their keys first: a label with letters of its own must not take
+    // the key a suffix shows ("Camera Raw 滤镜…" before "转换为智能滤镜(C)" leaves C to the latter).
+    let suffixed = |i: &usize| shown.get(*i).map(String::as_str) != labels.get(*i).copied();
+    let order: Vec<usize> = (0..shown.len()).filter(suffixed).chain((0..shown.len()).filter(|i| !suffixed(i))).collect();
+    let ordered: Vec<&str> = order.iter().map(|&i| shown.get(i).map_or("", String::as_str)).collect();
+    let ordered_pref: Vec<Option<char>> = order.iter().map(|&i| pref.get(i).copied().flatten()).collect();
+    let mut keys = vec![None; shown.len()];
+    for (&i, key) in order.iter().zip(assign(&ordered, &ordered_pref)) {
+        if let Some(slot) = keys.get_mut(i) {
+            *slot = key;
+        }
+    }
+    (shown, keys)
+}
+
+/// Append `label` to `job` after `lead` points, with the first occurrence of `mnemonic`
+/// (case-insensitively) underlined.
+pub(crate) fn append_underlined(job: &mut egui::text::LayoutJob, label: &str, mut lead: f32, mnemonic: Option<char>, format: &TextFormat) {
+    let at = mnemonic.and_then(|m| label.char_indices().find(|(_, c)| c.to_ascii_uppercase() == m).map(|(i, c)| (i, c.len_utf8())));
+    let parts = match at {
+        Some((i, len)) => [label.get(..i), label.get(i..i + len), label.get(i + len..)],
+        None => [Some(label), None, None],
+    };
+    let mut any = false;
+    for (k, part) in parts.into_iter().enumerate() {
+        let Some(part) = part.filter(|p| !p.is_empty()) else { continue };
+        let underline = if k == 1 { Stroke::new(1.0, format.color) } else { Stroke::NONE };
+        job.append(part, lead, TextFormat { underline, ..format.clone() });
+        lead = 0.0;
+        any = true;
+    }
+    if !any {
+        // An empty label still keeps its lead.
+        job.append("", lead, format.clone());
+    }
+}
+
+/// A title's text: `label` in `color`, its mnemonic underlined.
+pub(crate) fn title_text(ui: &egui::Ui, label: &str, mnemonic: Option<char>, color: Color32) -> egui::WidgetText {
+    let font = egui::TextStyle::Button.resolve(ui.style());
+    let mut job = egui::text::LayoutJob::default();
+    job.wrap.max_width = f32::INFINITY;
+    append_underlined(&mut job, label, 0.0, mnemonic, &TextFormat { font_id: font, color, ..Default::default() });
+    job.into()
+}
+
+/// Take `key` (with `mods`) out of this frame's events, and the text it typed: a letter the bar
+/// used doesn't also land in a text field.
+fn consume_letter(ctx: &egui::Context, mods: Modifiers, key: Key, c: char) {
+    ctx.input_mut(|i| {
+        i.consume_key(mods, key);
+        i.events.retain(|e| !matches!(e, Event::Text(t) if t.chars().count() == 1 && t.chars().all(|t| t.to_ascii_uppercase() == c)));
+    });
+}
+
+impl Keys {
+    /// Last frame's state, without the focus when [`leave_for_shortcut`] took it.
+    pub fn load(ctx: &egui::Context, id: Id) -> Keys {
+        let mut keys: Keys = ctx.data(|d| d.get_temp(id)).unwrap_or_default();
+        if ctx.data_mut(|d| d.remove_temp::<bool>(leave_id())).unwrap_or(false) {
+            keys.focus = None;
+            keys.underline = false;
+        }
+        keys
+    }
+
+    /// The state as the last frame left it.
+    #[cfg(test)]
+    pub fn current(ctx: &egui::Context, id: Id) -> Keys {
+        ctx.data(|d| d.get_temp(id)).unwrap_or_default()
+    }
+
+    pub fn store(self, ctx: &egui::Context, id: Id) {
+        let pass = ctx.cumulative_pass_nr();
+        ctx.data_mut(|d| {
+            if self.focus.is_some() {
+                d.insert_temp(focus_id(), pass);
+            } else {
+                d.remove::<u64>(focus_id());
+            }
+            d.insert_temp(id, self);
+        });
+    }
+
+    /// Underline the mnemonics this frame?
+    pub fn show_underlines(&self, ctx: &egui::Context) -> bool {
+        self.underline || self.focus.is_some() || self.alt_down || ctx.input(|i| i.modifiers.alt)
+    }
+
+    /// Before drawing: a menu just opened from the keyboard lights its first row (once, when it
+    /// is drawn); with no menu open and the keyboard off the bar, nothing is underlined any more.
+    pub fn begin(&mut self, nav: &mut Nav) {
+        if nav.top.is_some() {
+            if self.first_row {
+                nav.highlight_first(0);
+                self.first_row = false;
+            }
+        } else if self.focus.is_none() && !self.first_row {
+            self.underline = false;
+        }
+    }
+
+    /// Off: a Mac target, or a dialog or the shortcut recorder has the keys. Forget the focus
+    /// and any tap in progress.
+    pub fn off(&mut self) {
+        *self = Keys { buttons_held: self.buttons_held, ..Keys::default() };
+    }
+
+    /// Handle this frame's keys, after the menus were drawn and [`Nav::keys`] took the arrows.
+    /// `tops` are the titles' popup ids and `mnemonics` their letters, both in screen order;
+    /// `nav` is the open menu's state. A command a mnemonic ran lands in `clicked`.
+    pub fn keys(
+        &mut self,
+        ctx: &egui::Context,
+        gate: Gate,
+        tops: &[Id],
+        mnemonics: &[Option<char>],
+        nav: &mut Nav,
+        clicked: &mut Option<CommandRef>,
+    ) {
+        if tops.is_empty() {
+            return;
+        }
+        let events = ctx.input(|i| i.events.clone());
+        let mut tap = false;
+        // The tap is judged on every event of the frame, also those another handler consumed
+        // before the bar's turn: a shortcut such as Ctrl+Alt+I that ran first leaves no trace in
+        // `events`, and releasing Alt must not then count as a tap.
+        let raw = ctx.input(|i| i.raw.events.clone());
+        for e in &raw {
+            match e {
+                Event::Key { key: Key::AltLeft | Key::AltRight, pressed: true, .. } => {
+                    self.alt_down = true;
+                    // Alt pressed while a mouse button is down is a modifier for that drag, never
+                    // a tap.
+                    self.alt_tap = self.buttons_held == 0;
+                }
+                Event::Key { key: Key::AltLeft | Key::AltRight, pressed: false, .. } => {
+                    self.alt_down = false;
+                    tap |= std::mem::take(&mut self.alt_tap);
+                }
+                // A click or the end of a drag while Alt is held is no tap. It also cancels a tap
+                // taken earlier in this frame: a whole drag can arrive in one frame (press, Alt
+                // down, Alt up, release).
+                Event::PointerButton { button, pressed, .. } => {
+                    let bit = 1u8 << (*button as u8);
+                    if *pressed {
+                        self.buttons_held |= bit;
+                    } else {
+                        self.buttons_held &= !bit;
+                    }
+                    self.alt_tap = false;
+                    tap = false;
+                }
+                // Alt going to the desktop is no tap, and a button let go out there is up.
+                Event::WindowFocused(false) => {
+                    self.alt_tap = false;
+                    self.buttons_held = 0;
+                }
+                // Alt+wheel (zoom, say) is no tap either.
+                Event::Key { pressed: true, .. } | Event::Text(_) | Event::MouseWheel { .. } => self.alt_tap = false,
+                _ => {}
+            }
+        }
+        if events.iter().any(|e| matches!(e, Event::PointerButton { pressed: true, .. })) {
+            self.focus = None;
+            self.underline = false;
+        }
+        let open = nav.top.is_some();
+        let n = tops.len();
+        let open_top = |i: usize, keys: &mut Keys| {
+            if let Some(&id) = tops.get(i) {
+                egui::Popup::open_id(ctx, id);
+                keys.focus = None;
+                keys.underline = true;
+                keys.first_row = true;
+                ctx.request_repaint();
+            }
+        };
+        // Alt+letter opens that menu, open or not (an open one switches), as on Windows.
+        let alt_letter = events.iter().find_map(|e| match e {
+            Event::Key { key, pressed: true, modifiers, .. } if modifiers.alt && !modifiers.command && !modifiers.ctrl => {
+                key_char(*key).map(|c| (*key, c))
+            }
+            _ => None,
+        });
+        if let Some((key, c)) = alt_letter
+            && let Some(i) = mnemonics.iter().position(|m| *m == Some(c))
+        {
+            consume_letter(ctx, Modifiers::ALT, key, c);
+            self.alt_tap = false;
+            open_top(i, self);
+            return;
+        }
+        let letter = || {
+            events.iter().find_map(|e| match e {
+                Event::Key { key, pressed: true, modifiers, .. } if !modifiers.command && !modifiers.ctrl && !modifiers.alt && !modifiers.mac_cmd => {
+                    key_char(*key).map(|c| (*key, c))
+                }
+                _ => None,
+            })
+        };
+        if open {
+            // A letter runs the row with that mnemonic in the level the arrows are in, a text
+            // field having the keys or not: the open menu has them.
+            if let Some((key, c)) = letter()
+                && let Some(row) = nav.row_with_mnemonic(c)
+            {
+                consume_letter(ctx, Modifiers::NONE, key, c);
+                self.underline = true;
+                if let Some(cmd) = row.command.clone() {
+                    *clicked = Some(cmd);
+                    egui::Popup::close_all(ctx);
+                } else {
+                    nav.open_sub_row(ctx, row.widget);
+                }
+                ctx.request_repaint();
+            }
+            if tap {
+                egui::Popup::close_all(ctx);
+                self.underline = false;
+                ctx.request_repaint();
+            }
+            return;
+        }
+        // No menu open: Alt (tapped) or F10 puts the keyboard on the bar or takes it off again.
+        let f10 = ctx.input_mut(|i| i.consume_key(Modifiers::NONE, Key::F10));
+        if tap || f10 {
+            self.focus = if self.focus.is_some() { None } else { Some(0) };
+            self.underline = false;
+            ctx.request_repaint();
+            return;
+        }
+        let Some(focus) = self.focus.map(|f| f.min(n - 1)) else { return };
+        let press = |k: Key| ctx.input_mut(|i| i.consume_key(Modifiers::NONE, k));
+        if press(Key::Escape) {
+            self.focus = None;
+        } else if press(Key::ArrowRight) {
+            self.focus = Some((focus + 1) % n);
+        } else if press(Key::ArrowLeft) {
+            self.focus = Some((focus + n - 1) % n);
+        } else if press(Key::ArrowDown) || press(Key::Enter) || press(Key::Space) {
+            open_top(focus, self);
+        } else if let Some((key, c)) = letter() {
+            if gate.text_editing {
+                // Typing goes on in the text field, and the keyboard leaves the bar for it.
+                self.focus = None;
+            } else if let Some(i) = mnemonics.iter().position(|m| *m == Some(c)) {
+                consume_letter(ctx, Modifiers::NONE, key, c);
+                open_top(i, self);
+            }
+        } else {
+            return;
+        }
+        ctx.request_repaint();
+    }
+}
diff --git a/crates/menu/src/bar/mod.rs b/crates/menu/src/bar/mod.rs
new file mode 100644
index 00000000..d034b9ad
--- /dev/null
+++ b/crates/menu/src/bar/mod.rs
@@ -0,0 +1,705 @@
+//! The menu bar drawn with egui, for Windows, Linux and the web (and macOS, for testing): an
+//! already laid-out [`MenuBar`] as a row of menu titles whose menus open below them.
+//!
+//! A press on a title opens its menu (releasing over an item runs it, as in a native bar), a
+//! second press or Esc closes it, and while one is open the pointer moving onto another title
+//! opens that one. Submenus open on hover and stay open while the pointer heads for them. Tall
+//! menus scroll, and the arrow keys, ↩ and Space drive an open menu ([`nav`]). Except on a Mac
+//! target, a tap on Alt or F10 puts the keyboard on the bar and the menus have mnemonics, as on
+//! Windows ([`keys`]). When the titles don't fit, the last ones move into a trailing "⋯" menu,
+//! or all of them into one "Menu".
+
+pub(crate) mod keys;
+pub(crate) mod nav;
+
+use craft_keymap::{CommandRef, Platform};
+use egui::accesskit::{HasPopup, Role, Toggled};
+use egui::containers::menu::{MenuConfig, MenuState, SubMenu, SubMenuButton};
+use egui::text::LayoutJob;
+use egui::{Color32, Id, PopupCloseBehavior, Response, TextFormat, TextStyle, Ui, UiKind, UiStackInfo, WidgetText};
+
+use crate::model::Builtin;
+use crate::{Gate, Item, ItemKind, Menu, MenuBar, Node, Target};
+use keys::Keys;
+use nav::Nav;
+
+pub use keys::{is_focused, leave_for_shortcut};
+pub use nav::is_open;
+
+/// A row or title, as the bar names it to the app's mnemonic hooks ([`MenuBarUi::english`]).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Labeled<'s> {
+    /// An item, by its command.
+    Command(&'s CommandRef),
+    /// A menu or submenu, by its title as shown.
+    Title(&'s str),
+}
+
+/// The app's English labels ([`MenuBarUi::english`]).
+type EnglishHook<'h> = dyn Fn(Labeled<'_>) -> Option<String> + 'h;
+
+/// How the bar looks. [`BarStyle::from_style`] takes its defaults from an egui style.
+#[derive(Clone, Debug, PartialEq)]
+pub struct BarStyle {
+    /// Padding around a menu title.
+    pub title_padding: egui::Vec2,
+    /// The menu titles' text color.
+    pub title_color: Color32,
+    /// The narrowest a menu is.
+    pub menu_width: f32,
+    /// Room a separator takes: the line and the space above and below it.
+    pub separator_spacing: f32,
+    /// Shown before the label of a checked check item.
+    pub check_mark: String,
+    /// Shown before the label of the selected radio item.
+    pub radio_mark: String,
+}
+
+impl BarStyle {
+    /// Title padding, title color and a menu width in step with the row height, from `style`.
+    pub fn from_style(style: &egui::Style) -> BarStyle {
+        BarStyle {
+            title_padding: style.spacing.button_padding,
+            title_color: style.visuals.widgets.inactive.text_color(),
+            // egui's `menu_width` is where menu text wraps, far wider than a menu needs.
+            menu_width: 12.0 * style.spacing.interact_size.y,
+            separator_spacing: 9.0,
+            check_mark: "✓".to_owned(),
+            radio_mark: "●".to_owned(),
+        }
+    }
+}
+
+impl Default for BarStyle {
+    fn default() -> BarStyle {
+        BarStyle::from_style(&egui::Style::default())
+    }
+}
+
+/// The platform whose key names a target's shortcut column shows; for the web, the one the
+/// browser runs on (`os`, [`egui::Context::os`]).
+fn keymap_platform(target: Target, os: egui::os::OperatingSystem) -> Platform {
+    use egui::os::OperatingSystem;
+    match target {
+        Target::Mac => Platform::Mac,
+        Target::Windows => Platform::Windows,
+        Target::Linux => Platform::Linux,
+        Target::Web => match os {
+            OperatingSystem::Mac | OperatingSystem::IOS => Platform::Mac,
+            OperatingSystem::Windows => Platform::Windows,
+            _ => Platform::Linux,
+        },
+    }
+}
+
+fn english(label: &'static str) -> String {
+    label.to_owned()
+}
+
+/// The bar for one frame: `MenuBarUi::new(&bar).gate(gate).show(ui)` returns the commands
+/// chosen. Draw it at the top of the window, in a top panel.
+pub struct MenuBarUi<'a> {
+    bar: &'a MenuBar,
+    gate: Gate,
+    target: Target,
+    style: Option<BarStyle>,
+    label: &'a dyn Fn(&'static str) -> String,
+    english: Option<&'a EnglishHook<'a>>,
+    preferred: &'a [(&'a str, char)],
+    id: Id,
+    fit: Option<f32>,
+}
+
+impl<'a> MenuBarUi<'a> {
+    /// The bar for `bar`, already laid out ([`crate::layout`]), on [`Target::current`].
+    pub fn new(bar: &'a MenuBar) -> MenuBarUi<'a> {
+        MenuBarUi {
+            bar,
+            gate: Gate::default(),
+            target: Target::current(),
+            style: None,
+            label: &english,
+            english: None,
+            preferred: &[],
+            id: Id::unique("craft-menu-bar"),
+            fit: None,
+        }
+    }
+
+    /// What may run this frame: the items `gate` forbids ([`Gate::allows`]) are drawn and
+    /// behave as disabled.
+    pub fn gate(mut self, gate: Gate) -> MenuBarUi<'a> {
+        self.gate = gate;
+        self
+    }
+
+    /// The platform the bar is on, for the shortcut column ([`craft_keymap::Chord::display`]): ⌘
+    /// glyphs on [`Target::Mac`] and in a browser on a Mac ([`egui::Context::os`]), Ctrl names
+    /// everywhere else. Where the names are a Mac's, the bar has no mnemonics.
+    pub fn target(mut self, target: Target) -> MenuBarUi<'a> {
+        self.target = target;
+        self
+    }
+
+    /// The bar's look; [`BarStyle::from_style`] of the `Ui` by default.
+    pub fn style(mut self, style: BarStyle) -> MenuBarUi<'a> {
+        self.style = Some(style);
+        self
+    }
+
+    /// The app's translation of the labels the bar writes itself: `⋯` (the menu of titles that
+    /// don't fit), `Menu` (the one menu when none fits), `Scroll menu up` and `Scroll menu down`
+    /// (the scroll arrows' accessible names). The same hook as [`crate::LayoutOptions::label`].
+    pub fn label(mut self, label: &'a dyn Fn(&'static str) -> String) -> MenuBarUi<'a> {
+        self.label = label;
+        self
+    }
+
+    /// The English label of a row or title, for labels the keyboard can't type a letter of
+    /// (Chinese, Japanese, Korean…): such a label shows its English label's mnemonic after it,
+    /// "文件(F)", before a trailing ellipsis ("開く(O)…"), as Windows menus do. Without this hook (or when it returns `None`) such a label
+    /// has no mnemonic. Not asked on a Mac target, which has no mnemonics.
+    pub fn english(mut self, english: &'a dyn Fn(Labeled<'_>) -> Option<String>) -> MenuBarUi<'a> {
+        self.english = Some(english);
+        self
+    }
+
+    /// Preferred mnemonics, each for a menu or submenu by its title as shown or for an item by
+    /// its command id: the row takes that letter when its label has it and no row before it in
+    /// its menu took it. Every other row takes the first unused letter of its label, word starts
+    /// first.
+    pub fn mnemonics(mut self, preferred: &'a [(&'a str, char)]) -> MenuBarUi<'a> {
+        self.preferred = preferred;
+        self
+    }
+
+    /// Take only the width the titles need, at most `max_width` (`f32::INFINITY` for no limit)
+    /// and the room the `Ui` has, so that other controls can share the row; past that the menus
+    /// overflow into "⋯". By default the bar fills the row.
+    pub fn shrink_to_fit(mut self, max_width: f32) -> MenuBarUi<'a> {
+        self.fit = Some(max_width);
+        self
+    }
+
+    /// The bar's id, where its state lives in egui memory: tells two bars in one window apart.
+    pub fn id(mut self, id: Id) -> MenuBarUi<'a> {
+        self.id = id;
+        self
+    }
+
+    /// Draw the bar and its open menu; returns the commands chosen this frame (at most one),
+    /// clicked or run with ↩ or Space. Disabled items, and items the gate forbids, never run.
+    /// [`Builtin::Quit`] (asks the window to close, see [`craft_quit::on_menu_event`]) and
+    /// [`Builtin::Minimize`] run here and are left out.
+    pub fn show(self, ui: &mut Ui) -> Vec<CommandRef> {
+        let ctx = ui.ctx().clone();
+        let style = self.style.clone().unwrap_or_else(|| BarStyle::from_style(ui.style()));
+        let nav_id = self.id.with("nav");
+        let mut nav = Nav::load(&ctx, nav_id);
+        let keys_id = self.id.with("keys");
+        let mut keys = Keys::load(&ctx, keys_id);
+        // Option is a typing key on a Mac, also in a browser there; a dialog or the shortcut
+        // recorder has the keys.
+        let platform = keymap_platform(self.target, ctx.os());
+        let mnemonics = platform != Platform::Mac;
+        let keys_on = mnemonics && !self.gate.modal && !self.gate.recording_shortcut;
+        if keys_on {
+            keys.begin(&mut nav);
+            nav.underline = keys.show_underlines(&ctx);
+        } else {
+            keys.off();
+        }
+        let mut draw = Draw {
+            gate: self.gate,
+            platform,
+            style: &style,
+            label: self.label,
+            mnemonics,
+            english: self.english,
+            preferred: self.preferred,
+            press: self.id.with("press"),
+            clicked: None,
+        };
+        let room = self.fit.map_or(ui.available_width(), |max| max.min(ui.available_width())).max(0.0);
+        let width = match self.fit {
+            // The half point keeps rounding from pushing the last title into "⋯".
+            Some(_) => (self.title_widths(ui, &draw, style.title_padding.x).iter().sum::<f32>() + 0.5).min(room),
+            None => room,
+        };
+        ui.allocate_ui(egui::vec2(width, ui.available_height()), |ui| {
+            ui.spacing_mut().item_spacing.x = 0.0;
+            egui::MenuBar::new().ui(ui, |ui| {
+                ctx.accesskit_node_builder(ui.unique_id(), |n| n.set_role(Role::MenuBar));
+                ui.spacing_mut().button_padding = style.title_padding;
+                nav.bar_bottom = Some(ui.max_rect().bottom());
+                let tops = self.tops(ui, &draw);
+                let names: Vec<(&str, Name<'_>)> = tops.iter().map(Top::name).collect();
+                let (titles, title_keys) = draw.mnemonics(&names);
+                let mut buttons = Vec::with_capacity(tops.len());
+                for (k, top) in tops.iter().enumerate() {
+                    let shown = titles.get(k).map_or(top.title(), String::as_str);
+                    let mnemonic = title_keys.get(k).copied().flatten();
+                    let text: WidgetText = if nav.underline {
+                        keys::title_text(ui, shown, mnemonic, style.title_color)
+                    } else {
+                        egui::RichText::new(shown).color(style.title_color).into()
+                    };
+                    let mut button = egui::Button::new(text);
+                    if keys.focus == Some(k) {
+                        // The title the keyboard is on is lit like a hovered one.
+                        button = button.fill(ui.visuals().widgets.hovered.weak_bg_fill);
+                    }
+                    let title = ui.add(button);
+                    let open_now = egui::Popup::is_id_open(&ctx, egui::Popup::default_response_id(&title));
+                    ctx.accesskit_node_builder(title.id, |n| {
+                        n.set_role(Role::MenuItem);
+                        n.set_label(shown);
+                        n.set_has_popup(HasPopup::Menu);
+                        n.set_expanded(open_now);
+                        if let Some(m) = mnemonic {
+                            n.set_access_key(m.to_string());
+                        }
+                    });
+                    // The bar's style, as a menu (not bar) config so that submenus inside draw as
+                    // submenus. Only a click outside closes the menus, as in a native menu: a
+                    // click on a disabled item or a separator leaves them open, and the item
+                    // that runs closes them itself.
+                    let bar = MenuConfig::find(ui);
+                    let config = MenuConfig::new().close_behavior(PopupCloseBehavior::CloseOnClickOutside).style(bar.style.clone());
+                    let open = title_press(&ctx, &title, draw.press);
+                    // The release ending the press that opened this menu is a click "outside"
+                    // the popup: it must not close it again.
+                    let opening = title.clicked() && ctx.data(|d| d.get_temp::<bool>(draw.press)).unwrap_or(false);
+                    let close = if opening { PopupCloseBehavior::IgnoreClicks } else { config.close_behavior };
+                    egui::Popup::menu(&title)
+                        .open_memory(open)
+                        .close_behavior(close)
+                        .style(config.style.clone())
+                        .info(UiStackInfo::new(UiKind::Menu).with_tag_value(MenuConfig::MENU_CONFIG_TAG, config))
+                        .show(|ui| {
+                            ctx.accesskit_node_builder(ui.unique_id(), |n| n.set_role(Role::Menu));
+                            ui.set_min_width(style.menu_width);
+                            let rows = match top {
+                                Top::Menu(m) => entries(&m.children),
+                                Top::Group(_, _, menus) => menus.iter().map(|m| Entry::Sub(&m.title, &m.children)).collect(),
+                            };
+                            draw.level(ui, 1, &rows, &mut nav);
+                        });
+                    buttons.push(title);
+                }
+                switch_on_hover(&ctx, &buttons);
+                let ids: Vec<Id> = buttons.iter().map(egui::Popup::default_response_id).collect();
+                nav.keys(&ctx, &ids, &mut draw.clicked);
+                if keys_on {
+                    keys.keys(&ctx, self.gate, &ids, &title_keys, &mut nav, &mut draw.clicked);
+                }
+            });
+        });
+        keys.store(&ctx, keys_id);
+        nav.store(&ctx, nav_id);
+        // The press-drag gesture ends with the button (its release was handled by the rows).
+        if ctx.input(|i| i.pointer.primary_released() || !i.pointer.primary_down()) {
+            ctx.data_mut(|d| d.remove::<bool>(draw.press));
+        }
+        draw.clicked
+            .into_iter()
+            .filter(|command| match Builtin::of(command) {
+                Some(Builtin::Quit) => !craft_quit::on_menu_event(&ctx, Builtin::Quit.id()),
+                Some(Builtin::Minimize) => {
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(true));
+                    false
+                }
+                _ => true,
+            })
+            .collect()
+    }
+
+    /// Each title's width as shown, with any "(F)" it takes, and `pad` on either side.
+    fn title_widths(&self, ui: &Ui, draw: &Draw<'_>, pad: f32) -> Vec<f32> {
+        let font = TextStyle::Button.resolve(ui.style());
+        let names: Vec<(&str, Name<'_>)> = self.bar.menus.iter().map(|m| (m.title.as_str(), Name::App(Labeled::Title(&m.title)))).collect();
+        draw.mnemonics(&names)
+            .0
+            .iter()
+            .map(|t| ui.painter().layout_no_wrap(t.to_owned(), font.clone(), Color32::PLACEHOLDER).size().x + 2.0 * pad)
+            .collect()
+    }
+
+    /// The titles to draw: every menu when they fit in the row; else the menus that fit with
+    /// room for a "⋯" menu holding the rest; else one "Menu" holding them all.
+    fn tops(&self, ui: &Ui, draw: &Draw<'_>) -> Vec<Top<'a>> {
+        let menus = &self.bar.menus;
+        let font = TextStyle::Button.resolve(ui.style());
+        let pad = 2.0 * ui.spacing().button_padding.x;
+        let width = |t: &str| ui.painter().layout_no_wrap(t.to_owned(), font.clone(), Color32::PLACEHOLDER).size().x + pad;
+        let room = ui.available_width();
+        let widths = self.title_widths(ui, draw, ui.spacing().button_padding.x);
+        if widths.iter().sum::<f32>() <= room {
+            return menus.iter().map(Top::Menu).collect();
+        }
+        let more = (self.label)("⋯");
+        let room = room - width(&more);
+        let mut used = 0.0;
+        let fit = widths
+            .iter()
+            .take_while(|w| {
+                used += **w;
+                used <= room
+            })
+            .count();
+        if fit == 0 {
+            return vec![Top::Group((self.label)("Menu"), "Menu", menus)];
+        }
+        let (shown, rest) = menus.split_at(fit);
+        shown.iter().map(Top::Menu).chain([Top::Group(more, "⋯", rest)]).collect()
+    }
+}
+
+/// A title of the bar: a menu, or the overflow menu (its title, translated and in English)
+/// holding whole menus as submenus.
+enum Top<'a> {
+    Menu(&'a Menu),
+    Group(String, &'static str, &'a [Menu]),
+}
+
+impl Top<'_> {
+    fn title(&self) -> &str {
+        match self {
+            Top::Menu(m) => &m.title,
+            Top::Group(title, ..) => title,
+        }
+    }
+
+    /// The title as shown, and what it is.
+    fn name(&self) -> (&str, Name<'_>) {
+        match self {
+            Top::Menu(m) => (&m.title, Name::App(Labeled::Title(&m.title))),
+            Top::Group(title, english, _) => (title, Name::Own(english)),
+        }
+    }
+}
+
+/// A row or title to assign a mnemonic to: one of the app's, or one the bar writes itself (by
+/// its English label).
+#[derive(Clone, Copy)]
+enum Name<'s> {
+    App(Labeled<'s>),
+    Own(&'static str),
+}
+
+/// A row of a menu level.
+#[derive(Clone, Copy)]
+enum Entry<'a> {
+    Item(&'a Item),
+    Separator,
+    Sub(&'a str, &'a [Node]),
+}
+
+/// The rows of `nodes`. AppKit's own items ([`Node::Standard`]) have nothing to run here and
+/// are left out; a desktop or web layout has none.
+fn entries(nodes: &[Node]) -> Vec<Entry<'_>> {
+    nodes
+        .iter()
+        .filter_map(|n| match n {
+            Node::Item(it) => Some(Entry::Item(it)),
+            Node::Separator => Some(Entry::Separator),
+            Node::Submenu { label, children, .. } => Some(Entry::Sub(label, children)),
+            Node::Standard { .. } => None,
+        })
+        .collect()
+}
+
+/// A submenu is enabled only while some item under it (at any depth) can run, so a submenu of
+/// disabled items is disabled too instead of opening onto them.
+fn any_enabled(nodes: &[Node], gate: Gate) -> bool {
+    nodes.iter().any(|n| match n {
+        Node::Item(it) => it.enabled && gate.allows(it),
+        Node::Submenu { children, .. } => any_enabled(children, gate),
+        Node::Separator | Node::Standard { .. } => false,
+    })
+}
+
+/// What the rows need while drawing, and the command chosen.
+struct Draw<'s> {
+    gate: Gate,
+    platform: Platform,
+    style: &'s BarStyle,
+    label: &'s dyn Fn(&'static str) -> String,
+    /// The target has mnemonics (not a Mac).
+    mnemonics: bool,
+    english: Option<&'s EnglishHook<'s>>,
+    preferred: &'s [(&'s str, char)],
+    /// Where the press-drag gesture's flag lives: a press on a title opened the menus and the
+    /// button is still down.
+    press: Id,
+    clicked: Option<CommandRef>,
+}
+
+impl Draw<'_> {
+    /// The labels to show for one menu level (or the titles) and their mnemonics, from the
+    /// labels as the app shows them ([`keys::localized`]). On a Mac target, the labels as they
+    /// are and no mnemonics.
+    fn mnemonics(&self, rows: &[(&str, Name<'_>)]) -> (Vec<String>, Vec<Option<char>>) {
+        if !self.mnemonics {
+            return (rows.iter().map(|(l, _)| (*l).to_owned()).collect(), vec![None; rows.len()]);
+        }
+        let labels: Vec<&str> = rows.iter().map(|(l, _)| *l).collect();
+        let english: Vec<Option<String>> = rows
+            .iter()
+            .map(|(_, name)| match *name {
+                Name::App(labeled) => self.english.and_then(|f| f(labeled)),
+                Name::Own(english) => Some(english.to_owned()),
+            })
+            .collect();
+        let preferred: Vec<Option<char>> = rows
+            .iter()
+            .map(|(_, name)| {
+                let key = match *name {
+                    Name::App(Labeled::Command(c)) => c.id.as_str(),
+                    Name::App(Labeled::Title(t)) => t,
+                    Name::Own(_) => return None,
+                };
+                self.preferred.iter().find(|(k, _)| *k == key).map(|(_, c)| *c)
+            })
+            .collect();
+        keys::localized(&labels, &english, &preferred)
+    }
+
+    /// One level of a menu, scrolling when taller than the window.
+    fn level(&mut self, ui: &mut Ui, depth: usize, rows: &[Entry<'_>], nav: &mut Nav) {
+        let label = self.label;
+        nav::level(ui, depth, nav, label, |ui, nav| self.rows(ui, depth, rows, nav));
+    }
+
+    fn rows(&mut self, ui: &mut Ui, depth: usize, rows: &[Entry<'_>], nav: &mut Nav) {
+        // Items never wrap: the menu widens to its longest label and shortcut.
+        ui.style_mut().wrap_mode = Some(egui::TextWrapMode::Extend);
+        // Rows touch, as in native menus.
+        ui.spacing_mut().item_spacing.y = 0.0;
+        let marks = Marks::new(ui, self.style);
+        // Mnemonics are unique within the level, separators aside.
+        let names: Vec<(&str, Name<'_>)> = rows
+            .iter()
+            .filter_map(|r| match *r {
+                Entry::Item(it) => Some((it.label.as_str(), Name::App(Labeled::Command(&it.command)))),
+                Entry::Sub(label, _) => Some((label, Name::App(Labeled::Title(label)))),
+                Entry::Separator => None,
+            })
+            .collect();
+        let (shown, mnemonics) = self.mnemonics(&names);
+        let mut next = 0;
+        let mut last_was_sep = true;
+        for (i, row) in rows.iter().enumerate() {
+            let label = |next: usize, fallback: &str| -> (String, Option<char>) {
+                (shown.get(next).cloned().unwrap_or_else(|| fallback.to_owned()), mnemonics.get(next).copied().flatten())
+            };
+            match *row {
+                Entry::Separator => {
+                    let more = rows.get(i + 1..).is_some_and(|rest| rest.iter().any(|r| !matches!(r, Entry::Separator)));
+                    if !last_was_sep && more {
+                        ui.add(egui::Separator::default().spacing(self.style.separator_spacing));
+                        last_was_sep = true;
+                    }
+                }
+                Entry::Item(it) => {
+                    let (shown, mnemonic) = label(next, &it.label);
+                    next += 1;
+                    self.item(ui, depth, it, (&shown, mnemonic), &marks, nav);
+                    last_was_sep = false;
+                }
+                Entry::Sub(title, children) => {
+                    let (shown, mnemonic) = label(next, title);
+                    next += 1;
+                    self.submenu(ui, depth, (&shown, mnemonic), children, &marks, nav);
+                    last_was_sep = false;
+                }
+            }
+        }
+    }
+
+    /// An item's row; `shown` is its label as shown and its mnemonic.
+    fn item(&mut self, ui: &mut Ui, depth: usize, it: &Item, shown: (&str, Option<char>), marks: &Marks, nav: &mut Nav) {
+        let (label, mnemonic) = shown;
+        let enabled = it.enabled && self.gate.allows(it);
+        let (role, mark) = match it.kind {
+            ItemKind::Plain => (Role::MenuItem, None),
+            ItemKind::Check(on) => (Role::MenuItemCheckBox, on.then_some(self.style.check_mark.as_str())),
+            ItemKind::Radio(on) => (Role::MenuItemRadio, on.then_some(self.style.radio_mark.as_str())),
+        };
+        let shortcut = it.shortcut.map(|c| c.display(self.platform));
+        let underline = mnemonic.filter(|_| nav.underline);
+        let mut button = egui::Button::new(marks.text(ui, mark, label, underline));
+        if let Some(s) = &shortcut {
+            button = button.shortcut_text(s.as_str());
+        }
+        let press = self.press;
+        let hit = nav.row(ui, depth - 1, enabled, Some(&it.command), mnemonic, |ui, _| {
+            let r = ui.add_enabled(enabled, button);
+            access(&r, role, label, mnemonic, it.kind.checked(), shortcut.as_deref());
+            let hit = r.clicked() || released_on(ui, &r, press);
+            (r, hit)
+        });
+        if hit {
+            self.clicked = Some(it.command.clone());
+            ui.close();
+        }
+    }
+
+    /// A submenu's row; `shown` is its title as shown and its mnemonic.
+    fn submenu(&mut self, ui: &mut Ui, depth: usize, shown: (&str, Option<char>), children: &[Node], marks: &Marks, nav: &mut Nav) {
+        let (label, mnemonic) = shown;
+        let enabled = any_enabled(children, self.gate);
+        let text = marks.text(ui, None, label, mnemonic.filter(|_| nav.underline));
+        ui.add_enabled_ui(enabled, |ui| {
+            nav.row(ui, depth - 1, enabled, None, mnemonic, |ui, nav| {
+                let (response, open) = submenu_row(ui, text, |ui| {
+                    ui.ctx().accesskit_node_builder(ui.unique_id(), |n| n.set_role(Role::Menu));
+                    self.level(ui, depth + 1, &entries(children), nav);
+                });
+                if open {
+                    // Where the submenu hangs from, to keep it below the bar.
+                    nav.set_anchor(depth, response.rect);
+                }
+                access(&response, Role::MenuItem, label, mnemonic, None, None);
+                response.ctx.accesskit_node_builder(response.id, |n| {
+                    n.set_has_popup(HasPopup::Menu);
+                    n.set_expanded(open);
+                });
+                (response, ())
+            });
+        });
+    }
+}
+
+/// The mark column every row of a level keeps before its label, so that checked, unchecked
+/// and plain rows (and submenu rows) start their labels at the same x.
+struct Marks {
+    font: egui::FontId,
+    /// The column's width: the wider mark and a space.
+    gutter: f32,
+}
+
+impl Marks {
+    fn new(ui: &Ui, style: &BarStyle) -> Marks {
+        let font = TextStyle::Button.resolve(ui.style());
+        let w = |s: &str| ui.painter().layout_no_wrap(format!("{s} "), font.clone(), Color32::PLACEHOLDER).size().x;
+        let gutter = w(&style.check_mark).max(w(&style.radio_mark));
+        Marks { font, gutter }
+    }
+
+    /// A row's text: `mark` in the column, then the label with `mnemonic` underlined. The text
+    /// takes the button's color (dimmed when disabled).
+    fn text(&self, ui: &Ui, mark: Option<&str>, label: &str, mnemonic: Option<char>) -> WidgetText {
+        let plain = TextFormat { font_id: self.font.clone(), color: Color32::PLACEHOLDER, ..Default::default() };
+        let mut job = LayoutJob::default();
+        job.wrap.max_width = f32::INFINITY;
+        let mut lead = self.gutter;
+        if let Some(mark) = mark {
+            let w = ui.painter().layout_no_wrap(mark.to_owned(), self.font.clone(), Color32::PLACEHOLDER).size().x;
+            job.append(mark, 0.0, plain.clone());
+            lead = (self.gutter - w).max(0.0);
+        }
+        keys::append_underlined(&mut job, label, lead, mnemonic, &plain);
+        job.into()
+    }
+}
+
+/// Give a row its AccessKit role, its label without the mark, its mnemonic, its checked state
+/// and its shortcut. egui marks it disabled already.
+fn access(r: &Response, role: Role, label: &str, mnemonic: Option<char>, checked: Option<bool>, shortcut: Option<&str>) {
+    r.ctx.accesskit_node_builder(r.id, |n| {
+        n.set_role(role);
+        n.set_label(label);
+        if let Some(m) = mnemonic {
+            n.set_access_key(m.to_string());
+        }
+        match checked {
+            Some(true) => n.set_toggled(Toggled::True),
+            Some(false) => n.set_toggled(Toggled::False),
+            None => n.clear_toggled(),
+        }
+        if let Some(s) = shortcut {
+            n.set_keyboard_shortcut(s);
+        }
+    });
+}
+
+/// A submenu row, drawn as `ui.menu_button` draws it, except that a row scrolled out of view
+/// doesn't open its submenu. egui opens a submenu whenever the pointer is over its row, clipped
+/// or not: a menu reopened scrolled down has rows hidden above its view, over the bar, and the
+/// hidden one under the title would open on the press; the release on the title then counted
+/// as a click outside that submenu and closed the whole menu. An open submenu (opened from the
+/// keyboard, say) is drawn as usual. Returns the row and whether its submenu is shown.
+fn submenu_row(ui: &mut Ui, title: WidgetText, content: impl FnOnce(&mut Ui)) -> (Response, bool) {
+    let sub = SubMenu::id_from_widget_id(ui.next_auto_id());
+    let open = MenuState::from_ui(ui, |state, _| state.open_item == Some(sub));
+    let inactive = ui.style().visuals.widgets.inactive;
+    if open {
+        ui.style_mut().visuals.widgets.inactive = ui.style().visuals.widgets.open;
+    }
+    let response = ui.add(egui::Button::new(title).right_text(SubMenuButton::arrow_atom(None)));
+    ui.style_mut().visuals.widgets.inactive = inactive;
+    // The rect egui tests the pointer against (`SubMenu::show`), against the part that can be seen.
+    let reach = response.rect.expand2(ui.spacing().item_spacing / 2.0);
+    let hidden = ui.ctx().pointer_hover_pos().is_some_and(|p| reach.contains(p) && !ui.clip_rect().contains(p));
+    if hidden && !open {
+        return (response, false);
+    }
+    let shown = SubMenu::new().show(ui, &response, content).is_some();
+    (response, shown)
+}
+
+/// A title's open or close command this frame: the press opens a closed menu (and starts a
+/// press-drag gesture: releasing on an item runs it) or closes an open one; the release never
+/// toggles, so the menu doesn't blink. A keyboard or AccessKit click toggles it.
+fn title_press(ctx: &egui::Context, title: &Response, press: Id) -> Option<egui::SetOpenCommand> {
+    // A press this frame on the title (still down, or a whole click within one frame).
+    let pressed = ctx.input(|i| i.pointer.primary_pressed()) && (title.is_pointer_button_down_on() || title.clicked());
+    if !pressed {
+        return (title.clicked() && !title.clicked_by(egui::PointerButton::Primary)).then_some(egui::SetOpenCommand::Toggle);
+    }
+    let open = egui::Popup::is_id_open(ctx, egui::Popup::default_response_id(title));
+    if !open {
+        ctx.data_mut(|d| d.insert_temp(press, true));
+    }
+    Some(egui::SetOpenCommand::Bool(!open))
+}
+
+/// Did the press-drag gesture that opened the menus end over `item` (released on it)?
+fn released_on(ui: &Ui, item: &Response, press: Id) -> bool {
+    item.enabled()
+        && item.contains_pointer()
+        && ui.input(|i| i.pointer.primary_released())
+        && ui.ctx().data(|d| d.get_temp::<bool>(press)).unwrap_or(false)
+}
+
+/// Whether the pointer can reach a title: a tall submenu that egui moved up over the bar is on
+/// top there, and hovering it must not switch menus. The title's column reaches up to the top
+/// of the window: egui lights a widget up to `interact_radius` away, so in a maximized window
+/// a pointer pushed against the screen edge above the title lights it and switches to it too.
+fn pointer_reaches_title(ctx: &egui::Context, response: &Response, p: egui::Pos2) -> bool {
+    let r = response.interact_rect;
+    let column = egui::Rect::from_min_max(egui::pos2(r.left(), f32::NEG_INFINITY), r.max);
+    column.contains(p) && ctx.layer_id_at(p) == Some(response.layer_id)
+}
+
+/// As in a native menu bar: while one menu is open, the pointer moving onto another title opens
+/// that menu instead.
+fn switch_on_hover(ctx: &egui::Context, buttons: &[Response]) {
+    let ids: Vec<Id> = buttons.iter().map(egui::Popup::default_response_id).collect();
+    let Some(open) = ids.iter().position(|id| egui::Popup::is_id_open(ctx, *id)) else { return };
+    // `Response::hovered` is false while the menu's popup layer is open: hit-test the title,
+    // but only where its own layer is on top.
+    let Some(p) = ctx.pointer_hover_pos() else { return };
+    // Only a moving pointer switches: a pointer resting on a title must not undo ← and →.
+    if ctx.input(|i| i.pointer.delta() == egui::Vec2::ZERO) {
+        return;
+    }
+    if let Some(i) = buttons.iter().position(|b| pointer_reaches_title(ctx, b, p))
+        && i != open
+        && let Some(&id) = ids.get(i)
+    {
+        egui::Popup::open_id(ctx, id);
+        ctx.request_repaint();
+    }
+}
diff --git a/crates/menu/src/bar/nav.rs b/crates/menu/src/bar/nav.rs
new file mode 100644
index 00000000..acdb5811
--- /dev/null
+++ b/crates/menu/src/bar/nav.rs
@@ -0,0 +1,532 @@
+//! How an open menu of the bar behaves like a native one: a menu or submenu taller than the
+//! window scrolls (wheel, and the ▲ / ▼ arrows at its top and bottom, which scroll while the
+//! pointer rests on them), and the keyboard drives it: ↑ / ↓ move the highlight (and keep it in
+//! view), → opens a submenu or the next menu, ← closes the submenu or opens the previous menu,
+//! ↩ / Space run the highlighted item, Esc closes.
+//!
+//! The highlight is view state in egui memory, per top-level menu. It follows the pointer too, so
+//! the mouse and the keyboard share one highlighted row, as in a native menu.
+//!
+//! An open submenu stays open while the pointer heads for it: crossing the rows between its row
+//! and the submenu, on a diagonal, a curved path or with a pause on the way, neither closes it
+//! nor opens the submenu of a row crossed. The pointer resting on another row, or moving away
+//! from the submenu, switches as usual.
+//!
+//! The bar's own keys (Alt and F10 focusing it, mnemonics; [`super::keys`]) drive the same
+//! state: the open menu ([`Nav::top`], through the popup ids in [`Nav::tops`]), the level the
+//! arrows move in ([`Nav::level`]), its rows' mnemonics ([`Nav::row_with_mnemonic`]) and
+//! [`Nav::open_sub_row`] to go into a submenu.
+
+use egui::containers::menu::{MenuState, SubMenu, find_menu_root};
+use egui::{Id, Key, Modifiers, Pos2, Rect, Sense, Ui, pos2, vec2};
+
+use craft_keymap::CommandRef;
+
+/// Height of a scroll-arrow strip.
+pub(crate) const ARROW: f32 = 16.0;
+/// Gap kept between a menu and the window edge.
+const EDGE: f32 = 6.0;
+/// How fast resting on a scroll arrow scrolls, in points per second.
+const SPEED: f32 = 600.0;
+/// How far above and below an open submenu the pointer may aim and still be heading for it.
+const AIM_SLACK: f32 = 24.0;
+/// How long the pointer may rest on another row, heading for an open submenu, before that row
+/// takes over (macOS waits about as long).
+const AIM_REST: f32 = 0.3;
+
+/// The pointer heading for the open submenu of a row.
+#[derive(Clone, Debug)]
+struct Aim {
+    /// The row whose submenu is open, and its index in its level.
+    row: Id,
+    index: usize,
+    /// Where the pointer last was on that row.
+    from: Pos2,
+    /// The pointer was off the row with its submenu still open in the last frame.
+    held: bool,
+}
+
+/// One row of a menu level: a command or a submenu.
+#[derive(Clone, Debug)]
+pub(crate) struct Row {
+    /// The row's widget id (a submenu's popup id derives from it).
+    pub widget: Id,
+    pub enabled: bool,
+    /// The command it runs; `None` for a submenu.
+    pub command: Option<CommandRef>,
+    /// Where it was drawn (scrolled out of view when outside its level's `views` rect).
+    #[cfg_attr(not(test), allow(dead_code))]
+    pub rect: Rect,
+    /// The letter that runs it from the keyboard, upper case.
+    pub mnemonic: Option<char>,
+}
+
+/// Keyboard and highlight state of the open menu.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct Nav {
+    /// The open top-level menu (index into the bar's titles).
+    pub top: Option<usize>,
+    /// Popup ids of the top-level menus, from the last frame.
+    pub tops: Vec<Id>,
+    /// The level the arrow keys move in (0 = the top-level menu).
+    pub level: usize,
+    /// Highlighted row per level.
+    hi: Vec<Option<usize>>,
+    /// This frame's rows per level (deeper levels are dropped when their parent redraws).
+    pub rows: Vec<Vec<Row>>,
+    /// Menu-root id per level (the owner of egui's `MenuState` for that level).
+    roots: Vec<Id>,
+    /// Underline the rows' mnemonics this frame.
+    pub underline: bool,
+    /// Bottom of the menu bar: where top-level menus hang from.
+    pub bar_bottom: Option<f32>,
+    /// The visible (scrolled) part of each level.
+    pub views: Vec<Rect>,
+    /// The full height of each level's rows (taller than its view when it scrolls).
+    pub contents: Vec<f32>,
+    /// Per level: the row its open submenu hangs from (level 0 has none). From the frame
+    /// before, since a submenu is drawn while its row is.
+    anchors: Vec<Option<Rect>>,
+    /// Scroll the highlighted row of `level` into view when it is next drawn.
+    reveal: bool,
+    /// Highlight the first enabled row of this level once it has been drawn (a keyboard-opened
+    /// submenu).
+    first_at: Option<usize>,
+    /// Per level: the pointer heading for the open submenu of one of its rows.
+    aims: Vec<Option<Aim>>,
+    /// A held submenu of this level let go: the row under the pointer takes the highlight even
+    /// if the pointer rests.
+    follow: Option<usize>,
+}
+
+fn open_id() -> Id {
+    Id::unique("craft-menu-bar-open")
+}
+
+/// Whether one of the bar's menus is open. An app leaves the keys to it meanwhile: its
+/// shortcuts wait until the menu closes.
+pub fn is_open(ctx: &egui::Context) -> bool {
+    // Only while the bar is still drawn: an app that hides it with a menu open (full screen)
+    // gets its keys back.
+    let pass = ctx.cumulative_pass_nr();
+    ctx.data(|d| d.get_temp::<u64>(open_id())).is_some_and(|seen| seen + 2 >= pass)
+}
+
+impl Nav {
+    /// Last frame's state, reset when another top-level menu (or none) is open now.
+    pub fn load(ctx: &egui::Context, id: Id) -> Nav {
+        let mut nav: Nav = ctx.data(|d| d.get_temp(id)).unwrap_or_default();
+        let top = nav.tops.iter().position(|id| egui::Popup::is_id_open(ctx, *id));
+        if top != nav.top {
+            nav = Nav { top, tops: std::mem::take(&mut nav.tops), ..Default::default() };
+        }
+        nav
+    }
+
+    /// The state as the last frame left it.
+    #[cfg(test)]
+    pub fn current(ctx: &egui::Context, id: Id) -> Nav {
+        ctx.data(|d| d.get_temp(id)).unwrap_or_default()
+    }
+
+    /// The highlighted row of `level`, if any.
+    pub fn highlighted(&self, level: usize) -> Option<usize> {
+        self.hi.get(level).copied().flatten()
+    }
+
+    fn set_hi(&mut self, level: usize, row: Option<usize>) {
+        if self.hi.len() <= level {
+            self.hi.resize(level + 1, None);
+        }
+        self.hi[level] = row;
+    }
+
+    /// Start drawing `level`: forget its rows from before, and every deeper level's.
+    fn begin_level(&mut self, level: usize, root: Id) {
+        self.rows.truncate(level);
+        self.rows.resize(level + 1, Vec::new());
+        self.roots.truncate(level);
+        self.roots.resize(level + 1, root);
+        self.views.truncate(level);
+        self.views.resize(level + 1, Rect::NOTHING);
+        self.contents.truncate(level);
+        self.contents.resize(level + 1, 0.0);
+    }
+
+    /// Draw a row of `level` with `add`, lit like a hovered row when the keyboard (or the
+    /// pointer) is on it, and register it for the keys. `add` returns the row's response. A row
+    /// without a `command` opens a submenu; `mnemonic` is the letter that runs or opens it.
+    pub fn row<R>(
+        &mut self,
+        ui: &mut Ui,
+        level: usize,
+        enabled: bool,
+        command: Option<&CommandRef>,
+        mnemonic: Option<char>,
+        add: impl FnOnce(&mut Ui, &mut Nav) -> (egui::Response, R),
+    ) -> R {
+        let i = self.rows.get(level).map_or(usize::MAX, Vec::len);
+        // While a submenu is kept open for the pointer heading to it, its row stays lit and the
+        // rows crossed on the way don't light up.
+        let held = self.aims.get(level).and_then(Option::as_ref).filter(|a| a.held).map(|a| a.index);
+        let lit = enabled && (held == Some(i) || held.is_none() && self.highlighted(level) == Some(i));
+        let saved = (ui.visuals().widgets.inactive, ui.visuals().widgets.hovered);
+        if lit {
+            ui.visuals_mut().widgets.inactive = ui.visuals().widgets.hovered;
+        } else if held.is_some() {
+            ui.visuals_mut().widgets.hovered = ui.visuals().widgets.inactive;
+        }
+        let root = self.roots.get(level).copied().filter(|_| command.is_none());
+        let open = root.and_then(|root| MenuState::from_id(ui.ctx(), root, |s| s.open_item));
+        let (r, out) = add(ui, self);
+        (ui.visuals_mut().widgets.inactive, ui.visuals_mut().widgets.hovered) = saved;
+        if let Some(root) = root {
+            self.aim(level, i, root, open, &r);
+        }
+        if let Some(rows) = self.rows.get_mut(level) {
+            rows.push(Row { widget: r.id, enabled, command: command.cloned(), rect: r.rect, mnemonic });
+            if let Some(index) = held {
+                self.set_hi(level, Some(index));
+            } else {
+                self.after_row(level, i, lit, &r);
+            }
+        }
+        out
+    }
+
+    /// After a submenu row is drawn: if egui just closed its submenu because the pointer is over
+    /// another row of this menu, keep it open while the pointer heads for it. `open` was the
+    /// menu's open submenu before the row was drawn.
+    fn aim(&mut self, level: usize, index: usize, root: Id, open: Option<Id>, r: &egui::Response) {
+        if self.aims.len() <= level {
+            self.aims.resize(level + 1, None);
+        }
+        let Some(p) = r.ctx.pointer_hover_pos() else { return };
+        let was_held = self.aims.get(level).and_then(Option::as_ref).is_some_and(|a| a.row == r.id && a.held);
+        let held = self.hold(level, index, root, open, p, r);
+        if was_held && !held {
+            // Let go: the row under the pointer takes the highlight, moving or not.
+            self.follow = Some(level);
+        }
+    }
+
+    /// [`Self::aim`]: is this row's submenu open with the pointer off the row (held) now?
+    fn hold(&mut self, level: usize, index: usize, root: Id, open: Option<Id>, p: Pos2, r: &egui::Response) -> bool {
+        let ctx = &r.ctx;
+        let sub = SubMenu::id_from_widget_id(r.id);
+        let target = self.views.get(level + 1).copied();
+        let Some(slot) = self.aims.get_mut(level) else { return false };
+        if open != Some(sub) {
+            if slot.as_ref().is_some_and(|a| a.row == r.id) {
+                *slot = None;
+            }
+            return false;
+        }
+        if r.interact_rect.contains(p) {
+            *slot = Some(Aim { row: r.id, index, from: p, held: false });
+            return false;
+        }
+        let Some(aim) = slot.as_mut().filter(|a| a.row == r.id) else { return false };
+        // Off its row with the submenu still open (egui keeps it while the pointer moves straight
+        // at it): the row stays lit.
+        aim.held = true;
+        if MenuState::from_id(ctx, root, |s| s.open_item) == Some(sub) {
+            return true;
+        }
+        aim.held = false;
+        // A click or a key closes menus as usual; so does leaving the submenu's direction, or
+        // resting on another row.
+        let (acted, rest) =
+            ctx.input(|i| (i.pointer.any_pressed() || i.pointer.any_click() || !i.keys_down.is_empty(), i.pointer.time_since_last_movement()));
+        let Some(target) = target else { return false };
+        if acted || rest >= AIM_REST || !heading(aim.from, p, target) {
+            return false;
+        }
+        MenuState::from_id(ctx, root, |s| s.open_item = Some(sub));
+        aim.held = true;
+        ctx.request_repaint_after_secs(AIM_REST - rest);
+        true
+    }
+
+    /// After a row is drawn: the pointer moving onto it highlights it; a keyboard move scrolls
+    /// the highlighted row into view.
+    fn after_row(&mut self, level: usize, i: usize, lit: bool, r: &egui::Response) {
+        let moved = r.ctx.input(|inp| inp.pointer.delta() != egui::Vec2::ZERO);
+        let follow = self.follow == Some(level);
+        if (moved || follow) && r.hovered() && !lit {
+            if follow {
+                self.follow = None;
+            }
+            self.set_hi(level, Some(i));
+            self.level = level;
+            r.ctx.request_repaint();
+        }
+        if lit && self.reveal && level == self.level {
+            r.scroll_to_me(None);
+            self.reveal = false;
+        }
+    }
+
+    fn enabled(&self, level: usize) -> Vec<usize> {
+        self.rows.get(level).map(|rows| rows.iter().enumerate().filter(|(_, r)| r.enabled).map(|(i, _)| i).collect()).unwrap_or_default()
+    }
+
+    /// ↑ / ↓: the next enabled row (wrapping), or the first / last one.
+    fn step(&mut self, level: usize, down: bool) {
+        let on = self.enabled(level);
+        let (Some(&first), Some(&last)) = (on.first(), on.last()) else { return };
+        let next = match self.highlighted(level) {
+            None => {
+                if down {
+                    first
+                } else {
+                    last
+                }
+            }
+            Some(cur) if down => on.iter().copied().find(|&i| i > cur).unwrap_or(first),
+            Some(cur) => on.iter().rev().copied().find(|&i| i < cur).unwrap_or(last),
+        };
+        self.set_hi(level, Some(next));
+        self.hi.truncate(level + 1);
+        self.level = level;
+        self.reveal = true;
+        // The keys move the highlight now, not the pointer heading for a submenu.
+        if let Some(aim) = self.aims.get_mut(level) {
+            *aim = None;
+        }
+    }
+
+    /// Light the first enabled row of `level` once it has been drawn (a menu opened from the
+    /// keyboard, as on Windows).
+    pub fn highlight_first(&mut self, level: usize) {
+        self.first_at = Some(level);
+    }
+
+    /// The enabled row of the level the arrows are in whose mnemonic is `c`.
+    pub fn row_with_mnemonic(&self, c: char) -> Option<Row> {
+        let level = self.level.min(self.rows.len().saturating_sub(1));
+        self.rows.get(level)?.iter().find(|r| r.enabled && r.mnemonic == Some(c)).cloned()
+    }
+
+    /// Open the submenu of row `widget` of the level the arrows are in.
+    pub fn open_sub_row(&mut self, ctx: &egui::Context, widget: Id) {
+        let level = self.level.min(self.rows.len().saturating_sub(1));
+        self.open_sub(ctx, level, widget);
+    }
+
+    /// Open the submenu of row `widget` of `level` and move the keyboard into it, on its first
+    /// enabled row.
+    pub fn open_sub(&mut self, ctx: &egui::Context, level: usize, widget: Id) {
+        let Some(&root) = self.roots.get(level) else { return };
+        let sub = SubMenu::id_from_widget_id(widget);
+        // egui drops an open item it has never drawn: mark it shown so it survives to the next frame.
+        MenuState::mark_shown(ctx, sub);
+        MenuState::from_id(ctx, root, |s| s.open_item = Some(sub));
+        self.level = level + 1;
+        self.hi.truncate(level + 1);
+        self.first_at = Some(level + 1);
+    }
+
+    /// Remember the row the submenu of `level` (1 = a top-level menu's submenu) hangs from.
+    pub fn set_anchor(&mut self, level: usize, row: Rect) {
+        if self.anchors.len() <= level {
+            self.anchors.resize(level + 1, None);
+        }
+        if let Some(a) = self.anchors.get_mut(level) {
+            *a = Some(row);
+        }
+    }
+
+    /// Handle this frame's navigation keys (after the menus were drawn). `tops` are the bar's
+    /// popup ids, in screen order; an activated command lands in `clicked`.
+    pub fn keys(&mut self, ctx: &egui::Context, tops: &[Id], clicked: &mut Option<CommandRef>) {
+        self.tops = tops.to_vec();
+        let Some(top) = self.top.filter(|_| !tops.is_empty()) else { return };
+        let level = self.level.min(self.rows.len().saturating_sub(1));
+        self.level = level;
+        let press = |k: Key| ctx.input_mut(|i| i.consume_key(Modifiers::NONE, k));
+        let current = self.highlighted(level).and_then(|i| self.rows.get(level)?.get(i)).cloned();
+        let switch = |by: usize| {
+            let n = tops.len();
+            if let Some(&id) = tops.get((top + by) % n) {
+                egui::Popup::open_id(ctx, id);
+            }
+        };
+        if press(Key::Escape) {
+            egui::Popup::close_all(ctx);
+        } else if press(Key::ArrowDown) {
+            self.step(level, true);
+        } else if press(Key::ArrowUp) {
+            self.step(level, false);
+        } else if press(Key::ArrowRight) {
+            match current {
+                Some(Row { widget, enabled: true, command: None, .. }) => self.open_sub(ctx, level, widget),
+                _ => switch(1),
+            }
+        } else if press(Key::ArrowLeft) {
+            if level > 0 {
+                if let Some(&root) = self.roots.get(level - 1) {
+                    MenuState::from_id(ctx, root, |s| s.open_item = None);
+                }
+                self.hi.truncate(level);
+                self.level = level - 1;
+            } else {
+                switch(tops.len() - 1);
+            }
+        } else if press(Key::Enter) || press(Key::Space) {
+            match current {
+                Some(Row { enabled: true, command: Some(c), .. }) => {
+                    *clicked = Some(c);
+                    egui::Popup::close_all(ctx);
+                }
+                Some(Row { widget, enabled: true, command: None, .. }) => self.open_sub(ctx, level, widget),
+                _ => {}
+            }
+        } else {
+            return;
+        }
+        ctx.request_repaint();
+    }
+
+    pub fn store(self, ctx: &egui::Context, id: Id) {
+        let pass = ctx.cumulative_pass_nr();
+        ctx.data_mut(|d| {
+            if self.top.is_some() {
+                d.insert_temp(open_id(), pass);
+            } else {
+                d.remove::<u64>(open_id());
+            }
+            d.insert_temp(id, self);
+        });
+    }
+}
+
+/// Is the pointer at `p`, having left a submenu's row at `from`, heading for the submenu at
+/// `target`? It is while it stays inside the triangle from `from` to the submenu's near edge
+/// (with [`AIM_SLACK`] above and below), as macOS menus judge it.
+pub(crate) fn heading(from: Pos2, p: Pos2, target: Rect) -> bool {
+    if !target.is_positive() {
+        return false;
+    }
+    let x = if target.center().x >= from.x { target.left() } else { target.right() };
+    let (a, b) = (pos2(x, target.top() - AIM_SLACK), pos2(x, target.bottom() + AIM_SLACK));
+    let side = |u: Pos2, v: Pos2| (v.x - u.x) * (p.y - u.y) - (v.y - u.y) * (p.x - u.x);
+    let (d1, d2, d3) = (side(from, a), side(a, b), side(b, from));
+    let neg = d1 < 0.0 || d2 < 0.0 || d3 < 0.0;
+    let pos = d1 > 0.0 || d2 > 0.0 || d3 > 0.0;
+    !(neg && pos)
+}
+
+/// Is the pointer over `rect` on this ui's layer (not under a submenu drawn on top)?
+fn pointer_on(ui: &Ui, rect: Rect) -> bool {
+    ui.ctx().pointer_hover_pos().is_some_and(|p| rect.contains(p) && ui.ctx().layer_id_at(p) == Some(ui.layer_id()))
+}
+
+/// The height a menu level's rows may take. Every level stays below the bar: a top-level menu
+/// hangs from it, and a submenu that is too tall for the window between its row and the bottom,
+/// or (opening upward, as egui does when that fits) between the bar and its row, scrolls instead
+/// of egui sliding it up over the bar, where it would hide the menu titles. `anchor` is the
+/// submenu's row (unknown on its first frame), `rows` the level's rows' height when known (the
+/// popup shrinks to it), `frame` the popup's margins.
+pub(crate) fn level_room(screen: Rect, bar_bottom: Option<f32>, depth: usize, anchor: Option<Rect>, rows: Option<f32>, frame: f32) -> f32 {
+    let top = bar_bottom.unwrap_or(screen.top()).max(screen.top()) + EDGE;
+    let bottom = screen.bottom() - EDGE;
+    let below_bar = bottom - top;
+    let room = match anchor.filter(|_| depth > 1) {
+        Some(row) => {
+            // Downward from the row, or upward from it, whichever leaves more room. egui opens a
+            // submenu upward only when the downward one doesn't fit the window (it hangs from the
+            // row's top less half the frame margin).
+            let (down, up) = (bottom - row.top(), row.bottom() - top);
+            let opens_up = |h: f32| row.top() - (frame - 2.0) / 2.0 + h + frame > screen.bottom();
+            let want = rows.unwrap_or(f32::INFINITY);
+            if want > down && up > down && opens_up(want.min(up)) { up } else { down }.min(below_bar)
+        }
+        None => below_bar,
+    } - frame;
+    if room.is_finite() { room.max(4.0 * ARROW) } else { 4.0 * ARROW }
+}
+
+/// Draw one level of a menu, bounded by the window: when its rows don't fit they scroll, with
+/// scroll arrows at the top and bottom. `depth` is 1 for a top-level menu. `label` translates the
+/// arrows' accessible names.
+pub(crate) fn level(ui: &mut Ui, depth: usize, nav: &mut Nav, label: &dyn Fn(&'static str) -> String, rows: impl FnOnce(&mut Ui, &mut Nav)) {
+    let ctx = ui.ctx().clone();
+    let level = depth.saturating_sub(1);
+    nav.begin_level(level, find_menu_root(ui).scope_id);
+    let screen = ctx.content_rect();
+    // The menu frame's margin and stroke around the rows.
+    let frame = ui.spacing().menu_margin.sum().y + 2.0;
+    let anchor = nav.anchors.get(level).copied().flatten();
+    let key = ui.scope_id().with(("craft-menu-level", depth));
+    // Rows' height from the last frame: does this level overflow?
+    let content: Option<f32> = ctx.data(|d| d.get_temp(key));
+    let room = level_room(screen, nav.bar_bottom, depth, anchor, content, frame);
+    let over = content.is_some_and(|h| h > room + 0.5);
+    let up = over.then(|| ui.allocate_exact_size(vec2(0.0, ARROW), Sense::hover()).0);
+    let height = if over { room - 2.0 * ARROW } else { room };
+    // The popup's `Ui` is only as tall as the popup was last frame (egui's `default_area_size`,
+    // 400 pt, on the first): a scroll area never grows past that, so every menu would stop at that
+    // height and scroll even on a tall window. Ask for the room the window has; auto-shrink then
+    // fits the area to its rows, so a menu scrolls only when they don't fit.
+    let mut area = egui::ScrollArea::vertical()
+        .id_salt(("craft-menu-level", depth))
+        .max_height(height)
+        .min_scrolled_height(height)
+        .scroll_source(egui::containers::scroll_area::ScrollSource::ALL);
+    // Where the scroll arrows moved the rows last frame; egui's scroll state has no setter.
+    if let Some(y) = ctx.data_mut(|d| d.remove_temp::<f32>(key.with("scroll-to"))) {
+        area = area.vertical_scroll_offset(y);
+    }
+    let out = area.show(ui, |ui| rows(ui, nav));
+    let down = over.then(|| ui.allocate_exact_size(vec2(0.0, ARROW), Sense::hover()).0);
+    ctx.data_mut(|d| d.insert_temp(key, out.content_size.y));
+    if let Some(v) = nav.views.get_mut(level) {
+        // `inner_rect` is the size asked for, before auto-shrink fits it to the rows.
+        *v = Rect::from_min_size(out.inner_rect.min, vec2(out.inner_rect.width(), out.inner_rect.height().min(out.content_size.y)));
+    }
+    if let Some(c) = nav.contents.get_mut(level) {
+        *c = out.content_size.y;
+    }
+    if nav.first_at == Some(level) {
+        nav.first_at = None;
+        nav.step(level, true);
+        ctx.request_repaint();
+    }
+    let (Some(up), Some(down)) = (up, down) else { return };
+    let (live_color, dead_color) = (ui.visuals().text_color(), ui.visuals().weak_text_color().gamma_multiply(0.5));
+    let x = ui.min_rect().x_range();
+    let max = (out.content_size.y - out.inner_rect.height()).max(0.0);
+    let offset = out.state.clamped_offset().y;
+    let dt = ctx.input(|i| i.stable_dt).clamp(0.0, 0.1);
+    let mut target = offset;
+    for (strip, dir, live) in [(up, -1.0, offset > 0.5), (down, 1.0, offset < max - 0.5)] {
+        let strip = Rect::from_x_y_ranges(x, strip.y_range());
+        let c = strip.center();
+        let (h, w) = (4.5, 6.0);
+        let tri = if dir < 0.0 {
+            vec![pos2(c.x - w, c.y + h * 0.5), pos2(c.x + w, c.y + h * 0.5), pos2(c.x, c.y - h * 0.5)]
+        } else {
+            vec![pos2(c.x - w, c.y - h * 0.5), pos2(c.x + w, c.y - h * 0.5), pos2(c.x, c.y + h * 0.5)]
+        };
+        ui.painter().add(egui::Shape::convex_polygon(tri, if live { live_color } else { dead_color }, egui::Stroke::NONE));
+        let id = key.with(dir < 0.0);
+        let r = ui.interact(strip, id, Sense::hover());
+        let name = label(if dir < 0.0 { "Scroll menu up" } else { "Scroll menu down" });
+        r.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, live, &name));
+        if live && pointer_on(ui, strip) {
+            target = (offset + dir * SPEED * dt.max(1.0 / 120.0)).clamp(0.0, max);
+            ctx.request_repaint();
+        }
+        // The wheel scrolls over the arrows too.
+        if pointer_on(ui, strip) {
+            let wheel = ctx.input(|i| i.smooth_scroll_delta.y);
+            if wheel != 0.0 {
+                target = (target - wheel).clamp(0.0, max);
+            }
+        }
+    }
+    if target != offset {
+        ctx.data_mut(|d| d.insert_temp(key.with("scroll-to"), target));
+    }
+}
diff --git a/crates/menu/src/driver.rs b/crates/menu/src/driver.rs
new file mode 100644
index 00000000..6e20103f
--- /dev/null
+++ b/crates/menu/src/driver.rs
@@ -0,0 +1,492 @@
+//! The app's side: events from the platform menu in, menu bars out.
+
+use std::borrow::Cow;
+use std::collections::HashSet;
+use std::sync::{Arc, Mutex, MutexGuard, PoisonError};
+
+use craft_keymap::{Chord, CommandRef, Key, Mods};
+
+use crate::layout::{Clash, Layout};
+use crate::model::{Builtin, Item, ItemKind, MenuBar, Node};
+
+/// What the native menu reports.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Event {
+    /// An item was chosen with the mouse (or the keyboard inside an open menu), or by a key
+    /// equivalent the app's key handling doesn't know ([`crate::Item::layout_shortcut`]): the
+    /// item's command.
+    Click(CommandRef),
+    /// A key equivalent was pressed: the shortcut, to be handled as the key press it was.
+    Key(Chord),
+    /// An item whose shortcut a text field handles itself (Edit › Copy, Undo) was clicked while a
+    /// text field has the keys: the shortcut, to be handled as a press and release of it.
+    Tap(Chord),
+    /// A click the app's [`NativeMenu::on_command`] hook ran; [`NativeMenu::take_clicks`] leaves it
+    /// out.
+    Handled(CommandRef),
+}
+
+/// How ⌘C, ⌘X and ⌘V reach egui when the native menu takes them as key equivalents (an Edit
+/// menu with Copy, Cut and Paste items).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum ClipboardKeys {
+    /// As egui-winit makes them without a native menu: ⌘C is [`egui::Event::Copy`], ⌘X
+    /// [`egui::Event::Cut`], and ⌘V a [`egui::ViewportCommand::RequestPaste`], which eframe answers
+    /// with an [`egui::Event::Paste`] of the clipboard's text in the next frame. Text fields copy,
+    /// cut and paste.
+    #[default]
+    Egui,
+    /// Key presses like any other key equivalent, for an app that runs its clipboard commands
+    /// from the keys itself.
+    Raw,
+}
+
+/// What may run from the menus this frame, set by the app.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct Gate {
+    /// A modal dialog is open.
+    pub modal: bool,
+    /// The shortcut editor is recording a chord.
+    pub recording_shortcut: bool,
+    /// A text field has the keys.
+    pub text_editing: bool,
+}
+
+impl Gate {
+    /// Whether `item` may run now: while a modal dialog is open or a shortcut is being recorded,
+    /// only the built-in items (Hide, Hide Others, Minimize, Quit) do. The built-in Quit stays
+    /// because it asks the window to close, and the app's close guard knows about its dialogs; an
+    /// app's own Quit item ([`crate::ItemRole::Quit`]) is greyed with its other commands. A text field having the keys doesn't stop a click: menu commands run while
+    /// typing, as in a Mac app, and the keys a field keeps are handled before the menus see them.
+    pub fn allows(&self, item: &Item) -> bool {
+        self.allows_command(&item.command)
+    }
+
+    /// [`Gate::allows`] for an item that runs `command`.
+    pub fn allows_command(&self, command: &CommandRef) -> bool {
+        !(self.modal || self.recording_shortcut) || Builtin::of(command).is_some()
+    }
+
+    /// `bar` with every item the gate forbids disabled, so the menus show them greyed, but the
+    /// items whose shortcut a text field handles itself (Undo, Copy, Select All, …).
+    pub(crate) fn grey<'a>(&self, bar: &'a MenuBar) -> Cow<'a, MenuBar> {
+        fn walk(nodes: &mut [Node], gate: &Gate) {
+            for n in nodes {
+                match n {
+                    // The field's own keys stay enabled: AppKit doesn't send a disabled item's key
+                    // equivalent on, so greyed Copy or Undo would leave ⌘C and ⌘Z dead in a
+                    // dialog's text fields. Their clicks are still dropped (`take_clicks`).
+                    Node::Item(it) if !gate.allows(it) && !it.shortcut.as_ref().is_some_and(text_editing_key) => it.enabled = false,
+                    Node::Submenu { children, .. } => walk(children, gate),
+                    _ => {}
+                }
+            }
+        }
+        if !(self.modal || self.recording_shortcut) {
+            return Cow::Borrowed(bar);
+        }
+        let mut bar = bar.clone();
+        for m in &mut bar.menus {
+            walk(&mut m.children, self);
+        }
+        Cow::Owned(bar)
+    }
+}
+
+/// An app's [`NativeMenu::on_command`] hook: `true` when it ran the command.
+pub type CommandHook = Box<dyn Fn(&CommandRef) -> bool + Send + Sync>;
+
+/// What a backend's menu event handler needs from the driver when an item is chosen: the
+/// current [`Gate`] and the app's [`NativeMenu::on_command`] hook. The platform calls the handler
+/// between frames, from the event that chose the item, so this is shared with the driver rather
+/// than borrowed from it. [`NativeMenu::new`] hands it to the backend ([`Backend::attach`]).
+#[derive(Clone, Default)]
+pub struct Dispatch(Arc<Mutex<Shared>>);
+
+type SharedHook = Arc<dyn Fn(&CommandRef) -> bool + Send + Sync>;
+
+#[derive(Default)]
+struct Shared {
+    gate: Gate,
+    hook: Option<SharedHook>,
+}
+
+impl Dispatch {
+    /// The event for an item with `command`, its `shortcut` and [`Item::layout_shortcut`],
+    /// chosen with the modifiers `held` for a key-down (⌘, ⌃, ⌥, ⇧ as AppKit reports them) or
+    /// `None` for a mouse click, under the current gate. A click the gate allows on an app command
+    /// (not a [`Builtin`]) also goes to the app's [`NativeMenu::on_command`] hook, before this
+    /// returns; when the hook ran it, the event is [`Event::Handled`].
+    pub fn chosen(&self, command: &CommandRef, shortcut: Option<&Chord>, layout_shortcut: bool, held: Option<Mods>) -> Event {
+        let (gate, hook) = {
+            let shared = self.lock();
+            (shared.gate, shared.hook.clone())
+        };
+        let event = chosen_event(command, shortcut, layout_shortcut, held, gate);
+        if let (Event::Click(c), Some(hook)) = (&event, hook)
+            && gate.allows_command(c)
+            && Builtin::of(c).is_none()
+            && hook(c)
+        {
+            return Event::Handled(c.clone());
+        }
+        event
+    }
+
+    fn lock(&self) -> MutexGuard<'_, Shared> {
+        self.0.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+}
+
+/// A platform's native menu bar.
+pub trait Backend {
+    /// Bring the menu in step with `bar`: update labels, enabled and checked in place, or
+    /// rebuild when its structure changed ([`crate::structure_key`], [`crate::window_key`]).
+    fn sync(&mut self, bar: &MenuBar);
+    /// Events since the last call. Platform items (Hide, Services, Zoom, …) are handled by the
+    /// backend and not reported.
+    fn drain(&mut self) -> Vec<Event>;
+    /// Whether one of the native menus is open.
+    fn tracking(&self) -> bool {
+        false
+    }
+    /// Close the open native menu, if there is one.
+    fn cancel_tracking(&mut self) {}
+    /// Keep the driver's [`Dispatch`]: the backend's menu event handler turns every chosen item
+    /// into an [`Event`] through [`Dispatch::chosen`]. [`NativeMenu::new`] calls it once.
+    fn attach(&mut self, dispatch: Dispatch);
+}
+
+/// The native menu bar, while the app uses one (its in-window menus are hidden then).
+pub struct NativeMenu {
+    backend: Box<dyn Backend>,
+    /// The state the menus were last built from.
+    state: Option<u64>,
+    clicks: Vec<CommandRef>,
+    /// An event arrived (AppKit may have toggled a check item itself): re-sync.
+    dirty: bool,
+    clashes: Vec<Clash>,
+    clipboard: ClipboardKeys,
+    /// ⌘V arrived: [`NativeMenu::take_clicks`] asks eframe for the paste.
+    paste: bool,
+    /// Whether a click may be kept from egui as the one closing an open menu (see
+    /// [`NativeMenu::raw_input`]).
+    armed: bool,
+    gate: Gate,
+    dispatch: Dispatch,
+    /// The menus last laid out, before the gate greyed anything, and the gate they were last
+    /// synced with: a gate change re-syncs them without laying them out again.
+    bar: Option<MenuBar>,
+    synced_gate: Option<Gate>,
+    /// The commands whose items were check items in a layout so far: they stay check items, so
+    /// that `checked` going from `Some` to `None` doesn't rebuild the menus.
+    checkable: HashSet<String>,
+}
+
+impl NativeMenu {
+    pub fn new(mut backend: Box<dyn Backend>) -> NativeMenu {
+        let dispatch = Dispatch::default();
+        backend.attach(dispatch.clone());
+        NativeMenu {
+            backend,
+            state: None,
+            clicks: Vec::new(),
+            dirty: true,
+            clashes: Vec::new(),
+            clipboard: ClipboardKeys::default(),
+            paste: false,
+            armed: true,
+            gate: Gate::default(),
+            dispatch,
+            bar: None,
+            synced_gate: None,
+            checkable: HashSet::new(),
+        }
+    }
+
+    pub fn clipboard_keys(mut self, keys: ClipboardKeys) -> NativeMenu {
+        self.clipboard = keys;
+        self
+    }
+
+    /// What may run from the menus. Call it every frame, before [`NativeMenu::take_clicks`]; it
+    /// also holds for the menu events that arrive until the next call.
+    ///
+    /// - While [`Gate::modal`] or [`Gate::recording_shortcut`] is on, the app's items are greyed
+    ///   (updated in place at the next [`NativeMenu::sync_with`]) and clicks on them are dropped,
+    ///   also a click that arrived before the gate closed and is still waiting for
+    ///   [`NativeMenu::take_clicks`]. The built-in items (Hide, Hide Others, Minimize, Quit) stay.
+    ///   A greyed item's key equivalent goes to the window, so the app's key handling sees it.
+    /// - While [`Gate::recording_shortcut`] is on, every key equivalent reaches egui as the plain
+    ///   key press that was made (⌘Q, ⌘H and ⌘C included), for the shortcut recorder.
+    /// - While [`Gate::text_editing`] is on (in egui, `ctx.wants_keyboard_input()`), a key
+    ///   equivalent runs its item as an [`Event::Click`], as a Mac app's menu commands run while
+    ///   typing, except the keys the field handles itself: ⌘C, ⌘X and ⌘V (following
+    ///   [`ClipboardKeys`]) and [`craft_keymap::text_editing_chords`] (⌘A, ⌘Z, ⇧⌘Z, ⌘←, …) stay
+    ///   key presses.
+    pub fn set_gate(&mut self, gate: Gate) {
+        self.gate = gate;
+        self.dispatch.lock().gate = gate;
+    }
+
+    /// Run `hook` with each command clicked in the menus, from the menu event handler, as the
+    /// click arrives: on macOS on the main thread, between frames, also while egui is idle. Only
+    /// app commands the current gate ([`NativeMenu::set_gate`]) allows reach it, and key
+    /// equivalents reported as key presses don't. It must return quickly; it is for waking the
+    /// app's own loop or a worker.
+    ///
+    /// The hook returns `true` when it ran the command: [`NativeMenu::take_clicks`] then leaves
+    /// it out. A command it returned `false` for comes back from `take_clicks`, after the gate as
+    /// it is then.
+    pub fn on_command(&mut self, hook: CommandHook) {
+        self.dispatch.lock().hook = Some(Arc::from(hook));
+    }
+
+    /// Before egui sees this frame's input: key equivalents become the key presses they were,
+    /// and clicks wait for [`NativeMenu::take_clicks`].
+    ///
+    /// A click or Escape in the window closes an open native menu. AppKit can deliver it to the
+    /// window while the menu is still open (asynchronous menu presentation), so while the backend
+    /// reports one open, the click or Escape is taken out of the input: it closes the menu
+    /// without starting a canvas gesture or reaching the active tool. Pointer moves stay. Only
+    /// one such click is kept from egui until the backend reports no menu open again, so a
+    /// backend that wrongly keeps reporting one open costs one click, not every click.
+    ///
+    /// AppKit takes only the key-down: winit still delivers the key-up (it forwards key-ups while
+    /// ⌘ is held). So a key equivalent adds just its press, ahead of its key-up when that is
+    /// already queued. Adding a made-up release as well sends two key-ups; in PhotoCraft, which
+    /// reads a ⌘V release without a press as an image paste, that made ⌘V paste three times.
+    /// ⌘C, ⌘X and ⌘V follow [`ClipboardKeys`].
+    pub fn raw_input(&mut self, raw: &mut egui::RawInput) {
+        // The window's own input, before key equivalents are added to it.
+        if let Some(kept) = dismiss_input(raw, || self.armed && self.backend.tracking()) {
+            if kept {
+                self.armed = false;
+            }
+            // Also without a menu reported open: an asynchronously presented menu can still be
+            // on screen after it reports closing.
+            self.backend.cancel_tracking();
+        }
+        if !self.armed && !self.backend.tracking() {
+            self.armed = true;
+        }
+        for e in self.backend.drain() {
+            match e {
+                Event::Key(chord) => self.add_key(raw, &chord, false),
+                Event::Tap(chord) => self.add_key(raw, &chord, true),
+                Event::Click(command) => self.clicks.push(command),
+                Event::Handled(_) => {}
+            }
+            self.dirty = true;
+        }
+    }
+
+    /// `tap`: a press and its release, for a click that stands for the key (no key-up follows).
+    fn add_key(&mut self, raw: &mut egui::RawInput, chord: &Chord, tap: bool) {
+        let pressed_key = chord.key.to_egui();
+        let clipboard = self.clipboard == ClipboardKeys::Egui && chord.mods == Mods::CMD && !self.gate.recording_shortcut;
+        let event = match chord.key {
+            Key::C if clipboard => egui::Event::Copy,
+            Key::X if clipboard => egui::Event::Cut,
+            Key::V if clipboard => {
+                self.paste = true;
+                return;
+            }
+            _ => key_event(chord, true),
+        };
+        let at = raw
+            .events
+            .iter()
+            .position(|e| matches!(e, egui::Event::Key { key, pressed: false, .. } if *key == pressed_key))
+            .unwrap_or(raw.events.len());
+        let press = matches!(event, egui::Event::Key { .. });
+        raw.events.insert(at, event);
+        if tap && press {
+            raw.events.insert(at + 1, key_event(chord, false));
+        }
+    }
+
+    /// The commands clicked since the last call that the gate ([`NativeMenu::set_gate`]) allows
+    /// now, for the app to run like in-window menu clicks; the others are dropped.
+    /// [`Builtin::Minimize`] (minimizes the window) and [`Builtin::Quit`] (asks the window to
+    /// close, see [`craft_quit::on_menu_event`]) are run here and left out. A ⌘V from the menu
+    /// ([`ClipboardKeys::Egui`]) is asked of eframe here too.
+    pub fn take_clicks(&mut self, ctx: &egui::Context) -> Vec<CommandRef> {
+        if std::mem::take(&mut self.paste) {
+            ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaste);
+        }
+        let mut out = Vec::new();
+        for command in std::mem::take(&mut self.clicks) {
+            if !self.gate.allows_command(&command) {
+                continue;
+            }
+            match Builtin::of(&command) {
+                Some(Builtin::Minimize) => ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(true)),
+                Some(Builtin::Quit) => {
+                    craft_quit::on_menu_event(ctx, Builtin::Quit.id());
+                }
+                _ => out.push(command),
+            }
+        }
+        out
+    }
+
+    /// Bring the native menu up to date. `state` is a hash of what the menus show (see
+    /// [`had_input`]); `build` lays them out ([`crate::mac_layout`]) and runs only when `state`
+    /// changed or a menu event arrived since the last sync, since building the rows usually walks
+    /// every command's enabled state. A menu event re-syncs because AppKit flips a check or radio
+    /// item's state itself when it is chosen: the sync sets it back to the app's state. A gate
+    /// change ([`NativeMenu::set_gate`]) re-syncs the menus last laid out, greyed or not, without
+    /// calling `build`.
+    ///
+    /// `state` must cover everything the menus show. A change that comes without input, such as
+    /// a load or save finishing on a worker or a timer, leaves the menus stale until the next
+    /// input or menu event unless it is in the hash. An app that can't keep the hash complete
+    /// uses [`NativeMenu::sync`] instead.
+    ///
+    /// Returns the layout's clashes when they differ from the last ones returned, for the app to
+    /// log; otherwise nothing.
+    pub fn sync_with(&mut self, state: u64, build: impl FnOnce() -> Layout) -> Vec<Clash> {
+        let relayout = self.state != Some(state) || self.dirty;
+        if !relayout && self.synced_gate == Some(self.gate) {
+            return Vec::new();
+        }
+        let mut clashes = Vec::new();
+        if relayout {
+            let mut layout = build();
+            self.keep_kinds(&mut layout.bar);
+            clashes = self.keep(layout);
+            self.state = Some(state);
+        }
+        self.push();
+        clashes
+    }
+
+    /// [`NativeMenu::sync_with`] without a state hash: the app lays the menus out every frame
+    /// and they are synced when the layout differs from the last one (or a menu event or gate
+    /// change calls for it), so they never go stale. It costs a layout per frame.
+    pub fn sync(&mut self, mut layout: Layout) -> Vec<Clash> {
+        self.keep_kinds(&mut layout.bar);
+        if !self.dirty && self.bar.as_ref() == Some(&layout.bar) && self.clashes == layout.clashes && self.synced_gate == Some(self.gate) {
+            return Vec::new();
+        }
+        let clashes = self.keep(layout);
+        // A later `sync_with` lays the menus out again.
+        self.state = None;
+        self.push();
+        clashes
+    }
+
+    /// An item that was a check item once stays one, unchecked: switching its kind would change
+    /// [`crate::structure_key`] and rebuild the menus.
+    fn keep_kinds(&mut self, bar: &mut MenuBar) {
+        let checkable = &mut self.checkable;
+        bar.for_each_item_mut(|it| match it.kind {
+            ItemKind::Check(_) => {
+                checkable.insert(it.command.key());
+            }
+            ItemKind::Plain if checkable.contains(&it.command.key()) => it.kind = ItemKind::Check(false),
+            _ => {}
+        });
+    }
+
+    /// Keep `layout` as the menus to show; its clashes when they differ from the last ones.
+    fn keep(&mut self, layout: Layout) -> Vec<Clash> {
+        self.dirty = false;
+        self.bar = Some(layout.bar);
+        if layout.clashes == self.clashes {
+            return Vec::new();
+        }
+        self.clashes = layout.clashes.clone();
+        layout.clashes
+    }
+
+    /// Sync the backend with the kept menus, greyed by the gate.
+    fn push(&mut self) {
+        if let Some(bar) = &self.bar {
+            self.backend.sync(&self.gate.grey(bar));
+        }
+        self.synced_gate = Some(self.gate);
+    }
+}
+
+/// `Some` when `raw` has a press or Escape that closes an open menu: `Some(true)` when, with
+/// `tracking` (a menu is open), those events were removed, since they belong to the menu.
+pub(crate) fn dismiss_input(raw: &mut egui::RawInput, tracking: impl FnOnce() -> bool) -> Option<bool> {
+    if !raw
+        .events
+        .iter()
+        .any(|e| matches!(e, egui::Event::PointerButton { pressed: true, .. } | egui::Event::Key { key: egui::Key::Escape, pressed: true, .. }))
+    {
+        return None;
+    }
+    let kept = tracking();
+    if kept {
+        raw.events.retain(|e| !matches!(e, egui::Event::PointerButton { .. } | egui::Event::Key { key: egui::Key::Escape, .. }));
+    }
+    Some(kept)
+}
+
+/// What a backend reports for an item chosen with `command`, `chord` (its shortcut) and
+/// `layout_shortcut` ([`crate::Item::layout_shortcut`]) under `gate`. `held` holds the modifiers
+/// held when a key-down chose it, `None` for a mouse click.
+///
+/// A key-down is the item's key equivalent, reported as the key press, unless it was ↩ or Space
+/// inside the open menu: the item's shortcut is not a key equivalent at all ([`native_ok`]), or
+/// neither ⌘ nor ⌃ is held. The key is the item's (AppKit matched on it); the modifiers are the
+/// ones held, since AppKit may match ⌘R to a ⇧⌘R item. Minimize, craft-quit's Quit and shortcuts
+/// the layout assigned are run by the driver or the app's click handling, not by its key
+/// handling, so they stay clicks. While text editing, the app's key handling leaves shortcuts to
+/// the field, so a key equivalent is a click too, except the field's own editing keys
+/// ([`text_editing_key`]); a mouse click on one of those items (Edit › Copy, Undo) is a tap of
+/// its shortcut ([`Event::Tap`]), so it acts on the field rather than the document. While recording a shortcut every key equivalent is a key press, for the
+/// recorder.
+pub(crate) fn chosen_event(command: &CommandRef, chord: Option<&Chord>, layout_shortcut: bool, held: Option<Mods>, gate: Gate) -> Event {
+    let recording = gate.recording_shortcut;
+    let runs_as_click = !recording && (layout_shortcut || matches!(Builtin::of(command), Some(Builtin::Minimize | Builtin::Quit)));
+    let Some(held) = held else {
+        return match chord {
+            Some(c) if !recording && gate.text_editing && text_editing_key(c) => Event::Tap(*c),
+            _ => Event::Click(command.clone()),
+        };
+    };
+    let pressed = chord
+        .filter(|c| !runs_as_click && native_ok(c) && (held.cmd || held.ctrl))
+        .map(|c| Chord::new(held, c.key))
+        .filter(|c| recording || !gate.text_editing || text_editing_key(c));
+    match pressed {
+        Some(chord) => Event::Key(chord),
+        None => Event::Click(command.clone()),
+    }
+}
+
+/// A chord a text field handles itself: the clipboard keys and craft-keymap's text-editing
+/// chords (undo, redo, select all, moving by word and line).
+fn text_editing_key(c: &Chord) -> bool {
+    const CLIPBOARD: [Chord; 3] = [Chord::new(Mods::CMD, Key::C), Chord::new(Mods::CMD, Key::X), Chord::new(Mods::CMD, Key::V)];
+    CLIPBOARD.contains(c) || craft_keymap::text_editing_chords(craft_keymap::Platform::Mac).contains(c)
+}
+
+/// May the native menu make this a key equivalent? Only with ⌘ or ⌃. Other shortcuts (a bare
+/// letter, ⇧ or ⌥ alone, a bare function key) are tool keys: as key equivalents AppKit would take
+/// a `b` typed into a text field, and the app's key handling may bind them per tool or context.
+/// They are shown but not made key equivalents.
+pub(crate) fn native_ok(c: &Chord) -> bool {
+    c.has_command()
+}
+
+/// The key press egui would have received for `chord` on macOS: `cmd` is ⌘, `ctrl` the Control
+/// key.
+pub(crate) fn key_event(chord: &Chord, pressed: bool) -> egui::Event {
+    let m = chord.mods;
+    let key = chord.key.to_egui();
+    let modifiers = egui::Modifiers { alt: m.alt, ctrl: m.ctrl, shift: m.shift, mac_cmd: m.cmd, command: m.cmd };
+    egui::Event::Key { key, physical_key: Some(key), pressed, repeat: false, modifiers }
+}
+
+/// A key press or click this frame. It may have changed state an app's menu hash doesn't list,
+/// so apps fold it into the `state` passed to [`NativeMenu::sync_with`], for example as
+/// `had_input(ctx).then_some(ctx.cumulative_frame_nr())`.
+pub fn had_input(ctx: &egui::Context) -> bool {
+    ctx.input(|i| i.events.iter().any(|e| matches!(e, egui::Event::Key { pressed: true, .. } | egui::Event::PointerButton { pressed: false, .. })))
+}
diff --git a/crates/menu/src/keymap.rs b/crates/menu/src/keymap.rs
new file mode 100644
index 00000000..352a85d9
--- /dev/null
+++ b/crates/menu/src/keymap.rs
@@ -0,0 +1,62 @@
+//! Shortcuts and checked states from the app's craft-keymap [`Keymap`], and the per-frame
+//! enabled and checked update.
+
+use craft_keymap::{CommandRef, Keymap};
+
+use crate::model::{Builtin, ItemKind, MenuBar};
+
+/// Give each item the shortcut its command has in `keymap`, the user's overrides included, and
+/// make the items of toggle commands ([`craft_keymap::Bindable::is_toggle`]) check items.
+///
+/// The shortcut is the first single-press binding, one in the command's home scope first; a
+/// double press can't be a menu shortcut. A command the keymap binds to nothing loses its
+/// shortcut, and an item whose command the keymap doesn't know keeps its own. A toggle's check
+/// item keeps its checked state; radio items stay radio items. Call it on the app's bar, before
+/// the layout.
+pub fn apply_keymap(bar: &mut MenuBar, keymap: &Keymap) {
+    bar.for_each_item_mut(|it| {
+        let Some(bindable) = keymap.bindable(&it.command) else { return };
+        let bindings = keymap.bindings(&it.command);
+        let single = || bindings.iter().filter(|b| !b.trigger.double);
+        let home = single().find(|b| *b.scope_or(&bindable.scope) == bindable.scope);
+        it.shortcut = home.or_else(|| single().next()).map(|b| b.trigger.chord);
+        if bindable.is_toggle && it.kind == ItemKind::Plain {
+            it.kind = ItemKind::Check(false);
+        }
+    });
+}
+
+/// An item's state for the frame.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct ItemState {
+    pub enabled: bool,
+    /// Checked or selected; `None` leaves the item's [`ItemKind`] as it is.
+    pub checked: Option<bool>,
+}
+
+impl Default for ItemState {
+    /// Enabled, the kind left as it is.
+    fn default() -> ItemState {
+        ItemState { enabled: true, checked: None }
+    }
+}
+
+/// Set every item's enabled and checked state from `state`, called once per item of the app's
+/// commands. `checked: Some(..)` makes a plain item a check item and sets a radio item's
+/// selection. The built-in items and the open documents are left alone.
+pub fn apply_state(bar: &mut MenuBar, mut state: impl FnMut(&CommandRef) -> ItemState) {
+    let documents: Vec<CommandRef> = bar.documents.iter().map(|d| d.command.clone()).collect();
+    bar.for_each_item_mut(|it| {
+        if Builtin::of(&it.command).is_some() || documents.contains(&it.command) {
+            return;
+        }
+        let s = state(&it.command);
+        it.enabled = s.enabled;
+        if let Some(on) = s.checked {
+            it.kind = match it.kind {
+                ItemKind::Radio(_) => ItemKind::Radio(on),
+                ItemKind::Plain | ItemKind::Check(_) => ItemKind::Check(on),
+            };
+        }
+    });
+}
diff --git a/crates/menu/src/layout.rs b/crates/menu/src/layout.rs
new file mode 100644
index 00000000..51f45959
--- /dev/null
+++ b/crates/menu/src/layout.rs
@@ -0,0 +1,480 @@
+//! The platform layouts of an app's menus. See the crate docs for what they do.
+
+use std::collections::HashMap;
+
+use craft_keymap::{Chord, CommandRef, Key, Mods};
+
+use crate::model::{Builtin, Item, ItemRole, Menu, MenuBar, MenuRole, Node, Platforms, Standard, tidy};
+
+const CTRL_CMD: Mods = Mods { ctrl: true, ..Mods::CMD };
+const ALT_CMD: Mods = Mods { alt: true, ..Mods::CMD };
+const CMD_H: Chord = Chord::new(Mods::CMD, Key::H);
+const CTRL_CMD_H: Chord = Chord::new(CTRL_CMD, Key::H);
+const ALT_CMD_H: Chord = Chord::new(ALT_CMD, Key::H);
+const CMD_Q: Chord = Chord::new(Mods::CMD, Key::Q);
+const CMD_W: Chord = Chord::new(Mods::CMD, Key::W);
+const CMD_M: Chord = Chord::new(Mods::CMD, Key::M);
+const CTRL_CMD_M: Chord = Chord::new(CTRL_CMD, Key::M);
+const CMD_COMMA: Chord = Chord::new(Mods::CMD, Key::Comma);
+
+/// The platform a layout is for.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Target {
+    Mac,
+    Windows,
+    Linux,
+    /// A browser, on any operating system.
+    Web,
+}
+
+impl Target {
+    /// The platform this build runs on: `wasm32` builds are [`Target::Web`], and operating
+    /// systems other than macOS and Windows are [`Target::Linux`].
+    pub const fn current() -> Target {
+        if cfg!(target_arch = "wasm32") {
+            Target::Web
+        } else if cfg!(target_os = "macos") {
+            Target::Mac
+        } else if cfg!(target_os = "windows") {
+            Target::Windows
+        } else {
+            Target::Linux
+        }
+    }
+
+    /// The [`Platforms`] flag an item needs to be shown on this target.
+    pub const fn platforms(self) -> Platforms {
+        match self {
+            Target::Mac => Platforms::MAC,
+            Target::Windows => Platforms::WINDOWS,
+            Target::Linux => Platforms::LINUX,
+            Target::Web => Platforms::WEB,
+        }
+    }
+}
+
+/// The app's name, its translations of the labels the layout writes itself, and its shortcuts
+/// that no menu item shows.
+pub struct LayoutOptions<'a> {
+    /// Shown in the About, Hide and Quit items.
+    pub app_name: &'a str,
+    /// The app's translation of an English label a layout uses: `About {app}`, `Settings…`,
+    /// `Settings`, `Language`, `Appearance`, `Hide {app}`, `Hide Others`, `Quit {app}`, `Minimize`,
+    /// `Preferences…`, `Preferences`, `Exit`, `Quit`, the menu titles `File`, `Edit`, `Window` and
+    /// `Help`, and each [`Standard::english`]. `{app}` is replaced by [`LayoutOptions::app_name`]
+    /// afterwards.
+    pub label: &'a dyn Fn(&'static str) -> String,
+    /// Shortcuts the app binds outside its menus (tool keys, canvas keys), with their commands:
+    /// the system items give way to them as to menu shortcuts.
+    pub extra_shortcuts: &'a [(Chord, CommandRef)],
+}
+
+impl<'a> LayoutOptions<'a> {
+    /// English labels.
+    pub fn new(app_name: &'a str) -> LayoutOptions<'a> {
+        LayoutOptions { app_name, label: &english, extra_shortcuts: &[] }
+    }
+
+    pub fn extra_shortcuts(mut self, shortcuts: &'a [(Chord, CommandRef)]) -> LayoutOptions<'a> {
+        self.extra_shortcuts = shortcuts;
+        self
+    }
+
+    fn text(&self, english: &'static str) -> String {
+        (self.label)(english).replace("{app}", self.app_name)
+    }
+
+    fn standard(&self, kind: Standard) -> Node {
+        Node::Standard { kind, label: self.text(kind.english()) }
+    }
+}
+
+fn english(s: &'static str) -> String {
+    s.into()
+}
+
+/// A system or browser shortcut the app also uses for one of its commands.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Clash {
+    pub shortcut: Chord,
+    /// What macOS or the browser uses it for.
+    pub system: &'static str,
+    /// The app's command bound to it.
+    pub command: CommandRef,
+    /// What the layout did about it.
+    pub resolution: &'static str,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Layout {
+    pub bar: MenuBar,
+    pub clashes: Vec<Clash>,
+}
+
+/// Lay an app's menus out for `target`: [`mac_layout`], [`desktop_layout`] or [`web_layout`].
+pub fn layout(bar: &MenuBar, target: Target, options: &LayoutOptions) -> Layout {
+    match target {
+        Target::Mac => mac_layout(bar, options),
+        Target::Windows | Target::Linux => desktop_layout(bar, target, options),
+        Target::Web => web_layout(bar, options),
+    }
+}
+
+/// Turn an app's menus, tagged with roles, into a Mac menu bar. See the crate docs.
+///
+/// A menu the app tagged [`MenuRole::App`] is merged into the app menu: its tagged items go where
+/// their roles put them, the rest after Settings, Language and Appearance.
+pub fn mac_layout(bar: &MenuBar, options: &LayoutOptions) -> Layout {
+    let mut bar = shown_on(bar, Target::Mac);
+    let mut clashes = Vec::new();
+    let mut bound: HashMap<Chord, CommandRef> = HashMap::new();
+    let menu_shortcuts = bar.items().into_iter().filter_map(|it| Some((it.shortcut?, &it.command)));
+    let extra = options.extra_shortcuts.iter().map(|(sc, command)| (*sc, command));
+    for (sc, command) in menu_shortcuts.chain(extra) {
+        bound.entry(sc).or_insert_with(|| command.clone());
+    }
+    let taken = |sc: Chord, own: Option<&CommandRef>| bound.get(&sc).filter(|cmd| Some(*cmd) != own).cloned();
+    let tagged = |role: ItemRole| {
+        move |n: &Node| match n {
+            Node::Item(it) => it.role == Some(role),
+            Node::Submenu { role: r, .. } => *r == Some(role),
+            _ => false,
+        }
+    };
+
+    let about = take(&mut bar, |n| matches!(n, Node::Item(it) if it.role == Some(ItemRole::About)));
+    let settings = take(&mut bar, tagged(ItemRole::Settings));
+    let language = take(&mut bar, tagged(ItemRole::Language));
+    let quit = take(&mut bar, |n| matches!(n, Node::Item(it) if it.role == Some(ItemRole::Quit)));
+    let appearance = appearance_node(&mut bar, options);
+    let own_app: Vec<Node> = match bar.menus.iter().position(|m| m.role == MenuRole::App) {
+        Some(i) => bar.menus.remove(i).children,
+        None => Vec::new(),
+    };
+
+    let mut menu = Vec::new();
+    if let Some(Node::Item(mut it)) = about {
+        it.label = options.text("About {app}");
+        menu.extend([Node::Item(it), Node::Separator]);
+    }
+    if let Some(s) = settings {
+        let own = node_commands(&s);
+        let comma = bound.get(&CMD_COMMA).filter(|cmd| !own.contains(*cmd)).cloned();
+        menu.push(settings_node(s, comma, options, &mut clashes));
+    }
+    if let Some(mut l) = language {
+        if let Node::Submenu { label, .. } = &mut l {
+            *label = options.text("Language");
+        }
+        menu.push(l);
+    }
+    menu.extend(appearance);
+    if !own_app.is_empty() {
+        menu.push(Node::Separator);
+        menu.extend(own_app);
+    }
+    if !menu.is_empty() && menu.last() != Some(&Node::Separator) {
+        menu.push(Node::Separator);
+    }
+    menu.extend([options.standard(Standard::Services), Node::Separator]);
+    let mut hide = Item::new(Builtin::Hide.command(), options.text("Hide {app}")).role(ItemRole::Hide);
+    hide.layout_shortcut = true;
+    match taken(CMD_H, None) {
+        Some(command) => {
+            let free = taken(CTRL_CMD_H, None).is_none();
+            if free {
+                hide.shortcut = Some(CTRL_CMD_H);
+            }
+            let resolution = if free { "Hide moves to ⌃⌘H" } else { "Hide has no shortcut" };
+            clashes.push(Clash { shortcut: CMD_H, system: "Hide", command, resolution });
+        }
+        None => hide.shortcut = Some(CMD_H),
+    }
+    menu.push(Node::Item(hide));
+    let mut hide_others = Item::new(Builtin::HideOthers.command(), options.text("Hide Others"));
+    hide_others.layout_shortcut = true;
+    match taken(ALT_CMD_H, None) {
+        Some(command) => clashes.push(Clash { shortcut: ALT_CMD_H, system: "Hide Others", command, resolution: "Hide Others has no shortcut" }),
+        None => hide_others.shortcut = Some(ALT_CMD_H),
+    }
+    menu.extend([Node::Item(hide_others), options.standard(Standard::ShowAll), Node::Separator]);
+    let mut quit = match quit {
+        Some(Node::Item(it)) => it,
+        _ => Item::new(Builtin::Quit.command(), "").role(ItemRole::Quit),
+    };
+    quit.label = options.text("Quit {app}");
+    match taken(CMD_Q, Some(&quit.command)) {
+        Some(command) => {
+            clashes.push(Clash { shortcut: CMD_Q, system: "Quit", command, resolution: "Quit has no shortcut" });
+            quit.shortcut = None;
+        }
+        None => {
+            quit.layout_shortcut = quit.shortcut != Some(CMD_Q);
+            quit.shortcut = Some(CMD_Q);
+        }
+    }
+    menu.push(Node::Item(quit));
+    bar.menus.insert(0, Menu::new(options.app_name, menu).role(MenuRole::App));
+
+    match taken(CMD_W, None) {
+        Some(command) => clashes.push(Clash { shortcut: CMD_W, system: "Close Window", command, resolution: "no system Close Window item" }),
+        None => {
+            if let Some(file) = bar.menus.iter_mut().find(|m| m.role == MenuRole::File) {
+                file.children.extend([Node::Separator, options.standard(Standard::CloseWindow)]);
+            }
+        }
+    }
+
+    let minimize = match taken(CMD_M, None) {
+        Some(command) => {
+            let mut it = Item::new(Builtin::Minimize.command(), options.text("Minimize")).role(ItemRole::Minimize);
+            it.layout_shortcut = true;
+            let free = taken(CTRL_CMD_M, None).is_none();
+            if free {
+                it.shortcut = Some(CTRL_CMD_M);
+            }
+            let resolution = if free { "Minimize moves to ⌃⌘M" } else { "Minimize has no shortcut" };
+            clashes.push(Clash { shortcut: CMD_M, system: "Minimize", command, resolution });
+            Node::Item(it)
+        }
+        None => options.standard(Standard::Minimize),
+    };
+    let documents = document_items(&bar);
+    let window = ensure_menu(&mut bar, MenuRole::Window, "Window", options);
+    let mut children = vec![minimize, options.standard(Standard::Zoom), Node::Separator];
+    children.append(&mut window.children);
+    children.extend([Node::Separator, options.standard(Standard::BringAllToFront), Node::Separator]);
+    children.extend(documents);
+    window.children = children;
+
+    // The Help menu stays even when empty: it has the search field.
+    finish(&mut bar, |m| m.role == MenuRole::Help);
+    Layout { bar, clashes }
+}
+
+/// Lay an app's menus out the Windows or Linux way:
+/// - About goes last in Help, as `About {app}`;
+/// - Settings goes last in Edit, as `Preferences…` (an item) or `Preferences` (a submenu);
+/// - Quit goes last in File, as `Exit` on Windows and `Quit` elsewhere: the app's item tagged
+///   [`ItemRole::Quit`], or [`Builtin::Quit`];
+/// - the open documents go last in Window, as radio items.
+///
+/// The layout creates the File, Edit, Help and Window menus these need, and adds no Services,
+/// Hide or Minimize items. Language and Appearance stay where the app put them, and items keep
+/// the app's shortcuts. AppKit's items ([`Node::Standard`]) are dropped.
+pub fn desktop_layout(bar: &MenuBar, target: Target, options: &LayoutOptions) -> Layout {
+    let quit = if target == Target::Windows { "Exit" } else { "Quit" };
+    Layout { bar: desktop_bar(bar, target, Some(quit), options), clashes: Vec::new() }
+}
+
+/// Lay an app's menus out for a browser: [`desktop_layout`] without a Quit item. Shortcuts the
+/// browser keeps for itself (Ctrl or ⌘ with W, N, T or Q, and with Shift+N, Shift+T or Shift+W)
+/// are taken off the items and reported as clashes, since the page never sees them.
+pub fn web_layout(bar: &MenuBar, options: &LayoutOptions) -> Layout {
+    let mut bar = desktop_bar(bar, Target::Web, None, options);
+    let mut clashes = Vec::new();
+    bar.for_each_item_mut(|it| {
+        if let Some(shortcut) = it.shortcut
+            && let Some(system) = browser_reserved(shortcut)
+        {
+            clashes.push(Clash { shortcut, system, command: it.command.clone(), resolution: "not shown: the browser keeps it" });
+            it.shortcut = None;
+        }
+    });
+    Layout { bar, clashes }
+}
+
+// Browsers run these themselves and never pass them to the page. craft_keymap::reserved lists
+// only the operating systems' chords.
+const BROWSER: &[(Key, bool, &str)] = &[
+    (Key::W, false, "Close Tab"),
+    (Key::N, false, "New Window"),
+    (Key::T, false, "New Tab"),
+    (Key::Q, false, "Quit"),
+    (Key::N, true, "New Private Window"),
+    (Key::T, true, "Reopen Closed Tab"),
+    (Key::W, true, "Close Window"),
+];
+
+/// What the browser uses `chord` for, if it keeps it. Either command modifier counts (Ctrl off
+/// macOS, ⌘ on it), since a web build serves both.
+fn browser_reserved(chord: Chord) -> Option<&'static str> {
+    let m = chord.mods;
+    if m.cmd == m.ctrl || m.alt {
+        return None;
+    }
+    BROWSER.iter().find(|(key, shift, _)| *key == chord.key && *shift == m.shift).map(|(_, _, what)| *what)
+}
+
+/// [`desktop_layout`], with Quit labelled `quit` or left out.
+fn desktop_bar(bar: &MenuBar, target: Target, quit: Option<&'static str>, options: &LayoutOptions) -> MenuBar {
+    let mut bar = shown_on(bar, target);
+    let item = |role: ItemRole| move |n: &Node| matches!(n, Node::Item(it) if it.role == Some(role));
+    let about = take(&mut bar, item(ItemRole::About));
+    let settings = take(&mut bar, |n| match n {
+        Node::Item(it) => it.role == Some(ItemRole::Settings),
+        Node::Submenu { role, .. } => *role == Some(ItemRole::Settings),
+        _ => false,
+    });
+    let own_quit = take(&mut bar, item(ItemRole::Quit));
+
+    if let Some(label) = quit {
+        let mut it = match own_quit {
+            Some(Node::Item(it)) => it,
+            _ => Item::new(Builtin::Quit.command(), "").role(ItemRole::Quit),
+        };
+        it.label = options.text(label);
+        ensure_menu(&mut bar, MenuRole::File, "File", options).children.extend([Node::Separator, Node::Item(it)]);
+    }
+    if let Some(s) = settings {
+        let s = match s {
+            Node::Item(mut it) => {
+                it.label = options.text("Preferences…");
+                Node::Item(it)
+            }
+            Node::Submenu { children, role, platforms, .. } => Node::Submenu { label: options.text("Preferences"), children, role, platforms },
+            other => other,
+        };
+        ensure_menu(&mut bar, MenuRole::Edit, "Edit", options).children.extend([Node::Separator, s]);
+    }
+    let documents = document_items(&bar);
+    if !documents.is_empty() {
+        let window = ensure_menu(&mut bar, MenuRole::Window, "Window", options);
+        window.children.push(Node::Separator);
+        window.children.extend(documents);
+    }
+    if let Some(Node::Item(mut it)) = about {
+        it.label = options.text("About {app}");
+        ensure_menu(&mut bar, MenuRole::Help, "Help", options).children.extend([Node::Separator, Node::Item(it)]);
+    }
+    finish(&mut bar, |_| false);
+    bar
+}
+
+/// The app's menus with only what `target` shows: no items or submenus whose [`Platforms`]
+/// leave it out, and no AppKit items off macOS. Tidied, so a submenu left empty goes.
+fn shown_on(bar: &MenuBar, target: Target) -> MenuBar {
+    fn keep(nodes: &[Node], on: Platforms, appkit: bool) -> Vec<Node> {
+        let shown = nodes.iter().filter_map(|n| match n {
+            Node::Item(it) if !it.platforms.contains(on) => None,
+            Node::Submenu { platforms, .. } if !platforms.contains(on) => None,
+            Node::Submenu { label, children, role, platforms } => {
+                Some(Node::Submenu { label: label.clone(), children: keep(children, on, appkit), role: *role, platforms: *platforms })
+            }
+            Node::Standard { .. } if !appkit => None,
+            other => Some(other.clone()),
+        });
+        tidy(shown.collect())
+    }
+    let on = target.platforms();
+    let menus = bar.menus.iter().map(|m| Menu { children: keep(&m.children, on, target == Target::Mac), ..m.clone() }).collect();
+    MenuBar { menus, documents: bar.documents.clone() }
+}
+
+/// The listed documents as radio items, the one in front selected, after a separator.
+fn document_items(bar: &MenuBar) -> Vec<Node> {
+    let items: Vec<Node> =
+        bar.documents.iter().filter(|d| !d.hidden).map(|d| Item::new(d.command.clone(), d.label.clone()).radio(d.active).into()).collect();
+    if items.is_empty() {
+        return items;
+    }
+    std::iter::once(Node::Separator).chain(items).collect()
+}
+
+/// The menu with `role`, added with the title `english` when the app has none: File first, Edit
+/// after File, Help last, any other before Help.
+fn ensure_menu<'b>(bar: &'b mut MenuBar, role: MenuRole, english: &'static str, options: &LayoutOptions) -> &'b mut Menu {
+    let at = match bar.menus.iter().position(|m| m.role == role) {
+        Some(i) => i,
+        None => {
+            let at = match role {
+                MenuRole::File => 0,
+                MenuRole::Edit => bar.menus.iter().position(|m| m.role == MenuRole::File).map_or(0, |i| i + 1),
+                MenuRole::Help => bar.menus.len(),
+                _ => bar.menus.iter().position(|m| m.role == MenuRole::Help).unwrap_or(bar.menus.len()),
+            };
+            bar.menus.insert(at, Menu::new(options.text(english), Vec::new()).role(role));
+            at
+        }
+    };
+    &mut bar.menus[at]
+}
+
+/// Tidy every menu and drop the ones the moves emptied, unless `keep_empty`.
+fn finish(bar: &mut MenuBar, keep_empty: impl Fn(&Menu) -> bool) {
+    for m in &mut bar.menus {
+        m.children = tidy(std::mem::take(&mut m.children));
+    }
+    bar.menus.retain(|m| !m.children.is_empty() || keep_empty(m));
+}
+
+/// Settings in the app menu: an item becomes "Settings…", a submenu of settings pages
+/// "Settings". ⌘, goes to the item or the first enabled page, unless the app binds ⌘, elsewhere.
+fn settings_node(node: Node, comma_taken: Option<CommandRef>, options: &LayoutOptions, clashes: &mut Vec<Clash>) -> Node {
+    if let Some(command) = &comma_taken {
+        clashes.push(Clash { shortcut: CMD_COMMA, system: "Settings", command: command.clone(), resolution: "Settings has no shortcut" });
+    }
+    let give = |it: &mut Item| {
+        if comma_taken.is_none() && it.shortcut.is_none() {
+            it.shortcut = Some(CMD_COMMA);
+            it.layout_shortcut = true;
+        }
+    };
+    match node {
+        Node::Item(mut it) => {
+            it.label = options.text("Settings…");
+            give(&mut it);
+            Node::Item(it)
+        }
+        Node::Submenu { mut children, role, platforms, .. } => {
+            if let Some(Node::Item(first)) = children.iter_mut().find(|n| matches!(n, Node::Item(i) if i.enabled)) {
+                give(first);
+            }
+            Node::Submenu { label: options.text("Settings"), children, role, platforms }
+        }
+        other => other,
+    }
+}
+
+/// Appearance in the app menu: the submenu tagged [`ItemRole::Appearance`], renamed, with the
+/// items tagged the same (Next Theme) after it. Without such a submenu the tagged items go into
+/// the app menu as they are.
+fn appearance_node(bar: &mut MenuBar, options: &LayoutOptions) -> Vec<Node> {
+    let submenu = take(bar, |n| matches!(n, Node::Submenu { role, .. } if *role == Some(ItemRole::Appearance)));
+    let mut items = Vec::new();
+    while let Some(it) = take(bar, |n| matches!(n, Node::Item(it) if it.role == Some(ItemRole::Appearance))) {
+        items.push(it);
+    }
+    match submenu {
+        Some(Node::Submenu { mut children, role, platforms, .. }) => {
+            if !items.is_empty() {
+                children.push(Node::Separator);
+                children.extend(items);
+            }
+            vec![Node::Submenu { label: options.text("Appearance"), children, role, platforms }]
+        }
+        _ => items,
+    }
+}
+
+fn node_commands(node: &Node) -> Vec<CommandRef> {
+    match node {
+        Node::Item(it) => vec![it.command.clone()],
+        Node::Submenu { children, .. } => children.iter().flat_map(node_commands).collect(),
+        _ => Vec::new(),
+    }
+}
+
+/// Remove and return the first node matching `pred`, at any depth.
+fn take(bar: &mut MenuBar, pred: impl Fn(&Node) -> bool + Copy) -> Option<Node> {
+    fn walk(nodes: &mut Vec<Node>, pred: impl Fn(&Node) -> bool + Copy) -> Option<Node> {
+        if let Some(i) = nodes.iter().position(pred) {
+            return Some(nodes.remove(i));
+        }
+        nodes.iter_mut().find_map(|n| match n {
+            Node::Submenu { children, .. } => walk(children, pred),
+            _ => None,
+        })
+    }
+    bar.menus.iter_mut().find_map(|m| walk(&mut m.children, pred))
+}
diff --git a/crates/menu/src/lib.rs b/crates/menu/src/lib.rs
new file mode 100644
index 00000000..6e46250c
--- /dev/null
+++ b/crates/menu/src/lib.rs
@@ -0,0 +1,100 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+//! A Craft app's menus, laid out for macOS, Windows, Linux and the web.
+//!
+//! The app supplies its menus as a tree ([`MenuBar`]), built directly or from the flat rows of
+//! its in-window bar ([`from_items`]), gives each top-level menu its role ([`MenuRole`]), and
+//! tags the items the layouts put in fixed places ([`MenuBar::tag_item`], [`MenuBar::tag_submenu`]).
+//! Each item runs a [`craft_keymap::CommandRef`], its shortcut is a [`craft_keymap::Chord`], and
+//! its [`ItemKind`] makes it plain, a check item or a radio item. [`layout`]
+//! arranges them the way the platform's apps do, and [`NativeMenu`] hands the result to a platform
+//! [`Backend`] and brings its events back. This part is pure and platform-free, so it is tested
+//! everywhere and builds for the web; only the backend, `mac` (macOS only, built on muda), touches
+//! AppKit. Its `mac::install` builds the menu bar and returns the [`NativeMenu`].
+//!
+//! **Layouts.** [`layout`] takes a [`Target`] ([`Target::current`] for this build) and calls
+//! [`mac_layout`], [`desktop_layout`] (Windows and Linux) or [`web_layout`]. Each first drops the
+//! items and submenus whose [`Platforms`] leave the target out, and every one lists
+//! [`MenuBar::documents`] (but the hidden ones) last in the Window menu, as radio items with the
+//! active document selected. On Windows and Linux About goes last in Help, Settings last in Edit
+//! as Preferences, and Quit last in File, as Exit on Windows; the web layout has no Quit and takes
+//! the browser's own shortcuts (Ctrl+W, Ctrl+T, …) off the items, reporting each as a [`Clash`].
+//! A layout adds the menus it needs when the app has none. A submenu left empty goes; a dynamic
+//! list with nothing in it shows the disabled placeholder item the app supplies.
+//!
+//! **Keymap.** [`apply_keymap`] sets the items' shortcuts from the app's
+//! [`craft_keymap::Keymap`], user overrides included, and makes toggle commands check items;
+//! [`apply_state`] sets enabled and checked per frame from an [`ItemState`] the app returns for
+//! each command. Both run on the app's bar, before the layout.
+//!
+//! What the Mac layout does:
+//! - an **app menu** named after the app: About (the item tagged [`ItemRole::About`]), Settings
+//!   ([`ItemRole::Settings`], an item or a submenu of pages), Language ([`ItemRole::Language`]),
+//!   Appearance ([`ItemRole::Appearance`]), Services, Hide ([`Builtin::Hide`]), Hide Others
+//!   ([`Builtin::HideOthers`]), Show All and Quit. Quit is the app's own item tagged
+//!   [`ItemRole::Quit`], so its unsaved-changes prompt runs; without one the layout adds
+//!   [`Builtin::Quit`], which asks the window to close. These items leave the menus they came from. A menu the app
+//!   tagged [`MenuRole::App`] is merged into this one;
+//! - **Window** ([`MenuRole::Window`], added when the app has none) gets Minimize, Zoom and Bring
+//!   All to Front, with the open documents ([`MenuBar::documents`]) after them, where a Mac app
+//!   lists its windows. **Help** ([`MenuRole::Help`]) gets the system search field from the
+//!   backend. **File** ([`MenuRole::File`]) gets Close Window unless the app binds ⌘W;
+//! - **clashes** with the system's keys (⌘H, ⌥⌘H, ⌘M, ⌘W, ⌘,, ⌘Q) are resolved in the app's
+//!   favour and reported ([`Clash`]); Hide and Minimize move to ⌃⌘H and ⌃⌘M, as Photoshop does,
+//!   the others go without a shortcut. Shortcuts the app binds outside its menus count too
+//!   ([`LayoutOptions::extra_shortcuts`]).
+//!
+//! The labels the layout writes itself are English unless the app passes its translations in
+//! [`LayoutOptions::label`].
+//!
+//! **Keys stay with egui.** AppKit runs a menu's key equivalents before the window sees the key,
+//! which would skip the app's own key rules (a focused text field keeps ⌘C, ⌘V and ⌘Z, dialogs
+//! are modal, a tool may have its own ⌘Z). So the backend reports a key equivalent as
+//! [`Event::Key`], and [`NativeMenu::raw_input`] feeds it to egui as the input egui-winit would
+//! have made of it: a key press, or for ⌘C, ⌘X and ⌘V egui's copy, cut and paste events
+//! ([`ClipboardKeys`]). The shortcut runs through the app's key handling as without a native
+//! menu. A click is [`Event::Click`], and [`NativeMenu::take_clicks`] returns its command for the app
+//! to run like an in-window menu click; so is a key equivalent the layout assigned (⌘Q on the
+//! app's Quit item, ⌘, on Settings), which the app's key handling doesn't know, and, while a text
+//! field has the keys ([`Gate::text_editing`]), every key equivalent but the field's own
+//! (⌘C, ⌘X, ⌘V and [`craft_keymap::text_editing_chords`]): an app's key handling skips shortcuts
+//! while text has the keys, and a Mac app's menu commands (⌘S, ⌘N) run while typing. Only
+//! shortcuts with ⌘ or ⌃ become key equivalents; tool keys (`B`, `⇧B`, `F5`) stay with the app.
+//!
+//! What may run from the menus is the app's [`Gate`], set every frame ([`NativeMenu::set_gate`]):
+//! while a modal dialog is open or a shortcut is being recorded, the app's items are greyed (but
+//! the text fields' own Undo, Copy, …) and their clicks dropped, also clicks that arrived before
+//! the gate closed. While a shortcut is
+//! recorded, key equivalents reach egui as plain key presses.
+//!
+//! craft-menu owns muda's one menu event handler: `mac::install` (a full menu bar) and
+//! `mac::install_app_menu` (a minimal app menu, for apps without a [`MenuBar`]) both use it.
+//! [`NativeMenu::on_command`] sees each allowed click as it arrives, also while egui is idle.
+//!
+//! Per frame: [`NativeMenu::raw_input`] before egui reads the input (`eframe::App::raw_input_hook`),
+//! then [`NativeMenu::set_gate`], [`NativeMenu::take_clicks`] and run the commands, then
+//! [`NativeMenu::sync_with`], which lays the menus out again only when the app's state changed
+//! (or [`NativeMenu::sync`], which compares a layout built every frame).
+//! [`NativeMenu::raw_input`] also keeps a click or Escape that closes an open native menu away
+//! from egui.
+
+pub mod bar;
+mod driver;
+mod keymap;
+mod layout;
+mod model;
+
+#[cfg(target_os = "macos")]
+pub mod mac;
+
+pub use bar::{BarStyle, Labeled, MenuBarUi};
+pub use craft_keymap::{Chord, CommandRef};
+pub use driver::{Backend, ClipboardKeys, CommandHook, Dispatch, Event, Gate, NativeMenu, had_input};
+pub use keymap::{ItemState, apply_keymap, apply_state};
+pub use layout::{Clash, Layout, LayoutOptions, Target, desktop_layout, layout, mac_layout, web_layout};
+pub use model::{
+    Builtin, Document, Item, ItemKind, ItemRole, Menu, MenuBar, MenuRole, Node, Platforms, Row, Standard, from_items, structure_key, tidy, window_key,
+};
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/menu/src/mac.rs b/crates/menu/src/mac.rs
new file mode 100644
index 00000000..e5bdd306
--- /dev/null
+++ b/crates/menu/src/mac.rs
@@ -0,0 +1,694 @@
+//! The macOS menu bar, through muda (AppKit menus behind a safe API; no GTK with default features
+//! off). This module only builds and updates the `NSMenu`s; the layout and how keys reach egui are
+//! in the platform-free part of the crate.
+//!
+//! - An item's muda id is its command's [`craft_keymap::CommandRef::key`]. muda ids must be
+//!   unique: a command shown twice (Keyboard Shortcuts in Edit and Window) has `key` for its first
+//!   item and `key#2` for its second, and both report the command.
+//! - A radio item is a check item: AppKit menus have no radio look.
+//! - A structure change ([`crate::structure_key`]: a new Open Recent file, a language switch)
+//!   rebuilds the menu bar; labels, enabled and checked are updated in place. Opening or closing a
+//!   document ([`crate::window_key`]) rebuilds only the Window menu: AppKit adds its own items to
+//!   that menu (window tiling, the window list), so muda can't insert rows there by position.
+//! - A chosen item is a click or a key equivalent: AppKit's current event says which. A key
+//!   equivalent goes back to egui as the key press that was made (the event's modifiers, not the
+//!   item's: AppKit may match ⌘R to a ⇧⌘R item), so the app's key rules still apply. A shortcut
+//!   the layout assigned ([`crate::Item::layout_shortcut`]) stays a click: the app's keys don't
+//!   know it. While a text field has the keys, a key equivalent is a click unless the field
+//!   handles it ([`NativeMenu::set_gate`]).
+//! - Only shortcuts with ⌘ or ⌃ become key equivalents. The others (`B`, `⇧B`, `⌥B`, `F5`) are not
+//!   shown in the native menu: muda 0.21 has no handle on the `NSMenuItem`, and its
+//!   `set_attributed_title` needs an `NSAttributedString` with a font and a tab stop, which
+//!   objc2 builds only with `unsafe` calls (the workspace forbids unsafe code).
+//! - The process has one muda menu event handler, set by the first [`install`] or
+//!   [`install_app_menu`]; each install points it at its own menu.
+//! - A check or radio item: AppKit (muda) flips its state when it is chosen. The next sync sets it
+//!   back to the app's state; the driver re-syncs after every menu event.
+//! - Hide ([`crate::Builtin::Hide`]) and Hide Others ([`crate::Builtin::HideOthers`]) are custom items calling
+//!   `NSApplication hide:` and `hideOtherApplications:`, because the predefined ones always take ⌘H
+//!   and ⌥⌘H.
+//! - While a menu is open, changes wait until it closes: replacing or changing an `NSMenu` while
+//!   AppKit tracks it can leave the displayed menu stranded.
+
+use std::cell::RefCell;
+use std::collections::{HashMap, HashSet};
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::{Receiver, Sender, channel};
+use std::sync::{Arc, Mutex, MutexGuard, OnceLock, PoisonError};
+use std::time::Duration;
+
+use muda::accelerator::{Accelerator, Code, Modifiers};
+use muda::{CheckMenuItem, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
+use objc2::MainThreadMarker;
+use objc2_app_kit::{NSApplication, NSEventModifierFlags, NSEventType};
+
+use craft_keymap::{Chord, CommandRef, Key, Mods};
+
+use crate::driver::{Backend, Dispatch, Event, NativeMenu, native_ok};
+use crate::model::{Builtin, Item, ItemKind, Menu, MenuBar, MenuRole, Node, Standard, native_id, structure_key, window_key};
+
+/// Set by [`install`]: there is one full menu bar per process.
+static INSTALLED: AtomicBool = AtomicBool::new(false);
+
+/// Where the menu event handler sends events: the menu installed last.
+static ROUTE: Mutex<Option<Route>> = Mutex::new(None);
+
+/// muda keeps the first menu event handler set and ignores later ones, so it is set once.
+static HANDLER: OnceLock<()> = OnceLock::new();
+
+thread_local! {
+    /// The minimal app menu ([`install_app_menu`]). muda's items must outlive the native menu
+    /// that shows them.
+    static APP_MENU: RefCell<Option<muda::Menu>> = const { RefCell::new(None) };
+}
+
+/// Install the native menu bar for `bar` (a [`crate::mac_layout`] result) and return the driver
+/// for it. Call it once, on the main thread, in eframe's creator closure, so winit's default menu
+/// doesn't stay up. `None` when AppKit refused the menus (the app keeps its in-window menus), off
+/// the main thread, or when a menu bar is already installed. It replaces an app menu from
+/// [`install_app_menu`].
+///
+/// craft-menu owns muda's menu event handler. muda keeps the first one set, so an app calls this
+/// or the deprecated `craft_quit::install_app_menu`, never both: called first, that one leaves
+/// this menu without events; called after, it replaces this menu bar with its app menu.
+pub fn install(ctx: &egui::Context, bar: &MenuBar) -> Option<NativeMenu> {
+    install_with(ctx, bar, MacOptions::default())
+}
+
+/// How [`install_with`] sets up the native menus.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct MacOptions {
+    /// Make the [`MenuRole::Window`] menu AppKit's Windows menu, which lists the app's windows
+    /// after the menu's own items. On by default. An app that lists its documents itself
+    /// in the Window menu ([`MenuBar::documents`]) and keeps them in one window turns it off: AppKit
+    /// would list that window as well.
+    pub window_list: bool,
+}
+
+impl Default for MacOptions {
+    fn default() -> MacOptions {
+        MacOptions { window_list: true }
+    }
+}
+
+impl MacOptions {
+    pub fn window_list(mut self, on: bool) -> MacOptions {
+        self.window_list = on;
+        self
+    }
+}
+
+/// [`install`] with `options`.
+pub fn install_with(ctx: &egui::Context, bar: &MenuBar, options: MacOptions) -> Option<NativeMenu> {
+    MainThreadMarker::new()?;
+    if INSTALLED.swap(true, Ordering::SeqCst) {
+        return None;
+    }
+    let mut menu = MacMenu::new(ctx, options);
+    if !menu.build(bar) {
+        INSTALLED.store(false, Ordering::SeqCst);
+        return None;
+    }
+    // `NativeMenu::new` attaches the driver's dispatch, which points the handler at this menu.
+    Some(NativeMenu::new(Box::new(menu)))
+}
+
+/// Replace winit's default macOS app menu with a minimal one whose Quit (⌘Q) asks the app first,
+/// for an app without a [`MenuBar`] of its own: About, Services, Hide, Hide Others, Show All and
+/// Quit, labelled in English with `app_name` ("Quit WordCraft").
+///
+/// winit's Quit ends the process without asking, so unsaved work is lost. This Quit has the id
+/// [`craft_quit::QUIT_MENU_ID`] and runs [`craft_quit::on_menu_event`]: it asks the root window to
+/// close, the app's unsaved-changes check runs as for the close button, and
+/// [`craft_quit::on_close_request`] then quits. Call it once, from the eframe app creator: winit
+/// builds its default menu before that and would replace one installed earlier.
+///
+/// Does nothing when this menu or a full menu bar ([`install`]) is already installed. On error
+/// winit's menu stays: the app still runs, but ⌘Q quits without asking.
+pub fn install_app_menu(ctx: &egui::Context, app_name: &str) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    if MainThreadMarker::new().is_none() {
+        return Err("craft_menu::mac::install_app_menu runs on the main thread".into());
+    }
+    if INSTALLED.load(Ordering::SeqCst) || APP_MENU.with_borrow(Option::is_some) {
+        return Ok(());
+    }
+    let quit = MenuItem::with_id(craft_quit::QUIT_MENU_ID, format!("Quit {app_name}"), true, Some(Accelerator::new(Modifiers::META, Code::KeyQ)));
+    let app_menu = Submenu::new(app_name, true);
+    app_menu.append_items(&[
+        &PredefinedMenuItem::about(Some(&format!("About {app_name}")), None),
+        &PredefinedMenuItem::separator(),
+        &PredefinedMenuItem::services(None),
+        &PredefinedMenuItem::separator(),
+        &PredefinedMenuItem::hide(Some(&format!("Hide {app_name}"))),
+        &PredefinedMenuItem::hide_others(None),
+        &PredefinedMenuItem::show_all(None),
+        &PredefinedMenuItem::separator(),
+        &quit,
+    ])?;
+    let menu = muda::Menu::new();
+    menu.append(&app_menu)?;
+    menu.init_for_nsapp();
+    route_events(Route::AppMenu(ctx.clone()));
+    APP_MENU.set(Some(menu));
+    Ok(())
+}
+
+/// The installed menu the handler reports to.
+#[derive(Clone)]
+enum Route {
+    /// [`install_app_menu`]'s: only Quit reports, to craft-quit.
+    AppMenu(egui::Context),
+    /// A full menu bar's.
+    Menu(MenuRoute),
+}
+
+#[derive(Clone)]
+struct MenuRoute {
+    ctx: egui::Context,
+    targets: Targets,
+    dispatch: Dispatch,
+    tx: Sender<Event>,
+}
+
+/// What each native item runs, by muda id, for the handler.
+type Targets = Arc<Mutex<HashMap<String, Target>>>;
+
+/// Point the process's menu event handler at `route`, setting the handler the first time.
+fn route_events(route: Route) {
+    *lock(&ROUTE) = Some(route);
+    HANDLER.get_or_init(|| MenuEvent::set_event_handler(Some(handle_event)));
+}
+
+/// The menu event handler. AppKit calls it on the main thread, from the event that chose the
+/// item: a key equivalent is a key-down, a click a mouse-up (or ↩ inside the open menu).
+fn handle_event(e: MenuEvent) {
+    let held = MainThreadMarker::new()
+        .and_then(|mtm| NSApplication::sharedApplication(mtm).currentEvent())
+        .filter(|ev| ev.r#type() == NSEventType::KeyDown)
+        .map(|ev| {
+            let flags = ev.modifierFlags();
+            Mods {
+                cmd: flags.contains(NSEventModifierFlags::Command),
+                ctrl: flags.contains(NSEventModifierFlags::Control),
+                alt: flags.contains(NSEventModifierFlags::Option),
+                shift: flags.contains(NSEventModifierFlags::Shift),
+            }
+        });
+    // A copy, so nothing is locked while the app's hook runs.
+    let route = lock(&ROUTE).clone();
+    let ctx = match route {
+        None => return,
+        Some(Route::AppMenu(ctx)) => {
+            craft_quit::on_menu_event(&ctx, e.id.as_ref());
+            ctx
+        }
+        Some(Route::Menu(r)) => {
+            let target = lock(&r.targets).get(e.id.as_ref()).cloned();
+            // Ids that aren't ours are AppKit's own items (Services, Zoom, …), already handled.
+            if let Some(t) = target {
+                let event = r.dispatch.chosen(&t.command, t.chord.as_ref(), t.layout_shortcut, held);
+                // The receiver goes away only with the app.
+                let _ = r.tx.send(event);
+            }
+            r.ctx
+        }
+    };
+    // Choosing an item is not window input, so nothing else wakes egui: without this the item
+    // runs only with the next input event, 8 to 90 seconds later in measurements.
+    ctx.request_repaint();
+}
+
+fn lock<T>(m: &Mutex<T>) -> MutexGuard<'_, T> {
+    m.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+#[derive(Clone)]
+enum Handle {
+    Plain(MenuItem),
+    Check(CheckMenuItem),
+}
+
+/// One native item.
+#[derive(Clone)]
+struct Entry {
+    handle: Handle,
+    target: Target,
+    label: String,
+    enabled: bool,
+}
+
+/// What choosing an item reports.
+#[derive(Clone)]
+struct Target {
+    /// The command (several items can share one).
+    command: CommandRef,
+    chord: Option<Chord>,
+    layout_shortcut: bool,
+}
+
+/// The native items by muda id.
+type Entries = HashMap<String, Entry>;
+
+/// The Window menu, the muda ids of its items, and its [`window_key`].
+type WindowMenu = (Submenu, Vec<String>, u64);
+
+struct MacMenu {
+    ctx: egui::Context,
+    menu: Option<muda::Menu>,
+    entries: Entries,
+    /// The entries' targets, for the menu event handler.
+    targets: Targets,
+    tx: Sender<Event>,
+    rx: Receiver<Event>,
+    structure: u64,
+    window: Option<WindowMenu>,
+    /// The latest menus, waiting for the open menu to close.
+    pending: Option<MenuBar>,
+    options: MacOptions,
+}
+
+impl MacMenu {
+    fn new(ctx: &egui::Context, options: MacOptions) -> MacMenu {
+        let (tx, rx) = channel();
+        MacMenu {
+            ctx: ctx.clone(),
+            menu: None,
+            entries: HashMap::new(),
+            targets: Targets::default(),
+            tx,
+            rx,
+            structure: 0,
+            window: None,
+            pending: None,
+            options,
+        }
+    }
+
+    /// Hand the entries' targets to the menu event handler.
+    fn publish(&self) {
+        *lock(&self.targets) = self.entries.iter().map(|(id, e)| (id.clone(), e.target.clone())).collect();
+    }
+
+    /// Build the menu bar for `bar` and make it NSApp's. On an error or a panic in muda or AppKit
+    /// the menus stay as they were (never crash for a menu) and this returns false.
+    fn build(&mut self, bar: &MenuBar) -> bool {
+        let built = catch_unwind(AssertUnwindSafe(|| -> muda::Result<(muda::Menu, Entries, Option<WindowMenu>)> {
+            let mut entries = Entries::new();
+            let mut window = None;
+            let menu = muda::Menu::new();
+            let mut special = Vec::new();
+            for m in &bar.menus {
+                let (sub, ids) = submenu(&mut entries, m)?;
+                menu.append(&sub)?;
+                if m.role == MenuRole::Window {
+                    window = Some((sub.clone(), ids, window_key(bar)));
+                }
+                if m.role == MenuRole::Help || (m.role == MenuRole::Window && self.options.window_list) {
+                    special.push((m.role, sub));
+                }
+            }
+            menu.init_for_nsapp();
+            // Only once the menu is NSApp's: muda looks the submenus up in the installed main menu.
+            for (role, sub) in special {
+                match role {
+                    MenuRole::Window => sub.set_as_windows_menu_for_nsapp(),
+                    _ => sub.set_as_help_menu_for_nsapp(),
+                }
+            }
+            Ok((menu, entries, window))
+        }));
+        match built {
+            Ok(Ok((menu, entries, window))) => {
+                self.menu = Some(menu);
+                self.entries = entries;
+                self.window = window;
+                self.structure = structure_key(bar);
+                self.publish();
+                true
+            }
+            _ => {
+                // The new menu may have been made NSApp's before the failure.
+                if let Some(old) = &self.menu {
+                    let _ = catch_unwind(AssertUnwindSafe(|| {
+                        old.init_for_nsapp();
+                        if let Some((sub, ..)) = &self.window
+                            && self.options.window_list
+                        {
+                            sub.set_as_windows_menu_for_nsapp();
+                        }
+                    }));
+                }
+                false
+            }
+        }
+    }
+
+    /// Replace the Window menu (a document opened or closed), leaving the other menus as they are.
+    /// Falls back to a full build when that fails.
+    fn rebuild_window(&mut self, bar: &MenuBar) {
+        let (Some(menu), Some((old, old_ids, _))) = (self.menu.clone(), self.window.clone()) else {
+            self.build(bar);
+            return;
+        };
+        let Some((at, spec)) = bar.menus.iter().enumerate().find(|(_, m)| m.role == MenuRole::Window) else {
+            self.build(bar);
+            return;
+        };
+        let mut entries = self.entries.clone();
+        for id in &old_ids {
+            entries.remove(id);
+        }
+        let replaced = catch_unwind(AssertUnwindSafe(|| -> muda::Result<WindowMenu> {
+            let (sub, ids) = submenu(&mut entries, spec)?;
+            menu.remove(&old)?;
+            if let Err(e) = menu.insert(&sub, at) {
+                let _ = menu.insert(&old, at);
+                return Err(e);
+            }
+            if self.options.window_list {
+                sub.set_as_windows_menu_for_nsapp();
+            }
+            Ok((sub, ids, window_key(bar)))
+        }));
+        match replaced {
+            Ok(Ok(window)) => {
+                self.entries = entries;
+                self.window = Some(window);
+                self.publish();
+            }
+            _ => {
+                self.build(bar);
+            }
+        }
+    }
+
+    fn update(&mut self, bar: &MenuBar) {
+        if self.menu.is_none() || structure_key(bar) != self.structure {
+            self.build(bar);
+            return;
+        }
+        if self.window.as_ref().map(|w| w.2) != Some(window_key(bar)) {
+            self.rebuild_window(bar);
+        }
+        // Items by muda id: the n-th item of a command, depth first, is its n-th native item.
+        let mut items: HashMap<String, &Item> = HashMap::new();
+        for it in bar.items() {
+            let id = native_id(&it.command, |id| items.contains_key(id));
+            items.insert(id, it);
+        }
+        for (id, e) in &mut self.entries {
+            let Some(it) = items.get(id) else { continue };
+            if e.label != it.label {
+                let text = escape(&it.label);
+                match &e.handle {
+                    Handle::Plain(h) => h.set_text(text),
+                    Handle::Check(h) => h.set_text(text),
+                }
+                e.label = it.label.clone();
+            }
+            if e.enabled != it.enabled {
+                match &e.handle {
+                    Handle::Plain(h) => h.set_enabled(it.enabled),
+                    Handle::Check(h) => h.set_enabled(it.enabled),
+                }
+                e.enabled = it.enabled;
+            }
+            // Compare with AppKit's own state: muda flips a check item when it's chosen, and the
+            // app's state wins (a radio item chosen again stays selected).
+            if let (Handle::Check(h), Some(c)) = (&e.handle, it.kind.checked())
+                && h.is_checked() != c
+            {
+                h.set_checked(c);
+            }
+        }
+    }
+
+    /// Nothing else may wake egui when the menu closes (Escape goes to the menu), so look again.
+    fn retry_later(&mut self, bar: MenuBar) {
+        self.pending = Some(bar);
+        self.ctx.request_repaint_after(Duration::from_millis(250));
+    }
+}
+
+/// A top-level menu, and the muda ids of the items it added to `entries`.
+fn submenu(entries: &mut Entries, m: &Menu) -> muda::Result<(Submenu, Vec<String>)> {
+    let before: HashSet<String> = entries.keys().cloned().collect();
+    let sub = Submenu::new(escape(&m.title), true);
+    append(entries, &sub, &m.children)?;
+    let ids = entries.keys().filter(|id| !before.contains(*id)).cloned().collect();
+    Ok((sub, ids))
+}
+
+fn append(entries: &mut Entries, sub: &Submenu, nodes: &[Node]) -> muda::Result<()> {
+    for n in nodes {
+        match n {
+            Node::Separator => sub.append(&PredefinedMenuItem::separator())?,
+            Node::Submenu { label, children, .. } => {
+                let s = Submenu::new(escape(label), !children.is_empty());
+                append(entries, &s, children)?;
+                sub.append(&s)?;
+            }
+            Node::Standard { kind, label } => {
+                let text = Some(label.as_str());
+                let p = match kind {
+                    Standard::Services => PredefinedMenuItem::services(text),
+                    Standard::ShowAll => PredefinedMenuItem::show_all(text),
+                    Standard::Minimize => PredefinedMenuItem::minimize(text),
+                    Standard::Zoom => PredefinedMenuItem::maximize(text),
+                    Standard::BringAllToFront => PredefinedMenuItem::bring_all_to_front(text),
+                    Standard::CloseWindow => PredefinedMenuItem::close_window(text),
+                };
+                sub.append(&p)?;
+            }
+            Node::Item(it) => {
+                let id = native_id(&it.command, |id| entries.contains_key(id));
+                let chord = it.shortcut;
+                let accel = chord.as_ref().filter(|c| native_ok(c)).and_then(accelerator);
+                let handle = match it.kind {
+                    ItemKind::Check(c) | ItemKind::Radio(c) => {
+                        let h = CheckMenuItem::with_id(id.clone(), escape(&it.label), it.enabled, c, accel);
+                        sub.append(&h)?;
+                        Handle::Check(h)
+                    }
+                    ItemKind::Plain => {
+                        let h = MenuItem::with_id(id.clone(), escape(&it.label), it.enabled, accel);
+                        sub.append(&h)?;
+                        Handle::Plain(h)
+                    }
+                };
+                let target = Target { command: it.command.clone(), chord, layout_shortcut: it.layout_shortcut };
+                let entry = Entry { handle, target, label: it.label.clone(), enabled: it.enabled };
+                entries.insert(id, entry);
+            }
+        }
+    }
+    Ok(())
+}
+
+impl Backend for MacMenu {
+    fn sync(&mut self, bar: &MenuBar) {
+        if self.tracking() {
+            // The driver counts this sync as done and may not send these menus again.
+            self.retry_later(bar.clone());
+            return;
+        }
+        self.pending = None;
+        self.update(bar);
+    }
+
+    fn drain(&mut self) -> Vec<Event> {
+        let mut out = Vec::new();
+        while let Ok(event) = self.rx.try_recv() {
+            // With asynchronous menu presentation the menu can stay on screen after its item ran.
+            self.cancel_tracking();
+            // Hide and Hide Others run here. While a shortcut is recorded their key equivalents
+            // arrive as key presses instead, for the recorder.
+            if let Event::Click(command) = &event
+                && let Some(hide @ (Builtin::Hide | Builtin::HideOthers)) = Builtin::of(command)
+            {
+                if let Some(mtm) = MainThreadMarker::new() {
+                    let app = NSApplication::sharedApplication(mtm);
+                    if hide == Builtin::Hide { app.hide(None) } else { app.hideOtherApplications(None) }
+                }
+                continue;
+            }
+            out.push(event);
+        }
+        // After the events: they were chosen from the menus as they were.
+        if let Some(bar) = self.pending.take() {
+            if self.tracking() {
+                self.retry_later(bar);
+            } else {
+                self.update(&bar);
+            }
+        }
+        out
+    }
+
+    /// A menu bar menu is open while one of its titles is highlighted.
+    ///
+    /// This assumes AppKit sets the main menu's `highlightedItem` while one of its menus is open
+    /// and clears it when the menu closes; not yet confirmed on every macOS version. If it stayed
+    /// set, menu updates would wait (retried every 250 ms) and the driver would keep only one
+    /// window click from egui ([`NativeMenu::raw_input`]).
+    fn tracking(&self) -> bool {
+        MainThreadMarker::new().and_then(|mtm| NSApplication::sharedApplication(mtm).mainMenu()).is_some_and(|m| m.highlightedItem().is_some())
+    }
+
+    fn attach(&mut self, dispatch: Dispatch) {
+        route_events(Route::Menu(MenuRoute { ctx: self.ctx.clone(), targets: self.targets.clone(), dispatch, tx: self.tx.clone() }));
+    }
+
+    fn cancel_tracking(&mut self) {
+        if let Some(menu) = MainThreadMarker::new().and_then(|mtm| NSApplication::sharedApplication(mtm).mainMenu()) {
+            menu.cancelTracking();
+        }
+    }
+}
+
+/// `&` marks a mnemonic in muda labels.
+fn escape(s: &str) -> String {
+    s.replace('&', "&&")
+}
+
+/// A key equivalent for AppKit. `cmd` is ⌘ (`META`) and `ctrl` is ⌃: never folded together.
+fn accelerator(c: &Chord) -> Option<Accelerator> {
+    let m = c.mods;
+    let mut mods = Modifiers::empty();
+    for (on, flag) in [(m.cmd, Modifiers::META), (m.ctrl, Modifiers::CONTROL), (m.alt, Modifiers::ALT), (m.shift, Modifiers::SHIFT)] {
+        if on {
+            mods |= flag;
+        }
+    }
+    let code = match c.key {
+        Key::A => Code::KeyA,
+        Key::B => Code::KeyB,
+        Key::C => Code::KeyC,
+        Key::D => Code::KeyD,
+        Key::E => Code::KeyE,
+        Key::F => Code::KeyF,
+        Key::G => Code::KeyG,
+        Key::H => Code::KeyH,
+        Key::I => Code::KeyI,
+        Key::J => Code::KeyJ,
+        Key::K => Code::KeyK,
+        Key::L => Code::KeyL,
+        Key::M => Code::KeyM,
+        Key::N => Code::KeyN,
+        Key::O => Code::KeyO,
+        Key::P => Code::KeyP,
+        Key::Q => Code::KeyQ,
+        Key::R => Code::KeyR,
+        Key::S => Code::KeyS,
+        Key::T => Code::KeyT,
+        Key::U => Code::KeyU,
+        Key::V => Code::KeyV,
+        Key::W => Code::KeyW,
+        Key::X => Code::KeyX,
+        Key::Y => Code::KeyY,
+        Key::Z => Code::KeyZ,
+        Key::Num0 => Code::Digit0,
+        Key::Num1 => Code::Digit1,
+        Key::Num2 => Code::Digit2,
+        Key::Num3 => Code::Digit3,
+        Key::Num4 => Code::Digit4,
+        Key::Num5 => Code::Digit5,
+        Key::Num6 => Code::Digit6,
+        Key::Num7 => Code::Digit7,
+        Key::Num8 => Code::Digit8,
+        Key::Num9 => Code::Digit9,
+        Key::F1 => Code::F1,
+        Key::F2 => Code::F2,
+        Key::F3 => Code::F3,
+        Key::F4 => Code::F4,
+        Key::F5 => Code::F5,
+        Key::F6 => Code::F6,
+        Key::F7 => Code::F7,
+        Key::F8 => Code::F8,
+        Key::F9 => Code::F9,
+        Key::F10 => Code::F10,
+        Key::F11 => Code::F11,
+        Key::F12 => Code::F12,
+        Key::F13 => Code::F13,
+        Key::F14 => Code::F14,
+        Key::F15 => Code::F15,
+        Key::F16 => Code::F16,
+        Key::F17 => Code::F17,
+        Key::F18 => Code::F18,
+        Key::F19 => Code::F19,
+        Key::F20 => Code::F20,
+        Key::F21 => Code::F21,
+        Key::F22 => Code::F22,
+        Key::F23 => Code::F23,
+        Key::F24 => Code::F24,
+        Key::OpenBracket => Code::BracketLeft,
+        Key::CloseBracket => Code::BracketRight,
+        Key::Backslash => Code::Backslash,
+        Key::Slash => Code::Slash,
+        // `+` is ⇧= on the keyboards AppKit matches by key: Zoom In shows ⌘=.
+        Key::Equals | Key::Plus => Code::Equal,
+        Key::Minus => Code::Minus,
+        Key::Quote => Code::Quote,
+        Key::Semicolon => Code::Semicolon,
+        Key::Comma => Code::Comma,
+        Key::Period => Code::Period,
+        Key::Backtick => Code::Backquote,
+        // `Delete` is forward delete (egui's `Key::Delete`), `Backspace` the key Macs label
+        // delete. muda writes them as U+007F and U+0008; which physical key AppKit matches to
+        // each is not yet checked on a Mac.
+        Key::Delete => Code::Delete,
+        Key::Backspace => Code::Backspace,
+        Key::Insert => Code::Insert,
+        Key::Left => Code::ArrowLeft,
+        Key::Right => Code::ArrowRight,
+        Key::Up => Code::ArrowUp,
+        Key::Down => Code::ArrowDown,
+        Key::Home => Code::Home,
+        Key::End => Code::End,
+        Key::PageUp => Code::PageUp,
+        Key::PageDown => Code::PageDown,
+        Key::Escape if !mods.is_empty() => Code::Escape,
+        Key::Enter if !mods.is_empty() => Code::Enter,
+        Key::Tab if !mods.is_empty() => Code::Tab,
+        Key::Space if !mods.is_empty() => Code::Space,
+        _ => return None,
+    };
+    Some(Accelerator::new(mods, code))
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+
+    use super::*;
+    use crate::driver::key_event;
+
+    /// The shortcuts the layout writes itself, and common app ones, become key equivalents.
+    #[test]
+    fn shortcuts_map_to_key_equivalents() {
+        #[rustfmt::skip]
+        let shortcuts = [
+            "Cmd+Q", "Cmd+H", "Cmd+Alt+H", "Ctrl+Cmd+H", "Ctrl+Cmd+M", "Cmd+,", "Cmd+Shift+Z", "Cmd+1", "Cmd+[", "Cmd+=", "Cmd++",
+            "Cmd+-", "Cmd+Delete", "Cmd+Backspace", "Cmd+Left", "Alt+Cmd+ArrowDown", "Cmd+Escape", "Cmd+Home", "Cmd+End",
+            "Cmd+PageUp", "Cmd+PageDown", "Cmd+Enter", "Ctrl+F7",
+        ];
+        for s in shortcuts {
+            let c = Chord::parse(s).unwrap();
+            assert!(native_ok(&c) && accelerator(&c).is_some(), "{s} has no key equivalent");
+            assert!(matches!(key_event(&c, true), egui::Event::Key { .. }), "{s} has no egui key press");
+        }
+        let code = |s: &str| accelerator(&Chord::parse(s).unwrap()).unwrap();
+        assert_eq!(code("Cmd+Delete"), Accelerator::new(Modifiers::META, Code::Delete), "forward delete, as egui's Key::Delete");
+        assert_eq!(code("Cmd+Backspace"), Accelerator::new(Modifiers::META, Code::Backspace));
+        assert_eq!(code("Cmd++"), code("Cmd+="), "⌘+ is the ⌘= key");
+    }
+
+    #[test]
+    fn control_and_command_stay_distinct() {
+        let a = accelerator(&Chord::parse("Cmd+M").unwrap()).unwrap();
+        let b = accelerator(&Chord::parse("Ctrl+Cmd+M").unwrap()).unwrap();
+        assert_ne!(a, b);
+    }
+}
diff --git a/crates/menu/src/model.rs b/crates/menu/src/model.rs
new file mode 100644
index 00000000..f8a295ab
--- /dev/null
+++ b/crates/menu/src/model.rs
@@ -0,0 +1,561 @@
+//! The menu tree, the flat rows it can be built from, and the keys that tell a backend what
+//! changed.
+
+use std::hash::{DefaultHasher, Hash, Hasher};
+use std::ops::BitOr;
+
+use craft_keymap::{Chord, CommandRef};
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct MenuBar {
+    pub menus: Vec<Menu>,
+    /// The app's open documents, for the Window menu.
+    pub documents: Vec<Document>,
+}
+
+/// An open document, listed in the Window menu.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Document {
+    /// What choosing it runs (bring the document to the front).
+    pub command: CommandRef,
+    /// The document's name.
+    pub label: String,
+    /// The document in front.
+    pub active: bool,
+    /// Open but not listed: a document the app keeps open in the background.
+    pub hidden: bool,
+}
+
+impl Document {
+    /// A listed document, not the one in front.
+    pub fn new(command: impl Into<CommandRef>, label: impl Into<String>) -> Document {
+        Document { command: command.into(), label: label.into(), active: false, hidden: false }
+    }
+
+    pub fn active(mut self, active: bool) -> Document {
+        self.active = active;
+        self
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Menu {
+    pub title: String,
+    pub role: MenuRole,
+    pub children: Vec<Node>,
+}
+
+/// What a top-level menu is for, set by the app. macOS treats the app, Window and Help menus
+/// specially; File is where the system Close Window item goes.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub enum MenuRole {
+    /// Any menu without a fixed place.
+    #[default]
+    Other,
+    App,
+    File,
+    Edit,
+    View,
+    Window,
+    Help,
+}
+
+/// The platforms an item or submenu is shown on. All of them by default.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub struct Platforms(u8);
+
+impl Platforms {
+    pub const NONE: Platforms = Platforms(0);
+    pub const MAC: Platforms = Platforms(1);
+    pub const WINDOWS: Platforms = Platforms(1 << 1);
+    pub const LINUX: Platforms = Platforms(1 << 2);
+    pub const WEB: Platforms = Platforms(1 << 3);
+    pub const ALL: Platforms = Platforms(0b1111);
+
+    /// Whether every platform in `other` is in `self`.
+    pub const fn contains(self, other: Platforms) -> bool {
+        self.0 & other.0 == other.0
+    }
+
+    /// `self` without the platforms in `other`: `Platforms::ALL.without(Platforms::WEB)`.
+    pub const fn without(self, other: Platforms) -> Platforms {
+        Platforms(self.0 & !other.0)
+    }
+
+    pub const fn is_empty(self) -> bool {
+        self.0 == 0
+    }
+}
+
+impl Default for Platforms {
+    fn default() -> Platforms {
+        Platforms::ALL
+    }
+}
+
+impl BitOr for Platforms {
+    type Output = Platforms;
+    fn bitor(self, other: Platforms) -> Platforms {
+        Platforms(self.0 | other.0)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub enum Node {
+    Item(Item),
+    Separator,
+    Submenu {
+        label: String,
+        children: Vec<Node>,
+        role: Option<ItemRole>,
+        platforms: Platforms,
+    },
+    /// An item AppKit provides and runs itself (Services, Zoom, …), with the label to show.
+    Standard {
+        kind: Standard,
+        label: String,
+    },
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Item {
+    /// What the item runs: the app's command (`file.open`), with its parameters
+    /// (`CommandRef::with_params("file.open_recent", json!({"index": 3}))`), or a [`Builtin`]. A
+    /// click reports it.
+    pub command: CommandRef,
+    pub label: String,
+    /// `cmd` is ⌘ and `ctrl` the Control key: ⌃⌘M and ⌘M are different shortcuts.
+    pub shortcut: Option<Chord>,
+    pub enabled: bool,
+    pub kind: ItemKind,
+    pub role: Option<ItemRole>,
+    /// The platforms the item is shown on.
+    pub platforms: Platforms,
+    /// The layout gave this item its shortcut (⌘Q on the app's Quit, ⌘, on Settings): the app's
+    /// key handling doesn't know it, so a backend reports the key equivalent as a click.
+    pub layout_shortcut: bool,
+}
+
+/// A plain item, or one with a checked state.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub enum ItemKind {
+    #[default]
+    Plain,
+    /// A check item, and whether it is checked.
+    Check(bool),
+    /// One choice of a group: the radio items next to each other between separators. Whether it
+    /// is the selected one. macOS shows it as a check item.
+    Radio(bool),
+}
+
+impl ItemKind {
+    /// The checked or selected state, `None` for a plain item.
+    pub fn checked(self) -> Option<bool> {
+        match self {
+            ItemKind::Plain => None,
+            ItemKind::Check(on) | ItemKind::Radio(on) => Some(on),
+        }
+    }
+}
+
+/// Items the layouts put in fixed places. The app tags its own About, Settings, Quit, Appearance
+/// and Language items; the Mac layout adds Hide and Minimize.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum ItemRole {
+    About,
+    /// The app's settings: an item, or a submenu of settings pages.
+    Settings,
+    /// The app's own quit command, which asks about unsaved changes. Without one the layout adds
+    /// [`Builtin::Quit`].
+    Quit,
+    Hide,
+    Minimize,
+    /// A submenu of themes or appearance modes, and items that go with it (Next Theme).
+    Appearance,
+    /// The app's language chooser, a submenu.
+    Language,
+}
+
+/// The items AppKit provides.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Standard {
+    Services,
+    ShowAll,
+    Minimize,
+    Zoom,
+    BringAllToFront,
+    CloseWindow,
+}
+
+impl Standard {
+    /// The English label, as passed to [`crate::LayoutOptions::label`].
+    pub fn english(self) -> &'static str {
+        match self {
+            Standard::Services => "Services",
+            Standard::ShowAll => "Show All",
+            Standard::Minimize => "Minimize",
+            Standard::Zoom => "Zoom",
+            Standard::BringAllToFront => "Bring All to Front",
+            Standard::CloseWindow => "Close Window",
+        }
+    }
+}
+
+/// The commands of the items the crate adds itself. The crate runs them; an app sees them only
+/// in a layout's result.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Builtin {
+    /// Hide the app: a custom item, because AppKit's own always takes ⌘H, which apps often bind.
+    Hide,
+    /// Hide the other apps: a custom item, because AppKit's own always takes ⌥⌘H.
+    HideOthers,
+    /// Minimize: a custom item, used when the app binds ⌘M (AppKit's own always takes ⌘M).
+    /// [`crate::NativeMenu::take_clicks`] runs it.
+    Minimize,
+    /// Quit for an app without its own quit item: asks the window to close, through
+    /// [`craft_quit::on_menu_event`], so the app's unsaved-changes check runs.
+    Quit,
+}
+
+impl Builtin {
+    /// The command id.
+    pub const fn id(self) -> &'static str {
+        match self {
+            Builtin::Hide => "craft-menu.hide",
+            Builtin::HideOthers => "craft-menu.hide-others",
+            Builtin::Minimize => "craft-menu.minimize",
+            Builtin::Quit => craft_quit::QUIT_MENU_ID,
+        }
+    }
+
+    pub fn command(self) -> CommandRef {
+        CommandRef::new(self.id())
+    }
+
+    /// The built-in command `command` is, if any.
+    pub fn of(command: &CommandRef) -> Option<Builtin> {
+        if !command.params.is_null() {
+            return None;
+        }
+        [Builtin::Hide, Builtin::HideOthers, Builtin::Minimize, Builtin::Quit].into_iter().find(|b| b.id() == command.id)
+    }
+}
+
+impl Item {
+    /// An enabled plain item with no shortcut, shown on every platform.
+    pub fn new(command: impl Into<CommandRef>, label: impl Into<String>) -> Item {
+        Item {
+            command: command.into(),
+            label: label.into(),
+            shortcut: None,
+            enabled: true,
+            kind: ItemKind::Plain,
+            role: None,
+            platforms: Platforms::ALL,
+            layout_shortcut: false,
+        }
+    }
+
+    pub fn shortcut(mut self, shortcut: Chord) -> Item {
+        self.shortcut = Some(shortcut);
+        self
+    }
+
+    pub fn enabled(mut self, enabled: bool) -> Item {
+        self.enabled = enabled;
+        self
+    }
+
+    /// Make this a check item.
+    pub fn check(mut self, checked: bool) -> Item {
+        self.kind = ItemKind::Check(checked);
+        self
+    }
+
+    /// Make this a radio item, `selected` or not.
+    pub fn radio(mut self, selected: bool) -> Item {
+        self.kind = ItemKind::Radio(selected);
+        self
+    }
+
+    pub fn role(mut self, role: ItemRole) -> Item {
+        self.role = Some(role);
+        self
+    }
+
+    pub fn platforms(mut self, platforms: Platforms) -> Item {
+        self.platforms = platforms;
+        self
+    }
+}
+
+impl From<Item> for Node {
+    fn from(item: Item) -> Node {
+        Node::Item(item)
+    }
+}
+
+impl Node {
+    /// A submenu shown on every platform.
+    pub fn submenu(label: impl Into<String>, children: Vec<Node>) -> Node {
+        Node::Submenu { label: label.into(), children, role: None, platforms: Platforms::ALL }
+    }
+
+    /// Give an item or a submenu a role: `Node::submenu("Theme", pages).role(ItemRole::Appearance)`.
+    pub fn role(mut self, role: ItemRole) -> Node {
+        match &mut self {
+            Node::Item(it) => it.role = Some(role),
+            Node::Submenu { role: r, .. } => *r = Some(role),
+            Node::Separator | Node::Standard { .. } => {}
+        }
+        self
+    }
+
+    /// Show an item or a submenu only on `platforms`.
+    pub fn platforms(mut self, platforms: Platforms) -> Node {
+        match &mut self {
+            Node::Item(it) => it.platforms = platforms,
+            Node::Submenu { platforms: p, .. } => *p = platforms,
+            Node::Separator | Node::Standard { .. } => {}
+        }
+        self
+    }
+}
+
+impl Menu {
+    pub fn new(title: impl Into<String>, children: Vec<Node>) -> Menu {
+        Menu { title: title.into(), role: MenuRole::Other, children }
+    }
+
+    pub fn role(mut self, role: MenuRole) -> Menu {
+        self.role = role;
+        self
+    }
+}
+
+impl MenuBar {
+    /// Every item, depth first.
+    pub fn items(&self) -> Vec<&Item> {
+        fn walk<'a>(nodes: &'a [Node], out: &mut Vec<&'a Item>) {
+            for n in nodes {
+                match n {
+                    Node::Item(it) => out.push(it),
+                    Node::Submenu { children, .. } => walk(children, out),
+                    Node::Separator | Node::Standard { .. } => {}
+                }
+            }
+        }
+        let mut out = Vec::new();
+        for m in &self.menus {
+            walk(&m.children, &mut out);
+        }
+        out
+    }
+
+    /// Every item, depth first, changed in place.
+    pub(crate) fn for_each_item_mut(&mut self, mut f: impl FnMut(&mut Item)) {
+        fn walk(nodes: &mut [Node], f: &mut dyn FnMut(&mut Item)) {
+            for n in nodes {
+                match n {
+                    Node::Item(it) => f(it),
+                    Node::Submenu { children, .. } => walk(children, f),
+                    Node::Separator | Node::Standard { .. } => {}
+                }
+            }
+        }
+        for m in &mut self.menus {
+            walk(&mut m.children, &mut f);
+        }
+    }
+
+    /// Whether `command` opens one of [`MenuBar::documents`].
+    pub(crate) fn is_document(&self, command: &CommandRef) -> bool {
+        self.documents.iter().any(|d| d.command == *command)
+    }
+
+    pub fn find(&self, command: &CommandRef) -> Option<&Item> {
+        self.items().into_iter().find(|it| it.command == *command)
+    }
+
+    pub fn menu(&self, role: MenuRole) -> Option<&Menu> {
+        self.menus.iter().find(|m| m.role == role)
+    }
+
+    /// Give every item with this command the role, at any depth.
+    pub fn tag_item(&mut self, command: &CommandRef, role: ItemRole) {
+        fn walk(nodes: &mut [Node], command: &CommandRef, role: ItemRole) {
+            for n in nodes {
+                match n {
+                    Node::Item(it) if it.command == *command => it.role = Some(role),
+                    Node::Submenu { children, .. } => walk(children, command, role),
+                    _ => {}
+                }
+            }
+        }
+        for m in &mut self.menus {
+            walk(&mut m.children, command, role);
+        }
+    }
+
+    /// Give the submenu `name`, directly in the menu with the role `menu`, the role.
+    pub fn tag_submenu(&mut self, menu: MenuRole, name: &str, role: ItemRole) {
+        let Some(menu) = self.menus.iter_mut().find(|m| m.role == menu) else { return };
+        for n in &mut menu.children {
+            if let Node::Submenu { label, role: r, .. } = n
+                && label == name
+            {
+                *r = Some(role);
+            }
+        }
+    }
+
+    /// Give the menu titled `title` the role: a shortcut for apps that build the bar from rows.
+    pub fn tag_menu(&mut self, title: &str, role: MenuRole) {
+        if let Some(m) = self.menus.iter_mut().find(|m| m.title == title) {
+            m.role = role;
+        }
+    }
+}
+
+/// One row of a flat menu list: the menu path (`["File", "Open Recent"]`) and the item in it.
+/// A row labelled `---` is a separator.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Row {
+    pub path: Vec<String>,
+    pub command: CommandRef,
+    pub label: String,
+    pub shortcut: Option<Chord>,
+    pub enabled: bool,
+    pub kind: ItemKind,
+}
+
+/// The menus as a tree, from flat rows, in the order an in-window bar draws them: one menu per
+/// entry of `tops`, and at each depth leaves and separators in order, with a submenu where its
+/// first row is. The result is [`tidy`].
+pub fn from_items(tops: &[&str], rows: &[Row]) -> MenuBar {
+    fn level(rows: &[&Row], depth: usize) -> Vec<Node> {
+        let mut out = Vec::new();
+        let mut shown: Vec<&str> = Vec::new();
+        for it in rows {
+            if it.path.len() == depth {
+                if it.label == "---" {
+                    out.push(Node::Separator);
+                } else {
+                    out.push(Node::Item(Item {
+                        shortcut: it.shortcut,
+                        enabled: it.enabled,
+                        kind: it.kind,
+                        ..Item::new(it.command.clone(), it.label.clone())
+                    }));
+                }
+            } else if let Some(name) = it.path.get(depth) {
+                let name = name.as_str();
+                if shown.contains(&name) {
+                    continue;
+                }
+                shown.push(name);
+                let child: Vec<&Row> = rows.iter().copied().filter(|c| c.path.get(depth).map(String::as_str) == Some(name)).collect();
+                out.push(Node::submenu(name, level(&child, depth + 1)));
+            }
+        }
+        tidy(out)
+    }
+    let menus = tops
+        .iter()
+        .map(|top| {
+            let rows: Vec<&Row> = rows.iter().filter(|r| r.path.first().map(String::as_str) == Some(*top)).collect();
+            Menu::new(*top, level(&rows, 1))
+        })
+        .collect();
+    MenuBar { menus, documents: Vec::new() }
+}
+
+/// Drop separators at the start or end of a level and collapse runs of them, and drop empty
+/// submenus, at every depth. A submenu holding only a disabled placeholder (`No Recent Files`)
+/// stays.
+pub fn tidy(nodes: Vec<Node>) -> Vec<Node> {
+    let mut out: Vec<Node> = Vec::with_capacity(nodes.len());
+    for n in nodes {
+        let n = match n {
+            Node::Submenu { label, children, role, platforms } => {
+                let children = tidy(children);
+                if children.is_empty() {
+                    continue;
+                }
+                Node::Submenu { label, children, role, platforms }
+            }
+            other => other,
+        };
+        if matches!(n, Node::Separator) && matches!(out.last(), None | Some(Node::Separator)) {
+            continue;
+        }
+        out.push(n);
+    }
+    while matches!(out.last(), Some(Node::Separator)) {
+        out.pop();
+    }
+    out
+}
+
+/// A hash of everything a native menu can only change by rebuilding: menus, roles, item
+/// commands, kinds (plain, check or radio), shortcuts, submenu labels and the labels of AppKit's items. Item
+/// labels, enabled and checked are updated in place. Window's open documents (the items running a
+/// [`MenuBar::documents`] command) are left out: opening or closing a document rebuilds only the
+/// Window menu ([`window_key`]).
+pub fn structure_key(bar: &MenuBar) -> u64 {
+    let mut h = DefaultHasher::new();
+    for m in &bar.menus {
+        (&m.title, m.role).hash(&mut h);
+        if m.role == MenuRole::Window {
+            let document = |n: &Node| matches!(n, Node::Item(it) if bar.is_document(&it.command));
+            let mut rest: Vec<Node> = m.children.iter().filter(|n| !document(n)).cloned().collect();
+            while matches!(rest.last(), Some(Node::Separator)) {
+                rest.pop();
+            }
+            hash_nodes(&rest, &mut h);
+        } else {
+            hash_nodes(&m.children, &mut h);
+        }
+    }
+    h.finish()
+}
+
+/// The Window menu's structure, its open documents included: when it changes and nothing else
+/// did, a native menu rebuilds just the Window menu.
+pub fn window_key(bar: &MenuBar) -> u64 {
+    let mut h = DefaultHasher::new();
+    if let Some(m) = bar.menu(MenuRole::Window) {
+        hash_nodes(&m.children, &mut h);
+    }
+    h.finish()
+}
+
+fn hash_nodes(nodes: &[Node], h: &mut DefaultHasher) {
+    for n in nodes {
+        match n {
+            Node::Item(it) => ('i', it.command.key(), std::mem::discriminant(&it.kind), &it.shortcut, it.role, it.layout_shortcut).hash(h),
+            Node::Separator => '-'.hash(h),
+            Node::Submenu { label, children, role, .. } => {
+                ('[', label, role).hash(h);
+                hash_nodes(children, h);
+                ']'.hash(h);
+            }
+            Node::Standard { kind, label } => ('s', kind, label).hash(h),
+        }
+    }
+}
+
+/// The native id of an item with `command`: its [`CommandRef::key`], or `key#2`, `key#3`, …
+/// while `taken`, since native ids must be unique and a command can be shown twice (Keyboard
+/// Shortcuts in Edit and Window).
+#[cfg(any(target_os = "macos", test))]
+pub(crate) fn native_id(command: &CommandRef, taken: impl Fn(&str) -> bool) -> String {
+    let key = command.key();
+    let mut unique = key.clone();
+    let mut n = 2;
+    while taken(&unique) {
+        unique = format!("{key}#{n}");
+        n += 1;
+    }
+    unique
+}
diff --git a/crates/menu/src/tests.rs b/crates/menu/src/tests.rs
new file mode 100644
index 00000000..d0854f73
--- /dev/null
+++ b/crates/menu/src/tests.rs
@@ -0,0 +1,604 @@
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::cell::{Cell, RefCell};
+use std::rc::Rc;
+
+use egui::{Key, Modifiers};
+
+use super::*;
+use crate::driver::key_event;
+
+mod bar;
+mod layout;
+mod native;
+
+fn chord(s: &str) -> Chord {
+    Chord::parse(s).unwrap()
+}
+
+/// The modifiers held for a key-down: ⌘, ⌃, ⌥, ⇧.
+fn held([cmd, ctrl, alt, shift]: [bool; 4]) -> Option<craft_keymap::Mods> {
+    Some(craft_keymap::Mods { cmd, ctrl, alt, shift })
+}
+
+fn typing(text_editing: bool) -> Gate {
+    Gate { text_editing, ..Gate::default() }
+}
+
+fn cmd(id: &str) -> CommandRef {
+    CommandRef::new(id)
+}
+
+fn row(path: &[&str], id: &str, label: &str, shortcut: Option<&str>) -> Row {
+    Row {
+        path: path.iter().map(|s| s.to_string()).collect(),
+        command: id.into(),
+        label: label.into(),
+        shortcut: shortcut.map(chord),
+        enabled: true,
+        kind: ItemKind::Plain,
+    }
+}
+
+fn sep(path: &[&str]) -> Row {
+    row(path, "", "---", None)
+}
+
+/// A small app's menus, tagged. With `clashing`, app commands take ⌘H, ⌘M, ⌘W and ⌘,.
+fn sample(clashing: bool, tag_quit: bool) -> MenuBar {
+    let k = |own: &'static str| clashing.then_some(own);
+    let rows = vec![
+        row(&["File"], "file.new", "New", Some("Cmd+N")),
+        sep(&["File"]),
+        row(&["File"], "file.close", "Close", k("Cmd+W")),
+        sep(&["File"]),
+        row(&["File"], "file.exit", "Exit", None),
+        row(&["Edit"], "edit.undo", "Undo", Some("Cmd+Z")),
+        row(&["Edit"], "edit.redo", "Redo", Some("Cmd+Shift+Z")),
+        sep(&["Edit"]),
+        row(&["Edit", "Preferences"], "prefs.general", "General", None),
+        row(&["Edit", "Preferences"], "prefs.keys", "Keys", None),
+        row(&["Edit", "Language"], "lang.en", "English", None),
+        row(&["View"], "view.extras", "Extras", k("Cmd+H")),
+        row(&["View"], "view.hideLayers", "Hide Layers", k("Cmd+,")),
+        row(&["View"], "view.curves", "Curves", k("Cmd+M")),
+        row(&["View"], "view.zoomIn", "Zoom In", Some("Cmd++")),
+        row(&["Window", "Theme"], "theme.dark", "Dark", None),
+        row(&["Window"], "theme.next", "Next Theme", None),
+        row(&["Window"], "panel.layers", "Layers", Some("F7")),
+        row(&["Help"], "help.about", "About", None),
+        row(&["Help"], "help.docs", "Docs", None),
+    ];
+    let mut bar = from_items(&["File", "Edit", "View", "Window", "Help"], &rows);
+    bar.tag_menu("File", MenuRole::File);
+    bar.tag_menu("Edit", MenuRole::Edit);
+    bar.tag_menu("View", MenuRole::View);
+    bar.tag_menu("Window", MenuRole::Window);
+    bar.tag_menu("Help", MenuRole::Help);
+    bar.tag_item(&cmd("help.about"), ItemRole::About);
+    if tag_quit {
+        bar.tag_item(&cmd("file.exit"), ItemRole::Quit);
+    }
+    bar.documents = vec![Document::new("doc.0", "Untitled-1").active(true)];
+    bar.tag_item(&cmd("theme.next"), ItemRole::Appearance);
+    bar.tag_submenu(MenuRole::Edit, "Preferences", ItemRole::Settings);
+    bar.tag_submenu(MenuRole::Edit, "Language", ItemRole::Language);
+    bar.tag_submenu(MenuRole::Window, "Theme", ItemRole::Appearance);
+    bar
+}
+
+fn ids(nodes: &[Node]) -> Vec<String> {
+    nodes
+        .iter()
+        .map(|n| match n {
+            Node::Item(it) => it.command.key(),
+            Node::Separator => "---".into(),
+            Node::Submenu { label, .. } => format!("[{label}]"),
+            Node::Standard { kind, .. } => format!("<{kind:?}>"),
+        })
+        .collect()
+}
+
+fn titled<'a>(bar: &'a MenuBar, title: &str) -> &'a Menu {
+    bar.menus.iter().find(|m| m.title == title).unwrap()
+}
+
+#[test]
+fn the_app_menu_is_laid_out_the_mac_way() {
+    let l = mac_layout(&sample(false, true), &LayoutOptions::new("Sample"));
+    assert!(l.clashes.is_empty(), "{:?}", l.clashes);
+    let app = &l.bar.menus[0];
+    assert_eq!((app.title.as_str(), app.role), ("Sample", MenuRole::App));
+    #[rustfmt::skip]
+    let expected = [
+        "help.about", "---", "[Settings]", "[Language]", "[Appearance]", "---",
+        "<Services>", "---", Builtin::Hide.id(), Builtin::HideOthers.id(), "<ShowAll>", "---", "file.exit",
+    ];
+    assert_eq!(ids(&app.children), expected);
+    let quit = l.bar.find(&cmd("file.exit")).unwrap();
+    assert_eq!((quit.label.as_str(), quit.shortcut), ("Quit Sample", Some(chord("Cmd+Q"))), "the app's own Quit");
+    assert_eq!(l.bar.find(&cmd("help.about")).unwrap().label, "About Sample");
+    assert_eq!(l.bar.find(&Builtin::Hide.command()).unwrap().shortcut, Some(chord("Cmd+H")));
+    assert_eq!(l.bar.find(&Builtin::HideOthers.command()).unwrap().shortcut, Some(chord("Cmd+Alt+H")));
+    assert_eq!(l.bar.find(&cmd("prefs.general")).unwrap().shortcut, Some(chord("Cmd+,")), "⌘, opens the first settings page");
+    let Some(Node::Submenu { children, .. }) = app.children.iter().find(|n| matches!(n, Node::Submenu { label, .. } if label == "Appearance")) else {
+        panic!("an Appearance submenu");
+    };
+    assert_eq!(ids(children), ["theme.dark", "---", "theme.next"]);
+
+    // The moved items leave their menus, and emptied separators go with them.
+    let titles: Vec<&str> = l.bar.menus.iter().map(|m| m.title.as_str()).collect();
+    assert_eq!(titles, ["Sample", "File", "Edit", "View", "Window", "Help"]);
+    assert_eq!(ids(&titled(&l.bar, "File").children), ["file.new", "---", "file.close", "---", "<CloseWindow>"]);
+    assert_eq!(ids(&titled(&l.bar, "Edit").children), ["edit.undo", "edit.redo"]);
+    assert_eq!(ids(&titled(&l.bar, "Help").children), ["help.docs"]);
+    assert_eq!(
+        ids(&l.bar.menu(MenuRole::Window).unwrap().children),
+        ["<Minimize>", "<Zoom>", "---", "panel.layers", "---", "<BringAllToFront>", "---", "doc.0"],
+        "the open documents follow Bring All to Front"
+    );
+}
+
+/// Without a tagged Quit the layout adds craft-quit's; the app's translations name what the
+/// layout writes, AppKit's items included.
+#[test]
+fn an_untagged_quit_is_craft_quits_and_labels_are_translated() {
+    let mut bar = sample(false, false);
+    bar.menus.retain(|m| m.role != MenuRole::Window);
+    let german = |s: &'static str| match s {
+        "Quit {app}" => "{app} beenden".to_string(),
+        "Window" => "Fenster".into(),
+        "Services" => "Dienste".into(),
+        other => other.into(),
+    };
+    let l = mac_layout(&bar, &LayoutOptions { label: &german, ..LayoutOptions::new("Sample") });
+    let quit = l.bar.find(&Builtin::Quit.command()).unwrap();
+    assert_eq!((quit.label.as_str(), quit.shortcut, quit.role), ("Sample beenden", Some(chord("Cmd+Q")), Some(ItemRole::Quit)));
+    assert!(ids(&titled(&l.bar, "File").children).contains(&"file.exit".to_string()), "File › Exit stays");
+    let app = l.bar.menu(MenuRole::App).unwrap();
+    assert!(app.children.contains(&Node::Standard { kind: Standard::Services, label: "Dienste".into() }));
+    let titles: Vec<&str> = l.bar.menus.iter().map(|m| m.title.as_str()).collect();
+    assert_eq!(titles, ["Sample", "File", "Edit", "View", "Fenster", "Help"], "a Window menu before Help");
+    assert_eq!(ids(&l.bar.menu(MenuRole::Window).unwrap().children), ["<Minimize>", "<Zoom>", "---", "<BringAllToFront>", "---", "doc.0"]);
+}
+
+/// App commands keep ⌘H, ⌘M, ⌘W and ⌘,: the system items give way, and each clash is reported.
+#[test]
+fn clashes_are_resolved_in_the_apps_favour() {
+    let l = mac_layout(&sample(true, true), &LayoutOptions::new("Sample"));
+    let clash = |sc: &str| l.clashes.iter().find(|c| c.shortcut == chord(sc)).map(|c| c.command.id.as_str());
+    assert_eq!(clash("Cmd+H"), Some("view.extras"));
+    assert_eq!(clash("Cmd+M"), Some("view.curves"));
+    assert_eq!(clash("Cmd+W"), Some("file.close"));
+    assert_eq!(clash("Cmd+,"), Some("view.hideLayers"));
+    assert_eq!(l.clashes.len(), 4);
+    assert_eq!(l.bar.find(&Builtin::Hide.command()).unwrap().shortcut, Some(chord("Ctrl+Cmd+H")));
+    assert_eq!(l.bar.find(&Builtin::Minimize.command()).unwrap().shortcut, Some(chord("Ctrl+Cmd+M")));
+    assert_eq!(l.bar.find(&cmd("prefs.general")).unwrap().shortcut, None);
+    assert_eq!(ids(&l.bar.menu(MenuRole::Window).unwrap().children)[..2], [Builtin::Minimize.id(), "<Zoom>"]);
+    assert!(!ids(&titled(&l.bar, "File").children).contains(&"<CloseWindow>".to_string()), "⌘W stays File › Close");
+
+    // With ⌃⌘H taken too, Hide goes without a shortcut.
+    let mut bar = sample(true, true);
+    bar.menus[0].children.push(Item::new("file.other", "Other").shortcut(chord("Ctrl+Cmd+H")).into());
+    let l = mac_layout(&bar, &LayoutOptions::new("Sample"));
+    assert_eq!(l.bar.find(&Builtin::Hide.command()).unwrap().shortcut, None);
+    assert_eq!(l.clashes.iter().find(|c| c.shortcut == chord("Cmd+H")).map(|c| c.resolution), Some("Hide has no shortcut"));
+}
+
+#[test]
+fn rows_become_a_tidy_tree() {
+    let rows = [
+        sep(&["A"]),
+        row(&["A"], "a", "a", None),
+        sep(&["A"]),
+        sep(&["A"]),
+        sep(&["A", "Sub"]),
+        row(&["A", "Sub"], "b", "b", None),
+        sep(&["A", "Sub"]),
+    ];
+    let bar = from_items(&["A", "Empty"], &rows);
+    assert_eq!(bar.menus.len(), 2);
+    assert_eq!(bar.menus[0].children, [Item::new("a", "a").into(), Node::Separator, Node::submenu("Sub", vec![Item::new("b", "b").into()])]);
+    assert!(bar.menus[1].children.is_empty());
+    let nested = vec![Node::Separator, Node::submenu("S", vec![Node::Separator, Node::Separator]), Node::Separator, Node::Separator];
+    assert_eq!(tidy(nested), [], "a submenu left empty goes");
+}
+
+/// Labels, enabled and checked are updated in place; a shortcut or a check item that used to be
+/// plain needs a rebuild. A document opening or closing rebuilds only the Window menu.
+#[test]
+fn keys_separate_rebuilds_from_updates_in_place() {
+    let opts = LayoutOptions::new("Sample");
+    let base = mac_layout(&sample(false, true), &opts).bar;
+    let key = |bar: &MenuBar| (structure_key(bar), window_key(bar));
+    let edit = |f: &dyn Fn(&mut Item)| {
+        let mut bar = sample(false, true);
+        for m in &mut bar.menus {
+            for n in &mut m.children {
+                if let Node::Item(it) = n
+                    && it.command.id == "edit.undo"
+                {
+                    f(it);
+                }
+            }
+        }
+        mac_layout(&bar, &opts).bar
+    };
+    assert_eq!(key(&edit(&|it| it.label = "Undo Typing".into())), key(&base));
+    assert_eq!(key(&edit(&|it| it.enabled = false)), key(&base));
+    assert_ne!(structure_key(&edit(&|it| it.shortcut = Some(chord("Ctrl+Z")))), structure_key(&base));
+    assert_ne!(structure_key(&edit(&|it| it.kind = ItemKind::Check(false))), structure_key(&base));
+
+    let mut two = sample(false, true);
+    two.documents.push(Document::new("doc.1", "Untitled-2"));
+    let two = mac_layout(&two, &opts).bar;
+    assert_eq!(structure_key(&two), structure_key(&base));
+    assert_ne!(window_key(&two), window_key(&base));
+    assert_eq!(ids(&two.menu(MenuRole::Window).unwrap().children).last().map(String::as_str), Some("doc.1"));
+}
+
+#[test]
+fn chords_become_egui_key_presses() {
+    use crate::driver::native_ok;
+    assert!(native_ok(&chord("Cmd+B")));
+    assert!(native_ok(&chord("Ctrl+B")));
+    assert!(native_ok(&chord("Ctrl+F5")));
+    assert!(!native_ok(&chord("F5")), "a bare function key is display-only");
+    assert!(!native_ok(&chord("Alt+F12")));
+    assert!(!native_ok(&chord("B")));
+    assert!(!native_ok(&chord("Alt+F")));
+    assert!(!native_ok(&chord("Shift+X")));
+
+    let egui::Event::Key { key, modifiers, pressed: true, .. } = key_event(&chord("Shift+Cmd+Z"), true) else { panic!("a key press") };
+    assert_eq!(key, Key::Z);
+    assert!(modifiers.command && modifiers.mac_cmd && modifiers.shift && !modifiers.ctrl && !modifiers.alt);
+    let ctrl = key_event(&chord("Ctrl+Cmd+M"), true);
+    assert!(matches!(ctrl, egui::Event::Key { modifiers, .. } if modifiers.ctrl && modifiers.command));
+
+    // Every shortcut the layout writes is a key equivalent; the app's F7 is display-only.
+    let bar = mac_layout(&sample(true, true), &LayoutOptions::new("Sample")).bar;
+    for it in bar.items().into_iter().filter(|it| it.layout_shortcut) {
+        let Some(sc) = &it.shortcut else { continue };
+        assert!(native_ok(sc), "{sc} on {}", it.command);
+    }
+    assert!(!native_ok(&bar.find(&cmd("panel.layers")).unwrap().shortcut.unwrap()));
+}
+
+/// A command's native id is its key; a command shown twice gets `key#2` for its second item, also
+/// when it has parameters.
+#[test]
+fn a_command_shown_twice_gets_a_second_native_id() {
+    use crate::model::native_id;
+    let keys = cmd("edit.keys");
+    let recent = CommandRef::parse_key(r#"file.open_recent {"index":3}"#).unwrap();
+    let mut taken: Vec<String> = Vec::new();
+    for c in [&keys, &recent, &keys, &recent, &keys] {
+        let id = native_id(c, |id| taken.iter().any(|t| t == id));
+        taken.push(id);
+    }
+    assert_eq!(taken, ["edit.keys", r#"file.open_recent {"index":3}"#, "edit.keys#2", r#"file.open_recent {"index":3}#2"#, "edit.keys#3"]);
+}
+
+#[derive(Default)]
+struct Fake {
+    synced: Rc<RefCell<Vec<MenuBar>>>,
+    events: Rc<RefCell<Vec<Event>>>,
+    tracking: Rc<Cell<bool>>,
+    cancels: Rc<Cell<usize>>,
+    /// Keeps reporting a menu open after `cancel_tracking`.
+    stuck: bool,
+    /// What the backend's menu event handler would call.
+    dispatch: Rc<RefCell<Option<Dispatch>>>,
+}
+
+impl Backend for Fake {
+    fn sync(&mut self, bar: &MenuBar) {
+        self.synced.borrow_mut().push(bar.clone());
+    }
+    fn drain(&mut self) -> Vec<Event> {
+        std::mem::take(&mut self.events.borrow_mut())
+    }
+    fn tracking(&self) -> bool {
+        self.tracking.get()
+    }
+    fn cancel_tracking(&mut self) {
+        self.cancels.set(self.cancels.get() + 1);
+        if !self.stuck {
+            self.tracking.set(false);
+        }
+    }
+    fn attach(&mut self, dispatch: Dispatch) {
+        *self.dispatch.borrow_mut() = Some(dispatch);
+    }
+}
+
+/// AppKit takes a key equivalent's key-down but winit still delivers the key-up: the menu adds
+/// only the press, before a key-up already queued, so the shortcut runs once. (⌘V as a key, as
+/// an app taking the raw clipboard keys gets it.)
+#[test]
+fn key_equivalents_become_one_key_press() {
+    let events = Rc::new(RefCell::new(Vec::new()));
+    let mut menu = NativeMenu::new(Box::new(Fake { events: events.clone(), ..Default::default() })).clipboard_keys(ClipboardKeys::Raw);
+    let paste = Chord::parse("Cmd+V").unwrap();
+    let release = egui::Event::Key { key: Key::V, physical_key: Some(Key::V), pressed: false, repeat: false, modifiers: Modifiers::COMMAND };
+    let press = key_event(&paste, true);
+
+    events.borrow_mut().push(Event::Key(paste));
+    let mut raw = egui::RawInput { events: vec![egui::Event::ModifiersChanged(Modifiers::COMMAND), release.clone()], ..Default::default() };
+    menu.raw_input(&mut raw);
+    assert_eq!(raw.events, [egui::Event::ModifiersChanged(Modifiers::COMMAND), press.clone(), release]);
+
+    events.borrow_mut().push(Event::Key(paste));
+    let mut raw = egui::RawInput::default();
+    menu.raw_input(&mut raw);
+    assert_eq!(raw.events, [press], "no made-up release: the real one comes in a later frame");
+}
+
+/// Minimize and craft-quit's Quit run in the crate; other clicks go to the app. The menus are
+/// laid out again only when the state changed or an event arrived.
+#[test]
+fn clicks_and_syncs() {
+    let synced = Rc::new(RefCell::new(Vec::new()));
+    let events = Rc::new(RefCell::new(vec![
+        Event::Click(Builtin::Minimize.command()),
+        Event::Click("edit.undo".into()),
+        Event::Click(craft_quit::QUIT_MENU_ID.into()),
+    ]));
+    let mut menu = NativeMenu::new(Box::new(Fake { synced: synced.clone(), events: events.clone(), ..Default::default() }));
+    let mut raw = egui::RawInput::default();
+    menu.raw_input(&mut raw);
+    assert!(raw.events.is_empty());
+
+    let ctx = egui::Context::default();
+    let mut clicks = Vec::new();
+    let mut out = ctx.run_ui(raw, |ui| clicks = menu.take_clicks(ui.ctx()));
+    out.textures_delta.clear(); // not painted
+    assert_eq!(clicks, [cmd("edit.undo")]);
+    let commands = out.viewport_output.remove(&egui::ViewportId::ROOT).map(|o| o.commands).unwrap_or_default();
+    assert!(commands.contains(&egui::ViewportCommand::Minimized(true)));
+    assert!(commands.contains(&egui::ViewportCommand::Close), "Quit asks the window to close");
+
+    let opts = LayoutOptions::new("Sample");
+    let builds = Cell::new(0);
+    let build = || {
+        builds.set(builds.get() + 1);
+        mac_layout(&sample(true, true), &opts)
+    };
+    assert_eq!(menu.sync_with(1, build).len(), 4, "the clashes, once");
+    assert!(menu.sync_with(1, build).is_empty());
+    assert_eq!(builds.get(), 1, "same state: nothing built");
+    assert!(menu.sync_with(2, build).is_empty(), "same clashes: not reported again");
+    events.borrow_mut().push(Event::Click("edit.redo".into()));
+    menu.raw_input(&mut egui::RawInput::default());
+    menu.sync_with(2, build);
+    assert_eq!((builds.get(), synced.borrow().len()), (3, 3), "an event re-syncs");
+}
+
+fn press() -> egui::Event {
+    egui::Event::PointerButton { pos: egui::pos2(300.0, 200.0), button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() }
+}
+
+#[test]
+fn outside_press_dismisses_without_starting_a_canvas_gesture() {
+    use crate::driver::dismiss_input;
+    let moved = egui::Event::PointerMoved(egui::pos2(300.0, 200.0));
+    let mut raw = egui::RawInput { events: vec![moved.clone(), press()], ..Default::default() };
+    assert_eq!(dismiss_input(&mut raw, || true), Some(true));
+    assert_eq!(raw.events, [moved]);
+    assert_eq!(dismiss_input(&mut raw, || true), None);
+    raw.events.push(press());
+    assert_eq!(dismiss_input(&mut raw, || false), Some(false));
+    assert_eq!(raw.events.len(), 2, "ordinary canvas presses still reach egui");
+}
+
+#[test]
+fn escape_dismisses_without_reaching_the_active_tool() {
+    let escape = |pressed| egui::Event::Key { key: Key::Escape, physical_key: None, pressed, repeat: false, modifiers: Default::default() };
+    let mut raw = egui::RawInput { events: vec![escape(true), escape(false)], ..Default::default() };
+    assert_eq!(crate::driver::dismiss_input(&mut raw, || true), Some(true));
+    assert!(raw.events.is_empty());
+}
+
+#[test]
+fn moving_the_pointer_does_not_dismiss_a_tracking_menu() {
+    let mut raw = egui::RawInput { events: vec![egui::Event::PointerMoved(egui::pos2(300.0, 200.0))], ..Default::default() };
+    assert_eq!(crate::driver::dismiss_input(&mut raw, || true), None);
+    assert_eq!(raw.events.len(), 1);
+}
+
+/// `raw_input` closes an open menu on a click and keeps the click from egui; with no menu open
+/// the click reaches egui (the menu is still asked to close, in case one is on screen).
+#[test]
+fn a_click_closes_an_open_menu() {
+    let tracking = Rc::new(Cell::new(true));
+    let cancels = Rc::new(Cell::new(0));
+    let mut menu = NativeMenu::new(Box::new(Fake { tracking: tracking.clone(), cancels: cancels.clone(), ..Default::default() }));
+    let mut raw = egui::RawInput { events: vec![press()], ..Default::default() };
+    menu.raw_input(&mut raw);
+    assert!(raw.events.is_empty());
+    assert_eq!((cancels.get(), tracking.get()), (1, false));
+
+    let mut raw = egui::RawInput { events: vec![press()], ..Default::default() };
+    menu.raw_input(&mut raw);
+    assert_eq!(raw.events, [press()]);
+    assert_eq!(cancels.get(), 2);
+
+    menu.raw_input(&mut egui::RawInput { events: vec![egui::Event::PointerMoved(egui::pos2(1.0, 1.0))], ..Default::default() });
+    assert_eq!(cancels.get(), 2, "a pointer move closes nothing");
+}
+
+/// A backend that keeps reporting a menu open costs one window click, not all of them; once it
+/// reports the menu closed, the next open menu's closing click is kept from egui again.
+#[test]
+fn a_stuck_open_menu_keeps_only_one_click() {
+    let tracking = Rc::new(Cell::new(true));
+    let mut menu = NativeMenu::new(Box::new(Fake { tracking: tracking.clone(), stuck: true, ..Default::default() }));
+    let mut raw = egui::RawInput { events: vec![press()], ..Default::default() };
+    menu.raw_input(&mut raw);
+    assert!(raw.events.is_empty(), "the click that closes the menu");
+    for _ in 0..3 {
+        let mut raw = egui::RawInput { events: vec![press()], ..Default::default() };
+        menu.raw_input(&mut raw);
+        assert_eq!(raw.events, [press()], "later clicks reach egui");
+    }
+    tracking.set(false);
+    menu.raw_input(&mut egui::RawInput::default());
+    tracking.set(true);
+    let mut raw = egui::RawInput { events: vec![press()], ..Default::default() };
+    menu.raw_input(&mut raw);
+    assert!(raw.events.is_empty());
+}
+
+fn key(key: Key, pressed: bool, modifiers: Modifiers) -> egui::Event {
+    egui::Event::Key { key, physical_key: Some(key), pressed, repeat: false, modifiers }
+}
+
+/// AppKit takes ⌘C, ⌘X and ⌘V for the Edit menu, so egui-winit never makes its Copy, Cut and
+/// Paste events: the driver makes them, unless the app takes the raw keys.
+#[test]
+fn clipboard_key_equivalents_reach_text_fields() {
+    let events = Rc::new(RefCell::new(Vec::new()));
+    let mut menu = NativeMenu::new(Box::new(Fake { events: events.clone(), ..Default::default() }));
+    let equivalent = |s: &str| Event::Key(chord(s));
+    events.borrow_mut().extend([equivalent("Cmd+C"), equivalent("Cmd+X"), equivalent("Cmd+Shift+V")]);
+    let release = key(Key::C, false, Modifiers::COMMAND);
+    let mut raw = egui::RawInput { events: vec![release.clone()], ..Default::default() };
+    menu.raw_input(&mut raw);
+    let shift_v = key_event(&chord("Cmd+Shift+V"), true);
+    assert_eq!(raw.events, [egui::Event::Copy, release, egui::Event::Cut, shift_v], "⌘⇧V is an app shortcut");
+
+    events.borrow_mut().push(equivalent("Cmd+V"));
+    let mut raw = egui::RawInput::default();
+    menu.raw_input(&mut raw);
+    assert!(raw.events.is_empty(), "the paste comes from eframe, with the clipboard's text");
+    let ctx = egui::Context::default();
+    let mut out = ctx.run_ui(raw, |ui| {
+        menu.take_clicks(ui.ctx());
+    });
+    out.textures_delta.clear();
+    let commands = out.viewport_output.remove(&egui::ViewportId::ROOT).map(|o| o.commands).unwrap_or_default();
+    assert!(commands.contains(&egui::ViewportCommand::RequestPaste));
+
+    let mut menu = NativeMenu::new(Box::new(Fake { events: events.clone(), ..Default::default() })).clipboard_keys(ClipboardKeys::Raw);
+    events.borrow_mut().extend([equivalent("Cmd+C"), equivalent("Cmd+V")]);
+    let mut raw = egui::RawInput::default();
+    menu.raw_input(&mut raw);
+    let press = |s: &str| key_event(&chord(s), true);
+    assert_eq!(raw.events, [press("Cmd+C"), press("Cmd+V")]);
+}
+
+/// The layout marks the shortcuts it gives (the app's key handling doesn't bind them), and a key
+/// equivalent on such an item comes back as a click.
+#[test]
+fn shortcuts_the_layout_assigns_come_back_as_clicks() {
+    use crate::driver::chosen_event;
+    let l = mac_layout(&sample(false, true), &LayoutOptions::new("Sample"));
+    let assigned = |id: &str| l.bar.find(&cmd(id)).unwrap().layout_shortcut;
+    assert!(assigned("file.exit") && assigned("prefs.general") && assigned(Builtin::Hide.id()));
+    assert!(!assigned("edit.undo") && !assigned("prefs.keys"));
+    let mut bar = sample(false, true);
+    bar.menus[0].children.push(Item::new("file.quit", "Quit").shortcut(chord("Cmd+Q")).role(ItemRole::Quit).into());
+    bar.tag_item(&cmd("file.exit"), ItemRole::About);
+    assert!(!mac_layout(&bar, &LayoutOptions::new("Sample")).bar.find(&cmd("file.quit")).unwrap().layout_shortcut, "the app's own ⌘Q");
+
+    let cmd_q = Chord::parse("Cmd+Q").unwrap();
+    let cmd_held = held([true, false, false, false]);
+    let open = Gate::default();
+    assert_eq!(chosen_event(&cmd("file.exit"), Some(&cmd_q), true, cmd_held, open), Event::Click("file.exit".into()));
+    assert_eq!(chosen_event(&cmd("file.quit"), Some(&cmd_q), false, cmd_held, open), Event::Key(cmd_q));
+    // ⇧ held on a ⌘R item: the key press that was made.
+    let shift_r = Chord::parse("Cmd+Shift+R").unwrap();
+    assert_eq!(
+        chosen_event(&cmd("view.reload"), Some(&Chord::parse("Cmd+R").unwrap()), false, held([true, false, false, true]), open),
+        Event::Key(shift_r)
+    );
+    assert_eq!(chosen_event(&cmd("file.quit"), Some(&cmd_q), false, None, open), Event::Click("file.quit".into()), "a mouse click");
+    assert_eq!(
+        chosen_event(&Builtin::Minimize.command(), Some(&Chord::parse("Ctrl+Cmd+M").unwrap()), false, held([true, true, false, false]), open),
+        Event::Click(Builtin::Minimize.command())
+    );
+    // ↩ inside the open menu: on a ⌘ item without ⌘ held, and on a bare tool key.
+    let enter = held([false; 4]);
+    assert_eq!(chosen_event(&cmd("file.quit"), Some(&cmd_q), false, enter, open), Event::Click("file.quit".into()));
+    assert_eq!(chosen_event(&cmd("tool.brush"), Some(&Chord::parse("B").unwrap()), false, enter, open), Event::Click("tool.brush".into()));
+}
+
+/// While a text field has the keys, a key equivalent runs its command as a click (⌘S saves while
+/// typing), except the editing keys the field handles itself.
+#[test]
+fn key_equivalents_run_commands_while_text_editing() {
+    use crate::driver::chosen_event;
+    let dispatch = Rc::new(RefCell::new(None));
+    let mut menu = NativeMenu::new(Box::new(Fake { dispatch: dispatch.clone(), ..Default::default() }));
+    menu.set_gate(typing(true));
+    let dispatch = dispatch.borrow().clone().unwrap();
+    assert_eq!(
+        dispatch.chosen(&cmd("file.save"), Some(&chord("Cmd+S")), false, held([true, false, false, false])),
+        Event::Click(cmd("file.save")),
+        "the backend's handler sees the gate"
+    );
+
+    let chosen = |shortcut: &str, mods: [bool; 4], text_editing: bool| {
+        chosen_event(&cmd("cmd"), Some(&Chord::parse(shortcut).unwrap()), false, held(mods), typing(text_editing))
+    };
+    let cmd = [true, false, false, false];
+    let shift_cmd = [true, false, false, true];
+    for (shortcut, held) in [
+        ("Cmd+S", cmd),
+        ("Cmd+N", cmd),
+        ("Cmd+Shift+S", shift_cmd),
+        ("Ctrl+Cmd+F", [true, true, false, false]),
+        ("Ctrl+F5", [false, true, false, false]),
+    ] {
+        assert_eq!(chosen(shortcut, held, true), Event::Click("cmd".into()), "{shortcut} while typing");
+        assert!(matches!(chosen(shortcut, held, false), Event::Key(_)), "{shortcut} with no text field");
+    }
+    for (shortcut, held) in [("Cmd+C", cmd), ("Cmd+X", cmd), ("Cmd+V", cmd), ("Cmd+A", cmd), ("Cmd+Z", cmd), ("Cmd+Shift+Z", shift_cmd)] {
+        assert_eq!(chosen(shortcut, held, true), Event::Key(Chord::parse(shortcut).unwrap()), "{shortcut} stays with the field");
+    }
+    assert_eq!(chosen("Cmd+A", shift_cmd, true), Event::Click("cmd".into()), "⇧⌘A is not select all");
+}
+
+/// Hide Others is the crate's own item: an app command on ⌥⌘H, in a menu or bound elsewhere,
+/// keeps the key, and shortcuts bound outside the menus clash like menu ones.
+#[test]
+fn hide_others_and_extra_shortcuts_give_way_to_the_app() {
+    let extra = [(chord("Cmd+Alt+H"), cmd("canvas.hideGuides")), (chord("Shift+Cmd+Q"), cmd("canvas.other"))];
+    let l = mac_layout(&sample(false, true), &LayoutOptions::new("Sample").extra_shortcuts(&extra));
+    assert_eq!(l.bar.find(&Builtin::HideOthers.command()).unwrap().shortcut, None);
+    assert_eq!(
+        l.clashes,
+        [Clash { shortcut: chord("Cmd+Alt+H"), system: "Hide Others", command: cmd("canvas.hideGuides"), resolution: "Hide Others has no shortcut" }]
+    );
+    let extra = [(chord("Cmd+H"), cmd("canvas.hand"))];
+    let l = mac_layout(&sample(false, true), &LayoutOptions::new("Sample").extra_shortcuts(&extra));
+    assert_eq!(l.bar.find(&Builtin::Hide.command()).unwrap().shortcut, Some(chord("Ctrl+Cmd+H")));
+}
+
+/// An app menu in the app's own tree merges into the layout's: no second app menu.
+#[test]
+fn an_apps_own_app_menu_is_merged() {
+    let mut bar = sample(false, true);
+    let own = vec![
+        Item::new("app.discord", "Join Our Discord").into(),
+        Node::submenu("Theme", vec![Item::new("theme.light", "Light").into()]).role(ItemRole::Appearance),
+    ];
+    bar.menus.insert(0, Menu::new("Sample", own).role(MenuRole::App));
+    bar.menus.iter_mut().find(|m| m.title == "Window").unwrap().children.retain(|n| !matches!(n, Node::Submenu { .. }));
+    let l = mac_layout(&bar, &LayoutOptions::new("Sample"));
+    assert_eq!(l.bar.menus.iter().filter(|m| m.role == MenuRole::App).count(), 1);
+    let app = l.bar.menu(MenuRole::App).unwrap();
+    assert_eq!(ids(&app.children)[..7], ["help.about", "---", "[Settings]", "[Language]", "[Appearance]", "---", "app.discord"]);
+}
+
+#[test]
+fn a_modal_dialog_or_shortcut_recording_lets_only_the_built_in_items_run() {
+    let save = Item::new(CommandRef::new("file.save"), "Save");
+    let quit = Item::new(Builtin::Quit.command(), "Quit");
+    for gate in [Gate { modal: true, ..Gate::default() }, Gate { recording_shortcut: true, ..Gate::default() }] {
+        assert!(!gate.allows(&save) && gate.allows(&quit), "{gate:?}");
+    }
+    assert!(Gate { text_editing: true, ..Gate::default() }.allows(&save));
+    assert!(Gate::default().allows(&save));
+}
diff --git a/crates/menu/src/tests/bar.rs b/crates/menu/src/tests/bar.rs
new file mode 100644
index 00000000..5227839b
--- /dev/null
+++ b/crates/menu/src/tests/bar.rs
@@ -0,0 +1,700 @@
+//! The egui bar: clicks, hover, the keys, overflow, scrolling, submenu hover intent and AccessKit.
+
+use egui::accesskit::{self, NodeId, Role, Toggled};
+use egui::{Event, Id, Key, Modifiers, Pos2, Rect, Vec2, pos2, vec2};
+
+use super::*;
+use crate::bar::Labeled;
+use crate::bar::nav::{ARROW, Nav, heading, is_open};
+
+#[path = "bar_keys.rs"]
+mod keys;
+
+fn item(id: &str, label: &str) -> Item {
+    Item::new(id, label)
+}
+
+/// A small app's menus, as a desktop layout leaves them.
+fn sample() -> MenuBar {
+    MenuBar {
+        menus: vec![
+            Menu::new(
+                "File",
+                vec![
+                    item("file.new", "New").shortcut(Chord::parse("Cmd+N").unwrap()).into(),
+                    item("file.open", "Open…").into(),
+                    Node::Separator,
+                    Node::submenu("Open Recent", vec![item("file.recent.a", "a.txt").into(), item("file.recent.b", "b.txt").into()]),
+                    Node::submenu("Nothing Here", vec![item("file.gone", "Gone").enabled(false).into()]),
+                    Node::Separator,
+                    item("file.locked", "Locked").enabled(false).into(),
+                    Item::new(Builtin::Quit.command(), "Quit").into(),
+                ],
+            )
+            .role(MenuRole::File),
+            Menu::new("Edit", vec![item("edit.undo", "Undo").into(), item("edit.redo", "Redo").into()]).role(MenuRole::Edit),
+            Menu::new(
+                "View",
+                vec![
+                    item("view.grid", "Grid").check(true).shortcut(Chord::parse("G").unwrap()).into(),
+                    item("view.rulers", "Rulers").check(false).into(),
+                    Node::Separator,
+                    item("view.light", "Light").radio(true).into(),
+                    item("view.dark", "Dark").radio(false).into(),
+                ],
+            )
+            .role(MenuRole::View),
+            Menu::new("Help", vec![item("help.about", "About").into()]).role(MenuRole::Help),
+        ],
+        documents: Vec::new(),
+    }
+}
+
+/// The bar alone in a window, driven frame by frame with synthetic input.
+struct Bar {
+    ctx: egui::Context,
+    bar: MenuBar,
+    gate: Gate,
+    target: Target,
+    english: Option<fn(Labeled<'_>) -> Option<String>>,
+    preferred: Vec<(&'static str, char)>,
+    size: Vec2,
+    dt: f64,
+    time: f64,
+    events: Vec<Event>,
+    pointer: Pos2,
+    tree: Vec<(NodeId, accesskit::Node)>,
+    clicked: Vec<CommandRef>,
+    /// `shrink_to_fit`'s limit; the bar then shares a row with a label, which starts at `after`.
+    fit: Option<f32>,
+    after: Option<f32>,
+    /// The viewport commands the bar sent.
+    sent: Vec<egui::ViewportCommand>,
+}
+
+impl Bar {
+    fn new(bar: MenuBar, size: Vec2) -> Bar {
+        let ctx = egui::Context::default();
+        // Not the host's: the web target's key names follow it.
+        ctx.set_os(egui::os::OperatingSystem::Nix);
+        ctx.enable_accesskit();
+        ctx.all_styles_mut(|s| s.scroll_animation = egui::style::ScrollAnimation::none());
+        let mut b = Bar {
+            ctx,
+            bar,
+            gate: Gate::default(),
+            target: Target::Linux,
+            english: None,
+            preferred: Vec::new(),
+            size,
+            dt: 1.0 / 60.0,
+            time: 0.0,
+            events: Vec::new(),
+            pointer: pos2(-10.0, -10.0),
+            tree: Vec::new(),
+            clicked: Vec::new(),
+            fit: None,
+            after: None,
+            sent: Vec::new(),
+        };
+        b.run(3);
+        b
+    }
+
+    fn frame(&mut self) {
+        self.time += self.dt;
+        let raw = egui::RawInput {
+            screen_rect: Some(Rect::from_min_size(Pos2::ZERO, self.size)),
+            time: Some(self.time),
+            predicted_dt: self.dt as f32,
+            events: std::mem::take(&mut self.events),
+            ..Default::default()
+        };
+        let (bar, gate, target, english, preferred, fit) = (&self.bar, self.gate, self.target, self.english, &self.preferred, self.fit);
+        let mut out = Vec::new();
+        let mut after = None;
+        let mut full = self.ctx.run_ui(raw, |ui| {
+            let mut ui_bar = MenuBarUi::new(bar).gate(gate).target(target).mnemonics(preferred);
+            if let Some(english) = &english {
+                ui_bar = ui_bar.english(english);
+            }
+            match fit {
+                Some(max) => {
+                    ui.horizontal(|ui| {
+                        out = ui_bar.shrink_to_fit(max).show(ui);
+                        after = Some(ui.label("after").rect.left());
+                    });
+                }
+                None => out = ui_bar.show(ui),
+            }
+        });
+        full.textures_delta.clear();
+        self.after = after;
+        if let Some(root) = full.viewport_output.remove(&egui::ViewportId::ROOT) {
+            self.sent.extend(root.commands);
+        }
+        if let Some(update) = full.platform_output.accesskit_update {
+            self.tree = update.nodes;
+        }
+        self.clicked.extend(out);
+    }
+
+    fn run(&mut self, frames: usize) {
+        for _ in 0..frames {
+            self.frame();
+        }
+    }
+
+    /// The commands chosen since the last call.
+    fn take(&mut self) -> Vec<CommandRef> {
+        std::mem::take(&mut self.clicked)
+    }
+
+    fn nodes(&self, label: &str) -> impl Iterator<Item = &accesskit::Node> {
+        self.tree.iter().map(|(_, n)| n).filter(move |n| n.label() == Some(label))
+    }
+
+    fn node(&self, label: &str) -> Option<&accesskit::Node> {
+        self.nodes(label).next()
+    }
+
+    fn shown(&self, label: &str) -> bool {
+        self.node(label).is_some()
+    }
+
+    /// A title of the bar (not a submenu row of the same name).
+    fn title(&self, label: &str) -> Option<&accesskit::Node> {
+        let (_, bar) = self.tree.iter().find(|(_, n)| n.role() == Role::MenuBar)?;
+        self.tree.iter().filter(|(id, _)| bar.children().contains(id)).map(|(_, n)| n).find(|n| n.label() == Some(label))
+    }
+
+    fn rect(&self, label: &str) -> Rect {
+        let n = self.node(label).unwrap_or_else(|| panic!("no {label:?}"));
+        let b = n.bounds().unwrap_or_else(|| panic!("{label:?} has no bounds"));
+        Rect::from_min_max(pos2(b.x0 as f32, b.y0 as f32), pos2(b.x1 as f32, b.y1 as f32))
+    }
+
+    fn move_to(&mut self, p: Pos2) {
+        self.pointer = p;
+        self.events.push(Event::PointerMoved(p));
+        self.frame();
+    }
+
+    /// A point on `label`, near its left end: a menu row can be wider than a narrow window.
+    fn point(&self, label: &str) -> Pos2 {
+        let r = self.rect(label);
+        pos2(r.left() + (r.width() / 2.0).min(20.0), r.center().y)
+    }
+
+    fn hover(&mut self, label: &str) {
+        let p = self.point(label);
+        self.move_to(p);
+        self.run(3);
+    }
+
+    fn button(&mut self, pressed: bool) {
+        self.events.push(Event::PointerButton { pos: self.pointer, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        self.frame();
+    }
+
+    fn click_at(&mut self, p: Pos2) {
+        self.move_to(p);
+        self.button(true);
+        self.button(false);
+        self.run(3);
+    }
+
+    fn click(&mut self, label: &str) {
+        let p = self.point(label);
+        self.click_at(p);
+    }
+
+    fn key(&mut self, key: Key) {
+        for pressed in [true, false] {
+            self.events.push(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE });
+        }
+        self.run(3);
+    }
+
+    fn nav(&self) -> Nav {
+        Nav::current(&self.ctx, Id::unique("craft-menu-bar").with("nav"))
+    }
+
+    /// Is row `i` of `level` entirely inside its level's visible (scrolled) part, in the window?
+    fn visible(&self, level: usize, i: usize) -> bool {
+        let nav = self.nav();
+        let (Some(row), Some(view)) = (nav.rows.get(level).and_then(|r| r.get(i)), nav.views.get(level)) else { return false };
+        view.expand(0.5).contains_rect(row.rect) && self.ctx.content_rect().expand(0.5).contains_rect(*view)
+    }
+}
+
+fn wide() -> Bar {
+    Bar::new(sample(), vec2(800.0, 600.0))
+}
+
+#[test]
+fn clicking_an_item_returns_its_command_and_closes_the_menu() {
+    let mut b = wide();
+    assert!(!b.shown("New"));
+    b.click("File");
+    assert!(b.shown("New") && is_open(&b.ctx), "a click on a title opens its menu");
+    b.click("New");
+    assert_eq!(b.take(), vec![CommandRef::new("file.new")]);
+    assert!(!b.shown("New") && !is_open(&b.ctx), "choosing an item closes the menu");
+}
+
+#[test]
+fn a_second_click_escape_or_a_click_outside_closes_the_menu() {
+    let mut b = wide();
+    b.click("File");
+    b.click("File");
+    assert!(!b.shown("New"), "a second click on the title");
+    b.click("File");
+    b.key(Key::Escape);
+    assert!(!b.shown("New"), "Esc");
+    b.click("File");
+    b.click_at(pos2(700.0, 500.0));
+    assert!(!b.shown("New"), "a click outside");
+    assert!(b.take().is_empty());
+}
+
+#[test]
+fn press_drag_release_runs_an_item() {
+    let mut b = wide();
+    let file = b.rect("File").center();
+    b.move_to(file);
+    b.button(true);
+    b.run(3);
+    assert!(b.shown("Open…"), "the press opens the menu");
+    // Down out of the bar first, then across: crossing the Edit title would open Edit.
+    let open = b.rect("Open…").center();
+    let below = pos2(file.x, open.y);
+    for k in 1..=6 {
+        b.move_to(file + (below - file) * (k as f32 / 6.0));
+    }
+    b.move_to(open);
+    b.button(false);
+    b.run(2);
+    assert_eq!(b.take(), vec![CommandRef::new("file.open")]);
+}
+
+#[test]
+fn disabled_and_gate_forbidden_items_return_nothing() {
+    let mut b = wide();
+    b.click("File");
+    b.click("Locked");
+    assert!(b.take().is_empty(), "a disabled item");
+    assert!(b.node("Locked").is_some_and(|n| n.is_disabled()));
+    assert!(b.node("Nothing Here").is_some_and(|n| n.is_disabled()), "a submenu of disabled items is disabled");
+
+    b.key(Key::Escape);
+    b.gate = Gate { modal: true, ..Gate::default() };
+    b.click("File");
+    assert!(b.node("New").is_some_and(|n| n.is_disabled()), "a modal dialog disables the app's items");
+    b.click("New");
+    assert!(b.take().is_empty(), "and they don't run");
+    b.click("Quit");
+    assert!(b.take().is_empty(), "the bar runs the built-in Quit itself");
+    assert!(b.sent.contains(&egui::ViewportCommand::Close), "and it still runs: the window is asked to close");
+
+    b.gate = Gate { text_editing: true, ..Gate::default() };
+    b.click("File");
+    b.click("New");
+    assert_eq!(b.take(), vec![CommandRef::new("file.new")], "a text field having the keys doesn't stop a click");
+}
+
+#[test]
+fn hovering_another_title_switches_menus_only_while_one_is_open() {
+    let mut b = wide();
+    b.hover("Edit");
+    assert!(!b.shown("Undo"), "hover alone opens nothing");
+    b.click("File");
+    b.hover("Edit");
+    assert!(b.shown("Undo") && !b.shown("New"), "hover switches to Edit");
+    b.hover("View");
+    assert!(b.shown("Grid") && !b.shown("Undo"));
+}
+
+#[test]
+fn submenus_open_on_hover() {
+    let mut b = wide();
+    b.click("File");
+    assert!(!b.shown("a.txt"));
+    b.hover("Open Recent");
+    b.run(3);
+    assert!(b.shown("a.txt"), "hovering a submenu row opens it");
+    assert_eq!(b.node("Open Recent").and_then(|n| n.is_expanded()), Some(true));
+    b.click("b.txt");
+    assert_eq!(b.take(), vec![CommandRef::new("file.recent.b")]);
+}
+
+#[test]
+fn the_arrow_keys_move_open_submenus_and_enter_runs_an_item() {
+    let mut b = wide();
+    b.click("File");
+    b.key(Key::ArrowDown);
+    assert_eq!(b.nav().highlighted(0), Some(0), "↓ lights the first row");
+    b.key(Key::ArrowDown);
+    b.key(Key::ArrowDown);
+    let nav = b.nav();
+    let row = nav.highlighted(0).and_then(|i| nav.rows[0].get(i)).cloned().unwrap();
+    assert!(row.command.is_none(), "↓ skips the separator to Open Recent");
+    b.key(Key::ArrowRight);
+    let nav = b.nav();
+    assert_eq!(nav.level, 1, "→ moves into the submenu");
+    assert_eq!(nav.highlighted(1), Some(0), "on its first row");
+    assert!(b.shown("a.txt"));
+    b.key(Key::ArrowLeft);
+    let nav = b.nav();
+    assert_eq!((nav.level, nav.rows.len()), (0, 1), "← closes the submenu");
+    // ↓ past the disabled submenu and item, then wrapping to the first row.
+    b.key(Key::ArrowDown);
+    let nav = b.nav();
+    assert_eq!(nav.highlighted(0).and_then(|i| nav.rows[0][i].command.clone()), Some(Builtin::Quit.command()), "disabled rows are skipped");
+    b.key(Key::ArrowDown);
+    assert_eq!(b.nav().highlighted(0), Some(0), "↓ wraps");
+    b.key(Key::Enter);
+    assert_eq!(b.take(), vec![CommandRef::new("file.new")]);
+    assert!(!is_open(&b.ctx), "↩ closes the menu");
+
+    b.click("Edit");
+    b.key(Key::ArrowUp);
+    b.key(Key::Space);
+    assert_eq!(b.take(), vec![CommandRef::new("edit.redo")], "↑ from nothing lights the last row; Space runs it");
+}
+
+#[test]
+fn left_and_right_switch_menus() {
+    let mut b = wide();
+    b.click("File");
+    b.key(Key::ArrowRight);
+    assert!(b.shown("Undo") && !b.shown("New"), "→ on a plain row opens the next menu");
+    b.key(Key::ArrowLeft);
+    assert!(b.shown("New"), "← back to File");
+    b.key(Key::ArrowLeft);
+    assert!(b.shown("About"), "← from the first menu wraps to the last");
+    b.key(Key::Escape);
+    assert!(!is_open(&b.ctx));
+}
+
+#[test]
+fn a_gate_forbidden_item_doesnt_run_from_the_keys() {
+    let mut b = wide();
+    b.gate = Gate { recording_shortcut: true, ..Gate::default() };
+    b.click("Edit");
+    b.key(Key::ArrowDown);
+    b.key(Key::Enter);
+    assert!(b.take().is_empty());
+    assert_eq!(b.nav().highlighted(0), None, "no enabled row to light");
+}
+
+#[test]
+fn titles_that_dont_fit_move_into_the_overflow_menu() {
+    let file_and_edit = {
+        let b = wide();
+        b.rect("Edit").right() - b.rect("File").left()
+    };
+    let mut b = Bar::new(sample(), vec2(file_and_edit + 30.0, 400.0));
+    assert!(b.title("File").is_some() && b.title("Edit").is_some());
+    assert!(b.title("Help").is_none() && b.title("⋯").is_some(), "Help moved into ⋯");
+    b.click("⋯");
+    assert!(b.shown("View") && b.shown("Help"), "⋯ lists the menus that don't fit");
+    b.hover("Help");
+    b.run(3);
+    b.click("About");
+    assert_eq!(b.take(), vec![CommandRef::new("help.about")]);
+
+    let b = Bar::new(sample(), vec2(20.0, 400.0));
+    assert!(b.title("File").is_none() && b.title("⋯").is_none());
+    assert!(b.title("Menu").is_some(), "one Menu holds all when none fits");
+}
+
+#[test]
+fn the_overflow_labels_come_from_the_label_hook() {
+    let ctx = egui::Context::default();
+    ctx.enable_accesskit();
+    let bar = sample();
+    let label = |english: &'static str| if english == "Menu" { "Menü".to_owned() } else { english.to_owned() };
+    let mut tree = Vec::new();
+    for _ in 0..2 {
+        let raw = egui::RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(20.0, 300.0))), ..Default::default() };
+        let mut out = ctx.run_ui(raw, |ui| {
+            MenuBarUi::new(&bar).label(&label).show(ui);
+        });
+        out.textures_delta.clear();
+        tree = out.platform_output.accesskit_update.map(|u| u.nodes).unwrap_or_default();
+    }
+    assert!(tree.iter().any(|(_, n)| n.label() == Some("Menü")));
+}
+
+#[test]
+fn accesskit_sees_a_menu_bar_of_menus_with_checked_states_and_shortcuts() {
+    let mut b = wide();
+    assert!(b.tree.iter().any(|(_, n)| n.role() == Role::MenuBar), "the bar");
+    let file = b.title("File").expect("File is a title in the bar");
+    assert_eq!(file.role(), Role::MenuItem);
+    assert_eq!(file.is_expanded(), Some(false));
+    b.click("View");
+    assert_eq!(b.title("View").and_then(|n| n.is_expanded()), Some(true));
+    assert!(b.tree.iter().any(|(_, n)| n.role() == Role::Menu), "the open menu");
+    let state = |label: &str| b.node(label).map(|n| (n.role(), n.toggled()));
+    assert_eq!(state("Grid"), Some((Role::MenuItemCheckBox, Some(Toggled::True))));
+    assert_eq!(state("Rulers"), Some((Role::MenuItemCheckBox, Some(Toggled::False))));
+    assert_eq!(state("Light"), Some((Role::MenuItemRadio, Some(Toggled::True))));
+    assert_eq!(state("Dark"), Some((Role::MenuItemRadio, Some(Toggled::False))));
+    assert_eq!(b.node("Grid").and_then(|n| n.keyboard_shortcut()), Some("G"), "a display-only shortcut too");
+    b.hover("File");
+    assert_eq!(b.node("New").map(|n| (n.role(), n.keyboard_shortcut())), Some((Role::MenuItem, Some("Ctrl+N"))));
+}
+
+/// In a browser the names are those of the system it runs on, and on a Mac there are no
+/// mnemonics: Option types there.
+#[test]
+fn the_web_shows_the_browsers_system_names_and_the_mac_its_glyphs() {
+    use egui::os::OperatingSystem as Os;
+    for (target, os, text, mnemonic) in [
+        (Target::Web, Os::Nix, "Ctrl+N", true),
+        (Target::Web, Os::Mac, "⌘N", false),
+        (Target::Windows, Os::Nix, "Ctrl+N", true),
+        (Target::Mac, Os::Nix, "⌘N", false),
+    ] {
+        let mut b = wide();
+        b.ctx.set_os(os);
+        b.target = target;
+        b.click("File");
+        let new = b.node("New");
+        assert_eq!(new.and_then(|n| n.keyboard_shortcut()), Some(text), "{target:?} on {os:?}");
+        assert_eq!(new.and_then(|n| n.access_key()).is_some(), mnemonic, "{target:?} on {os:?}");
+    }
+}
+
+/// `shrink_to_fit` leaves the rest of the row to other controls; past its limit the menus
+/// overflow into "⋯".
+#[test]
+fn a_bar_shrunk_to_fit_shares_its_row() {
+    let mut b = wide();
+    b.fit = Some(f32::INFINITY);
+    b.run(2);
+    let after = b.after.expect("the label after the bar");
+    assert!(after < b.size.x / 2.0, "the bar takes only its titles' width: {after}");
+    assert!(b.title("Help").is_some() && b.title("⋯").is_none());
+    b.fit = Some(100.0);
+    b.run(2);
+    assert!(b.title("⋯").is_some(), "the menus past 100 points overflow");
+    // The bar's 100 points and the row's item spacing (8).
+    assert!(b.after.is_some_and(|x| x <= 109.0), "{:?}", b.after);
+    // A limit an app computed from a full row can go negative.
+    b.fit = Some(-20.0);
+    b.run(2);
+}
+
+/// A menu far taller than the window.
+fn tall() -> Bar {
+    let rows = (0..60).map(|i| item(&format!("cmd.{i}"), &format!("Item {i}")).into()).collect();
+    Bar::new(MenuBar { menus: vec![Menu::new("Long", rows)], documents: Vec::new() }, vec2(600.0, 300.0))
+}
+
+fn open_tall() -> Bar {
+    let mut b = tall();
+    b.click("Long");
+    b.run(3);
+    assert_eq!(b.nav().rows[0].len(), 60);
+    b
+}
+
+#[test]
+fn a_tall_menu_stays_in_the_window_below_the_bar_and_shows_scroll_arrows() {
+    let b = open_tall();
+    let nav = b.nav();
+    let screen = b.ctx.content_rect();
+    assert!(!b.visible(0, 59), "the menu must overflow for this test to mean anything");
+    assert!(nav.views[0].bottom() <= screen.bottom() && nav.views[0].top() >= b.rect("Long").bottom());
+    assert!(b.shown("Scroll menu down") && b.shown("Scroll menu up"));
+}
+
+#[test]
+fn every_row_of_a_tall_menu_is_reachable_with_the_arrow_keys() {
+    let mut b = open_tall();
+    for i in 0..60 {
+        b.key(Key::ArrowDown);
+        // The scroll lands a frame after the row is revealed.
+        b.run(2);
+        assert_eq!(b.nav().highlighted(0), Some(i));
+        assert!(b.visible(0, i), "row {i} is scrolled into view: {:?} in {:?}", b.nav().rows[0][i].rect, b.nav().views[0]);
+    }
+    b.key(Key::ArrowDown);
+    b.run(2);
+    assert_eq!(b.nav().highlighted(0), Some(0));
+    assert!(b.visible(0, 0), "↓ wraps to the first row, scrolling back up");
+}
+
+#[test]
+fn the_wheel_scrolls_a_tall_menu() {
+    let mut b = open_tall();
+    let view = b.nav().views[0];
+    b.move_to(view.center());
+    for _ in 0..60 {
+        if b.visible(0, 59) {
+            break;
+        }
+        b.events.push(Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Point,
+            delta: vec2(0.0, -60.0),
+            modifiers: Modifiers::NONE,
+            phase: egui::TouchPhase::Move,
+            source: egui::MouseWheelSource::Unknown,
+        });
+        b.run(2);
+    }
+    assert!(b.visible(0, 59), "the wheel reaches the last row");
+    assert_eq!(b.nav().rows[0].len(), 60, "the menu stays open while scrolling");
+}
+
+#[test]
+fn resting_on_the_scroll_arrows_scrolls() {
+    let mut b = open_tall();
+    let view = b.nav().views[0];
+    b.move_to(pos2(view.center().x, view.bottom() + ARROW / 2.0));
+    for _ in 0..240 {
+        if b.visible(0, 59) {
+            break;
+        }
+        b.frame();
+    }
+    assert!(b.visible(0, 59), "resting on ▼ scrolls to the end");
+    let view = b.nav().views[0];
+    b.move_to(pos2(view.center().x, view.top() - ARROW / 2.0));
+    for _ in 0..240 {
+        if b.visible(0, 0) {
+            break;
+        }
+        b.frame();
+    }
+    assert!(b.visible(0, 0), "resting on ▲ scrolls back to the top");
+}
+
+/// A menu with two submenus one above the other, as Image › Mode and Image › Adjustments.
+fn two_submenus() -> Bar {
+    let sub = |name: &str, n: usize| Node::submenu(name, (0..n).map(|i| item(&format!("{name}.{i}"), &format!("{name} {i}")).into()).collect());
+    let menu = Menu::new("Image", vec![sub("Mode", 8), sub("Adjust", 8)]);
+    let mut b = Bar::new(MenuBar { menus: vec![menu], documents: Vec::new() }, vec2(800.0, 600.0));
+    b.dt = 1.0 / 120.0;
+    b
+}
+
+/// Open Image › Mode with the pointer resting on it; returns where the pointer is, the Adjust
+/// row below it, and the row low in Mode's submenu the pointer heads for.
+fn rest_on_mode(b: &mut Bar) -> (Pos2, Rect, Rect) {
+    b.click("Image");
+    let mode = b.rect("Mode");
+    let from = pos2(mode.right() - 40.0, mode.center().y);
+    for k in 0..=12 {
+        b.move_to(from - vec2(30.0 * (1.0 - k as f32 / 12.0), 0.0));
+    }
+    b.run(30);
+    assert_eq!(open_submenu(b), "Mode", "resting on Mode opens it");
+    (from, b.rect("Adjust"), b.rect("Mode 6"))
+}
+
+fn open_submenu(b: &Bar) -> &'static str {
+    match (b.shown("Mode 0"), b.shown("Adjust 0")) {
+        (true, false) => "Mode",
+        (false, true) => "Adjust",
+        (false, false) => "none",
+        (true, true) => "both",
+    }
+}
+
+/// Move the pointer along `path` (0…1) in `frames` frames; `pause` holds it still for that many
+/// frames at that fraction of the way.
+fn glide(b: &mut Bar, frames: usize, pause: Option<(f32, usize)>, mut path: impl FnMut(f32) -> Pos2) {
+    let mut paused = false;
+    for k in 0..=frames {
+        let t = k as f32 / frames as f32;
+        b.move_to(path(t));
+        if let Some((_, n)) = pause.filter(|(at, _)| !paused && t >= *at) {
+            paused = true;
+            b.run(n);
+        }
+    }
+}
+
+/// A person's path from `a` to `b`: it bows, down first and then across, by `bow`.
+fn bowed(a: Pos2, b: Pos2, bow: f32) -> impl Fn(f32) -> Pos2 {
+    let c = pos2(a.x + (b.x - a.x) * (0.5 - bow), a.y + (b.y - a.y) * (0.5 + bow));
+    move |t| {
+        let u = 1.0 - t;
+        pos2(u * u * a.x + 2.0 * u * t * c.x + t * t * b.x, u * u * a.y + 2.0 * u * t * c.y + t * t * b.y)
+    }
+}
+
+/// Heading from Mode for a row low in its submenu, the pointer crosses the Adjust row. On a
+/// diagonal, a bowed path or with a short pause on the way, Mode's submenu stays open, Adjust's
+/// doesn't open, and the crossed row isn't highlighted.
+#[test]
+fn a_submenu_stays_open_while_the_pointer_heads_for_it() {
+    let paths = [("straight", 36, None, 0.0), ("hesitate", 36, Some((0.3, 18)), 0.0), ("bowed", 42, None, 0.2), ("slow and bowed", 96, None, 0.2)];
+    let mut wrong = Vec::new();
+    for (name, frames, pause, bow) in paths {
+        let mut b = two_submenus();
+        let (from, adjust, target) = rest_on_mode(&mut b);
+        let to = pos2(target.left() + 40.0, target.center().y);
+        let path = bowed(from, to, bow);
+        let mut crossed = false;
+        glide(&mut b, frames, pause, |t| {
+            let p = path(t);
+            crossed |= adjust.contains(p);
+            p
+        });
+        assert!(crossed, "{name}: the path crosses the Adjust row");
+        let open = open_submenu(&b);
+        if open != "Mode" {
+            wrong.push(format!("{name}: arrived with {open} open, not Mode"));
+        }
+        if let Some(row) = b.nav().highlighted(0).filter(|&row| row != 0) {
+            wrong.push(format!("{name}: row {row} is highlighted, not Mode"));
+        }
+    }
+    assert!(wrong.is_empty(), "{wrong:#?}");
+}
+
+/// Resting on the row crossed, or moving away from the submenu onto it, still opens its submenu,
+/// and the highlight moves to it.
+#[test]
+fn resting_on_another_row_or_moving_away_switches_submenus() {
+    let mut b = two_submenus();
+    let (from, adjust, _) = rest_on_mode(&mut b);
+    let stop = pos2(from.x + 15.0, adjust.center().y);
+    glide(&mut b, 12, None, |t| from + (stop - from) * t);
+    assert_eq!(open_submenu(&b), "Mode", "just arrived on Adjust, still heading for Mode's submenu");
+    b.run(48);
+    assert_eq!(open_submenu(&b), "Adjust", "resting on Adjust opens it");
+    assert_eq!(b.nav().highlighted(0), Some(1));
+
+    for dx in [0.0, -60.0] {
+        let mut b = two_submenus();
+        let (from, adjust, _) = rest_on_mode(&mut b);
+        let to = pos2(from.x + dx, adjust.center().y);
+        glide(&mut b, 10, None, |t| from + (to - from) * t);
+        b.run(30);
+        assert_eq!(open_submenu(&b), "Adjust", "moving away ({dx}) from Mode's submenu opens Adjust's");
+        assert_eq!(b.nav().highlighted(0), Some(1));
+    }
+}
+
+#[test]
+fn heading_is_the_triangle_to_the_submenus_near_edge() {
+    let sub = Rect::from_min_max(pos2(200.0, 100.0), pos2(400.0, 400.0));
+    let from = pos2(150.0, 110.0);
+    assert!(heading(from, from, sub));
+    assert!(heading(from, pos2(170.0, 160.0), sub), "down and right, toward the submenu");
+    assert!(heading(from, pos2(190.0, 105.0), sub), "straight across");
+    assert!(!heading(from, pos2(150.0, 160.0), sub), "straight down");
+    assert!(!heading(from, pos2(120.0, 140.0), sub), "away to the left");
+    assert!(!heading(from, pos2(170.0, 60.0), sub), "up past the submenu's top");
+    // A submenu that opened to the left.
+    let left = Rect::from_min_max(pos2(0.0, 100.0), pos2(100.0, 400.0));
+    assert!(heading(pos2(150.0, 110.0), pos2(130.0, 160.0), left));
+    assert!(!heading(pos2(150.0, 110.0), pos2(170.0, 160.0), left));
+    assert!(!heading(from, from, Rect::NOTHING));
+}
diff --git a/crates/menu/src/tests/bar_keys.rs b/crates/menu/src/tests/bar_keys.rs
new file mode 100644
index 00000000..9b463aef
--- /dev/null
+++ b/crates/menu/src/tests/bar_keys.rs
@@ -0,0 +1,362 @@
+//! The bar from the keyboard: Alt and F10 focus it, Alt+letter opens a menu, letters run rows,
+//! mnemonics are assigned per level (with "(F)" for letterless labels) and underlined only when
+//! the keyboard drives the bar.
+
+use egui::{Event, Key, Modifiers, PointerButton, pos2};
+
+use super::*;
+use crate::bar::keys::{Keys, assign, is_command_key, key_char, localized};
+use crate::bar::{Labeled, is_focused, leave_for_shortcut};
+
+impl Bar {
+    fn keys(&self) -> Keys {
+        Keys::current(&self.ctx, Id::unique("craft-menu-bar").with("keys"))
+    }
+
+    fn focus(&self) -> Option<usize> {
+        self.keys().focus
+    }
+
+    fn alt(&mut self, pressed: bool) {
+        let modifiers = if pressed { Modifiers::ALT } else { Modifiers::NONE };
+        self.events.push(Event::Key { key: Key::AltLeft, physical_key: None, pressed, repeat: false, modifiers });
+        self.run(2);
+    }
+
+    /// A tap on Alt: down, then up with nothing else pressed between.
+    fn alt_tap(&mut self) {
+        self.alt(true);
+        self.alt(false);
+        self.run(1);
+    }
+
+    /// `key` pressed and released with Alt held.
+    fn alt_key(&mut self, key: Key) {
+        for pressed in [true, false] {
+            self.events.push(Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::ALT });
+        }
+        self.run(3);
+    }
+
+    /// A letter typed: its key and the text it types.
+    fn letter(&mut self, c: char) {
+        let key = Key::from_name(&c.to_ascii_uppercase().to_string()).unwrap();
+        self.events.push(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+        self.events.push(Event::Text(c.to_ascii_lowercase().to_string()));
+        self.events.push(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
+        self.run(3);
+    }
+
+    fn mnemonic(&self, level: usize, command: &str) -> Option<char> {
+        self.nav().rows.get(level)?.iter().find(|r| r.command.as_ref().is_some_and(|c| c.id == command))?.mnemonic
+    }
+}
+
+fn chars(s: &str) -> Vec<Option<char>> {
+    s.chars().map(Some).collect()
+}
+
+#[test]
+fn mnemonics_are_unique_word_starts_first_and_take_preferred_letters() {
+    let labels = ["File", "Edit", "Image", "Layer", "Type", "Select", "Filter", "View", "Window", "Help"];
+    assert_eq!(assign(&labels, &[]), chars("FEILTSRVWH"), "first letters, then the next free one");
+    let preferred = chars("FEILYSTVWH");
+    assert_eq!(assign(&labels, &preferred), chars("FEILYSTVWH"), "the app's letters where the labels have them");
+    // Items: first letters first, then the next free letter of the word starts, then any.
+    assert_eq!(assign(&["New…", "Open…", "Open Recent", "Close", "Close All", "Save", "Save As…"], &[]), chars("NORCASV"));
+    // A preferred letter the label lacks (a translation) falls back; a taken one too.
+    assert_eq!(assign(&["Datei", "Bearbeiten"], &[Some('F'), Some('E')]), [Some('D'), Some('E')]);
+    assert_eq!(assign(&["Aa", "Ab", "Ba"], &[Some('A'), Some('A'), Some('A')]), [Some('A'), Some('B'), None]);
+    // Only ASCII letters and digits are keys: no mnemonic without one.
+    assert_eq!(assign(&["ファイル", "Zoom 100%", "✔ Rulers"], &[]), [None, Some('Z'), Some('R')]);
+}
+
+#[test]
+fn key_chars_are_plain_letters_and_digits_and_command_keys_leave_the_bar() {
+    assert_eq!(key_char(Key::A), Some('A'));
+    assert_eq!(key_char(Key::Num7), Some('7'));
+    assert_eq!(key_char(Key::F10), None);
+    assert_eq!(key_char(Key::ArrowDown), None);
+    assert_eq!(key_char(Key::Space), None);
+    assert!(is_command_key(Key::D, Modifiers::COMMAND));
+    assert!(is_command_key(Key::F7, Modifiers::NONE));
+    assert!(!is_command_key(Key::F10, Modifiers::NONE), "F10 toggles the bar");
+    assert!(!is_command_key(Key::ControlLeft, Modifiers::CTRL), "Ctrl going down is no shortcut yet");
+    assert!(!is_command_key(Key::E, Modifiers::NONE), "a letter is a mnemonic");
+    assert!(!is_command_key(Key::E, Modifiers::ALT), "Alt+letter opens a menu");
+    assert!(!is_command_key(Key::Enter, Modifiers::NONE));
+}
+
+/// A label with no Latin letter (Chinese, Japanese…) shows its English label's letter in
+/// parentheses, before a trailing ellipsis, and takes it as its mnemonic; the letters stay unique.
+#[test]
+fn labels_without_latin_letters_show_their_english_key() {
+    let en = |v: &[&str]| v.iter().map(|s| Some((*s).to_owned())).collect::<Vec<_>>();
+    let (shown, keys) = localized(&["文件", "编辑", "Image", "图层"], &en(&["File", "Edit", "Image", "Layer"]), &[]);
+    assert_eq!(shown, ["文件(F)", "编辑(E)", "Image", "图层(L)"]);
+    assert_eq!(keys, chars("FEIL"));
+    // Rows: the key goes before the ellipsis; a clash takes the next letter of the shown label.
+    let (shown, keys) = localized(&["新建…", "打开...", "关闭"], &en(&["New…", "Open...", "Close"]), &[]);
+    assert_eq!(shown, ["新建(N)…", "打开(O)...", "关闭(C)"]);
+    assert_eq!(keys, chars("NOC"));
+    let (shown, keys) = localized(&["关闭", "复制"], &en(&["Close", "Copy"]), &[]);
+    assert_eq!(shown, ["关闭(C)", "复制(O)"]);
+    assert_eq!(keys, chars("CO"));
+    // A shown "(C)" keeps its key even when a label with letters of its own comes first.
+    let (shown, keys) = localized(&["Copy", "关闭"], &en(&["Open", "Close"]), &[]);
+    assert_eq!(shown, ["Copy", "关闭(C)"]);
+    assert_eq!(keys, chars("OC"));
+    // Without an English label, no suffix and no key.
+    let (shown, keys) = localized(&["文件", "Edit"], &[None, None], &[]);
+    assert_eq!(shown, ["文件", "Edit"]);
+    assert_eq!(keys, [None, Some('E')]);
+    // An English UI is unchanged.
+    assert_eq!(localized(&["File", "Edit"], &en(&["File", "Edit"]), &[]).0, ["File", "Edit"]);
+}
+
+#[test]
+fn alt_focuses_the_bar_arrows_move_and_down_opens_the_lit_menu() {
+    let mut b = wide();
+    b.alt_tap();
+    assert_eq!(b.focus(), Some(0), "Alt puts the keyboard on File");
+    assert!(is_focused(&b.ctx) && !is_open(&b.ctx), "the shortcuts wait for the bar; no menu opens yet");
+    b.key(Key::ArrowRight);
+    assert_eq!(b.focus(), Some(1), "→ moves to Edit");
+    b.key(Key::ArrowLeft);
+    b.key(Key::ArrowLeft);
+    assert_eq!(b.focus(), Some(3), "← wraps round to Help");
+    b.key(Key::ArrowRight);
+    b.key(Key::ArrowRight);
+    b.key(Key::ArrowDown);
+    assert!(is_open(&b.ctx) && b.shown("Undo"), "↓ opens the lit menu, Edit");
+    assert_eq!(b.focus(), None, "the focus moves into the menu");
+    assert_eq!(b.nav().highlighted(0), Some(0), "its first row is lit, as on Windows");
+    assert!(b.nav().underline, "a menu opened from the keyboard shows its mnemonics");
+    b.key(Key::Escape);
+    assert!(!is_open(&b.ctx) && b.focus().is_none(), "Esc leaves the menu and the bar");
+    assert!(!b.nav().underline && !b.keys().show_underlines(&b.ctx), "and the underlines go");
+}
+
+#[test]
+fn a_second_alt_esc_or_a_click_takes_the_keyboard_off_the_bar_and_f10_focuses_it() {
+    let mut b = wide();
+    b.alt_tap();
+    b.alt_tap();
+    assert_eq!(b.focus(), None, "a second tap leaves");
+    b.key(Key::F10);
+    assert_eq!(b.focus(), Some(0), "F10 focuses the bar too");
+    b.key(Key::Escape);
+    assert!(b.focus().is_none() && !is_focused(&b.ctx));
+    b.key(Key::F10);
+    b.click_at(pos2(600.0, 300.0));
+    assert_eq!(b.focus(), None, "a click anywhere leaves");
+}
+
+/// Alt+wheel zooms in many apps, and Alt that went to the desktop (Alt+Tab) is no tap either.
+#[test]
+fn alt_with_a_wheel_scroll_a_lost_focus_or_a_drag_is_no_tap() {
+    let mut b = wide();
+    b.alt(true);
+    b.events.push(Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Line,
+        delta: vec2(0.0, -1.0),
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Unknown,
+        modifiers: Modifiers::ALT,
+    });
+    b.run(2);
+    b.alt(false);
+    assert_eq!(b.focus(), None, "Alt+scroll");
+    b.alt(true);
+    b.events.push(Event::WindowFocused(false));
+    b.events.push(Event::WindowFocused(true));
+    b.run(1);
+    b.alt(false);
+    assert_eq!(b.focus(), None, "Alt+Tab");
+    // Alt pressed during a drag is a modifier for the drag, with the button let go before or after.
+    b.move_to(pos2(600.0, 300.0));
+    for button_up_first in [true, false] {
+        b.button(true);
+        b.alt(true);
+        if button_up_first {
+            b.button(false);
+            b.alt(false);
+        } else {
+            b.alt(false);
+            b.button(false);
+        }
+        assert_eq!(b.focus(), None, "a drag, button up first: {button_up_first}");
+    }
+    // The whole gesture within one frame: press, Alt down, Alt up, release.
+    let (at, alt, none) = (b.pointer, Modifiers::ALT, Modifiers::NONE);
+    b.events.push(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: true, modifiers: none });
+    b.events.push(Event::Key { key: Key::AltLeft, physical_key: None, pressed: true, repeat: false, modifiers: alt });
+    b.events.push(Event::Key { key: Key::AltLeft, physical_key: None, pressed: false, repeat: false, modifiers: none });
+    b.events.push(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: false, modifiers: none });
+    b.run(2);
+    assert_eq!(b.focus(), None, "one frame");
+    b.alt_tap();
+    assert_eq!(b.focus(), Some(0), "a lone tap still focuses the bar");
+}
+
+#[test]
+fn alt_with_a_letter_opens_that_menu_and_enter_or_a_letter_opens_one_from_the_bar() {
+    let mut b = wide();
+    b.alt_key(Key::E);
+    assert!(is_open(&b.ctx) && b.shown("Undo"), "Alt+E opens Edit");
+    b.alt_key(Key::F);
+    assert!(b.shown("Open…") && !b.shown("Undo"), "Alt+F switches to File while a menu is open");
+    b.key(Key::Escape);
+    b.key(Key::F10);
+    b.key(Key::Enter);
+    assert!(b.shown("Open…"), "Enter opens the lit File menu");
+    b.key(Key::Escape);
+    b.key(Key::F10);
+    b.letter('v');
+    assert!(is_open(&b.ctx) && b.shown("Grid"), "a letter on the focused bar opens that menu (V = View)");
+    assert!(b.take().is_empty());
+}
+
+#[test]
+fn a_letter_in_an_open_menu_runs_the_row_with_that_mnemonic_or_opens_its_submenu() {
+    let mut b = wide();
+    b.alt_key(Key::V);
+    assert_eq!(b.mnemonic(0, "view.grid"), Some('G'));
+    let letters: Vec<char> = b.nav().rows[0].iter().filter_map(|r| r.mnemonic).collect();
+    let mut unique = letters.clone();
+    unique.sort_unstable();
+    unique.dedup();
+    assert_eq!(letters.len(), unique.len(), "mnemonics are unique within a level: {letters:?}");
+    b.letter('g');
+    assert_eq!(b.take(), vec![CommandRef::new("view.grid")], "G ran Grid");
+    assert!(!is_open(&b.ctx), "and closed the menu");
+    // File: New N, Open… O, Open Recent R; a submenu's letter opens it, with its first row lit.
+    b.alt_key(Key::F);
+    b.letter('r');
+    let nav = b.nav();
+    assert_eq!((nav.level, nav.highlighted(1)), (1, Some(0)), "R opened Open Recent on its first row");
+    assert!(b.shown("a.txt"));
+    b.letter('b');
+    assert_eq!(b.take(), vec![CommandRef::new("file.recent.b")], "B ran b.txt from the submenu");
+    // A disabled row's letter does nothing.
+    b.alt_key(Key::F);
+    assert_eq!(b.mnemonic(0, "file.locked"), Some('L'));
+    b.letter('l');
+    assert!(b.take().is_empty() && is_open(&b.ctx), "Locked is disabled");
+}
+
+#[test]
+fn mnemonics_are_underlined_only_with_alt_or_a_keyboard_opened_menu() {
+    let mut b = wide();
+    b.click("File");
+    assert!(is_open(&b.ctx));
+    assert!(!b.nav().underline, "a menu opened with the mouse shows no underlines");
+    let underlined = |b: &Bar| {
+        let ctx = b.ctx.clone();
+        // The rows' mnemonics are in AccessKit either way; the drawn text has the underline.
+        b.node("New").and_then(|n| n.access_key().map(str::to_owned)).is_some()
+            && Nav::current(&ctx, Id::unique("craft-menu-bar").with("nav")).underline
+    };
+    assert!(!underlined(&b));
+    b.alt(true);
+    assert!(underlined(&b), "while Alt is held they show");
+    b.alt(false);
+    assert!(!is_open(&b.ctx), "an Alt tap closes an open menu, as on Windows");
+    b.alt_key(Key::F);
+    assert!(is_open(&b.ctx) && underlined(&b), "a menu opened from the keyboard shows them");
+    assert_eq!(b.node("New").and_then(|n| n.access_key()), Some("N"), "AccessKit has the mnemonic");
+    assert_eq!(b.title("File").and_then(|n| n.access_key()), Some("F"));
+}
+
+#[test]
+fn the_app_can_prefer_letters_and_name_english_labels_for_letterless_ones() {
+    let mut b = wide();
+    b.preferred = vec![("View", 'W'), ("file.open", 'P')];
+    b.english = Some(|l: Labeled<'_>| match l {
+        Labeled::Title("帮助") => Some("Help".to_owned()),
+        Labeled::Command(c) if c.id == "file.new" => Some("New".to_owned()),
+        _ => None,
+    });
+    b.bar.menus[3].title = "帮助".to_owned();
+    b.bar.menus[0].children[0] = item("file.new", "新建…").into();
+    b.run(2);
+    assert!(b.title("帮助(H)").is_some(), "a letterless title shows its English key");
+    b.alt_key(Key::W);
+    assert!(b.shown("Grid"), "View took the app's W");
+    b.alt_key(Key::H);
+    assert!(b.shown("About"), "Alt+H opens 帮助(H)");
+    b.alt_key(Key::F);
+    assert!(b.shown("新建(N)…"), "the key goes before the ellipsis");
+    assert_eq!(b.mnemonic(0, "file.open"), Some('P'));
+    b.letter('n');
+    assert_eq!(b.take(), vec![CommandRef::new("file.new")]);
+}
+
+#[test]
+fn a_dialog_or_a_text_field_keeps_its_keys() {
+    let mut b = wide();
+    b.gate = Gate { modal: true, ..Gate::default() };
+    b.alt_tap();
+    assert_eq!(b.focus(), None, "a dialog keeps Enter and Esc: Alt doesn't take the keyboard");
+    b.alt_key(Key::F);
+    assert!(!is_open(&b.ctx), "nor does Alt+F");
+    b.click("File");
+    b.letter('n');
+    assert!(b.take().is_empty() && is_open(&b.ctx), "a gate-forbidden item's letter doesn't run it");
+    b.key(Key::Escape);
+
+    b.gate = Gate { text_editing: true, ..Gate::default() };
+    b.alt_tap();
+    assert_eq!(b.focus(), Some(0), "a tap on Alt still focuses the bar from a text field");
+    b.letter('e');
+    assert!(!is_open(&b.ctx) && b.focus().is_none(), "a letter goes on to the field and leaves the bar");
+    b.alt_key(Key::E);
+    assert!(b.shown("Undo"), "Alt+E opens Edit");
+    b.letter('u');
+    assert_eq!(b.take(), vec![CommandRef::new("edit.undo")], "with a menu open the letters are its");
+}
+
+#[test]
+fn a_command_shortcut_takes_the_keyboard_off_the_bar() {
+    let mut b = wide();
+    b.alt_tap();
+    assert!(is_focused(&b.ctx));
+    b.events.push(Event::Key { key: Key::S, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::COMMAND });
+    let mut left = false;
+    b.time += b.dt;
+    let raw = egui::RawInput {
+        screen_rect: Some(Rect::from_min_size(Pos2::ZERO, b.size)),
+        time: Some(b.time),
+        events: std::mem::take(&mut b.events),
+        ..Default::default()
+    };
+    let bar = &b.bar;
+    let mut out = b.ctx.run_ui(raw, |ui| {
+        left = leave_for_shortcut(ui.ctx());
+        MenuBarUi::new(bar).target(Target::Linux).show(ui);
+    });
+    out.textures_delta.clear();
+    assert!(left && !is_focused(&b.ctx), "Ctrl+S leaves the bar for the app's shortcut");
+    b.run(2);
+    assert_eq!(b.focus(), None);
+    assert!(!is_open(&b.ctx));
+}
+
+#[test]
+fn a_mac_target_has_no_mnemonics() {
+    let mut b = wide();
+    b.target = Target::Mac;
+    b.alt_tap();
+    b.key(Key::F10);
+    assert!(b.focus().is_none() && !is_focused(&b.ctx), "Alt and F10 leave the bar alone");
+    b.alt_key(Key::F);
+    assert!(!is_open(&b.ctx), "Option+F is a typing key");
+    b.click("File");
+    b.alt(true);
+    assert!(!b.nav().underline, "Option shows no underlines");
+    assert!(b.nav().rows[0].iter().all(|r| r.mnemonic.is_none()), "the rows have no mnemonics");
+    assert_eq!(b.node("New").and_then(|n| n.access_key()), None);
+    b.alt(false);
+    b.letter('n');
+    assert!(b.take().is_empty(), "letters run nothing");
+}
diff --git a/crates/menu/src/tests/layout.rs b/crates/menu/src/tests/layout.rs
new file mode 100644
index 00000000..d50940fd
--- /dev/null
+++ b/crates/menu/src/tests/layout.rs
@@ -0,0 +1,146 @@
+//! The Windows, Linux and web layouts, platform filtering, and the keymap adapter.
+
+use craft_keymap::{Bindable, Binding, Keymap, Platform, Policy, Scope, Scopes};
+
+use super::*;
+
+fn menu(bar: &MenuBar, role: MenuRole) -> &Menu {
+    bar.menu(role).unwrap()
+}
+
+fn has(bar: &MenuBar, id: &str) -> bool {
+    bar.find(&cmd(id)).is_some()
+}
+
+#[test]
+fn windows_puts_exit_last_in_file_and_documents_in_window() {
+    let l = layout(&sample(false, true), Target::Windows, &LayoutOptions::new("Sample"));
+    assert!(l.clashes.is_empty());
+    assert_eq!(ids(&menu(&l.bar, MenuRole::File).children), ["file.new", "---", "file.close", "---", "file.exit"]);
+    assert_eq!(l.bar.find(&cmd("file.exit")).unwrap().label, "Exit");
+    assert_eq!(ids(&menu(&l.bar, MenuRole::Edit).children), ["edit.undo", "edit.redo", "---", "[Language]", "---", "[Preferences]"]);
+    assert_eq!(ids(&menu(&l.bar, MenuRole::Help).children), ["help.docs", "---", "help.about"]);
+    assert_eq!(l.bar.find(&cmd("help.about")).unwrap().label, "About Sample");
+    assert_eq!(ids(&menu(&l.bar, MenuRole::Window).children), ["[Theme]", "theme.next", "panel.layers", "---", "doc.0"]);
+    assert_eq!(l.bar.find(&cmd("doc.0")).unwrap().kind, ItemKind::Radio(true), "the document in front is selected");
+    assert!(!has(&l.bar, Builtin::Hide.id()) && !has(&l.bar, Builtin::Minimize.id()));
+    assert_eq!(l.bar.menus.len(), 5);
+
+    let mac = mac_layout(&sample(false, true), &LayoutOptions::new("Sample")).bar;
+    assert_eq!(mac.find(&cmd("doc.0")).unwrap().kind, ItemKind::Radio(true));
+}
+
+/// Without the menus the moved items need, the layout adds them, with translated titles.
+#[test]
+fn linux_adds_quit_and_the_menus_it_needs() {
+    let view = vec![
+        Item::new("help.about", "About").role(ItemRole::About).into(),
+        Item::new("app.settings", "Settings").role(ItemRole::Settings).into(),
+        Item::new("view.zoom", "Zoom").into(),
+    ];
+    let mut bar = MenuBar { menus: vec![Menu::new("View", view).role(MenuRole::View)], documents: vec![Document::new("doc.0", "Untitled")] };
+    bar.documents.push(Document { hidden: true, ..Document::new("doc.1", "Background") });
+    let label = |s: &'static str| format!("«{s}»");
+    let l = layout(&bar, Target::Linux, &LayoutOptions { label: &label, ..LayoutOptions::new("Sample") });
+    let titles: Vec<&str> = l.bar.menus.iter().map(|m| m.title.as_str()).collect();
+    assert_eq!(titles, ["«File»", "«Edit»", "View", "«Window»", "«Help»"]);
+    let quit = &menu(&l.bar, MenuRole::File).children;
+    assert_eq!(ids(quit), [Builtin::Quit.id()]);
+    assert_eq!(l.bar.find(&Builtin::Quit.command()).unwrap().label, "«Quit»");
+    assert_eq!(l.bar.find(&cmd("app.settings")).unwrap().label, "«Preferences…»");
+    assert_eq!(l.bar.find(&cmd("help.about")).unwrap().label, "«About Sample»");
+    assert_eq!(ids(&menu(&l.bar, MenuRole::Window).children), ["doc.0"], "a hidden document isn't listed");
+}
+
+#[test]
+fn the_web_has_no_quit_and_gives_the_browser_its_shortcuts() {
+    let mut bar = sample(false, true);
+    let file = bar.menus.iter_mut().find(|m| m.role == MenuRole::File).unwrap();
+    file.children.push(Item::new("file.reopen", "Reopen").shortcut(chord("Cmd+Shift+T")).into());
+    file.children.push(Item::new("file.tab", "Tab").shortcut(chord("Cmd+Alt+T")).into());
+    let l = layout(&bar, Target::Web, &LayoutOptions::new("Sample"));
+    assert!(!has(&l.bar, "file.exit") && !has(&l.bar, Builtin::Quit.id()));
+    let clashes: Vec<(String, &str)> = l.clashes.iter().map(|c| (c.command.key(), c.system)).collect();
+    assert_eq!(clashes, [("file.new".into(), "New Window"), ("file.reopen".into(), "Reopen Closed Tab")]);
+    assert_eq!(l.bar.find(&cmd("file.new")).unwrap().shortcut, None);
+    assert_eq!(l.bar.find(&cmd("file.tab")).unwrap().shortcut, Some(chord("Cmd+Alt+T")));
+    assert_eq!(l.bar.find(&cmd("edit.undo")).unwrap().shortcut, Some(chord("Cmd+Z")));
+}
+
+/// Items and submenus show only on their platforms; a submenu left empty goes, one holding only
+/// the app's disabled placeholder stays.
+#[test]
+fn layouts_keep_only_what_the_target_shows() {
+    let file = vec![
+        Item::new("file.new", "New").into(),
+        Item::new("file.tabs", "Show Tab Bar").platforms(Platforms::MAC).into(),
+        Node::submenu("Export", vec![Item::new("file.export_native", "Native").platforms(Platforms::MAC).into()]),
+        Node::submenu("Open Recent", vec![Item::new("file.no_recent", "No Recent Files").enabled(false).into()]),
+        Node::submenu("Plugins", vec![Item::new("plugin.a", "A").into()]).platforms(Platforms::ALL.without(Platforms::WEB)),
+    ];
+    let bar = MenuBar { menus: vec![Menu::new("File", file).role(MenuRole::File)], documents: Vec::new() };
+    let file_on = |target| {
+        let l = layout(&bar, target, &LayoutOptions::new("Sample"));
+        let file = menu(&l.bar, MenuRole::File).children.iter().take_while(|n| **n != Node::Separator).cloned().collect::<Vec<_>>();
+        ids(&file)
+    };
+    assert_eq!(file_on(Target::Mac), ["file.new", "file.tabs", "[Export]", "[Open Recent]", "[Plugins]"]);
+    assert_eq!(file_on(Target::Linux), ["file.new", "[Open Recent]", "[Plugins]"]);
+    assert_eq!(file_on(Target::Web), ["file.new", "[Open Recent]"]);
+}
+
+fn keymap() -> Keymap {
+    let app = Scope::app();
+    let layers = Scope::new("Layers").unwrap();
+    let catalog = vec![
+        Bindable::new("file.save", "Save", app.clone()).with_default(Binding::new(chord("Cmd+S"))),
+        Bindable::new("view.rulers", "Rulers", app.clone()).toggle().with_default(Binding::new(chord("Cmd+R"))),
+        Bindable::new("view.grid", "Grid", app.clone()).toggle(),
+        Bindable::new("layer.new", "New Layer", layers.clone())
+            .with_default(Binding::in_scope(chord("Cmd+Shift+N"), app.clone()))
+            .with_default(Binding::new(chord("Cmd+L"))),
+        Bindable::new("view.mode", "Mode", app).with_default(Binding::new(chord("M"))),
+    ];
+    Keymap::new(catalog, Scopes::new().with_panel("Layers"), Platform::Linux)
+}
+
+#[test]
+fn the_keymap_gives_shortcuts_and_check_items() {
+    let mut keys = keymap();
+    keys.set_bindings(&cmd("file.save"), vec![Binding::new(chord("Cmd+Alt+S"))], Policy::Steal).unwrap();
+    let view = vec![
+        Item::new("file.save", "Save").shortcut(chord("Cmd+S")).into(),
+        Item::new("view.rulers", "Rulers").into(),
+        Item::new("view.grid", "Grid").check(true).into(),
+        Item::new("layer.new", "New Layer").into(),
+        Item::new("view.mode", "Mode").radio(true).into(),
+        Item::new("view.other", "Other").shortcut(chord("F9")).into(),
+    ];
+    let mut bar = MenuBar { menus: vec![Menu::new("View", view)], documents: Vec::new() };
+    apply_keymap(&mut bar, &keys);
+    let item = |id: &str| bar.find(&cmd(id)).unwrap().clone();
+    assert_eq!(item("file.save").shortcut, Some(chord("Cmd+Alt+S")), "the user's override");
+    assert_eq!((item("view.rulers").shortcut, item("view.rulers").kind), (Some(chord("Cmd+R")), ItemKind::Check(false)));
+    assert_eq!((item("view.grid").shortcut, item("view.grid").kind), (None, ItemKind::Check(true)), "a toggle keeps its state");
+    assert_eq!(item("layer.new").shortcut, Some(chord("Cmd+L")), "the home scope's binding first");
+    assert_eq!(item("view.mode").kind, ItemKind::Radio(true));
+    assert_eq!(item("view.other").shortcut, Some(chord("F9")), "a command the keymap doesn't know keeps its shortcut");
+}
+
+#[test]
+fn the_app_sets_enabled_and_checked_each_frame() {
+    let mut bar = mac_layout(&sample(false, true), &LayoutOptions::new("Sample")).bar;
+    let mut asked = Vec::new();
+    apply_state(&mut bar, |c| {
+        asked.push(c.key());
+        match c.id.as_str() {
+            "edit.undo" => ItemState { enabled: false, checked: None },
+            "panel.layers" => ItemState { checked: Some(true), ..ItemState::default() },
+            _ => ItemState::default(),
+        }
+    });
+    assert!(!bar.find(&cmd("edit.undo")).unwrap().enabled);
+    assert_eq!(bar.find(&cmd("panel.layers")).unwrap().kind, ItemKind::Check(true));
+    assert!(asked.contains(&"file.new".to_string()));
+    assert!(!asked.iter().any(|k| k == Builtin::Hide.id() || k == "doc.0"), "built-ins and documents are left alone: {asked:?}");
+}
diff --git a/crates/menu/src/tests/native.rs b/crates/menu/src/tests/native.rs
new file mode 100644
index 00000000..f067ca77
--- /dev/null
+++ b/crates/menu/src/tests/native.rs
@@ -0,0 +1,230 @@
+//! The driver's side of the native menu: the gate, the command hook, display-only shortcuts and
+//! shortcut recording.
+
+use std::sync::{Arc, Mutex};
+
+use super::*;
+use crate::driver::chosen_event;
+
+fn modal() -> Gate {
+    Gate { modal: true, ..Gate::default() }
+}
+
+fn recording() -> Gate {
+    Gate { recording_shortcut: true, ..Gate::default() }
+}
+
+type Shared<T> = Rc<RefCell<Vec<T>>>;
+
+/// A driver over a fake backend, with what it synced, its pending events and its dispatch.
+fn driver() -> (NativeMenu, Shared<MenuBar>, Shared<Event>, Dispatch) {
+    let fake = Fake::default();
+    let (synced, events, dispatch) = (fake.synced.clone(), fake.events.clone(), fake.dispatch.clone());
+    let menu = NativeMenu::new(Box::new(fake));
+    let dispatch = dispatch.borrow().clone().expect("NativeMenu::new attaches the dispatch");
+    (menu, synced, events, dispatch)
+}
+
+fn take_clicks(menu: &mut NativeMenu) -> Vec<CommandRef> {
+    let ctx = egui::Context::default();
+    let mut clicks = Vec::new();
+    let mut out = ctx.run_ui(egui::RawInput::default(), |ui| clicks = menu.take_clicks(ui.ctx()));
+    out.textures_delta.clear();
+    clicks
+}
+
+/// The gate is checked when the app takes the clicks, not only when the menu was open: a click
+/// that arrived before a modal dialog opened doesn't run behind it. Built-ins still do.
+#[test]
+fn a_click_waiting_when_a_dialog_opens_is_dropped() {
+    let (mut menu, _, events, _) = driver();
+    events.borrow_mut().extend([Event::Click(cmd("file.save")), Event::Click(Builtin::HideOthers.command())]);
+    menu.raw_input(&mut egui::RawInput::default());
+    menu.set_gate(modal());
+    assert_eq!(take_clicks(&mut menu), [Builtin::HideOthers.command()]);
+
+    events.borrow_mut().push(Event::Click(cmd("file.save")));
+    menu.raw_input(&mut egui::RawInput::default());
+    menu.set_gate(Gate::default());
+    assert_eq!(take_clicks(&mut menu), [cmd("file.save")]);
+}
+
+/// While a dialog is open the app's items are greyed and the built-ins aren't. Opening and
+/// closing it re-syncs the last menus in place, without laying them out again.
+#[test]
+fn a_modal_gate_greys_the_apps_items() {
+    let (mut menu, synced, _, _) = driver();
+    let opts = LayoutOptions::new("Sample");
+    let builds = Cell::new(0);
+    let build = || {
+        builds.set(builds.get() + 1);
+        mac_layout(&sample(false, true), &opts)
+    };
+    menu.sync_with(1, build);
+    menu.set_gate(modal());
+    menu.sync_with(1, build);
+    menu.sync_with(1, build);
+    menu.set_gate(Gate::default());
+    menu.sync_with(1, build);
+    assert_eq!((builds.get(), synced.borrow().len()), (1, 3), "one layout; synced open, greyed, open");
+
+    let synced = synced.borrow();
+    let enabled = |bar: &MenuBar, c: &CommandRef| bar.find(c).unwrap().enabled;
+    let greyed = &synced[1];
+    assert!(!enabled(greyed, &cmd("file.new")) && !enabled(greyed, &cmd("help.about")));
+    // AppKit sends a disabled item's key equivalent nowhere: ⌘Z must reach the dialog's fields.
+    assert!(enabled(greyed, &cmd("edit.undo")), "the text-editing keys stay");
+    assert!(enabled(greyed, &Builtin::Hide.command()) && enabled(greyed, &Builtin::HideOthers.command()));
+    assert!(enabled(&synced[2], &cmd("file.new")));
+    assert_eq!(structure_key(greyed), structure_key(&synced[0]), "greying is an update in place");
+
+    assert!(Gate::default().grey(&synced[0]).as_ref() == &synced[0]);
+    assert!(typing(true).grey(&synced[0]).as_ref() == &synced[0], "text editing greys nothing");
+}
+
+/// The hook sees app commands clicked while the gate allows them, as they arrive; key presses and
+/// built-ins don't reach it. `take_clicks` still returns the commands.
+#[test]
+fn on_command_sees_allowed_clicks_only() {
+    let (mut menu, _, events, dispatch) = driver();
+    let seen = Arc::new(Mutex::new(Vec::new()));
+    let log = seen.clone();
+    menu.on_command(Box::new(move |c| {
+        log.lock().unwrap().push(c.clone());
+        false
+    }));
+
+    let save = chord("Cmd+S");
+    let mouse = |c: &CommandRef| dispatch.chosen(c, Some(&save), false, None);
+    events.borrow_mut().push(mouse(&cmd("file.save")));
+    assert_eq!(dispatch.chosen(&cmd("file.save"), Some(&save), false, held([true, false, false, false])), Event::Key(save));
+    mouse(&Builtin::Quit.command());
+    menu.set_gate(modal());
+    mouse(&cmd("file.export"));
+    menu.set_gate(Gate::default());
+    assert_eq!(*seen.lock().unwrap(), [cmd("file.save")]);
+
+    menu.raw_input(&mut egui::RawInput::default());
+    assert_eq!(take_clicks(&mut menu), [cmd("file.save")], "a click the hook didn't run");
+
+    menu.on_command(Box::new(|c| c.id == "file.save"));
+    events.borrow_mut().extend([mouse(&cmd("file.save")), mouse(&cmd("file.export"))]);
+    assert_eq!(events.borrow()[0], Event::Handled(cmd("file.save")));
+    menu.raw_input(&mut egui::RawInput::default());
+    assert_eq!(take_clicks(&mut menu), [cmd("file.export")], "the hook ran file.save");
+}
+
+/// While a text field has the keys, clicking Edit › Copy or Undo acts on the field: the item's
+/// shortcut is tapped (press and release, since a click has no key-up), not the app's command run.
+#[test]
+fn a_click_on_a_text_editing_item_while_typing_taps_its_shortcut() {
+    let (copy, undo, save) = (chord("Cmd+C"), chord("Cmd+Z"), chord("Cmd+S"));
+    assert_eq!(chosen_event(&cmd("edit.copy"), Some(&copy), false, None, typing(true)), Event::Tap(copy));
+    assert_eq!(chosen_event(&cmd("edit.undo"), Some(&undo), false, None, typing(true)), Event::Tap(undo));
+    assert_eq!(chosen_event(&cmd("file.save"), Some(&save), false, None, typing(true)), Event::Click(cmd("file.save")));
+    assert_eq!(chosen_event(&cmd("edit.undo"), Some(&undo), false, None, typing(false)), Event::Click(cmd("edit.undo")));
+
+    let (mut menu, _, events, _) = driver();
+    menu.set_gate(typing(true));
+    events.borrow_mut().extend([Event::Tap(undo), Event::Tap(copy)]);
+    let mut raw = egui::RawInput::default();
+    menu.raw_input(&mut raw);
+    assert_eq!(raw.events, [key_event(&undo, true), key_event(&undo, false), egui::Event::Copy]);
+    assert!(take_clicks(&mut menu).is_empty());
+}
+
+/// `sync` lays nothing out itself: it compares each frame's layout with the last, so a change
+/// without input still reaches the menus, and an unchanged one costs no sync.
+#[test]
+fn sync_compares_each_frames_layout() {
+    let (mut menu, synced, _, _) = driver();
+    let opts = LayoutOptions::new("Sample");
+    let mut bar = sample(false, true);
+    menu.sync(mac_layout(&bar, &opts));
+    menu.sync(mac_layout(&bar, &opts));
+    assert_eq!(synced.borrow().len(), 1, "unchanged: no sync");
+    bar.for_each_item_mut(|it| {
+        if it.command.id == "file.new" {
+            it.enabled = false;
+        }
+    });
+    menu.sync(mac_layout(&bar, &opts));
+    assert_eq!(synced.borrow().len(), 2);
+    assert!(!synced.borrow()[1].find(&cmd("file.new")).unwrap().enabled);
+}
+
+/// An item that was a check item stays one when the app's state stops saying checked
+/// (`checked: None`): unchecked, with the same structure, so the menus aren't rebuilt.
+#[test]
+fn a_check_item_keeps_its_kind() {
+    let (mut menu, synced, _, _) = driver();
+    let opts = LayoutOptions::new("Sample");
+    let with = |checked: Option<bool>| {
+        let mut bar = sample(false, true);
+        apply_state(&mut bar, |c| ItemState { checked: checked.filter(|_| c.id == "file.new"), ..ItemState::default() });
+        mac_layout(&bar, &opts)
+    };
+    menu.sync(with(Some(true)));
+    menu.sync(with(None));
+    let synced = synced.borrow();
+    assert_eq!(synced[1].find(&cmd("file.new")).unwrap().kind, ItemKind::Check(false));
+    assert_eq!(structure_key(&synced[1]), structure_key(&synced[0]));
+}
+
+/// Only shortcuts with ⌘ or ⌃ are key equivalents. A tool key (`B`, `⇧B`, `⌥B`, `F5`) is
+/// display-only: choosing its item with ↩ in the open menu is a click.
+#[test]
+fn only_command_or_control_shortcuts_are_key_equivalents() {
+    use crate::driver::native_ok;
+    for s in ["Cmd+B", "Ctrl+B", "Ctrl+F5", "Alt+Cmd+F12", "Shift+Ctrl+Tab"] {
+        assert!(native_ok(&chord(s)), "{s}");
+    }
+    for s in ["B", "Shift+B", "Alt+B", "Shift+Alt+B", "F5", "Shift+F5", "Escape"] {
+        assert!(!native_ok(&chord(s)), "{s}");
+        let event = chosen_event(&cmd("tool"), Some(&chord(s)), false, held([false; 4]), Gate::default());
+        assert_eq!(event, Event::Click(cmd("tool")), "{s}");
+    }
+}
+
+/// While a shortcut is recorded every key equivalent reaches egui as the key that was pressed,
+/// also those that are clicks otherwise (⌘Q on the app's Quit, Minimize, while typing) and the
+/// clipboard keys.
+#[test]
+fn recording_a_shortcut_passes_key_equivalents_through() {
+    let cmd_held = held([true, false, false, false]);
+    let quit = chord("Cmd+Q");
+    assert_eq!(chosen_event(&cmd("file.exit"), Some(&quit), true, cmd_held, recording()), Event::Key(quit));
+    let min = chord("Ctrl+Cmd+M");
+    assert_eq!(chosen_event(&Builtin::Minimize.command(), Some(&min), false, held([true, true, false, false]), recording()), Event::Key(min));
+    let hide = chord("Cmd+H");
+    assert_eq!(chosen_event(&Builtin::Hide.command(), Some(&hide), true, cmd_held, recording()), Event::Key(hide));
+    let typing_and_recording = Gate { text_editing: true, recording_shortcut: true, ..Gate::default() };
+    assert_eq!(chosen_event(&cmd("file.save"), Some(&chord("Cmd+S")), false, cmd_held, typing_and_recording), Event::Key(chord("Cmd+S")));
+    assert_eq!(chosen_event(&cmd("file.exit"), Some(&quit), true, None, recording()), Event::Click(cmd("file.exit")), "a mouse click");
+
+    let (mut menu, _, events, _) = driver();
+    menu.set_gate(recording());
+    events.borrow_mut().extend([Event::Key(chord("Cmd+C")), Event::Key(chord("Cmd+V"))]);
+    let mut raw = egui::RawInput::default();
+    menu.raw_input(&mut raw);
+    assert_eq!(raw.events, [key_event(&chord("Cmd+C"), true), key_event(&chord("Cmd+V"), true)], "no Copy or Paste events");
+}
+
+/// Dynamic lists (recent files, workspaces) change the tree: adding or removing one rebuilds,
+/// relabelling one updates in place.
+#[test]
+fn dynamic_lists_rebuild_when_they_grow_or_shrink() {
+    let recents = |files: &[&str]| {
+        let items = files
+            .iter()
+            .enumerate()
+            .map(|(i, f)| Item::new(CommandRef::parse_key(&format!(r#"file.open_recent {{"index":{i}}}"#)).unwrap(), *f).into())
+            .collect();
+        let file = Menu::new("File", vec![Node::submenu("Open Recent", items)]).role(MenuRole::File);
+        MenuBar { menus: vec![file], documents: Vec::new() }
+    };
+    let two = structure_key(&recents(&["a.pdf", "b.pdf"]));
+    assert_ne!(structure_key(&recents(&["a.pdf", "b.pdf", "c.pdf"])), two);
+    assert_ne!(structure_key(&recents(&["a.pdf"])), two);
+    assert_eq!(structure_key(&recents(&["b.pdf", "a.pdf"])), two, "same commands, new labels");
+}
diff --git a/crates/pdf/README.md b/crates/pdf/README.md
index f35c5b1b..4a73fdc6 100644
--- a/crates/pdf/README.md
+++ b/crates/pdf/README.md
@@ -56,7 +56,7 @@ Cancellation is polled between operators, so a decoder may finish before noticin
 ## Backend provenance and consumer pins
 
 The shared reader vendors the current patched Hayro trees from PdfCraft revision
-`7437bde378f43856eada40af25b983812e615e8a`. See
+`ec0a965074f376a5bf610435948e4e5184bf3299`. See
 [`vendor/README.craft-reader.md`](../../vendor/README.craft-reader.md) for the transfer and
 local patches. Lopdf, COS editing, inspection fallback and application caches remain app-owned.
 
@@ -103,7 +103,7 @@ that supply shaped glyphs do not need that shaper. Adapters that call `draw_text
 DeckCraft, also need `write-simple-text` when adopting this revision. `write-pdf` adds
 embedded-PDF support independently of text shaping.
 
-The writer pins Krilla 0.8.2, with a local unwind-cleanup patch documented in
+The writer pins Krilla 0.8.2, with local unwind-cleanup, print color and optional content patches documented in
 [`vendor/krilla/README.craft.md`](../../vendor/krilla/README.craft.md). Successful
 serialization uses the same backend version as before extraction. It provides:
 
@@ -119,6 +119,49 @@ serialization uses the same backend version as before extraction. It provides:
   postprocessing. App errors pass through; serialization errors retain backend diagnostics.
   Caught panic messages retain up to 1024 Unicode scalar values; the installed panic hook
   remains responsible for logging source locations and full diagnostics.
+- `write::uri_target`: the Krilla link target for a URI link, or `None` when `safe_url`
+  refuses it. Apps build URI links with it instead of `backend::action::LinkAction`, so a
+  link target from someone else's document becomes a PDF link only when it is an `http`/`https`
+  URL with a host or a `mailto` address. A refused target writes no link annotation.
+- `safe_url` (crate root, any feature): the same rule, for apps that open links themselves,
+  such as a slide show.
+
+### Print color
+
+`write::print::cmyk_blending(profile)` returns `Result<SerializeSettings, WriteError>`
+with the settings for a plain CMYK print PDF: DeviceCMYK color and transparency blending in
+CMYK (`GroupColorSpace::Cmyk`), with no output intent. `write::print::settings` adds the
+document's CMYK profile as a `GTS_PDFX` output intent and `/Trapped /False`, for PDF/X. Both
+fail with `WriteError::InvalidProfile` when the profile is not a readable CMYK ICC profile.
+The profile is the document's working space. craft-pdf takes the profile bytes and does not
+depend on craft-cms. Its CC0 `builtin::COATED_FOGRA39_ICC` is the default working space, described by
+`PrintColor::fogra39`:
+
+```rust
+use craft_pdf::write::print::{self, PrintColor};
+
+let settings = print::settings(PrintColor::fogra39(craft_cms::builtin::COATED_FOGRA39_ICC))?;
+let writer = Writer::new(SerializeSettings { configuration, ..settings }, metadata);
+```
+
+For another profile, fill `PrintColor` with its condition identifier (`Custom` when it is
+not registered) and `info`. The settings claim no PDF/X version and are not checked against
+PDF/X; apps that claim conformance set `pdfx_version` (and `pdfx_conformance` for PDF/X-1a
+and X-3) and keep their own checks. Writing these
+settings needs the patched Krilla (`CRAFT_PRINT_COLOR`, see
+[`vendor/krilla/README.craft.md`](../../vendor/krilla/README.craft.md)).
+
+### Optional content
+
+Drawing layers are written as optional content groups. `Document::add_optional_content_group(name,
+visible)` returns an `OcgId`; `Surface::start_optional_content(id)` and
+`Surface::end_optional_content()` mark the content between them, and nest independently of
+tagged sections. Both return `KrillaError` on misuse instead of panicking, and a mark left open
+when its stream finishes fails `Writer::finish`. The catalog lists every group in
+`/OCProperties`, hidden ones in `/OFF`; `Document::set_optional_content_page_mode(true)` adds
+`/PageMode /UseOC`. Optional content needs PDF 1.5 and fails PDF/A-1 validation (patch 12 in
+[`vendor/krilla/README.craft.md`](../../vendor/krilla/README.craft.md), marker
+`CRAFT_OPTIONAL_CONTENT`).
 
 `Writer::document_mut` and `write::backend` deliberately expose Krilla's page, resource and
 painting APIs. The apps keep their document walks, pagination, font selection/licensing,
diff --git a/crates/pdf/src/lib.rs b/crates/pdf/src/lib.rs
index e540157a..9814c469 100644
--- a/crates/pdf/src/lib.rs
+++ b/crates/pdf/src/lib.rs
@@ -6,8 +6,10 @@
 
 #[cfg(feature = "interpret")]
 pub use hayro_interpret as interpret;
+mod link;
 #[cfg(feature = "read")]
 pub use hayro_syntax as syntax;
+pub use link::safe_url;
 
 #[cfg(feature = "read")]
 mod read;
diff --git a/crates/pdf/src/link.rs b/crates/pdf/src/link.rs
new file mode 100644
index 00000000..f4c7b6a7
--- /dev/null
+++ b/crates/pdf/src/link.rs
@@ -0,0 +1,84 @@
+//! Which link targets from a document may become clickable links in a written PDF.
+
+/// Whether a link target from a (possibly untrusted) document may be opened by whoever opens
+/// the file: `http`/`https` URLs with a host, and `mailto` with an address.
+///
+/// Everything else is refused: `file:`, `javascript:`, `data:`, relative paths, network
+/// shares (`\\host\share`, `//host/share`, `smb:`) and other schemes, which an operating system
+/// may hand to a protocol handler. Leading and trailing whitespace is ignored; schemes compare
+/// case-insensitively.
+pub fn safe_url(url: &str) -> bool {
+    let u = url.trim();
+    let Some((scheme, rest)) = u.split_once(':') else { return false };
+    match scheme.to_ascii_lowercase().as_str() {
+        "http" | "https" => rest.strip_prefix("//").is_some_and(|r| !host(r).is_empty()),
+        "mailto" => has_recipient(rest),
+        _ => false,
+    }
+}
+
+/// The host of an authority-first URL remainder: before the path, query or fragment, after any
+/// userinfo, without the port.
+fn host(rest: &str) -> &str {
+    let authority = rest.split(['/', '?', '#', '\\']).next().unwrap_or("");
+    let host_port = authority.rsplit_once('@').map_or(authority, |(_, h)| h);
+    match host_port.strip_prefix('[') {
+        Some(v6) => v6.split_once(']').map_or("", |(h, _)| h),
+        None => host_port.split(':').next().unwrap_or(""),
+    }
+}
+
+/// Whether a `mailto:` remainder names an address, before its headers or in a `to` header.
+fn has_recipient(rest: &str) -> bool {
+    let (to, headers) = rest.split_once('?').unwrap_or((rest, ""));
+    !to.trim().is_empty() || headers.split('&').any(|h| h.split_once('=').is_some_and(|(k, v)| k.eq_ignore_ascii_case("to") && !v.trim().is_empty()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::safe_url;
+
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    fn only_web_and_mail_links_are_safe_to_open() {
+        for url in [
+            "https://example.com",
+            " HTTP://example.com/x",
+            "https://user@example.com:8443/x?q#f",
+            "https://[::1]/",
+            "mailto:someone@example.com",
+            "mailto:?to=someone@example.com&subject=hi",
+        ] {
+            assert!(safe_url(url), "{url}");
+        }
+        let refused = [
+            "https://",
+            "https://?q=x",
+            "https:///x",
+            "https://user@/x",
+            "https://:80/",
+            "mailto:",
+            "mailto:?subject=hello",
+            "file:///C:/notes.pdf",
+            "notes.pdf",
+            "javascript:alert(1)",
+            "\t JavaScript:alert(1)",
+            "java\nscript:alert(1)",
+            "vbscript:MsgBox(1)",
+            "data:text/html,<script>alert(1)</script>",
+            "ms-msdt:/id PCWDiagnostic",
+            "ms-word:ofe|u|\\\\attacker.example\\share\\x.docx",
+            "ldap://attacker.example/x",
+            "//attacker.example/share",
+            "\\\\attacker.example\\share",
+            "file://attacker.example/share/x",
+            "file:////attacker.example/share/x",
+            "smb://attacker.example/share",
+            "search-ms:query=x&crumb=location:\\\\attacker.example\\share",
+            "search:query=x&crumb=location:\\\\attacker.example\\share",
+        ];
+        for url in refused {
+            assert!(!safe_url(url), "{url}");
+        }
+    }
+}
diff --git a/crates/pdf/src/raster.rs b/crates/pdf/src/raster.rs
index bf1fc931..9b170d1f 100644
--- a/crates/pdf/src/raster.rs
+++ b/crates/pdf/src/raster.rs
@@ -26,6 +26,8 @@ pub struct Options {
     /// Straight-alpha sRGB bytes; output pixels are always premultiplied.
     pub background: [u8; 4],
     /// Generic solid-colour mapping; reading presets and print bypass policy belong to callers.
+    /// It also maps a plate's gray film (`InterpreterSettings::plate`), so a plate render that
+    /// must keep its tints leaves it `None`. Knockout clears are never mapped.
     pub color_replacement: Option<ColorReplacement>,
 }
 
diff --git a/crates/pdf/src/write.rs b/crates/pdf/src/write.rs
index 1c2e0413..8114327d 100644
--- a/crates/pdf/src/write.rs
+++ b/crates/pdf/src/write.rs
@@ -8,8 +8,13 @@ use std::panic::{AssertUnwindSafe, catch_unwind};
 
 pub use krilla as backend;
 
-// Require the root workspace patch; an unpatched backend can abort during unwind.
+// Require the root workspace patch; an unpatched backend can abort during unwind, writes
+// RGB blending groups and no print output intent, and has no optional content.
 const _: bool = backend::CRAFT_UNWIND_POISONING;
+const _: bool = backend::CRAFT_PRINT_COLOR;
+const _: bool = backend::CRAFT_OPTIONAL_CONTENT;
+
+pub mod print;
 
 use backend::configure::{Archival, Configuration, ConfigurationBuilder, ConfigurationError, PdfVersion};
 use backend::text::{Font, Tag};
@@ -36,6 +41,8 @@ pub enum WriteError {
     Allocation,
     #[error("font could not be read for embedding")]
     InvalidFont,
+    #[error("the print profile is not a readable CMYK ICC profile")]
+    InvalidProfile,
 }
 
 /// Run an entire app export, including drawing and postprocessing, behind a native
@@ -77,6 +84,8 @@ pub struct Metadata {
     pub description: Option<String>,
     pub keywords: Vec<String>,
     pub created: Option<backend::metadata::DateTime>,
+    /// Written as the modification date; `created` is written there when this is `None`.
+    pub modified: Option<backend::metadata::DateTime>,
 }
 
 impl Metadata {
@@ -92,6 +101,9 @@ impl Metadata {
         if let Some(created) = self.created {
             metadata = metadata.creation_date(created);
         }
+        if let Some(modified) = self.modified {
+            metadata = metadata.modification_date(modified);
+        }
         metadata
     }
 }
@@ -132,6 +144,14 @@ impl Writer {
     }
 }
 
+/// The link target that opens `url`, or `None` when [`safe_url`](crate::safe_url) refuses it.
+/// Build URI links with this instead of `backend::action::LinkAction` so a refused target
+/// writes no link annotation; the page content stays as drawn. The URI is written trimmed.
+pub fn uri_target(url: &str) -> Option<backend::annotation::Target> {
+    let url = url.trim();
+    crate::safe_url(url).then(|| backend::annotation::Target::Action(backend::action::LinkAction::new(url.to_owned()).into()))
+}
+
 fn check_font_input(size: usize, variations: Option<&[([u8; 4], f32)]>) -> Result<(), WriteError> {
     if size > MAX_FONT_BYTES {
         return Err(WriteError::FontLimit);
diff --git a/crates/pdf/src/write/print.rs b/crates/pdf/src/write/print.rs
new file mode 100644
index 00000000..951ce5a8
--- /dev/null
+++ b/crates/pdf/src/write/print.rs
@@ -0,0 +1,83 @@
+//! Serialization settings for CMYK print output.
+//!
+//! The document's CMYK profile, its working space, describes the printing condition.
+//! [`cmyk_blending`] blends transparency in CMYK and writes no output intent, like a plain
+//! print PDF; [`settings`] also writes the profile as the `GTS_PDFX` output intent, through
+//! which DeviceCMYK content and the CMYK blending groups are interpreted, as PDF/X needs. This module takes the profile bytes and has no
+//! color-management dependency; craft-cms's `builtin::COATED_FOGRA39_ICC` is a suitable
+//! default profile, described by [`PrintColor::fogra39`].
+//!
+//! The settings carry no PDF/X version and are not checked against PDF/X: callers that claim
+//! conformance set [`SerializeSettings::pdfx_version`] and run their own checks.
+
+use super::backend::icc::ICCProfile;
+use super::backend::{GroupColorSpace, OutputIntent, SerializeSettings, Trapped};
+use super::{WriteError, guard};
+
+/// The printing condition of a CMYK export.
+#[derive(Clone, Copy, Debug)]
+pub struct PrintColor<'a> {
+    /// The CMYK ICC profile, written as `/DestOutputProfile`.
+    pub profile: &'a [u8],
+    /// `/OutputConditionIdentifier`: a registered name such as `FOGRA39`, or `Custom`.
+    pub condition_identifier: &'a str,
+    /// `/OutputCondition`: a human-readable description.
+    pub condition: Option<&'a str>,
+    /// `/RegistryName`, such as `http://www.color.org` for registered conditions.
+    pub registry_name: Option<&'a str>,
+    /// `/Info`: PDF/X requires it when the condition is not registered.
+    pub info: Option<&'a str>,
+}
+
+impl<'a> PrintColor<'a> {
+    /// A profile for the registered FOGRA39 condition (ISO 12647-2:2004 coated paper), such
+    /// as craft-cms's `builtin::COATED_FOGRA39_ICC`.
+    pub fn fogra39(profile: &'a [u8]) -> Self {
+        Self {
+            profile,
+            condition_identifier: "FOGRA39",
+            condition: Some("Coated FOGRA39 (ISO 12647-2:2004)"),
+            registry_name: Some("http://www.color.org"),
+            info: Some("Coated FOGRA39 (ISO 12647-2:2004)"),
+        }
+    }
+}
+
+/// Settings for a CMYK print PDF without an output intent: DeviceCMYK color and CMYK
+/// blending groups, with `profile` as `cmyk_profile`. Other fields keep their defaults;
+/// override them with struct update syntax.
+///
+/// Fails with [`WriteError::InvalidProfile`] when `profile` is not a readable CMYK ICC
+/// profile.
+pub fn cmyk_blending(profile: &[u8]) -> Result<SerializeSettings, WriteError> {
+    guard(|| {
+        let profile = ICCProfile::<4>::new(profile).ok_or(WriteError::InvalidProfile)?;
+        Ok(SerializeSettings {
+            no_device_cs: false,
+            cmyk_profile: Some(profile),
+            group_color_space: GroupColorSpace::Cmyk,
+            ..SerializeSettings::default()
+        })
+    })
+}
+
+/// [`cmyk_blending`] plus the profile as the `GTS_PDFX` output intent and `/Trapped /False`,
+/// for PDF/X export.
+///
+/// Fails with [`WriteError::InvalidProfile`] when `profile` is not a readable CMYK ICC
+/// profile.
+pub fn settings(color: PrintColor<'_>) -> Result<SerializeSettings, WriteError> {
+    let settings = cmyk_blending(color.profile)?;
+    let profile = settings.cmyk_profile.clone().ok_or(WriteError::InvalidProfile)?;
+    Ok(SerializeSettings {
+        output_intent: Some(OutputIntent {
+            profile,
+            condition_identifier: color.condition_identifier.to_owned(),
+            condition: color.condition.map(str::to_owned),
+            registry_name: color.registry_name.map(str::to_owned),
+            info: color.info.map(str::to_owned),
+        }),
+        trapped: Some(Trapped::False),
+        ..settings
+    })
+}
diff --git a/crates/pdf/tests/knockout.rs b/crates/pdf/tests/knockout.rs
new file mode 100644
index 00000000..039674b9
--- /dev/null
+++ b/crates/pdf/tests/knockout.rs
@@ -0,0 +1,162 @@
+//! Knockout transparency groups through the raster path. Adapted from PdfCraft #2974 by mtlcl410
+//! (`raster::tests::knockout_groups_replace_what_their_elements_cover` in pdfcraft-render at
+//! bae69819594a6385a027fec1f67e6b3c36c259b4, MIT OR Apache-2.0).
+#![cfg(feature = "raster")]
+
+use craft_pdf::interpret::InterpreterSettings;
+use craft_pdf::{
+    open_slice,
+    raster::{self, Options, RenderCache},
+};
+
+/// A 300 × 200 pt page that draws form `Fm1` (a transparency group with `group` entries and
+/// content `form`), then a green square at 50 % opacity.
+fn knockout_pdf(group: &str, form: &str) -> Vec<u8> {
+    format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /XObject << /Fm1 5 0 R >> /ExtGState << /G << /ca 0.5 >> >> >> >> endobj
+4 0 obj << /Length 39 >> stream
+/Fm1 Do /G gs 0 1 0 rg 10 10 30 30 re f
+endstream endobj
+5 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency {group} >> /Resources << /ExtGState << /A << /ca 0.5 >> >> /XObject << /In 6 0 R /Msk 7 0 R /Neu 8 0 R /Img 9 0 R /Sm 10 0 R /Nimg 12 0 R /Deep 13 0 R /Shg 16 0 R /Big 17 0 R >> >> /Length {} >> stream
+{form}
+endstream endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /A << /ca 0.5 >> >> >> /Length 34 >> stream
+/A gs 0 0 1 rg 100 50 150 120 re f
+endstream endobj
+7 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ImageMask true /Filter /ASCIIHexDecode /Length 5 >> stream
+0000>
+endstream endobj
+8 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /H << /ca 0.5 >> >> >> /Length 62 >> stream
+/H gs 0 1 0 rg 80 40 100 100 re f 0 0 1 rg 130 80 100 100 re f
+endstream endobj
+9 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 7 >> stream
+0000FF>
+endstream endobj
+10 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /SMask 11 0 R /Filter /ASCIIHexDecode /Length 13 >> stream
+0000FF0000FF>
+endstream endobj
+11 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 5 >> stream
+00FF>
+endstream endobj
+12 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /H << /ca 0.5 >> >> /XObject << /Img 9 0 R >> >> /Length 38 >> stream
+/H gs q 160 0 0 100 60 50 cm /Img Do Q
+endstream endobj
+13 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /ExtGState << /H << /ca 0.5 >> >> /XObject << /In3 14 0 R >> >> /Length 13 >> stream
+/H gs /In3 Do
+endstream endobj
+14 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Length 28 >> stream
+0 0 1 rg 100 50 150 120 re f
+endstream endobj
+15 0 obj << /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 1 0] /Function << /FunctionType 2 /Domain [0 1] /C0 [0 0 1] /C1 [0 0 1] /N 1 >> /Extend [true true] /BBox [100 50 140 170] >> >> endobj
+16 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 300 200] /Group << /S /Transparency >> /Resources << /Pattern << /P 15 0 R >> >> /Length 38 >> stream
+/Pattern cs /P scn 100 50 150 120 re f
+endstream endobj
+17 0 obj << /Type /XObject /Subtype /Image /Width 20000 /Height 20000 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length 7 >> stream
+0000FF>
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        form.len()
+    )
+    .into_bytes()
+}
+
+/// The page rendered over white, as RGBA8, 300 × 200 pixels.
+fn render(group: &str, form: &str) -> Vec<u8> {
+    let pdf = knockout_pdf(group, form);
+    let doc = open_slice(&pdf, None).unwrap();
+    let options = Options { background: [255; 4], ..Default::default() };
+    let raster = raster::render(&doc.pages()[0], &RenderCache::new(), &InterpreterSettings::default(), &options).unwrap();
+    assert_eq!((raster.width, raster.height), (300, 200));
+    raster.bytes().to_vec()
+}
+
+/// The RGB at PDF point (x, y); pixel rows run top down.
+fn px(page: &[u8], x: usize, y: usize) -> [u8; 3] {
+    let p = &page[((200 - y) * 300 + x) * 4..][..3];
+    [p[0], p[1], p[2]]
+}
+
+fn check(page: &[u8], x: usize, y: usize, want: [u8; 3], what: &str) {
+    let got = px(page, x, y);
+    assert!(got.iter().zip(want).all(|(a, b)| a.abs_diff(b) <= 2), "{what}: {got:?}, expected {want:?}");
+}
+
+/// In a knockout transparency group (`/K true`) each element composites with the group's initial
+/// backdrop, not with the elements drawn before it in the group, over the element's shape. A blue
+/// square at 50 % opacity over a red one at 50 % shows only the blue where they overlap; without
+/// `/K` the two blend. The same holds for an image (its shape is its rectangle; a soft-masked
+/// image's shape is its mask, so its transparent part leaves what is under it) and for a nested
+/// group (its shape is the union of its elements' shapes, while its own elements still blend with
+/// each other).
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn knockout_groups_replace_what_their_elements_cover() {
+    let red = "/A gs 1 0 0 rg 20 20 150 150 re f ";
+    let ko = "/I true /K true";
+
+    let squares = render(ko, &format!("{red}0 0 1 rg 100 50 150 120 re f"));
+    check(&squares, 130, 100, [128, 128, 255], "knocked out");
+    check(&squares, 50, 40, [255, 128, 128], "red alone");
+    check(&squares, 210, 100, [128, 128, 255], "blue alone");
+    check(&squares, 280, 190, [255, 255, 255], "paper");
+    // Page content after the group composites normally again: green at 50 % over the red.
+    check(&squares, 30, 30, [128, 191, 64], "after the group");
+    let plain = render("/I true", &format!("{red}0 0 1 rg 100 50 150 120 re f"));
+    check(&plain, 130, 100, [128, 64, 191], "blended without /K");
+
+    // An image at 50 % replaces the red under its rectangle.
+    let image = render(ko, &format!("{red}q 160 0 0 100 60 50 cm /Img Do Q"));
+    check(&image, 100, 100, [128, 128, 255], "image knocks out");
+    check(&image, 40, 40, [255, 128, 128], "red beside the image");
+    // A soft-masked image: its transparent left half leaves the red, its opaque half replaces it.
+    let masked = render(ko, "1 0 0 rg 20 20 150 150 re f q 160 0 0 100 60 50 cm /Sm Do Q");
+    check(&masked, 100, 100, [255, 0, 0], "under the transparent half");
+    check(&masked, 155, 100, [0, 0, 255], "under the opaque half");
+
+    // A nested group entered at 50 % (blue at 25 % in all) replaces the red under its shape.
+    let nested = render(ko, &format!("{red}/In Do"));
+    check(&nested, 130, 100, [191, 191, 255], "nested group knocks out");
+    check(&nested, 50, 40, [255, 128, 128], "red beside the nested group");
+    // A nested group at full opacity: it knocks out the red as a whole, and its own two squares
+    // at 50 % still blend with each other where they overlap.
+    let neutral = render(ko, "1 0 0 rg 20 20 150 150 re f /Neu Do");
+    check(&neutral, 100, 60, [128, 255, 128], "green over the knocked-out red");
+    check(&neutral, 150, 110, [64, 128, 191], "the nested squares blend");
+    check(&neutral, 40, 40, [255, 0, 0], "red beside the nested group");
+
+    // An image inside a nested group is drawn once (blue at 50 %), over the knocked-out red.
+    let nested_image = render(ko, "1 0 0 rg 20 20 150 150 re f /Nimg Do");
+    check(&nested_image, 100, 100, [128, 128, 255], "image in a nested group");
+    // A group inside a nested group knocks out the red as well.
+    let deep = render(ko, "1 0 0 rg 20 20 150 150 re f /Deep Do");
+    check(&deep, 130, 100, [128, 128, 255], "group in a nested group");
+    check(&deep, 40, 40, [255, 0, 0], "red beside it");
+
+    // A stencil mask must not erase the red beside it. Where the stencil paints (every sample 0)
+    // its blue is drawn; a stencil composites rather than knocking the red out, and its exact
+    // color also depends on its fill opacity (pdfcraft #2975), so only "blue was drawn here" is
+    // pinned.
+    let stencil = render(ko, &format!("{red}0 0 1 rg q 150 0 0 120 100 50 cm /Msk Do Q"));
+    check(&stencil, 50, 40, [255, 128, 128], "red beside a stencil");
+    let under = px(&stencil, 130, 100);
+    assert!(under != [255, 128, 128] && under[2] >= 150 && under[0] < 230, "stencil drew nothing: {under:?}");
+
+    // A shading's /BBox clips it (ISO 32000-2 Table 77), so a shading fill's shape is its path
+    // inside the box: the erase pass clears only that, and the red outside the box but inside
+    // the path stays.
+    let shaded = render(ko, &format!("{red}/Shg Do"));
+    check(&shaded, 120, 100, [128, 128, 255], "the shading inside its box");
+    check(&shaded, 155, 100, [255, 128, 128], "red outside the shading's box");
+
+    // An image that isn't decoded (here over the renderer's pixel limit) draws nothing, so it
+    // doesn't clear what is under its rectangle either.
+    let undecoded = render(ko, &format!("{red}q 160 0 0 100 60 50 cm /Big Do Q"));
+    check(&undecoded, 100, 100, [255, 128, 128], "red under an image that isn't drawn");
+    // A tiny image still knocks out in a final render.
+    let tiny = render(ko, &format!("{red}q 3 0 0 3 100 100 cm /Img Do Q"));
+    check(&tiny, 101, 101, [128, 128, 255], "a tiny image");
+}
diff --git a/crates/pdf/tests/link_annotations.rs b/crates/pdf/tests/link_annotations.rs
new file mode 100644
index 00000000..e637b3c7
--- /dev/null
+++ b/crates/pdf/tests/link_annotations.rs
@@ -0,0 +1,66 @@
+//! Link annotations, destinations and page boxes whose geometry has no finite place on the
+//! page make `Writer::finish` return an error instead of panicking (krilla patch 13).
+#![cfg(feature = "write")]
+#![allow(clippy::unwrap_used, clippy::panic)]
+
+use backend::action::LinkAction;
+use backend::annotation::{LinkAnnotation, Target};
+use backend::destination::XyzDestination;
+use backend::error::KrillaError;
+use backend::geom::{Point, Quadrilateral, Rect};
+use backend::page::PageSettings;
+use craft_pdf::write::{Metadata, WriteError, Writer, backend};
+
+fn link() -> Target {
+    Target::Action(LinkAction::new("https://example.com".into()).into())
+}
+
+fn quad(x: f32, y: f32) -> Quadrilateral {
+    Quadrilateral([Point::from_xy(x, y); 4])
+}
+
+fn write(settings: PageSettings, annotation: Option<LinkAnnotation>) -> Result<Vec<u8>, KrillaError> {
+    let mut writer = Writer::new(Default::default(), Metadata::default());
+    let mut page = writer.document_mut().start_page_with(settings);
+    if let Some(annotation) = annotation {
+        page.add_annotation(annotation.into());
+    }
+    page.finish();
+    match writer.finish() {
+        Ok(pdf) => Ok(pdf),
+        Err(WriteError::Serialization(error)) => Err(*error),
+        Err(error) => panic!("unexpected error: {error}"),
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn unplaceable_geometry_is_an_error() {
+    let page = || PageSettings::from_wh(40.0, 20.0).unwrap();
+    let big_page = || PageSettings::from_wh(40.0, 2e38).unwrap();
+
+    let ok = write(page(), Some(LinkAnnotation::new_with_quad_points(vec![quad(1.0, 2.0)], link())));
+    assert!(ok.is_ok(), "{ok:?}");
+
+    let quads = [vec![], vec![quad(f32::NAN, f32::NAN)], vec![quad(1.0, 2.0), quad(f32::INFINITY, 2.0)], vec![quad(-3e38, 0.0), quad(3e38, 0.0)]];
+    for (case, quads) in quads.into_iter().enumerate() {
+        let result = write(page(), Some(LinkAnnotation::new_with_quad_points(quads, link())));
+        assert!(matches!(result, Err(KrillaError::InvalidAnnotationGeometry(None))), "case {case}: {result:?}");
+    }
+
+    // Finite, but 2e38 + 2e38 overflows when flipped into PDF coordinates.
+    let far = Rect::from_ltrb(0.0, -2e38, 10.0, -1e38).unwrap();
+    let result = write(big_page(), Some(LinkAnnotation::new(far, link())));
+    assert!(matches!(result, Err(KrillaError::InvalidAnnotationGeometry(None))), "{result:?}");
+
+    let result = write(big_page().with_crop_box(Some(far)), None);
+    assert!(matches!(result, Err(KrillaError::InvalidPageBox(0))), "{result:?}");
+
+    let missing_page = Target::Destination(XyzDestination::new(5, Point::from_xy(1.0, 1.0)).into());
+    let result = write(page(), Some(LinkAnnotation::new(Rect::from_xywh(0.0, 0.0, 5.0, 5.0).unwrap(), missing_page)));
+    assert!(matches!(result, Err(KrillaError::InvalidDestination(5))), "{result:?}");
+
+    let far_point = Target::Destination(XyzDestination::new(0, Point::from_xy(1.0, -3e38)).into());
+    let result = write(big_page(), Some(LinkAnnotation::new(Rect::from_xywh(0.0, 0.0, 5.0, 5.0).unwrap(), far_point)));
+    assert!(matches!(result, Err(KrillaError::InvalidDestination(0))), "{result:?}");
+}
diff --git a/crates/pdf/tests/optional_content.rs b/crates/pdf/tests/optional_content.rs
new file mode 100644
index 00000000..38b77334
--- /dev/null
+++ b/crates/pdf/tests/optional_content.rs
@@ -0,0 +1,287 @@
+//! Optional content (layers): `Document::add_optional_content_group`,
+//! `Surface::start_optional_content` and `Surface::end_optional_content`, read back with the
+//! shared reader.
+#![cfg(feature = "write")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::collections::BTreeMap;
+use std::sync::Arc;
+
+use backend::SerializeSettings;
+use backend::configure::{Archival, PdfVersion, ValidationError};
+use backend::error::KrillaError;
+use backend::geom::{PathBuilder, Rect, Size};
+use backend::optional_content::OcgId;
+use backend::page::PageSettings;
+use backend::paint::Fill;
+use backend::surface::Surface;
+use backend::tagging::ContentTag;
+use craft_pdf::write::{self, Metadata, WriteError, Writer, backend};
+use hayro_syntax::object::{Array, Dict, Name, Stream, String as PdfString};
+
+const NOTES: &str = "注記";
+
+fn rect(surface: &mut Surface<'_>, x: f32) {
+    let mut path = PathBuilder::new();
+    path.push_rect(Rect::from_xywh(x, 10.0, 20.0, 20.0).unwrap());
+    surface.set_fill(Some(Fill::default()));
+    surface.draw_path(&path.finish().unwrap());
+}
+
+fn page_settings() -> PageSettings {
+    PageSettings::new(Size::from_wh(200.0, 60.0).unwrap())
+}
+
+/// Two pages and three groups: "Walls" (shown), the hidden notes layer and "Unused" (shown,
+/// on no page). Page 1 marks one rect per layer, plus a mark inside an isolated group. Page 2
+/// nests the notes inside the walls and a tagged section inside the notes.
+fn layered(settings: SerializeSettings, page_mode: bool) -> Result<Vec<u8>, WriteError> {
+    let mut writer = Writer::new(settings, Metadata::default());
+    let document = writer.document_mut();
+    let walls = document.add_optional_content_group("Walls", true);
+    let notes = document.add_optional_content_group(NOTES, false);
+    document.add_optional_content_group("Unused", true);
+    document.set_optional_content_page_mode(page_mode);
+    {
+        let mut page = document.start_page_with(page_settings());
+        let mut surface = page.surface();
+        surface.start_optional_content(walls).unwrap();
+        rect(&mut surface, 0.0);
+        surface.end_optional_content().unwrap();
+        surface.start_optional_content(notes).unwrap();
+        rect(&mut surface, 30.0);
+        surface.end_optional_content().unwrap();
+        surface.push_isolated();
+        surface.start_optional_content(notes).unwrap();
+        rect(&mut surface, 60.0);
+        surface.end_optional_content().unwrap();
+        surface.pop();
+        surface.finish();
+        page.finish();
+    }
+    {
+        let mut page = document.start_page_with(page_settings());
+        let mut surface = page.surface();
+        surface.start_optional_content(walls).unwrap();
+        rect(&mut surface, 0.0);
+        surface.start_optional_content(notes).unwrap();
+        surface.start_tagged(ContentTag::Other);
+        rect(&mut surface, 30.0);
+        surface.end_tagged();
+        surface.end_optional_content().unwrap();
+        surface.end_optional_content().unwrap();
+        surface.finish();
+        page.finish();
+    }
+    writer.finish()
+}
+
+fn text(string: &PdfString<'_>) -> String {
+    let bytes = string.as_bytes();
+    match bytes.strip_prefix(&[0xFE, 0xFF]) {
+        Some(utf16) => String::from_utf16(&utf16.chunks(2).map(|c| u16::from_be_bytes([c[0], c[1]])).collect::<Vec<_>>()).unwrap(),
+        None => String::from_utf8(bytes.to_vec()).unwrap(),
+    }
+}
+
+fn ocg_name(ocg: &Dict<'_>) -> String {
+    assert_eq!(ocg.get::<Name<'_>>(b"Type".as_slice()).unwrap().as_str(), "OCG");
+    text(&ocg.get::<PdfString<'_>>(b"Name".as_slice()).unwrap())
+}
+
+fn names(array: &Array<'_>) -> Vec<String> {
+    array.iter::<Dict<'_>>().map(|ocg| ocg_name(&ocg)).collect()
+}
+
+fn open(bytes: &[u8]) -> hayro_syntax::Pdf {
+    hayro_syntax::Pdf::new(Arc::new(bytes.to_vec())).unwrap()
+}
+
+fn root(pdf: &hayro_syntax::Pdf) -> Dict<'_> {
+    pdf.xref().get::<Dict<'_>>(pdf.xref().root_id()).unwrap()
+}
+
+/// The `/OC /name BDC` names in a content stream, after checking that every `BDC` has its
+/// `EMC` and that nothing ends before it starts.
+fn oc_marks(content: &[u8]) -> Vec<String> {
+    // pdf-writer omits the space before a name and around dictionaries.
+    let content = String::from_utf8_lossy(content).replace('/', " /").replace("<<", " << ").replace(">>", " >> ");
+    let tokens: Vec<&str> = content.split_whitespace().collect();
+    let mut depth = 0usize;
+    let mut marks = Vec::new();
+    for (i, token) in tokens.iter().enumerate() {
+        match *token {
+            "BDC" => {
+                depth += 1;
+                if i >= 2 && tokens[i - 2] == "/OC" {
+                    marks.push(tokens[i - 1].trim_start_matches('/').to_owned());
+                }
+            }
+            "EMC" => depth = depth.checked_sub(1).expect("EMC without BDC"),
+            _ => {}
+        }
+    }
+    assert_eq!(depth, 0, "unbalanced marked content");
+    marks
+}
+
+/// Each `/Properties` entry of a resource dictionary, as resource name to group name.
+fn properties(resources: &Dict<'_>) -> BTreeMap<String, String> {
+    resources.keys().map(|key| (key.as_str().to_owned(), ocg_name(&resources.get::<Dict<'_>>(key.as_ref()).unwrap()))).collect()
+}
+
+/// Per page: the layer of each optional content mark, in content order.
+fn page_layers(bytes: &[u8]) -> Vec<Vec<String>> {
+    let pdf = open(bytes);
+    pdf.pages()
+        .iter()
+        .map(|page| {
+            let map = properties(&page.resources().properties);
+            oc_marks(page.page_stream().unwrap())
+                .iter()
+                .map(|mark| map.get(mark).unwrap_or_else(|| panic!("/{mark} is not in /Properties")).clone())
+                .collect()
+        })
+        .collect()
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn groups_are_listed_in_the_catalog_with_hidden_ones_off() {
+    let bytes = layered(SerializeSettings::default(), false).unwrap();
+    let pdf = open(&bytes);
+    let root = root(&pdf);
+    let properties = root.get::<Dict<'_>>(b"OCProperties".as_slice()).unwrap();
+    let all = ["Walls", NOTES, "Unused"].map(str::to_owned).to_vec();
+    assert_eq!(names(&properties.get::<Array<'_>>(b"OCGs".as_slice()).unwrap()), all);
+    let config = properties.get::<Dict<'_>>(b"D".as_slice()).unwrap();
+    assert_eq!(text(&config.get::<PdfString<'_>>(b"Name".as_slice()).unwrap()), "Layers");
+    assert_eq!(names(&config.get::<Array<'_>>(b"Order".as_slice()).unwrap()), all);
+    assert_eq!(names(&config.get::<Array<'_>>(b"OFF".as_slice()).unwrap()), vec![NOTES.to_owned()]);
+    assert!(root.get::<Name<'_>>(b"PageMode".as_slice()).is_none());
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn page_mode_use_oc_is_opt_in() {
+    let bytes = layered(SerializeSettings::default(), true).unwrap();
+    let pdf = open(&bytes);
+    assert_eq!(root(&pdf).get::<Name<'_>>(b"PageMode".as_slice()).unwrap().as_str(), "UseOC");
+
+    // Without groups there is nothing to show.
+    let mut writer = Writer::new(SerializeSettings::default(), Metadata::default());
+    writer.document_mut().set_optional_content_page_mode(true);
+    let bytes = writer.finish().unwrap();
+    let pdf = open(&bytes);
+    assert!(root(&pdf).get::<Name<'_>>(b"PageMode".as_slice()).is_none());
+    assert!(root(&pdf).get::<Dict<'_>>(b"OCProperties".as_slice()).is_none());
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn marks_name_groups_in_their_own_stream_resources() {
+    let bytes = layered(SerializeSettings::default(), false).unwrap();
+    assert_eq!(page_layers(&bytes), vec![vec!["Walls".to_owned(), NOTES.to_owned()], vec!["Walls".to_owned(), NOTES.to_owned()]]);
+
+    // Page 2 holds a tagged section inside the nested marks: three BDCs, balanced.
+    let pdf = open(&bytes);
+    let page = &pdf.pages()[1];
+    let content = String::from_utf8_lossy(page.page_stream().unwrap()).into_owned();
+    assert_eq!(content.matches("BDC").count(), 3);
+
+    // The isolated group on page 1 is a form XObject with its own `/Properties`.
+    let page = &pdf.pages()[0];
+    let x_objects = &page.resources().x_objects;
+    let forms: Vec<Stream<'_>> = x_objects.keys().filter_map(|key| x_objects.get::<Stream<'_>>(key.as_ref())).collect();
+    assert_eq!(forms.len(), 1);
+    let resources = forms[0].dict().get::<Dict<'_>>(b"Resources".as_slice()).unwrap();
+    let map = properties(&resources.get::<Dict<'_>>(b"Properties".as_slice()).unwrap());
+    let decoded = forms[0].decoded().unwrap();
+    let layers: Vec<String> = oc_marks(&decoded).iter().map(|mark| map[mark].clone()).collect();
+    assert_eq!(layers, vec![NOTES.to_owned()]);
+}
+
+fn validation_errors(version: PdfVersion, archival: Option<Archival>) -> Vec<ValidationError> {
+    let settings = SerializeSettings { configuration: write::configuration(version, archival).unwrap(), ..Default::default() };
+    match layered(settings, false) {
+        Ok(_) => Vec::new(),
+        Err(WriteError::Serialization(error)) => match *error {
+            KrillaError::Validation(errors) => errors.into_iter().map(|(error, _)| error).collect(),
+            other => panic!("expected validation errors, got {other:?}"),
+        },
+        Err(other) => panic!("expected validation errors, got {other:?}"),
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn optional_content_is_a_pdf_a1_error() {
+    let is_oc = |error: &ValidationError| matches!(error, ValidationError::OptionalContent(_));
+    // The metadata is missing, so every archival export fails; only PDF/A-1 names layers.
+    assert!(validation_errors(PdfVersion::Pdf14, Some(Archival::A1_B)).iter().any(is_oc));
+    assert!(!validation_errors(PdfVersion::Pdf17, Some(Archival::A2_B)).iter().any(is_oc));
+    assert!(validation_errors(PdfVersion::Pdf14, None).is_empty());
+}
+
+fn one_page(draw: impl FnOnce(&mut Surface<'_>, OcgId)) -> Result<Vec<u8>, WriteError> {
+    let mut writer = Writer::new(SerializeSettings::default(), Metadata::default());
+    let layer = writer.document_mut().add_optional_content_group("Layer", true);
+    {
+        let mut page = writer.document_mut().start_page_with(page_settings());
+        let mut surface = page.surface();
+        draw(&mut surface, layer);
+        surface.finish();
+        page.finish();
+    }
+    writer.finish()
+}
+
+fn serialization_error(result: Result<Vec<u8>, WriteError>) -> KrillaError {
+    match result {
+        Err(WriteError::Serialization(error)) => *error,
+        other => panic!("expected a serialization error, got {:?}", other.map(|bytes| bytes.len())),
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn misuse_returns_errors_instead_of_panicking() {
+    // An end without a start, and an end that would close a tagged section started inside
+    // the mark, are refused and write nothing; the document stays valid.
+    let bytes = one_page(|surface, layer| {
+        assert!(matches!(surface.end_optional_content(), Err(KrillaError::UnbalancedOptionalContent(_))));
+        surface.start_optional_content(layer).unwrap();
+        surface.start_tagged(ContentTag::Other);
+        assert!(matches!(surface.end_optional_content(), Err(KrillaError::UnbalancedOptionalContent(_))));
+        surface.end_tagged();
+        surface.end_optional_content().unwrap();
+    })
+    .unwrap();
+    assert_eq!(page_layers(&bytes), vec![vec!["Layer".to_owned()]]);
+
+    // A group of another document.
+    let mut other = backend::Document::new();
+    let foreign = (0..4).map(|i| other.add_optional_content_group(format!("{i}"), true)).last().unwrap();
+    one_page(|surface, _| {
+        assert!(matches!(surface.start_optional_content(foreign), Err(KrillaError::UnknownOptionalContentGroup(_))));
+    })
+    .unwrap();
+
+    // Marks left open when the page or a group finishes, and a tagged section that ends
+    // inside a mark started within it, fail the document.
+    let unbalanced = |draw: fn(&mut Surface<'_>, OcgId)| {
+        assert!(matches!(serialization_error(one_page(draw)), KrillaError::UnbalancedOptionalContent(_)));
+    };
+    unbalanced(|surface, layer| surface.start_optional_content(layer).unwrap());
+    unbalanced(|surface, layer| {
+        surface.push_isolated();
+        surface.start_optional_content(layer).unwrap();
+        surface.pop();
+    });
+    unbalanced(|surface, layer| {
+        surface.start_tagged(ContentTag::Other);
+        surface.start_optional_content(layer).unwrap();
+        surface.end_tagged();
+        assert!(surface.end_optional_content().is_err());
+    });
+}
diff --git a/crates/pdf/tests/plates.rs b/crates/pdf/tests/plates.rs
new file mode 100644
index 00000000..41e6d653
--- /dev/null
+++ b/crates/pdf/tests/plates.rs
@@ -0,0 +1,539 @@
+//! Plate mode through the raster path: each ink's separation drawn as a gray film.
+//! Adapted from PdfCraft #2770 by Guillem Hermida (`separations::tests` in pdfcraft-render at
+//! 6fcf2a4aca29e943e28cb69017ff8f87d00656c6, MIT OR Apache-2.0).
+#![cfg(feature = "raster")]
+
+#[path = "support/synthetic_icc.rs"]
+mod synthetic_icc;
+
+use craft_pdf::interpret::InterpreterSettings;
+use craft_pdf::interpret::color::{CmykConversion, CmykSimulation, Ink, InkSinkFn, NoSimulation, PCS_WHITE, Plate};
+use craft_pdf::{
+    open_slice,
+    raster::{self, Options, RenderCache},
+};
+use std::sync::{Arc, Mutex};
+
+/// A 40 × 40 pt page with `content` and `resources`, and `objects` numbered from 5 (each a
+/// whole object body: a dictionary, or a dictionary and its stream).
+fn page_pdf(content: &str, resources: &str, objects: &[Vec<u8>]) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    out.extend_from_slice(b"1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n");
+    out.extend_from_slice(b"2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n");
+    out.extend_from_slice(
+        format!("3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << {resources} >> >> endobj\n").as_bytes(),
+    );
+    out.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n", content.len()).as_bytes());
+    for (i, body) in objects.iter().enumerate() {
+        out.extend_from_slice(format!("{} 0 obj ", i + 5).as_bytes());
+        out.extend_from_slice(body);
+        out.extend_from_slice(b" endobj\n");
+    }
+    out.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF");
+    out
+}
+
+/// A stream object body with `dict` entries and `data`.
+fn stream(dict: &str, data: &[u8]) -> Vec<u8> {
+    let mut out = format!("<< {dict} /Length {} >> stream\n", data.len()).into_bytes();
+    out.extend_from_slice(data);
+    out.extend_from_slice(b"\nendstream");
+    out
+}
+
+fn render(pdf: &[u8], settings: &InterpreterSettings) -> Vec<u8> {
+    render_each(pdf, std::slice::from_ref(settings)).remove(0)
+}
+
+/// The page rendered once per settings, sharing one render cache as a separating caller does.
+fn render_each(pdf: &[u8], settings: &[InterpreterSettings]) -> Vec<Vec<u8>> {
+    let doc = open_slice(pdf, None).unwrap();
+    let cache = RenderCache::new();
+    let options = Options { background: [255; 4], ..Default::default() };
+    settings
+        .iter()
+        .map(|settings| {
+            let raster = raster::render(&doc.pages()[0], &cache, settings, &options).unwrap();
+            assert_eq!((raster.width, raster.height), (40, 40));
+            raster.bytes().to_vec()
+        })
+        .collect()
+}
+
+/// One film per ink, as RGBA8 over white.
+struct Plates(Vec<Vec<u8>>);
+
+impl Plates {
+    /// Each ink's tint at device pixel (x, y), in whole percent.
+    fn at(&self, x: usize, y: usize) -> Vec<u32> {
+        self.0
+            .iter()
+            .map(|film| {
+                let px = &film[(y * 40 + x) * 4..][..4];
+                assert_eq!((px[0], px[3]), (px[2], 255), "a film is opaque gray");
+                (f32::from(255 - px[0]) * 100.0 / 255.0).round() as u32
+            })
+            .collect()
+    }
+}
+
+fn plates(pdf: &[u8], inks: &[Ink], overprint: bool, simulation: Option<&CmykSimulation>) -> Plates {
+    let settings: Vec<InterpreterSettings> = inks
+        .iter()
+        .map(|ink| InterpreterSettings {
+            plate: Some(Plate { ink: ink.clone(), overprint, simulation: simulation.cloned(), spots_as_process: false }),
+            ..Default::default()
+        })
+        .collect();
+    Plates(render_each(pdf, &settings))
+}
+
+fn spot(name: &str) -> Ink {
+    Ink::Spot(name.into())
+}
+
+/// The four process plates, then `spots`.
+fn inks(spots: &[&str]) -> Vec<Ink> {
+    Ink::PROCESS.into_iter().chain(spots.iter().map(|s| spot(s))).collect()
+}
+
+/// The process plates and Gold, overprint honored.
+fn separate(pdf: &[u8]) -> Plates {
+    plates(pdf, &inks(&["Gold"]), true, None)
+}
+
+/// A spot color whose alternate is a yellowish CMYK.
+const GOLD: &str = "[/Separation /Gold /DeviceCMYK << /FunctionType 2 /Domain [0 1] /C0 [0 0 0 0] /C1 [0 0.3 1 0] /N 1 >>]";
+
+fn gold_resource() -> String {
+    format!("/ColorSpace << /CS0 {GOLD} >>")
+}
+
+const CGATS: &[u8] = include_bytes!("../../../vendor/hayro-interpret/assets/CGATS001Compat-v2-micro.icc");
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn device_cmyk_puts_each_component_on_its_own_plate() {
+    let s = plates(&page_pdf("0.2 0.4 0.6 0.8 k 0 0 40 40 re f", "", &[]), &inks(&[]), true, None);
+    assert_eq!(s.at(20, 20), [20, 40, 60, 80]);
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn a_spot_color_paints_its_own_plate_and_knocks_out_the_process_plates() {
+    let s = separate(&page_pdf("0 0 0 1 k 0 0 40 40 re f /CS0 cs 0.5 scn 10 10 20 20 re f", &gold_resource(), &[]));
+    assert_eq!(s.at(20, 20), [0, 0, 0, 0, 50], "knocked out under the spot color");
+    assert_eq!(s.at(2, 2), [0, 0, 0, 100, 0]);
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn overprinting_keeps_the_plates_a_color_does_not_specify() {
+    let resources = format!("{} /ExtGState << /GS1 << /op true >> >>", gold_resource());
+    let pdf = page_pdf("0 0 0 1 k 0 0 40 40 re f /GS1 gs /CS0 cs 0.5 scn 10 10 20 20 re f", &resources, &[]);
+    assert_eq!(separate(&pdf).at(20, 20), [0, 0, 0, 100, 50], "overprinted");
+    assert_eq!(plates(&pdf, &inks(&["Gold"]), false, None).at(20, 20), [0, 0, 0, 0, 50], "overprint simulation off: knocked out");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn op_sets_stroke_overprint_and_fill_overprint_too_without_op() {
+    let resources = format!("{} /ExtGState << /GS1 << /OP true >> /GS2 << /OP true /op false >> >>", gold_resource());
+    let fill = |gs: &str| page_pdf(&format!("0 0 0 1 k 0 0 40 40 re f /{gs} gs /CS0 cs 1 scn 10 10 20 20 re f"), &resources, &[]);
+    assert_eq!(separate(&fill("GS1")).at(20, 20)[3], 100, "OP alone also sets op");
+    assert_eq!(separate(&fill("GS2")).at(20, 20)[3], 0, "op false keeps fills knocking out");
+    let stroke = page_pdf("0 0 0 1 k 0 0 40 40 re f /GS2 gs /CS0 CS 1 SCN 8 w 0 20 m 40 20 l S", &resources, &[]);
+    assert_eq!(separate(&stroke).at(20, 20), [0, 0, 0, 100, 100], "strokes overprint with OP");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn nonzero_overprint_mode_leaves_zero_device_cmyk_components() {
+    let resources = "/ExtGState << /M1 << /OP true /OPM 1 >> /M0 << /OP true /OPM 0 >> >>";
+    let pdf = |gs: &str| page_pdf(&format!("1 0 0 0 k 0 0 40 40 re f /{gs} gs 0 1 0 0 k 10 10 20 20 re f"), resources, &[]);
+    let process = inks(&[]);
+    assert_eq!(plates(&pdf("M1"), &process, true, None).at(20, 20), [100, 100, 0, 0], "OPM 1: the zero cyan leaves the plate");
+    assert_eq!(plates(&pdf("M0"), &process, true, None).at(20, 20), [0, 100, 0, 0], "OPM 0: zero components paint");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn gray_and_rgb_are_process_color_and_never_take_the_nonzero_overprint_mode() {
+    let process = inks(&[]);
+    let gray = page_pdf("1 0 0 0 k 0 0 40 40 re f /M1 gs 0.25 g 10 10 20 20 re f", "/ExtGState << /M1 << /OP true /OPM 1 >> >>", &[]);
+    assert_eq!(plates(&gray, &process, true, None).at(20, 20), [0, 0, 0, 75], "gray is black only, and knocks out cyan");
+    let s = plates(&page_pdf("1 0 0 rg 0 0 20 40 re f 0.2 0.2 0.2 rg 20 0 20 40 re f", "", &[]), &process, true, None);
+    assert_eq!(s.at(10, 20), [0, 100, 100, 0], "red");
+    assert_eq!(s.at(30, 20), [0, 0, 0, 80], "a neutral gray goes to black (10.4.2.4)");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn devicen_components_go_to_the_plates_they_name() {
+    let resources = "/ColorSpace << /CS0 [/DeviceN [/Cyan /Silver /None] /DeviceCMYK 5 0 R] >>";
+    let function = stream("/FunctionType 4 /Domain [0 1 0 1 0 1] /Range [0 1 0 1 0 1 0 1]", b"{ pop 0.5 mul 0 0 }");
+    let s = plates(&page_pdf("/CS0 cs 0.3 0.7 1 scn 0 0 40 40 re f", resources, &[function]), &inks(&["Silver"]), true, None);
+    assert_eq!(s.at(20, 20), [30, 0, 0, 0, 70]);
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn the_all_colorant_paints_every_plate_and_none_paints_nothing() {
+    let gray = "/DeviceGray << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >>";
+    let resources = format!("/ColorSpace << /CS0 {GOLD} /Reg [/Separation /All {gray}] /No [/Separation /None {gray}] >>");
+    let content = "/CS0 cs 0.2 scn 0 0 40 40 re f /Reg cs 1 scn 0 0 20 40 re f /No cs 1 scn 20 0 20 40 re f";
+    let s = separate(&page_pdf(content, &resources, &[]));
+    assert_eq!(s.at(10, 20), [100, 100, 100, 100, 100], "registration color");
+    assert_eq!(s.at(30, 20), [0, 0, 0, 0, 20], "None leaves every plate as it is");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn icc_based_cmyk_is_separated_as_its_components() {
+    let pdf = page_pdf("/CS0 cs 0.1 0.3 0.5 0.7 scn 0 0 40 40 re f", "/ColorSpace << /CS0 [/ICCBased 5 0 R] >>", &[stream("/N 4", CGATS)]);
+    assert_eq!(plates(&pdf, &inks(&[]), true, None).at(20, 20), [10, 30, 50, 70]);
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn images_are_separated_sample_by_sample() {
+    let cmyk = stream("/Type /XObject /Subtype /Image /Width 2 /Height 1 /BitsPerComponent 8 /ColorSpace /DeviceCMYK", &[255, 0, 0, 0, 0, 0, 0, 128]);
+    let s = plates(&page_pdf("q 40 0 0 40 0 0 cm /Im1 Do Q", "/XObject << /Im1 5 0 R >>", &[cmyk]), &inks(&[]), true, None);
+    assert_eq!(s.at(10, 20), [100, 0, 0, 0]);
+    assert_eq!(s.at(30, 20), [0, 0, 0, 50]);
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn a_spot_color_image_overprints_like_any_paint() {
+    let image = stream(&format!("/Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace {GOLD}"), &[128]);
+    let resources = "/XObject << /Im1 5 0 R >> /ExtGState << /GS1 << /op true >> >>";
+    let pdf = |gs: &str| page_pdf(&format!("0 0 0 1 k 0 0 40 40 re f {gs} q 20 0 0 20 10 10 cm /Im1 Do Q"), resources, std::slice::from_ref(&image));
+    assert_eq!(separate(&pdf("/GS1 gs")).at(20, 20), [0, 0, 0, 100, 50]);
+    assert_eq!(separate(&pdf("")).at(20, 20), [0, 0, 0, 0, 50]);
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn shadings_are_separated_through_their_color_space() {
+    let shading = format!(
+        "<< /ShadingType 2 /ColorSpace {GOLD} /Coords [0 0 40 0] /Function << /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> /Extend [true true] >>"
+    );
+    let s = separate(&page_pdf("0 0 0 1 k 0 0 40 40 re f /Sh1 sh", "/Shading << /Sh1 5 0 R >>", &[shading.into_bytes()]));
+    let (left, right) = (s.at(4, 20), s.at(36, 20));
+    assert!(left[4] < 20 && right[4] > 80, "a gradient on the spot plate: {left:?} {right:?}");
+    assert_eq!((left[3], right[3]), (0, 0), "the shading knocks out the black under it");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn an_uncolored_pattern_paints_the_film_of_the_color_it_is_used_with() {
+    let cell = stream("/PatternType 1 /PaintType 2 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << >>", b"0 0 10 10 re f");
+    let resources = format!("/ColorSpace << /PCS [/Pattern {GOLD}] >> /Pattern << /P1 5 0 R >>");
+    let s = separate(&page_pdf("0 0 0 1 k 0 0 40 40 re f /PCS cs 0.5 /P1 scn 0 0 40 40 re f", &resources, &[cell]));
+    assert_eq!(s.at(20, 20), [0, 0, 0, 0, 50], "the pattern's spot color, knocking out black");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn soft_masks_keep_the_luminosity_of_their_own_colors() {
+    // A mask drawn in blue lets about a tenth of the black through. Drawn as the black
+    // plate's film, blue (no black ink) would read as white and let all of it through.
+    let group = stream("/Type /XObject /Subtype /Form /BBox [0 0 40 40] /Group << /S /Transparency /CS /DeviceRGB >>", b"0 0 1 rg 0 0 40 40 re f");
+    let resources = "/ExtGState << /SM << /SMask << /S /Luminosity /G 5 0 R >> >> >>";
+    let s = plates(&page_pdf("/SM gs 0 0 0 1 k 0 0 40 40 re f", resources, &[group]), &[Ink::Black], true, None);
+    let black = s.at(20, 20)[0];
+    assert!((1..30).contains(&black), "black through a blue luminosity mask: {black}%");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn a_device_cmyk_luminosity_mask_reads_its_inks_by_the_device_formula() {
+    // Black ink through a mask whose DeviceCMYK group paints the left half, at (10, 20), and
+    // leaves the backdrop on the right, at (30, 20). Luminosity is 1 - min(1, 0.3c + 0.59m +
+    // 0.11y + k) (ISO 32000-2 §10.4.2.2); Gold's alternate is C0 M30 Y100 K0.
+    let masked = |paint: &str, backdrop: &str| {
+        let group = stream(
+            &format!(
+                "/Type /XObject /Subtype /Form /BBox [0 0 40 40] /Group << /S /Transparency /CS /DeviceCMYK >> /Resources << {} >>",
+                gold_resource()
+            ),
+            format!("{paint} 0 0 20 40 re f").as_bytes(),
+        );
+        let resources = format!("/ExtGState << /SM << /SMask << /S /Luminosity /G 5 0 R {backdrop} >> >> >>");
+        let s = plates(&page_pdf("/SM gs 0 0 0 1 k 0 0 40 40 re f", &resources, &[group]), &[Ink::Black], true, None);
+        [s.at(10, 20)[0], s.at(30, 20)[0]]
+    };
+    assert_eq!(masked("0 0 0 1 k", ""), [0, 0], "K 100% and the default black backdrop hide all of it");
+    assert_eq!(masked("0 0 0 0 k", "/BC [0 0 0 0]"), [100, 100], "paper shows all of it");
+    assert_eq!(masked("0.5 0 0 0 k", "/BC [0 0 0 0.25]"), [85, 75]);
+    assert_eq!(masked("/CS0 cs 1 scn", ""), [71, 0], "a spot ink reads as its alternate CMYK");
+    assert_eq!(masked("1 0 0 rg", ""), [30, 0], "RGB red is C0 M100 Y100 K0 by the device formulas");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn the_ink_sink_reports_spot_inks_of_patterns_and_images_but_not_of_soft_masks() {
+    let image = stream(&format!("/Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace {GOLD}"), &[255]);
+    let cell = stream(
+        "/PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << /ColorSpace << /S [/Separation /Silver /DeviceGray << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0.5] /N 1 >>] >> >>",
+        b"/S cs 1 scn 0 0 5 5 re f",
+    );
+    let mask_group = stream(
+        "/Type /XObject /Subtype /Form /BBox [0 0 40 40] /Group << /S /Transparency /CS /DeviceGray >> /Resources << /ColorSpace << /M [/Separation /MaskOnly /DeviceGray << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >>] >> >>",
+        b"/M cs 0.5 scn 0 0 40 40 re f",
+    );
+    let resources = "/XObject << /Im1 5 0 R >> /Pattern << /P1 6 0 R >> /ExtGState << /SM << /SMask << /S /Luminosity /G 7 0 R >> >> >>";
+    let content = "/Pattern cs /P1 scn 0 0 20 20 re f q 10 0 0 10 25 25 cm /Im1 Do Q /SM gs 0 g 0 0 40 40 re f";
+    // Each spot ink with its appearance at 100%.
+    type Seen = Vec<(Ink, [u8; 3])>;
+    let seen: Arc<Mutex<Seen>> = Arc::default();
+    let log = seen.clone();
+    let sink: InkSinkFn = Arc::new(move |ink: &Ink, appearance: &dyn Fn(f32) -> [u8; 3]| {
+        let mut log = log.lock().unwrap();
+        if !log.iter().any(|(seen, _)| seen == ink) {
+            log.push((ink.clone(), appearance(1.0)));
+        }
+    });
+    render(&page_pdf(content, resources, &[image, cell, mask_group]), &InterpreterSettings { ink_sink: Some(sink), ..Default::default() });
+    let seen = seen.lock().unwrap();
+    let names: Vec<&str> = seen.iter().map(|(ink, _)| ink.name()).collect();
+    assert_eq!(names, ["Silver", "Gold"], "in the order first painted; a mask's ink doesn't print");
+    assert_eq!(seen[0].1, [128, 128, 128], "Silver at 100% is its alternate color");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn malformed_color_spaces_and_overprint_parameters_draw_what_they_can() {
+    let resources = "/ColorSpace << /A [/DeviceN [] /DeviceGray 0] /B [/Separation] /C [/Indexed /DeviceCMYK 300 <00>] >> /ExtGState << /G << /OP 7 /OPM /X /op (y) >> >>";
+    let pdf = page_pdf("/G gs /A cs 1 scn 0 0 9 9 re f /B cs 1 scn /C cs 255 scn 0 0 40 40 re f", resources, &[]);
+    plates(&pdf, &inks(&["Gold"]), true, None);
+}
+
+// Separating through an output intent's CMYK profile (vendored patch 36).
+
+const PRESS: &str = "PdfCraft synthetic press";
+
+fn press_simulation() -> CmykSimulation {
+    CmykSimulation::new(&synthetic_icc::cmyk_profile(PRESS, true)).unwrap()
+}
+
+/// What the synthetic press prints for CIE L*a*b*, in whole percent.
+fn press(l: f64, a: f64, b: f64) -> Vec<u32> {
+    synthetic_icc::btoa(l, a, b).iter().map(|v| (v * 100.0).round() as u32).collect()
+}
+
+/// Whether every ink is within `tolerance` percent of `expected`.
+fn near(got: &[u32], expected: &[u32], tolerance: u32) -> bool {
+    got.len() == expected.len() && got.iter().zip(expected).all(|(g, e)| g.abs_diff(*e) <= tolerance)
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn rgb_separates_through_the_simulated_cmyk_profile() {
+    let simulation = press_simulation();
+    assert_eq!(simulation.description(), Some(PRESS));
+    assert!(!simulation.perceptual());
+    let pdf = page_pdf("0.5 0.5 0.5 rg 0 0 40 40 re f", "", &[]);
+    // The press prints a neutral with equal inks, where the device formulas put it on black
+    // alone.
+    let gray = press(synthetic_icc::srgb_gray_lightness(0.5), 0.0, 0.0);
+    let got = plates(&pdf, &inks(&[]), true, Some(&simulation)).at(20, 20);
+    assert!(near(&got, &gray, 2), "{got:?}, the press prints {gray:?}");
+    assert_eq!(plates(&pdf, &inks(&[]), true, None).at(20, 20), [0, 0, 0, 50]);
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn only_cmyk_profiles_with_pcs_to_device_tables_simulate() {
+    let whole = synthetic_icc::cmyk_profile(PRESS, true);
+    assert_eq!(CmykSimulation::new(&synthetic_icc::gray_profile("Gray")).err(), Some(NoSimulation::NotCmyk));
+    assert_eq!(CmykSimulation::new(&synthetic_icc::cmyk_profile("Proofing only", false)).err(), Some(NoSimulation::NoPcsToDevice));
+    assert_eq!(CmykSimulation::new(b"not a profile").err(), Some(NoSimulation::Unreadable));
+    assert_eq!(CmykSimulation::new(&whole[..300]).err(), Some(NoSimulation::Unreadable));
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn cmyk_in_the_simulated_profile_passes_through_and_other_cmyk_converts() {
+    let profile = synthetic_icc::cmyk_profile(PRESS, true);
+    let simulation = CmykSimulation::new(&profile).unwrap();
+    // Object 5 is the press profile, 6 another CMYK profile.
+    let resources = "/ColorSpace << /Same [/ICCBased 5 0 R] /Other [/ICCBased 6 0 R] >>";
+    let content = "0.2 0.4 0.6 0.8 k 0 0 10 40 re f /Same cs 0.1 0.3 0.5 0.7 scn 10 0 10 40 re f /Other cs 0 0 0 1 scn 30 0 10 40 re f";
+    let pdf = page_pdf(content, resources, &[stream("/N 4", &profile), stream("/N 4", CGATS)]);
+    let s = plates(&pdf, &inks(&[]), true, Some(&simulation));
+    assert_eq!(s.at(5, 20), [20, 40, 60, 80], "DeviceCMYK is the press's own CMYK");
+    assert_eq!(s.at(15, 20), [10, 30, 50, 70], "ICC CMYK in the simulated profile");
+    let other = s.at(35, 20);
+    assert!(other.iter().all(|v| *v > 70), "black alone in another profile is a four-ink black on this press: {other:?}");
+    assert_eq!(plates(&pdf, &inks(&[]), true, None).at(35, 20), [0, 0, 0, 100], "without a simulation ICC CMYK is taken as it is");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn device_gray_stays_on_the_black_plate_under_a_simulation() {
+    let s = plates(&page_pdf("0.25 g 0 0 40 40 re f", "", &[]), &inks(&[]), true, Some(&press_simulation()));
+    assert_eq!(s.at(20, 20), [0, 0, 0, 75]);
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn cie_and_icc_colors_convert_through_the_profile_relative_to_their_white() {
+    let resources =
+        "/ColorSpace << /D50 [/Lab << /WhitePoint [0.9642 1 0.8249] >>] /D65 [/Lab << /WhitePoint [0.9505 1 1.089] >>] /Gray [/ICCBased 5 0 R] >>";
+    let content = "/D50 cs 50 20 -10 scn 0 0 10 40 re f /D65 cs 100 0 0 scn 10 0 10 40 re f /Gray cs 0.5 scn 20 0 10 40 re f";
+    let pdf = page_pdf(content, resources, &[stream("/N 1", &synthetic_icc::gray_profile("Gray 2.2"))]);
+    let s = plates(&pdf, &inks(&[]), true, Some(&press_simulation()));
+    assert!(near(&s.at(5, 20), &press(50.0, 20.0, -10.0), 2), "Lab: {:?}", s.at(5, 20));
+    assert_eq!(s.at(15, 20), [0, 0, 0, 0], "a Lab space's own white prints as paper, whatever its white point");
+    let lightness = 116.0 * 0.5_f64.powf(2.2).cbrt() - 16.0;
+    assert!(near(&s.at(25, 20), &press(lightness, 0.0, 0.0), 2), "ICC gray: {:?}", s.at(25, 20));
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn images_convert_through_the_simulation_sample_by_sample() {
+    let rgb = stream("/Type /XObject /Subtype /Image /Width 2 /Height 1 /BitsPerComponent 8 /ColorSpace /DeviceRGB", &[128, 128, 128, 255, 255, 255]);
+    // More samples than palette entries: the palette is separated once.
+    let indexed = stream(
+        "/Type /XObject /Subtype /Image /Width 4 /Height 1 /BitsPerComponent 8 /ColorSpace [/Indexed /DeviceRGB 1 <808080FFFFFF>]",
+        &[0, 0, 1, 1],
+    );
+    let content = "q 40 0 0 20 0 20 cm /Im1 Do Q q 40 0 0 20 0 0 cm /Im2 Do Q";
+    let pdf = page_pdf(content, "/XObject << /Im1 5 0 R /Im2 6 0 R >>", &[rgb, indexed]);
+    let s = plates(&pdf, &inks(&[]), true, Some(&press_simulation()));
+    let gray = press(synthetic_icc::srgb_gray_lightness(128.0 / 255.0), 0.0, 0.0);
+    for y in [10, 30] {
+        assert!(near(&s.at(10, y), &gray, 2), "y = {y}: {:?}, the press prints {gray:?}", s.at(10, y));
+        assert_eq!(s.at(30, y), [0, 0, 0, 0], "y = {y}: white prints no ink");
+    }
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn a_simulation_shows_its_cmyk_through_its_own_profile() {
+    // The inks the press prints sRGB gray 128 with show as that gray: its two tables invert
+    // each other.
+    let ink = (255.0 * (1.0 - synthetic_icc::srgb_gray_lightness(128.0 / 255.0) / 100.0)).round() as u8;
+    let mut shown = [0; 3];
+    press_simulation().cmyk_to_srgb8(&[ink; 4], &mut shown).unwrap();
+    assert!(shown.iter().all(|c| c.abs_diff(128) <= 4), "{shown:?}");
+    assert!(press_simulation().cmyk_to_srgb8(&[0; 4], &mut [0; 4]).is_none(), "lengths disagree");
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn mutated_profiles_simulate_or_are_refused_without_panicking() {
+    // The header fields a reader checks, every 16th byte of the tag table and bytes spread
+    // over the tag data, changed in turn. Making a simulation takes a fifth of a second in a
+    // debug build, so header bytes readers skip (date, creator, profile ID, reserved) are left
+    // out and the data is sampled.
+    let whole = synthetic_icc::cmyk_profile(PRESS, true);
+    let pdf = page_pdf("0.5 0.5 0.5 rg 0 0 40 40 re f", "", &[]);
+    // Size, version, class, color space, PCS, `acsp`, rendering intent, illuminant.
+    let header = [3, 8, 12, 16, 20, 36, 67, 70];
+    let positions = header.into_iter().chain((128..256).step_by(16)).chain((256..whole.len()).step_by(15_000));
+    for (n, at_byte) in positions.enumerate() {
+        let mut bent = whole.clone();
+        bent[at_byte] = [0x00, 0x7F, 0xFF][n % 3];
+        if let Ok(simulation) = CmykSimulation::new(&bent) {
+            let plate = Plate { ink: Ink::Cyan, overprint: true, simulation: Some(simulation), spots_as_process: false };
+            render(&pdf, &InterpreterSettings { plate: Some(plate), ..Default::default() });
+        }
+    }
+}
+
+/// A caller's conversion: sRGB prints as 10/20/30/40%, XYZ as 50/60/70/80%, and the XYZ it is
+/// given is kept.
+struct Fixed(Arc<Mutex<Vec<[f32; 3]>>>);
+
+impl CmykConversion for Fixed {
+    fn from_srgb(&self, rgb: &[f32], cmyk: &mut [f32]) -> Option<()> {
+        (rgb.len() / 3 == cmyk.len() / 4).then(|| cmyk.as_chunks_mut::<4>().0.fill([0.1, 0.2, 0.3, 0.4]))
+    }
+
+    fn from_pcs_xyz(&self, xyz: &[f32], cmyk: &mut [f32]) -> Option<()> {
+        self.0.lock().unwrap().extend(xyz.as_chunks::<3>().0.iter().copied());
+        cmyk.as_chunks_mut::<4>().0.fill([0.5, 0.6, 0.7, 0.8]);
+        Some(())
+    }
+
+    fn description(&self) -> Option<&str> {
+        Some("fixed")
+    }
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn a_callers_cmyk_conversion_separates_process_color() {
+    let profile = synthetic_icc::cmyk_profile(PRESS, true);
+    let xyz = Arc::default();
+    let simulation = CmykSimulation::with_conversion(&profile, Fixed(Arc::clone(&xyz)));
+    assert_eq!(simulation.description(), Some("fixed"));
+    assert!(simulation.cmyk_to_srgb8(&[0; 4], &mut [0; 3]).is_none(), "no way to show CMYK");
+    let resources = "/ColorSpace << /Lab [/Lab << /WhitePoint [0.9505 1 1.089] >>] /Same [/ICCBased 5 0 R] >>";
+    let content = "1 0 0 rg 0 0 10 40 re f /Lab cs 100 0 0 scn 10 0 10 40 re f 0.2 0.4 0.6 0.8 k 20 0 10 40 re f \
+                   /Same cs 0.1 0.3 0.5 0.7 scn 30 0 10 40 re f";
+    let s = plates(&page_pdf(content, resources, &[stream("/N 4", &profile)]), &inks(&[]), true, Some(&simulation));
+    assert_eq!(s.at(5, 20), [10, 20, 30, 40], "DeviceRGB through from_srgb");
+    assert_eq!(s.at(15, 20), [50, 60, 70, 80], "Lab through from_pcs_xyz");
+    assert_eq!(s.at(25, 20), [20, 40, 60, 80], "DeviceCMYK as it is");
+    assert_eq!(s.at(35, 20), [10, 30, 50, 70], "ICC CMYK in the simulated profile as it is");
+    let xyz = xyz.lock().unwrap();
+    assert!(!xyz.is_empty());
+    for c in xyz.iter() {
+        assert!(c.iter().zip(PCS_WHITE).all(|(v, w)| (v - w).abs() < 1e-3), "a Lab white arrives as the PCS white: {c:?}");
+    }
+}
+
+/// A knockout group (`/K true`, pdfcraft #2974) of two process squares at 50 % opacity separates
+/// with only the top square where they overlap: its plates replace the bottom square's there.
+/// Without `/K` the two blend on every plate.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn a_knockout_group_separates_with_only_the_top_object_in_the_overlap() {
+    let group = |entries: &str| {
+        let form = "/A gs 1 0 0 0 k 0 0 25 25 re f 0 1 0 0 k 15 15 25 25 re f";
+        page_pdf(
+            "/Fm Do",
+            "/XObject << /Fm 5 0 R >>",
+            &[stream(
+                &format!(
+                    "/Type /XObject /Subtype /Form /BBox [0 0 40 40] /Group << /S /Transparency {entries} >> /Resources << /ExtGState << /A << /ca 0.5 >> >> >>"
+                ),
+                form.as_bytes(),
+            )],
+        )
+    };
+    // Device rows run top down: the overlap is at (20, 20), cyan alone at (5, 35), magenta alone
+    // at (35, 5).
+    let knockout = plates(&group("/K true"), &inks(&[]), true, None);
+    assert_eq!(knockout.at(20, 20), [0, 50, 0, 0], "only the magenta square in the overlap");
+    assert_eq!(knockout.at(5, 35), [50, 0, 0, 0]);
+    assert_eq!(knockout.at(35, 5), [0, 50, 0, 0]);
+    let blended = plates(&group(""), &inks(&[]), true, None);
+    assert_eq!(blended.at(20, 20), [25, 50, 0, 0], "both squares without /K");
+}
+
+/// PdfCraft #3018: `/DefaultCMYK` and `/DefaultGray` change how device color looks, not the
+/// inks it prints with. Under them DeviceCMYK still separates as its components (and keeps the
+/// nonzero overprint mode), a DeviceCMYK image sample by sample, and DeviceGray on black alone,
+/// with or without a simulation whose profile differs from the default.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn default_color_spaces_leave_device_color_on_its_plates() {
+    let image = stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace /DeviceCMYK", &[51, 102, 153, 204]);
+    let objects = [stream("/N 4", CGATS), stream("/N 1", &synthetic_icc::gray_profile("Gray 2.2")), image];
+    let content = "0 0 0 1 k 0 0 10 40 re f 1 0 0 0 k 10 0 10 40 re f /M1 gs 0 1 0 0 k 10 0 10 40 re f \
+                   q 10 0 0 40 20 0 cm /Im1 Do Q 0.25 g 30 0 10 40 re f";
+    let resources = "/ExtGState << /M1 << /OP true /OPM 1 >> >> /XObject << /Im1 7 0 R >>";
+    let calibrated = format!("{resources} /ColorSpace << /DefaultCMYK [/ICCBased 5 0 R] /DefaultGray [/ICCBased 6 0 R] >>");
+    let expected: [[u32; 4]; 4] = [[0, 0, 0, 100], [100, 100, 0, 0], [20, 40, 60, 80], [0, 0, 0, 75]];
+    for simulation in [None, Some(press_simulation())] {
+        let s = plates(&page_pdf(content, &calibrated, &objects), &inks(&[]), true, simulation.as_ref());
+        for (x, want) in [5, 15, 25, 35].into_iter().zip(expected) {
+            assert_eq!(s.at(x, 20), want, "x {x}, simulated: {}", simulation.is_some());
+        }
+    }
+}
diff --git a/crates/pdf/tests/print_color.rs b/crates/pdf/tests/print_color.rs
new file mode 100644
index 00000000..c1f2ccc9
--- /dev/null
+++ b/crates/pdf/tests/print_color.rs
@@ -0,0 +1,1186 @@
+//! Print color: the blending color space of transparency groups
+//! (`SerializeSettings::group_color_space`), overprint (`Surface::push_overprint`), knockout
+//! groups (`Surface::push_group`), soft-mask backdrop and transfer function, DeviceN colors,
+//! images and shadings, and the print output intent with the PDF/X markers.
+#![cfg(feature = "write")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::sync::Arc;
+
+use backend::blend::{GroupOptions, Overprint};
+use backend::color::device_n::{self, Colorant, DeviceNSpace, Process};
+use backend::color::{cmyk, luma};
+use backend::configure::{Archival, PdfVersion, ValidationError};
+use backend::geom::{PathBuilder, Rect, Size, Transform};
+use backend::image::{BitsPerComponent, CustomImage, Image, ImageColorspace};
+use backend::mask::{Mask, MaskType, TransferFunction};
+use backend::num::NormalizedF32;
+use backend::page::PageSettings;
+use backend::paint::{Fill, LinearGradient, MeshGradient, MeshPatch, SpreadMethod, Stop, SweepGradient};
+use backend::surface::Surface;
+use backend::{GroupColorSpace, SerializeSettings, Trapped};
+use craft_pdf::write::print::{self, PrintColor};
+use craft_pdf::write::{Metadata, WriteError, Writer, backend};
+use hayro_syntax::object::{Array, Dict, Name, Object, Stream};
+
+const CMYK_PROFILE: &[u8] = include_bytes!("../../cms/profiles/photocraft-coated-cmyk.icc");
+
+fn rect(surface: &mut Surface<'_>, x: f32, color: cmyk::Color, opacity: f32) {
+    let mut path = PathBuilder::new();
+    path.push_rect(Rect::from_xywh(x, 10.0, 40.0, 40.0).unwrap());
+    surface.set_fill(Some(Fill { paint: color.into(), opacity: NormalizedF32::new(opacity).unwrap(), ..Default::default() }));
+    surface.draw_path(&path.finish().unwrap());
+}
+
+fn k(value: u8) -> cmyk::Color {
+    cmyk::Color::new(0, 0, 0, value)
+}
+
+/// Page 1: opacity group, isolated multiply group, soft mask, fill opacity and (with
+/// `write-pdf`) a placed page. Page 2: opaque. Page 3: only the fill opacity of page 1, whose
+/// graphics state is already written.
+fn sample(settings: SerializeSettings, placed: Option<&[u8]>) -> Result<Vec<u8>, WriteError> {
+    let mut writer = Writer::new(settings, Metadata::default());
+    let page_settings = PageSettings::new(Size::from_wh(300.0, 60.0).unwrap());
+    {
+        let mut page = writer.document_mut().start_page_with(page_settings.clone());
+        let mut surface = page.surface();
+        rect(&mut surface, 0.0, cmyk::Color::new(255, 0, 0, 0), 1.0);
+        surface.push_opacity(NormalizedF32::new(0.5).unwrap());
+        rect(&mut surface, 20.0, k(255), 1.0);
+        surface.pop();
+        surface.push_isolated();
+        surface.push_blend_mode(backend::blend::BlendMode::Multiply);
+        rect(&mut surface, 60.0, cmyk::Color::new(0, 255, 0, 0), 1.0);
+        surface.pop();
+        surface.pop();
+        let mut builder = surface.stream_builder();
+        let mut mask_surface = builder.surface();
+        let mut path = PathBuilder::new();
+        path.push_rect(Rect::from_xywh(110.0, 10.0, 20.0, 40.0).unwrap());
+        mask_surface.set_fill(Some(Fill { paint: luma::Color::white().into(), ..Default::default() }));
+        mask_surface.draw_path(&path.finish().unwrap());
+        mask_surface.finish();
+        let stream = builder.finish();
+        surface.push_mask(Mask::new(stream, MaskType::Luminosity));
+        rect(&mut surface, 100.0, k(255), 1.0);
+        surface.pop();
+        rect(&mut surface, 150.0, k(255), 0.5);
+        #[cfg(feature = "write-pdf")]
+        if let Some(placed) = placed {
+            let pdf = backend::pdf::Pdf::new(Arc::new(placed.to_vec())).unwrap();
+            let doc = backend::pdf::PdfDocument::new(Arc::new(pdf));
+            surface.draw_pdf_page(&doc, Size::from_wh(60.0, 12.0).unwrap(), 0);
+        }
+        #[cfg(not(feature = "write-pdf"))]
+        let _ = placed;
+        surface.finish();
+        page.finish();
+    }
+    for page_index in [2, 3] {
+        let mut page = writer.document_mut().start_page_with(page_settings.clone());
+        let mut surface = page.surface();
+        rect(&mut surface, 150.0, k(255), if page_index == 3 { 0.5 } else { 1.0 });
+        surface.finish();
+        page.finish();
+    }
+    writer.finish()
+}
+
+fn cmyk_settings() -> SerializeSettings {
+    SerializeSettings { group_color_space: GroupColorSpace::Cmyk, ..Default::default() }
+}
+
+/// Every transparency group in the file, as (where, `/CS` family or `None`).
+#[derive(Debug, Default)]
+struct Groups {
+    pages: Vec<Option<Option<String>>>,
+    forms: Vec<Option<String>>,
+    masks: Vec<Option<String>>,
+}
+
+fn groups(bytes: &[u8]) -> Groups {
+    let pdf = hayro_syntax::Pdf::new(Arc::new(bytes.to_vec())).unwrap();
+    let mut out = Groups::default();
+    let mut seen = std::collections::HashSet::new();
+    for page in pdf.pages().iter() {
+        out.pages.push(page.raw().get::<Dict<'_>>(b"Group".as_slice()).map(|g| cs(&g)));
+        visit(&page.resources().x_objects, &page.resources().ext_g_states, &mut out, &mut seen);
+    }
+    out
+}
+
+fn visit(x_objects: &Dict<'_>, states: &Dict<'_>, out: &mut Groups, seen: &mut std::collections::HashSet<String>) {
+    let mut forms = Vec::new();
+    for key in x_objects.keys() {
+        if let Some(x) = x_objects.get::<Stream<'_>>(key.as_ref()) {
+            forms.push((x, false));
+        }
+    }
+    for key in states.keys() {
+        if let Some(mask) = states.get::<Dict<'_>>(key.as_ref()).and_then(|s| s.get::<Dict<'_>>(b"SMask".as_slice()))
+            && let Some(source) = mask.get::<Stream<'_>>(b"G".as_slice())
+        {
+            forms.push((source, true));
+        }
+    }
+    for (x, is_mask) in forms {
+        if !seen.insert(format!("{:?}", x.obj_id())) {
+            continue;
+        }
+        let dict = x.dict();
+        if let Some(group) = dict.get::<Dict<'_>>(b"Group".as_slice()) {
+            if is_mask { out.masks.push(cs(&group)) } else { out.forms.push(cs(&group)) }
+        }
+        if let Some(res) = dict.get::<Dict<'_>>(b"Resources".as_slice()) {
+            let sub = |key: &[u8]| res.get::<Dict<'_>>(key).unwrap_or_default();
+            visit(&sub(b"XObject"), &sub(b"ExtGState"), out, seen);
+        }
+    }
+}
+
+fn cs(group: &Dict<'_>) -> Option<String> {
+    assert_eq!(group.get::<Name<'_>>(b"S".as_slice()).unwrap().as_str(), "Transparency");
+    group.get::<Object<'_>>(b"CS".as_slice()).map(|cs| match cs {
+        Object::Name(name) => name.as_str().to_owned(),
+        Object::Array(array) => {
+            let array: Array<'_> = array;
+            let n = array.iter::<Object<'_>>().nth(1).and_then(|o| match o {
+                Object::Stream(s) => s.dict().get::<i32>(b"N".as_slice()),
+                _ => None,
+            });
+            format!("ICCBased(N={})", n.unwrap_or(0))
+        }
+        _ => "?".to_owned(),
+    })
+}
+
+/// A copy of the sample to place on page 1, written with the same settings.
+fn placed(settings: &SerializeSettings) -> Option<Vec<u8>> {
+    cfg!(feature = "write-pdf").then(|| sample(settings.clone(), None).unwrap())
+}
+
+/// Opacity, isolated and masked content groups; with `write-pdf` also the placed page's
+/// group and the three inside it.
+const FORMS: usize = if cfg!(feature = "write-pdf") { 7 } else { 3 };
+const MASKS: usize = if cfg!(feature = "write-pdf") { 2 } else { 1 };
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn rgb_default_names_rgb_on_every_group_and_writes_no_page_group() {
+    let settings = SerializeSettings::default();
+    assert_eq!(settings.group_color_space, GroupColorSpace::Rgb);
+    let groups = groups(&sample(settings.clone(), placed(&settings).as_deref()).unwrap());
+    assert_eq!(groups.pages, vec![None, None, None]);
+    assert_eq!(groups.forms, vec![Some("DeviceRGB".to_owned()); FORMS], "{groups:?}");
+    assert_eq!(groups.masks, vec![Some("DeviceRGB".to_owned()); MASKS], "{groups:?}");
+}
+
+/// Content groups and the placed page write no `/CS`; pages that blend (also only through a
+/// graphics state already written for page 1) get a DeviceCMYK page group; the soft-mask
+/// group names DeviceCMYK; nothing mentions DeviceRGB.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn cmyk_groups_inherit_a_cmyk_page_group_on_pages_that_blend() {
+    let settings = cmyk_settings();
+    let bytes = sample(settings.clone(), placed(&settings).as_deref()).unwrap();
+    let groups = groups(&bytes);
+    let cmyk_group = Some(Some("DeviceCMYK".to_owned()));
+    assert_eq!(groups.pages, vec![cmyk_group.clone(), None, cmyk_group], "{groups:?}");
+    assert_eq!(groups.forms, vec![None; FORMS], "{groups:?}");
+    assert_eq!(groups.masks, vec![Some("DeviceCMYK".to_owned()); MASKS], "{groups:?}");
+    assert!(!String::from_utf8_lossy(&bytes).contains("DeviceRGB"));
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn cmyk_groups_use_the_cmyk_profile_without_device_spaces() {
+    let settings =
+        SerializeSettings { no_device_cs: true, cmyk_profile: Some(backend::icc::ICCProfile::<4>::new(CMYK_PROFILE).unwrap()), ..cmyk_settings() };
+    let bytes = sample(settings.clone(), placed(&settings).as_deref()).unwrap();
+    let groups = groups(&bytes);
+    let icc = Some(Some("ICCBased(N=4)".to_owned()));
+    assert_eq!(groups.pages, vec![icc.clone(), None, icc], "{groups:?}");
+    assert_eq!(groups.forms, vec![None; FORMS], "{groups:?}");
+    assert_eq!(groups.masks, vec![Some("ICCBased(N=1)".to_owned()); MASKS], "{groups:?}");
+    assert!(!String::from_utf8_lossy(&bytes).contains("DeviceRGB"));
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn cmyk_groups_without_device_spaces_need_a_cmyk_profile() {
+    let settings = SerializeSettings { no_device_cs: true, ..cmyk_settings() };
+    let Err(WriteError::Serialization(error)) = sample(settings, None) else { panic!("expected an error") };
+    assert_eq!(*error, backend::error::KrillaError::MissingGroupCmykProfile);
+}
+
+/// Each page graphics state as its overprint and alpha entries, sorted.
+fn page_states(bytes: &[u8]) -> Vec<String> {
+    let pdf = hayro_syntax::Pdf::new(Arc::new(bytes.to_vec())).unwrap();
+    let page = pdf.pages().iter().next().unwrap();
+    let states = &page.resources().ext_g_states;
+    let mut out: Vec<String> = states
+        .keys()
+        .map(|key| {
+            let state = states.get::<Dict<'_>>(key.as_ref()).unwrap();
+            let mut entries = Vec::new();
+            for name in ["op", "OP"] {
+                if let Some(value) = state.get::<bool>(name.as_bytes()) {
+                    entries.push(format!("{name}={value}"));
+                }
+            }
+            if let Some(mode) = state.get::<i32>(b"OPM".as_slice()) {
+                entries.push(format!("OPM={mode}"));
+            }
+            for name in ["ca", "CA"] {
+                if let Some(value) = state.get::<f32>(name.as_bytes()) {
+                    entries.push(format!("{name}={value}"));
+                }
+            }
+            entries.join(" ")
+        })
+        .collect();
+    out.sort();
+    out
+}
+
+fn overprinted(settings: SerializeSettings, overprint: Overprint) -> Result<Vec<u8>, WriteError> {
+    let mut writer = Writer::new(settings, Metadata::default());
+    let mut page = writer.document_mut().start_page_with(PageSettings::new(Size::from_wh(300.0, 60.0).unwrap()));
+    let mut surface = page.surface();
+    surface.push_overprint(overprint);
+    rect(&mut surface, 0.0, k(255), 1.0);
+    surface.pop();
+    surface.finish();
+    page.finish();
+    writer.finish()
+}
+
+/// Every push writes `/op`, `/OP` and `/OPM`; a fill opacity and an opacity group pushed
+/// inside combine with it; an inner push replaces the outer one.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn overprint_writes_op_and_opm_and_combines_with_inner_state() {
+    let mut writer = Writer::new(SerializeSettings::default(), Metadata::default());
+    {
+        let mut page = writer.document_mut().start_page_with(PageSettings::new(Size::from_wh(300.0, 60.0).unwrap()));
+        let mut surface = page.surface();
+        surface.push_overprint(Overprint { fill: true, stroke: false, nonzero: true });
+        rect(&mut surface, 0.0, k(255), 1.0);
+        rect(&mut surface, 50.0, k(255), 0.5);
+        surface.push_opacity(NormalizedF32::new(0.25).unwrap());
+        rect(&mut surface, 100.0, k(255), 1.0);
+        surface.pop();
+        surface.push_overprint(Overprint { stroke: true, ..Default::default() });
+        rect(&mut surface, 150.0, k(255), 1.0);
+        surface.pop();
+        surface.pop();
+        surface.finish();
+        page.finish();
+    }
+    let bytes = writer.finish().unwrap();
+    assert_eq!(
+        page_states(&bytes),
+        vec!["op=false OP=true OPM=0", "op=true OP=false OPM=1", "op=true OP=false OPM=1 ca=0.25 CA=0.25", "op=true OP=false OPM=1 ca=0.5",]
+    );
+}
+
+/// PDF/A-2 and later forbid OPM 1 with overprint when CMYK is ICCBased, as it always is
+/// under PDF/A; OPM 0 is allowed.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn overprint_mode_one_is_a_pdf_a_error() {
+    let has_opm_error = |nonzero: bool| {
+        let settings = SerializeSettings {
+            configuration: craft_pdf::write::configuration(PdfVersion::Pdf17, Some(Archival::A2_B)).unwrap(),
+            cmyk_profile: Some(backend::icc::ICCProfile::<4>::new(CMYK_PROFILE).unwrap()),
+            ..Default::default()
+        };
+        let Err(WriteError::Serialization(error)) = overprinted(settings, Overprint { fill: true, stroke: false, nonzero }) else {
+            panic!("expected validation errors (the metadata is missing)")
+        };
+        let backend::error::KrillaError::Validation(errors) = *error else { panic!("expected validation errors") };
+        errors.iter().any(|(error, _)| matches!(error, ValidationError::OverprintModeIccCmyk(_)))
+    };
+    assert!(has_opm_error(true));
+    assert!(!has_opm_error(false));
+    assert!(overprinted(SerializeSettings::default(), Overprint { fill: true, stroke: true, nonzero: true }).is_ok());
+}
+
+/// Draws two overlapping rects in each of the nested groups (outermost first) and returns
+/// the page `/Group` `/CS` and, for each form from the outside in, `I=… K=… CS=…`.
+fn grouped(settings: SerializeSettings, nested: &[GroupOptions]) -> (Option<Option<String>>, Vec<String>) {
+    let mut writer = Writer::new(settings, Metadata::default());
+    {
+        let mut page = writer.document_mut().start_page_with(PageSettings::new(Size::from_wh(300.0, 60.0).unwrap()));
+        let mut surface = page.surface();
+        for options in nested {
+            surface.push_group(*options);
+            rect(&mut surface, 0.0, cmyk::Color::new(255, 0, 0, 0), 1.0);
+            rect(&mut surface, 20.0, k(255), 0.5);
+        }
+        for _ in nested {
+            surface.pop();
+        }
+        surface.finish();
+        page.finish();
+    }
+    let bytes = writer.finish().unwrap();
+    let pdf = hayro_syntax::Pdf::new(Arc::new(bytes)).unwrap();
+    let page = pdf.pages().iter().next().unwrap();
+    let page_group = page.raw().get::<Dict<'_>>(b"Group".as_slice()).map(|g| cs(&g));
+    let mut forms = Vec::new();
+    let mut x_objects = page.resources().x_objects.clone();
+    loop {
+        let keys: Vec<_> = x_objects.keys().collect();
+        let [key] = keys.as_slice() else { break };
+        let form = x_objects.get::<Stream<'_>>(key.as_ref()).unwrap();
+        let dict = form.dict();
+        let flag = |group: &Dict<'_>, key: &[u8]| group.get::<bool>(key).map_or("-".to_owned(), |b| b.to_string());
+        forms.push(match dict.get::<Dict<'_>>(b"Group".as_slice()) {
+            Some(group) => format!("I={} K={} CS={}", flag(&group, b"I"), flag(&group, b"K"), cs(&group).unwrap_or("-".to_owned())),
+            None => "no group".to_owned(),
+        });
+        x_objects = dict.get::<Dict<'_>>(b"Resources".as_slice()).and_then(|r| r.get::<Dict<'_>>(b"XObject".as_slice())).unwrap_or_default();
+    }
+    (page_group, forms)
+}
+
+const KNOCKOUT: GroupOptions = GroupOptions { isolated: false, knockout: true };
+const ISOLATED: GroupOptions = GroupOptions { isolated: true, knockout: false };
+const BOTH: GroupOptions = GroupOptions { isolated: true, knockout: true };
+
+/// A knockout group that is not isolated is still a transparency group: `/K true`, no `/I`,
+/// RGB `/CS` by default and no `/CS` under a CMYK page group.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn knockout_group_without_isolation_is_a_transparency_group() {
+    assert_eq!(grouped(SerializeSettings::default(), &[KNOCKOUT]), (None, vec!["I=- K=true CS=DeviceRGB".to_owned()]));
+    assert_eq!(grouped(cmyk_settings(), &[KNOCKOUT]), (Some(Some("DeviceCMYK".to_owned())), vec!["I=- K=true CS=-".to_owned()]));
+}
+
+/// `/I` and `/K` are set independently; `push_isolated` writes `/I` only.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn knockout_and_isolation_are_independent() {
+    assert_eq!(grouped(cmyk_settings(), &[BOTH]).1, vec!["I=true K=true CS=-"]);
+    assert_eq!(grouped(cmyk_settings(), &[ISOLATED]).1, vec!["I=true K=- CS=-"]);
+    assert_eq!(grouped(cmyk_settings(), &[GroupOptions::default()]).1, vec!["no group"]);
+}
+
+/// Nested groups each keep their own attributes.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn nested_groups_keep_their_own_attributes() {
+    assert_eq!(
+        grouped(SerializeSettings::default(), &[KNOCKOUT, ISOLATED, BOTH]).1,
+        vec!["I=- K=true CS=DeviceRGB", "I=true K=- CS=DeviceRGB", "I=true K=true CS=DeviceRGB"]
+    );
+}
+
+/// One page with a luminosity mask (white backdrop, sampled transfer curve) and an alpha mask
+/// (backdrop ignored, identity transfer).
+fn masked(settings: SerializeSettings) -> Vec<u8> {
+    let mut writer = Writer::new(settings, Metadata::default());
+    let mut page = writer.document_mut().start_page_with(PageSettings::new(Size::from_wh(200.0, 60.0).unwrap()));
+    let mut surface = page.surface();
+    let curve: Vec<NormalizedF32> = [0.0, 0.2, 1.0].iter().map(|v| NormalizedF32::new(*v).unwrap()).collect();
+    let masks = [(MaskType::Luminosity, TransferFunction::Sampled(curve), 0.0), (MaskType::Alpha, TransferFunction::Identity, 100.0)];
+    for (kind, transfer, x) in masks {
+        let mut builder = surface.stream_builder();
+        let mut mask_surface = builder.surface();
+        let mut path = PathBuilder::new();
+        path.push_rect(Rect::from_xywh(x + 10.0, 10.0, 20.0, 40.0).unwrap());
+        mask_surface.set_fill(Some(Fill { paint: luma::Color::black().into(), ..Default::default() }));
+        mask_surface.draw_path(&path.finish().unwrap());
+        mask_surface.finish();
+        let stream = builder.finish();
+        surface.push_mask(Mask::new(stream, kind).with_backdrop(luma::Color::white()).with_transfer(transfer));
+        rect(&mut surface, x, k(255), 1.0);
+        surface.pop();
+    }
+    surface.finish();
+    page.finish();
+    writer.finish().unwrap()
+}
+
+/// `(/S, /BC, /TR)` of each soft mask on page 1, `/TR` as `Identity` or `Type0 Size=n`.
+fn soft_masks(bytes: &[u8]) -> Vec<(String, Option<Vec<f32>>, Option<String>)> {
+    let pdf = hayro_syntax::Pdf::new(Arc::new(bytes.to_vec())).unwrap();
+    let page = &pdf.pages()[0];
+    let states = &page.resources().ext_g_states;
+    let mut out = Vec::new();
+    for key in states.keys() {
+        let Some(mask) = states.get::<Dict<'_>>(key.as_ref()).and_then(|s| s.get::<Dict<'_>>(b"SMask".as_slice())) else { continue };
+        let kind = mask.get::<Name<'_>>(b"S".as_slice()).unwrap().as_str().to_owned();
+        let backdrop = mask.get::<Array<'_>>(b"BC".as_slice()).map(|a| a.iter::<f32>().collect());
+        let transfer = mask.get::<Object<'_>>(b"TR".as_slice()).map(|tr| match tr {
+            Object::Name(name) => name.as_str().to_owned(),
+            Object::Stream(function) => {
+                let dict = function.dict();
+                let size: Vec<i32> = dict.get::<Array<'_>>(b"Size".as_slice()).unwrap().iter::<i32>().collect();
+                assert_eq!(dict.get::<i32>(b"BitsPerSample".as_slice()), Some(16));
+                assert_eq!(function.decoded().unwrap().len(), 2 * size[0] as usize);
+                format!("Type{} Size={}", dict.get::<i32>(b"FunctionType".as_slice()).unwrap(), size[0])
+            }
+            _ => "?".to_owned(),
+        });
+        out.push((kind, backdrop, transfer));
+    }
+    out.sort_by(|a, b| a.0.cmp(&b.0));
+    out
+}
+
+/// `/BC` has the components of the mask group's color space (RGB; under
+/// `GroupColorSpace::Cmyk`, CMYK, or gray with `no_device_cs`); an alpha mask gets no `/BC`; `/TR` is a Type 0 function or
+/// `/Identity`.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn soft_masks_write_backdrop_in_the_group_space_and_transfer() {
+    let profile = || Some(backend::icc::ICCProfile::<4>::new(CMYK_PROFILE).unwrap());
+    let cases = [
+        (SerializeSettings::default(), vec![1.0, 1.0, 1.0]),
+        (SerializeSettings { no_device_cs: true, ..Default::default() }, vec![1.0, 1.0, 1.0]),
+        (cmyk_settings(), vec![0.0, 0.0, 0.0, 0.0]),
+        (SerializeSettings { no_device_cs: true, cmyk_profile: profile(), ..cmyk_settings() }, vec![1.0]),
+    ];
+    for (settings, white) in cases {
+        let masks = soft_masks(&masked(settings));
+        assert_eq!(
+            masks,
+            vec![("Alpha".to_owned(), None, Some("Identity".to_owned())), ("Luminosity".to_owned(), Some(white), Some("Type0 Size=3".to_owned())),]
+        );
+    }
+}
+
+/// With an ICC CMYK page group, a luminosity mask hides the masked object wherever its content
+/// paints nothing: without `/BC`, and with a black `/BC` given as gray or as K 100%. Through a
+/// CMYK profile K 100% is not black, so a mask group in that space would leave the object
+/// showing there.
+#[cfg(feature = "raster")]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn icc_cmyk_luminosity_masks_hide_the_object_outside_their_content() {
+    use craft_pdf::interpret::InterpreterSettings;
+    use craft_pdf::raster::{self, Options, RenderCache};
+
+    let settings =
+        SerializeSettings { no_device_cs: true, cmyk_profile: Some(backend::icc::ICCProfile::<4>::new(CMYK_PROFILE).unwrap()), ..cmyk_settings() };
+    let mut writer = Writer::new(settings, Metadata::default());
+    let mut page = writer.document_mut().start_page_with(PageSettings::new(Size::from_wh(200.0, 60.0).unwrap()));
+    let mut surface = page.surface();
+    let backdrops: [Option<backend::color::RegularColor>; 3] = [None, Some(luma::Color::black().into()), Some(k(255).into())];
+    for (i, backdrop) in backdrops.into_iter().enumerate() {
+        let x = 60.0 * i as f32;
+        let mut builder = surface.stream_builder();
+        let mut mask_surface = builder.surface();
+        let mut path = PathBuilder::new();
+        path.push_rect(Rect::from_xywh(x + 10.0, 10.0, 20.0, 40.0).unwrap());
+        mask_surface.set_fill(Some(Fill { paint: luma::Color::white().into(), ..Default::default() }));
+        mask_surface.draw_path(&path.finish().unwrap());
+        mask_surface.finish();
+        let mut mask = Mask::new(builder.finish(), MaskType::Luminosity);
+        if let Some(backdrop) = backdrop {
+            mask = mask.with_backdrop(backdrop);
+        }
+        surface.push_mask(mask);
+        rect(&mut surface, x, k(255), 1.0);
+        surface.pop();
+    }
+    surface.finish();
+    page.finish();
+    let bytes = writer.finish().unwrap();
+
+    let doc = craft_pdf::open_slice(&bytes, None).unwrap();
+    let options = Options { background: [255; 4], ..Default::default() };
+    let raster = raster::render(&doc.pages()[0], &RenderCache::new(), &InterpreterSettings::default(), &options).unwrap();
+    assert_eq!((raster.width, raster.height), (200, 60));
+    let page = raster.bytes();
+    let red = |x: usize, y: usize| page[(y * 200 + x) * 4];
+    for i in 0..3 {
+        let x = 60 * i;
+        assert!(red(x + 20, 30) < 128, "mask {i}: the object shows inside the mask content");
+        assert_eq!((red(x + 5, 30), red(x + 35, 30)), (255, 255), "mask {i}: the object shows outside the mask content");
+    }
+}
+
+// DeviceN colors (`color::device_n`).
+
+fn spot(name: &str, alternate: cmyk::Color) -> Colorant {
+    Colorant::Spot { name: name.to_owned(), alternate }
+}
+
+fn gold() -> cmyk::Color {
+    cmyk::Color::new(0, 51, 255, 26)
+}
+
+/// One page with a fill in each color; returns the PDF or the writer's error.
+fn device_n_sample(settings: SerializeSettings, colors: Vec<backend::color::Color>) -> Result<Vec<u8>, WriteError> {
+    let mut writer = Writer::new(settings, Metadata::default());
+    let mut page = writer.document_mut().start_page_with(PageSettings::new(Size::from_wh(300.0, 60.0).unwrap()));
+    let mut surface = page.surface();
+    for (i, color) in colors.into_iter().enumerate() {
+        let mut path = PathBuilder::new();
+        path.push_rect(Rect::from_xywh(10.0 + 50.0 * i as f32, 10.0, 40.0, 40.0).unwrap());
+        surface.set_fill(Some(Fill { paint: color.into(), ..Default::default() }));
+        surface.draw_path(&path.finish().unwrap());
+    }
+    surface.finish();
+    page.finish();
+    writer.finish()
+}
+
+fn device_n(colorants: Vec<Colorant>, tints: Vec<u8>) -> backend::color::Color {
+    device_n::Color::new(tints, DeviceNSpace::new(colorants).unwrap()).unwrap().into()
+}
+
+/// The page's DeviceN color space arrays, as (names, alternate, tint transform, attributes).
+fn device_n_spaces(bytes: &[u8], mut each: impl FnMut(Vec<String>, Object<'_>, Stream<'_>, Option<Dict<'_>>)) {
+    let pdf = hayro_syntax::Pdf::new(Arc::new(bytes.to_vec())).unwrap();
+    let page = pdf.pages().iter().next().unwrap();
+    let spaces = &page.resources().color_spaces;
+    for key in spaces.keys() {
+        let array = spaces.get::<Array<'_>>(key.as_ref()).unwrap();
+        let mut items = array.iter::<Object<'_>>();
+        let Some(Object::Name(family)) = items.next() else { panic!("color space without a family") };
+        if family.as_str() != "DeviceN" {
+            continue;
+        }
+        let Some(Object::Array(names)) = items.next() else { panic!("DeviceN without names") };
+        let names = names.iter::<Name<'_>>().map(|n| n.as_str().to_owned()).collect();
+        let alternate = items.next().unwrap();
+        let Some(Object::Stream(tint)) = items.next() else { panic!("DeviceN tint transform is not a stream") };
+        assert_eq!(tint.dict().get::<i32>(b"FunctionType".as_slice()), Some(4));
+        let attrs = items.next().map(|a| match a {
+            Object::Dict(d) => d,
+            _ => panic!("DeviceN attributes are not a dictionary"),
+        });
+        each(names, alternate, tint, attrs);
+    }
+}
+
+fn family(cs: &Object<'_>) -> String {
+    match cs {
+        Object::Name(n) => n.as_str().to_owned(),
+        Object::Array(a) => a.iter::<Name<'_>>().next().map(|n| n.as_str().to_owned()).unwrap_or_default(),
+        _ => "?".to_owned(),
+    }
+}
+
+/// The tint transform evaluated by hayro on the given tints.
+#[cfg(feature = "interpret")]
+fn evaluate(tint: &Stream<'_>, tints: Vec<f32>) -> Vec<f32> {
+    let function = hayro_interpret::Function::new(&Object::Stream(tint.clone())).unwrap();
+    function.eval(tints.into()).unwrap().iter().map(|v| (v * 100.0).round() / 100.0).collect()
+}
+
+/// [Cyan Black] needs no attributes; its tint transform passes the tints to C and K.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn device_n_process_fill_maps_tints_to_their_cmyk_components() {
+    let color = device_n(vec![Colorant::Process(Process::Cyan), Colorant::Process(Process::Black)], vec![153, 102]);
+    let bytes = device_n_sample(cmyk_settings(), vec![color]).unwrap();
+    let mut found = 0;
+    device_n_spaces(&bytes, |names, alternate, _tint, attrs| {
+        found += 1;
+        assert_eq!(names, ["Cyan", "Black"]);
+        assert_eq!(family(&alternate), "DeviceCMYK");
+        assert!(attrs.is_none());
+        #[cfg(feature = "interpret")]
+        assert_eq!(evaluate(&_tint, vec![0.6, 0.4]), [0.6, 0.0, 0.0, 0.4]);
+    });
+    assert_eq!(found, 1);
+}
+
+/// Spot and process mixed: an NChannel space whose `/Colorants` holds the spot's
+/// Separation and whose `/Process` names the alternate space; with `no_device_cs` both use
+/// the `cmyk_profile` ICC space.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn device_n_mixing_spots_and_process_writes_nchannel_attributes() {
+    let icc =
+        SerializeSettings { no_device_cs: true, cmyk_profile: Some(backend::icc::ICCProfile::<4>::new(CMYK_PROFILE).unwrap()), ..cmyk_settings() };
+    for (settings, alternate_family) in [(cmyk_settings(), "DeviceCMYK"), (icc, "ICCBased")] {
+        let color = device_n(vec![Colorant::Process(Process::Cyan), spot("Gold", gold())], vec![255, 128]);
+        let bytes = device_n_sample(settings, vec![color]).unwrap();
+        let mut found = 0;
+        device_n_spaces(&bytes, |names, alternate, _tint, attrs| {
+            found += 1;
+            assert_eq!(names, ["Cyan", "Gold"]);
+            assert_eq!(family(&alternate), alternate_family);
+            let attrs = attrs.expect("attributes");
+            assert_eq!(attrs.get::<Name<'_>>(b"Subtype".as_slice()).unwrap().as_str(), "NChannel");
+            let colorants = attrs.get::<Dict<'_>>(b"Colorants".as_slice()).unwrap();
+            assert_eq!(colorants.keys().count(), 1);
+            let gold = colorants.get::<Array<'_>>(b"Gold".as_slice()).unwrap();
+            let gold: Vec<Object<'_>> = gold.iter::<Object<'_>>().collect();
+            assert_eq!(family(&gold[0]), "Separation");
+            assert!(matches!(&gold[1], Object::Name(n) if n.as_str() == "Gold"));
+            assert_eq!(family(&gold[2]), alternate_family);
+            let process = attrs.get::<Dict<'_>>(b"Process".as_slice()).unwrap();
+            assert_eq!(family(&process.get::<Object<'_>>(b"ColorSpace".as_slice()).unwrap()), alternate_family);
+            let components: Vec<String> =
+                process.get::<Array<'_>>(b"Components".as_slice()).unwrap().iter::<Name<'_>>().map(|n| n.as_str().to_owned()).collect();
+            assert_eq!(components, ["Cyan", "Magenta", "Yellow", "Black"]);
+            // Gold at 50% (M 0.1, Y 0.5, K 0.05) over full cyan.
+            #[cfg(feature = "interpret")]
+            assert_eq!(evaluate(&_tint, vec![1.0, 0.5]), [1.0, 0.1, 0.5, 0.05]);
+        });
+        assert_eq!(found, 1);
+    }
+}
+
+/// NChannel's `/Subtype` and `/Process` are PDF 1.6: a 1.4 file (PDF/X-1a) gets only
+/// `/Colorants`, a 1.7 file the NChannel attributes.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn device_n_attributes_follow_the_pdf_version() {
+    for version in [PdfVersion::Pdf14, PdfVersion::Pdf17] {
+        let settings = SerializeSettings {
+            configuration: craft_pdf::write::configuration(version, None).unwrap(),
+            compress_content_streams: false,
+            ..cmyk_settings()
+        };
+        let color = device_n(vec![Colorant::Process(Process::Cyan), spot("Gold", gold())], vec![255, 128]);
+        let bytes = device_n_sample(settings, vec![color]).unwrap();
+        let nchannel = version >= PdfVersion::Pdf16;
+        assert_eq!(bytes.windows(8).any(|w| w == b"NChannel"), nchannel, "{version:?}");
+        let mut found = 0;
+        device_n_spaces(&bytes, |_, _, _, attrs| {
+            found += 1;
+            let attrs = attrs.expect("attributes");
+            assert!(attrs.get::<Dict<'_>>(b"Colorants".as_slice()).unwrap().get::<Array<'_>>(b"Gold".as_slice()).is_some());
+            assert_eq!(attrs.contains_key(b"Subtype".as_slice()), nchannel, "{version:?}");
+            assert_eq!(attrs.contains_key(b"Process".as_slice()), nchannel, "{version:?}");
+        });
+        assert_eq!(found, 1);
+    }
+}
+
+/// A spot name keeps one alternate across Separation and DeviceN; PDF/A-2 rejects a second.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn device_n_spot_alternate_must_match_its_separation_fallback() {
+    use backend::color::separation::{self, SeparationColorant, SeparationSpace};
+    use backend::configure::{Archival, ConfigurationBuilder, ValidationError};
+    let settings = SerializeSettings {
+        configuration: ConfigurationBuilder::new().with_archival_validator(Archival::A2_B).finish().unwrap(),
+        ..Default::default()
+    };
+    let separation = |alternate: cmyk::Color| -> backend::color::Color {
+        separation::Color::new(255, SeparationSpace::new(SeparationColorant::Custom("Gold".to_owned()), alternate.into())).into()
+    };
+    let gold_device_n = || device_n(vec![spot("Gold", gold()), Colorant::Process(Process::Black)], vec![255, 255]);
+    let inconsistent = |colors| match device_n_sample(settings.clone(), colors) {
+        Err(WriteError::Serialization(error)) => match *error {
+            backend::error::KrillaError::Validation(errors) => {
+                errors.iter().any(|(e, _)| *e == ValidationError::InconsistentSeparationFallback(SeparationColorant::Custom("Gold".to_owned())))
+            }
+            other => panic!("unexpected error {other:?}"),
+        },
+        Err(other) => panic!("unexpected error {other:?}"),
+        Ok(_) => false,
+    };
+    assert!(!inconsistent(vec![separation(gold()), gold_device_n()]));
+    assert!(inconsistent(vec![separation(cmyk::Color::new(0, 40, 255, 0)), gold_device_n()]));
+    assert!(inconsistent(vec![gold_device_n(), device_n(vec![spot("Gold", cmyk::Color::new(0, 0, 255, 0))], vec![255])]));
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn device_n_space_rejects_bad_colorant_lists() {
+    assert!(DeviceNSpace::new([]).is_none());
+    assert!(DeviceNSpace::new([Colorant::Process(Process::Cyan), Colorant::Process(Process::Cyan)]).is_none());
+    assert!(DeviceNSpace::new([spot("Black", gold())]).is_none());
+    assert!(DeviceNSpace::new([spot("All", gold())]).is_none());
+    let space = DeviceNSpace::new([spot("Gold", gold())]).unwrap();
+    assert!(device_n::Color::new(vec![1, 2], space).is_none());
+}
+
+// DeviceN images and shadings.
+
+#[derive(Clone, Hash)]
+struct Samples {
+    data: Vec<u8>,
+    size: (u32, u32),
+    space: ImageColorspace,
+    device_n: Option<DeviceNSpace>,
+}
+
+impl CustomImage for Samples {
+    fn color_channel(&self) -> &[u8] {
+        &self.data
+    }
+    fn alpha_channel(&self) -> Option<&[u8]> {
+        None
+    }
+    fn bits_per_component(&self) -> BitsPerComponent {
+        BitsPerComponent::Eight
+    }
+    fn size(&self) -> (u32, u32) {
+        self.size
+    }
+    fn icc_profile(&self) -> Option<&[u8]> {
+        None
+    }
+    fn color_space(&self) -> ImageColorspace {
+        self.space
+    }
+    fn device_n_space(&self) -> Option<DeviceNSpace> {
+        self.device_n.clone()
+    }
+}
+
+/// One page drawn by `draw`, written with CMYK blending.
+fn page_with(draw: impl FnOnce(&mut Surface<'_>)) -> Vec<u8> {
+    let mut writer = Writer::new(cmyk_settings(), Metadata::default());
+    let mut page = writer.document_mut().start_page_with(PageSettings::new(Size::from_wh(300.0, 60.0).unwrap()));
+    let mut surface = page.surface();
+    draw(&mut surface);
+    surface.finish();
+    page.finish();
+    writer.finish().unwrap()
+}
+
+/// The names of a Separation (one) or DeviceN color space array; the family for others.
+fn colorant_names(cs: &Object<'_>) -> (String, Vec<String>) {
+    let Object::Array(array) = cs else { return (family(cs), Vec::new()) };
+    let items: Vec<Object<'_>> = array.iter::<Object<'_>>().collect();
+    let names = match items.get(1) {
+        Some(Object::Name(n)) => vec![n.as_str().to_owned()],
+        Some(Object::Array(names)) => names.iter::<Name<'_>>().map(|n| n.as_str().to_owned()).collect(),
+        _ => Vec::new(),
+    };
+    (family(cs), names)
+}
+
+/// A [Black Gold] duotone: the image's `/ColorSpace` is the DeviceN space, with two 8-bit
+/// samples a pixel in colorant order.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn device_n_image_writes_one_sample_per_colorant() {
+    let space = DeviceNSpace::new([Colorant::Process(Process::Black), spot("Gold", gold())]).unwrap();
+    let data = vec![0, 0, 128, 64, 255, 153];
+    let image =
+        Image::from_custom(Samples { data: data.clone(), size: (3, 1), space: ImageColorspace::DeviceN, device_n: Some(space) }, false).unwrap();
+    let bytes = page_with(|surface| surface.draw_image(image, Size::from_wh(30.0, 10.0).unwrap()));
+    let pdf = hayro_syntax::Pdf::new(Arc::new(bytes)).unwrap();
+    let page = pdf.pages().iter().next().unwrap();
+    let x_objects = &page.resources().x_objects;
+    let mut found = 0;
+    for key in x_objects.keys() {
+        let image = x_objects.get::<Stream<'_>>(key.as_ref()).unwrap();
+        let dict = image.dict();
+        assert_eq!(dict.get::<Name<'_>>(b"Subtype".as_slice()).unwrap().as_str(), "Image");
+        found += 1;
+        let cs = dict.get::<Object<'_>>(b"ColorSpace".as_slice()).unwrap();
+        assert_eq!(colorant_names(&cs), ("DeviceN".to_owned(), vec!["Black".to_owned(), "Gold".to_owned()]));
+        assert_eq!(dict.get::<i32>(b"BitsPerComponent".as_slice()), Some(8));
+        assert_eq!((dict.get::<i32>(b"Width".as_slice()), dict.get::<i32>(b"Height".as_slice())), (Some(3), Some(1)));
+        assert_eq!(image.decoded().unwrap().as_ref(), data.as_slice());
+    }
+    assert_eq!(found, 1);
+}
+
+/// `Image::from_custom` refuses channel data that doesn't match the dimensions, and dimensions
+/// whose channel length overflows, instead of panicking when the page is written.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn custom_image_with_mismatched_or_huge_dimensions_is_refused() {
+    let cmyk = |data: Vec<u8>, size| Samples { data, size, space: ImageColorspace::Cmyk, device_n: None };
+    assert!(Image::from_custom(cmyk(vec![0; 3], (1, 1)), false).is_err());
+    assert!(Image::from_custom(cmyk(vec![0; 4], (u32::MAX, u32::MAX)), false).is_err());
+    assert!(Image::from_custom(cmyk(vec![0; 4], (1, 1)), false).is_ok());
+}
+
+/// A DeviceN image needs its space from `CustomImage::device_n_space`.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn device_n_image_without_a_space_is_refused() {
+    let image = Samples { data: vec![0; 6], size: (3, 1), space: ImageColorspace::DeviceN, device_n: None };
+    assert!(Image::from_custom(image, false).is_err());
+}
+
+/// A shading's color space family and colorant names, function `/Range` length and
+/// function `/Domain`.
+type ShadingSummary = ((String, Vec<String>), usize, Vec<f32>);
+
+/// Each shading on the page.
+fn shadings(bytes: &[u8]) -> Vec<ShadingSummary> {
+    let pdf = hayro_syntax::Pdf::new(Arc::new(bytes.to_vec())).unwrap();
+    let page = pdf.pages().iter().next().unwrap();
+    let patterns = &page.resources().patterns;
+    let mut out = Vec::new();
+    for key in patterns.keys() {
+        let pattern = patterns.get::<Dict<'_>>(key.as_ref()).unwrap();
+        let shading = pattern.get::<Dict<'_>>(b"Shading".as_slice()).unwrap();
+        let cs = shading.get::<Object<'_>>(b"ColorSpace".as_slice()).unwrap();
+        let function = match shading.get::<Object<'_>>(b"Function".as_slice()).unwrap() {
+            Object::Dict(d) => d,
+            Object::Stream(s) => s.dict().clone(),
+            _ => panic!("shading function is not a dictionary or stream"),
+        };
+        let floats = |key: &[u8]| -> Vec<f32> { function.get::<Array<'_>>(key).unwrap().iter::<f32>().collect() };
+        out.push((colorant_names(&cs), floats(b"Range").len(), floats(b"Domain")));
+    }
+    out.sort_by(|a, b| a.0.cmp(&b.0));
+    out
+}
+
+fn stops(colors: [backend::color::Color; 2]) -> Vec<Stop> {
+    let [a, b] = colors;
+    vec![
+        Stop { offset: NormalizedF32::ZERO, color: a, opacity: NormalizedF32::ONE },
+        Stop { offset: NormalizedF32::ONE, color: b, opacity: NormalizedF32::ONE },
+    ]
+}
+
+fn fill_rect(surface: &mut Surface<'_>, x: f32, paint: backend::paint::Paint) {
+    let mut path = PathBuilder::new();
+    path.push_rect(Rect::from_xywh(x, 10.0, 40.0, 40.0).unwrap());
+    surface.set_fill(Some(Fill { paint, ..Default::default() }));
+    surface.draw_path(&path.finish().unwrap());
+}
+
+fn linear(colors: [backend::color::Color; 2]) -> backend::paint::Paint {
+    LinearGradient {
+        x1: 0.0,
+        y1: 0.0,
+        x2: 40.0,
+        y2: 0.0,
+        transform: Transform::identity(),
+        spread_method: SpreadMethod::Pad,
+        stops: stops(colors),
+        anti_alias: false,
+    }
+    .into()
+}
+
+/// Stops mixing a spot with process colors (linear: exponential function; sweep:
+/// PostScript function) become DeviceN shadings with one function output per colorant; pure
+/// CMYK stays DeviceCMYK.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn device_n_shading_mixes_a_spot_with_process_colors() {
+    use backend::color::separation::{self, SeparationColorant, SeparationSpace};
+    let gold_spot = || -> backend::color::Color {
+        separation::Color::new(255, SeparationSpace::new(SeparationColorant::Custom("Gold".to_owned()), gold().into())).into()
+    };
+    let cyan: backend::color::Color = cmyk::Color::new(255, 0, 0, 0).into();
+    let bytes = page_with(|surface| {
+        fill_rect(surface, 0.0, linear([gold_spot(), cyan.clone()]));
+        let sweep = SweepGradient {
+            cx: 70.0,
+            cy: 30.0,
+            start_angle: 0.0,
+            end_angle: 360.0,
+            transform: Transform::identity(),
+            spread_method: SpreadMethod::Pad,
+            stops: stops([gold_spot(), luma::Color::black().into()]),
+            anti_alias: false,
+        };
+        fill_rect(surface, 50.0, sweep.into());
+        fill_rect(surface, 100.0, linear([cyan.clone(), k(255).into()]));
+    });
+    let names = |v: &[&str]| v.iter().map(|s| (*s).to_owned()).collect::<Vec<_>>();
+    let found = shadings(&bytes);
+    assert_eq!(found.len(), 3, "{found:?}");
+    assert_eq!(found[0], (("DeviceCMYK".to_owned(), vec![]), 8, vec![0.0, 1.0]));
+    assert_eq!(found[1].0, ("DeviceN".to_owned(), names(&["Black", "Gold"])));
+    assert_eq!(found[1].1, 4, "sweep: one range pair per colorant");
+    assert_eq!(found[1].2.len(), 4, "sweep: the function's domain is the bounding box");
+    assert_eq!(found[2], (("DeviceN".to_owned(), names(&["Cyan", "Gold"])), 4, vec![0.0, 1.0]));
+}
+
+/// A spot to paper (CMYK 0 or a spot at tint 0) stays a Separation shading.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn device_n_shading_keeps_a_spot_to_paper_as_separation() {
+    use backend::color::separation::{self, SeparationColorant, SeparationSpace};
+    let gold_spot = |tint| -> backend::color::Color {
+        separation::Color::new(tint, SeparationSpace::new(SeparationColorant::Custom("Gold".to_owned()), gold().into())).into()
+    };
+    let bytes = page_with(|surface| {
+        fill_rect(surface, 0.0, linear([gold_spot(255), cmyk::Color::new(0, 0, 0, 0).into()]));
+        fill_rect(surface, 50.0, linear([gold_spot(128), gold_spot(0)]));
+    });
+    let found = shadings(&bytes);
+    assert_eq!(found.len(), 2, "{found:?}");
+    for (cs, range, domain) in found {
+        assert_eq!(cs, ("Separation".to_owned(), vec!["Gold".to_owned()]));
+        assert_eq!((range, domain), (2, vec![0.0, 1.0]));
+    }
+}
+
+// Mesh gradients (`paint::MeshGradient`, Type 6 shadings).
+
+/// A square Coons patch with straight edges, corners clockwise from the top left at (x, y).
+fn square(x: f32, y: f32, size: f32, colors: [backend::color::Color; 4], opacities: [f32; 4]) -> MeshPatch {
+    let corners = [(x, y), (x + size, y), (x + size, y + size), (x, y + size)];
+    let mut points = [(0.0, 0.0); 12];
+    for (i, &(ax, ay)) in corners.iter().enumerate() {
+        let (bx, by) = corners[(i + 1) % 4];
+        for step in 0..3 {
+            let t = step as f32 / 3.0;
+            points[3 * i + step] = (ax + (bx - ax) * t, ay + (by - ay) * t);
+        }
+    }
+    MeshPatch { points, colors, opacities: opacities.map(|o| NormalizedF32::new(o).unwrap()) }
+}
+
+fn mesh(patches: Vec<MeshPatch>) -> backend::paint::Paint {
+    MeshGradient { patches, transform: Transform::identity(), anti_alias: false }.into()
+}
+
+/// Each Type 6 shading in the file: color space family and colorant names, components a
+/// corner (from `/Decode`), and the corner color bytes of each patch.
+type MeshSummary = ((String, Vec<String>), usize, Vec<Vec<u8>>);
+
+fn mesh_shadings(bytes: &[u8]) -> Vec<MeshSummary> {
+    let pdf = hayro_syntax::Pdf::new(Arc::new(bytes.to_vec())).unwrap();
+    let mut out = Vec::new();
+    for object in pdf.objects() {
+        let Object::Stream(stream) = object else { continue };
+        let dict = stream.dict();
+        if dict.get::<i32>(b"ShadingType".as_slice()) != Some(6) {
+            continue;
+        }
+        assert_eq!(dict.get::<i32>(b"BitsPerCoordinate".as_slice()), Some(32));
+        assert_eq!(dict.get::<i32>(b"BitsPerComponent".as_slice()), Some(8));
+        assert_eq!(dict.get::<i32>(b"BitsPerFlag".as_slice()), Some(8));
+        let cs = dict.get::<Object<'_>>(b"ColorSpace".as_slice()).unwrap();
+        let decode = dict.get::<Array<'_>>(b"Decode".as_slice()).unwrap().iter::<f32>().count();
+        let components = (decode - 4) / 2;
+        let data = stream.decoded().unwrap();
+        let patch_len = 1 + 12 * 8 + 4 * components;
+        assert_eq!(data.len() % patch_len, 0, "whole patches of {components} components a corner");
+        let corners = data.chunks(patch_len).map(|patch| patch[1 + 12 * 8..].to_vec()).collect();
+        out.push((colorant_names(&cs), components, corners));
+    }
+    out.sort_by(|a, b| a.0.cmp(&b.0));
+    out
+}
+
+fn gold_spot(tint: u8) -> backend::color::Color {
+    use backend::color::separation::{self, SeparationColorant, SeparationSpace};
+    separation::Color::new(tint, SeparationSpace::new(SeparationColorant::Custom("Gold".to_owned()), gold().into())).into()
+}
+
+/// Mesh corner colors follow the gradient stop rule across every patch: CMYK, gray and a
+/// spot become one DeviceN space with process colorants first, so a later patch's spot is
+/// written as itself. Corner opacities below 1 add the same mesh in gray as a soft mask.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn mesh_mixing_process_and_spot_corners_is_a_device_n_shading() {
+    let cyan = || -> backend::color::Color { cmyk::Color::new(255, 0, 0, 0).into() };
+    let paper = || -> backend::color::Color { cmyk::Color::new(0, 0, 0, 0).into() };
+    let patches = |opacity: f32| {
+        vec![
+            square(10.0, 10.0, 40.0, [cyan(), cyan(), luma::Color::black().into(), paper()], [1.0; 4]),
+            square(50.0, 10.0, 40.0, [gold_spot(255), gold_spot(128), cyan(), cyan()], [1.0, 1.0, 1.0, opacity]),
+        ]
+    };
+    let names = |v: &[&str]| v.iter().map(|s| (*s).to_owned()).collect::<Vec<_>>();
+    let expected = vec![vec![255, 0, 0, 255, 0, 0, 0, 255, 0, 0, 0, 0], vec![0, 0, 255, 0, 0, 128, 255, 0, 0, 255, 0, 0]];
+
+    let opaque = page_with(|surface| fill_rect(surface, 0.0, mesh(patches(1.0))));
+    assert_eq!(mesh_shadings(&opaque), vec![(("DeviceN".to_owned(), names(&["Cyan", "Black", "Gold"])), 3, expected.clone())]);
+
+    let translucent = page_with(|surface| fill_rect(surface, 0.0, mesh(patches(0.5))));
+    let found = mesh_shadings(&translucent);
+    assert_eq!(found.len(), 2, "{found:?}");
+    assert_eq!(found[0], (("DeviceGray".to_owned(), vec![]), 1, vec![vec![255; 4], vec![255, 255, 255, 128]]));
+    assert_eq!(found[1], (("DeviceN".to_owned(), names(&["Cyan", "Black", "Gold"])), 3, expected));
+    assert_eq!(soft_masks(&translucent).len(), 1);
+}
+
+/// RGB corners can't share a space with CMYK ones: the document fails instead of writing
+/// one patch's colors in the other's space.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn mesh_mixing_rgb_and_cmyk_corners_is_refused() {
+    let red: backend::color::Color = backend::color::rgb::Color::new(255, 0, 0).into();
+    let cyan: backend::color::Color = cmyk::Color::new(255, 0, 0, 0).into();
+    let patches = vec![
+        square(10.0, 10.0, 40.0, [red.clone(), red.clone(), red.clone(), red.clone()], [1.0; 4]),
+        square(50.0, 10.0, 40.0, [cyan.clone(), cyan.clone(), red.clone(), red], [1.0; 4]),
+    ];
+    let mut writer = Writer::new(cmyk_settings(), Metadata::default());
+    let mut page = writer.document_mut().start_page_with(PageSettings::new(Size::from_wh(300.0, 60.0).unwrap()));
+    let mut surface = page.surface();
+    fill_rect(&mut surface, 0.0, mesh(patches));
+    surface.finish();
+    page.finish();
+    let Err(WriteError::Serialization(error)) = writer.finish() else { panic!("a mixed RGB and CMYK mesh was written") };
+    assert!(matches!(*error, backend::error::KrillaError::MixedMeshColorSpaces(_)), "{error:?}");
+}
+
+/// A mesh in one color space is written in that space, three bytes a corner for RGB.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn rgb_mesh_is_a_device_rgb_shading() {
+    let rgb = |r, g, b| -> backend::color::Color { backend::color::rgb::Color::new(r, g, b).into() };
+    let patch = square(10.0, 10.0, 40.0, [rgb(255, 0, 0), rgb(0, 255, 0), rgb(0, 0, 255), rgb(255, 255, 255)], [1.0; 4]);
+    let bytes = page_with(|surface| fill_rect(surface, 0.0, mesh(vec![patch])));
+    let corners = vec![vec![255, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 255]];
+    assert_eq!(mesh_shadings(&bytes), vec![(("DeviceRGB".to_owned(), vec![]), 3, corners)]);
+}
+
+const FOGRA39: &[u8] = include_bytes!("../../cms/profiles/craft-coated-fogra39.icc");
+
+fn text(dict: &Dict<'_>, key: &[u8]) -> Option<String> {
+    dict.get::<hayro_syntax::object::String<'_>>(key).map(|s| String::from_utf8_lossy(s.as_bytes()).into_owned())
+}
+
+/// One `/OutputIntents` entry.
+#[derive(Debug)]
+struct Intent {
+    subtype: String,
+    identifier: Option<String>,
+    registry: Option<String>,
+    /// The `/DestOutputProfile` object and its decoded bytes.
+    profile_object: String,
+    profile: Vec<u8>,
+}
+
+fn output_intents(bytes: &[u8]) -> Vec<Intent> {
+    let pdf = hayro_syntax::Pdf::new(Arc::new(bytes.to_vec())).unwrap();
+    let catalog = pdf.xref().get::<Dict<'_>>(pdf.xref().root_id()).unwrap();
+    let Some(intents) = catalog.get::<Array<'_>>(b"OutputIntents".as_slice()) else { return Vec::new() };
+    intents
+        .iter::<Dict<'_>>()
+        .map(|intent| {
+            let profile = intent.get::<Stream<'_>>(b"DestOutputProfile".as_slice()).unwrap();
+            Intent {
+                subtype: intent.get::<Name<'_>>(b"S".as_slice()).unwrap().as_str().to_owned(),
+                identifier: text(&intent, b"OutputConditionIdentifier"),
+                registry: text(&intent, b"RegistryName"),
+                profile_object: format!("{:?}", profile.obj_id()),
+                profile: profile.decoded().unwrap().into_owned(),
+            }
+        })
+        .collect()
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn print_settings_blend_in_cmyk_and_name_the_profile_as_the_output_intent() {
+    let settings = print::settings(PrintColor::fogra39(FOGRA39)).unwrap();
+    assert!(!settings.no_device_cs);
+    assert_eq!(settings.group_color_space, GroupColorSpace::Cmyk);
+    assert_eq!(settings.trapped, Some(Trapped::False));
+    assert_eq!(settings.pdfx_version, None);
+    let intent = settings.output_intent.as_ref().unwrap();
+    assert_eq!((intent.condition_identifier.as_str(), intent.registry_name.as_deref()), ("FOGRA39", Some("http://www.color.org")));
+
+    let bytes = sample(settings.clone(), placed(&settings).as_deref()).unwrap();
+    let cmyk_group = Some(Some("DeviceCMYK".to_owned()));
+    assert_eq!(groups(&bytes).pages, vec![cmyk_group.clone(), None, cmyk_group]);
+    let intents = output_intents(&bytes);
+    assert_eq!(intents.len(), 1);
+    let intent = &intents[0];
+    assert_eq!(
+        (intent.subtype.as_str(), intent.identifier.as_deref(), intent.registry.as_deref()),
+        ("GTS_PDFX", Some("FOGRA39"), Some("http://www.color.org"))
+    );
+    assert!(intent.profile == FOGRA39, "the output intent embeds the given profile");
+    let text = String::from_utf8_lossy(&bytes);
+    assert!(text.contains("/Trapped/False") && text.contains("<pdf:Trapped>False</pdf:Trapped>"));
+    assert!(!text.contains("GTS_PDFXVersion"));
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn cmyk_blending_writes_no_output_intent_or_trapped() {
+    let settings = print::cmyk_blending(FOGRA39).unwrap();
+    assert_eq!(settings.group_color_space, GroupColorSpace::Cmyk);
+    assert!(settings.output_intent.is_none() && settings.trapped.is_none());
+
+    let bytes = sample(settings.clone(), placed(&settings).as_deref()).unwrap();
+    let cmyk_group = Some(Some("DeviceCMYK".to_owned()));
+    assert_eq!(groups(&bytes).pages, vec![cmyk_group.clone(), None, cmyk_group]);
+    assert!(output_intents(&bytes).is_empty());
+    assert!(!String::from_utf8_lossy(&bytes).contains("Trapped"));
+    assert!(matches!(print::cmyk_blending(b"not a profile"), Err(WriteError::InvalidProfile)));
+}
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn print_settings_reject_a_profile_that_is_not_cmyk() {
+    assert!(matches!(print::settings(PrintColor::fogra39(b"not a profile")), Err(WriteError::InvalidProfile)));
+}
+
+/// `/Trapped` (`Unknown` included) and `GTS_PDFXVersion` go to the information dictionary and
+/// to XMP, `GTS_PDFXConformance` to the dictionary only; without settings none appears.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn trapped_and_pdfx_version_are_written_to_info_and_xmp() {
+    let settings = SerializeSettings {
+        trapped: Some(Trapped::True),
+        pdfx_version: Some("PDF/X-1:2003".to_owned()),
+        pdfx_conformance: Some("PDF/X-1a:2003".to_owned()),
+        ..Default::default()
+    };
+    let marked = String::from_utf8_lossy(&sample(settings, None).unwrap()).into_owned();
+    assert!(marked.contains("/Trapped/True"), "Info /Trapped");
+    assert!(marked.contains("/GTS_PDFXVersion(PDF/X-1:2003)"), "Info /GTS_PDFXVersion");
+    assert!(marked.contains("/GTS_PDFXConformance(PDF/X-1a:2003)"), "Info /GTS_PDFXConformance");
+    assert!(!marked.contains("pdfxid:GTS_PDFXConformance"), "no XMP conformance property");
+    assert!(marked.contains("<pdf:Trapped>True</pdf:Trapped>"), "XMP pdf:Trapped");
+    assert!(marked.contains("<pdfxid:GTS_PDFXVersion>PDF/X-1:2003</pdfxid:GTS_PDFXVersion>"), "XMP GTS_PDFXVersion");
+
+    let unknown = SerializeSettings { trapped: Some(Trapped::Unknown), ..Default::default() };
+    let unknown = String::from_utf8_lossy(&sample(unknown, None).unwrap()).into_owned();
+    assert!(unknown.contains("/Trapped/Unknown") && unknown.contains("<pdf:Trapped>Unknown</pdf:Trapped>"));
+
+    let plain = String::from_utf8_lossy(&sample(SerializeSettings::default(), None).unwrap()).into_owned();
+    assert!(!plain.contains("Trapped") && !plain.contains("GTS_PDFX"));
+}
+
+/// A one-page PDF/A document with FOGRA39 print settings and the given PDF/X version.
+fn pdfa_print(version: PdfVersion, archival: Archival, pdfx_version: Option<&str>) -> Result<Vec<u8>, WriteError> {
+    let settings = SerializeSettings {
+        no_device_cs: true,
+        configuration: craft_pdf::write::configuration(version, Some(archival)).unwrap(),
+        pdfx_version: pdfx_version.map(str::to_owned),
+        ..print::settings(PrintColor::fogra39(FOGRA39)).unwrap()
+    };
+    let created = Some(backend::metadata::DateTime::new(2026));
+    let metadata = Metadata { title: Some("Print".to_owned()), created, ..Metadata::default() };
+    let mut writer = Writer::new_with_language(settings, metadata, Some("en".to_owned()));
+    {
+        let mut page = writer.document_mut().start_page_with(PageSettings::new(Size::from_wh(60.0, 60.0).unwrap()));
+        let mut surface = page.surface();
+        rect(&mut surface, 0.0, k(255), 0.5);
+        surface.finish();
+        page.finish();
+    }
+    writer.finish()
+}
+
+/// Under PDF/A the archival intent names the same profile object as the print intent.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn pdfa_and_print_intents_share_the_profile() {
+    let intents = output_intents(&pdfa_print(PdfVersion::Pdf17, Archival::A2_B, None).unwrap());
+    let subtypes: Vec<_> = intents.iter().map(|i| i.subtype.as_str()).collect();
+    assert_eq!(subtypes, ["GTS_PDFA1", "GTS_PDFX"]);
+    assert_eq!(intents[0].profile_object, intents[1].profile_object);
+    assert!(intents[0].profile == FOGRA39);
+}
+
+/// `pdfxid:GTS_PDFXVersion` needs an XMP extension schema under PDF/A-1 to 3, which krilla
+/// doesn't write, so a PDF/X version fails validation there; PDF/A-4 needs none.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn pdfx_version_is_a_pdf_a_1_to_3_error() {
+    for (version, archival) in [(PdfVersion::Pdf14, Archival::A1_B), (PdfVersion::Pdf17, Archival::A2_B), (PdfVersion::Pdf17, Archival::A3_B)] {
+        let Err(WriteError::Serialization(error)) = pdfa_print(version, archival, Some("PDF/X-4")) else {
+            panic!("{archival:?}: expected a validation error")
+        };
+        let backend::error::KrillaError::Validation(errors) = *error else { panic!("{archival:?}: expected validation errors") };
+        assert!(errors.iter().any(|(error, _)| *error == ValidationError::PdfxVersionWithoutExtensionSchema), "{archival:?}: {errors:?}");
+    }
+    let bytes = pdfa_print(PdfVersion::Pdf20, Archival::A4, Some("PDF/X-4")).unwrap();
+    assert!(String::from_utf8_lossy(&bytes).contains("<pdfxid:GTS_PDFXVersion>PDF/X-4</pdfxid:GTS_PDFXVersion>"));
+}
diff --git a/crates/pdf/tests/support/synthetic_icc.rs b/crates/pdf/tests/support/synthetic_icc.rs
new file mode 100644
index 00000000..97aeb30a
--- /dev/null
+++ b/crates/pdf/tests/support/synthetic_icc.rs
@@ -0,0 +1,227 @@
+//! Synthetic ICC profiles for the plate-mode tests, written byte by byte from ICC.1 (version
+//! 2.1 profiles with `lut16Type` tables and the legacy 16-bit PCS L*a*b* encoding). They are
+//! contributor-original and generated when a test runs; no profile file is committed.
+//!
+//! The CMYK printing condition is made up so that its conversions can be worked out by hand:
+//!
+//! - AToB (CMYK → PCS L*a*b*): L* = 100 · (1 − (c + m + y + k) / 4), a* = 60 · (m − c),
+//!   b* = 60 · (y − (c + m) / 2). It is affine, so a two-point grid holds it exactly.
+//! - BToA (PCS → CMYK), its inverse with equal inks along the neutral axis: with
+//!   t = 1 − L* / 100, c = t − a* / 120, m = t + a* / 120, y = t + b* / 60, k = t − b* / 60, each
+//!   clamped to 0..1. A neutral of L* 50 prints as 50% of each ink, where the ISO 32000-2
+//!   §10.4.2.4 device formulas would print it on black alone.
+//!
+//! From PdfCraft #2770 by Guillem Hermida (`crates/render/tests/support/synthetic_icc.rs` at
+//! 6fcf2a4aca29e943e28cb69017ff8f87d00656c6, MIT OR Apache-2.0). Used by `tests/plates.rs`
+//! through `#[path]`.
+
+#![allow(dead_code)]
+
+/// Grid points per input of the BToA table: fine enough that colors a little off the neutral
+/// axis interpolate between unclamped grid points.
+const BTOA_GRID: usize = 17;
+
+/// What the synthetic printing condition prints for PCS L*a*b*, each ink `0.0..=1.0`.
+pub fn btoa(l: f64, a: f64, b: f64) -> [f64; 4] {
+    let t = 1.0 - l / 100.0;
+    [t - a / 120.0, t + a / 120.0, t + b / 60.0, t - b / 60.0].map(|v| v.clamp(0.0, 1.0))
+}
+
+/// The PCS L*a*b* the synthetic printing condition gives an ink combination.
+pub fn atob([c, m, y, k]: [f64; 4]) -> [f64; 3] {
+    [100.0 * (1.0 - (c + m + y + k) / 4.0), 60.0 * (m - c), 60.0 * (y - (c + m) / 2.0)]
+}
+
+/// The CIE L* of an sRGB gray `v` (`0.0..=1.0`); a neutral's a* and b* are 0.
+pub fn srgb_gray_lightness(v: f64) -> f64 {
+    let linear = if v <= 0.04045 { v / 12.92 } else { ((v + 0.055) / 1.055).powf(2.4) };
+    let f = if linear > 216.0 / 24389.0 { linear.cbrt() } else { (24389.0 / 27.0 * linear + 16.0) / 116.0 };
+    116.0 * f - 16.0
+}
+
+/// A CMYK output profile (`prtr`) of the synthetic printing condition, described as
+/// `description`. With `btoa` false it has no PCS-to-device tables (and so can't be printed to).
+pub fn cmyk_profile(description: &str, btoa_tables: bool) -> Vec<u8> {
+    let atob_table = lut16(4, 3, 2, false, |node| {
+        let cmyk = [node[0], node[1], node[2], node[3]];
+        encode_lab(atob(cmyk))
+    });
+    let mut tags: Vec<(&[u8; 4], Vec<u8>)> = vec![
+        (b"desc", text_description(description)),
+        (b"cprt", text(b"No copyright, synthetic test data")),
+        (b"wtpt", xyz(D50)),
+        (b"A2B0", atob_table.clone()),
+        (b"A2B1", atob_table.clone()),
+        (b"A2B2", atob_table),
+    ];
+    if btoa_tables {
+        let btoa_table = lut16(3, 4, BTOA_GRID, true, |node| {
+            let [l, a, b] = grid_lab([node[0], node[1], node[2]]);
+            btoa(l, a, b).map(|v| v * 65535.0).to_vec()
+        });
+        tags.push((b"B2A0", btoa_table.clone()));
+        tags.push((b"B2A1", btoa_table.clone()));
+        tags.push((b"B2A2", btoa_table));
+        // Everything is in gamut.
+        tags.push((b"gamt", lut16(3, 1, 2, false, |_| vec![0.0])));
+    }
+    profile(b"prtr", b"CMYK", b"Lab ", &tags)
+}
+
+/// A gray display profile (gamma 2.2), described as `description`: an output intent that is
+/// not CMYK.
+pub fn gray_profile(description: &str) -> Vec<u8> {
+    // curveType with one entry: a gamma as u8Fixed8Number (2.2 ≈ 0x0233).
+    let mut curve = b"curv\0\0\0\0".to_vec();
+    curve.extend_from_slice(&1_u32.to_be_bytes());
+    curve.extend_from_slice(&0x0233_u16.to_be_bytes());
+    let tags: Vec<(&[u8; 4], Vec<u8>)> =
+        vec![(b"desc", text_description(description)), (b"cprt", text(b"No copyright, synthetic test data")), (b"wtpt", xyz(D50)), (b"kTRC", curve)];
+    profile(b"mntr", b"GRAY", b"XYZ ", &tags)
+}
+
+/// The D50 illuminant of the PCS.
+const D50: [f64; 3] = [0.9642, 1.0, 0.8249];
+
+/// PCS L*a*b* in the legacy 16-bit encoding (ICC.1 Annex A), as `0.0..=65535.0` table values:
+/// L* 100 is 0xFF00 and a* or b* 0 is 0x8000.
+fn encode_lab([l, a, b]: [f64; 3]) -> Vec<f64> {
+    vec![l * 65280.0 / 100.0, (a + 128.0) * 256.0, (b + 128.0) * 256.0].into_iter().map(|v| v.clamp(0.0, 65535.0)).collect()
+}
+
+/// A BToA grid point's PCS L*a*b*: `node` holds its inputs as `0.0..=1.0`. The L* input
+/// table has stretched L* 100 (0xFF00) onto the last grid point, so white prints no ink; a*
+/// and b* are in the legacy encoding.
+fn grid_lab(node: [f64; 3]) -> [f64; 3] {
+    let [l, a, b] = node;
+    [l * 100.0, a * 65535.0 / 256.0 - 128.0, b * 65535.0 / 256.0 - 128.0]
+}
+
+/// A `lut16Type` with `inputs` × `outputs` channels, `grid` points per input, identity
+/// matrix and output tables, and the grid filled by `value` (each grid point's inputs as
+/// `0.0..=1.0`, returning its outputs as `0.0..=65535.0`). The input tables are the identity,
+/// except that `stretch_lightness` scales the first input by 0xFFFF / 0xFF00 (see [`grid_lab`]).
+fn lut16(inputs: usize, outputs: usize, grid: usize, stretch_lightness: bool, value: impl Fn(&[f64]) -> Vec<f64>) -> Vec<u8> {
+    const ENTRIES: usize = 257;
+    let mut out = b"mft2\0\0\0\0".to_vec();
+    out.extend_from_slice(&[inputs as u8, outputs as u8, grid as u8, 0]);
+    for k in 0_usize..9 {
+        let one = if k.is_multiple_of(4) { 0x0001_0000_i32 } else { 0 };
+        out.extend_from_slice(&one.to_be_bytes());
+    }
+    out.extend_from_slice(&(ENTRIES as u16).to_be_bytes());
+    out.extend_from_slice(&2_u16.to_be_bytes());
+    for channel in 0..inputs {
+        for e in 0..ENTRIES {
+            let x = e as f64 / (ENTRIES - 1) as f64;
+            let y = if stretch_lightness && channel == 0 { (x * 65535.0 / 65280.0).min(1.0) } else { x };
+            out.extend_from_slice(&((y * 65535.0).round() as u16).to_be_bytes());
+        }
+    }
+    // The first input varies slowest.
+    let points = grid.pow(inputs as u32);
+    for index in 0..points {
+        let mut node = vec![0.0; inputs];
+        let mut rest = index;
+        for i in (0..inputs).rev() {
+            node[i] = (rest % grid) as f64 / (grid - 1) as f64;
+            rest /= grid;
+        }
+        let values = value(&node);
+        assert_eq!(values.len(), outputs);
+        for v in values {
+            out.extend_from_slice(&(v.round().clamp(0.0, 65535.0) as u16).to_be_bytes());
+        }
+    }
+    for _ in 0..outputs {
+        out.extend_from_slice(&[0, 0, 0xFF, 0xFF]);
+    }
+    out
+}
+
+/// A `textDescriptionType` (ICC.1:2001, the version 2 `desc` tag) with an ASCII description.
+fn text_description(description: &str) -> Vec<u8> {
+    let ascii: Vec<u8> = description.bytes().filter(u8::is_ascii).collect();
+    let mut out = b"desc\0\0\0\0".to_vec();
+    out.extend_from_slice(&(ascii.len() as u32 + 1).to_be_bytes());
+    out.extend_from_slice(&ascii);
+    out.push(0);
+    out.extend_from_slice(&[0; 4]); // Unicode language code
+    out.extend_from_slice(&[0; 4]); // Unicode count
+    out.extend_from_slice(&[0; 2]); // ScriptCode code
+    out.push(0); // ScriptCode count
+    out.extend_from_slice(&[0; 67]);
+    out
+}
+
+/// A `textType`.
+fn text(ascii: &[u8]) -> Vec<u8> {
+    let mut out = b"text\0\0\0\0".to_vec();
+    out.extend_from_slice(ascii);
+    out.push(0);
+    out
+}
+
+fn s15_fixed16(v: f64) -> [u8; 4] {
+    ((v * 65536.0).round() as i32).to_be_bytes()
+}
+
+/// An `XYZType` with one value.
+fn xyz(v: [f64; 3]) -> Vec<u8> {
+    let mut out = b"XYZ \0\0\0\0".to_vec();
+    for c in v {
+        out.extend_from_slice(&s15_fixed16(c));
+    }
+    out
+}
+
+/// A whole version 2.1 profile: the 128-byte header, the tag table, then each tag's data,
+/// 4-byte aligned. Tags with equal data share it.
+fn profile(class: &[u8; 4], space: &[u8; 4], pcs: &[u8; 4], tags: &[(&[u8; 4], Vec<u8>)]) -> Vec<u8> {
+    let table_end = 128 + 4 + 12 * tags.len();
+    let mut data: Vec<u8> = Vec::new();
+    let mut entries: Vec<(&[u8; 4], usize, usize)> = Vec::new();
+    for (signature, body) in tags {
+        let shared = entries.iter().zip(tags).find(|(_, (_, b))| b == body).map(|((_, offset, len), _)| (*offset, *len));
+        let (offset, len) = match shared {
+            Some(place) => place,
+            None => {
+                while !data.len().is_multiple_of(4) {
+                    data.push(0);
+                }
+                let offset = table_end + data.len();
+                data.extend_from_slice(body);
+                (offset, body.len())
+            }
+        };
+        entries.push((signature, offset, len));
+    }
+    while !data.len().is_multiple_of(4) {
+        data.push(0);
+    }
+    let size = table_end + data.len();
+    let mut out = Vec::with_capacity(size);
+    out.extend_from_slice(&(size as u32).to_be_bytes());
+    out.extend_from_slice(&[0; 4]); // preferred CMM
+    out.extend_from_slice(&0x0210_0000_u32.to_be_bytes());
+    out.extend_from_slice(class);
+    out.extend_from_slice(space);
+    out.extend_from_slice(pcs);
+    for v in [2026_u16, 10, 16, 0, 0, 0] {
+        out.extend_from_slice(&v.to_be_bytes());
+    }
+    out.extend_from_slice(b"acsp");
+    out.extend_from_slice(&[0; 4 + 4 + 4 + 4 + 8 + 4]); // platform, flags, manufacturer, model, attributes, intent
+    for c in D50 {
+        out.extend_from_slice(&s15_fixed16(c));
+    }
+    out.extend_from_slice(&[0; 4 + 16 + 28]); // creator, ID, reserved
+    out.extend_from_slice(&(tags.len() as u32).to_be_bytes());
+    for (signature, offset, len) in &entries {
+        out.extend_from_slice(*signature);
+        out.extend_from_slice(&(*offset as u32).to_be_bytes());
+        out.extend_from_slice(&(*len as u32).to_be_bytes());
+    }
+    out.extend_from_slice(&data);
+    out
+}
diff --git a/crates/pdf/tests/upstream_compatibility.rs b/crates/pdf/tests/upstream_compatibility.rs
index 38ffa0c7..d8aface5 100644
--- a/crates/pdf/tests/upstream_compatibility.rs
+++ b/crates/pdf/tests/upstream_compatibility.rs
@@ -280,6 +280,7 @@ mod painting {
                 GlyphDrawMode::Fill => 'F',
                 GlyphDrawMode::Stroke(_) => 'S',
                 GlyphDrawMode::Invisible => 'I',
+                GlyphDrawMode::Clip => 'C',
             };
             self.glyphs.push(GlyphEvent { text, mode, rgba: rgba(paint), origin: glyph_transform * Point::ORIGIN });
         }
diff --git a/crates/pdf/tests/upstream_raster.rs b/crates/pdf/tests/upstream_raster.rs
index 9f27f989..44170098 100644
--- a/crates/pdf/tests/upstream_raster.rs
+++ b/crates/pdf/tests/upstream_raster.rs
@@ -1,9 +1,12 @@
-//! Portable regressions adapted from PdfCraft 7437bde378f43856eada40af25b983812e615e8a (MIT OR Apache-2.0).
+//! Portable regressions adapted from PdfCraft 7437bde378f43856eada40af25b983812e615e8a and
+//! a2ec27b4775f53c40cad3456936d9406611e3a8d (MIT OR Apache-2.0).
 #![cfg(feature = "raster")]
+use craft_pdf::interpret::InterpreterSettings;
 use craft_pdf::{
     open_slice,
     raster::{self, Options, RenderCache},
 };
+use std::sync::Arc;
 
 struct Pixels {
     width: u32,
@@ -269,3 +272,882 @@ fn tiff_predictor_packed_rgb_image_renders_every_row() {
     assert_eq!(pixel(10), &[255, 0, 0, 255]);
     assert_eq!(pixel(30), &[0, 255, 0, 255]);
 }
+
+// An 8 x 4 all-black Group 4 stream, hand-encoded from ITU-T T.6: one horizontal-mode row
+// (white 0, black 8), three V0 rows, then EOFB.
+const ALL_BLACK_8X4: [u8; 6] = [0x26, 0xa2, 0xfe, 0x00, 0x20, 0x02];
+
+fn fax_page(space: &str, params: &str) -> Pixels {
+    let content = "q 20 0 0 20 5 5 cm /Im1 Do Q";
+    let mut pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 4 /ColorSpace {space} /BitsPerComponent 1 /Filter /CCITTFaxDecode /DecodeParms << /K -1 /Columns 8 {params} >> /Length {} >> stream\n",
+        content.len(),
+        ALL_BLACK_8X4.len()
+    )
+    .into_bytes();
+    pdf.extend_from_slice(&ALL_BLACK_8X4);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF");
+    render(&pdf)
+}
+
+fn pixel(page: &Pixels, x: u32, y: u32) -> &[u8] {
+    let i = ((y * page.width + x) * 4) as usize;
+    &page.rgba[i..i + 4]
+}
+
+/// Scanners and fax services write Group 4 pages with `/Rows 0`, which ISO 32000-2 Table 11
+/// defines as "height not predetermined" (the default), not as zero rows.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn group4_fax_with_rows_zero_decodes_to_the_image_height() {
+    for rows in ["", "/Rows 4", "/Rows 0"] {
+        let page = fax_page("/DeviceGray", rows);
+        assert_eq!(pixel(&page, 15, 24), &[0, 0, 0, 255], "{rows:?}: the fax image paints black");
+        assert_eq!(pixel(&page, 1, 38), &[255, 255, 255, 255], "{rows:?}: outside the image stays white");
+    }
+}
+
+/// PdfCraft #3308: a fax image whose `/Rows` is below its `/Height` is decoded to its height.
+/// `/BlackIs1` turns the fixture white, so rows left undecoded show as black. Also through an
+/// `/Indexed` color space, the filter's other output path.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn group4_fax_with_rows_below_its_height_decodes_to_the_image_height() {
+    for (space, rows) in [("/DeviceGray", "/Rows 2"), ("[/Indexed /DeviceRGB 1 <000000FFFFFF>]", "/Rows 2"), ("/DeviceGray", "/Rows 4")] {
+        let page = fax_page(space, &format!("{rows} /BlackIs1 true"));
+        for y in [17, 22, 27, 32] {
+            assert_eq!(pixel(&page, 15, y), &[255, 255, 255, 255], "{space} {rows}: image row at y {y} is decoded");
+        }
+    }
+}
+
+/// PdfCraft ledger hayro-interpret P2 (#3178): a shaded Type 3 glyph clips to its `/FontBBox` in
+/// device space at every position, not to the glyph-space box.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn shaded_type3_glyph_draws_at_multiple_positions() {
+    let content = "BT /F 30 Tf 1 0 0 1 50 70 Tm (A) Tj 1 0 0 1 220 70 Tm (A) Tj ET";
+    let glyph = "100 0 d0 0 0 100 100 re W n /S sh";
+    let pdf = format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 150] /Resources << /Font << /F 5 0 R >> >> /Contents 4 0 R >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 100 100] /FontMatrix [0.01 0 0 0.01 0 0] /CharProcs << /A 6 0 R >> /Encoding << /Differences [65 /A] >> /FirstChar 65 /LastChar 65 /Widths [100] /Resources << /Shading << /S 7 0 R >> >> >> endobj
+6 0 obj << /Length {} >> stream
+{glyph}
+endstream endobj
+7 0 obj << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Function << /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [0 0 1] /N 1 >> /Extend [true true] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len(),
+        glyph.len()
+    );
+    let page = render(pdf.as_bytes());
+    for x in [65, 235] {
+        let px = pixel(&page, x, 65);
+        assert!(px[0] < 240 && px[2] < 240 && px[1] < 10, "glyph at {x}: {px:?}");
+    }
+}
+
+/// PdfCraft ledger hayro-interpret (26) extension: comma-below letters in non-embedded standard
+/// fonts are the letter with the font's comma under it, apart from the letter and inside the
+/// descender, whichever name the font gives them (`/scommaaccent`, `/Kcedilla`, `/uni0219`).
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter() {
+    let pairs = [
+        ("s", "uni0219"),
+        ("t", "uni021B"),
+        ("T", "uni021A"),
+        ("K", "uni0136"),
+        ("k", "kcedilla"),
+        ("G", "uni0122"),
+        ("G", "Gcedilla"),
+        ("R", "uni0156"),
+        ("s", "scommaaccent"),
+        ("S", "Scommaaccent"),
+        ("t", "tcommaaccent"),
+        ("T", "Tcommaaccent"),
+        ("k", "kcommaaccent"),
+        ("K", "Kcommaaccent"),
+        ("l", "lcommaaccent"),
+        ("L", "Lcommaaccent"),
+        ("n", "ncommaaccent"),
+        ("N", "Ncommaaccent"),
+        ("r", "rcommaaccent"),
+        ("R", "Rcommaaccent"),
+        ("G", "Gcommaaccent"),
+    ];
+    let letters: Vec<&str> = pairs.iter().flat_map(|(base, accented)| [*base, *accented]).collect();
+    let (size, baseline) = (40u32, 60u32);
+    for font in ["Helvetica", "Times-Roman", "Courier", "Helvetica-BoldOblique"] {
+        let mut content = String::new();
+        for i in 0..letters.len() {
+            content.push_str(&format!("BT /F1 {size} Tf {} {} Td <{:02X}> Tj ET\n", 10 + 40 * i, 80 - baseline, 1 + i));
+        }
+        let differences = letters.iter().map(|n| format!("/{n}")).collect::<Vec<_>>().join(" ");
+        let pdf = format!(
+            "%PDF-1.4
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {} 80] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /{font}
+  /Encoding << /Type /Encoding /BaseEncoding /WinAnsiEncoding /Differences [1 {differences}] >> >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            20 + 40 * letters.len(),
+            content.len()
+        );
+        let p = render(pdf.as_bytes());
+        // The rows (y down) of the i-th letter that have dark pixels.
+        let ink_rows = |i: u32| -> Vec<u32> {
+            (0..p.height).filter(|&y| ((8 + 40 * i)..(48 + 40 * i).min(p.width)).any(|x| pixel(&p, x, y)[0] < 128)).collect()
+        };
+        for (pair, (_, name)) in pairs.iter().enumerate() {
+            let (base, accented) = (ink_rows(2 * pair as u32), ink_rows(2 * pair as u32 + 1));
+            let (Some(&base_bottom), Some(&bottom)) = (base.last(), accented.last()) else {
+                panic!("{font} {name}: draws nothing ({} rows of its base letter)", base.len());
+            };
+            assert!(bottom > base_bottom + 2, "{font} {name}: a mark hangs below the letter ({bottom} vs {base_bottom})");
+            assert!(
+                (base_bottom + 1..bottom).any(|y| !accented.contains(&y)),
+                "{font} {name}: the mark is apart from the letter, a comma and not a cedilla"
+            );
+            assert!(bottom < baseline + size * 3 / 10, "{font} {name}: the comma stays within the descender ({bottom})");
+        }
+    }
+}
+
+/// A one-page PDF: `page` holds the page dictionary's entries besides its tree links and
+/// contents (the media box, resources, annotations), and `objects` the objects from 5 on.
+fn one_page(page: &str, content: &[u8], objects: &[u8]) -> Vec<u8> {
+    let mut pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R {page} /Contents 4 0 R >> endobj\n\
+         4 0 obj << /Length {} >> stream\n",
+        content.len()
+    )
+    .into_bytes();
+    pdf.extend_from_slice(content);
+    pdf.extend_from_slice(b"\nendstream endobj\n");
+    pdf.extend_from_slice(objects);
+    pdf.extend_from_slice(b"\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+    pdf
+}
+
+/// PdfCraft ledger hayro-interpret (46) and the hayro stencil paint (#2975): a stencil mask is painted in the
+/// fill color at the fill opacity, once: at `ca 0.5` it is as opaque as a rectangle filled at
+/// `ca 0.5` beside it. The same holds when the fill is a pattern, an uncolored tiling pattern
+/// (drawn in its fill color, not its stroke color) or a shading pattern.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn stencil_masks_are_drawn_at_the_fill_opacity_once() {
+    let fills = [("color", "0 0 1 rg"), ("uncolored tiling pattern", "/CsP cs 0 0 1 /Tp scn"), ("shading pattern", "/Pattern cs /Sp scn")];
+    for (fill_name, fill) in fills {
+        for alpha in ["1", "0.5", "0.25"] {
+            let content = format!("/A gs {fill} q 100 0 0 100 20 50 cm /Msk Do Q 160 50 100 100 re f");
+            let page = format!(
+                "/MediaBox [0 0 300 200] /Resources << /ExtGState << /A << /ca {alpha} >> >> /XObject << /Msk 5 0 R >> \
+                 /ColorSpace << /CsP [/Pattern /DeviceRGB] >> /Pattern << /Tp 6 0 R /Sp 7 0 R >> >>"
+            );
+            let objects = b"5 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ImageMask true /Length 2 >> stream\n\0\0\nendstream endobj\n\
+6 0 obj << /Type /Pattern /PatternType 1 /PaintType 2 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << >> /Length 14 >> stream\n0 0 10 10 re f\nendstream endobj\n\
+7 0 obj << /Type /Pattern /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 300 0] /Extend [true true] /Function << /FunctionType 2 /Domain [0 1] /C0 [0 0 1] /C1 [0 0 1] /N 1 >> >> >> endobj";
+            let p = render(&one_page(&page, content.as_bytes(), objects));
+            // Pixel rows run top down: PDF (70, 100) is in the mask, (210, 100) in the rectangle.
+            let (mask, rect) = (pixel(&p, 70, 100), pixel(&p, 210, 100));
+            assert!(rect[..3] != [255, 255, 255], "{fill_name}, ca {alpha}: the rectangle is painted");
+            assert!(mask.iter().zip(rect).all(|(m, r)| m.abs_diff(*r) <= 1), "{fill_name}, ca {alpha}: mask {mask:?}, rectangle {rect:?}");
+        }
+    }
+}
+
+/// PdfCraft #3246 (#3176, with ledger hayro-interpret (46)): `CA` and `ca` belong to the graphics
+/// state at paint time, so a `gs` after `SCN` or `scn` still fades a shading pattern, and a
+/// stroke takes the stroke alpha.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn shading_pattern_uses_the_alpha_current_at_paint_time() {
+    let content = b"/Pattern CS /P0 SCN /S1 gs 10 w 0 75 m 100 75 l S /Pattern cs /P0 scn /F1 gs 0 0 100 50 re f";
+    let page = "/MediaBox [0 0 100 100] /Resources << /ExtGState << /S1 << /CA 0.25 >> /F1 << /ca 0.25 >> >> /Pattern << /P0 5 0 R >> >>";
+    let objects = b"5 0 obj << /PatternType 2 /Shading << /ShadingType 2 /ColorSpace /DeviceRGB /Coords [0 0 100 0] /Extend [true true] \
+/Function << /FunctionType 2 /Domain [0 1] /C0 [1 0 0] /C1 [1 0 0] /N 1 >> >> >> endobj";
+    let p = render(&one_page(page, content, objects));
+    // A quarter red over white: (255, 191, 191).
+    for (what, y) in [("stroke", 25), ("fill", 75)] {
+        let px = pixel(&p, 50, y);
+        assert!(px[0] == 255 && (185..=197).contains(&px[1]) && (185..=197).contains(&px[2]), "{what}: {px:?}");
+    }
+}
+
+fn type4_mesh_page(data: &[u8]) -> Pixels {
+    let mut objects = format!(
+        "5 0 obj << /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 \
+         /Decode [0 255 0 255 0 1 0 1 0 1] /Length {} >> stream\n",
+        data.len()
+    )
+    .into_bytes();
+    objects.extend_from_slice(data);
+    objects.extend_from_slice(b"\nendstream endobj");
+    let page = render(&one_page("/MediaBox [0 0 50 50] /Resources << /Shading << /Sh0 5 0 R >> >>", b"/Sh0 sh", &objects));
+    assert_eq!((page.width, page.height), (50, 50));
+    page
+}
+
+/// PdfCraft ledger hayro-interpret (36) (#3035): two triangles of a mesh that share an edge cover it
+/// together. Testing only each pixel's corner, strictly inside a triangle, left the shared
+/// diagonal white, and a pixel row or column along the mesh's own sides.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn mesh_triangles_sharing_an_edge_leave_no_seam() {
+    // A red square from 10 to 40 on a 50 × 50 page, cut along its diagonal; in device space
+    // the diagonal runs through pixel centers and corners alike.
+    let vertex = |flag: u8, x: u8, y: u8| [flag, x, y, 255, 0, 0];
+    let (lo, hi) = (10, 40);
+    let mut triangles = Vec::new();
+    for [a, b, c] in [[(lo, lo), (hi, lo), (hi, hi)], [(lo, lo), (hi, hi), (lo, hi)]] {
+        for (x, y) in [a, b, c] {
+            triangles.extend(vertex(0, x, y));
+        }
+    }
+    // Each triangle as its own three vertices, and the second one as a strip (flag 1).
+    let mut strip = Vec::new();
+    for (flag, (x, y)) in [(0, (lo, lo)), (0, (hi, lo)), (0, (hi, hi)), (2, (lo, hi))] {
+        strip.extend(vertex(flag, x, y));
+    }
+    for (label, data) in [("separate triangles", triangles), ("a strip", strip)] {
+        let page = type4_mesh_page(&data);
+        let (mut white_inside, mut red_outside) = (Vec::new(), Vec::new());
+        for y in 0..50 {
+            for x in 0..50 {
+                let p = pixel(&page, x, y);
+                let inside = (10..40).contains(&x) && (10..40).contains(&y);
+                if inside && p != [255, 0, 0, 255] {
+                    white_inside.push((x, y));
+                } else if !inside && p != [255, 255, 255, 255] {
+                    red_outside.push((x, y));
+                }
+            }
+        }
+        assert!(white_inside.is_empty(), "{label}: unshaded pixels inside the square: {white_inside:?}");
+        assert!(red_outside.is_empty(), "{label}: shaded pixels outside the square: {red_outside:?}");
+    }
+
+    // One triangle alone, the square's upper left half: a pixel whose corner lies on its
+    // diagonal is taken by its center, so one wholly across the diagonal (x + y ≥ 50 in
+    // device space) is not shaded, and one wholly inside is.
+    let mut data = Vec::new();
+    for (x, y) in [(lo, lo), (hi, hi), (lo, hi)] {
+        data.extend(vertex(0, x, y));
+    }
+    let page = type4_mesh_page(&data);
+    let (mut spilled, mut missing) = (Vec::new(), Vec::new());
+    for y in 10..40 {
+        for x in 10..40 {
+            let p = pixel(&page, x, y);
+            if x + y >= 50 && p == [255, 0, 0, 255] {
+                spilled.push((x, y));
+            } else if x + y + 2 <= 50 && p != [255, 0, 0, 255] {
+                missing.push((x, y));
+            }
+        }
+    }
+    assert!(spilled.is_empty(), "shaded pixels wholly across the diagonal: {spilled:?}");
+    assert!(missing.is_empty(), "unshaded pixels wholly inside the triangle: {missing:?}");
+}
+
+/// PdfCraft ledger hayro-interpret (40) (#2987): an optional content membership dictionary
+/// with a visibility expression (`/VE`, ISO 32000-2 §8.11.2.2) shows its content only when the
+/// expression is true, and the expression takes precedence over `/OCGs` and `/P`. A malformed
+/// expression, one naming an object that isn't a listed group, or one nested too deep falls
+/// back to `/OCGs`.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn visibility_expressions_decide_what_a_membership_dictionary_shows() {
+    let render = |ocmd: &str, off: &[i32]| {
+        let catalog = "<< /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R 6 0 R] /D << /Order [5 0 R 6 0 R] >> >> >>";
+        let objects = format!("5 0 obj << /Type /OCG /Name (A) >> endobj\n6 0 obj << /Type /OCG /Name (B) >> endobj\n7 0 obj {ocmd} endobj");
+        let pdf = String::from_utf8(one_page(
+            "/MediaBox [0 0 100 100] /Resources << /Properties << /M1 7 0 R >> >>",
+            b"/OC /M1 BDC 1 0 0 rg 0 0 100 100 re f EMC",
+            objects.as_bytes(),
+        ))
+        .unwrap()
+        .replacen("<< /Type /Catalog /Pages 2 0 R >>", catalog, 1);
+        let doc = open_slice(pdf.as_bytes(), None).unwrap();
+        let settings = InterpreterSettings { ocg_overrides: Arc::new(off.iter().map(|n| (*n, 0, false)).collect()), ..Default::default() };
+        let options = Options { background: [255; 4], scale: [0.5, 0.5], ..Default::default() };
+        let raster = raster::render(&doc.pages()[0], &RenderCache::new(), &settings, &options).unwrap();
+        raster.bytes()[..4] == [255, 0, 0, 255]
+    };
+    let and = "<< /Type /OCMD /VE [/And 5 0 R 6 0 R] >>";
+    assert!(render(and, &[]), "And: both on");
+    assert!(!render(and, &[5]), "And: one off");
+    let or = "<< /Type /OCMD /VE [/Or 5 0 R 6 0 R] >>";
+    assert!(render(or, &[5]), "Or: one on");
+    assert!(!render(or, &[5, 6]), "Or: both off");
+    let not = "<< /Type /OCMD /VE [/Not 5 0 R] >>";
+    assert!(!render(not, &[]), "Not: the group is on");
+    assert!(render(not, &[5]), "Not: the group is off");
+    let nested = "<< /Type /OCMD /VE [/And [/Not 5 0 R] 6 0 R] >>";
+    assert!(render(nested, &[5]), "nested: A off, B on");
+    assert!(!render(nested, &[]), "nested: A on");
+    let both = "<< /Type /OCMD /OCGs [5 0 R] /P /AllOn /VE [/Not 5 0 R] >>";
+    assert!(render(both, &[5]), "the expression, not /P, decides");
+    // Malformed: an unknown operator, a wrong operand count, a bare group, a string operand,
+    // a missing object, and the page instead of a group.
+    for bad in ["[/Xor 5 0 R]", "[/Not 5 0 R 6 0 R]", "[/And]", "[5 0 R]", "[/And (5)]", "[/Or 8 0 R]", "[/Or 3 0 R]"] {
+        let ocmd = format!("<< /Type /OCMD /OCGs [5 0 R] /VE {bad} >>");
+        assert!(render(&ocmd, &[]), "{bad}: /OCGs on");
+        assert!(!render(&ocmd, &[5]), "{bad}: /OCGs off");
+    }
+    let deep = format!("<< /Type /OCMD /OCGs [5 0 R] /VE {}5 0 R{} >>", "[/Not ".repeat(41), "]".repeat(41));
+    assert!(!render(&deep, &[5]), "too deep: /OCGs decides");
+}
+
+/// PdfCraft ledger hayro (18) (#2972): a page's objects composite with a transparent backdrop
+/// and the page group is then put on the paper, so a blend mode only blends where something
+/// was drawn. A green fill with `/BM /Screen` (or Lighten, Difference…) half over a red square
+/// takes the mode's color over the red and stays plain green over the empty page.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn blend_modes_over_an_empty_part_of_the_page_keep_their_color() {
+    for (mode, over_red) in [
+        ("Normal", Some([0, 255, 0])),
+        ("Multiply", Some([0, 0, 0])),
+        ("Screen", Some([255, 255, 0])),
+        ("Lighten", Some([255, 255, 0])),
+        ("Difference", Some([255, 255, 0])),
+        ("Exclusion", Some([255, 255, 0])),
+        ("ColorDodge", Some([255, 0, 0])),
+        ("Overlay", Some([255, 0, 0])),
+        // The non-separable modes mix hue, saturation and luminosity; over an empty part of
+        // the page they too keep the source color.
+        ("Hue", None),
+        ("Saturation", None),
+        ("Color", None),
+        ("Luminosity", None),
+    ] {
+        let page = format!("/MediaBox [0 0 300 200] /Resources << /ExtGState << /G1 << /Type /ExtGState /BM /{mode} >> >> >>");
+        let p = render(&one_page(&page, b"1 0 0 rg 20 20 150 150 re f /G1 gs 0 1 0 rg 100 50 150 120 re f", b""));
+        // Pixel rows run top down: PDF (210, 100) and (130, 100) are rows 100 from the top.
+        assert_eq!(pixel(&p, 210, 100), [0, 255, 0, 255], "{mode} over the empty page");
+        if let Some(over_red) = over_red {
+            assert_eq!(pixel(&p, 130, 100)[..3], over_red, "{mode} over the red square");
+        }
+        assert_eq!(pixel(&p, 280, 10), [255, 255, 255, 255], "{mode}: the paper stays white");
+    }
+}
+
+/// PdfCraft #3018 (ISO 32000-2 §8.6.5.6): the `/DefaultGray`, `/DefaultRGB` and `/DefaultCMYK`
+/// color spaces of a resource dictionary stand in for the device spaces its content selects,
+/// with color operators, images and shadings. The defaults are synthetic ICC profiles that send
+/// device color somewhere it cannot go uncalibrated: red to green (or blue), black to mid gray,
+/// black ink to blue.
+mod default_color_spaces {
+    use super::{Pixels, render};
+
+    const WIDTH: usize = 130;
+    pub(super) const RED: [u8; 3] = [255, 0, 0];
+    const GREEN: [u8; 3] = [0, 255, 0];
+    pub(super) const BLUE: [u8; 3] = [0, 0, 255];
+    const BLACK: [u8; 3] = [0, 0, 0];
+    /// Device black through `gray_profile`: half the luminance of white, sRGB-encoded.
+    const MID_GRAY: [u8; 3] = [188, 188, 188];
+    /// Full black ink through `cmyk_profile`: CIELAB (40, 20, -60) relative to D50.
+    const INK_BLUE: [u8; 3] = [67, 86, 194];
+    const ONE_PIXEL_RGB: &str = "<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Length 3 >>";
+
+    /// An s15Fixed16Number (ICC.1 §4.6).
+    fn s15f16(value: f64) -> [u8; 4] {
+        ((value * 65536.0).round() as i32).to_be_bytes()
+    }
+
+    /// An ICC v2 profile of device class `class` for the color space `space`, with `tags`
+    /// (signature, data) in that order. The device model stays blank: hayro skips the transform
+    /// of a profile whose model reads `sRGB`.
+    fn icc(class: &[u8; 4], space: &[u8; 4], pcs: &[u8; 4], tags: &[([u8; 4], Vec<u8>)]) -> Vec<u8> {
+        let start = 128 + 4 + 12 * tags.len();
+        let (mut table, mut data) = (Vec::new(), Vec::new());
+        for (signature, tag) in tags {
+            table.extend_from_slice(signature);
+            table.extend_from_slice(&u32::try_from(start + data.len()).unwrap().to_be_bytes());
+            table.extend_from_slice(&u32::try_from(tag.len()).unwrap().to_be_bytes());
+            data.extend_from_slice(tag);
+            data.resize(data.len().next_multiple_of(4), 0);
+        }
+        let mut profile = vec![0; 128];
+        profile[0..4].copy_from_slice(&u32::try_from(start + data.len()).unwrap().to_be_bytes());
+        profile[8..12].copy_from_slice(&[2, 0x10, 0, 0]);
+        profile[12..16].copy_from_slice(class);
+        profile[16..20].copy_from_slice(space);
+        profile[20..24].copy_from_slice(pcs);
+        profile[36..40].copy_from_slice(b"acsp");
+        for (i, value) in [0.9642, 1.0, 0.8249].into_iter().enumerate() {
+            profile[68 + 4 * i..72 + 4 * i].copy_from_slice(&s15f16(value));
+        }
+        profile.extend_from_slice(&u32::try_from(tags.len()).unwrap().to_be_bytes());
+        profile.extend(table);
+        profile.extend(data);
+        profile
+    }
+
+    fn xyz([x, y, z]: [f64; 3]) -> Vec<u8> {
+        [b"XYZ ".as_slice(), &[0; 4], &s15f16(x), &s15f16(y), &s15f16(z)].concat()
+    }
+
+    /// A `curveType` tag: one entry is a gamma (u8Fixed8), more are points spread evenly over 0..1.
+    fn curve(points: &[u16]) -> Vec<u8> {
+        let mut tag = [b"curv".as_slice(), &[0; 4], &u32::try_from(points.len()).unwrap().to_be_bytes()].concat();
+        for point in points {
+            tag.extend_from_slice(&point.to_be_bytes());
+        }
+        tag
+    }
+
+    /// sRGB's red, green and blue colorants, adapted to D50.
+    const SRGB_COLORANTS: [[f64; 3]; 3] = [[0.4361, 0.2225, 0.0139], [0.3851, 0.7169, 0.0971], [0.1431, 0.0606, 0.7141]];
+
+    /// A linear RGB profile whose red, green and blue take the sRGB colorants `primaries` names:
+    /// with `[1, 2, 0]` red is drawn as sRGB green.
+    pub(super) fn rgb_profile(primaries: [usize; 3]) -> Vec<u8> {
+        let mut tags = Vec::new();
+        for (signature, primary) in [*b"rXYZ", *b"gXYZ", *b"bXYZ"].into_iter().zip(primaries) {
+            tags.push((signature, xyz(SRGB_COLORANTS[primary])));
+        }
+        for signature in [*b"rTRC", *b"gTRC", *b"bTRC"] {
+            tags.push((signature, curve(&[0x0100])));
+        }
+        icc(b"mntr", b"RGB ", b"XYZ ", &tags)
+    }
+
+    /// A gray profile whose tone curve rises from half the luminance of white, so `0 g` is mid gray.
+    fn gray_profile() -> Vec<u8> {
+        icc(b"mntr", b"GRAY", b"XYZ ", &[(*b"kTRC", curve(&[0x8000, 0xffff]))])
+    }
+
+    /// A CMYK profile (`lut8Type` into CIELAB) that draws full black ink as L*a*b* (40, 20, -60)
+    /// and no black ink as white, whatever the other inks.
+    fn cmyk_profile() -> Vec<u8> {
+        let mut lut = [b"mft1".as_slice(), &[0; 4], &[4, 3, 2, 0]].concat();
+        for value in [1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0] {
+            lut.extend_from_slice(&s15f16(value));
+        }
+        for _ in 0..4 {
+            lut.extend(0..=255_u8);
+        }
+        // Two grid points per ink, black varying fastest; Lab encoded as L* · 2.55, a* + 128, b* + 128.
+        for point in 0..16 {
+            lut.extend_from_slice(if point % 2 == 1 { &[102, 148, 68] } else { &[255, 128, 128] });
+        }
+        for _ in 0..3 {
+            lut.extend(0..=255_u8);
+        }
+        icc(b"prtr", b"CMYK", b"Lab ", &[(*b"A2B0", lut)])
+    }
+
+    pub(super) fn profile_stream(n: u8, profile: Vec<u8>) -> (String, Vec<u8>) {
+        (format!("<< /N {n} /Length {} >>", profile.len()), profile)
+    }
+
+    /// A form XObject covering the page, with the dictionary entries `extra`.
+    fn form(extra: &str, content: &str) -> (String, Vec<u8>) {
+        (format!("<< /Type /XObject /Subtype /Form /BBox [0 0 130 70] {extra} /Length {} >>", content.len()), content.as_bytes().to_vec())
+    }
+
+    /// A 130 × 70 pt page that draws `content` with `resources`, whose objects 5, 6, … are the
+    /// streams `objects`.
+    pub(super) fn page_pdf(content: &str, resources: &str, objects: &[(String, Vec<u8>)]) -> Vec<u8> {
+        let mut pdf = format!(
+            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 130 70] /Contents 4 0 R /Resources {resources} >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n",
+            content.len()
+        )
+        .into_bytes();
+        for (i, (dict, data)) in objects.iter().enumerate() {
+            pdf.extend(format!("{} 0 obj {dict} stream\n", i + 5).bytes());
+            pdf.extend_from_slice(data);
+            pdf.extend_from_slice(b"\nendstream endobj\n");
+        }
+        pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF");
+        pdf
+    }
+
+    /// Draw `content` with `resources` on a 130 × 70 pt page whose objects 5, 6, … are the
+    /// streams `objects`, and give the color at each of `points` (from the top left).
+    pub(super) fn colors(content: &str, resources: &str, objects: &[(String, Vec<u8>)], points: &[(usize, usize)]) -> Vec<[u8; 3]> {
+        let Pixels { width, height, rgba } = render(&page_pdf(content, resources, objects));
+        assert_eq!((width as usize, height), (WIDTH, 70));
+        points.iter().map(|&(x, y)| rgba[(y * WIDTH + x) * 4..][..3].try_into().unwrap()).collect()
+    }
+
+    #[track_caller]
+    pub(super) fn assert_near(got: [u8; 3], want: [u8; 3], what: &str) {
+        assert!(got.iter().zip(want).all(|(got, want)| got.abs_diff(want) <= 6), "{what}: got {got:?}, expected about {want:?}");
+    }
+
+    /// Device CMYK black ink through hayro's own CMYK profile: near black.
+    #[track_caller]
+    fn assert_dark(got: [u8; 3], what: &str) {
+        assert!(got.iter().all(|c| *c < 90), "{what}: got {got:?}, expected near black");
+    }
+
+    /// `rg`, `RG`, `/DeviceRGB cs` and a `/ColorSpace` resource naming DeviceRGB all draw in the
+    /// page's DefaultRGB; without one they draw device red.
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    fn device_rgb_operators_draw_in_default_rgb() {
+        let content = "1 0 0 rg 0 0 30 70 re f /DeviceRGB cs 1 0 0 sc 32 0 30 70 re f /CS0 cs 1 0 0 sc 64 0 30 70 re f \
+                       1 0 0 RG 20 w 111 0 m 111 70 l S";
+        let points = [(15, 35), (47, 35), (79, 35), (111, 35)];
+        let what = ["rg", "/DeviceRGB cs", "/CS0 cs (/DeviceRGB)", "RG"];
+        let objects = [profile_stream(3, rgb_profile([1, 2, 0]))];
+        let calibrated = colors(content, "<< /ColorSpace << /DefaultRGB [/ICCBased 5 0 R] /CS0 /DeviceRGB >> >>", &objects, &points);
+        for (got, what) in calibrated.into_iter().zip(what) {
+            assert_near(got, GREEN, &format!("{what} with DefaultRGB"));
+        }
+        let device = colors(content, "<< /ColorSpace << /CS0 /DeviceRGB >> >>", &objects, &points);
+        for (got, what) in device.into_iter().zip(what) {
+            assert_eq!(got, RED, "{what} without DefaultRGB");
+        }
+    }
+
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    fn device_cmyk_operators_draw_in_default_cmyk() {
+        let content = "0 0 0 1 k 0 0 40 70 re f /DeviceCMYK cs 0 0 0 1 sc 45 0 40 70 re f 0 0 0 1 K 20 w 110 0 m 110 70 l S";
+        let points = [(20, 35), (65, 35), (110, 35)];
+        let what = ["k", "/DeviceCMYK cs", "K"];
+        let objects = [profile_stream(4, cmyk_profile())];
+        let calibrated = colors(content, "<< /ColorSpace << /DefaultCMYK [/ICCBased 5 0 R] >> >>", &objects, &points);
+        for (got, what) in calibrated.into_iter().zip(what) {
+            assert_near(got, INK_BLUE, &format!("{what} with DefaultCMYK"));
+        }
+        for (got, what) in colors(content, "<< >>", &objects, &points).into_iter().zip(what) {
+            assert_dark(got, &format!("{what} without DefaultCMYK"));
+        }
+    }
+
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    fn device_gray_operators_draw_in_default_gray() {
+        let content = "0 g 0 0 40 70 re f /DeviceGray cs 0 sc 45 0 40 70 re f 0 G 20 w 110 0 m 110 70 l S";
+        let points = [(20, 35), (65, 35), (110, 35)];
+        let what = ["g", "/DeviceGray cs", "G"];
+        let objects = [profile_stream(1, gray_profile())];
+        let calibrated = colors(content, "<< /ColorSpace << /DefaultGray [/ICCBased 5 0 R] >> >>", &objects, &points);
+        for (got, what) in calibrated.into_iter().zip(what) {
+            assert_near(got, MID_GRAY, &format!("{what} with DefaultGray"));
+        }
+        for (got, what) in colors(content, "<< >>", &objects, &points).into_iter().zip(what) {
+            assert_eq!(got, BLACK, "{what} without DefaultGray");
+        }
+    }
+
+    /// Image XObjects and inline images (whose `/RGB` and `/G` abbreviate the device spaces, or
+    /// that name a `/ColorSpace` resource that is DeviceRGB) in a device space draw in its default.
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    fn device_images_draw_in_the_default_color_spaces() {
+        let content = "q 20 0 0 70 0 0 cm /R Do Q q 20 0 0 70 22 0 cm /G Do Q q 20 0 0 70 44 0 cm /K Do Q \
+                       q 20 0 0 70 66 0 cm BI /W 1 /H 1 /CS /RGB /BPC 8 /F /AHx ID ff0000> EI Q \
+                       q 20 0 0 70 88 0 cm BI /W 1 /H 1 /CS /CS0 /BPC 8 /F /AHx ID ff0000> EI Q \
+                       q 20 0 0 70 110 0 cm BI /W 1 /H 1 /CS /G /BPC 8 /F /AHx ID 00> EI Q";
+        let points = [(10, 35), (32, 35), (54, 35), (76, 35), (98, 35), (120, 35)];
+        let image = |space: &str, data: &[u8]| {
+            let dict =
+                format!("<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /{space} /BitsPerComponent 8 /Length {} >>", data.len());
+            (dict, data.to_vec())
+        };
+        let objects = [
+            profile_stream(3, rgb_profile([1, 2, 0])),
+            profile_stream(1, gray_profile()),
+            profile_stream(4, cmyk_profile()),
+            image("DeviceRGB", &[255, 0, 0]),
+            image("DeviceGray", &[0]),
+            image("DeviceCMYK", &[0, 0, 0, 255]),
+        ];
+        let x_objects = "/XObject << /R 8 0 R /G 9 0 R /K 10 0 R >>";
+        let defaults = "/DefaultRGB [/ICCBased 5 0 R] /DefaultGray [/ICCBased 6 0 R] /DefaultCMYK [/ICCBased 7 0 R]";
+        let calibrated = colors(content, &format!("<< /ColorSpace << {defaults} /CS0 /DeviceRGB >> {x_objects} >>"), &objects, &points);
+        assert_near(calibrated[0], GREEN, "DeviceRGB image");
+        assert_near(calibrated[1], MID_GRAY, "DeviceGray image");
+        assert_near(calibrated[2], INK_BLUE, "DeviceCMYK image");
+        assert_near(calibrated[3], GREEN, "inline /RGB image");
+        assert_near(calibrated[4], GREEN, "inline image in /CS0 (/DeviceRGB)");
+        assert_near(calibrated[5], MID_GRAY, "inline /G image");
+
+        let device = colors(content, &format!("<< /ColorSpace << /CS0 /DeviceRGB >> {x_objects} >>"), &objects, &points);
+        assert_eq!(device[0], RED, "DeviceRGB image without DefaultRGB");
+        assert_eq!(device[1], BLACK, "DeviceGray image without DefaultGray");
+        assert_dark(device[2], "DeviceCMYK image without DefaultCMYK");
+        assert_eq!(device[3], RED, "inline /RGB image without DefaultRGB");
+        assert_eq!(device[4], RED, "inline /CS0 image without DefaultRGB");
+        assert_eq!(device[5], BLACK, "inline /G image without DefaultGray");
+    }
+
+    /// Shadings in a device space, painted by `sh` or as a shading pattern, with colors from a
+    /// function (axial) or from their vertices (a Type 4 mesh), draw in its default.
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    fn device_shadings_draw_in_the_default_color_spaces() {
+        let axial = |space: &str, color: &str| {
+            format!(
+                "<< /ShadingType 2 /ColorSpace /{space} /Coords [0 0 130 0] /Extend [true true] \
+                 /Function << /FunctionType 2 /Domain [0 1] /C0 [{color}] /C1 [{color}] /N 1 >> >>"
+            )
+        };
+        // Two red triangles over the page: a flag, x, y and red, green and blue, a byte each.
+        let mut mesh: Vec<u8> = Vec::new();
+        for (x, y) in [(0, 0), (255, 0), (0, 255), (255, 0), (255, 255), (0, 255)] {
+            mesh.extend_from_slice(&[0, x, y, 255, 0, 0]);
+        }
+        let objects = [
+            profile_stream(3, rgb_profile([1, 2, 0])),
+            profile_stream(1, gray_profile()),
+            (
+                format!(
+                    "<< /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 \
+                     /Decode [0 255 0 255 0 1 0 1 0 1] /Length {} >>",
+                    mesh.len()
+                ),
+                mesh,
+            ),
+        ];
+        let content = "q 0 0 30 70 re W n /A sh Q /Pattern cs /P scn 32 0 30 70 re f \
+                       q 64 0 30 70 re W n /M sh Q q 96 0 30 70 re W n /G sh Q";
+        let points = [(15, 35), (47, 35), (79, 35), (111, 35)];
+        let shadings = format!(
+            "/Shading << /A {} /M 7 0 R /G {} >> /Pattern << /P << /PatternType 2 /Shading {} >> >>",
+            axial("DeviceRGB", "1 0 0"),
+            axial("DeviceGray", "0"),
+            axial("DeviceRGB", "1 0 0")
+        );
+        let calibrated = colors(
+            content,
+            &format!("<< /ColorSpace << /DefaultRGB [/ICCBased 5 0 R] /DefaultGray [/ICCBased 6 0 R] >> {shadings} >>"),
+            &objects,
+            &points,
+        );
+        assert_near(calibrated[0], GREEN, "sh, an axial shading in DeviceRGB");
+        assert_near(calibrated[1], GREEN, "a shading pattern in DeviceRGB");
+        assert_near(calibrated[2], GREEN, "sh, a Type 4 mesh in DeviceRGB");
+        assert_near(calibrated[3], MID_GRAY, "sh, an axial shading in DeviceGray");
+
+        let device = colors(content, &format!("<< {shadings} >>"), &objects, &points);
+        assert_near(device[0], RED, "sh, an axial shading without DefaultRGB");
+        assert_near(device[1], RED, "a shading pattern without DefaultRGB");
+        assert_near(device[2], RED, "sh, a Type 4 mesh without DefaultRGB");
+        assert_near(device[3], BLACK, "sh, an axial shading without DefaultGray");
+    }
+
+    /// One image drawn by a page with DefaultRGB and by a form that switches it off is decoded
+    /// for each: the decoded-image cache keys the default.
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    fn an_image_drawn_with_and_without_a_default_keeps_both_colors() {
+        let objects = [
+            profile_stream(3, rgb_profile([1, 2, 0])),
+            (ONE_PIXEL_RGB.to_owned(), vec![255, 0, 0]),
+            form("/Resources << /ColorSpace << /DefaultRGB /DeviceRGB >> /XObject << /R 6 0 R >> >>", "q 40 0 0 70 70 0 cm /R Do Q"),
+        ];
+        let got = colors(
+            "q 40 0 0 70 0 0 cm /R Do Q /F Do",
+            "<< /ColorSpace << /DefaultRGB [/ICCBased 5 0 R] >> /XObject << /R 6 0 R /F 7 0 R >> >>",
+            &objects,
+            &[(20, 35), (90, 35)],
+        );
+        assert_near(got[0], GREEN, "the image on the page, in DefaultRGB");
+        assert_eq!(got[1], RED, "the same image in the form without DefaultRGB");
+    }
+
+    /// A form XObject draws device color in the defaults of the resources in its scope: the
+    /// page's when it has no `/Resources` (directly or nested in another form), else only its
+    /// own, as for every other resource here. PdfCraft, Poppler and MuPDF also fall back to the
+    /// page's default from a form with `/Resources` of its own. A form whose own default is a
+    /// device space or not a usable default draws device color.
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    fn forms_draw_in_the_default_color_spaces_of_their_resource_scope() {
+        let blue = rgb_profile([2, 0, 1]);
+        let objects = [
+            profile_stream(3, rgb_profile([1, 2, 0])),
+            // hayro caches a profile by its stream's dictionary, which would otherwise match the first.
+            (format!("<< /N 3 /Alternate /DeviceRGB /Length {} >>", blue.len()), blue),
+            form("", "1 0 0 rg 22 37 20 33 re f"),
+            form("/Resources << /ProcSet [/PDF] >>", "1 0 0 rg 44 37 20 33 re f"),
+            form("/Resources << /ColorSpace << /DefaultRGB [/ICCBased 6 0 R] >> /XObject << /N 12 0 R >> >>", "1 0 0 rg 66 37 20 33 re f /N Do"),
+            form("/Resources << /ColorSpace << /DefaultRGB /DeviceRGB >> >>", "1 0 0 rg 88 37 20 33 re f"),
+            form("/Resources << /ColorSpace << /DefaultRGB [/Lab << /WhitePoint [0.9642 1 0.8249] >>] >> >>", "1 0 0 rg 110 37 20 33 re f"),
+            form("", "1 0 0 rg 0 0 20 33 re f"),
+            form("/Resources << /ColorSpace << /CS1 /DeviceGray >> >>", "1 0 0 rg 22 0 20 33 re f"),
+        ];
+        let got = colors(
+            "1 0 0 rg 0 37 20 33 re f /A Do /B Do /C Do /D Do /E Do /F Do",
+            "<< /ColorSpace << /DefaultRGB [/ICCBased 5 0 R] >> /XObject << /A 7 0 R /B 8 0 R /C 9 0 R /D 10 0 R /E 11 0 R /F 13 0 R >> >>",
+            &objects,
+            &[(10, 17), (32, 17), (54, 17), (76, 17), (98, 17), (120, 17), (10, 53), (32, 53)],
+        );
+        assert_near(got[0], GREEN, "the page");
+        assert_near(got[1], GREEN, "a form without /Resources");
+        assert_eq!(got[2], RED, "a form whose /Resources has no /ColorSpace");
+        assert_near(got[3], BLUE, "a form with a DefaultRGB of its own");
+        assert_eq!(got[4], RED, "a form whose DefaultRGB is /DeviceRGB");
+        assert_eq!(got[5], RED, "a form whose DefaultRGB is a Lab space");
+        assert_near(got[6], BLUE, "a form nested in the one with its own DefaultRGB");
+        assert_eq!(got[7], RED, "a form whose /ColorSpace has no DefaultRGB");
+    }
+
+    /// A default that cannot stand in for its device space (Lab, Indexed, Pattern, another device
+    /// space, the wrong number of components, or no color space) leaves device color as it is,
+    /// and the dictionary's other defaults still apply.
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    fn unusable_defaults_leave_device_color_alone() {
+        let objects = [
+            profile_stream(1, gray_profile()),
+            profile_stream(4, cmyk_profile()),
+            (String::from("<< /N 3 /Length 13 >>"), b"not a profile".to_vec()),
+        ];
+        for default in [
+            "[/Lab << /WhitePoint [0.9642 1 0.8249] >>]",
+            "[/CalGray << /WhitePoint [0.9642 1 0.8249] >>]",
+            "[/Indexed /DeviceRGB 0 <00FF00>]",
+            "/Pattern",
+            "[/Pattern /DeviceRGB]",
+            "/DeviceCMYK",
+            "/DeviceGray",
+            "[/ICCBased 6 0 R]",
+            "[/ICCBased 7 0 R]",
+            "42",
+            "[/NoSuchSpace]",
+            "/DefaultRGB",
+        ] {
+            let got = colors(
+                "1 0 0 rg 0 0 60 70 re f 0 g 70 0 60 70 re f",
+                &format!("<< /ColorSpace << /DefaultRGB {default} /DefaultGray [/ICCBased 5 0 R] >> >>"),
+                &objects,
+                &[(30, 35), (100, 35)],
+            );
+            assert_eq!(got[0], RED, "DefaultRGB {default}: device RGB is drawn as it is");
+            assert_near(got[1], MID_GRAY, &format!("DefaultRGB {default}: DefaultGray still applies"));
+        }
+    }
+}
+
+/// PdfCraft ledger hayro-interpret (48) and the ICC profile cache key (#3020): two `/ICCBased`
+/// profiles whose stream dictionaries are byte for byte the same (`/N 3` and one `/Length`)
+/// each draw through their own profile. hayro cached the color space it read from a profile
+/// stream by the dictionary's bytes alone, so the second profile drew through whichever was
+/// read first. The profiles are linear sRGB and the same profile with red and blue swapped,
+/// which draws red as blue; they have the same length.
+mod icc_profile_cache {
+    use super::default_color_spaces::{BLUE, RED, assert_near, colors, page_pdf, profile_stream, rgb_profile};
+    use craft_pdf::interpret::{
+        BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, InterpreterSettings, Paint, PathDrawMode, SoftMask,
+        TransformExt, font::Glyph,
+    };
+    use kurbo::{Affine, BezPath, Rect};
+
+    /// An `/ICCBased` space whose profile stream is written directly in the space's array, not
+    /// as an object of its own: the profile as ASCIIHex digits, each a token of its own, in
+    /// upper case (a lone `f` reads as a broken `false`). Its dictionary reports the object
+    /// holding the array, which is the page for every one of them.
+    fn direct_space(profile: &[u8]) -> String {
+        let hex: String = profile.iter().flat_map(|b| [b >> 4, b & 0xf]).map(|d| format!("{d:X} ")).collect();
+        format!("[/ICCBased << /N 3 /Filter /ASCIIHexDecode /Length {} >> stream\n{hex}\nendstream]", hex.len())
+    }
+
+    /// Six 20 pt squares, side by side, filled with `1 0 0 sc` (red) in `/A` (object 5, linear
+    /// sRGB), `/B` (object 6, red and blue swapped), `/A2` (object 5 again, through an array of
+    /// other bytes), `/A3` (object 7, a copy of object 5), `/C` and `/D` (the two profiles
+    /// again, each written directly in its array). Objects 5, 6 and 7 have the same dictionary,
+    /// and so do the two direct streams.
+    fn page() -> (String, String, Vec<(String, Vec<u8>)>) {
+        let (srgb, swapped) = (rgb_profile([0, 1, 2]), rgb_profile([2, 1, 0]));
+        assert_eq!(srgb.len(), swapped.len(), "the profiles have the same length, so the same dictionary");
+        assert_ne!(srgb, swapped);
+        let resources = format!(
+            "<< /ColorSpace << /A [/ICCBased 5 0 R] /B [/ICCBased 6 0 R] /A2 [ /ICCBased 5 0 R ] /A3 [/ICCBased 7 0 R] /C {} /D {} >> >>",
+            direct_space(&srgb),
+            direct_space(&swapped)
+        );
+        let content = ["A", "B", "A2", "A3", "C", "D"]
+            .iter()
+            .enumerate()
+            .map(|(i, name)| format!("/{name} cs 1 0 0 sc {} 20 20 30 re f", 2 + 21 * i))
+            .collect::<Vec<_>>()
+            .join("\n");
+        (content, resources, vec![profile_stream(3, srgb.clone()), profile_stream(3, swapped), profile_stream(3, srgb)])
+    }
+
+    /// Each square is drawn through its own profile, whether the profile is an object or
+    /// written in its array, and object 5 looked up again and its copy still draw red.
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    fn icc_profiles_with_identical_dictionaries_draw_their_own_colors() {
+        let (content, resources, objects) = page();
+        let points: Vec<_> = (0..6).map(|i| (12 + 21 * i, 35)).collect();
+        let got = colors(&content, &resources, &objects, &points);
+        let expected = [
+            ("/A, object 5, linear sRGB", RED),
+            ("/B, object 6, red and blue swapped", BLUE),
+            ("/A2, object 5 again", RED),
+            ("/A3, object 7, a copy of object 5", RED),
+            ("/C, linear sRGB written in its array", RED),
+            ("/D, red and blue swapped written in its array", BLUE),
+        ];
+        for (got, (what, want)) in got.into_iter().zip(expected) {
+            assert_near(got, want, what);
+        }
+    }
+
+    /// Draws nothing: only the color spaces the page selects matter here.
+    struct Nothing;
+    impl<'a> Device<'a> for Nothing {
+        fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
+        fn set_blend_mode(&mut self, _: BlendMode) {}
+        fn draw_path(&mut self, _: &BezPath, _: Affine, _: &Paint<'a>, _: &PathDrawMode) {}
+        fn push_clip_path(&mut self, _: &ClipPath) {}
+        fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
+        fn draw_glyph(&mut self, _: &Glyph<'a>, _: Affine, _: Affine, _: &Paint<'a>, _: &GlyphDrawMode) {}
+        fn draw_image(&mut self, _: Image<'a, '_>, _: Affine) {}
+        fn pop_clip_path(&mut self) {}
+        fn pop_transparency_group(&mut self) {}
+    }
+
+    /// The profiles are still cached: the four different ones (objects 5 and 6, and the two
+    /// written in their arrays) are read once each, and neither object 5 looked up again nor its
+    /// copy, object 7, is read again. A second pass through the same cache reads none.
+    #[cfg_attr(not(target_arch = "wasm32"), test)]
+    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+    fn icc_profiles_used_again_are_read_once() {
+        let (content, resources, objects) = page();
+        let bytes = page_pdf(&content, &resources, &objects);
+        let pdf = craft_pdf::open_slice(&bytes, None).unwrap();
+        let page = &pdf.pages()[0];
+        let cache = InterpreterCache::new();
+        for pass in ["first", "second"] {
+            let initial = page.initial_transform(true).to_kurbo();
+            let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, 130.0, 70.0), &cache, page.xref(), InterpreterSettings::default());
+            craft_pdf::interpret_page(page, &mut ctx, &mut Nothing).unwrap();
+            assert_eq!(cache.icc_profile_reads(), 4, "after the {pass} pass: each different profile is read once");
+        }
+    }
+}
diff --git a/crates/pdf/tests/upstream_text.rs b/crates/pdf/tests/upstream_text.rs
new file mode 100644
index 00000000..1e6fdacd
--- /dev/null
+++ b/crates/pdf/tests/upstream_text.rs
@@ -0,0 +1,150 @@
+//! Text contracts adapted from PdfCraft a2ec27b4775f53c40cad3456936d9406611e3a8d (MIT OR Apache-2.0):
+//! Annex D.2 alias codes, glyph names outside the Adobe Glyph List, and `/ToUnicode` identity names;
+//! and from PdfCraft 0b670caf4a090e9d83a7f41a84b4cb2144a2d33e, clipping-only text.
+#![cfg(feature = "interpret")]
+#![allow(clippy::unwrap_used, clippy::panic)]
+
+use craft_pdf::interpret::{
+    BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, InterpreterSettings, Paint, PathDrawMode, SoftMask, TransformExt,
+    font::Glyph,
+};
+use hayro_cmap::BfString;
+use kurbo::{Affine, BezPath, Rect};
+
+/// The text of each glyph drawn, `None` where the font gives none, and how it was drawn.
+#[derive(Default)]
+struct TextDevice {
+    glyphs: Vec<Option<String>>,
+    modes: Vec<char>,
+}
+
+impl Device<'_> for TextDevice {
+    fn set_soft_mask(&mut self, _: Option<SoftMask<'_>>) {}
+    fn set_blend_mode(&mut self, _: BlendMode) {}
+    fn draw_path(&mut self, _: &BezPath, _: Affine, _: &Paint<'_>, _: &PathDrawMode) {}
+    fn push_clip_path(&mut self, _: &ClipPath) {}
+    fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'_>>, _: BlendMode) {}
+    fn draw_glyph(&mut self, glyph: &Glyph<'_>, _: Affine, _: Affine, _: &Paint<'_>, mode: &GlyphDrawMode) {
+        self.modes.push(match mode {
+            GlyphDrawMode::Fill => 'F',
+            GlyphDrawMode::Stroke(_) => 'S',
+            GlyphDrawMode::Clip => 'C',
+            GlyphDrawMode::Invisible => 'I',
+        });
+        self.glyphs.push(glyph.as_unicode().map(|text| match text {
+            BfString::Char(c) => c.to_string(),
+            BfString::String(s) => s,
+        }));
+    }
+    fn draw_image(&mut self, _: Image<'_, '_>, _: Affine) {}
+    fn pop_clip_path(&mut self) {}
+    fn pop_transparency_group(&mut self) {}
+}
+
+/// The glyphs a one-page PDF draws with its font `/F1`, object 5; `extra` holds further objects.
+fn drawn_glyphs(font: &str, extra: &str, content: &[u8]) -> TextDevice {
+    let mut pdf = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj\n\
+         4 0 obj << /Length {} >> stream\n",
+        content.len()
+    )
+    .into_bytes();
+    pdf.extend_from_slice(content);
+    pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj {font} endobj\n{extra}trailer << /Root 1 0 R >>\n%%EOF\n").as_bytes());
+    let pdf = craft_pdf::open_slice(&pdf, None).unwrap();
+    let page = &pdf.pages()[0];
+    let cache = InterpreterCache::new();
+    let mut context =
+        Context::new(page.initial_transform(true).to_kurbo(), Rect::new(0.0, 0.0, 300.0, 300.0), &cache, page.xref(), InterpreterSettings::default());
+    let mut device = TextDevice::default();
+    craft_pdf::interpret_page(page, &mut context, &mut device).unwrap();
+    device
+}
+
+fn glyph_texts(font: &str, extra: &str, content: &[u8]) -> Vec<Option<String>> {
+    drawn_glyphs(font, extra, content).glyphs
+}
+
+fn helvetica_texts(encoding: &str, content: &[u8]) -> Vec<String> {
+    let font = format!("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding {encoding} >>");
+    glyph_texts(&font, "", content).into_iter().map(|text| text.unwrap_or_default()).collect()
+}
+
+/// PdfCraft ledger hayro-interpret (30): WinAnsiEncoding gives 0xAD and 0xA0 the glyph names
+/// `hyphen` and `space`, and MacRomanEncoding gives 0xCA `space` (Annex D.2), so they read as the
+/// ordinary hyphen and space rather than U+00AD and U+00A0. A `/Differences` entry naming
+/// `sfthyphen` or `nbspace` keeps its glyph list value.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space() {
+    assert_eq!(
+        helvetica_texts("/WinAnsiEncoding", b"BT /F1 20 Tf 20 150 Td (a\xadb\xa0c) Tj ET"),
+        ["a", "-", "b", " ", "c"],
+        "WinAnsi 0xAD and 0xA0"
+    );
+    assert_eq!(helvetica_texts("/MacRomanEncoding", b"BT /F1 20 Tf 20 150 Td (a\xcab) Tj ET"), ["a", " ", "b"], "MacRoman 0xCA");
+    assert_eq!(
+        helvetica_texts(
+            "<< /Type /Encoding /BaseEncoding /WinAnsiEncoding /Differences [88 /sfthyphen 89 /nbspace] >>",
+            b"BT /F1 20 Tf 20 150 Td (aXbYc) Tj ET"
+        ),
+        ["a", "\u{ad}", "b", "\u{a0}", "c"],
+        "a named glyph keeps its glyph list value"
+    );
+}
+
+/// PdfCraft ledger hayro-interpret P6 (#3169, #3170): ligature (`f_i`) and suffixed
+/// (`hyphen.case`) names read by the glyph list specification's full mapping. A name that only
+/// numbers the glyph (`C39`, `c251`), a ZapfDingbats name (`a12`) and a name with no meaning
+/// left (`foo`) read as nothing.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn glyph_names_outside_the_glyph_list_still_read_as_text() {
+    let encoding = "<< /Type /Encoding /Differences [30 /f_i /f_l 2 /hyphen.case 39 /C39 97 /c251 174 /C174 \
+                    88 /a12 /foo /uni00660069 61 /C39.sc 233 /C1] >>";
+    let texts = helvetica_texts(encoding, b"BT /F1 20 Tf 20 150 Td (\x1e\x1f\x02'a\xaeXYZ=\xe9) Tj ET");
+    assert_eq!(texts, ["fi", "fl", "-", "", "", "", "", "", "fi", "", ""]);
+}
+
+/// PdfCraft ledger hayro-interpret P6: the `uni` and `u` forms take uppercase hex digits only.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn glyph_names_with_lowercase_hex_read_as_nothing() {
+    let encoding = "<< /Type /Encoding /Differences [65 /uni20ac0308 /uni20AC0308 /u1040c.alt /u1040C.alt /f_uni20ac /f_uni20AC] >>";
+    let texts = helvetica_texts(encoding, b"BT /F1 20 Tf 20 150 Td (ABCDEF) Tj ET");
+    assert_eq!(texts, ["", "\u{20ac}\u{308}", "", "\u{1040c}", "f", "f\u{20ac}"]);
+}
+
+/// PdfCraft ledger hayro-interpret (44): `/ToUnicode /Identity-H` (a name, not a CMap stream)
+/// reads two-byte codes as their Unicode values. Controls (a DEL and a C1 control) are not text.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn identity_to_unicode_names_give_text() {
+    for name in ["Identity-H", "Identity-V"] {
+        let font = format!(
+            "<< /Type /Font /Subtype /Type0 /BaseFont /RobotoMono-Regular /Encoding /Identity-H /DescendantFonts [6 0 R] /ToUnicode /{name} >>"
+        );
+        let cid = "6 0 obj << /Type /Font /Subtype /CIDFontType2 /BaseFont /RobotoMono-Regular \
+                   /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> /DW 600 /CIDToGIDMap /Identity >> endobj\n";
+        let texts = glyph_texts(&font, cid, b"BT /F1 12 Tf 20 200 Td <005A00FC0072006900630068002020AC007F0085> Tj ET");
+        let texts: Vec<String> = texts.into_iter().map(|text| text.unwrap_or_default()).collect();
+        assert_eq!(texts, ["Z", "\u{fc}", "r", "i", "c", "h", " ", "\u{20ac}", "", ""], "{name}");
+    }
+}
+
+/// PdfCraft #3109 / #3116: text in mode 7 (clip only) reaches the device as
+/// `GlyphDrawMode::Clip`, apart from mode 3 (invisible OCR text), so extraction that leaves out
+/// OCR text keeps a heading drawn through its clip.
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+fn clipping_only_text_reaches_the_device_apart_from_invisible_text() {
+    let font = "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>";
+    for (mode, expected) in [(0, 'F'), (3, 'I'), (7, 'C')] {
+        let content = format!("q BT /F1 24 Tf {mode} Tr 30 200 Td (Hi) Tj ET 0 0 1 rg 0 0 300 300 re f Q");
+        let drawn = drawn_glyphs(font, "", content.as_bytes());
+        assert_eq!(drawn.glyphs, [Some("H".into()), Some("i".into())], "{mode} Tr");
+        assert_eq!(drawn.modes, [expected; 2], "{mode} Tr");
+    }
+}
diff --git a/crates/pdf/tests/writing.rs b/crates/pdf/tests/writing.rs
index da611b61..de77d490 100644
--- a/crates/pdf/tests/writing.rs
+++ b/crates/pdf/tests/writing.rs
@@ -16,6 +16,7 @@ fn document(compress: bool) -> Vec<u8> {
         description: Some("Original synthetic artwork".into()),
         keywords: vec!["craft".into(), "pdf".into()],
         created: Some(backend::metadata::DateTime::new(2026).month(10).day(9)),
+        modified: Some(backend::metadata::DateTime::new(2026).month(10).day(12)),
     };
     let settings = backend::SerializeSettings {
         compress_content_streams: compress,
@@ -49,9 +50,25 @@ fn writes_pages_metadata_and_selected_version_without_a_renderer() {
         let pdf = hayro_syntax::Pdf::new(std::sync::Arc::new(bytes.clone())).unwrap();
         let sizes: Vec<_> = pdf.pages().iter().map(|page| page.render_dimensions()).collect();
         assert_eq!(sizes, vec![(80.0, 40.0), (30.0, 60.0)]);
+        let day = |d: &Option<hayro_syntax::object::DateTime>| d.as_ref().map(|d| (d.year, d.month, d.day));
+        assert_eq!(day(&pdf.metadata().creation_date), Some((2026, 10, 9)));
+        assert_eq!(day(&pdf.metadata().modification_date), Some((2026, 10, 12)));
+        assert!(text.contains("<xmp:CreateDate>2026-10-09") && text.contains("<xmp:ModifyDate>2026-10-12"), "XMP dates");
     }
 }
 
+/// Without a modification date, the creation date is written as both.
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn the_creation_date_is_the_modification_date_when_none_is_given() {
+    let created = Some(backend::metadata::DateTime::new(2026).month(10).day(9));
+    let mut writer = Writer::new(Default::default(), Metadata { created, ..Default::default() });
+    writer.document_mut().start_page_with(PageSettings::from_wh(40.0, 20.0).unwrap()).finish();
+    let pdf = hayro_syntax::Pdf::new(std::sync::Arc::new(writer.finish().unwrap())).unwrap();
+    let day = |d: &Option<hayro_syntax::object::DateTime>| d.as_ref().map(|d| (d.year, d.month, d.day));
+    assert_eq!(day(&pdf.metadata().modification_date), Some((2026, 10, 9)));
+}
+
 #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
 #[cfg_attr(not(target_arch = "wasm32"), test)]
 fn fixed_input_does_not_read_a_clock_or_change_pdf_bytes() {
@@ -317,3 +334,40 @@ fn empty_language_is_absent_and_keeps_required_language_validation() {
     }
     assert_eq!(outputs[0], outputs[1], "empty language and absent language must serialize identically");
 }
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn only_web_and_mail_link_targets_become_uri_links() {
+    use backend::annotation::{Annotation, LinkAnnotation};
+    use hayro_syntax::object::{Array, Dict, String as PdfString};
+    let urls = [
+        " https://example.com/deck ",
+        "mailto:someone@example.com",
+        "javascript:alert(1)",
+        "data:text/html,<script>alert(1)</script>",
+        "file://attacker.example/share/x",
+        "\\\\attacker.example\\share\\x",
+        "//attacker.example/share/x",
+        "ms-msdt:/id PCWDiagnostic",
+        "search-ms:query=x&crumb=location:\\\\attacker.example\\share",
+    ];
+    let settings = backend::SerializeSettings { configuration: write::configuration(PdfVersion::Pdf17, None).unwrap(), ..Default::default() };
+    let mut writer = Writer::new(settings, Metadata::default());
+    let mut page = writer.document_mut().start_page_with(PageSettings::new(Size::from_wh(200.0, 400.0).unwrap()));
+    for (i, url) in (0u8..).zip(urls) {
+        let rect = Rect::from_xywh(10.0, 10.0 + 30.0 * f32::from(i), 100.0, 20.0).unwrap();
+        if let Some(target) = write::uri_target(url) {
+            page.add_annotation(Annotation::new_link(LinkAnnotation::new(rect, target), None));
+        }
+    }
+    page.finish();
+    let bytes = writer.finish().unwrap();
+    let pdf = hayro_syntax::Pdf::new(std::sync::Arc::new(bytes)).unwrap();
+    let annotations = pdf.pages()[0].raw().get::<Array<'_>>(b"Annots").unwrap();
+    let uris: Vec<String> = annotations
+        .iter::<Dict<'_>>()
+        .filter_map(|a| a.get::<Dict<'_>>(b"A")?.get::<PdfString<'_>>(b"URI"))
+        .map(|s| String::from_utf8_lossy(s.as_bytes()).into_owned())
+        .collect();
+    assert_eq!(uris, ["https://example.com/deck", "mailto:someone@example.com"]);
+}
diff --git a/crates/plate-test/Cargo.toml b/crates/plate-test/Cargo.toml
new file mode 100644
index 00000000..f17bbce4
--- /dev/null
+++ b/crates/plate-test/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "craft-plate-test"
+description = "Print-color test scenes for Craft apps: reference PDFs and PDF structure checks"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+publish = false
+
+[lints]
+workspace = true
+
+[dependencies]
+craft-cms = { workspace = true }
+craft-pdf = { workspace = true, features = ["write-pdf", "write-simple-text"] }
+hayro-syntax = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
diff --git a/crates/plate-test/README.md b/crates/plate-test/README.md
new file mode 100644
index 00000000..8b1f7056
--- /dev/null
+++ b/crates/plate-test/README.md
@@ -0,0 +1,161 @@
+# Craft plate test
+
+`craft-plate-test` holds print-color test scenes for the Craft apps and the tools to check PDFs
+against them. A scene is an app-neutral JSON description of one page (spot inks, CMYK fills,
+transparency, overprint, soft masks, placed PDFs), the ink each plate must carry at sample points,
+and the PDF structure a correct print export has.
+
+- `scene`: serde types for the scene files in `scenes/`, and `Scene::validate` for the checks a
+  schema can't make (declared inks, geometry fields per object type, plates named by points).
+- `reference`: writes a scene to PDF with krilla through craft-pdf. It tests the shared writer on
+  its own. A feature the writer can't express yet returns `Error::Unsupported`.
+- `structure`: summarizes a PDF with hayro-syntax (page and form transparency groups with `/S /CS
+  /I /K`; graphics states with `OP op OPM BM SMask`; color space families; DeviceRGB use;
+  output intents) and checks the summary against a scene's `structure` block.
+- `gs`, `tiff`, `judge`, `report`: the local plate check (below).
+
+`tests/scenes.rs` parses every scene, writes every scene without `pending`, and checks the
+structure. It runs in CI in seconds, with the unit tests of the TIFF reader and the judge.
+
+## Scenes
+
+The file names say what each scene tests; `title` and `source` say more.
+
+| IDs | Cases |
+|---|---|
+| `S01`–`S17` | Print-color research cases: overprint, spots, blending spaces, knockout and isolated groups, masks, placed PDFs, gradients |
+| `D01`–`D10` | DesignCraft print cases (its DC list) and a GWG idea (D04) |
+| `M1`, `M2`, `N1` | Luminosity mask backdrop and transfer; DeviceN overprint |
+| `F01` | Flattener: a semi-transparent image over a flat fill; where the image's alpha is 0 the fill prints unchanged (vectorcraft#2160) |
+| `F02` | Flattener: art hidden under opaque fills, with transparency over them, leaves no trace (vectorcraft#2161) |
+
+## Scene format
+
+Coordinates are points from the page's top-left corner; rectangles are `[x, y, width, height]`.
+Ink values are percentages (0 = no ink, 100 = solid). Plates use separation names: `Cyan`,
+`Magenta`, `Yellow`, `Black` and the spot names.
+
+| Field | Meaning |
+|---|---|
+| `id`, `title`, `source`, `note` | Identity and origin (research case, app regression) |
+| `page` | `[width, height]` in pt |
+| `inks` | Spot inks, each `{"name", "cmyk": [c, m, y, k]}` or `"lab": [L, a, b]`; their order is the DeviceN colorant order after the process inks |
+| `settings` | `group_cs` (`"rgb"` or `"cmyk"`: the transparency blending space), `output_intent` (`"fogra39"`: writes the scene with craft-pdf `write::print` settings and craft-cms's `COATED_FOGRA39_ICC`; `tests/scenes.rs` also writes every non-pending scene this way) |
+| `objects` | Drawn in order (below) |
+| `expect` | `plates`: every plate the separation must produce, process plates included, and no others. `points`: `{at, kind: "area" or "text", region (text), plate (text, default Black), inks: {plate: value or [lo, hi]}, tol, info, note}`; unlisted plates expect 0, `info` points are measured but not judged |
+| `structure` | Expected PDF structure (below) |
+| `pending` | The task that makes the scene writable, e.g. `"T4"`; pending scenes are parsed but not written |
+
+Objects have a `type`: `rect` and `ellipse` (`rect`), `text` (`at` = baseline start, `size`,
+`text`), `image` (`rect`, `image`), `pdf` (`rect`, `scene` = id of a scene placed as a page),
+`group` (`objects`, `isolated`, `knockout`). Any object can carry `opacity` (whole object, as a
+transparency group), `blend` (`multiply`, `color`, … in kebab case), `overprint` (`{fill, stroke,
+mode}`, mode = OPM, default 1) and `mask` (`{kind: "luminosity" or "alpha", content: [objects],
+backdrop, transfer}`; `backdrop` is a process or gray paint, `transfer` a list of samples 0–1). Shapes and text take `fill` and `stroke` (`{paint, width}`).
+
+Paints:
+
+| Paint | Example |
+|---|---|
+| Process | `{"cmyk": [100, 0, 0, 0]}` |
+| Gray (black ink %, written as DeviceGray) | `{"gray": 50}` |
+| RGB (0–255) | `{"rgb": [255, 0, 0]}` |
+| Spot | `{"spot": "Gold", "tint": 50}` (tint defaults to 100) |
+| Several inks (DeviceN) | `{"inks": {"Cyan": 60, "Black": 40}}` |
+| Registration (`/All`) | `"registration"` |
+| Linear gradient | `{"linear": {"from": [x, y], "to": [x, y], "stops": [{"at": 0, "paint": …}, …]}}` |
+| Mesh gradient (one Coons patch with straight edges) | `{"mesh": {"rect": [x, y, w, h], "corners": [paint, paint, paint, paint]}}` (top left, top right, bottom right, bottom left) |
+
+Images are synthetic: `{"px": [w, h], "ramp": [paint, paint]}` (left to right),
+`"split": [paint, paint]` (left and right halves) or `"feather": pt` (a gray soft-mask image,
+white inside and fading to black at the edges). Shadows and feathers are luminosity masks over
+such an image. A ramp or split image can carry `"alpha": {"rect": [x, y, w, h], "opacity": 0.6}`,
+written as its `/SMask` like a PNG with transparency: pixels whose centers lie in `rect` (page
+pt) have that opacity, the rest 0.
+
+Tolerances: ±2 for device, spot and overprint values; ±6 for blends and ICC; ±10 for shadows and
+gradients.
+
+### The `structure` block
+
+Each field is optional; only the fields present are checked.
+
+| Field | Check |
+|---|---|
+| `page_group` | The page group's `/CS` family; `"none"` = no page group, `"no-cs"` = a group without `/CS` |
+| `group_cs` | The set of `/CS` values of form and soft-mask groups (`"none"` = no `/CS`) |
+| `knockout`, `isolated` | Some group has `/K true` / `/I true` (page groups excluded for `isolated`) |
+| `overprint`, `smask` | Some graphics state sets `OP` or `op` true / a soft mask |
+| `blend_modes` | The set of blend modes other than Normal |
+| `ext_g_states` | Each entry (keys `OP op OPM BM SMask BC TR`) matches some graphics state |
+| `color_spaces`, `color_spaces_include` | The exact set / a subset of color space families, e.g. `DeviceCMYK`, `Separation(Gold, alt DeviceCMYK)` |
+| `device_rgb` | Some painting color space, alternates included, is DeviceRGB |
+| `output_intents` | The `/S` of each output intent |
+
+A failing check prints the full summary as JSON, which is also the quickest way to write a new
+block.
+
+## Adding a scene
+
+1. Add `scenes/<ID>-<slug>.json`. Reuse the 360 × 216 pt page and the `Gold` spot unless the
+   case needs otherwise. Use fonts and images that the harness makes; never commit fonts, GWG
+   files or other third-party test files.
+2. Add `pending` when the writer can't express the scene yet, and remove it in the change that
+   adds the feature.
+3. Run `cargo test -p craft-plate-test`.
+
+Text uses `Inter-Regular.ttf` from `CRAFT_PDF_TEST_FONT_DIR`
+(`python scripts/fetch-pdf-test-fonts.py <dir outside the checkout>`). Without it, text objects
+are skipped with a printed note.
+
+## Use from an app
+
+Add the crate as a dev-dependency and write an adapter in the app's tests: build each scene as an
+app document, export it through the app's own print path, and check the result with
+`structure::summarize` and the scene's `structure` block. Scenes the app can't build yet are
+skipped by the adapter, not edited.
+
+```rust
+let scenes = craft_plate_test::scene::load_dir(&craft_plate_test::scene::scenes_dir())?;
+for scene in scenes.iter().filter(|s| s.pending.is_none()) {
+    let pdf = my_app_export(scene)?; // the app's adapter
+    let summary = craft_plate_test::structure::summarize(&pdf)?;
+    assert!(scene.structure.check(&summary).is_empty());
+}
+```
+
+## Plate check (local only)
+
+```sh
+scripts/plate-check.sh
+```
+
+The check writes every scene, separates it with Ghostscript's `tiffsep` device at 72 dpi with
+overprint simulated, and judges the plates:
+
+- Area points: the median of the 5 × 5 pixels around the point, per plate.
+- Text points: the median over the glyph's pixels, those in `region` with at least half the
+  darkest ink on the point's `plate`.
+- Each point's plates within `tol` of the expected value (or inside the `[lo, hi]` range).
+- The separation produces exactly the scene's `plates`.
+
+Pending scenes are written without the features they wait for (`reference::write_partial`) and
+are expected to fail; the report shows what the writer prints today. A pending scene that passes
+is reported as such: its plates don't show the missing feature under Ghostscript, so its
+`structure` block is the check that does. The test fails when a scene without `pending` fails or
+the harness errors.
+
+`scripts/plate-check.sh --flatten` runs the same check on each scene's page flattened by
+craft-prepress (`flatten_page` at 300 dpi; the test is `flatten_plates` in craft-prepress, since
+craft-prepress dev-depends on this crate). The flattened page must also have no transparency
+left (`structure::transparency`: transparency groups, soft masks in graphics states, blend modes
+other than Normal, `ca`/`CA` below 1). Its report goes to `plate-test/flattened/` and shows both
+pages side by side, with the flattener's time per scene.
+
+The results go to `plate-test/report.md` and `results.json` in Cargo's target directory
+(`CARGO_TARGET_DIR` is respected). The script sets `CRAFT_PDF_TEST_FONT_DIR` to
+`~/.cache/craft-pdf-test-fonts` when the font is there; without the font, text points are skipped.
+
+Ghostscript is AGPL. It runs only as an external program on developer machines (`gs` on `PATH`, or
+`CRAFT_PLATE_TEST_GS`), never in CI. Don't link it, copy its code, or commit its output. Without
+Ghostscript the test returns with a note.
diff --git a/crates/plate-test/scenes/D01-spot-control.json b/crates/plate-test/scenes/D01-spot-control.json
new file mode 100644
index 00000000..0440f400
--- /dev/null
+++ b/crates/plate-test/scenes/D01-spot-control.json
@@ -0,0 +1,25 @@
+{
+  "id": "D01",
+  "title": "Gold alone, no transparency",
+  "source": "DesignCraft DC01",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "objects": [{"type": "rect", "rect": [36, 36, 108, 144], "fill": {"spot": "Gold", "tint": 100}}],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {"at": [90, 108], "inks": {"Gold": 100}, "tol": 2, "note": "spot fill"},
+      {"at": [300, 108], "inks": {}, "tol": 2, "note": "paper"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": false,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["Separation(Gold, alt DeviceCMYK)"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/D04-spot-opacity.json b/crates/plate-test/scenes/D04-spot-opacity.json
new file mode 100644
index 00000000..bcf8a25d
--- /dev/null
+++ b/crates/plate-test/scenes/D04-spot-opacity.json
@@ -0,0 +1,37 @@
+{
+  "id": "D04",
+  "title": "Gold at 50% opacity over C100",
+  "source": "DesignCraft DC04",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "rect", "rect": [36, 36, 180, 144], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [144, 36, 180, 144],
+      "fill": {"spot": "Gold", "tint": 100},
+      "opacity": 0.5
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {"at": [90, 108], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"},
+      {
+        "at": [180, 108],
+        "inks": {"Cyan": 50, "Gold": 50},
+        "tol": 6,
+        "note": "half the spot, half the cyan"
+      },
+      {"at": [290, 108], "inks": {"Gold": 50}, "tol": 6, "note": "spot 50% over paper"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "group_cs": ["none"],
+    "color_spaces": ["DeviceCMYK", "Separation(Gold, alt DeviceCMYK)"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/D06-stroke-fill-overprint.json b/crates/plate-test/scenes/D06-stroke-fill-overprint.json
new file mode 100644
index 00000000..aa05c33b
--- /dev/null
+++ b/crates/plate-test/scenes/D06-stroke-fill-overprint.json
@@ -0,0 +1,84 @@
+{
+  "id": "D06",
+  "title": "Overprint stroke and overprint fill, process and spot",
+  "source": "DesignCraft DC06",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 150, 100], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [40, 40, 110, 60],
+      "stroke": {"paint": {"spot": "Gold", "tint": 100}, "width": 10},
+      "overprint": {"stroke": true}
+    },
+    {"type": "rect", "rect": [190, 20, 150, 100], "fill": {"cmyk": [0, 0, 100, 0]}},
+    {
+      "type": "rect",
+      "rect": [210, 40, 110, 60],
+      "stroke": {"paint": {"cmyk": [0, 100, 0, 0]}, "width": 10},
+      "overprint": {"stroke": true}
+    },
+    {"type": "rect", "rect": [20, 130, 320, 70], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [40, 140, 120, 50],
+      "fill": {"cmyk": [0, 100, 0, 0]},
+      "overprint": {"fill": true}
+    },
+    {
+      "type": "rect",
+      "rect": [200, 140, 120, 50],
+      "fill": {"spot": "Gold", "tint": 100},
+      "overprint": {"fill": true}
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {
+        "at": [40, 70],
+        "inks": {"Gold": 100, "Cyan": 100},
+        "tol": 2,
+        "note": "spot stroke over cyan"
+      },
+      {"at": [95, 70], "inks": {"Cyan": 100}, "tol": 2, "note": "inside the spot-stroked frame"},
+      {
+        "at": [210, 70],
+        "inks": {"Magenta": 100, "Yellow": 100},
+        "tol": 2,
+        "note": "magenta stroke over yellow"
+      },
+      {
+        "at": [265, 70],
+        "inks": {"Yellow": 100},
+        "tol": 2,
+        "note": "inside the magenta-stroked frame"
+      },
+      {
+        "at": [100, 165],
+        "inks": {"Magenta": 100, "Cyan": 100},
+        "tol": 2,
+        "note": "magenta fill over cyan"
+      },
+      {
+        "at": [260, 165],
+        "inks": {"Gold": 100, "Cyan": 100},
+        "tol": 2,
+        "note": "spot fill over cyan"
+      },
+      {"at": [180, 165], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": true,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["DeviceCMYK", "Separation(Gold, alt DeviceCMYK)"],
+    "ext_g_states": [{"OP": true}, {"op": true}],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/D08-feather.json b/crates/plate-test/scenes/D08-feather.json
new file mode 100644
index 00000000..8182a48e
--- /dev/null
+++ b/crates/plate-test/scenes/D08-feather.json
@@ -0,0 +1,81 @@
+{
+  "id": "D08",
+  "title": "Feathered Gold (10 pt soft-mask feather), alone and in a group with cyan",
+  "source": "DesignCraft DC08",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {
+      "type": "rect",
+      "rect": [36, 36, 120, 144],
+      "fill": {"spot": "Gold", "tint": 100},
+      "mask": {
+        "kind": "luminosity",
+        "backdrop": {"gray": 100},
+        "content": [
+          {
+            "type": "image",
+            "rect": [36, 36, 120, 144],
+            "image": {"px": [120, 144], "feather": 10}
+          }
+        ]
+      }
+    },
+    {
+      "type": "group",
+      "objects": [
+        {
+          "type": "rect",
+          "rect": [204, 36, 120, 144],
+          "fill": {"spot": "Gold", "tint": 100},
+          "mask": {
+            "kind": "luminosity",
+            "backdrop": {"gray": 100},
+            "content": [
+              {
+                "type": "image",
+                "rect": [204, 36, 120, 144],
+                "image": {"px": [120, 144], "feather": 10}
+              }
+            ]
+          }
+        },
+        {"type": "rect", "rect": [300, 170, 40, 36], "fill": {"cmyk": [100, 0, 0, 0]}}
+      ]
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {"at": [96, 108], "inks": {"Gold": 100}, "tol": 2, "note": "feathered spot, center"},
+      {
+        "at": [38, 108],
+        "inks": {"Gold": [3, 70]},
+        "tol": 10,
+        "note": "2 pt inside the edge: partial spot, no process ink"
+      },
+      {
+        "at": [264, 108],
+        "inks": {"Gold": 100},
+        "tol": 2,
+        "note": "feathered spot in a group, center"
+      },
+      {
+        "at": [206, 108],
+        "inks": {"Gold": [3, 70]},
+        "tol": 10,
+        "note": "2 pt inside the edge: partial spot, no process ink"
+      },
+      {"at": [330, 195], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "smask": true,
+    "ext_g_states": [{"SMask": "Luminosity"}],
+    "color_spaces_include": ["Separation(Gold, alt DeviceCMYK)", "DeviceGray"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/D10-k100-text.json b/crates/plate-test/scenes/D10-k100-text.json
new file mode 100644
index 00000000..54330b1b
--- /dev/null
+++ b/crates/plate-test/scenes/D10-k100-text.json
@@ -0,0 +1,62 @@
+{
+  "id": "D10",
+  "title": "K100 text (overprint) on a page with transparency, over 50% cyan and over paper",
+  "source": "DesignCraft DC10",
+  "page": [360, 216],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {
+      "type": "rect",
+      "rect": [20, 20, 180, 176],
+      "fill": {"cmyk": [100, 0, 0, 0]},
+      "opacity": 0.5
+    },
+    {
+      "type": "text",
+      "at": [30, 100],
+      "size": 60,
+      "text": "HHH",
+      "fill": {"cmyk": [0, 0, 0, 100]},
+      "overprint": {"fill": true}
+    },
+    {
+      "type": "text",
+      "at": [210, 100],
+      "size": 60,
+      "text": "HHH",
+      "fill": {"cmyk": [0, 0, 0, 100]},
+      "overprint": {"fill": true}
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {
+        "at": [100, 80],
+        "kind": "text",
+        "region": [30, 56.2, 133.2, 43.8],
+        "inks": {"Black": 100, "Cyan": 50},
+        "tol": 2,
+        "note": "K text over 50% cyan: overprint keeps the cyan"
+      },
+      {
+        "at": [280, 80],
+        "kind": "text",
+        "region": [210, 56.2, 133.2, 43.8],
+        "inks": {"Black": 100},
+        "tol": 2,
+        "note": "K text over paper: K only, no rich black"
+      },
+      {"at": [100, 160], "inks": {"Cyan": 50}, "tol": 6, "note": "cyan at 50% opacity"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "overprint": true,
+    "ext_g_states": [{"op": true}],
+    "group_cs": ["none"],
+    "color_spaces": ["DeviceCMYK"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/F01-image-alpha-over-fill.json b/crates/plate-test/scenes/F01-image-alpha-over-fill.json
new file mode 100644
index 00000000..5aac7245
--- /dev/null
+++ b/crates/plate-test/scenes/F01-image-alpha-over-fill.json
@@ -0,0 +1,48 @@
+{
+  "id": "F01",
+  "title": "Semi-transparent image over a flat process fill: where the image's alpha is 0, the fill prints unchanged",
+  "source": "vectorcraft#2160 (X-1a flattening washed out a fill behind a transparent PNG)",
+  "page": [360, 216],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 320, 176], "fill": {"cmyk": [100, 6, 41, 3]}},
+    {
+      "type": "image",
+      "rect": [60, 48, 290, 120],
+      "image": {
+        "px": [290, 120],
+        "split": [{"cmyk": [0, 100, 0, 0]}, {"cmyk": [0, 0, 0, 100]}],
+        "alpha": {"rect": [100, 78, 160, 60], "opacity": 0.6}
+      },
+      "note": "image alpha 0.6 inside x 100–260, y 78–138; 0 in the rest of the image, which reaches past the fill on the right"
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {"at": [40, 108], "inks": {"Cyan": 100, "Magenta": 6, "Yellow": 41, "Black": 3}, "tol": 0.5, "note": "fill clear of the image"},
+      {"at": [80, 108], "inks": {"Cyan": 100, "Magenta": 6, "Yellow": 41, "Black": 3}, "tol": 0.5, "note": "image alpha 0 over the fill"},
+      {"at": [180, 60], "inks": {"Cyan": 100, "Magenta": 6, "Yellow": 41, "Black": 3}, "tol": 0.5, "note": "image alpha 0 over the fill"},
+      {"at": [300, 150], "inks": {"Cyan": 100, "Magenta": 6, "Yellow": 41, "Black": 3}, "tol": 0.5, "note": "image alpha 0 over the fill"},
+      {"at": [345, 108], "inks": {}, "tol": 0.5, "note": "image alpha 0 over paper"},
+      {
+        "at": [150, 108],
+        "inks": {"Cyan": 40, "Magenta": 62.4, "Yellow": 16.4, "Black": 1.2},
+        "tol": 6,
+        "note": "M100 at 60% over the fill, CMYK blending"
+      },
+      {
+        "at": [230, 108],
+        "inks": {"Cyan": 40, "Magenta": 2.4, "Yellow": 16.4, "Black": 61.2},
+        "tol": 6,
+        "note": "K100 at 60% over the fill, CMYK blending"
+      }
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "color_spaces": ["DeviceCMYK"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/F02-hidden-art.json b/crates/plate-test/scenes/F02-hidden-art.json
new file mode 100644
index 00000000..bd856de3
--- /dev/null
+++ b/crates/plate-test/scenes/F02-hidden-art.json
@@ -0,0 +1,63 @@
+{
+  "id": "F02",
+  "title": "Art hidden under opaque fills, with transparency over them: nothing of it shows",
+  "source": "vectorcraft#2161 (old art under opaque layers showed through an X-1a export)",
+  "page": [360, 216],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {
+      "type": "group",
+      "note": "an old copy of the page, still visible and fully covered",
+      "objects": [
+        {"type": "rect", "rect": [190, 30, 140, 156], "fill": {"cmyk": [0, 30, 0, 0]}},
+        {"type": "text", "at": [200, 80], "size": 40, "text": "HHH", "fill": {"cmyk": [0, 0, 0, 100]}},
+        {"type": "rect", "rect": [200, 100, 120, 6], "fill": {"cmyk": [0, 0, 0, 100]}},
+        {"type": "rect", "rect": [200, 115, 120, 0.5], "fill": {"cmyk": [0, 0, 0, 100]}},
+        {"type": "rect", "rect": [200, 130, 12, 12], "stroke": {"paint": {"cmyk": [0, 0, 0, 100]}, "width": 1}},
+        {
+          "type": "image",
+          "rect": [260, 140, 60, 40],
+          "image": {"px": [6, 4], "split": [{"cmyk": [100, 0, 0, 0]}, {"cmyk": [0, 0, 100, 0]}]}
+        },
+        {"type": "rect", "rect": [200, 150, 50, 30], "fill": {"cmyk": [0, 100, 0, 0]}, "opacity": 0.5},
+        {"type": "text", "at": [30, 80], "size": 40, "text": "HHH", "fill": {"cmyk": [0, 0, 0, 100]}},
+        {"type": "rect", "rect": [30, 100, 120, 6], "fill": {"cmyk": [0, 0, 0, 100]}}
+      ]
+    },
+    {"type": "rect", "rect": [20, 20, 150, 176], "fill": {"cmyk": [0, 0, 0, 0]}, "note": "white card"},
+    {"type": "rect", "rect": [180, 20, 160, 176], "fill": {"cmyk": [100, 6, 41, 3]}, "note": "teal box"},
+    {"type": "rect", "rect": [100, 160, 200, 20], "fill": {"cmyk": [0, 0, 0, 100]}, "opacity": 0.3, "note": "a 30% black band over both"}
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {"at": [230, 103], "inks": {"Cyan": 100, "Magenta": 6, "Yellow": 41, "Black": 3}, "tol": 0.5, "note": "teal over a hidden K bar"},
+      {"at": [215, 70], "inks": {"Cyan": 100, "Magenta": 6, "Yellow": 41, "Black": 3}, "tol": 0.5, "note": "teal over hidden text"},
+      {"at": [290, 150], "inks": {"Cyan": 100, "Magenta": 6, "Yellow": 41, "Black": 3}, "tol": 0.5, "note": "teal over a hidden image"},
+      {"at": [206, 136], "inks": {"Cyan": 100, "Magenta": 6, "Yellow": 41, "Black": 3}, "tol": 0.5, "note": "teal over a hidden checkbox"},
+      {"at": [335, 25], "inks": {"Cyan": 100, "Magenta": 6, "Yellow": 41, "Black": 3}, "tol": 0.5, "note": "teal over nothing"},
+      {"at": [60, 103], "inks": {}, "tol": 0.5, "note": "white card over a hidden K bar"},
+      {"at": [45, 70], "inks": {}, "tol": 0.5, "note": "white card over hidden text"},
+      {"at": [175, 108], "inks": {}, "tol": 0.5, "note": "paper between the card and the box"},
+      {
+        "at": [220, 170],
+        "inks": {"Cyan": 70, "Magenta": 4.2, "Yellow": 28.7, "Black": 32.1},
+        "tol": 2,
+        "note": "band over teal over a hidden 50% magenta fill"
+      },
+      {
+        "at": [290, 170],
+        "inks": {"Cyan": 70, "Magenta": 4.2, "Yellow": 28.7, "Black": 32.1},
+        "tol": 2,
+        "note": "band over teal over a hidden image"
+      },
+      {"at": [130, 170], "inks": {"Black": 30}, "tol": 2, "note": "band over the white card"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "color_spaces": ["DeviceCMYK"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/M1-mask-backdrop.json b/crates/plate-test/scenes/M1-mask-backdrop.json
new file mode 100644
index 00000000..d32cebdf
--- /dev/null
+++ b/crates/plate-test/scenes/M1-mask-backdrop.json
@@ -0,0 +1,46 @@
+{
+  "id": "M1",
+  "title": "M100 under a luminosity mask whose content is a black hole, /BC white",
+  "source": "new",
+  "page": [360, 216],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 320, 176], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [60, 40, 240, 136],
+      "fill": {"cmyk": [0, 100, 0, 0]},
+      "mask": {
+        "kind": "luminosity",
+        "backdrop": {"gray": 0},
+        "content": [{"type": "rect", "rect": [140, 70, 80, 76], "fill": {"gray": 100}}]
+      }
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {
+        "at": [80, 60],
+        "inks": {"Magenta": 100},
+        "tol": 2,
+        "note": "outside the mask content: /BC white shows the object"
+      },
+      {
+        "at": [180, 108],
+        "inks": {"Cyan": 100},
+        "tol": 2,
+        "note": "inside the black hole: masked out"
+      },
+      {"at": [30, 30], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "smask": true,
+    "ext_g_states": [{"SMask": "Luminosity", "BC": true}],
+    "color_spaces_include": ["DeviceCMYK"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/M2-mask-transfer.json b/crates/plate-test/scenes/M2-mask-transfer.json
new file mode 100644
index 00000000..6a744cc0
--- /dev/null
+++ b/crates/plate-test/scenes/M2-mask-transfer.json
@@ -0,0 +1,46 @@
+{
+  "id": "M2",
+  "title": "M100 under a luminosity mask with an inverting /TR: the white mask content becomes a hole",
+  "source": "new",
+  "page": [360, 216],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 320, 176], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [60, 40, 240, 136],
+      "fill": {"cmyk": [0, 100, 0, 0]},
+      "mask": {
+        "kind": "luminosity",
+        "transfer": [1, 0],
+        "content": [{"type": "rect", "rect": [140, 70, 80, 76], "fill": {"gray": 0}}]
+      }
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {
+        "at": [80, 60],
+        "inks": {"Magenta": 100},
+        "tol": 2,
+        "note": "outside the mask content: default black backdrop, inverted to fully visible"
+      },
+      {
+        "at": [180, 108],
+        "inks": {"Cyan": 100},
+        "tol": 2,
+        "note": "white mask content, inverted: masked out"
+      },
+      {"at": [30, 30], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "smask": true,
+    "ext_g_states": [{"SMask": "Luminosity", "BC": false, "TR": true}],
+    "color_spaces_include": ["DeviceCMYK"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/N1-devicen-fill.json b/crates/plate-test/scenes/N1-devicen-fill.json
new file mode 100644
index 00000000..78ee01c1
--- /dev/null
+++ b/crates/plate-test/scenes/N1-devicen-fill.json
@@ -0,0 +1,38 @@
+{
+  "id": "N1",
+  "title": "DeviceN [Cyan Black] 60/40 fill overprinting Y100",
+  "source": "GWG 19 idea",
+  "page": [360, 216],
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 320, 176], "fill": {"cmyk": [0, 0, 100, 0]}},
+    {
+      "type": "rect",
+      "rect": [60, 60, 240, 96],
+      "fill": {"inks": {"Cyan": 60, "Black": 40}},
+      "overprint": {"fill": true}
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {
+        "at": [180, 108],
+        "inks": {"Yellow": 100, "Cyan": 60, "Black": 40},
+        "tol": 2,
+        "note": "DeviceN overprint leaves unnamed colorants alone"
+      },
+      {"at": [30, 30], "inks": {"Yellow": 100}, "tol": 2, "note": "yellow only"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": true,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["DeviceCMYK", "DeviceN(Cyan,Black, alt DeviceCMYK)"],
+    "ext_g_states": [{"op": true}],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S01-black-overprint.json b/crates/plate-test/scenes/S01-black-overprint.json
new file mode 100644
index 00000000..2cfd10d7
--- /dev/null
+++ b/crates/plate-test/scenes/S01-black-overprint.json
@@ -0,0 +1,50 @@
+{
+  "id": "S01",
+  "title": "[Black] rect and text over C100, overprint on",
+  "source": "research S1, DesignCraft DC06",
+  "page": [360, 216],
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 300, 176], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [40, 40, 100, 60],
+      "fill": {"cmyk": [0, 0, 0, 100]},
+      "overprint": {"fill": true}
+    },
+    {
+      "type": "text",
+      "at": [40, 160],
+      "size": 60,
+      "text": "HHH",
+      "fill": {"cmyk": [0, 0, 0, 100]},
+      "overprint": {"fill": true}
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {"at": [90, 70], "inks": {"Cyan": 100, "Black": 100}, "tol": 2, "note": "K rect"},
+      {
+        "at": [110, 140],
+        "kind": "text",
+        "region": [40, 116.2, 133.2, 43.8],
+        "inks": {"Cyan": 100, "Black": 100},
+        "tol": 2,
+        "note": "K text"
+      },
+      {"at": [250, 70], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"},
+      {"at": [340, 108], "inks": {}, "tol": 2, "note": "paper"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": true,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["DeviceCMYK"],
+    "ext_g_states": [{"op": true}],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S02-black-knockout.json b/crates/plate-test/scenes/S02-black-knockout.json
new file mode 100644
index 00000000..d7e7f5b0
--- /dev/null
+++ b/crates/plate-test/scenes/S02-black-knockout.json
@@ -0,0 +1,43 @@
+{
+  "id": "S02",
+  "title": "[Black] rect and text over C100, overprint off",
+  "source": "research S2",
+  "page": [360, 216],
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 300, 176], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {"type": "rect", "rect": [40, 40, 100, 60], "fill": {"cmyk": [0, 0, 0, 100]}},
+    {
+      "type": "text",
+      "at": [40, 160],
+      "size": 60,
+      "text": "HHH",
+      "fill": {"cmyk": [0, 0, 0, 100]}
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {"at": [90, 70], "inks": {"Black": 100}, "tol": 2, "note": "K rect"},
+      {
+        "at": [110, 140],
+        "kind": "text",
+        "region": [40, 116.2, 133.2, 43.8],
+        "inks": {"Black": 100},
+        "tol": 2,
+        "note": "K text"
+      },
+      {"at": [250, 70], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"},
+      {"at": [340, 108], "inks": {}, "tol": 2, "note": "paper"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": false,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["DeviceCMYK"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S03-opm.json b/crates/plate-test/scenes/S03-opm.json
new file mode 100644
index 00000000..7aebb275
--- /dev/null
+++ b/crates/plate-test/scenes/S03-opm.json
@@ -0,0 +1,51 @@
+{
+  "id": "S03",
+  "title": "C50 Y50 under M100 with fill overprint, OPM 1 (left) and OPM 0 (right)",
+  "source": "research S3 (GWG 1.1 idea)",
+  "page": [360, 216],
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 150, 176], "fill": {"cmyk": [50, 0, 50, 0]}},
+    {
+      "type": "rect",
+      "rect": [40, 60, 110, 96],
+      "fill": {"cmyk": [0, 100, 0, 0]},
+      "overprint": {"fill": true, "mode": 1}
+    },
+    {"type": "rect", "rect": [190, 20, 150, 176], "fill": {"cmyk": [50, 0, 50, 0]}},
+    {
+      "type": "rect",
+      "rect": [210, 60, 110, 96],
+      "fill": {"cmyk": [0, 100, 0, 0]},
+      "overprint": {"fill": true, "mode": 0}
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {
+        "at": [95, 108],
+        "inks": {"Cyan": 50, "Magenta": 100, "Yellow": 50},
+        "tol": 2,
+        "note": "OPM 1: zero components leave the backdrop"
+      },
+      {
+        "at": [265, 108],
+        "inks": {"Magenta": 100},
+        "tol": 2,
+        "note": "OPM 0: every DeviceCMYK component paints"
+      },
+      {"at": [30, 30], "inks": {"Cyan": 50, "Yellow": 50}, "tol": 2, "note": "backdrop"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": true,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["DeviceCMYK"],
+    "ext_g_states": [{"op": true, "OPM": 1}, {"op": true, "OPM": 0}],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S04-spot-overprint.json b/crates/plate-test/scenes/S04-spot-overprint.json
new file mode 100644
index 00000000..20cd7fa2
--- /dev/null
+++ b/crates/plate-test/scenes/S04-spot-overprint.json
@@ -0,0 +1,34 @@
+{
+  "id": "S04",
+  "title": "Gold 50 over C100, overprint on",
+  "source": "research S4 (GWG 2.0 idea)",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 320, 176], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [100, 60, 160, 96],
+      "fill": {"spot": "Gold", "tint": 50},
+      "overprint": {"fill": true}
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {"at": [180, 108], "inks": {"Cyan": 100, "Gold": 50}, "tol": 2, "note": "spot over cyan"},
+      {"at": [40, 108], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": true,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["DeviceCMYK", "Separation(Gold, alt DeviceCMYK)"],
+    "ext_g_states": [{"op": true}],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S05-spot-normal.json b/crates/plate-test/scenes/S05-spot-normal.json
new file mode 100644
index 00000000..0f7aa15c
--- /dev/null
+++ b/crates/plate-test/scenes/S05-spot-normal.json
@@ -0,0 +1,28 @@
+{
+  "id": "S05",
+  "title": "Gold 50 over C100, overprint off",
+  "source": "research S5",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 320, 176], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {"type": "rect", "rect": [100, 60, 160, 96], "fill": {"spot": "Gold", "tint": 50}}
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {"at": [180, 108], "inks": {"Gold": 50}, "tol": 2, "note": "spot over cyan"},
+      {"at": [40, 108], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": false,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["DeviceCMYK", "Separation(Gold, alt DeviceCMYK)"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S06-k50-opacity.json b/crates/plate-test/scenes/S06-k50-opacity.json
new file mode 100644
index 00000000..13909de8
--- /dev/null
+++ b/crates/plate-test/scenes/S06-k50-opacity.json
@@ -0,0 +1,36 @@
+{
+  "id": "S06",
+  "title": "K100 at 50% opacity over C100",
+  "source": "research S6 (the krilla RGB-group regression)",
+  "page": [360, 216],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 200, 176], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [120, 20, 220, 176],
+      "fill": {"cmyk": [0, 0, 0, 100]},
+      "opacity": 0.5
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {"at": [60, 108], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"},
+      {
+        "at": [170, 108],
+        "inks": {"Cyan": 50, "Black": 50},
+        "tol": 6,
+        "note": "CMYK blending: C50 K50, no M or Y"
+      },
+      {"at": [300, 108], "inks": {"Black": 50}, "tol": 6, "note": "K 50% over paper"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "group_cs": ["none"],
+    "color_spaces": ["DeviceCMYK"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S07-spot-multiply.json b/crates/plate-test/scenes/S07-spot-multiply.json
new file mode 100644
index 00000000..8ca9d9b3
--- /dev/null
+++ b/crates/plate-test/scenes/S07-spot-multiply.json
@@ -0,0 +1,45 @@
+{
+  "id": "S07",
+  "title": "Gold 100 Multiply over Teal 100 and over C100",
+  "source": "research S7, DesignCraft DC02",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}, {"name": "Teal", "cmyk": [80, 0, 30, 0]}],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 150, 176], "fill": {"spot": "Teal", "tint": 100}},
+    {"type": "rect", "rect": [190, 20, 150, 176], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [60, 60, 240, 96],
+      "fill": {"spot": "Gold", "tint": 100},
+      "blend": "multiply"
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold", "Teal"],
+    "points": [
+      {"at": [40, 108], "inks": {"Teal": 100}, "tol": 2, "note": "Teal only"},
+      {
+        "at": [100, 108],
+        "inks": {"Teal": 100, "Gold": 100},
+        "tol": 6,
+        "note": "both spots kept"
+      },
+      {"at": [180, 108], "inks": {"Gold": 100}, "tol": 6, "note": "Gold over paper"},
+      {
+        "at": [260, 108],
+        "inks": {"Cyan": 100, "Gold": 100},
+        "tol": 6,
+        "note": "cyan kept under the spot"
+      },
+      {"at": [330, 108], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "blend_modes": ["Multiply"],
+    "color_spaces": ["DeviceCMYK", "Separation(Gold, alt DeviceCMYK)", "Separation(Teal, alt DeviceCMYK)"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S08-nonseparable-spot.json b/crates/plate-test/scenes/S08-nonseparable-spot.json
new file mode 100644
index 00000000..090ccb6a
--- /dev/null
+++ b/crates/plate-test/scenes/S08-nonseparable-spot.json
@@ -0,0 +1,45 @@
+{
+  "id": "S08",
+  "title": "M100 in Color blend mode over Gold and over C50",
+  "source": "research S8, DesignCraft DC09",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "rect", "rect": [36, 36, 180, 144], "fill": {"spot": "Gold", "tint": 100}},
+    {"type": "rect", "rect": [216, 36, 124, 144], "fill": {"cmyk": [50, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [144, 72, 156, 72],
+      "fill": {"cmyk": [0, 100, 0, 0]},
+      "blend": "color"
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {"at": [60, 108], "inks": {"Gold": 100}, "tol": 2, "note": "spot only"},
+      {
+        "at": [180, 108],
+        "inks": {},
+        "tol": 6,
+        "note": "spot plate composites Normal (knocked out); Color over a paper process backdrop gives paper"
+      },
+      {
+        "at": [258, 108],
+        "inks": {},
+        "tol": 6,
+        "info": true,
+        "note": "non-separable blend of process inks"
+      },
+      {"at": [320, 160], "inks": {"Cyan": 50}, "tol": 2, "note": "cyan 50% only"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "blend_modes": ["Color"],
+    "color_spaces": ["DeviceCMYK", "Separation(Gold, alt DeviceCMYK)"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S09-knockout.json b/crates/plate-test/scenes/S09-knockout.json
new file mode 100644
index 00000000..7c3390d9
--- /dev/null
+++ b/crates/plate-test/scenes/S09-knockout.json
@@ -0,0 +1,60 @@
+{
+  "id": "S09",
+  "title": "Knockout group of a 50% cyan and a 50% magenta circle over yellow",
+  "source": "research S9, DesignCraft DC05",
+  "page": [360, 216],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 320, 176], "fill": {"cmyk": [0, 0, 100, 0]}},
+    {
+      "type": "group",
+      "knockout": true,
+      "objects": [
+        {
+          "type": "ellipse",
+          "rect": [60, 38, 140, 140],
+          "fill": {"cmyk": [100, 0, 0, 0]},
+          "opacity": 0.5
+        },
+        {
+          "type": "ellipse",
+          "rect": [160, 38, 140, 140],
+          "fill": {"cmyk": [0, 100, 0, 0]},
+          "opacity": 0.5
+        }
+      ]
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {"at": [30, 108], "inks": {"Yellow": 100}, "tol": 2, "note": "yellow only"},
+      {
+        "at": [100, 108],
+        "inks": {"Yellow": 50, "Cyan": 50},
+        "tol": 6,
+        "note": "cyan 50% over yellow"
+      },
+      {
+        "at": [180, 108],
+        "inks": {"Yellow": 50, "Magenta": 50},
+        "tol": 6,
+        "note": "overlap: only the top circle over the backdrop (without knockout C25 M50 Y25)"
+      },
+      {
+        "at": [260, 108],
+        "inks": {"Yellow": 50, "Magenta": 50},
+        "tol": 6,
+        "note": "magenta 50% over yellow"
+      }
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "knockout": true,
+    "group_cs": ["none"],
+    "color_spaces": ["DeviceCMYK"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S10-isolated-multiply.json b/crates/plate-test/scenes/S10-isolated-multiply.json
new file mode 100644
index 00000000..aeed7f7e
--- /dev/null
+++ b/crates/plate-test/scenes/S10-isolated-multiply.json
@@ -0,0 +1,51 @@
+{
+  "id": "S10",
+  "title": "Isolated group: M100 Multiply over Y100, both over a C100 backdrop",
+  "source": "research S10",
+  "page": [360, 216],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 320, 176], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "group",
+      "isolated": true,
+      "objects": [
+        {"type": "rect", "rect": [60, 50, 120, 116], "fill": {"cmyk": [0, 0, 100, 0]}},
+        {
+          "type": "rect",
+          "rect": [120, 50, 160, 116],
+          "fill": {"cmyk": [0, 100, 0, 0]},
+          "blend": "multiply"
+        }
+      ]
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {"at": [90, 108], "inks": {"Yellow": 100}, "tol": 2, "note": "yellow knocks out cyan"},
+      {
+        "at": [150, 108],
+        "inks": {"Yellow": 100, "Magenta": 100},
+        "tol": 6,
+        "note": "Multiply with a group member"
+      },
+      {
+        "at": [250, 108],
+        "inks": {"Magenta": 100},
+        "tol": 6,
+        "note": "Multiply over the group's transparent backdrop: no cyan (non-isolated would give C100 M100)"
+      },
+      {"at": [320, 108], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "isolated": true,
+    "group_cs": ["none"],
+    "blend_modes": ["Multiply"],
+    "color_spaces": ["DeviceCMYK"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S11-shadow-over-spot.json b/crates/plate-test/scenes/S11-shadow-over-spot.json
new file mode 100644
index 00000000..37463e64
--- /dev/null
+++ b/crates/plate-test/scenes/S11-shadow-over-spot.json
@@ -0,0 +1,83 @@
+{
+  "id": "S11",
+  "title": "K drop shadows (soft mask, Multiply 75%) over Gold and over a CMYK image",
+  "source": "research S11, DesignCraft DC03, DC11",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "rect", "rect": [20, 36, 140, 144], "fill": {"spot": "Gold", "tint": 100}},
+    {
+      "type": "rect",
+      "rect": [30, 46, 120, 120],
+      "fill": {"cmyk": [0, 0, 0, 100]},
+      "opacity": 0.75,
+      "blend": "multiply",
+      "mask": {
+        "kind": "luminosity",
+        "backdrop": {"gray": 100},
+        "content": [{"type": "image", "rect": [50, 66, 80, 80], "image": {"px": [80, 80], "feather": 10}}]
+      },
+      "note": "mask content is smaller than the K rect: outside it the backdrop (/BC black) hides the shadow"
+    },
+    {
+      "type": "image",
+      "rect": [190, 36, 140, 144],
+      "image": {"px": [140, 144], "split": [{"cmyk": [100, 0, 0, 0]}, {"cmyk": [0, 0, 0, 50]}]}
+    },
+    {
+      "type": "rect",
+      "rect": [210, 46, 120, 120],
+      "fill": {"cmyk": [0, 0, 0, 100]},
+      "opacity": 0.75,
+      "blend": "multiply",
+      "mask": {
+        "kind": "luminosity",
+        "backdrop": {"gray": 100},
+        "content": [{"type": "image", "rect": [230, 66, 80, 80], "image": {"px": [80, 80], "feather": 10}}]
+      },
+      "note": "mask content is smaller than the K rect: outside it the backdrop (/BC black) hides the shadow"
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {"at": [30, 50], "inks": {"Gold": 100}, "tol": 2, "note": "spot only"},
+      {
+        "at": [90, 106],
+        "inks": {"Gold": 100, "Black": 75},
+        "tol": 10,
+        "note": "shadow over spot: spot kept, K follows the mask"
+      },
+      {
+        "at": [35, 52],
+        "inks": {"Gold": 100},
+        "tol": 10,
+        "note": "inside the K rect, outside the mask content: /BC hides the shadow"
+      },
+      {
+        "at": [245, 106],
+        "inks": {"Cyan": 100, "Black": 75},
+        "tol": 10,
+        "note": "shadow over the image's C100 half"
+      },
+      {
+        "at": [295, 106],
+        "inks": {"Black": 88},
+        "tol": 10,
+        "note": "shadow (K75 Multiply) over the image's K50 half"
+      },
+      {"at": [205, 50], "inks": {"Cyan": 100}, "tol": 2, "note": "image C100 half"},
+      {"at": [320, 170], "inks": {"Black": 50}, "tol": 2, "note": "image K50 half"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "smask": true,
+    "blend_modes": ["Multiply"],
+    "ext_g_states": [{"SMask": "Luminosity", "BC": true}],
+    "color_spaces_include": ["DeviceCMYK", "Separation(Gold, alt DeviceCMYK)", "DeviceGray"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S12-white-overprint.json b/crates/plate-test/scenes/S12-white-overprint.json
new file mode 100644
index 00000000..cef5b99b
--- /dev/null
+++ b/crates/plate-test/scenes/S12-white-overprint.json
@@ -0,0 +1,46 @@
+{
+  "id": "S12",
+  "title": "White (C0 M0 Y0 K0) fill overprint over C100, OPM 1 (left) and OPM 0 (right)",
+  "source": "research S12 (GWG 4.x/12.0 idea)",
+  "page": [360, 216],
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 320, 176], "fill": {"cmyk": [100, 0, 0, 0]}},
+    {
+      "type": "rect",
+      "rect": [60, 60, 100, 96],
+      "fill": {"cmyk": [0, 0, 0, 0]},
+      "overprint": {"fill": true, "mode": 1}
+    },
+    {
+      "type": "rect",
+      "rect": [200, 60, 100, 96],
+      "fill": {"cmyk": [0, 0, 0, 0]},
+      "overprint": {"fill": true, "mode": 0}
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black"],
+    "points": [
+      {
+        "at": [110, 108],
+        "inks": {"Cyan": 100},
+        "tol": 2,
+        "note": "OPM 1: an all-zero overprinting white leaves the backdrop"
+      },
+      {"at": [250, 108], "inks": {}, "tol": 2, "note": "OPM 0: white knocks out"},
+      {"at": [40, 108], "inks": {"Cyan": 100}, "tol": 2, "note": "cyan only"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": true,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["DeviceCMYK"],
+    "ext_g_states": [{"op": true, "OPM": 1}, {"op": true, "OPM": 0}],
+    "device_rgb": false,
+    "output_intents": []
+  },
+  "note": "The app warns about white overprint in preflight; the writer keeps the attribute exactly."
+}
diff --git a/crates/plate-test/scenes/S13-registration.json b/crates/plate-test/scenes/S13-registration.json
new file mode 100644
index 00000000..9a66c850
--- /dev/null
+++ b/crates/plate-test/scenes/S13-registration.json
@@ -0,0 +1,45 @@
+{
+  "id": "S13",
+  "title": "Registration marks print on every plate, spots included",
+  "source": "research S13",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "objects": [
+    {"type": "rect", "rect": [40, 40, 80, 80], "fill": "registration"},
+    {
+      "type": "ellipse",
+      "rect": [200, 40, 80, 80],
+      "stroke": {"paint": "registration", "width": 6}
+    },
+    {"type": "rect", "rect": [160, 140, 60, 40], "fill": {"spot": "Gold", "tint": 100}}
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {
+        "at": [80, 80],
+        "inks": {"Cyan": 100, "Magenta": 100, "Yellow": 100, "Black": 100, "Gold": 100},
+        "tol": 2,
+        "note": "registration fill"
+      },
+      {
+        "at": [240, 40],
+        "inks": {"Cyan": 100, "Magenta": 100, "Yellow": 100, "Black": 100, "Gold": 100},
+        "tol": 2,
+        "note": "registration stroke (top of the circle)"
+      },
+      {"at": [240, 80], "inks": {}, "tol": 2, "note": "inside the circle"},
+      {"at": [190, 160], "inks": {"Gold": 100}, "tol": 2, "note": "Gold"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": false,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["Separation(All, alt DeviceCMYK)", "Separation(Gold, alt DeviceCMYK)"],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S14-duotone-gradients.json b/crates/plate-test/scenes/S14-duotone-gradients.json
new file mode 100644
index 00000000..c13d9b6c
--- /dev/null
+++ b/crates/plate-test/scenes/S14-duotone-gradients.json
@@ -0,0 +1,75 @@
+{
+  "id": "S14",
+  "title": "DeviceN [Black Gold] duotone ramp, Gold-to-paper and Gold-to-cyan gradients",
+  "source": "research S14, DesignCraft DC07",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "objects": [
+    {
+      "type": "image",
+      "rect": [20, 20, 320, 80],
+      "image": {
+        "px": [320, 8],
+        "ramp": [{"inks": {"Black": 0, "Gold": 0}}, {"inks": {"Black": 100, "Gold": 60}}]
+      }
+    },
+    {
+      "type": "rect",
+      "rect": [20, 120, 150, 76],
+      "fill": {
+        "linear": {
+          "from": [20, 0],
+          "to": [170, 0],
+          "stops": [
+            {"at": 0, "paint": {"spot": "Gold", "tint": 100}},
+            {"at": 1, "paint": {"spot": "Gold", "tint": 0}}
+          ]
+        }
+      }
+    },
+    {
+      "type": "rect",
+      "rect": [190, 120, 150, 76],
+      "fill": {
+        "linear": {
+          "from": [190, 0],
+          "to": [340, 0],
+          "stops": [
+            {"at": 0, "paint": {"spot": "Gold", "tint": 100}},
+            {"at": 1, "paint": {"cmyk": [100, 0, 0, 0]}}
+          ]
+        }
+      }
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {"at": [100, 60], "inks": {"Black": 25, "Gold": 15}, "tol": 10, "note": "duotone at 25%"},
+      {"at": [260, 60], "inks": {"Black": 75, "Gold": 45}, "tol": 10, "note": "duotone at 75%"},
+      {"at": [57.5, 158], "inks": {"Gold": 75}, "tol": 10, "note": "spot>paper at 25%"},
+      {"at": [95, 158], "inks": {"Gold": 50}, "tol": 10, "note": "spot>paper at 50%"},
+      {"at": [132.5, 158], "inks": {"Gold": 25}, "tol": 10, "note": "spot>paper at 75%"},
+      {
+        "at": [227.5, 158],
+        "inks": {"Gold": 75, "Cyan": 25},
+        "tol": 10,
+        "note": "spot>cyan at 25%"
+      },
+      {
+        "at": [265, 158],
+        "inks": {"Gold": 50, "Cyan": 50},
+        "tol": 10,
+        "note": "spot>cyan at 50%"
+      }
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "smask": false,
+    "color_spaces_include": ["DeviceN(Black,Gold, alt DeviceCMYK)", "Separation(Gold, alt DeviceCMYK)"],
+    "device_rgb": false,
+    "output_intents": []
+  },
+  "note": "DeviceN colorants follow process order (Cyan, Magenta, Yellow, Black), then the scene's inks."
+}
diff --git a/crates/plate-test/scenes/S15-placed-pdf.json b/crates/plate-test/scenes/S15-placed-pdf.json
new file mode 100644
index 00000000..66f0b4b8
--- /dev/null
+++ b/crates/plate-test/scenes/S15-placed-pdf.json
@@ -0,0 +1,43 @@
+{
+  "id": "S15",
+  "title": "S06, S02 and D01 placed as PDF pages at half size",
+  "source": "research S15",
+  "page": [360, 216],
+  "settings": {"group_cs": "cmyk"},
+  "objects": [
+    {"type": "pdf", "scene": "S06", "rect": [0, 0, 180, 108]},
+    {"type": "pdf", "scene": "S02", "rect": [180, 0, 180, 108]},
+    {"type": "pdf", "scene": "D01", "rect": [0, 108, 180, 108]}
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {"at": [30, 54], "inks": {"Cyan": 100}, "tol": 2, "note": "S06 cyan only"},
+      {
+        "at": [85, 54],
+        "inks": {"Cyan": 50, "Black": 50},
+        "tol": 6,
+        "note": "S06 K50% over cyan"
+      },
+      {"at": [225, 35], "inks": {"Black": 100}, "tol": 2, "note": "S02 K rect"},
+      {
+        "at": [235, 70],
+        "kind": "text",
+        "region": [200, 58, 67, 22],
+        "inks": {"Black": 100},
+        "tol": 2,
+        "note": "S02 K text"
+      },
+      {"at": [45, 162], "inks": {"Gold": 100}, "tol": 2, "note": "D01 spot"},
+      {"at": [270, 162], "inks": {}, "tol": 2, "note": "paper"}
+    ]
+  },
+  "structure": {
+    "page_group": "DeviceCMYK",
+    "group_cs": ["none"],
+    "color_spaces_include": ["DeviceCMYK", "Separation(Gold, alt DeviceCMYK)"],
+    "device_rgb": false,
+    "output_intents": []
+  },
+  "note": "The placed pages must separate like their sources: K-only text stays K, the spot stays a spot."
+}
diff --git a/crates/plate-test/scenes/S16-gray-overprint.json b/crates/plate-test/scenes/S16-gray-overprint.json
new file mode 100644
index 00000000..4cbf006a
--- /dev/null
+++ b/crates/plate-test/scenes/S16-gray-overprint.json
@@ -0,0 +1,42 @@
+{
+  "id": "S16",
+  "title": "DeviceGray 50% fill overprint over Gold and Teal",
+  "source": "research S16 (GWG 3.0 idea)",
+  "page": [360, 216],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}, {"name": "Teal", "cmyk": [80, 0, 30, 0]}],
+  "objects": [
+    {"type": "rect", "rect": [20, 20, 150, 176], "fill": {"spot": "Gold", "tint": 100}},
+    {"type": "rect", "rect": [190, 20, 150, 176], "fill": {"spot": "Teal", "tint": 100}},
+    {
+      "type": "rect",
+      "rect": [60, 60, 240, 96],
+      "fill": {"gray": 50},
+      "overprint": {"fill": true}
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold", "Teal"],
+    "points": [
+      {"at": [40, 108], "inks": {"Gold": 100}, "tol": 2, "note": "Gold only"},
+      {
+        "at": [100, 108],
+        "inks": {},
+        "tol": 2,
+        "info": true,
+        "note": "gray over Gold: devices differ (DeviceGray maps to K; overprint may keep the spot)"
+      },
+      {"at": [260, 108], "inks": {}, "tol": 2, "info": true, "note": "gray over Teal"}
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "group_cs": [],
+    "overprint": true,
+    "smask": false,
+    "blend_modes": [],
+    "color_spaces": ["DeviceGray", "Separation(Gold, alt DeviceCMYK)", "Separation(Teal, alt DeviceCMYK)"],
+    "ext_g_states": [{"op": true}],
+    "device_rgb": false,
+    "output_intents": []
+  }
+}
diff --git a/crates/plate-test/scenes/S17-mesh-spot.json b/crates/plate-test/scenes/S17-mesh-spot.json
new file mode 100644
index 00000000..9a0919b3
--- /dev/null
+++ b/crates/plate-test/scenes/S17-mesh-spot.json
@@ -0,0 +1,52 @@
+{
+  "id": "S17",
+  "title": "Mesh gradient with a spot, process and DeviceN corner",
+  "source": "storytold/craft-libs#184 (mesh gradients), CodeRabbit review",
+  "page": [240, 160],
+  "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+  "objects": [
+    {
+      "type": "rect",
+      "rect": [20, 20, 200, 120],
+      "fill": {
+        "mesh": {
+          "rect": [20, 20, 200, 120],
+          "corners": [
+            {"spot": "Gold", "tint": 100},
+            {"cmyk": [100, 0, 0, 0]},
+            {"inks": {"Magenta": 100, "Gold": 50}},
+            {"cmyk": [0, 0, 0, 0]}
+          ]
+        }
+      }
+    }
+  ],
+  "expect": {
+    "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+    "points": [
+      {"at": [24, 24], "inks": {"Gold": 95}, "tol": 10, "note": "top left: Gold"},
+      {"at": [216, 24], "inks": {"Cyan": 95}, "tol": 10, "note": "top right: Cyan"},
+      {
+        "at": [216, 136],
+        "inks": {"Magenta": 95, "Gold": 47},
+        "tol": 10,
+        "note": "bottom right: Magenta and half Gold"
+      },
+      {"at": [24, 136], "inks": {}, "tol": 10, "note": "bottom left: paper"},
+      {
+        "at": [120, 80],
+        "inks": {"Gold": 37.5, "Cyan": 25, "Magenta": 25},
+        "tol": 10,
+        "note": "center: bilinear mix of the corners"
+      }
+    ]
+  },
+  "structure": {
+    "page_group": "none",
+    "smask": false,
+    "color_spaces_include": ["DeviceN(Cyan,Magenta,Gold, alt DeviceCMYK)"],
+    "device_rgb": false,
+    "output_intents": []
+  },
+  "note": "Corner colors in different ink spaces share one DeviceN space: process colorants first, then the spot."
+}
diff --git a/crates/plate-test/src/gs.rs b/crates/plate-test/src/gs.rs
new file mode 100644
index 00000000..a659647c
--- /dev/null
+++ b/crates/plate-test/src/gs.rs
@@ -0,0 +1,106 @@
+//! Separates a PDF into plates with Ghostscript's `tiffsep` device.
+//!
+//! Ghostscript is AGPL: it runs here only as an external program on a developer's machine. It is
+//! never linked or copied into this crate, and its output is never committed.
+
+use std::collections::BTreeMap;
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use crate::Error;
+use crate::tiff::{self, Plate};
+
+/// Overrides the Ghostscript program (default `gs` on `PATH`).
+pub const GS_ENV: &str = "CRAFT_PLATE_TEST_GS";
+
+/// Plate resolution in dpi; at 72 dpi one pixel is one scene point.
+pub const RESOLUTION: f32 = 72.0;
+
+/// The Ghostscript program to run.
+pub fn program() -> OsString {
+    std::env::var_os(GS_ENV).unwrap_or_else(|| "gs".into())
+}
+
+/// Ghostscript's version, or `None` when the program can't be run.
+pub fn version() -> Option<String> {
+    let output = Command::new(program()).arg("--version").output().ok()?;
+    output.status.success().then(|| String::from_utf8_lossy(&output.stdout).trim().to_owned())
+}
+
+/// Separate the first page of `pdf` into plates, keyed by separation name (`Cyan`, …, spot
+/// names). Overprint is simulated as a separating RIP would print it (`-dOverprint=/enable`).
+pub fn separate(pdf: &[u8], label: &str) -> Result<BTreeMap<String, Plate>, Error> {
+    let work = WorkDir::new(label)?;
+    let input = work.0.join("in.pdf");
+    std::fs::write(&input, pdf).map_err(|e| gs_error(&work.0, e))?;
+    let res = format!("-r{RESOLUTION}");
+    let output_file = format!("-sOutputFile={}", work.0.join("p%d.tif").display());
+    let run = Command::new(program())
+        .args(["-q", "-dSAFER", "-dBATCH", "-dNOPAUSE", "-sDEVICE=tiffsep", &res, "-sCompression=none", "-dOverprint=/enable"])
+        .arg(output_file)
+        .arg(&input)
+        .output()
+        .map_err(|e| Error::Ghostscript(format!("{}: {e}", program().to_string_lossy())))?;
+    if !run.status.success() {
+        let stderr = String::from_utf8_lossy(&run.stderr);
+        let tail: Vec<&str> = stderr.lines().rev().take(5).collect();
+        return Err(Error::Ghostscript(format!("{label}: {}: {}", run.status, tail.into_iter().rev().collect::<Vec<_>>().join(" / "))));
+    }
+    let mut plates = BTreeMap::new();
+    for entry in std::fs::read_dir(&work.0).map_err(|e| gs_error(&work.0, e))? {
+        let path = entry.map_err(|e| gs_error(&work.0, e))?.path();
+        let Some(name) = path.file_name().and_then(|n| n.to_str()).and_then(plate_name) else { continue };
+        let data = std::fs::read(&path).map_err(|e| gs_error(&path, e))?;
+        let plate = tiff::read(&data).map_err(|e| Error::Tiff(format!("{}: {e}", path.display())))?;
+        plates.insert(name.to_owned(), plate);
+    }
+    if plates.is_empty() {
+        return Err(Error::Ghostscript(format!("{label}: no plates written")));
+    }
+    Ok(plates)
+}
+
+/// `p1(Cyan).tif` → `Cyan`; the composite `p1.tif` and later pages are not plates.
+pub fn plate_name(file: &str) -> Option<&str> {
+    file.strip_prefix("p1(")?.strip_suffix(").tif")
+}
+
+fn gs_error(path: &Path, e: std::io::Error) -> Error {
+    Error::Ghostscript(format!("{}: {e}", path.display()))
+}
+
+/// A fresh temporary directory, removed on drop.
+struct WorkDir(PathBuf);
+
+impl WorkDir {
+    fn new(label: &str) -> Result<Self, Error> {
+        static NEXT: AtomicUsize = AtomicUsize::new(0);
+        let safe: String = label.chars().map(|c| if c.is_ascii_alphanumeric() { c } else { '_' }).collect();
+        let n = NEXT.fetch_add(1, Ordering::Relaxed);
+        let dir = std::env::temp_dir().join(format!("craft-plate-test-{}-{n}-{safe}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).map_err(|e| gs_error(&dir, e))?;
+        Ok(Self(dir))
+    }
+}
+
+impl Drop for WorkDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::plate_name;
+
+    #[test]
+    fn names_plates_from_tiffsep_files() {
+        assert_eq!(plate_name("p1(Cyan).tif"), Some("Cyan"));
+        assert_eq!(plate_name("p1(PANTONE 871 C).tif"), Some("PANTONE 871 C"));
+        assert_eq!(plate_name("p1.tif"), None);
+        assert_eq!(plate_name("p2(Cyan).tif"), None);
+    }
+}
diff --git a/crates/plate-test/src/judge.rs b/crates/plate-test/src/judge.rs
new file mode 100644
index 00000000..693106cb
--- /dev/null
+++ b/crates/plate-test/src/judge.rs
@@ -0,0 +1,311 @@
+//! Judges separated plates against a scene's `expect` block.
+//!
+//! An area point is the median of the 5 × 5 pixels around it on each plate. A text point is the
+//! median over the glyph's pixels: those in its region with at least half the darkest ink on
+//! the glyph plate (Black unless the point names another). Plates a point doesn't list expect 0.
+
+use std::collections::BTreeMap;
+
+use serde::Serialize;
+
+use crate::scene::{Level, PROCESS, PointKind, SamplePoint, Scene, TEXT_PLATE};
+use crate::tiff::Plate;
+
+/// Below this much ink on the glyph plate a text region counts as empty.
+const TEXT_MIN_INK: f32 = 20.0;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum Verdict {
+    Pass,
+    Fail,
+    /// Measured, not judged.
+    Info,
+    /// Not measured: the scene's text was not drawn (no font).
+    Skipped,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct PointResult {
+    pub at: [f32; 2],
+    pub kind: PointKind,
+    pub note: Option<String>,
+    pub expected: BTreeMap<String, Level>,
+    pub tol: f32,
+    /// Ink percentage per plate, rounded to 0.1; every expected and every separated plate.
+    pub measured: BTreeMap<String, f32>,
+    pub verdict: Verdict,
+    /// Plates outside tolerance.
+    pub off: Vec<String>,
+    /// How the value was found, or why it wasn't.
+    pub how: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Judgement {
+    /// The plates the separation produced.
+    pub plates: Vec<String>,
+    /// Expected plates the separation lacks.
+    pub missing_plates: Vec<String>,
+    /// Plates the separation produced that the scene doesn't expect.
+    pub extra_plates: Vec<String>,
+    pub points: Vec<PointResult>,
+}
+
+impl Judgement {
+    pub fn passed(&self) -> bool {
+        self.missing_plates.is_empty() && self.extra_plates.is_empty() && self.failed_points() == 0
+    }
+
+    pub fn failed_points(&self) -> usize {
+        self.points.iter().filter(|p| p.verdict == Verdict::Fail).count()
+    }
+
+    pub fn judged_points(&self) -> usize {
+        self.points.iter().filter(|p| matches!(p.verdict, Verdict::Pass | Verdict::Fail)).count()
+    }
+}
+
+/// Judge `plates` (separated at `res` dpi) against `scene`. `text_drawn` is false when the
+/// scene's text was left out, so text points are skipped rather than failed.
+pub fn judge(scene: &Scene, plates: &BTreeMap<String, Plate>, res: f32, text_drawn: bool) -> Judgement {
+    let expected = &scene.expect.plates;
+    let mut names: Vec<String> = expected.iter().chain(plates.keys()).cloned().collect();
+    sort_plates(&mut names);
+    names.dedup();
+    let points = scene.expect.points.iter().map(|point| judge_point(point, plates, &names, res, text_drawn)).collect();
+    let mut separated: Vec<String> = plates.keys().cloned().collect();
+    sort_plates(&mut separated);
+    Judgement {
+        missing_plates: expected.iter().filter(|p| !plates.contains_key(*p)).cloned().collect(),
+        extra_plates: separated.iter().filter(|p| !expected.contains(p)).cloned().collect(),
+        plates: separated,
+        points,
+    }
+}
+
+fn judge_point(point: &SamplePoint, plates: &BTreeMap<String, Plate>, names: &[String], res: f32, text_drawn: bool) -> PointResult {
+    let mut result = PointResult {
+        at: point.at,
+        kind: point.kind,
+        note: point.note.clone(),
+        expected: point.inks.clone(),
+        tol: point.tol,
+        measured: BTreeMap::new(),
+        verdict: Verdict::Fail,
+        off: Vec::new(),
+        how: None,
+    };
+    if point.kind == PointKind::Text && !text_drawn {
+        result.verdict = Verdict::Skipped;
+        result.how = Some("text not drawn (no font)".into());
+        return result;
+    }
+    let pixels = match point_pixels(point, plates, res) {
+        Ok((pixels, how)) => {
+            result.how = how;
+            pixels
+        }
+        Err(why) => {
+            result.how = Some(why);
+            Vec::new()
+        }
+    };
+    for name in names {
+        let value = match plates.get(name) {
+            Some(plate) => median(&mut pixels.iter().filter_map(|&(x, y)| plate.ink(x, y)).collect::<Vec<_>>()).unwrap_or(0.0),
+            None => 0.0,
+        };
+        result.measured.insert(name.clone(), (value * 10.0).round() / 10.0);
+    }
+    if pixels.is_empty() {
+        return result;
+    }
+    for (name, value) in &result.measured {
+        let ok = match point.inks.get(name).copied().unwrap_or(Level::Value(0.0)) {
+            Level::Value(expected) => (value - expected).abs() <= point.tol,
+            Level::Range([lo, hi]) => (lo..=hi).contains(value),
+        };
+        if !ok {
+            result.off.push(name.clone());
+        }
+    }
+    sort_plates(&mut result.off);
+    result.verdict = if point.info {
+        Verdict::Info
+    } else if result.off.is_empty() {
+        Verdict::Pass
+    } else {
+        Verdict::Fail
+    };
+    result
+}
+
+/// Pixels a point samples, and a note on how they were found.
+type Sample = (Vec<(usize, usize)>, Option<String>);
+
+/// The pixels a point samples; `Err` says why there are none.
+fn point_pixels(point: &SamplePoint, plates: &BTreeMap<String, Plate>, res: f32) -> Result<Sample, String> {
+    let (width, height) = plates.values().next().map(|p| (p.width(), p.height())).ok_or("no plates")?;
+    let px = |v: f32| (v * res / 72.0).round();
+    let inside = |x: f32, y: f32| x >= 0.0 && y >= 0.0 && (x as usize) < width && (y as usize) < height;
+    match (point.kind, point.region) {
+        (PointKind::Text, Some([x, y, w, h])) => {
+            let glyph = point.plate.as_deref().unwrap_or(TEXT_PLATE);
+            let plate = plates.get(glyph).ok_or_else(|| format!("no {glyph} plate to find the text on"))?;
+            let (x0, y0, x1, y1) = (px(x).max(0.0), px(y).max(0.0), px(x + w), px(y + h));
+            let mut region = Vec::new();
+            let mut row = y0;
+            while row < y1 {
+                let mut col = x0;
+                while col < x1 {
+                    if inside(col, row) {
+                        let (cx, cy) = (col as usize, row as usize);
+                        region.push(((cx, cy), plate.ink(cx, cy).unwrap_or(0.0)));
+                    }
+                    col += 1.0;
+                }
+                row += 1.0;
+            }
+            let darkest = region.iter().map(|(_, ink)| *ink).fold(0.0, f32::max);
+            if darkest < TEXT_MIN_INK {
+                return Err(format!("text not found on the {glyph} plate"));
+            }
+            let glyph_pixels: Vec<(usize, usize)> = region.into_iter().filter(|(_, ink)| *ink >= darkest * 0.5).map(|(at, _)| at).collect();
+            let how = format!("{} glyph pixels on {glyph}", glyph_pixels.len());
+            Ok((glyph_pixels, Some(how)))
+        }
+        _ => {
+            let (cx, cy) = (px(point.at[0]), px(point.at[1]));
+            let mut pixels = Vec::with_capacity(25);
+            for dy in -2..=2 {
+                for dx in -2..=2 {
+                    let (x, y) = (cx + dx as f32, cy + dy as f32);
+                    if inside(x, y) {
+                        pixels.push((x as usize, y as usize));
+                    }
+                }
+            }
+            if pixels.is_empty() { Err("outside the page".into()) } else { Ok((pixels, None)) }
+        }
+    }
+}
+
+/// The median; the mean of the middle two for an even count.
+pub fn median(values: &mut [f32]) -> Option<f32> {
+    values.sort_by(f32::total_cmp);
+    let n = values.len();
+    match n {
+        0 => None,
+        _ if n % 2 == 1 => values.get(n / 2).copied(),
+        _ => Some((values.get(n / 2 - 1)? + values.get(n / 2)?) / 2.0),
+    }
+}
+
+/// Process plates first in press order, then spots by name.
+pub fn sort_plates(names: &mut [String]) {
+    names.sort_by_key(|name| (PROCESS.iter().position(|p| p == name).unwrap_or(PROCESS.len()), name.clone()));
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used)]
+
+    use super::*;
+
+    const W: usize = 60;
+    const H: usize = 40;
+
+    fn plate(paint: impl Fn(usize, usize) -> u8) -> Plate {
+        let ink = (0..W * H).map(|i| paint(i % W, i / W)).collect();
+        Plate::new(W, H, ink).unwrap()
+    }
+
+    fn scene(json: &str) -> Scene {
+        serde_json::from_str(json).unwrap()
+    }
+
+    /// Cyan everywhere; Gold at 50% in the right half; a "glyph" of solid Black in
+    /// x 10..20, y 10..30 with stray 30% black pixels around it.
+    fn plates(with_gold: bool, extra: Option<&str>) -> BTreeMap<String, Plate> {
+        let mut plates = BTreeMap::new();
+        plates.insert("Cyan".to_owned(), plate(|_, _| 255));
+        plates.insert("Magenta".to_owned(), plate(|_, _| 0));
+        plates.insert("Yellow".to_owned(), plate(|_, _| 0));
+        plates.insert(
+            "Black".to_owned(),
+            plate(|x, y| match (x, y) {
+                (10..20, 10..30) => 255,
+                (5..25, 5..35) if (x + y) % 3 == 0 => 77,
+                _ => 0,
+            }),
+        );
+        if with_gold {
+            plates.insert("Gold".to_owned(), plate(|x, _| if x >= 30 { 128 } else { 0 }));
+        }
+        if let Some(name) = extra {
+            plates.insert(name.to_owned(), plate(|_, _| 0));
+        }
+        plates
+    }
+
+    const SCENE: &str = r#"{
+        "id": "T", "title": "t", "source": "unit test", "page": [60, 40],
+        "inks": [{"name": "Gold", "cmyk": [0, 20, 60, 20]}],
+        "objects": [],
+        "expect": {
+            "plates": ["Cyan", "Magenta", "Yellow", "Black", "Gold"],
+            "points": [
+                {"at": [45, 20], "inks": {"Cyan": 100, "Gold": 50}, "tol": 2},
+                {"at": [15, 20], "kind": "text", "region": [5, 5, 20, 30], "inks": {"Cyan": 100, "Black": 100}, "tol": 2},
+                {"at": [45, 20], "inks": {"Gold": [10, 20]}, "tol": 2, "info": true},
+                {"at": [45, 20], "inks": {"Cyan": 100, "Gold": [40, 60]}, "tol": 2}
+            ]
+        }
+    }"#;
+
+    #[test]
+    fn passes_a_matching_separation() {
+        let judgement = judge(&scene(SCENE), &plates(true, None), 72.0, true);
+        let verdicts: Vec<Verdict> = judgement.points.iter().map(|p| p.verdict).collect();
+        assert_eq!(verdicts, [Verdict::Pass, Verdict::Pass, Verdict::Info, Verdict::Pass], "{judgement:#?}");
+        assert!(judgement.passed());
+        assert_eq!(judgement.points[0].measured["Gold"], 50.2);
+        assert_eq!(judgement.points[1].how.as_deref(), Some("200 glyph pixels on Black"));
+        assert_eq!(judgement.plates, ["Cyan", "Magenta", "Yellow", "Black", "Gold"]);
+    }
+
+    #[test]
+    fn fails_wrong_ink_and_wrong_plates() {
+        let mut knocked = plates(false, Some("Orange"));
+        knocked.insert("Cyan".to_owned(), plate(|x, _| if x >= 30 { 0 } else { 255 }));
+        let judgement = judge(&scene(SCENE), &knocked, 72.0, true);
+        assert_eq!(judgement.missing_plates, ["Gold"]);
+        assert_eq!(judgement.extra_plates, ["Orange"]);
+        let first = &judgement.points[0];
+        assert_eq!(first.verdict, Verdict::Fail);
+        assert_eq!(first.off, ["Cyan", "Gold"]);
+        assert_eq!(judgement.points[2].verdict, Verdict::Info, "info points are never judged");
+        assert!(!judgement.passed());
+        assert_eq!((judgement.failed_points(), judgement.judged_points()), (2, 3));
+    }
+
+    #[test]
+    fn text_points_need_the_glyph() {
+        let mut no_text = plates(true, None);
+        no_text.insert("Black".to_owned(), plate(|_, _| 0));
+        let judgement = judge(&scene(SCENE), &no_text, 72.0, true);
+        assert_eq!(judgement.points[1].verdict, Verdict::Fail);
+        assert_eq!(judgement.points[1].how.as_deref(), Some("text not found on the Black plate"));
+        let skipped = judge(&scene(SCENE), &no_text, 72.0, false);
+        assert_eq!(skipped.points[1].verdict, Verdict::Skipped);
+        assert_eq!(skipped.failed_points(), 0);
+    }
+
+    #[test]
+    fn medians() {
+        assert_eq!(median(&mut []), None);
+        assert_eq!(median(&mut [3.0, 1.0, 2.0]), Some(2.0));
+        assert_eq!(median(&mut [4.0, 1.0, 2.0, 3.0]), Some(2.5));
+    }
+}
diff --git a/crates/plate-test/src/lib.rs b/crates/plate-test/src/lib.rs
new file mode 100644
index 00000000..4a651c92
--- /dev/null
+++ b/crates/plate-test/src/lib.rs
@@ -0,0 +1,42 @@
+//! Print-color test scenes for the Craft apps.
+//!
+//! [`scene`] reads the app-neutral scene files in `scenes/`. [`reference`] writes a scene to
+//! PDF through craft-pdf, so the shared writer is tested on its own. [`structure`] summarizes a
+//! PDF's print-relevant structure (transparency groups, overprint and soft-mask graphics states,
+//! color spaces, output intents) and checks it against a scene's `structure` block. Apps use
+//! the scenes and [`structure`] from their own adapter, as a dev-dependency.
+//!
+//! On developer machines, [`report`] separates each scene's PDF into plates with Ghostscript
+//! ([`gs`], an external program; [`tiff`] reads the plates) and [`judge`]s the ink at the
+//! scene's sample points.
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+pub mod gs;
+pub mod judge;
+pub mod reference;
+pub mod report;
+pub mod scene;
+pub mod structure;
+pub mod tiff;
+
+/// Failures of the harness itself; scene results are reported, not raised.
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    /// A scene file could not be read, parsed or resolved.
+    #[error("scene: {0}")]
+    Scene(String),
+    /// The writer can't express this feature yet.
+    #[error("unsupported: {0}")]
+    Unsupported(String),
+    #[error("write: {0}")]
+    Write(#[from] craft_pdf::write::WriteError),
+    /// The PDF could not be parsed for the structure summary.
+    #[error("read: {0}")]
+    Read(String),
+    /// Ghostscript could not be run or failed to separate a PDF.
+    #[error("ghostscript: {0}")]
+    Ghostscript(String),
+    /// A plate file could not be read.
+    #[error("tiff: {0}")]
+    Tiff(String),
+}
diff --git a/crates/plate-test/src/reference.rs b/crates/plate-test/src/reference.rs
new file mode 100644
index 00000000..2bae10ff
--- /dev/null
+++ b/crates/plate-test/src/reference.rs
@@ -0,0 +1,693 @@
+//! The reference writer: draws a scene with krilla through craft-pdf.
+//!
+//! Each scene feature maps to one plain krilla call, so the output shows what the shared writer
+//! does on its own. Features the writer can't express yet return [`Error::Unsupported`] before
+//! anything is drawn.
+
+use std::collections::BTreeMap;
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use craft_pdf::write::backend as krilla;
+use craft_pdf::write::print::{self, PrintColor};
+use craft_pdf::write::{self, Metadata, Writer};
+use krilla::blend::{BlendMode, GroupOptions, Overprint};
+use krilla::color::device_n::{self, Colorant, DeviceNSpace, Process};
+use krilla::color::separation::{SeparationColorant, SeparationSpace};
+use krilla::color::{RegularColor, cmyk, luma, rgb, separation};
+use krilla::geom::{Path, PathBuilder, Point, Rect, Size, Transform};
+use krilla::image::{BitsPerComponent, CustomImage, Image, ImageColorspace};
+use krilla::mask::{Mask as KrillaMask, MaskType, TransferFunction};
+use krilla::num::NormalizedF32;
+use krilla::page::PageSettings;
+use krilla::paint::{Fill, LinearGradient, MeshGradient, MeshPatch, Paint as KrillaPaint, SpreadMethod, Stop, Stroke as KrillaStroke};
+use krilla::pdf::{Pdf, PdfDocument};
+use krilla::surface::Surface;
+use krilla::text::{Font, TextDirection};
+
+use crate::Error;
+use crate::scene::{Blend, GroupCs, ImageSource, Kind, MAX_NESTING, MaskKind, Named, Object, Paint, Scene, Stroke};
+
+/// The font used for text objects, from `scripts/fetch-pdf-test-fonts.py`.
+pub const FONT_FILE: &str = "Inter-Regular.ttf";
+/// Directory holding [`FONT_FILE`].
+pub const FONT_DIR_ENV: &str = "CRAFT_PDF_TEST_FONT_DIR";
+
+/// What a scene may refer to outside itself.
+pub struct Context<'a> {
+    /// Scenes that `pdf` objects can place.
+    pub scenes: &'a [Scene],
+    /// Font data for text objects; without it text is skipped with a note.
+    pub font: Option<Arc<Vec<u8>>>,
+}
+
+impl<'a> Context<'a> {
+    /// Reads the font from [`FONT_DIR_ENV`] when it is set and the file exists.
+    pub fn from_env(scenes: &'a [Scene]) -> Self {
+        let font =
+            std::env::var_os(FONT_DIR_ENV).map(|dir| PathBuf::from(dir).join(FONT_FILE)).and_then(|path| std::fs::read(path).ok()).map(Arc::new);
+        Self { scenes, font }
+    }
+}
+
+/// A written scene.
+#[derive(Debug)]
+pub struct Output {
+    pub pdf: Vec<u8>,
+    /// What was left out, e.g. text without a font.
+    pub notes: Vec<String>,
+}
+
+/// Write `scene` as a one-page PDF.
+pub fn write(scene: &Scene, ctx: &Context<'_>) -> Result<Output, Error> {
+    write_nested(scene, ctx, 0, false)
+}
+
+/// Write `scene` as far as the writer can, to see what a pending scene prints today. Features
+/// the writer lacks but can leave out are left out with a note; the others still return
+/// [`Error::Unsupported`].
+pub fn write_partial(scene: &Scene, ctx: &Context<'_>) -> Result<Output, Error> {
+    write_nested(scene, ctx, 0, true)
+}
+
+fn write_nested(scene: &Scene, ctx: &Context<'_>, depth: usize, partial: bool) -> Result<Output, Error> {
+    let mut resolver = Resolver { scene, ctx, depth, partial, notes: Vec::new(), font: None };
+    let nodes = resolver.objects(&scene.objects)?;
+    let notes = resolver.notes;
+    let [width, height] = scene.page;
+    let page = PageSettings::from_wh(width, height).ok_or_else(|| Error::Scene(format!("{}: bad page size", scene.id)))?;
+    let settings = settings(scene)?;
+    let pdf = write::guard(|| {
+        let mut writer = Writer::new(settings, Metadata::default());
+        let mut page = writer.document_mut().start_page_with(page);
+        let mut surface = page.surface();
+        for node in &nodes {
+            draw(node, &mut surface);
+        }
+        surface.finish();
+        page.finish();
+        writer.finish().map_err(Error::from)
+    })?;
+    Ok(Output { pdf, notes })
+}
+
+/// The writer's defaults, or the print settings for the scene's output intent; an explicit
+/// `group_cs` overrides either.
+fn settings(scene: &Scene) -> Result<krilla::SerializeSettings, Error> {
+    let base = match scene.settings.output_intent.as_deref() {
+        None => krilla::SerializeSettings::default(),
+        Some(name) => {
+            let color = print_color(name).ok_or_else(|| Error::Scene(format!("{}: unknown output intent {name}", scene.id)))?;
+            print::settings(color)?
+        }
+    };
+    let group_color_space = match scene.settings.group_cs {
+        None => base.group_color_space,
+        Some(GroupCs::Rgb) => krilla::GroupColorSpace::Rgb,
+        Some(GroupCs::Cmyk) => krilla::GroupColorSpace::Cmyk,
+    };
+    Ok(krilla::SerializeSettings { group_color_space, ..base })
+}
+
+/// The printing condition for each name in [`OUTPUT_INTENTS`](crate::scene::OUTPUT_INTENTS).
+fn print_color(name: &str) -> Option<PrintColor<'static>> {
+    match name {
+        "fogra39" => Some(PrintColor::fogra39(craft_cms::builtin::COATED_FOGRA39_ICC)),
+        _ => None,
+    }
+}
+
+fn unsupported(feature: &str) -> Error {
+    Error::Unsupported(feature.to_owned())
+}
+
+/// A scene object resolved to krilla values, drawable without failing.
+enum Node {
+    Shape {
+        path: Path,
+        fill: Option<Fill>,
+        stroke: Option<KrillaStroke>,
+    },
+    Text {
+        at: Point,
+        size: f32,
+        text: String,
+        font: Font,
+        fill: Option<Fill>,
+        stroke: Option<KrillaStroke>,
+    },
+    Image {
+        image: Image,
+        rect: [f32; 4],
+    },
+    Pdf {
+        doc: PdfDocument,
+        rect: [f32; 4],
+    },
+    Group {
+        options: GroupOptions,
+        children: Vec<Node>,
+    },
+    /// Outermost first: blend mode, soft mask, opacity group, overprint.
+    Wrapped {
+        blend: Option<BlendMode>,
+        mask: Option<SoftMask>,
+        opacity: Option<NormalizedF32>,
+        overprint: Option<Overprint>,
+        inner: Box<Node>,
+    },
+}
+
+struct SoftMask {
+    kind: MaskType,
+    backdrop: Option<RegularColor>,
+    transfer: Option<TransferFunction>,
+    content: Vec<Node>,
+}
+
+struct Resolver<'s, 'c> {
+    scene: &'s Scene,
+    ctx: &'c Context<'c>,
+    depth: usize,
+    /// Leave out features the writer lacks instead of failing; see [`write_partial`].
+    partial: bool,
+    notes: Vec<String>,
+    font: Option<Font>,
+}
+
+impl Resolver<'_, '_> {
+    /// A feature the writer lacks: a note when writing partially, otherwise unsupported.
+    // Every scene feature is written today; scenes for later work (the flattener) call it again.
+    #[allow(dead_code)]
+    fn lacks(&mut self, feature: &str) -> Result<(), Error> {
+        if !self.partial {
+            return Err(unsupported(feature));
+        }
+        let note = format!("{}: {feature} left out", self.scene.id);
+        if !self.notes.contains(&note) {
+            self.notes.push(note);
+        }
+        Ok(())
+    }
+
+    fn objects(&mut self, objects: &[Object]) -> Result<Vec<Node>, Error> {
+        let mut nodes = Vec::new();
+        for object in objects {
+            if let Some(node) = self.object(object)? {
+                nodes.push(node);
+            }
+        }
+        Ok(nodes)
+    }
+
+    fn object(&mut self, o: &Object) -> Result<Option<Node>, Error> {
+        let overprint = match o.overprint {
+            Some(op) => Some(Overprint {
+                fill: op.fill,
+                stroke: op.stroke,
+                nonzero: match op.mode {
+                    0 => false,
+                    1 => true,
+                    _ => return Err(self.bad("overprint mode must be 0 or 1")),
+                },
+            }),
+            None => None,
+        };
+        let Some(inner) = self.content(o)? else { return Ok(None) };
+        let blend = o.blend.filter(|b| *b != Blend::Normal).map(blend_mode);
+        let opacity = match o.opacity {
+            Some(value) if value < 1.0 => Some(NormalizedF32::new(value).ok_or_else(|| self.bad("opacity must be 0–1"))?),
+            _ => None,
+        };
+        let mask = match &o.mask {
+            Some(mask) => {
+                let kind = match mask.kind {
+                    MaskKind::Luminosity => MaskType::Luminosity,
+                    MaskKind::Alpha => MaskType::Alpha,
+                };
+                let backdrop = match &mask.backdrop {
+                    Some(paint) => match self.color(paint)? {
+                        krilla::color::Color::Regular(color) => Some(color),
+                        krilla::color::Color::Special(_) => return Err(self.bad("a mask backdrop must be a process or gray color")),
+                    },
+                    None => None,
+                };
+                let transfer = match &mask.transfer {
+                    Some(curve) => {
+                        let samples = curve.iter().map(|v| NormalizedF32::new(*v)).collect::<Option<Vec<_>>>();
+                        Some(TransferFunction::Sampled(samples.ok_or_else(|| self.bad("transfer samples must be 0–1"))?))
+                    }
+                    None => None,
+                };
+                Some(SoftMask { kind, backdrop, transfer, content: self.objects(&mask.content)? })
+            }
+            None => None,
+        };
+        if blend.is_none() && mask.is_none() && opacity.is_none() && overprint.is_none() {
+            return Ok(Some(inner));
+        }
+        Ok(Some(Node::Wrapped { blend, mask, opacity, overprint, inner: Box::new(inner) }))
+    }
+
+    fn content(&mut self, o: &Object) -> Result<Option<Node>, Error> {
+        Ok(Some(match o.kind {
+            Kind::Rect | Kind::Ellipse => {
+                let [x, y, w, h] = self.rect(o)?;
+                let path = if o.kind == Kind::Rect { rect_path(x, y, w, h) } else { ellipse_path(x, y, w, h) };
+                let path = path.ok_or_else(|| self.bad("degenerate shape"))?;
+                let (fill, stroke) = self.fill_stroke(o)?;
+                if fill.is_none() && stroke.is_none() {
+                    return Ok(None);
+                }
+                Node::Shape { path, fill, stroke }
+            }
+            Kind::Text => {
+                let (Some([x, y]), Some(size), Some(text)) = (o.at, o.size, o.text.clone()) else {
+                    return Err(self.bad("text needs at, size and text"));
+                };
+                let Some(font) = self.font()? else {
+                    self.notes.push(format!("{}: text {text:?} skipped ({FONT_DIR_ENV} not set)", self.scene.id));
+                    return Ok(None);
+                };
+                let (fill, stroke) = self.fill_stroke(o)?;
+                Node::Text { at: Point::from_xy(x, y), size, text, font, fill, stroke }
+            }
+            Kind::Image => {
+                let source = o.image.as_ref().ok_or_else(|| self.bad("missing image"))?;
+                let rect = self.rect(o)?;
+                Node::Image { image: self.image(source, rect)?, rect }
+            }
+            Kind::Pdf => {
+                let id = o.scene.as_deref().ok_or_else(|| self.bad("missing scene"))?;
+                let placed = self.ctx.scenes.iter().find(|s| s.id == id).ok_or_else(|| self.bad(&format!("unknown scene {id}")))?;
+                if self.depth >= MAX_NESTING {
+                    return Err(self.bad("placed scenes nest too deep"));
+                }
+                let rect = self.rect(o)?;
+                let output = write_nested(placed, self.ctx, self.depth + 1, self.partial)?;
+                self.notes.extend(output.notes);
+                let pdf = Pdf::new(Arc::new(output.pdf)).map_err(|e| Error::Read(format!("{id}: {e:?}")))?;
+                Node::Pdf { doc: PdfDocument::new(Arc::new(pdf)), rect }
+            }
+            Kind::Group => Node::Group { options: GroupOptions { isolated: o.isolated, knockout: o.knockout }, children: self.objects(&o.objects)? },
+        }))
+    }
+
+    fn rect(&self, o: &Object) -> Result<[f32; 4], Error> {
+        o.rect.ok_or_else(|| self.bad("missing rect"))
+    }
+
+    fn font(&mut self) -> Result<Option<Font>, Error> {
+        if self.font.is_none()
+            && let Some(data) = &self.ctx.font
+        {
+            self.font = Some(write::font(data, 0, None)?);
+        }
+        Ok(self.font.clone())
+    }
+
+    fn fill_stroke(&self, o: &Object) -> Result<(Option<Fill>, Option<KrillaStroke>), Error> {
+        let fill = o.fill.as_ref().map(|p| self.paint(p)).transpose()?.map(|paint| Fill { paint, ..Default::default() });
+        let stroke = match &o.stroke {
+            Some(Stroke { paint, width }) => Some(KrillaStroke { paint: self.paint(paint)?, width: *width, ..Default::default() }),
+            None => None,
+        };
+        Ok((fill, stroke))
+    }
+
+    fn paint(&self, paint: &Paint) -> Result<KrillaPaint, Error> {
+        match paint {
+            Paint::Linear { linear } => {
+                mixable(linear.stops.iter().map(|s| &s.paint))?;
+                let mut stops = Vec::new();
+                for stop in &linear.stops {
+                    let offset = NormalizedF32::new(stop.at).ok_or_else(|| self.bad("gradient stop outside 0–1"))?;
+                    stops.push(Stop { offset, color: self.color(&stop.paint)?, opacity: NormalizedF32::ONE });
+                }
+                Ok(LinearGradient {
+                    x1: linear.from[0],
+                    y1: linear.from[1],
+                    x2: linear.to[0],
+                    y2: linear.to[1],
+                    transform: Transform::identity(),
+                    spread_method: SpreadMethod::Pad,
+                    stops,
+                    anti_alias: false,
+                }
+                .into())
+            }
+            Paint::Mesh { mesh } => {
+                mixable(mesh.corners.iter())?;
+                let [x, y, w, h] = mesh.rect;
+                let corners = [(x, y), (x + w, y), (x + w, y + h), (x, y + h)];
+                let mut points = [(0.0, 0.0); 12];
+                for (i, &(ax, ay)) in corners.iter().enumerate() {
+                    let (bx, by) = corners[(i + 1) % 4];
+                    for step in 0..3 {
+                        let t = step as f32 / 3.0;
+                        points[3 * i + step] = (ax + (bx - ax) * t, ay + (by - ay) * t);
+                    }
+                }
+                let [a, b, c, d] = &mesh.corners;
+                let colors = [self.color(a)?, self.color(b)?, self.color(c)?, self.color(d)?];
+                let patch = MeshPatch { points, colors, opacities: [NormalizedF32::ONE; 4] };
+                Ok(MeshGradient { patches: vec![patch], transform: Transform::identity(), anti_alias: false }.into())
+            }
+            solid => Ok(self.color(solid)?.into()),
+        }
+    }
+
+    fn color(&self, paint: &Paint) -> Result<krilla::color::Color, Error> {
+        Ok(match paint {
+            Paint::Named(Named::Registration) => {
+                let all = SeparationSpace::new(SeparationColorant::AllColorants, cmyk::Color::new(255, 255, 255, 255).into());
+                separation::Color::new(255, all).into()
+            }
+            Paint::Cmyk { cmyk } => cmyk_color(*cmyk).into(),
+            Paint::Gray { gray } => luma::Color::new(byte(100.0 - gray)).into(),
+            Paint::Rgb { rgb } => rgb::Color::new(channel(rgb[0]), channel(rgb[1]), channel(rgb[2])).into(),
+            Paint::Spot { spot, tint } => {
+                let alternate: RegularColor = self.spot_alternate(spot)?.into();
+                separation::Color::new(byte(*tint), SeparationSpace::new(SeparationColorant::Custom(spot.clone()), alternate)).into()
+            }
+            Paint::Inks { inks } => self.device_n(inks)?.into(),
+            Paint::Linear { .. } | Paint::Mesh { .. } => return Err(self.bad("gradients can't nest")),
+        })
+    }
+
+    fn spot_alternate(&self, spot: &str) -> Result<cmyk::Color, Error> {
+        let ink = self.scene.ink(spot).ok_or_else(|| self.bad(&format!("undeclared spot {spot}")))?;
+        match ink.cmyk {
+            Some(c) => Ok(cmyk_color(c)),
+            None => Err(unsupported("Lab spot alternate")),
+        }
+    }
+
+    /// A DeviceN color in the space of its inks (see [`Self::device_n_space`]).
+    fn device_n(&self, inks: &BTreeMap<String, f32>) -> Result<device_n::Color, Error> {
+        let space = self.device_n_space(inks.keys())?;
+        let tints = space.colorants().iter().map(|c| byte(inks.get(c.name()).copied().unwrap_or(0.0))).collect();
+        device_n::Color::new(tints, space).ok_or_else(|| self.bad("DeviceN tints don't match its inks"))
+    }
+
+    /// A DeviceN space of the named inks: process inks first, in CMYK order, then the spots in
+    /// the order the scene declares them.
+    fn device_n_space<'n>(&self, names: impl Iterator<Item = &'n String> + Clone) -> Result<DeviceNSpace, Error> {
+        let named = |name: &str| names.clone().any(|n| n == name);
+        let mut colorants = Vec::new();
+        for process in Process::ALL {
+            if named(process.name()) {
+                colorants.push(Colorant::Process(process));
+            }
+        }
+        for ink in &self.scene.inks {
+            if named(&ink.name) {
+                colorants.push(Colorant::Spot { name: ink.name.clone(), alternate: self.spot_alternate(&ink.name)? });
+            }
+        }
+        if let Some(name) = names.clone().find(|name| !colorants.iter().any(|c| c.name() == name.as_str())) {
+            return Err(self.bad(&format!("undeclared ink {name}")));
+        }
+        DeviceNSpace::new(colorants).ok_or_else(|| self.bad("bad DeviceN ink list"))
+    }
+
+    fn image(&self, source: &ImageSource, [x0, y0, w, h]: [f32; 4]) -> Result<Image, Error> {
+        let [px, py] = source.px;
+        let (width, height) = (px as usize, py as usize);
+        let image = if let Some(radius) = source.feather {
+            let mut data = Vec::with_capacity(width * height);
+            for y in 0..height {
+                for x in 0..width {
+                    let (fx, fy) = ((x as f32 + 0.5) * w / px as f32, (y as f32 + 0.5) * h / py as f32);
+                    let edge = fx.min(w - fx).min(fy).min(h - fy);
+                    data.push(channel(255.0 * (edge / radius.max(f32::EPSILON)).min(1.0)));
+                }
+            }
+            Synthetic { data, alpha: None, size: (px, py), space: ImageColorspace::Luma, device_n: None }
+        } else {
+            let (pair, ramp) = match (&source.ramp, &source.split) {
+                (Some(pair), _) => (pair, true),
+                (_, Some(pair)) => (pair, false),
+                _ => return Err(self.bad("image needs ramp, split or feather")),
+            };
+            let (space, device_n, a, b) = match (ink_tints(&pair[0]), ink_tints(&pair[1])) {
+                // Spot and DeviceN paints: one DeviceN image of every ink either names.
+                (Some(a), Some(b)) => {
+                    let space = self.device_n_space(a.keys().chain(b.keys()))?;
+                    let samples = |inks: &BTreeMap<String, f32>| -> Vec<f32> {
+                        space.colorants().iter().map(|c| inks.get(c.name()).copied().unwrap_or(0.0) * 2.55).collect()
+                    };
+                    let (a, b) = (samples(&a), samples(&b));
+                    (ImageColorspace::DeviceN, Some(space), a, b)
+                }
+                _ => {
+                    let (space, a) = self.components(&pair[0])?;
+                    let (space_b, b) = self.components(&pair[1])?;
+                    if space != space_b {
+                        return Err(self.bad("image paints must share a color space"));
+                    }
+                    (space, None, a, b)
+                }
+            };
+            let mut data = Vec::with_capacity(width * height * a.len());
+            for _ in 0..height {
+                for x in 0..width {
+                    let t = if ramp { (x as f32 + 0.5) / px as f32 } else { f32::from(u8::from(2 * x >= width)) };
+                    data.extend(a.iter().zip(&b).map(|(a, b)| channel(a + (b - a) * t)));
+                }
+            }
+            let alpha = source.alpha.as_ref().map(|a| {
+                let [ax, ay, aw, ah] = a.rect;
+                let value = channel(a.opacity * 255.0);
+                let mut alpha = Vec::with_capacity(width * height);
+                for y in 0..height {
+                    for x in 0..width {
+                        let (fx, fy) = (x0 + (x as f32 + 0.5) * w / px as f32, y0 + (y as f32 + 0.5) * h / py as f32);
+                        let inside = (ax..ax + aw).contains(&fx) && (ay..ay + ah).contains(&fy);
+                        alpha.push(if inside { value } else { 0 });
+                    }
+                }
+                alpha
+            });
+            Synthetic { data, alpha, size: (px, py), space, device_n }
+        };
+        Image::from_custom(image, false).map_err(|e| self.bad(&e))
+    }
+
+    /// Image samples (0–255) for a solid paint.
+    fn components(&self, paint: &Paint) -> Result<(ImageColorspace, Vec<f32>), Error> {
+        Ok(match paint {
+            Paint::Cmyk { cmyk } => (ImageColorspace::Cmyk, cmyk.iter().map(|v| v * 2.55).collect()),
+            Paint::Gray { gray } => (ImageColorspace::Luma, vec![(100.0 - gray) * 2.55]),
+            Paint::Rgb { rgb } => (ImageColorspace::Rgb, rgb.to_vec()),
+            Paint::Inks { .. } | Paint::Spot { .. } => return Err(self.bad("image paints must share a color space")),
+            Paint::Named(_) => return Err(unsupported("registration image")),
+            Paint::Linear { .. } | Paint::Mesh { .. } => return Err(self.bad("images take solid paints")),
+        })
+    }
+
+    fn bad(&self, message: &str) -> Error {
+        Error::Scene(format!("{}: {message}", self.scene.id))
+    }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Space<'a> {
+    Cmyk,
+    Gray,
+    Rgb,
+    Spot(&'a str),
+    Other,
+}
+
+/// krilla brings ink-based gradient colors into one space; RGB and registration don't mix.
+fn mixable<'a>(paints: impl Iterator<Item = &'a Paint> + Clone) -> Result<(), Error> {
+    let space = paints.clone().next().map(space_of);
+    let mixed = paints.clone().any(|p| Some(space_of(p)) != space);
+    if mixed && paints.into_iter().any(|p| matches!(p, Paint::Rgb { .. } | Paint::Named(_))) {
+        return Err(unsupported("gradient between RGB or registration and other color spaces"));
+    }
+    Ok(())
+}
+
+fn space_of(paint: &Paint) -> Space<'_> {
+    match paint {
+        Paint::Cmyk { .. } => Space::Cmyk,
+        Paint::Gray { .. } => Space::Gray,
+        Paint::Rgb { .. } => Space::Rgb,
+        Paint::Spot { spot, .. } => Space::Spot(spot),
+        _ => Space::Other,
+    }
+}
+
+/// Ink percentages of a spot or DeviceN paint.
+fn ink_tints(paint: &Paint) -> Option<BTreeMap<String, f32>> {
+    match paint {
+        Paint::Inks { inks } => Some(inks.clone()),
+        Paint::Spot { spot, tint } => Some(BTreeMap::from([(spot.clone(), *tint)])),
+        _ => None,
+    }
+}
+
+fn byte(percent: f32) -> u8 {
+    channel(percent * 2.55)
+}
+
+fn channel(value: f32) -> u8 {
+    value.round().clamp(0.0, 255.0) as u8
+}
+
+fn cmyk_color([c, m, y, k]: [f32; 4]) -> cmyk::Color {
+    cmyk::Color::new(byte(c), byte(m), byte(y), byte(k))
+}
+
+fn blend_mode(blend: Blend) -> BlendMode {
+    match blend {
+        Blend::Normal => BlendMode::Normal,
+        Blend::Multiply => BlendMode::Multiply,
+        Blend::Screen => BlendMode::Screen,
+        Blend::Overlay => BlendMode::Overlay,
+        Blend::Darken => BlendMode::Darken,
+        Blend::Lighten => BlendMode::Lighten,
+        Blend::ColorDodge => BlendMode::ColorDodge,
+        Blend::ColorBurn => BlendMode::ColorBurn,
+        Blend::HardLight => BlendMode::HardLight,
+        Blend::SoftLight => BlendMode::SoftLight,
+        Blend::Difference => BlendMode::Difference,
+        Blend::Exclusion => BlendMode::Exclusion,
+        Blend::Hue => BlendMode::Hue,
+        Blend::Saturation => BlendMode::Saturation,
+        Blend::Color => BlendMode::Color,
+        Blend::Luminosity => BlendMode::Luminosity,
+    }
+}
+
+fn rect_path(x: f32, y: f32, w: f32, h: f32) -> Option<Path> {
+    let mut builder = PathBuilder::new();
+    builder.push_rect(Rect::from_xywh(x, y, w, h)?);
+    builder.finish()
+}
+
+fn ellipse_path(x: f32, y: f32, w: f32, h: f32) -> Option<Path> {
+    // Four cubic arcs; KAPPA places the control points for a quarter circle.
+    const KAPPA: f32 = 0.552_284_8;
+    let (rx, ry) = (w / 2.0, h / 2.0);
+    let (cx, cy) = (x + rx, y + ry);
+    let (ox, oy) = (rx * KAPPA, ry * KAPPA);
+    let mut b = PathBuilder::new();
+    b.move_to(cx + rx, cy);
+    b.cubic_to(cx + rx, cy + oy, cx + ox, cy + ry, cx, cy + ry);
+    b.cubic_to(cx - ox, cy + ry, cx - rx, cy + oy, cx - rx, cy);
+    b.cubic_to(cx - rx, cy - oy, cx - ox, cy - ry, cx, cy - ry);
+    b.cubic_to(cx + ox, cy - ry, cx + rx, cy - oy, cx + rx, cy);
+    b.close();
+    b.finish()
+}
+
+#[derive(Clone, Hash)]
+struct Synthetic {
+    data: Vec<u8>,
+    alpha: Option<Vec<u8>>,
+    size: (u32, u32),
+    space: ImageColorspace,
+    device_n: Option<DeviceNSpace>,
+}
+
+impl CustomImage for Synthetic {
+    fn color_channel(&self) -> &[u8] {
+        &self.data
+    }
+    fn alpha_channel(&self) -> Option<&[u8]> {
+        self.alpha.as_deref()
+    }
+    fn bits_per_component(&self) -> BitsPerComponent {
+        BitsPerComponent::Eight
+    }
+    fn size(&self) -> (u32, u32) {
+        self.size
+    }
+    fn icc_profile(&self) -> Option<&[u8]> {
+        None
+    }
+    fn color_space(&self) -> ImageColorspace {
+        self.space
+    }
+    fn device_n_space(&self) -> Option<DeviceNSpace> {
+        self.device_n.clone()
+    }
+}
+
+fn draw(node: &Node, surface: &mut Surface<'_>) {
+    match node {
+        Node::Shape { path, fill, stroke } => {
+            surface.set_fill(fill.clone());
+            surface.set_stroke(stroke.clone());
+            surface.draw_path(path);
+        }
+        Node::Text { at, size, text, font, fill, stroke } => {
+            surface.set_fill(fill.clone());
+            surface.set_stroke(stroke.clone());
+            surface.draw_text(*at, font.clone(), *size, text, false, TextDirection::Auto);
+        }
+        Node::Image { image, rect: [x, y, w, h] } => {
+            if let Some(size) = Size::from_wh(*w, *h) {
+                surface.push_transform(&Transform::from_translate(*x, *y));
+                surface.draw_image(image.clone(), size);
+                surface.pop();
+            }
+        }
+        Node::Pdf { doc, rect: [x, y, w, h] } => {
+            if let Some(size) = Size::from_wh(*w, *h) {
+                surface.push_transform(&Transform::from_translate(*x, *y));
+                surface.draw_pdf_page(doc, size, 0);
+                surface.pop();
+            }
+        }
+        Node::Group { options, children } => {
+            let grouped = *options != GroupOptions::default();
+            if grouped {
+                surface.push_group(*options);
+            }
+            for child in children {
+                draw(child, surface);
+            }
+            if grouped {
+                surface.pop();
+            }
+        }
+        Node::Wrapped { blend, mask, opacity, overprint, inner } => {
+            if let Some(blend) = blend {
+                surface.push_blend_mode(*blend);
+            }
+            if let Some(mask) = mask {
+                let mut builder = surface.stream_builder();
+                let mut sub = builder.surface();
+                for child in &mask.content {
+                    draw(child, &mut sub);
+                }
+                sub.finish();
+                let stream = builder.finish();
+                let mut krilla_mask = KrillaMask::new(stream, mask.kind);
+                if let Some(backdrop) = mask.backdrop {
+                    krilla_mask = krilla_mask.with_backdrop(backdrop);
+                }
+                if let Some(transfer) = &mask.transfer {
+                    krilla_mask = krilla_mask.with_transfer(transfer.clone());
+                }
+                surface.push_mask(krilla_mask);
+            }
+            if let Some(opacity) = opacity {
+                surface.push_opacity(*opacity);
+            }
+            if let Some(overprint) = overprint {
+                surface.push_overprint(*overprint);
+            }
+            draw(inner, surface);
+            for pushed in [overprint.is_some(), opacity.is_some(), mask.is_some(), blend.is_some()] {
+                if pushed {
+                    surface.pop();
+                }
+            }
+        }
+    }
+}
diff --git a/crates/plate-test/src/report.rs b/crates/plate-test/src/report.rs
new file mode 100644
index 00000000..246400c4
--- /dev/null
+++ b/crates/plate-test/src/report.rs
@@ -0,0 +1,387 @@
+//! Runs the Ghostscript plate check over scenes and writes `report.md` and `results.json`.
+//!
+//! Pending scenes are written as far as the writer can ([`reference::write_partial`]) and are
+//! expected to fail; their results show what the writer prints today.
+//!
+//! [`run_flattened`] also flattens each scene's PDF with a caller's flattener and checks the
+//! flattened page the same way, plus [`structure::transparency`]. The flattener comes from the
+//! caller so that this crate doesn't depend on it.
+
+use std::fmt::Write as _;
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use serde::Serialize;
+
+use crate::judge::{self, Judgement, Verdict};
+use crate::reference::{self, Context};
+use crate::scene::{Level, PROCESS, Scene};
+use crate::{Error, gs, structure};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum Status {
+    Pass,
+    Fail,
+    /// A pending scene fails, as it should until its task lands.
+    ExpectedFail,
+    /// A pending scene passes: the feature works, or the scene doesn't catch its absence.
+    PendingPasses,
+    /// A pending scene needs a feature the writer can't leave out.
+    NotWritten,
+    /// The harness failed (Ghostscript, TIFF, writer error).
+    Error,
+}
+
+impl Status {
+    /// Whether the scene result is what the scene's `pending` field says it should be.
+    pub fn as_expected(self) -> bool {
+        matches!(self, Status::Pass | Status::ExpectedFail | Status::PendingPasses | Status::NotWritten)
+    }
+
+    fn label(self) -> &'static str {
+        match self {
+            Status::Pass => "pass",
+            Status::Fail => "**FAIL**",
+            Status::ExpectedFail => "expected fail",
+            Status::PendingPasses => "pending, passes",
+            Status::NotWritten => "not written",
+            Status::Error => "**ERROR**",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct SceneResult {
+    pub id: String,
+    pub title: String,
+    pub pending: Option<String>,
+    pub status: Status,
+    /// What the writer left out or skipped.
+    pub notes: Vec<String>,
+    /// Why the scene was not written or judged.
+    pub error: Option<String>,
+    pub judgement: Option<Judgement>,
+    /// The flattened page's result, from [`run_flattened`].
+    pub flattened: Option<FlatResult>,
+}
+
+/// One scene's flattened page.
+#[derive(Debug, Clone, Serialize)]
+pub struct FlatResult {
+    /// As for the source page; a pass also needs `transparency` empty.
+    pub status: Status,
+    /// What [`structure::transparency`] found in the flattened page.
+    pub transparency: Vec<String>,
+    /// Time spent in the flattener.
+    pub millis: f64,
+    pub error: Option<String>,
+    pub judgement: Option<Judgement>,
+}
+
+/// Flattens a scene's PDF: the flattened PDF, or why it failed.
+pub type Flatten<'a> = &'a dyn Fn(&[u8]) -> Result<Vec<u8>, String>;
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Report {
+    pub ghostscript: String,
+    pub resolution: f32,
+    pub scenes: Vec<SceneResult>,
+}
+
+impl Report {
+    /// Scenes whose source or flattened result is not what their `pending` field says.
+    pub fn unexpected(&self) -> Vec<String> {
+        let mut out = Vec::new();
+        for r in &self.scenes {
+            if !r.status.as_expected() {
+                out.push(format!("{} {:?}{}", r.id, r.status, r.error.as_deref().map(|e| format!(": {e}")).unwrap_or_default()));
+            }
+            if let Some(f) = r.flattened.as_ref().filter(|f| !f.status.as_expected()) {
+                let why = f.error.clone().or_else(|| (!f.transparency.is_empty()).then(|| f.transparency.join(", ")));
+                out.push(format!("{} flattened {:?}{}", r.id, f.status, why.map(|e| format!(": {e}")).unwrap_or_default()));
+            }
+        }
+        out
+    }
+}
+
+/// Write, separate and judge every scene in `ctx.scenes`.
+pub fn run(ctx: &Context<'_>, ghostscript: String) -> Report {
+    Report { ghostscript, resolution: gs::RESOLUTION, scenes: ctx.scenes.iter().map(|scene| check_scene(scene, ctx)).collect() }
+}
+
+/// [`run`], and each scene's page flattened by `flatten`, separated and judged as well.
+pub fn run_flattened(ctx: &Context<'_>, ghostscript: String, flatten: Flatten<'_>) -> Report {
+    let scenes = ctx.scenes.iter().map(|scene| check_scene_with(scene, ctx, Some(flatten))).collect();
+    Report { ghostscript, resolution: gs::RESOLUTION, scenes }
+}
+
+/// Write, separate and judge one scene.
+pub fn check_scene(scene: &Scene, ctx: &Context<'_>) -> SceneResult {
+    check_scene_with(scene, ctx, None)
+}
+
+fn check_scene_with(scene: &Scene, ctx: &Context<'_>, flatten: Option<Flatten<'_>>) -> SceneResult {
+    let mut result = SceneResult {
+        id: scene.id.clone(),
+        title: scene.title.clone(),
+        pending: scene.pending.clone(),
+        status: Status::Error,
+        notes: Vec::new(),
+        error: None,
+        judgement: None,
+        flattened: None,
+    };
+    let written = if scene.pending.is_some() { reference::write_partial(scene, ctx) } else { reference::write(scene, ctx) };
+    let output = match written {
+        Ok(output) => output,
+        Err(Error::Unsupported(feature)) if scene.pending.is_some() => {
+            result.status = Status::NotWritten;
+            result.error = Some(format!("needs {feature}"));
+            return result;
+        }
+        Err(e) => {
+            result.error = Some(e.to_string());
+            return result;
+        }
+    };
+    result.notes = output.notes;
+    result.flattened = flatten.map(|f| check_flattened(scene, ctx, &output.pdf, f));
+    match separate_and_judge(scene, ctx, &output.pdf, &scene.id) {
+        Ok(judgement) => {
+            result.status = status(scene, judgement.passed());
+            result.judgement = Some(judgement);
+        }
+        Err(e) => result.error = Some(e.to_string()),
+    }
+    result
+}
+
+fn check_flattened(scene: &Scene, ctx: &Context<'_>, pdf: &[u8], flatten: Flatten<'_>) -> FlatResult {
+    let mut result = FlatResult { status: Status::Error, transparency: Vec::new(), millis: 0.0, error: None, judgement: None };
+    let start = Instant::now();
+    let flat = flatten(pdf);
+    result.millis = start.elapsed().as_secs_f64() * 1000.0;
+    let flat = match flat {
+        Ok(flat) => flat,
+        Err(e) => {
+            result.error = Some(format!("flatten: {e}"));
+            return result;
+        }
+    };
+    match structure::summarize(&flat) {
+        Ok(summary) => result.transparency = structure::transparency(&summary),
+        Err(e) => {
+            result.error = Some(e.to_string());
+            return result;
+        }
+    }
+    match separate_and_judge(scene, ctx, &flat, &format!("{}-flat", scene.id)) {
+        Ok(judgement) => {
+            result.status = status(scene, judgement.passed() && result.transparency.is_empty());
+            result.judgement = Some(judgement);
+        }
+        Err(e) => result.error = Some(e.to_string()),
+    }
+    result
+}
+
+fn separate_and_judge(scene: &Scene, ctx: &Context<'_>, pdf: &[u8], label: &str) -> Result<Judgement, Error> {
+    let plates = gs::separate(pdf, label)?;
+    Ok(judge::judge(scene, &plates, gs::RESOLUTION, ctx.font.is_some()))
+}
+
+fn status(scene: &Scene, passed: bool) -> Status {
+    match (scene.pending.is_some(), passed) {
+        (false, true) => Status::Pass,
+        (false, false) => Status::Fail,
+        (true, false) => Status::ExpectedFail,
+        (true, true) => Status::PendingPasses,
+    }
+}
+
+/// Cargo's target directory: `CARGO_TARGET_DIR` (relative to the workspace root) or `target`.
+pub fn target_dir() -> PathBuf {
+    let manifest = Path::new(env!("CARGO_MANIFEST_DIR"));
+    let root = manifest.parent().and_then(Path::parent).unwrap_or(manifest);
+    match std::env::var_os("CARGO_TARGET_DIR") {
+        Some(dir) => root.join(dir),
+        None => root.join("target"),
+    }
+}
+
+/// Where the report goes: `plate-test/` in the target directory.
+pub fn output_dir() -> PathBuf {
+    target_dir().join("plate-test")
+}
+
+/// Write `report.md` and `results.json` into `dir`; returns the report's path.
+pub fn write(report: &Report, dir: &Path) -> Result<PathBuf, Error> {
+    let io = |path: &Path, e: std::io::Error| Error::Scene(format!("{}: {e}", path.display()));
+    std::fs::create_dir_all(dir).map_err(|e| io(dir, e))?;
+    let json_path = dir.join("results.json");
+    let json = serde_json::to_string_pretty(report).map_err(|e| Error::Scene(e.to_string()))?;
+    std::fs::write(&json_path, json).map_err(|e| io(&json_path, e))?;
+    let md_path = dir.join("report.md");
+    std::fs::write(&md_path, markdown(report)).map_err(|e| io(&md_path, e))?;
+    Ok(md_path)
+}
+
+/// The report as Markdown.
+pub fn markdown(report: &Report) -> String {
+    let flat = report.scenes.iter().any(|s| s.flattened.is_some());
+    let mut md = String::new();
+    let _ = writeln!(
+        md,
+        "# Plate check\n\nGhostscript {}, `tiffsep` at {} dpi with overprint simulated (`/enable`). Ink % per plate \
+         (C M Y K, spots by name); plates under 1% are left out. Pending scenes are written without the features \
+         they wait for and are expected to fail. Generated by `scripts/plate-check.sh`.\n",
+        report.ghostscript, report.resolution
+    );
+    if flat {
+        md.push_str(
+            "Each scene's page is also flattened and separated the same way. \"Transparency left\" lists transparency \
+             groups, graphics-state soft masks, blend modes and `ca`/`CA` below 1 in the flattened page.\n\n",
+        );
+        md.push_str(
+            "| Scene | Status | Pending | Failing points | Plates | Flattened | Failing points | Plates | Transparency left | Flatten ms |\n\
+             |---|---|---|---|---|---|---|---|---|---|\n",
+        );
+    } else {
+        md.push_str("| Scene | Status | Pending | Failing points | Plates |\n|---|---|---|---|---|\n");
+    }
+    for scene in &report.scenes {
+        let (points, plates) = summary_cells(scene.judgement.as_ref());
+        let pending = scene.pending.as_deref().unwrap_or("");
+        let _ = write!(
+            md,
+            "| [{id}](#{anchor}) | {} | {pending} | {points} | {plates} |",
+            scene.status.label(),
+            id = scene.id,
+            anchor = scene.id.to_lowercase()
+        );
+        if let Some(f) = &scene.flattened {
+            let (points, plates) = summary_cells(f.judgement.as_ref());
+            let left = if f.transparency.is_empty() { "none".to_owned() } else { f.transparency.join(", ") };
+            let _ = write!(md, " {} | {points} | {plates} | {left} | {:.0} |", f.status.label(), f.millis);
+        } else if flat {
+            md.push_str(" – | – | – | – | – |");
+        }
+        md.push('\n');
+    }
+    for scene in &report.scenes {
+        let _ = writeln!(md, "\n## {}\n\n{}. Status: {}.", scene.id, scene.title, scene.status.label());
+        if let Some(task) = &scene.pending {
+            let _ = writeln!(md, "Pending {task}.");
+        }
+        if let Some(error) = &scene.error {
+            let _ = writeln!(md, "\n{error}");
+        }
+        for note in &scene.notes {
+            let _ = writeln!(md, "- {note}");
+        }
+        let flat_judgement = scene.flattened.as_ref().and_then(|f| f.judgement.as_ref());
+        if let Some(f) = &scene.flattened {
+            let _ = writeln!(md, "\nFlattened: {}, {:.0} ms.", f.status.label(), f.millis);
+            if let Some(error) = &f.error {
+                let _ = writeln!(md, "\n{error}");
+            }
+            if !f.transparency.is_empty() {
+                let _ = writeln!(md, "Transparency left: {}.", f.transparency.join(", "));
+            }
+            if let Some(j) = flat_judgement {
+                let _ = writeln!(md, "Flattened plates: {}.{}", j.plates.join(", "), plate_problems(j).map(|p| format!(" {p}.")).unwrap_or_default());
+            }
+        }
+        let Some(judgement) = &scene.judgement else { continue };
+        let _ = writeln!(md, "\nPlates: {}.{}", judgement.plates.join(", "), plate_problems(judgement).map(|p| format!(" {p}.")).unwrap_or_default());
+        if scene.flattened.is_some() {
+            md.push_str("\n| # | Point | Expected | Measured | Verdict | Flattened | Verdict |\n|---|---|---|---|---|---|---|\n");
+        } else {
+            md.push_str("\n| # | Point | Expected | Measured | Verdict |\n|---|---|---|---|---|\n");
+        }
+        for (i, point) in judgement.points.iter().enumerate() {
+            let how = point.how.as_deref().map(|h| format!("; {h}")).unwrap_or_default();
+            let note = point.note.as_deref().map(|n| format!("{n} ")).unwrap_or_default();
+            let _ = write!(
+                md,
+                "| {} | {note}({}, {}){how} | {} ±{} | {} | {} |",
+                i + 1,
+                point.at[0],
+                point.at[1],
+                expected(&point.expected),
+                point.tol,
+                measured(&point.measured),
+                verdict(point),
+            );
+            if scene.flattened.is_some() {
+                match flat_judgement.and_then(|j| j.points.get(i)) {
+                    Some(p) => {
+                        let _ = write!(md, " {} | {} |", measured(&p.measured), verdict(p));
+                    }
+                    None => md.push_str(" – | – |"),
+                }
+            }
+            md.push('\n');
+        }
+    }
+    md
+}
+
+fn summary_cells(judgement: Option<&Judgement>) -> (String, String) {
+    match judgement {
+        Some(j) => (format!("{}/{}", j.failed_points(), j.judged_points()), plate_problems(j).unwrap_or_else(|| "ok".into())),
+        None => ("–".into(), "–".into()),
+    }
+}
+
+fn verdict(point: &judge::PointResult) -> String {
+    match point.verdict {
+        Verdict::Pass => "pass".to_owned(),
+        Verdict::Info => "info".to_owned(),
+        Verdict::Skipped => "skipped".to_owned(),
+        Verdict::Fail if point.off.is_empty() => "**fail**".to_owned(),
+        Verdict::Fail => format!("**fail** ({})", point.off.iter().map(|p| short(p)).collect::<Vec<_>>().join(" ")),
+    }
+}
+
+fn plate_problems(judgement: &Judgement) -> Option<String> {
+    let mut parts = Vec::new();
+    if !judgement.missing_plates.is_empty() {
+        parts.push(format!("missing {}", judgement.missing_plates.join(", ")));
+    }
+    if !judgement.extra_plates.is_empty() {
+        parts.push(format!("extra {}", judgement.extra_plates.join(", ")));
+    }
+    (!parts.is_empty()).then(|| parts.join("; "))
+}
+
+/// Process plates as `C M Y K`; spots keep their names.
+fn short(plate: &str) -> &str {
+    match PROCESS.iter().position(|p| *p == plate) {
+        Some(i) => ["C", "M", "Y", "K"].get(i).copied().unwrap_or(plate),
+        None => plate,
+    }
+}
+
+fn expected(inks: &std::collections::BTreeMap<String, Level>) -> String {
+    let mut names: Vec<String> = inks.keys().cloned().collect();
+    judge::sort_plates(&mut names);
+    let parts: Vec<String> = names
+        .iter()
+        .filter_map(|name| match inks.get(name)? {
+            Level::Value(v) if *v >= 1.0 => Some(format!("{}{v}", short(name))),
+            Level::Value(_) => None,
+            Level::Range([lo, hi]) => Some(format!("{}{lo}–{hi}", short(name))),
+        })
+        .collect();
+    if parts.is_empty() { "paper".into() } else { parts.join(" ") }
+}
+
+fn measured(inks: &std::collections::BTreeMap<String, f32>) -> String {
+    let mut names: Vec<String> = inks.iter().filter(|(_, v)| **v >= 1.0).map(|(k, _)| k.clone()).collect();
+    judge::sort_plates(&mut names);
+    let parts: Vec<String> = names.iter().filter_map(|name| Some(format!("{}{:.0}", short(name), inks.get(name)?))).collect();
+    if parts.is_empty() { "paper".into() } else { parts.join(" ") }
+}
diff --git a/crates/plate-test/src/scene.rs b/crates/plate-test/src/scene.rs
new file mode 100644
index 00000000..422db7dd
--- /dev/null
+++ b/crates/plate-test/src/scene.rs
@@ -0,0 +1,580 @@
+//! The scene format: an app-neutral description of one test page, what each plate should
+//! carry at sample points, and what the PDF's structure should look like.
+//!
+//! Coordinates are points from the page's top-left corner. Ink values are percentages
+//! (0 = no ink, 100 = solid). Rectangles are `[x, y, width, height]`.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+
+use crate::Error;
+use crate::structure::StructureExpect;
+
+/// How deep placed scenes may nest.
+pub const MAX_NESTING: usize = 4;
+
+/// The plate text points find their glyphs on unless they name another.
+pub const TEXT_PLATE: &str = "Black";
+
+/// The process plates, named as separation tools (Ghostscript `tiffsep`) name them.
+pub const PROCESS: [&str; 4] = ["Cyan", "Magenta", "Yellow", "Black"];
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Scene {
+    /// Short id, also the file name stem's prefix (`S01`, `D04`).
+    pub id: String,
+    pub title: String,
+    /// Where the scene comes from (research case or app regression).
+    pub source: String,
+    /// Page size `[width, height]` in pt.
+    pub page: [f32; 2],
+    /// Spot inks the scene may use. Their order is the colorant order after the process inks.
+    #[serde(default)]
+    pub inks: Vec<Ink>,
+    #[serde(default)]
+    pub settings: Settings,
+    pub objects: Vec<Object>,
+    pub expect: Expect,
+    #[serde(default)]
+    pub structure: StructureExpect,
+    /// The task that makes this scene writable, e.g. `"T4"`. Pending scenes are parsed but not
+    /// written or checked.
+    #[serde(default)]
+    pub pending: Option<String>,
+    #[serde(default)]
+    pub note: Option<String>,
+}
+
+/// A spot ink with its alternate (exactly one of `cmyk` or `lab`).
+#[derive(Debug, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Ink {
+    pub name: String,
+    #[serde(default)]
+    pub cmyk: Option<[f32; 4]>,
+    #[serde(default)]
+    pub lab: Option<[f32; 3]>,
+}
+
+/// Output intents a scene can name: `fogra39` is craft-cms's `COATED_FOGRA39_ICC`.
+pub const OUTPUT_INTENTS: &[&str] = &["fogra39"];
+
+#[derive(Debug, Clone, Default, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Settings {
+    /// Blending color space of transparency groups; absent means the writer's default.
+    #[serde(default)]
+    pub group_cs: Option<GroupCs>,
+    /// Name of the print output intent, one of [`OUTPUT_INTENTS`]; the scene is then written
+    /// with craft-pdf's print settings. Absent means the writer's defaults.
+    #[serde(default)]
+    pub output_intent: Option<String>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum GroupCs {
+    Rgb,
+    Cmyk,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Kind {
+    Rect,
+    Ellipse,
+    Text,
+    Image,
+    /// Another scene, written and placed as a PDF page.
+    Pdf,
+    Group,
+}
+
+/// One drawable object. Which geometry fields apply depends on `type`; [`Scene::validate`]
+/// reports missing or stray ones.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Object {
+    #[serde(rename = "type")]
+    pub kind: Kind,
+    /// rect, ellipse (bounding box), image, pdf.
+    #[serde(default)]
+    pub rect: Option<[f32; 4]>,
+    /// text: baseline start.
+    #[serde(default)]
+    pub at: Option<[f32; 2]>,
+    /// text: font size in pt.
+    #[serde(default)]
+    pub size: Option<f32>,
+    #[serde(default)]
+    pub text: Option<String>,
+    #[serde(default)]
+    pub image: Option<ImageSource>,
+    /// pdf: id of the scene to place.
+    #[serde(default)]
+    pub scene: Option<String>,
+    /// group: children, drawn in order.
+    #[serde(default)]
+    pub objects: Vec<Object>,
+    #[serde(default)]
+    pub isolated: bool,
+    #[serde(default)]
+    pub knockout: bool,
+    #[serde(default)]
+    pub fill: Option<Paint>,
+    #[serde(default)]
+    pub stroke: Option<Stroke>,
+    /// Whole-object opacity, 0–1 (a transparency group).
+    #[serde(default)]
+    pub opacity: Option<f32>,
+    #[serde(default)]
+    pub blend: Option<Blend>,
+    #[serde(default)]
+    pub overprint: Option<Overprint>,
+    #[serde(default)]
+    pub mask: Option<Mask>,
+    #[serde(default)]
+    pub note: Option<String>,
+}
+
+/// A paint. Ink values are percentages.
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(untagged, deny_unknown_fields)]
+pub enum Paint {
+    /// `"registration"`: the Separation `/All` colorant (every plate).
+    Named(Named),
+    Cmyk {
+        cmyk: [f32; 4],
+    },
+    /// Black ink percentage, written as DeviceGray `1 - gray / 100`.
+    Gray {
+        gray: f32,
+    },
+    /// 0–255 per channel.
+    Rgb {
+        rgb: [f32; 3],
+    },
+    Spot {
+        spot: String,
+        #[serde(default = "full")]
+        tint: f32,
+    },
+    /// Several named inks at once (DeviceN); names are process plates or declared spots.
+    Inks {
+        inks: BTreeMap<String, f32>,
+    },
+    Linear {
+        linear: Gradient,
+    },
+    Mesh {
+        mesh: Box<Mesh>,
+    },
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Named {
+    Registration,
+}
+
+fn full() -> f32 {
+    100.0
+}
+
+/// A linear gradient in page coordinates.
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Gradient {
+    pub from: [f32; 2],
+    pub to: [f32; 2],
+    pub stops: Vec<GradientStop>,
+}
+
+/// A mesh gradient of one Coons patch with straight edges over `rect` (page coordinates).
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Mesh {
+    pub rect: [f32; 4],
+    /// Solid paints at the top-left, top-right, bottom-right and bottom-left corners.
+    pub corners: [Paint; 4],
+}
+
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct GradientStop {
+    /// 0–1 along the gradient.
+    pub at: f32,
+    pub paint: Paint,
+}
+
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Stroke {
+    pub paint: Paint,
+    pub width: f32,
+}
+
+/// A synthetic image filling the object's `rect` (exactly one of `ramp`, `split`, `feather`).
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ImageSource {
+    /// Pixel size `[width, height]`.
+    pub px: [u32; 2],
+    /// Horizontal ramp from the first paint (left) to the second (right).
+    #[serde(default)]
+    pub ramp: Option<[Paint; 2]>,
+    /// Left half the first paint, right half the second.
+    #[serde(default)]
+    pub split: Option<[Paint; 2]>,
+    /// Gray image for soft masks: white inside, fading to black over this many pt at the edges.
+    #[serde(default)]
+    pub feather: Option<f32>,
+    /// An alpha channel, written as the image's `/SMask` (a PNG with transparency).
+    #[serde(default)]
+    pub alpha: Option<ImageAlpha>,
+}
+
+/// Image alpha: `opacity` (0–1) for pixels whose centers lie inside `rect` (page pt), 0 for the rest.
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ImageAlpha {
+    pub rect: [f32; 4],
+    pub opacity: f32,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum Blend {
+    Normal,
+    Multiply,
+    Screen,
+    Overlay,
+    Darken,
+    Lighten,
+    ColorDodge,
+    ColorBurn,
+    HardLight,
+    SoftLight,
+    Difference,
+    Exclusion,
+    Hue,
+    Saturation,
+    Color,
+    Luminosity,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Overprint {
+    #[serde(default)]
+    pub fill: bool,
+    #[serde(default)]
+    pub stroke: bool,
+    /// OPM: 1 = zero components leave the backdrop (nonzero overprint), 0 = all components paint.
+    #[serde(default = "opm_default")]
+    pub mode: u8,
+}
+
+fn opm_default() -> u8 {
+    1
+}
+
+/// A soft mask over the object.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Mask {
+    pub kind: MaskKind,
+    pub content: Vec<Object>,
+    /// `/BC`: the color outside the mask content (luminosity masks).
+    #[serde(default)]
+    pub backdrop: Option<Paint>,
+    /// `/TR`: a sampled transfer function, values 0–1 over the input range.
+    #[serde(default)]
+    pub transfer: Option<Vec<f32>>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum MaskKind {
+    Luminosity,
+    Alpha,
+}
+
+/// What a correct separation gives.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Expect {
+    /// Every plate the separation must produce (process plates included), and no others.
+    pub plates: Vec<String>,
+    pub points: Vec<SamplePoint>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SamplePoint {
+    pub at: [f32; 2],
+    #[serde(default)]
+    pub kind: PointKind,
+    /// text: the glyph area to sample, `[x, y, w, h]`.
+    #[serde(default)]
+    pub region: Option<[f32; 4]>,
+    /// text: the plate the glyphs are found on; defaults to [`TEXT_PLATE`].
+    #[serde(default)]
+    pub plate: Option<String>,
+    /// Expected ink per plate; plates not listed expect 0.
+    #[serde(default)]
+    pub inks: BTreeMap<String, Level>,
+    /// Allowed difference in ink percentage points.
+    pub tol: f32,
+    /// Measured and reported, not judged.
+    #[serde(default)]
+    pub info: bool,
+    #[serde(default)]
+    pub note: Option<String>,
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum PointKind {
+    #[default]
+    Area,
+    Text,
+}
+
+/// An expected ink value or an inclusive `[lo, hi]` range.
+#[derive(Debug, Clone, Copy, PartialEq, Deserialize, Serialize)]
+#[serde(untagged)]
+pub enum Level {
+    Value(f32),
+    Range([f32; 2]),
+}
+
+/// The directory holding this crate's scenes.
+pub fn scenes_dir() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("scenes")
+}
+
+/// Parse every `*.json` scene in `dir`, sorted by file name.
+pub fn load_dir(dir: &Path) -> Result<Vec<Scene>, Error> {
+    let mut paths = Vec::new();
+    for entry in std::fs::read_dir(dir).map_err(|e| Error::Scene(format!("{}: {e}", dir.display())))? {
+        let path = entry.map_err(|e| Error::Scene(e.to_string()))?.path();
+        if path.extension().is_some_and(|ext| ext == "json") {
+            paths.push(path);
+        }
+    }
+    paths.sort();
+    paths.iter().map(|path| load(path)).collect()
+}
+
+/// Parse one scene file.
+pub fn load(path: &Path) -> Result<Scene, Error> {
+    let text = std::fs::read_to_string(path).map_err(|e| Error::Scene(format!("{}: {e}", path.display())))?;
+    serde_json::from_str(&text).map_err(|e| Error::Scene(format!("{}: {e}", path.display())))
+}
+
+impl Scene {
+    pub fn ink(&self, name: &str) -> Option<&Ink> {
+        self.inks.iter().find(|ink| ink.name == name)
+    }
+
+    /// Consistency problems a JSON schema can't catch; empty when the scene is well formed.
+    /// `all` resolves placed scenes.
+    pub fn validate(&self, all: &[Scene]) -> Vec<String> {
+        let mut problems = Vec::new();
+        let mut say = |message: String| problems.push(format!("{}: {message}", self.id));
+        if !(self.page[0] > 0.0 && self.page[1] > 0.0) {
+            say("page size must be positive".into());
+        }
+        if let Some(name) = &self.settings.output_intent
+            && !OUTPUT_INTENTS.contains(&name.as_str())
+        {
+            say(format!("unknown output intent {name}"));
+        }
+        for ink in &self.inks {
+            if ink.cmyk.is_some() == ink.lab.is_some() {
+                say(format!("ink {} needs exactly one of cmyk or lab", ink.name));
+            }
+            if PROCESS.contains(&ink.name.as_str()) || ink.name == "All" || ink.name == "None" {
+                say(format!("ink {} shadows a process or reserved colorant", ink.name));
+            }
+        }
+        let mut objects = Vec::new();
+        collect(&self.objects, &mut objects);
+        for object in objects {
+            for problem in self.object_problems(object, all) {
+                say(problem);
+            }
+        }
+        for plate in &self.expect.plates {
+            if !PROCESS.contains(&plate.as_str()) && !self.declares_spot(plate, all, 0) {
+                say(format!("plate {plate} is neither process nor a declared spot"));
+            }
+        }
+        for name in PROCESS {
+            if !self.expect.plates.iter().any(|plate| plate == name) {
+                say(format!("plates must list the process plate {name}"));
+            }
+        }
+        for point in &self.expect.points {
+            if point.tol <= 0.0 {
+                say(format!("point {:?}: tol must be positive", point.at));
+            }
+            if (point.kind == PointKind::Text) != point.region.is_some() {
+                say(format!("point {:?}: text points need a region, area points none", point.at));
+            }
+            if let Some(plate) = &point.plate
+                && (point.kind != PointKind::Text || !self.expect.plates.contains(plate))
+            {
+                say(format!("point {:?}: plate {plate} must be a text point's plate from plates", point.at));
+            }
+            for name in point.inks.keys() {
+                if !self.expect.plates.contains(name) {
+                    say(format!("point {:?}: ink {name} is not in plates", point.at));
+                }
+            }
+        }
+        problems
+    }
+
+    /// Declared here or in a placed scene (placements nest at most [`MAX_NESTING`] deep).
+    fn declares_spot(&self, name: &str, all: &[Scene], depth: usize) -> bool {
+        self.ink(name).is_some()
+            || (depth < MAX_NESTING
+                && placed(&self.objects).iter().any(|id| all.iter().any(|s| s.id == **id && s.declares_spot(name, all, depth + 1))))
+    }
+
+    fn object_problems(&self, object: &Object, all: &[Scene]) -> Vec<String> {
+        let mut out = Vec::new();
+        let kind = object.kind;
+        let needs_rect = matches!(kind, Kind::Rect | Kind::Ellipse | Kind::Image | Kind::Pdf);
+        if needs_rect != object.rect.is_some() {
+            out.push(format!("{kind:?}: rect is {}", if needs_rect { "required" } else { "not used" }));
+        }
+        if let Some([_, _, w, h]) = object.rect
+            && !(w > 0.0 && h > 0.0)
+        {
+            out.push(format!("{kind:?}: rect needs a positive size"));
+        }
+        let is_text = kind == Kind::Text;
+        if is_text != (object.at.is_some() && object.size.is_some() && object.text.is_some()) {
+            out.push(format!("{kind:?}: at, size and text belong to (and are required by) text"));
+        }
+        if (kind == Kind::Image) != object.image.is_some() {
+            out.push(format!("{kind:?}: image belongs to (and is required by) image objects"));
+        }
+        if let Some(image) = &object.image {
+            let sources = [image.ramp.is_some(), image.split.is_some(), image.feather.is_some()];
+            if sources.iter().filter(|s| **s).count() != 1 {
+                out.push("image needs exactly one of ramp, split or feather".into());
+            }
+            if image.px[0] == 0 || image.px[1] == 0 || image.px[0] > 4096 || image.px[1] > 4096 {
+                out.push("image px must be 1–4096".into());
+            }
+            if image.alpha.as_ref().is_some_and(|a| image.feather.is_some() || !(0.0..=1.0).contains(&a.opacity)) {
+                out.push("image alpha needs a color image and an opacity of 0–1".into());
+            }
+        }
+        if (kind == Kind::Pdf) != object.scene.is_some() {
+            out.push(format!("{kind:?}: scene belongs to (and is required by) pdf objects"));
+        }
+        if let Some(id) = &object.scene
+            && (id == &self.id || !all.iter().any(|s| &s.id == id))
+        {
+            out.push(format!("pdf: unknown scene {id}"));
+        }
+        if kind != Kind::Group && (!object.objects.is_empty() || object.isolated || object.knockout) {
+            out.push(format!("{kind:?}: objects, isolated and knockout belong to groups"));
+        }
+        if matches!(kind, Kind::Image | Kind::Pdf | Kind::Group) && (object.fill.is_some() || object.stroke.is_some()) {
+            out.push(format!("{kind:?}: fill and stroke apply to shapes and text"));
+        }
+        if let Some(opacity) = object.opacity
+            && !(0.0..=1.0).contains(&opacity)
+        {
+            out.push("opacity must be 0–1".into());
+        }
+        let mut paints: Vec<&Paint> = object.fill.iter().chain(object.stroke.iter().map(|s| &s.paint)).collect();
+        if let Some(image) = &object.image {
+            paints.extend(image.ramp.iter().flatten());
+            paints.extend(image.split.iter().flatten());
+        }
+        if let Some(mask) = &object.mask {
+            paints.extend(mask.backdrop.iter());
+            let mut nested = Vec::new();
+            collect(&mask.content, &mut nested);
+            for inner in nested {
+                out.extend(self.object_problems(inner, all));
+            }
+        }
+        for paint in paints {
+            self.paint_problems(paint, &mut out);
+        }
+        out
+    }
+
+    fn paint_problems(&self, paint: &Paint, out: &mut Vec<String>) {
+        let percent = |v: &f32| (0.0..=100.0).contains(v);
+        match paint {
+            Paint::Named(_) => {}
+            Paint::Cmyk { cmyk } if !cmyk.iter().all(percent) => out.push("cmyk values must be 0–100".into()),
+            Paint::Gray { gray } if !percent(gray) => out.push("gray must be 0–100".into()),
+            Paint::Rgb { rgb } if !rgb.iter().all(|v| (0.0..=255.0).contains(v)) => out.push("rgb values must be 0–255".into()),
+            Paint::Spot { spot, tint } => {
+                if self.ink(spot).is_none() {
+                    out.push(format!("spot {spot} is not declared in inks"));
+                }
+                if !percent(tint) {
+                    out.push("tint must be 0–100".into());
+                }
+            }
+            Paint::Inks { inks } => {
+                for (name, value) in inks {
+                    if !PROCESS.contains(&name.as_str()) && self.ink(name).is_none() {
+                        out.push(format!("ink {name} is not process or declared"));
+                    }
+                    if !percent(value) {
+                        out.push("ink values must be 0–100".into());
+                    }
+                }
+            }
+            Paint::Linear { linear } => {
+                if linear.stops.len() < 2 {
+                    out.push("gradients need at least two stops".into());
+                }
+                for stop in &linear.stops {
+                    if matches!(stop.paint, Paint::Linear { .. } | Paint::Mesh { .. }) {
+                        out.push("gradient stops must be solid paints".into());
+                    }
+                    self.paint_problems(&stop.paint, out);
+                }
+            }
+            Paint::Mesh { mesh } => {
+                for corner in &mesh.corners {
+                    if matches!(corner, Paint::Linear { .. } | Paint::Mesh { .. }) {
+                        out.push("mesh corners must be solid paints".into());
+                    }
+                    self.paint_problems(corner, out);
+                }
+            }
+            _ => {}
+        }
+    }
+}
+
+/// Every object in the tree, depth first (mask contents excluded).
+fn collect<'a>(objects: &'a [Object], out: &mut Vec<&'a Object>) {
+    for object in objects {
+        out.push(object);
+        collect(&object.objects, out);
+    }
+}
+
+fn placed(objects: &[Object]) -> Vec<&String> {
+    let mut all = Vec::new();
+    collect(objects, &mut all);
+    all.into_iter().filter_map(|o| o.scene.as_ref()).collect()
+}
diff --git a/crates/plate-test/src/structure.rs b/crates/plate-test/src/structure.rs
new file mode 100644
index 00000000..c51ebf0b
--- /dev/null
+++ b/crates/plate-test/src/structure.rs
@@ -0,0 +1,478 @@
+//! A summary of a PDF's print-relevant structure, and the scene `structure` block it is checked
+//! against.
+//!
+//! Color spaces are described as families: `DeviceCMYK`, `ICCBased(N=4)`,
+//! `Separation(Gold, alt DeviceCMYK)`, `DeviceN(Cyan,Black, alt DeviceCMYK)`, `Indexed(…)`,
+//! `Pattern`. Transparency group color spaces are reported per group, not in `color_spaces`.
+
+use std::collections::{BTreeSet, HashSet};
+use std::sync::Arc;
+
+use hayro_syntax::Pdf;
+use hayro_syntax::content::UntypedIter;
+use hayro_syntax::object::{Array, Dict, Name, Object, ObjectIdentifier, Stream};
+use serde::{Deserialize, Serialize};
+
+use crate::Error;
+
+/// What [`summarize`] found.
+#[derive(Debug, Clone, Default, PartialEq, Serialize)]
+pub struct Summary {
+    /// Every transparency group: pages first, then form XObjects and soft-mask groups.
+    pub groups: Vec<Group>,
+    pub ext_g_states: Vec<ExtGState>,
+    /// Color space families used for painting: resources, images, shadings and the device
+    /// spaces set directly by content operators (`rg`, `k`, `g`, `cs /DeviceRGB`).
+    pub color_spaces: BTreeSet<String>,
+    /// Any painting color space mentions DeviceRGB, including Separation/DeviceN alternates.
+    pub device_rgb: bool,
+    /// `/S` of each output intent, in order.
+    pub output_intents: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub struct Group {
+    /// `page 1`, `form` or `soft mask`.
+    pub at: String,
+    pub s: String,
+    pub cs: Option<String>,
+    pub i: bool,
+    pub k: bool,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Serialize)]
+pub struct ExtGState {
+    /// `/OP` (stroke overprint, and fill overprint when `/op` is absent).
+    #[serde(rename = "OP", skip_serializing_if = "Option::is_none")]
+    pub op_stroke: Option<bool>,
+    /// `/op` (fill overprint).
+    #[serde(rename = "op", skip_serializing_if = "Option::is_none")]
+    pub op_fill: Option<bool>,
+    #[serde(rename = "OPM", skip_serializing_if = "Option::is_none")]
+    pub opm: Option<i32>,
+    #[serde(rename = "BM", skip_serializing_if = "Option::is_none")]
+    pub bm: Option<String>,
+    /// `/ca` (fill and text alpha).
+    #[serde(rename = "ca", skip_serializing_if = "Option::is_none")]
+    pub alpha_fill: Option<f32>,
+    /// `/CA` (stroke alpha).
+    #[serde(rename = "CA", skip_serializing_if = "Option::is_none")]
+    pub alpha_stroke: Option<f32>,
+    /// The soft mask's `/S`, when the state sets a mask.
+    #[serde(rename = "SMask", skip_serializing_if = "Option::is_none")]
+    pub smask: Option<String>,
+    /// The soft mask has `/BC`.
+    #[serde(rename = "BC", skip_serializing_if = "std::ops::Not::not")]
+    pub smask_bc: bool,
+    /// The soft mask has a `/TR` other than `/Identity`.
+    #[serde(rename = "TR", skip_serializing_if = "std::ops::Not::not")]
+    pub smask_tr: bool,
+}
+
+/// Summarize `pdf`. Malformed objects are skipped rather than reported.
+pub fn summarize(pdf: &[u8]) -> Result<Summary, Error> {
+    let pdf = Pdf::new(Arc::new(pdf.to_vec())).map_err(|e| Error::Read(format!("{e:?}")))?;
+    let mut walk = Walk::default();
+    if let Some(catalog) = pdf.xref().get::<Dict<'_>>(pdf.xref().root_id())
+        && let Some(intents) = catalog.get::<Array<'_>>(b"OutputIntents".as_slice())
+    {
+        for intent in intents.iter::<Dict<'_>>() {
+            walk.summary.output_intents.push(intent.get::<Name<'_>>(b"S".as_slice()).map(|n| n.as_str().to_owned()).unwrap_or_default());
+        }
+    }
+    for (index, page) in pdf.pages().iter().enumerate() {
+        let raw = page.raw();
+        if let Some(group) = raw.get::<Dict<'_>>(b"Group".as_slice()) {
+            walk.group(&format!("page {}", index + 1), &group);
+        }
+        let mut ops = page.operations();
+        walk.operators(&mut ops);
+        let res = page.resources();
+        walk.resources(&Resources {
+            ext_g_states: res.ext_g_states.clone(),
+            color_spaces: res.color_spaces.clone(),
+            x_objects: res.x_objects.clone(),
+            patterns: res.patterns.clone(),
+            shadings: res.shadings.clone(),
+        });
+    }
+    let mut summary = walk.summary;
+    summary.device_rgb = summary.color_spaces.iter().any(|cs| cs.contains("DeviceRGB"));
+    Ok(summary)
+}
+
+struct Resources<'a> {
+    ext_g_states: Dict<'a>,
+    color_spaces: Dict<'a>,
+    x_objects: Dict<'a>,
+    patterns: Dict<'a>,
+    shadings: Dict<'a>,
+}
+
+impl<'a> Resources<'a> {
+    fn of(dict: &Dict<'a>) -> Self {
+        let sub = |key: &[u8]| dict.get::<Dict<'a>>(key).unwrap_or_default();
+        Self {
+            ext_g_states: sub(b"ExtGState"),
+            color_spaces: sub(b"ColorSpace"),
+            x_objects: sub(b"XObject"),
+            patterns: sub(b"Pattern"),
+            shadings: sub(b"Shading"),
+        }
+    }
+}
+
+#[derive(Default)]
+struct Walk {
+    summary: Summary,
+    seen: HashSet<ObjectIdentifier>,
+}
+
+impl Walk {
+    /// True the first time an indirect object is visited.
+    fn first_visit(&mut self, id: Option<ObjectIdentifier>) -> bool {
+        id.is_none_or(|id| self.seen.insert(id))
+    }
+
+    fn group(&mut self, at: &str, group: &Dict<'_>) {
+        self.summary.groups.push(Group {
+            at: at.to_owned(),
+            s: group.get::<Name<'_>>(b"S".as_slice()).map(|n| n.as_str().to_owned()).unwrap_or_default(),
+            cs: group.get::<Object<'_>>(b"CS".as_slice()).map(|cs| describe(&cs, 0)),
+            i: group.get::<bool>(b"I".as_slice()).unwrap_or(false),
+            k: group.get::<bool>(b"K".as_slice()).unwrap_or(false),
+        });
+    }
+
+    fn operators(&mut self, ops: &mut UntypedIter<'_>) {
+        while let Some(op) = ops.next() {
+            let family = match &**op.operator {
+                b"rg" | b"RG" => Some("DeviceRGB".to_owned()),
+                b"k" | b"K" => Some("DeviceCMYK".to_owned()),
+                b"g" | b"G" => Some("DeviceGray".to_owned()),
+                b"cs" | b"CS" => op
+                    .operands()
+                    .next()
+                    .and_then(|o| o.clone().into_name())
+                    .map(|n| n.as_str().to_owned())
+                    .filter(|n| matches!(n.as_str(), "DeviceRGB" | "DeviceCMYK" | "DeviceGray")),
+                _ => None,
+            };
+            if let Some(family) = family {
+                self.summary.color_spaces.insert(family);
+            }
+        }
+    }
+
+    fn resources(&mut self, res: &Resources<'_>) {
+        for key in res.color_spaces.keys() {
+            if let Some(cs) = res.color_spaces.get::<Object<'_>>(key.as_ref()) {
+                self.summary.color_spaces.insert(describe(&cs, 0));
+            }
+        }
+        for key in res.ext_g_states.keys() {
+            if let Some(gs) = res.ext_g_states.get::<Dict<'_>>(key.as_ref())
+                && self.first_visit(gs.obj_id())
+            {
+                self.ext_g_state(&gs);
+            }
+        }
+        for key in res.shadings.keys() {
+            if let Some(shading) = res.shadings.get::<Object<'_>>(key.as_ref()) {
+                self.shading(&shading);
+            }
+        }
+        for key in res.patterns.keys() {
+            let Some(pattern) = res.patterns.get::<Object<'_>>(key.as_ref()) else { continue };
+            let (dict, stream) = match pattern {
+                Object::Dict(dict) => (dict, None),
+                Object::Stream(stream) => (stream.dict().clone(), Some(stream)),
+                _ => continue,
+            };
+            if let Some(shading) = dict.get::<Object<'_>>(b"Shading".as_slice()) {
+                self.summary.color_spaces.insert("Pattern".to_owned());
+                self.shading(&shading);
+            }
+            if let Some(stream) = stream
+                && self.first_visit(Some(stream.obj_id()))
+            {
+                self.summary.color_spaces.insert("Pattern".to_owned());
+                self.content(&stream);
+            }
+        }
+        for key in res.x_objects.keys() {
+            if let Some(xobject) = res.x_objects.get::<Stream<'_>>(key.as_ref())
+                && self.first_visit(Some(xobject.obj_id()))
+            {
+                self.x_object(&xobject, "form");
+            }
+        }
+    }
+
+    fn ext_g_state(&mut self, gs: &Dict<'_>) {
+        let mut state = ExtGState {
+            op_stroke: gs.get::<bool>(b"OP".as_slice()),
+            op_fill: gs.get::<bool>(b"op".as_slice()),
+            opm: gs.get::<i32>(b"OPM".as_slice()),
+            alpha_fill: gs.get::<f32>(b"ca".as_slice()),
+            alpha_stroke: gs.get::<f32>(b"CA".as_slice()),
+            bm: gs.get::<Object<'_>>(b"BM".as_slice()).and_then(|bm| match bm {
+                Object::Name(name) => Some(name.as_str().to_owned()),
+                Object::Array(names) => names.iter::<Name<'_>>().next().map(|n| n.as_str().to_owned()),
+                _ => None,
+            }),
+            ..Default::default()
+        };
+        if let Some(mask) = gs.get::<Dict<'_>>(b"SMask".as_slice()) {
+            state.smask = Some(mask.get::<Name<'_>>(b"S".as_slice()).map(|n| n.as_str().to_owned()).unwrap_or_default());
+            state.smask_bc = mask.contains_key(b"BC".as_slice());
+            state.smask_tr = mask.get::<Object<'_>>(b"TR".as_slice()).is_some_and(|tr| !matches!(&tr, Object::Name(n) if n.as_str() == "Identity"));
+            if let Some(source) = mask.get::<Stream<'_>>(b"G".as_slice())
+                && self.first_visit(Some(source.obj_id()))
+            {
+                self.x_object(&source, "soft mask");
+            }
+        }
+        self.summary.ext_g_states.push(state);
+    }
+
+    fn shading(&mut self, shading: &Object<'_>) {
+        let dict = match shading {
+            Object::Dict(dict) => dict.clone(),
+            Object::Stream(stream) => stream.dict().clone(),
+            _ => return,
+        };
+        if let Some(cs) = dict.get::<Object<'_>>(b"ColorSpace".as_slice()) {
+            self.summary.color_spaces.insert(describe(&cs, 0));
+        }
+    }
+
+    fn x_object(&mut self, xobject: &Stream<'_>, at: &str) {
+        let dict = xobject.dict();
+        match dict.get::<Name<'_>>(b"Subtype".as_slice()).as_ref().map(Name::as_str) {
+            Some("Image") => {
+                if !dict.get::<bool>(b"ImageMask".as_slice()).unwrap_or(false)
+                    && let Some(cs) = dict.get::<Object<'_>>(b"ColorSpace".as_slice())
+                {
+                    self.summary.color_spaces.insert(describe(&cs, 0));
+                }
+            }
+            Some("Form") => {
+                if let Some(group) = dict.get::<Dict<'_>>(b"Group".as_slice()) {
+                    self.group(at, &group);
+                }
+                self.content(xobject);
+            }
+            _ => {}
+        }
+    }
+
+    fn content(&mut self, stream: &Stream<'_>) {
+        if let Ok(data) = stream.decoded() {
+            self.operators(&mut UntypedIter::new(&data));
+        }
+        if let Some(res) = stream.dict().get::<Dict<'_>>(b"Resources".as_slice()) {
+            self.resources(&Resources::of(&res));
+        }
+    }
+}
+
+/// A color space's family, with the names and alternates that matter for separation.
+fn describe(cs: &Object<'_>, depth: usize) -> String {
+    if depth > 4 {
+        return "?".to_owned();
+    }
+    match cs {
+        Object::Name(name) => name.as_str().to_owned(),
+        Object::Array(array) => {
+            let items: Vec<Object<'_>> = array.iter::<Object<'_>>().collect();
+            let Some(Object::Name(kind)) = items.first() else { return "?".to_owned() };
+            let alt = |i: usize| items.get(i).map(|o| describe(o, depth + 1)).unwrap_or_else(|| "?".to_owned());
+            match kind.as_str() {
+                "Separation" => {
+                    let name = items.get(1).and_then(|o| o.clone().into_name()).map(|n| n.as_str().to_owned()).unwrap_or_default();
+                    format!("Separation({name}, alt {})", alt(2))
+                }
+                "DeviceN" => {
+                    let names: Vec<String> = match items.get(1) {
+                        Some(Object::Array(names)) => names.iter::<Name<'_>>().map(|n| n.as_str().to_owned()).collect(),
+                        _ => Vec::new(),
+                    };
+                    format!("DeviceN({}, alt {})", names.join(","), alt(2))
+                }
+                "ICCBased" => {
+                    let n = match items.get(1) {
+                        Some(Object::Stream(stream)) => stream.dict().get::<i32>(b"N".as_slice()).unwrap_or(0),
+                        _ => 0,
+                    };
+                    format!("ICCBased(N={n})")
+                }
+                "Indexed" => format!("Indexed({})", alt(1)),
+                "Pattern" if items.len() > 1 => format!("Pattern({})", alt(1)),
+                other => other.to_owned(),
+            }
+        }
+        _ => "?".to_owned(),
+    }
+}
+
+/// Live transparency left in a page that should have none, as a flattener's output must: transparency
+/// groups, soft masks in graphics states, blend modes other than Normal, and `ca` or `CA` below 1.
+/// Soft masks of images are not graphics states and are allowed. Empty when there is none.
+pub fn transparency(summary: &Summary) -> Vec<String> {
+    let mut out: Vec<String> = summary.groups.iter().filter(|g| g.s == "Transparency").map(|g| format!("transparency group ({})", g.at)).collect();
+    for gs in &summary.ext_g_states {
+        if let Some(mask) = gs.smask.as_deref().filter(|m| !m.is_empty() && *m != "None") {
+            out.push(format!("soft mask /{mask}"));
+        }
+        if let Some(bm) = gs.bm.as_deref().filter(|b| *b != "Normal" && *b != "Compatible") {
+            out.push(format!("blend mode /{bm}"));
+        }
+        for (key, alpha) in [("ca", gs.alpha_fill), ("CA", gs.alpha_stroke)] {
+            if let Some(a) = alpha.filter(|a| *a < 1.0) {
+                out.push(format!("/{key} {a}"));
+            }
+        }
+    }
+    out.sort();
+    out.dedup();
+    out
+}
+
+/// A scene's `structure` block. Every field is optional; only the fields present are checked.
+#[derive(Debug, Clone, Default, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct StructureExpect {
+    /// The page group's `/CS`: a family, `"none"` (no page group) or `"no-cs"` (group without
+    /// `/CS`). Checked on every page.
+    #[serde(default)]
+    pub page_group: Option<String>,
+    /// The set of `/CS` values of form and soft-mask groups; `"none"` stands for a group
+    /// without `/CS`.
+    #[serde(default)]
+    pub group_cs: Option<BTreeSet<String>>,
+    /// Some group has `/K true`.
+    #[serde(default)]
+    pub knockout: Option<bool>,
+    /// Some group (page groups excluded) has `/I true`.
+    #[serde(default)]
+    pub isolated: Option<bool>,
+    /// Some graphics state sets `/OP` or `/op` true.
+    #[serde(default)]
+    pub overprint: Option<bool>,
+    /// Some graphics state sets a soft mask.
+    #[serde(default)]
+    pub smask: Option<bool>,
+    /// The set of blend modes other than Normal.
+    #[serde(default)]
+    pub blend_modes: Option<BTreeSet<String>>,
+    /// Each entry must match some graphics state on every key it gives.
+    #[serde(default)]
+    pub ext_g_states: Option<Vec<ExtGStateMatch>>,
+    /// The exact set of painting color space families.
+    #[serde(default)]
+    pub color_spaces: Option<BTreeSet<String>>,
+    /// Families that must be among the painting color spaces.
+    #[serde(default)]
+    pub color_spaces_include: Option<BTreeSet<String>>,
+    #[serde(default)]
+    pub device_rgb: Option<bool>,
+    #[serde(default)]
+    pub output_intents: Option<Vec<String>>,
+}
+
+/// A partial graphics state; keys as in the PDF.
+#[derive(Debug, Clone, Default, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ExtGStateMatch {
+    #[serde(rename = "OP", default)]
+    pub op_stroke: Option<bool>,
+    #[serde(rename = "op", default)]
+    pub op_fill: Option<bool>,
+    #[serde(rename = "OPM", default)]
+    pub opm: Option<i32>,
+    #[serde(rename = "BM", default)]
+    pub bm: Option<String>,
+    #[serde(rename = "SMask", default)]
+    pub smask: Option<String>,
+    #[serde(rename = "BC", default)]
+    pub smask_bc: Option<bool>,
+    #[serde(rename = "TR", default)]
+    pub smask_tr: Option<bool>,
+}
+
+impl ExtGStateMatch {
+    fn matches(&self, gs: &ExtGState) -> bool {
+        (self.op_stroke.is_none() || self.op_stroke == gs.op_stroke)
+            && (self.op_fill.is_none() || self.op_fill == gs.op_fill)
+            && (self.opm.is_none() || self.opm == gs.opm)
+            && (self.bm.is_none() || self.bm == gs.bm)
+            && (self.smask.is_none() || self.smask == gs.smask)
+            && self.smask_bc.is_none_or(|bc| bc == gs.smask_bc)
+            && self.smask_tr.is_none_or(|tr| tr == gs.smask_tr)
+    }
+}
+
+impl StructureExpect {
+    /// Differences between the expectation and `summary`; empty when it matches.
+    pub fn check(&self, summary: &Summary) -> Vec<String> {
+        let mut out = Vec::new();
+        let mut differ = |what: &str, want: String, got: String| {
+            if want != got {
+                out.push(format!("{what}: expected {want}, found {got}"));
+            }
+        };
+        let page_groups: Vec<&Group> = summary.groups.iter().filter(|g| g.at.starts_with("page")).collect();
+        let others: Vec<&Group> = summary.groups.iter().filter(|g| !g.at.starts_with("page")).collect();
+        if let Some(want) = &self.page_group {
+            let got = if page_groups.is_empty() {
+                "none".to_owned()
+            } else {
+                let all: BTreeSet<String> = page_groups.iter().map(|g| g.cs.clone().unwrap_or_else(|| "no-cs".to_owned())).collect();
+                all.into_iter().collect::<Vec<_>>().join(" | ")
+            };
+            differ("page_group", want.clone(), got);
+        }
+        if let Some(want) = &self.group_cs {
+            let got: BTreeSet<String> = others.iter().map(|g| g.cs.clone().unwrap_or_else(|| "none".to_owned())).collect();
+            differ("group_cs", format!("{want:?}"), format!("{got:?}"));
+        }
+        if let Some(want) = self.knockout {
+            differ("knockout", want.to_string(), summary.groups.iter().any(|g| g.k).to_string());
+        }
+        if let Some(want) = self.isolated {
+            differ("isolated", want.to_string(), others.iter().any(|g| g.i).to_string());
+        }
+        let states = &summary.ext_g_states;
+        if let Some(want) = self.overprint {
+            let got = states.iter().any(|s| s.op_stroke == Some(true) || s.op_fill == Some(true));
+            differ("overprint", want.to_string(), got.to_string());
+        }
+        if let Some(want) = self.smask {
+            differ("smask", want.to_string(), states.iter().any(|s| s.smask.is_some()).to_string());
+        }
+        if let Some(want) = &self.blend_modes {
+            let got: BTreeSet<String> = states.iter().filter_map(|s| s.bm.clone()).filter(|bm| bm != "Normal" && bm != "Compatible").collect();
+            differ("blend_modes", format!("{want:?}"), format!("{got:?}"));
+        }
+        if let Some(want) = &self.color_spaces {
+            differ("color_spaces", format!("{want:?}"), format!("{:?}", summary.color_spaces));
+        }
+        if let Some(want) = &self.color_spaces_include {
+            let missing: BTreeSet<&String> = want.difference(&summary.color_spaces).collect();
+            differ("color_spaces_include missing", "{}".to_owned(), format!("{missing:?}"));
+        }
+        if let Some(want) = self.device_rgb {
+            differ("device_rgb", want.to_string(), summary.device_rgb.to_string());
+        }
+        if let Some(want) = &self.output_intents {
+            differ("output_intents", format!("{want:?}"), format!("{:?}", summary.output_intents));
+        }
+        for wanted in self.ext_g_states.iter().flatten() {
+            if !states.iter().any(|s| wanted.matches(s)) {
+                out.push(format!("ext_g_states: nothing matches {wanted:?}"));
+            }
+        }
+        out
+    }
+}
diff --git a/crates/plate-test/src/tiff.rs b/crates/plate-test/src/tiff.rs
new file mode 100644
index 00000000..0d673106
--- /dev/null
+++ b/crates/plate-test/src/tiff.rs
@@ -0,0 +1,219 @@
+//! A minimal reader for the plates Ghostscript's `tiffsep` device writes: one uncompressed
+//! 8-bit gray channel in strips, either byte order.
+//!
+//! `tiffsep` writes plates as BlackIsZero, so a sample of 0 is solid ink and 255 is paper.
+
+use crate::Error;
+
+/// One separation plate, as ink levels (0 = paper, 255 = solid ink), row-major.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Plate {
+    width: usize,
+    height: usize,
+    ink: Vec<u8>,
+}
+
+impl Plate {
+    /// A plate from ink levels; `None` when `ink` doesn't hold `width × height` values.
+    pub fn new(width: usize, height: usize, ink: Vec<u8>) -> Option<Self> {
+        (width.checked_mul(height) == Some(ink.len())).then_some(Self { width, height, ink })
+    }
+
+    pub fn width(&self) -> usize {
+        self.width
+    }
+
+    pub fn height(&self) -> usize {
+        self.height
+    }
+
+    /// Ink percentage (0–100) at a pixel; `None` outside the plate.
+    pub fn ink(&self, x: usize, y: usize) -> Option<f32> {
+        if x >= self.width {
+            return None;
+        }
+        self.ink.get(y.checked_mul(self.width)?.checked_add(x)?).map(|level| f32::from(*level) * 100.0 / 255.0)
+    }
+}
+
+const WIDTH: u16 = 256;
+const HEIGHT: u16 = 257;
+const BITS_PER_SAMPLE: u16 = 258;
+const COMPRESSION: u16 = 259;
+const PHOTOMETRIC: u16 = 262;
+const STRIP_OFFSETS: u16 = 273;
+const SAMPLES_PER_PIXEL: u16 = 277;
+const ROWS_PER_STRIP: u16 = 278;
+
+/// Read a plate from TIFF bytes.
+pub fn read(data: &[u8]) -> Result<Plate, Error> {
+    let bad = |what: &str| Error::Tiff(what.to_owned());
+    let big = match data.get(..4) {
+        Some(b"II*\0") => false,
+        Some(b"MM\0*") => true,
+        _ => return Err(bad("not a TIFF file")),
+    };
+    let file = File { data, big };
+    let ifd = file.u32(4).ok_or_else(|| bad("truncated header"))? as usize;
+    let count = file.u16(ifd).ok_or_else(|| bad("truncated directory"))? as usize;
+    let mut entries = Vec::with_capacity(count);
+    for i in 0..count {
+        let at = ifd + 2 + 12 * i;
+        let (Some(tag), Some(kind), Some(n)) = (file.u16(at), file.u16(at + 2), file.u32(at + 4)) else {
+            return Err(bad("truncated directory"));
+        };
+        entries.push(Entry { tag, kind, count: n as usize, value_at: at + 8 });
+    }
+    let get = |tag: u16| -> Result<Option<Vec<usize>>, Error> {
+        entries.iter().find(|e| e.tag == tag).map(|e| file.values(e).ok_or_else(|| bad(&format!("bad value for tag {tag}")))).transpose()
+    };
+    let one = |tag: u16, default: Option<usize>| -> Result<usize, Error> {
+        match get(tag)?.as_deref() {
+            Some([value]) => Ok(*value),
+            Some(_) => Err(bad(&format!("tag {tag} must hold one value"))),
+            None => default.ok_or_else(|| bad(&format!("missing tag {tag}"))),
+        }
+    };
+    let (width, height) = (one(WIDTH, None)?, one(HEIGHT, None)?);
+    if one(BITS_PER_SAMPLE, Some(1))? != 8 || one(SAMPLES_PER_PIXEL, Some(1))? != 1 {
+        return Err(bad("only 8-bit single-channel plates are supported"));
+    }
+    if one(COMPRESSION, Some(1))? != 1 {
+        return Err(bad("only uncompressed plates are supported (-sCompression=none)"));
+    }
+    let white_is_zero = match one(PHOTOMETRIC, None)? {
+        0 => true,
+        1 => false,
+        other => return Err(bad(&format!("photometric interpretation {other} is not gray"))),
+    };
+    let rows_per_strip = one(ROWS_PER_STRIP, Some(height))?.clamp(1, height.max(1));
+    let offsets = get(STRIP_OFFSETS)?.ok_or_else(|| bad("missing strip offsets"))?;
+    let size = width.checked_mul(height).ok_or_else(|| bad("plate too large"))?;
+    let mut ink = Vec::with_capacity(size);
+    for (strip, offset) in offsets.iter().enumerate() {
+        let rows = rows_per_strip.min(height.saturating_sub(strip * rows_per_strip));
+        let bytes = data.get(*offset..offset.saturating_add(rows * width)).ok_or_else(|| bad("strip outside the file"))?;
+        ink.extend(bytes.iter().map(|v| if white_is_zero { *v } else { 255 - v }));
+    }
+    Plate::new(width, height, ink).ok_or_else(|| bad("strips don't cover the plate"))
+}
+
+struct Entry {
+    tag: u16,
+    kind: u16,
+    count: usize,
+    /// Where the value (four bytes or less) or the offset to it sits.
+    value_at: usize,
+}
+
+struct File<'a> {
+    data: &'a [u8],
+    big: bool,
+}
+
+impl File<'_> {
+    fn u16(&self, at: usize) -> Option<u16> {
+        let b: [u8; 2] = self.data.get(at..at + 2)?.try_into().ok()?;
+        Some(if self.big { u16::from_be_bytes(b) } else { u16::from_le_bytes(b) })
+    }
+
+    fn u32(&self, at: usize) -> Option<u32> {
+        let b: [u8; 4] = self.data.get(at..at + 4)?.try_into().ok()?;
+        Some(if self.big { u32::from_be_bytes(b) } else { u32::from_le_bytes(b) })
+    }
+
+    /// SHORT or LONG values, inline when they fit in four bytes.
+    fn values(&self, entry: &Entry) -> Option<Vec<usize>> {
+        let size = match entry.kind {
+            3 => 2,
+            4 => 4,
+            _ => return None,
+        };
+        let start = if entry.count * size <= 4 { entry.value_at } else { self.u32(entry.value_at)? as usize };
+        (0..entry.count)
+            .map(|i| {
+                let at = start.checked_add(i.checked_mul(size)?)?;
+                if size == 2 { self.u16(at).map(usize::from) } else { self.u32(at).map(|v| v as usize) }
+            })
+            .collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+
+    use super::*;
+
+    /// A gray TIFF as `tiffsep` writes it (BlackIsZero samples), in strips of `rows` rows.
+    fn encode(width: u16, height: u16, samples: &[u8], rows: u16, big: bool) -> Vec<u8> {
+        let p16 = |v: u16| if big { v.to_be_bytes() } else { v.to_le_bytes() };
+        let p32 = |v: u32| if big { v.to_be_bytes() } else { v.to_le_bytes() };
+        let strips: Vec<&[u8]> = samples.chunks(usize::from(width) * usize::from(rows)).collect();
+        let mut out = if big { b"MM\0*".to_vec() } else { b"II*\0".to_vec() };
+        out.extend(p32(8));
+        let entries = 8u16;
+        let dir_end = 8 + 2 + 12 * u32::from(entries) + 4;
+        let offsets_at = dir_end;
+        let data_at = offsets_at + 4 * strips.len() as u32;
+        let mut dir = p16(entries).to_vec();
+        let mut entry = |tag: u16, kind: u16, count: u32, value: u32| {
+            dir.extend(p16(tag));
+            dir.extend(p16(kind));
+            dir.extend(p32(count));
+            if kind == 3 && count == 1 {
+                dir.extend(p16(value as u16));
+                dir.extend([0, 0]);
+            } else {
+                dir.extend(p32(value));
+            }
+        };
+        entry(WIDTH, 3, 1, u32::from(width));
+        entry(HEIGHT, 3, 1, u32::from(height));
+        entry(BITS_PER_SAMPLE, 3, 1, 8);
+        entry(COMPRESSION, 3, 1, 1);
+        entry(PHOTOMETRIC, 3, 1, 1);
+        let first = if strips.len() == 1 { data_at } else { offsets_at };
+        entry(STRIP_OFFSETS, 4, strips.len() as u32, first);
+        entry(SAMPLES_PER_PIXEL, 3, 1, 1);
+        entry(ROWS_PER_STRIP, 3, 1, u32::from(rows));
+        dir.extend(p32(0));
+        out.extend(dir);
+        let mut at = data_at;
+        for strip in &strips {
+            out.extend(p32(at));
+            at += strip.len() as u32;
+        }
+        for strip in strips {
+            out.extend(strip);
+        }
+        out
+    }
+
+    #[test]
+    fn reads_strips_in_both_byte_orders() {
+        let samples: Vec<u8> = (0..15).map(|i| (i * 17) as u8).collect();
+        for big in [false, true] {
+            for rows in [1, 2, 3] {
+                let plate = read(&encode(5, 3, &samples, rows, big)).unwrap();
+                assert_eq!((plate.width(), plate.height()), (5, 3));
+                assert_eq!(plate.ink(0, 0), Some(100.0), "sample 0 is solid ink");
+                assert_eq!(plate.ink(4, 2), Some((255.0 - 238.0) * 100.0 / 255.0));
+                assert_eq!(plate.ink(5, 0), None);
+                assert_eq!(plate.ink(0, 3), None);
+            }
+        }
+    }
+
+    #[test]
+    fn rejects_what_it_cannot_read() {
+        let good = encode(2, 2, &[0, 0, 0, 0], 2, false);
+        assert!(read(b"GIF89a").is_err());
+        assert!(read(&good[..40]).is_err());
+        assert!(read(&good[..good.len() - 1]).is_err(), "truncated strip");
+        let mut packed = good.clone();
+        // Compression (the fourth entry's value) set to PackBits.
+        packed[8 + 2 + 12 * 3 + 8] = 5;
+        assert!(read(&packed).unwrap_err().to_string().contains("uncompressed"));
+    }
+}
diff --git a/crates/plate-test/tests/ghostscript.rs b/crates/plate-test/tests/ghostscript.rs
new file mode 100644
index 00000000..ae2cd38a
--- /dev/null
+++ b/crates/plate-test/tests/ghostscript.rs
@@ -0,0 +1,32 @@
+//! Local plate check: separates every scene with Ghostscript and judges its sample points.
+//! Run it with `scripts/plate-check.sh`; it never runs in CI.
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use craft_plate_test::reference::{self, Context};
+use craft_plate_test::report::{self, Status};
+use craft_plate_test::{gs, scene};
+
+#[test]
+#[ignore = "needs Ghostscript; run scripts/plate-check.sh"]
+fn every_scene_separates_as_expected() {
+    let Some(version) = gs::version() else {
+        println!("note: Ghostscript ({:?}) not found; set {} or install gs", gs::program(), gs::GS_ENV);
+        return;
+    };
+    let scenes = scene::load_dir(&scene::scenes_dir()).unwrap();
+    let ctx = Context::from_env(&scenes);
+    if ctx.font.is_none() {
+        println!("note: {} not set; text points are skipped", reference::FONT_DIR_ENV);
+    }
+    let report = report::run(&ctx, version);
+    let path = report::write(&report, &report::output_dir()).unwrap();
+    for result in &report.scenes {
+        let pending = result.pending.as_deref().map(|t| format!(" (pending {t})")).unwrap_or_default();
+        println!("{} {:?}{pending}", result.id, result.status);
+    }
+    println!("report: {}", path.display());
+    let wrong = report.unexpected();
+    assert!(wrong.is_empty(), "see {}:\n{}", path.display(), wrong.join("\n"));
+    assert!(report.scenes.iter().any(|r| r.status == Status::Pass));
+}
diff --git a/crates/plate-test/tests/scenes.rs b/crates/plate-test/tests/scenes.rs
new file mode 100644
index 00000000..0e114471
--- /dev/null
+++ b/crates/plate-test/tests/scenes.rs
@@ -0,0 +1,137 @@
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use craft_plate_test::reference::{self, Context};
+use craft_plate_test::scene::{self, Scene};
+use craft_plate_test::{Error, structure};
+
+fn scenes() -> Vec<Scene> {
+    scene::load_dir(&scene::scenes_dir()).unwrap()
+}
+
+/// On CI (`CI` set) the workflow provisions the font, so a scene that left text out fails.
+/// Local runs without the font skip text and only note it.
+fn text_must_be_written() -> bool {
+    std::env::var_os("CI").is_some_and(|v| !v.is_empty() && v != "false")
+}
+
+fn missing_font(scene: &Scene) -> String {
+    format!("{}: text skipped; {} must name a directory with {} on CI", scene.id, reference::FONT_DIR_ENV, reference::FONT_FILE)
+}
+
+#[test]
+fn every_scene_parses_and_is_consistent() {
+    let scenes = scenes();
+    assert!(!scenes.is_empty());
+    let problems: Vec<String> = scenes.iter().flat_map(|s| s.validate(&scenes)).collect();
+    assert!(problems.is_empty(), "{}", problems.join("\n"));
+    let mut ids: Vec<&str> = scenes.iter().map(|s| s.id.as_str()).collect();
+    ids.sort_unstable();
+    ids.dedup();
+    assert_eq!(ids.len(), scenes.len(), "scene ids must be unique");
+}
+
+/// Non-pending scenes are written and match their `structure` block (with text left out for
+/// lack of fonts, a mismatch is only a note, except on CI). Pending scenes must
+/// either write or stop at a feature the writer lacks, so their other fields stay valid.
+#[test]
+fn written_scenes_match_their_structure() {
+    let scenes = scenes();
+    let ctx = Context::from_env(&scenes);
+    if ctx.font.is_none() {
+        println!("note: {} not set; text objects are skipped", reference::FONT_DIR_ENV);
+    }
+    let mut failures = Vec::new();
+    let mut written = 0;
+    for scene in &scenes {
+        let result = reference::write(scene, &ctx);
+        if let Some(task) = &scene.pending {
+            match result {
+                Ok(_) | Err(Error::Unsupported(_)) => println!("{} pending ({task})", scene.id),
+                Err(e) => failures.push(format!("{} (pending {task}): {e}", scene.id)),
+            }
+            continue;
+        }
+        let output = match result {
+            Ok(output) => output,
+            Err(e) => {
+                failures.push(format!("{}: {e}", scene.id));
+                continue;
+            }
+        };
+        for note in &output.notes {
+            println!("note: {note}");
+        }
+        let summary = structure::summarize(&output.pdf).unwrap();
+        let problems = scene.structure.check(&summary);
+        // A scene whose overprint or other states sit only on text can't match without fonts.
+        let text_skipped = output.notes.iter().any(|note| note.contains(reference::FONT_DIR_ENV));
+        if text_skipped && text_must_be_written() {
+            failures.push(missing_font(scene));
+        } else if !problems.is_empty() && text_skipped {
+            println!("note: {}: structure not checked with text skipped: {}", scene.id, problems.join("; "));
+        } else if !problems.is_empty() {
+            let json = serde_json::to_string_pretty(&summary).unwrap();
+            failures.push(format!("{}:\n  {}\nsummary: {json}", scene.id, problems.join("\n  ")));
+        }
+        written += 1;
+    }
+    println!("{written} scenes written, {} pending", scenes.len() - written);
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+}
+
+/// The print preset (the FOGRA39 output intent) adds one `GTS_PDFX` intent and leaves the rest
+/// of a scene's structure as the scene expects. Three scenes cover blending, overprint and
+/// DeviceN; embedding the 700 KB profile in every scene would make this the slowest test.
+#[test]
+fn print_preset_adds_one_gts_pdfx_intent() {
+    let scenes = scenes();
+    let ctx = Context::from_env(&scenes);
+    let mut failures = Vec::new();
+    for scene in scenes.iter().filter(|s| ["S01", "S06", "S14"].contains(&s.id.as_str())) {
+        let mut print = scene.clone();
+        print.settings.output_intent = Some("fogra39".to_owned());
+        let output = reference::write(&print, &ctx).unwrap();
+        let summary = structure::summarize(&output.pdf).unwrap();
+        let mut want = scene.structure.clone();
+        want.output_intents = Some(vec!["GTS_PDFX".to_owned()]);
+        let problems = want.check(&summary);
+        let text_skipped = output.notes.iter().any(|note| note.contains(reference::FONT_DIR_ENV));
+        if text_skipped && text_must_be_written() {
+            failures.push(missing_font(scene));
+        } else if !problems.is_empty() && text_skipped {
+            assert!(summary.output_intents.iter().filter(|i| *i == "GTS_PDFX").count() == 1, "{}: {summary:?}", scene.id);
+        } else if !problems.is_empty() {
+            failures.push(format!("{}: {}", scene.id, problems.join("; ")));
+        }
+    }
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+}
+
+/// The check catches the RGB blending regression: S06 written with the writer's default group
+/// space has an RGB form group and no page group, which its `structure` block rejects.
+#[test]
+fn structure_check_rejects_rgb_blending() {
+    let scenes = scenes();
+    let mut s06 = scenes.iter().find(|s| s.id == "S06").unwrap().clone();
+    s06.settings.group_cs = None;
+    let pdf = reference::write(&s06, &Context { scenes: &scenes, font: None }).unwrap().pdf;
+    let summary = structure::summarize(&pdf).unwrap();
+    assert!(summary.groups.iter().any(|g| g.at == "form" && g.s == "Transparency" && g.cs.as_deref() == Some("DeviceRGB")), "{summary:?}");
+    assert!(summary.color_spaces.contains("DeviceCMYK"), "{summary:?}");
+    let problems = s06.structure.check(&summary);
+    assert!(problems.iter().any(|p| p.starts_with("page_group")), "{problems:?}");
+    assert!(problems.iter().any(|p| p.starts_with("group_cs")), "{problems:?}");
+    assert!(structure::summarize(b"not a pdf").is_err());
+}
+
+/// N1 waits for overprint (T4); without it, the DeviceN fill and its color spaces already
+/// match the scene.
+#[test]
+fn device_n_scene_writes_its_color_spaces() {
+    let scenes = scenes();
+    let n1 = scenes.iter().find(|s| s.id == "N1").unwrap();
+    let output = reference::write_partial(n1, &Context { scenes: &scenes, font: None }).unwrap();
+    let summary = structure::summarize(&output.pdf).unwrap();
+    assert_eq!(Some(&summary.color_spaces), n1.structure.color_spaces.as_ref(), "{summary:?}");
+    assert!(!summary.device_rgb, "{summary:?}");
+}
diff --git a/crates/prepress/Cargo.toml b/crates/prepress/Cargo.toml
new file mode 100644
index 00000000..e78fbbd8
--- /dev/null
+++ b/crates/prepress/Cargo.toml
@@ -0,0 +1,27 @@
+[package]
+name = "craft-prepress"
+description = "Prepress for the Craft apps: ink model, per-ink plates rendered from a PDF, coverage, ink limits and composite preview"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+craft-pdf = { workspace = true, features = ["raster", "write"] }
+craft-cms = { workspace = true }
+thiserror = { workspace = true }
+kurbo = { workspace = true, optional = true }
+linesweeper = { version = "0.5", optional = true }
+ttf-parser = { version = "=0.25.1", optional = true }
+
+[dev-dependencies]
+craft-plate-test = { workspace = true }
+ttf-parser = "=0.25.1"
+
+[features]
+# The transparency flattener.
+flatten = ["craft-pdf/write-pdf", "dep:kurbo", "dep:linesweeper", "dep:ttf-parser"]
diff --git a/crates/prepress/README.md b/crates/prepress/README.md
new file mode 100644
index 00000000..49beb635
--- /dev/null
+++ b/crates/prepress/README.md
@@ -0,0 +1,224 @@
+# craft-prepress
+
+Prepress for the Craft apps: separations, ink limits and the ink manager.
+
+- `ink`: the ink model the writers and previews share. `InkSet` holds the four process inks
+  (always first, in plate order) and the spot inks of a job, and is the job's ink manager
+  (aliases, spots to process); `InkColor` is a color as ink tints (`Separation`, `DeviceN`,
+  registration or none); `Overprint` holds `op`, `OP` and `OPM`. Spot names are compared as
+  PDF names: `/Gold#20Foil` and `Gold Foil` are one ink. `to_pdf_color` writes an `InkColor`
+  as a krilla color for export.
+- `plates`: one 8-bit plane per ink (255 = 100% ink) rendered from a PDF page.
+- `coverage`: ink coverage at a pixel and over a page, total area coverage (TAC) per pixel,
+  and the pixels and regions over a TAC limit.
+- `composite`: an sRGB preview of chosen plates.
+- `cms`: process color conversion into a CMYK printing condition through craft-cms.
+
+- `flatten` (feature `flatten`): the display list a transparency flattener reads and writes:
+  fills, text runs, images and transparency groups in page space, with ink colors and overprint
+  per item. Text runs keep their font (bytes, face index, a dedup key), glyph ids and positions,
+  and Unicode text, so text without transparency stays live text; outlines are kept as the
+  fallback for fonts that can't be embedded again. `flatten` turns the transparent parts into
+  opaque region fills, compositing one value per ink (process and spot) with blend modes, group
+  opacity, isolated and knockout groups, and overprint per plate. Items without transparency
+  come back unchanged (JPEG images in DeviceGray or DeviceCMYK keep their DCT data; other images
+  are written as 8-bit Flate samples); regions a gradient, image or soft mask reaches are listed
+  for rasterizing. `flatten::raster` rasterizes them: each region's items are written alone,
+  separated with `plates` and written back as a DeviceN image of the page's inks, clipped to the
+  region, snapped to the device grid and a pixel larger than the clip so no paper shows at its
+  edges. `flatten_document` flattens every page of a PDF, or a range of pages, into one PDF with
+  the source's output intent, page boxes, title, author, creation date and modification date; a
+  font used on several pages is embedded once. The caller sets the PDF version and the PDF/X
+  version and conformance keys (for PDF/X-1a:2003, 1.4, `PDF/X-1:2003` and `PDF/X-1a:2003`);
+  krilla has no PDF/X validator, so the app keeps its own PDF/X checks. `flatten_page` is its
+  one-page case.
+
+## Plates from an exported PDF
+
+An app exports its PDF as usual, then separates a page of it:
+
+```rust
+use craft_prepress::{plates, InkId, Options, Process};
+
+let p = plates(&pdf, 0, 150.0, &Options::default())?;
+for (id, ink) in p.inks.iter() {
+    let plane = p.plane(id); // p.width × p.height tints, row-major
+    println!("{}: {} pixels inked", ink.name(), plane.map_or(0, |t| t.iter().filter(|v| **v > 0).count()));
+}
+let black = p.tint(InkId::process(Process::Black), 10, 10);
+let gold = p.inks.lookup("Gold").and_then(|id| p.tint(id, 10, 10));
+```
+
+The plates are the PDF as printed, so a preview built on them shows what the writer produced,
+not what the document model intended.
+
+How a plate is made: the page renders once per ink through craft-pdf's `raster` with
+hayro-interpret's plate mode (`InterpreterSettings::plate`). Every paint draws its tint of
+that ink as gray film. A paint that overprints (`op`/`OP`, and `OPM 1` for zero DeviceCMYK
+components) without naming the ink leaves the film as it is; with `Options::overprint` off,
+every paint knocks out. Clipping, anti-aliasing, soft masks, transparency and knockout groups
+stay the renderer's own. `Separation` and `DeviceN` colorants paint their own plates (`All`
+every plate, `None` none), DeviceCMYK its components, DeviceGray black only.
+
+Inks are found by a low-resolution pass that records each spot ink a paint uses, in the order
+first painted. Spot inks used only inside soft masks are left out. Each spot gets a Lab
+alternate measured from its sRGB appearance at 100%, so out-of-sRGB spots are clipped.
+
+### Process color
+
+RGB, CIE-based and ICCBased colors become CMYK through, in order:
+
+1. the CMYK profile of the page's or the document's output intent (a `GTS_PDFX` intent first),
+   when craft-cms can convert into it;
+2. `Options::fallback`: craft-cms's Coated FOGRA39 profile (the default), a profile the caller
+   gives, or the ISO 32000-2 §10.4.2.4 device formulas.
+
+`Plates::conversion` says which was used. Conversions are relative colorimetric without black
+point compensation. DeviceCMYK, and ICCBased CMYK in the printing condition's own profile,
+separate as they are.
+
+### Caps
+
+| Constant | Value | Why |
+|---|---|---|
+| `MAX_SPOT_INKS` | 32 spot inks per page | A `DeviceN` space has at most 32 colorants, and each plate costs a render and a byte per pixel. Further spots are listed in `Plates::unseparated`. |
+| `MAX_PLATE_PIXELS` | 4 MP per plate (2000 × 2000) | A page with many inks stays within a few hundred megabytes. The resolution is lowered to fit; `Plates::dpi` reports the one used. |
+
+The renderer's side limit (`craft_pdf::raster::MAX_SIDE`) also lowers the resolution.
+
+### Approximations
+
+- Non-separable blend modes and groups that blend in RGB are approximated per ink.
+- The graphics state's rendering intent is not read; transfer functions and halftones are not
+  applied.
+
+## Coverage and TAC
+
+Every reading takes `enabled`, indexed by `InkId::index` like a Separations Preview's
+toggles: inks past its end count, so `&[]` counts every ink. Values are percent of one ink at
+100%, so TAC runs to 100 × the number of inks.
+
+| Call | Gives |
+|---|---|
+| `coverage_at(x, y, enabled)` | `Coverage`: each ink's tint and the TAC of the enabled inks at a pixel |
+| `pixel_at(u, v)` | The pixel under a point given as fractions of the page, for a pointer readout |
+| `tac(enabled)` | TAC per pixel, row-major |
+| `stats(enabled)` | `Stats`: per ink `InkStats { max, mean, area }`; the page's highest TAC, where, and its mean |
+| `above(limit, enabled)` | `Above`: a mask of the pixels over `limit` and their `count`; `regions()` lists connected regions with bounding boxes, largest first (at most `MAX_REGIONS`); `paint(rgb, color)` marks them on a preview |
+
+## Composite preview
+
+`Plates::composite(enabled, &cms)` returns sRGB8 (three bytes per pixel, row-major) of the
+enabled inks:
+
+- the process plates convert through `cms` (a `CmsConversion` for the plates' printing
+  condition, `Plates::conversion` names it), relative colorimetric with black point
+  compensation, or through the bundled CMYK profile when `cms` can't convert;
+- each enabled spot plate multiplies over them by the spot's appearance at its tint: a Lab
+  alternate interpolated from paper white to the solid, or a CMYK alternate scaled by the tint.
+
+Overprint is already in the plates (the renderer decides per plate what overprints and what
+knocks out), so the preview shows it without rewriting any paint as a blend mode.
+
+```rust
+use craft_prepress::{CmsConversion, InkId};
+
+let cms = CmsConversion::fogra39();
+let mut enabled = vec![true; p.inks.len()];
+enabled[InkId::process(craft_prepress::Process::Black).index()] = false; // hide Black
+let mut rgb = p.composite(&enabled, &cms);
+let over = p.above(300.0, &enabled);
+over.paint(&mut rgb, [255, 0, 255]); // TAC warning
+let worst = over.regions().first().copied();
+```
+
+## Ink manager
+
+`InkSet` carries the job's ink settings next to its inks:
+
+| Call | Effect |
+|---|---|
+| `alias(from, to)` | Spot `from` prints on `to`'s plate (a process ink or another spot, chains followed); `alias(from, from)` removes it. Loops and process `from` are refused. |
+| `set_to_process(ink, on)` | Spot `ink` prints as process color, from its alternate (`spot_cmyk`). |
+| `set_all_to_process(on)` | All Spots to Process; aliases still apply first. |
+| `plate_of(ink)` | The plate a tint of `ink` lands on, `None` when it prints as process. |
+| `resolve(&color, &cms)` | `color` with both applied. Tints landing on one plate combine as `1 − (1 − a)(1 − b)`; a converted color lists the four process inks first, and `InkColor::as_cmyk` gives the CMYK when no spot is left. |
+
+`resolve` takes a `CmykConversion` (such as `CmsConversion`) because a spot with a Lab
+alternate needs the printing condition to become CMYK.
+
+Apply it in two places:
+
+- **Export.** The writer calls `resolve` on every color it emits, then
+  `to_pdf_color(&resolved, &inks, &cms)` for the krilla color to paint with (see
+  [Export](#export)). An overprinting color that became CMYK is written with `OPM 1`, so its
+  zero components leave the plates under it as they are.
+- **Preview.** The preview separates that exported PDF with `plates` and shows
+  `composite` and the coverage readings. Plates are the truth: an ink manager change shows
+  after the next export, and the preview never recomputes overprint from the document.
+
+## Export
+
+`to_pdf_color(&color, &inks, &cms)` gives the krilla color (`craft_pdf::write::backend::color::Color`)
+for an `InkColor`, choosing the color space from the inks it names:
+
+| Color | Written as |
+|---|---|
+| Tints of process inks only | DeviceCMYK; unlisted process inks are 0 |
+| One spot ink | `Separation` with the spot's alternate as DeviceCMYK fallback |
+| Any other mix | `DeviceN`: process inks first in plate order, then spots in `InkSet` order |
+| `All` | `Separation /All` (registration) |
+| `None` | `Separation /None` (marks no plate) |
+
+A spot's alternate is `spot_cmyk`: a CMYK alternate as given, a Lab one converted through
+`cms` into the printing condition, so a spot has one alternate in every space that names it.
+`None` when the color names an ink not in the set or a `DeviceN` space would need more than
+32 colorants.
+
+```rust
+use craft_prepress::{CmsConversion, InkColor, to_pdf_color};
+
+let cms = CmsConversion::fogra39();
+let printed = inks.resolve(&InkColor::Tints(vec![(gold, 1.0), (black, 0.5)]), &cms);
+if let Some(color) = to_pdf_color(&printed, &inks, &cms) {
+    surface.set_fill(Some(Fill { paint: color.into(), ..Default::default() })); // DeviceN [Black Gold]
+}
+```
+
+## In DesignCraft and VectorCraft
+
+- **Separations Preview**: export the spread to PDF
+  in memory, `plates(pdf, 0, dpi, &Options::default())` at the zoom's resolution, then
+  `composite(enabled, &cms)` for the canvas. The panel lists `p.inks` with a toggle per row
+  feeding `enabled`, each row's percentage from `coverage_at` under the pointer
+  (`pixel_at`), and the TAC mode from `above(limit, enabled)` with `paint`. Single-plate view
+  shows `p.plane(id)` as gray film. It would replace VectorCraft's `proof.rs`, which
+  recolors the document and draws overprint as Darken.
+- **Ink Manager** (DesignCraft's `InkManager` aliases and convert-to-process, VectorCraft's
+  `inks.rs` plates): keep one `InkSet` per document, add each spot swatch with its Lab or
+  CMYK alternate, and map the dialog's rows onto `alias`, `set_to_process` and
+  `set_all_to_process`. The PDF writer resolves swatch colors through it; the Separations
+  Preview then lists the plates the export produced.
+- **Preflight**: `stats(&[])` gives per-ink max and mean coverage and the page's highest TAC
+  and its position for a report line such as "TAC 340% at …, limit 300%".
+
+## Credits
+
+- Plate mode, ink discovery, the output-intent handling and the coverage readings and
+  composite (`Separations::above`, `stats`, `composite`) come from
+  [storytold/pdfcraft#2770](https://github.com/storytold/pdfcraft/pull/2770) by Guillem Hermida
+  (guillehr2), with craft-cms in place of moxcms.
+- Knockout groups in the renderer come from
+  [storytold/pdfcraft#2974](https://github.com/storytold/pdfcraft/pull/2974) by mtlcl410.
+- The flattener's planar regions (`flatten::geom`) are ported from VectorCraft at commit
+  `c2b15982` by the VectorCraft contributors: `crates/pathops/src/pathfinder.rs`,
+  `crates/pathops/src/boolean.rs` and `crates/engine/src/cmd/flatten.rs`.
+- The flattener's compositor (`flatten::compose`) is ported from VectorCraft at commit
+  `c2b15982` by the VectorCraft contributors: `Composer`, `region_fill` and the raster/vector
+  balance in `crates/engine/src/cmd/flatten.rs`, and the blend formulas in
+  `crates/color/src/blend.rs`.
+- The flattener's raster step (`flatten::raster`) follows VectorCraft's `render_raster` in
+  `crates/engine/src/cmd/flatten.rs` at commit `c2b15982`: the image reaching a pixel past its
+  area, and the coverage of the art drawn opaque as the image's alpha.
+
+All MIT OR Apache-2.0, as this crate.
diff --git a/crates/prepress/src/cms.rs b/crates/prepress/src/cms.rs
new file mode 100644
index 00000000..97c5a74d
--- /dev/null
+++ b/crates/prepress/src/cms.rs
@@ -0,0 +1,162 @@
+//! Process color conversion for plate mode through craft-cms.
+
+use std::sync::{Arc, OnceLock};
+
+use craft_cms::{Builtin, ColorSpace, Intent, Profile, Transform, TransformOptions, builtin, cached, math};
+use craft_pdf::interpret::color::{CmykConversion, CmykSimulation};
+
+/// Converts process color into a CMYK printing condition with craft-cms: relative
+/// colorimetric, without black point compensation, as the plate renderer expects (see
+/// [`CmykConversion`]). CMYK shows as sRGB relative colorimetric with black point
+/// compensation. Transforms are built on first use and shared through craft-cms's cache.
+pub struct CmsConversion {
+    profile: Profile,
+    perceptual: bool,
+    from_srgb: OnceLock<Option<Arc<Transform>>>,
+    from_lab: OnceLock<Option<Arc<Transform>>>,
+    to_srgb: OnceLock<Option<Arc<Transform>>>,
+}
+
+/// Why a profile can't be a printing condition.
+#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
+#[non_exhaustive]
+pub enum ProfileError {
+    #[error("the profile could not be read: {0}")]
+    Unreadable(String),
+    #[error("the profile is not CMYK")]
+    NotCmyk,
+    #[error("the profile has no PCS-to-device (BToA) tables")]
+    NoPcsToDevice,
+}
+
+impl CmsConversion {
+    /// The printing condition of ICC profile bytes `icc`.
+    pub fn new(icc: &[u8]) -> Result<Self, ProfileError> {
+        Self::from_profile(Profile::parse(icc).map_err(|e| ProfileError::Unreadable(format!("{e:?}")))?)
+    }
+
+    /// The printing condition of a parsed CMYK profile with PCS-to-device tables.
+    pub fn from_profile(profile: Profile) -> Result<Self, ProfileError> {
+        if profile.color_space != ColorSpace::Cmyk {
+            return Err(ProfileError::NotCmyk);
+        }
+        if profile.pcs_to_device(Intent::RelativeColorimetric).is_err() {
+            return Err(ProfileError::NoPcsToDevice);
+        }
+        // Without a colorimetric BToA1 table craft-cms uses BToA0, the perceptual one.
+        let perceptual = profile.b2a[1].is_none() && profile.b2a[0].is_some();
+        Ok(Self { profile, perceptual, from_srgb: OnceLock::new(), from_lab: OnceLock::new(), to_srgb: OnceLock::new() })
+    }
+
+    /// craft-cms's Coated FOGRA39 profile.
+    pub fn fogra39() -> Self {
+        let profile = Builtin::CoatedFogra39.profile().clone();
+        let perceptual = profile.b2a[1].is_none() && profile.b2a[0].is_some();
+        Self { profile, perceptual, from_srgb: OnceLock::new(), from_lab: OnceLock::new(), to_srgb: OnceLock::new() }
+    }
+
+    /// A plate-mode printing condition converting through this, for the profile bytes `icc`
+    /// this was made from. ICCBased CMYK colors embedding those same bytes separate as they
+    /// are.
+    pub fn simulation(self, icc: &[u8]) -> CmykSimulation {
+        CmykSimulation::with_conversion(icc, self)
+    }
+
+    fn transform(cell: &OnceLock<Option<Arc<Transform>>>, src: &Profile, dst: &Profile, bpc: bool) -> Option<Arc<Transform>> {
+        cell.get_or_init(|| {
+            // The fast path interpolates the same tables that 8-bit buffers use: plates convert
+            // images sample by sample through here.
+            let opts = TransformOptions { intent: Intent::RelativeColorimetric, bpc, precise_float: false };
+            cached(src, dst, opts).ok()
+        })
+        .clone()
+    }
+}
+
+fn whole(input: &[f32], channels: usize, cmyk: &[f32]) -> bool {
+    input.len().is_multiple_of(channels) && cmyk.len().is_multiple_of(4) && input.len() / channels == cmyk.len() / 4
+}
+
+fn finite01(cmyk: &mut [f32]) {
+    for v in cmyk {
+        *v = if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 };
+    }
+}
+
+impl CmykConversion for CmsConversion {
+    fn from_srgb(&self, rgb: &[f32], cmyk: &mut [f32]) -> Option<()> {
+        if !whole(rgb, 3, cmyk) {
+            return None;
+        }
+        let t = Self::transform(&self.from_srgb, builtin::srgb(), &self.profile, false)?;
+        t.convert_f32(rgb, 3, cmyk, 4, false).ok()?;
+        finite01(cmyk);
+        Some(())
+    }
+
+    fn from_pcs_xyz(&self, xyz: &[f32], cmyk: &mut [f32]) -> Option<()> {
+        if !whole(xyz, 3, cmyk) {
+            return None;
+        }
+        // Into the Lab D50 identity profile's device values (ICC v4 Lab encoding).
+        let lab: Vec<f32> = xyz
+            .as_chunks::<3>()
+            .0
+            .iter()
+            .flat_map(|c| {
+                let [l, a, b] = math::xyz_to_lab_f32(*c);
+                [l / 100.0, (a + 128.0) / 255.0, (b + 128.0) / 255.0]
+            })
+            .collect();
+        let t = Self::transform(&self.from_lab, Builtin::LabD50.profile(), &self.profile, false)?;
+        t.convert_f32(&lab, 3, cmyk, 4, false).ok()?;
+        finite01(cmyk);
+        Some(())
+    }
+
+    fn to_srgb8(&self, cmyk: &[u8], rgb: &mut [u8]) -> Option<()> {
+        if !cmyk.len().is_multiple_of(4) || cmyk.len() / 4 * 3 != rgb.len() {
+            return None;
+        }
+        let t = Self::transform(&self.to_srgb, &self.profile, builtin::srgb(), true)?;
+        t.convert_u8(cmyk, 4, rgb, 3, false).ok()
+    }
+
+    fn description(&self) -> Option<&str> {
+        let d = self.profile.description.trim();
+        (!d.is_empty()).then_some(d)
+    }
+
+    fn perceptual(&self) -> bool {
+        self.perceptual
+    }
+}
+
+/// CIE L\*a\*b\* (D50) of an sRGB color, relative colorimetric; `None` if craft-cms can't
+/// convert.
+pub(crate) fn srgb8_to_lab(rgb: [u8; 3]) -> Option<[f32; 3]> {
+    static T: OnceLock<Option<Arc<Transform>>> = OnceLock::new();
+    let t = CmsConversion::transform(&T, builtin::srgb(), Builtin::LabD50.profile(), false)?;
+    let mut lab = [0.0_f32; 3];
+    let rgb = rgb.map(|c| f32::from(c) / 255.0);
+    t.convert_f32(&rgb, 3, &mut lab, 3, false).ok()?;
+    Some([lab[0] * 100.0, lab[1] * 255.0 - 128.0, lab[2] * 255.0 - 128.0])
+}
+
+/// sRGB of CIE L\*a\*b\* (D50) colors, relative colorimetric, three values per color in
+/// both; `None` if craft-cms can't convert or the lengths disagree.
+pub(crate) fn lab_to_srgb8(lab: &[f32], rgb: &mut [u8]) -> Option<()> {
+    static T: OnceLock<Option<Arc<Transform>>> = OnceLock::new();
+    if !lab.len().is_multiple_of(3) || lab.len() != rgb.len() {
+        return None;
+    }
+    let t = CmsConversion::transform(&T, Builtin::LabD50.profile(), builtin::srgb(), false)?;
+    // The Lab D50 identity profile's device values (ICC v4 Lab encoding).
+    let encoded: Vec<f32> = lab.as_chunks::<3>().0.iter().flat_map(|[l, a, b]| [l / 100.0, (a + 128.0) / 255.0, (b + 128.0) / 255.0]).collect();
+    let mut out = vec![0.0_f32; encoded.len()];
+    t.convert_f32(&encoded, 3, &mut out, 3, false).ok()?;
+    for (byte, v) in rgb.iter_mut().zip(out) {
+        *byte = if v.is_finite() { (v.clamp(0.0, 1.0) * 255.0).round() as u8 } else { 0 };
+    }
+    Some(())
+}
diff --git a/crates/prepress/src/composite.rs b/crates/prepress/src/composite.rs
new file mode 100644
index 00000000..fd5d48ec
--- /dev/null
+++ b/crates/prepress/src/composite.rs
@@ -0,0 +1,155 @@
+//! A color preview composed from plates, as a Separations Preview shows the page.
+//!
+//! The preview is built from the plates alone, after the renderer has decided per plate what
+//! overprints and what knocks out, so it shows overprint as printed without changing any
+//! paint's blend mode.
+
+use craft_pdf::interpret::color::{CmykConversion, cmyk_to_srgb8};
+
+use crate::cms::lab_to_srgb8;
+use crate::coverage::filled;
+use crate::{Alternate, InkId, Plates, Process};
+
+/// Pixels converted per call into the CMYK profile, to bound the scratch buffers.
+const CHUNK: usize = 16 * 1024;
+
+fn on(enabled: &[bool], index: usize) -> bool {
+    enabled.get(index).copied().unwrap_or(true)
+}
+
+/// CMYK bytes to sRGB bytes through `cms`, else through the bundled profile pages are drawn
+/// with; paper white if neither converts.
+fn to_srgb(cms: &dyn CmykConversion, cmyk: &[u8], rgb: &mut [u8]) {
+    if cms.to_srgb8(cmyk, rgb).or_else(|| cmyk_to_srgb8(cmyk, rgb)).is_none() {
+        rgb.fill(255);
+    }
+}
+
+/// Spot ink `alternate` alone at each tint byte, in sRGB: a Lab alternate runs in a straight
+/// line from paper white (L\* 100) to the solid, a CMYK one scales its components, as a
+/// `Separation` color space's usual tint transform does. Index the result by tint byte;
+/// `None` when a Lab alternate can't be converted.
+pub fn appearance(alternate: Alternate, cms: &dyn CmykConversion) -> Option<Vec<[u8; 3]>> {
+    let mut rgb = vec![0_u8; 256 * 3];
+    match alternate {
+        Alternate::Lab([l, a, b]) => {
+            let lab: Vec<f32> = (0..=255_u8)
+                .flat_map(|t| {
+                    let t = f32::from(t) / 255.0;
+                    [100.0 + t * (l - 100.0), t * a, t * b]
+                })
+                .collect();
+            lab_to_srgb8(&lab, &mut rgb)?;
+        }
+        Alternate::Cmyk(solid) => {
+            let cmyk: Vec<u8> = (0..=255_u8)
+                .flat_map(|t| solid.map(|c| (f32::from(t) * if c.is_finite() { c.clamp(0.0, 1.0) } else { 0.0 }).round() as u8))
+                .collect();
+            to_srgb(cms, &cmyk, &mut rgb);
+        }
+    }
+    Some(rgb.as_chunks::<3>().0.to_vec())
+}
+
+impl Plates {
+    /// The enabled inks as they print, as sRGB8 (three bytes per pixel, row-major,
+    /// `width × height` pixels). `enabled` is indexed by [`InkId::index`]; inks past its end
+    /// are enabled, so `&[]` shows every ink.
+    ///
+    /// The process plates convert through `cms` ([`CmsConversion`](crate::CmsConversion) for
+    /// the printing condition the plates were made for, see [`Plates::conversion`]), relative
+    /// colorimetric with black point compensation, or through the bundled CMYK profile when
+    /// `cms` can't. Each spot plate is then multiplied over them by the spot's appearance at
+    /// its tint, from its alternate. Spots whose Lab alternate craft-cms can't convert are
+    /// left out. Empty when `width × height × 3` overflows or can't be allocated.
+    pub fn composite(&self, enabled: &[bool], cms: &dyn CmykConversion) -> Vec<u8> {
+        let Some(mut rgb) = self.pixels().and_then(|n| n.checked_mul(3)).and_then(|len| filled(len, 255_u8)) else {
+            return Vec::new();
+        };
+        let process: Vec<Option<&[u8]>> = Process::ALL
+            .iter()
+            .map(|p| {
+                let id = InkId::process(*p);
+                self.plane(id).filter(|_| on(enabled, id.index()))
+            })
+            .collect();
+        let mut cmyk = Vec::with_capacity(CHUNK * 4);
+        for (c, out) in rgb.chunks_mut(CHUNK * 3).enumerate() {
+            let start = c * CHUNK;
+            let len = out.len() / 3;
+            cmyk.clear();
+            for i in start..start + len {
+                cmyk.extend(process.iter().map(|plane| plane.and_then(|p| p.get(i)).copied().unwrap_or(0)));
+            }
+            to_srgb(cms, &cmyk, out);
+        }
+
+        for (id, spot) in self.inks.spots().filter(|(id, _)| on(enabled, id.index())) {
+            let Some(plane) = self.plane(id).filter(|p| p.iter().any(|t| *t > 0)) else { continue };
+            let Some(ramp) = appearance(spot.alternate, cms) else { continue };
+            for (px, tint) in rgb.as_chunks_mut::<3>().0.iter_mut().zip(plane) {
+                if let Some(ink) = ramp.get(usize::from(*tint)).filter(|_| *tint > 0) {
+                    for (c, s) in px.iter_mut().zip(ink) {
+                        *c = ((u16::from(*c) * u16::from(*s) + 127) / 255) as u8;
+                    }
+                }
+            }
+        }
+        rgb
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::CmsConversion;
+    use crate::cms::srgb8_to_lab;
+    use crate::coverage::tests::synthetic;
+
+    fn near(got: &[u8], expected: [u8; 3], tolerance: u8) -> bool {
+        got.iter().zip(expected).all(|(g, e)| g.abs_diff(e) <= tolerance)
+    }
+
+    #[test]
+    fn a_spot_appearance_runs_from_paper_to_its_solid() {
+        const GOLD: [u8; 3] = [212, 175, 55];
+        let ramp = super::appearance(crate::Alternate::Lab(srgb8_to_lab(GOLD).unwrap()), &CmsConversion::fogra39()).unwrap();
+        assert_eq!(ramp.len(), 256);
+        assert!(near(&ramp[0], [255, 255, 255], 1) && near(&ramp[255], GOLD, 2), "{:?} {:?}", ramp[0], ramp[255]);
+    }
+
+    #[test]
+    fn a_black_and_gold_composite_multiplies_gold_over_black() {
+        const GOLD: [u8; 3] = [212, 175, 55];
+        let lab = srgb8_to_lab(GOLD).unwrap();
+        // Black alone, Gold alone, Gold over black, Gold at 50%.
+        let p = synthetic(4, 1, lab, [vec![0; 4], vec![0; 4], vec![0; 4], vec![255, 0, 255, 0], vec![0, 255, 255, 128]]);
+        let cms = CmsConversion::fogra39();
+        let rgb = p.composite(&[], &cms);
+        assert_eq!(rgb.len(), 12);
+
+        let black = &rgb[0..3];
+        let (lo, hi) = (black.iter().min().unwrap(), black.iter().max().unwrap());
+        assert!(*hi < 80 && hi - lo < 12, "Coated FOGRA39 black is a dark neutral: {black:?}");
+        assert!(near(&rgb[3..6], GOLD, 2), "Gold: {:?}", &rgb[3..6]);
+        let over: Vec<u8> = black.iter().zip(GOLD).map(|(k, g)| ((u16::from(*k) * u16::from(g) + 127) / 255) as u8).collect();
+        assert!(near(&rgb[6..9], [over[0], over[1], over[2]], 2), "Gold over black: {:?}", &rgb[6..9]);
+        let half = &rgb[9..12];
+        assert!(half.iter().zip(GOLD).all(|(h, g)| *h > g && *h < 255) && half[2] > 110 && half[2] < 200, "Gold at 50%: {half:?}");
+
+        let no_black = p.composite(&[true, true, true, false], &cms);
+        assert!(near(&no_black[0..3], [255, 255, 255], 1), "paper: {:?}", &no_black[0..3]);
+        assert!(near(&no_black[6..9], GOLD, 2));
+        let no_gold = p.composite(&[true, true, true, true, false], &cms);
+        assert_eq!(&no_gold[6..9], black);
+    }
+
+    #[test]
+    fn plates_too_large_to_hold_give_empty_results() {
+        let p = crate::Plates { width: u32::MAX, height: u32::MAX, ..synthetic(0, 0, [50.0, 0.0, 0.0], Default::default()) };
+        assert!(p.composite(&[], &CmsConversion::fogra39()).is_empty());
+        assert!(p.tac(&[]).is_empty());
+        assert_eq!(p.stats(&[]).max_total_at, None);
+        assert!(p.above(10.0, &[]).regions().is_empty());
+        assert_eq!(p.tint(crate::InkId::process(crate::Process::Black), u32::MAX - 1, u32::MAX - 1), None);
+    }
+}
diff --git a/crates/prepress/src/coverage.rs b/crates/prepress/src/coverage.rs
new file mode 100644
index 00000000..74563b50
--- /dev/null
+++ b/crates/prepress/src/coverage.rs
@@ -0,0 +1,307 @@
+//! Ink coverage read from plates: per ink at a point and over a page, total area coverage
+//! (TAC) per pixel, and the pixels over a TAC limit.
+//!
+//! Inks are chosen with an `enabled` list indexed by [`InkId::index`], as a Separations
+//! Preview's toggles hold them: inks past its end are enabled, so `&[]` enables every ink.
+//! Percentages are of one ink's 100%, so a TAC runs to 100 × the number of inks.
+
+use crate::{InkId, Plates};
+
+/// The most regions [`Above::regions`] lists.
+pub const MAX_REGIONS: usize = 256;
+
+/// Coverage at one pixel, in percent.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Coverage {
+    /// Each ink's tint, in [`InkSet::iter`](crate::InkSet::iter) order, enabled or not.
+    pub inks: Vec<f32>,
+    /// The total area coverage: the sum of the enabled inks' tints.
+    pub total: f32,
+}
+
+/// One ink's coverage over a page, in percent.
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub struct InkStats {
+    /// The highest tint.
+    pub max: f32,
+    /// The mean tint over every pixel of the page.
+    pub mean: f32,
+    /// The share of the page the ink prints on (any tint above 0).
+    pub area: f32,
+}
+
+/// A page's coverage figures, in percent.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Stats {
+    /// Each ink's figures, in [`InkSet::iter`](crate::InkSet::iter) order, enabled or not.
+    pub inks: Vec<InkStats>,
+    /// The highest TAC of the enabled inks.
+    pub max_total: f32,
+    /// The first pixel (in row order) with [`max_total`](Self::max_total); `None` for an empty
+    /// page.
+    pub max_total_at: Option<(u32, u32)>,
+    /// The mean TAC of the enabled inks.
+    pub mean_total: f32,
+}
+
+/// The pixels whose TAC is over a limit.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Above {
+    pub width: u32,
+    pub height: u32,
+    /// One entry per pixel, row-major: `true` where the TAC is over the limit.
+    pub mask: Vec<bool>,
+    /// The number of pixels over the limit.
+    pub count: usize,
+}
+
+/// A connected group of pixels over the limit (4-connected), with its bounding box in pixels.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Region {
+    pub x: u32,
+    pub y: u32,
+    pub width: u32,
+    pub height: u32,
+    /// The pixels over the limit in the region.
+    pub pixels: u32,
+}
+
+/// `len` copies of `value`; `None` when the memory can't be had.
+pub(crate) fn filled<T: Clone>(len: usize, value: T) -> Option<Vec<T>> {
+    let mut v = Vec::new();
+    v.try_reserve_exact(len).ok()?;
+    v.resize(len, value);
+    Some(v)
+}
+
+fn on(enabled: &[bool], index: usize) -> bool {
+    enabled.get(index).copied().unwrap_or(true)
+}
+
+fn percent(tint: u64) -> f32 {
+    (tint as f64 * 100.0 / 255.0) as f32
+}
+
+impl Plates {
+    /// `width × height`; `None` when it overflows `usize`, as it can for hand-made plates.
+    pub(crate) fn pixels(&self) -> Option<usize> {
+        usize::try_from(self.width).ok()?.checked_mul(usize::try_from(self.height).ok()?)
+    }
+
+    pub(crate) fn index_of(&self, x: u32, y: u32) -> Option<usize> {
+        if x >= self.width || y >= self.height {
+            return None;
+        }
+        usize::try_from(y).ok()?.checked_mul(usize::try_from(self.width).ok()?)?.checked_add(usize::try_from(x).ok()?)
+    }
+
+    fn enabled_planes<'a>(&'a self, enabled: &'a [bool]) -> impl Iterator<Item = &'a Vec<u8>> + 'a {
+        self.planes.iter().enumerate().filter(|(i, _)| on(enabled, *i)).map(|(_, p)| p)
+    }
+
+    /// The pixel under a point given as fractions `0.0..1.0` of the page's width and height,
+    /// as a pointer over a preview gives it.
+    pub fn pixel_at(&self, u: f32, v: f32) -> Option<(u32, u32)> {
+        if !(0.0..1.0).contains(&u) || !(0.0..1.0).contains(&v) {
+            return None;
+        }
+        let x = ((u * self.width as f32) as u32).min(self.width.checked_sub(1)?);
+        let y = ((v * self.height as f32) as u32).min(self.height.checked_sub(1)?);
+        Some((x, y))
+    }
+
+    /// Each ink's tint and the TAC of the enabled inks at pixel (`x`, `y`).
+    pub fn coverage_at(&self, x: u32, y: u32, enabled: &[bool]) -> Option<Coverage> {
+        let at = self.index_of(x, y)?;
+        let tints: Vec<u64> = self.planes.iter().map(|p| p.get(at).copied().map_or(0, u64::from)).collect();
+        let total = tints.iter().enumerate().filter(|(i, _)| on(enabled, *i)).map(|(_, t)| t).sum();
+        Some(Coverage { inks: tints.into_iter().map(percent).collect(), total: percent(total) })
+    }
+
+    /// Ink `id`'s tint at pixel (`x`, `y`) in percent.
+    pub fn percent_at(&self, id: InkId, x: u32, y: u32) -> Option<f32> {
+        self.tint(id, x, y).map(|t| percent(u64::from(t)))
+    }
+
+    /// The TAC of the enabled inks at every pixel, row-major, as a sum of tint bytes (255 per
+    /// ink at 100%). Empty when `width × height` overflows or can't be allocated.
+    fn totals(&self, enabled: &[bool]) -> Vec<u32> {
+        let Some(mut totals) = self.pixels().and_then(|n| filled(n, 0_u32)) else { return Vec::new() };
+        for plane in self.enabled_planes(enabled) {
+            for (sum, tint) in totals.iter_mut().zip(plane) {
+                *sum = sum.saturating_add(u32::from(*tint));
+            }
+        }
+        totals
+    }
+
+    /// The TAC of the enabled inks at every pixel, row-major, in percent.
+    pub fn tac(&self, enabled: &[bool]) -> Vec<f32> {
+        self.totals(enabled).into_iter().map(|t| percent(u64::from(t))).collect()
+    }
+
+    /// Each ink's figures over the page, and the TAC of the enabled inks.
+    pub fn stats(&self, enabled: &[bool]) -> Stats {
+        let n = self.pixels().unwrap_or(0);
+        let mean = |sum: u64| if n == 0 { 0.0 } else { percent(sum) / n as f32 };
+        let inks = self
+            .planes
+            .iter()
+            .map(|plane| {
+                let plane = plane.get(..n).unwrap_or(plane);
+                let max = plane.iter().copied().max().unwrap_or(0);
+                let sum: u64 = plane.iter().map(|t| u64::from(*t)).sum();
+                let inked = plane.iter().filter(|t| **t > 0).count();
+                let area = if n == 0 { 0.0 } else { inked as f32 * 100.0 / n as f32 };
+                InkStats { max: percent(u64::from(max)), mean: mean(sum), area }
+            })
+            .collect();
+        let totals = self.totals(enabled);
+        // The first pixel with the highest total: `max_by_key` keeps the last of equals.
+        let top = totals.iter().enumerate().rev().max_by_key(|(_, t)| **t);
+        let width = self.width as usize;
+        let max_total_at = top.and_then(|(at, _)| Some((u32::try_from(at % width).ok()?, u32::try_from(at / width).ok()?)));
+        Stats {
+            inks,
+            max_total: top.map_or(0.0, |(_, t)| percent(u64::from(*t))),
+            max_total_at,
+            mean_total: mean(totals.iter().map(|t| u64::from(*t)).sum()),
+        }
+    }
+
+    /// The pixels whose TAC of the enabled inks is over `limit` percent (such as 300 for
+    /// coated paper). A limit that isn't finite marks nothing.
+    pub fn above(&self, limit: f32, enabled: &[bool]) -> Above {
+        let limit = if limit.is_finite() { limit.max(0.0) } else { f32::MAX };
+        let mask: Vec<bool> = self.totals(enabled).into_iter().map(|t| percent(u64::from(t)) > limit).collect();
+        let count = mask.iter().filter(|m| **m).count();
+        Above { width: self.width, height: self.height, mask, count }
+    }
+}
+
+impl Above {
+    /// The connected regions of marked pixels, largest first (ties in row order of their first
+    /// pixel), at most [`MAX_REGIONS`] of them.
+    pub fn regions(&self) -> Vec<Region> {
+        let (w, h) = (self.width as usize, self.height as usize);
+        if self.mask.len() != w.saturating_mul(h) {
+            return Vec::new();
+        }
+        let mut seen = vec![false; self.mask.len()];
+        let mut regions = Vec::new();
+        let mut stack = Vec::new();
+        for start in 0..self.mask.len() {
+            if !self.mask.get(start).copied().unwrap_or(false) || seen.get(start).copied().unwrap_or(true) {
+                continue;
+            }
+            let (mut x0, mut y0, mut x1, mut y1, mut pixels) = (start % w, start / w, start % w, start / w, 0_u32);
+            if let Some(s) = seen.get_mut(start) {
+                *s = true;
+            }
+            stack.push(start);
+            while let Some(at) = stack.pop() {
+                let (x, y) = (at % w, at / w);
+                pixels = pixels.saturating_add(1);
+                (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x), y1.max(y));
+                let next = [(x > 0).then(|| at - 1), (x + 1 < w).then(|| at + 1), (y > 0).then(|| at - w), (y + 1 < h).then(|| at + w)];
+                for n in next.into_iter().flatten() {
+                    if self.mask.get(n).copied().unwrap_or(false)
+                        && let Some(s) = seen.get_mut(n).filter(|s| !**s)
+                    {
+                        *s = true;
+                        stack.push(n);
+                    }
+                }
+            }
+            // The mask is at most `width × height` with both `u32`, so coordinates fit.
+            regions.push(Region { x: x0 as u32, y: y0 as u32, width: (x1 - x0 + 1) as u32, height: (y1 - y0 + 1) as u32, pixels });
+        }
+        regions.sort_by_key(|r| std::cmp::Reverse(r.pixels));
+        regions.truncate(MAX_REGIONS);
+        regions
+    }
+
+    /// Paints the marked pixels of an sRGB8 image of the same size (three bytes per pixel,
+    /// such as [`Plates::composite`]'s) in `color`, as a TAC warning.
+    pub fn paint(&self, rgb: &mut [u8], color: [u8; 3]) {
+        for (px, _) in rgb.as_chunks_mut::<3>().0.iter_mut().zip(&self.mask).filter(|(_, m)| **m) {
+            *px = color;
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use crate::{Alternate, Conversion, Ink, InkSet, Spot};
+
+    /// Plates of `width × height` pixels for the process inks and a Gold spot (Lab alternate
+    /// `gold`), from planes given in `C M Y K Gold` order.
+    pub(crate) fn synthetic(width: u32, height: u32, gold: [f32; 3], planes: [Vec<u8>; 5]) -> Plates {
+        let mut inks = InkSet::new();
+        inks.add(Ink::Spot(Spot { name: "Gold".into(), alternate: Alternate::Lab(gold), solidity: None }));
+        Plates { inks, unseparated: Vec::new(), width, height, dpi: 72.0, conversion: Conversion::DeviceFormulas, planes: planes.to_vec() }
+    }
+
+    fn close(a: f32, b: f32) -> bool {
+        (a - b).abs() < 0.01
+    }
+
+    #[test]
+    fn coverage_tac_and_regions_over_a_limit() {
+        // 3 × 2 pixels: rich black with Gold at (0,0), (1,0) (Gold at 50%) and (2,1); black
+        // alone at (2,0).
+        let p = synthetic(
+            3,
+            2,
+            [70.0, 5.0, 60.0],
+            [vec![0; 6], vec![255, 255, 0, 0, 0, 255], vec![255, 255, 0, 0, 0, 255], vec![255, 255, 255, 0, 0, 255], vec![255, 128, 0, 0, 0, 255]],
+        );
+        let at = p.coverage_at(1, 0, &[]).unwrap();
+        assert!(close(at.inks[4], 50.196) && close(at.total, 350.196), "{at:?}");
+        assert!(close(p.coverage_at(1, 0, &[true, true, true, true, false]).unwrap().total, 300.0), "Gold hidden");
+        assert_eq!(p.coverage_at(3, 0, &[]), None);
+        assert_eq!(p.pixel_at(0.99, 0.6), Some((2, 1)));
+        assert_eq!(p.pixel_at(1.0, 0.0), None);
+        assert!(close(p.tac(&[])[2], 100.0));
+
+        let s = p.stats(&[]);
+        assert!(close(s.max_total, 400.0) && s.max_total_at == Some((0, 0)), "{s:?}");
+        assert!(close(s.mean_total, 3188.0 / 1530.0 * 100.0), "{s:?}");
+        let k = s.inks[3];
+        assert!(close(k.max, 100.0) && close(k.mean, 66.667) && close(k.area, 66.667), "{k:?}");
+        let gold = s.inks[4];
+        assert!(close(gold.mean, 638.0 / 1530.0 * 100.0) && close(gold.area, 50.0), "{gold:?}");
+        assert_eq!(s.inks[0], InkStats::default());
+
+        let over = p.above(300.0, &[]);
+        assert_eq!(over.count, 3);
+        assert_eq!(over.mask, [true, true, false, false, false, true]);
+        let regions = over.regions();
+        assert_eq!(regions, [Region { x: 0, y: 0, width: 2, height: 1, pixels: 2 }, Region { x: 2, y: 1, width: 1, height: 1, pixels: 1 }]);
+        assert_eq!(p.above(300.0, &[true, true, true, true, false]).count, 0, "exactly at the limit is not over it");
+        assert_eq!(p.above(f32::NAN, &[]).count, 0);
+
+        let mut rgb = vec![0_u8; 18];
+        over.paint(&mut rgb, [255, 0, 255]);
+        assert_eq!(&rgb[..6], [255, 0, 255, 255, 0, 255]);
+        assert_eq!(&rgb[6..9], [0, 0, 0]);
+    }
+
+    #[test]
+    fn regions_join_four_connected_pixels_and_keep_the_largest() {
+        // A ring around an unmarked center is one region; the diagonal neighbor is another.
+        #[rustfmt::skip]
+        let mask = vec![
+            true,  true,  true,  false,
+            true,  false, true,  false,
+            true,  true,  true,  false,
+            false, false, false, true,
+        ];
+        let above = Above { width: 4, height: 4, count: 9, mask };
+        assert_eq!(above.regions(), [Region { x: 0, y: 0, width: 3, height: 3, pixels: 8 }, Region { x: 3, y: 3, width: 1, height: 1, pixels: 1 }]);
+        let empty = Plates { width: 0, height: 0, planes: Vec::new(), ..synthetic(0, 0, [0.0; 3], Default::default()) };
+        assert_eq!(empty.stats(&[]).max_total_at, None);
+        assert!(empty.above(10.0, &[]).regions().is_empty());
+    }
+}
diff --git a/crates/prepress/src/flatten/compose.rs b/crates/prepress/src/flatten/compose.rs
new file mode 100644
index 00000000..ba0cceef
--- /dev/null
+++ b/crates/prepress/src/flatten/compose.rs
@@ -0,0 +1,1161 @@
+//! The transparency flattener: transparent art becomes opaque fills that print the same.
+//!
+//! Items split into transitive groups of overlapping items ([`geom::transparent_groups`]). Groups
+//! without transparency come back unchanged, so their text stays live. The items of the other
+//! groups are cut into planar regions ([`geom::regions`]); the same paints cover all of a region,
+//! so one composited color is exact for it. Colors composite as ink vectors, one subtractive value
+//! per ink of the list's [`InkSet`], process and spot inks alike (ISO 32000-2 §11.3). Overprint
+//! applies per ink while compositing (§11.7.4, `CompatibleOverprint`), never through blend modes or
+//! knockout groups. Regions a gradient, image or soft mask reaches have no single color: they are
+//! listed in [`Flattened::complex`] for the raster step.
+//!
+//! Overprint after flattening: a region fill has nothing under it, and its color already holds
+//! every plate's result, so it does not overprint. The exception keeps a paint as it was: where a
+//! region's color equals its top paint painted alone, the fill takes that paint's color and
+//! overprint attributes, which print the same over paper. Kept items keep their attributes, since
+//! what they overprint is still under them.
+//!
+//! Ported from VectorCraft (MIT OR Apache-2.0) at commit c2b15982: `Composer`, `region_fill` and
+//! the raster/vector balance (`rasterize_all`) in `crates/engine/src/cmd/flatten.rs`, and the
+//! blend formulas in `crates/color/src/blend.rs`. VectorCraft composites RGB or CMY+K planes;
+//! here each ink is a plane, and groups follow the §11.4 formulas.
+
+use std::collections::HashMap;
+use std::ops::Range;
+
+use kurbo::{BezPath, Rect, Shape as _};
+
+use super::geom::{self, ClipPath, GeomError, Shape};
+use super::{BlendMode, DisplayList, FillItem, FillRule, GroupItem, Item, Paint};
+use crate::ink::{InkColor, InkId, InkSet, Overprint, Process};
+
+/// How [`flatten`] cuts transparent art.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct FlattenOptions {
+    /// Regions narrower than this (in points) are dropped ([`geom::regions_with`]).
+    pub sliver: f64,
+    /// A group that cuts into more regions than this goes to [`Flattened::complex`] whole,
+    /// as VectorCraft's raster/vector balance rasterizes it.
+    pub max_regions: usize,
+    /// The resolution complex regions are rasterized at ([`raster`](super::raster)).
+    pub raster_dpi: f32,
+}
+
+impl Default for FlattenOptions {
+    fn default() -> Self {
+        // VectorCraft's medium preset (balance 75) allows 10^(75/20), about 5600 regions.
+        Self { sliver: geom::DEFAULT_SLIVER, max_regions: 5000, raster_dpi: 300.0 }
+    }
+}
+
+/// A page with no transparency left.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Flattened {
+    /// Kept items and region fills, in painting order. No group in it is transparent.
+    pub items: Vec<Item>,
+    /// Areas left for rasterizing, each disjoint from every item but those it paints before.
+    pub complex: Vec<ComplexRegion>,
+    pub report: FlattenReport,
+}
+
+/// An area without one flat color.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ComplexRegion {
+    /// The area, nonzero rule.
+    pub path: BezPath,
+    /// Indices into [`DisplayList::items`] of the top-level items painting in the area, in
+    /// painting order. Rendered alone and clipped to `path`, they give its look.
+    pub items: Vec<usize>,
+    /// Paints before [`Flattened::items`]`[at]` (after all of them when `at` is their count).
+    pub at: usize,
+    /// Set when the region is a whole group ([`FlattenReport::complex_groups`]).
+    pub whole: Option<ComplexReason>,
+}
+
+/// What [`flatten`] did.
+#[derive(Clone, Debug, Default, PartialEq)]
+#[non_exhaustive]
+pub struct FlattenReport {
+    /// Top-level items returned unchanged.
+    pub kept: usize,
+    /// Top-level items cut into regions.
+    pub flattened: usize,
+    /// Regions computed.
+    pub regions: usize,
+    /// Region fills written.
+    pub fills: usize,
+    /// Entries of [`Flattened::complex`].
+    pub complex_regions: usize,
+    /// Groups that went to [`Flattened::complex`] whole.
+    pub complex_groups: Vec<ComplexGroup>,
+}
+
+/// A group of items rasterized whole.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ComplexGroup {
+    /// Indices into [`DisplayList::items`].
+    pub items: Vec<usize>,
+    pub reason: ComplexReason,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum ComplexReason {
+    /// The region sweep failed ([`GeomError::Degenerate`]).
+    Degenerate,
+    /// More regions than [`FlattenOptions::max_regions`].
+    TooManyRegions(usize),
+}
+
+#[derive(Clone, Debug, PartialEq, thiserror::Error)]
+#[non_exhaustive]
+pub enum FlattenError {
+    #[error("a color names ink {0:?}, which is not in the list's ink set")]
+    UnknownInk(InkId),
+    #[error(transparent)]
+    Geometry(#[from] GeomError),
+}
+
+/// `list` with its transparency flattened. Items that neither involve transparency nor overlap
+/// an item that does come back unchanged, and so do opaque items with no transparency painted
+/// above them where they paint.
+pub fn flatten(list: &DisplayList, opts: &FlattenOptions) -> Result<Flattened, FlattenError> {
+    let nan = Rect::new(f64::NAN, f64::NAN, f64::NAN, f64::NAN);
+    let bounds: Vec<Rect> = list.items.iter().map(|i| bounds(i).unwrap_or(nan)).collect();
+    let transparent: Vec<bool> = list.items.iter().map(is_transparent).collect();
+
+    #[derive(Clone, Copy)]
+    enum Plan {
+        Keep,
+        Drop,
+        Emit(usize),
+    }
+    let groups = geom::transparent_groups(&bounds, &transparent);
+    let mut plan = vec![Plan::Keep; list.items.len()];
+    let mut members: Vec<Vec<usize>> = Vec::with_capacity(groups.len());
+    for g in &groups {
+        // Opaque items above the group's last transparent item paint over flat regions as they
+        // would over the composited art, overprint included: they stay as they are.
+        let Some(&last) = g.iter().rev().find(|&&i| transparent[i]) else { continue };
+        let m: Vec<usize> = g.iter().copied().filter(|&i| i <= last).collect();
+        for &i in &m {
+            plan[i] = Plan::Drop;
+        }
+        plan[last] = Plan::Emit(members.len());
+        members.push(m);
+    }
+
+    let mut out = Flattened { items: Vec::new(), complex: Vec::new(), report: FlattenReport::default() };
+    for (i, item) in list.items.iter().enumerate() {
+        match plan[i] {
+            Plan::Keep => {
+                out.items.push(without_groups(item));
+                out.report.kept += 1;
+            }
+            Plan::Drop => {}
+            Plan::Emit(g) => flatten_group(list, &members[g], &bounds, &transparent, opts, &mut out)?,
+        }
+    }
+    out.report.complex_regions = out.complex.len();
+    Ok(out)
+}
+
+fn flatten_group(
+    list: &DisplayList,
+    members: &[usize],
+    bounds: &[Rect],
+    transparent: &[bool],
+    opts: &FlattenOptions,
+    out: &mut Flattened,
+) -> Result<(), FlattenError> {
+    let mut b = Builder::new(&list.inks);
+    let mut nodes = Vec::new();
+    for &i in members {
+        b.top = i;
+        if let Some(n) = b.node(&list.items[i], false)? {
+            nodes.push(n);
+        }
+    }
+    let whole = |out: &mut Flattened, path: BezPath, reason| {
+        out.complex.push(ComplexRegion { path, items: members.to_vec(), at: out.items.len(), whole: Some(reason) });
+        out.report.complex_groups.push(ComplexGroup { items: members.to_vec(), reason });
+    };
+    let regions = match geom::regions_with(&b.shapes, &b.clips, opts.sliver) {
+        Ok(r) => r,
+        Err(GeomError::Degenerate) => {
+            // Each member's box is clear of every other group's items.
+            let mut path = BezPath::new();
+            for &i in members {
+                if !bounds[i].is_nan() {
+                    path.extend(bounds[i].abs().path_elements(0.1));
+                }
+            }
+            whole(out, path, ComplexReason::Degenerate);
+            out.report.flattened += members.len();
+            return Ok(());
+        }
+        Err(e) => return Err(e.into()),
+    };
+    out.report.regions += regions.len();
+    if regions.len() > opts.max_regions {
+        let mut path = BezPath::new();
+        for r in &regions {
+            path.extend(r.path.iter());
+        }
+        whole(out, path, ComplexReason::TooManyRegions(regions.len()));
+        out.report.flattened += members.len();
+        return Ok(());
+    }
+
+    // Members drawn as they are, over the region fills of the others: opaque, with only kept
+    // members above them wherever they paint. Painting them in order over the composite of what
+    // is under them gives the same page, and text among them stays live text.
+    let kept = kept_members(members, transparent, &b.owners, &regions);
+    let is_kept = |s: usize| kept.binary_search(&b.owners[s]).is_ok();
+
+    // A region's look depends only on its visible sources: the last one that covers what is
+    // under it ([`Builder::covers`]) and those above it. Regions with the same visible sources
+    // are one area of one look, so they are written as one: art hidden under an opaque fill
+    // must not cut it into pieces, whose edges anti-aliasing viewers show (vectorcraft#2161).
+    let mut by_visible: HashMap<Vec<usize>, BezPath> = HashMap::new();
+    let mut order = Vec::new();
+    for r in regions {
+        // Kept members come last in a region's sources. The fill is the look of what is under
+        // them, also where one covers it: the region then joins its neighbors of that look
+        // instead of leaving a hole whose edge anti-aliasing viewers show.
+        let below = r.sources.iter().position(|&s| is_kept(s)).unwrap_or(r.sources.len());
+        if below == 0 {
+            continue;
+        }
+        let sources = &r.sources[..below];
+        let from = sources.iter().rposition(|&s| b.covers[s]).unwrap_or(0);
+        let visible = sources[from..].to_vec();
+        let path = oriented(r.path);
+        match by_visible.get_mut(&visible) {
+            Some(p) => p.extend(path),
+            None => {
+                order.push(visible.clone());
+                by_visible.insert(visible, path);
+            }
+        }
+    }
+
+    let mut complex = Vec::new();
+    let mut fills: Vec<(Option<usize>, FillItem)> = Vec::new();
+    for sources in order {
+        let Some(path) = by_visible.remove(&sources) else { continue };
+        let r = geom::Region { path, area: 0.0, sources };
+        if r.sources.iter().any(|&s| b.paints[s].is_none()) {
+            let mut items: Vec<usize> = r.sources.iter().map(|&s| b.owners[s]).collect();
+            items.dedup();
+            complex.push(ComplexRegion { path: r.path, items, at: 0, whole: None });
+            continue;
+        }
+        let c = Composer { sources: &r.sources, paints: &b.paints };
+        if nodes.iter().fold(0.0, |a, n| union(a, c.alpha(n))) < 0.5 / 255.0 {
+            continue;
+        }
+        // The page group composites over paper: no ink, opaque.
+        let paper = Px { c: vec![0.0; list.inks.len()], a: 1.0 };
+        let px = nodes.iter().fold(paper, |acc, n| c.draw(n, acc));
+        let top = r.sources.last().and_then(|&s| b.paints[s].as_ref());
+        let (color, overprint) = match top {
+            Some(t) if px.c.iter().zip(&t.value).all(|(a, b)| (a - b).abs() < 1e-4) => (t.color.clone(), t.overprint),
+            _ => (ink_color(&px.c, &list.inks), Overprint::default()),
+        };
+        let tag = r.sources.iter().rev().find_map(|&s| b.tags[s]);
+        fills.push((tag, FillItem { path: r.path, rule: FillRule::NonZero, paint: Paint::Solid(color), overprint }));
+    }
+    // Region fills are disjoint and nothing else of the page is under them, so they can be
+    // reordered: those showing tagged text go into one plain group per text.
+    out.report.fills += fills.len();
+    let mut tagged: Vec<Vec<Item>> = vec![Vec::new(); b.texts.len()];
+    for (tag, fill) in fills {
+        match tag.and_then(|t| tagged.get_mut(t)) {
+            Some(children) => children.push(Item::Fill(fill)),
+            None => out.items.push(Item::Fill(fill)),
+        }
+    }
+    for (text, children) in b.texts.into_iter().zip(tagged).filter(|(_, c)| !c.is_empty()) {
+        out.items.push(Item::Group(GroupItem {
+            opacity: 1.0,
+            blend: BlendMode::Normal,
+            isolated: false,
+            knockout: false,
+            clip: None,
+            mask: None,
+            actual_text: Some(text),
+            children,
+        }));
+    }
+    let at = out.items.len();
+    out.complex.extend(merge_touching(complex).into_iter().map(|c| ComplexRegion { at, ..c }));
+    for &i in &kept {
+        out.items.push(without_groups(&list.items[i]));
+    }
+    out.report.kept += kept.len();
+    out.report.flattened += members.len() - kept.len();
+    Ok(())
+}
+
+/// The members of a group that can be drawn as they are ([`flatten_group`]), ascending: not
+/// transparent, and in every region a member's shapes are in, only kept members are above it.
+fn kept_members(members: &[usize], transparent: &[bool], owners: &[usize], regions: &[geom::Region]) -> Vec<usize> {
+    let mut regions_of: HashMap<usize, Vec<usize>> = HashMap::new();
+    for (r, region) in regions.iter().enumerate() {
+        let mut last = None;
+        for &s in &region.sources {
+            let o = owners[s];
+            if last != Some(o) {
+                regions_of.entry(o).or_default().push(r);
+                last = Some(o);
+            }
+        }
+    }
+    // From the top down, so that a member's decision sees every member above it decided.
+    // `clear[r]`: every member decided so far that is in region `r` is kept.
+    let mut clear = vec![true; regions.len()];
+    let mut kept = Vec::new();
+    for &m in members.iter().rev() {
+        let rs = regions_of.get(&m).map_or(&[][..], Vec::as_slice);
+        let keep = !transparent[m] && rs.iter().all(|&r| clear[r]);
+        if keep {
+            kept.push(m);
+        } else {
+            for &r in rs {
+                clear[r] = false;
+            }
+        }
+    }
+    kept.reverse();
+    kept
+}
+
+/// `path` with its subpaths reversed when its signed area is negative. Faces of one look are
+/// written as one path; with one orientation, their shared edges cancel in an anti-aliasing
+/// rasterizer's coverage instead of leaving a seam.
+fn oriented(path: BezPath) -> BezPath {
+    if path.area() < 0.0 { path.reverse_subpaths() } else { path }
+}
+
+/// Complex regions whose boxes touch, merged, so that one image spans their shared edges. A
+/// merged region lists the items of all its parts: an item paints nothing in a part that
+/// doesn't list it, so rendering it there changes nothing.
+fn merge_touching(regions: Vec<ComplexRegion>) -> Vec<ComplexRegion> {
+    if regions.len() < 2 {
+        return regions;
+    }
+    let boxes: Vec<Rect> = regions.iter().map(|r| r.path.bounding_box().inflate(1e-6, 1e-6)).collect();
+    geom::overlap_groups(&boxes)
+        .into_iter()
+        .map(|g| {
+            let (mut path, mut items) = (BezPath::new(), Vec::new());
+            for i in g {
+                path.extend(regions[i].path.iter());
+                items.extend_from_slice(&regions[i].items);
+            }
+            items.sort_unstable();
+            items.dedup();
+            ComplexRegion { path, items, at: 0, whole: None }
+        })
+        .collect()
+}
+
+/// Composited ink values as a color: the inks with ink on them, or no ink on the process plates.
+fn ink_color(c: &[f32], inks: &InkSet) -> InkColor {
+    let mut tints: Vec<(InkId, f32)> = inks.iter().zip(c).map(|((id, _), v)| (id, unit(*v))).filter(|(_, v)| *v > 1e-6).collect();
+    if tints.is_empty() {
+        tints = Process::ALL.iter().map(|p| (InkId::process(*p), 0.0)).collect();
+    }
+    InkColor::Tints(tints)
+}
+
+fn bounds(item: &Item) -> Option<Rect> {
+    let path = |p: &BezPath| (!p.elements().is_empty()).then(|| p.bounding_box());
+    match item {
+        Item::Fill(f) => path(&f.path),
+        Item::Text(t) => path(&t.outlines),
+        Item::Image(im) => Some(im.transform.transform_rect_bbox(Rect::new(0.0, 0.0, 1.0, 1.0))),
+        Item::Group(g) => {
+            let inner = g.children.iter().filter_map(bounds).reduce(|a, b| a.union(b))?;
+            match g.clip.as_ref().and_then(path) {
+                Some(clip) => Some(inner.intersect(clip)),
+                None if g.clip.is_some() => None,
+                None => Some(inner),
+            }
+        }
+    }
+}
+
+/// Whether `item` paints differently composited than painted opaquely in order.
+fn is_transparent(item: &Item) -> bool {
+    match item {
+        Item::Fill(_) | Item::Text(_) => false,
+        Item::Image(im) => im.smask.is_some(),
+        Item::Group(g) => {
+            g.opacity < 1.0
+                || g.blend != BlendMode::Normal
+                || g.mask.is_some()
+                || ((g.isolated || g.knockout) && g.children.iter().any(overprints))
+                || g.children.iter().any(is_transparent)
+        }
+    }
+}
+
+/// A kept item with its isolated and knockout groups made plain groups: without transparency
+/// inside ([`is_transparent`]), they paint the same, and a flattened page has no transparency
+/// groups.
+fn without_groups(item: &Item) -> Item {
+    match item {
+        Item::Group(g) => {
+            Item::Group(GroupItem { isolated: false, knockout: false, children: g.children.iter().map(without_groups).collect(), ..g.clone() })
+        }
+        other => other.clone(),
+    }
+}
+
+fn overprints(item: &Item) -> bool {
+    match item {
+        Item::Fill(f) => f.overprint.fill,
+        Item::Text(t) => t.overprint.fill,
+        Item::Image(im) => im.overprint.fill,
+        Item::Group(g) => g.children.iter().any(overprints),
+    }
+}
+
+/// A flat paint as the compositor uses it.
+#[derive(Debug)]
+struct Source {
+    /// One value per ink, `0.0..=1.0`; unnamed inks 0.
+    value: Vec<f32>,
+    /// With overprint: which inks the paint names. `None` when it names all of them.
+    named: Option<Vec<bool>>,
+    color: InkColor,
+    overprint: Overprint,
+}
+
+impl Source {
+    /// Fills, outlined strokes included, overprint by `overprint.fill`. An overprinting paint
+    /// names the inks it lists; with nonzero overprint mode a process-only color (DeviceCMYK)
+    /// leaves out its zero components too. `None` for the `None` colorant, which paints nothing.
+    fn new(color: &InkColor, overprint: Overprint, inks: &InkSet) -> Result<Option<Self>, FlattenError> {
+        let n = inks.len();
+        let (value, named) = match color {
+            InkColor::None => return Ok(None),
+            InkColor::All(t) => (vec![unit(*t); n], vec![true; n]),
+            InkColor::Tints(tints) => {
+                let (mut value, mut named) = (vec![0.0; n], vec![false; n]);
+                for &(id, t) in tints {
+                    let (v, k) = value.get_mut(id.index()).zip(named.get_mut(id.index())).ok_or(FlattenError::UnknownInk(id))?;
+                    *v = 1.0 - (1.0 - *v) * (1.0 - unit(t));
+                    *k = true;
+                }
+                if overprint.nonzero && color.as_cmyk().is_some() {
+                    for (k, v) in named.iter_mut().zip(&value).take(4) {
+                        *k &= *v > 0.0;
+                    }
+                }
+                (value, named)
+            }
+        };
+        let named = overprint.fill.then_some(named);
+        Ok(Some(Self { value, named, color: color.clone(), overprint }))
+    }
+}
+
+enum Node {
+    /// A shape and its paint (`Builder::paints`).
+    Leaf(usize),
+    Group(GroupNode),
+}
+
+struct GroupNode {
+    opacity: f32,
+    blend: BlendMode,
+    isolated: bool,
+    knockout: bool,
+    /// [`is_plain`].
+    plain: bool,
+    /// The shapes of every leaf inside, which come in this range by construction.
+    shapes: Range<usize>,
+    children: Vec<Node>,
+}
+
+impl GroupNode {
+    /// The children, with those of plain groups ([`is_plain`]) in their place, recursively.
+    fn elements(self) -> Vec<Node> {
+        let mut out = Vec::with_capacity(self.children.len());
+        for c in self.children {
+            match c {
+                Node::Group(g) if g.plain => out.extend(g.elements()),
+                n => out.push(n),
+            }
+        }
+        out
+    }
+}
+
+/// A group that only clips: it composites nothing of its own.
+fn is_plain(item: &Item) -> bool {
+    matches!(item, Item::Group(g) if g.opacity >= 1.0 && g.blend == BlendMode::Normal && !g.isolated && !g.knockout && g.mask.is_none())
+}
+
+/// Turns items into the region sweep's shapes and the compositor's tree.
+struct Builder<'a> {
+    inks: &'a InkSet,
+    shapes: Vec<Shape>,
+    clips: Vec<ClipPath>,
+    clip_stack: Vec<usize>,
+    /// Per shape: its flat paint, `None` for art without one (gradients, images, masked art).
+    paints: Vec<Option<Source>>,
+    /// Per shape: the top-level item it is part of.
+    owners: Vec<usize>,
+    top: usize,
+    /// Per shape: the text it shows, an index into `texts`. The outermost source wins: a group's
+    /// `actual_text`, else a text run's own text.
+    tags: Vec<Option<usize>>,
+    texts: Vec<String>,
+    tag: Option<usize>,
+    /// Per shape: it paints its color over whatever is under it, so nothing under it shows.
+    covers: Vec<bool>,
+    /// Every open group composites at full opacity with Normal blending.
+    plain_path: bool,
+    /// Some open group is a knockout group.
+    knockout_path: bool,
+}
+
+impl<'a> Builder<'a> {
+    fn new(inks: &'a InkSet) -> Self {
+        Self {
+            inks,
+            shapes: Vec::new(),
+            clips: Vec::new(),
+            clip_stack: Vec::new(),
+            paints: Vec::new(),
+            owners: Vec::new(),
+            top: 0,
+            tags: Vec::new(),
+            texts: Vec::new(),
+            tag: None,
+            covers: Vec::new(),
+            plain_path: true,
+            knockout_path: false,
+        }
+    }
+
+    fn leaf(&mut self, path: BezPath, rule: FillRule, paint: Option<Source>) -> Option<Node> {
+        if path.elements().is_empty() {
+            return None;
+        }
+        self.shapes.push(Shape::new(path, rule).clipped(self.clip_stack.iter().copied()));
+        // An opaque paint without overprint in groups that composite it unchanged (an isolated
+        // group too: the paint replaces its backdrop either way). Not in a knockout group: a later
+        // element there composites over the group's backdrop, so what is under the paint shows.
+        self.covers.push(self.plain_path && !self.knockout_path && paint.as_ref().is_some_and(|p| p.named.is_none()));
+        self.paints.push(paint);
+        self.owners.push(self.top);
+        self.tags.push(self.tag);
+        Some(Node::Leaf(self.shapes.len() - 1))
+    }
+
+    fn painted(&mut self, path: &BezPath, rule: FillRule, paint: &Paint, overprint: Overprint, masked: bool) -> Result<Option<Node>, FlattenError> {
+        let source = match paint {
+            Paint::Solid(color) => match Source::new(color, overprint, self.inks)? {
+                Some(s) => (!masked).then_some(s),
+                None => return Ok(None),
+            },
+            Paint::Gradient { .. } => None,
+        };
+        Ok(self.leaf(path.clone(), rule, source))
+    }
+
+    /// Makes `text` the current tag unless one is set; returns the tag to restore.
+    fn push_tag(&mut self, text: Option<&str>) -> Option<usize> {
+        let outer = self.tag;
+        if let (None, Some(text)) = (outer, text) {
+            self.texts.push(text.to_string());
+            self.tag = Some(self.texts.len() - 1);
+        }
+        outer
+    }
+
+    fn node(&mut self, item: &Item, masked: bool) -> Result<Option<Node>, FlattenError> {
+        match item {
+            Item::Fill(f) => self.painted(&f.path, f.rule, &f.paint, f.overprint, masked),
+            Item::Text(t) => {
+                let outer = self.push_tag(t.text.as_deref());
+                let node = self.painted(&t.outlines, FillRule::NonZero, &t.paint, t.overprint, masked);
+                self.tag = outer;
+                node
+            }
+            Item::Image(im) => Ok(self.leaf(im.transform * Rect::new(0.0, 0.0, 1.0, 1.0).to_path(0.1), FillRule::NonZero, None)),
+            Item::Group(g) => {
+                let start = self.shapes.len();
+                let outer = self.push_tag(g.actual_text.as_deref());
+                if let Some(clip) = &g.clip {
+                    self.clip_stack.push(self.clips.len());
+                    self.clips.push(ClipPath { path: clip.clone(), rule: FillRule::NonZero });
+                }
+                let masked = masked || g.mask.is_some();
+                let (plain_path, knockout_path) = (self.plain_path, self.knockout_path);
+                self.plain_path &= g.opacity >= 1.0 && g.blend == BlendMode::Normal;
+                self.knockout_path |= g.knockout;
+                let mut children = Vec::with_capacity(g.children.len());
+                for c in &g.children {
+                    match self.node(c, masked)? {
+                        // A clip (or a plain form) is not an element of a knockout group: the
+                        // elements inside it are, and knock each other out.
+                        Some(Node::Group(inner)) if g.knockout && is_plain(c) => children.extend(inner.elements()),
+                        Some(n) => children.push(n),
+                        None => {}
+                    }
+                }
+                if g.clip.is_some() {
+                    self.clip_stack.pop();
+                }
+                (self.plain_path, self.knockout_path) = (plain_path, knockout_path);
+                self.tag = outer;
+                Ok((!children.is_empty()).then(|| {
+                    Node::Group(GroupNode {
+                        opacity: unit(g.opacity),
+                        blend: g.blend,
+                        isolated: g.isolated,
+                        knockout: g.knockout,
+                        plain: is_plain(item),
+                        shapes: start..self.shapes.len(),
+                        children,
+                    })
+                }))
+            }
+        }
+    }
+}
+
+/// A color and its alpha at one point: one subtractive value per ink (0 = no ink).
+#[derive(Clone, Debug)]
+struct Px {
+    c: Vec<f32>,
+    a: f32,
+}
+
+/// Composites the items over one region (ISO 32000-2 §11.3–11.4). Shapes are 0 or 1 across a
+/// region, so a knockout group shows its last element that covers it.
+struct Composer<'a> {
+    /// The shapes covering the region, ascending.
+    sources: &'a [usize],
+    paints: &'a [Option<Source>],
+}
+
+impl Composer<'_> {
+    fn covers(&self, n: &Node) -> bool {
+        match n {
+            Node::Leaf(s) => self.sources.binary_search(s).is_ok(),
+            Node::Group(g) => {
+                let i = self.sources.partition_point(|&s| s < g.shapes.start);
+                self.sources.get(i).is_some_and(|&s| s < g.shapes.end)
+            }
+        }
+    }
+
+    /// `n`'s alpha as an element of its parent group.
+    fn alpha(&self, n: &Node) -> f32 {
+        match n {
+            _ if !self.covers(n) => 0.0,
+            Node::Leaf(_) => 1.0,
+            Node::Group(g) => g.opacity * self.group_alpha(g),
+        }
+    }
+
+    /// The group's own alpha, without its backdrop (§11.4.8, α_gn).
+    fn group_alpha(&self, g: &GroupNode) -> f32 {
+        if g.knockout {
+            g.children.iter().rev().find(|c| self.covers(c)).map_or(0.0, |c| self.alpha(c))
+        } else {
+            g.children.iter().fold(0.0, |a, c| union(a, self.alpha(c)))
+        }
+    }
+
+    /// `n` composited over `acc`.
+    fn draw(&self, n: &Node, acc: Px) -> Px {
+        if !self.covers(n) {
+            return acc;
+        }
+        let g = match n {
+            Node::Leaf(s) => match &self.paints[*s] {
+                Some(p) => return composite(&acc, &p.value, p.named.as_deref(), 1.0, BlendMode::Normal),
+                None => return acc,
+            },
+            Node::Group(g) => g,
+        };
+        if g.opacity >= 1.0 && g.blend == BlendMode::Normal && !g.isolated && !g.knockout {
+            return g.children.iter().fold(acc, |acc, c| self.draw(c, acc));
+        }
+        let init = if g.isolated { Px { c: vec![0.0; acc.c.len()], a: 0.0 } } else { acc.clone() };
+        let cn = if g.knockout {
+            match g.children.iter().rev().find(|c| self.covers(c)) {
+                Some(c) => self.draw(c, init.clone()),
+                None => init.clone(),
+            }
+        } else {
+            g.children.iter().fold(init.clone(), |acc, c| self.draw(c, acc))
+        };
+        let ag = self.group_alpha(g);
+        if ag <= 0.0 {
+            return acc;
+        }
+        let c = if g.isolated {
+            cn.c
+        } else {
+            // Take the backdrop's share out of a non-isolated group's result (§11.4.8).
+            let k = init.a / ag - init.a;
+            cn.c.iter().zip(&init.c).map(|(n, b)| unit(n + (n - b) * k)).collect()
+        };
+        composite(&acc, &c, None, ag * g.opacity, g.blend)
+    }
+}
+
+/// `s` with alpha `a_s` composited over `b` with blend mode `mode` (§11.3.3). Inks that `named`
+/// leaves out keep the backdrop's value (`CompatibleOverprint`, §11.7.4.3).
+fn composite(b: &Px, s: &[f32], named: Option<&[bool]>, a_s: f32, mode: BlendMode) -> Px {
+    let a_r = union(b.a, a_s);
+    if a_r <= 0.0 {
+        return b.clone();
+    }
+    let mixed = blend(mode, &b.c, s);
+    let t = a_s / a_r;
+    let c = (0..b.c.len())
+        .map(|i| {
+            let (cb, cs) = (b.c[i], s[i]);
+            if named.is_some_and(|n| !n[i]) { cb } else { unit((1.0 - t) * cb + t * ((1.0 - b.a) * cs + b.a * mixed[i])) }
+        })
+        .collect();
+    Px { c, a: a_r }
+}
+
+/// B(c_b, c_s) per ink, on subtractive values: the additive formulas on complemented values
+/// (§11.3.5). Non-separable modes blend C, M and Y as RGB, keep the backdrop's K (the source's
+/// for Luminosity), and act as Normal on spot inks (§11.3.5.3).
+fn blend(mode: BlendMode, b: &[f32], s: &[f32]) -> Vec<f32> {
+    if mode == BlendMode::Normal {
+        return s.to_vec();
+    }
+    if mode.is_non_separable() {
+        let mut out = s.to_vec();
+        if let ([b0, b1, b2, bk, ..], [s0, s1, s2, sk, ..]) = (b, s) {
+            let m = non_separable(mode, [1.0 - b0, 1.0 - b1, 1.0 - b2], [1.0 - s0, 1.0 - s1, 1.0 - s2]);
+            for (o, v) in out.iter_mut().zip(m) {
+                *o = 1.0 - v;
+            }
+            out[3] = if mode == BlendMode::Luminosity { *sk } else { *bk };
+        }
+        return out;
+    }
+    let f = separable(mode);
+    b.iter().zip(s).map(|(b, s)| 1.0 - f(1.0 - unit(*b), 1.0 - unit(*s))).collect()
+}
+
+fn separable(mode: BlendMode) -> fn(f32, f32) -> f32 {
+    use BlendMode as B;
+    match mode {
+        B::Multiply => |b, s| b * s,
+        B::Screen => screen,
+        B::Overlay => |b, s| hard_light(s, b),
+        B::Darken => f32::min,
+        B::Lighten => f32::max,
+        B::ColorDodge => |b, s| {
+            if b <= 0.0 {
+                0.0
+            } else if s >= 1.0 {
+                1.0
+            } else {
+                (b / (1.0 - s)).min(1.0)
+            }
+        },
+        B::ColorBurn => |b, s| {
+            if b >= 1.0 {
+                1.0
+            } else if s <= 0.0 {
+                0.0
+            } else {
+                1.0 - ((1.0 - b) / s).min(1.0)
+            }
+        },
+        B::HardLight => hard_light,
+        B::SoftLight => |b, s| {
+            if s <= 0.5 {
+                b - (1.0 - 2.0 * s) * b * (1.0 - b)
+            } else {
+                let d = if b <= 0.25 { ((16.0 * b - 12.0) * b + 4.0) * b } else { b.sqrt() };
+                b + (2.0 * s - 1.0) * (d - b)
+            }
+        },
+        B::Difference => |b, s| (b - s).abs(),
+        B::Exclusion => |b, s| b + s - 2.0 * b * s,
+        B::Normal | B::Hue | B::Saturation | B::Color | B::Luminosity => |_, s| s,
+    }
+}
+
+fn non_separable(mode: BlendMode, b: [f32; 3], s: [f32; 3]) -> [f32; 3] {
+    match mode {
+        BlendMode::Hue => set_lum(set_sat(s, sat(b)), lum(b)),
+        BlendMode::Saturation => set_lum(set_sat(b, sat(s)), lum(b)),
+        BlendMode::Color => set_lum(s, lum(b)),
+        BlendMode::Luminosity => set_lum(b, lum(s)),
+        _ => s,
+    }
+}
+
+fn screen(b: f32, s: f32) -> f32 {
+    b + s - b * s
+}
+
+fn hard_light(b: f32, s: f32) -> f32 {
+    if s <= 0.5 { b * 2.0 * s } else { screen(b, 2.0 * s - 1.0) }
+}
+
+fn lum(c: [f32; 3]) -> f32 {
+    0.3 * c[0] + 0.59 * c[1] + 0.11 * c[2]
+}
+
+fn sat(c: [f32; 3]) -> f32 {
+    c[0].max(c[1]).max(c[2]) - c[0].min(c[1]).min(c[2])
+}
+
+/// `c` moved back into gamut keeping its luminance. A gray is clamped instead of scaled by 0/0.
+fn clip_color(c: [f32; 3]) -> [f32; 3] {
+    let l = lum(c);
+    let (n, x) = (c[0].min(c[1]).min(c[2]), c[0].max(c[1]).max(c[2]));
+    let mut c = c;
+    if n < 0.0 {
+        c = if l - n > f32::EPSILON { c.map(|v| l + (v - l) * l / (l - n)) } else { c.map(|v| v.max(0.0)) };
+    }
+    if x > 1.0 {
+        c = if x - l > f32::EPSILON { c.map(|v| l + (v - l) * (1.0 - l) / (x - l)) } else { c.map(|v| v.min(1.0)) };
+    }
+    c
+}
+
+fn set_lum(c: [f32; 3], l: f32) -> [f32; 3] {
+    let d = l - lum(c);
+    clip_color(c.map(|v| v + d))
+}
+
+fn set_sat(c: [f32; 3], s: f32) -> [f32; 3] {
+    let (n, x) = (c[0].min(c[1]).min(c[2]), c[0].max(c[1]).max(c[2]));
+    if x <= n {
+        return [0.0; 3];
+    }
+    c.map(|v| (v - n) * s / (x - n))
+}
+
+fn union(a: f32, b: f32) -> f32 {
+    a + b - a * b
+}
+
+fn unit(v: f32) -> f32 {
+    if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use kurbo::{Affine, Point};
+
+    use super::*;
+    use crate::flatten::{GradientGeometry, GroupItem, PlacedGlyph, TextFont, TextItem};
+    use crate::ink::{Alternate, Ink, Spot};
+
+    const C: InkId = InkId::process(Process::Cyan);
+    const M: InkId = InkId::process(Process::Magenta);
+    const Y: InkId = InkId::process(Process::Yellow);
+    const K: InkId = InkId::process(Process::Black);
+
+    fn fill(r: Rect, tints: &[(InkId, f32)], overprint: Overprint) -> Item {
+        Item::Fill(FillItem { path: r.to_path(0.1), rule: FillRule::NonZero, paint: Paint::Solid(InkColor::Tints(tints.to_vec())), overprint })
+    }
+
+    fn solid(r: Rect, tints: &[(InkId, f32)]) -> Item {
+        fill(r, tints, Overprint::default())
+    }
+
+    fn group(opacity: f32, blend: BlendMode, children: Vec<Item>) -> GroupItem {
+        GroupItem { opacity, blend, isolated: false, knockout: false, clip: None, mask: None, actual_text: None, children }
+    }
+
+    fn list(inks: InkSet, items: Vec<Item>) -> DisplayList {
+        DisplayList { page: Rect::new(0.0, 0.0, 600.0, 800.0), inks, items }
+    }
+
+    fn flat(list: &DisplayList) -> Flattened {
+        flatten(list, &FlattenOptions::default()).unwrap()
+    }
+
+    /// The fill painting `(x, y)` and its tint of each of `inks`.
+    fn at<'a>(f: &'a Flattened, x: f64, y: f64, inks: &[InkId]) -> (&'a FillItem, Vec<f32>) {
+        let p = Point::new(x, y);
+        let hit = f.items.iter().rev().find_map(|i| match i {
+            Item::Fill(fi) if fi.path.winding(p) != 0 => Some(fi),
+            _ => None,
+        });
+        let fi = hit.unwrap_or_else(|| panic!("nothing paints {p:?}"));
+        let Paint::Solid(InkColor::Tints(t)) = &fi.paint else { panic!("{:?}", fi.paint) };
+        let tint = |id: InkId| t.iter().find(|(i, _)| *i == id).map_or(0.0, |(_, v)| (v * 1000.0).round() / 1000.0);
+        (fi, inks.iter().map(|&id| tint(id)).collect())
+    }
+
+    #[test]
+    fn half_black_over_cyan_composites_per_ink() {
+        let l = list(
+            InkSet::new(),
+            vec![
+                solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)]),
+                Item::Group(group(0.5, BlendMode::Normal, vec![solid(Rect::new(50.0, 0.0, 150.0, 100.0), &[(K, 1.0)])])),
+            ],
+        );
+        let f = flat(&l);
+        assert_eq!(at(&f, 75.0, 50.0, &[C, M, Y, K]).1, [0.5, 0.0, 0.0, 0.5]);
+        assert_eq!(at(&f, 25.0, 50.0, &[C, K]).1, [1.0, 0.0]);
+        assert_eq!(at(&f, 125.0, 50.0, &[C, K]).1, [0.0, 0.5]);
+        assert_eq!((f.report.kept, f.report.flattened, f.report.regions, f.report.fills), (0, 2, 3, 3));
+        assert!(f.complex.is_empty());
+    }
+
+    #[test]
+    fn multiply_adds_spot_inks_and_non_separable_modes_are_normal_on_spots() {
+        let mut inks = InkSet::new();
+        let spot = |name: &str| Ink::Spot(Spot { name: name.into(), alternate: Alternate::Cmyk([0.0, 0.3, 1.0, 0.0]), solidity: None });
+        let gold = inks.add(spot("Gold")).unwrap();
+        let silver = inks.add(spot("Silver")).unwrap();
+        let scene = |blend| {
+            list(
+                inks.clone(),
+                vec![
+                    solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(gold, 0.5)]),
+                    Item::Group(group(1.0, blend, vec![solid(Rect::new(50.0, 0.0, 150.0, 100.0), &[(gold, 0.4), (silver, 0.6)])])),
+                ],
+            )
+        };
+        let f = flat(&scene(BlendMode::Multiply));
+        assert_eq!(at(&f, 75.0, 50.0, &[gold, silver, K]).1, [0.7, 0.6, 0.0]);
+        let f = flat(&scene(BlendMode::Hue));
+        assert_eq!(at(&f, 75.0, 50.0, &[gold, silver, K]).1, [0.4, 0.6, 0.0]);
+    }
+
+    #[test]
+    fn overprint_keeps_the_inks_a_paint_leaves_out() {
+        let op = Overprint { fill: true, ..Overprint::default() };
+        let opm = Overprint { nonzero: true, ..op };
+        let cyan = || solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)]);
+        // A 50% yellow strip over both, so that neither is kept as it is.
+        let veil = || Item::Group(group(0.5, BlendMode::Normal, vec![solid(Rect::new(0.0, 90.0, 150.0, 100.0), &[(Y, 1.0)])]));
+        let top = |tints: &[(InkId, f32)], o| list(InkSet::new(), vec![cyan(), fill(Rect::new(50.0, 0.0, 150.0, 100.0), tints, o), veil()]);
+
+        let f = flat(&top(&[(K, 1.0)], op));
+        let (fi, v) = at(&f, 75.0, 50.0, &[C, M, Y, K]);
+        assert_eq!(v, [1.0, 0.0, 0.0, 1.0], "K100 overprints cyan");
+        assert_eq!(fi.overprint, Overprint::default(), "the composite needs no overprint");
+        let (fi, _) = at(&f, 125.0, 50.0, &[K]);
+        assert_eq!((fi.paint.clone(), fi.overprint), (Paint::Solid(InkColor::Tints(vec![(K, 1.0)])), op), "a paint shown as it is stays");
+        assert_eq!(at(&flat(&top(&[(K, 1.0)], Overprint::default())), 75.0, 50.0, &[C, K]).1, [0.0, 1.0], "knocks out");
+
+        let magenta = [(C, 0.0), (M, 1.0), (Y, 0.0), (K, 0.0)];
+        assert_eq!(at(&flat(&top(&magenta, opm)), 75.0, 50.0, &[C, M]).1, [1.0, 1.0], "OPM 1: a zero component keeps the backdrop");
+        assert_eq!(at(&flat(&top(&magenta, op)), 75.0, 50.0, &[C, M]).1, [0.0, 1.0], "OPM 0: zero is a value");
+    }
+
+    #[test]
+    fn knockout_group_replaces_what_is_under_the_top_element() {
+        let scene = |knockout| {
+            let half_magenta = Item::Group(group(0.5, BlendMode::Normal, vec![solid(Rect::new(50.0, 0.0, 150.0, 100.0), &[(M, 1.0)])]));
+            let g =
+                GroupItem { knockout, ..group(1.0, BlendMode::Normal, vec![solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)]), half_magenta]) };
+            list(InkSet::new(), vec![Item::Group(g)])
+        };
+        assert_eq!(at(&flat(&scene(true)), 75.0, 50.0, &[C, M]).1, [0.0, 0.5]);
+        assert_eq!(at(&flat(&scene(false)), 75.0, 50.0, &[C, M]).1, [0.5, 0.5]);
+    }
+
+    #[test]
+    fn knockout_group_shows_its_backdrop_under_a_later_element() {
+        let half_yellow = Item::Group(group(0.5, BlendMode::Normal, vec![solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(Y, 1.0)])]));
+        let g =
+            GroupItem { knockout: true, ..group(1.0, BlendMode::Normal, vec![solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(M, 1.0)]), half_yellow]) };
+        let l = list(InkSet::new(), vec![solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)]), Item::Group(g)]);
+        assert_eq!(at(&flat(&l), 50.0, 50.0, &[C, M, Y]).1, [0.5, 0.0, 0.5]);
+    }
+
+    #[test]
+    fn knockout_reaches_elements_inside_a_clip() {
+        // A form's bounding box arrives as a clip around the knockout group's elements.
+        let half_magenta = Item::Group(group(0.5, BlendMode::Normal, vec![solid(Rect::new(50.0, 0.0, 150.0, 100.0), &[(M, 1.0)])]));
+        let clip = GroupItem {
+            clip: Some(Rect::new(0.0, 0.0, 150.0, 100.0).to_path(0.1)),
+            ..group(1.0, BlendMode::Normal, vec![solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)]), half_magenta])
+        };
+        let g = GroupItem { knockout: true, ..group(1.0, BlendMode::Normal, vec![Item::Group(clip)]) };
+        assert_eq!(at(&flat(&list(InkSet::new(), vec![Item::Group(g)])), 75.0, 50.0, &[C, M]).1, [0.0, 0.5]);
+    }
+
+    #[test]
+    fn isolated_group_blends_without_the_backdrop() {
+        let scene = |isolated| {
+            let multiply = Item::Group(group(1.0, BlendMode::Multiply, vec![solid(Rect::new(50.0, 0.0, 150.0, 100.0), &[(M, 1.0)])]));
+            let outer = GroupItem { isolated, ..group(1.0, BlendMode::Normal, vec![multiply]) };
+            list(InkSet::new(), vec![solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)]), Item::Group(outer)])
+        };
+        assert_eq!(at(&flat(&scene(false)), 75.0, 50.0, &[C, M]).1, [1.0, 1.0]);
+        assert_eq!(at(&flat(&scene(true)), 75.0, 50.0, &[C, M]).1, [0.0, 1.0]);
+    }
+
+    #[test]
+    fn opaque_items_away_from_transparency_and_above_it_stay_as_they_are() {
+        let font = Arc::new(TextFont { data: Arc::new(vec![0_u8; 8]), index: 0, key: 7 });
+        let text = |x: f64| {
+            Item::Text(TextItem {
+                font: Some(font.clone()),
+                size: 12.0,
+                transform: Affine::translate((x, 50.0)),
+                glyphs: vec![PlacedGlyph { id: 3, origin: Point::ZERO, text: 0..1 }],
+                text: Some("A".into()),
+                outlines: Rect::new(x, 40.0, x + 8.0, 50.0).to_path(0.1),
+                paint: Paint::Solid(InkColor::Tints(vec![(K, 1.0)])),
+                overprint: Overprint { fill: true, ..Overprint::default() },
+            })
+        };
+        let far = solid(Rect::new(300.0, 300.0, 400.0, 400.0), &[(M, 1.0)]);
+        let l = list(
+            InkSet::new(),
+            vec![
+                far.clone(),
+                text(500.0),
+                solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)]),
+                Item::Group(group(0.5, BlendMode::Normal, vec![solid(Rect::new(50.0, 0.0, 150.0, 100.0), &[(K, 1.0)])])),
+                text(60.0),
+            ],
+        );
+        let f = flat(&l);
+        assert_eq!(f.items[0], far);
+        assert_eq!(f.items[1], l.items[1]);
+        assert_eq!(f.items.last(), Some(&l.items[4]), "text above the transparency, painted last");
+        let Some(Item::Text(t)) = f.items.last() else { panic!() };
+        assert!(Arc::ptr_eq(t.font.as_ref().unwrap(), &font));
+        assert_eq!((f.report.kept, f.report.flattened, f.report.fills), (3, 2, 3));
+    }
+
+    #[test]
+    fn opaque_members_with_no_transparency_above_them_stay_as_they_are() {
+        // A background frame, body text on it, and a transparent object over the frame only: the
+        // boxes put all three in one group, but only the frame is under transparency.
+        let text = solid(Rect::new(10.0, 10.0, 50.0, 20.0), &[(K, 1.0)]);
+        let veiled = |items: Vec<Item>| {
+            let mut items = items;
+            items.push(Item::Group(group(0.5, BlendMode::Normal, vec![solid(Rect::new(100.0, 100.0, 150.0, 150.0), &[(M, 1.0)])])));
+            list(InkSet::new(), items)
+        };
+        let f = flat(&veiled(vec![solid(Rect::new(0.0, 0.0, 200.0, 200.0), &[(C, 0.2)]), text.clone()]));
+        assert_eq!((f.report.kept, f.report.flattened), (1, 2));
+        assert_eq!(f.items.last(), Some(&text), "the text is drawn as it is, over the fills");
+        assert_eq!(at(&f, 125.0, 125.0, &[C, M]).1, [0.1, 0.5]);
+        assert_eq!(at(&f, 5.0, 5.0, &[C, K]).1, [0.2, 0.0]);
+        // Under the text, the frame's fill goes on.
+        let fills = Flattened { items: f.items[..f.items.len() - 1].to_vec(), ..f.clone() };
+        assert_eq!(at(&fills, 30.0, 15.0, &[C, K]).1, [0.2, 0.0]);
+
+        // Under an opaque rectangle that is itself under the transparency, the text is flattened.
+        let over = solid(Rect::new(40.0, 0.0, 120.0, 120.0), &[(Y, 1.0)]);
+        let f = flat(&veiled(vec![text.clone(), over]));
+        assert_eq!((f.report.kept, f.report.flattened), (0, 3));
+        assert_eq!(at(&f, 20.0, 15.0, &[Y, K]).1, [0.0, 1.0]);
+        assert_eq!(at(&f, 45.0, 15.0, &[Y, K]).1, [1.0, 0.0]);
+    }
+
+    #[test]
+    fn art_hidden_under_an_opaque_fill_does_not_cut_it() {
+        // K bars under a cyan fill, one where a half magenta overlaps it: three looks, three fills.
+        let half_magenta = Item::Group(group(0.5, BlendMode::Normal, vec![solid(Rect::new(50.0, 0.0, 150.0, 100.0), &[(M, 1.0)])]));
+        let l = list(
+            InkSet::new(),
+            vec![
+                solid(Rect::new(10.0, 10.0, 20.0, 90.0), &[(K, 1.0)]),
+                solid(Rect::new(60.0, 10.0, 70.0, 90.0), &[(K, 1.0)]),
+                solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)]),
+                half_magenta,
+            ],
+        );
+        let f = flat(&l);
+        assert_eq!(f.report.fills, 3, "{:?}", f.items);
+        assert_eq!(at(&f, 15.0, 50.0, &[C, K]).1, [1.0, 0.0]);
+        assert_eq!(at(&f, 65.0, 50.0, &[C, M, K]).1, [0.5, 0.5, 0.0]);
+    }
+
+    #[test]
+    fn kept_isolated_and_knockout_groups_come_back_plain() {
+        // A placed page: an isolated group of opaque art, away from any transparency.
+        let inner = GroupItem { knockout: true, ..group(1.0, BlendMode::Normal, vec![solid(Rect::new(0.0, 0.0, 10.0, 10.0), &[(C, 1.0)])]) };
+        let placed = GroupItem { isolated: true, ..group(1.0, BlendMode::Normal, vec![Item::Group(inner)]) };
+        let f = flat(&list(InkSet::new(), vec![Item::Group(placed)]));
+        let Some(Item::Group(g)) = f.items.first() else { panic!("{:?}", f.items) };
+        let Some(Item::Group(inner)) = g.children.first() else { panic!("{g:?}") };
+        assert!(!g.isolated && !inner.knockout);
+    }
+
+    #[test]
+    fn gradients_and_crowded_groups_go_to_complex() {
+        let gradient = Item::Fill(FillItem {
+            path: Rect::new(50.0, 0.0, 150.0, 100.0).to_path(0.1),
+            rule: FillRule::NonZero,
+            paint: Paint::Gradient {
+                stops: vec![(0.0, InkColor::Tints(vec![(C, 0.0)])), (1.0, InkColor::Tints(vec![(C, 1.0)]))],
+                geometry: GradientGeometry::Axial {
+                    start: Point::new(50.0, 0.0),
+                    end: Point::new(150.0, 0.0),
+                    extend: [true; 2],
+                    transform: Affine::IDENTITY,
+                },
+            },
+            overprint: Overprint::default(),
+        });
+        let l = list(
+            InkSet::new(),
+            vec![
+                solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(M, 1.0)]),
+                Item::Group(group(0.5, BlendMode::Normal, vec![gradient])),
+                solid(Rect::new(140.0, 0.0, 200.0, 100.0), &[(Y, 1.0)]),
+            ],
+        );
+        let f = flat(&l);
+        assert_eq!(f.report.complex_regions, 1, "touching regions merge: {:?}", f.complex);
+        let both = f.complex.iter().find(|c| c.path.winding(Point::new(75.0, 50.0)) != 0).unwrap();
+        assert_eq!(both.items, [0, 1]);
+        assert_eq!(both.at, f.items.len() - 1, "before the yellow kept on top");
+        assert_eq!(at(&f, 25.0, 50.0, &[M]).1, [1.0]);
+
+        let f = flatten(&l, &FlattenOptions { max_regions: 2, ..FlattenOptions::default() }).unwrap();
+        assert_eq!(f.report.complex_groups, [ComplexGroup { items: vec![0, 1], reason: ComplexReason::TooManyRegions(3) }]);
+        assert_eq!((f.complex.len(), f.items.len()), (1, 1));
+    }
+
+    #[test]
+    fn flattened_fills_keep_the_actual_text_they_show() {
+        let tagged = GroupItem {
+            actual_text: Some("fi".into()),
+            ..group(1.0, BlendMode::Normal, vec![solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)])])
+        };
+        let veil = group(0.5, BlendMode::Normal, vec![solid(Rect::new(50.0, 0.0, 150.0, 100.0), &[(K, 1.0)])]);
+        let f = flat(&list(InkSet::new(), vec![Item::Group(tagged), Item::Group(veil)]));
+        let groups: Vec<&GroupItem> = f
+            .items
+            .iter()
+            .filter_map(|i| match i {
+                Item::Group(g) => Some(g),
+                _ => None,
+            })
+            .collect();
+        assert_eq!(groups.len(), 1, "{:?}", f.items);
+        assert_eq!(groups[0].actual_text.as_deref(), Some("fi"));
+        assert_eq!(groups[0].children.len(), 2, "the cyan alone and under the veil");
+        assert_eq!((f.items.len(), f.report.fills), (2, 3));
+        assert!(!is_transparent(&f.items[1]));
+    }
+}
diff --git a/crates/prepress/src/flatten/document.rs b/crates/prepress/src/flatten/document.rs
new file mode 100644
index 00000000..0c0b31f4
--- /dev/null
+++ b/crates/prepress/src/flatten/document.rs
@@ -0,0 +1,387 @@
+//! [`flatten_document`]: every page of a PDF flattened into one PDF.
+//!
+//! - Output intent: written once, the first flattened page's as [`flatten_page`] picks it (the
+//!   page's own `/OutputIntents`, PDF 2.0, else the catalog's), else [`ReadOptions::fallback`]'s
+//!   profile, else FOGRA39. Each page is read and its complex regions separated with its own
+//!   intent; krilla writes no page-level `/OutputIntents`, so pages whose intent differs from the
+//!   one written are listed in [`FlattenDocumentReport::other_intents`].
+//! - Page boxes: the page is the source's visible area (CropBox within MediaBox, rotated), written
+//!   as the MediaBox. TrimBox, BleedBox and ArtBox carry over, mapped onto it and clipped to it.
+//! - Metadata: title, author, creation date and modification date carry over; the producer is
+//!   the caller's.
+//! - Version: [`FlattenDocumentOptions::version`], [`FlattenDocumentOptions::pdfx_version`]
+//!   and [`FlattenDocumentOptions::pdfx_conformance`] set the header, `pdf:PDFVersion` and the
+//!   PDF/X version and conformance keys. krilla has no PDF/X validator, so a caller claiming
+//!   PDF/X runs its own conformance checks.
+//! - Fonts: prepared per page ([`FontCache`](super::font::FontCache)); pages share a krilla font
+//!   only when the font bytes are equal ([`FontMap`]).
+//! - The source is opened once, and each output intent and printing condition parsed once.
+
+use std::cell::Cell;
+use std::collections::HashMap;
+use std::ops::Range;
+use std::rc::Rc;
+use std::sync::{Arc, OnceLock};
+
+use craft_pdf::interpret::TransformExt as _;
+use craft_pdf::syntax::Pdf;
+use craft_pdf::syntax::object::dict::keys::{ART_BOX, BLEED_BOX, OUTPUT_INTENTS, TRIM_BOX};
+use craft_pdf::syntax::object::{Array, DateTime as PdfDate, Dict, Rect as PdfRect};
+use craft_pdf::syntax::page::Page;
+use craft_pdf::write::backend::SerializeSettings;
+use craft_pdf::write::backend::configure::PdfVersion;
+use craft_pdf::write::backend::geom::{Rect as KRect, Size, Transform};
+use craft_pdf::write::backend::metadata::DateTime;
+use craft_pdf::write::backend::page::PageSettings;
+use craft_pdf::write::backend::pdf::PdfDocument;
+use craft_pdf::write::print::{self as print_settings, PrintColor};
+use craft_pdf::write::{self as pdf_write, Metadata, Writer};
+use craft_pdf::{OpenError, open_slice};
+use kurbo::Rect;
+
+use super::pdf::{ReadColor, ReadError, ReadOptions, read_color, read_page_in};
+use super::raster::{FlattenPageReport, Rasterizer};
+use super::write::{FontMap, WriteError, write_flattened_with_fonts};
+use super::{DisplayList, FlattenError, FlattenOptions, flatten};
+use crate::cms::CmsConversion;
+use crate::plates::{self, Fallback, pdf_text};
+
+/// How [`flatten_document`] reads, flattens and writes.
+#[derive(Clone, Debug, Default)]
+pub struct FlattenDocumentOptions {
+    pub read: ReadOptions,
+    pub flatten: FlattenOptions,
+    /// The pages to flatten, from 0; all when `None`.
+    pub pages: Option<Range<usize>>,
+    /// Written as `/Producer`.
+    pub producer: String,
+    pub unreadable: Unreadable,
+    /// The output's PDF version. Below 1.6, DeviceN spaces get no NChannel attributes; at 1.4,
+    /// krilla also enforces the 1.4 implementation limits (reals, array and dictionary sizes),
+    /// and a DeviceN space of more than 8 colorants is a [`WriteError::Colorants`].
+    pub version: PdfVersion,
+    /// The PDF/X version claimed: `/GTS_PDFXVersion` in the information dictionary and
+    /// `pdfxid:GTS_PDFXVersion` in XMP. For PDF/X-1a:2003 it is `PDF/X-1:2003`. Not checked.
+    pub pdfx_version: Option<String>,
+    /// The PDF/X conformance level claimed, `/GTS_PDFXConformance` in the information
+    /// dictionary: `PDF/X-1a:2003` for PDF/X-1a:2003. Not checked.
+    pub pdfx_conformance: Option<String>,
+}
+
+/// What [`flatten_document`] does with a page the PDF interpreter fails on.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum Unreadable {
+    /// Fail with [`FlattenDocumentError::Read`].
+    #[default]
+    Fail,
+    /// Copy the page unflattened, as a form XObject, and list it in
+    /// [`FlattenDocumentReport::unflattened`]. Its transparency stays.
+    Keep,
+}
+
+/// What [`flatten_document`] did.
+#[derive(Clone, Debug, Default, PartialEq)]
+#[non_exhaustive]
+pub struct FlattenDocumentReport {
+    /// Each flattened page (from 0) and its report.
+    pub pages: Vec<(usize, FlattenPageReport)>,
+    /// Pages copied unflattened ([`Unreadable::Keep`]) and why they didn't read.
+    pub unflattened: Vec<(usize, String)>,
+    /// Pages read and separated with an output intent other than the one written.
+    pub other_intents: Vec<usize>,
+    pub totals: FlattenTotals,
+}
+
+/// [`FlattenDocumentReport::pages`] summed.
+#[derive(Clone, Debug, Default, PartialEq)]
+#[non_exhaustive]
+pub struct FlattenTotals {
+    /// Top-level items cut into regions.
+    pub flattened: usize,
+    pub complex_regions: usize,
+    /// Groups rasterized whole.
+    pub complex_groups: usize,
+    pub raster_images: usize,
+    pub raster_pixels: u64,
+    /// The lowest resolution a complex region was rasterized at, when one needed less than
+    /// [`FlattenOptions::raster_dpi`].
+    pub lowest_dpi: Option<f32>,
+    /// Raster images read.
+    pub images: usize,
+    pub unreadable_images: usize,
+    pub dropped_tilings: usize,
+    pub dropped_inks: usize,
+    pub dropped_annotations: usize,
+}
+
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum FlattenDocumentError {
+    #[error(transparent)]
+    Open(#[from] OpenError),
+    #[error("pages {start}..{end} are not pages of the document's {count}")]
+    PageRange { start: usize, end: usize, count: usize },
+    #[error("page {page} (from 0): {source}")]
+    Read { page: usize, source: ReadError },
+    #[error("page {page} (from 0): {source}")]
+    Flatten { page: usize, source: FlattenError },
+    #[error("page {page} (from 0): {source}")]
+    Write { page: usize, source: WriteError },
+    /// Serializing the document failed.
+    #[error(transparent)]
+    Serialize(#[from] pdf_write::WriteError),
+}
+
+/// `pdf` with the transparency of every page in [`FlattenDocumentOptions::pages`] flattened, as
+/// one PDF. See the [module docs](self) for what carries over.
+pub fn flatten_document(pdf: &[u8], opts: &FlattenDocumentOptions) -> Result<(Vec<u8>, FlattenDocumentReport), FlattenDocumentError> {
+    flatten_document_with_progress(pdf, opts, &mut |_, _| {})
+}
+
+/// [`flatten_document`], calling `progress(done, total)` after each page.
+pub fn flatten_document_with_progress(
+    pdf: &[u8],
+    opts: &FlattenDocumentOptions,
+    progress: &mut dyn FnMut(usize, usize),
+) -> Result<(Vec<u8>, FlattenDocumentReport), FlattenDocumentError> {
+    let doc = Arc::new(open_slice(pdf, None)?);
+    let count = doc.pages().len();
+    let range = opts.pages.clone().unwrap_or(0..count);
+    if range.is_empty() || range.end > count {
+        return Err(FlattenDocumentError::PageRange { start: range.start, end: range.end, count });
+    }
+    let mut colors = Colors { doc: &doc, fallback: &opts.read.fallback, cache: HashMap::new() };
+    let first = colors.get(range.start)?;
+    let mut report = FlattenDocumentReport::default();
+    // The page being written, to name it when krilla panics.
+    let current = Cell::new(None);
+    let written = pdf_write::guard(|| {
+        let settings = SerializeSettings {
+            configuration: pdf_write::configuration(opts.version, None)?,
+            pdfx_version: opts.pdfx_version.clone(),
+            pdfx_conformance: opts.pdfx_conformance.clone(),
+            ..first.settings.clone()
+        };
+        let mut writer = Writer::new(settings, metadata(&doc, &opts.producer));
+        let mut fonts = FontMap::new();
+        let mut source = None;
+        let total = range.len();
+        for (done, page) in range.clone().enumerate() {
+            current.set(Some(page));
+            let color = colors.get(page)?;
+            if !Rc::ptr_eq(&color, &first) && !same_condition(&color.condition, &first.condition) {
+                report.other_intents.push(page);
+            }
+            let p = doc.pages().get(page).ok_or(FlattenDocumentError::Read { page, source: ReadError::NoPage(page) })?;
+            match read_page_in(&doc, page, &opts.read, color.read.clone()) {
+                Ok((list, read)) => {
+                    let flat = flatten(&list, &opts.flatten).map_err(|source| FlattenDocumentError::Flatten { page, source })?;
+                    let mut raster = Rasterizer::new(&list, color.settings.clone(), color.condition.clone(), &color.cms, opts.flatten.raster_dpi);
+                    let at = |source| FlattenDocumentError::Write { page, source };
+                    let settings = page_settings(p, list.page).ok_or(at(WriteError::Page))?;
+                    write_page(&mut writer, settings, &list, |surface| {
+                        write_flattened_with_fonts(surface, &list, &flat, &color.cms, opts.version, &mut fonts, &mut |r| raster.region(r))
+                    })
+                    .map_err(at)?;
+                    report.pages.push((page, FlattenPageReport { read, flatten: flat.report, raster: raster.report().clone() }));
+                }
+                Err(e) if opts.unreadable == Unreadable::Keep => {
+                    let (w, h) = p.render_dimensions();
+                    let bbox = Rect::new(0.0, 0.0, f64::from(w), f64::from(h));
+                    let at = |source| FlattenDocumentError::Write { page, source };
+                    let settings = page_settings(p, bbox).ok_or(at(WriteError::Page))?;
+                    let size = Size::from_wh(w, h).ok_or(at(WriteError::Page))?;
+                    let source = source.get_or_insert_with(|| PdfDocument::new(doc.clone()));
+                    let mut page_builder = writer.document_mut().start_page_with(settings);
+                    let mut surface = page_builder.surface();
+                    surface.draw_pdf_page(source, size, page);
+                    surface.finish();
+                    page_builder.finish();
+                    report.unflattened.push((page, e.to_string()));
+                }
+                Err(source) => return Err(FlattenDocumentError::Read { page, source }),
+            }
+            progress(done + 1, total);
+        }
+        current.set(None);
+        Ok(writer.finish()?)
+    });
+    let bytes = written.map_err(|e| match (e, current.get()) {
+        (FlattenDocumentError::Serialize(source), Some(page)) => FlattenDocumentError::Write { page, source: WriteError::Pdf(source) },
+        (e, _) => e,
+    })?;
+    report.totals = totals(&report.pages);
+    Ok((bytes, report))
+}
+
+/// Draws one page of `list.page`'s size with `draw`, in page space.
+fn write_page(
+    writer: &mut Writer,
+    settings: PageSettings,
+    list: &DisplayList,
+    draw: impl FnOnce(&mut craft_pdf::write::backend::surface::Surface<'_>) -> Result<(), WriteError>,
+) -> Result<(), WriteError> {
+    let box_ = list.page;
+    let mut page_builder = writer.document_mut().start_page_with(settings);
+    let mut surface = page_builder.surface();
+    let shifted = box_.x0 != 0.0 || box_.y0 != 0.0;
+    if shifted {
+        surface.push_transform(&Transform::from_translate(-box_.x0 as f32, -box_.y0 as f32));
+    }
+    let drawn = draw(&mut surface);
+    if shifted {
+        surface.pop();
+    }
+    surface.finish();
+    page_builder.finish();
+    drawn
+}
+
+/// A page of `bbox`'s size (page space) with the source page's TrimBox, BleedBox and ArtBox,
+/// mapped into page space and clipped to `bbox`.
+fn page_settings(p: &Page<'_>, bbox: Rect) -> Option<PageSettings> {
+    let size = PageSettings::from_wh(bbox.width() as f32, bbox.height() as f32).filter(|_| bbox.is_finite())?;
+    let to_page = p.initial_transform(true).to_kurbo();
+    let mapped = |key: &[u8]| {
+        let r = p.raw().get::<PdfRect>(key)?;
+        let r = to_page.transform_rect_bbox(Rect::new(r.x0, r.y0, r.x1, r.y1)).intersect(bbox);
+        if !(r.is_finite() && r.width() > 0.0 && r.height() > 0.0) {
+            return None;
+        }
+        KRect::from_ltrb((r.x0 - bbox.x0) as f32, (r.y0 - bbox.y0) as f32, (r.x1 - bbox.x0) as f32, (r.y1 - bbox.y0) as f32)
+    };
+    Some(size.with_trim_box(mapped(TRIM_BOX)).with_bleed_box(mapped(BLEED_BOX)).with_art_box(mapped(ART_BOX)))
+}
+
+/// The source's title, author, creation and modification dates, and `producer`.
+fn metadata(doc: &Pdf, producer: &str) -> Metadata {
+    let info = doc.metadata();
+    let text = |bytes: &Option<Vec<u8>>| bytes.as_deref().map(|b| pdf_text(b).trim().to_string()).filter(|s| !s.is_empty());
+    Metadata {
+        producer: producer.to_string(),
+        title: text(&info.title),
+        authors: text(&info.author).into_iter().collect(),
+        created: info.creation_date.as_ref().map(date),
+        modified: info.modification_date.as_ref().map(date),
+        ..Metadata::default()
+    }
+}
+
+fn date(d: &PdfDate) -> DateTime {
+    DateTime::new(d.year)
+        .month(d.month)
+        .day(d.day)
+        .hour(d.hour)
+        .minute(d.minute)
+        .second(d.second)
+        .utc_offset_hour(d.utc_offset_hour)
+        .utc_offset_minute(d.utc_offset_minute)
+}
+
+fn totals(pages: &[(usize, FlattenPageReport)]) -> FlattenTotals {
+    let mut t = FlattenTotals::default();
+    for (_, r) in pages {
+        t.flattened += r.flatten.flattened;
+        t.complex_regions += r.flatten.complex_regions;
+        t.complex_groups += r.flatten.complex_groups.len();
+        t.raster_images += r.raster.images;
+        t.raster_pixels += r.raster.pixels;
+        t.lowest_dpi = match (t.lowest_dpi, r.raster.lowest_dpi) {
+            (Some(a), Some(b)) => Some(a.min(b)),
+            (a, b) => a.or(b),
+        };
+        t.images += r.read.images;
+        t.unreadable_images += r.read.unreadable_images;
+        t.dropped_tilings += r.read.dropped_tilings;
+        t.dropped_inks += r.read.dropped_inks;
+        t.dropped_annotations += r.read.dropped_annotations;
+    }
+    t
+}
+
+/// A page's printing condition, for reading, separating and writing.
+struct PageColor {
+    /// With the output intent.
+    settings: SerializeSettings,
+    cms: CmsConversion,
+    condition: Fallback,
+    read: ReadColor,
+}
+
+/// The [`PageColor`]s of a document: one for the pages without their own output intents, one per
+/// page with them.
+struct Colors<'d> {
+    doc: &'d Pdf,
+    fallback: &'d Fallback,
+    cache: HashMap<Option<usize>, Rc<PageColor>>,
+}
+
+impl Colors<'_> {
+    fn get(&mut self, page: usize) -> Result<Rc<PageColor>, FlattenDocumentError> {
+        let own =
+            self.doc.pages().get(page).and_then(|p| p.raw().get::<Array<'_>>(OUTPUT_INTENTS)).is_some_and(|a| a.iter::<Dict<'_>>().next().is_some());
+        let key = own.then_some(page);
+        if let Some(color) = self.cache.get(&key) {
+            return Ok(color.clone());
+        }
+        let read = read_color(self.doc, page, self.fallback).map_err(|source| FlattenDocumentError::Read { page, source })?;
+        let (settings, cms, condition) = printing(self.doc, page, self.fallback).map_err(|source| FlattenDocumentError::Write { page, source })?;
+        let color = Rc::new(PageColor { settings, cms, condition, read });
+        self.cache.insert(key, color.clone());
+        Ok(color)
+    }
+}
+
+fn same_condition(a: &Fallback, b: &Fallback) -> bool {
+    match (a, b) {
+        (Fallback::Profile(a), Fallback::Profile(b)) => a == b,
+        _ => std::mem::discriminant(a) == std::mem::discriminant(b),
+    }
+}
+
+/// The output's serialize settings and printing condition for page `page`: its output intent
+/// written again, else `fallback`'s profile, else FOGRA39.
+fn printing(doc: &Pdf, page: usize, fallback: &Fallback) -> Result<(SerializeSettings, CmsConversion, Fallback), WriteError> {
+    let fogra39 = || -> Result<_, WriteError> {
+        // Reading the profile is the slow part of writing a small page; it is the usual one.
+        static SETTINGS: OnceLock<Option<SerializeSettings>> = OnceLock::new();
+        let settings = SETTINGS.get_or_init(|| print_settings::settings(PrintColor::fogra39(craft_cms::builtin::COATED_FOGRA39_ICC)).ok());
+        let settings = settings.clone().ok_or(WriteError::Pdf(pdf_write::WriteError::InvalidProfile))?;
+        Ok((settings, CmsConversion::fogra39(), Fallback::Fogra39))
+    };
+    let custom = |icc: &[u8], color: PrintColor<'_>| {
+        if icc == craft_cms::builtin::COATED_FOGRA39_ICC {
+            return fogra39().ok();
+        }
+        let cms = CmsConversion::new(icc).ok()?;
+        let settings = print_settings::settings(color).ok()?;
+        Some((settings, cms, Fallback::Profile(icc.into())))
+    };
+    let found = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| plates::output_intent_profile(doc, page))).ok().flatten();
+    if let Some(intent) = found {
+        let color = PrintColor {
+            profile: &intent.icc,
+            condition_identifier: intent.identifier.as_deref().unwrap_or("Custom"),
+            condition: intent.condition.as_deref(),
+            registry_name: intent.registry_name.as_deref(),
+            info: intent.info.as_deref().or(intent.condition.as_deref()),
+        };
+        if let Some(found) = custom(&intent.icc, color) {
+            return Ok(found);
+        }
+    }
+    if let Fallback::Profile(icc) = fallback {
+        let color = PrintColor {
+            profile: icc,
+            condition_identifier: "Custom",
+            condition: None,
+            registry_name: None,
+            info: Some("Custom CMYK printing condition"),
+        };
+        if let Some(found) = custom(icc, color) {
+            return Ok(found);
+        }
+    }
+    fogra39()
+}
diff --git a/crates/prepress/src/flatten/font.rs b/crates/prepress/src/flatten/font.rs
new file mode 100644
index 00000000..1b9d5a6b
--- /dev/null
+++ b/crates/prepress/src/flatten/font.rs
@@ -0,0 +1,209 @@
+//! Source fonts prepared for embedding again. The PDF-in adapter notes every outline glyph it
+//! reads; after the page, [`FontCache::finish`] gives one [`TextFont`] per source font, or
+//! `None` where the font's runs are drawn from their outlines.
+
+use std::collections::{BTreeMap, HashMap};
+use std::sync::Arc;
+
+use craft_pdf::interpret::font::OutlineGlyph;
+use craft_pdf::write::backend::geom::Point;
+use craft_pdf::write::backend::page::PageSettings;
+use craft_pdf::write::backend::text::{Font, GlyphId, KrillaGlyph};
+use craft_pdf::write::backend::{Data, SerializeSettings};
+use craft_pdf::write::{Metadata, WriteError, Writer, guard};
+
+use super::{FontBytes, TextFont};
+
+/// The fonts of one page, collected glyph by glyph.
+#[derive(Default)]
+pub struct FontCache {
+    fonts: HashMap<u128, Noted>,
+}
+
+struct Noted {
+    /// The font's own bytes and face index; `None` when the PDF doesn't embed the font or
+    /// hayro has no bytes for it.
+    source: Option<(FontBytes, u32)>,
+    /// Glyph id to advance in glyph space (1000 units per em), from the PDF's widths. Ordered,
+    /// so the trial embedding is deterministic.
+    advances: BTreeMap<u32, f32>,
+}
+
+impl FontCache {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Records a glyph seen on the page (font key, glyph id, PDF width) and returns the key.
+    pub fn note(&mut self, glyph: &OutlineGlyph) -> u128 {
+        let key = glyph.font_cache_key();
+        let noted = self.fonts.entry(key).or_insert_with(|| Noted {
+            // A substitute from the font resolver is not the file's font.
+            source: glyph.font_data().filter(|d| d.embedded).map(|d| (d.data, d.index)),
+            advances: BTreeMap::new(),
+        });
+        if noted.source.is_some() {
+            noted.advances.insert(glyph.glyph_id().to_u32(), glyph.advance_width().unwrap_or(0.0));
+        }
+        key
+    }
+
+    /// After the page is read: sniff, wrap bare CFF, trial-embed. `None` means: draw from
+    /// outlines. Every noted key is present.
+    pub fn finish(self) -> HashMap<u128, Option<Arc<TextFont>>> {
+        self.fonts.into_iter().map(|(key, noted)| (key, noted.prepare(key).map(Arc::new))).collect()
+    }
+}
+
+impl Noted {
+    fn prepare(self, key: u128) -> Option<TextFont> {
+        let (data, index) = self.source?;
+        let magic: [u8; 4] = (*data).as_ref().get(..4)?.try_into().ok()?;
+        let font = match &magic {
+            [0, 1, 0, 0] | b"OTTO" | b"true" | b"ttcf" => TextFont { data, index, key },
+            // The CFF wrap needs the widths of all glyphs used, hence once per page.
+            [1, _, _, _] => TextFont { data: Arc::new(wrap_cff((*data).as_ref(), &self.advances)?), index: 0, key },
+            _ => return None,
+        };
+        embeds(&font, self.advances.keys().copied()).then_some(font)
+    }
+}
+
+/// Whether krilla embeds `glyphs` of `font`. `Font::new` accepts fonts whose subsetting fails
+/// later, in `Writer::finish`, which is too late to fall back for one font; a throwaway
+/// one-page document finds those failures here.
+fn embeds(font: &TextFont, glyphs: impl Iterator<Item = u32>) -> bool {
+    let glyphs: Vec<KrillaGlyph> = glyphs.map(|id| KrillaGlyph::new(GlyphId::new(id), 0.0, 0.0, 0.0, 0.0, 0..0, None)).collect();
+    let trial = || {
+        let font = Font::new(Data::from(font.data.clone()), font.index).ok_or(WriteError::InvalidFont)?;
+        let mut writer = Writer::new(SerializeSettings::default(), Metadata::default());
+        let mut page = writer.document_mut().start_page_with(PageSettings::from_wh(10.0, 10.0).ok_or(WriteError::InvalidFont)?);
+        let mut surface = page.surface();
+        surface.draw_glyphs(Point::from_xy(0.0, 0.0), &glyphs, font, "", 10.0, false);
+        surface.finish();
+        page.finish();
+        writer.finish()
+    };
+    guard(trial).is_ok()
+}
+
+/// Wraps bare CFF (`FontFile3`) in the smallest OpenType font krilla loads: `CFF `, `head`,
+/// `hhea`, `hmtx`, `maxp` 0.5 and `post` 3. `hmtx` holds `advances` (glyph space, 1000 units
+/// per em) and 0 for the glyphs not listed; `unitsPerEm` follows the CFF `FontMatrix`.
+pub(crate) fn wrap_cff(cff: &[u8], advances: &BTreeMap<u32, f32>) -> Option<Vec<u8>> {
+    let table = ttf_parser::cff::Table::parse(cff)?;
+    let glyphs = table.number_of_glyphs();
+    let upem = (1.0 / table.matrix().sx).round().clamp(16.0, 16384.0) as u16;
+    let scale = f32::from(upem) / 1000.0;
+    let be16 = |v: &mut Vec<u8>, x: u16| v.extend_from_slice(&x.to_be_bytes());
+    let be32 = |v: &mut Vec<u8>, x: u32| v.extend_from_slice(&x.to_be_bytes());
+
+    let mut head = Vec::new();
+    be32(&mut head, 0x0001_0000);
+    be32(&mut head, 0x0001_0000);
+    be32(&mut head, 0);
+    be32(&mut head, 0x5F0F_3CF5);
+    be16(&mut head, 0x000B);
+    be16(&mut head, upem);
+    head.extend_from_slice(&[0; 16]);
+    for v in [0, 0, upem, upem] {
+        be16(&mut head, v);
+    }
+    for v in [0, 8, 2, 0, 0] {
+        be16(&mut head, v);
+    }
+
+    let mut hmtx = Vec::new();
+    let mut max_advance = 0;
+    for gid in 0..u32::from(glyphs) {
+        let advance = advances.get(&gid).map_or(0, |a| (a * scale).round().clamp(0.0, 65535.0) as u16);
+        max_advance = max_advance.max(advance);
+        be16(&mut hmtx, advance);
+        be16(&mut hmtx, 0);
+    }
+
+    // krilla tells fonts apart by their metrics and `checksumAdjustment`, and two pages' wraps
+    // of one CFF differ only in `hmtx`: a hash of it keeps them apart in one document.
+    let hash = hmtx.iter().fold(0x811C_9DC5_u32, |h, b| (h ^ u32::from(*b)).wrapping_mul(0x0100_0193));
+    head[8..12].copy_from_slice(&hash.to_be_bytes());
+
+    let mut hhea = Vec::new();
+    be32(&mut hhea, 0x0001_0000);
+    be16(&mut hhea, (u32::from(upem) * 4 / 5) as u16);
+    be16(&mut hhea, (-(i32::from(upem) / 5)) as i16 as u16);
+    be16(&mut hhea, 0);
+    be16(&mut hhea, max_advance);
+    hhea.extend_from_slice(&[0; 4]);
+    be16(&mut hhea, max_advance);
+    be16(&mut hhea, 1);
+    hhea.extend_from_slice(&[0; 14]);
+    be16(&mut hhea, glyphs);
+
+    let mut maxp = Vec::new();
+    be32(&mut maxp, 0x0000_5000);
+    be16(&mut maxp, glyphs);
+
+    let mut post = Vec::new();
+    be32(&mut post, 0x0003_0000);
+    post.extend_from_slice(&[0; 28]);
+
+    // Tables in tag order, as the sfnt directory requires.
+    let tables: [(&[u8; 4], &[u8]); 6] = [(b"CFF ", cff), (b"head", &head), (b"hhea", &hhea), (b"hmtx", &hmtx), (b"maxp", &maxp), (b"post", &post)];
+    let mut out = Vec::new();
+    out.extend_from_slice(b"OTTO");
+    for v in [6, 64, 2, 32] {
+        be16(&mut out, v);
+    }
+    let mut offset = 12 + 16 * tables.len();
+    for (tag, data) in &tables {
+        out.extend_from_slice(*tag);
+        be32(&mut out, 0);
+        be32(&mut out, u32::try_from(offset).ok()?);
+        be32(&mut out, u32::try_from(data.len()).ok()?);
+        offset += data.len().next_multiple_of(4);
+    }
+    for (_, data) in &tables {
+        out.extend_from_slice(data);
+        out.resize(out.len().next_multiple_of(4), 0);
+    }
+    Some(out)
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use craft_pdf::interpret::font::StandardFont;
+
+    #[test]
+    fn bare_cff_is_wrapped_in_an_opentype_font_with_the_pdf_widths() {
+        // hayro's Foxit Sans substitute is bare CFF, as `FontFile3/Type1C` holds it.
+        let (data, _) = StandardFont::Helvetica.get_font_data();
+        let cff = (*data).as_ref();
+        assert_eq!(cff[0], 1);
+        assert!(Font::new(Data::from(cff.to_vec()), 0).is_none(), "krilla takes OpenType only");
+
+        let advances = BTreeMap::from([(1, 278.0), (36, 667.4)]);
+        let wrapped = wrap_cff(cff, &advances).unwrap();
+        let face = ttf_parser::Face::parse(&wrapped, 0).unwrap();
+        assert_eq!(face.units_per_em(), 1000);
+        assert_eq!(face.number_of_glyphs(), ttf_parser::cff::Table::parse(cff).unwrap().number_of_glyphs());
+        let advance = |id| face.glyph_hor_advance(ttf_parser::GlyphId(id));
+        assert_eq!((advance(1), advance(36), advance(2)), (Some(278), Some(667), Some(0)));
+
+        let font = TextFont { data: Arc::new(wrapped.clone()), index: 0, key: 1 };
+        assert!(embeds(&font, advances.keys().copied()));
+
+        // Another page's glyphs with the same width sum: krilla must not take it for the same font.
+        let other = wrap_cff(cff, &BTreeMap::from([(1, 278.0), (37, 667.4)])).unwrap();
+        assert_ne!(Font::new(Data::from(wrapped), 0), Font::new(Data::from(other), 0));
+    }
+
+    #[test]
+    fn unreadable_bytes_draw_from_outlines() {
+        let noted = Noted { source: Some((Arc::new(b"%!PS-AdobeFont-1.0".to_vec()), 0)), advances: BTreeMap::from([(1, 500.0)]) };
+        assert!(noted.prepare(7).is_none());
+        let noted = Noted { source: Some((Arc::new(vec![1, 0, 4, 1, 0, 0]), 0)), advances: BTreeMap::new() };
+        assert!(noted.prepare(7).is_none(), "broken CFF");
+    }
+}
diff --git a/crates/prepress/src/flatten/geom.rs b/crates/prepress/src/flatten/geom.rs
new file mode 100644
index 00000000..f84bf9ca
--- /dev/null
+++ b/crates/prepress/src/flatten/geom.rs
@@ -0,0 +1,1016 @@
+//! Planar regions for the transparency flattener: a page's filled shapes cut into the faces of
+//! their arrangement, each tagged with the shapes that cover it. The same shapes cover every
+//! point of a region, so one composited color is exact for all of it.
+//!
+//! Ported from VectorCraft (MIT OR Apache-2.0) at commit c2b15982:
+//! `crates/pathops/src/pathfinder.rs` (`regions`, `Region`, `Shape`),
+//! `crates/pathops/src/boolean.rs` (the arrangement, per-input winding numbers, horizontal
+//! snapping, contour repair and cleanup) and `overlapping` in
+//! `crates/engine/src/cmd/flatten.rs`. The sweep is `linesweeper`'s, on `kurbo` curves.
+//!
+//! Clips go into the same sweep as the shapes instead of being applied first: one sweep replaces
+//! a boolean per clipped shape, and a clip edge is then the same edge in every region it bounds.
+
+use std::collections::HashMap;
+
+use kurbo::{BezPath, CubicBez, ParamCurve, ParamCurveNearest, PathEl, PathSeg, Point, Rect, Shape as _, Vec2};
+use linesweeper::topology::{ContourIdx, Contours, Topology, WindingNumber};
+
+/// Contours narrower than this on average (2 × area / perimeter, in input units) are dropped as
+/// numerical debris, such as the lens between two nearly coincident curves.
+pub const DEFAULT_SLIVER: f64 = 0.01;
+
+/// How a path's winding number decides what is inside it.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub enum FillRule {
+    #[default]
+    NonZero,
+    EvenOdd,
+}
+
+impl FillRule {
+    /// Whether a point of winding number `winding` is inside.
+    pub fn inside(self, winding: i32) -> bool {
+        match self {
+            FillRule::NonZero => winding != 0,
+            FillRule::EvenOdd => winding % 2 != 0,
+        }
+    }
+}
+
+/// A filled shape. Open subpaths are closed, as a fill closes them.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Shape {
+    pub path: BezPath,
+    pub rule: FillRule,
+    /// Indices into the clip list: the shape covers only what all of them cover.
+    pub clips: Vec<usize>,
+}
+
+impl Shape {
+    pub fn new(path: BezPath, rule: FillRule) -> Self {
+        Self { path, rule, clips: Vec::new() }
+    }
+
+    pub fn clipped(mut self, clips: impl IntoIterator<Item = usize>) -> Self {
+        self.clips.extend(clips);
+        self
+    }
+}
+
+/// A clipping path.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ClipPath {
+    pub path: BezPath,
+    pub rule: FillRule,
+}
+
+/// One face of the arrangement: an area where the covering shapes don't change.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Region {
+    /// Outer contours and holes, oriented so that the nonzero rule fills the region.
+    pub path: BezPath,
+    /// Unsigned area.
+    pub area: f64,
+    /// Indices of the shapes covering the region, in input (paint) order.
+    pub sources: Vec<usize>,
+}
+
+impl Region {
+    /// The front-most shape covering the region.
+    pub fn top(&self) -> Option<usize> {
+        self.sources.last().copied()
+    }
+
+    pub fn contains(&self, p: Point) -> bool {
+        self.path.winding(p) != 0
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, thiserror::Error)]
+pub enum GeomError {
+    #[error("input contains NaN or infinite coordinates")]
+    NonFinite,
+    #[error("shape {shape} names clip {clip}, which does not exist")]
+    UnknownClip { shape: usize, clip: usize },
+    /// The sweep failed on near-degenerate input; the caller rasterizes instead.
+    #[error("the shapes are too degenerate to sweep")]
+    Degenerate,
+}
+
+/// The regions of `shapes` (back to front), each clipped by the `clips` it names. They tile the
+/// union of the clipped shapes without overlaps; regions narrower than [`DEFAULT_SLIVER`] are
+/// left out.
+pub fn regions(shapes: &[Shape], clips: &[ClipPath]) -> Result<Vec<Region>, GeomError> {
+    regions_with(shapes, clips, DEFAULT_SLIVER)
+}
+
+/// [`regions`] with contours narrower than `sliver` dropped.
+pub fn regions_with(shapes: &[Shape], clips: &[ClipPath], sliver: f64) -> Result<Vec<Region>, GeomError> {
+    if shapes.is_empty() {
+        return Ok(Vec::new());
+    }
+    Ok(Arrangement::new(shapes, clips, sliver)?.regions())
+}
+
+/// Indices of `bounds` grouped by overlap, transitively, each group in index order. Touching boxes
+/// overlap; NaN boxes overlap nothing.
+pub fn overlap_groups(bounds: &[Rect]) -> Vec<Vec<usize>> {
+    fn find(p: &mut [usize], mut i: usize) -> usize {
+        while p[i] != i {
+            p[i] = p[p[i]];
+            i = p[i];
+        }
+        i
+    }
+    let mut parent: Vec<usize> = (0..bounds.len()).collect();
+    let mut order: Vec<(usize, Rect)> = bounds.iter().enumerate().filter(|(_, b)| !b.is_nan()).map(|(i, b)| (i, b.abs())).collect();
+    order.sort_by(|a, b| a.1.x0.total_cmp(&b.1.x0));
+    // Sweep left to right, comparing each box with those still open at its left edge.
+    let mut open: Vec<(usize, Rect)> = Vec::new();
+    for (i, b) in order {
+        open.retain(|(_, o)| o.x1 >= b.x0);
+        for (j, o) in &open {
+            if o.y0 <= b.y1 && b.y0 <= o.y1 {
+                let (a, c) = (find(&mut parent, i), find(&mut parent, *j));
+                parent[a.max(c)] = a.min(c);
+            }
+        }
+        open.push((i, b));
+    }
+    let mut groups: Vec<Vec<usize>> = Vec::new();
+    let mut slot: Vec<Option<usize>> = vec![None; bounds.len()];
+    for i in 0..bounds.len() {
+        let r = find(&mut parent, i);
+        match slot[r] {
+            Some(g) => groups[g].push(i),
+            None => {
+                slot[r] = Some(groups.len());
+                groups.push(vec![i]);
+            }
+        }
+    }
+    groups
+}
+
+/// The [`overlap_groups`] that hold a transparent item. Only their items need [`regions`]; every
+/// other item paints as it is. Groups are transitive so that an opaque item keeps its place in
+/// paint order above or below everything it overlaps.
+pub fn transparent_groups(bounds: &[Rect], transparent: &[bool]) -> Vec<Vec<usize>> {
+    let mut groups = overlap_groups(bounds);
+    groups.retain(|g| g.iter().any(|&i| transparent.get(i).copied().unwrap_or(false)));
+    groups
+}
+
+/// Winding numbers for any number of inputs: the non-zero ones as (tag, winding), sorted by tag.
+/// A face is covered by a few inputs, so this stays short where a vector of every input's winding
+/// would cost one step per input.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Hash)]
+struct Multi(Vec<(usize, i32)>);
+
+impl Multi {
+    fn get(&self, tag: usize) -> i32 {
+        self.0.binary_search_by_key(&tag, |e| e.0).ok().and_then(|k| self.0.get(k)).map_or(0, |e| e.1)
+    }
+}
+
+impl std::ops::Add for Multi {
+    type Output = Multi;
+    fn add(mut self, rhs: Self) -> Multi {
+        self += rhs;
+        self
+    }
+}
+
+impl std::ops::AddAssign for Multi {
+    fn add_assign(&mut self, rhs: Self) {
+        // The sweep mostly adds one input's ±1 to a short list: add in place, insert in tag order,
+        // drop a winding that reaches zero.
+        for (t, k) in rhs.0 {
+            match self.0.binary_search_by_key(&t, |e| e.0) {
+                Ok(i) => {
+                    if let Some(e) = self.0.get_mut(i) {
+                        e.1 += k;
+                        if e.1 == 0 {
+                            self.0.remove(i);
+                        }
+                    }
+                }
+                Err(i) if k != 0 => self.0.insert(i, (t, k)),
+                Err(_) => {}
+            }
+        }
+    }
+}
+
+impl WindingNumber for Multi {
+    type Tag = usize;
+    fn single(tag: usize, positive: bool) -> Self {
+        Multi(vec![(tag, if positive { 1 } else { -1 })])
+    }
+    fn of_tag(&self, tag: usize) -> Self {
+        let w = self.get(tag);
+        Multi(if w == 0 { vec![] } else { vec![(tag, w)] })
+    }
+}
+
+/// The sweep of shapes and clips. Tags `0..n` are shapes, `n + c` is clip `c`.
+struct Arrangement {
+    top: Topology<Multi>,
+    rules: Vec<FillRule>,
+    n: usize,
+    /// Each shape's clip tags.
+    clips: Vec<Vec<usize>>,
+    tidy: Tidy,
+}
+
+impl Arrangement {
+    fn new(shapes: &[Shape], clips: &[ClipPath], sliver: f64) -> Result<Self, GeomError> {
+        let n = shapes.len();
+        let mut used = vec![false; clips.len()];
+        let mut shape_clips = Vec::with_capacity(n);
+        for (shape, s) in shapes.iter().enumerate() {
+            let mut tags = Vec::with_capacity(s.clips.len());
+            for &clip in &s.clips {
+                *used.get_mut(clip).ok_or(GeomError::UnknownClip { shape, clip })? = true;
+                tags.push(n + clip);
+            }
+            tags.sort_unstable();
+            tags.dedup();
+            shape_clips.push(tags);
+        }
+        let mut paths: Vec<(BezPath, usize)> = shapes
+            .iter()
+            .enumerate()
+            .map(|(i, s)| (closed(&s.path), i))
+            .chain(clips.iter().enumerate().filter(|(c, _)| used[*c]).map(|(c, p)| (closed(&p.path), n + c)))
+            .collect();
+        let eps = eps_for(paths.iter().map(|p| &p.0))?;
+        snap_horizontals(&mut paths.iter_mut().map(|p| &mut p.0).collect::<Vec<_>>(), eps);
+        // The sweep can panic on rare near-degenerate input; the flattener then rasterizes.
+        let sweep = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| Topology::<Multi>::from_paths(paths.iter().map(|(p, t)| (p, *t)), eps)));
+        // Every subpath is closed, so a path error is a degenerate input too.
+        let top = sweep.map_err(|_| GeomError::Degenerate)?.map_err(|_| GeomError::Degenerate)?;
+        let rules = shapes.iter().map(|s| s.rule).chain(clips.iter().map(|c| c.rule)).collect();
+        let tidy = Tidy::keeping(sliver, paths.iter().map(|p| &p.0));
+        Ok(Self { top, rules, n, clips: shape_clips, tidy })
+    }
+
+    /// The shapes covering a face of winding `w`, inside all their clips.
+    fn covering(&self, w: &Multi) -> Vec<usize> {
+        let inside: Vec<usize> = w.0.iter().filter(|&&(t, k)| self.rules.get(t).is_some_and(|r| r.inside(k))).map(|&(t, _)| t).collect();
+        inside.iter().copied().take_while(|&t| t < self.n).filter(|&s| self.clips[s].iter().all(|c| inside.binary_search(c).is_ok())).collect()
+    }
+
+    /// Every face, with the faces of one coverage set merged where they touch.
+    ///
+    /// A contour pass walks the whole arrangement, so one pass per coverage set would cost
+    /// sets × edges. Instead the sets go into batches whose faces share no vertex (so no edge
+    /// either): one pass per batch walks each face's contours as its own set's pass would, and the
+    /// set a contour bounds is the one of its batch at its first point.
+    fn regions(&self) -> Vec<Region> {
+        let top = &self.top;
+        // The distinct non-empty coverage sets, numbered in the order met, and the set of each
+        // side of each segment. Faces have many sides, so a set is worked out once per winding.
+        let mut ids: HashMap<Vec<usize>, usize> = HashMap::new();
+        let mut sets: Vec<Vec<usize>> = Vec::new();
+        let mut by_winding: HashMap<&Multi, Option<usize>> = HashMap::new();
+        // The contour passes hand their predicate references into the topology's windings, so
+        // the winding's address finds its set without hashing the winding.
+        let mut by_addr: HashMap<usize, Option<usize>> = HashMap::new();
+        let mut sides = Vec::new();
+        for s in top.segment_indices() {
+            let h = s.first_half();
+            let mut pair = [None; 2];
+            for (side, w) in pair.iter_mut().zip([top.winding_clockwise(h), top.winding_counter_clockwise(h)]) {
+                let m = *by_winding.entry(w).or_insert_with(|| {
+                    let set = self.covering(w);
+                    let next = sets.len();
+                    (!set.is_empty()).then(|| {
+                        *ids.entry(set.clone()).or_insert_with(|| {
+                            sets.push(set);
+                            next
+                        })
+                    })
+                });
+                by_addr.insert(std::ptr::from_ref(w).addr(), m);
+                *side = m;
+            }
+            sides.push((s, pair));
+        }
+        let id = |w: &Multi| match by_addr.get(&std::ptr::from_ref(w).addr()) {
+            Some(m) => *m,
+            None => ids.get(&self.covering(w)).copied(),
+        };
+        // The sets of the faces around each vertex.
+        let mut around: HashMap<(u64, u64), Vec<usize>> = HashMap::new();
+        for (s, pair) in sides {
+            for end in [s.first_half(), s.second_half()] {
+                let at = around.entry(vertex_key(top.point(end).to_kurbo())).or_default();
+                for m in pair.into_iter().flatten() {
+                    if !at.contains(&m) {
+                        at.push(m);
+                    }
+                }
+            }
+        }
+        let mut near = vec![Vec::new(); sets.len()];
+        for at in around.values() {
+            for &a in at {
+                near[a].extend(at.iter().copied().filter(|&b| b != a));
+            }
+        }
+        // Greedy coloring: each set takes the first batch none of its neighbors is in.
+        let mut batch = vec![usize::MAX; sets.len()];
+        let mut batches = 0;
+        for m in 0..sets.len() {
+            let mut taken = vec![false; batches];
+            for &n in &near[m] {
+                if let Some(t) = taken.get_mut(batch[n]) {
+                    *t = true;
+                }
+            }
+            batch[m] = taken.iter().position(|t| !t).unwrap_or(batches);
+            batches = batches.max(batch[m] + 1);
+        }
+        let mut faces: Vec<Vec<BezPath>> = vec![Vec::new(); sets.len()];
+        for b in 0..batches {
+            let c = top.contours(|w| id(w).is_some_and(|m| batch[m] == b));
+            let owner: Option<Vec<usize>> = c
+                .contours()
+                .map(|ct| {
+                    let Some(PathEl::MoveTo(p)) = ct.path.elements().first() else { return None };
+                    around.get(&vertex_key(*p))?.iter().copied().find(|&m| batch[m] == b)
+                })
+                .collect();
+            let Some(owner) = owner else {
+                // Not expected: every contour starts at a vertex of the arrangement. Fall back to
+                // a pass per set for this batch.
+                for m in (0..sets.len()).filter(|&m| batch[m] == b) {
+                    let c = top.contours(|w| id(w) == Some(m));
+                    faces[m].extend(c.grouped().into_iter().map(|g| self.outline(&c, g)));
+                }
+                continue;
+            };
+            // A contour belongs under the nearest enclosing contour of the same set, as in that
+            // set's own pass.
+            let mut children = vec![Vec::new(); owner.len()];
+            let mut roots = Vec::new();
+            for (i, &m) in owner.iter().enumerate() {
+                let mut up = c[ContourIdx(i)].parent;
+                while let Some(p) = up.filter(|p| owner.get(p.0) != Some(&m)) {
+                    up = c[p].parent;
+                }
+                match up {
+                    Some(p) => children[p.0].push(i),
+                    None => roots.push(i),
+                }
+            }
+            for r in roots {
+                let mut group = Vec::new();
+                let mut stack = vec![r];
+                while let Some(i) = stack.pop() {
+                    group.push(ContourIdx(i));
+                    stack.extend(children[i].iter().rev());
+                }
+                faces[owner[r]].push(self.outline(&c, group));
+            }
+        }
+        let mut out = Vec::new();
+        for (sources, paths) in sets.into_iter().zip(faces) {
+            for path in paths.into_iter().filter(|p| !p.elements().is_empty()) {
+                let area = path.area().abs();
+                out.push(Region { path, area, sources: sources.clone() });
+            }
+        }
+        out
+    }
+
+    /// The contours `idx` of `c` as one path, repaired, without slivers, and with the pieces the
+    /// sweep split from one input curve or line joined again.
+    fn outline(&self, c: &Contours, idx: impl IntoIterator<Item = ContourIdx>) -> BezPath {
+        let mut out = BezPath::new();
+        for i in idx {
+            let path = self.tidy.repair(&c[i].path);
+            if is_sliver(&path, self.tidy.sliver) {
+                continue;
+            }
+            let segs = tidy_segments(path.segments().map(to_seg).collect(), &self.tidy);
+            let Some(first) = segs.first() else { continue };
+            out.move_to(first.c.p0);
+            for s in &segs {
+                if s.line {
+                    out.line_to(s.c.p3);
+                } else {
+                    out.curve_to(s.c.p1, s.c.p2, s.c.p3);
+                }
+            }
+            out.close_path();
+        }
+        out
+    }
+}
+
+/// A point as a map key (the arrangement's vertices are exact).
+fn vertex_key(p: Point) -> (u64, u64) {
+    (p.x.to_bits(), p.y.to_bits())
+}
+
+/// `bp` with every subpath closed.
+fn closed(bp: &BezPath) -> BezPath {
+    let mut out = BezPath::new();
+    let (mut open, mut start) = (false, Point::ZERO);
+    for el in bp.iter() {
+        match el {
+            PathEl::MoveTo(p) => {
+                if open {
+                    out.close_path();
+                }
+                out.move_to(p);
+                (open, start) = (true, p);
+            }
+            PathEl::ClosePath => {
+                if open {
+                    out.close_path();
+                }
+                open = false;
+            }
+            _ => {
+                // Drawing on after a close starts again at the subpath's start.
+                if !open {
+                    out.move_to(start);
+                    open = true;
+                }
+                out.push(el);
+            }
+        }
+    }
+    if open {
+        out.close_path();
+    }
+    out
+}
+
+/// The sweep tolerance for a set of paths (linesweeper's own `binary_op` scaling).
+fn eps_for<'a>(paths: impl IntoIterator<Item = &'a BezPath>) -> Result<f64, GeomError> {
+    let mut m: f64 = 0.0;
+    for p in paths {
+        for el in p.elements() {
+            for pt in el_points(el) {
+                if !pt.x.is_finite() || !pt.y.is_finite() {
+                    return Err(GeomError::NonFinite);
+                }
+                m = m.max(pt.x.abs()).max(pt.y.abs());
+            }
+        }
+    }
+    Ok((m * f64::EPSILON * 64.0).max(1e-6))
+}
+
+fn el_points(el: &PathEl) -> impl Iterator<Item = Point> {
+    let v: [Option<Point>; 3] = match *el {
+        PathEl::MoveTo(p) | PathEl::LineTo(p) => [Some(p), None, None],
+        PathEl::QuadTo(a, b) => [Some(a), Some(b), None],
+        PathEl::CurveTo(a, b, c) => [Some(a), Some(b), Some(c)],
+        PathEl::ClosePath => [None, None, None],
+    };
+    v.into_iter().flatten()
+}
+
+/// Make edges that rise by less than the sweep tolerance `eps` exactly horizontal.
+///
+/// The sweep orders a curve against another segment over a y-span shorter than `eps` by bounding
+/// boxes alone, so an almost-horizontal edge can be mis-ordered against a curve it passes and a
+/// corner is lost; exact horizontals are handled exactly. So on-curve y coordinates within `eps`
+/// of each other snap to one value (the lowest of each cluster, keeping distinct values at least
+/// `eps` apart), handles move with their anchors, and a handle within `eps` of its anchor's
+/// height is leveled with it. Anchors move by less than `eps` and handles by less than `2·eps`.
+fn snap_horizontals(paths: &mut [&mut BezPath], eps: f64) {
+    let mut ys: Vec<f64> = paths.iter().flat_map(|p| p.elements().iter().filter_map(PathEl::end_point)).map(|p| p.y).collect();
+    ys.sort_by(f64::total_cmp);
+    ys.dedup();
+    let mut start = f64::NEG_INFINITY;
+    let levels: Vec<f64> = ys
+        .iter()
+        .map(|&y| {
+            if y - start >= eps {
+                start = y;
+            }
+            start
+        })
+        .collect();
+    let snap = |p: &mut Point| {
+        let y = levels.get(ys.partition_point(|&v| v < p.y)).copied().unwrap_or(p.y);
+        let moved = y - p.y;
+        p.y = y;
+        moved
+    };
+    // Shift a handle with its anchor, then level it with the anchor when within `eps`.
+    let follow = |h: &mut Point, anchor: Point, moved: f64| {
+        h.y += moved;
+        if (h.y - anchor.y).abs() < eps {
+            h.y = anchor.y;
+        }
+    };
+    for p in paths.iter_mut() {
+        // The current point (snapped), how far snapping moved it, and the subpath's start.
+        let (mut cur, mut moved, mut first) = (Point::ZERO, 0.0, Point::ZERO);
+        for el in p.elements_mut() {
+            match el {
+                PathEl::MoveTo(q) => {
+                    moved = snap(q);
+                    (cur, first) = (*q, *q);
+                }
+                PathEl::LineTo(q) => {
+                    moved = snap(q);
+                    cur = *q;
+                }
+                PathEl::QuadTo(c, q) => {
+                    let m = snap(q);
+                    follow(c, cur, moved);
+                    follow(c, *q, 0.0);
+                    (cur, moved) = (*q, m);
+                }
+                PathEl::CurveTo(c1, c2, q) => {
+                    let m = snap(q);
+                    follow(c1, cur, moved);
+                    follow(c2, *q, m);
+                    (cur, moved) = (*q, m);
+                }
+                PathEl::ClosePath => {
+                    (cur, moved) = (first, 0.0);
+                }
+            }
+        }
+    }
+}
+
+/// Contours whose mean width (2 × area / perimeter) is below `sliver` are debris.
+fn is_sliver(bp: &BezPath, sliver: f64) -> bool {
+    let a = bp.area().abs();
+    let per = bp.perimeter(1e-6);
+    per <= 0.0 || 2.0 * a / per < sliver
+}
+
+/// One segment of a contour: a cubic, and whether it is a straight line.
+#[derive(Clone, Copy, Debug)]
+struct Seg {
+    c: CubicBez,
+    line: bool,
+}
+
+impl Seg {
+    fn line(a: Point, b: Point) -> Self {
+        Self { c: CubicBez::new(a, a, b, b), line: true }
+    }
+}
+
+fn to_seg(s: PathSeg) -> Seg {
+    match s {
+        PathSeg::Line(l) => Seg::line(l.p0, l.p1),
+        PathSeg::Quad(q) => {
+            let c = q.raise();
+            Seg { c, line: is_straight(&c, 1e-9) }
+        }
+        PathSeg::Cubic(c) => Seg { c, line: is_straight(&c, 1e-9 * (1.0 + c.p0.distance(c.p3))) },
+    }
+}
+
+/// Whether the cubic is (within `tol`) a straight line with its handles inside the chord.
+fn is_straight(c: &CubicBez, tol: f64) -> bool {
+    let chord = c.p3 - c.p0;
+    let len = chord.hypot();
+    if len < 1e-12 {
+        return c.p1.distance(c.p0) <= tol && c.p2.distance(c.p0) <= tol;
+    }
+    let dir = chord / len;
+    [c.p1, c.p2].iter().all(|&h| {
+        let v = h - c.p0;
+        let along = v.dot(dir);
+        v.cross(dir).abs() <= tol && along >= -tol && along <= len + tol
+    })
+}
+
+fn unit(v: Vec2) -> Option<Vec2> {
+    let l = v.hypot();
+    (l > 1e-12 && l.is_finite()).then(|| v / l)
+}
+
+/// The direction the curve leaves `p0`.
+fn start_tangent(c: &CubicBez) -> Vec2 {
+    unit(c.p1 - c.p0).or_else(|| unit(c.p2 - c.p0)).or_else(|| unit(c.p3 - c.p0)).unwrap_or(Vec2::new(1.0, 0.0))
+}
+
+/// The direction the curve arrives at `p3`.
+fn end_tangent(c: &CubicBez) -> Vec2 {
+    unit(c.p3 - c.p2).or_else(|| unit(c.p3 - c.p1)).or_else(|| unit(c.p3 - c.p0)).unwrap_or(Vec2::new(1.0, 0.0))
+}
+
+/// The distance two points must be within to count as one, at `p`'s magnitude.
+fn tol_at(p: Point) -> f64 {
+    1e-6 * (1.0 + p.x.abs().max(p.y.abs()))
+}
+
+/// Output cleanup: the inputs' on-curve points (joints there stay), and their curves, to rebuild
+/// split pieces exactly.
+struct Tidy {
+    sliver: f64,
+    /// Sorted by x.
+    keep: Vec<Point>,
+    /// Input curves with slightly inflated bounds.
+    curves: Vec<(Rect, CubicBez)>,
+    /// `curves` indices by the left edge of their bounds, and the widest bounds: the curves whose
+    /// bounds can hold a point, without testing them all.
+    by_x: Vec<usize>,
+    max_width: f64,
+}
+
+impl Tidy {
+    fn keeping<'a>(sliver: f64, paths: impl IntoIterator<Item = &'a BezPath>) -> Self {
+        let mut keep = Vec::new();
+        let mut curves = Vec::new();
+        for p in paths {
+            for s in p.segments() {
+                let seg = to_seg(s);
+                keep.push(seg.c.p0);
+                if !seg.line {
+                    curves.push((seg.c.bounding_box().inflate(1e-6, 1e-6), seg.c));
+                }
+            }
+        }
+        keep.sort_by(|a, b| a.x.total_cmp(&b.x));
+        let mut by_x: Vec<usize> = (0..curves.len()).collect();
+        by_x.sort_by(|&i, &j| curves[i].0.x0.total_cmp(&curves[j].0.x0));
+        let max_width = curves.iter().map(|(r, _)| r.width()).fold(0.0, f64::max);
+        Self { sliver, keep, curves, by_x, max_width }
+    }
+
+    fn is_kept(&self, p: Point) -> bool {
+        let tol = tol_at(p);
+        let lo = self.keep.partition_point(|q| q.x < p.x - tol);
+        self.keep[lo..].iter().take_while(|q| q.x <= p.x + tol).any(|q| (q.y - p.y).abs() <= tol)
+    }
+
+    /// The input curves whose bounds hold both `a` and `b`.
+    fn curves_around(&self, a: Point, b: Point) -> impl Iterator<Item = &CubicBez> {
+        let x = a.x.min(b.x);
+        let hi = self.by_x.partition_point(|&i| self.curves[i].0.x0 <= x);
+        let lo = self.by_x[..hi].partition_point(|&i| self.curves[i].0.x0 < x - self.max_width);
+        self.by_x[lo..hi].iter().map(|&i| &self.curves[i]).filter(move |(r, _)| r.contains(a) && r.contains(b)).map(|(_, c)| c)
+    }
+
+    /// `bp` with each curve piece that strays from the one input curve through both its ends
+    /// rebuilt as that curve's exact sub-curve. linesweeper 0.5 can emit a piece that doesn't
+    /// follow its curve; out and back between two points of one curve, such pieces make a lens
+    /// instead of nothing (VectorCraft issue #1028). A piece on a curve, or whose ends two
+    /// different input curves pass through (a real lens between them), is left as it is.
+    fn repair(&self, bp: &BezPath) -> BezPath {
+        if self.curves.is_empty() {
+            return bp.clone();
+        }
+        let mut out = BezPath::new();
+        let (mut cur, mut start) = (Point::ZERO, Point::ZERO);
+        for el in bp.iter() {
+            let piece = match el {
+                PathEl::QuadTo(c, p) => Some(kurbo::QuadBez::new(cur, c, p).raise()),
+                PathEl::CurveTo(c1, c2, p) => Some(CubicBez::new(cur, c1, c2, p)),
+                _ => None,
+            };
+            match (el, piece) {
+                (_, Some(raw)) => {
+                    let (a, b) = (raw.p0, raw.p3);
+                    let tol = tol_at(Point::new(a.x.abs().max(b.x.abs()), a.y.abs().max(b.y.abs())));
+                    let mut subs: Vec<CubicBez> = Vec::new();
+                    let mut follows = false;
+                    for c in self.curves_around(a, b) {
+                        let (na, nb) = (c.nearest(a, 1e-12), c.nearest(b, 1e-12));
+                        if na.distance_sq.sqrt() > tol || nb.distance_sq.sqrt() > tol || (na.t - nb.t).abs() < 1e-12 {
+                            continue;
+                        }
+                        if [0.25, 0.5, 0.75].iter().all(|&t| c.nearest(raw.eval(t), 1e-12).distance_sq.sqrt() <= tol * 10.0) {
+                            follows = true;
+                            break;
+                        }
+                        subs.push(sub_curve(c, na.t, nb.t, a, b));
+                    }
+                    let same = |p: &CubicBez, q: &CubicBez| p.p1.distance(q.p1) <= tol * 10.0 && p.p2.distance(q.p2) <= tol * 10.0;
+                    match subs.split_first() {
+                        Some((sub, rest)) if !follows && rest.iter().all(|q| same(sub, q)) => out.curve_to(sub.p1, sub.p2, b),
+                        _ => out.push(el),
+                    }
+                    cur = b;
+                }
+                (PathEl::MoveTo(p), None) => {
+                    out.push(el);
+                    (cur, start) = (p, p);
+                }
+                (PathEl::LineTo(p), None) => {
+                    out.push(el);
+                    cur = p;
+                }
+                (PathEl::ClosePath, None) => {
+                    out.push(el);
+                    cur = start;
+                }
+                (_, None) => out.push(el),
+            }
+        }
+        out
+    }
+}
+
+/// The part of `c` from parameter `ta` to `tb` (either order), with its ends at `a` and `b`.
+fn sub_curve(c: &CubicBez, ta: f64, tb: f64, a: Point, b: Point) -> CubicBez {
+    let sub = if ta < tb {
+        c.subsegment(ta..tb)
+    } else {
+        let r = c.subsegment(tb..ta);
+        CubicBez::new(r.p3, r.p2, r.p1, r.p0)
+    };
+    CubicBez::new(a, sub.p1, sub.p2, b)
+}
+
+/// The closed contour `segs` with the pieces the sweep split from one input line or curve joined
+/// again, and degenerate pieces dropped. Joints at input points stay. Only exact joins are made,
+/// so neighboring regions keep the same edges.
+fn tidy_segments(segs: Vec<Seg>, tidy: &Tidy) -> Vec<Seg> {
+    let scale = segs.iter().map(|s| s.c.p0.distance(s.c.p3)).fold(0.0, f64::max);
+    let tiny = (scale * 1e-9).max(1e-9);
+    let mut segs: Vec<Seg> = segs
+        .into_iter()
+        .filter(|s| {
+            let r = Rect::from_points(s.c.p0, s.c.p3).union_pt(s.c.p1).union_pt(s.c.p2);
+            r.width() + r.height() > tiny
+        })
+        .collect();
+    let n = segs.len();
+    if n < 2 {
+        return segs;
+    }
+    // Joint i sits at the start of segment i.
+    let mergeable = |a: &Seg, b: &Seg| -> bool {
+        if a.line != b.line || tidy.is_kept(b.c.p0) {
+            return false;
+        }
+        let ta = end_tangent(&a.c);
+        let tb = start_tangent(&b.c);
+        ta.dot(tb) > 0.9998 && ta.cross(tb).abs() < 0.02
+    };
+    // Start at a real corner, if there is one.
+    if let Some(k) = (0..n).find(|&i| !mergeable(&segs[(i + n - 1) % n], &segs[i])) {
+        segs.rotate_left(k);
+    }
+    let mut out: Vec<Seg> = Vec::with_capacity(n);
+    let mut i = 0;
+    while i < n {
+        let mut cur = segs[i];
+        let mut j = i + 1;
+        while j < n && mergeable(&segs[j - 1], &segs[j]) {
+            match join(&segs[i..=j], tidy) {
+                Some(m) => {
+                    cur = m;
+                    j += 1;
+                }
+                None => break,
+            }
+        }
+        out.push(cur);
+        i = j;
+    }
+    out
+}
+
+/// `run` as one segment, when its pieces lie on one line or one input curve.
+fn join(run: &[Seg], tidy: &Tidy) -> Option<Seg> {
+    let (first, last) = (run.first()?.c, run.last()?.c);
+    let (a, b) = (first.p0, last.p3);
+    let tol = tol_at(Point::new(a.x.abs().max(b.x.abs()), a.y.abs().max(b.y.abs())));
+    if run[0].line {
+        let chord = b - a;
+        let len = chord.hypot();
+        if len < 1e-12 {
+            return None;
+        }
+        let ok = run.iter().all(|s| ((s.c.p3 - a).cross(chord) / len).abs() <= tol);
+        return ok.then(|| Seg::line(a, b));
+    }
+    for c in tidy.curves_around(a, b) {
+        let (na, nb) = (c.nearest(a, 1e-12), c.nearest(b, 1e-12));
+        if na.distance_sq.sqrt() > tol || nb.distance_sq.sqrt() > tol || (na.t - nb.t).abs() < 1e-12 {
+            continue;
+        }
+        if run.iter().all(|s| c.nearest(s.c.eval(0.5), 1e-12).distance_sq.sqrt() <= tol * 10.0) {
+            return Some(Seg { c: sub_curve(c, na.t, nb.t, a, b), line: false });
+        }
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use kurbo::Circle;
+
+    use super::*;
+
+    fn rect(x0: f64, y0: f64, x1: f64, y1: f64) -> BezPath {
+        Rect::new(x0, y0, x1, y1).to_path(0.1)
+    }
+
+    fn fill(path: BezPath) -> Shape {
+        Shape::new(path, FillRule::NonZero)
+    }
+
+    /// The regions with their sources and areas rounded to 1e-6, sorted.
+    fn summary(regions: &[Region]) -> Vec<(Vec<usize>, f64)> {
+        let mut v: Vec<(Vec<usize>, f64)> = regions.iter().map(|r| (r.sources.clone(), (r.area * 1e6).round() / 1e6)).collect();
+        v.sort_by(|a, b| a.0.cmp(&b.0).then(a.1.total_cmp(&b.1)));
+        v
+    }
+
+    /// Each grid point inside the union is in exactly one region, whose sources are the shapes
+    /// holding the point.
+    fn assert_tiles(shapes: &[Shape], regions: &[Region], area: Rect, step: f64) {
+        let mut y = area.y0 + step * 0.37;
+        while y < area.y1 {
+            let mut x = area.x0 + step * 0.41;
+            while x < area.x1 {
+                let p = Point::new(x, y);
+                let covering: Vec<usize> = shapes.iter().enumerate().filter(|(_, s)| s.rule.inside(s.path.winding(p))).map(|(i, _)| i).collect();
+                let hits: Vec<&Region> = regions.iter().filter(|r| r.contains(p)).collect();
+                if covering.is_empty() {
+                    assert!(hits.is_empty(), "{p:?} is in no shape but in {} regions", hits.len());
+                } else {
+                    assert_eq!(hits.len(), 1, "{p:?} is in {} regions", hits.len());
+                    assert_eq!(hits[0].sources, covering, "at {p:?}");
+                }
+                x += step;
+            }
+            y += step;
+        }
+    }
+
+    #[test]
+    fn two_overlapping_rectangles_make_three_regions() {
+        let shapes = [fill(rect(0.0, 0.0, 10.0, 10.0)), fill(rect(5.0, 5.0, 15.0, 15.0))];
+        let r = regions(&shapes, &[]).unwrap();
+        assert_eq!(summary(&r), vec![(vec![0], 75.0), (vec![0, 1], 25.0), (vec![1], 75.0)]);
+        assert_tiles(&shapes, &r, Rect::new(-1.0, -1.0, 16.0, 16.0), 0.5);
+        // The pieces the sweep split rectangle edges into are joined again.
+        let overlap = r.iter().find(|r| r.sources == [0, 1]).unwrap();
+        assert_eq!(overlap.path.segments().count(), 4);
+        assert_eq!(overlap.top(), Some(1));
+    }
+
+    #[test]
+    fn coincident_edges_make_no_slivers() {
+        // Side by side, sharing an edge.
+        let shapes = [fill(rect(0.0, 0.0, 10.0, 10.0)), fill(rect(10.0, 0.0, 20.0, 10.0))];
+        assert_eq!(summary(&regions(&shapes, &[]).unwrap()), vec![(vec![0], 100.0), (vec![1], 100.0)]);
+        // Sharing three edges.
+        let shapes = [fill(rect(0.0, 0.0, 10.0, 10.0)), fill(rect(0.0, 0.0, 10.0, 5.0))];
+        assert_eq!(summary(&regions(&shapes, &[]).unwrap()), vec![(vec![0], 50.0), (vec![0, 1], 50.0)]);
+        // The same circle twice, one reversed.
+        let circle = Circle::new((5.0, 5.0), 5.0).to_path(0.01);
+        let shapes = [fill(circle.clone()), fill(circle.reverse_subpaths())];
+        let r = regions(&shapes, &[]).unwrap();
+        assert_eq!(r.len(), 1);
+        assert_eq!(r[0].sources, [0, 1]);
+        assert!((r[0].area - circle.area().abs()).abs() < 1e-9);
+    }
+
+    #[test]
+    fn fill_rules_differ_on_self_overlap() {
+        // Two squares in one path, wound the same way: the overlap has winding 2.
+        let mut path = rect(0.0, 0.0, 10.0, 10.0);
+        path.extend(rect(5.0, 5.0, 15.0, 15.0));
+        let center = Point::new(7.5, 7.5);
+        let nonzero = regions(&[Shape::new(path.clone(), FillRule::NonZero)], &[]).unwrap();
+        assert_eq!(summary(&nonzero), vec![(vec![0], 175.0)]);
+        assert!(nonzero[0].contains(center));
+        let shapes = [Shape::new(path, FillRule::EvenOdd)];
+        let evenodd = regions(&shapes, &[]).unwrap();
+        assert!((evenodd.iter().map(|r| r.area).sum::<f64>() - 150.0).abs() < 1e-9);
+        assert!(evenodd.iter().all(|r| r.sources == [0] && !r.contains(center)));
+        assert_tiles(&shapes, &evenodd, Rect::new(-1.0, -1.0, 16.0, 16.0), 0.5);
+    }
+
+    #[test]
+    fn a_hole_is_part_of_its_region_and_a_shape_in_it_is_its_own() {
+        // Nonzero hole by reversal, even-odd hole by nesting.
+        let mut nonzero = rect(0.0, 0.0, 10.0, 10.0);
+        nonzero.extend(rect(3.0, 3.0, 7.0, 7.0).reverse_subpaths());
+        let mut evenodd = rect(0.0, 0.0, 10.0, 10.0);
+        evenodd.extend(rect(3.0, 3.0, 7.0, 7.0));
+        for donut in [Shape::new(nonzero, FillRule::NonZero), Shape::new(evenodd, FillRule::EvenOdd)] {
+            let shapes = [donut, fill(rect(4.0, 4.0, 6.0, 6.0))];
+            let r = regions(&shapes, &[]).unwrap();
+            assert_eq!(summary(&r), vec![(vec![0], 84.0), (vec![1], 4.0)]);
+            let ring = r.iter().find(|r| r.sources == [0]).unwrap();
+            assert_eq!(ring.path.elements().iter().filter(|e| matches!(e, PathEl::MoveTo(_))).count(), 2);
+            assert!(!ring.contains(Point::new(3.5, 3.5)));
+            assert_tiles(&shapes, &r, Rect::new(-1.0, -1.0, 11.0, 11.0), 0.25);
+        }
+    }
+
+    #[test]
+    fn slivers_below_the_threshold_are_dropped() {
+        // Overlapping by 0.001.
+        let shapes = [fill(rect(0.0, 0.0, 10.0, 10.0)), fill(rect(9.999, 0.0, 20.0, 10.0))];
+        let r = regions(&shapes, &[]).unwrap();
+        assert!(r.iter().all(|r| r.sources != [0, 1]));
+        assert_eq!(r.len(), 2);
+        let kept = regions_with(&shapes, &[], 0.0).unwrap();
+        let sliver = kept.iter().find(|r| r.sources == [0, 1]).unwrap();
+        assert!((sliver.area - 0.01).abs() < 1e-9, "{}", sliver.area);
+    }
+
+    #[test]
+    fn region_areas_sum_to_the_union_area() {
+        let shapes = [
+            fill(rect(0.0, 0.0, 40.0, 30.0)),
+            fill(Circle::new((35.0, 25.0), 12.0).to_path(0.01)),
+            fill(rect(10.0, 10.0, 60.0, 20.0)),
+            Shape::new(Circle::new((20.0, 35.0), 8.0).to_path(0.01), FillRule::EvenOdd),
+            fill(rect(70.0, 0.0, 80.0, 10.0)),
+        ];
+        let r = regions(&shapes, &[]).unwrap();
+        let sum: f64 = r.iter().map(|r| r.area).sum();
+        let union = union_area(&shapes);
+        assert!((sum - union).abs() < 1e-6 * union, "{sum} vs {union}");
+        assert_tiles(&shapes, &r, Rect::new(-1.0, -1.0, 81.0, 44.0), 0.7);
+    }
+
+    /// The area of the union of `shapes` (all positively wound), from a sweep of them as one path.
+    fn union_area(shapes: &[Shape]) -> f64 {
+        let mut all = BezPath::new();
+        for s in shapes {
+            all.extend(s.path.iter());
+        }
+        let top = Topology::<i32>::from_path(&all, 1e-6).unwrap();
+        top.contours(|w| *w != 0).contours().map(|c| c.path.area()).sum::<f64>().abs()
+    }
+
+    #[test]
+    fn clips_limit_their_shapes_only() {
+        let clips = [ClipPath { path: rect(5.0, 0.0, 25.0, 10.0), rule: FillRule::NonZero }];
+        let shapes = [fill(rect(0.0, 0.0, 10.0, 10.0)).clipped([0]), fill(rect(20.0, 0.0, 30.0, 10.0))];
+        let r = regions(&shapes, &clips).unwrap();
+        // The clip's edge at x = 25 crosses only the unclipped shape, which stays one region.
+        assert_eq!(summary(&r), vec![(vec![0], 50.0), (vec![1], 100.0)]);
+        assert!(r.iter().any(|r| r.sources == [0] && r.contains(Point::new(7.0, 5.0))));
+        assert_eq!(regions(&[fill(rect(0.0, 0.0, 1.0, 1.0)).clipped([3])], &clips), Err(GeomError::UnknownClip { shape: 0, clip: 3 }));
+    }
+
+    #[test]
+    fn open_and_non_finite_input() {
+        let mut open = BezPath::new();
+        open.move_to((0.0, 0.0));
+        open.line_to((10.0, 0.0));
+        open.line_to((10.0, 10.0));
+        assert_eq!(summary(&regions(&[fill(open)], &[]).unwrap()), vec![(vec![0], 50.0)]);
+        assert_eq!(regions(&[fill(rect(0.0, 0.0, f64::NAN, 1.0))], &[]), Err(GeomError::NonFinite));
+        assert_eq!(regions(&[], &[]), Ok(vec![]));
+    }
+
+    #[test]
+    fn only_groups_with_transparency_need_regions() {
+        let bounds = [
+            Rect::new(0.0, 0.0, 10.0, 10.0),
+            Rect::new(100.0, 100.0, 110.0, 110.0),
+            Rect::new(10.0, 5.0, 20.0, 15.0), // touches 0
+            Rect::new(18.0, 14.0, 30.0, 30.0),
+            Rect::new(200.0, 0.0, 210.0, 10.0),
+        ];
+        assert_eq!(overlap_groups(&bounds), vec![vec![0, 2, 3], vec![1], vec![4]]);
+        assert_eq!(transparent_groups(&bounds, &[false, false, false, true, false]), vec![vec![0, 2, 3]]);
+        assert!(transparent_groups(&bounds, &[false; 5]).is_empty());
+    }
+
+    /// About 1,000 rectangles on a letter page. Run with `--ignored --nocapture`.
+    #[test]
+    #[ignore]
+    fn timing_on_a_thousand_rectangles() {
+        let mut seed: u64 = 0x2545_f491_4f6c_dd1d;
+        let mut next = || {
+            seed ^= seed << 13;
+            seed ^= seed >> 7;
+            seed ^= seed << 17;
+            (seed >> 11) as f64 / (1u64 << 53) as f64
+        };
+        let shapes: Vec<Shape> = (0..1000)
+            .map(|_| {
+                let (x, y) = (next() * 560.0, next() * 740.0);
+                let (w, h) = (2.0 + next() * 50.0, 2.0 + next() * 50.0);
+                fill(rect(x, y, x + w, y + h))
+            })
+            .collect();
+        let t = std::time::Instant::now();
+        let r = regions(&shapes, &[]).unwrap();
+        let elapsed = t.elapsed();
+        eprintln!("{} shapes -> {} regions in {:?}", shapes.len(), r.len(), elapsed);
+        let union = union_area(&shapes);
+        let sum: f64 = r.iter().map(|r| r.area).sum();
+        // Less the slivers left out.
+        assert!(sum <= union * (1.0 + 1e-9) && sum > union * (1.0 - 1e-4), "{sum} vs {union}");
+    }
+}
diff --git a/crates/prepress/src/flatten/mod.rs b/crates/prepress/src/flatten/mod.rs
new file mode 100644
index 00000000..860d9ed7
--- /dev/null
+++ b/crates/prepress/src/flatten/mod.rs
@@ -0,0 +1,235 @@
+//! The display list the transparency flattener reads and writes.
+//!
+//! Coordinates are page space in points, origin at the top left and y down, as krilla draws.
+//! Opacity, blend modes, soft masks and clips live on [`GroupItem`]s only: a transparent or
+//! clipped paint arrives as a group with one child. Strokes arrive outlined as fills.
+//! Overprint stays a per-item attribute; the flattener applies it per plate.
+
+use std::fmt;
+use std::ops::Range;
+use std::sync::Arc;
+
+pub use kurbo;
+use kurbo::{Affine, BezPath, Point, Rect};
+
+use crate::ink::{InkColor, InkId, InkSet, Overprint};
+
+pub use compose::{ComplexGroup, ComplexReason, ComplexRegion, FlattenError, FlattenOptions, FlattenReport, Flattened, flatten};
+pub use document::{
+    FlattenDocumentError, FlattenDocumentOptions, FlattenDocumentReport, FlattenTotals, Unreadable, flatten_document, flatten_document_with_progress,
+};
+pub use geom::FillRule;
+pub use raster::{FlattenPageError, FlattenPageOptions, FlattenPageReport, flatten_page};
+
+mod compose;
+mod document;
+pub mod font;
+pub mod geom;
+pub mod pdf;
+pub mod raster;
+mod shade;
+pub mod write;
+
+/// One page's content as the flattener sees it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct DisplayList {
+    /// The page box in page space.
+    pub page: Rect,
+    /// The inks the items' colors refer to.
+    pub inks: InkSet,
+    /// Items in painting order.
+    pub items: Vec<Item>,
+}
+
+/// A painted element.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Item {
+    Fill(FillItem),
+    Text(TextItem),
+    Image(ImageItem),
+    Group(GroupItem),
+}
+
+/// A filled path.
+#[derive(Clone, Debug, PartialEq)]
+pub struct FillItem {
+    pub path: BezPath,
+    pub rule: FillRule,
+    pub paint: Paint,
+    pub overprint: Overprint,
+}
+
+/// A run of glyphs from one font at one size and transform, kept as live text when
+/// written out.
+#[derive(Clone, Debug, PartialEq)]
+pub struct TextItem {
+    /// The font to embed again; `None` when the source font can't be re-embedded, and the
+    /// run is then written as `outlines`.
+    pub font: Option<Arc<TextFont>>,
+    /// The em size in text space units.
+    pub size: f32,
+    /// Text space to page space. Text space is y up, as in a PDF text matrix.
+    pub transform: Affine,
+    pub glyphs: Vec<PlacedGlyph>,
+    /// The Unicode text of the run, when the source had it; [`PlacedGlyph::text`] indexes it.
+    pub text: Option<String>,
+    /// The glyphs' filled outlines in page space. Always present: the flattener's geometry for
+    /// the run, and what is drawn when `font` is `None`.
+    pub outlines: BezPath,
+    pub paint: Paint,
+    pub overprint: Overprint,
+}
+
+/// A glyph of a [`TextItem`].
+#[derive(Clone, Debug, PartialEq)]
+pub struct PlacedGlyph {
+    /// The glyph id in [`TextFont::data`].
+    pub id: u32,
+    /// The glyph origin in text space.
+    pub origin: Point,
+    /// The bytes of [`TextItem::text`] this glyph shows; empty when it shows none.
+    pub text: Range<usize>,
+}
+
+/// Font bytes shared without copying, as hayro-interpret and krilla hold them.
+pub type FontBytes = Arc<dyn AsRef<[u8]> + Send + Sync>;
+
+/// An OpenType (TrueType or CFF outlines) font that krilla can embed.
+#[derive(Clone)]
+pub struct TextFont {
+    pub data: FontBytes,
+    /// The face index in a font collection; 0 for a single font.
+    pub index: u32,
+    /// Identifies the source font: runs with equal keys embed one font, so equal keys mean
+    /// equal bytes.
+    pub key: u128,
+}
+
+impl fmt::Debug for TextFont {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("TextFont")
+            .field("bytes", &(*self.data).as_ref().len())
+            .field("index", &self.index)
+            .field("key", &format_args!("{:032x}", self.key))
+            .finish()
+    }
+}
+
+impl PartialEq for TextFont {
+    fn eq(&self, other: &Self) -> bool {
+        self.key == other.key && self.index == other.index
+    }
+}
+
+/// A sampled image, 8 bits per component, rows top to bottom.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ImageItem {
+    pub space: ImageSpace,
+    /// Width and height in samples.
+    pub size: (u32, u32),
+    /// Interleaved components, `size.0 * size.1 * components` bytes.
+    pub samples: Arc<[u8]>,
+    /// The unit square to page space; (0, 0) is the top left sample.
+    pub transform: Affine,
+    /// Alpha, one byte per sample, at `size`.
+    pub smask: Option<Arc<[u8]>>,
+    pub overprint: Overprint,
+    /// The source's JPEG (DCTDecode) data, when `samples` are its decoding and the writer can
+    /// write it as it is: [`ImageSpace::Gray`] or [`ImageSpace::Cmyk`], no `smask`.
+    pub jpeg: Option<Arc<[u8]>>,
+}
+
+/// The components of an [`ImageItem`]'s samples.
+#[derive(Clone, Debug, PartialEq)]
+pub enum ImageSpace {
+    Gray,
+    Rgb,
+    Cmyk,
+    /// Tints of these inks, 255 = 100% ink, in this order.
+    Inks(Vec<InkId>),
+}
+
+/// A transparency group, or a plain clip when it is opaque, Normal and unmasked.
+#[derive(Clone, Debug, PartialEq)]
+pub struct GroupItem {
+    pub opacity: f32,
+    pub blend: BlendMode,
+    pub isolated: bool,
+    pub knockout: bool,
+    /// Nonzero clip in page space.
+    pub clip: Option<BezPath>,
+    pub mask: Option<Box<Mask>>,
+    /// The Unicode text the children show, for content drawn as items that is text in the
+    /// source, such as a colored Type 3 glyph.
+    pub actual_text: Option<String>,
+    pub children: Vec<Item>,
+}
+
+/// A soft mask (ISO 32000-2 §11.6.5).
+#[derive(Clone, Debug, PartialEq)]
+pub struct Mask {
+    pub kind: MaskKind,
+    pub group: GroupItem,
+    /// The luminosity mask's backdrop (`/BC`), what the group composites over; `None` for an
+    /// alpha mask.
+    pub backdrop: Option<InkColor>,
+    /// The transfer function (`/TR`) sampled at 256 evenly spaced mask values from 0 to 1, as
+    /// bytes; `None` for the identity.
+    pub transfer: Option<Arc<[u8]>>,
+}
+
+/// Which value of the mask group masks.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum MaskKind {
+    Alpha,
+    Luminosity,
+}
+
+/// What an item paints with.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Paint {
+    Solid(InkColor),
+    /// Stops are offsets `0.0..=1.0` in increasing order. Function-based and mesh shadings
+    /// arrive as images.
+    Gradient {
+        stops: Vec<(f32, InkColor)>,
+        geometry: GradientGeometry,
+    },
+}
+
+/// Where a gradient runs, in gradient space.
+#[derive(Clone, Debug, PartialEq)]
+pub enum GradientGeometry {
+    Axial { start: Point, end: Point, extend: [bool; 2], transform: Affine },
+    Radial { start: Point, start_radius: f64, end: Point, end_radius: f64, extend: [bool; 2], transform: Affine },
+}
+
+/// PDF blend modes (ISO 32000-2 §11.3.5).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum BlendMode {
+    #[default]
+    Normal,
+    Multiply,
+    Screen,
+    Overlay,
+    Darken,
+    Lighten,
+    ColorDodge,
+    ColorBurn,
+    HardLight,
+    SoftLight,
+    Difference,
+    Exclusion,
+    Hue,
+    Saturation,
+    Color,
+    Luminosity,
+}
+
+impl BlendMode {
+    /// Hue, Saturation, Color and Luminosity; on spot inks they act as Normal
+    /// (ISO 32000-1 §11.3.5.3).
+    pub fn is_non_separable(self) -> bool {
+        matches!(self, Self::Hue | Self::Saturation | Self::Color | Self::Luminosity)
+    }
+}
diff --git a/crates/prepress/src/flatten/pdf.rs b/crates/prepress/src/flatten/pdf.rs
new file mode 100644
index 00000000..f6d67a9e
--- /dev/null
+++ b/crates/prepress/src/flatten/pdf.rs
@@ -0,0 +1,1335 @@
+//! The PDF-in adapter: a page read through hayro-interpret into a [`DisplayList`].
+//!
+//! - Coordinates are page space (`Page::initial_transform(true)`): rotation and the crop box
+//!   are applied.
+//! - Colors stay inks, as plate mode separates them (`InterpreterSettings::plate`):
+//!   `Separation` and `DeviceN` colorants are their inks, DeviceCMYK its four process tints,
+//!   DeviceGray black only (C, M and Y at 0), and RGB, Lab and ICC colors convert to CMYK through
+//!   the page's output intent, else [`ReadOptions::fallback`]. Spot inks join
+//!   [`DisplayList::inks`] with their alternate: CMYK when the space's alternate is DeviceCMYK,
+//!   else Lab measured from the sRGB appearance.
+//! - Overprint: an item's [`Overprint::fill`] and [`Overprint::stroke`] both hold the flag that
+//!   governed its paint (`op` for fills, glyphs and images, `OP` for strokes).
+//!   [`Overprint::nonzero`] is `OPM 1` for colors set in DeviceCMYK only, where it applies.
+//! - Constant opacity, blend modes and soft masks wrap each paint in a group of its own; a text
+//!   run shares one wrapper.
+//! - Images keep their own space where it is inks: DeviceGray, DeviceCMYK, and the colorants of
+//!   `Separation` and `DeviceN` (Indexed images take their base's). Other spaces convert to CMYK
+//!   as colors do. `/Decode` and `/Matte` are applied; transfer functions are not, as on a plate.
+//! - Stencil masks become fills traced from the mask, or images when the mask is too detailed.
+//! - Axial and radial shadings become [`Paint::Gradient`]s with stops sampled in ink space.
+//!   Function-based and mesh shadings, and tiling patterns past [`MAX_TILING_CELLS`] cells or
+//!   [`MAX_TILING_ITEMS`] items, become images at [`ReadOptions::raster_dpi`]; other tiling patterns expand into their cells.
+
+use std::collections::HashMap;
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::sync::Arc;
+
+use craft_pdf::interpret::color::{CmykSimulation, ColorSpace, Ink as PdfInk, InkPaint, InkSpace, SpotAlternate};
+use craft_pdf::interpret::font::{Glyph, OutlineGlyph};
+use craft_pdf::interpret::hayro_cmap::BfString;
+use craft_pdf::interpret::pattern::{Pattern, ShadingPattern, TilingPattern};
+use craft_pdf::interpret::shading::ShadingType;
+use craft_pdf::interpret::{
+    BlendMode as PdfBlend, CacheKey, ClipPath, Context, Device, FillRule as PdfFillRule, GlyphDrawMode, Image, InterpreterCache, InterpreterSettings,
+    MaskType, Paint as PdfPaint, PathDrawMode, RasterImage, SoftMask, StencilImage, StrokeProps, TransformExt, interpret_page,
+};
+use craft_pdf::syntax::Filter;
+use craft_pdf::syntax::Pdf;
+use craft_pdf::syntax::object::dict::keys::{ANNOTS, AP, BITS_PER_COMPONENT, COLORSPACE, DECODE, DECODE_PARMS, F, HEIGHT, N, WIDTH};
+use craft_pdf::syntax::object::{Array, Dict, Name, Stream};
+use craft_pdf::syntax::page::Page;
+use craft_pdf::{OpenError, open_slice};
+use kurbo::{Affine, BezPath, PathEl, Point, Rect, Shape, Stroke, StrokeOpts};
+
+use super::font::FontCache;
+use super::shade::{self, Canvas, StopInks};
+use super::{
+    BlendMode, DisplayList, FillItem, FillRule, GradientGeometry, GroupItem, ImageItem, ImageSpace, Item, Mask, MaskKind, Paint, PlacedGlyph,
+    TextFont, TextItem,
+};
+use crate::cms::{ProfileError, srgb8_to_lab};
+use crate::ink::{Alternate, Ink, InkColor, InkId, InkSet, Overprint, Process, Spot};
+use crate::plates::{self, Conversion, Fallback};
+
+/// Curve flattening tolerance of outlined strokes, in points.
+const STROKE_TOLERANCE: f64 = 0.01;
+
+/// The width of a `0 w` stroke, the thinnest line a device can draw, in points.
+const HAIRLINE: f64 = 0.1;
+
+/// Dashes one stroke may be cut into; past this it is stroked solid, as hayro draws it.
+const MAX_DASHES_PER_STROKE: f64 = 250_000.0;
+
+/// Tiling cells one pattern fill expands into; past this the fill is read as an image.
+pub const MAX_TILING_CELLS: usize = 10_000;
+
+/// Items one pattern fill expands into, counting those inside groups and nested pattern fills;
+/// past this the fill is read as an image. A hundred per cell at [`MAX_TILING_CELLS`].
+pub const MAX_TILING_ITEMS: usize = 1_000_000;
+
+/// Rectangles a stencil mask may trace into; past this it is read as an image.
+const MAX_STENCIL_RECTS: usize = 4_096;
+
+/// Pixels one image read from a shading or tiling pattern may hold; a larger area is sampled
+/// at a lower resolution.
+const MAX_RASTER_PIXELS: f64 = 16_777_216.0;
+
+/// How much finer than the image a tiling cell is drawn, so that small cells keep their shapes.
+const CELL_OVERSAMPLE: f64 = 4.0;
+
+/// Pixels the drawing of one tiling cell may hold.
+const MAX_CELL_PIXELS: f64 = 4_194_304.0;
+
+/// Cell samples one image read from a tiling pattern may take; a pattern whose cells overlap is
+/// sampled at a lower resolution. Four per pixel at [`MAX_RASTER_PIXELS`], because a cell no
+/// larger than its step meets three others at its corners.
+const MAX_TILING_SAMPLES: f64 = 4.0 * MAX_RASTER_PIXELS;
+
+/// Inks a tiling pattern's canvases hold at their full pixel limits. Each pixel holds a value
+/// per ink of the page, so a page with more inks is sampled at a lower resolution, keeping the
+/// canvases (and their sampling) at the memory and work of CMYK ones.
+const CANVAS_INKS: f64 = 4.0;
+
+/// How [`read_page`] reads.
+#[derive(Clone, Debug)]
+pub struct ReadOptions {
+    /// The printing condition RGB, Lab and ICC colors convert into when the page has no output
+    /// intent with a usable CMYK profile.
+    pub fallback: Fallback,
+    /// Read the page's annotation appearances too. When `false`, the print-flagged ones with an
+    /// appearance are left out and counted ([`ReadReport::dropped_annotations`]).
+    pub annotations: bool,
+    /// The resolution, in pixels per inch, of images read from function-based and mesh
+    /// shadings and from tiling patterns past [`MAX_TILING_CELLS`] or [`MAX_TILING_ITEMS`].
+    pub raster_dpi: f32,
+}
+
+impl Default for ReadOptions {
+    fn default() -> Self {
+        Self { fallback: Fallback::default(), annotations: false, raster_dpi: 300.0 }
+    }
+}
+
+/// What [`read_page`] read, converted or left out.
+#[derive(Clone, Debug, PartialEq)]
+#[non_exhaustive]
+pub struct ReadReport {
+    /// How process color that isn't CMYK became CMYK.
+    pub conversion: Conversion,
+    /// Raster images read.
+    pub images: usize,
+    /// Of [`Self::images`], those whose samples were converted into CMYK (RGB, Lab, ICC and
+    /// CIE-based spaces).
+    pub converted_images: usize,
+    /// Images whose `/SMask` or `/Mask` had another size than the image, resampled to it.
+    pub resampled_masks: usize,
+    /// Images and stencil masks that didn't decode, left out.
+    pub unreadable_images: usize,
+    /// Stencil masks (`/ImageMask`) read.
+    pub stencils: usize,
+    /// Axial and radial shadings read as gradients.
+    pub gradients: usize,
+    /// Function-based and mesh shadings read as images.
+    pub rasterized_shadings: usize,
+    /// Tiling pattern cells expanded.
+    pub tiling_cells: usize,
+    /// Tiling pattern fills past [`MAX_TILING_CELLS`] cells or [`MAX_TILING_ITEMS`] items, read
+    /// as images.
+    pub rasterized_tilings: usize,
+    /// Tiling pattern fills left out: cells stacked too deep to sample, or canvases too large.
+    pub dropped_tilings: usize,
+    /// Glyphs in text rendering mode 3, dropped.
+    pub invisible_glyphs: usize,
+    /// Spot inks past the ink set's capacity, whose tints were dropped.
+    pub dropped_inks: usize,
+    /// Annotations that would print (Print flag set, not Hidden, with a normal appearance), left
+    /// out because [`ReadOptions::annotations`] is `false`.
+    pub dropped_annotations: usize,
+}
+
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum ReadError {
+    #[error(transparent)]
+    Open(#[from] OpenError),
+    #[error("page {0} does not exist")]
+    NoPage(usize),
+    #[error("the fallback profile can't be a printing condition: {0}")]
+    Profile(#[from] ProfileError),
+    #[error("the PDF interpreter failed on the page")]
+    Interpret,
+}
+
+/// Reads page `page` (from 0) of `pdf` into a display list. Never panics.
+pub fn read_page(pdf: &[u8], page: usize, opts: &ReadOptions) -> Result<(DisplayList, ReadReport), ReadError> {
+    let doc = open_slice(pdf, None)?;
+    let color = read_color(&doc, page, &opts.fallback)?;
+    read_page_in(&doc, page, opts, color)
+}
+
+/// How a page's process color converts: its output intent's simulation, else `fallback`'s.
+pub(crate) type ReadColor = (Option<CmykSimulation>, Conversion);
+
+/// The [`ReadColor`] of page `page`; parsing the profile is the slow part, so a document
+/// reads it once per output intent.
+pub(crate) fn read_color(doc: &Pdf, page: usize, fallback: &Fallback) -> Result<ReadColor, ReadError> {
+    match catch_unwind(AssertUnwindSafe(|| plates::output_intent(doc, page))) {
+        Ok(Some(found)) => Ok((Some(found.0), found.1)),
+        Ok(None) | Err(_) => plates::fallback(fallback).map_err(|e| match e {
+            plates::Error::Profile(p) => ReadError::Profile(p),
+            _ => ReadError::Interpret,
+        }),
+    }
+}
+
+/// [`read_page`] of an open document, with the page's color already read.
+pub(crate) fn read_page_in(doc: &Pdf, page: usize, opts: &ReadOptions, color: ReadColor) -> Result<(DisplayList, ReadReport), ReadError> {
+    let (simulation, conversion) = color;
+    let pages = doc.pages();
+    let p = pages.get(page).ok_or(ReadError::NoPage(page))?;
+    let (w, h) = p.render_dimensions();
+    let bbox = Rect::new(0.0, 0.0, f64::from(w), f64::from(h));
+    let report = ReadReport {
+        conversion,
+        images: 0,
+        converted_images: 0,
+        resampled_masks: 0,
+        unreadable_images: 0,
+        stencils: 0,
+        gradients: 0,
+        rasterized_shadings: 0,
+        tiling_cells: 0,
+        rasterized_tilings: 0,
+        dropped_tilings: 0,
+        invisible_glyphs: 0,
+        dropped_inks: 0,
+        dropped_annotations: if opts.annotations { 0 } else { catch_unwind(AssertUnwindSafe(|| printing_annotations(p))).unwrap_or(0) },
+    };
+    let dpi = if opts.raster_dpi.is_finite() && opts.raster_dpi > 0.0 { opts.raster_dpi } else { 300.0 };
+    let mut shared = Shared {
+        simulation,
+        inks: InkSet::new(),
+        spots: HashMap::new(),
+        report,
+        masks: HashMap::new(),
+        fonts: FontCache::new(),
+        scale: f64::from(dpi) / 72.0,
+    };
+
+    let items = catch_unwind(AssertUnwindSafe(|| {
+        let cache = InterpreterCache::new();
+        let settings = InterpreterSettings { render_annotations: opts.annotations, ..Default::default() };
+        let mut context = Context::new(p.initial_transform(true).to_kurbo(), bbox, &cache, p.xref(), settings);
+        let mut reader = Reader::new(&mut shared, false, bbox);
+        interpret_page(p, &mut context, &mut reader);
+        reader.finish()
+    }))
+    .map_err(|_| ReadError::Interpret)?;
+
+    let Shared { inks, report, fonts, .. } = shared;
+    let fonts = fonts.finish();
+    let mut items = items;
+    set_fonts(&mut items, &fonts);
+    Ok((DisplayList { page: bbox, inks, items }, report))
+}
+
+/// The annotations of `page` a printer would paint: Print flag (bit 3) set, Hidden (bit 2)
+/// clear, with a normal appearance (`/AP /N`).
+fn printing_annotations(page: &Page<'_>) -> usize {
+    let Some(annots) = page.raw().get::<Array<'_>>(ANNOTS) else { return 0 };
+    annots
+        .iter::<Dict<'_>>()
+        .filter(|a| a.get::<u32>(F).unwrap_or(0) & (4 | 2) == 4 && a.get::<Dict<'_>>(AP).is_some_and(|ap| ap.contains_key(N)))
+        .count()
+}
+
+/// State shared by the page's reader and the readers of its soft masks and Type 3 glyphs.
+struct Shared {
+    simulation: Option<CmykSimulation>,
+    inks: InkSet,
+    spots: HashMap<PdfInk, Option<InkId>>,
+    report: ReadReport,
+    /// Soft masks read so far, by hayro's cache key.
+    masks: HashMap<u128, Option<Mask>>,
+    fonts: FontCache,
+    /// Raster pixels per point.
+    scale: f64,
+}
+
+/// How a paint composites: what wraps it in a group of its own.
+#[derive(Clone)]
+struct Look<'a> {
+    opacity: f32,
+    blend: BlendMode,
+    mask: Option<SoftMask<'a>>,
+}
+
+impl Look<'_> {
+    fn same(&self, other: &Self) -> bool {
+        self.opacity == other.opacity
+            && self.blend == other.blend
+            && self.mask.as_ref().map(CacheKey::cache_key) == other.mask.as_ref().map(CacheKey::cache_key)
+    }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum FrameKind {
+    Root,
+    Clip,
+    Group,
+}
+
+struct Frame {
+    kind: FrameKind,
+    group: GroupItem,
+}
+
+/// A text run being collected.
+struct Run<'a> {
+    /// The source font's key; `None` for Type 3 glyphs.
+    font: Option<u128>,
+    /// The linear part of glyph space (one unit per em) to page space.
+    linear: Affine,
+    look: Look<'a>,
+    item: TextItem,
+}
+
+/// What a paint paints with.
+enum Painted<'a> {
+    /// A paint an item carries.
+    Flat(Paint, Look<'a>, Overprint),
+    /// A pattern read over the painted area ([`Reader::area_fill`]).
+    Area,
+}
+
+/// The hayro-interpret device. `glyph` readers read a Type 3 glyph procedure: they collect
+/// paints without their own transparency, which the glyph's run carries.
+struct Reader<'s, 'a> {
+    shared: &'s mut Shared,
+    glyph: bool,
+    /// Where the content can show, before clips: the page, or unbounded for a tiling cell,
+    /// whose copies land elsewhere.
+    bounds: Rect,
+    frames: Vec<Frame>,
+    soft_mask: Option<SoftMask<'a>>,
+    blend: BlendMode,
+    /// `op`, `OP` and `OPM`.
+    overprint: (bool, bool, u8),
+    run: Option<Run<'a>>,
+}
+
+fn plain_group(clip: Option<BezPath>) -> GroupItem {
+    GroupItem { opacity: 1.0, blend: BlendMode::Normal, isolated: false, knockout: false, clip, mask: None, actual_text: None, children: Vec::new() }
+}
+
+impl<'s, 'a> Reader<'s, 'a> {
+    fn new(shared: &'s mut Shared, glyph: bool, bounds: Rect) -> Self {
+        Self {
+            shared,
+            glyph,
+            bounds,
+            frames: vec![Frame { kind: FrameKind::Root, group: plain_group(None) }],
+            soft_mask: None,
+            blend: BlendMode::Normal,
+            overprint: (false, false, 0),
+            run: None,
+        }
+    }
+
+    /// The items read, with every open clip and group closed.
+    fn finish(mut self) -> Vec<Item> {
+        self.flush();
+        while self.frames.len() > 1 {
+            self.close_top();
+        }
+        self.frames.pop().map(|f| f.group.children).unwrap_or_default()
+    }
+
+    fn add(&mut self, item: Item) {
+        if let Some(frame) = self.frames.last_mut() {
+            frame.group.children.push(item);
+        }
+    }
+
+    fn close_top(&mut self) {
+        let Some(frame) = self.frames.pop_if(|f| f.kind != FrameKind::Root) else { return };
+        if frame.group.children.is_empty() {
+            return;
+        }
+        // A group that changes nothing (hayro wraps every image in one) adds its children.
+        let g = &frame.group;
+        let plain = g.opacity == 1.0
+            && g.blend == BlendMode::Normal
+            && !g.isolated
+            && !g.knockout
+            && g.clip.is_none()
+            && g.mask.is_none()
+            && g.actual_text.is_none();
+        if plain {
+            for item in frame.group.children {
+                self.add(item);
+            }
+        } else {
+            self.add(Item::Group(frame.group));
+        }
+    }
+
+    /// The page area content can show in, through every open clip.
+    fn clip_bounds(&self) -> Rect {
+        let mut r = self.bounds;
+        for frame in &self.frames {
+            if let Some(clip) = &frame.group.clip {
+                r = r.intersect(clip.bounding_box());
+            }
+        }
+        r
+    }
+
+    /// Raster pixels per point for an image over `area`, within [`MAX_RASTER_PIXELS`].
+    fn raster_scale(&self, area: Rect) -> f64 {
+        limit_scale(self.shared.scale, area, MAX_RASTER_PIXELS)
+    }
+
+    /// Closes the innermost frame of `kind`, and the frames opened inside it.
+    fn close(&mut self, kind: FrameKind) {
+        self.flush();
+        let Some(at) = self.frames.iter().rposition(|f| f.kind == kind) else { return };
+        while self.frames.len() > at {
+            self.close_top();
+        }
+    }
+
+    fn look(&self, opacity: f32) -> Look<'a> {
+        if self.glyph {
+            return Look { opacity: 1.0, blend: BlendMode::Normal, mask: None };
+        }
+        Look { opacity, blend: self.blend, mask: self.soft_mask.clone() }
+    }
+
+    /// Adds `item`, in a group of its own when `look` is transparent.
+    fn push(&mut self, item: Item, look: &Look<'a>) {
+        let mask = look.mask.as_ref().and_then(|m| self.mask(m));
+        let item = if look.opacity < 1.0 || look.blend != BlendMode::Normal || mask.is_some() {
+            Item::Group(GroupItem { opacity: look.opacity, blend: look.blend, mask: mask.map(Box::new), children: vec![item], ..plain_group(None) })
+        } else {
+            item
+        };
+        self.add(item);
+    }
+
+    fn flush(&mut self) {
+        let Some(mut run) = self.run.take() else { return };
+        if run.item.text.as_deref() == Some("") {
+            run.item.text = None;
+        }
+        self.push(Item::Text(run.item), &run.look);
+    }
+
+    fn mask(&mut self, mask: &SoftMask<'a>) -> Option<Mask> {
+        let key = mask.cache_key();
+        if let Some(read) = self.shared.masks.get(&key) {
+            return read.clone();
+        }
+        // A mask that refers to itself reads as no mask.
+        self.shared.masks.insert(key, None);
+        let mut reader = Reader::new(&mut *self.shared, false, self.bounds);
+        mask.interpret(&mut reader);
+        let children = reader.finish();
+        let kind = match mask.mask_type() {
+            MaskType::Luminosity => MaskKind::Luminosity,
+            MaskType::Alpha => MaskKind::Alpha,
+        };
+        let backdrop = match kind {
+            MaskKind::Luminosity => self.ink_color(&mask.background_color()),
+            MaskKind::Alpha => None,
+        };
+        let transfer = mask.transfer_function().map(|tf| (0..=255_u8).map(|v| (tf.apply(f32::from(v) / 255.0) * 255.0).round() as u8).collect());
+        let group = GroupItem { isolated: true, children, ..plain_group(None) };
+        let read = Mask { kind, group, backdrop, transfer };
+        self.shared.masks.insert(key, Some(read.clone()));
+        Some(read)
+    }
+
+    fn ink(&mut self, ink: &PdfInk, alternate: impl FnOnce() -> Option<SpotAlternate>) -> Option<InkId> {
+        let process = match ink {
+            PdfInk::Cyan => Process::Cyan,
+            PdfInk::Magenta => Process::Magenta,
+            PdfInk::Yellow => Process::Yellow,
+            PdfInk::Black => Process::Black,
+            PdfInk::Spot(name) => {
+                if let Some(id) = self.shared.spots.get(ink) {
+                    return *id;
+                }
+                let alternate = match alternate() {
+                    Some(SpotAlternate::Cmyk(cmyk)) => Alternate::Cmyk(cmyk),
+                    Some(SpotAlternate::Srgb(rgb)) => Alternate::Lab(srgb8_to_lab(rgb).unwrap_or([0.0; 3])),
+                    None => Alternate::Lab([0.0; 3]),
+                };
+                let id = self.shared.inks.add(Ink::Spot(Spot { name: name.to_string(), alternate, solidity: None }));
+                self.shared.spots.insert(ink.clone(), id);
+                return id;
+            }
+        };
+        Some(InkId::process(process))
+    }
+
+    /// The color as inks; `None` when it paints nothing (the `None` colorant).
+    fn ink_color(&mut self, color: &craft_pdf::interpret::color::Color) -> Option<InkColor> {
+        match color.ink_paint(self.shared.simulation.as_ref())? {
+            InkPaint::Tints(tints) => {
+                let mut out = Vec::with_capacity(tints.len());
+                for (ink, tint) in tints {
+                    match self.ink(&ink, || color.spot_alternate(&ink)) {
+                        Some(id) => out.push((id, tint)),
+                        None => self.shared.report.dropped_inks += 1,
+                    }
+                }
+                Some(InkColor::Tints(out))
+            }
+            InkPaint::All(tint) => Some(InkColor::All(tint)),
+            InkPaint::None => None,
+        }
+    }
+
+    /// How values of `space` (colors of `cs`) become samples or stops: the inks, and which
+    /// values to keep. `None` when the space paints nothing.
+    fn space_inks(&mut self, space: &InkSpace, cs: &ColorSpace) -> Option<(Inks, Channels)> {
+        let process = || Process::ALL.iter().map(|p| InkId::process(*p)).collect();
+        Some(match space {
+            InkSpace::None => return None,
+            InkSpace::Gray => (Inks::Gray, Channels::All),
+            InkSpace::Cmyk { .. } => (Inks::Cmyk(process()), Channels::All),
+            InkSpace::All => (Inks::List(self.shared.inks.iter().map(|(id, _)| id).collect()), Channels::Spread(self.shared.inks.len())),
+            InkSpace::Inks(list) => {
+                let mut ids = Vec::with_capacity(list.len());
+                let mut keep = Vec::with_capacity(list.len());
+                for ink in list {
+                    let id = self.ink(ink, || cs.spot_alternate(ink));
+                    if id.is_none() {
+                        self.shared.report.dropped_inks += 1;
+                    }
+                    keep.push(id.is_some());
+                    ids.extend(id);
+                }
+                if ids.is_empty() {
+                    return None;
+                }
+                let channels = if keep.iter().all(|k| *k) { Channels::All } else { Channels::Keep(keep) };
+                (Inks::List(ids), channels)
+            }
+        })
+    }
+
+    /// The paint and how it paints; `None` when it paints nothing.
+    fn paint(&mut self, paint: &PdfPaint<'a>, stroke: bool) -> Option<Painted<'a>> {
+        let (op, big_op, mode) = self.overprint;
+        let flag = if stroke { big_op } else { op };
+        let mut overprint = Overprint { fill: flag, stroke: flag, nonzero: false };
+        match paint {
+            PdfPaint::Color(color) => {
+                overprint.nonzero = mode == 1 && color.is_device_cmyk();
+                let ink = self.ink_color(color)?;
+                Some(Painted::Flat(Paint::Solid(ink), self.look(color.opacity()), overprint))
+            }
+            PdfPaint::Pattern(pattern) => match pattern.as_ref() {
+                // A gradient that needs a clip (a bounding box, or an end that doesn't extend) or a
+                // background is read over its area.
+                Pattern::Shading(s)
+                    if s.shading.clip_path.is_none()
+                        && s.shading.background.is_none()
+                        && matches!(s.shading.shading_type.as_ref(), ShadingType::RadialAxial { extend: [true, true], .. }) =>
+                {
+                    overprint.nonzero = mode == 1 && s.shading.color_space.is_device_cmyk();
+                    let (gradient, _) = self.gradient(s)?;
+                    Some(Painted::Flat(gradient, self.look(s.opacity), overprint))
+                }
+                Pattern::Shading(_) | Pattern::Tiling(_) => Some(Painted::Area),
+            },
+        }
+    }
+
+    /// An axial or radial shading as a gradient extended at both ends, with the clip to its own
+    /// extent when the shading doesn't extend (see [`shade::gradient_extent`]); `None` for other
+    /// types, or when it paints nothing.
+    fn gradient(&mut self, sp: &ShadingPattern) -> Option<(Paint, Option<BezPath>)> {
+        let ShadingType::RadialAxial { coords, domain, function, extend, axial } = sp.shading.shading_type.as_ref() else { return None };
+        let cs = &sp.shading.color_space;
+        let simulation = self.shared.simulation.clone();
+        let space = cs.ink_space(simulation.as_ref());
+        let (inks, channels) = self.space_inks(&space, cs)?;
+        let stops = shade::sample_stops(space.len(), |s| {
+            let t = domain[0] + s * (domain[1] - domain[0]);
+            let components = shade::eval(function, &[t])?;
+            let mut values = Vec::new();
+            cs.ink_values(&components, simulation.as_ref(), &mut values);
+            Some(values)
+        });
+        let kind = inks.stop_inks();
+        let stops = stops.into_iter().map(|(offset, values)| (offset, shade::stop_color(&kind, &channels.apply_f32(&values)))).collect();
+        let c = coords.map(f64::from);
+        let geometry = if *axial {
+            GradientGeometry::Axial { start: Point::new(c[0], c[1]), end: Point::new(c[2], c[3]), extend: [true, true], transform: sp.matrix }
+        } else {
+            GradientGeometry::Radial {
+                start: Point::new(c[0], c[1]),
+                start_radius: c[2],
+                end: Point::new(c[3], c[4]),
+                end_radius: c[5],
+                extend: [true, true],
+                transform: sp.matrix,
+            }
+        };
+        let extent = shade::gradient_extent(&geometry, *extend, self.clip_bounds());
+        self.shared.report.gradients += 1;
+        Some((Paint::Gradient { stops, geometry }, extent))
+    }
+
+    fn fill(&mut self, path: BezPath, rule: FillRule, paint: &PdfPaint<'a>, stroke: bool) {
+        match self.paint(paint, stroke) {
+            Some(Painted::Flat(paint, look, overprint)) => {
+                self.flush();
+                self.push(Item::Fill(FillItem { path, rule, paint, overprint }), &look);
+            }
+            Some(Painted::Area) => self.area_fill(path, rule, paint, stroke),
+            None => {}
+        }
+    }
+
+    /// A shading or tiling pattern read over `path`: its items or an image, clipped to the
+    /// path.
+    fn area_fill(&mut self, path: BezPath, rule: FillRule, paint: &PdfPaint<'a>, stroke: bool) {
+        let PdfPaint::Pattern(pattern) = paint else { return };
+        self.flush();
+        let clip = nonzero(&path, rule);
+        let (op, big_op, _) = self.overprint;
+        let flag = if stroke { big_op } else { op };
+        match pattern.as_ref() {
+            Pattern::Shading(sp) => self.shading_area(clip, sp, flag),
+            Pattern::Tiling(t) => self.tiling_area(clip, t, flag, stroke),
+        }
+    }
+
+    fn shading_area(&mut self, clip: BezPath, sp: &ShadingPattern, flag: bool) {
+        let look = self.look(sp.opacity);
+        let cs = &sp.shading.color_space;
+        // Nonzero overprint mode is for colors set in DeviceCMYK, not shadings or images
+        // (ISO 32000-2 §8.6.7).
+        let overprint = Overprint { fill: flag, stroke: flag, nonzero: false };
+        let simulation = self.shared.simulation.clone();
+        let mut children = Vec::new();
+        if let Some(bg) = &sp.shading.background {
+            let mut values = Vec::new();
+            cs.ink_values(bg, simulation.as_ref(), &mut values);
+            let space = cs.ink_space(simulation.as_ref());
+            if let Some((inks, channels)) = self.space_inks(&space, cs) {
+                let kind = inks.stop_inks();
+                let paint = Paint::Solid(shade::stop_color(&kind, &channels.apply_f32(&values)));
+                children.push(Item::Fill(FillItem { path: clip.clone(), rule: FillRule::NonZero, paint, overprint }));
+            }
+        }
+        let shaded = if matches!(sp.shading.shading_type.as_ref(), ShadingType::RadialAxial { .. }) {
+            self.gradient(sp).map(|(paint, extent)| {
+                let fill = Item::Fill(FillItem { path: clip.clone(), rule: FillRule::NonZero, paint, overprint });
+                match extent {
+                    Some(extent) => Item::Group(GroupItem { children: vec![fill], ..plain_group(Some(extent)) }),
+                    None => fill,
+                }
+            })
+        } else {
+            self.shading_image(&clip, sp, overprint).map(Item::Image)
+        };
+        if let Some(item) = shaded {
+            match &sp.shading.clip_path {
+                Some(bbox) => children.push(Item::Group(GroupItem { children: vec![item], ..plain_group(Some(bbox.clone())) })),
+                None => children.push(item),
+            }
+        }
+        if !children.is_empty() {
+            self.push(Item::Group(GroupItem { children, ..plain_group(Some(clip)) }), &look);
+        }
+    }
+
+    /// A function-based or mesh shading sampled over the visible part of `clip`.
+    fn shading_image(&mut self, clip: &BezPath, sp: &ShadingPattern, overprint: Overprint) -> Option<ImageItem> {
+        let mut area = clip.bounding_box().intersect(self.clip_bounds());
+        if let Some(bbox) = &sp.shading.clip_path {
+            area = area.intersect(bbox.bounding_box());
+        }
+        if !(area.width() > 0.0 && area.height() > 0.0) {
+            return None;
+        }
+        let scale = self.raster_scale(area);
+        let simulation = self.shared.simulation.clone();
+        // The background is its own fill, under the image.
+        let raster = shade::rasterize_shading(sp, area, scale, false, simulation.as_ref())?;
+        let cs = &sp.shading.color_space;
+        let space = cs.ink_space(simulation.as_ref());
+        let (inks, channels) = self.space_inks(&space, cs)?;
+        let samples: Vec<u8> = raster.values.iter().map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8).collect();
+        let samples = channels.apply(samples, space.len());
+        let (w, h) = (raster.width as usize, raster.height as usize);
+        let smask = (!raster.alpha.iter().all(|a| *a == 255)).then(|| raster.alpha.into());
+        self.shared.report.rasterized_shadings += 1;
+        Some(ImageItem {
+            space: inks.image_space(),
+            size: (raster.width, raster.height),
+            samples: samples.into(),
+            transform: shade::area_transform(area, scale, (w, h)),
+            smask,
+            overprint,
+            jpeg: None,
+        })
+    }
+
+    /// A tiling pattern over `clip`: its cells, each read like page content, or an image past
+    /// [`MAX_TILING_CELLS`] or [`MAX_TILING_ITEMS`].
+    fn tiling_area(&mut self, clip: BezPath, t: &TilingPattern<'a>, flag: bool, stroke: bool) {
+        let area = clip.bounding_box().intersect(self.clip_bounds());
+        if !(area.width() > 0.0 && area.height() > 0.0) {
+            return;
+        }
+        let m = t.matrix;
+        let inv = m.inverse();
+        let (xs, ys) = (f64::from(t.x_step), f64::from(t.y_step));
+        let b = t.bbox;
+        let pa = inv.transform_rect_bbox(area);
+        let (Some(is), Some(js)) = (cells(pa.x0, pa.x1, b.x0, b.x1, xs), cells(pa.y0, pa.y1, b.y0, b.y1, ys)) else { return };
+        let count = (is.1 - is.0 + 1) as u128 * (js.1 - js.0 + 1) as u128;
+
+        let mut reader = Reader::new(&mut *self.shared, false, Rect::new(-1e9, -1e9, 1e9, 1e9));
+        reader.overprint = self.overprint;
+        t.interpret(&mut reader, m, stroke);
+        let cell = reader.finish();
+        if cell.is_empty() {
+            return;
+        }
+        let look = self.look(1.0);
+        let offset = |i: i64, j: i64| m * Point::new(i as f64 * xs, j as f64 * ys) - m * Point::ORIGIN;
+        let items = count.saturating_mul(item_count(&cell) as u128);
+        let child = if count <= MAX_TILING_CELLS as u128 && items <= MAX_TILING_ITEMS as u128 {
+            let mut children = Vec::with_capacity(count as usize * cell.len());
+            for j in js.0..=js.1 {
+                for i in is.0..=is.1 {
+                    let mut copy = cell.clone();
+                    shade::translate(&mut copy, offset(i, j));
+                    children.extend(copy);
+                }
+            }
+            self.shared.report.tiling_cells += count as usize;
+            children
+        } else {
+            // Every pixel samples each cell over it: one, or more where cells are larger than
+            // their step and overlap. Cells stacked deeper than MAX_TILING_CELLS paint nothing,
+            // like fills past the range of `cells`.
+            let per_pixel = ((b.width().abs() / xs.abs()).floor() + 1.0) * ((b.height().abs() / ys.abs()).floor() + 1.0);
+            if !per_pixel.is_finite() || per_pixel > MAX_TILING_CELLS as f64 {
+                self.shared.report.dropped_tilings += 1;
+                return;
+            }
+            let inks = &self.shared.inks;
+            let cell_box = m.transform_rect_bbox(b);
+            let (scale, cell_scale) = tiling_scales(self.shared.scale, area, cell_box, per_pixel, inks.len());
+            let (Some(mut drawn), Some(mut canvas)) = (Canvas::new(cell_box, cell_scale, inks), Canvas::new(area, scale, inks)) else {
+                self.shared.report.dropped_tilings += 1;
+                return;
+            };
+            drawn.draw(&cell);
+            let (w, h) = canvas.size();
+            for y in 0..h {
+                for x in 0..w {
+                    let p = canvas.center(x, y);
+                    let q = inv * p;
+                    let (Some(ci), Some(cj)) = (cells(q.x, q.x, b.x0, b.x1, xs), cells(q.y, q.y, b.y0, b.y1, ys)) else { continue };
+                    for j in cj.0..=cj.1 {
+                        for i in ci.0..=ci.1 {
+                            if let Some((value, a)) = drawn.sample(p - offset(i, j))
+                                && a > 0.0
+                            {
+                                let value = value.to_vec();
+                                canvas.over(x, y, &value, a);
+                            }
+                        }
+                    }
+                }
+            }
+            let image = canvas.into_image(Overprint { fill: flag, stroke: flag, nonzero: false });
+            self.shared.report.rasterized_tilings += 1;
+            vec![Item::Image(image)]
+        };
+        self.push(Item::Group(GroupItem { children: child, ..plain_group(Some(clip)) }), &look);
+    }
+
+    fn raster_image(&mut self, image: &RasterImage<'_>, transform: Affine) {
+        let mut decoded = None;
+        image.with_inks(self.shared.simulation.as_ref(), |im| decoded = Some(im));
+        let Some(im) = decoded else {
+            self.shared.report.unreadable_images += 1;
+            return;
+        };
+        let Some((inks, channels)) = self.space_inks(&im.space, &im.color_space) else { return };
+        self.shared.report.images += 1;
+        if matches!(im.space, InkSpace::Cmyk { converted: true }) {
+            self.shared.report.converted_images += 1;
+        }
+        let (w, h) = (im.width as usize, im.height as usize);
+        let samples = channels.apply(im.samples, im.space.len());
+        let smask = im.alpha.map(|a| {
+            if (a.width as usize, a.height as usize) == (w, h) {
+                a.data
+            } else {
+                self.shared.report.resampled_masks += 1;
+                shade::resample(&a.data, (a.width as usize, a.height as usize), (w, h))
+            }
+        });
+        let smask = smask.filter(|a| !a.iter().all(|v| *v == 255)).map(Arc::from);
+        let (sx, sy) = im.scale_factors;
+        let transform = transform * Affine::scale_non_uniform(w as f64 * f64::from(sx), h as f64 * f64::from(sy));
+        let (op, _, _) = self.overprint;
+        let overprint = Overprint { fill: op, stroke: op, nonzero: false };
+        self.flush();
+        let device = matches!(im.space, InkSpace::Gray | InkSpace::Cmyk { converted: false });
+        let jpeg = if device && smask.is_none() { dct_passthrough(image.stream(), im.width, im.height) } else { None };
+        self.add(Item::Image(ImageItem {
+            space: inks.image_space(),
+            size: (im.width, im.height),
+            samples: samples.into(),
+            transform,
+            smask,
+            overprint,
+            jpeg,
+        }));
+    }
+
+    /// A stencil mask: a fill traced from the mask, or past [`MAX_STENCIL_RECTS`] an image of
+    /// the paint with the mask as its alpha.
+    fn stencil(&mut self, image: &StencilImage<'a, '_>, transform: Affine) {
+        let mut read = None;
+        image.with_stencil(|luma, paint| read = Some((luma, paint.clone())), None);
+        let Some((luma, paint)) = read else {
+            self.shared.report.unreadable_images += 1;
+            return;
+        };
+        self.shared.report.stencils += 1;
+        let (w, h) = (luma.width as usize, luma.height as usize);
+        let (sx, sy) = luma.scale_factors;
+        let to_page = transform * Affine::scale_non_uniform(f64::from(sx), f64::from(sy));
+        if let Some(rects) = shade::trace_stencil(&luma.data, w, h, MAX_STENCIL_RECTS) {
+            let mut path = BezPath::new();
+            for r in rects {
+                path.extend(shade::rect_path(r, to_page).iter());
+            }
+            if !path.elements().is_empty() {
+                self.fill(path, FillRule::NonZero, &paint, false);
+            }
+            return;
+        }
+        let unit = to_page * Affine::scale_non_uniform(w as f64, h as f64);
+        let size = (luma.width, luma.height);
+        match self.paint(&paint, false) {
+            None => {}
+            Some(Painted::Flat(Paint::Solid(color), look, overprint)) => {
+                let (space, value): (ImageSpace, Vec<u8>) = match &color {
+                    InkColor::Tints(tints) => (ImageSpace::Inks(tints.iter().map(|t| t.0).collect()), tints.iter().map(|t| to_byte(t.1)).collect()),
+                    InkColor::All(t) => {
+                        (ImageSpace::Inks(self.shared.inks.iter().map(|(id, _)| id).collect()), vec![to_byte(*t); self.shared.inks.len()])
+                    }
+                    InkColor::None => return,
+                };
+                let samples: Vec<u8> = value.iter().copied().cycle().take(value.len() * w * h).collect();
+                self.flush();
+                self.push(
+                    Item::Image(ImageItem {
+                        space,
+                        size,
+                        samples: samples.into(),
+                        transform: unit,
+                        smask: Some(luma.data.into()),
+                        overprint,
+                        jpeg: None,
+                    }),
+                    &look,
+                );
+            }
+            Some(_) => {
+                // A pattern paint: the paint over the image's square, masked by the stencil.
+                let shape = ImageItem {
+                    space: ImageSpace::Gray,
+                    size,
+                    samples: vec![0; w * h].into(),
+                    transform: unit,
+                    smask: Some(luma.data.into()),
+                    overprint: Overprint::default(),
+                    jpeg: None,
+                };
+                let group = GroupItem { isolated: true, children: vec![Item::Image(shape)], ..plain_group(None) };
+                let mask = Mask { kind: MaskKind::Alpha, group, backdrop: None, transfer: None };
+                self.flush();
+                self.frames.push(Frame { kind: FrameKind::Group, group: GroupItem { mask: Some(Box::new(mask)), ..plain_group(None) } });
+                self.fill(shade::rect_path(Rect::new(0.0, 0.0, 1.0, 1.0), unit), FillRule::NonZero, &paint, false);
+                self.close(FrameKind::Group);
+            }
+        }
+    }
+
+    fn outline_glyph(&mut self, glyph: &OutlineGlyph, matrix: Affine, pdf_paint: &PdfPaint<'a>) {
+        let (paint, look, overprint) = match self.paint(pdf_paint, false) {
+            Some(Painted::Flat(paint, look, overprint)) => (paint, look, overprint),
+            Some(Painted::Area) => return self.area_fill(matrix * glyph.outline(), FillRule::NonZero, pdf_paint, false),
+            None => return,
+        };
+        let key = self.shared.fonts.note(glyph);
+        let unicode = glyph.as_unicode().map(unicode);
+        self.add_glyph(Some(key), glyph.glyph_id().to_u32(), matrix, matrix * glyph.outline(), unicode, paint, look, overprint);
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn add_glyph(
+        &mut self,
+        font: Option<u128>,
+        id: u32,
+        matrix: Affine,
+        outline: BezPath,
+        unicode: Option<String>,
+        paint: Paint,
+        look: Look<'a>,
+        overprint: Overprint,
+    ) {
+        let linear = matrix * Affine::scale(1000.0);
+        let continues = self.run.as_ref().is_some_and(|run| {
+            run.font == font && same_linear(run.linear, linear) && run.item.paint == paint && run.item.overprint == overprint && run.look.same(&look)
+        });
+        if !continues {
+            self.flush();
+            let size = linear.determinant().abs().sqrt();
+            if !size.is_finite() || size <= f64::EPSILON {
+                return;
+            }
+            let [a, b, c, d, ..] = linear.as_coeffs();
+            let origin = matrix.translation();
+            let transform = Affine::new([a / size, b / size, c / size, d / size, origin.x, origin.y]);
+            // A placeholder font carrying the key; `set_fonts` replaces it.
+            let placeholder = font.map(|key| Arc::new(TextFont { data: Arc::new(Vec::<u8>::new()), index: 0, key }));
+            let item = TextItem {
+                font: placeholder,
+                size: size as f32,
+                transform,
+                glyphs: Vec::new(),
+                text: Some(String::new()),
+                outlines: BezPath::new(),
+                paint,
+                overprint,
+            };
+            self.run = Some(Run { font, linear, look, item });
+        }
+        let Some(run) = self.run.as_mut() else { return };
+        let item = &mut run.item;
+        let text = item.text.get_or_insert_with(String::new);
+        let start = text.len();
+        text.push_str(unicode.as_deref().unwrap_or(""));
+        let origin = item.transform.inverse() * matrix.translation().to_point();
+        item.glyphs.push(PlacedGlyph { id, origin, text: start..text.len() });
+        item.outlines.extend(outline.iter());
+    }
+
+    fn type3_glyph(&mut self, glyph: &craft_pdf::interpret::font::Type3Glyph<'a>, transform: Affine, glyph_transform: Affine, paint: &PdfPaint<'a>) {
+        let (run_paint, look, overprint) = match self.paint(paint, false) {
+            Some(Painted::Flat(paint, look, overprint)) => (Some(paint), look, overprint),
+            Some(Painted::Area) => (None, self.look(1.0), Overprint::default()),
+            None => return,
+        };
+        let mut reader = Reader::new(&mut *self.shared, true, self.bounds);
+        reader.overprint = self.overprint;
+        glyph.interpret(&mut reader, transform, glyph_transform, paint);
+        let items = reader.finish();
+        let unicode = glyph.as_unicode().map(unicode);
+        // A glyph that only fills in the text's paint (`d1`, or `d0` painting that color) is a
+        // shape: it joins the run.
+        let shape = items.iter().all(|item| matches!(item, Item::Fill(f) if Some(&f.paint) == run_paint.as_ref()));
+        if let (true, Some(run_paint)) = (shape, run_paint) {
+            let mut outline = BezPath::new();
+            for item in &items {
+                if let Item::Fill(f) = item {
+                    outline.extend(nonzero(&f.path, f.rule).iter());
+                }
+            }
+            self.add_glyph(None, 0, transform * glyph_transform, outline, unicode, run_paint, look, overprint);
+        } else if !items.is_empty() {
+            self.flush();
+            let group = GroupItem { actual_text: unicode, children: items, ..plain_group(None) };
+            self.push(Item::Group(group), &look);
+        }
+    }
+}
+
+impl<'a> Device<'a> for Reader<'_, 'a> {
+    fn set_soft_mask(&mut self, mask: Option<SoftMask<'a>>) {
+        self.soft_mask = mask;
+    }
+
+    fn set_blend_mode(&mut self, blend_mode: PdfBlend) {
+        self.blend = blend(blend_mode);
+    }
+
+    fn set_overprint(&mut self, fill: bool, stroke: bool, mode: u8) {
+        self.overprint = (fill, stroke, mode);
+    }
+
+    fn draw_path(&mut self, path: &BezPath, transform: Affine, paint: &PdfPaint<'a>, draw_mode: &PathDrawMode) {
+        match draw_mode {
+            PathDrawMode::Fill(rule) => self.fill(transform * path.clone(), fill_rule(*rule), paint, false),
+            PathDrawMode::Stroke(props) => self.fill(outline_stroke(path, transform, props), FillRule::NonZero, paint, true),
+        }
+    }
+
+    fn push_clip_path(&mut self, clip_path: &ClipPath) {
+        self.flush();
+        let clip = nonzero(&clip_path.path, fill_rule(clip_path.fill));
+        self.frames.push(Frame { kind: FrameKind::Clip, group: plain_group(Some(clip)) });
+    }
+
+    fn push_transparency_group(&mut self, opacity: f32, mask: Option<SoftMask<'a>>, blend_mode: PdfBlend) {
+        self.flush();
+        let mask = if self.glyph { None } else { mask.and_then(|m| self.mask(&m)) };
+        let (opacity, blend_mode) = if self.glyph { (1.0, BlendMode::Normal) } else { (opacity, blend(blend_mode)) };
+        let group = GroupItem { opacity, blend: blend_mode, mask: mask.map(Box::new), ..plain_group(None) };
+        self.frames.push(Frame { kind: FrameKind::Group, group });
+    }
+
+    fn set_knockout(&mut self) {
+        if let Some(frame) = self.frames.last_mut().filter(|f| f.kind == FrameKind::Group) {
+            frame.group.knockout = true;
+        }
+    }
+
+    fn set_isolated(&mut self) {
+        if let Some(frame) = self.frames.last_mut().filter(|f| f.kind == FrameKind::Group) {
+            frame.group.isolated = true;
+        }
+    }
+
+    fn draw_glyph(&mut self, glyph: &Glyph<'a>, transform: Affine, glyph_transform: Affine, paint: &PdfPaint<'a>, draw_mode: &GlyphDrawMode) {
+        match (glyph, draw_mode) {
+            (_, GlyphDrawMode::Invisible) => self.shared.report.invisible_glyphs += 1,
+            // Clip-only text: the interpreter installs its clip, and the glyph paints nothing.
+            (_, GlyphDrawMode::Clip) => {}
+            (Glyph::Outline(o), GlyphDrawMode::Fill) => self.outline_glyph(o, transform * glyph_transform, paint),
+            (Glyph::Outline(o), GlyphDrawMode::Stroke(props)) => {
+                self.fill(outline_stroke(&(glyph_transform * o.outline()), transform, props), FillRule::NonZero, paint, true);
+            }
+            (Glyph::Type3(t), _) => self.type3_glyph(t, transform, glyph_transform, paint),
+        }
+    }
+
+    fn draw_image(&mut self, image: Image<'a, '_>, transform: Affine) {
+        match image {
+            Image::Raster(r) => self.raster_image(&r, transform),
+            Image::Stencil(s) => self.stencil(&s, transform),
+        }
+    }
+
+    fn pop_clip_path(&mut self) {
+        self.close(FrameKind::Clip);
+    }
+
+    fn pop_transparency_group(&mut self) {
+        self.close(FrameKind::Group);
+    }
+}
+
+/// The inks of samples or stops.
+enum Inks {
+    /// A gray level.
+    Gray,
+    /// The four process inks.
+    Cmyk(Vec<InkId>),
+    List(Vec<InkId>),
+}
+
+impl Inks {
+    fn stop_inks(self) -> StopInks {
+        match self {
+            Self::Gray => StopInks::Gray,
+            Self::Cmyk(ids) | Self::List(ids) => StopInks::Inks(ids),
+        }
+    }
+
+    fn image_space(self) -> ImageSpace {
+        match self {
+            Self::Gray => ImageSpace::Gray,
+            Self::Cmyk(_) => ImageSpace::Cmyk,
+            Self::List(ids) => ImageSpace::Inks(ids),
+        }
+    }
+}
+
+/// Which of a space's values become samples.
+enum Channels {
+    All,
+    /// Values of inks the set has room for.
+    Keep(Vec<bool>),
+    /// One value (the `All` colorant) for each of this many inks.
+    Spread(usize),
+}
+
+impl Channels {
+    fn apply(&self, samples: Vec<u8>, width: usize) -> Vec<u8> {
+        match self {
+            Self::All => samples,
+            Self::Keep(keep) => samples.chunks_exact(width.max(1)).flat_map(|s| s.iter().zip(keep).filter(|(_, k)| **k).map(|(v, _)| *v)).collect(),
+            Self::Spread(n) => samples.iter().flat_map(|v| std::iter::repeat_n(*v, *n)).collect(),
+        }
+    }
+
+    fn apply_f32(&self, values: &[f32]) -> Vec<f32> {
+        match self {
+            Self::All => values.to_vec(),
+            Self::Spread(n) => values.iter().flat_map(|v| std::iter::repeat_n(*v, *n)).collect(),
+            Self::Keep(keep) => values.iter().zip(keep).filter(|(_, k)| **k).map(|(v, _)| *v).collect(),
+        }
+    }
+}
+
+/// The JPEG data of a `width` × `height` image that krilla's JPEG passthrough writes with the
+/// same meaning: DCTDecode alone without parameters, 8 bits, DeviceGray with the default
+/// `/Decode`, or DeviceCMYK with the inverted `/Decode` of Adobe CMYK JPEGs, which krilla
+/// always writes for CMYK.
+fn dct_passthrough(stream: &Stream<'_>, width: u32, height: u32) -> Option<Arc<[u8]>> {
+    let dict = stream.dict();
+    let only_dct = stream.filters().as_slice() == [Filter::DctDecode] && !dict.contains_key(DECODE_PARMS);
+    let size = dict.get::<u32>(WIDTH) == Some(width) && dict.get::<u32>(HEIGHT) == Some(height);
+    if !(only_dct && size && dict.get::<u8>(BITS_PER_COMPONENT) == Some(8)) {
+        return None;
+    }
+    let decode: Option<Vec<f32>> = dict.get::<Array<'_>>(DECODE).map(|a| a.iter::<f32>().collect());
+    let ok = match dict.get::<Name<'_>>(COLORSPACE)?.as_ref() {
+        b"DeviceGray" => decode.is_none_or(|d| d == [0.0, 1.0]),
+        b"DeviceCMYK" => decode.is_some_and(|d| d == [1.0, 0.0].repeat(4)),
+        _ => false,
+    };
+    ok.then(|| Arc::from(stream.raw_data().as_ref()))
+}
+
+/// Pixels per point of the image a tiling pattern over `area` is read as, from `scale`, and of
+/// the drawing of its cell over `cell_box`, for `per_pixel` cells over each pixel and `inks`
+/// values per pixel.
+fn tiling_scales(scale: f64, area: Rect, cell_box: Rect, per_pixel: f64, inks: usize) -> (f64, f64) {
+    let ink_share = (CANVAS_INKS / inks.max(1) as f64).min(1.0);
+    let scale = limit_scale(scale, area, MAX_RASTER_PIXELS.min(MAX_TILING_SAMPLES / per_pixel) * ink_share);
+    (scale, limit_scale(scale * CELL_OVERSAMPLE, cell_box, MAX_CELL_PIXELS * ink_share))
+}
+
+/// `scale` (pixels per point), lowered so that `area` holds at most `pixels` pixels.
+fn limit_scale(scale: f64, area: Rect, pixels: f64) -> f64 {
+    let have = area.area() * scale * scale;
+    if have > pixels { scale * (pixels / have).sqrt() } else { scale }
+}
+
+/// `items` and every item inside their groups and masks.
+fn item_count(items: &[Item]) -> usize {
+    items.iter().fold(0, |sum, item| {
+        let inner = match item {
+            Item::Group(g) => item_count(&g.children).saturating_add(g.mask.as_ref().map_or(0, |m| item_count(&m.group.children))),
+            Item::Fill(_) | Item::Text(_) | Item::Image(_) => 0,
+        };
+        sum.saturating_add(1).saturating_add(inner)
+    })
+}
+
+/// The cell indices `k` whose span `[c0, c1] + k * step` meets `[lo, hi]`.
+fn cells(lo: f64, hi: f64, c0: f64, c1: f64, step: f64) -> Option<(i64, i64)> {
+    let (a, z) = ((lo - c1) / step, (hi - c0) / step);
+    let (a, z) = if step > 0.0 { (a, z) } else { (z, a) };
+    let (a, z) = (a.ceil(), z.floor());
+    (a.is_finite() && z.is_finite() && a <= z && z - a < 1e9).then_some((a as i64, z as i64))
+}
+
+fn to_byte(v: f32) -> u8 {
+    (v.clamp(0.0, 1.0) * 255.0).round() as u8
+}
+
+/// Fills each text item's font from the prepared fonts, replacing the key placeholders.
+fn set_fonts(items: &mut [Item], fonts: &HashMap<u128, Option<Arc<TextFont>>>) {
+    for item in items {
+        match item {
+            Item::Text(t) => {
+                t.font = t.font.as_ref().and_then(|f| fonts.get(&f.key).cloned().flatten());
+            }
+            Item::Group(g) => set_group_fonts(g, fonts),
+            Item::Fill(_) | Item::Image(_) => {}
+        }
+    }
+}
+
+fn set_group_fonts(group: &mut GroupItem, fonts: &HashMap<u128, Option<Arc<TextFont>>>) {
+    if let Some(mask) = group.mask.as_mut() {
+        set_group_fonts(&mut mask.group, fonts);
+    }
+    set_fonts(&mut group.children, fonts);
+}
+
+fn unicode(s: BfString) -> String {
+    match s {
+        BfString::Char(c) => c.to_string(),
+        BfString::String(s) => s,
+    }
+}
+
+fn same_linear(a: Affine, b: Affine) -> bool {
+    let (a, b) = (a.as_coeffs(), b.as_coeffs());
+    let scale = a[..4].iter().fold(0.0_f64, |m, v| m.max(v.abs()));
+    a[..4].iter().zip(&b[..4]).all(|(x, y)| (x - y).abs() <= scale * 1e-6)
+}
+
+fn fill_rule(rule: PdfFillRule) -> FillRule {
+    match rule {
+        PdfFillRule::NonZero => FillRule::NonZero,
+        PdfFillRule::EvenOdd => FillRule::EvenOdd,
+    }
+}
+
+fn blend(mode: PdfBlend) -> BlendMode {
+    match mode {
+        PdfBlend::Normal => BlendMode::Normal,
+        PdfBlend::Multiply => BlendMode::Multiply,
+        PdfBlend::Screen => BlendMode::Screen,
+        PdfBlend::Overlay => BlendMode::Overlay,
+        PdfBlend::Darken => BlendMode::Darken,
+        PdfBlend::Lighten => BlendMode::Lighten,
+        PdfBlend::ColorDodge => BlendMode::ColorDodge,
+        PdfBlend::ColorBurn => BlendMode::ColorBurn,
+        PdfBlend::HardLight => BlendMode::HardLight,
+        PdfBlend::SoftLight => BlendMode::SoftLight,
+        PdfBlend::Difference => BlendMode::Difference,
+        PdfBlend::Exclusion => BlendMode::Exclusion,
+        PdfBlend::Hue => BlendMode::Hue,
+        PdfBlend::Saturation => BlendMode::Saturation,
+        PdfBlend::Color => BlendMode::Color,
+        PdfBlend::Luminosity => BlendMode::Luminosity,
+    }
+}
+
+/// `path` (user space) stroked with `props` and taken to page space by `transform`. The stroke
+/// is outlined in user space, where its width is given, so a skewed CTM skews it too.
+fn outline_stroke(path: &BezPath, transform: Affine, props: &StrokeProps) -> BezPath {
+    let scale = transform.determinant().abs().sqrt();
+    let scale = if scale.is_finite() && scale > f64::EPSILON { scale } else { 1.0 };
+    let width = match f64::from(props.line_width) {
+        w if w > 0.0 && w.is_finite() => w,
+        _ => HAIRLINE / scale,
+    };
+    let mut style = Stroke::new(width).with_caps(props.line_cap).with_join(props.line_join).with_miter_limit(f64::from(props.miter_limit));
+    if let Some(dashes) = dash_pattern(path, &props.dash_array) {
+        style = style.with_dashes(f64::from(props.dash_offset), dashes);
+    }
+    let outline = kurbo::stroke(path.iter(), &style, &StrokeOpts::default(), STROKE_TOLERANCE / scale);
+    transform * outline
+}
+
+/// The dash pattern to outline `path` with; `None` (solid) when the pattern is invalid or could
+/// cut the path into more than [`MAX_DASHES_PER_STROKE`] pieces. The same estimate as hayro's.
+fn dash_pattern(path: &BezPath, dashes: &[f32]) -> Option<Vec<f64>> {
+    if dashes.iter().any(|d| !d.is_finite() || *d < 0.0) {
+        return None;
+    }
+    let sum: f64 = dashes.iter().map(|d| f64::from(*d)).sum();
+    // kurbo repeats an odd-length pattern once, so a period covers it twice.
+    let (period, per_period) = if dashes.len() % 2 == 1 { (2.0 * sum, dashes.len().saturating_mul(2)) } else { (sum, dashes.len()) };
+    if !(period.is_finite() && period > 0.0) {
+        return None;
+    }
+    // A curve is no longer than its control polygon. kurbo restarts the pattern at every
+    // subpath and close, so each restart can begin a whole period however short its segment.
+    let (mut length, mut restarts) = (0.0, 0usize);
+    let (mut start, mut last) = (Point::ORIGIN, Point::ORIGIN);
+    for el in path.elements() {
+        match *el {
+            PathEl::MoveTo(p) => {
+                (start, last) = (p, p);
+                restarts = restarts.saturating_add(1);
+            }
+            PathEl::LineTo(p) => {
+                length += last.distance(p);
+                last = p;
+            }
+            PathEl::QuadTo(c, p) => {
+                length += last.distance(c) + c.distance(p);
+                last = p;
+            }
+            PathEl::CurveTo(c1, c2, p) => {
+                length += last.distance(c1) + c1.distance(c2) + c2.distance(p);
+                last = p;
+            }
+            PathEl::ClosePath => {
+                length += last.distance(start);
+                last = start;
+                restarts = restarts.saturating_add(1);
+            }
+        }
+    }
+    let pieces = (length / period + restarts as f64) * per_period as f64;
+    (pieces.is_finite() && pieces <= MAX_DASHES_PER_STROKE).then(|| dashes.iter().map(|d| f64::from(*d)).collect())
+}
+
+/// `path` filled by `rule`, as a path filled nonzero. An even-odd path is rebuilt from its
+/// boundary; if that fails it is kept as it is.
+fn nonzero(path: &BezPath, rule: FillRule) -> BezPath {
+    if rule == FillRule::NonZero {
+        return path.clone();
+    }
+    let closed = closed(path);
+    match linesweeper::binary_op(&closed, &BezPath::new(), linesweeper::FillRule::EvenOdd, linesweeper::BinaryOp::Union) {
+        Ok(contours) => {
+            let mut out = BezPath::new();
+            for contour in contours.contours() {
+                out.extend(contour.path.iter());
+            }
+            out
+        }
+        Err(_) => closed,
+    }
+}
+
+/// `path` with every subpath closed, as a fill closes them.
+fn closed(path: &BezPath) -> BezPath {
+    let mut out = BezPath::new();
+    let mut open = false;
+    for el in path.elements() {
+        match el {
+            PathEl::MoveTo(_) => {
+                if open {
+                    out.close_path();
+                }
+                open = true;
+            }
+            PathEl::ClosePath => open = false,
+            _ => {}
+        }
+        out.push(*el);
+    }
+    if open {
+        out.close_path();
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tiling_canvases_hold_cmyk_memory_with_many_inks() {
+        let (page, cell) = (Rect::new(0.0, 0.0, 600.0, 800.0), Rect::new(0.0, 0.0, 300.0, 300.0));
+        let dpi = 300.0 / 72.0;
+        let values = |area: Rect, scale: f64, inks: usize| {
+            let (w, h) = shade::pixel_size(area, scale).unwrap();
+            (w * h * inks) as f64
+        };
+        // With 1,000 inks the page canvas would hold 8 billion values.
+        let (scale, cell_scale) = tiling_scales(dpi, page, cell, 1.0, 1000);
+        assert!(values(page, scale, 1000) <= MAX_RASTER_PIXELS * CANVAS_INKS * 1.01);
+        assert!(values(cell, cell_scale, 1000) <= MAX_CELL_PIXELS * CANVAS_INKS * 1.01);
+        // A CMYK page keeps its resolution.
+        assert_eq!(tiling_scales(dpi, page, cell, 1.0, 4).0, dpi);
+    }
+}
diff --git a/crates/prepress/src/flatten/raster.rs b/crates/prepress/src/flatten/raster.rs
new file mode 100644
index 00000000..92c55162
--- /dev/null
+++ b/crates/prepress/src/flatten/raster.rs
@@ -0,0 +1,393 @@
+//! Complex regions rasterized as ink images (plan tasks C3 and C4), and [`flatten_page`], which
+//! flattens one page of a PDF.
+//!
+//! A region's image is its items written alone as a small PDF ([`page_pdf`]) and separated with
+//! [`plates`], overprint on: one plane per ink, so spot inks stay spot inks and overprint applies
+//! per plate as on press. The planes map to the list's inks by name and come back as an
+//! [`ImageSpace::Inks`] image, which the writer clips to the region and writes as DeviceN.
+//!
+//! Backdrop: the sub-list is [`ComplexRegion::items`], in paint order, and nothing else. Those
+//! are the owners of every shape covering the region, and a flattened group holds every item
+//! whose box touches one of its members ([`geom::overlap_groups`](super::geom::overlap_groups)),
+//! up to its last transparent item. Kept items are either in other groups, so their boxes are
+//! clear of the region, or painted after it. So no kept item is under a complex region, and the
+//! items listed are the region's whole backdrop.
+//!
+//! Seams:
+//! - The image is snapped outward to the device pixel grid at the raster resolution (counted
+//!   from the page box's corner) and reaches one more device pixel on every side. The clip stays
+//!   the exact region path, so the image's edge pixels are never seen: no paper shows where the
+//!   clip edge falls between pixel centers, and anti-aliased edges of the image don't exist.
+//! - Items render unclipped in the sub-list, so pixels along the region edge hold the full color
+//!   of the art on both sides of the edge, not a mix with paper.
+//! - Neighboring complex regions are merged before rasterizing (`compose`), so their shared
+//!   edges fall inside one image.
+//! - Regions larger than a plate render in tiles that abut on the device grid and are joined
+//!   into one image before it is written.
+//!
+//! Whole groups the region sweep failed on
+//! ([`ComplexReason::Degenerate`](super::ComplexReason::Degenerate)) are clipped to their
+//! members' boxes, which hold pixels nothing paints. Their image is opaque like any other: the
+//! boxes are clear of every other group's items, so the paper is the only backdrop there, and
+//! the plates of the items over paper print the same as the items would. A soft mask would leave
+//! transparency on the page, which PDF/X-1a forbids.
+//!
+//! Ported from VectorCraft (MIT OR Apache-2.0) at commit c2b15982: `render_raster` in
+//! `crates/engine/src/cmd/flatten.rs` (the image reaching a pixel past its area). VectorCraft
+//! renders RGB over white; here the plates give each ink's tint directly.
+
+use craft_pdf::OpenError;
+use craft_pdf::interpret::color::CmykConversion;
+use craft_pdf::write::backend::SerializeSettings;
+use kurbo::{Affine, Rect, Shape as _};
+
+use super::document::{FlattenDocumentError, FlattenDocumentOptions, flatten_document};
+use super::pdf::{ReadError, ReadOptions, ReadReport};
+use super::write::{WriteError, page_pdf};
+use super::{
+    BlendMode, ComplexRegion, DisplayList, FillItem, FillRule, FlattenError, FlattenOptions, FlattenReport, GroupItem, ImageItem, ImageSpace, Item,
+    Mask, MaskKind, Paint,
+};
+use crate::ink::{Ink, InkColor, InkId, Overprint, Process};
+use crate::plates::{Fallback, MAX_SPOT_INKS, Options, plates};
+
+/// Pixels per complex region's image. A larger region rasterizes at a lower resolution;
+/// [`RasterReport::lowest_dpi`] says how low.
+pub const MAX_RASTER_PIXELS: u64 = 64 << 20;
+
+/// Tile side in device pixels: tiles stay below [`crate::MAX_PLATE_PIXELS`], so `plates` renders
+/// them at the resolution asked for.
+const TILE: i64 = 1536;
+
+/// What [`Rasterizer`] made.
+#[derive(Clone, Debug, Default, PartialEq)]
+#[non_exhaustive]
+pub struct RasterReport {
+    /// Images returned.
+    pub images: usize,
+    /// Device pixels of all images.
+    pub pixels: u64,
+    /// The lowest resolution used, when a region past [`MAX_RASTER_PIXELS`] needed less than
+    /// the one asked for.
+    pub lowest_dpi: Option<f32>,
+}
+
+/// Rasterizes the complex regions of a flattened [`DisplayList`]; [`Self::region`] is the
+/// callback [`write_flattened`](super::write::write_flattened) takes.
+pub struct Rasterizer<'a> {
+    list: &'a DisplayList,
+    settings: SerializeSettings,
+    printing: Fallback,
+    cms: &'a dyn CmykConversion,
+    dpi: f32,
+    report: RasterReport,
+}
+
+impl<'a> Rasterizer<'a> {
+    /// `settings` and `cms` are the output's, and `printing` is its printing condition: the
+    /// sub-lists are written without the output intent, which `plates` would decode and parse
+    /// for every region, and separated with `printing` as the fallback.
+    pub fn new(list: &'a DisplayList, settings: SerializeSettings, printing: Fallback, cms: &'a dyn CmykConversion, dpi: f32) -> Self {
+        let settings = SerializeSettings { output_intent: None, ..settings };
+        Self { list, settings, printing, cms, dpi, report: RasterReport::default() }
+    }
+
+    pub fn report(&self) -> &RasterReport {
+        &self.report
+    }
+
+    /// The image of `region`, or `None` when it prints no ink (nothing is under a complex
+    /// region to knock out).
+    pub fn region(&mut self, region: &ComplexRegion) -> Result<Option<ImageItem>, WriteError> {
+        let page = self.list.page;
+        let bounds = region.path.bounding_box();
+        if !(bounds.is_finite() && page.is_finite() && self.dpi.is_finite() && self.dpi > 0.0) {
+            return Ok(None);
+        }
+        let mut scale = f64::from(self.dpi) / 72.0;
+        let mut grid = Grid::new(bounds, page, scale);
+        let pixels = grid.pixels();
+        if pixels > MAX_RASTER_PIXELS {
+            scale *= (MAX_RASTER_PIXELS as f64 / pixels as f64).sqrt() * 0.999;
+            grid = Grid::new(bounds, page, scale);
+            let dpi = (scale * 72.0) as f32;
+            self.report.lowest_dpi = Some(self.report.lowest_dpi.map_or(dpi, |d| d.min(dpi)));
+        }
+        if grid.width() <= 0 || grid.height() <= 0 {
+            return Ok(None);
+        }
+
+        let items: Vec<Item> =
+            region.items.iter().filter_map(|&i| self.list.items.get(i)).map(|i| self.alpha_masks(i, &grid)).collect::<Result<_, _>>()?;
+        let planes = self.separate(&items, &grid, true)?;
+
+        let mut ids = Vec::new();
+        let mut used = Vec::new();
+        for ((id, _), plane) in self.list.inks.iter().zip(planes) {
+            if let Some(plane) = plane.filter(|p| p.iter().any(|v| *v > 0)) {
+                ids.push(id);
+                used.push(plane);
+            }
+        }
+        if ids.is_empty() {
+            return Ok(None);
+        }
+        let n = grid.len();
+        let mut samples = Vec::with_capacity(n * used.len());
+        for px in 0..n {
+            samples.extend(used.iter().map(|p| p[px]));
+        }
+        self.report.images += 1;
+        self.report.pixels += n as u64;
+        let r = grid.rect();
+        Ok(Some(ImageItem {
+            space: ImageSpace::Inks(ids),
+            size: (grid.width() as u32, grid.height() as u32),
+            samples: samples.into(),
+            transform: Affine::new([r.width(), 0.0, 0.0, r.height(), r.x0, r.y0]),
+            smask: None,
+            overprint: Overprint::default(),
+            jpeg: None,
+        }))
+    }
+
+    /// `item` with its luminosity masks, and those of the groups in it, made alpha masks over
+    /// `grid` (see [`Self::luminosity`]).
+    fn alpha_masks(&self, item: &Item, grid: &Grid) -> Result<Item, WriteError> {
+        let Item::Group(g) = item else { return Ok(item.clone()) };
+        let mask = match g.mask.as_deref() {
+            Some(m) if m.kind == MaskKind::Luminosity => Some(Box::new(self.luminosity(m, grid)?)),
+            other => other.cloned().map(Box::new),
+        };
+        let children = g.children.iter().map(|c| self.alpha_masks(c, grid)).collect::<Result<_, _>>()?;
+        Ok(Item::Group(GroupItem {
+            opacity: g.opacity,
+            blend: g.blend,
+            isolated: g.isolated,
+            knockout: g.knockout,
+            clip: g.clip.clone(),
+            mask,
+            actual_text: g.actual_text.clone(),
+            children,
+        }))
+    }
+
+    /// A luminosity mask as an alpha mask: an image whose alpha is the mask's luminosity over
+    /// `grid`, its transfer function applied.
+    ///
+    /// The mask's content arrives in inks, and a CMYK blending space has no exact black for the
+    /// renderer: K 100% (DeviceGray black, read as ink) has a luminosity of about 12% through
+    /// the printing condition. So the content is separated and its luminosity computed from the
+    /// inks with the ISO 32000-2 §10.4.2.2 formula, `1 - min(1, 0.3c + 0.59m + 0.11y + k)`,
+    /// spot inks through their CMYK equivalents.
+    fn luminosity(&self, m: &Mask, grid: &Grid) -> Result<Mask, WriteError> {
+        let r = grid.rect();
+        // Where nothing paints the mask is the backdrop's luminosity, black by default.
+        let backdrop = m.backdrop.clone().unwrap_or_else(|| InkColor::Tints(vec![(InkId::process(Process::Black), 1.0)]));
+        let content = [
+            Item::Fill(FillItem { path: r.to_path(0.1), rule: FillRule::NonZero, paint: Paint::Solid(backdrop), overprint: Overprint::default() }),
+            self.alpha_masks(&Item::Group(m.group.clone()), grid)?,
+        ];
+        let planes = self.separate(&content, grid, false)?;
+        let weights: Vec<[f32; 4]> = self
+            .list
+            .inks
+            .iter()
+            .map(|(id, _)| match Process::ALL.get(id.index()) {
+                Some(p) => {
+                    let mut w = [0.0; 4];
+                    w[p.index()] = 1.0;
+                    w
+                }
+                None => self.list.inks.spot_cmyk(id, self.cms).unwrap_or([0.0, 0.0, 0.0, 1.0]),
+            })
+            .collect();
+        let used: Vec<(&[u8], [f32; 4])> = planes.iter().zip(&weights).filter_map(|(p, w)| Some((p.as_deref()?, *w))).collect();
+        let alpha: Vec<u8> = (0..grid.len())
+            .map(|px| {
+                let mut cmyk = [0.0_f32; 4];
+                for (plane, w) in &used {
+                    let t = f32::from(plane[px]) / 255.0;
+                    for (v, w) in cmyk.iter_mut().zip(w) {
+                        *v = 1.0 - (1.0 - *v) * (1.0 - t * w);
+                    }
+                }
+                let [c, m_, y, k] = cmyk;
+                let gray = 1.0 - (0.3 * c + 0.59 * m_ + 0.11 * y + k).min(1.0);
+                let v = (gray * 255.0).round().clamp(0.0, 255.0) as u8;
+                m.transfer.as_ref().and_then(|t| t.get(usize::from(v)).copied()).unwrap_or(v)
+            })
+            .collect();
+        let n = alpha.len();
+        let image = ImageItem {
+            space: ImageSpace::Gray,
+            size: (grid.width() as u32, grid.height() as u32),
+            samples: vec![0; n].into(),
+            transform: Affine::new([r.width(), 0.0, 0.0, r.height(), r.x0, r.y0]),
+            smask: Some(alpha.into()),
+            overprint: Overprint::default(),
+            jpeg: None,
+        };
+        let group = GroupItem {
+            opacity: 1.0,
+            blend: BlendMode::Normal,
+            isolated: false,
+            knockout: false,
+            clip: None,
+            mask: None,
+            actual_text: None,
+            children: vec![Item::Image(image)],
+        };
+        Ok(Mask { kind: MaskKind::Alpha, group, backdrop: None, transfer: None })
+    }
+
+    /// `items` separated over `grid`, tile by tile: per ink of the list, its plane, `None` for
+    /// inks the items don't print.
+    fn separate(&self, items: &[Item], grid: &Grid, overprint: bool) -> Result<Vec<Option<Vec<u8>>>, WriteError> {
+        let (w, h) = (grid.width() as usize, grid.height() as usize);
+        let mut planes: Vec<Option<Vec<u8>>> = vec![None; self.list.inks.len()];
+        let dpi = (grid.scale * 72.0) as f32;
+        // The renderer makes a page at least 1 pt on a side: thinner tiles are rendered at that
+        // size and cropped.
+        let min = grid.scale.ceil() as i64;
+        let mut ty = 0;
+        while ty < grid.height() {
+            let th = TILE.min(grid.height() - ty);
+            let mut tx = 0;
+            while tx < grid.width() {
+                let tw = TILE.min(grid.width() - tx);
+                let (rw, rh) = (tw.max(min), th.max(min));
+                // A quarter pixel more than the tile: the renderer floors the page size.
+                let (x0, y0) = grid.point(grid.x0 + tx, grid.y0 + ty);
+                let extra = 0.25 / grid.scale;
+                let tile = Rect::new(x0, y0, x0 + rw as f64 / grid.scale + extra, y0 + rh as f64 / grid.scale + extra);
+                let sub = DisplayList { page: tile, inks: self.list.inks.clone(), items: items.to_vec() };
+                let pdf = page_pdf(&sub, self.settings.clone(), self.cms)?;
+                let p = plates(&pdf, 0, dpi, &Options { overprint, fallback: self.printing.clone() })
+                    .map_err(|e| WriteError::Region(format!("separating a complex region: {e}")))?;
+                if !p.unseparated.is_empty() {
+                    let spots = p.inks.iter().filter(|(_, ink)| matches!(ink, Ink::Spot(_))).count();
+                    return Err(WriteError::SpotInks { inks: spots + p.unseparated.len(), max: MAX_SPOT_INKS, unseparated: p.unseparated });
+                }
+                if (p.width as i64, p.height as i64) != (rw, rh) {
+                    return Err(WriteError::Region(format!("a tile of {rw} × {rh} px separated at {} × {} px", p.width, p.height)));
+                }
+                for (pid, ink) in p.inks.iter() {
+                    let Some(film) = p.plane(pid).filter(|f| f.iter().any(|v| *v > 0)) else { continue };
+                    let id = self.list.inks.lookup(ink.name()).ok_or_else(|| WriteError::Region(format!("ink {} is not in the list", ink.name())))?;
+                    let Some(plane) = planes.get_mut(id.index()) else { continue };
+                    let plane = plane.get_or_insert_with(|| vec![0; w * h]);
+                    for (row, src) in film.chunks_exact(rw as usize).take(th as usize).enumerate() {
+                        let at = (ty as usize + row) * w + tx as usize;
+                        if let (Some(dst), Some(src)) = (plane.get_mut(at..at + tw as usize), src.get(..tw as usize)) {
+                            dst.copy_from_slice(src);
+                        }
+                    }
+                }
+                tx += tw;
+            }
+            ty += th;
+        }
+        Ok(planes)
+    }
+}
+
+/// A region's pixels on the device grid of the page: `x0..x1` and `y0..y1` count device pixels
+/// from the page box's top left corner.
+struct Grid {
+    page: Rect,
+    scale: f64,
+    x0: i64,
+    y0: i64,
+    x1: i64,
+    y1: i64,
+}
+
+impl Grid {
+    /// `bounds` snapped outward and grown by one pixel, within the page's pixels.
+    fn new(bounds: Rect, page: Rect, scale: f64) -> Self {
+        let px = |v: f64| v.clamp(-1e12, 1e12) as i64;
+        let (pw, ph) = (px((page.width() * scale).ceil()), px((page.height() * scale).ceil()));
+        Self {
+            page,
+            scale,
+            x0: px(((bounds.x0 - page.x0) * scale).floor() - 1.0).max(0),
+            y0: px(((bounds.y0 - page.y0) * scale).floor() - 1.0).max(0),
+            x1: px(((bounds.x1 - page.x0) * scale).ceil() + 1.0).min(pw),
+            y1: px(((bounds.y1 - page.y0) * scale).ceil() + 1.0).min(ph),
+        }
+    }
+
+    fn width(&self) -> i64 {
+        self.x1 - self.x0
+    }
+
+    fn height(&self) -> i64 {
+        self.y1 - self.y0
+    }
+
+    fn pixels(&self) -> u64 {
+        (self.width().max(0) as u64).saturating_mul(self.height().max(0) as u64)
+    }
+
+    fn len(&self) -> usize {
+        usize::try_from(self.pixels()).unwrap_or(usize::MAX)
+    }
+
+    /// Page space of device pixel corner (`x`, `y`).
+    fn point(&self, x: i64, y: i64) -> (f64, f64) {
+        (self.page.x0 + x as f64 / self.scale, self.page.y0 + y as f64 / self.scale)
+    }
+
+    fn rect(&self) -> Rect {
+        let (x0, y0) = self.point(self.x0, self.y0);
+        let (x1, y1) = self.point(self.x1, self.y1);
+        Rect::new(x0, y0, x1, y1)
+    }
+}
+
+/// How [`flatten_page`] reads and flattens.
+#[derive(Clone, Debug, Default)]
+pub struct FlattenPageOptions {
+    pub read: ReadOptions,
+    pub flatten: FlattenOptions,
+}
+
+/// What [`flatten_page`] did.
+#[derive(Clone, Debug, PartialEq)]
+#[non_exhaustive]
+pub struct FlattenPageReport {
+    pub read: ReadReport,
+    pub flatten: FlattenReport,
+    pub raster: RasterReport,
+}
+
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum FlattenPageError {
+    #[error(transparent)]
+    Open(#[from] OpenError),
+    #[error(transparent)]
+    Read(#[from] ReadError),
+    #[error(transparent)]
+    Flatten(#[from] FlattenError),
+    #[error(transparent)]
+    Write(#[from] WriteError),
+}
+
+/// Page `page` (from 0) of `pdf` with its transparency flattened, as a one-page PDF: the
+/// one-page case of [`flatten_document`].
+pub fn flatten_page(pdf: &[u8], page: usize, opts: &FlattenPageOptions) -> Result<(Vec<u8>, FlattenPageReport), FlattenPageError> {
+    let doc =
+        FlattenDocumentOptions { read: opts.read.clone(), flatten: opts.flatten, pages: Some(page..page.saturating_add(1)), ..Default::default() };
+    let (bytes, mut report) = flatten_document(pdf, &doc).map_err(|e| match e {
+        FlattenDocumentError::Open(e) => FlattenPageError::Open(e),
+        FlattenDocumentError::PageRange { .. } => FlattenPageError::Read(ReadError::NoPage(page)),
+        FlattenDocumentError::Read { source, .. } => FlattenPageError::Read(source),
+        FlattenDocumentError::Flatten { source, .. } => FlattenPageError::Flatten(source),
+        FlattenDocumentError::Write { source, .. } => FlattenPageError::Write(source),
+        FlattenDocumentError::Serialize(e) => FlattenPageError::Write(WriteError::Pdf(e)),
+    })?;
+    let (_, report) = report.pages.pop().ok_or(FlattenPageError::Read(ReadError::Interpret))?;
+    Ok((bytes, report))
+}
diff --git a/crates/prepress/src/flatten/shade.rs b/crates/prepress/src/flatten/shade.rs
new file mode 100644
index 00000000..08243afa
--- /dev/null
+++ b/crates/prepress/src/flatten/shade.rs
@@ -0,0 +1,828 @@
+//! Raster work for the PDF-in adapter, all in ink values: gradient stops sampled from a shading
+//! function, shadings rasterized, tiling patterns past the cell cap drawn, stencil masks traced.
+
+use std::collections::HashMap;
+
+use craft_pdf::interpret::color::{CmykSimulation, ColorSpace};
+use craft_pdf::interpret::pattern::ShadingPattern;
+use craft_pdf::interpret::shading::{ShadingFunction, ShadingType, Triangle};
+use kurbo::{Affine, BezPath, PathEl, Point, Rect, Vec2};
+
+use super::{FillRule, GradientGeometry, ImageItem, ImageSpace, Item, Paint};
+use crate::ink::{InkColor, InkId, InkSet, Overprint, Process};
+
+/// Most a gradient's piecewise-linear stops may differ from the function, per ink.
+const STOP_TOLERANCE: f32 = 0.5 / 255.0;
+
+/// The narrowest interval between gradient stops; a discontinuous function gets a pair of stops
+/// this close.
+const MIN_STOP_STEP: f32 = 1.0 / 4096.0;
+
+/// Sub-rows per pixel row when the canvas computes path coverage.
+const SUBROWS: usize = 4;
+
+/// Stops `(offset, values)` approximating `eval` on `0..=1` within [`STOP_TOLERANCE`]. `eval`
+/// returns the same number of values everywhere; a failed evaluation reads as zeros.
+pub(super) fn sample_stops(len: usize, eval: impl Fn(f32) -> Option<Vec<f32>>) -> Vec<(f32, Vec<f32>)> {
+    let f = |s: f32| {
+        let mut v = eval(s).unwrap_or_default();
+        v.resize(len, 0.0);
+        v
+    };
+    const START: usize = 8;
+    let mut stops = vec![(0.0, f(0.0))];
+    for k in 0..START {
+        let (a, b) = (k as f32 / START as f32, (k + 1) as f32 / START as f32);
+        let fa = stops.last().map(|s| s.1.clone()).unwrap_or_default();
+        refine(a, &fa, b, f(b), &f, &mut stops);
+    }
+    stops
+}
+
+fn refine(a: f32, fa: &[f32], b: f32, fb: Vec<f32>, f: &impl Fn(f32) -> Vec<f32>, out: &mut Vec<(f32, Vec<f32>)>) {
+    let m = (a + b) / 2.0;
+    let fm = f(m);
+    let err = |t: f32, ft: &[f32]| {
+        let u = (t - a) / (b - a);
+        fa.iter().zip(&fb).zip(ft).map(|((x, y), v)| (x + (y - x) * u - v).abs()).fold(0.0_f32, f32::max)
+    };
+    let within = err(m, &fm) <= STOP_TOLERANCE
+        && [0.25, 0.75].iter().all(|q| {
+            let t = a + (b - a) * q;
+            err(t, &f(t)) <= STOP_TOLERANCE
+        });
+    if within || b - a <= MIN_STOP_STEP {
+        out.push((b, fb));
+    } else {
+        refine(a, fa, m, fm.clone(), f, out);
+        refine(m, &fm, b, fb, f, out);
+    }
+}
+
+/// `function` at `input`.
+pub(super) fn eval(function: &ShadingFunction, input: &[f32]) -> Option<Vec<f32>> {
+    function.eval(&input.iter().copied().collect()).map(|v| v.to_vec())
+}
+
+/// A shading's colors sampled on a pixel grid.
+pub(super) struct ShadeRaster {
+    pub width: u32,
+    pub height: u32,
+    /// `ink_space.len()` values per pixel.
+    pub values: Vec<f32>,
+    /// 255 where the shading (or its background) paints.
+    pub alpha: Vec<u8>,
+}
+
+/// The function-based or mesh shading `sp` over `area` (page space) at `scale` pixels per point,
+/// with `/Background` under it when `background`. `None` for other shading types.
+pub(super) fn rasterize_shading(
+    sp: &ShadingPattern,
+    area: Rect,
+    scale: f64,
+    background: bool,
+    simulation: Option<&CmykSimulation>,
+) -> Option<ShadeRaster> {
+    let (w, h) = pixel_size(area, scale)?;
+    let cs: &ColorSpace = &sp.shading.color_space;
+    let n = cs.components().max(1);
+    let mut comps = vec![0.0_f32; w * h * n];
+    let mut covered = vec![false; w * h];
+    let to_px = Affine::scale(scale) * Affine::translate(-area.origin().to_vec2());
+    match sp.shading.shading_type.as_ref() {
+        ShadingType::FunctionBased { domain, matrix, function } => {
+            let inv = (to_px * sp.matrix * *matrix).inverse();
+            for y in 0..h {
+                for x in 0..w {
+                    let r = inv * Point::new(x as f64 + 0.5, y as f64 + 0.5);
+                    let (rx, ry) = (r.x as f32, r.y as f32);
+                    if rx < domain[0] || rx > domain[1] || ry < domain[2] || ry > domain[3] {
+                        continue;
+                    }
+                    if let Some(c) = eval(function, &[rx, ry]) {
+                        set(&mut comps, &mut covered, n, y * w + x, &c);
+                    }
+                }
+            }
+        }
+        ShadingType::TriangleMesh { triangles, function } => {
+            let mut raster = Triangles { w, h, n, comps: &mut comps, covered: &mut covered, function: function.as_ref() };
+            for t in triangles {
+                raster.draw(t, to_px * sp.matrix);
+            }
+        }
+        ShadingType::CoonsPatchMesh { patches, function } => {
+            let mut raster = Triangles { w, h, n, comps: &mut comps, covered: &mut covered, function: function.as_ref() };
+            let mut buffer = Vec::new();
+            for patch in patches {
+                buffer.clear();
+                patch.to_triangles(&mut buffer);
+                for t in &buffer {
+                    raster.draw(t, to_px * sp.matrix);
+                }
+            }
+        }
+        ShadingType::TensorProductPatchMesh { patches, function } => {
+            let mut raster = Triangles { w, h, n, comps: &mut comps, covered: &mut covered, function: function.as_ref() };
+            let mut buffer = Vec::new();
+            for patch in patches {
+                buffer.clear();
+                patch.to_triangles(&mut buffer);
+                for t in &buffer {
+                    raster.draw(t, to_px * sp.matrix);
+                }
+            }
+        }
+        ShadingType::RadialAxial { .. } | ShadingType::Dummy => return None,
+    }
+    if let Some(bg) = sp.shading.background.as_ref().filter(|_| background) {
+        for i in 0..w * h {
+            if !covered[i] {
+                set(&mut comps, &mut covered, n, i, bg);
+            }
+        }
+    }
+    // Only covered pixels are converted.
+    let mut colors = Vec::new();
+    for (i, c) in covered.iter().enumerate() {
+        if *c {
+            colors.extend_from_slice(&comps[i * n..(i + 1) * n]);
+        }
+    }
+    let mut converted = Vec::new();
+    cs.ink_values(&colors, simulation, &mut converted);
+    let len = cs.ink_space(simulation).len();
+    let mut values = vec![0.0_f32; w * h * len];
+    let mut src = converted.chunks_exact(len.max(1));
+    for (i, c) in covered.iter().enumerate() {
+        if *c
+            && len > 0
+            && let Some(v) = src.next()
+        {
+            values[i * len..(i + 1) * len].copy_from_slice(v);
+        }
+    }
+    let alpha = covered.iter().map(|c| if *c { 255 } else { 0 }).collect();
+    Some(ShadeRaster { width: w as u32, height: h as u32, values, alpha })
+}
+
+fn set(comps: &mut [f32], covered: &mut [bool], n: usize, i: usize, c: &[f32]) {
+    for (k, v) in comps[i * n..(i + 1) * n].iter_mut().enumerate() {
+        *v = c.get(k).copied().unwrap_or(0.0);
+    }
+    covered[i] = true;
+}
+
+/// The pixel grid covering `area` at `scale`: its size, or `None` when empty.
+pub(super) fn pixel_size(area: Rect, scale: f64) -> Option<(usize, usize)> {
+    let (w, h) = ((area.width() * scale).ceil(), (area.height() * scale).ceil());
+    (w.is_finite() && h.is_finite() && w >= 1.0 && h >= 1.0).then_some((w as usize, h as usize))
+}
+
+/// Mesh triangles drawn into component buffers, later triangles over earlier ones.
+struct Triangles<'a> {
+    w: usize,
+    h: usize,
+    n: usize,
+    comps: &'a mut [f32],
+    covered: &'a mut [bool],
+    function: Option<&'a ShadingFunction>,
+}
+
+impl Triangles<'_> {
+    fn draw(&mut self, t: &Triangle, to_px: Affine) {
+        let (a, b, c) = (to_px * t.p0.point, to_px * t.p1.point, to_px * t.p2.point);
+        let area2 = (b.x - a.x) * (c.y - a.y) - (c.x - a.x) * (b.y - a.y);
+        if !area2.is_finite() || area2.abs() < 1e-12 {
+            return;
+        }
+        let bbox = Rect::from_points(a, b).union_pt(c);
+        let x0 = (bbox.x0 - 0.5).ceil().max(0.0) as usize;
+        let y0 = (bbox.y0 - 0.5).ceil().max(0.0) as usize;
+        let x1 = ((bbox.x1 - 0.5).floor() + 1.0).clamp(0.0, self.w as f64) as usize;
+        let y1 = ((bbox.y1 - 0.5).floor() + 1.0).clamp(0.0, self.h as f64) as usize;
+        let mut color = Vec::with_capacity(self.n);
+        for y in y0..y1 {
+            for x in x0..x1 {
+                let p = Point::new(x as f64 + 0.5, y as f64 + 0.5);
+                let la = ((b.x - p.x) * (c.y - p.y) - (c.x - p.x) * (b.y - p.y)) / area2;
+                let lb = ((c.x - p.x) * (a.y - p.y) - (a.x - p.x) * (c.y - p.y)) / area2;
+                let lc = 1.0 - la - lb;
+                if la < -1e-9 || lb < -1e-9 || lc < -1e-9 {
+                    continue;
+                }
+                color.clear();
+                let (ca, cb, cc) = (&t.p0.colors, &t.p1.colors, &t.p2.colors);
+                for k in 0..ca.len() {
+                    let v =
+                        la * f64::from(ca[k]) + lb * f64::from(cb.get(k).copied().unwrap_or(0.0)) + lc * f64::from(cc.get(k).copied().unwrap_or(0.0));
+                    color.push(v as f32);
+                }
+                let value = match self.function {
+                    Some(f) => match eval(f, &color[..color.len().min(1)]) {
+                        Some(v) => v,
+                        None => continue,
+                    },
+                    None => color.clone(),
+                };
+                set(self.comps, self.covered, self.n, y * self.w + x, &value);
+            }
+        }
+    }
+}
+
+/// `items` with every coordinate moved by `by`.
+pub(super) fn translate(items: &mut [Item], by: Vec2) {
+    let t = Affine::translate(by);
+    for item in items {
+        match item {
+            Item::Fill(f) => {
+                f.path.apply_affine(t);
+                translate_paint(&mut f.paint, t);
+            }
+            Item::Text(text) => {
+                text.transform = t * text.transform;
+                text.outlines.apply_affine(t);
+                translate_paint(&mut text.paint, t);
+            }
+            Item::Image(im) => im.transform = t * im.transform,
+            Item::Group(g) => {
+                if let Some(clip) = g.clip.as_mut() {
+                    clip.apply_affine(t);
+                }
+                if let Some(mask) = g.mask.as_mut() {
+                    translate(&mut mask.group.children, by);
+                    if let Some(clip) = mask.group.clip.as_mut() {
+                        clip.apply_affine(t);
+                    }
+                }
+                translate(&mut g.children, by);
+            }
+        }
+    }
+}
+
+fn translate_paint(paint: &mut Paint, t: Affine) {
+    if let Paint::Gradient { geometry, .. } = paint {
+        match geometry {
+            GradientGeometry::Axial { transform, .. } | GradientGeometry::Radial { transform, .. } => *transform = t * *transform,
+        }
+    }
+}
+
+/// The opaque samples (≥ 128) of a `w` × `h` mask as disjoint rectangles in sample space;
+/// `None` past `cap` rectangles.
+pub(super) fn trace_stencil(mask: &[u8], w: usize, h: usize, cap: usize) -> Option<Vec<Rect>> {
+    let mut done = Vec::new();
+    let mut open: HashMap<(usize, usize), usize> = HashMap::new();
+    for y in 0..=h {
+        let mut next = HashMap::new();
+        if y < h {
+            let row = mask.get(y * w..(y + 1) * w)?;
+            let mut x = 0;
+            while x < w {
+                if row[x] >= 128 {
+                    let start = x;
+                    while x < w && row[x] >= 128 {
+                        x += 1;
+                    }
+                    let top = open.remove(&(start, x)).unwrap_or(y);
+                    next.insert((start, x), top);
+                } else {
+                    x += 1;
+                }
+            }
+        }
+        for ((x0, x1), top) in open.drain() {
+            done.push(Rect::new(x0 as f64, top as f64, x1 as f64, y as f64));
+            if done.len() > cap {
+                return None;
+            }
+        }
+        open = next;
+    }
+    Some(done)
+}
+
+/// `src` (`sw` × `sh`) resampled bilinearly to `dw` × `dh`.
+pub(super) fn resample(src: &[u8], (sw, sh): (usize, usize), (dw, dh): (usize, usize)) -> Vec<u8> {
+    let at = |x: usize, y: usize| f64::from(src.get(y.min(sh - 1) * sw + x.min(sw - 1)).copied().unwrap_or(0));
+    let mut out = Vec::with_capacity(dw * dh);
+    for y in 0..dh {
+        let fy = ((y as f64 + 0.5) * sh as f64 / dh as f64 - 0.5).max(0.0);
+        let (y0, ty) = (fy.floor() as usize, fy.fract());
+        for x in 0..dw {
+            let fx = ((x as f64 + 0.5) * sw as f64 / dw as f64 - 0.5).max(0.0);
+            let (x0, tx) = (fx.floor() as usize, fx.fract());
+            let top = at(x0, y0) * (1.0 - tx) + at(x0 + 1, y0) * tx;
+            let bottom = at(x0, y0 + 1) * (1.0 - tx) + at(x0 + 1, y0 + 1) * tx;
+            out.push((top * (1.0 - ty) + bottom * ty).round().clamp(0.0, 255.0) as u8);
+        }
+    }
+    out
+}
+
+/// A raster of every ink in an [`InkSet`] with alpha (values premultiplied), for content drawn
+/// as an image.
+/// Transparency groups draw as plain groups: their clip and opacity apply; blend modes and soft
+/// masks are left out.
+pub(super) struct Canvas<'a> {
+    w: usize,
+    h: usize,
+    inks: &'a InkSet,
+    n: usize,
+    /// Page space to pixels.
+    to_px: Affine,
+    values: Vec<f32>,
+    alpha: Vec<f32>,
+}
+
+impl<'a> Canvas<'a> {
+    pub fn new(area: Rect, scale: f64, inks: &'a InkSet) -> Option<Self> {
+        let (w, h) = pixel_size(area, scale)?;
+        let n = inks.len();
+        let to_px = Affine::scale(scale) * Affine::translate(-area.origin().to_vec2());
+        let pixels = w.checked_mul(h)?;
+        Some(Self { w, h, inks, n, to_px, values: vec![0.0; pixels.checked_mul(n)?], alpha: vec![0.0; pixels] })
+    }
+
+    pub fn size(&self) -> (usize, usize) {
+        (self.w, self.h)
+    }
+
+    /// The unit square to page space, as [`ImageItem::transform`].
+    pub fn image_transform(&self) -> Affine {
+        self.to_px.inverse() * Affine::scale_non_uniform(self.w as f64, self.h as f64)
+    }
+
+    pub fn draw(&mut self, items: &[Item]) {
+        self.draw_clipped(items, None, 1.0);
+    }
+
+    fn draw_clipped(&mut self, items: &[Item], clip: Option<&[f32]>, opacity: f32) {
+        for item in items {
+            match item {
+                Item::Fill(f) => self.fill(&f.path, f.rule, &f.paint, f.overprint, clip, opacity),
+                Item::Text(t) => self.fill(&t.outlines, FillRule::NonZero, &t.paint, t.overprint, clip, opacity),
+                Item::Image(im) => self.image(im, clip, opacity),
+                Item::Group(g) => {
+                    let own = g.clip.as_ref().map(|c| {
+                        let mut cov = self.coverage(c, FillRule::NonZero);
+                        if let Some(outer) = clip {
+                            cov.iter_mut().zip(outer).for_each(|(a, b)| *a *= b);
+                        }
+                        cov
+                    });
+                    self.draw_clipped(&g.children, own.as_deref().or(clip), opacity * g.opacity.clamp(0.0, 1.0));
+                }
+            }
+        }
+    }
+
+    /// Dense values and the inks a paint sets, as the compositor reads a flat paint.
+    fn dense(&self, color: &InkColor, overprint: Overprint) -> Option<(Vec<f32>, Vec<bool>)> {
+        let n = self.n;
+        let (mut value, mut named) = (vec![0.0; n], vec![false; n]);
+        match color {
+            InkColor::None => return None,
+            InkColor::All(t) => {
+                value.fill(t.clamp(0.0, 1.0));
+                named.fill(true);
+            }
+            InkColor::Tints(tints) => {
+                for &(id, t) in tints {
+                    if let (Some(v), Some(k)) = (value.get_mut(id.index()), named.get_mut(id.index())) {
+                        *v = t.clamp(0.0, 1.0);
+                        *k = true;
+                    }
+                }
+                if overprint.nonzero && color.as_cmyk().is_some() {
+                    for (k, v) in named.iter_mut().zip(&value).take(4) {
+                        *k = *v > 0.0;
+                    }
+                }
+            }
+        }
+        if !overprint.fill {
+            named.fill(true);
+        }
+        Some((value, named))
+    }
+
+    fn put(&mut self, i: usize, cov: f32, value: &[f32], named: &[bool]) {
+        if cov <= 0.0 {
+            return;
+        }
+        let cov = cov.min(1.0);
+        for k in 0..self.n {
+            if named[k] {
+                let v = &mut self.values[i * self.n + k];
+                *v = *v * (1.0 - cov) + value[k] * cov;
+            }
+        }
+        self.alpha[i] += cov * (1.0 - self.alpha[i]);
+    }
+
+    fn fill(&mut self, path: &BezPath, rule: FillRule, paint: &Paint, overprint: Overprint, clip: Option<&[f32]>, opacity: f32) {
+        let cov = self.coverage(path, rule);
+        let factor = |i: usize| cov[i] * clip.map_or(1.0, |c| c[i]) * opacity;
+        match paint {
+            Paint::Solid(color) => {
+                let Some((value, named)) = self.dense(color, overprint) else { return };
+                for i in 0..self.w * self.h {
+                    self.put(i, factor(i), &value, &named);
+                }
+            }
+            Paint::Gradient { stops, geometry } => {
+                let dense: Vec<(f32, Vec<f32>, Vec<bool>)> =
+                    stops.iter().filter_map(|(s, c)| self.dense(c, overprint).map(|(v, k)| (*s, v, k))).collect();
+                let Some(first) = dense.first() else { return };
+                let mut named = first.2.clone();
+                for d in &dense {
+                    named.iter_mut().zip(&d.2).for_each(|(a, b)| *a |= b);
+                }
+                let from_px = self.to_px.inverse();
+                let mut value = vec![0.0; self.n];
+                for y in 0..self.h {
+                    for x in 0..self.w {
+                        let i = y * self.w + x;
+                        let f = factor(i);
+                        if f <= 0.0 {
+                            continue;
+                        }
+                        let p = from_px * Point::new(x as f64 + 0.5, y as f64 + 0.5);
+                        let Some(s) = gradient_offset(geometry, p) else { continue };
+                        interpolate_stops(&dense, s, &mut value);
+                        self.put(i, f, &value, &named);
+                    }
+                }
+            }
+        }
+    }
+
+    fn image(&mut self, im: &ImageItem, clip: Option<&[f32]>, opacity: f32) {
+        let (iw, ih) = (im.size.0 as usize, im.size.1 as usize);
+        let inv = (self.to_px * im.transform).inverse();
+        let ids: Vec<InkId> = match &im.space {
+            ImageSpace::Gray => vec![InkId::process(Process::Black)],
+            ImageSpace::Cmyk => Process::ALL.iter().map(|p| InkId::process(*p)).collect(),
+            ImageSpace::Inks(ids) => ids.clone(),
+            ImageSpace::Rgb => return,
+        };
+        let comps = if im.space == ImageSpace::Gray { 1 } else { ids.len() };
+        let mut named = vec![!im.overprint.fill; self.n];
+        for id in &ids {
+            if let Some(k) = named.get_mut(id.index()) {
+                *k = true;
+            }
+        }
+        if im.space == ImageSpace::Gray && !im.overprint.fill {
+            named.fill(true);
+        } else if im.space == ImageSpace::Gray {
+            named.iter_mut().take(4).for_each(|k| *k = true);
+        }
+        let mut value = vec![0.0; self.n];
+        for y in 0..self.h {
+            for x in 0..self.w {
+                let u = inv * Point::new(x as f64 + 0.5, y as f64 + 0.5);
+                if !(0.0..1.0).contains(&u.x) || !(0.0..1.0).contains(&u.y) {
+                    continue;
+                }
+                let (sx, sy) = ((u.x * iw as f64) as usize, (u.y * ih as f64) as usize);
+                let s = sy * iw + sx;
+                let Some(sample) = im.samples.get(s * comps..(s + 1) * comps) else { continue };
+                value.fill(0.0);
+                if im.space == ImageSpace::Gray {
+                    value[Process::Black.index()] = 1.0 - f32::from(sample[0]) / 255.0;
+                } else {
+                    for (id, v) in ids.iter().zip(sample) {
+                        if let Some(slot) = value.get_mut(id.index()) {
+                            *slot = f32::from(*v) / 255.0;
+                        }
+                    }
+                }
+                let a = im.smask.as_ref().and_then(|m| m.get(s)).map_or(1.0, |a| f32::from(*a) / 255.0);
+                let i = y * self.w + x;
+                self.put(i, a * clip.map_or(1.0, |c| c[i]) * opacity, &value, &named);
+            }
+        }
+    }
+
+    /// The fraction of each pixel `path` covers.
+    fn coverage(&self, path: &BezPath, rule: FillRule) -> Vec<f32> {
+        let mut edges: Vec<(Point, Point)> = Vec::new();
+        let (mut start, mut last) = (Point::ZERO, Point::ZERO);
+        kurbo::flatten(self.to_px * path.clone(), 0.1, |el| match el {
+            PathEl::MoveTo(p) => {
+                if last != start {
+                    edges.push((last, start));
+                }
+                (start, last) = (p, p);
+            }
+            PathEl::LineTo(p) => {
+                edges.push((last, p));
+                last = p;
+            }
+            PathEl::ClosePath => {
+                if last != start {
+                    edges.push((last, start));
+                }
+                last = start;
+            }
+            _ => {}
+        });
+        if last != start {
+            edges.push((last, start));
+        }
+        let mut cov = vec![0.0_f32; self.w * self.h];
+        let mut crossings: Vec<(f64, i32)> = Vec::new();
+        for sy in 0..self.h * SUBROWS {
+            let y = (sy as f64 + 0.5) / SUBROWS as f64;
+            crossings.clear();
+            for (a, b) in &edges {
+                let (lo, hi, dir) = if a.y <= b.y { (a, b, 1) } else { (b, a, -1) };
+                if y >= lo.y && y < hi.y {
+                    crossings.push((lo.x + (y - lo.y) / (hi.y - lo.y) * (hi.x - lo.x), dir));
+                }
+            }
+            crossings.sort_by(|a, b| a.0.total_cmp(&b.0));
+            let row = sy / SUBROWS;
+            let mut winding = 0;
+            for k in 0..crossings.len() {
+                winding += crossings[k].1;
+                let inside = match rule {
+                    FillRule::NonZero => winding != 0,
+                    FillRule::EvenOdd => winding % 2 != 0,
+                };
+                if inside && let Some(next) = crossings.get(k + 1) {
+                    self.span(&mut cov, row, crossings[k].0, next.0);
+                }
+            }
+        }
+        cov
+    }
+
+    fn span(&self, cov: &mut [f32], row: usize, xa: f64, xb: f64) {
+        let (xa, xb) = (xa.clamp(0.0, self.w as f64), xb.clamp(0.0, self.w as f64));
+        if xb <= xa {
+            return;
+        }
+        let weight = 1.0 / SUBROWS as f32;
+        let last = (xb.ceil() as usize).min(self.w);
+        for px in xa.floor() as usize..last {
+            let overlap = xb.min(px as f64 + 1.0) - xa.max(px as f64);
+            if overlap > 0.0 {
+                cov[row * self.w + px] += overlap as f32 * weight;
+            }
+        }
+    }
+
+    /// The canvas as an image in every ink of the set, and its alpha when not opaque throughout.
+    pub fn into_image(self, overprint: Overprint) -> ImageItem {
+        let transform = self.image_transform();
+        let ids: Vec<InkId> = self.inks.iter().map(|(id, _)| id).collect();
+        // Values are premultiplied by alpha; samples are not.
+        let n = self.n.max(1);
+        let samples: Vec<u8> = self
+            .values
+            .iter()
+            .enumerate()
+            .map(|(k, v)| {
+                let a = self.alpha[k / n];
+                let v = if a > 0.0 { v / a } else { 0.0 };
+                (v.clamp(0.0, 1.0) * 255.0).round() as u8
+            })
+            .collect();
+        let opaque = self.alpha.iter().all(|a| *a >= 1.0 - 1e-4);
+        let smask = (!opaque).then(|| self.alpha.iter().map(|a| (a.clamp(0.0, 1.0) * 255.0).round() as u8).collect());
+        ImageItem {
+            space: ImageSpace::Inks(ids),
+            size: (self.w as u32, self.h as u32),
+            samples: samples.into(),
+            transform,
+            smask,
+            overprint,
+            jpeg: None,
+        }
+    }
+
+    /// The canvas sample nearest page point `p`: premultiplied values and alpha.
+    pub fn sample(&self, p: Point) -> Option<(&[f32], f32)> {
+        let q = self.to_px * p;
+        if q.x < 0.0 || q.y < 0.0 {
+            return None;
+        }
+        let (x, y) = (q.x as usize, q.y as usize);
+        if x >= self.w || y >= self.h {
+            return None;
+        }
+        let i = y * self.w + x;
+        Some((&self.values[i * self.n..(i + 1) * self.n], self.alpha[i]))
+    }
+
+    /// Composites the premultiplied values `value` with alpha `a` over pixel (`x`, `y`),
+    /// knocking out every ink.
+    pub fn over(&mut self, x: usize, y: usize, value: &[f32], a: f32) {
+        let i = y * self.w + x;
+        for (v, s) in self.values[i * self.n..(i + 1) * self.n].iter_mut().zip(value) {
+            *v = *v * (1.0 - a) + s;
+        }
+        self.alpha[i] += a * (1.0 - self.alpha[i]);
+    }
+
+    /// The page point at the center of pixel (`x`, `y`).
+    pub fn center(&self, x: usize, y: usize) -> Point {
+        self.to_px.inverse() * Point::new(x as f64 + 0.5, y as f64 + 0.5)
+    }
+}
+
+/// Where page point `p` falls on the gradient, `0..=1`; `None` where it paints nothing.
+fn gradient_offset(geometry: &GradientGeometry, p: Point) -> Option<f64> {
+    let clamp = |s: f64, extend: [bool; 2]| {
+        if s < 0.0 {
+            extend[0].then_some(0.0)
+        } else if s > 1.0 {
+            extend[1].then_some(1.0)
+        } else {
+            Some(s)
+        }
+    };
+    match geometry {
+        GradientGeometry::Axial { start, end, extend, transform } => {
+            let q = transform.inverse() * p;
+            let d = *end - *start;
+            let len2 = d.hypot2();
+            if len2 <= f64::EPSILON {
+                return None;
+            }
+            clamp((q - *start).dot(d) / len2, *extend)
+        }
+        GradientGeometry::Radial { start, start_radius, end, end_radius, extend, transform } => {
+            let q = transform.inverse() * p;
+            let (cd, pd, dr, r0) = (*end - *start, q - *start, end_radius - start_radius, *start_radius);
+            let a = cd.hypot2() - dr * dr;
+            let b = pd.dot(cd) + r0 * dr;
+            let c = pd.hypot2() - r0 * r0;
+            let candidates = if a.abs() < 1e-9 {
+                if b.abs() < 1e-12 {
+                    return None;
+                }
+                [c / (2.0 * b), f64::NAN]
+            } else {
+                let disc = b * b - a * c;
+                if disc < 0.0 {
+                    return None;
+                }
+                let root = disc.sqrt();
+                let (s1, s2) = ((b + root) / a, (b - root) / a);
+                [s1.max(s2), s1.min(s2)]
+            };
+            candidates.into_iter().filter(|s| s.is_finite() && r0 + s * dr >= 0.0).find_map(|s| clamp(s, *extend))
+        }
+    }
+}
+
+fn interpolate_stops(stops: &[(f32, Vec<f32>, Vec<bool>)], s: f64, out: &mut [f32]) {
+    let s = s as f32;
+    let k = stops.iter().position(|st| st.0 >= s).unwrap_or(stops.len() - 1);
+    let (hi, lo) = (&stops[k], &stops[k.saturating_sub(1)]);
+    let u = if hi.0 > lo.0 { ((s - lo.0) / (hi.0 - lo.0)).clamp(0.0, 1.0) } else { 1.0 };
+    for (o, (a, b)) in out.iter_mut().zip(lo.1.iter().zip(&hi.1)) {
+        *o = a + (b - a) * u;
+    }
+}
+
+/// The unit square of a raster image placed over `area` at `scale`, as [`ImageItem::transform`].
+pub(super) fn area_transform(area: Rect, scale: f64, (w, h): (usize, usize)) -> Affine {
+    Affine::translate(area.origin().to_vec2()) * Affine::scale_non_uniform(w as f64 / scale, h as f64 / scale)
+}
+
+/// A gradient stop's color from ink values.
+pub(super) fn stop_color(ids: &StopInks, values: &[f32]) -> InkColor {
+    match ids {
+        StopInks::Gray => {
+            let k = 1.0 - values.first().copied().unwrap_or(1.0);
+            InkColor::Tints(Process::ALL.iter().map(|p| (InkId::process(*p), if *p == Process::Black { k } else { 0.0 })).collect())
+        }
+        StopInks::Inks(ids) => InkColor::Tints(ids.iter().zip(values).map(|(id, v)| (*id, *v)).collect()),
+    }
+}
+
+/// What ink values mean in a gradient stop.
+pub(super) enum StopInks {
+    /// A gray level, painted as black.
+    Gray,
+    Inks(Vec<InkId>),
+}
+
+/// Where a gradient with `extend` paints, in page space, as a clip for the same gradient
+/// extended at both ends; `None` when it extends at both. `bounds` is the page area that can
+/// show. Exact for axial gradients; for radial ones it is the convex hull of the circles the
+/// gradient sweeps, which is where it paints.
+pub(super) fn gradient_extent(geometry: &GradientGeometry, extend: [bool; 2], bounds: Rect) -> Option<BezPath> {
+    if extend == [true, true] {
+        return None;
+    }
+    let (transform, path) = match geometry {
+        GradientGeometry::Axial { start, end, transform, .. } => {
+            let inv = transform.inverse();
+            let r = inv.transform_rect_bbox(bounds);
+            let corners = [Point::new(r.x0, r.y0), Point::new(r.x1, r.y0), Point::new(r.x1, r.y1), Point::new(r.x0, r.y1)];
+            let d = *end - *start;
+            let len = d.hypot();
+            if len.is_nan() || len <= 0.0 {
+                return None;
+            }
+            let normal = Vec2::new(-d.y, d.x) / len;
+            let s: Vec<f64> = corners.iter().map(|c| (*c - *start).dot(d) / (len * len)).collect();
+            let t: Vec<f64> = corners.iter().map(|c| (*c - *start).dot(normal)).collect();
+            let (smin, smax) = s.iter().fold((0.0_f64, 1.0_f64), |(lo, hi), v| (lo.min(*v), hi.max(*v)));
+            let (tmin, tmax) = t.iter().fold((0.0_f64, 0.0_f64), |(lo, hi), v| (lo.min(*v), hi.max(*v)));
+            let a = if extend[0] { smin - 1.0 } else { 0.0 };
+            let b = if extend[1] { smax + 1.0 } else { 1.0 };
+            let at = |s: f64, t: f64| *start + d * s + normal * t;
+            let mut path = BezPath::new();
+            path.move_to(at(a, tmin - 1.0));
+            path.line_to(at(b, tmin - 1.0));
+            path.line_to(at(b, tmax + 1.0));
+            path.line_to(at(a, tmax + 1.0));
+            path.close_path();
+            (*transform, path)
+        }
+        GradientGeometry::Radial { start, start_radius, end, end_radius, transform, .. } => {
+            let inv = transform.inverse();
+            let r = inv.transform_rect_bbox(bounds);
+            let corners = [Point::new(r.x0, r.y0), Point::new(r.x1, r.y0), Point::new(r.x1, r.y1), Point::new(r.x0, r.y1)];
+            let circle = |s: f64| (*start + (*end - *start) * s, start_radius + s * (end_radius - start_radius));
+            let dr = end_radius - start_radius;
+            // How far an extended end reaches: to where the radius is 0, or until the circle
+            // holds the visible area.
+            let reach = |from: f64, dir: f64| {
+                if dr * dir < 0.0 {
+                    return -start_radius / dr;
+                }
+                let mut s = from + dir;
+                for _ in 0..64 {
+                    let (c, radius) = circle(s);
+                    if corners.iter().all(|p| (*p - c).hypot() <= radius) {
+                        break;
+                    }
+                    s = from + (s - from) * 2.0;
+                }
+                s
+            };
+            let a = if extend[0] { reach(0.0, -1.0) } else { 0.0 };
+            let b = if extend[1] { reach(1.0, 1.0) } else { 1.0 };
+            (*transform, hull_of_circles(circle(a), circle(b)))
+        }
+    };
+    Some(transform * path)
+}
+
+/// The convex hull of two circles, circumscribed by a polygon.
+fn hull_of_circles((c0, r0): (Point, f64), (c1, r1): (Point, f64)) -> BezPath {
+    const SIDES: usize = 256;
+    let grow = 1.0 / (std::f64::consts::PI / SIDES as f64).cos();
+    let mut points = Vec::with_capacity(2 * SIDES);
+    for (c, r) in [(c0, r0.max(0.0)), (c1, r1.max(0.0))] {
+        for k in 0..SIDES {
+            let a = k as f64 * std::f64::consts::TAU / SIDES as f64;
+            points.push(c + Vec2::new(a.cos(), a.sin()) * r * grow);
+        }
+    }
+    points.sort_by(|a, b| a.x.total_cmp(&b.x).then(a.y.total_cmp(&b.y)));
+    let cross = |o: Point, a: Point, b: Point| (a - o).cross(b - o);
+    let mut hull: Vec<Point> = Vec::new();
+    for pass in 0..2 {
+        let floor = hull.len();
+        let iter: Box<dyn Iterator<Item = &Point>> = if pass == 0 { Box::new(points.iter()) } else { Box::new(points.iter().rev()) };
+        for p in iter {
+            while hull.len() >= floor + 2 && cross(hull[hull.len() - 2], hull[hull.len() - 1], *p) <= 0.0 {
+                hull.pop();
+            }
+            hull.push(*p);
+        }
+        hull.pop();
+    }
+    let mut path = BezPath::new();
+    for (k, p) in hull.iter().enumerate() {
+        if k == 0 {
+            path.move_to(*p);
+        } else {
+            path.line_to(*p);
+        }
+    }
+    path.close_path();
+    path
+}
+
+/// The rectangle's corners in page space through `t`, as a closed path.
+pub(super) fn rect_path(r: Rect, t: Affine) -> BezPath {
+    let mut path = BezPath::new();
+    path.move_to(t * Point::new(r.x0, r.y0));
+    path.line_to(t * Point::new(r.x1, r.y0));
+    path.line_to(t * Point::new(r.x1, r.y1));
+    path.line_to(t * Point::new(r.x0, r.y1));
+    path.close_path();
+    path
+}
diff --git a/crates/prepress/src/flatten/write.rs b/crates/prepress/src/flatten/write.rs
new file mode 100644
index 00000000..06fcc485
--- /dev/null
+++ b/crates/prepress/src/flatten/write.rs
@@ -0,0 +1,777 @@
+//! Writes a display list, or a [`Flattened`] page, as PDF content through krilla.
+//!
+//! Colors print as [`InkSet::resolve`] makes them (aliases, spots printed as process color)
+//! and are written by [`to_pdf_color`], with one exception: an overprinting process-only
+//! color that names fewer than four process inks is written as a DeviceN color of just the
+//! inks it names. DeviceCMYK would set the unnamed plates to 0 under `OPM 0`, and `OPM 1`
+//! would also leave alone the plates of named inks at 0; a DeviceN color paints exactly its
+//! colorants when it overprints (ISO 32000-2 §8.6.7), whatever `OPM` says.
+//!
+//! Overprint is written as `op`/`OP`/`OPM` on each item, never as blend modes or knockout
+//! groups.
+
+use std::collections::{BTreeMap, BTreeSet, HashMap};
+use std::hash::{Hash, Hasher};
+use std::sync::Arc;
+
+use craft_pdf::interpret::color::CmykConversion;
+use craft_pdf::write::backend::blend::{self as kblend, GroupOptions};
+use craft_pdf::write::backend::color::device_n::{self, Colorant, DeviceNSpace};
+use craft_pdf::write::backend::color::{Color as PdfColor, RegularColor, cmyk};
+use craft_pdf::write::backend::configure::PdfVersion;
+use craft_pdf::write::backend::geom::{Path, PathBuilder, Point as KPoint, Size, Transform};
+use craft_pdf::write::backend::image::{BitsPerComponent, CustomImage, Image, ImageColorspace};
+use craft_pdf::write::backend::mask::{Mask as KMask, MaskType, TransferFunction};
+use craft_pdf::write::backend::num::NormalizedF32;
+use craft_pdf::write::backend::page::PageSettings;
+use craft_pdf::write::backend::paint::{Fill, FillRule as KFillRule, LinearGradient, Paint as KPaint, RadialGradient, SpreadMethod, Stop};
+use craft_pdf::write::backend::surface::Surface;
+use craft_pdf::write::backend::tagging::{ContentTag, SpanTag};
+use craft_pdf::write::backend::text::{Font, GlyphId, KrillaGlyph};
+use craft_pdf::write::backend::{Data, SerializeSettings};
+use craft_pdf::write::{self as pdf_write, Metadata, Writer};
+use kurbo::{Affine, BezPath, PathEl};
+
+use super::{
+    BlendMode, ComplexRegion, DisplayList, FillItem, FillRule, Flattened, FontBytes, GradientGeometry, GroupItem, ImageItem, ImageSpace, Item, Mask,
+    MaskKind, Paint, TextFont, TextItem,
+};
+use crate::ink::{Ink, InkColor, InkId, InkSet, Overprint, Process, to_pdf_color};
+
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum WriteError {
+    #[error(transparent)]
+    Pdf(#[from] pdf_write::WriteError),
+    /// An ink isn't in the set or a spot's Lab alternate can't be converted.
+    #[error("color {0:?} can't be written")]
+    Color(InkColor),
+    /// A DeviceN space would have more colorants than the output's PDF version takes
+    /// ([`max_colorants`]).
+    #[error("a DeviceN space of {colorants} colorants; this output takes at most {max}")]
+    Colorants { colorants: usize, max: usize },
+    /// A complex region paints more spot inks than [`plates`](crate::plates::plates) separates;
+    /// `unseparated` are the ones past the limit.
+    #[error("a complex region paints {inks} spot inks; at most {max} are separated, not {}", some_names(.unseparated))]
+    SpotInks { inks: usize, max: usize, unseparated: Vec<String> },
+    #[error("the page box is empty or not finite")]
+    Page,
+    #[error("image: {0}")]
+    Image(&'static str),
+    /// Display-list features the writer doesn't write yet.
+    #[error("not written yet: {0}")]
+    Unsupported(&'static str),
+    /// Raised by a [`write_flattened`] region callback.
+    #[error("complex region: {0}")]
+    Region(String),
+}
+
+/// The most colorants a DeviceN space takes at `version`: 8 up to PDF 1.4 (implementation
+/// limits, PDF 1.4 reference Appendix C), 32 from PDF 1.5.
+pub fn max_colorants(version: PdfVersion) -> usize {
+    match version {
+        PdfVersion::Pdf14 => 8,
+        _ => DeviceNSpace::MAX_COLORANTS,
+    }
+}
+
+fn some_names(names: &[String]) -> String {
+    let mut listed = names.iter().take(3).map(String::as_str).collect::<Vec<_>>().join(", ");
+    if names.len() > 3 {
+        listed.push_str(", …");
+    }
+    listed
+}
+
+/// Draws `items` on `surface` in page space, with colors of `inks`, for an output of PDF
+/// `version`. `cms` converts spot inks' Lab alternates into the printing condition. On error,
+/// the items before the failing one are drawn and the surface is left balanced.
+pub fn draw(surface: &mut Surface<'_>, inks: &InkSet, items: &[Item], cms: &dyn CmykConversion, version: PdfVersion) -> Result<(), WriteError> {
+    let mut painter = Painter::new(inks, cms, version);
+    items.iter().try_for_each(|item| painter.item(surface, item))
+}
+
+/// Draws `flat.items` in order and, before item `at` of each complex region, the image
+/// `raster` returns for it, clipped to the region's path and without overprint. `raster`
+/// returns an [`ImageItem`] whose space is [`ImageSpace::Inks`] of `list.inks` and which
+/// covers the region, or `None` to leave the region empty. `version` is the output's PDF
+/// version.
+pub fn write_flattened(
+    surface: &mut Surface<'_>,
+    list: &DisplayList,
+    flat: &Flattened,
+    cms: &dyn CmykConversion,
+    version: PdfVersion,
+    raster: &mut dyn FnMut(&ComplexRegion) -> Result<Option<ImageItem>, WriteError>,
+) -> Result<(), WriteError> {
+    Painter::new(&list.inks, cms, version).flattened(surface, flat, raster)
+}
+
+/// [`write_flattened`] for one page of a document whose pages share `fonts`.
+pub fn write_flattened_with_fonts(
+    surface: &mut Surface<'_>,
+    list: &DisplayList,
+    flat: &Flattened,
+    cms: &dyn CmykConversion,
+    version: PdfVersion,
+    fonts: &mut FontMap,
+    raster: &mut dyn FnMut(&ComplexRegion) -> Result<Option<ImageItem>, WriteError>,
+) -> Result<(), WriteError> {
+    let mut painter = Painter::new(&list.inks, cms, version);
+    painter.shared = Some(fonts);
+    painter.flattened(surface, flat, raster)
+}
+
+/// krilla fonts shared by the pages of one document, so that a font used on several pages is
+/// embedded once. Runs share a font only when their [`TextFont`] bytes are equal: equal keys on
+/// two pages can name different bytes (per-page widths of a wrapped bare CFF).
+#[derive(Default)]
+pub struct FontMap {
+    /// By [`TextFont::key`] and face index: each font program seen, `None` where krilla can't
+    /// read it.
+    fonts: HashMap<(u128, u32), Vec<Shared>>,
+}
+
+type Shared = (FontBytes, Option<Font>);
+
+impl FontMap {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Distinct font programs seen, including those krilla can't read.
+    pub fn len(&self) -> usize {
+        self.fonts.values().map(Vec::len).sum()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.fonts.is_empty()
+    }
+
+    fn get(&mut self, tf: &TextFont) -> Option<Font> {
+        let same = |d: &FontBytes| std::ptr::addr_eq(Arc::as_ptr(d), Arc::as_ptr(&tf.data)) || (**d).as_ref() == (*tf.data).as_ref();
+        let entries = self.fonts.entry((tf.key, tf.index)).or_default();
+        if let Some((_, font)) = entries.iter().find(|(d, _)| same(d)) {
+            return font.clone();
+        }
+        let font = Font::new(Data::from(tf.data.clone()), tf.index);
+        entries.push((tf.data.clone(), font.clone()));
+        font
+    }
+}
+
+impl Painter<'_, '_> {
+    fn flattened(
+        &mut self,
+        surface: &mut Surface<'_>,
+        flat: &Flattened,
+        raster: &mut dyn FnMut(&ComplexRegion) -> Result<Option<ImageItem>, WriteError>,
+    ) -> Result<(), WriteError> {
+        let mut regions: Vec<&ComplexRegion> = flat.complex.iter().collect();
+        regions.sort_by_key(|r| r.at);
+        let mut regions = regions.into_iter().peekable();
+        for at in 0..=flat.items.len() {
+            while let Some(region) = regions.next_if(|r| r.at <= at || at == flat.items.len()) {
+                let Some(image) = raster(region)? else { continue };
+                let Some(clip) = to_path(&region.path) else { continue };
+                surface.push_clip_path(&clip, &KFillRule::NonZero);
+                let drawn = self.image(surface, &ImageItem { overprint: Overprint::default(), ..image });
+                surface.pop();
+                drawn?;
+            }
+            if let Some(item) = flat.items.get(at) {
+                self.item(surface, item)?;
+            }
+        }
+        Ok(())
+    }
+}
+
+/// `list` as a one-page PDF with `settings`.
+pub fn page_pdf(list: &DisplayList, settings: SerializeSettings, cms: &dyn CmykConversion) -> Result<Vec<u8>, WriteError> {
+    let page = list.page;
+    let size = PageSettings::from_wh(page.width() as f32, page.height() as f32).filter(|_| page.is_finite()).ok_or(WriteError::Page)?;
+    let version = settings.configuration.version();
+    pdf_write::guard(|| {
+        let mut writer = Writer::new(settings, Metadata::default());
+        let mut page_builder = writer.document_mut().start_page_with(size);
+        let mut surface = page_builder.surface();
+        let shifted = page.x0 != 0.0 || page.y0 != 0.0;
+        if shifted {
+            surface.push_transform(&Transform::from_translate(-page.x0 as f32, -page.y0 as f32));
+        }
+        let drawn = draw(&mut surface, &list.inks, &list.items, cms, version);
+        if shifted {
+            surface.pop();
+        }
+        surface.finish();
+        page_builder.finish();
+        drawn?;
+        Ok(writer.finish()?)
+    })
+}
+
+struct Painter<'a, 'f> {
+    inks: &'a InkSet,
+    cms: &'a dyn CmykConversion,
+    /// [`max_colorants`] of the output.
+    max_colorants: usize,
+    /// The document's fonts, consulted on a miss in `fonts`.
+    shared: Option<&'f mut FontMap>,
+    /// `None` for fonts krilla can't read; their runs are written as outlines. Keyed by
+    /// [`TextFont::key`] for one page only: a font built for another page may have the same
+    /// key and other bytes (per-page widths of a wrapped bare CFF).
+    fonts: HashMap<(u128, u32), Option<Font>>,
+    /// Inside an `/ActualText` span, which can't nest.
+    tagged: bool,
+}
+
+impl<'a> Painter<'a, '_> {
+    fn new(inks: &'a InkSet, cms: &'a dyn CmykConversion, version: PdfVersion) -> Self {
+        Self { inks, cms, max_colorants: max_colorants(version), shared: None, fonts: HashMap::new(), tagged: false }
+    }
+
+    /// An error when a DeviceN space of `colorants` is more than the output takes.
+    fn fits(&self, colorants: usize) -> Result<(), WriteError> {
+        if colorants > self.max_colorants {
+            return Err(WriteError::Colorants { colorants, max: self.max_colorants });
+        }
+        Ok(())
+    }
+
+    fn item(&mut self, s: &mut Surface<'_>, item: &Item) -> Result<(), WriteError> {
+        self.item_with_opacity(s, item, 1.0)
+    }
+
+    /// `opacity` is a group's, applied to a fill or text drawn alone in it.
+    fn item_with_opacity(&mut self, s: &mut Surface<'_>, item: &Item, opacity: f32) -> Result<(), WriteError> {
+        match item {
+            Item::Fill(f) => self.fill(s, f, opacity),
+            Item::Text(t) => self.text(s, t, opacity),
+            Item::Image(im) => self.image(s, im),
+            Item::Group(g) => self.group(s, g),
+        }
+    }
+
+    fn fill(&mut self, s: &mut Surface<'_>, f: &FillItem, opacity: f32) -> Result<(), WriteError> {
+        let Some(path) = to_path(&f.path) else { return Ok(()) };
+        let rule = match f.rule {
+            FillRule::NonZero => KFillRule::NonZero,
+            FillRule::EvenOdd => KFillRule::EvenOdd,
+        };
+        let (paint, overprint) = self.paint(&f.paint, f.overprint, Affine::IDENTITY)?;
+        with_overprint(s, overprint, |s| {
+            s.set_fill(Some(Fill { paint, opacity: normalized(opacity), rule }));
+            s.draw_path(&path);
+        });
+        Ok(())
+    }
+
+    fn text(&mut self, s: &mut Surface<'_>, t: &TextItem, opacity: f32) -> Result<(), WriteError> {
+        let text = t.text.as_deref().unwrap_or("");
+        let font = t.font.as_deref().and_then(|tf| self.font(tf));
+        let (Some(font), Some(first)) = (font, t.glyphs.first()) else {
+            let Some(path) = to_path(&t.outlines) else { return Ok(()) };
+            let (paint, overprint) = self.paint(&t.paint, t.overprint, Affine::IDENTITY)?;
+            let tag = !self.tagged && t.text.is_some();
+            with_overprint(s, overprint, |s| {
+                if tag {
+                    s.start_tagged(ContentTag::Span(SpanTag { actual_text: Some(text), ..SpanTag::empty() }));
+                }
+                s.set_fill(Some(Fill { paint, opacity: normalized(opacity), rule: KFillRule::NonZero }));
+                s.draw_path(&path);
+                if tag {
+                    s.end_tagged();
+                }
+            });
+            return Ok(());
+        };
+        let size = f64::from(t.size);
+        if !(size.is_finite() && size > 0.0) {
+            return Ok(());
+        }
+        let glyphs: Vec<KrillaGlyph> = t
+            .glyphs
+            .iter()
+            .enumerate()
+            .map(|(i, g)| {
+                let next_x = t.glyphs.get(i + 1).map_or(g.origin.x, |n| n.origin.x);
+                let range = if text.get(g.text.clone()).is_some() { g.text.clone() } else { 0..0 };
+                KrillaGlyph::new(GlyphId::new(g.id), ((next_x - g.origin.x) / size) as f32, 0.0, (g.origin.y / size) as f32, 0.0, range, None)
+            })
+            .collect();
+        // Text space is y up; krilla places glyphs y down.
+        let ctm = t.transform * Affine::scale_non_uniform(1.0, -1.0);
+        let (paint, overprint) = self.paint(&t.paint, t.overprint, ctm)?;
+        with_overprint(s, overprint, |s| {
+            s.set_fill(Some(Fill { paint, opacity: normalized(opacity), rule: KFillRule::NonZero }));
+            s.push_transform(&to_transform(ctm));
+            s.draw_glyphs(KPoint::from_xy(first.origin.x as f32, 0.0), &glyphs, font, text, t.size, false);
+            s.pop();
+        });
+        Ok(())
+    }
+
+    fn font(&mut self, tf: &TextFont) -> Option<Font> {
+        if let Some(font) = self.fonts.get(&(tf.key, tf.index)) {
+            return font.clone();
+        }
+        let font = match self.shared.as_deref_mut() {
+            Some(shared) => shared.get(tf),
+            None => Font::new(Data::from(tf.data.clone()), tf.index),
+        };
+        self.fonts.insert((tf.key, tf.index), font.clone());
+        font
+    }
+
+    fn image(&mut self, s: &mut Surface<'_>, im: &ImageItem) -> Result<(), WriteError> {
+        let (w, h) = im.size;
+        let pixels = usize::try_from(u64::from(w) * u64::from(h)).map_err(|_| WriteError::Image("too large"))?;
+        if pixels == 0 {
+            return Ok(());
+        }
+        let draw = |s: &mut Surface<'_>, image: Image| {
+            let Some(unit) = Size::from_wh(1.0, 1.0) else { return };
+            with_overprint(s, im.overprint, |s| {
+                s.push_transform(&to_transform(im.transform));
+                s.draw_image(image, unit);
+                s.pop();
+            });
+        };
+        if let Some(image) = passthrough(im) {
+            draw(s, image);
+            return Ok(());
+        }
+        let (space, components, device_n, samples) = match &im.space {
+            ImageSpace::Gray => (ImageColorspace::Luma, 1, None, im.samples.clone()),
+            ImageSpace::Rgb => (ImageColorspace::Rgb, 3, None, im.samples.clone()),
+            ImageSpace::Cmyk => (ImageColorspace::Cmyk, 4, None, im.samples.clone()),
+            ImageSpace::Inks(ids) => {
+                if im.samples.len() != pixels.saturating_mul(ids.len()) {
+                    return Err(WriteError::Image("sample count doesn't match the size and inks"));
+                }
+                let (space, samples) = self.ink_samples(ids, &im.samples)?;
+                (ImageColorspace::DeviceN, space.colorants().len(), Some(space), samples)
+            }
+        };
+        if samples.len() != pixels.saturating_mul(components) {
+            return Err(WriteError::Image("sample count doesn't match the size and space"));
+        }
+        if im.smask.as_ref().is_some_and(|a| a.len() != pixels) {
+            return Err(WriteError::Image("smask size doesn't match the image"));
+        }
+        let image = Image::from_custom(Samples { samples, alpha: im.smask.clone(), size: im.size, space, device_n }, false)
+            .map_err(|_| WriteError::Image("krilla rejected it"))?;
+        draw(s, image);
+        Ok(())
+    }
+
+    /// Samples of `ids` as samples of the inks they print on: each ink's tint moves to the
+    /// inks [`InkSet::resolve`] gives a full tint of it, and tints on one ink combine as
+    /// overlapping halftones, as `resolve` combines them.
+    fn ink_samples(&self, ids: &[InkId], samples: &Arc<[u8]>) -> Result<(DeviceNSpace, Arc<[u8]>), WriteError> {
+        let mut weights: Vec<Vec<(InkId, f32)>> = Vec::with_capacity(ids.len());
+        for &id in ids {
+            let full = InkColor::Tints(vec![(id, 1.0)]);
+            match self.inks.resolve(&full, self.cms) {
+                InkColor::Tints(t) => weights.push(t),
+                _ => return Err(WriteError::Color(full)),
+            }
+        }
+        let out: Vec<InkId> = weights.iter().flatten().map(|(id, _)| *id).collect::<BTreeSet<_>>().into_iter().collect();
+        self.fits(out.len())?;
+        let colorants = out
+            .iter()
+            .map(|&id| self.colorant(id).ok_or_else(|| WriteError::Color(InkColor::Tints(vec![(id, 1.0)]))))
+            .collect::<Result<Vec<_>, _>>()?;
+        let space = DeviceNSpace::new(colorants).ok_or(WriteError::Image("krilla rejected its DeviceN space"))?;
+        let renames = weights.iter().all(|w| matches!(w[..], [(_, t)] if t == 1.0)) && out.len() == ids.len();
+        if renames && weights.iter().zip(&out).all(|(w, o)| w.first().is_some_and(|(id, _)| id == o)) {
+            return Ok((space, samples.clone()));
+        }
+        // Column of each ink's weights in `out`.
+        let routes: Vec<Vec<(usize, f32)>> =
+            weights.iter().map(|w| w.iter().filter_map(|(id, t)| out.iter().position(|o| o == id).map(|i| (i, *t))).collect()).collect();
+        let n = ids.len();
+        let mut result = Vec::with_capacity(samples.len() / n.max(1) * out.len());
+        let mut keep = vec![1.0_f32; out.len()];
+        for px in samples.chunks_exact(n.max(1)) {
+            keep.fill(1.0);
+            for (v, route) in px.iter().zip(&routes) {
+                let v = f32::from(*v) / 255.0;
+                for &(i, t) in route {
+                    if let Some(k) = keep.get_mut(i) {
+                        *k *= 1.0 - v * t;
+                    }
+                }
+            }
+            result.extend(keep.iter().map(|k| byte(1.0 - k)));
+        }
+        Ok((space, result.into()))
+    }
+
+    fn group(&mut self, s: &mut Surface<'_>, g: &GroupItem) -> Result<(), WriteError> {
+        if g.children.is_empty() {
+            return Ok(());
+        }
+        let mut pushed = 0;
+        let clip = match &g.clip {
+            Some(clip) => match to_path(clip) {
+                Some(path) => Some(path),
+                // An empty clip shows nothing.
+                None => return Ok(()),
+            },
+            None => None,
+        };
+        if let Some(clip) = clip {
+            s.push_clip_path(&clip, &KFillRule::NonZero);
+            pushed += 1;
+        }
+        let tag = match &g.actual_text {
+            Some(text) if !self.tagged => {
+                s.start_tagged(ContentTag::Span(SpanTag { actual_text: Some(text), ..SpanTag::empty() }));
+                self.tagged = true;
+                true
+            }
+            _ => false,
+        };
+        let drawn = self.group_content(s, g, &mut pushed);
+        for _ in 0..pushed {
+            s.pop();
+        }
+        if tag {
+            s.end_tagged();
+            self.tagged = false;
+        }
+        drawn
+    }
+
+    /// Pushes the group's blend mode, mask, opacity and attributes, counted in `pushed`, and
+    /// draws the children.
+    fn group_content(&mut self, s: &mut Surface<'_>, g: &GroupItem, pushed: &mut usize) -> Result<(), WriteError> {
+        let opacity = unit(g.opacity);
+        let blended = g.blend != BlendMode::Normal;
+        if blended {
+            s.push_blend_mode(blend_mode(g.blend));
+            *pushed += 1;
+        }
+        // One fill or text run alone in a plain group: opacity and blend mode on the paint
+        // itself composite the same.
+        if let ([child @ (Item::Fill(_) | Item::Text(_))], false, false, None) = (&g.children[..], g.isolated, g.knockout, &g.mask) {
+            return self.item_with_opacity(s, child, opacity);
+        }
+        let mut isolated = false;
+        if let Some(mask) = &g.mask {
+            let mask = self.mask(s, mask, opacity)?;
+            s.push_mask(mask);
+            *pushed += 1;
+        } else if opacity < 1.0 && g.isolated {
+            s.push_opacity(normalized(opacity));
+            *pushed += 1;
+            isolated = true;
+        } else if opacity < 1.0 || (blended && !g.isolated && !g.knockout) {
+            // krilla writes opacity as an isolated group and a group without attributes as a
+            // plain form; a constant soft mask makes a non-isolated transparency group.
+            let mask = constant_mask(s, opacity);
+            s.push_mask(mask);
+            *pushed += 1;
+        }
+        if g.knockout || (g.isolated && !isolated) {
+            s.push_group(GroupOptions { isolated: g.isolated, knockout: g.knockout });
+            *pushed += 1;
+        }
+        g.children.iter().try_for_each(|child| self.item(s, child))
+    }
+
+    /// `m` as a krilla mask, with `opacity` folded into its transfer function.
+    fn mask(&mut self, s: &mut Surface<'_>, m: &Mask, opacity: f32) -> Result<KMask, WriteError> {
+        let mut builder = s.stream_builder();
+        let mut sub = builder.surface();
+        let tagged = std::mem::replace(&mut self.tagged, true);
+        let drawn = self.group(&mut sub, &m.group);
+        self.tagged = tagged;
+        sub.finish();
+        let stream = builder.finish();
+        drawn?;
+        let kind = match m.kind {
+            MaskKind::Alpha => MaskType::Alpha,
+            MaskKind::Luminosity => MaskType::Luminosity,
+        };
+        let mut mask = KMask::new(stream, kind);
+        if let (MaskKind::Luminosity, Some(backdrop)) = (m.kind, &m.backdrop) {
+            // The backdrop is a color of the CMYK blending space, so spots count as process.
+            let mut process = self.inks.clone();
+            process.set_all_to_process(true);
+            let cmyk = process.resolve(backdrop, self.cms).as_cmyk().ok_or_else(|| WriteError::Color(backdrop.clone()))?;
+            let [c, m, y, k] = cmyk.map(byte);
+            mask = mask.with_backdrop(cmyk::Color::new(c, m, y, k));
+        }
+        let transfer = match &m.transfer {
+            Some(samples) => Some(samples.iter().map(|v| f32::from(*v) / 255.0 * opacity).collect()),
+            None if opacity < 1.0 => Some(vec![0.0, opacity]),
+            None => None,
+        };
+        if let Some(transfer) = transfer {
+            mask = mask.with_transfer(TransferFunction::Sampled(transfer.into_iter().map(normalized).collect()));
+        }
+        Ok(mask)
+    }
+
+    /// `paint` as krilla draws it under `ctm` (page space from the drawing space), and the
+    /// overprint to draw it with.
+    fn paint(&self, paint: &Paint, overprint: Overprint, ctm: Affine) -> Result<(KPaint, Overprint), WriteError> {
+        match paint {
+            Paint::Solid(color) => {
+                let (color, overprint) = self.solid(color, overprint)?;
+                Ok((color.into(), overprint))
+            }
+            Paint::Gradient { stops, geometry } => Ok((self.gradient(stops, geometry, overprint, ctm)?, overprint)),
+        }
+    }
+
+    fn solid(&self, color: &InkColor, overprint: Overprint) -> Result<(PdfColor, Overprint), WriteError> {
+        let resolved = self.inks.resolve(color, self.cms);
+        if let InkColor::Tints(tints) = &resolved
+            && overprint.fill
+            && let Some(cmyk) = resolved.as_cmyk()
+        {
+            let named: Vec<usize> =
+                (0..4).filter(|&i| tints.iter().any(|(id, _)| id.index() == i) && (!overprint.nonzero || cmyk[i] > 0.0)).collect();
+            if named.len() < 4 {
+                if named.is_empty() {
+                    // Zero DeviceCMYK under OPM 1 leaves every plate alone.
+                    return Ok((RegularColor::Cmyk(cmyk::Color::new(0, 0, 0, 0)).into(), Overprint { nonzero: true, ..overprint }));
+                }
+                return Ok((self.process_device_n(&named, cmyk).ok_or_else(|| WriteError::Color(color.clone()))?, overprint));
+            }
+        }
+        if let InkColor::Tints(tints) = &resolved {
+            // More inks than the output's limit include a spot, so `to_pdf_color` makes a
+            // DeviceN space of them.
+            self.fits(tints.iter().map(|(id, _)| *id).collect::<BTreeSet<_>>().len())?;
+        }
+        let pdf = to_pdf_color(&resolved, self.inks, self.cms).ok_or_else(|| WriteError::Color(color.clone()))?;
+        Ok((pdf, overprint))
+    }
+
+    /// A DeviceN color of process inks `named` (indices in plate order) at their `cmyk` tints.
+    fn process_device_n(&self, named: &[usize], cmyk: [f32; 4]) -> Option<PdfColor> {
+        let colorants = named.iter().map(|&i| Process::ALL.get(i).map(|p| process_colorant(*p))).collect::<Option<Vec<_>>>()?;
+        let tints = named.iter().map(|&i| cmyk.get(i).copied().map(byte)).collect::<Option<Vec<_>>>()?;
+        Some(device_n::Color::new(tints, DeviceNSpace::new(colorants)?)?.into())
+    }
+
+    /// Stops in one color space: each lists every ink some stop lists, so krilla writes them
+    /// all in the space a color of those inks gets.
+    fn gradient(&self, stops: &[(f32, InkColor)], geometry: &GradientGeometry, overprint: Overprint, ctm: Affine) -> Result<KPaint, WriteError> {
+        let mut resolved: Vec<(f32, BTreeMap<InkId, f32>)> = Vec::with_capacity(stops.len());
+        for (offset, color) in stops {
+            let InkColor::Tints(tints) = self.inks.resolve(color, self.cms) else {
+                return Err(WriteError::Unsupported("a gradient stop of the All or None colorant"));
+            };
+            let mut merged = BTreeMap::new();
+            for (id, t) in tints {
+                let v = merged.entry(id).or_insert(0.0);
+                *v = 1.0 - (1.0 - *v) * (1.0 - unit(t));
+            }
+            resolved.push((*offset, merged));
+        }
+        let all: BTreeSet<InkId> = resolved.iter().flat_map(|(_, m)| m.keys().copied()).collect();
+        self.fits(all.len())?;
+        let partial_process = overprint.fill && all.len() < 4 && all.iter().all(|id| id.index() < 4);
+        let mut krilla_stops = Vec::with_capacity(resolved.len());
+        for ((offset, merged), (_, original)) in resolved.iter().zip(stops) {
+            let tint = |id: &InkId| merged.get(id).copied().unwrap_or(0.0);
+            let color = if partial_process {
+                let named: Vec<usize> = all.iter().map(|id| id.index()).collect();
+                let mut cmyk = [0.0; 4];
+                for id in &all {
+                    if let Some(c) = cmyk.get_mut(id.index()) {
+                        *c = tint(id);
+                    }
+                }
+                self.process_device_n(&named, cmyk)
+            } else {
+                to_pdf_color(&InkColor::Tints(all.iter().map(|id| (*id, tint(id))).collect()), self.inks, self.cms)
+            };
+            let color = color.ok_or_else(|| WriteError::Color(original.clone()))?;
+            krilla_stops.push(Stop { offset: normalized(*offset), color, opacity: NormalizedF32::ONE });
+        }
+        let to_drawing = |t: &Affine| to_transform(ctm.inverse() * *t);
+        Ok(match geometry {
+            GradientGeometry::Axial { start, end, extend: [true, true], transform } => LinearGradient {
+                x1: start.x as f32,
+                y1: start.y as f32,
+                x2: end.x as f32,
+                y2: end.y as f32,
+                transform: to_drawing(transform),
+                spread_method: SpreadMethod::Pad,
+                stops: krilla_stops,
+                anti_alias: false,
+            }
+            .into(),
+            GradientGeometry::Radial { start, start_radius, end, end_radius, extend: [true, true], transform } => RadialGradient {
+                fx: start.x as f32,
+                fy: start.y as f32,
+                fr: *start_radius as f32,
+                cx: end.x as f32,
+                cy: end.y as f32,
+                cr: *end_radius as f32,
+                transform: to_drawing(transform),
+                spread_method: SpreadMethod::Pad,
+                stops: krilla_stops,
+                anti_alias: false,
+            }
+            .into(),
+            _ => return Err(WriteError::Unsupported("a gradient that doesn't extend at both ends")),
+        })
+    }
+
+    /// Ink `id` as a DeviceN colorant; a spot carries its CMYK alternate.
+    fn colorant(&self, id: InkId) -> Option<Colorant> {
+        match self.inks.get(id)? {
+            Ink::Process(p) => Some(process_colorant(*p)),
+            Ink::Spot(spot) => {
+                let [c, m, y, k] = self.inks.spot_cmyk(id, self.cms)?.map(byte);
+                (!spot.name.is_empty()).then(|| Colorant::Spot { name: spot.name.clone(), alternate: cmyk::Color::new(c, m, y, k) })
+            }
+        }
+    }
+}
+
+/// A soft mask of `opacity` everywhere: an empty luminosity group whose transfer function
+/// maps every value to `opacity`.
+fn constant_mask(s: &mut Surface<'_>, opacity: f32) -> KMask {
+    let builder = s.stream_builder();
+    let stream = builder.finish();
+    let o = normalized(opacity);
+    KMask::new(stream, MaskType::Luminosity).with_transfer(TransferFunction::Sampled(vec![o, o]))
+}
+
+fn with_overprint(s: &mut Surface<'_>, overprint: Overprint, draw: impl FnOnce(&mut Surface<'_>)) {
+    if overprint == Overprint::default() {
+        draw(s);
+        return;
+    }
+    s.push_overprint(kblend::Overprint { fill: overprint.fill, stroke: overprint.stroke, nonzero: overprint.nonzero });
+    draw(s);
+    s.pop();
+}
+
+fn process_colorant(p: Process) -> Colorant {
+    Colorant::Process(match p {
+        Process::Cyan => device_n::Process::Cyan,
+        Process::Magenta => device_n::Process::Magenta,
+        Process::Yellow => device_n::Process::Yellow,
+        Process::Black => device_n::Process::Black,
+    })
+}
+
+fn blend_mode(b: BlendMode) -> kblend::BlendMode {
+    use kblend::BlendMode as K;
+    match b {
+        BlendMode::Normal => K::Normal,
+        BlendMode::Multiply => K::Multiply,
+        BlendMode::Screen => K::Screen,
+        BlendMode::Overlay => K::Overlay,
+        BlendMode::Darken => K::Darken,
+        BlendMode::Lighten => K::Lighten,
+        BlendMode::ColorDodge => K::ColorDodge,
+        BlendMode::ColorBurn => K::ColorBurn,
+        BlendMode::HardLight => K::HardLight,
+        BlendMode::SoftLight => K::SoftLight,
+        BlendMode::Difference => K::Difference,
+        BlendMode::Exclusion => K::Exclusion,
+        BlendMode::Hue => K::Hue,
+        BlendMode::Saturation => K::Saturation,
+        BlendMode::Color => K::Color,
+        BlendMode::Luminosity => K::Luminosity,
+    }
+}
+
+fn to_transform(a: Affine) -> Transform {
+    let [a, b, c, d, e, f] = a.as_coeffs().map(|v| v as f32);
+    Transform::from_row(a, b, c, d, e, f)
+}
+
+/// `None` for an empty path, which paints nothing.
+fn to_path(path: &BezPath) -> Option<Path> {
+    let mut b = PathBuilder::new();
+    for el in path.elements() {
+        match *el {
+            PathEl::MoveTo(p) => b.move_to(p.x as f32, p.y as f32),
+            PathEl::LineTo(p) => b.line_to(p.x as f32, p.y as f32),
+            PathEl::QuadTo(p1, p) => b.quad_to(p1.x as f32, p1.y as f32, p.x as f32, p.y as f32),
+            PathEl::CurveTo(p1, p2, p) => b.cubic_to(p1.x as f32, p1.y as f32, p2.x as f32, p2.y as f32, p.x as f32, p.y as f32),
+            PathEl::ClosePath => b.close(),
+        }
+    }
+    b.finish()
+}
+
+fn unit(v: f32) -> f32 {
+    if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 }
+}
+
+fn normalized(v: f32) -> NormalizedF32 {
+    NormalizedF32::new(unit(v)).unwrap_or(NormalizedF32::ONE)
+}
+
+fn byte(v: f32) -> u8 {
+    (unit(v) * 255.0).round() as u8
+}
+
+/// Image samples for krilla.
+#[derive(Clone)]
+struct Samples {
+    samples: Arc<[u8]>,
+    alpha: Option<Arc<[u8]>>,
+    size: (u32, u32),
+    space: ImageColorspace,
+    device_n: Option<DeviceNSpace>,
+}
+
+impl Hash for Samples {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.samples.hash(state);
+        self.alpha.hash(state);
+        self.size.hash(state);
+        self.space.hash(state);
+        self.device_n.hash(state);
+    }
+}
+
+impl CustomImage for Samples {
+    fn color_channel(&self) -> &[u8] {
+        &self.samples
+    }
+    fn alpha_channel(&self) -> Option<&[u8]> {
+        self.alpha.as_deref()
+    }
+    fn bits_per_component(&self) -> BitsPerComponent {
+        BitsPerComponent::Eight
+    }
+    fn size(&self) -> (u32, u32) {
+        self.size
+    }
+    fn icc_profile(&self) -> Option<&[u8]> {
+        None
+    }
+    fn color_space(&self) -> ImageColorspace {
+        self.space
+    }
+    fn device_n_space(&self) -> Option<DeviceNSpace> {
+        self.device_n.clone()
+    }
+}
+
+/// `im`'s JPEG data as a krilla image, written as it is (DCTDecode), when it has one that
+/// decodes to its size. The embedded ICC profile is left out, as the samples path leaves it.
+fn passthrough(im: &ImageItem) -> Option<Image> {
+    if im.smask.is_some() || !matches!(im.space, ImageSpace::Gray | ImageSpace::Cmyk) {
+        return None;
+    }
+    let data: Arc<dyn AsRef<[u8]> + Send + Sync> = Arc::new(im.jpeg.clone()?);
+    let image = Image::from_jpeg_with_icc(Data::from(data), None, false).ok()?;
+    (image.size() == im.size).then_some(image)
+}
diff --git a/crates/prepress/src/ink.rs b/crates/prepress/src/ink.rs
new file mode 100644
index 00000000..2dc3b472
--- /dev/null
+++ b/crates/prepress/src/ink.rs
@@ -0,0 +1,589 @@
+//! The ink model: which inks a job prints with, and colors as tints of those inks.
+
+use std::borrow::Cow;
+use std::collections::{BTreeMap, BTreeSet};
+
+use craft_cms::math;
+use craft_pdf::interpret::color::CmykConversion;
+use craft_pdf::write::backend::color::device_n::{self, Colorant, DeviceNSpace};
+use craft_pdf::write::backend::color::separation::{self, SeparationColorant, SeparationSpace};
+use craft_pdf::write::backend::color::{Color as PdfColor, RegularColor, cmyk};
+
+use crate::cms::lab_to_srgb8;
+
+/// A process ink, in plate order.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Process {
+    Cyan,
+    Magenta,
+    Yellow,
+    Black,
+}
+
+impl Process {
+    /// The four process inks, in plate order.
+    pub const ALL: [Process; 4] = [Process::Cyan, Process::Magenta, Process::Yellow, Process::Black];
+
+    /// The colorant name a `Separation` or `DeviceN` color space gives this ink.
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Cyan => "Cyan",
+            Self::Magenta => "Magenta",
+            Self::Yellow => "Yellow",
+            Self::Black => "Black",
+        }
+    }
+
+    /// The process ink a colorant name denotes (ISO 32000-2 §8.6.6.4).
+    pub fn from_name(name: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|p| p.name() == name)
+    }
+
+    /// The ink's position in a CMYK color.
+    pub fn index(self) -> usize {
+        self as usize
+    }
+}
+
+/// How a spot ink looks, for previews and for printing it as process color.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Alternate {
+    /// CMYK components, `0.0..=1.0`.
+    Cmyk([f32; 4]),
+    /// CIE L\*a\*b\* relative to D50.
+    Lab([f32; 3]),
+}
+
+/// A spot ink.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Spot {
+    /// The colorant name, as a `Separation` color space would name it, without PDF name
+    /// escapes (see [`normalize_name`]).
+    pub name: String,
+    /// The ink at 100%.
+    pub alternate: Alternate,
+    /// How opaque the ink is (`0.0..=1.0`, as InDesign's Ink Manager states it), when known.
+    pub solidity: Option<f32>,
+}
+
+/// A process or spot ink.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Ink {
+    Process(Process),
+    Spot(Spot),
+}
+
+impl Ink {
+    /// The colorant name: `Cyan` … `Black`, or the spot ink's name.
+    pub fn name(&self) -> &str {
+        match self {
+            Self::Process(p) => p.name(),
+            Self::Spot(s) => &s.name,
+        }
+    }
+
+    pub fn is_spot(&self) -> bool {
+        matches!(self, Self::Spot(_))
+    }
+}
+
+/// An ink's index in its [`InkSet`].
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct InkId(u16);
+
+impl InkId {
+    /// The ink's position in [`InkSet::iter`] order, which is also its plane in
+    /// [`Plates::planes`](crate::Plates::planes).
+    pub fn index(self) -> usize {
+        usize::from(self.0)
+    }
+
+    /// The id of process ink `p`, the same in every [`InkSet`].
+    pub const fn process(p: Process) -> Self {
+        Self(p as u16)
+    }
+}
+
+/// The inks of one document or job: the four process inks, always first and in plate order,
+/// then spot inks in the order added. Ids stay valid as inks are added.
+///
+/// The set is also the job's ink manager, as InDesign's Ink Manager states it: a spot ink can
+/// print on another ink's plate ([`alias`](Self::alias)) or as process color
+/// ([`set_to_process`](Self::set_to_process), [`set_all_to_process`](Self::set_all_to_process)).
+/// [`resolve`](Self::resolve) applies both to a color.
+#[derive(Clone, Debug, PartialEq)]
+pub struct InkSet {
+    inks: Vec<Ink>,
+    aliases: BTreeMap<InkId, InkId>,
+    to_process: BTreeSet<InkId>,
+    all_to_process: bool,
+}
+
+impl Default for InkSet {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl InkSet {
+    /// The four process inks.
+    pub fn new() -> Self {
+        Self {
+            inks: Process::ALL.into_iter().map(Ink::Process).collect(),
+            aliases: BTreeMap::new(),
+            to_process: BTreeSet::new(),
+            all_to_process: false,
+        }
+    }
+
+    /// Adds `ink` and returns its id. An ink whose name is already in the set (compared after
+    /// [`normalize_name`]) is not added again, and its existing id is returned; a spot named
+    /// `Cyan` … `Black` is the process ink. A spot's name is stored normalized. `None` for the
+    /// names `All` and `None`, which are not inks (§8.6.6.4), and when the set is full
+    /// (65 536 inks).
+    pub fn add(&mut self, ink: Ink) -> Option<InkId> {
+        let spot = match ink {
+            Ink::Process(p) => return Some(InkId::process(p)),
+            Ink::Spot(spot) => spot,
+        };
+        let name = normalize_name(&spot.name).into_owned();
+        self.add_decoded(Spot { name, ..spot })
+    }
+
+    /// [`add`](Self::add) for a spot whose name is already decoded, as a PDF reader hands it
+    /// over: `#` in the name is a literal character.
+    pub(crate) fn add_decoded(&mut self, spot: Spot) -> Option<InkId> {
+        if spot.name == "All" || spot.name == "None" {
+            return None;
+        }
+        if let Some(id) = self.lookup_decoded(&spot.name) {
+            return Some(id);
+        }
+        let id = InkId(u16::try_from(self.inks.len()).ok()?);
+        self.inks.push(Ink::Spot(spot));
+        Some(id)
+    }
+
+    /// The ink named `name`, compared after [`normalize_name`]: `"/Gold#20Foil"` finds
+    /// `Gold Foil`.
+    pub fn lookup(&self, name: &str) -> Option<InkId> {
+        self.lookup_decoded(&normalize_name(name))
+    }
+
+    fn lookup_decoded(&self, name: &str) -> Option<InkId> {
+        if let Some(p) = Process::from_name(name) {
+            return Some(InkId::process(p));
+        }
+        let at = self.inks.iter().skip(4).position(|ink| ink.name() == name)?;
+        u16::try_from(at + 4).ok().map(InkId)
+    }
+
+    pub fn get(&self, id: InkId) -> Option<&Ink> {
+        self.inks.get(id.index())
+    }
+
+    /// Every ink with its id: the process inks, then the spot inks.
+    pub fn iter(&self) -> impl Iterator<Item = (InkId, &Ink)> {
+        // At most 65 536 inks (`add`), so every index fits.
+        self.inks.iter().enumerate().map(|(i, ink)| (InkId(i as u16), ink))
+    }
+
+    /// The spot inks with their ids.
+    pub fn spots(&self) -> impl Iterator<Item = (InkId, &Spot)> {
+        self.iter().filter_map(|(id, ink)| match ink {
+            Ink::Spot(s) => Some((id, s)),
+            Ink::Process(_) => None,
+        })
+    }
+
+    /// The number of inks, process inks included.
+    pub fn len(&self) -> usize {
+        self.inks.len()
+    }
+
+    /// Always `false`: a set holds the process inks.
+    pub fn is_empty(&self) -> bool {
+        self.inks.is_empty()
+    }
+
+    fn spot(&self, id: InkId) -> Option<&Spot> {
+        match self.get(id)? {
+            Ink::Spot(s) => Some(s),
+            Ink::Process(_) => None,
+        }
+    }
+
+    /// Prints spot ink `from` on ink `to`'s plate. `to` may be a process ink or another spot,
+    /// which may itself be aliased or printed as process color; `resolve` follows the chain.
+    /// `to == from` removes the alias. Returns `false`, changing nothing, when `from` is not a
+    /// spot ink of the set, `to` is not in the set, or the alias would make a loop.
+    pub fn alias(&mut self, from: InkId, to: InkId) -> bool {
+        if self.spot(from).is_none() || self.get(to).is_none() {
+            return false;
+        }
+        if from == to {
+            self.aliases.remove(&from);
+            return true;
+        }
+        if self.plate_chain(to).any(|id| id == from) {
+            return false;
+        }
+        self.aliases.insert(from, to);
+        true
+    }
+
+    /// The ink spot ink `from` is aliased to, if any.
+    pub fn alias_of(&self, from: InkId) -> Option<InkId> {
+        self.aliases.get(&from).copied()
+    }
+
+    /// Prints spot ink `ink` as process color (`on`), converted from its alternate, or on its
+    /// own plate. Returns `false`, changing nothing, when `ink` is not a spot ink of the set.
+    pub fn set_to_process(&mut self, ink: InkId, on: bool) -> bool {
+        if self.spot(ink).is_none() {
+            return false;
+        }
+        if on {
+            self.to_process.insert(ink);
+        } else {
+            self.to_process.remove(&ink);
+        }
+        true
+    }
+
+    /// Prints every spot ink as process color ("All Spots to Process"), whatever
+    /// [`set_to_process`](Self::set_to_process) says for each. Aliases still apply first: a
+    /// spot aliased to a process ink prints on that ink's plate.
+    pub fn set_all_to_process(&mut self, on: bool) {
+        self.all_to_process = on;
+    }
+
+    pub fn all_to_process(&self) -> bool {
+        self.all_to_process
+    }
+
+    /// Whether spot ink `ink` prints as process color when a color names it directly (an
+    /// alias of it is followed first, see [`plate_of`](Self::plate_of)).
+    pub fn is_to_process(&self, ink: InkId) -> bool {
+        self.spot(ink).is_some() && (self.all_to_process || self.to_process.contains(&ink))
+    }
+
+    /// `id`, then each ink it is aliased to in turn. Stops after as many steps as there are
+    /// inks, so a loop can't make it endless.
+    fn plate_chain(&self, id: InkId) -> impl Iterator<Item = InkId> + '_ {
+        std::iter::successors(Some(id), |id| self.alias_of(*id)).take(self.inks.len())
+    }
+
+    /// The end of `id`'s alias chain: `id` itself when it has no alias. It prints on its own
+    /// plate unless [`is_to_process`](Self::is_to_process) says it converts. `None` when `id`
+    /// is not in the set.
+    pub fn alias_end(&self, id: InkId) -> Option<InkId> {
+        self.get(id)?;
+        self.plate_chain(id).last()
+    }
+
+    /// The ink whose plate a tint of `id` prints on after aliases: `id` itself, the end of its
+    /// alias chain, or `None` when that ink prints as process color (or `id` is not in the
+    /// set).
+    pub fn plate_of(&self, id: InkId) -> Option<InkId> {
+        let end = self.alias_end(id)?;
+        (!self.is_to_process(end)).then_some(end)
+    }
+
+    /// Spot ink `id` at 100% as process color, `0.0..=1.0` per component: its CMYK alternate
+    /// as it is, a Lab alternate through `cms`, or, when `cms` can't convert, through sRGB and
+    /// the ISO 32000-2 §10.4.2.4 formulas (full black generation and undercolor removal).
+    /// `None` for process inks, inks not in the set, and Lab colors craft-cms can't convert.
+    pub fn spot_cmyk(&self, id: InkId, cms: &dyn CmykConversion) -> Option<[f32; 4]> {
+        let lab = match self.spot(id)?.alternate {
+            Alternate::Cmyk(cmyk) => return Some(cmyk.map(|v| if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 })),
+            Alternate::Lab(lab) => lab,
+        };
+        let mut cmyk = [0.0_f32; 4];
+        if cms.from_pcs_xyz(&math::lab_to_xyz_f32(lab), &mut cmyk).is_some() {
+            return Some(cmyk);
+        }
+        let mut rgb = [0_u8; 3];
+        lab_to_srgb8(&lab, &mut rgb)?;
+        let [c, m, y] = rgb.map(|v| 1.0 - f32::from(v) / 255.0);
+        let k = c.min(m).min(y);
+        Some([c - k, m - k, y - k, k])
+    }
+
+    /// `color` as it prints with this set's aliases and to-process settings: each tint moves
+    /// to the plate [`plate_of`](Self::plate_of) names, and a tint of an ink printed as process
+    /// color becomes that tint of its [`spot_cmyk`](Self::spot_cmyk). Tints that land on one
+    /// plate combine as overlapping halftones, `1 − (1 − a)(1 − b)`. When any tint became
+    /// process color the result lists all four process inks first (a CMYK color if no spot
+    /// is left); otherwise inks keep their order. Inks not in the set, and spots whose Lab
+    /// alternate can't be converted, stay as they are. `All` and `None` are unchanged.
+    pub fn resolve(&self, color: &InkColor, cms: &dyn CmykConversion) -> InkColor {
+        let InkColor::Tints(tints) = color else { return color.clone() };
+        let mut out: Vec<(InkId, f32)> = Vec::with_capacity(tints.len());
+        let mut process: Option<[f32; 4]> = None;
+        let combine = |a: f32, b: f32| 1.0 - (1.0 - a) * (1.0 - b);
+        for &(id, tint) in tints {
+            let end = match self.get(id) {
+                Some(_) => self.plate_chain(id).last().unwrap_or(id),
+                None => id,
+            };
+            if self.is_to_process(end)
+                && let Some(cmyk) = self.spot_cmyk(end, cms)
+            {
+                let acc = process.get_or_insert([0.0; 4]);
+                for (a, c) in acc.iter_mut().zip(cmyk) {
+                    *a = combine(*a, c * tint);
+                }
+                continue;
+            }
+            match out.iter_mut().find(|(i, _)| *i == end) {
+                Some((_, t)) => *t = combine(*t, tint),
+                None => out.push((end, tint)),
+            }
+        }
+        let Some(mut cmyk) = process else { return InkColor::Tints(out) };
+        out.retain(|(id, tint)| match Process::ALL.get(id.index()) {
+            Some(p) => {
+                if let Some(c) = cmyk.get_mut(p.index()) {
+                    *c = combine(*c, *tint);
+                }
+                false
+            }
+            None => true,
+        });
+        let mut all: Vec<(InkId, f32)> = Process::ALL.iter().zip(cmyk).map(|(p, c)| (InkId::process(*p), c)).collect();
+        all.extend(out);
+        InkColor::Tints(all)
+    }
+}
+
+/// A color as ink tints.
+#[derive(Clone, Debug, PartialEq)]
+#[non_exhaustive]
+pub enum InkColor {
+    /// Tints `0.0..=1.0` of the listed inks; other inks are unspecified (they keep what is
+    /// under the paint when it overprints, and are knocked out otherwise). One entry is a
+    /// `Separation` color, several a `DeviceN` one.
+    Tints(Vec<(InkId, f32)>),
+    /// The same tint on every plate: the registration color (the `All` colorant).
+    All(f32),
+    /// No ink on any plate (the `None` colorant).
+    None,
+}
+
+impl InkColor {
+    /// The color as DeviceCMYK components when every tint is of a process ink, as
+    /// [`InkSet::resolve`] leaves a spot printed as process color; process inks not listed
+    /// are 0. `None` when a spot ink is listed, and for `All` and `None`.
+    pub fn as_cmyk(&self) -> Option<[f32; 4]> {
+        let Self::Tints(tints) = self else { return None };
+        let mut cmyk = [0.0; 4];
+        for (id, tint) in tints {
+            *cmyk.get_mut(id.index())? = *tint;
+        }
+        Some(cmyk)
+    }
+}
+
+/// `color` as a krilla fill or stroke color, for the PDF writer. Pass the color as it prints,
+/// after [`InkSet::resolve`].
+///
+/// - Tints of process inks only: DeviceCMYK, unlisted inks 0 (so with `OPM 1` an overprinting
+///   paint leaves their plates as they are).
+/// - One spot ink alone: a `Separation` space with the spot's alternate as DeviceCMYK fallback.
+/// - Any other mix: a `DeviceN` space, process inks first in plate order, then spot inks in
+///   set order. Each spot keeps the alternate its `Separation` space has.
+/// - `All`: the registration color, a `Separation /All` space; `None`: a `Separation /None`
+///   space, which marks no plate.
+///
+/// Spot alternates are [`InkSet::spot_cmyk`]: a CMYK alternate as given, a Lab one through
+/// `cms` into the printing condition. A tint listed twice combines as overlapping halftones,
+/// as in `resolve`. `None` when `Tints` lists no ink (there is nothing to paint; use
+/// [`InkColor::None`] to mark no plate), a tint's ink is not in `inks`, a spot's Lab alternate
+/// can't be converted, a spot name is empty, or a `DeviceN` space would have more than 32
+/// colorants.
+pub fn to_pdf_color(color: &InkColor, inks: &InkSet, cms: &dyn CmykConversion) -> Option<PdfColor> {
+    let tints = match color {
+        InkColor::All(tint) => return Some(separation(SeparationColorant::AllColorants, *tint, cmyk::Color::new(255, 255, 255, 255))),
+        InkColor::None => return Some(separation(SeparationColorant::NoColorant, 0.0, cmyk::Color::new(0, 0, 0, 0))),
+        InkColor::Tints(tints) if tints.is_empty() => return None,
+        InkColor::Tints(tints) => tints,
+    };
+    // Sorted by id: process inks first, in plate order, then spots in set order.
+    let mut merged: BTreeMap<InkId, f32> = BTreeMap::new();
+    for &(id, tint) in tints {
+        inks.get(id)?;
+        let t = merged.entry(id).or_insert(0.0);
+        *t = 1.0 - (1.0 - *t) * (1.0 - unit(tint));
+    }
+    if merged.keys().all(|id| id.index() < Process::ALL.len()) {
+        let mut cmyk = [0_u8; 4];
+        for (id, tint) in &merged {
+            if let Some(c) = cmyk.get_mut(id.index()) {
+                *c = byte(*tint);
+            }
+        }
+        let [c, m, y, k] = cmyk;
+        return Some(RegularColor::Cmyk(cmyk::Color::new(c, m, y, k)).into());
+    }
+    let spot = |id: InkId| -> Option<(String, cmyk::Color)> {
+        let name = inks.get(id)?.name();
+        let [c, m, y, k] = inks.spot_cmyk(id, cms)?.map(byte);
+        (!name.is_empty()).then(|| (name.to_owned(), cmyk::Color::new(c, m, y, k)))
+    };
+    if let [(&id, &tint)] = merged.iter().collect::<Vec<_>>()[..] {
+        let (name, alternate) = spot(id)?;
+        return Some(separation(SeparationColorant::Custom(name), tint, alternate));
+    }
+    let mut colorants = Vec::with_capacity(merged.len());
+    for &id in merged.keys() {
+        colorants.push(match Process::ALL.get(id.index()) {
+            Some(p) => Colorant::Process(match p {
+                Process::Cyan => device_n::Process::Cyan,
+                Process::Magenta => device_n::Process::Magenta,
+                Process::Yellow => device_n::Process::Yellow,
+                Process::Black => device_n::Process::Black,
+            }),
+            None => {
+                let (name, alternate) = spot(id)?;
+                Colorant::Spot { name, alternate }
+            }
+        });
+    }
+    let space = DeviceNSpace::new(colorants)?;
+    Some(device_n::Color::new(merged.values().map(|t| byte(*t)).collect(), space)?.into())
+}
+
+fn unit(v: f32) -> f32 {
+    if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 }
+}
+
+fn byte(v: f32) -> u8 {
+    (unit(v) * 255.0).round() as u8
+}
+
+fn separation(colorant: SeparationColorant, tint: f32, fallback: cmyk::Color) -> PdfColor {
+    separation::Color::new(byte(tint), SeparationSpace::new(colorant, RegularColor::Cmyk(fallback))).into()
+}
+
+/// Overprint parameters of a paint (ISO 32000-2 §8.6.7).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct Overprint {
+    /// Fills and other non-stroking paints overprint (`op`).
+    pub fill: bool,
+    /// Strokes overprint (`OP`).
+    pub stroke: bool,
+    /// Nonzero overprint mode (`OPM 1`): a zero DeviceCMYK component leaves its plate as it is.
+    pub nonzero: bool,
+}
+
+/// A colorant name as a PDF name object carries it: without a leading `/` and with `#xx`
+/// escapes decoded (ISO 32000-2 §7.3.5), read as UTF-8 (invalid sequences replaced).
+pub fn normalize_name(name: &str) -> Cow<'_, str> {
+    let name = name.strip_prefix('/').unwrap_or(name);
+    if !name.contains('#') {
+        return Cow::Borrowed(name);
+    }
+    let bytes = name.as_bytes();
+    let mut out = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    while let Some(&b) = bytes.get(i) {
+        let hex = bytes.get(i + 1..i + 3).and_then(|h| std::str::from_utf8(h).ok()).and_then(|h| u8::from_str_radix(h, 16).ok());
+        match (b, hex) {
+            (b'#', Some(decoded)) => {
+                out.push(decoded);
+                i += 3;
+            }
+            _ => {
+                out.push(b);
+                i += 1;
+            }
+        }
+    }
+    Cow::Owned(String::from_utf8_lossy(&out).into_owned())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn spot(name: &str) -> Ink {
+        Ink::Spot(Spot { name: name.into(), alternate: Alternate::Lab([80.0, 5.0, 60.0]), solidity: None })
+    }
+
+    #[test]
+    fn spots_follow_the_process_inks_and_names_are_compared_as_pdf_names() {
+        let mut set = InkSet::new();
+        let gold = set.add(spot("/Gold#20Foil")).unwrap();
+        assert_eq!(gold.index(), 4);
+        assert_eq!(set.get(gold).unwrap().name(), "Gold Foil");
+        assert_eq!(set.add(spot("Gold Foil")), Some(gold), "added once");
+        assert_eq!(set.lookup("Gold#20Foil"), Some(gold));
+        assert_eq!(set.add(spot("Black")), Some(InkId::process(Process::Black)));
+        assert_eq!(set.lookup("/Cyan"), Some(InkId::process(Process::Cyan)));
+        assert_eq!(set.add(spot("All")), None);
+        assert_eq!(set.add(spot("None")), None);
+        assert_eq!(set.lookup("gold foil"), None, "names are case-sensitive");
+        let names: Vec<&str> = set.iter().map(|(_, ink)| ink.name()).collect();
+        assert_eq!(names, ["Cyan", "Magenta", "Yellow", "Black", "Gold Foil"]);
+        assert_eq!(set.spots().count(), 1);
+    }
+
+    fn close(got: Option<[f32; 4]>, expected: [f32; 4]) -> bool {
+        got.is_some_and(|got| got.iter().zip(expected).all(|(g, e)| (g - e).abs() < 1e-4))
+    }
+
+    #[test]
+    fn aliases_and_spots_to_process_resolve_colors() {
+        let mut set = InkSet::new();
+        let gold = set.add(Ink::Spot(Spot { name: "Gold".into(), alternate: Alternate::Cmyk([0.0, 0.3, 1.0, 0.0]), solidity: None })).unwrap();
+        let yellow = set.add(spot("Lab Yellow")).unwrap();
+        let varnish = set.add(spot("Varnish")).unwrap();
+        let k = InkId::process(Process::Black);
+        let cms = crate::CmsConversion::fogra39();
+        let tints = |t: &[(InkId, f32)]| InkColor::Tints(t.to_vec());
+
+        let plain = tints(&[(gold, 0.5), (k, 1.0)]);
+        assert_eq!(set.resolve(&plain, &cms), plain, "no settings: unchanged");
+        assert_eq!(set.resolve(&InkColor::All(1.0), &cms), InkColor::All(1.0));
+
+        assert!(set.alias(varnish, gold));
+        assert_eq!((set.alias_of(varnish), set.plate_of(varnish)), (Some(gold), Some(gold)));
+        assert_eq!(set.resolve(&tints(&[(varnish, 0.5)]), &cms), tints(&[(gold, 0.5)]));
+        assert_eq!(set.resolve(&tints(&[(gold, 0.5), (varnish, 0.5)]), &cms), tints(&[(gold, 0.75)]), "one plate: tints overlap");
+        assert!(!set.alias(gold, varnish), "a loop is refused");
+        assert!(!set.alias(k, gold), "process inks aren't aliased");
+        assert!(!set.alias(gold, InkId(99)));
+
+        assert!(set.set_to_process(gold, true));
+        assert!(!set.set_to_process(k, true));
+        assert_eq!(set.plate_of(varnish), None, "aliased to a spot printed as process");
+        assert_eq!(set.alias_end(varnish), Some(gold), "the converted ink is still named");
+        assert!(set.is_to_process(gold));
+        assert_eq!(set.alias_end(InkId(99)), None);
+        assert!(close(set.resolve(&tints(&[(varnish, 0.5)]), &cms).as_cmyk(), [0.0, 0.15, 0.5, 0.0]));
+        let rich = set.resolve(&tints(&[(k, 0.5), (gold, 1.0)]), &cms);
+        assert!(close(rich.as_cmyk(), [0.0, 0.3, 1.0, 0.5]), "{rich:?}");
+        let InkColor::Tints(mixed) = set.resolve(&tints(&[(yellow, 0.4), (gold, 1.0)]), &cms) else { panic!() };
+        let order: Vec<InkId> = mixed.iter().map(|(id, _)| *id).collect();
+        assert_eq!(order[..4], Process::ALL.map(InkId::process), "process inks first");
+        assert_eq!(mixed[4], (yellow, 0.4), "the spot left on its plate");
+
+        set.set_all_to_process(true);
+        assert!(set.is_to_process(yellow) && !set.is_to_process(k));
+        let lab = set.resolve(&tints(&[(yellow, 1.0)]), &cms).as_cmyk().unwrap();
+        assert!(lab[2] > 0.4 && lab[2] > lab[0] && lab[3] < 0.2, "a light yellow through FOGRA39: {lab:?}");
+        assert!(set.alias(yellow, k));
+        assert_eq!(set.resolve(&tints(&[(yellow, 0.5)]), &cms), tints(&[(k, 0.5)]), "aliases apply first");
+
+        assert!(set.alias(varnish, varnish));
+        assert_eq!(set.alias_of(varnish), None);
+    }
+
+    #[test]
+    fn malformed_escapes_stay_as_written() {
+        assert_eq!(normalize_name("A#2"), "A#2");
+        assert_eq!(normalize_name("A#zz#41"), "A#zzA");
+        assert_eq!(normalize_name("#E2#82#AC"), "€");
+    }
+}
diff --git a/crates/prepress/src/lib.rs b/crates/prepress/src/lib.rs
new file mode 100644
index 00000000..4100696b
--- /dev/null
+++ b/crates/prepress/src/lib.rs
@@ -0,0 +1,18 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+//! Prepress for the Craft apps: an ink model and ink manager shared by the writers,
+//! plates rendered from a PDF, coverage and a color preview read from the plates, and process
+//! color conversion through craft-cms. See the README.
+
+pub mod cms;
+pub mod composite;
+pub mod coverage;
+#[cfg(feature = "flatten")]
+pub mod flatten;
+pub mod ink;
+pub mod plates;
+
+pub use cms::{CmsConversion, ProfileError};
+pub use coverage::{Above, Coverage, InkStats, MAX_REGIONS, Region, Stats};
+pub use ink::{Alternate, Ink, InkColor, InkId, InkSet, Overprint, Process, Spot, normalize_name, to_pdf_color};
+pub use plates::{Conversion, Error, Fallback, MAX_PLATE_PIXELS, MAX_SPOT_INKS, Options, Plates, plates};
diff --git a/crates/prepress/src/plates.rs b/crates/prepress/src/plates.rs
new file mode 100644
index 00000000..332c8b6b
--- /dev/null
+++ b/crates/prepress/src/plates.rs
@@ -0,0 +1,354 @@
+//! A PDF page separated into plates, one gray film per ink.
+//!
+//! A plate is the page rendered with hayro-interpret's plate mode
+//! (`InterpreterSettings::plate`): every paint draws its tint of one ink as gray, and a paint
+//! that overprints without naming the ink leaves the film as it is (ISO 32000-2 §8.6.7).
+//! Clipping, anti-aliasing, soft masks, transparency groups and blending stay the renderer's
+//! own. `Separation` and `DeviceN` colorants paint their own plates, DeviceCMYK its four
+//! components, DeviceGray black only, and other process color converts to CMYK through the
+//! printing condition (see [`Conversion`]).
+//!
+//! Ported from PdfCraft #2770 by Guillem Hermida (`crates/render/src/separations.rs` at
+//! 6fcf2a4, MIT OR Apache-2.0), with craft-cms in place of moxcms.
+
+use std::collections::HashSet;
+use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::sync::{Arc, Mutex};
+
+use craft_pdf::interpret::InterpreterSettings;
+use craft_pdf::interpret::color::{CmykSimulation, Ink as PdfInk, InkSinkFn, Plate};
+use craft_pdf::raster::{self, MAX_SIDE, RenderCache};
+use craft_pdf::syntax::Pdf;
+use craft_pdf::syntax::object::dict::keys::{DEST_OUTPUT_PROFILE, OUTPUT_CONDITION, OUTPUT_CONDITION_IDENTIFIER, OUTPUT_INTENTS, S};
+use craft_pdf::syntax::object::{Array, Dict, Name, Stream, String as PdfText};
+use craft_pdf::{OpenError, open_slice};
+
+use crate::cms::{CmsConversion, ProfileError, srgb8_to_lab};
+use crate::ink::{Alternate, InkId, InkSet, Spot};
+
+/// Spot inks separated per page, after the four process inks. More than any press runs: a
+/// `DeviceN` space has at most 32 colorants, and every plate costs a render and a byte per
+/// pixel. Further spot inks are listed in [`Plates::unseparated`].
+pub const MAX_SPOT_INKS: usize = 32;
+
+/// Device pixels per plate (4 MP, 2000 × 2000), so a page with many inks stays within a few
+/// hundred megabytes. The resolution is reduced to fit; [`Plates::dpi`] says what was used.
+pub const MAX_PLATE_PIXELS: f32 = 4.0e6;
+
+/// The resolution, in pixels per point, inks are discovered at before the plates render.
+const DISCOVERY_SCALE: f32 = 0.1;
+
+/// Spot ink names recorded while discovering, past which further names are dropped.
+const MAX_LISTED_SPOTS: usize = MAX_SPOT_INKS * 4;
+
+/// Output intents looked at per page: each can cost a profile's decoding and parsing.
+const MAX_OUTPUT_INTENTS: usize = 16;
+
+/// Decoding limit for an output intent's profile.
+const MAX_PROFILE_BYTES: usize = 16 << 20;
+
+/// The longest output condition kept, in characters.
+const MAX_CONDITION: usize = 160;
+
+/// The printing condition process color converts to when the page has no usable output
+/// intent.
+#[derive(Clone, Debug, Default)]
+#[non_exhaustive]
+pub enum Fallback {
+    /// craft-cms's Coated FOGRA39 profile.
+    #[default]
+    Fogra39,
+    /// The caller's CMYK ICC profile.
+    Profile(Arc<[u8]>),
+    /// The ISO 32000-2 §10.4.2.4 device formulas, black generation and undercolor removal the
+    /// identity: neutral RGB goes to black alone, ICCBased CMYK separates as it is.
+    DeviceFormulas,
+}
+
+/// How [`plates`] separates.
+#[derive(Clone, Debug)]
+pub struct Options {
+    /// Honor `OP`, `op` and `OPM` as a separating device does. Without it every paint knocks
+    /// out what is under it.
+    pub overprint: bool,
+    /// The printing condition when the page has no output intent with a usable CMYK profile.
+    pub fallback: Fallback,
+}
+
+impl Default for Options {
+    fn default() -> Self {
+        Self { overprint: true, fallback: Fallback::default() }
+    }
+}
+
+/// How process color that isn't CMYK already became CMYK.
+#[derive(Clone, Debug, PartialEq)]
+#[non_exhaustive]
+pub enum Conversion {
+    /// Through the CMYK profile of the page's or document's output intent (ISO 32000-2
+    /// §14.11.5).
+    OutputIntent {
+        /// The profile's description, else the intent's output condition.
+        profile: String,
+        /// The intent's `/OutputConditionIdentifier`, such as `FOGRA39`.
+        condition: Option<String>,
+    },
+    /// Through [`Fallback::Fogra39`] or [`Fallback::Profile`]; the profile's description.
+    Fallback { profile: String },
+    /// By [`Fallback::DeviceFormulas`].
+    DeviceFormulas,
+}
+
+/// A page separated into plates.
+#[derive(Clone, Debug)]
+pub struct Plates {
+    /// The process inks, then the spot inks the page paints, in the order first painted. Spots
+    /// carry a Lab alternate measured from their sRGB appearance at 100%.
+    pub inks: InkSet,
+    /// Spot inks past [`MAX_SPOT_INKS`]: listed, not separated.
+    pub unseparated: Vec<String>,
+    pub width: u32,
+    pub height: u32,
+    /// The resolution the plates rendered at, after [`MAX_PLATE_PIXELS`].
+    pub dpi: f32,
+    pub conversion: Conversion,
+    /// One plane per ink, in [`InkSet::iter`] order: the tint per pixel, row-major, 0 for no
+    /// ink and 255 for 100%.
+    pub planes: Vec<Vec<u8>>,
+}
+
+impl Plates {
+    /// Ink `id`'s plane.
+    pub fn plane(&self, id: InkId) -> Option<&[u8]> {
+        self.planes.get(id.index()).map(Vec::as_slice)
+    }
+
+    /// Ink `id`'s tint at pixel (`x`, `y`), 0–255.
+    pub fn tint(&self, id: InkId, x: u32, y: u32) -> Option<u8> {
+        self.plane(id)?.get(self.index_of(x, y)?).copied()
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum Error {
+    #[error(transparent)]
+    Open(#[from] OpenError),
+    #[error("page {0} does not exist")]
+    NoPage(usize),
+    #[error("the resolution must be positive and finite")]
+    InvalidDpi,
+    #[error("the fallback profile can't be a printing condition: {0}")]
+    Profile(#[from] ProfileError),
+    /// After a [`raster::Error::BackendPanic`] the document is dropped; nothing else is kept.
+    #[error(transparent)]
+    Render(#[from] raster::Error),
+}
+
+/// Separates page `page` (from 0) of `pdf` at `dpi`, reduced to fit [`MAX_PLATE_PIXELS`] and
+/// the renderer's side limit: one plate per ink, the four process inks and up to
+/// [`MAX_SPOT_INKS`] spot inks the page paints. Spot inks only soft masks use are left out
+/// (masks don't print). Never panics.
+pub fn plates(pdf: &[u8], page: usize, dpi: f32, opts: &Options) -> Result<Plates, Error> {
+    if !dpi.is_finite() || dpi <= 0.0 {
+        return Err(Error::InvalidDpi);
+    }
+    let doc = open_slice(pdf, None)?;
+    let (simulation, conversion) = match catch_unwind(AssertUnwindSafe(|| output_intent(&doc, page))) {
+        Ok(Some(found)) => (Some(found.0), found.1),
+        Ok(None) | Err(_) => fallback(&opts.fallback)?,
+    };
+    let pages = doc.pages();
+    let p = pages.get(page).ok_or(Error::NoPage(page))?;
+    let (w, h) = p.render_dimensions();
+    let scale = plate_scale(w, h, dpi / 72.0);
+    let cache = RenderCache::new();
+
+    let log = Arc::new(Mutex::new(SpotLog::default()));
+    let discover = InterpreterSettings { ink_sink: Some(spot_sink(&log)), ..Default::default() };
+    render(p, &cache, &discover, DISCOVERY_SCALE.min(scale))?;
+    let spots = std::mem::take(&mut log.lock().unwrap_or_else(|poisoned| poisoned.into_inner()).order);
+
+    let mut inks = InkSet::new();
+    let mut separated: Vec<PdfInk> = PdfInk::PROCESS.to_vec();
+    let mut unseparated = Vec::new();
+    for (ink, swatch) in spots {
+        if separated.len() >= 4 + MAX_SPOT_INKS {
+            unseparated.push(ink.name().to_string());
+            continue;
+        }
+        let alternate = Alternate::Lab(srgb8_to_lab(swatch).unwrap_or([0.0; 3]));
+        let spot = Spot { name: ink.name().to_string(), alternate, solidity: None };
+        // hayro hands over names with their `#xx` escapes decoded, so `#` here is a literal
+        // character. Two names that read the same after lossy UTF-8 decoding share one plate.
+        match inks.add_decoded(spot) {
+            Some(id) if id.index() == separated.len() => separated.push(ink),
+            _ => unseparated.push(ink.name().to_string()),
+        }
+    }
+
+    let mut size = None;
+    let mut planes = Vec::with_capacity(separated.len());
+    for ink in separated {
+        let plate = Plate { ink, overprint: opts.overprint, simulation: simulation.clone(), spots_as_process: false };
+        let settings = InterpreterSettings { plate: Some(plate), ..Default::default() };
+        let film = render(p, &cache, &settings, scale)?;
+        size = Some((film.width, film.height));
+        // The film is gray on white: its red channel is the paper left uncovered.
+        planes.push(film.bytes().as_chunks::<4>().0.iter().map(|[red, ..]| 255 - red).collect());
+    }
+    let (width, height) = size.unwrap_or((0, 0));
+    Ok(Plates { inks, unseparated, width, height, dpi: scale * 72.0, conversion, planes })
+}
+
+fn render<'a>(
+    page: &'a craft_pdf::syntax::page::Page<'a>,
+    cache: &RenderCache<'a>,
+    settings: &InterpreterSettings,
+    scale: f32,
+) -> Result<raster::Raster, Error> {
+    // The plate's gray film must keep its tints: no color replacement.
+    let options = raster::Options { scale: [scale, scale], background: [255; 4], color_replacement: None, ..Default::default() };
+    Ok(raster::render(page, cache, settings, &options)?)
+}
+
+/// The scale a `w` × `h` pt page separates at: `scale`, within [`MAX_PLATE_PIXELS`] and
+/// [`MAX_SIDE`].
+fn plate_scale(w: f32, h: f32, scale: f32) -> f32 {
+    let (w, h) = (w.max(1.0), h.max(1.0));
+    let by_area = (MAX_PLATE_PIXELS / (w * h)).sqrt();
+    let by_side = MAX_SIDE as f32 / w.max(h);
+    let s = scale.min(by_area).min(by_side);
+    if s.is_finite() && s > 0.0 { s } else { f32::MIN_POSITIVE }
+}
+
+pub(crate) fn fallback(fallback: &Fallback) -> Result<(Option<CmykSimulation>, Conversion), Error> {
+    let (conversion, icc): (CmsConversion, &[u8]) = match fallback {
+        Fallback::DeviceFormulas => return Ok((None, Conversion::DeviceFormulas)),
+        Fallback::Fogra39 => (CmsConversion::fogra39(), craft_cms::builtin::COATED_FOGRA39_ICC),
+        Fallback::Profile(icc) => (CmsConversion::new(icc)?, icc),
+    };
+    let simulation = conversion.simulation(icc);
+    let profile = simulation.description().unwrap_or("unnamed CMYK profile").to_string();
+    Ok((Some(simulation), Conversion::Fallback { profile }))
+}
+
+/// Spot inks reported while a page renders, in the order first painted, each with its sRGB
+/// appearance at 100%.
+#[derive(Default)]
+struct SpotLog {
+    order: Vec<(PdfInk, [u8; 3])>,
+    seen: HashSet<PdfInk>,
+}
+
+fn spot_sink(log: &Arc<Mutex<SpotLog>>) -> InkSinkFn {
+    let log = log.clone();
+    Arc::new(move |ink: &PdfInk, appearance: &dyn Fn(f32) -> [u8; 3]| {
+        let mut log = log.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
+        if log.seen.contains(ink) || log.order.len() >= MAX_LISTED_SPOTS {
+            return;
+        }
+        log.seen.insert(ink.clone());
+        log.order.push((ink.clone(), appearance(1.0)));
+    })
+}
+
+/// A text string entry of `dict`, without control characters and at most [`MAX_CONDITION`]
+/// characters long; `None` when missing or blank.
+fn text_entry(dict: &Dict<'_>, key: &[u8]) -> Option<String> {
+    let s = dict.get::<PdfText<'_>>(key)?;
+    let text: String = pdf_text(s.as_bytes()).chars().filter(|c| !c.is_control()).take(MAX_CONDITION).collect();
+    let text = text.trim();
+    (!text.is_empty()).then(|| text.to_string())
+}
+
+/// A PDF text string (ISO 32000-2 §7.9.2.2): UTF-16BE or UTF-8 after its byte order mark, else
+/// PDFDocEncoding, read here as Latin-1 (they differ only in rarely used punctuation).
+pub(crate) fn pdf_text(bytes: &[u8]) -> String {
+    if let Some(utf16) = bytes.strip_prefix(&[0xFE, 0xFF]) {
+        let units: Vec<u16> = utf16.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes(*c)).collect();
+        return String::from_utf16_lossy(&units);
+    }
+    if let Some(utf8) = bytes.strip_prefix(&[0xEF, 0xBB, 0xBF]) {
+        return String::from_utf8_lossy(utf8).into_owned();
+    }
+    bytes.iter().map(|b| char::from(*b)).collect()
+}
+
+/// The printing condition of page `page` (ISO 32000-2 §14.11.5): of the page's own
+/// `/OutputIntents` (PDF 2.0), else the catalog's, the first whose `/DestOutputProfile` is a
+/// CMYK profile craft-cms converts into, a `GTS_PDFX` intent before the others.
+pub(crate) fn output_intent(pdf: &Pdf, page: usize) -> Option<(CmykSimulation, Conversion)> {
+    output_intents(pdf, page).iter().find_map(|intent| {
+        let icc = intent.get::<Stream<'_>>(DEST_OUTPUT_PROFILE)?.decoded_within(MAX_PROFILE_BYTES).ok()?;
+        let simulation = CmsConversion::new(&icc).ok()?.simulation(&icc);
+        let condition = text_entry(intent, OUTPUT_CONDITION_IDENTIFIER);
+        let profile = simulation
+            .description()
+            .map(str::to_string)
+            .or_else(|| text_entry(intent, OUTPUT_CONDITION))
+            .or_else(|| condition.clone())
+            .unwrap_or_else(|| "unnamed CMYK profile".to_string());
+        Some((simulation, Conversion::OutputIntent { profile, condition }))
+    })
+}
+
+/// The output intent [`output_intent`] picks, as written in the PDF.
+#[cfg(feature = "flatten")]
+pub(crate) struct IntentProfile {
+    pub icc: Vec<u8>,
+    pub identifier: Option<String>,
+    pub condition: Option<String>,
+    pub registry_name: Option<String>,
+    pub info: Option<String>,
+}
+
+/// The output intent [`output_intent`] picks: its profile bytes and entries, to write the same
+/// intent again.
+#[cfg(feature = "flatten")]
+pub(crate) fn output_intent_profile(pdf: &Pdf, page: usize) -> Option<IntentProfile> {
+    output_intents(pdf, page).iter().find_map(|intent| {
+        let icc = intent.get::<Stream<'_>>(DEST_OUTPUT_PROFILE)?.decoded_within(MAX_PROFILE_BYTES).ok()?;
+        if *icc != *craft_cms::builtin::COATED_FOGRA39_ICC && CmsConversion::new(&icc).is_err() {
+            return None;
+        }
+        Some(IntentProfile {
+            icc: icc.into_owned(),
+            identifier: text_entry(intent, OUTPUT_CONDITION_IDENTIFIER),
+            condition: text_entry(intent, OUTPUT_CONDITION),
+            registry_name: text_entry(intent, b"RegistryName"),
+            info: text_entry(intent, b"Info"),
+        })
+    })
+}
+
+/// The page's own `/OutputIntents` (PDF 2.0), else the catalog's, a `GTS_PDFX` intent first.
+fn output_intents(pdf: &Pdf, page: usize) -> Vec<Dict<'_>> {
+    fn list<'a>(intents: Option<Array<'a>>) -> Vec<Dict<'a>> {
+        intents.iter().flat_map(|a| a.iter::<Dict<'a>>()).take(MAX_OUTPUT_INTENTS).collect()
+    }
+    let xref = pdf.xref();
+    let mut listed = list(pdf.pages().get(page).and_then(|p| p.raw().get::<Array<'_>>(OUTPUT_INTENTS)));
+    if listed.is_empty() {
+        listed = list(xref.get::<Dict<'_>>(xref.root_id()).and_then(|catalog| catalog.get::<Array<'_>>(OUTPUT_INTENTS)));
+    }
+    // A stable sort: the PDF/X intent first, the others in their order.
+    listed.sort_by_key(|d| d.get::<Name<'_>>(S).is_none_or(|s| s.as_ref() != b"GTS_PDFX"));
+    listed
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn plates_fit_the_pixel_and_side_caps() {
+        assert_eq!(plate_scale(40.0, 40.0, 1.0), 1.0);
+        // A4 at 2400 dpi would be 22 000 × 31 000 pixels.
+        let s = plate_scale(595.0, 842.0, 2400.0 / 72.0);
+        assert!((595.0 * s) * (842.0 * s) <= MAX_PLATE_PIXELS * 1.0001);
+        // A 1 × 10 000 pt strip fits the area cap but not the renderer's side limit.
+        assert!(10_000.0 * plate_scale(1.0, 10_000.0, 1.0) <= MAX_SIDE as f32);
+        assert!(plate_scale(0.0, f32::NAN, 1.0) > 0.0);
+    }
+}
diff --git a/crates/prepress/tests/fixtures/cyan-cmyk.jpg b/crates/prepress/tests/fixtures/cyan-cmyk.jpg
new file mode 100644
index 00000000..4cd81d13
Binary files /dev/null and b/crates/prepress/tests/fixtures/cyan-cmyk.jpg differ
diff --git a/crates/prepress/tests/fixtures/gray-25.jpg b/crates/prepress/tests/fixtures/gray-25.jpg
new file mode 100644
index 00000000..21fcda8f
Binary files /dev/null and b/crates/prepress/tests/fixtures/gray-25.jpg differ
diff --git a/crates/prepress/tests/flatten_document.rs b/crates/prepress/tests/flatten_document.rs
new file mode 100644
index 00000000..165a80e9
--- /dev/null
+++ b/crates/prepress/tests/flatten_document.rs
@@ -0,0 +1,379 @@
+//! Whole documents flattened: pages, boxes, metadata, output intent and shared fonts carry over,
+//! and each page's plates match the source.
+//!
+//! The text cases need Inter from `CRAFT_PDF_TEST_FONT_DIR` or `~/.cache/craft-pdf-test-fonts`,
+//! and are skipped when it is missing.
+#![cfg(feature = "flatten")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::path::PathBuf;
+use std::time::Instant;
+
+use craft_pdf::syntax::object::dict::keys::{BLEED_BOX, DEST_OUTPUT_PROFILE, OUTPUT_CONDITION_IDENTIFIER, OUTPUT_INTENTS, TRIM_BOX};
+use craft_pdf::syntax::object::{Array, Dict, Rect as PdfRect, Stream, String as PdfString};
+use craft_pdf::write::backend;
+use craft_pdf::write::backend::color::cmyk;
+use craft_pdf::write::backend::color::device_n::{self, Colorant, DeviceNSpace, Process};
+use craft_pdf::write::backend::configure::PdfVersion;
+use craft_pdf::write::backend::geom::{PathBuilder, Point, Rect as KRect};
+use craft_pdf::write::backend::metadata::DateTime;
+use craft_pdf::write::backend::num::NormalizedF32;
+use craft_pdf::write::backend::page::PageSettings;
+use craft_pdf::write::backend::paint::Fill;
+use craft_pdf::write::backend::surface::Surface;
+use craft_pdf::write::backend::text::{Font, GlyphId, KrillaGlyph};
+use craft_pdf::write::backend::{GroupColorSpace, SerializeSettings};
+use craft_pdf::write::print::{self, PrintColor};
+use craft_pdf::write::{Metadata, Writer};
+use craft_plate_test::reference;
+use craft_plate_test::structure;
+use craft_prepress::flatten::{
+    FlattenDocumentOptions, FlattenOptions, FlattenPageOptions, flatten_document, flatten_document_with_progress, flatten_page,
+};
+use craft_prepress::{Options, Plates, plates};
+
+const DPI: f32 = 36.0;
+const SIZES: [(f32, f32); 3] = [(200.0, 160.0), (150.0, 200.0), (220.0, 120.0)];
+
+fn inter() -> Option<Vec<u8>> {
+    let dir = std::env::var_os(reference::FONT_DIR_ENV)
+        .map(PathBuf::from)
+        .or_else(|| std::env::var_os("HOME").map(|h| PathBuf::from(h).join(".cache/craft-pdf-test-fonts")))?;
+    let font = std::fs::read(dir.join(reference::FONT_FILE)).ok();
+    if font.is_none() {
+        eprintln!("skipped: no {} in {}", reference::FONT_FILE, dir.display());
+    }
+    font
+}
+
+fn fill(c: u8, m: u8, y: u8, k: u8) -> Fill {
+    Fill { paint: cmyk::Color::new(c, m, y, k).into(), ..Default::default() }
+}
+
+fn rect(s: &mut Surface<'_>, x0: f32, y0: f32, x1: f32, y1: f32, f: Fill) {
+    let mut b = PathBuilder::new();
+    b.push_rect(tiny_rect(x0, y0, x1, y1));
+    s.set_fill(Some(f));
+    s.draw_path(&b.finish().unwrap());
+}
+
+fn tiny_rect(x0: f32, y0: f32, x1: f32, y1: f32) -> craft_pdf::write::backend::geom::Rect {
+    KRect::from_ltrb(x0, y0, x1, y1).unwrap()
+}
+
+fn text(s: &mut Surface<'_>, font: &Font, face: &ttf_parser::Face<'_>, at: (f32, f32), size: f32, string: &str) {
+    let upem = f32::from(face.units_per_em());
+    let glyphs: Vec<KrillaGlyph> = string
+        .char_indices()
+        .map(|(i, c)| {
+            let id = face.glyph_index(c).unwrap();
+            let advance = f32::from(face.glyph_hor_advance(id).unwrap()) / upem;
+            KrillaGlyph::new(GlyphId::new(u32::from(id.0)), advance, 0.0, 0.0, 0.0, i..i + c.len_utf8(), None)
+        })
+        .collect();
+    s.set_fill(Some(fill(0, 0, 0, 255)));
+    s.draw_glyphs(Point::from_xy(at.0, at.1), &glyphs, font.clone(), string, size, false);
+}
+
+/// Three pages of different sizes: transparency beside text, no transparency, and transparency
+/// over text in page 1's font. Page 1 has a TrimBox and a BleedBox.
+fn three_pages(font_bytes: &[u8]) -> Vec<u8> {
+    let face = ttf_parser::Face::parse(font_bytes, 0).unwrap();
+    let font = craft_pdf::write::font(font_bytes, 0, None).unwrap();
+    let metadata = Metadata {
+        title: Some("Flatten test".into()),
+        authors: vec!["A. Writer".into()],
+        created: Some(DateTime::new(2026).month(10).day(20).hour(9).minute(30).second(0).utc_offset_hour(2)),
+        modified: Some(DateTime::new(2026).month(10).day(21).hour(16).minute(5).second(0).utc_offset_hour(2)),
+        ..Metadata::default()
+    };
+    // DeviceCMYK blending and no output intent: parsing a profile takes half a second in a debug build.
+    let settings = SerializeSettings { no_device_cs: false, group_color_space: GroupColorSpace::Cmyk, ..SerializeSettings::default() };
+    let mut writer = Writer::new(settings, metadata);
+    let mut page = |settings: PageSettings, draw: &dyn Fn(&mut Surface<'_>)| {
+        let mut page = writer.document_mut().start_page_with(settings);
+        let mut s = page.surface();
+        draw(&mut s);
+        s.finish();
+        page.finish();
+    };
+    let size = |i: usize| PageSettings::from_wh(SIZES[i].0, SIZES[i].1).unwrap();
+    page(size(0).with_trim_box(Some(tiny_rect(10.0, 10.0, 190.0, 150.0))).with_bleed_box(Some(tiny_rect(5.0, 5.0, 195.0, 155.0))), &|s| {
+        rect(s, 20.0, 20.0, 120.0, 100.0, fill(255, 0, 0, 0));
+        s.push_opacity(NormalizedF32::new(0.5).unwrap());
+        rect(s, 70.0, 60.0, 170.0, 130.0, fill(0, 255, 0, 0));
+        s.pop();
+        text(s, &font, &face, (10.0, 150.0), 10.0, "Hello");
+    });
+    page(size(1), &|s| {
+        rect(s, 10.0, 10.0, 140.0, 90.0, fill(0, 0, 255, 0));
+        text(s, &font, &face, (10.0, 150.0), 14.0, "Opaque");
+    });
+    page(size(2), &|s| {
+        text(s, &font, &face, (20.0, 60.0), 30.0, "Hello");
+        s.push_opacity(NormalizedF32::new(0.4).unwrap());
+        rect(s, 40.0, 25.0, 120.0, 80.0, fill(255, 0, 0, 0));
+        s.pop();
+        text(s, &font, &face, (20.0, 110.0), 12.0, "World");
+    });
+    drop(page);
+    writer.finish().unwrap()
+}
+
+fn opts() -> FlattenDocumentOptions {
+    FlattenDocumentOptions { flatten: FlattenOptions { raster_dpi: 72.0, ..FlattenOptions::default() }, ..FlattenDocumentOptions::default() }
+}
+
+fn separate(pdf: &[u8], page: usize) -> Plates {
+    plates(pdf, page, DPI, &Options::default()).unwrap()
+}
+
+fn tint(p: &Plates, name: &str, x: f32, y: f32) -> u8 {
+    let s = p.dpi / 72.0;
+    p.inks.lookup(name).and_then(|id| p.tint(id, (x * s) as u32, (y * s) as u32)).unwrap_or(0)
+}
+
+/// No transparency groups, soft masks in graphics states, blend modes or constant alpha.
+fn assert_opaque(pdf: &[u8]) {
+    let s = structure::summarize(pdf).unwrap();
+    assert!(s.groups.iter().all(|g| g.s != "Transparency"), "transparency groups: {:?}", s.groups);
+    for gs in &s.ext_g_states {
+        assert!(gs.smask.as_deref().is_none_or(|m| m == "None" || m.is_empty()), "soft mask: {gs:?}");
+        assert!(gs.bm.as_deref().is_none_or(|b| b == "Normal" || b == "Compatible"), "blend mode: {gs:?}");
+        assert!(gs.alpha_fill.is_none_or(|a| a >= 1.0) && gs.alpha_stroke.is_none_or(|a| a >= 1.0), "alpha: {gs:?}");
+    }
+}
+
+fn has_text(pdf: &craft_pdf::syntax::Pdf, page: usize) -> bool {
+    let pages = pdf.pages();
+    let mut ops = pages.get(page).unwrap().operations();
+    let mut found = false;
+    while let Some(op) = ops.next() {
+        found |= matches!(&**op.operator, b"Tj" | b"TJ");
+    }
+    found
+}
+
+fn count(haystack: &[u8], needle: &[u8]) -> usize {
+    haystack.windows(needle.len()).filter(|w| *w == needle).count()
+}
+
+fn page_box(pdf: &craft_pdf::syntax::Pdf, page: usize, key: &[u8]) -> Option<[f64; 4]> {
+    pdf.pages().get(page)?.raw().get::<PdfRect>(key).map(|r| [r.x0, r.y0, r.x1, r.y1])
+}
+
+#[test]
+fn a_document_flattens_page_by_page_and_keeps_boxes_metadata_and_shared_fonts() {
+    let Some(font) = inter() else { return };
+    let source = three_pages(&font);
+    let start = Instant::now();
+    let (out, report) = flatten_document(&source, &opts()).unwrap();
+    eprintln!("flatten_document: {:?}, totals {:?}", start.elapsed(), report.totals);
+
+    let doc = craft_pdf::open_slice(&out, None).unwrap();
+    let src = craft_pdf::open_slice(&source, None).unwrap();
+    assert_eq!(doc.pages().len(), 3);
+    for (i, (w, h)) in SIZES.iter().enumerate() {
+        assert_eq!(doc.pages()[i].render_dimensions(), (*w, *h), "page {i}");
+    }
+    assert_eq!(report.pages.iter().map(|(p, _)| *p).collect::<Vec<_>>(), [0, 1, 2]);
+    assert!(report.pages[0].1.flatten.flattened > 0 && report.pages[2].1.flatten.flattened > 0);
+    assert_eq!(report.pages[1].1.flatten.flattened, 0);
+    assert!(report.unflattened.is_empty() && report.other_intents.is_empty());
+
+    assert_opaque(&out);
+    for page in 0..3 {
+        assert!(has_text(&doc, page), "page {page} has live text");
+    }
+
+    // One embedded program for the font all three pages use.
+    assert_eq!(count(&source, b"/FontFile2"), 1);
+    assert_eq!(count(&out, b"/FontFile2"), 1, "the shared font is embedded once");
+
+    for key in [TRIM_BOX, BLEED_BOX] {
+        assert_eq!(page_box(&doc, 0, key), page_box(&src, 0, key));
+        assert!(page_box(&doc, 0, key).is_some());
+        assert_eq!(page_box(&doc, 1, key), None);
+    }
+
+    let info = doc.metadata();
+    assert_eq!(info.title.as_deref(), Some(b"Flatten test".as_slice()));
+    assert_eq!(info.author.as_deref(), Some(b"A. Writer".as_slice()));
+    let created = info.creation_date.unwrap();
+    assert_eq!((created.year, created.month, created.day, created.hour, created.minute), (2026, 10, 20, 9, 30));
+    let modified = info.modification_date.unwrap();
+    assert_eq!((modified.year, modified.month, modified.day, modified.hour, modified.minute), (2026, 10, 21, 16, 5));
+
+    let points: [&[(f32, f32)]; 3] = [
+        &[(40.0, 40.0), (100.0, 80.0), (150.0, 120.0), (190.0, 15.0)],
+        &[(50.0, 50.0), (100.0, 180.0)],
+        &[(110.0, 30.0), (115.0, 75.0), (180.0, 50.0)],
+    ];
+    for (page, points) in points.iter().enumerate() {
+        let (a, b) = (separate(&source, page), separate(&out, page));
+        for &(x, y) in *points {
+            for ink in ["Cyan", "Magenta", "Yellow", "Black"] {
+                let (want, got) = (tint(&a, ink, x, y), tint(&b, ink, x, y));
+                assert!(want.abs_diff(got) <= 3, "page {page} {ink} at ({x}, {y}): {got}, the source has {want}");
+            }
+        }
+    }
+
+    let single: usize = (0..3)
+        .map(|p| {
+            let opts = FlattenPageOptions { flatten: opts().flatten, ..FlattenPageOptions::default() };
+            flatten_page(&source, p, &opts).unwrap().0.len()
+        })
+        .sum();
+    eprintln!("source {} bytes; flattened document {} bytes; three flatten_page outputs {single} bytes", source.len(), out.len());
+}
+
+#[test]
+fn a_page_range_flattens_only_those_pages() {
+    let Some(font) = inter() else { return };
+    let t = Instant::now();
+    let source = three_pages(&font);
+    eprintln!("three_pages {:?}", t.elapsed());
+    let mut calls = Vec::new();
+    let opts = FlattenDocumentOptions { pages: Some(1..3), ..opts() };
+    let t = Instant::now();
+    let (out, report) = flatten_document_with_progress(&source, &opts, &mut |done, total| calls.push((done, total))).unwrap();
+    eprintln!("flatten {:?}", t.elapsed());
+    let doc = craft_pdf::open_slice(&out, None).unwrap();
+    assert_eq!(doc.pages().len(), 2);
+    assert_eq!(doc.pages()[0].render_dimensions(), SIZES[1]);
+    assert_eq!(doc.pages()[1].render_dimensions(), SIZES[2]);
+    assert_eq!(report.pages.iter().map(|(p, _)| *p).collect::<Vec<_>>(), [1, 2]);
+    assert_eq!(calls, [(1, 2), (2, 2)]);
+
+    let opts = FlattenDocumentOptions { pages: Some(2..4), ..FlattenDocumentOptions::default() };
+    assert!(flatten_document(&source, &opts).is_err());
+}
+
+#[test]
+fn the_source_output_intent_is_written_once() {
+    let color = PrintColor {
+        profile: craft_cms::builtin::COATED_CMYK_ICC,
+        condition_identifier: "Test coated",
+        condition: Some("A coated test condition"),
+        registry_name: None,
+        info: Some("A coated test condition"),
+    };
+    let mut writer = Writer::new(print::settings(color).unwrap(), Metadata::default());
+    for _ in 0..2 {
+        let mut page = writer.document_mut().start_page_with(PageSettings::from_wh(100.0, 100.0).unwrap());
+        let mut s = page.surface();
+        rect(&mut s, 10.0, 10.0, 60.0, 60.0, fill(255, 0, 0, 0));
+        s.push_opacity(NormalizedF32::new(0.5).unwrap());
+        rect(&mut s, 30.0, 30.0, 90.0, 90.0, fill(0, 0, 0, 255));
+        s.pop();
+        s.finish();
+        page.finish();
+    }
+    let source = writer.finish().unwrap();
+    let (out, report) = flatten_document(&source, &opts()).unwrap();
+    assert!(report.other_intents.is_empty());
+    assert_opaque(&out);
+
+    let doc = craft_pdf::open_slice(&out, None).unwrap();
+    let xref = doc.xref();
+    let catalog = xref.get::<Dict<'_>>(xref.root_id()).unwrap();
+    let intents: Vec<Dict<'_>> = catalog.get::<Array<'_>>(OUTPUT_INTENTS).unwrap().iter::<Dict<'_>>().collect();
+    assert_eq!(intents.len(), 1);
+    let id = intents[0].get::<PdfString<'_>>(OUTPUT_CONDITION_IDENTIFIER).unwrap();
+    assert_eq!(id.as_bytes(), b"Test coated");
+    let icc = intents[0].get::<Stream<'_>>(DEST_OUTPUT_PROFILE).unwrap().decoded().unwrap();
+    assert_eq!(&*icc, craft_cms::builtin::COATED_CMYK_ICC);
+    assert_eq!(count(&out, b"/DestOutputProfile"), 1);
+}
+
+/// PDF/X-1a output: the source's DeviceN fill (cyan and a spot, NChannel at 1.7) is written at
+/// 1.4 without the 1.6 NChannel attributes, and the PDF/X version goes to Info and XMP.
+#[test]
+fn pdf_x1a_output_is_pdf_14_without_nchannel() {
+    let gold = cmyk::Color::new(0, 51, 255, 26);
+    let space = DeviceNSpace::new(vec![Colorant::Process(Process::Cyan), Colorant::Spot { name: "Gold".to_owned(), alternate: gold }]).unwrap();
+    let color = device_n::Color::new(vec![255, 128], space).unwrap();
+    let mut writer = Writer::new(print::settings(PrintColor::fogra39(craft_cms::builtin::COATED_FOGRA39_ICC)).unwrap(), Metadata::default());
+    let mut page = writer.document_mut().start_page_with(PageSettings::from_wh(100.0, 100.0).unwrap());
+    let mut s = page.surface();
+    rect(&mut s, 10.0, 10.0, 60.0, 60.0, Fill { paint: backend::color::Color::from(color).into(), ..Default::default() });
+    s.push_opacity(NormalizedF32::new(0.5).unwrap());
+    rect(&mut s, 30.0, 30.0, 90.0, 90.0, fill(0, 0, 0, 255));
+    s.pop();
+    s.finish();
+    page.finish();
+    let source = writer.finish().unwrap();
+    assert!(count(&source, b"/NChannel") > 0);
+
+    let opts = FlattenDocumentOptions {
+        version: PdfVersion::Pdf14,
+        pdfx_version: Some("PDF/X-1:2003".to_owned()),
+        pdfx_conformance: Some("PDF/X-1a:2003".to_owned()),
+        ..opts()
+    };
+    let (out, _) = flatten_document(&source, &opts).unwrap();
+    assert_opaque(&out);
+    assert!(out.starts_with(b"%PDF-1.4"));
+    assert_eq!(count(&out, b"NChannel"), 0);
+    assert_eq!(count(&out, b"/GTS_PDFXVersion(PDF/X-1:2003)"), 1);
+    assert_eq!(count(&out, b"/GTS_PDFXConformance(PDF/X-1a:2003)"), 1);
+    assert_eq!(count(&out, b"<pdfxid:GTS_PDFXVersion>PDF/X-1:2003</pdfxid:GTS_PDFXVersion>"), 1);
+    assert_eq!(count(&out, b"<pdf:PDFVersion>1.4</pdf:PDFVersion>"), 1);
+    let gold_plate = separate(&out, 0);
+    assert!(tint(&gold_plate, "Gold", 20.0, 20.0) > 100);
+}
+
+/// A 16 × 16 Adobe CMYK JPEG of C 100%, and a 16 × 16 gray JPEG of 25% gray (ImageMagick).
+const CYAN_JPEG: &[u8] = include_bytes!("fixtures/cyan-cmyk.jpg");
+const GRAY_JPEG: &[u8] = include_bytes!("fixtures/gray-25.jpg");
+
+#[test]
+fn untouched_jpeg_images_are_written_as_they_are() {
+    let image = |cs: &str, decode: &str, data: &[u8]| {
+        let mut obj = format!(
+            "<< /Type /XObject /Subtype /Image /Width 16 /Height 16 /ColorSpace /{cs} {decode} /BitsPerComponent 8 \
+             /Filter /DCTDecode /Length {} >> stream\n",
+            data.len()
+        )
+        .into_bytes();
+        obj.extend_from_slice(data);
+        obj.extend_from_slice(b"\nendstream");
+        obj
+    };
+    // The images, and a half-transparent black square away from them.
+    let content = "q 50 0 0 50 10 10 cm /Im1 Do Q q 50 0 0 50 70 10 cm /Im2 Do Q \
+        q /GS1 gs 0 0 0 1 k 140 10 50 50 re f Q";
+    let objects =
+        [image("DeviceCMYK", "/Decode [1 0 1 0 1 0 1 0]", CYAN_JPEG), image("DeviceGray", "", GRAY_JPEG), b"<< /Type /ExtGState /ca 0.5 >>".to_vec()];
+    let mut pdf = b"%PDF-1.7\n".to_vec();
+    pdf.extend_from_slice(b"1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n");
+    pdf.extend_from_slice(b"2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n");
+    pdf.extend_from_slice(
+        b"3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 70] /Contents 4 0 R \
+          /Resources << /XObject << /Im1 5 0 R /Im2 6 0 R >> /ExtGState << /GS1 7 0 R >> >> >> endobj\n",
+    );
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n", content.len()).as_bytes());
+    for (i, body) in objects.iter().enumerate() {
+        pdf.extend_from_slice(format!("{} 0 obj ", i + 5).as_bytes());
+        pdf.extend_from_slice(body);
+        pdf.extend_from_slice(b" endobj\n");
+    }
+    pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF");
+
+    let (out, report) = flatten_document(&pdf, &opts()).unwrap();
+    assert_eq!(report.totals.images, 2);
+    assert!(report.totals.flattened > 0);
+    assert_opaque(&out);
+    assert_eq!(count(&out, CYAN_JPEG), 1, "the CMYK JPEG is written as it is");
+    assert_eq!(count(&out, GRAY_JPEG), 1, "the gray JPEG is written as it is");
+    assert_eq!(count(&out, b"/DCTDecode"), 2);
+    let (a, b) = (separate(&pdf, 0), separate(&out, 0));
+    for (x, y) in [(35.0, 35.0), (95.0, 35.0), (165.0, 35.0)] {
+        for ink in ["Cyan", "Magenta", "Yellow", "Black"] {
+            let (want, got) = (tint(&a, ink, x, y), tint(&b, ink, x, y));
+            assert!(want.abs_diff(got) <= 3, "{ink} at ({x}, {y}): {got}, the source has {want}");
+        }
+    }
+    assert!(tint(&b, "Cyan", 35.0, 35.0) > 240 && tint(&b, "Black", 95.0, 35.0) > 150);
+}
diff --git a/crates/prepress/tests/flatten_pdf.rs b/crates/prepress/tests/flatten_pdf.rs
new file mode 100644
index 00000000..0f8dfc45
--- /dev/null
+++ b/crates/prepress/tests/flatten_pdf.rs
@@ -0,0 +1,613 @@
+//! The PDF-in adapter on plate-test scenes and hand-written pages: display list structure, ink
+//! colors, overprint and group attributes, and plates of opaque items written back.
+#![cfg(feature = "flatten")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use craft_pdf::write::backend::blend::Overprint as KOverprint;
+use craft_pdf::write::backend::geom::PathBuilder;
+use craft_pdf::write::backend::page::PageSettings;
+use craft_pdf::write::backend::paint::{Fill, FillRule as KFillRule};
+use craft_pdf::write::{Metadata, Writer};
+use craft_plate_test::reference::{self, Context};
+use craft_plate_test::scene;
+use craft_prepress::flatten::kurbo::{BezPath, PathEl, Point, Shape};
+use craft_prepress::flatten::pdf::{ReadOptions, ReadReport, read_page};
+use craft_prepress::flatten::{
+    BlendMode, DisplayList, FillItem, FillRule, GradientGeometry, GroupItem, ImageItem, ImageSpace, Item, MaskKind, Paint,
+};
+use craft_prepress::{CmsConversion, InkColor, InkId, Options, Overprint, Process, plates, to_pdf_color};
+
+fn scene_pdf(id: &str) -> Vec<u8> {
+    let scenes = scene::load_dir(&scene::scenes_dir()).unwrap();
+    let s = scenes.iter().find(|s| s.id == id).unwrap();
+    reference::write(s, &Context { scenes: &scenes, font: None }).unwrap().pdf
+}
+
+fn read(pdf: &[u8]) -> (DisplayList, ReadReport) {
+    read_page(pdf, 0, &ReadOptions::default()).unwrap()
+}
+
+/// Every non-group item with the groups it is in, outermost first.
+fn leaves(items: &[Item]) -> Vec<(Vec<&GroupItem>, &Item)> {
+    fn walk<'a>(items: &'a [Item], path: &mut Vec<&'a GroupItem>, out: &mut Vec<(Vec<&'a GroupItem>, &'a Item)>) {
+        for item in items {
+            match item {
+                Item::Group(g) => {
+                    path.push(g);
+                    walk(&g.children, path, out);
+                    path.pop();
+                }
+                other => out.push((path.clone(), other)),
+            }
+        }
+    }
+    let mut out = Vec::new();
+    walk(items, &mut Vec::new(), &mut out);
+    out
+}
+
+fn fill_items(list: &DisplayList) -> Vec<(Vec<&GroupItem>, &FillItem)> {
+    leaves(&list.items)
+        .into_iter()
+        .filter_map(|(groups, item)| match item {
+            Item::Fill(f) => Some((groups, f)),
+            _ => None,
+        })
+        .collect()
+}
+
+fn ink(p: Process) -> InkId {
+    InkId::process(p)
+}
+
+fn cmyk_color(c: f32, m: f32, y: f32, k: f32) -> InkColor {
+    InkColor::Tints(vec![(ink(Process::Cyan), c), (ink(Process::Magenta), m), (ink(Process::Yellow), y), (ink(Process::Black), k)])
+}
+
+fn cmyk(c: f32, m: f32, y: f32, k: f32) -> Paint {
+    Paint::Solid(cmyk_color(c, m, y, k))
+}
+
+fn op(fill: bool, nonzero: bool) -> Overprint {
+    Overprint { fill, stroke: fill, nonzero }
+}
+
+#[test]
+fn black_overprints_cyan() {
+    let (list, report) = read(&scene_pdf("S01"));
+    let fills = fill_items(&list);
+    assert_eq!(fills.len(), 2, "two rects (text is skipped without a font): {fills:?}");
+    assert_eq!(fills[0].1.paint, cmyk(1.0, 0.0, 0.0, 0.0));
+    assert_eq!(fills[0].1.overprint, op(false, false));
+    assert_eq!(fills[1].1.paint, cmyk(0.0, 0.0, 0.0, 1.0));
+    assert_eq!(fills[1].1.overprint, op(true, true));
+    assert_eq!(fills[1].1.path.bounding_box().size().width.round(), 100.0);
+    assert_eq!((report.images, report.gradients), (0, 0));
+}
+
+#[test]
+fn spot_inks_join_the_set() {
+    let (list, _) = read(&scene_pdf("S04"));
+    let gold = list.inks.lookup("Gold").unwrap();
+    let fills = fill_items(&list);
+    let Paint::Solid(InkColor::Tints(tints)) = &fills[1].1.paint else { panic!() };
+    assert!(matches!(tints[..], [(id, t)] if id == gold && (t - 0.5).abs() < 0.01), "{tints:?}");
+    assert!(fills[1].1.overprint.fill);
+    let alternate = list.inks.spots().find(|(id, _)| *id == gold).unwrap().1.alternate;
+    assert_eq!(alternate, craft_prepress::Alternate::Cmyk([0.0, 0.2, 0.6, 0.2]));
+
+    // An overprinting stroke carries `OP` in `fill`.
+    let (list, _) = read(&scene_pdf("D06"));
+    let gold = list.inks.lookup("Gold").unwrap();
+    let stroke = fill_items(&list).into_iter().find(|(_, f)| f.paint == Paint::Solid(InkColor::Tints(vec![(gold, 1.0)]))).unwrap().1;
+    assert_eq!(stroke.overprint, op(true, false));
+    // The 10 pt stroke outlined around a 110 × 60 rect.
+    assert_eq!(stroke.path.bounding_box().size().width.round(), 120.0);
+}
+
+#[test]
+fn registration_is_all_inks() {
+    let (list, _) = read(&scene_pdf("S13"));
+    let all: Vec<_> = fill_items(&list).into_iter().filter(|(_, f)| f.paint == Paint::Solid(InkColor::All(1.0))).collect();
+    assert_eq!(all.len(), 2, "the registration fill and stroke");
+}
+
+#[test]
+fn knockout_and_isolated_groups() {
+    let (list, _) = read(&scene_pdf("S09"));
+    let fills = fill_items(&list);
+    let ellipses: Vec<_> = fills.iter().filter(|(groups, _)| groups.iter().any(|g| g.knockout)).collect();
+    assert_eq!(ellipses.len(), 2);
+    for (groups, _) in ellipses {
+        // The writer puts each ellipse in an opacity group of its own, inside the knockout group.
+        let at = groups.iter().position(|g| g.knockout).unwrap();
+        assert!(groups[at + 1..].iter().any(|g| g.opacity == 0.5));
+    }
+
+    let (list, _) = read(&scene_pdf("S10"));
+    let fills = fill_items(&list);
+    let magenta = fills.iter().find(|(_, f)| f.paint == cmyk(0.0, 1.0, 0.0, 0.0)).unwrap();
+    assert!(magenta.0.iter().any(|g| g.isolated));
+    assert_eq!(magenta.0.last().unwrap().blend, BlendMode::Multiply);
+    let yellow = fills.iter().find(|(_, f)| f.paint == cmyk(0.0, 0.0, 1.0, 0.0)).unwrap();
+    assert!(yellow.0.iter().any(|g| g.isolated));
+    assert!(yellow.0.iter().all(|g| g.blend == BlendMode::Normal));
+}
+
+#[test]
+fn soft_masks_keep_backdrop_and_transfer() {
+    let (list, _) = read(&scene_pdf("M1"));
+    let (groups, _) = fill_items(&list).into_iter().find(|(_, f)| f.paint == cmyk(0.0, 1.0, 0.0, 0.0)).unwrap();
+    let mask = groups.iter().find_map(|g| g.mask.as_deref()).unwrap();
+    assert_eq!(mask.kind, MaskKind::Luminosity);
+    assert!(mask.group.isolated);
+    assert_eq!(leaves(&mask.group.children).len(), 1, "the mask's rect");
+    // The scene's backdrop is white (no black ink).
+    assert_eq!(mask.backdrop, Some(cmyk_color(0.0, 0.0, 0.0, 0.0)));
+
+    let (list, _) = read(&scene_pdf("M2"));
+    let (groups, _) = fill_items(&list).into_iter().find(|(_, f)| f.paint == cmyk(0.0, 1.0, 0.0, 0.0)).unwrap();
+    let mask = groups.iter().find_map(|g| g.mask.as_deref()).unwrap();
+    let transfer = mask.transfer.as_deref().unwrap();
+    assert_eq!((transfer.len(), transfer[0], transfer[255]), (256, 255, 0));
+}
+
+#[test]
+fn shadow_over_spot_counts_images() {
+    let (list, report) = read(&scene_pdf("S11"));
+    assert_eq!(report.images, 3, "the split image and two feather images in masks");
+    let shadows: Vec<_> = fill_items(&list).into_iter().filter(|(_, f)| f.paint == cmyk(0.0, 0.0, 0.0, 1.0)).collect();
+    assert_eq!(shadows.len(), 2);
+    for (groups, _) in shadows {
+        let masked = groups.iter().find(|g| g.mask.is_some()).unwrap();
+        assert_eq!(masked.blend, BlendMode::Multiply);
+        let mask = masked.mask.as_deref().unwrap();
+        assert_eq!(mask.kind, MaskKind::Luminosity);
+        assert_eq!(mask.backdrop, Some(cmyk_color(0.0, 0.0, 0.0, 1.0)));
+        // The mask's content is the feather image, alpha and all.
+        let feathers: Vec<_> =
+            leaves(&mask.group.children).into_iter().filter_map(|(_, i)| if let Item::Image(im) = i { Some(im) } else { None }).collect();
+        assert_eq!(feathers.len(), 1, "{:?}", mask.group.children);
+        assert!(groups.iter().any(|g| g.opacity == 0.75));
+    }
+}
+
+/// A one-page PDF from raw content and resources, objects numbered from 5.
+fn raw_pdf(content: &str, resources: &str, objects: &[String]) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    out.extend_from_slice(b"1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n");
+    out.extend_from_slice(b"2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n");
+    out.extend_from_slice(
+        format!("3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 120] /Contents 4 0 R /Resources << {resources} >> >> endobj\n").as_bytes(),
+    );
+    out.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n", content.len()).as_bytes());
+    for (i, body) in objects.iter().enumerate() {
+        out.extend_from_slice(format!("{} 0 obj {body} endobj\n", i + 5).as_bytes());
+    }
+    out.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF");
+    out
+}
+
+fn stream(dict: &str, data: &str) -> String {
+    format!("<< {dict} /Length {} >> stream\n{data}\nendstream", data.len())
+}
+
+#[test]
+fn text_clips_strokes_and_process_color() {
+    let to_unicode = "/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CMapName /T3 def /CMapType 2 def \
+        1 begincodespacerange <00> <FF> endcodespacerange 2 beginbfchar <41> <0041> <42> <0042> endbfchar \
+        endcmap CMapName currentdict /CMap defineresource pop end end";
+    let objects = [
+        // 5: a Type 3 font with a shape glyph (A) and a colored one (B).
+        "<< /Type /Font /Subtype /Type3 /FontBBox [0 0 1000 1000] /FontMatrix [0.001 0 0 0.001 0 0] \
+         /CharProcs << /sq 6 0 R /cg 7 0 R >> /Encoding << /Type /Encoding /Differences [65 /sq /cg] >> \
+         /FirstChar 65 /LastChar 66 /Widths [1000 1000] /ToUnicode 8 0 R >>"
+            .to_string(),
+        stream("", "1000 0 0 0 1000 1000 d1 0 0 1000 1000 re f"),
+        stream("", "1000 0 d0 0 1 0 0 k 0 0 1000 1000 re f"),
+        stream("", to_unicode),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_string(),
+    ];
+    let content = "BT /F1 20 Tf 10 90 Td (AAB) Tj ET \
+        BT /F2 24 Tf 100 90 Td (Hi) Tj ET \
+        q 0 0 100 50 re 25 10 50 30 re W* n 0 0 0 1 k 0 0 100 50 re f Q \
+        0.5 G 4 w [6 3] 0 d 110 10 m 290 10 l S \
+        1 0 0 rg 200 30 10 10 re f";
+    let pdf = raw_pdf(content, "/Font << /F1 5 0 R /F2 9 0 R >>", &objects);
+    let (list, report) = read(&pdf);
+    let items = leaves(&list.items);
+
+    // The two shape glyphs form one run; the colored glyph is a group with its text.
+    let Item::Text(t3) = items[0].1 else { panic!("{:?}", items[0]) };
+    assert_eq!((t3.glyphs.len(), t3.text.as_deref(), t3.font.is_none()), (2, Some("AA"), true));
+    assert_eq!(t3.size.round(), 20.0);
+    assert_eq!(t3.glyphs[1].origin.x.round(), 20.0, "origins in text space");
+    assert_eq!(t3.paint, cmyk(0.0, 0.0, 0.0, 1.0), "DeviceGray 0 is solid black only");
+    let colored = items[1].0.last().unwrap();
+    assert_eq!(colored.actual_text.as_deref(), Some("B"));
+    assert!(matches!(items[1].1, Item::Fill(f) if f.paint == cmyk(0.0, 1.0, 0.0, 0.0)));
+
+    let Item::Text(hi) = items[2].1 else { panic!("{:?}", items[2]) };
+    assert_eq!(hi.text.as_deref(), Some("Hi"));
+    assert_eq!(hi.glyphs[1].text, 1..2);
+    assert!(!hi.outlines.is_empty());
+    // Text space is y up: the run's transform flips y into page space.
+    assert!(hi.transform.as_coeffs()[3] < 0.0);
+
+    // The even-odd clip, as a nonzero path with the hole kept.
+    let (groups, _) = &items[3];
+    let clip = groups.last().unwrap().clip.as_ref().unwrap();
+    assert_eq!(clip.winding(Point::new(50.0, 95.0)), 0, "the hole");
+    assert_ne!(clip.winding(Point::new(10.0, 115.0)), 0);
+
+    // The dashed stroke, outlined: 20 dashes of 6 pt in 180 pt, 4 pt wide.
+    let Item::Fill(dashes) = items[4].1 else { panic!() };
+    assert_eq!(dashes.paint, cmyk(0.0, 0.0, 0.0, 0.5));
+    assert_eq!(dashes.path.elements().iter().filter(|e| matches!(e, PathEl::MoveTo(_))).count(), 20);
+    assert_eq!(dashes.path.bounding_box().height().round(), 4.0);
+
+    // RGB converts through FOGRA39: red is mostly magenta and yellow.
+    let Item::Fill(red) = items[5].1 else { panic!() };
+    let Paint::Solid(InkColor::Tints(tints)) = &red.paint else { panic!() };
+    assert_eq!(tints.len(), 4);
+    assert!(tints[1].1 > 0.8 && tints[2].1 > 0.8 && tints[0].1 < 0.2, "{tints:?}");
+    assert!(matches!(report.conversion, plates::Conversion::Fallback { .. }));
+    assert_eq!(items.len(), 6);
+}
+
+fn images(list: &DisplayList) -> Vec<(Vec<&GroupItem>, &ImageItem)> {
+    leaves(&list.items)
+        .into_iter()
+        .filter_map(|(groups, item)| match item {
+            Item::Image(im) => Some((groups, im)),
+            _ => None,
+        })
+        .collect()
+}
+
+/// The ink tints of `im` at page point `p` (nearest sample).
+fn tints_at(im: &ImageItem, p: Point) -> Vec<(InkId, f32)> {
+    let u = im.transform.inverse() * p;
+    let (w, h) = (im.size.0 as usize, im.size.1 as usize);
+    let (x, y) = (((u.x * w as f64) as usize).min(w - 1), ((u.y * h as f64) as usize).min(h - 1));
+    let ids: Vec<InkId> = match &im.space {
+        ImageSpace::Gray => vec![ink(Process::Black)],
+        ImageSpace::Cmyk => Process::ALL.iter().map(|p| ink(*p)).collect(),
+        ImageSpace::Inks(ids) => ids.clone(),
+        ImageSpace::Rgb => panic!("RGB image"),
+    };
+    let n = if im.space == ImageSpace::Gray { 1 } else { ids.len() };
+    let s = &im.samples[(y * w + x) * n..(y * w + x + 1) * n];
+    if im.space == ImageSpace::Gray {
+        return vec![(ids[0], 1.0 - f32::from(s[0]) / 255.0)];
+    }
+    ids.into_iter().zip(s).map(|(id, v)| (id, f32::from(*v) / 255.0)).collect()
+}
+
+fn tint(tints: &[(InkId, f32)], id: InkId) -> f32 {
+    tints.iter().find(|t| t.0 == id).map_or(0.0, |t| t.1)
+}
+
+fn hex_image(dict: &str, hex: &str) -> String {
+    stream(&format!("/Type /XObject /Subtype /Image /Filter /ASCIIHexDecode {dict}"), &format!("{hex}>"))
+}
+
+const GOLD: &str = "[/Separation /Gold /DeviceCMYK << /FunctionType 2 /Domain [0 1] /C0 [0 0 0 0] /C1 [0 0.2 0.6 0.2] /N 1 >>]";
+
+#[test]
+fn cmyk_image_keeps_its_samples() {
+    let objects = [hex_image("/Width 2 /Height 1 /ColorSpace /DeviceCMYK /BitsPerComponent 8", "FF000000 00804020")];
+    let pdf = raw_pdf("q 100 0 0 50 10 10 cm /Im1 Do Q", "/XObject << /Im1 5 0 R >>", &objects);
+    let (list, report) = read(&pdf);
+    let ims = images(&list);
+    assert_eq!(ims.len(), 1);
+    let im = ims[0].1;
+    assert_eq!((&im.space, im.size, &im.samples[..]), (&ImageSpace::Cmyk, (2, 1), &[255, 0, 0, 0, 0, 128, 64, 32][..]));
+    assert_eq!(im.transform * Point::ORIGIN, Point::new(10.0, 60.0), "(0, 0) is the top left sample");
+    assert_eq!(im.transform * Point::new(1.0, 1.0), Point::new(110.0, 110.0));
+    assert!(im.smask.is_none());
+    assert_eq!((report.images, report.converted_images), (1, 0));
+}
+
+#[test]
+fn cmyk_image_overprints_without_nonzero_mode() {
+    let objects = [hex_image("/Width 2 /Height 1 /ColorSpace /DeviceCMYK /BitsPerComponent 8", "FF000000 00804020")];
+    let pdf = raw_pdf("/GS1 gs q 100 0 0 50 10 10 cm /Im1 Do Q", "/XObject << /Im1 5 0 R >> /ExtGState << /GS1 << /op true /OPM 1 >> >>", &objects);
+    let (list, _) = read(&pdf);
+    assert_eq!(images(&list)[0].1.overprint, op(true, false), "nonzero overprint mode is not for images");
+}
+
+#[test]
+fn separation_image_is_its_ink_with_decode_applied() {
+    let objects = [hex_image(&format!("/Width 2 /Height 1 /ColorSpace {GOLD} /BitsPerComponent 8 /Decode [1 0]"), "FF40")];
+    let pdf = raw_pdf("/GS1 gs q 100 0 0 50 10 10 cm /Im1 Do Q", "/XObject << /Im1 5 0 R >> /ExtGState << /GS1 << /op true /OPM 1 >> >>", &objects);
+    let (list, _) = read(&pdf);
+    let gold = list.inks.lookup("Gold").unwrap();
+    let im = images(&list)[0].1;
+    assert_eq!(im.space, ImageSpace::Inks(vec![gold]));
+    assert_eq!(&im.samples[..], &[0, 0xBF]);
+    assert_eq!(im.overprint, op(true, false), "nonzero overprint mode is for DeviceCMYK only");
+}
+
+#[test]
+fn rgb_image_converts_to_cmyk() {
+    let objects = [hex_image("/Width 1 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8", "FF0000")];
+    let pdf = raw_pdf("q 10 0 0 10 10 10 cm /Im1 Do Q", "/XObject << /Im1 5 0 R >>", &objects);
+    let (list, report) = read(&pdf);
+    let im = images(&list)[0].1;
+    assert_eq!(im.space, ImageSpace::Cmyk);
+    assert!(im.samples[1] > 200 && im.samples[2] > 200 && im.samples[0] < 50, "{:?}", im.samples);
+    assert_eq!(report.converted_images, 1);
+}
+
+#[test]
+fn image_smask_is_resampled_to_the_image() {
+    let objects = [
+        hex_image("/Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /SMask 6 0 R", "00FF8040"),
+        hex_image("/Width 1 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8", "FF00"),
+    ];
+    let pdf = raw_pdf("q 20 0 0 20 10 10 cm /Im1 Do Q", "/XObject << /Im1 5 0 R >>", &objects);
+    let (list, report) = read(&pdf);
+    let im = images(&list)[0].1;
+    assert_eq!((&im.space, &im.samples[..]), (&ImageSpace::Gray, &[0, 255, 128, 64][..]));
+    assert_eq!(im.smask.as_deref(), Some(&[255, 255, 0, 0][..]));
+    assert_eq!(report.resampled_masks, 1);
+}
+
+#[test]
+fn spot_stencil_is_a_traced_fill() {
+    // Sample 0 paints: the left half of each row.
+    let objects = [hex_image("/Width 8 /Height 2 /ImageMask true /BitsPerComponent 1", "0F0F")];
+    let pdf = raw_pdf("/CS1 cs 1 scn q 80 0 0 20 10 10 cm /Im1 Do Q", &format!("/XObject << /Im1 5 0 R >> /ColorSpace << /CS1 {GOLD} >>"), &objects);
+    let (list, report) = read(&pdf);
+    let gold = list.inks.lookup("Gold").unwrap();
+    let fills = fill_items(&list);
+    assert_eq!(fills.len(), 1);
+    assert_eq!(fills[0].1.paint, Paint::Solid(InkColor::Tints(vec![(gold, 1.0)])));
+    let bbox = fills[0].1.path.bounding_box();
+    assert_eq!((bbox.x0, bbox.x1, bbox.y0, bbox.y1), (10.0, 50.0, 90.0, 110.0));
+    assert_eq!((report.stencils, images(&list).len()), (1, 0));
+}
+
+/// The gradient's ink values at offset `s`, interpolated between stops.
+fn stop_tints(stops: &[(f32, InkColor)], s: f32) -> Vec<(InkId, f32)> {
+    let k = stops.iter().position(|st| st.0 >= s).unwrap();
+    let (lo, hi) = (&stops[k.saturating_sub(1)], &stops[k]);
+    let u = if hi.0 > lo.0 { (s - lo.0) / (hi.0 - lo.0) } else { 1.0 };
+    let (InkColor::Tints(a), InkColor::Tints(b)) = (&lo.1, &hi.1) else { panic!() };
+    a.iter().zip(b).map(|(x, y)| (x.0, x.1 + (y.1 - x.1) * u)).collect()
+}
+
+#[test]
+fn axial_spot_to_paper_shading_is_a_gradient() {
+    // Gold from 100% to paper, quadratic: 1 - s².
+    let objects = [format!(
+        "<< /ShadingType 2 /ColorSpace {GOLD} /Coords [0 0 100 0] /Extend [true true] /Function << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 2 >> >>"
+    )];
+    let pdf = raw_pdf("q 0 0 100 100 re W n /Sh1 sh Q", "/Shading << /Sh1 5 0 R >>", &objects);
+    let (list, report) = read(&pdf);
+    let gold = list.inks.lookup("Gold").unwrap();
+    let fills = fill_items(&list);
+    assert_eq!(fills.len(), 1);
+    let Paint::Gradient { stops, geometry } = &fills[0].1.paint else { panic!("{:?}", fills[0].1.paint) };
+    for s in [0.25_f32, 0.5, 0.75] {
+        let t = stop_tints(stops, s);
+        assert!((tint(&t, gold) - (1.0 - s * s)).abs() < 1.0 / 255.0, "at {s}: {t:?}");
+    }
+    assert!(stops.len() < 64, "{} stops", stops.len());
+    let GradientGeometry::Axial { start, end, extend, .. } = geometry else { panic!() };
+    assert_eq!((*start, *end, *extend), (Point::new(0.0, 0.0), Point::new(100.0, 0.0), [true, true]));
+    assert_eq!(report.gradients, 1);
+}
+
+#[test]
+fn radial_process_shading_is_clipped_to_its_extent() {
+    let objects = ["<< /ShadingType 3 /ColorSpace /DeviceCMYK /Coords [50 50 0 50 50 40] /Function << /FunctionType 2 /Domain [0 1] /C0 [1 0 0 0] /C1 [0 1 0 0] /N 1 >> >>".to_string()];
+    let pdf = raw_pdf("/Sh1 sh", "/Shading << /Sh1 5 0 R >>", &objects);
+    let (list, _) = read(&pdf);
+    let fills = fill_items(&list);
+    assert_eq!(fills.len(), 1);
+    let (groups, fill) = &fills[0];
+    let Paint::Gradient { stops, geometry } = &fill.paint else { panic!() };
+    assert!(matches!(geometry, GradientGeometry::Radial { extend: [true, true], end_radius, .. } if *end_radius == 40.0));
+    let mid = stop_tints(stops, 0.5);
+    assert!((tint(&mid, ink(Process::Cyan)) - 0.5).abs() < 0.01 && (tint(&mid, ink(Process::Magenta)) - 0.5).abs() < 0.01);
+    assert_eq!(mid.len(), 4);
+    // Without Extend it paints within the outer circle only (page space: y flipped).
+    let extent = groups.iter().rev().find_map(|g| g.clip.as_ref()).unwrap();
+    assert_ne!(extent.winding(Point::new(50.0, 70.0)), 0);
+    assert_ne!(extent.winding(Point::new(89.5, 70.0)), 0);
+    assert_eq!(extent.winding(Point::new(91.0, 70.0)), 0);
+}
+
+#[test]
+fn coons_mesh_shading_rasterizes() {
+    // One square patch over 0..100 with C, M, Y and K corners.
+    let points = "00 00 00 55 00 AA 00 FF 55 FF AA FF FF FF FF AA FF 55 FF 00 AA 00 55 00";
+    let colors = "FF000000 00FF0000 0000FF00 000000FF";
+    let objects = [hex_image_free(
+        "/ShadingType 6 /ColorSpace /DeviceCMYK /BitsPerCoordinate 8 /BitsPerComponent 8 /BitsPerFlag 8 /Decode [0 100 0 100 0 1 0 1 0 1 0 1]",
+        &format!("00 {points} {colors}"),
+    )];
+    let pdf = raw_pdf("q 1 0 0 1 10 10 cm /Sh1 sh Q", "/Shading << /Sh1 5 0 R >>", &objects);
+    let (list, report) = read(&pdf);
+    let ims = images(&list);
+    assert_eq!((ims.len(), report.rasterized_shadings), (1, 1));
+    let im = ims[0].1;
+    assert_eq!(im.space, ImageSpace::Cmyk);
+    let corner = tints_at(im, Point::new(11.0, 109.0));
+    assert!(tint(&corner, ink(Process::Cyan)) > 0.95, "{corner:?}");
+    let center = tints_at(im, Point::new(60.0, 60.0));
+    for p in Process::ALL {
+        assert!((tint(&center, ink(p)) - 0.25).abs() < 0.03, "{center:?}");
+    }
+    assert_eq!(im.smask.as_ref().unwrap()[0], 0, "outside the patch");
+}
+
+fn hex_image_free(dict: &str, hex: &str) -> String {
+    stream(&format!("{dict} /Filter /ASCIIHexDecode"), &format!("{hex}>"))
+}
+
+#[test]
+fn tiling_pattern_expands_into_cells() {
+    let objects = [
+        stream("/PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 10 10] /XStep 20 /YStep 20 /Resources << >>", "1 0 0 0 k 0 0 10 10 re f"),
+        stream(
+            "/PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 0.25 0.25] /XStep 0.5 /YStep 0.5 /Resources << >>",
+            "0 1 0 0 k 0 0 0.25 0.25 re f",
+        ),
+    ];
+    let pdf = raw_pdf("/Pattern cs /P1 scn 0 0 90 30 re f /P2 scn 100 0 90 30 re f", "/Pattern << /P1 5 0 R /P2 6 0 R >>", &objects);
+    let (list, report) = read(&pdf);
+    // Cells start every 20 pt from 0: five across 90 pt, two up 30 pt.
+    assert_eq!(report.tiling_cells, 10);
+    let cyan = fill_items(&list).into_iter().filter(|(_, f)| f.paint == cmyk(1.0, 0.0, 0.0, 0.0)).count();
+    assert_eq!(cyan, 10);
+    // 180 × 60 cells are past the cap: an image, a quarter magenta on average.
+    assert_eq!(report.rasterized_tilings, 1);
+    let im = images(&list)[0].1;
+    let a = im.smask.as_ref().unwrap();
+    let mean = a.iter().map(|v| f64::from(*v)).sum::<f64>() / a.len() as f64 / 255.0;
+    assert!((mean - 0.25).abs() < 0.05, "{mean}");
+}
+
+#[test]
+fn tiling_cells_past_the_item_budget_rasterize() {
+    // Each of the 99 × 99 outer cells holds an expanded 15 × 15 inner pattern: 2.2 million
+    // items in all.
+    let objects = [
+        stream(
+            "/PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 1 1] /XStep 1 /YStep 1 /Resources << /Pattern << /P2 6 0 R >> >>",
+            "/Pattern cs /P2 scn 0 0 1 1 re f",
+        ),
+        stream(
+            "/PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 0.02 0.02] /XStep 0.07 /YStep 0.07 /Resources << >>",
+            "1 0 0 0 k 0 0 0.02 0.02 re f",
+        ),
+    ];
+    let pdf = raw_pdf("/Pattern cs /P1 scn 0.5 0.5 98 98 re f", "/Pattern << /P1 5 0 R >>", &objects);
+    let (list, report) = read(&pdf);
+    assert_eq!(report.tiling_cells, 225, "only the inner pattern expands");
+    assert_eq!(report.rasterized_tilings, 1);
+    assert_eq!(images(&list).len(), 1);
+}
+
+#[test]
+fn deeply_overlapping_tiling_cells_paint_nothing() {
+    // Every point lies in 6 × 10^14 cells.
+    let objects = [stream(
+        "/PatternType 1 /PaintType 1 /TilingType 1 /BBox [0 0 100000 100000] /XStep 0.004 /YStep 0.004 /Resources << >>",
+        "1 0 0 0 k 0 0 1 1 re f",
+    )];
+    let pdf = raw_pdf("/Pattern cs /P1 scn 0 0 90 30 re f", "/Pattern << /P1 5 0 R >>", &objects);
+    let (list, report) = read(&pdf);
+    assert_eq!((report.tiling_cells, report.rasterized_tilings, report.dropped_tilings), (0, 0, 1));
+    assert!(images(&list).is_empty());
+}
+
+#[test]
+fn dashes_past_the_budget_stroke_solid() {
+    // A billion dashes.
+    let pdf = raw_pdf("[0.000001] 0 d 0 0 m 1000 0 l S", "", &[]);
+    let (list, _) = read(&pdf);
+    let fills = fill_items(&list);
+    assert_eq!(fills.len(), 1);
+    assert!(fills[0].1.path.elements().len() < 20, "{:?}", fills[0].1.path);
+}
+
+#[test]
+fn plate_test_gradients_and_meshes_read() {
+    let (list, report) = read(&scene_pdf("S14"));
+    let gold = list.inks.lookup("Gold").unwrap();
+    assert_eq!((report.gradients, report.unreadable_images), (2, 0));
+    let duotone = images(&list)[0].1;
+    let at = tints_at(duotone, Point::new(100.0, 60.0));
+    assert!((tint(&at, ink(Process::Black)) - 0.25).abs() < 0.1 && (tint(&at, gold) - 0.15).abs() < 0.1, "{at:?}");
+    for (_, f) in fill_items(&list) {
+        assert!(matches!(f.paint, Paint::Gradient { .. }), "{:?}", f.paint);
+    }
+
+    let (list, report) = read(&scene_pdf("S17"));
+    let gold = list.inks.lookup("Gold").unwrap();
+    assert_eq!(report.rasterized_shadings, 1);
+    let mesh = images(&list)[0].1;
+    let expect = [
+        ((24.0, 24.0), vec![(gold, 0.95)]),
+        ((216.0, 24.0), vec![(ink(Process::Cyan), 0.95)]),
+        ((120.0, 80.0), vec![(gold, 0.375), (ink(Process::Cyan), 0.25), (ink(Process::Magenta), 0.25)]),
+    ];
+    for ((x, y), inks) in expect {
+        let at = tints_at(mesh, Point::new(x, y));
+        for (id, v) in inks {
+            assert!((tint(&at, id) - v).abs() < 0.1, "({x}, {y}): {at:?}");
+        }
+    }
+}
+
+fn write_fills(list: &DisplayList) -> Vec<u8> {
+    let cms = CmsConversion::fogra39();
+    let mut writer = Writer::new(Default::default(), Metadata::default());
+    let size = list.page.size();
+    let mut page = writer.document_mut().start_page_with(PageSettings::from_wh(size.width as f32, size.height as f32).unwrap());
+    let mut surface = page.surface();
+    for (groups, item) in leaves(&list.items) {
+        assert!(groups.iter().all(|g| g.opacity == 1.0 && g.mask.is_none() && g.clip.is_none()), "opaque scenes only");
+        let Item::Fill(f) = item else { panic!("{item:?}") };
+        let Paint::Solid(color) = &f.paint else { panic!() };
+        let o = f.overprint;
+        surface.push_overprint(KOverprint { fill: o.fill, stroke: o.stroke, nonzero: o.nonzero });
+        let rule = if f.rule == FillRule::EvenOdd { KFillRule::EvenOdd } else { KFillRule::NonZero };
+        surface.set_fill(Some(Fill { paint: to_pdf_color(color, &list.inks, &cms).unwrap().into(), rule, ..Default::default() }));
+        surface.draw_path(&krilla_path(&f.path));
+        surface.pop();
+    }
+    surface.finish();
+    page.finish();
+    writer.finish().unwrap()
+}
+
+fn krilla_path(path: &BezPath) -> craft_pdf::write::backend::geom::Path {
+    let mut b = PathBuilder::new();
+    for el in path.elements() {
+        match *el {
+            PathEl::MoveTo(p) => b.move_to(p.x as f32, p.y as f32),
+            PathEl::LineTo(p) => b.line_to(p.x as f32, p.y as f32),
+            PathEl::QuadTo(p1, p) => b.quad_to(p1.x as f32, p1.y as f32, p.x as f32, p.y as f32),
+            PathEl::CurveTo(p1, p2, p) => b.cubic_to(p1.x as f32, p1.y as f32, p2.x as f32, p2.y as f32, p.x as f32, p.y as f32),
+            PathEl::ClosePath => b.close(),
+        }
+    }
+    b.finish().unwrap()
+}
+
+#[test]
+fn opaque_items_separate_as_the_source() {
+    for id in ["S01", "S04", "D06", "S13"] {
+        let source = scene_pdf(id);
+        let (list, _) = read(&source);
+        let copy = write_fills(&list);
+        let (a, b) = (plates(&source, 0, 36.0, &Options::default()).unwrap(), plates(&copy, 0, 36.0, &Options::default()).unwrap());
+        assert_eq!(a.planes.len(), b.planes.len(), "{id}: plates");
+        for (k, (pa, pb)) in a.planes.iter().zip(&b.planes).enumerate() {
+            let differ = pa.iter().zip(pb).filter(|(x, y)| x.abs_diff(**y) > 8).count();
+            assert!(differ * 100 < pa.len(), "{id}: plate {k} differs in {differ} of {} pixels", pa.len());
+        }
+    }
+}
+
+#[test]
+fn print_flagged_annotations_left_out_are_counted() {
+    let ap = stream("/Type /XObject /Subtype /Form /BBox [0 0 10 10]", "0 0 0 1 k 0 0 10 10 re f");
+    let annot = |flags: u32| format!("<< /Type /Annot /Subtype /Stamp /Rect [10 10 20 20] /F {flags} /AP << /N 5 0 R >> >>");
+    // Print; Print and Hidden; no flags (screen only); Print without an appearance.
+    let objects = [ap, annot(4), annot(4 | 2), annot(0), "<< /Type /Annot /Subtype /Text /Rect [0 0 5 5] /F 4 >>".to_string()];
+    // `raw_pdf` puts its argument inside the page's /Resources; this closes that dictionary to
+    // add /Annots to the page.
+    let pdf = raw_pdf("", ">> /Annots [6 0 R 7 0 R 8 0 R 9 0 R] /PieceInfo <<", &objects);
+    let (list, report) = read_page(&pdf, 0, &ReadOptions::default()).unwrap();
+    assert!(list.items.is_empty());
+    assert_eq!(report.dropped_annotations, 1);
+    let (list, report) = read_page(&pdf, 0, &ReadOptions { annotations: true, ..ReadOptions::default() }).unwrap();
+    assert!(!list.items.is_empty());
+    assert_eq!(report.dropped_annotations, 0);
+}
diff --git a/crates/prepress/tests/flatten_plates.rs b/crates/prepress/tests/flatten_plates.rs
new file mode 100644
index 00000000..91c11262
--- /dev/null
+++ b/crates/prepress/tests/flatten_plates.rs
@@ -0,0 +1,38 @@
+//! Local plate check of the flattener: every plate-test scene written, flattened with
+//! [`flatten_page`] at 300 dpi, separated with Ghostscript and judged against the scene, with no
+//! transparency left in the flattened page. Run it with `scripts/plate-check.sh --flatten`; it
+//! never runs in CI.
+#![cfg(feature = "flatten")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use craft_plate_test::reference::{self, Context};
+use craft_plate_test::report::{self, Status};
+use craft_plate_test::{gs, scene};
+use craft_prepress::flatten::{FlattenPageOptions, flatten_page};
+
+#[test]
+#[ignore = "needs Ghostscript; run scripts/plate-check.sh --flatten"]
+fn every_scene_separates_as_expected_flattened() {
+    let Some(version) = gs::version() else {
+        println!("note: Ghostscript ({:?}) not found; set {} or install gs", gs::program(), gs::GS_ENV);
+        return;
+    };
+    let scenes = scene::load_dir(&scene::scenes_dir()).unwrap();
+    let ctx = Context::from_env(&scenes);
+    if ctx.font.is_none() {
+        println!("note: {} not set; text points are skipped", reference::FONT_DIR_ENV);
+    }
+    let opts = FlattenPageOptions::default();
+    let flatten = |pdf: &[u8]| flatten_page(pdf, 0, &opts).map(|(flat, _)| flat).map_err(|e| e.to_string());
+    let report = report::run_flattened(&ctx, version, &flatten);
+    let path = report::write(&report, &report::output_dir().join("flattened")).unwrap();
+    for r in &report.scenes {
+        let pending = r.pending.as_deref().map(|t| format!(" (pending {t})")).unwrap_or_default();
+        let flat = r.flattened.as_ref().map(|f| format!(", flattened {:?} in {:.0} ms", f.status, f.millis)).unwrap_or_default();
+        println!("{} {:?}{flat}{pending}", r.id, r.status);
+    }
+    println!("report: {}", path.display());
+    let wrong = report.unexpected();
+    assert!(wrong.is_empty(), "see {}:\n{}", path.display(), wrong.join("\n"));
+    assert!(report.scenes.iter().any(|r| r.flattened.as_ref().is_some_and(|f| f.status == Status::Pass)));
+}
diff --git a/crates/prepress/tests/flatten_raster.rs b/crates/prepress/tests/flatten_raster.rs
new file mode 100644
index 00000000..7f9af1c2
--- /dev/null
+++ b/crates/prepress/tests/flatten_raster.rs
@@ -0,0 +1,416 @@
+//! Complex regions rasterized as ink images, and plate-test scenes flattened end to end: the
+//! plates of a scene and of its flattened page match at the scene's sample points, and the
+//! flattened page has no transparency left.
+//!
+//! D10 needs Inter from `CRAFT_PDF_TEST_FONT_DIR` or `~/.cache/craft-pdf-test-fonts`, and is
+//! skipped when it is missing.
+#![cfg(feature = "flatten")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::path::PathBuf;
+use std::sync::{Arc, OnceLock};
+use std::time::Instant;
+
+use craft_pdf::write::backend::SerializeSettings;
+use craft_pdf::write::backend::configure::PdfVersion;
+use craft_pdf::write::backend::page::PageSettings;
+use craft_pdf::write::print::{self, PrintColor};
+use craft_pdf::write::{Metadata, Writer, configuration};
+use craft_plate_test::reference::{self, Context};
+use craft_plate_test::{scene, structure};
+use craft_prepress::flatten::kurbo::{Affine, BezPath, Point, Rect, Shape};
+use craft_prepress::flatten::raster::Rasterizer;
+use craft_prepress::flatten::write::{WriteError, page_pdf, write_flattened};
+use craft_prepress::flatten::{
+    BlendMode, ComplexReason, ComplexRegion, DisplayList, FillItem, FillRule, FlattenOptions, FlattenPageOptions, Flattened, GradientGeometry,
+    GroupItem, Item, Paint, flatten, flatten_page,
+};
+use craft_prepress::{Alternate, CmsConversion, Fallback, Ink, InkColor, InkId, InkSet, Options, Overprint, Plates, Process, Spot, plates};
+
+const C: InkId = InkId::process(Process::Cyan);
+const K: InkId = InkId::process(Process::Black);
+
+fn settings() -> SerializeSettings {
+    // Reading the profile takes a quarter second in a debug build.
+    static SETTINGS: OnceLock<SerializeSettings> = OnceLock::new();
+    SETTINGS.get_or_init(|| print::settings(PrintColor::fogra39(craft_cms::builtin::COATED_FOGRA39_ICC)).unwrap()).clone()
+}
+
+fn separate(pdf: &[u8], dpi: f32) -> Plates {
+    plates(pdf, 0, dpi, &Options::default()).unwrap()
+}
+
+/// Ink `name`'s tint at (`x`, `y`) in points, 0 when the page doesn't use the ink.
+fn tint(p: &Plates, name: &str, x: f32, y: f32) -> u8 {
+    let s = p.dpi / 72.0;
+    p.inks.lookup(name).and_then(|id| p.tint(id, (x * s) as u32, (y * s) as u32)).unwrap_or(0)
+}
+
+/// The flattened page has no transparency left ([`structure::transparency`]).
+fn assert_opaque(pdf: &[u8]) {
+    let left = structure::transparency(&structure::summarize(pdf).unwrap());
+    assert!(left.is_empty(), "transparency left: {left:?}");
+}
+
+fn font() -> Option<Arc<Vec<u8>>> {
+    let dir = std::env::var_os(reference::FONT_DIR_ENV)
+        .map(PathBuf::from)
+        .or_else(|| std::env::var_os("HOME").map(|h| PathBuf::from(h).join(".cache/craft-pdf-test-fonts")))?;
+    std::fs::read(dir.join(reference::FONT_FILE)).ok().map(Arc::new)
+}
+
+/// Scene `id` written by the reference writer and flattened with complex regions at 72 dpi: the
+/// plates match at every judged sample point within `tol` (0–255), or the flattened page meets the
+/// scene's expectation there. The renderer's source page can differ from the scene where it
+/// converts a mask's CMYK luminosity through the printing condition (S11's K100 `/BC` reads as
+/// about 12% luminosity); the flattener uses the DeviceCMYK formula, as Acrobat does. Returns the worst
+/// difference from the source.
+fn scene_round_trip(id: &str, tol: u8) -> u8 {
+    scene_planes(id, tol).0
+}
+
+/// [`scene_round_trip`], with the source's and the flattened page's plates.
+fn scene_planes(id: &str, tol: u8) -> (u8, Plates, Plates) {
+    let scenes = scene::load_dir(&scene::scenes_dir()).unwrap();
+    let s = scenes.iter().find(|s| s.id == id).unwrap();
+    let pdf = reference::write(s, &Context { scenes: &scenes, font: font() }).unwrap().pdf;
+    let opts = FlattenPageOptions { flatten: FlattenOptions { raster_dpi: 72.0, ..FlattenOptions::default() }, ..FlattenPageOptions::default() };
+    let start = Instant::now();
+    let (flat, report) = flatten_page(&pdf, 0, &opts).unwrap();
+    eprintln!("{id}: flatten_page {:?}, {:?}", start.elapsed(), report.raster);
+    assert_opaque(&flat);
+    let (a, b) = (separate(&pdf, 72.0), separate(&flat, 72.0));
+    let mut worst = 0;
+    for point in s.expect.points.iter().filter(|p| !p.info) {
+        let [x, y] = point.at;
+        for name in s.expect.plates.iter().map(String::as_str) {
+            let (want, got) = (tint(&a, name, x, y), tint(&b, name, x, y));
+            if want.abs_diff(got) <= tol {
+                worst = worst.max(want.abs_diff(got));
+                continue;
+            }
+            let meets = |v: u8| {
+                let pct = f32::from(v) / 2.55;
+                match point.inks.get(name).copied().unwrap_or(scene::Level::Value(0.0)) {
+                    scene::Level::Value(e) => (pct - e).abs() <= point.tol,
+                    scene::Level::Range([lo, hi]) => pct >= lo - point.tol && pct <= hi + point.tol,
+                }
+            };
+            assert!(meets(got), "{id} {name} at ({x}, {y}): {got}, the source has {want}");
+            eprintln!("{id} {name} at ({x}, {y}): {got} meets the scene, the source renders {want}");
+        }
+    }
+    eprintln!("{id}: worst ink difference {worst}/255");
+    (worst, a, b)
+}
+
+#[test]
+fn s06_half_black_over_cyan() {
+    scene_round_trip("S06", 3);
+}
+
+#[test]
+fn s07_spot_multiply() {
+    scene_round_trip("S07", 3);
+}
+
+#[test]
+fn s08_non_separable_blend_over_a_spot() {
+    scene_round_trip("S08", 3);
+}
+
+#[test]
+fn s10_isolated_multiply() {
+    scene_round_trip("S10", 3);
+}
+
+#[test]
+fn s11_shadow_over_spot() {
+    scene_round_trip("S11", 6);
+}
+
+#[test]
+fn s14_duotone_gradients() {
+    scene_round_trip("S14", 6);
+}
+
+#[test]
+fn m1_luminosity_mask_rasterizes() {
+    scene_round_trip("M1", 3);
+}
+
+#[test]
+fn m2_mask_transfer_rasterizes() {
+    scene_round_trip("M2", 3);
+}
+
+#[test]
+fn f02_hidden_art_leaves_no_trace() {
+    // vectorcraft#2161: no pixel of the opaque card and box, anti-aliased as viewers draw them,
+    // differs from the source: art hidden under them doesn't cut them into pieces whose edges
+    // show.
+    let (_, a, b) = scene_planes("F02", 3);
+    let s = a.dpi / 72.0;
+    let mut off = Vec::new();
+    for (x0, x1) in [(22.0, 168.0), (182.0, 338.0)] {
+        for y in (22.0 * s) as u32..(158.0 * s) as u32 {
+            for x in (x0 * s) as u32..(x1 * s) as u32 {
+                for name in ["Cyan", "Magenta", "Yellow", "Black"] {
+                    let tint = |p: &Plates| p.inks.lookup(name).and_then(|id| p.tint(id, x, y)).unwrap_or(0);
+                    if tint(&a) != tint(&b) {
+                        off.push(format!("{name} {} vs {} at pixel ({x}, {y})", tint(&b), tint(&a)));
+                    }
+                }
+            }
+        }
+    }
+    assert!(off.is_empty(), "{} pixels differ, e.g. {:?}", off.len(), &off[..off.len().min(8)]);
+}
+
+#[test]
+fn d10_text_over_transparency_stays_live() {
+    if font().is_none() {
+        eprintln!("skipped: no test font");
+        return;
+    }
+    scene_round_trip("D10", 3);
+    let scenes = scene::load_dir(&scene::scenes_dir()).unwrap();
+    let s = scenes.iter().find(|s| s.id == "D10").unwrap();
+    let pdf = reference::write(s, &Context { scenes: &scenes, font: font() }).unwrap().pdf;
+    let (flat, _) = flatten_page(&pdf, 0, &FlattenPageOptions::default()).unwrap();
+    let doc = craft_pdf::open_slice(&flat, None).unwrap();
+    let pages = doc.pages();
+    let mut ops = Vec::new();
+    let mut it = pages.first().unwrap().operations();
+    while let Some(op) = it.next() {
+        ops.push(String::from_utf8_lossy(op.operator).into_owned());
+    }
+    assert!(ops.iter().any(|op| op == "Tj" || op == "TJ"), "text drawn as text: {ops:?}");
+}
+
+fn spot_inks() -> (InkSet, InkId) {
+    let mut inks = InkSet::new();
+    let gold = inks.add(Ink::Spot(Spot { name: "Gold".into(), alternate: Alternate::Cmyk([0.0, 0.3, 1.0, 0.0]), solidity: None })).unwrap();
+    (inks, gold)
+}
+
+fn solid(r: Rect, tints: &[(InkId, f32)]) -> Item {
+    Item::Fill(FillItem {
+        path: r.to_path(0.1),
+        rule: FillRule::NonZero,
+        paint: Paint::Solid(InkColor::Tints(tints.to_vec())),
+        overprint: Overprint::default(),
+    })
+}
+
+fn group(opacity: f32, blend: BlendMode, children: Vec<Item>) -> Item {
+    Item::Group(GroupItem { opacity, blend, isolated: false, knockout: false, clip: None, mask: None, actual_text: None, children })
+}
+
+fn ramp(r: Rect, from: InkColor, to: InkColor) -> Item {
+    Item::Fill(FillItem {
+        path: r.to_path(0.1),
+        rule: FillRule::NonZero,
+        paint: Paint::Gradient {
+            stops: vec![(0.0, from), (1.0, to)],
+            geometry: GradientGeometry::Axial {
+                start: Point::new(r.x0, 0.0),
+                end: Point::new(r.x1, 0.0),
+                extend: [true; 2],
+                transform: Affine::IDENTITY,
+            },
+        },
+        overprint: Overprint::default(),
+    })
+}
+
+/// `flat` written with complex regions rasterized at `dpi`.
+fn write(list: &DisplayList, flat: &Flattened, dpi: f32) -> Vec<u8> {
+    write_at(list, flat, dpi, PdfVersion::default()).unwrap()
+}
+
+/// [`write`] for an output of PDF `version`.
+fn write_at(list: &DisplayList, flat: &Flattened, dpi: f32, version: PdfVersion) -> Result<Vec<u8>, WriteError> {
+    let cms = CmsConversion::fogra39();
+    let mut raster = Rasterizer::new(list, settings(), Fallback::Fogra39, &cms, dpi);
+    let output = SerializeSettings { configuration: configuration(version, None).unwrap(), ..settings() };
+    let mut writer = Writer::new(output, Metadata::default());
+    let size = PageSettings::from_wh(list.page.width() as f32, list.page.height() as f32).unwrap();
+    let mut page_builder = writer.document_mut().start_page_with(size);
+    let mut surface = page_builder.surface();
+    let drawn = write_flattened(&mut surface, list, flat, &cms, version, &mut |r| raster.region(r));
+    surface.finish();
+    page_builder.finish();
+    drawn?;
+    Ok(writer.finish().unwrap())
+}
+
+/// A page of 2 pt stripes, one of `process` tints and one of each of `count` spot inks, under a
+/// half-transparent ramp: a complex region that paints them all.
+fn many_inks(count: usize, process: &[(InkId, f32)]) -> (DisplayList, Flattened) {
+    let mut inks = InkSet::new();
+    let stripe = |i: usize| Rect::new(2.0 * i as f64, 0.0, 2.0 * (i + 1) as f64, 10.0);
+    let mut items = vec![solid(stripe(0), process)];
+    for i in 0..count {
+        let spot = Spot { name: format!("Spot {i}"), alternate: Alternate::Cmyk([0.0, 0.0, 0.0, 0.1]), solidity: None };
+        items.push(solid(stripe(i + 1), &[(inks.add(Ink::Spot(spot)).unwrap(), 0.5)]));
+    }
+    let width = 2.0 * (count + 1) as f64;
+    let ramp = ramp(Rect::new(0.0, 0.0, width, 10.0), InkColor::Tints(vec![(K, 0.0)]), InkColor::Tints(vec![(K, 1.0)]));
+    items.push(group(0.5, BlendMode::Multiply, vec![ramp]));
+    let list = DisplayList { page: Rect::new(0.0, 0.0, width, 10.0), inks, items };
+    let flat = flatten(&list, &FlattenOptions::default()).unwrap();
+    assert!(!flat.complex.is_empty());
+    (list, flat)
+}
+
+#[test]
+fn a_region_of_more_spot_inks_than_plates_separates_is_an_error() {
+    let (list, flat) = many_inks(33, &[(K, 0.5)]);
+    match write_at(&list, &flat, 72.0, PdfVersion::default()) {
+        Err(WriteError::SpotInks { inks: 33, max: 32, unseparated }) => assert_eq!(unseparated.len(), 1),
+        other => panic!("{:?}", other.map(|_| ())),
+    }
+}
+
+#[test]
+fn a_raster_region_of_nine_inks_needs_pdf_1_5() {
+    let (list, flat) = many_inks(5, &[(C, 0.5), (InkId::process(Process::Magenta), 0.5), (InkId::process(Process::Yellow), 0.5), (K, 0.5)]);
+    match write_at(&list, &flat, 72.0, PdfVersion::Pdf14) {
+        Err(WriteError::Colorants { colorants: 9, max: 8 }) => {}
+        other => panic!("{:?}", other.map(|_| ())),
+    }
+    let p = separate(&write_at(&list, &flat, 72.0, PdfVersion::Pdf17).unwrap(), 72.0);
+    assert!(tint(&p, "Spot 4", 11.0, 5.0) > 0);
+}
+
+#[test]
+fn gradient_under_multiply_over_a_spot_prints_the_same_rasterized() {
+    // A K ramp multiplied over Gold and cyan, half transparent: complex regions over a spot and
+    // a process backdrop, with a kept K fill above them.
+    let (inks, gold) = spot_inks();
+    let list = DisplayList {
+        page: Rect::new(0.0, 0.0, 100.0, 100.0),
+        inks,
+        items: vec![
+            solid(Rect::new(0.0, 0.0, 50.0, 100.0), &[(gold, 1.0)]),
+            solid(Rect::new(50.0, 0.0, 100.0, 100.0), &[(C, 0.6)]),
+            group(
+                0.5,
+                BlendMode::Multiply,
+                vec![ramp(Rect::new(10.0, 20.0, 90.0, 80.0), InkColor::Tints(vec![(K, 0.0)]), InkColor::Tints(vec![(K, 1.0)]))],
+            ),
+            solid(Rect::new(40.0, 45.0, 60.0, 55.0), &[(K, 1.0)]),
+        ],
+    };
+    let flat = flatten(&list, &FlattenOptions::default()).unwrap();
+    assert_eq!(flat.complex.len(), 1, "touching complex regions merge: {:?}", flat.complex.iter().map(|c| &c.items).collect::<Vec<_>>());
+    let start = Instant::now();
+    let out = write(&list, &flat, 72.0);
+    eprintln!("ramp: written in {:?}", start.elapsed());
+    assert_opaque(&out);
+    let (a, b) = (separate(&page_pdf(&list, settings(), &CmsConversion::fogra39()).unwrap(), 72.0), separate(&out, 72.0));
+    let mut worst = 0;
+    for (x, y) in [(5.0, 50.0), (20.0, 30.0), (30.0, 70.0), (45.0, 40.0), (50.0, 50.0), (55.0, 60.0), (70.0, 30.0), (85.0, 75.0), (95.0, 50.0)] {
+        for name in ["Cyan", "Magenta", "Yellow", "Black", "Gold"] {
+            let (want, got) = (tint(&a, name, x, y), tint(&b, name, x, y));
+            assert!(want.abs_diff(got) <= 3, "{name} at ({x}, {y}): {got}, expected {want}");
+            worst = worst.max(want.abs_diff(got));
+        }
+    }
+    eprintln!("ramp: worst ink difference {worst}/255");
+}
+
+#[test]
+fn abutting_complex_regions_leave_no_paper_at_their_edge() {
+    // Two regions cut off the grid at x = 50.3, each its own image of the same 60% K fill.
+    let list = DisplayList {
+        page: Rect::new(0.0, 0.0, 100.0, 100.0),
+        inks: InkSet::new(),
+        items: vec![solid(Rect::new(10.0, 10.0, 90.0, 90.0), &[(K, 0.6)])],
+    };
+    let region = |r: Rect| ComplexRegion { path: r.to_path(0.1), items: vec![0], at: 0, whole: None };
+    let flat = Flattened {
+        items: Vec::new(),
+        complex: vec![region(Rect::new(10.0, 10.0, 50.3, 90.0)), region(Rect::new(50.3, 10.0, 90.0, 90.0))],
+        report: Default::default(),
+    };
+    let dpi = 36.0;
+    let p = separate(&write(&list, &flat, dpi), 2.0 * dpi);
+    let k = p.inks.lookup("Black").unwrap();
+    let edge = (50.3 * p.dpi / 72.0) as u32;
+    for y in (12.0 * p.dpi / 72.0) as u32..(88.0 * p.dpi / 72.0) as u32 {
+        for x in edge.saturating_sub(1)..=edge + 1 {
+            let v = p.tint(k, x, y).unwrap();
+            assert!(v >= 153 / 2, "K {v} at pixel ({x}, {y})");
+        }
+    }
+}
+
+#[test]
+fn a_degenerate_group_is_an_opaque_image_over_paper() {
+    // The region's path is a box larger than the half-black disc in it, with cyan beside it.
+    // Nothing else is under the box, so its image needs no soft mask: paper where the disc
+    // doesn't paint, the disc's own color where it does.
+    let disc = kurbo_circle(Point::new(50.0, 50.0), 20.0);
+    let list = DisplayList {
+        page: Rect::new(0.0, 0.0, 100.0, 100.0),
+        inks: InkSet::new(),
+        items: vec![
+            solid(Rect::new(0.0, 0.0, 20.0, 100.0), &[(C, 1.0)]),
+            group(
+                0.5,
+                BlendMode::Normal,
+                vec![Item::Fill(FillItem {
+                    path: disc,
+                    rule: FillRule::NonZero,
+                    paint: Paint::Solid(InkColor::Tints(vec![(K, 1.0)])),
+                    overprint: Overprint::default(),
+                })],
+            ),
+        ],
+    };
+    let flat = Flattened {
+        items: vec![list.items[0].clone()],
+        complex: vec![ComplexRegion {
+            path: Rect::new(25.0, 25.0, 75.0, 75.0).to_path(0.1),
+            items: vec![1],
+            at: 1,
+            whole: Some(ComplexReason::Degenerate),
+        }],
+        report: Default::default(),
+    };
+    let out = write(&list, &flat, 72.0);
+    assert_opaque(&out);
+    let p = separate(&out, 72.0);
+    // A corner of the box, outside the disc: paper.
+    assert!(tint(&p, "Cyan", 28.0, 28.0) <= 3 && tint(&p, "Black", 28.0, 28.0) <= 3);
+    // The disc: K 50%.
+    assert!(tint(&p, "Black", 50.0, 50.0).abs_diff(128) <= 3 && tint(&p, "Cyan", 50.0, 50.0) <= 3);
+    // The cyan beside the box, untouched.
+    assert!(tint(&p, "Cyan", 10.0, 50.0) >= 250);
+}
+
+fn kurbo_circle(c: Point, r: f64) -> BezPath {
+    craft_prepress::flatten::kurbo::Circle::new(c, r).to_path(0.01)
+}
+
+#[test]
+fn regions_thinner_than_a_point_rasterize() {
+    // At 300 dpi the hairline region is a tile of 3 px, 0.72 pt; the strip's last tile is 3 px
+    // wide.
+    let list = DisplayList {
+        page: Rect::new(0.0, 0.0, 400.0, 40.0),
+        inks: InkSet::new(),
+        items: vec![group(0.5, BlendMode::Normal, vec![solid(Rect::new(10.0, 10.0, 390.0, 30.0), &[(K, 1.0)])])],
+    };
+    let region = |r: Rect| ComplexRegion { path: r.to_path(0.1), items: vec![0], at: 0, whole: None };
+    let flat = Flattened {
+        items: Vec::new(),
+        complex: vec![region(Rect::new(20.0, 20.0, 20.1, 25.0)), region(Rect::new(10.0, 10.0, 378.71, 15.0))],
+        report: Default::default(),
+    };
+    let p = separate(&write(&list, &flat, 300.0), 300.0);
+    assert!(tint(&p, "Black", 20.05, 22.0) > 0, "the hairline prints");
+    assert!(tint(&p, "Black", 378.4, 12.0).abs_diff(128) <= 3, "the last tile prints");
+}
diff --git a/crates/prepress/tests/flatten_timings.rs b/crates/prepress/tests/flatten_timings.rs
new file mode 100644
index 00000000..842c9c50
--- /dev/null
+++ b/crates/prepress/tests/flatten_timings.rs
@@ -0,0 +1,209 @@
+//! Times the flattener in stages on every plate-test scene and on a synthetic heavy page, at
+//! 300 dpi. A report, not a benchmark: run it in release with
+//! `cargo test --release -p craft-prepress --features flatten --test flatten_timings -- --ignored --nocapture`.
+#![cfg(feature = "flatten")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::sync::OnceLock;
+use std::time::{Duration, Instant};
+
+use craft_pdf::write::backend::SerializeSettings;
+
+use craft_pdf::write::backend::page::PageSettings;
+use craft_pdf::write::print::{self, PrintColor};
+use craft_pdf::write::{Metadata, Writer};
+use craft_plate_test::reference::{self, Context};
+use craft_plate_test::scene;
+use craft_prepress::flatten::kurbo::{Affine, Circle, Point, Rect, Shape};
+use craft_prepress::flatten::pdf::{ReadOptions, read_page};
+use craft_prepress::flatten::raster::Rasterizer;
+use craft_prepress::flatten::write::{page_pdf, write_flattened};
+use craft_prepress::flatten::{
+    BlendMode, DisplayList, FillItem, FillRule, FlattenOptions, FlattenPageOptions, GradientGeometry, GroupItem, Item, Paint, flatten, flatten_page,
+};
+use craft_prepress::{CmsConversion, Fallback, InkColor, InkId, InkSet, Options, Overprint, Process, plates};
+
+const DPI: f32 = 300.0;
+
+#[derive(Default)]
+struct Stages {
+    read: Duration,
+    flatten: Duration,
+    raster: Duration,
+    write: Duration,
+    total: Duration,
+    regions: usize,
+    whole: String,
+    pixels: u64,
+    fills: usize,
+    complex: usize,
+}
+
+/// The page read, flattened, and written with its complex regions rasterized, each stage timed;
+/// `total` is [`flatten_page`] in one call.
+fn stages(pdf: &[u8]) -> Stages {
+    let mut st = Stages::default();
+    let start = Instant::now();
+    let opts = FlattenPageOptions { flatten: FlattenOptions { raster_dpi: DPI, ..FlattenOptions::default() }, ..FlattenPageOptions::default() };
+    flatten_page(pdf, 0, &opts).unwrap();
+    st.total = start.elapsed();
+
+    let start = Instant::now();
+    let (list, _) = read_page(pdf, 0, &ReadOptions::default()).unwrap();
+    st.read = start.elapsed();
+    written(&list, &mut st);
+    st
+}
+
+/// Flattens and writes `list`, timing the stages into `st`.
+fn written(list: &DisplayList, st: &mut Stages) -> Vec<u8> {
+    let start = Instant::now();
+    let flat = flatten(list, &FlattenOptions { raster_dpi: DPI, ..FlattenOptions::default() }).unwrap();
+    st.flatten = start.elapsed();
+    st.fills = flat.report.fills;
+    st.regions = flat.report.regions;
+    st.whole = flat.report.complex_groups.iter().map(|g| format!("{:?}", g.reason)).collect::<Vec<_>>().join(", ");
+    st.complex = flat.complex.len();
+
+    let settings = settings();
+    let cms = CmsConversion::fogra39();
+    let start = Instant::now();
+    let mut raster = Rasterizer::new(list, settings.clone(), Fallback::Fogra39, &cms, DPI);
+    let mut raster_time = Duration::ZERO;
+    let version = settings.configuration.version();
+    let mut writer = Writer::new(settings, Metadata::default());
+    let size = PageSettings::from_wh(list.page.width() as f32, list.page.height() as f32).unwrap();
+    let mut page_builder = writer.document_mut().start_page_with(size);
+    let mut surface = page_builder.surface();
+    write_flattened(&mut surface, list, &flat, &cms, version, &mut |r| {
+        let t = Instant::now();
+        let image = raster.region(r);
+        raster_time += t.elapsed();
+        image
+    })
+    .unwrap();
+    surface.finish();
+    page_builder.finish();
+    let pdf = writer.finish().unwrap();
+    st.raster = raster_time;
+    st.write = start.elapsed() - raster_time;
+    st.pixels = raster.report().pixels;
+    pdf
+}
+
+fn settings() -> SerializeSettings {
+    static SETTINGS: OnceLock<SerializeSettings> = OnceLock::new();
+    SETTINGS.get_or_init(|| print::settings(PrintColor::fogra39(craft_cms::builtin::COATED_FOGRA39_ICC)).unwrap()).clone()
+}
+
+fn ms(d: Duration) -> String {
+    format!("{:.1}", d.as_secs_f64() * 1000.0)
+}
+
+fn row(name: &str, st: &Stages) -> String {
+    format!(
+        "| {name} | {} | {} | {} | {} | {} | {} | {} | {}{} | {:.1} |",
+        ms(st.total),
+        ms(st.read),
+        ms(st.flatten),
+        ms(st.raster),
+        ms(st.write),
+        st.regions,
+        st.fills,
+        st.complex,
+        if st.whole.is_empty() { String::new() } else { format!(" ({})", st.whole) },
+        st.pixels as f64 / 1e6
+    )
+}
+
+/// About 1,000 shapes up to `size` pt on an A4 page, 100 of them transparent (opacity or
+/// Multiply); `gradients` of the transparent ones are filled with a ramp. Positions come from a fixed
+/// sequence, so every run draws the same page.
+fn heavy(size: f64, gradients: usize) -> DisplayList {
+    let mut seed = 0x2545_f491_u64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        (seed % 10_000) as f64 / 10_000.0
+    };
+    let ink = |i: usize| InkId::process(Process::ALL[i % 4]);
+    let mut items = Vec::new();
+    let mut transparent = 0;
+    for i in 0..1000 {
+        let (x, y) = (20.0 + next() * 520.0, 20.0 + next() * 780.0);
+        let (w, h) = (2.0 + next() * (size - 2.0), 2.0 + next() * (size - 2.0));
+        let path = if i % 3 == 0 { Circle::new(Point::new(x, y), w / 2.0).to_path(0.1) } else { Rect::new(x, y, x + w, y + h).to_path(0.1) };
+        let color = InkColor::Tints(vec![(ink(i), 0.2 + next() as f32 * 0.8), (ink(i + 1), next() as f32 * 0.5)]);
+        let paint = if i % 10 == 9 && transparent < gradients {
+            Paint::Gradient {
+                stops: vec![(0.0, color), (1.0, InkColor::Tints(vec![(ink(i + 2), 1.0)]))],
+                geometry: GradientGeometry::Axial {
+                    start: Point::new(x, y),
+                    end: Point::new(x + w, y),
+                    extend: [true; 2],
+                    transform: Affine::IDENTITY,
+                },
+            }
+        } else {
+            Paint::Solid(color)
+        };
+        let fill = Item::Fill(FillItem { path, rule: FillRule::NonZero, paint, overprint: Overprint::default() });
+        if i % 10 == 9 {
+            transparent += 1;
+            let blend = if i % 40 == 9 { BlendMode::Multiply } else { BlendMode::Normal };
+            items.push(Item::Group(GroupItem {
+                opacity: 0.3 + next() as f32 * 0.5,
+                blend,
+                isolated: false,
+                knockout: false,
+                clip: None,
+                mask: None,
+                actual_text: None,
+                children: vec![fill],
+            }));
+        } else {
+            items.push(fill);
+        }
+    }
+    DisplayList { page: Rect::new(0.0, 0.0, 595.0, 842.0), inks: InkSet::new(), items }
+}
+
+#[test]
+#[ignore = "timing report; run in release"]
+fn flatten_timings() {
+    let scenes = scene::load_dir(&scene::scenes_dir()).unwrap();
+    let ctx = Context::from_env(&scenes);
+    // Load the profiles once, so the first scene doesn't pay for it.
+    let _ = stages(&reference::write(&scenes[0], &ctx).unwrap().pdf);
+    println!(
+        "| Page | flatten_page ms | read | flatten | rasterize | write | regions | fills | complex | Mpx |\n|---|---|---|---|---|---|---|---|---|---|"
+    );
+    for s in scenes.iter().filter(|s| s.pending.is_none()) {
+        let pdf = reference::write(s, &ctx).unwrap().pdf;
+        println!("{}", row(&s.id, &stages(&pdf)));
+    }
+    let pages = [
+        ("heavy, 2–65 pt, flat paints", 65.0, 0),
+        ("heavy, 2–65 pt, 10 gradients", 65.0, 10),
+        ("heavy, 2–20 pt, flat paints", 20.0, 0),
+        ("heavy, 2–20 pt, 10 gradients", 20.0, 10),
+    ];
+    for (name, size, gradients) in pages {
+        let list = heavy(size, gradients);
+        let start = Instant::now();
+        let pdf = page_pdf(&list, settings(), &CmsConversion::fogra39()).unwrap();
+        let wrote = start.elapsed();
+        let start = Instant::now();
+        let p = plates(&pdf, 0, DPI, &Options::default()).unwrap();
+        // What rasterizing a region as large as the page costs: writing its items as a PDF and
+        // separating that.
+        println!("<!-- {name}: page_pdf {} ms, plates {} ms for {} x {} px -->", ms(wrote), ms(start.elapsed()), p.width, p.height);
+        println!("{}", row(name, &stages(&pdf)));
+        let mut st = Stages::default();
+        let start = Instant::now();
+        written(&list, &mut st);
+        st.total = start.elapsed();
+        println!("{}", row(&format!("{name} (display list)"), &st));
+    }
+}
diff --git a/crates/prepress/tests/flatten_write.rs b/crates/prepress/tests/flatten_write.rs
new file mode 100644
index 00000000..8e0c9875
--- /dev/null
+++ b/crates/prepress/tests/flatten_write.rs
@@ -0,0 +1,472 @@
+//! The flattener's writer: display lists written with krilla and separated again by `plates`.
+//! Pages are 100 pt square and separated at 36 dpi; sample points are in points.
+//!
+//! Text cases with an embedded font need Inter from `CRAFT_PDF_TEST_FONT_DIR` or
+//! `~/.cache/craft-pdf-test-fonts`, and are skipped when it is missing.
+#![cfg(feature = "flatten")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::path::PathBuf;
+use std::sync::{Arc, OnceLock};
+
+use craft_pdf::interpret::font::Glyph;
+use craft_pdf::interpret::hayro_cmap::BfString;
+use craft_pdf::interpret::{
+    BlendMode as HBlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, InterpreterSettings, Paint as HPaint, PathDrawMode,
+    SoftMask, TransformExt, interpret_page,
+};
+use craft_pdf::syntax::object::{Dict, Name, Stream};
+use craft_pdf::write::backend::SerializeSettings;
+use craft_pdf::write::backend::configure::PdfVersion;
+use craft_pdf::write::backend::page::PageSettings;
+use craft_pdf::write::print::{self, PrintColor};
+use craft_pdf::write::{Metadata, Writer};
+use craft_prepress::flatten::kurbo::{Affine, BezPath, Point, Rect, Shape};
+use craft_prepress::flatten::write::{WriteError, page_pdf, write_flattened};
+use craft_prepress::flatten::{
+    BlendMode, ComplexRegion, DisplayList, FillItem, FillRule, FlattenOptions, GradientGeometry, GroupItem, ImageItem, ImageSpace, Item, Paint,
+    PlacedGlyph, TextFont, TextItem, flatten,
+};
+use craft_prepress::{Alternate, CmsConversion, Ink, InkColor, InkId, InkSet, Options, Overprint, Plates, Process, Spot, plates};
+
+const C: InkId = InkId::process(Process::Cyan);
+const M: InkId = InkId::process(Process::Magenta);
+const Y: InkId = InkId::process(Process::Yellow);
+const K: InkId = InkId::process(Process::Black);
+const OVERPRINT: Overprint = Overprint { fill: true, stroke: false, nonzero: false };
+
+fn fill(r: Rect, tints: &[(InkId, f32)], overprint: Overprint) -> Item {
+    Item::Fill(FillItem { path: r.to_path(0.1), rule: FillRule::NonZero, paint: Paint::Solid(InkColor::Tints(tints.to_vec())), overprint })
+}
+
+fn solid(r: Rect, tints: &[(InkId, f32)]) -> Item {
+    fill(r, tints, Overprint::default())
+}
+
+fn group(opacity: f32, children: Vec<Item>) -> Item {
+    Item::Group(GroupItem {
+        opacity,
+        blend: BlendMode::Normal,
+        isolated: false,
+        knockout: false,
+        clip: None,
+        mask: None,
+        actual_text: None,
+        children,
+    })
+}
+
+fn page(inks: InkSet, items: Vec<Item>) -> DisplayList {
+    DisplayList { page: Rect::new(0.0, 0.0, 100.0, 100.0), inks, items }
+}
+
+fn pdf(list: &DisplayList) -> Vec<u8> {
+    // Reading the profile takes a quarter second in a debug build.
+    static SETTINGS: OnceLock<SerializeSettings> = OnceLock::new();
+    let settings = SETTINGS.get_or_init(|| print::settings(PrintColor::fogra39(craft_cms::builtin::COATED_FOGRA39_ICC)).unwrap());
+    page_pdf(list, settings.clone(), &CmsConversion::fogra39()).unwrap()
+}
+
+/// `list` flattened, with nothing left for the raster step, written.
+fn flat_pdf(list: &DisplayList) -> Vec<u8> {
+    let flat = flatten(list, &FlattenOptions::default()).unwrap();
+    assert!(flat.complex.is_empty());
+    pdf(&DisplayList { items: flat.items, ..list.clone() })
+}
+
+fn separate(pdf: &[u8]) -> Plates {
+    plates(pdf, 0, 36.0, &Options::default()).unwrap()
+}
+
+/// Ink `name`'s tint at (`x`, `y`) in points, 0 when the page doesn't use the ink.
+fn tint(p: &Plates, name: &str, x: u32, y: u32) -> u8 {
+    p.inks.lookup(name).and_then(|id| p.tint(id, x / 2, y / 2)).unwrap_or(0)
+}
+
+/// Each ink's tint at (`x`, `y`) is within 3 of `expected`.
+fn assert_inks(p: &Plates, x: u32, y: u32, expected: &[(&str, u8)]) {
+    for (name, want) in expected {
+        let got = tint(p, name, x, y);
+        assert!(got.abs_diff(*want) <= 3, "{name} at ({x}, {y}): {got}, expected {want}");
+    }
+}
+
+#[test]
+fn half_black_over_cyan_in_a_group_composites_the_same_flattened_or_not() {
+    let list = page(
+        InkSet::new(),
+        vec![solid(Rect::new(0.0, 0.0, 60.0, 100.0), &[(C, 1.0)]), group(0.5, vec![solid(Rect::new(40.0, 0.0, 100.0, 100.0), &[(K, 1.0)])])],
+    );
+    for written in [pdf(&list), flat_pdf(&list)] {
+        let p = separate(&written);
+        assert_inks(&p, 50, 50, &[("Cyan", 128), ("Black", 128)]);
+        assert_inks(&p, 20, 50, &[("Cyan", 255), ("Black", 0)]);
+        assert_inks(&p, 80, 50, &[("Cyan", 0), ("Black", 128)]);
+    }
+}
+
+#[test]
+fn group_opacity_applies_to_the_group_not_to_each_child() {
+    // Two overlapping K100 fills in a 50% group: K50 where they overlap, not K75.
+    let list = page(
+        InkSet::new(),
+        vec![group(0.5, vec![solid(Rect::new(0.0, 0.0, 60.0, 100.0), &[(K, 1.0)]), solid(Rect::new(40.0, 0.0, 100.0, 100.0), &[(K, 1.0)])])],
+    );
+    for written in [pdf(&list), flat_pdf(&list)] {
+        let p = separate(&written);
+        assert_inks(&p, 50, 50, &[("Black", 128)]);
+        assert_inks(&p, 20, 50, &[("Black", 128)]);
+    }
+}
+
+#[test]
+fn black_overprint_keeps_the_cyan_under_it() {
+    let list = page(
+        InkSet::new(),
+        vec![solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)]), fill(Rect::new(50.0, 0.0, 100.0, 100.0), &[(K, 1.0)], OVERPRINT)],
+    );
+    for written in [pdf(&list), flat_pdf(&list)] {
+        let p = separate(&written);
+        assert_inks(&p, 75, 50, &[("Cyan", 255), ("Black", 255)]);
+        assert_inks(&p, 25, 50, &[("Cyan", 255), ("Black", 0)]);
+    }
+}
+
+#[test]
+fn overprinting_process_color_leaves_the_plates_of_inks_it_doesnt_list() {
+    let over = |tints: &[(InkId, f32)], nonzero: bool| {
+        let list = page(
+            InkSet::new(),
+            vec![
+                solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(C, 1.0)]),
+                fill(Rect::new(50.0, 0.0, 100.0, 100.0), tints, Overprint { nonzero, ..OVERPRINT }),
+            ],
+        );
+        separate(&pdf(&list))
+    };
+    // Magenta and yellow only: cyan stays, black stays empty.
+    assert_inks(&over(&[(M, 1.0), (Y, 0.5)], false), 75, 50, &[("Cyan", 255), ("Magenta", 255), ("Yellow", 128), ("Black", 0)]);
+    // A listed cyan at 0 knocks cyan out under OPM 0 ...
+    assert_inks(&over(&[(C, 0.0), (M, 1.0)], false), 75, 50, &[("Cyan", 0), ("Magenta", 255)]);
+    // ... and leaves it under OPM 1.
+    assert_inks(&over(&[(C, 0.0), (M, 1.0)], true), 75, 50, &[("Cyan", 255), ("Magenta", 255)]);
+    // Nothing named paints nothing.
+    assert_inks(&over(&[(C, 0.0)], true), 75, 50, &[("Cyan", 255)]);
+}
+
+fn gold() -> Spot {
+    Spot { name: "Gold".into(), alternate: Alternate::Cmyk([0.0, 0.2, 0.8, 0.1]), solidity: None }
+}
+
+#[test]
+fn spot_fills_print_on_their_plate_or_where_the_ink_manager_sends_them() {
+    let mut inks = InkSet::new();
+    let gold = inks.add(Ink::Spot(gold())).unwrap();
+    let list = page(inks.clone(), vec![solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(gold, 0.8)])]);
+    assert_inks(&separate(&pdf(&list)), 50, 50, &[("Gold", 204), ("Cyan", 0), ("Magenta", 0), ("Yellow", 0)]);
+
+    let mut aliased = inks.clone();
+    assert!(aliased.alias(gold, M));
+    let p = separate(&pdf(&DisplayList { inks: aliased, ..list.clone() }));
+    assert!(p.inks.lookup("Gold").is_none());
+    assert_inks(&p, 50, 50, &[("Magenta", 204), ("Yellow", 0)]);
+
+    let mut process = inks;
+    assert!(process.set_to_process(gold, true));
+    let p = separate(&pdf(&DisplayList { inks: process, ..list }));
+    assert!(p.inks.lookup("Gold").is_none());
+    assert_inks(&p, 50, 50, &[("Cyan", 0), ("Magenta", 41), ("Yellow", 163), ("Black", 20)]);
+}
+
+// ---- text ----------------------------------------------------------------------------------
+
+const SAMPLE: &str = "Hamburg";
+
+fn inter() -> Option<Vec<u8>> {
+    let dir = std::env::var_os("CRAFT_PDF_TEST_FONT_DIR")
+        .map(PathBuf::from)
+        .or_else(|| std::env::var_os("HOME").map(|h| PathBuf::from(h).join(".cache/craft-pdf-test-fonts")));
+    let data = dir.as_ref().and_then(|d| std::fs::read(d.join("Inter-Regular.ttf")).ok());
+    if data.is_none() {
+        println!("note: Inter-Regular.ttf not found in {dir:?}; case skipped");
+    }
+    data
+}
+
+struct Outline(BezPath);
+
+impl ttf_parser::OutlineBuilder for Outline {
+    fn move_to(&mut self, x: f32, y: f32) {
+        self.0.move_to((f64::from(x), f64::from(y)));
+    }
+    fn line_to(&mut self, x: f32, y: f32) {
+        self.0.line_to((f64::from(x), f64::from(y)));
+    }
+    fn quad_to(&mut self, x1: f32, y1: f32, x: f32, y: f32) {
+        self.0.quad_to((f64::from(x1), f64::from(y1)), (f64::from(x), f64::from(y)));
+    }
+    fn curve_to(&mut self, x1: f32, y1: f32, x2: f32, y2: f32, x: f32, y: f32) {
+        self.0.curve_to((f64::from(x1), f64::from(y1)), (f64::from(x2), f64::from(y2)), (f64::from(x), f64::from(y)));
+    }
+    fn close(&mut self) {
+        self.0.close_path();
+    }
+}
+
+/// `SAMPLE` in K100 at 18 pt on a baseline at (5, 60), with its outlines.
+fn text_run(font: &[u8], embed: bool) -> TextItem {
+    let face = ttf_parser::Face::parse(font, 0).unwrap();
+    let upem = f64::from(face.units_per_em());
+    let size = 18.0;
+    let transform = Affine::new([1.0, 0.0, 0.0, -1.0, 5.0, 60.0]);
+    let (mut x, mut glyphs, mut outlines) = (0.0, Vec::new(), BezPath::new());
+    for (i, c) in SAMPLE.char_indices() {
+        let id = face.glyph_index(c).unwrap();
+        glyphs.push(PlacedGlyph { id: u32::from(id.0), origin: Point::new(x, 0.0), text: i..i + c.len_utf8() });
+        let mut outline = Outline(BezPath::new());
+        face.outline_glyph(id, &mut outline);
+        outlines.extend((transform * Affine::translate((x, 0.0)) * Affine::scale(size / upem) * outline.0).iter());
+        x += f64::from(face.glyph_hor_advance(id).unwrap()) * size / upem;
+    }
+    TextItem {
+        font: embed.then(|| Arc::new(TextFont { data: Arc::new(font.to_vec()), index: 0, key: 1 })),
+        size: size as f32,
+        transform,
+        glyphs,
+        text: Some(SAMPLE.to_owned()),
+        outlines,
+        paint: Paint::Solid(InkColor::Tints(vec![(K, 1.0)])),
+        overprint: Overprint::default(),
+    }
+}
+
+#[derive(Default)]
+struct Reader {
+    unicode: String,
+    actual_text: String,
+}
+
+impl<'a> Device<'a> for Reader {
+    fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
+    fn set_blend_mode(&mut self, _: HBlendMode) {}
+    fn draw_path(&mut self, _: &BezPath, _: Affine, _: &HPaint<'a>, _: &PathDrawMode) {}
+    fn push_clip_path(&mut self, _: &ClipPath) {}
+    fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: HBlendMode) {}
+    fn draw_glyph(&mut self, glyph: &Glyph<'a>, _: Affine, _: Affine, _: &HPaint<'a>, _: &GlyphDrawMode) {
+        if let Glyph::Outline(o) = glyph {
+            match o.as_unicode() {
+                Some(BfString::Char(c)) => self.unicode.push(c),
+                Some(BfString::String(s)) => self.unicode.push_str(&s),
+                None => {}
+            }
+        }
+    }
+    fn draw_image(&mut self, _: Image<'a, '_>, _: Affine) {}
+    fn pop_clip_path(&mut self) {}
+    fn pop_transparency_group(&mut self) {}
+    fn actual_text(&mut self, text: &[u8]) {
+        self.actual_text.push_str(&match text {
+            [0xFE, 0xFF, rest @ ..] => String::from_utf16_lossy(&rest.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes(*c)).collect::<Vec<_>>()),
+            _ => text.iter().map(|&b| char::from(b)).collect(),
+        });
+    }
+}
+
+fn read_text(pdf: &[u8]) -> Reader {
+    let doc = craft_pdf::syntax::Pdf::new(Arc::new(pdf.to_vec())).unwrap();
+    let page = &doc.pages()[0];
+    let cache = InterpreterCache::new();
+    let bbox = Rect::new(0.0, 0.0, 100.0, 100.0);
+    let mut context = Context::new(page.initial_transform(true).to_kurbo(), bbox, &cache, page.xref(), InterpreterSettings::default());
+    let mut reader = Reader::default();
+    interpret_page(page, &mut context, &mut reader);
+    reader
+}
+
+#[test]
+fn text_with_a_font_is_live_and_prints_like_its_outlines() {
+    let Some(font) = inter() else { return };
+    let live = pdf(&page(InkSet::new(), vec![Item::Text(text_run(&font, true))]));
+    let outlined = pdf(&page(InkSet::new(), vec![Item::Text(text_run(&font, false))]));
+    assert_eq!(read_text(&live).unicode, SAMPLE);
+    let (a, b) = (separate(&live), separate(&outlined));
+    let (a, b) = (a.plane(K).unwrap(), b.plane(K).unwrap());
+    assert!(a.iter().map(|v| u64::from(*v)).sum::<u64>() > 255 * 50, "the text prints");
+    let differ = a.iter().zip(b).filter(|(x, y)| x.abs_diff(**y) > 64).count();
+    assert!(differ <= a.len() / 200, "{differ} pixels differ between glyphs and outlines");
+}
+
+#[test]
+fn text_without_a_font_is_drawn_as_outlines_with_its_text() {
+    let mut run = TextItem {
+        font: None,
+        size: 18.0,
+        transform: Affine::new([1.0, 0.0, 0.0, -1.0, 5.0, 60.0]),
+        glyphs: Vec::new(),
+        text: Some(SAMPLE.to_owned()),
+        outlines: Rect::new(5.0, 45.0, 80.0, 60.0).to_path(0.1),
+        paint: Paint::Solid(InkColor::Tints(vec![(K, 1.0)])),
+        overprint: Overprint::default(),
+    };
+    if let Some(font) = inter() {
+        run = TextItem { font: None, ..text_run(&font, false) };
+    }
+    let written = pdf(&page(InkSet::new(), vec![Item::Text(run)]));
+    let read = read_text(&written);
+    assert_eq!(read.actual_text, SAMPLE);
+    assert!(read.unicode.is_empty());
+}
+
+// ---- structure -----------------------------------------------------------------------------
+
+/// Transparency left on a page: groups, soft masks, blend modes other than Normal and
+/// constant opacity below 1, in its resources and those of the forms it uses.
+fn transparency(pdf: &[u8]) -> Vec<String> {
+    let doc = craft_pdf::syntax::Pdf::new(Arc::new(pdf.to_vec())).unwrap();
+    let page = &doc.pages()[0];
+    let mut found = Vec::new();
+    if page.raw().get::<Dict<'_>>(b"Group".as_slice()).is_some() {
+        found.push("page group".to_owned());
+    }
+    visit(&page.resources().x_objects, &page.resources().ext_g_states, &mut found, 0);
+    found
+}
+
+fn visit(x_objects: &Dict<'_>, states: &Dict<'_>, found: &mut Vec<String>, depth: usize) {
+    assert!(depth < 16);
+    for key in states.keys() {
+        let Some(state) = states.get::<Dict<'_>>(key.as_ref()) else { continue };
+        if state.get::<Dict<'_>>(b"SMask".as_slice()).is_some() {
+            found.push("soft mask".to_owned());
+        }
+        if let Some(bm) = state.get::<Name<'_>>(b"BM".as_slice())
+            && bm.as_str() != "Normal"
+        {
+            found.push(format!("blend mode {}", bm.as_str()));
+        }
+        for alpha in ["ca", "CA"] {
+            if state.get::<f32>(alpha.as_bytes()).is_some_and(|a| a < 1.0) {
+                found.push(alpha.to_owned());
+            }
+        }
+    }
+    for key in x_objects.keys() {
+        let Some(x) = x_objects.get::<Stream<'_>>(key.as_ref()) else { continue };
+        let dict = x.dict();
+        if dict.get::<Dict<'_>>(b"Group".as_slice()).is_some() {
+            found.push("group".to_owned());
+        }
+        if let Some(res) = dict.get::<Dict<'_>>(b"Resources".as_slice()) {
+            let sub = |key: &[u8]| res.get::<Dict<'_>>(key).unwrap_or_default();
+            visit(&sub(b"XObject"), &sub(b"ExtGState"), found, depth + 1);
+        }
+    }
+}
+
+#[test]
+fn a_flattened_page_has_no_transparency_left() {
+    let multiply = Item::Group(GroupItem {
+        blend: BlendMode::Multiply,
+        isolated: true,
+        ..match group(0.7, vec![solid(Rect::new(30.0, 30.0, 90.0, 90.0), &[(M, 1.0)]), solid(Rect::new(50.0, 10.0, 95.0, 60.0), &[(Y, 0.6)])]) {
+            Item::Group(g) => g,
+            _ => unreachable!(),
+        }
+    });
+    let list = page(
+        InkSet::new(),
+        vec![
+            solid(Rect::new(0.0, 0.0, 60.0, 100.0), &[(C, 1.0)]),
+            group(0.5, vec![solid(Rect::new(40.0, 0.0, 100.0, 100.0), &[(K, 1.0)])]),
+            multiply,
+        ],
+    );
+    let unflattened = transparency(&pdf(&list));
+    assert!(unflattened.iter().any(|t| t == "ca") && unflattened.iter().any(|t| t.starts_with("blend mode")), "{unflattened:?}");
+    assert_eq!(transparency(&flat_pdf(&list)), Vec::<String>::new());
+}
+
+// ---- images, gradients and complex regions ------------------------------------------------
+
+fn axial(from: InkColor, to: InkColor) -> Paint {
+    Paint::Gradient {
+        stops: vec![(0.0, from), (1.0, to)],
+        geometry: GradientGeometry::Axial {
+            start: Point::new(0.0, 0.0),
+            end: Point::new(100.0, 0.0),
+            extend: [true, true],
+            transform: Affine::IDENTITY,
+        },
+    }
+}
+
+#[test]
+fn an_overprinting_cyan_gradient_keeps_the_yellow_under_it() {
+    let ramp = Item::Fill(FillItem {
+        path: Rect::new(0.0, 0.0, 100.0, 100.0).to_path(0.1),
+        rule: FillRule::NonZero,
+        paint: axial(InkColor::Tints(vec![(C, 0.0)]), InkColor::Tints(vec![(C, 1.0)])),
+        overprint: OVERPRINT,
+    });
+    let p = separate(&pdf(&page(InkSet::new(), vec![solid(Rect::new(0.0, 0.0, 100.0, 100.0), &[(Y, 1.0)]), ramp])));
+    assert_inks(&p, 26, 50, &[("Cyan", 66), ("Yellow", 255)]);
+    assert_inks(&p, 74, 50, &[("Cyan", 189), ("Yellow", 255)]);
+}
+
+#[test]
+fn ink_images_print_through_the_ink_manager() {
+    let mut inks = InkSet::new();
+    let gold = inks.add(Ink::Spot(gold())).unwrap();
+    assert!(inks.alias(gold, C));
+    let image = Item::Image(ImageItem {
+        space: ImageSpace::Inks(vec![C, gold]),
+        size: (2, 1),
+        samples: Arc::from(&[128, 128, 0, 255][..]),
+        transform: Affine::new([100.0, 0.0, 0.0, 100.0, 0.0, 0.0]),
+        smask: None,
+        overprint: Overprint::default(),
+        jpeg: None,
+    });
+    let p = separate(&pdf(&page(inks, vec![image])));
+    // Two half tints on one plate overlap as halftones: 1 − 0.5 × 0.5.
+    assert_inks(&p, 25, 50, &[("Cyan", 191)]);
+    assert_inks(&p, 75, 50, &[("Cyan", 255)]);
+    assert!(p.inks.lookup("Gold").is_none());
+}
+
+#[test]
+fn complex_regions_are_drawn_where_the_flattened_items_put_them() {
+    let ramp = Item::Fill(FillItem {
+        path: Rect::new(40.0, 0.0, 100.0, 100.0).to_path(0.1),
+        rule: FillRule::NonZero,
+        paint: axial(InkColor::Tints(vec![(K, 0.2)]), InkColor::Tints(vec![(K, 1.0)])),
+        overprint: Overprint::default(),
+    });
+    let list = page(InkSet::new(), vec![solid(Rect::new(0.0, 0.0, 60.0, 100.0), &[(C, 1.0)]), group(0.5, vec![ramp])]);
+    let flat = flatten(&list, &FlattenOptions::default()).unwrap();
+    assert!(!flat.complex.is_empty());
+    // A stand-in for the raster step: magenta over each region's bounds.
+    let mut raster = |region: &ComplexRegion| -> Result<Option<ImageItem>, WriteError> {
+        let b = region.path.bounding_box();
+        Ok(Some(ImageItem {
+            space: ImageSpace::Inks(vec![M]),
+            size: (1, 1),
+            samples: Arc::from(&[255][..]),
+            transform: Affine::new([b.width(), 0.0, 0.0, b.height(), b.x0, b.y0]),
+            smask: None,
+            overprint: Overprint::default(),
+            jpeg: None,
+        }))
+    };
+    let settings = print::settings(PrintColor::fogra39(craft_cms::builtin::COATED_FOGRA39_ICC)).unwrap();
+    let mut writer = Writer::new(settings, Metadata::default());
+    let mut page_builder = writer.document_mut().start_page_with(PageSettings::from_wh(100.0, 100.0).unwrap());
+    let mut surface = page_builder.surface();
+    write_flattened(&mut surface, &list, &flat, &CmsConversion::fogra39(), PdfVersion::default(), &mut raster).unwrap();
+    surface.finish();
+    page_builder.finish();
+    let p = separate(&writer.finish().unwrap());
+    assert_inks(&p, 20, 50, &[("Cyan", 255), ("Magenta", 0)]);
+    assert_inks(&p, 50, 50, &[("Cyan", 0), ("Magenta", 255)]);
+    assert_inks(&p, 80, 50, &[("Cyan", 0), ("Magenta", 255), ("Black", 0)]);
+}
diff --git a/crates/prepress/tests/font_reembed.rs b/crates/prepress/tests/font_reembed.rs
new file mode 100644
index 00000000..12288d29
--- /dev/null
+++ b/crates/prepress/tests/font_reembed.rs
@@ -0,0 +1,521 @@
+//! Text read from a PDF through hayro-interpret and written again with krilla: as live text
+//! when the font can be embedded again, as outlines with `/ActualText` otherwise. Covers what
+//! the PDF-in adapter relies on: glyph ids, positions, Unicode and plates survive the trip.
+//!
+//! Fonts not in the repository are read from paths and their cases are skipped when missing:
+//! Inter from `CRAFT_PDF_TEST_FONT_DIR`, a CFF-flavored OpenType font from
+//! `CRAFT_PREPRESS_CFF_FONT` (default: Debian's `fonts-urw-base35` Nimbus Sans). The Type1C
+//! case embeds hayro's Foxit Sans, which is bare CFF.
+#![cfg(feature = "flatten")]
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use craft_pdf::interpret::font::{Glyph, OutlineFontData, StandardFont};
+use craft_pdf::interpret::hayro_cmap::BfString;
+use craft_pdf::interpret::{
+    BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, InterpreterSettings, Paint, PathDrawMode, SoftMask, TransformExt,
+    interpret_page,
+};
+use craft_pdf::write::backend::color::cmyk;
+use craft_pdf::write::backend::geom::{PathBuilder, Point as KPoint, Transform};
+use craft_pdf::write::backend::page::PageSettings;
+use craft_pdf::write::backend::paint::Fill;
+use craft_pdf::write::backend::surface::Surface;
+use craft_pdf::write::backend::tagging::{ContentTag, SpanTag};
+use craft_pdf::write::backend::text::{Font, GlyphId, KrillaGlyph};
+use craft_pdf::write::backend::{self, Data};
+use craft_pdf::write::{Metadata, Writer};
+use craft_prepress::flatten::font::FontCache;
+use craft_prepress::flatten::kurbo::{Affine, BezPath, PathEl, Rect, Shape};
+use craft_prepress::flatten::{PlacedGlyph, TextFont, TextItem};
+use craft_prepress::{InkColor, InkId, Options, Overprint, Process, plates};
+
+const W: f64 = 300.0;
+const H: f64 = 120.0;
+const SAMPLE: &str = "Hamburgefonstiv 0123";
+
+// ---- fonts ---------------------------------------------------------------------------------
+
+fn read_font(path: Option<PathBuf>, what: &str) -> Option<Vec<u8>> {
+    let data = path.as_ref().and_then(|p| std::fs::read(p).ok());
+    if data.is_none() {
+        println!("note: {what} not found at {path:?}; case skipped");
+    }
+    data
+}
+
+fn inter() -> Option<Vec<u8>> {
+    read_font(std::env::var_os("CRAFT_PDF_TEST_FONT_DIR").map(|d| PathBuf::from(d).join("Inter-Regular.ttf")), "Inter (CRAFT_PDF_TEST_FONT_DIR)")
+}
+
+fn cff_otf() -> Option<Vec<u8>> {
+    let path = std::env::var_os("CRAFT_PREPRESS_CFF_FONT")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| PathBuf::from("/usr/share/fonts/opentype/urw-base35/NimbusSans-Regular.otf"));
+    read_font(Some(path), "a CFF OpenType font (CRAFT_PREPRESS_CFF_FONT)")
+}
+
+// ---- writing -------------------------------------------------------------------------------
+
+fn black() -> Fill {
+    Fill { paint: cmyk::Color::new(0, 0, 0, 255).into(), ..Default::default() }
+}
+
+fn write_page(draw: impl FnOnce(&mut Surface<'_>)) -> Vec<u8> {
+    let settings = backend::SerializeSettings { compress_content_streams: false, ..Default::default() };
+    let mut writer = Writer::new(settings, Metadata::default());
+    let mut page = writer.document_mut().start_page_with(PageSettings::from_wh(W as f32, H as f32).unwrap());
+    let mut surface = page.surface();
+    draw(&mut surface);
+    surface.finish();
+    page.finish();
+    writer.finish().unwrap()
+}
+
+/// The source document: `SAMPLE` mapped through the font's cmap (no shaping), once on a
+/// baseline and once rotated and scaled.
+fn source_pdf(font_bytes: &[u8]) -> Vec<u8> {
+    let face = ttf_parser::Face::parse(font_bytes, 0).unwrap();
+    let upem = f32::from(face.units_per_em());
+    let glyphs: Vec<_> = SAMPLE
+        .char_indices()
+        .map(|(i, c)| {
+            let id = face.glyph_index(c).unwrap();
+            let advance = f32::from(face.glyph_hor_advance(id).unwrap()) / upem;
+            KrillaGlyph::new(GlyphId::new(u32::from(id.0)), advance, 0.0, 0.0, 0.0, i..i + c.len_utf8(), None)
+        })
+        .collect();
+    let font = craft_pdf::write::font(font_bytes, 0, None).unwrap();
+    write_page(|s| {
+        s.set_fill(Some(black()));
+        s.draw_glyphs(KPoint::from_xy(10.0, 40.0), &glyphs, font.clone(), SAMPLE, 24.0, false);
+        s.push_transform(&Transform::from_row(0.96, -0.26, 0.26, 0.96, 20.0, 100.0));
+        s.draw_glyphs(KPoint::from_xy(0.0, 0.0), &glyphs, font, SAMPLE, 13.0, false);
+        s.pop();
+    })
+}
+
+fn to_krilla(a: Affine) -> Transform {
+    let [a, b, c, d, e, f] = a.as_coeffs().map(|v| v as f32);
+    Transform::from_row(a, b, c, d, e, f)
+}
+
+fn to_krilla_path(path: &BezPath) -> Option<backend::geom::Path> {
+    let mut b = PathBuilder::new();
+    for el in path.elements() {
+        match *el {
+            PathEl::MoveTo(p) => b.move_to(p.x as f32, p.y as f32),
+            PathEl::LineTo(p) => b.line_to(p.x as f32, p.y as f32),
+            PathEl::QuadTo(p1, p) => b.quad_to(p1.x as f32, p1.y as f32, p.x as f32, p.y as f32),
+            PathEl::CurveTo(p1, p2, p) => b.cubic_to(p1.x as f32, p1.y as f32, p2.x as f32, p2.y as f32, p.x as f32, p.y as f32),
+            PathEl::ClosePath => b.close(),
+        }
+    }
+    b.finish()
+}
+
+/// Writes text runs as the flattener's output would: live text through krilla when the run
+/// has a font, else its outlines with the Unicode text as `/ActualText`.
+fn rewrite(items: &[TextItem]) -> Vec<u8> {
+    let mut fonts: HashMap<u128, Font> = HashMap::new();
+    write_page(|s| {
+        s.set_fill(Some(black()));
+        for item in items {
+            let text = item.text.as_deref().unwrap_or("");
+            match &item.font {
+                Some(tf) => {
+                    let font = fonts
+                        .entry(tf.key)
+                        .or_insert_with(|| Font::new(Data::from(tf.data.clone()), tf.index).expect("krilla reads the font"))
+                        .clone();
+                    let size = item.size as f64;
+                    let glyphs: Vec<_> = item
+                        .glyphs
+                        .iter()
+                        .enumerate()
+                        .map(|(i, g)| {
+                            let next_x = item.glyphs.get(i + 1).map_or(g.origin.x, |n| n.origin.x);
+                            let x_advance = ((next_x - g.origin.x) / size) as f32;
+                            KrillaGlyph::new(GlyphId::new(g.id), x_advance, 0.0, (g.origin.y / size) as f32, 0.0, g.text.clone(), None)
+                        })
+                        .collect();
+                    // Text space is y up; krilla's glyph placement is y down.
+                    s.push_transform(&to_krilla(item.transform * Affine::scale_non_uniform(1.0, -1.0)));
+                    s.draw_glyphs(KPoint::from_xy(0.0, 0.0), &glyphs, font, text, item.size, false);
+                    s.pop();
+                }
+                None => {
+                    let span = SpanTag { actual_text: Some(text), ..SpanTag::empty() };
+                    s.start_tagged(ContentTag::Span(span));
+                    if let Some(path) = to_krilla_path(&item.outlines) {
+                        s.draw_path(&path);
+                    }
+                    s.end_tagged();
+                }
+            }
+        }
+    })
+}
+
+/// A one-page PDF from raw content and resources, objects numbered from 5.
+fn raw_pdf(content: &str, resources: &str, objects: &[String]) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    out.extend_from_slice(b"1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n");
+    out.extend_from_slice(b"2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n");
+    out.extend_from_slice(
+        format!("3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {W} {H}] /Contents 4 0 R /Resources << {resources} >> >> endobj\n").as_bytes(),
+    );
+    out.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n", content.len()).as_bytes());
+    for (i, body) in objects.iter().enumerate() {
+        out.extend_from_slice(format!("{} 0 obj {body} endobj\n", i + 5).as_bytes());
+    }
+    out.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF");
+    out
+}
+
+fn stream(dict: &str, data: &str) -> String {
+    format!("<< {dict} /Length {} >> stream\n{data}\nendstream", data.len())
+}
+
+// ---- reading -------------------------------------------------------------------------------
+
+/// What the PDF-in adapter needs from one drawn glyph.
+struct Drawn {
+    /// The font's key in the [`FontCache`]; `None` for Type3 glyphs.
+    key: Option<u128>,
+    /// What hayro hands out for the font, for the checks.
+    data: Option<OutlineFontData>,
+    id: u32,
+    /// Glyph space (1000 units per em, y up) to page space.
+    matrix: Affine,
+    unicode: Option<String>,
+    vertical: bool,
+    type3: bool,
+    outline: BezPath,
+}
+
+#[derive(Default)]
+struct Recorder {
+    glyphs: Vec<Drawn>,
+    actual_text: String,
+    fonts: FontCache,
+}
+
+#[derive(Default)]
+struct PathSink(BezPath);
+
+impl Device<'_> for PathSink {
+    fn set_soft_mask(&mut self, _: Option<SoftMask<'_>>) {}
+    fn set_blend_mode(&mut self, _: BlendMode) {}
+    fn draw_path(&mut self, path: &BezPath, transform: Affine, _: &Paint<'_>, _: &PathDrawMode) {
+        self.0.extend((transform * path.clone()).iter());
+    }
+    fn push_clip_path(&mut self, _: &ClipPath) {}
+    fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'_>>, _: BlendMode) {}
+    fn draw_glyph(&mut self, _: &Glyph<'_>, _: Affine, _: Affine, _: &Paint<'_>, _: &GlyphDrawMode) {}
+    fn draw_image(&mut self, _: Image<'_, '_>, _: Affine) {}
+    fn pop_clip_path(&mut self) {}
+    fn pop_transparency_group(&mut self) {}
+}
+
+fn unicode(s: BfString) -> String {
+    match s {
+        BfString::Char(c) => c.to_string(),
+        BfString::String(s) => s,
+    }
+}
+
+impl<'a> Device<'a> for Recorder {
+    fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
+    fn set_blend_mode(&mut self, _: BlendMode) {}
+    fn draw_path(&mut self, _: &BezPath, _: Affine, _: &Paint<'a>, _: &PathDrawMode) {}
+    fn push_clip_path(&mut self, _: &ClipPath) {}
+    fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
+    fn draw_glyph(&mut self, glyph: &Glyph<'a>, transform: Affine, glyph_transform: Affine, paint: &Paint<'a>, mode: &GlyphDrawMode) {
+        if !matches!(mode, GlyphDrawMode::Fill) {
+            return;
+        }
+        let matrix = transform * glyph_transform;
+        let drawn = match glyph {
+            Glyph::Outline(o) => Drawn {
+                key: Some(self.fonts.note(o)),
+                data: o.font_data(),
+                id: o.glyph_id().to_u32(),
+                matrix,
+                unicode: o.as_unicode().map(unicode),
+                vertical: o.is_vertical(),
+                type3: false,
+                outline: matrix * o.outline(),
+            },
+            Glyph::Type3(t) => {
+                let mut sink = PathSink::default();
+                t.interpret(&mut sink, transform, glyph_transform, paint);
+                Drawn { key: None, data: None, id: 0, matrix, unicode: t.as_unicode().map(unicode), vertical: false, type3: true, outline: sink.0 }
+            }
+        };
+        self.glyphs.push(drawn);
+    }
+    fn draw_image(&mut self, _: Image<'a, '_>, _: Affine) {}
+    fn pop_clip_path(&mut self) {}
+    fn pop_transparency_group(&mut self) {}
+    fn actual_text(&mut self, text: &[u8]) {
+        self.actual_text.push_str(&pdf_text_string(text));
+    }
+}
+
+fn pdf_text_string(bytes: &[u8]) -> String {
+    match bytes {
+        [0xFE, 0xFF, rest @ ..] => {
+            let units: Vec<u16> = rest.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes(*c)).collect();
+            String::from_utf16_lossy(&units)
+        }
+        _ => bytes.iter().map(|&b| char::from(b)).collect(),
+    }
+}
+
+fn read(pdf: &[u8]) -> Recorder {
+    let doc = craft_pdf::syntax::Pdf::new(Arc::new(pdf.to_vec())).unwrap();
+    let page = &doc.pages()[0];
+    let cache = InterpreterCache::new();
+    let mut context =
+        Context::new(page.initial_transform(true).to_kurbo(), Rect::new(0.0, 0.0, W, H), &cache, page.xref(), InterpreterSettings::default());
+    let mut recorder = Recorder::default();
+    interpret_page(page, &mut context, &mut recorder);
+    recorder
+}
+
+// ---- runs, as the adapter builds them ------------------------------------------------------
+
+fn same_linear(a: Affine, b: Affine) -> bool {
+    let (a, b) = (a.as_coeffs(), b.as_coeffs());
+    let scale = a[..4].iter().fold(0.0f64, |m, v| m.max(v.abs()));
+    a[..4].iter().zip(&b[..4]).all(|(x, y)| (x - y).abs() <= scale * 1e-6)
+}
+
+/// Groups drawn glyphs into runs: one font and one text matrix (up to translation) each.
+fn text_items(drawn: &[Drawn], fonts: &HashMap<u128, Option<Arc<TextFont>>>) -> Vec<TextItem> {
+    let mut items: Vec<TextItem> = Vec::new();
+    for d in drawn {
+        let font = d.key.and_then(|key| fonts[&key].clone());
+        let linear = d.matrix * Affine::scale(1000.0);
+        let continues = items
+            .last()
+            .is_some_and(|last| last.font == font && last.font.is_some() && same_linear(last.transform * Affine::scale(last.size as f64), linear));
+        if !continues {
+            let size = linear.determinant().abs().sqrt();
+            let origin = d.matrix.translation();
+            let [a, b, c, dd, ..] = linear.as_coeffs();
+            items.push(TextItem {
+                font: font.clone(),
+                size: size as f32,
+                transform: Affine::new([a / size, b / size, c / size, dd / size, origin.x, origin.y]),
+                glyphs: Vec::new(),
+                text: Some(String::new()),
+                outlines: BezPath::new(),
+                paint: craft_prepress::flatten::Paint::Solid(InkColor::Tints(vec![(InkId::process(Process::Black), 1.0)])),
+                overprint: Overprint::default(),
+            });
+        }
+        let item = items.last_mut().unwrap();
+        let text = item.text.as_mut().unwrap();
+        let start = text.len();
+        text.push_str(d.unicode.as_deref().unwrap_or(""));
+        let origin = item.transform.inverse() * d.matrix.translation().to_point();
+        item.glyphs.push(PlacedGlyph { id: d.id, origin, text: start..text.len() });
+        item.outlines.extend(d.outline.iter());
+    }
+    items
+}
+
+// ---- checks --------------------------------------------------------------------------------
+
+fn black_plate(pdf: &[u8]) -> Vec<u8> {
+    let p = plates(pdf, 0, 72.0, &Options::default()).unwrap();
+    p.plane(InkId::process(Process::Black)).unwrap().to_vec()
+}
+
+/// Mean and largest per-pixel difference of the black plates.
+fn plate_difference(a: &[u8], b: &[u8]) -> (f64, u8) {
+    assert_eq!(a.len(), b.len());
+    let max = a.iter().zip(b).map(|(x, y)| x.abs_diff(*y)).max().unwrap_or(0);
+    let mean = a.iter().zip(b).map(|(x, y)| f64::from(x.abs_diff(*y))).sum::<f64>() / a.len() as f64;
+    (mean, max)
+}
+
+fn text_of(r: &Recorder) -> String {
+    r.glyphs.iter().filter_map(|g| g.unicode.as_deref()).collect()
+}
+
+/// Reads `source`, writes it again from the runs, and checks positions, outlines, text and
+/// plates. Returns the runs, the source and the rewrite as read.
+fn round_trip(source: &[u8]) -> (Vec<TextItem>, Recorder, Recorder) {
+    let mut before = read(source);
+    assert!(!before.glyphs.is_empty());
+    let items = text_items(&before.glyphs, &std::mem::take(&mut before.fonts).finish());
+    let pdf = rewrite(&items);
+    let after = read(&pdf);
+
+    let (mean, max) = plate_difference(&black_plate(source), &black_plate(&pdf));
+    println!("black plates: mean difference {mean:.4}, largest {max}");
+    assert!(mean < 0.01 && max <= 4, "plates differ: mean {mean}, max {max}");
+
+    if items.iter().all(|i| i.font.is_some()) {
+        assert_eq!(after.glyphs.len(), before.glyphs.len());
+        for (b, a) in before.glyphs.iter().zip(&after.glyphs) {
+            let (pa, pb) = (a.matrix.translation(), b.matrix.translation());
+            assert!((pa - pb).hypot() < 1e-3, "glyph origin {pa:?} vs {pb:?}");
+            assert!(same_linear(a.matrix, b.matrix));
+            let (ba, bb) = (a.outline.bounding_box(), b.outline.bounding_box());
+            assert!((ba.min_x() - bb.min_x()).abs() < 1e-3 && (ba.max_y() - bb.max_y()).abs() < 1e-3, "outline {ba:?} vs {bb:?}");
+        }
+        assert_eq!(text_of(&after), text_of(&before), "Unicode survives");
+    } else {
+        assert_eq!(after.actual_text, text_of(&before), "Unicode survives as ActualText");
+    }
+    (items, before, after)
+}
+
+/// krilla keeps glyph ids when the source is one of its own subsets: those are compact in
+/// first-use order already.
+fn assert_same_ids(before: &Recorder, after: &Recorder) {
+    assert!(before.glyphs.iter().zip(&after.glyphs).all(|(b, a)| a.id == b.id), "glyph ids match");
+}
+
+/// Whether the rewrite has the text as live text in an embedded CFF font.
+fn has_live_cff(after: &Recorder) -> bool {
+    after.glyphs.iter().all(|g| g.data.as_ref().is_some_and(|d| d.embedded && (*d.data).as_ref().starts_with(&[1])))
+}
+
+#[test]
+fn truetype_text_reembeds_as_live_text() {
+    let Some(font) = inter() else { return };
+    let source = source_pdf(&font);
+    let (items, before, after) = round_trip(&source);
+    assert_eq!(items.len(), 2, "two runs: one per text matrix");
+    assert!(items.iter().all(|i| i.font.is_some()));
+    assert_same_ids(&before, &after);
+    assert_eq!(text_of(&after), SAMPLE.repeat(2));
+}
+
+#[test]
+fn cff_text_reembeds_after_wrapping_the_bare_cff() {
+    let Some(font) = cff_otf() else { return };
+    let source = source_pdf(&font);
+    assert!(String::from_utf8_lossy(&source).contains("/CIDFontType0C"), "krilla writes CFF as bare CIDFontType0C");
+    let (items, before, after) = round_trip(&source);
+    let data = before.glyphs[0].data.as_ref().unwrap().data.clone();
+    assert_eq!((*data).as_ref()[0], 1, "hayro hands out the bare CFF");
+    assert!(Font::new(Data::from(data), 0).is_none(), "krilla needs an OpenType wrapper");
+    assert!(items.iter().all(|i| i.font.is_some()));
+    assert!(has_live_cff(&after), "the rewrite embeds CFF again, not outlines");
+    assert_same_ids(&before, &after);
+    assert_eq!(text_of(&after), SAMPLE.repeat(2));
+}
+
+const TYPE3_CMAP: &str = "/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CMapName /T3 def \
+/CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def 1 begincodespacerange <00> <FF> endcodespacerange \
+2 beginbfchar <41> <0041> <42> <0042> endbfchar endcmap CMapName currentdict /CMapResource defineresource pop end end";
+
+#[test]
+fn type3_text_falls_back_to_outlines_with_actual_text() {
+    let font = "<< /Type /Font /Subtype /Type3 /FontBBox [0 0 1000 1000] /FontMatrix [0.001 0 0 0.001 0 0] \
+        /CharProcs << /a 6 0 R /b 7 0 R >> /Encoding << /Type /Encoding /Differences [65 /a /b] >> \
+        /FirstChar 65 /LastChar 66 /Widths [1000 1000] /Resources << >> /ToUnicode 8 0 R >>";
+    let objects = [
+        font.to_owned(),
+        stream("", "1000 0 0 0 800 800 d1 0 0 800 800 re f"),
+        stream("", "1000 0 0 0 800 800 d1 0 0 m 800 0 l 400 800 l f"),
+        stream("", TYPE3_CMAP),
+    ];
+    let source = raw_pdf("0 0 0 1 k BT /F1 30 Tf 10 30 Td (ABBA) Tj ET", "/Font << /F1 5 0 R >>", &objects);
+    let (items, before, _) = round_trip(&source);
+    assert!(before.glyphs.iter().all(|g| g.type3 && g.key.is_none()));
+    assert!(items.iter().all(|i| i.font.is_none()));
+}
+
+#[test]
+fn standard_14_text_has_no_font_bytes_and_falls_back_to_outlines() {
+    let source = raw_pdf(
+        "0 0 0 1 k BT /F1 24 Tf 10 40 Td (Hamburg) Tj ET",
+        "/Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> >>",
+        &[],
+    );
+    let (items, before, _) = round_trip(&source);
+    assert!(before.glyphs.iter().all(|g| !g.type3 && g.data.is_none()), "hayro returns no bytes for standard fonts");
+    assert!(items.iter().all(|i| i.font.is_none()));
+    assert_eq!(text_of(&before), "Hamburg");
+}
+
+#[test]
+fn vertical_text_reembeds_as_horizontal_glyphs_at_their_positions() {
+    let Some(font) = cff_otf().or_else(inter) else { return };
+    let mut source = source_pdf(&font);
+    let at: Vec<usize> = source.windows(11).enumerate().filter(|(_, w)| *w == b"/Identity-H").map(|(i, _)| i).collect();
+    assert_eq!(at.len(), 1, "one Type0 font");
+    // Same length, so the cross-reference offsets stay valid.
+    source[at[0] + 10] = b'V';
+    let (items, before, after) = round_trip(&source);
+    assert!(before.glyphs.iter().all(|g| g.vertical));
+    assert!(items.iter().all(|i| i.font.is_some()));
+    assert_same_ids(&before, &after);
+    assert!(after.glyphs.iter().all(|g| !g.vertical), "krilla writes horizontal fonts only");
+}
+
+const IDENTITY_CMAP: &str = "/CIDInit /ProcSet findresource begin 12 dict begin begincmap /CMapName /U def \
+/CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def 1 begincodespacerange <0000> <FFFF> endcodespacerange \
+2 beginbfchar <0041> <0041> <0042> <0042> endbfchar endcmap CMapName currentdict /CMapResource defineresource pop end end";
+
+#[test]
+fn a_non_embedded_cid_font_falls_back_to_outlines() {
+    let objects = [
+        "<< /Type /Font /Subtype /Type0 /BaseFont /NotEmbedded /Encoding /Identity-H /DescendantFonts [6 0 R] /ToUnicode 8 0 R >>".to_owned(),
+        "<< /Type /Font /Subtype /CIDFontType2 /BaseFont /NotEmbedded /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity) /Supplement 0 >> \
+            /FontDescriptor 7 0 R >>"
+            .to_owned(),
+        "<< /Type /FontDescriptor /FontName /NotEmbedded /Flags 32 /FontBBox [0 0 1000 1000] /ItalicAngle 0 /Ascent 800 /Descent -200 \
+            /CapHeight 700 /StemV 80 >>"
+            .to_owned(),
+        stream("", IDENTITY_CMAP),
+    ];
+    let source = raw_pdf("0 0 0 1 k BT /F1 24 Tf 10 40 Td <00410042> Tj ET", "/Font << /F1 5 0 R >>", &objects);
+    let (items, before, _) = round_trip(&source);
+    // hayro hands out the font resolver's substitute, marked as not embedded.
+    assert!(before.glyphs.iter().all(|g| g.data.as_ref().is_some_and(|d| !d.embedded)));
+    assert!(items.iter().all(|i| i.font.is_none()));
+    assert_eq!(text_of(&before), "AB");
+}
+
+/// A simple font with `FontFile3/Type1C`: hayro's Foxit Sans substitute, which is bare CFF,
+/// hex-encoded so the PDF stays text. The widths are made up; positions follow them.
+fn type1c_pdf() -> Vec<u8> {
+    let (data, _) = StandardFont::Helvetica.get_font_data();
+    let hex: String = (*data).as_ref().iter().map(|b| format!("{b:02x}")).collect();
+    let widths: Vec<String> = (32..=126).map(|c| (400 + c % 7 * 50).to_string()).collect();
+    let objects = [
+        format!(
+            "<< /Type /Font /Subtype /Type1 /BaseFont /ChromSansOTF /FirstChar 32 /LastChar 126 /Widths [{}] \
+            /Encoding /WinAnsiEncoding /FontDescriptor 6 0 R >>",
+            widths.join(" ")
+        ),
+        "<< /Type /FontDescriptor /FontName /ChromSansOTF /Flags 32 /FontBBox [-166 -225 1000 931] /ItalicAngle 0 /Ascent 718 \
+            /Descent -207 /CapHeight 718 /StemV 88 /FontFile3 7 0 R >>"
+            .to_owned(),
+        stream("/Subtype /Type1C /Filter /ASCIIHexDecode", &format!("{hex}>")),
+    ];
+    let content = format!("0 0 0 1 k BT /F1 24 Tf 10 40 Td ({SAMPLE}) Tj ET BT /F1 13 Tf 0.96 0.26 -0.26 0.96 20 80 Tm ({SAMPLE}) Tj ET");
+    raw_pdf(&content, "/Font << /F1 5 0 R >>", &objects)
+}
+
+#[test]
+fn type1c_text_reembeds_after_wrapping_the_cff() {
+    let source = type1c_pdf();
+    let (items, before, after) = round_trip(&source);
+    assert!(before.glyphs.iter().all(|g| g.data.as_ref().is_some_and(|d| d.embedded && (*d.data).as_ref()[0] == 1)), "bare CFF from the file");
+    assert_eq!(items.len(), 2);
+    assert!(items.iter().all(|i| i.font.is_some()));
+    assert!(has_live_cff(&after), "the rewrite embeds CFF again, not outlines");
+    assert_eq!(text_of(&after), SAMPLE.repeat(2));
+}
diff --git a/crates/prepress/tests/plates.rs b/crates/prepress/tests/plates.rs
new file mode 100644
index 00000000..791d4a44
--- /dev/null
+++ b/crates/prepress/tests/plates.rs
@@ -0,0 +1,276 @@
+use std::sync::Arc;
+
+use craft_cms::{Intent, Profile, Transform, builtin};
+use craft_prepress::{Alternate, CmsConversion, Conversion, Error, Fallback, Ink, InkId, MAX_SPOT_INKS, Options, Process, plates};
+
+/// A 40 × 40 pt page with `content` and `resources`, `catalog` entries, and `objects`
+/// numbered from 5 (each a whole object body).
+fn page_pdf(content: &str, resources: &str, catalog: &str, objects: &[Vec<u8>]) -> Vec<u8> {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    out.extend_from_slice(format!("1 0 obj << /Type /Catalog /Pages 2 0 R {catalog} >> endobj\n").as_bytes());
+    out.extend_from_slice(b"2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n");
+    out.extend_from_slice(
+        format!("3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << {resources} >> >> endobj\n").as_bytes(),
+    );
+    out.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n", content.len()).as_bytes());
+    for (i, body) in objects.iter().enumerate() {
+        out.extend_from_slice(format!("{} 0 obj ", i + 5).as_bytes());
+        out.extend_from_slice(body);
+        out.extend_from_slice(b" endobj\n");
+    }
+    out.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF");
+    out
+}
+
+fn stream(dict: &str, data: &[u8]) -> Vec<u8> {
+    let mut out = format!("<< {dict} /Length {} >> stream\n", data.len()).into_bytes();
+    out.extend_from_slice(data);
+    out.extend_from_slice(b"\nendstream");
+    out
+}
+
+/// A spot color whose alternate is a yellowish CMYK.
+const GOLD: &str = "[/Separation /Gold /DeviceCMYK << /FunctionType 2 /Domain [0 1] /C0 [0 0 0 0] /C1 [0 0.3 1 0] /N 1 >>]";
+
+/// Black over the page, Gold at 50% in the middle square, overprinting when `gs` sets `op`.
+fn black_and_gold(gs: &str) -> Vec<u8> {
+    let resources = format!("/ColorSpace << /CS0 {GOLD} >> /ExtGState << /OP << /op true >> >>");
+    page_pdf(&format!("0 0 0 1 k 0 0 40 40 re f {gs} /CS0 cs 0.5 scn 10 10 20 20 re f"), &resources, "", &[])
+}
+
+fn black() -> InkId {
+    InkId::process(Process::Black)
+}
+
+#[test]
+fn a_black_and_gold_page_separates_into_the_process_plates_and_gold() {
+    let p = plates(&black_and_gold(""), 0, 72.0, &Options::default()).unwrap();
+    assert_eq!((p.width, p.height, p.dpi), (40, 40, 72.0));
+    let names: Vec<&str> = p.inks.iter().map(|(_, ink)| ink.name()).collect();
+    assert_eq!(names, ["Cyan", "Magenta", "Yellow", "Black", "Gold"]);
+    assert_eq!(p.planes.len(), 5);
+    assert!(p.unseparated.is_empty());
+    let gold = p.inks.lookup("Gold").unwrap();
+    let Some(Ink::Spot(spot)) = p.inks.get(gold) else { panic!("Gold is a spot ink") };
+    let Alternate::Lab([l, _, b]) = spot.alternate else { panic!("a Lab alternate") };
+    assert!(l > 60.0 && b > 40.0, "Gold looks yellow: {:?}", spot.alternate);
+
+    let half = |t: Option<u8>| t.is_some_and(|t| t.abs_diff(128) <= 1);
+    assert!(half(p.tint(gold, 20, 20)), "Gold at 50%");
+    assert_eq!(p.tint(black(), 20, 20), Some(0), "Gold knocks out black");
+    assert_eq!(p.tint(black(), 2, 2), Some(255));
+    assert_eq!(p.tint(gold, 2, 2), Some(0));
+    for c in [Process::Cyan, Process::Magenta, Process::Yellow] {
+        assert!(p.plane(InkId::process(c)).unwrap().iter().all(|t| *t == 0), "{c:?} is empty");
+    }
+
+    let over = plates(&black_and_gold("/OP gs"), 0, 72.0, &Options::default()).unwrap();
+    assert!(half(over.tint(gold, 20, 20)));
+    assert_eq!(over.tint(black(), 20, 20), Some(255), "overprinted");
+    let off = plates(&black_and_gold("/OP gs"), 0, 72.0, &Options { overprint: false, ..Options::default() }).unwrap();
+    assert_eq!(off.tint(black(), 20, 20), Some(0), "overprint off: knocked out");
+
+    // The preview reads the plates: knocked-out Gold shows pale on paper, overprinted Gold
+    // darkens the black under it.
+    let cms = CmsConversion::fogra39();
+    let px = |rgb: &[u8], x: usize, y: usize| -> [u8; 3] { rgb[(y * 40 + x) * 3..][..3].try_into().unwrap() };
+    let (knockout, overprint) = (p.composite(&[], &cms), over.composite(&[], &cms));
+    let [r, g, b] = px(&knockout, 20, 20);
+    assert!(r > 200 && g > 180 && b < g, "50% Gold on paper: {:?}", [r, g, b]);
+    let k = px(&knockout, 2, 2);
+    assert!(k.iter().all(|c| *c < 80), "black: {k:?}");
+    assert_eq!(px(&overprint, 2, 2), k);
+    let dark = px(&overprint, 20, 20);
+    assert!(dark.iter().zip(k).all(|(d, k)| *d <= k) && dark[2] < k[2], "Gold over black: {dark:?}, black {k:?}");
+}
+
+/// What `profile` prints for sRGB red, as tint bytes.
+fn red_in(profile: &[u8]) -> [u8; 4] {
+    let t = Transform::new(builtin::srgb(), &Profile::parse(profile).unwrap(), Intent::RelativeColorimetric, false).unwrap();
+    let mut cmyk = [0.0_f32; 4];
+    t.convert_f32(&[1.0, 0.0, 0.0], 3, &mut cmyk, 4, false).unwrap();
+    cmyk.map(|v| (v * 255.0).round() as u8)
+}
+
+fn red_tints(p: &craft_prepress::Plates) -> [u8; 4] {
+    Process::ALL.map(|c| p.tint(InkId::process(c), 20, 20).unwrap())
+}
+
+fn near(got: [u8; 4], expected: [u8; 4]) -> bool {
+    got.iter().zip(expected).all(|(g, e)| g.abs_diff(e) <= 3)
+}
+
+#[test]
+fn process_color_converts_through_the_output_intent_else_the_fallback() {
+    let synthetic = builtin::COATED_CMYK_ICC;
+    let intent = "/OutputIntents [<< /Type /OutputIntent /S /GTS_PDFX /OutputConditionIdentifier (Synthetic press) /DestOutputProfile 5 0 R >>]";
+    let red = |catalog: &str| page_pdf("1 0 0 rg 0 0 40 40 re f", "", catalog, &[stream("/N 4", synthetic)]);
+
+    let p = plates(&red(intent), 0, 72.0, &Options::default()).unwrap();
+    let profile = craft_cms::synth::DESCRIPTION.to_string();
+    assert_eq!(p.conversion, Conversion::OutputIntent { profile: profile.clone(), condition: Some("Synthetic press".into()) });
+    let expected = red_in(synthetic);
+    assert!(near(red_tints(&p), expected), "{:?}, the output intent prints {expected:?}", red_tints(&p));
+
+    let fogra = plates(&red(""), 0, 72.0, &Options::default()).unwrap();
+    assert_eq!(fogra.conversion, Conversion::Fallback { profile: builtin::COATED_FOGRA39_DESCRIPTION.into() });
+    let expected = red_in(builtin::COATED_FOGRA39_ICC);
+    assert!(near(red_tints(&fogra), expected), "{:?}, FOGRA39 prints {expected:?}", red_tints(&fogra));
+
+    let callers = Options { fallback: Fallback::Profile(Arc::from(synthetic)), ..Options::default() };
+    assert_eq!(plates(&red(""), 0, 72.0, &callers).unwrap().conversion, Conversion::Fallback { profile });
+
+    let formulas = Options { fallback: Fallback::DeviceFormulas, ..Options::default() };
+    let device = plates(&red(""), 0, 72.0, &formulas).unwrap();
+    assert_eq!((device.conversion.clone(), red_tints(&device)), (Conversion::DeviceFormulas, [0, 255, 255, 0]));
+
+    let broken = Options { fallback: Fallback::Profile(Arc::from(&b"not a profile"[..])), ..Options::default() };
+    assert!(matches!(plates(&red(""), 0, 72.0, &broken), Err(Error::Profile(_))));
+}
+
+#[test]
+fn spot_inks_past_the_cap_are_listed_not_separated_and_bad_input_is_refused() {
+    let n = MAX_SPOT_INKS + 2;
+    let spaces: String =
+        (0..n).map(|i| format!("/S{i} [/Separation /Spot{i} /DeviceGray << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >>] ")).collect();
+    let content: String = (0..n).map(|i| format!("/S{i} cs 1 scn {i} 0 1 1 re f ")).collect();
+    let pdf = page_pdf(&content, &format!("/ColorSpace << {spaces} >>"), "", &[]);
+    let p = plates(&pdf, 0, 72.0, &Options::default()).unwrap();
+    assert_eq!((p.inks.len(), p.planes.len()), (4 + MAX_SPOT_INKS, 4 + MAX_SPOT_INKS));
+    assert_eq!(p.unseparated, [format!("Spot{}", n - 2), format!("Spot{}", n - 1)]);
+
+    assert!(matches!(plates(&pdf, 1, 72.0, &Options::default()), Err(Error::NoPage(1))));
+    assert!(matches!(plates(&pdf, 0, f32::NAN, &Options::default()), Err(Error::InvalidDpi)));
+    assert!(matches!(plates(b"not a pdf", 0, 72.0, &Options::default()), Err(Error::Open(_))));
+}
+
+#[test]
+fn escaped_spot_names_are_decoded_once_and_each_gets_its_own_plate() {
+    // `/A#2341` is the spot `A#41`, not `AA`; `/Spot#20#2312` is `Spot #12`.
+    let names = ["/A#2341", "/AA", "/Spot#20#2312"];
+    let spaces: String = names
+        .iter()
+        .enumerate()
+        .map(|(i, name)| format!("/S{i} [/Separation {name} /DeviceGray << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >>] "))
+        .collect();
+    let content: String = (0..names.len()).map(|i| format!("/S{i} cs 1 scn {} 0 10 10 re f ", i * 10)).collect();
+    let pdf = page_pdf(&content, &format!("/ColorSpace << {spaces} >>"), "", &[]);
+    let p = plates(&pdf, 0, 72.0, &Options::default()).unwrap();
+    let spots: Vec<&str> = p.inks.spots().map(|(_, s)| s.name.as_str()).collect();
+    assert_eq!(spots, ["A#41", "AA", "Spot #12"]);
+    assert!(p.unseparated.is_empty());
+    assert_eq!(p.planes.len(), 7);
+    for (i, (id, _)) in p.inks.spots().enumerate() {
+        for x in [5u32, 15, 25] {
+            let expected = if (x / 10) as usize == i { 255 } else { 0 };
+            assert_eq!(p.tint(id, x, 35), Some(expected), "spot {i} at x = {x}");
+        }
+    }
+}
+
+#[test]
+fn lab_colors_convert_through_the_profile_and_lab_white_is_paper() {
+    let resources = "/ColorSpace << /D50 [/Lab << /WhitePoint [0.9642 1 0.8249] >>] /D65 [/Lab << /WhitePoint [0.9505 1 1.089] >>] >>";
+    let pdf = page_pdf("/D50 cs 50 20 -10 scn 0 0 20 40 re f /D65 cs 100 0 0 scn 20 0 20 40 re f", resources, "", &[]);
+    let p = plates(&pdf, 0, 72.0, &Options::default()).unwrap();
+    let at = |x| Process::ALL.map(|c| p.tint(InkId::process(c), x, 20).unwrap());
+    let fogra = Profile::parse(builtin::COATED_FOGRA39_ICC).unwrap();
+    let t = Transform::new(craft_cms::Builtin::LabD50.profile(), &fogra, Intent::RelativeColorimetric, false).unwrap();
+    let mut cmyk = [0.0_f32; 4];
+    t.convert_f32(&[0.5, 148.0 / 255.0, 118.0 / 255.0], 3, &mut cmyk, 4, false).unwrap();
+    let expected = cmyk.map(|v| (v * 255.0).round() as u8);
+    assert!(near(at(10), expected), "{:?}, FOGRA39 prints {expected:?}", at(10));
+    assert_eq!(at(30), [0, 0, 0, 0], "a Lab space's own white prints as paper");
+}
+
+/// A 60 × 10 pt page written by the PDF writer, with a 10 pt wide fill of each color.
+fn written(colors: Vec<craft_pdf::write::backend::color::Color>) -> Vec<u8> {
+    use craft_pdf::write::backend::{geom, page::PageSettings, paint::Fill};
+    let mut writer = craft_pdf::write::Writer::new(Default::default(), Default::default());
+    let mut page = writer.document_mut().start_page_with(PageSettings::new(geom::Size::from_wh(60.0, 10.0).unwrap()));
+    let mut surface = page.surface();
+    for (i, color) in colors.into_iter().enumerate() {
+        let mut path = geom::PathBuilder::new();
+        path.push_rect(geom::Rect::from_xywh(10.0 * i as f32, 0.0, 10.0, 10.0).unwrap());
+        surface.set_fill(Some(Fill { paint: color.into(), ..Default::default() }));
+        surface.draw_path(&path.finish().unwrap());
+    }
+    surface.finish();
+    page.finish();
+    writer.finish().unwrap()
+}
+
+/// The page's color space resources as (family, colorant names), sorted.
+fn color_spaces(pdf: &[u8]) -> Vec<(String, Vec<String>)> {
+    use craft_pdf::syntax::object::{Array, Name, Object};
+    let pdf = craft_pdf::syntax::Pdf::new(Arc::new(pdf.to_vec())).unwrap();
+    let page = pdf.pages().iter().next().unwrap();
+    let spaces = &page.resources().color_spaces;
+    let mut out: Vec<(String, Vec<String>)> = spaces
+        .keys()
+        .map(|key| {
+            let array = spaces.get::<Array<'_>>(key.as_ref()).unwrap();
+            let items: Vec<Object<'_>> = array.iter::<Object<'_>>().collect();
+            let Some(Object::Name(family)) = items.first() else { panic!("a color space without a family") };
+            let names = match items.get(1) {
+                Some(Object::Name(n)) => vec![n.as_str().to_owned()],
+                Some(Object::Array(a)) => a.iter::<Name<'_>>().map(|n| n.as_str().to_owned()).collect(),
+                _ => Vec::new(),
+            };
+            (family.as_str().to_owned(), names)
+        })
+        .collect();
+    out.sort();
+    out
+}
+
+#[test]
+fn ink_colors_write_as_cmyk_separation_or_device_n_and_separate_onto_their_plates() {
+    use craft_prepress::{InkColor, InkSet, Spot, to_pdf_color};
+    let mut inks = InkSet::new();
+    let gold = inks.add(Ink::Spot(Spot { name: "Gold".into(), alternate: Alternate::Cmyk([0.0, 0.3, 1.0, 0.0]), solidity: None })).unwrap();
+    let teal = inks.add(Ink::Spot(Spot { name: "Teal".into(), alternate: Alternate::Lab([55.0, -40.0, -10.0]), solidity: None })).unwrap();
+    let (c, k) = (InkId::process(Process::Cyan), black());
+    let cms = CmsConversion::fogra39();
+    let colors = [
+        InkColor::Tints(vec![(k, 0.4), (c, 0.6)]),
+        InkColor::Tints(vec![(gold, 0.5)]),
+        InkColor::Tints(vec![(gold, 1.0), (k, 0.5)]),
+        InkColor::Tints(vec![(teal, 1.0)]),
+        InkColor::All(1.0),
+        InkColor::None,
+    ];
+    let pdf = written(colors.iter().map(|color| to_pdf_color(color, &inks, &cms).unwrap()).collect());
+    let names = |n: &[&str]| n.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+    let mut expected = vec![
+        ("DeviceN".to_owned(), names(&["Black", "Gold"])),
+        ("Separation".to_owned(), names(&["All"])),
+        ("Separation".to_owned(), names(&["Gold"])),
+        ("Separation".to_owned(), names(&["None"])),
+        ("Separation".to_owned(), names(&["Teal"])),
+    ];
+    expected.sort();
+    assert_eq!(color_spaces(&pdf), expected, "process only is DeviceCMYK, which needs no resource");
+
+    let p = plates(&pdf, 0, 72.0, &Options::default()).unwrap();
+    let names: Vec<&str> = p.inks.iter().map(|(_, ink)| ink.name()).collect();
+    assert_eq!(names, ["Cyan", "Magenta", "Yellow", "Black", "Gold", "Teal"]);
+    let (gold, teal) = (p.inks.lookup("Gold").unwrap(), p.inks.lookup("Teal").unwrap());
+    let at = |x: u32| -> Vec<u8> { p.inks.iter().map(|(id, _)| p.tint(id, x, 5).unwrap()).collect() };
+    assert_eq!(at(5), [153, 0, 0, 102, 0, 0]);
+    assert_eq!(at(15), [0, 0, 0, 0, 128, 0]);
+    assert_eq!(at(25), [0, 0, 0, 128, 255, 0]);
+    assert_eq!(at(35), [0, 0, 0, 0, 0, 255]);
+    assert_eq!(at(45), [255; 6], "registration");
+    assert_eq!(at(55), [0; 6]);
+    assert_eq!((p.tint(gold, 25, 5), p.tint(teal, 35, 5)), (Some(255), Some(255)));
+
+    let unknown = InkSet::new();
+    assert_eq!(to_pdf_color(&colors[1], &unknown, &cms), None, "an ink not in the set");
+    assert_eq!(to_pdf_color(&InkColor::Tints(vec![]), &inks, &cms), None, "no ink: nothing to paint");
+    let mut many = InkSet::new();
+    let tints: Vec<(InkId, f32)> = (0..33)
+        .map(|i| (many.add(Ink::Spot(Spot { name: format!("S{i}"), alternate: Alternate::Cmyk([0.0; 4]), solidity: None })).unwrap(), 1.0))
+        .collect();
+    assert_eq!(to_pdf_color(&InkColor::Tints(tints), &many, &cms), None, "more than 32 colorants");
+}
diff --git a/crates/print/Cargo.toml b/crates/print/Cargo.toml
index 1f5aa1a8..1e6a6350 100644
--- a/crates/print/Cargo.toml
+++ b/crates/print/Cargo.toml
@@ -27,11 +27,11 @@ winsafe = { version = "0.0.29", default-features = false, features = ["winspool"
 # The job file's private folder.
 tempfile = "3"
 # Reading the PrintTicket and PrintCapabilities the driver hands back.
-roxmltree = "0.20"
+roxmltree = "0.21"
 # Inflating the print-ready PDF's cross-reference and object streams (src/sheets.rs).
-miniz_oxide = "0.8"
+miniz_oxide = "0.9"
 
 [dev-dependencies]
 tempfile = "3"
-roxmltree = "0.20"
-miniz_oxide = "0.8"
+roxmltree = "0.21"
+miniz_oxide = "0.9"
diff --git a/crates/print/README.md b/crates/print/README.md
index 00b12689..22d39e43 100644
--- a/crates/print/README.md
+++ b/crates/print/README.md
@@ -81,10 +81,21 @@ their own fidelity checks.
 
 Native Windows PDF submission checks the driver's validated copy count and explicit
 simplex/duplex and grayscale requests before sending. Collation must be retained when both
-the page count and copy count exceed one. A driver that drops or changes these options is
-refused; select supported options or flatten grayscale into the print-ready page content.
-Without an explicit duplex request, the queue default applies. Normal color output retains
-the driver's color policy. Single-page or single-copy jobs have no collating order to check.
+the page count and copy count exceed one. A driver that offers one of these options and drops
+or changes it is refused; select supported options or flatten grayscale into the print-ready
+page content. A driver without the feature, per its PrintCapabilities, is accepted when it can
+only do what was asked: one-sided on a queue with no two-sided feature, grayscale on one with no
+colour option, uncollated copies on one that can't collate. Two-sided on such a queue is
+refused. Windows doesn't document collating for a driver that can't collate, so collated copies
+on one are a single job of one copy that holds the document's pages once per copy; on two-sided
+paper an odd page count gets a blank page after each copy but the last, so every copy starts on
+a sheet of its own. Where one job would print the copies wrongly or can't hold them (pages with
+annotations, an encrypted PDF, a very large job, a queue set to several pages per sheet, binding,
+stapling or a two-sided option outside the Print Schema's), each copy is a job of its own.
+Without an explicit duplex request, the queue default applies. Without a grayscale request the
+ticket names no colour, so the colour in the user's printing preferences (Properties…, or
+Windows Settings) applies, black and white included. Single-page or single-copy jobs have no
+collating order to check.
 
 `cargo test -p craft-print` tests CUPS transport (including pipe-sized jobs and refusal),
 printer parsing, PPD options and argument mapping, and on every platform the Windows pieces that
diff --git a/crates/print/src/lib.rs b/crates/print/src/lib.rs
index 3c26974a..ecf97508 100644
--- a/crates/print/src/lib.rs
+++ b/crates/print/src/lib.rs
@@ -483,7 +483,9 @@ pub fn submit(pdf: &[u8], job: &Job) -> Result<String, Error> {
 
 /// [`submit`] with Windows sheet-processing progress: `(processed, sheets)` before the first
 /// sheet and after each sheet is successfully added to the native print job. Counts refer to
-/// source PDF sheets, regardless of copies or duplex. CUPS reports no progress.
+/// source PDF sheets, regardless of copies or duplex, except for collated copies on a driver
+/// that can't collate: every copy's sheets are sent, in one job or a job per copy, and counted
+/// together. CUPS reports no progress.
 ///
 /// The callback runs synchronously on the thread calling this function, need not be `Send`,
 /// and should return promptly. It is never retained. All sheets processed is not terminal
@@ -590,7 +592,7 @@ fn windows_preview(job: &Job) -> Vec<String> {
                 Scaling::ShrinkToFit => "shrink-to-fit",
             }
         ),
-        format!("color={}", if job.grayscale { "monochrome" } else { "color" }),
+        format!("color={}", if job.grayscale { "monochrome" } else { "(driver default)" }),
     ]
 }
 
diff --git a/crates/print/src/sheets.rs b/crates/print/src/sheets.rs
index bbb4c7c7..56303d2f 100644
--- a/crates/print/src/sheets.rs
+++ b/crates/print/src/sheets.rs
@@ -31,6 +31,8 @@ const MAX_TOKENS: usize = 16 << 20;
 const MAX_OBJECT_NODES: usize = 32_000;
 const MAX_OBJECT_TOKENS: usize = 1 << 20;
 const MAX_SECTIONS: usize = 256;
+/// The most the page objects of repeated copies ([`Repeat`]) may take, in bytes.
+const MAX_REPEATED: usize = 64 << 20;
 /// A page without a MediaBox (invalid, but readers accept it) is US Letter.
 const DEFAULT_MEDIA: [f64; 4] = [0.0, 0.0, 612.0, 792.0];
 /// Sheet sizes this close, in points (0.18 mm), are the same size.
@@ -515,6 +517,53 @@ fn indirect<'a>(data: &'a [u8], offset: usize, budget: &mut Budget) -> Option<In
     Some(Indirect { num, obj, stream })
 }
 
+/// How an inflate ended.
+enum Inflated {
+    /// The whole stream, within the limit.
+    Done(Vec<u8>),
+    /// The output would pass the limit.
+    Exhausted,
+    /// A damaged or truncated stream: only the bytes actually written before the damage.
+    Damaged(Vec<u8>),
+}
+
+/// Inflate `raw` (zlib-wrapped or bare deflate) to at most `limit` bytes. Unlike the
+/// `decompress_to_vec*` helpers it reports the bytes the decompressor really wrote, so a stream
+/// rejected early yields an empty `Damaged`, never the zero-filled output buffer.
+fn inflate(raw: &[u8], zlib: bool, limit: usize) -> Inflated {
+    use miniz_oxide::inflate::TINFLStatus;
+    use miniz_oxide::inflate::core::{DecompressorOxide, decompress, inflate_flags};
+    let flags = inflate_flags::TINFL_FLAG_USING_NON_WRAPPING_OUTPUT_BUF | if zlib { inflate_flags::TINFL_FLAG_PARSE_ZLIB_HEADER } else { 0 };
+    let mut out = vec![0u8; raw.len().saturating_mul(2).max(64).min(limit)];
+    let mut state = Box::<DecompressorOxide>::default();
+    let (mut input, mut written) = (raw, 0usize);
+    loop {
+        let (status, consumed, wrote) = decompress(&mut state, input, &mut out, written, flags);
+        written = written.saturating_add(wrote).min(out.len());
+        match status {
+            TINFLStatus::Done => {
+                out.truncate(written);
+                return Inflated::Done(out);
+            }
+            TINFLStatus::HasMoreOutput => {
+                if out.len() >= limit {
+                    return Inflated::Exhausted;
+                }
+                let Some(rest) = input.get(consumed..) else {
+                    out.truncate(written);
+                    return Inflated::Damaged(out);
+                };
+                input = rest;
+                out.resize(out.len().saturating_mul(2).min(limit), 0);
+            }
+            _ => {
+                out.truncate(written);
+                return Inflated::Damaged(out);
+            }
+        }
+    }
+}
+
 /// A stream's data with its filters undone: FlateDecode (with PNG predictors), or none.
 fn decode(dict: &Dict, raw: &[u8], budget: &mut Budget) -> Option<Vec<u8>> {
     if budget.exhausted {
@@ -545,20 +594,22 @@ fn decode(dict: &Dict, raw: &[u8], budget: &mut Budget) -> Option<Vec<u8>> {
             Some(raw.to_vec())
         }
         [b"FlateDecode" | b"Fl"] => {
-            let inflated = match miniz_oxide::inflate::decompress_to_vec_zlib_with_limit(raw, limit) {
-                Ok(v) => v,
-                Err(e) if e.status == miniz_oxide::inflate::TINFLStatus::HasMoreOutput => {
+            let inflated = match inflate(raw, true, limit) {
+                Inflated::Done(v) => v,
+                Inflated::Exhausted => {
                     budget.exhausted = true;
                     return None;
                 }
                 // A damaged stream: what inflated before the damage, as other readers do.
-                Err(e) if !e.output.is_empty() => e.output,
-                Err(_) => match miniz_oxide::inflate::decompress_to_vec_with_limit(raw, limit) {
-                    Ok(v) => v,
-                    Err(e) => {
-                        budget.exhausted |= e.status == miniz_oxide::inflate::TINFLStatus::HasMoreOutput;
+                Inflated::Damaged(v) if !v.is_empty() => v,
+                // Rejected before any output: retry as a bare deflate stream.
+                Inflated::Damaged(_) => match inflate(raw, false, limit) {
+                    Inflated::Done(v) => v,
+                    Inflated::Exhausted => {
+                        budget.exhausted = true;
                         return None;
                     }
+                    Inflated::Damaged(_) => return None,
                 },
             };
             unpredict(&inflated, parms, limit)
@@ -814,12 +865,18 @@ pub(crate) struct Sheet {
     /// The page object (number, generation); `None` for a page written inside its parent.
     obj: Option<(u32, u16)>,
     dict: Dict,
+    /// The MediaBox, inherited or not.
+    media: [f64; 4],
     /// The visible box (CropBox within MediaBox), in the page's own unrotated space.
     pub(crate) bounds: [f64; 4],
+    /// `/Resources` inherited from the page tree; `None` when the page has its own or none.
+    resources: Option<Arc<Obj>>,
     /// `/Rotate`, 0, 90, 180 or 270.
     pub(crate) rotate: u32,
     /// Annotation flags match the renderer's visible printing behavior.
     print_annotations_safe: bool,
+    /// `/Annots` lists at least one annotation.
+    annotated: bool,
 }
 
 impl Sheet {
@@ -835,6 +892,7 @@ pub(crate) struct Sheets<'a> {
     data: &'a [u8],
     pub(crate) sheets: Vec<Sheet>,
     trailer: Dict,
+    catalog: Dict,
     /// The newest cross-reference section is a stream (so is the update's).
     xref_stream: bool,
     startxref: usize,
@@ -848,6 +906,7 @@ struct Inherited {
     media: Option<Arc<Obj>>,
     crop: Option<Arc<Obj>>,
     rotate: Option<Arc<Obj>>,
+    resources: Option<Arc<Obj>>,
 }
 
 /// Read the sheets of a print-ready PDF.
@@ -905,10 +964,14 @@ pub(crate) fn read(data: &[u8]) -> Result<Sheets<'_>, Error> {
             _ => None,
         };
         let mut dict = reader.resolve(&node).and_then(|d| d.dict().cloned()).ok_or_else(|| unreadable("a page is missing"))?;
+        // A null value is the same as no entry (ISO 32000-1, 7.3.9), so it inherits.
+        let own = |key: &[u8]| get(&dict, key).filter(|v| **v != Obj::Null).cloned().map(Arc::new);
+        let parent_resources = inherited.resources.clone();
         let here = Inherited {
-            media: get(&dict, b"MediaBox").cloned().map(Arc::new).or(inherited.media),
-            crop: get(&dict, b"CropBox").cloned().map(Arc::new).or(inherited.crop),
-            rotate: get(&dict, b"Rotate").cloned().map(Arc::new).or(inherited.rotate),
+            media: own(b"MediaBox").or(inherited.media),
+            crop: own(b"CropBox").or(inherited.crop),
+            rotate: own(b"Rotate").or(inherited.rotate),
+            resources: own(b"Resources").or(inherited.resources),
         };
         let kids = get(&dict, b"Kids").cloned().and_then(|k| reader.resolve(&k));
         let is_node = get(&dict, b"Type").and_then(Obj::name) == Some(b"Pages") || (get(&dict, b"Type").is_none() && kids.is_some());
@@ -955,20 +1018,31 @@ pub(crate) fn read(data: &[u8]) -> Result<Sheets<'_>, Error> {
         let rotate = if rotate % 90 == 0 { u32::try_from(rotate).unwrap_or(0) } else { 0 };
         // Windows renders viewer visibility, not annotation print visibility. Only a plain
         // visible printable annotation is safe; flatten other flags before native submission.
-        let print_annotations_safe = match get(&dict, b"Annots") {
-            None | Some(Obj::Null) => true,
+        let (print_annotations_safe, annotated) = match get(&dict, b"Annots") {
+            None | Some(Obj::Null) => (true, false),
             Some(annotations) => match reader.resolve(annotations) {
-                Some(Obj::Null) => true,
-                Some(Obj::Array(items)) => items.iter().all(|item| {
-                    reader
-                        .resolve(item)
-                        .and_then(|a| a.dict().cloned())
-                        .is_some_and(|annotation| get(&annotation, b"F").and_then(|f| reader.resolve(f)).and_then(|f| f.int()) == Some(4))
-                }),
-                _ => false,
+                Some(Obj::Null) => (true, false),
+                Some(Obj::Array(items)) => (
+                    items.iter().all(|item| {
+                        reader
+                            .resolve(item)
+                            .and_then(|a| a.dict().cloned())
+                            .is_some_and(|annotation| get(&annotation, b"F").and_then(|f| reader.resolve(f)).and_then(|f| f.int()) == Some(4))
+                    }),
+                    !items.is_empty(),
+                ),
+                _ => (false, true),
             },
         };
-        sheets.push(Sheet { obj, dict, bounds, rotate, print_annotations_safe });
+        // A reference to a missing object is null too. Only the cross-reference table is
+        // looked at: resolving a shared Resources dictionary for every page would parse it again.
+        let own_resources = match get(&dict, b"Resources") {
+            None | Some(Obj::Null) => false,
+            Some(Obj::Ref(num, _)) => matches!(reader.entries.get(num), Some(Entry::At(_) | Entry::In(..))),
+            Some(_) => true,
+        };
+        let resources = if own_resources { None } else { parent_resources };
+        sheets.push(Sheet { obj, dict, media, bounds, resources, rotate, print_annotations_safe, annotated });
     }
     if reader.budget.exhausted {
         return Err(unreadable("the parser memory budget was exceeded"));
@@ -976,7 +1050,7 @@ pub(crate) fn read(data: &[u8]) -> Result<Sheets<'_>, Error> {
     if sheets.is_empty() {
         return Err(Error::Spool("the print-ready PDF has no pages".into()));
     }
-    Ok(Sheets { data, sheets, trailer, xref_stream, startxref: start, size })
+    Ok(Sheets { data, sheets, trailer, catalog, xref_stream, startxref: start, size })
 }
 
 /// How sheets of another size than the paper are printed.
@@ -1067,6 +1141,30 @@ pub(crate) fn plan(sheets: &[Sheet], paper: (f64, f64), fit: Fit) -> Result<Vec<
     Ok(edits)
 }
 
+/// The whole document printed `copies` times in one job, for collated copies the driver can't
+/// make: each copy's pages follow the previous copy's. On two-sided paper, a document with an odd
+/// number of sheets gets a blank page after every copy but the last, so each copy starts on a
+/// sheet of its own.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct Repeat {
+    pub(crate) copies: u32,
+    pub(crate) two_sided: bool,
+}
+
+fn has_annotations(dict: &Dict) -> bool {
+    get(dict, b"Annots").is_some_and(|a| !matches!(a, Obj::Null) && !matches!(a, Obj::Array(items) if items.is_empty()))
+}
+
+fn rect_obj(r: [f64; 4]) -> Obj {
+    Obj::Array(r.into_iter().map(num_obj).collect())
+}
+
+/// Starts object `num` in an update, recording where it is.
+fn new_object(out: &mut Vec<u8>, num: u32, generation: u16, written: &mut Vec<(u32, u16, usize)>) {
+    written.push((num, generation, out.len()));
+    out.extend_from_slice(format!("{num} {generation} obj\n").as_bytes());
+}
+
 /// Boxes a reframed page drops: they were in the old geometry.
 const OLD_GEOMETRY: [&[u8]; 6] = [b"MediaBox", b"CropBox", b"BleedBox", b"TrimBox", b"ArtBox", b"Rotate"];
 
@@ -1084,7 +1182,25 @@ impl Sheets<'_> {
     /// original bytes, then the new versions of the edited pages, the content streams a
     /// reframed page wraps its own in, and a cross-reference section of the same kind as the
     /// newest one, chained to it with `/Prev`.
+    ///
     pub(crate) fn update(&self, edits: &[Edit]) -> Result<Vec<u8>, Error> {
+        // Only a repeat can be turned down, so there is always a PDF.
+        Ok(self.write(edits, None)?.unwrap_or_else(|| self.data.to_vec()))
+    }
+
+    /// [`update`](Self::update) with every copy of `repeat` in the one PDF. The edited pages
+    /// are not written in place: the update adds a page tree of its own, every copy's pages as
+    /// new page objects that share the original content and resources, and a new version of
+    /// the catalog pointing to it. Each new page carries the boxes, rotation and resources it
+    /// inherited, since its parent is the new tree. `None` when the copies can't be one PDF:
+    /// the PDF is encrypted (strings are encrypted with keys made from their object's number),
+    /// a page has annotations (an annotation belongs to one page; whether a renderer draws it on
+    /// others is unknown), or the job would be too large.
+    pub(crate) fn repeated(&self, edits: &[Edit], repeat: Repeat) -> Result<Option<Vec<u8>>, Error> {
+        self.write(edits, Some(repeat))
+    }
+
+    fn write(&self, edits: &[Edit], repeat: Option<Repeat>) -> Result<Option<Vec<u8>>, Error> {
         let refuse = |why: &str| Error::Spool(format!("the print-ready PDF can't be fitted to the paper: {why}"));
         let mut out = self.data.to_vec();
         if !out.ends_with(b"\n") {
@@ -1093,13 +1209,10 @@ impl Sheets<'_> {
         let mut next = self.size;
         // Each new object's number, generation and offset.
         let mut written: Vec<(u32, u16, usize)> = Vec::new();
-        fn new_object(out: &mut Vec<u8>, num: u32, generation: u16, written: &mut Vec<(u32, u16, usize)>) {
-            written.push((num, generation, out.len()));
-            out.extend_from_slice(format!("{num} {generation} obj\n").as_bytes());
-        }
+        let repeat = repeat.filter(|r| r.copies > 1);
+        let mut edited = HashMap::new();
         for edit in edits {
             let sheet = self.sheets.get(edit.sheet).ok_or_else(|| refuse("no such sheet"))?;
-            let (num, generation) = sheet.obj.ok_or_else(|| refuse("a page is not an object of its own"))?;
             let mut dict = sheet.dict.clone();
             dict.retain(|(k, _)| k != b"Rotate");
             if let Some(frame) = &edit.frame {
@@ -1109,10 +1222,7 @@ impl Sheets<'_> {
                 // Annotation appearances live outside /Contents. Transforming only content
                 // would leave them at the old coordinates; deleting them loses printed marks.
                 // Require callers to flatten before fitting until appearances can be reframed.
-                if let Some(annotations) = get(&dict, b"Annots")
-                    && !matches!(annotations, Obj::Null)
-                    && !matches!(annotations, Obj::Array(items) if items.is_empty())
-                {
+                if has_annotations(&dict) {
                     return Err(refuse("flatten page annotations before using shrink-to-fit"));
                 }
                 let [a, b, c, d, e, f] = frame.matrix;
@@ -1155,12 +1265,126 @@ impl Sheets<'_> {
                 dict.push((b"Contents".to_vec(), Obj::Array(contents)));
             }
             dict.push((b"Rotate".to_vec(), Obj::Num(edit.rotate.to_string().into_bytes())));
-            new_object(&mut out, num, generation, &mut written);
-            write_dict(&mut out, &dict);
+            if repeat.is_some() {
+                edited.insert(edit.sheet, dict);
+            } else {
+                let (num, generation) = sheet.obj.ok_or_else(|| refuse("a page is not an object of its own"))?;
+                new_object(&mut out, num, generation, &mut written);
+                write_dict(&mut out, &dict);
+                out.extend_from_slice(b"\nendobj\n");
+            }
+        }
+        if let Some(Repeat { copies, two_sided }) = repeat {
+            let refuse = |why: &str| Error::Spool(format!("the copies can't be written: {why}"));
+            if get(&self.trailer, b"Encrypt").is_some() || self.sheets.iter().any(|s| s.annotated) {
+                return Ok(None);
+            }
+            let Some(&Obj::Ref(root, root_generation)) = get(&self.trailer, b"Root") else {
+                return Ok(None);
+            };
+            let blank = two_sided && self.sheets.len() % 2 == 1;
+            let per_copy = self.sheets.len() + usize::from(blank);
+            let count =
+                usize::try_from(copies).ok().and_then(|c| per_copy.checked_mul(c)).map(|n| n - usize::from(blank)).filter(|&n| n <= MAX_PAGES);
+            let Some(count) = count else { return Ok(None) };
+            let tree = next;
+            next = next.checked_add(1).ok_or_else(|| refuse("too many objects"))?;
+            let parent = (b"Parent".to_vec(), Obj::Ref(tree, 0));
+            // Bytes written once, and bytes written once per copy (a page, its xref entry and kid).
+            let (mut once, mut each) = (0usize, 0usize);
+            let within =
+                |once: usize, each: usize| each.checked_mul(copies as usize).and_then(|n| n.checked_add(once)).is_some_and(|n| n <= MAX_REPEATED);
+            // Inherited inline resources are written once, as an object of their own, and every
+            // page that inherited them refers to it.
+            let mut shared: HashMap<*const Obj, Obj> = HashMap::new();
+            let mut bodies: Vec<Vec<u8>> = Vec::with_capacity(per_copy);
+            let mut last = Dict::new();
+            for (i, sheet) in self.sheets.iter().enumerate() {
+                let mut dict = edited.remove(&i).unwrap_or_else(|| sheet.dict.clone());
+                dict.retain(|(k, _)| k != b"Parent");
+                // The boxes as read, not the inherited objects: those can be anything.
+                for (key, value) in [(&b"MediaBox"[..], rect_obj(sheet.media)), (b"CropBox", rect_obj(sheet.bounds))] {
+                    if get(&dict, key).is_none_or(|v| *v == Obj::Null) {
+                        dict.retain(|(k, _)| k != key);
+                        dict.push((key.to_vec(), value));
+                    }
+                }
+                if get(&dict, b"Rotate").is_none_or(|v| *v == Obj::Null) {
+                    dict.retain(|(k, _)| k != b"Rotate");
+                    dict.push((b"Rotate".to_vec(), Obj::Num(sheet.rotate.to_string().into_bytes())));
+                }
+                if let Some(resources) = &sheet.resources {
+                    let value = match &**resources {
+                        Obj::Ref(..) => Obj::clone(resources),
+                        _ => match shared.get(&Arc::as_ptr(resources)) {
+                            Some(r) => r.clone(),
+                            None => {
+                                let num = next;
+                                next = next.checked_add(1).ok_or_else(|| refuse("too many objects"))?;
+                                let at = out.len();
+                                new_object(&mut out, num, 0, &mut written);
+                                write_obj(&mut out, resources);
+                                out.extend_from_slice(b"\nendobj\n");
+                                once += out.len() - at;
+                                if !within(once, each) {
+                                    return Ok(None);
+                                }
+                                shared.insert(Arc::as_ptr(resources), Obj::Ref(num, 0));
+                                Obj::Ref(num, 0)
+                            }
+                        },
+                    };
+                    dict.retain(|(k, _)| k != b"Resources");
+                    dict.push((b"Resources".to_vec(), value));
+                }
+                dict.push(parent.clone());
+                let mut body = Vec::new();
+                write_dict(&mut body, &dict);
+                each += body.len() + 64;
+                if !within(once, each) {
+                    return Ok(None);
+                }
+                bodies.push(body);
+                last = dict;
+            }
+            if blank {
+                let mut page = vec![(b"Type".to_vec(), Obj::Name(b"Page".to_vec())), parent.clone(), (b"Resources".to_vec(), Obj::Dict(Vec::new()))];
+                for key in [&b"MediaBox"[..], b"CropBox", b"Rotate"] {
+                    if let Some(value) = get(&last, key) {
+                        page.push((key.to_vec(), value.clone()));
+                    }
+                }
+                let mut body = Vec::new();
+                write_dict(&mut body, &page);
+                bodies.push(body);
+            }
+            let mut kids = Vec::with_capacity(count);
+            for body in bodies.iter().cycle().take(count) {
+                let num = next;
+                next = next.checked_add(1).ok_or_else(|| refuse("too many objects"))?;
+                new_object(&mut out, num, 0, &mut written);
+                out.extend_from_slice(body);
+                out.extend_from_slice(b"\nendobj\n");
+                kids.push(Obj::Ref(num, 0));
+            }
+            new_object(&mut out, tree, 0, &mut written);
+            let node = vec![
+                (b"Type".to_vec(), Obj::Name(b"Pages".to_vec())),
+                (b"Kids".to_vec(), Obj::Array(kids)),
+                (b"Count".to_vec(), Obj::Num(count.to_string().into_bytes())),
+            ];
+            write_dict(&mut out, &node);
+            out.extend_from_slice(b"\nendobj\n");
+            let mut catalog = self.catalog.clone();
+            // Page labels and the open action name pages of the old tree.
+            catalog.retain(|(k, _)| k != b"Pages" && k != b"PageLabels" && k != b"OpenAction");
+            catalog.push((b"Pages".to_vec(), Obj::Ref(tree, 0)));
+            new_object(&mut out, root, root_generation, &mut written);
+            write_dict(&mut out, &catalog);
             out.extend_from_slice(b"\nendobj\n");
         }
         if written.is_empty() {
-            return Ok(self.data.to_vec());
+            return Ok(Some(self.data.to_vec()));
         }
         written.sort_by_key(|(num, _, _)| *num);
         let mut trailer: Dict = Vec::new();
@@ -1207,7 +1431,7 @@ impl Sheets<'_> {
             write_dict(&mut out, &trailer);
             out.extend_from_slice(format!("\nstartxref\n{at}\n%%EOF\n").as_bytes());
         }
-        Ok(out)
+        Ok(Some(out))
     }
 }
 
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index db03fb8a..e051cda6 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -309,7 +309,7 @@ fn command_previews_do_not_require_pdf_files() {
     } else {
         assert_eq!(
             preview,
-            ["xps-print", "printer=Office (east)", "copies=2", "collate=true", "duplex=(queue default)", "scaling=exact", "color=color"]
+            ["xps-print", "printer=Office (east)", "copies=2", "collate=true", "duplex=(queue default)", "scaling=exact", "color=(driver default)"]
         );
     }
 }
diff --git a/crates/print/src/tests/pdf_bounds.rs b/crates/print/src/tests/pdf_bounds.rs
index 76b1409a..b9bc15a2 100644
--- a/crates/print/src/tests/pdf_bounds.rs
+++ b/crates/print/src/tests/pdf_bounds.rs
@@ -283,3 +283,196 @@ fn an_oversized_inherited_media_box_is_not_copied_for_every_page() {
     assert!(started.elapsed() < std::time::Duration::from_secs(10), "{:?}", started.elapsed());
     assert_eq!(sheets.sheets.len(), pages);
 }
+
+/// A classic-xref PDF of these objects, numbered from 1.
+fn classic(objects: &[String]) -> Vec<u8> {
+    let mut pdf = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(pdf.len());
+        pdf.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = pdf.len();
+    pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f\r\n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        pdf.extend_from_slice(format!("{offset:010} 00000 n\r\n").as_bytes());
+    }
+    pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    pdf
+}
+
+/// Three Letter pages that inherit their MediaBox and Resources; the third is turned by its own
+/// `/Rotate 90`, and carries `extra` in its dictionary.
+fn three_pages(extra: &str) -> Vec<u8> {
+    classic(&three_page_objects(extra))
+}
+
+fn three_page_objects(extra: &str) -> Vec<String> {
+    let mut objects = vec![
+        "<< /Type /Catalog /Pages 2 0 R /PageMode /UseNone >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 /MediaBox [0 0 612 792] /Resources << /ProcSet [/PDF] >> >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /Contents 6 0 R >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /Contents 7 0 R >>".to_string(),
+        format!("<< /Type /Page /Parent 2 0 R /Contents 8 0 R /Rotate 90 {extra} >>"),
+    ];
+    objects.extend((0..3).map(|_| "<< /Length 0 >>\nstream\n\nendstream".to_string()));
+    objects
+}
+
+/// `pdf` with `copies` collated copies in one job, or `None` when they can't be.
+fn repeat(pdf: &[u8], copies: u32, two_sided: bool) -> Option<Vec<u8>> {
+    read(pdf).unwrap().repeated(&[], Repeat { copies, two_sided }).unwrap()
+}
+
+#[test]
+fn collated_copies_repeat_the_pages_with_a_blank_back_between_odd_copies() {
+    let pdf = three_pages("");
+    let sheets = read(&pdf).unwrap();
+    // The turned page comes back upright in a portrait job, in every copy.
+    let edits = plan(&sheets.sheets, (612.0, 792.0), Fit::Exact).unwrap();
+    let content = |n: u32| Some(Obj::Ref(n, 0));
+    for (two_sided, expected) in [
+        (true, vec![content(6), content(7), content(8), None, content(6), content(7), content(8)]),
+        (false, vec![content(6), content(7), content(8), content(6), content(7), content(8)]),
+    ] {
+        let updated = sheets.repeated(&edits, Repeat { copies: 2, two_sided }).unwrap().unwrap();
+        let repeated = read(&updated).unwrap();
+        let contents: Vec<Option<Obj>> = repeated.sheets.iter().map(|s| get(&s.dict, b"Contents").cloned()).collect();
+        assert_eq!(contents, expected);
+        for sheet in &repeated.sheets {
+            assert_eq!((sheet.size(), sheet.rotate % 180), ((612.0, 792.0), 0), "{sheet:?}");
+            // What the old parent gave each page is the page's own now.
+            assert!(get(&sheet.dict, b"Resources").is_some());
+            assert!(sheet.obj.is_some_and(|(num, _)| num >= sheets.size), "every copy is a new page object");
+        }
+        assert_eq!(get(&repeated.catalog, b"PageMode"), get(&sheets.catalog, b"PageMode"), "the rest of the catalog is kept");
+        // The inherited resources are written once and shared.
+        let resources: Vec<_> = repeated.sheets.iter().filter(|s| get(&s.dict, b"Contents").is_some()).map(|s| get(&s.dict, b"Resources")).collect();
+        assert!(matches!(resources[0], Some(Obj::Ref(..))) && resources.iter().all(|r| *r == resources[0]), "{resources:?}");
+    }
+    // Without the edits the last page stays turned, and so does the blank back after it.
+    let bytes = repeat(&pdf, 2, true).unwrap();
+    let repeated = read(&bytes).unwrap();
+    assert_eq!((repeated.sheets[3].size(), repeated.sheets[3].rotate), (repeated.sheets[2].size(), 90));
+    // An even page count needs no blank; one copy is the document as it is.
+    let even = classic(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 612 792] >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+    ]);
+    assert_eq!(read(&repeat(&even, 3, true).unwrap()).unwrap().sheets.len(), 6);
+    assert_eq!(repeat(&pdf, 1, true).unwrap(), pdf);
+    // A cross-reference stream, with the catalog and the page in an object stream.
+    for compressed in [false, true] {
+        let bytes = repeat(&fixture("3 0 R", compressed, ""), 3, false).unwrap();
+        let repeated = read(&bytes).unwrap();
+        assert_eq!(repeated.sheets.len(), 3);
+        assert_eq!(repeated.xref_stream, compressed);
+    }
+}
+
+#[test]
+fn collated_copies_that_cannot_be_one_job_are_left_to_separate_jobs() {
+    assert!(repeat(&three_pages("/Annots [6 0 R]"), 2, false).is_none(), "annotations");
+    let pdf = three_pages("");
+    assert!(repeat(&pdf, 50_000, false).is_none(), "too many pages");
+    let encrypted = Sheets { trailer: vec![(b"Encrypt".to_vec(), Obj::Ref(9, 0))], ..read(&pdf).unwrap() };
+    assert!(encrypted.repeated(&[], Repeat { copies: 2, two_sided: false }).unwrap().is_none(), "encrypted");
+}
+
+#[test]
+fn a_null_missing_or_free_entry_inherits_and_an_empty_annotation_list_is_none() {
+    // Object 9 is written, but its cross-reference entry is free.
+    let mut objects = three_page_objects("/Resources 9 0 R");
+    objects.push("<< /ProcSet [/Text] >>".into());
+    let mut free = classic(&objects);
+    let at = free.windows(9).rposition(|w| w == b"00000 n\r\n").unwrap();
+    free[at + 6] = b'f';
+    for (extra, pdf) in [
+        ("/Resources null", three_pages("/Resources null")),
+        ("/Resources 99 0 R", three_pages("/Resources 99 0 R")),
+        ("/Resources 9 0 R (free)", free),
+        ("/Annots null", three_pages("/Annots null")),
+        ("/Annots []", three_pages("/Annots []")),
+    ] {
+        let bytes = repeat(&pdf, 2, false).unwrap();
+        let repeated = read(&bytes).unwrap();
+        let resources: Vec<_> = repeated.sheets.iter().map(|s| get(&s.dict, b"Resources")).collect();
+        assert!(matches!(resources[0], Some(Obj::Ref(..))) && resources.iter().all(|r| *r == resources[0]), "{extra}: {resources:?}");
+    }
+}
+
+#[test]
+fn large_inherited_resources_are_written_once_for_every_copy() {
+    let pages = 4_000;
+    let procset = vec!["/PDF"; 25_000].join(" ");
+    let kids: Vec<String> = (0..pages).map(|i| format!("{} 0 R", i + 3)).collect();
+    let mut objects = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        format!("<< /Type /Pages /Kids [{}] /Count {pages} /MediaBox [0 0 612 792] /Resources << /ProcSet [{procset}] >> >>", kids.join(" ")),
+    ];
+    objects.extend((0..pages).map(|_| "<< /Type /Page /Parent 2 0 R >>".to_string()));
+    let pdf = classic(&objects);
+    let updated = repeat(&pdf, 3, false).unwrap();
+    assert!(updated.len() < pdf.len() + (4 << 20), "{} bytes", updated.len());
+    assert_eq!(read(&updated).unwrap().sheets.len(), 3 * pages);
+}
+
+fn flate_dict() -> Dict {
+    vec![(b"Filter".to_vec(), Obj::Name(b"FlateDecode".to_vec()))]
+}
+
+fn varied(len: usize) -> Vec<u8> {
+    (0..len).map(|i| u8::try_from(i * i % 251).unwrap_or(0)).collect()
+}
+
+#[test]
+fn a_valid_flate_stream_round_trips() {
+    let raw = varied(4000);
+    let packed = miniz_oxide::deflate::compress_to_vec_zlib(&raw, 6);
+    let mut budget = Budget::default();
+    assert_eq!(decode(&flate_dict(), &packed, &mut budget), Some(raw.clone()));
+    assert_eq!(budget.decoded, raw.len());
+    assert!(!budget.exhausted);
+}
+
+#[test]
+fn a_truncated_flate_stream_yields_only_the_bytes_it_inflated() {
+    let raw = varied(4000);
+    let packed = miniz_oxide::deflate::compress_to_vec_zlib(&raw, 6);
+    let cut = packed.get(..packed.len() * 3 / 4).unwrap_or_default();
+    let mut budget = Budget::default();
+    let got = decode(&flate_dict(), cut, &mut budget).unwrap_or_default();
+    assert!(!got.is_empty() && got.len() < raw.len());
+    assert!(raw.starts_with(&got), "a prefix of the data, with no zero padding");
+    assert!(!budget.exhausted);
+}
+
+#[test]
+fn a_stream_rejected_before_any_output_is_none_not_zeros() {
+    // A zlib header, then a reserved deflate block type: nothing is ever inflated, and the
+    // bare-deflate retry rejects it too.
+    let bad = [0x78, 0x9c, 0x07, 0xff, 0xff, 0xff, 0xff, 0xff];
+    let mut budget = Budget::default();
+    assert!(decode(&flate_dict(), &bad, &mut budget).is_none());
+    assert_eq!(budget.decoded, 0);
+    assert!(!budget.exhausted);
+}
+
+#[test]
+fn a_bare_deflate_stream_still_decodes_through_the_retry() {
+    let raw = varied(500);
+    let packed = miniz_oxide::deflate::compress_to_vec(&raw, 6);
+    let mut budget = Budget::default();
+    assert_eq!(decode(&flate_dict(), &packed, &mut budget), Some(raw));
+}
+
+#[test]
+fn an_over_limit_flate_stream_sets_exhausted() {
+    let packed = miniz_oxide::deflate::compress_to_vec_zlib(&vec![7u8; 4096], 6);
+    let mut budget = Budget { decoded: MAX_DECODED - 100, ..Budget::default() };
+    assert!(decode(&flate_dict(), &packed, &mut budget).is_none());
+    assert!(budget.exhausted);
+    assert_eq!(budget.decoded, MAX_DECODED - 100);
+}
diff --git a/crates/print/src/tests/windows_native.rs b/crates/print/src/tests/windows_native.rs
index c42bccc9..f25f0cfb 100644
--- a/crates/print/src/tests/windows_native.rs
+++ b/crates/print/src/tests/windows_native.rs
@@ -429,6 +429,9 @@ fn windows_jobs_reach_the_spooler() {
     } else {
         None
     };
+    // The Print dialog's default, an explicit one-sided request, on a queue with no duplex unit.
+    let simplex_only = listed.as_ref().is_some_and(|p| p.two_sided == Some(false));
+    let one_sided = simplex_only.then(|| spool::submit(&mixed, &Job { duplex: Some(Duplex::Off), title: "simplex".into(), ..job.clone() }));
     let tabloid = test_pdf(&[TABLOID, LETTER], false);
     let shrink = Job { printer: Some(name.into()), scaling: Scaling::ShrinkToFit, title: "shrink".into(), ..Job::default() };
     let shrunk = spool::submit(&tabloid, &shrink);
@@ -451,12 +454,16 @@ fn windows_jobs_reach_the_spooler() {
     if let Some(refused) = duplex_refused {
         assert!(matches!(refused, Err(Error::Spool(ref m)) if m.contains("simplex/duplex") && m.contains("nothing was sent")), "{refused:?}");
     }
+    if let Some(one_sided) = one_sided {
+        assert_eq!(one_sided.as_deref(), Ok("spooled 3 sheet(s)"), "one-sided is what a simplex-only queue does: {one_sided:?}");
+    }
     assert_eq!(*processed.borrow(), [(0, 3), (1, 3), (2, 3), (3, 3)]);
     assert!(duplex_progress.is_empty(), "driver refusal before submission has no progress");
     assert_eq!(shrunk.as_deref(), Ok("spooled 2 sheet(s)"), "{shrunk:?}");
     assert!(matches!(exact_refused, Err(Error::Spool(ref m)) if m.contains("one paper size")), "{exact_refused:?}");
     assert!(refused_progress.is_empty(), "rejection before a job starts has no progress: {refused_progress:?}");
-    assert_eq!(queued.as_deref().map(str::trim), Ok("mixed.pdf 3|shrink.pdf 2"), "one job each, all sheets, in the paused queue: {queued:?}");
+    let expected = if simplex_only { "mixed.pdf 3|simplex.pdf 3|shrink.pdf 2" } else { "mixed.pdf 3|shrink.pdf 2" };
+    assert_eq!(queued.as_deref().map(str::trim), Ok(expected), "one job each, all sheets, in the paused queue: {queued:?}");
     assert!(cleaned.is_ok(), "the test printer is removed again: {cleaned:?}");
     // Asking for a printer that isn't there is an error, never a job on another one.
     let missing = spool::submit(&mixed, &Job { printer: Some(name.into()), ..Job::default() });
diff --git a/crates/print/src/ticket.rs b/crates/print/src/ticket.rs
index 5f8c914b..ade33dc8 100644
--- a/crates/print/src/ticket.rs
+++ b/crates/print/src/ticket.rs
@@ -43,14 +43,15 @@ pub(crate) fn ticket_xml(job: &Job, landscape: bool) -> String {
         }
     };
     let collate = if job.collate { "Collated" } else { "Uncollated" };
-    let color = if job.grayscale { "Monochrome" } else { "Color" };
+    // Only grayscale is asked for. Without it the ticket says nothing about colour, so a black and
+    // white chosen in the driver's own preferences (Properties…) still applies (storytold/pdfcraft#2422).
+    let color = if job.grayscale { "\n <psf:Feature name=\"psk:PageOutputColor\"><psf:Option name=\"psk:Monochrome\"/></psf:Feature>" } else { "" };
     let copies = job.copies.clamp(1, 999);
     format!(
         r#"<?xml version="1.0" encoding="UTF-8"?>
 <psf:PrintTicket version="1" xmlns:psf="{NS_PSF}" xmlns:psk="{NS_PSK}" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <psf:ParameterInit name="psk:JobCopiesAllDocuments"><psf:Value xsi:type="xsd:integer">{copies}</psf:Value></psf:ParameterInit>
- <psf:Feature name="psk:DocumentCollate"><psf:Option name="psk:{collate}"/></psf:Feature>{duplex}
- <psf:Feature name="psk:PageOutputColor"><psf:Option name="psk:{color}"/></psf:Feature>
+ <psf:Feature name="psk:DocumentCollate"><psf:Option name="psk:{collate}"/></psf:Feature>{duplex}{color}
  <psf:Feature name="psk:PageScaling"><psf:Option name="psk:None"/></psf:Feature>
  <psf:Feature name="psk:PageOrientation"><psf:Option name="psk:{orientation}"/></psf:Feature>
 </psf:PrintTicket>"#
@@ -171,10 +172,97 @@ pub(crate) fn verify_ticket(xml: &str, paper: Option<(u32, u32)>, landscape: boo
     Ok(size)
 }
 
+/// What a driver's PrintCapabilities offer for the options [`verify_job_options`] checks. A
+/// field is `None` when the capabilities couldn't be read; that option is then checked strictly.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub(crate) struct Offered {
+    /// The two-sided feature (`JobDuplexAllDocumentsContiguously`) has any option.
+    pub duplex: Option<bool>,
+    /// The colour feature (`PageOutputColor`) has an option other than Monochrome and Grayscale.
+    pub color: Option<bool>,
+    /// The collation feature (`DocumentCollate`) has a Collated option.
+    pub collate: Option<bool>,
+}
+
+/// What these PrintCapabilities offer ([`Offered`]); all unknown when the document is not
+/// PrintCapabilities.
+pub(crate) fn offered(capabilities_xml: &str) -> Offered {
+    let Ok(document) = roxmltree::Document::parse(capabilities_xml) else { return Offered::default() };
+    let root = document.root_element();
+    if !root.has_tag_name((NS_PSF, "PrintCapabilities")) {
+        return Offered::default();
+    }
+    let options = |name: &'static str| {
+        root.children()
+            .filter(move |n| n.has_tag_name((NS_PSF, "Feature")) && named(*n, name))
+            .flat_map(|f| f.children().filter(|n| n.has_tag_name((NS_PSF, "Option"))))
+    };
+    Offered {
+        // The schema's two duplex features are alternatives; a driver offers one or the other.
+        duplex: Some(options("JobDuplexAllDocumentsContiguously").chain(options("DocumentDuplex")).next().is_some()),
+        // A vendor's own option might be colour, so only the two schema keywords count as not.
+        color: Some(options("PageOutputColor").any(|n| !named(n, "Monochrome") && !named(n, "Grayscale"))),
+        collate: Some(options("DocumentCollate").any(|n| named(n, "Collated"))),
+    }
+}
+
+/// Whether a `pages`-page job asks for collated copies.
+pub(crate) fn collated_copies(job: &Job, pages: usize) -> bool {
+    job.collate && job.copies.clamp(1, 999) > 1 && pages > 1
+}
+
+/// Whether collated copies are made by repeating the document in one job with one copy on the
+/// ticket: the job asks for them and the driver can't collate.
+pub(crate) fn repeats_collated(job: &Job, pages: usize, offered: Offered) -> bool {
+    collated_copies(job, pages) && offered.collate == Some(false)
+}
+
+/// Whether a repeated job's validated one-copy ticket ([`crate::sheets::Repeat`]) prints on
+/// both sides; `None` when the copies can't share one job and are printed as a job each: a
+/// duplex option other than the schema's (the blank backs would be guessed), several pages per
+/// sheet, binding (booklets and offset stacking included) or stapling, which would treat every
+/// copy as one document.
+pub(crate) fn one_job_sides(xml: &str) -> Option<bool> {
+    let document = roxmltree::Document::parse(xml).ok()?;
+    let features = |names: &'static [&'static str]| {
+        document.root_element().children().filter(move |n| n.has_tag_name((NS_PSF, "Feature")) && names.iter().any(|name| named(*n, name)))
+    };
+    fn option<'a, 'i>(feature: roxmltree::Node<'a, 'i>) -> Option<roxmltree::Node<'a, 'i>> {
+        feature.children().find(|n| n.has_tag_name((NS_PSF, "Option")))
+    }
+    let mut two_sided = false;
+    for feature in features(&["JobDuplexAllDocumentsContiguously", "DocumentDuplex"]) {
+        match option(feature) {
+            Some(o) if named(o, "OneSided") => {}
+            Some(o) if named(o, "TwoSidedLongEdge") || named(o, "TwoSidedShortEdge") => two_sided = true,
+            _ => return None,
+        }
+    }
+    if features(&["JobNUpAllDocumentsContiguously", "DocumentNUp"]).any(|f| integer(f, "ScoredProperty", "PagesPerSheet").is_some_and(|n| n > 1)) {
+        return None;
+    }
+    if features(&["JobBindAllDocuments", "DocumentBinding", "JobStapleAllDocuments", "DocumentStaple"])
+        .any(|f| !option(f).is_some_and(|o| named(o, "None")))
+    {
+        return None;
+    }
+    Some(two_sided)
+}
+
 /// Confirm explicit job options survived driver validation. Collation only changes output
 /// when both the document and copy count exceed one. Without a duplex request the queue's
-/// default applies; without forced grayscale the driver's normal color policy applies.
-pub(crate) fn verify_job_options(xml: &str, job: &Job, pages: usize) -> Result<(), Error> {
+/// default applies; without a grayscale request the driver's own colour setting applies.
+///
+/// A driver that offers an option ([`Offered`]) and returned a ticket without the requested
+/// value dropped it, and the job is refused. A driver without the feature is accepted where it
+/// can only do what was asked: one-sided on a driver with no two-sided feature, grayscale on one
+/// with no colour option, uncollated copies on one that can't collate. Two-sided on a simplex
+/// driver is refused, and so are collated copies on a driver that can't collate: Windows doesn't
+/// document collating for such a driver (the standard XPS filters make the copies, and leave
+/// collated copies to the device only when its GPD or PPD has a Collate command). The job then
+/// asks for one copy and repeats the document instead ([`repeats_collated`]), in one job or a
+/// job per copy ([`one_job_sides`]). An unknown offer (`None`) is checked strictly.
+pub(crate) fn verify_job_options(xml: &str, job: &Job, pages: usize, offered: Offered) -> Result<(), Error> {
     let document = roxmltree::Document::parse(xml).map_err(spool_error)?;
     let root = document.root_element();
     let option = |name: &str| {
@@ -188,7 +276,15 @@ pub(crate) fn verify_job_options(xml: &str, job: &Job, pages: usize) -> Result<(
         return Err(refused("copy count"));
     }
     if copies > 1 && pages > 1 && !option("DocumentCollate").is_some_and(|n| named(n, if job.collate { "Collated" } else { "Uncollated" })) {
-        return Err(refused("collation"));
+        match (job.collate, offered.collate) {
+            (false, Some(false)) => {}
+            (true, Some(false)) => {
+                return Err(spool_error(
+                    "the printer's driver can't collate copies; nothing was sent (turn collation off, or print one copy at a time)",
+                ));
+            }
+            _ => return Err(refused("collation")),
+        }
     }
     if let Some(duplex) = job.duplex {
         let wanted = match duplex {
@@ -196,11 +292,13 @@ pub(crate) fn verify_job_options(xml: &str, job: &Job, pages: usize) -> Result<(
             Duplex::LongEdge => "TwoSidedLongEdge",
             Duplex::ShortEdge => "TwoSidedShortEdge",
         };
-        if !option("JobDuplexAllDocumentsContiguously").is_some_and(|n| named(n, wanted)) {
+        let one_sided_only = duplex == Duplex::Off && offered.duplex == Some(false);
+        if !one_sided_only && !option("JobDuplexAllDocumentsContiguously").is_some_and(|n| named(n, wanted)) {
             return Err(refused("simplex/duplex setting"));
         }
     }
-    if job.grayscale && !option("PageOutputColor").is_some_and(|n| named(n, "Monochrome") || named(n, "Grayscale")) {
+    let monochrome_only = offered.color == Some(false);
+    if job.grayscale && !monochrome_only && !option("PageOutputColor").is_some_and(|n| named(n, "Monochrome") || named(n, "Grayscale")) {
         return Err(refused("grayscale"));
     }
     Ok(())
@@ -256,10 +354,11 @@ mod tests {
         assert!(!xml.contains("<&>"), "the title never enters the XML");
         assert!(roxmltree::Document::parse(&xml).is_ok());
         let xml = ticket_xml(&Job { copies: 5000, ..Job::default() }, false);
-        for value in [">999<", "psk:Collated", "psk:Color", "psk:Portrait"] {
+        for value in [">999<", "psk:Collated", "psk:Portrait"] {
             assert!(xml.contains(value), "missing {value}");
         }
         assert!(!xml.contains("JobDuplex"), "no duplex asked: the queue's default applies");
+        assert!(!xml.contains("PageOutputColor"), "no grayscale asked: the driver's own colour setting applies");
         assert!(ticket_xml(&Job { duplex: Some(Duplex::Off), ..Job::default() }, false).contains("psk:OneSided"));
         assert!(ticket_xml(&Job { duplex: Some(Duplex::LongEdge), ..Job::default() }, false).contains("psk:TwoSidedLongEdge"));
         assert!(!ticket_xml(&Job { printer: Some("Office \"east\" <1>".into()), ..Job::default() }, false).contains("east"));
@@ -301,31 +400,159 @@ mod tests {
     fn a_driver_that_drops_explicit_job_options_is_refused() {
         let job = Job { copies: 2, duplex: Some(Duplex::LongEdge), grayscale: true, ..Job::default() };
         let xml = ticket_xml(&job, false);
-        assert!(verify_job_options(&xml, &job, 3).is_ok());
+        assert!(verify_job_options(&xml, &job, 3, Offered::default()).is_ok());
         for (from, to) in
             [(">2<", ">1<"), ("psk:Collated", "psk:Uncollated"), ("psk:TwoSidedLongEdge", "psk:OneSided"), ("psk:Monochrome", "psk:Color")]
         {
-            assert!(verify_job_options(&xml.replace(from, to), &job, 3).is_err(), "{from}");
+            assert!(verify_job_options(&xml.replace(from, to), &job, 3, Offered::default()).is_err(), "{from}");
         }
-        assert!(verify_job_options(&xml.replace("psk:Collated", "vendor:Collated"), &job, 3).is_err(), "namespace matters");
-        assert!(verify_job_options(&xml.replace("psk:Monochrome", "psk:Grayscale"), &job, 3).is_ok());
+        assert!(verify_job_options(&xml.replace("psk:Collated", "vendor:Collated"), &job, 3, Offered::default()).is_err(), "namespace matters");
+        assert!(verify_job_options(&xml.replace("psk:Monochrome", "psk:Grayscale"), &job, 3, Offered::default()).is_ok());
         for feature in ["DocumentCollate", "JobDuplexAllDocumentsContiguously", "PageOutputColor"] {
             let start = xml.find(&format!("<psf:Feature name=\"psk:{feature}\"")).unwrap();
             let end = start + xml[start..].find("</psf:Feature>").unwrap() + "</psf:Feature>".len();
             let mut dropped = xml.clone();
             dropped.replace_range(start..end, "");
-            assert!(verify_job_options(&dropped, &job, 3).is_err(), "{feature}");
+            assert!(verify_job_options(&dropped, &job, 3, Offered::default()).is_err(), "{feature}");
             if feature == "DocumentCollate" {
-                assert!(verify_job_options(&dropped, &job, 1).is_ok(), "one page has no collating order");
+                assert!(verify_job_options(&dropped, &job, 1, Offered::default()).is_ok(), "one page has no collating order");
             }
         }
         let default = Job::default();
         let xml = ticket_xml(&default, false);
-        assert!(verify_job_options(&xml, &default, 3).is_ok());
+        assert!(verify_job_options(&xml, &default, 3, Offered::default()).is_ok());
         let simplex = Job { duplex: Some(Duplex::Off), ..Job::default() };
-        assert!(verify_job_options(&ticket_xml(&simplex, false), &simplex, 3).is_ok());
-        assert!(verify_job_options(&xml, &simplex, 3).is_err(), "explicit simplex must be confirmed");
-        assert!(verify_job_options("<not xml", &default, 1).is_err());
+        assert!(verify_job_options(&ticket_xml(&simplex, false), &simplex, 3, Offered::default()).is_ok());
+        assert!(verify_job_options(&xml, &simplex, 3, Offered::default()).is_err(), "explicit simplex must be confirmed");
+        assert!(verify_job_options("<not xml", &default, 1, Offered::default()).is_err());
+    }
+
+    /// PrintCapabilities as a driver might write them: with or without a duplex feature, and the
+    /// colour and collation options given (none: no such feature).
+    fn capabilities_xml(duplex: bool, colors: &[&str], collations: &[&str]) -> String {
+        let feature = |name: &str, options: &[&str]| {
+            if options.is_empty() {
+                return String::new();
+            }
+            let options: String = options.iter().map(|o| format!(r#"<psf:Option name="{o}"/>"#)).collect();
+            format!(r#"<psf:Feature name="psk:{name}">{options}</psf:Feature>"#)
+        };
+        let duplex = feature("JobDuplexAllDocumentsContiguously", if duplex { &["psk:OneSided", "psk:TwoSidedLongEdge"] } else { &[] });
+        format!(
+            r#"<psf:PrintCapabilities version="1" xmlns:psf="{NS_PSF}" xmlns:psk="{NS_PSK}" xmlns:ns0000="http://example.com/vendor">
+{}{duplex}{}
+</psf:PrintCapabilities>"#,
+            feature("DocumentCollate", collations),
+            feature("PageOutputColor", colors)
+        )
+    }
+
+    const COLOR: &[&str] = &["psk:Color", "psk:Monochrome"];
+    const COLLATE: &[&str] = &["psk:Collated", "psk:Uncollated"];
+
+    /// The ticket without one of its features, as a driver that doesn't know it returns it.
+    fn without(xml: &str, feature: &str) -> String {
+        let start = xml.find(&format!("<psf:Feature name=\"psk:{feature}\"")).unwrap();
+        let end = start + xml[start..].find("</psf:Feature>").unwrap() + "</psf:Feature>".len();
+        let mut dropped = xml.to_owned();
+        dropped.replace_range(start..end, "");
+        dropped
+    }
+
+    #[test]
+    fn a_driver_without_a_duplex_feature_prints_one_side_and_is_not_refused_for_it() {
+        let offered = |duplex| offered(&capabilities_xml(duplex, COLOR, COLLATE));
+        assert_eq!(offered(true), Offered { duplex: Some(true), color: Some(true), collate: Some(true) });
+        assert_eq!(offered(false).duplex, Some(false));
+        assert_eq!(super::offered("<psf:PrintCapabilities xmlns:psf=\"x\"/>"), Offered::default(), "another namespace is not capabilities");
+        assert_eq!(super::offered("<not xml"), Offered::default());
+        let empty = format!(
+            r#"<psf:PrintCapabilities xmlns:psf="{NS_PSF}"><psf:Feature name="psk:JobDuplexAllDocumentsContiguously"/></psf:PrintCapabilities>"#
+        );
+        assert_eq!(super::offered(&empty).duplex, Some(false), "a feature with no option offers nothing");
+        let document_duplex = format!(
+            r#"<psf:PrintCapabilities xmlns:psf="{NS_PSF}" xmlns:psk="{NS_PSK}"><psf:Feature name="psk:DocumentDuplex"><psf:Option name="psk:OneSided"/><psf:Option name="psk:TwoSidedLongEdge"/></psf:Feature></psf:PrintCapabilities>"#
+        );
+        assert_eq!(super::offered(&document_duplex).duplex, Some(true), "DocumentDuplex is a duplex feature too");
+
+        let one_sided = Job { duplex: Some(Duplex::Off), ..Job::default() };
+        let two_sided = Job { duplex: Some(Duplex::LongEdge), ..Job::default() };
+        let kept = ticket_xml(&one_sided, false);
+        // The ticket a driver with no duplex feature returns: the setting is gone.
+        let none_kept = ticket_xml(&Job::default(), false);
+
+        // The Print dialog's defaults (duplex Off) on a simplex-only queue.
+        assert!(verify_job_options(&none_kept, &one_sided, 3, offered(false)).is_ok());
+        // Offered and kept.
+        assert!(verify_job_options(&kept, &one_sided, 3, offered(true)).is_ok());
+        // Offered but the ticket lost it: the driver dropped the choice.
+        assert!(verify_job_options(&none_kept, &one_sided, 3, offered(true)).is_err());
+        // Two-sided never rests on the missing feature.
+        assert!(verify_job_options(&none_kept, &two_sided, 3, offered(false)).is_err());
+        // Unknown capabilities stay strict.
+        assert!(verify_job_options(&none_kept, &one_sided, 3, Offered::default()).is_err());
+        // The other options are still checked on a simplex-only queue.
+        let copies = Job { copies: 2, duplex: Some(Duplex::Off), ..Job::default() };
+        assert!(verify_job_options(&none_kept, &copies, 3, offered(false)).is_err(), "copy count");
+        let gray = Job { grayscale: true, duplex: Some(Duplex::Off), ..Job::default() };
+        assert!(verify_job_options(&none_kept, &gray, 3, offered(false)).is_err(), "grayscale");
+    }
+
+    #[test]
+    fn a_driver_without_colour_prints_grayscale_and_is_not_refused_for_it() {
+        let colors = |colors: &[&str]| offered(&capabilities_xml(true, colors, COLLATE)).color;
+        assert_eq!(colors(COLOR), Some(true));
+        assert_eq!(colors(&["psk:Monochrome"]), Some(false), "monochrome-only");
+        assert_eq!(colors(&["psk:Grayscale", "psk:Monochrome"]), Some(false));
+        assert_eq!(colors(&[]), Some(false), "no colour feature");
+        assert_eq!(colors(&["psk:Monochrome", "ns0000:Vivid"]), Some(true), "a vendor's option may be colour");
+
+        let gray = Job { grayscale: true, ..Job::default() };
+        let kept = ticket_xml(&gray, false);
+        // A driver without the feature returns a ticket without it.
+        let dropped = without(&kept, "PageOutputColor");
+        let color = kept.replace("psk:Monochrome", "psk:Color");
+        let caps = |colors: &[&str]| offered(&capabilities_xml(true, colors, COLLATE));
+
+        assert!(verify_job_options(&dropped, &gray, 3, caps(&["psk:Monochrome"])).is_ok());
+        assert!(verify_job_options(&dropped, &gray, 3, caps(&[])).is_ok());
+        assert!(verify_job_options(&kept, &gray, 3, caps(COLOR)).is_ok());
+        // A colour driver that dropped or changed the request.
+        assert!(verify_job_options(&color, &gray, 3, caps(COLOR)).is_err());
+        assert!(verify_job_options(&dropped, &gray, 3, caps(COLOR)).is_err());
+        assert!(verify_job_options(&dropped, &gray, 3, Offered::default()).is_err(), "unknown stays strict");
+    }
+
+    #[test]
+    fn copies_on_a_driver_that_cannot_collate_are_accepted_only_uncollated() {
+        let caps = |collations: &[&str]| offered(&capabilities_xml(true, COLOR, collations));
+        assert_eq!(caps(COLLATE).collate, Some(true));
+        assert_eq!(caps(&["psk:Uncollated"]).collate, Some(false));
+        assert_eq!(caps(&[]).collate, Some(false));
+
+        let collated = Job { copies: 2, collate: true, ..Job::default() };
+        let uncollated = Job { copies: 2, collate: false, ..Job::default() };
+        let dropped = |job: &Job| without(&ticket_xml(job, false), "DocumentCollate");
+
+        // Uncollated copies are what a driver without collation prints.
+        assert!(verify_job_options(&dropped(&uncollated), &uncollated, 3, caps(&[])).is_ok());
+        assert!(verify_job_options(&ticket_xml(&uncollated, false), &uncollated, 3, caps(&["psk:Uncollated"])).is_ok());
+        // Collated copies are refused, saying why.
+        let refused = verify_job_options(&dropped(&collated), &collated, 3, caps(&[])).unwrap_err();
+        assert!(refused.to_string().contains("can't collate"), "{refused}");
+        // A driver that collates and dropped or changed the request.
+        assert!(verify_job_options(&dropped(&collated), &collated, 3, caps(COLLATE)).is_err());
+        assert!(verify_job_options(&dropped(&uncollated), &uncollated, 3, caps(COLLATE)).is_err());
+        let changed = ticket_xml(&collated, false).replace("psk:Collated", "psk:Uncollated");
+        assert!(verify_job_options(&changed, &collated, 3, caps(COLLATE)).is_err());
+        assert!(verify_job_options(&dropped(&uncollated), &uncollated, 3, Offered::default()).is_err(), "unknown stays strict");
+        // The job repeats the document instead of asking for collated copies.
+        assert!(repeats_collated(&collated, 3, caps(&[])));
+        assert!(!repeats_collated(&collated, 3, caps(COLLATE)) && !repeats_collated(&collated, 3, Offered::default()));
+        assert!(!repeats_collated(&uncollated, 3, caps(&[])) && !repeats_collated(&collated, 1, caps(&[])));
+        assert!(!repeats_collated(&Job { copies: 1, ..collated.clone() }, 3, caps(&[])));
+        // One page or one copy has no collating order.
+        assert!(verify_job_options(&dropped(&collated), &collated, 1, caps(&[])).is_ok());
     }
 
     #[test]
@@ -404,4 +631,27 @@ mod tests {
         assert_eq!(job_filename(""), "Print.pdf");
         assert_eq!(job_filename("Отчёт"), "Отчёт.pdf");
     }
+
+    #[test]
+    fn a_repeated_job_reads_its_sides_and_leaves_layouts_that_mix_copies_to_separate_jobs() {
+        let xml = ticket_xml(&Job { duplex: Some(Duplex::LongEdge), ..Job::default() }, false);
+        assert_eq!(one_job_sides(&xml), Some(true));
+        assert_eq!(one_job_sides(&xml.replace("JobDuplexAllDocumentsContiguously", "DocumentDuplex")), Some(true));
+        assert_eq!(one_job_sides(&ticket_xml(&Job { duplex: Some(Duplex::Off), ..Job::default() }, false)), Some(false));
+        assert_eq!(one_job_sides(&ticket_xml(&Job::default(), false)), Some(false), "no duplex feature");
+        assert_eq!(one_job_sides(&xml.replace("psk:TwoSidedLongEdge", "vendor:Duplex")), None, "an option it can't read");
+        let with = |feature: &str| xml.replace("</psf:PrintTicket>", &format!("{feature}</psf:PrintTicket>"));
+        let n_up = |n: u32| {
+            with(&format!(
+                r#"<psf:Feature name="psk:JobNUpAllDocumentsContiguously"><psf:Option><psf:ScoredProperty name="psk:PagesPerSheet"><psf:Value xsi:type="xsd:integer">{n}</psf:Value></psf:ScoredProperty></psf:Option></psf:Feature>"#
+            ))
+        };
+        assert_eq!(one_job_sides(&n_up(1)), Some(true));
+        assert_eq!(one_job_sides(&n_up(2)), None);
+        for feature in ["JobBindAllDocuments", "JobStapleAllDocuments", "DocumentStaple"] {
+            let finishing = |option: &str| with(&format!(r#"<psf:Feature name="psk:{feature}"><psf:Option name="psk:{option}"/></psf:Feature>"#));
+            assert_eq!(one_job_sides(&finishing("None")), Some(true), "{feature}");
+            assert_eq!(one_job_sides(&finishing("StapleTopLeft")), None, "{feature}");
+        }
+    }
 }
diff --git a/crates/print/src/windows.rs b/crates/print/src/windows.rs
index 45a23aa7..b99d1cf0 100644
--- a/crates/print/src/windows.rs
+++ b/crates/print/src/windows.rs
@@ -45,6 +45,15 @@ fn two_sided(device: &PrinterDevice) -> Option<bool> {
     Some(capabilities.options_for_feature(duplex).any(|o| o.name.as_ref().is_some_and(|n| n.local_name.starts_with("TwoSided"))))
 }
 
+/// What the driver's PrintCapabilities offer for the job options [`ticket::verify_job_options`]
+/// checks; all unknown when they can't be read.
+fn driver_offers(device: &PrinterDevice) -> ticket::Offered {
+    PrintCapabilities::fetch_xml_for_ticket(device, None)
+        .ok()
+        .and_then(|xml| String::from_utf8(xml).ok())
+        .map_or_else(ticket::Offered::default, |xml| ticket::offered(&xml))
+}
+
 /// The queue the job goes to: the one asked for, else the default. Never another one: a job
 /// for a queue that has gone must not come out of a different printer.
 fn select_device(devices: Vec<PrinterDevice>, requested: Option<&str>, default: Option<&str>) -> Result<PrinterDevice, Error> {
@@ -142,9 +151,32 @@ pub(crate) fn submit_with_progress(pdf: &[u8], job: &Job, progress: &mut dyn FnM
     let read = &read;
     // The worker is joined before `dir` is dropped: the spooler reads the file.
     let result = crate::progress::run(progress, move |sender| {
-        let (ticket, paper) = driver_ticket(&device, job, first, landscape)?;
+        let (mut ticket, mut paper) = driver_ticket(&device, job, first, landscape)?;
         let xml = std::str::from_utf8(ticket.get_xml()).map_err(spool_error)?;
-        ticket::verify_job_options(xml, job, count)?;
+        let mut repeat = None;
+        // Jobs of one copy each, for collated copies that can't be one job.
+        let mut jobs = 1;
+        // The capabilities are read when the ticket lacks a requested value: they tell a driver
+        // that dropped it from one that never had the feature. Unreadable stays strict. A driver
+        // can also keep a collation it doesn't offer, so collated copies always read them.
+        let checked = ticket::verify_job_options(xml, job, count, ticket::Offered::default());
+        if checked.is_err() || ticket::collated_copies(job, count) {
+            let offered = driver_offers(&device);
+            if ticket::repeats_collated(job, count, offered) {
+                let single = Job { copies: 1, ..job.clone() };
+                (ticket, paper) = driver_ticket(&device, &single, first, landscape)?;
+                let xml = std::str::from_utf8(ticket.get_xml()).map_err(spool_error)?;
+                ticket::verify_job_options(xml, &single, count, offered)?;
+                // Two-sided as the driver will print it, the queue's default included.
+                let copies = job.copies.clamp(1, 999);
+                match ticket::one_job_sides(xml) {
+                    Some(two_sided) => repeat = Some(sheets::Repeat { copies, two_sided }),
+                    None => jobs = copies,
+                }
+            } else if checked.is_err() {
+                ticket::verify_job_options(xml, job, count, offered)?;
+            }
+        }
         let (fit, paper) = match job.scaling {
             Scaling::Exact => (Fit::Exact, first),
             Scaling::ShrinkToFit => {
@@ -153,29 +185,50 @@ pub(crate) fn submit_with_progress(pdf: &[u8], job: &Job, progress: &mut dyn FnM
             }
         };
         let edits = sheets::plan(&read.sheets, paper, fit)?;
-        let updated = if edits.is_empty() { None } else { Some(read.update(&edits)?) };
+        let mut updated = None;
+        if let Some(r) = repeat {
+            updated = read.repeated(&edits, r)?;
+            if updated.is_none() {
+                (repeat, jobs) = (None, r.copies);
+            }
+        }
+        if updated.is_none() && !edits.is_empty() {
+            updated = Some(read.update(&edits)?);
+        }
         let mut file = std::fs::OpenOptions::new().write(true).create_new(true).open(&path).map_err(written)?;
         file.write_all(updated.as_deref().unwrap_or(pdf)).map_err(written)?;
         drop(file);
-        WinPdfPrinter::new(device)
-            .print_with_progress(&path, ticket, |processed, total| {
-                // Page acceptance is distinct from terminal job success. The callback
-                // drains on the submitter's thread, so it can retain non-Send UI state.
-                let _ = sender.send((processed as usize, total as usize));
-            })
-            .map_err(|e| {
-                let mut message = e.to_string();
-                let mut cause = std::error::Error::source(&e);
-                while let Some(source) = cause {
-                    message.push_str(&format!(": {source}"));
-                    cause = source.source();
-                }
-                spool_error(message)
-            })
+        let printer = WinPdfPrinter::new(device);
+        let jobs = jobs as usize;
+        for copy in 0..jobs {
+            printer
+                .print_with_progress(&path, ticket.clone(), |processed, total| {
+                    // Page acceptance is distinct from terminal job success. The callback
+                    // drains on the submitter's thread, so it can retain non-Send UI state.
+                    let (processed, total) = (processed as usize, total as usize);
+                    let _ = sender.send((copy * total + processed, jobs * total));
+                })
+                .map_err(|e| {
+                    let mut message = e.to_string();
+                    let mut cause = std::error::Error::source(&e);
+                    while let Some(source) = cause {
+                        message.push_str(&format!(": {source}"));
+                        cause = source.source();
+                    }
+                    if copy > 0 {
+                        message = format!("{copy} of {jobs} copies were sent, each as a job of its own, and the next was not: {message}");
+                    }
+                    spool_error(message)
+                })?;
+        }
+        Ok((repeat, jobs))
     });
     drop(dir);
-    result?;
-    Ok(format!("spooled {count} sheet(s)"))
+    Ok(match result? {
+        (Some(repeat), _) => format!("spooled {count} sheet(s) {} times, collated", repeat.copies),
+        (None, jobs) if jobs > 1 => format!("spooled {count} sheet(s) as {jobs} jobs, one per collated copy"),
+        _ => format!("spooled {count} sheet(s)"),
+    })
 }
 
 #[cfg(test)]
@@ -199,7 +252,7 @@ mod tests {
         let device = select_device(PrinterDevice::all().unwrap(), Some(&name), None).unwrap();
         let job = Job { copies: 2, ..Job::default() };
         let (ticket, paper) = driver_ticket(&device, &job, (612.0, 792.0), false).unwrap();
-        ticket::verify_job_options(std::str::from_utf8(ticket.get_xml()).unwrap(), &job, 1).unwrap();
+        ticket::verify_job_options(std::str::from_utf8(ticket.get_xml()).unwrap(), &job, 1, ticket::Offered::default()).unwrap();
         assert_eq!(paper, (215_900, 279_400));
         eprintln!("unprintable margin: {} pt", imageable_margin(&device, &ticket));
         if let Ok(path) = std::env::var("CRAFT_PRINT_TEST_TICKET_OUTPUT") {
@@ -212,7 +265,7 @@ mod tests {
             ("DocumentCollate", "Collated", Job { copies: 2, ..Job::default() }),
         ] {
             let (ticket, _) = driver_ticket(&device, &requested, (612.0, 792.0), false).unwrap();
-            let retained = ticket::verify_job_options(std::str::from_utf8(ticket.get_xml()).unwrap(), &requested, 3);
+            let retained = ticket::verify_job_options(std::str::from_utf8(ticket.get_xml()).unwrap(), &requested, 3, ticket::Offered::default());
             eprintln!("{feature}={wanted}: {retained:?}");
             let offered = capabilities
                 .options_for_feature(OwnedName::qualified(feature, NS_PSK, Some("psk")))
@@ -242,4 +295,30 @@ mod tests {
         eprintln!("{sent:?}");
         assert!(sent.is_ok());
     }
+
+    /// A colour chosen in the driver's own preferences (Properties…) reaches the job when the job
+    /// doesn't ask for grayscale: the validated ticket has the colour of the user's preferences,
+    /// whatever they are (storytold/pdfcraft#2422; it was always Color before). Set the queue to
+    /// black and white in its preferences to see the case that failed. Sends no job.
+    #[test]
+    #[ignore = "needs CRAFT_PRINT_TEST_PRINTER naming an installed printer; sends no job"]
+    fn the_preferences_colour_reaches_a_job_without_grayscale() {
+        fn colour(ticket: &PrintTicket) -> Option<String> {
+            let xml = std::str::from_utf8(ticket.get_xml()).ok()?;
+            let document = roxmltree::Document::parse(xml).ok()?;
+            let feature = document
+                .root_element()
+                .children()
+                .find(|n| n.has_tag_name((ticket::NS_PSF, "Feature")) && n.attribute("name").is_some_and(|a| a.ends_with(":PageOutputColor")))?;
+            feature.children().find(|n| n.has_tag_name((ticket::NS_PSF, "Option")))?.attribute("name").map(str::to_owned)
+        }
+        let name = std::env::var("CRAFT_PRINT_TEST_PRINTER").unwrap();
+        let device = select_device(PrinterDevice::all().unwrap(), Some(&name), None).unwrap();
+        let mut builder = PrintTicketBuilder::new(&device).unwrap();
+        builder.merge(PrintTicket::from_xml(winprint::ticket::DEFAULT_PRINT_TICKET_XML.as_bytes().to_vec())).unwrap();
+        let preferences = colour(&builder.build().unwrap());
+        eprintln!("the preferences' colour: {preferences:?}");
+        let (ticket, _) = driver_ticket(&device, &Job::default(), (595.28, 841.89), false).unwrap();
+        assert_eq!(colour(&ticket), preferences, "a job without grayscale keeps the preferences' colour");
+    }
 }
diff --git a/crates/quit/src/lib.rs b/crates/quit/src/lib.rs
index b57928c9..5151c47d 100644
--- a/crates/quit/src/lib.rs
+++ b/crates/quit/src/lib.rs
@@ -65,12 +65,16 @@ pub use close::{QUIT_MENU_ID, on_close_request, on_menu_event};
 /// For apps without an app menu of their own. It replaces the whole menu and sets muda's
 /// process-wide menu-event handler, so an app that builds its own muda menu should not call it:
 /// give that menu's Quit item [`QUIT_MENU_ID`] and pass its events to [`on_menu_event`] instead.
+/// muda keeps the first handler set, so this and `craft_menu::mac::install` are alternatives: an
+/// app calls one of them. `craft_menu::mac::install_app_menu` builds the same menu on craft-menu's
+/// menu event handler, which its full menu bar shares.
 ///
 /// On error winit's menu stays: the app still runs, but ⌘Q quits without asking. The app decides
 /// whether that is fatal; `?` passes it out of the eframe app creator.
 ///
 /// Other platforms: does nothing and returns `Ok`.
 #[cfg(feature = "menu")]
+#[deprecated(note = "use craft_menu::mac::install_app_menu")]
 pub fn install_app_menu(ctx: &egui::Context, app_name: &str) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     #[cfg(target_os = "macos")]
     menu::install(ctx, app_name)?;
diff --git a/crates/text/Cargo.toml b/crates/text/Cargo.toml
new file mode 100644
index 00000000..ae32a115
--- /dev/null
+++ b/crates/text/Cargo.toml
@@ -0,0 +1,156 @@
+[package]
+name = "craft-text"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+description = "Text processing below the Craft composer: hyphenation with a bundled US English dictionary and patterns, other languages through hypher"
+
+[lints]
+workspace = true
+
+[dependencies]
+hypher = { version = "0.1.8", default-features = false, features = ["alloc"], optional = true }
+miniz_oxide = { version = "0.8", optional = true }
+unicode-general-category = { version = "1.1", optional = true }
+unicode-linebreak = { version = "0.1.5", optional = true }
+unicode-segmentation = { version = "1.13", optional = true }
+icu_segmenter = { version = "2.3", default-features = false, features = ["compiled_data"], optional = true }
+unicode-bidi = { version = "0.3.18", optional = true }
+unicode-bidi-mirroring = { version = "0.4.0", optional = true }
+
+[dev-dependencies]
+unicode-segmentation = "1.13"
+
+[[example]]
+name = "hyphgen"
+required-features = ["generator"]
+
+[features]
+default = ["hyphen", "bidi", "segment", "linebreak"]
+# Hyphenation points; English (bundled dictionary and patterns) needs no further feature.
+hyphen = ["dep:hypher", "dep:miniz_oxide", "dep:unicode-general-category"]
+# Bidirectional text: embedding levels, line reordering and mirroring (UAX #9).
+bidi = ["dep:unicode-bidi", "dep:unicode-bidi-mirroring"]
+# Line breaking on a box/glue/penalty model (Knuth–Plass, greedy, balanced); no dependencies.
+linebreak = []
+# The dictionary writer (`hyphen::dict`) and pattern trainer (`hyphen::patgen`) used by
+# examples/hyphgen.rs.
+generator = ["hyphen"]
+# Line-break opportunities (UAX #14 with kinsoku) and grapheme-cluster emergency breaks; Thai, Lao,
+# Khmer and Burmese words need their language feature.
+segment = ["dep:unicode-linebreak", "dep:unicode-segmentation"]
+# With `thai`, `lao`, `khmer` or `burmese`: find their words with ICU4X's LSTM models instead of its
+# dictionaries. Much smaller (for web builds), slower to run, and its words differ slightly.
+lstm = ["segment", "icu_segmenter?/lstm"]
+# Each feature below adds the data for one more language: for `hyphen`, hypher's patterns (see
+# NOTICE for their licenses; Slovak is `slovak-gpl`, outside `all-languages`); for `segment`, ICU4X's word data for Thai, Lao, Khmer and Burmese
+# (one shared data set, Unicode License v3).
+all-languages = [
+    "afrikaans",
+    "albanian",
+    "assamese",
+    "belarusian",
+    "bengali",
+    "bulgarian",
+    "burmese",
+    "catalan",
+    "croatian",
+    "czech",
+    "danish",
+    "dutch",
+    "estonian",
+    "finnish",
+    "french",
+    "galician",
+    "georgian",
+    "german",
+    "greek",
+    "gujarati",
+    "hindi",
+    "hungarian",
+    "icelandic",
+    "italian",
+    "kannada",
+    "khmer",
+    "kurmanji",
+    "lao",
+    "latin",
+    "lithuanian",
+    "malayalam",
+    "marathi",
+    "mongolian",
+    "norwegian",
+    "oriya",
+    "panjabi",
+    "polish",
+    "portuguese",
+    "russian",
+    "sanskrit",
+    "serbian",
+    "slovenian",
+    "spanish",
+    "swedish",
+    "tamil",
+    "telugu",
+    "thai",
+    "turkish",
+    "turkmen",
+    "ukrainian",
+]
+afrikaans = ["hyphen", "hypher/afrikaans"]
+albanian = ["hyphen", "hypher/albanian"]
+assamese = ["hyphen", "hypher/assamese"]
+belarusian = ["hyphen", "hypher/belarusian"]
+bengali = ["hyphen", "hypher/bengali"]
+bulgarian = ["hyphen", "hypher/bulgarian"]
+catalan = ["hyphen", "hypher/catalan"]
+croatian = ["hyphen", "hypher/croatian"]
+czech = ["hyphen", "hypher/czech"]
+danish = ["hyphen", "hypher/danish"]
+dutch = ["hyphen", "hypher/dutch"]
+estonian = ["hyphen", "hypher/estonian"]
+finnish = ["hyphen", "hypher/finnish"]
+french = ["hyphen", "hypher/french"]
+galician = ["hyphen", "hypher/galician"]
+georgian = ["hyphen", "hypher/georgian"]
+german = ["hyphen", "hypher/german"]
+greek = ["hyphen", "hypher/greek"]
+gujarati = ["hyphen", "hypher/gujarati"]
+hindi = ["hyphen", "hypher/hindi"]
+hungarian = ["hyphen", "hypher/hungarian"]
+icelandic = ["hyphen", "hypher/icelandic"]
+italian = ["hyphen", "hypher/italian"]
+kannada = ["hyphen", "hypher/kannada"]
+kurmanji = ["hyphen", "hypher/kurmanji"]
+latin = ["hyphen", "hypher/latin"]
+lithuanian = ["hyphen", "hypher/lithuanian"]
+malayalam = ["hyphen", "hypher/malayalam"]
+marathi = ["hyphen", "hypher/marathi"]
+mongolian = ["hyphen", "hypher/mongolian"]
+norwegian = ["hyphen", "hypher/norwegian"]
+oriya = ["hyphen", "hypher/oriya"]
+panjabi = ["hyphen", "hypher/panjabi"]
+polish = ["hyphen", "hypher/polish"]
+portuguese = ["hyphen", "hypher/portuguese"]
+russian = ["hyphen", "hypher/russian"]
+sanskrit = ["hyphen", "hypher/sanskrit"]
+serbian = ["hyphen", "hypher/serbian"]
+# Slovak patterns are under the GPL, version 2 or later (hyph-sk.tex), unlike every other language
+# here, so `all-languages` leaves them out. A build that enables this ships GPL-licensed data. Any
+# other dependency that enables `hypher/slovak` (hypher's defaults do) embeds them too, through
+# feature unification.
+slovak-gpl = ["hyphen", "hypher/slovak"]
+slovenian = ["hyphen", "hypher/slovenian"]
+spanish = ["hyphen", "hypher/spanish"]
+swedish = ["hyphen", "hypher/swedish"]
+tamil = ["hyphen", "hypher/tamil"]
+telugu = ["hyphen", "hypher/telugu"]
+turkish = ["hyphen", "hypher/turkish"]
+turkmen = ["hyphen", "hypher/turkmen"]
+ukrainian = ["hyphen", "hypher/ukrainian"]
+burmese = ["segment", "dep:icu_segmenter"]
+khmer = ["segment", "dep:icu_segmenter"]
+lao = ["segment", "dep:icu_segmenter"]
+thai = ["segment", "dep:icu_segmenter"]
diff --git a/crates/text/README.md b/crates/text/README.md
new file mode 100644
index 00000000..585945b7
--- /dev/null
+++ b/crates/text/README.md
@@ -0,0 +1,313 @@
+# Craft Text
+
+`craft-text` holds the text processing that sits below each app's composer: functions that take
+plain text and a language and return what layout needs before it shapes and places glyphs.
+
+| Module | Feature | Provides |
+| --- | --- | --- |
+| `hyphen` | `hyphen` (default) | Hyphenation points |
+| `segment` | `segment` (default) | Line-break opportunities with kinsoku; Thai, Lao, Khmer and Burmese words; grapheme-cluster emergency breaks |
+| `bidi` | `bidi` (default) | Bidirectional text: embedding levels, line reordering, mirroring |
+| `linebreak` | `linebreak` (default) | Line breaking on a box/glue/penalty model |
+
+Language features (`spanish`, `german`, …, `all-languages`) add the data for one language to every
+module that uses it, and turn those modules on. Build with `default-features = false` to leave
+out all modules and data.
+
+## Hyphenation
+
+`craft_text::hyphen` finds hyphenation points. It returns byte offsets into the word: a hyphen
+may go before the char that starts at each offset. Line breaking, discretionary hyphens and
+exception lists stay in each application.
+
+### English
+
+English is always available with `hyphen` and needs no language feature. Each word is looked up
+in this order:
+
+1. the bundled dictionary (`Dictionary::en_us`): the Moby Hyphenator II word list, about 160,000
+   words. Simple inflections (`'s`, `-s`, `-es`, `-ed`, `-d`) inherit the breaks of their stem;
+2. the bundled Liang patterns (`assets/hyphen/en-us.pat`), trained from the same list by the crate's
+   patgen-style trainer;
+3. a small syllable heuristic for words outside the pattern alphabet.
+
+Case, apostrophes (`don't`, `’s`), surrounding punctuation and compounds are handled; no break is
+placed next to an apostrophe or a non-letter. `Dictionary::en_us()` also serves as an English word
+list, for example for spelling checks.
+
+### Other languages
+
+Other languages use the patterns compiled into [hypher](https://crates.io/crates/hypher) 0.1.8.
+Each has a cargo feature named as in hypher (`spanish`, `german`, `norwegian`, …); `all-languages`
+enables 46 of them. Patterns for languages whose feature is off are not compiled in.
+
+Slovak's patterns are under the GPL, version 2 or later; the patterns of every other language are
+under a permissive license. craft-text asks for Slovak through the feature `slovak-gpl`, which
+`all-languages` leaves out; a build that enables it ships GPL-licensed data. Cargo unifies features,
+so another dependency that enables hypher's `slovak` feature (hypher's default features do) embeds
+the same data. A build that must exclude it checks its dependency graph
+(`cargo tree -e features -i hypher`).
+
+```rust
+use craft_text::hyphen::{Lang, Limits, hyphen_points_in};
+
+fn points(word: &str, language: &str) -> Vec<usize> {
+    match Lang::for_language(language) {
+        Some(lang) => hyphen_points_in(word, &Limits::default(), lang),
+        None => Vec::new(), // unknown language or feature off: don't hyphenate
+    }
+}
+```
+
+`Lang::for_language` accepts English language names as InDesign and IDML write them (`Spanish`,
+`German: 2006 Reform`, `$ID/Norwegian: Bokmal`) and locale codes (`es`, `es_ES`, `pt-BR`,
+`de_DE_2006`). It returns `None` for unknown languages and for languages not compiled in.
+`Lang` is `Copy + Eq + Hash`, so it can key a cache of computed points. Its `Patterns` variant
+holds an opaque `PatternLang`; build one with `Lang::for_language`.
+
+### Limits
+
+`Limits` holds the paragraph's settings: minimum word length, letters before the first and after
+the last hyphen, and whether capitalized words are hyphenated. Words in all capitals are never
+hyphenated. Limit checks are linear in word length.
+
+### Regenerating the English data
+
+`examples/hyphgen.rs` rebuilds `assets/hyphen/en-us.dic` and `assets/hyphen/en-us.pat` from the
+Moby list. It needs the `generator` feature, which exposes the dictionary writer (`hyphen::dict`)
+and the pattern trainer (`hyphen::patgen`); applications don't need it.
+
+```sh
+curl -LO https://www.gutenberg.org/files/3204/files/mhyph.txt
+cargo run --release -p craft-text --features generator --example hyphgen -- mhyph.txt crates/text/assets/hyphen --validate
+```
+
+## Segmentation
+
+`craft_text::segment` finds where a line may break. It takes plain text and returns byte offsets;
+measuring, choosing breaks and hanging punctuation stay in each application's composer.
+Consolidated from vectorcraft, wordcraft, deckcraft and designcraft.
+
+```rust
+use craft_text::segment::{Kinsoku, Options, line_breaks};
+
+let options = Options { kinsoku: Kinsoku::Soft, ..Options::default() };
+for b in line_breaks("日本語のテキスト。", &options) {
+    // A line may end before byte b.offset; it must if b.mandatory.
+}
+```
+
+`line_breaks` starts from UAX #14 (the `unicode-linebreak` crate) and adjusts it:
+
+- `Options::kinsoku` applies the Japanese and Chinese line-start and line-end rules (JLREQ,
+  CLREQ) at breaks next to an East Asian character. Text with no East Asian characters gets
+  UAX #14's breaks unchanged.
+  - `Hard` (default): UAX #14's breaks, minus those kinsoku forbids.
+  - `Soft`: as `Hard`, and 々, ー and small kana may start a line.
+  - `None`: UAX #14's breaks plus a break between any two East Asian characters.
+- `Options::korean_words` sets Korean word by word: no break between two Hangul letters or Han
+  ideographs. Off, Korean breaks between syllables as UAX #14 does.
+- Mandatory breaks (newlines and the end of the text) are always kept.
+
+`Options::for_language(language)` gives the options for a paragraph's BCP 47 language tag, or for
+an unknown language (`None`): `korean_words` for Korean, the defaults otherwise.
+
+When no opportunity leaves a line short enough, `emergency_breaks(text, range)` gives the places
+to break the piece `text[range]` anyway: byte offsets into `text` between extended grapheme
+clusters (UAX #29, through `unicode-segmentation`). An emoji ZWJ sequence, a flag or a letter with
+its marks is never split.
+
+`kinsoku_allows(before, after, mode)` is the same rule for composers that build their own
+opportunity lists.
+
+### Each app's kinsoku as a `Kinsoku` value
+
+| App | App setting | `Kinsoku` | Rules the app keeps |
+| --- | --- | --- | --- |
+| vectorcraft | Kinsoku set None, Hard, Soft | `None`, `Hard`, `Soft` | none |
+| wordcraft | `kinsoku` on, off | `Hard`, `None` | `word_wrap` off: Latin words break at any character |
+| designcraft | no set (the breaker's own rules); Hard Kinsoku | `Hard` | custom document tables, inseparable pairs, bunri-kinshi, rensuuji, roman word break |
+| designcraft | Soft, Simplified Chinese, Traditional Chinese, Korean Kinsoku | `Soft` | as above |
+| designcraft | Kinsoku set None | `None` | as above |
+
+Push-in and push-out priority and hanging punctuation decide how a line fits, not where it may
+break, and stay in the composer. deckcraft has no kinsoku of its own (see below).
+
+### Kinsoku sets for adopters
+
+The sets are vectorcraft's (`no_line_start`, `soft_line_start`, `no_line_end`), plus these from
+the other apps:
+
+- Can't start a line: 〞 (closing double prime quote), ゛ ゜ ﾞ ﾟ (spacing sound marks), ％ ￠
+  (postfixed abbreviations, JLREQ cl-13). From wordcraft.
+- Can't end a line: ＄ ￡ ￥ (prefixed abbreviations, JLREQ cl-12). From wordcraft.
+
+What changes for each app:
+
+- vectorcraft: the additions above. Breaks come from UAX #14 rather than "after any CJK
+  character", so `Hard` and `Soft` also keep every break UAX #14 forbids. Kinsoku no longer
+  applies between two non-East-Asian characters (a space before an en dash in Latin text may
+  break).
+- wordcraft: its kinsoku on is `Hard`, which also keeps the prolonged sound mark, small kana,
+  hyphens (‐ – 〜 ゠), ‼ ⁇ ⁈ ⁉ and the Latin closing marks next to East Asian text off the line
+  start, and « ‘ “ ( [ { off the line end. Its kinsoku off is `None`. Breaking Latin words
+  anywhere (`word_wrap` off) and the no-break-after-slash rule stay in wordcraft.
+- designcraft: its breaker's set is `Hard` without the additions above and without ’ ” 〛 〟 ｠
+  〜 ～ ゠ ‐ – ‼ ⁇ ⁈ ⁉ », ゕ ゖ, ㇰ–ㇿ and the half-width forms (can't start), « ‘ “ 〚 〝 ｟ ｢
+  (can't end). Its Soft set also lets ゝ ゞ ヽ ヾ 〻 start a line; here they stay forbidden, as in
+  InDesign's Soft set. Document kinsoku tables (`Kinsoku` in `doc/cjk.rs`) stay in designcraft.
+  `korean_char_breaks: false` is `korean_words: true`.
+- deckcraft: `Hard` is its UAX #14 breaks minus those kinsoku forbids. `None` adds breaks between
+  East Asian characters, so no mode returns plain UAX #14 for East Asian text.
+
+### Thai, Lao, Khmer and Burmese
+
+UAX #14 gives these scripts class SA and leaves breaking inside them to a dictionary. Without the
+script's language feature, `line_breaks` treats a run of them as one word: it never breaks inside
+the run, only at its edges where UAX #14 allows a break (after a space, for example). A long Thai
+sentence with no spaces is one unbreakable piece, so the composer needs an emergency break for it.
+The features `thai`, `lao`, `khmer` and `burmese` split runs of that
+script into words with ICU4X's segmenter (`icu_segmenter`). Any one of them links the data for all
+four; the default build has no ICU data. The data is under the Unicode License v3 (see NOTICE).
+
+The segmenter has two models, chosen by the `lstm` feature:
+
+| Model | Feature | Added to a wasm32 release build | Gzipped |
+| --- | --- | --- | --- |
+| Dictionaries (desktop default) | none | 1.86 MB | 0.89 MB |
+| LSTM models (for web) | `lstm` | 0.42 MB | 0.33 MB |
+
+Measured on a minimal `line_breaks` example, against the same example with `segment` alone. The
+LSTM models are slower to run and split a few words differently, mostly compounds broken between
+syllables (Lao ລາດ|ຊະການ, Burmese မြန်|မာ), which are still valid line breaks.
+## Bidi
+
+`craft_text::bidi` runs the Unicode Bidirectional Algorithm (UAX #9, through
+[unicode-bidi](https://crates.io/crates/unicode-bidi)) on document text. It works on plain text and
+needs no fonts; shaping, glyph mirroring and caret placement stay in each application.
+
+The pipeline is the one UAX #9 prescribes:
+
+1. `Paragraph::new(text, Direction::Rtl)` resolves embedding levels once for the logical
+   paragraph. `Direction::Auto` takes the direction from the first strong character.
+   `Paragraph::with_overrides` also forces byte ranges to one direction (as LRO/RLO would),
+   keeping offsets into the original text. A paragraph separator (`\n`, U+2029) in the text starts
+   a new paragraph with its own level: `paragraphs()` lists each one's byte range and level, and
+   `level()` is the first one's.
+2. The application shapes and breaks lines in logical order.
+3. Each line is reordered on its own: `Paragraph::visual_runs(line)` returns its runs of one level
+   (byte range and level) left to right as displayed, with rule L1 applied (trailing whitespace,
+   tabs and separators at the level of the paragraph they are in). Zero-width joiners and tag
+   characters keep the level of the character before them, so no run splits a grapheme cluster.
+   A run with an odd level displays its characters from end to start. Lines should not cross a
+   paragraph separator.
+
+Lines made of other units (clusters, glyphs, cells) use the free functions on level slices:
+`line_levels(chars, levels, para_level)` for rule L1 and `visual_order(levels)` for rule L2.
+`mirror(c)` returns the mirrored character for rule L4 (`(` for `)`), or `None` when the font has
+to supply a mirrored glyph.
+
+Offsets are bytes into the paragraph's `&str`: `Paragraph::levels()` holds one level per byte,
+as unicode-bidi resolves them, and line ranges and runs are byte ranges. This matches the shaper
+cluster offsets and line ranges the apps already keep, so no char-index table is needed;
+`char_levels()` gives one level per character for code that works on `char` slices. Levels are
+plain `u8` (even left to right, odd right to left), so unicode-bidi's types don't leak into
+callers.
+
+Text with nothing right to left in a left-to-right or `Auto` paragraph skips the algorithm.
+
+The module started from DeckCraft's `text::bidi` (levels, rule L1 and L2 over chars). The
+per-byte levels, the run-level reordering test cases and the hostile-input checks come from
+WordCraft's layout; overrides and mirroring follow DesignCraft's composer.
+## Line breaking
+
+`craft_text::linebreak` breaks paragraphs into lines on Knuth and Plass's box/glue/penalty model.
+It knows nothing about fonts: the composer turns shaped glyphs into `Item`s, calls a breaker and
+places the glyphs of each returned `Line`. Widths are in the caller's units, and `width(k)` gives
+the measure of line `k`, so first-line indents and shaped frames work. The core comes from
+vectorcraft's every-line composer; tiered justification, emergency breaks, the hyphenation zone,
+greedy and balanced lines come from designcraft's breaker.
+
+- **Items.** Boxes, glue and penalties. Glue has a natural width and stretch and shrink in three
+  tiers (word space, letter space, glyph scale) that are used in that order, as in InDesign's
+  justification settings. Boxes may carry letter and glyph tiers too. Penalties have a cost and a
+  flag (hyphens); ±10 000 forbids or forces the break. `Item::fill()` before the final
+  `Item::forced()` leaves the last line unjustified. Optional fields, set on top of a constructor
+  (`Item { hang, ..Item::glue(w, st, sh) }`): `hang` (optical margin), `edge` (an `Edge` of
+  stretch and shrink gained at a line end or start, such as mojikumi), `hyphenation`,
+  `emergency`.
+- **Breakers.** `knuth_plass` runs one total-fit pass. `break_paragraph` runs passes at rising
+  tolerances, then falls back to `greedy`; the returned `Breaks` says in `method` which one
+  produced the lines. `greedy_with` resolves position-dependent widths (tabs). `balanced` evens
+  the lines (meant for ragged text) and sets `Breaks::balanced` when it did. `overlong` finds
+  words wider than the measure, where the composer adds `Item::emergency()` breaks.
+- **Params.** Demerits, fitness classes, tolerance, hyphen limit, tier costs, `uniform_from`,
+  and `Rag` for ragged text: rag stretch, short-last-line rating and hyphenation zone.
+  `uniform_from` is the first line index from which `width(k)` stays the same. The default 0 is
+  right for a constant measure; a caller with a first-line indent, drop cap or shaped frame sets
+  it to the first line of the constant tail, or its breaks may not be the best ones. Negative or
+  NaN demerits count as 0, and a NaN measure as 0.
+- **Lines.** Each `Line` gives its item range, natural width, adjustment ratio, the fraction of
+  each tier used and the width left over, so the composer can distribute the space.
+
+```rust
+use craft_text::linebreak::{Item, Params, Rag, break_paragraph};
+
+let space = Item::glue(0.5, 0.0, 0.0);
+let items = [Item::boxed(3.0), space, Item::boxed(3.0), space, Item::boxed(5.0), Item::fill(), Item::forced()];
+let ragged = Params { rag: Some(Rag::default()), ..Params::default() };
+let lines = break_paragraph(&items, &|_line| 8.0, &ragged, &[1.0, f64::INFINITY]).lines;
+```
+
+### Adopting
+
+- **vectorcraft** `composer::compose`: a box per glyph (`hang` = `start_credit(i)` for `i > 0`),
+  glue per space (justified: stretch 0.5 and shrink 0.2 of its width; ragged: none), a penalty per
+  `Breakpoint` (width = its hyphen, flagged when it has one, cost 50 justified or 25 ragged), and
+  `fill` + `forced` at the end unless Justify All. `Params`: `first_fitness: None`,
+  `max_badness: 10_000`, `fitness_demerits` 10 000 or 1 000, `fitness` bounds
+  `[-0.5, 0.5, 1.0]` or `[0.15, 0.4, 0.75]`, `uniform_from` as `layout.rs` computes it (the
+  first index from which `widths` stay at the last width); ragged adds
+  `Rag { stretch: 0, width_fraction: 1/6, short_last: 1/3, short_last_unit: 1/3 }`. Its two
+  `compose` calls become two `knuth_plass` calls (tolerance 1, then 4 or ∞); `None` still falls
+  back to the single-line composer.
+- **designcraft** `breaker::items` builds `linebreak::Item`s: `hang`, `edge` (mojikumi
+  end/start elasticity), `overflow` (`space_overflow`), `hyphenation` (`auto`), `emergency`.
+  Ragged text uses plain spaces and `Rag { stretch: ragged_stretch, width_fraction: 0,
+  hyphenation_zone: hyph_zone }` instead of glue/penalty/glue triples. `Spacing` maps to
+  `Params { hyphen_limit, overrun: FIT_EPS, uniform_from, .. }` with `uniform_from` the number
+  of drop-cap lines, else 1 with a first-line indent, else 0. Kinsoku priority 1 or 2 maps
+  to `stretch_weight` or `shrink_weight` 4; `TIER_COST` is `tier_cost`. `knuth_plass` becomes
+  `overlong` + emergency items + `break_paragraph(.., &[2.5, 12.0, f64::INFINITY])`; `greedy`
+  becomes `greedy_with` (tabs through `advance`; `Item::no_break()` where an emergency split is
+  not allowed); `balanced` becomes `balanced`. Mapping lines back to glyphs
+  (`breaks_from_positions`) stays in the app.
+- **effectcraft** `every_line`: a box per segment between line-break opportunities, glue for its
+  trailing whitespace, `Rag { width_fraction: 1.0, .. }`, `uniform_from: 1` (the first line's
+  measure differs when it is indented) and `break_paragraph(.., &[f64::INFINITY])`.
+
+Differences from the seeds:
+
+- vectorcraft: a Justify All last line is accepted at any ratio, like every line that ends at a
+  forced break.
+- designcraft: fill glue stretches infinitely instead of by 10 000 units. In ragged text a line
+  ending at a forced break keeps its neighbour's fitness class. Greedy counts every flagged break
+  toward the hyphen limit, and splits overlong words at the composer's emergency breaks instead
+  of scanning for kinsoku. Past 4096 active breaks a pass fails and `break_paragraph` falls back
+  to greedy, reported as `Method::Greedy`. Lines before `uniform_from` (first-line indent, drop
+  cap) are kept apart by line number, where designcraft treats every line alike.
+- effectcraft: lines are rated by Knuth's cubed ratio, not squared slack.
+
+## Licenses
+
+The word list is public domain; the trained patterns are CC0-1.0. hypher's patterns come from
+hyph-utf8 under their own permissive licenses (LPPL, MPL, MIT, BSD-3); see the repository's
+[NOTICE](../../NOTICE) and [ATTRIBUTION.md](../../ATTRIBUTION.md).
+
+## Checks
+
+Some tests depend on language features, so run the suite with them on:
+
+```sh
+cargo test -p craft-text --all-features
+```
diff --git a/crates/text/assets/hyphen/en-us.dic b/crates/text/assets/hyphen/en-us.dic
new file mode 100644
index 00000000..a0900914
Binary files /dev/null and b/crates/text/assets/hyphen/en-us.dic differ
diff --git a/crates/text/assets/hyphen/en-us.pat b/crates/text/assets/hyphen/en-us.pat
new file mode 100644
index 00000000..92dc61f3
--- /dev/null
+++ b/crates/text/assets/hyphen/en-us.pat
@@ -0,0 +1,1633 @@
+% DesignCraft US English hyphenation patterns (Liang/TeX notation).
+% Generated by crates/compose/examples/hyphgen.rs: trained with DesignCraft's patgen-style trainer
+% from the Moby Hyphenator II word list by Grady Ward (public domain, Project Gutenberg #3204).
+% Released into the public domain (CC0-1.0) by the DesignCraft contributors.
+'2c '4cl '4do 'emil4 'emili4 'exi4 '4fa '4fl 'ha4 'immor4 '4in 'l2
+4'll 4're 2's 4's. .a2 .a4ba. .a3bas .a4b3er .ab3h .a4bia. .a4bie .a4bil
+.ab5ir .a4bl .ab3la .a4bo. .a4bos .a3b4u .a6cetyl. .a4cl .a5coe .ac3t .ac4te .ac4u
+.a4cus .acu4ta .a4cy .ad4ded .ad4der. .ad6din .a4dh .a4di .ad3ia .ad3ip .a4don .ad3um
+.a4dur .a4dy .ae4r3 .ae4ta .af1 .af3t .a4gan .a4g3a4t .ag4e .a3gen .agis4te .a3gl
+.a4glet .a3gu .aile4 .ak2 .alar4 .ald4 .a4ley .al4fa. .ali4as. .al3ie .al3im .a5lin
+.al4ist .alk4 .al5ky .al3l .alli4e .alm4 .a3lon .alth4 .amalgam5 .ama4li .ama4ra. .amato6ry
+.amb4 .ame4l .a4ment .ami4r .a4mosi .amp4 .an1 .a4na. .a6nac .an3ar .a3nath .an3c
+.anchis4 .an3g .a4n3i .an3k4 .an4nem .an3or .an3s .an4tal .an4tat .anti3a .anti5f .anti3s
+.an3y .a3o .a4pal .a3par .ap3at .a6perie .a4phar .apho3 .aph3or .a4plan .ap4le .a5por4
+.appe3t .a3pr .aqui3 .arbo6rea .archa5i .ar4chan .ar3d4 .are4l .ar3g .ar2i .aria4 .ar4ia.
+.ar4io .ar4iu .ar4mes .a3rou .ar4rie .ar3s .arsen6 .ar4sp .ar4sy. .ar3t .ar4tier .ar4tin
+.ar4tl .ar4ty .as4a .as5ce .as4d .as4e .as3p4 .as4r .as1s .ass4e .as6teria .as4tom
+.as6tron. .as4u .at5ar .a4t4e .ate4l .ath3a .ath4em .a4to4 .ato2m .atom3i .at4ty .au3b
+.au4rou .aus3 .aus4a .a4val .a4vat .a4ven .a5veng .a3vi .a4vid .aw4r .ax3 .ax4en
+.ay4l .a3yu .a4zi .b2 .ba4bel. .ba2bi .bach3 .ba4cl .ba4di .ba4ga .ba4la. .bal4lu
+.ba2lu .banda4 .ba4ni4 .ba4r .ba4san .bas6tia .bate4 .b4b .b4d .be4a. .be2d .beef3
+.bel4lo. .be3ni .ber2a .ber4i .be3str .bev3 .b4h .bi2al .bi4e .bi4lan .bill4a .binar4
+.biz4 .bk4 .b4l4 .ble4 .bli4n6 .b4m .b4o .boan4 .bod2e .bo4ral .bor4t .b4r
+.brea4 .bre4c .brel4 .bres4 .bre4t .bri4t .bro4s .b4s .b4t .bul4bar .bun4di .bunk4e
+.bun4t .bu4ri .bz4 .c2 .c4a2 .ca4bel .ca4dil .ca4le .cal3o .ca4mas .candi4a .carbon5y
+.ca4ro. .car3ol .ca4t .cat4as .cat3e .catter4 .c4b .ce4br .cec4 .ce4lan .ce4li4a. .cens4
+.cer2a .cer4i .ce3r4o .cess4 .c4h4 .che4m3 .chi4g .chiv3 .chol4i .cho3ro .chthon4 .church5
+.chy4p .c4i .ci4a .cic5e .cid4e .cin3 .ciner4 .ci4s .ci4t .cit3i .cit3r .cit3y
+.c4l4 .cla4d .cla4r .cle4l .cli4nal .cli4t .clu4 .c4n .cnid4 .co3ed .co5et .co4let.
+.co4lo. .co4mat .convin6 .cop2e .co4pl .copol5 .co4p3y .corn4in .corre5s .cotti4 .cotu4 .cout4
+.cow5a .cp4 .cret4 .cre4ti .cro4ma .cro4p .cro4se .cru4d .c4to .cu4mi .cun4 .cu4rati
+.cur4b .cur4vy .cu2t .cutin3 .c4v .cya4ne .cyan4o .cy4n .cys6tic. .cy4th .cz4 .d2
+.d4a2 .da4ce .dacty4 .da4li .da4m .da4ni .dar4ia .dar4i4u .dar4te .da4to .da4vit. .dd4
+.d4e .de4an. .dea4t .de2bo .de4bra .de4cil .de4lis .de4mi. .de4moi .de4mons .de4mos. .dent4
+.de3r4a4 .dern4 .de3sce .de6sert. .de3t2 .de4vil .de4war .dez4 .di4a. .di6able. .di4al. .diar4y
+.didy4 .di4f .di4le .di4os. .diot4 .diri6gi .dis3 .disar4m .d4m4 .d4na. .do2 .do4co
+.dola4 .dol2o .dors4 .dous4 .do4v .dow4y .dr4 .dre4 .dro4 .dro2m5 .d4s4 .d4u
+.du4ca .dul4la .dun4nit .du3r4a .du6rativ .dus4 .d4v .dy4f .dy4nas .dy4s .d4z .eac4
+.ea3g .eak4 .eal4i .ear4t .east3 .ea4sy .ea4te .e2b .eb3o4 .ech3o .e4cla .e2cle
+.e4clo .e4col .e4con. .e2cos4 .e2cot .e4da. .e4deli .ed4h .ed4it. .e4do. .ed4t .ee4
+.eer4 .e4f .efflu6e .eg4ge .e2i .eid4 .el4a .elab3 .e6later. .e4lay .eld4i .e3le
+.e4lea .e4lect. .el3e3g2 .el4egit .e4len .ele3p .el4f .el4i .eli4as .e4lie .e4lio .e4lip
+.e3lis .eli4so .e2ly .e2man .em3ana .e4mer .e4met .em5igra .emil4 .emili4 .emi4r .e4mis
+.e4mog .e4mor .e2na .en3act .enam3 .e3name .en3an .en3c .en4cy. .en3e .enervat6 .enes4
+.e4nosi .ent2 .eon4 .eo3si .e2p .eph4 .epho4 .ep3ic .epid4 .ep3in .e4pio .e4po
+.e6quine .eq3ui5t .e6quiva .er2 .e1ra .er4e .erg4 .e4ri .eri4d .er3m .e1ro .ero6g
+.er4rab .er4ri .e4s3 .es4op .eso3t .es4u .et4al .e3te .e3ther .eth4yl. .e4tia .e4tow
+.etu4 .eun4 .eu4ra .e4va. .e4van. .evapor4 .e4var .e4vat .ever2 .evers4 .ever4t .eve3ry
+.evo4c .e4wan .ex3 .exhaus4 .ex4or. .ex5u .ey4a .f2 .fanat3 .f4b .f4c .fe4me
+.fen4d .fer4a .feri4a .fe4ta. .f4f .f4i2 .fi4do .figur5at .final4 .fi6nan .finea6 .fin3g
+.fis4ti .f4l .fle4 .frin4 .f4s .fu4el. .fu3si .g2 .g4a2 .ga4da .ga4m .gam3i
+.gam3o .ga4p .ga4ri .gar4th .ga4s3 .ga4th .g4b .g4c .g4d .ge2a .ge4li .gen4f
+.geni4a .genom4 .gent4 .gen3tl .geo4me .ger4ent .ger4i .ger4o .ghi4 .gi2 .gian4 .gi4b
+.gin5ge .g4l .glass5 .g6le .gle4a .gluti6na .g4n .gne4 .go4l .go4me .gon3o .go4r
+.go4s5p .gou4t .g4r .gra4ce .graduat6 .gra4p .grip4pa .gro4g .gu4g .gu4ri .gu4t .gy4b
+.h2 .ha2 .ha4c .hae2 .ha4g .hag3i .ha3la .hal3i .ham5ad .hand3i .han4g3 .hank4
+.ha4no .haran4 .has4k .has4t .hast6i .ha4v .he2 .he4a .hec3at .he4i .he4la. .hel3ic
+.help5 .hem3i .hem4ic. .hemis6 .he3mot .hemo6tr .hem4p .hep3a .he3red .he5resi .her6in .hero4p
+.he4s .hi3b .hi4c .hi4dr .hi4lary .hil5d4 .hiller4 .hil4li .hil4ly .hi4m .hin4der .hin4g
+.hi4o .hi4s .hi4t .h4m .ho4a .ho4do .hoe4s .ho4i .ho4la .ho4le .hol3o .ho4ma
+.ho4mon .ho4my .hoo4 .hoosi4 .ho4p .ho4rac .ho4sen .ho4th .hov5er .h4s .huff3 .hurs4
+.hy3g .hyo4 .ia2 .iae4 .i5am .i4as. .i4ast .ia4t .i4ata .iat3r .i4br .i4ca
+.i4cel .ich3 .ich4i .i4da. .idel4 .i4des .i4d3i .i3d4l .ido2 .idol3 .i4e .if4u
+.ig4f .i4gl .ig3n .i4h .i4j .ikar4 .ile4a .i4li .ili4s .ilk4 .il4lima .illo4
+.il4lus. .i4lo. .i2m .im3age .imi4d .im4in .im4it. .im3m .i4mo .im4ph .im5pin .i4n3
+.ina4m .inc4 .in5ce .ind2 .in4dic. .indi6cat .ine4a .in4gly .in4k .inow4 .in6suran .i1o
+.i4oa .io4b .i4or .i4ou .i4pa .ipi4 .iq4 .i4ra. .i4ran. .ir2i .i3ric .ir3id
+.iri4s .i4ro. .ir3r .i4si .i4so. .i4ta. .i4tac .ital3 .i4tal. .i3tem .i3ti .i4to.
+.i4tu. .iv2 .ixo4 .j2 .jame4 .jh4 .joli4 .juni4 .ju1r .jus3 .k2 .ka4le
+.kal4i .ka4li. .ka4te .ka4ti .k4c .ke4g .ke4p .ke4r .kh2 .ki2 .kian4 .ki4b
+.kil1 .ki4l3o .kin3em .k4l .kle4s .k4n .kni4f .kold4 .kon4e .ko4ni4a .k4u .k4w
+.l2 .l4a2 .la4br .lab5y .la4cy .la4ga .lalish4 .la3ma .la4me .la4na .lan4dr .laps4ib
+.lar4g .lar4i .las4t .lat3er .la4th .la4ti .lati6na .latin5i .lau2d .laz3a .l4e2 .lea4
+.lear4 .le4b .lech3e .lecith4 .le4gat .le4m .lemo4 .len4g .le4om .lep3r .le4pu .le4va.
+.lew3i .l4h .l4i2 .lid4i .lie4 .li4f .li4go .li4me .limo4 .linar4 .lin4eag .li3o4
+.lis6ter. .li4tu .l4l4 .lo2 .lo4chi. .lo4g .lo4i .lo4n .lo4p .lor4in .lot4i .lo4v
+.l4s .l4u .lub4l .lu4e .l4y .ly4b .ly4l .m2 .ma4bi .ma2c .mack4er .maga3
+.ma4la. .mal3ad .ma2n .mand4 .man4is .mans4 .mar4ia. .mar3ti .ma4thi .ma4tin .may4er .m4b
+.mc3 .mensu4 .mer4a .mer4ise .merit6e .me4s1 .met4al. .me6te6or. .meth6yl. .me4to .m4i .mia4
+.mi4a. .mi4d .mif4 .mi4na .mi4ne .mines4 .mi4n3i .mini4a .mi4s1 .mis4er. .mk4 .m4la.
+.m4m .m4ne .mo2 .mod1 .mo4da .mol4o .mo4no. .moth3 .mou4 .mould5 .mo4v .m4p
+.m4s4 .mul3 .mun4ga .muni4 .munis4 .mus5ke .mw4 .mye3 .my4i .my4t .n2 .naba4
+.na4bat .na4ch .nadi4 .na4i .nal4g .nan4i .na4ri .na4to .na2v .naw4 .n4c .n4d4
+.n4e2 .ne4bri .neb3u .ne4gro. .nem3at .neph3e .ner2 .ne4th3 .neva4 .ne4vi .n4g4 .n4i
+.ni2c .ni4da. .ni4e .ni4ne .nish4 .nit4e .n4n .n4o2 .no3e .no4m .no4n .no4r
+.nor4thi .no4s .noy4 .ns4 .nu4i .nu4n .nur4s .ny2 .o'4 .oax4 .obe3l .ob5elis
+.o5ber .o4bit4 .o4bl .ob5la .ob5lo .oblon4 .o4br .o2c .o4ca .oca4l .o4cel .o4ch
+.och3l .od4 .odel4 .o6donta .o4dr .o2dy .oe6co .oes3t .o4h .oil3 .ois4 .oit4
+.ok4 .o3le .ole4c .ol3ig .ol4la .o3ly .o4mad .on4as .ond4 .on4de .on4eros .oni4
+.onk4 .on3o .ood4 .o5og .o3o3ph .oos4 .o3pa4 .o4pec .ophe4 .o3pin .o2r .or3ato
+.orbi4 .or3c .or3d .o5ron .ors4 .ory4 .os3 .os4a .o4sa. .o4sc .os4i .o4st
+.os4tl .ote4 .ot4i .o4tr .ou4 .ous4 .out3 .ov2 .over3 .o4ver. .o4vu .ox3
+.oy4 .o4za .p2 .p4a2 .pa4b .paci4 .pa4k4 .pa4li .pan5at .par1 .par3at .par4ch
+.pa4ri. .park4e .parti4a .part4ib .pe4a .pear2 .pearl3 .pe4ba .pec3t .pe4lik .pel4te .pend4
+.pe6nult. .per4a. .pe4r3ia .per4lie .peron4 .pe3ru .pet3a .pe4ti .p4f .p4g .ph4 .pha4c
+.pha4n3 .phar3i .phil4ia .pho3n4 .phtha4 .p4i2 .pic5r .pi3ge .pi4mo .pin4dl .pin4er .pi4ol
+.pi3ra .pi4t .pit3y .p4l .plas3t .plat3i .pli6catu .po4dite .po3e .po4et. .po4k .po4lis
+.po4ni .po4p .pop5i .pop5l .port4e .post3a .post3h .post3o .p4r .pre3ad .pre4cat .pre4lat
+.pre6sent .pri4c .pro3a .proc4i4 .prolo6gi .pro4phy .propos6a .p4s .psa4 .p4t .pter4on .ptot4
+.ptyal4 .p4u .pur4ri .put4ter .p4v .q2 .qi4 .q4t .qua4m .r2 .r4a2 .ra4be
+.ra4bid .ra4ce .ra4cy .ra3d .ra4da. .ra4du .ra4f .ra4gi .rain4e .ra4pi .rap4pis .ra4to.
+.rave4 .rawl4i .r4c4 .re1 .re4an. .recho4 .re4col .rec5oll .rec3re .red4ded .red4din .red5in
+.redriv6 .reduc4e .re5end .re4go. .re4ist .re3ma .ren4ta .re4par .rep4i .re4rem .res4t .rest4i
+.ret2 .re3te .re4trib .re3vi .r3ge .rgen3 .rhag4 .rhet4 .rhe4to .rhe4u .rhot4 .ri2
+.ri4ba. .rib4e .ri4bl .ri4co .ri4e .ri4i .rio4 .ri4sh .ri4ta. .riv3e .r4ma .r4n4
+.r4o .ro4ba .ro4bi .rob4o4 .ro4ch .ro4g .rol4lin .romani6a .ro4p .ro4q .ro4san .ro2sc
+.ro4set. .ro4sin .ro4sy .ro4th .rough3 .ro4ze .rp4 .rs4 .r4sa .rt4 .rud4e .ru4in.
+.ru4l .run4i .runt3 .ru3r .r4w .ry4c .s2 .sa2 .sa4do .sak4e .sali6na .sal4is
+.sal4te .san4de .sani3 .sa4t3in .satur4a .sa4ve .s4c4 .sca4li .scar3a .sca6tol .schil5 .sci3e
+.s4e2 .se4a .se4lag .sel4e .self5 .sel4i .sel4li .sem3 .se4pa .sepho4 .ser4ice .ses3
+.se4v .s4f .s4g .s4h4 .shan3t .shing4 .shov3 .s4i2 .si3al .si4b .si4de .sid4eri
+.silk3 .si5lo .sin4ga .sin3g4l .sin3i .sis3 .s4k4 .s4l .sli4 .s4m .smal4 .smar2
+.smell3 .smok4in .s4n .sna4 .sne4 .so4a .soap3 .sodom4 .so4lute .so4me .som5er .son4a
+.soni4 .sot4e .soth4 .s4p4 .spel4 .spen4 .sper4o .spi4c .spi3d .spi4e .spi6ral. .spi4t
+.spo3ro .s4s4 .s4t4 .sta3li .stal4l .ste4n .ster4ic .stin4 .sto4le .sto4ria .stort4 .stot4i
+.sto4v .sub5l .sug3a .s4w .sy2 .sy5ring .sz4 .t2 .ta2 .ta4b .tac3i .ta4gr
+.ta4l .tal4ly. .ta4mi .tani4a .tanis4 .tanta3 .ta4p .tark4 .tas4si .tati4 .t4bil .t4c
+.te4 .tecto4 .tel1 .tel3a .tel3et .tel4li .ten3d4 .ten4o .ten4ti .ten4ty .tep4 .ter4as
+.ter4ent .ter4me .termin4 .ter4mo .teu3 .th4 .the3a .tho4m .tho6rax .thro4 .t4i2 .tia4
+.ti4f .ti3ge .til4lag .timet4 .ting4 .ti4p .tisa4 .tita4 .ti4ti .to4e .to4i .to4li
+.to4mal .tona4 .to4p .tor4c .to4th .trache5 .tra4s .tra4v .tre2 .tre4a .trep3o3 .tristi4
+.tri4ti .tro4po .t4s4 .tsu3 .t4u .tu4r4i .tuy4 .t4v .t4w .twin4i .ty3ro .tz4
+.u2 .u3b .uc4 .uca4 .u4da. .u4di. .udo4me .ugar4 .umen4 .un3 .unch4 .und2
+.under5e .under5s .u4ne .un5er4 .une4s3 .un5et .ung4 .un5in3 .unk4 .u4no .un5p .un5s
+.unsel4 .un5t4 .unta4 .u4p1 .u3ra .ura4l .u3re3 .ure4ti .u3ri .u4rial .u4rid .u3ro
+.u3ru .u4ru. .u4sa .u4si .usur4 .uta4 .ut4e4 .u3ti .u3tr .ut4s .u3v .v2
+.va2 .vac3i .va4len .val4is .va3p .vapo4 .var5ic .va4s .vas3o3 .v4c .ve2b .vei4
+.vel4la .ve3l4o .ven4er. .ver4se .ver4sy .ve2s .ve4ti .vi3gn .vi4ne .vin4i .vi2t .vi5va
+.vivipa6 .vi5zi .vo2l .vol5v .vo4r .v4r .v4z .w2 .wap5 .ward4er .war4e .wc4
+.whirl3 .wi4 .wk4 .wo4m .wr4 .x2 .xe3r .x4i4 .xn4 .x4t .x4v .xy3
+.xyl4 .y2 .ye4 .yes3t .yh4 .ym4 .y4o .yog4 .ys4e .y4u .yw4 .z2
+.za4c .zar4i .za4s .ze2 .zh4 .z4i .zi4b .zo4i .zo4n .zo4oty .zori4 .z4v
+2aa2 aad4 aa4f aar4d aar4i ab2 4a4b. 4aba. 4abag 4abaj abal2 a4bala
+a3ball abal4lo a3ban aba4ri 4abasi a4basine abas4si 4abas4tro a4batea a4batis a4batt 4a4b3b
+abba4s ab3d abe2 4abee a4bef a3bel a4bela abel3i a4bell. 4aber a4berc ab3erd
+a4bern a3bet ab3ho 4abhu 4abia4 ab3ica abi4d a4bidit a4bien a4biet ab3if 4abile
+4abilia abilis6e a6bilism abiliz6e a4bily 4abin4 abini4 a4bino ab5irr a4bist 2abi2t abit3ab
+ab3itat ab3j 1a3bl a4bla ab3lat ab4lin a5bling ab3lis a4blu ab3n 2a2bo 4abo.
+4aboa 4a3bob 3abolic ab5o5lise ab5olism ab3o3liz ab3olo abon4 4abor ab3ora 3about a2br
+4abra. a4brad 4abran abras4 4abria ab3ric ab3rog a4b3s4 4absh absin4 a2bu a4bu.
+ab3ul a3b4un 4abur a3but 4aby abyl4 aby3r abys4s 4aca. a2cad acan4d a5cap
+4acara acare4 ac3a5ro 4acas. acas4se ac3c4 4acch acci4a ac5edl ac1er ac4er4o acess4
+acet2 ac3eta 4acetam ac5eton 2ac4h 4ach. 4acha achal4 a3chan ache3a ache4t a3chian
+a4chic ach5ic. 5achiev ach5inat a6chiop ach5ronis ach3ry a5chu 3achut a2ci acic3 ac3id.
+ac3ido a3cien ac5ifie ac5ify ac5ile a3cili aci4nate 2a3cio a6ciology 2acit ac3ita a4city
+aci4u ack4erel ac4l a4clav a3cly ac3m acoat4 a4coco acoid4 a4coli aco4pa aco4ph
+acorpo4 a3cou 5acoust ac3ram 4acre ac1ri ac3rob ac3roc acros4c acrot4 ac4so 4actac
+acte3a ac3ti actuar4y acu1 ac3ua a4cue ac3ul ac4ulifo a3c4um acun2 a4cuse a3cut
+a3cy a4cy4l a2d 2a4d. 4ada. a4daea a4daeu ad5aman 3adap 4a3das adav5e a4dc
+a4dd4 4addai ade4a. ade4mia 3ademic 6ademici a3denc ad3eno a3dent ad3er. ader4y adev4
+a4df adge4t a3dha 2adi a3dia adia4p adiaph5 a4d3ic. a4d3ica a4dice a3dii a4dina
+a4ding a4dinit a3dio adio3t adi4ph ad3ipo adi4ra adis4c a4dish a3d4it a4ditiv a4dito
+a3diu 3adju 4adk adm4 4admil 3admit a4dn 4ado. ado4ce ado4e a4doma a4dona
+a4doph adop4te ador5ab a4dot a3dou 3adox adria4 ad2t a3d4uc a4d3ula ad3umb 3adv
+adwom4 a4dyn 4adyr adys4 2a2e 4ae1a ae1di ae3g4 ae4gl ae3i ae2l ael3it
+ae1m ae2ma aem3or ae1n aen4i aeo4logu ae2r aer4ar aer3o1 3aerob aer4on. aer4ono
+ae4sal aes3t aes4ta ae3t4 ae4tat aeth4i ae1u ae4vu aey4 a2f 4af. a3fa
+a4fae a4fag af4e 4afe. afem4 affi4c a4fia a4fie a3fil a4flat a3fo4 afor4
+afri3 a3fu af4y4 4ag. agan3d aganis4t agar4ic. a4gath a4gaz ag3azi ag4c 2agea
+agean4 agel4i ag3ella age3na 4a3ge2o a4geol ager4y age2s ages3i 4aget 4ageur ageus4
+4aggi aggo4 4agh aght4 ag1i a3g4ia agi3an agiar4 ag3ic. 4agie agin2 ag4ines
+agio2 ag2is ag2l agli4 a3gly 4aglyphy agmen4 agn4 4agna ag4nac agni4s agnoli6
+a2go ag3oc ag1on 4ago3n4i agor4i a5gos 3agou agout4 ag3p a3g4ra a4grag agra4p
+a4grapha a3g4re a4grop agrue4 agth4 4agua 4ague a3gui agus4 a2gy ag4y. agy4r
+a3ha aha4li aha4n a3he ahe4m a3h4i ahi4e ahil4 ahi4m ahli4 a3ho aho4g
+a3hu a1hy 2ai2 4ai. ai4a ai3b a1ic ai3ca a3i3ci ai4d aig2 ai5ko
+ail3ab ail3i ail4ia. aim3ab aim3er 4a4in ain3ag ai4ne ain3i ain3ou ain2t ai4o
+a4ip4 aiq4 air3l air3m ais4e aish4e a3ism aiss4 a3isti aite4 aitor5 a4ity
+aiu4 aiwa4 4aj. a3ja aja4m a4jer a4jl a4jn a3jo a4joi 2ak ak4al
+aka4n a3kar ak1er ak4erli ak4et ak4ey ak1i a3ki. ak4ings ako4i aks4 aky4
+ak3y. al1 4ala. 4a5laa al3ab al4abr a3laci al3a3co ala4f a3lak a4lal. 4alam
+al3ama al3amu al3an4c a3lang al4ar2 a4laro al3ata al4ate a4lath al4ati a4latt a4laty
+ala4zi albur4y al3c 4alci 2ald4a alde4b ald4er alder4a 4aldi al4dis 4aldu 4ale.
+ale3a a3lee. aleer4 alem4a a1len a3lene. a4lenti al5entin a3leo a3lep aler4a a4les
+ale4so a5less. 4alet aleth4 a3lexi a4leya alfi4 al3g4 4ali. 2ali2a a3l4ia. al3iat
+alib4 2alic a4l3ic. al3ida ali2e a4lifa a1l4ig ali4ge a4liger a4lika al5imen al3ing
+a4linite a4lio ali4ol alipa4 al5ipe 6alipo alipu4 alir4i 4aliste alit4e al3iva alk3at
+allad4e alla4l al4lena alle4t al4leye al3li 2allic 4alloce 4allop 4alloth 4allu. al3ly
+al2mer al4mic al4min almon4d alm4s al2o aloblas4 a4locy al3ogiz a1lon4 a2lony a3loo
+a3lopi al4ora al3ori a3los aloy4 alp4 4alpa als4i al4sie. 4alta. alth3i al4tin
+al4tis 4alu. a3lu3b al3ue al3ui a5luk a1lum a3lumi a3lumn a1lus a5lus. a2lust
+a3lute a3luti alv4 al3va aly2 4alye 4alyn a3lyp 4alysan 5alyse 4alysi a3lyst
+1alyt 1alyz al4z 2am. a2ma 4ama. am3ab ama3c ama3d4 am3age am3agi amak4
+a4maka a4male ama4lia a3man a4mandu. ama4ne a4manit ama3ra amas4c a4mash a3matic am3atis
+am4atis. am3atiz am3ato am3atu a3maze 4amba. ambar4 am3bi ambi4er 4ambo 4ambr am4da
+4amele ameli4a a3men ame3na amen4d amendato6 ame4ne. ament4a a4mentab amenta5ry ameral4 am5eris
+am3ero ame4si ames4o ami4b 2am1ic a3micr am4ien am3if ami4la am3ily ami4m am3ina
+ami6nize amis4e am3ito a5miu am3iz am3l amme4d5 4ammel ammis4 amn4 a4moi am5ois
+4amon a4mora a4mort a4mosit a4moy ampa4nu amp3ing ampi4r am4por ampu3t 2ams am3sh
+am4sp 4a4mue a4mul 4amun amy4a amz4 a4n. a5naa an4abase ana4basi an4abr a3na4ch
+ana4din an4adr an3aer an3age an4al. anal6ise anal6ize. an4all an4ame4 an4amm anan4i 4anao
+an3arc ana4ri. anari4a anar4ia. an2as 4anasy a4nat. anath3 anat3ic ana4tr anau4 4anca
+anchan4 an3chi 3anchol 4ancht anci6nate 4anco. 2and and3ag andes5cen andev4 an4dies. an2dis
+andoo4 an4dow andown6e an4drac 4andre. 4androp and4t 4andu andu4a an4dun a3nea. a3nean.
+a3nemi ane4mon a3nen4t ane4p 4aner an4erg a4n3est an3eta ane4to 2ang 4ang. angar4
+anger4y ang2l an4glan an3gli angol4 an4gou angov4 an4gres an4gru an3gu an1i 4ani.
+an4ia 4aniac 4a3nial a4niar an3ic a4nic. an5ica an5icis an5ics a3nicul an4id a3nide
+an3iel ani4er an3if ani4la an4ilit ani4lo 4an4imi 4animo a3nine a4n3ing 4anio a3nip
+a4nipl an4ir an3is an5ish anis4tr an3ito ani4toi an3ity 4a3niu ani4y an3iz 4anke
+ank5ly an3l ann4 4ann. annar4 an4nema an4nia a3noc4 an3od anogam6 a3nol. 4anoli
+a1no4m a3noma anon4g an3onis a4nopo anora4 a3nosi anoti4 a4nour a3nov a4nove ano4vi
+4anow4 an5ox an3q 4anr an2s ans5co anse4l an5sen an4sil ans3l ans3m an4soc
+anso6phi ans3pa anspar3 ans3po an4sure an4sut an4tac antal2 an4talk antar4 4ante. an4ters
+anth4 an4thor anti3e 3antio 4antis 4anto. anto4c an4try an2ty a4nu. an4ub an3uf
+an3ul an5umi a3nut anx3 an3ya 2anz 2ao a4o. ao4a a4ob a4oh ao3li
+aos4 ao2t aout4 a2p 2ap. 4apa. 4apab a3pac apach4 a3pal a4pala a3pann
+apar2 a4parin ap3aro a3part ap4bl 4ape. 4aped apel4e ape4r 4aper. a6peries ap3ero
+a4pete apeu3 a3pezi aph3ano a4phare a3phe a4phes a4phot 4aphrasi aph3ro3 a4pid a3pien
+ap3illo ap3ing a4pio ap4is ap3ita a4plana ap4len ap3li apo4c a4poe ap3oge ap3ola
+a3polo a4p3o3m4 apon4a a4ponin a4pon4ism a4ponit apop4 apo4ph ap3opl apo4re apor3iz apor4t
+a4posp apos3t a4posto a4potac a3pou app4 appe3ti 4appi appi4a. ap4ri a4pric aprog4
+aproge4 a4prop apro4pi apro4s 3aptat 4apte. ap5ule a5pun 4a3pur a4puri a1py a3py.
+apyret4 a4qa aquil4 aquin4 aqui4v aq4w 2ar. a1ra. ar2ab ar3abe arac4i a3rade
+ara3di a3raj 4arak ar1al ar4alo ar4amb ara3me aramel3 ara4mu ar4an. a3rang aran4gu
+ar4ani aran4tis a4rap ar1as4 ar2at ara3th a3ratio ara3v4 arawa4 arb4 arbal4 arbalis4
+arbe2 arbel3i ar3bi arbor5i arbu3r arbut4 4arca ar4cant arce3n ar4chang archiv4 arcion4
+ar4cla 2ar2d ard3er. ard3is ard3ous a4rea ar3ean 2ared a1ree areli4 4aren ar3ent.
+ar5eou 4a4r3er ar4ero a3res4s a4rev ar3gic ar4gre ar3gu 4arguar ar1h a2r1i a3ri.
+4ar3ia aria4d ar4iali a4ric ar3ic. ar4i4cl ari4dea ar3ies a3rieta ari6ette arif4f a4rify
+arimi4 a3rina. ar3inat a3rine. 4a4r3ing a3rini ar4int ar3io 4arion ari4oso ar2is ar3ish.
+ariso4 ar3ison a5riss ar4it. ari3ta ar5ity ar3iu a3riv 2ariz ar3ko a4rl arla3t
+ar4lite armag4 4arman arm3er. ar4mes. armis4 armon6g armo5n4is armo5niz 4armos 2ar1n ar3na
+arnel4 arnet4t ar2o a3ro. ar4ob 4aroc a3roch aro4i aro4mat. ar5omatic arone4 a5roo
+a3rop a3ros4e a1rou aroun4 2arov ar3ox ar4per arp5ing arpos4 arr4 arri4an. arris4t
+4arrit arrol4 ar4sl ar4sn ar4sph arta4n ar3ter 4arth. 4arthe ar4thor ar4tom a1ru
+4aru. a4ruc a3rus 4arv arv4e arves4 ar3w ar1y arya2 a4rz 2asa asag4
+4asal asal4a a6salt. asan4i a4sanit as3an4t a4sav as3c4 ascar4 asca4t as4ch as4cop
+as4di a4sec as3ect aseli4 a4sent 4as4h ashal4 ash3er. ashi2 ashim4 ash4o a4shout
+ash3y asi2 as4ia asi5al a3sib 4asic asi4d a4sidim a4sif a4sila a4silin a4silis
+a4sin4 as4ings asionar4 a4sir 1a3sit ask4e asl4 as4ly as4met as1mi 2aso a2soc
+aso3li a4som a4sore a4sori as4pas as3pe as3ph as5pira aspi4ran as4pr 4asse. assem4i
+as2sh assis4 associ5 asso4l assor4 as4sp 4astad astat6in astau4 as4tele as3tell as3ten.
+as3teri as6teria. as3tero astho4 2as3ti astil4 as4tin as4titic astna4 as3t4o aston3 as3tr
+as4tray as3tu a2s1u 4asu. asu3a asu3i as4un 4asur a3sus 4asv a4syli 2at.
+a2ta a4tab at3abi atag4 ata5la atalo4 atani4a ata3ra atas4 a3tax at4ch atchet4t
+a2te a4teb at3e3ch at3ego at3en. at3ena atenar4y aten4te a3teri at4erin ater3n a3terna
+a5ternit at5erniz a6tersi a4terso ate4v a2th 4ath. ath3em a4th3e3te a4this. 3athist 4athoc
+athomor4 a3thy. 3a3thyr 4ati. at1ic atica4 at3icis 4atico a4ticoe a4ticu a4tida at3ies
+a2t1if 4atig at3iga ati2l 6a6tilise. 6a6tilize. a4tilo 4atim a4time at3inat 4at3inis 6atinize
+4atino atir2 a4tire at3iris a3tise a5t4iti at3itu ati4us ativ3i a3tiz at4ja 2atl
+at5li atmos5 a3to 4ato. 4atoa a4tob a4tocu a4togl a4togr a4toh a4tois a4tola
+a4toli a4tom a5toma a5tome at3omis at3omiz a5tona ato3nis 4atook a4topa a6tophi atopho4r
+4atora a4tosp a4totr at2r a4tra atra4p a3t4re 4atri. a4triate atri4cle 4a4trico at5rics
+a3tricu 4a4trid a2t3ril a2t3rim 3atriz a4troc atro4n3 a5tron. 4a4t5rophy 3atrou a3try 4ats
+ats4k at4sp at4su a4tt at3te atter6ie at4tho a2tu atu4an atuar4 at3uat at3ue
+a4t1ul a3tum atu3ra at3ural a4turat 4aturis 6aturiza aturn4 4atus. at4wai a2ty 4au.
+aub2 auc4e a4ud au4dato aud2i au3dib audo4 audu3 aud3ul au3e au4fi aug4h
+augi4 3augur 4auh au3i aul2 auld4 auli4e aulo4m aume4 aumer4 aumi4 aumon4
+4aun4 au5na aun5de aun5dr auni4 au4nit aupa4 au1r auran4 auri4o auriti4 au4rous
+4aus. au4sa aus5ativ 4ause au3sib auspi4ce auta4m 3au1th au3ti auti4e au4to. autu4
+4av1ag ava3li a4vanc avar4y a2vas av5asa a3vat a4vata a2ve 4ave. av4ed ave2l
+a4velo ave4no av3erag aver4an aver5i ave4sa 4avi a3v4ia av4ic a4vidl avi4et a4v3ig
+avi2o avi4o4le av3ish a4viz av4o2 a4voir 4avon avo4r avor3i a3vou a3vu 4aw.
+a3wa 3away 4awb a2wh aw3i aw4k awl4e awl5er aw4ly awm4 a3wo aw4pe
+a2w3r aws4e aw3ye 4axa axa4l ax4eni ax3i axi4b 4axim axim4e 4axo ax4yl
+2ay 4ay. ayac4 ay2an4 a4yar4 a3yat ay3l aymo4 ayn4 ays4t ay3t2 ayth4
+ayy4 az2 a2za az3ard aze4d a5zell a1zi 4azi. a4zic a3zie a3zine az3ing
+azi4r4 a4zl. azo4la a4zom a3zy. a4zygou 1b 2b' 2b. 3b4a. baa4 ba3ali
+4bab babel3 b3abil ba6bilis ba4br bach3e ba4cla bac3t bac4ulif b4a3da badar4 b4adic
+ba4din baen4 ba4gat 3b4ah bah4n 3bai bair4 ba4je bak4erl bak4l bal3an4 ba4lata
+bali4o balis4te ba4lit ballas4 balle4 bal4lo. bal4lup bal4mi 4balu ba4m b2an 3ban.
+ba3na4 banda4n ban4der. ban4e ban3i ba4ni4a ban4il 4bano banse4 bant4 ba4p bapos4
+bapt4 3bar. 4baran bar4bl bar4cl bar2i bar3ic ba4rin ba3riz bar4my bar3og barris4
+bart4 bas4a ba4sani bas4es. b4asi ba4sil. 2basis bas3k bas4king bas4sis bas4tron 3b2a2t
+4batae 4batean bate4s bathe4 bati4e 4batis. bat4s batter6i 4batto 4bauchee baw2d baxillar6
+ba3ya ba4za 4bazit 2bb2 4b4b. b3b4a b5bab bbal2 bba4si 4bbe b4bed bbe4s
+b4besi b4bev 4b3bi bbi4a bbi4na bbi4t bbit4i 4b3b4l b5bli b3bo 4bbu 4b3by
+2b1c bc4i4 bcres4 bcun4 2b1d2 4b4d. bde4m b3di bdisti4 b3do b3du b2e
+2b4e. bea4h be2a4n3 3bear beas4 beat4r bea3v be4bi be4br be4ce 2b4ed 4bed.
+be3da bede4v 3bedie be2dr 3bee bee4f 4befa befal4 bego4 begoni4 be3gu be4han
+3bei2 be3ia 4belai be4lan 4belar 4beld4 4beles 4belet be4lia. 3bell belle4 bellig3
+4bellik 4beme bemi4 4benda ben3ed be3nev3 ben4i be3nig be4nis 4beno 3benz b1era
+b3eral 3berc 4bercr berdi4 b4ere be3rea b4erg4 bergi4 3b4eri be4ri. ber4im beri4o
+be4rios berlin4 3bern b4ero 4berose b4ert. ber3ti ber4tie ber4tit b4eru 4b4es. 4besias
+be4sier 4bes4n be3sp be3stow bet1i be4ton be3tr be3tw be4v bev3e bev4er. 4bevi
+bevil4 be3w 3bey beyo4 be4ze 2bf bfoun4 2b1g bga4 bgen4 2bh bhav4
+b3hor bhyoi4 b2i 3b4i. 3bia 4biae bial6iza bia4n bi4anc bi4arr bia4t bi4b3
+bib4a bib4it 2bic b4ich b4ici 3bicu 3bidd 3bidi bid3in 3b4ie biel4 4bieta
+2bif biform4 bi2g bi4gl bigo4 big5ot 4biki 3bil1 4bila bi4land 4bilen bi4les
+bil2g bi3lin bi3lise bi5lisi 4bi3l2o 4bilyn 4bin' 3bina bin2d bin4e bine4t bin4ga
+bini4e 4binog 4bino4s bi4nou 4binso 3bi1o bio5e bioe4c bi4ol. 4biotr bi3p bipa4ro
+3biq bir2 bir4c bir4l birm4 b4is bis4e bish3 bis4p b3ited 3b4itio b3itiv
+b3itor bi4tram b4i2tu 3bitua 3biu biv4i biz4e 2bj b4j. b3je b3ju 2bk2
+bk4c b2l2 4b4l. blag4 4blah 3b4las blas5p blas4ty 4blat 4blau b4laz 3b4l4e1
+ble2a ble2m 4blem. blem3at ble4nit ble4p bler4 ble4sk 4bless 4blet 4bl4i b3lic
+b4lica. b3liga bli4gato 2blik 5blin6d b4ling bli4ni b3lish 4bloi 4blol blou4 blri4
+blu4e 4blum blun3d 4blut 3b4ly 2b1m bman4i b3m4e bmer2 bmi2 2b1n 4b3ne
+4bni b3no bnubi4 bo2 3bo. 3boa4 boan4e 4boant boas4 bo4b 3bod1 bod2h
+bod3ie b4oed boeti4 b4oh 3boi bois4 bok4s bo3la bol4e bo4ley 3bolic 3bolish
+b3o3lit bo3lo bo3lu bomba4b bom4be bombo4 3bomi b2on2 2bonai bonar4 bonav4 bon3i
+bonse4 bo3nu 3boo 3bor. bo3ra bo4rab borac4 bor4al b3orat borbi4 bor3d bor4ic
+4borin. bor3o. bor3ou borre4 3bort bor4ty 3bo4s bos3ci bos4si bos3w b4ot botan4
+bot4e bo4th 3bou boun4c boun5t bou4r bous4t bo3va boxyl3 3boy 2b1p bpe4t
+bpro4b 2bq b2r2 4br. 3bra 4braca bra4ce bra4che 4brado brail4 bra4ne brank4
+brant4i bra4r bras2 bras4e bras4si brau4n 4brawo 4brd bre2 brea4t bre4co brel4o
+bre4m 4brep bres4c bre4th bre4to 4brev. bri4b b4rici 3bri2d brid3i 3brie 4brifa
+4brifuge bri4g brig3an 6brillato brind4 4brio. 4brioi 4brion 4brios 4briu bro4a bro3g
+b3roga broge4 broid4 broi5de brok4 brom2 bro3mi bromi4n 4bron. bro4ph bro4sy broth3
+4brua brun4 bru3ne bry1 4bryc 2b1s2 4b4s. b4sb b3s4c bscon4 b3se 4bsh
+bsi4 bsin4t bsis4 bsist3 4b3so bsor4 bsorb5en 4b3s4t bstra4 bsur4 2b1t2 bt3ab
+bte2 bter4m bti4 b4u. bu4be bubin4 bub4o bu4chi buco4l budge4 bu4gou buil4
+build3 4buj 2bul bullar4y 3bullie bul4lo bulu4 bume3ni b4un4a 3b2und bun4dis bu4ne
+bun4ger bun4t4i 3bur bu5ra bu1re bu4ria buri4at bur5ie bu3ris bu3riz bur1y 3b4us
+busi4e buss4 bust2 bus5tib bus3y 4butan b3utar3 3butio b3utiv b3uto but4s 2b1v
+2b1w 3b4y. by4b b4ye 2byl4o 2byr by3ri b5yrin byr4l bys4e bys4sa bys4t
+byte4 by4z 2bz bze4 bz4i 4c'd 4c't 2c. 1c2a 3ca. 4caa. 4caaa
+cab3a3li ca4bell cab3ine cab4o 3cac cacci4 cach3i ca3ci ca4cit ca4co cac3o5d caco4p
+2cad4a cadav5 2cade cade4mi ca3den cael4 caeni4 c4ag cagel4 cag2o ca3gon. 2cah4
+cahi4 3cai 3cal. ca3lad calde4 cal4di ca4len ca4li. cali4fa cali4g calit4 cal4lin
+cal4mi 4calog cal3or cal4pi 4calus ca4ly. ca4mak 4cambo 4camen cam3er 4cam4et cami4e
+ca3nar canari4 can3c4 can3d4 4canedi can3k4 ca5noe can5ol cano5p4 4canor cant4a can4tic.
+can4u 4caoni ca3pa cap1i 4capl 4capod. capon3i cap4r car1 car4an carbor4 ca3ree
+car5eo ca3res4 care4u cari4sa carmi4n car3oli car4ter. car4tes car4tho carti4e car4v ca2s
+cas4a cas4ser casso4 cas3tel cas5tle 4c3asty casty6la casu3 2c3asy cat1a catani4 cat3e3c
+cat3eg cat4er. cat4eri ca4th cath3e3t ca4ti. 5catio 4catiz cat4j ca5to 4caton 4catoo
+4cator' catri4cl catter4y ca3t4u4 ca4turas cau4s cav5er2 ca4v3i c2b2 c4bi 2c1c2 c4c.
+ccar4y c3ce ccel3 ccentric6 ccep2 ccept5an ccessar4 ccha1 ccha3r4 c3ci cc4l c4cles.
+cco3l ccompa3 ccoun4 ccout4 ccun4 ccu4san 2cd cdi4 cdo2 cdo4t cdou4 cd4y4
+2ce2 4ce. ce5a. 4ceab ce3ani 4ceanog. 3ceas ce3b ce4bri cec4i cecili4 4ced.
+ce3da 5ceded 3cedi 3cee ce3f ceg4 ceger4 3cei2 ceip4 3cel. 4celain. 4celeu
+3cell ce3lo celo4n 4celot 5cels cel4t 4cely ce3m 4cem. ce4met 3cen 5cenc
+4cend cend3a cend5ent. cen4e 4cened 4cenes 4cenet cen4ic 4cenin4 ce3no cenogra6 ce4not
+censur5a cen4tag 4centar 4centati cen3ter cen6tic 3ceo 4ceor 3cep 4cepe ceph1 cephe4
+4cepl 4cepo 4cepr 4c1er. cera4m 4ceran c2erb 3c4erc 3cere cer3em 4ceri4n 3c4er2n
+cer4ne cer2o 4ceros cer3ou 3c4ert 4certil certin4 4certina c4e3r4u cervi4e 3ces 4cesa
+ces4co 4cesh 4ceso 4cessa 4cesse ces3si 4cest. 4cesu 3cet. ce5tab c3etal ce3tat
+cet2i 3cetic ce4til ce4toi cetu4 3cety 4cetylc 4cetylic 4cetylmo 4cetyls 3ceu ce3w
+4cfo cge4 cgre4 ch'4 4c4h. c4ha 3cha. 4chab ch3abi 4chaelm 6chaeoc 4chago
+3chai cha3l4a 4chalo 3cha4m chan4cy chan3d 3chan4g 4changel 3chanic 4chanici cha4p char4g
+char4ti 3chas 3chat chatu4 chaza4 4ch3b4 chcom4 2ch3d4 2c4he2 4che. 3chea4 cheap5
+3check. 4ched ched4di chei4on che5k che3li 4che3ma 4cheme 3chemi che4m3o ch4en. 4chenbe
+4chener 3che4no che4p cher4t 4ches. che4te 5chette chet4tin 4chf 2chg 2chh ch2i
+3chi. 3chial 3chiat chi4cle chi2co 3chid 4chies 3chiev chi4ge chi4l5i chilo4m 4chilu
+4ch3ily 3chim 4chin 5chin. chind4 ch5iness 2ch3ing 3chio chi4oe chirp3 chir4ri 3chise
+3chit 4chitar chiv3a chiz5oph 4chk 2chl chle3a 3chlo 4chloi 4chly 4chm chma4
+4chn4 c4ho 4chocy 4choe 4chogy 3chon 4chono 4chony 3ch4or chor4i cho4ry 4chosph
+cho2t chot3o 3chow 2chp chr4 4chroi. chro5niz ch3rym 2chs 4cht4 ch3te ch3th
+chu4l chur4 chura4 chu4t 4chw4 ch4we. ch3y3d 3chym chy4pr chys4 4chyto 1ci2
+3cia cia4l ci4alite cia4n ci3ar 4ciare ci6ata 4ciatic 2ci3b cic3at ci4chl 4cici
+3cicu cic4ulus 4cidas cid3i 3cidif 3cidit 3cidu 4cidur 3cies. ci3est cie3t cif1e
+ci4fic 3cific. 5cifical c3ifis ciform4i cig4e4 4cigr cil3ab 4cilat cil3i 5cili3a cil4ie
+4cil4is 3cilit4 4cilite 4cilitr 3cilli 5cillu ci3ly 2cim 2cin 3cin. ci3na ci4nac
+c4inatio 3cine. 4c3ing 3cini cin4quef 5cinth cioe4 4ci4ol. 3ciou 2cipa 4cipe ci3ph
+ci4p3i 4cipic cip4is cip4it. c4i3p4l cip3ro 4ciproci cip4ule 4cish ciss4 4cista 4ciste
+2cit cit3ab 3c4ite. ci4thi cit3i3z citur4 3ciz 2c2k1 4ck. c4k3a ckas4 4cke2
+ckel3i ck3er cke4t ck3i ck3l ck5le 4ckm ck3o cko4h 1c2l2 4cl. cla2
+4cla. 4cla4do4 claf4 4clame clam3o 4clamp clan4g 4clarati clari4no cla4ro 4clasi clas4p
+class4es clat4u4 c4l4e 3cle. cle2an 2c5lect cle4la cle4m cler4a cli4f4 4clik clim4
+5clinab clin4g5 cli4ni clin4is 3clip cliq2 cli4to 4clium 4cliva 3cl4o 4clogi 4clogu
+4clomy 4clonu clo3p clos4t clothi4 clow4 cl4u2 clu4b 4cluc clu4d 4cluse 2cl4y2
+c4lym cly4p 2cm2 4cma 4cme 2cn c1ne cn4i 1co2 3co. co3ad coar4
+c3obit coble4 3coc co4cal cocar4p 4coche 4cocot cod4ic coenter4 co3er coffi4 4cog.
+cog1i 2cogn co3h cohol5 3coi co3la co4lan colas4 col4e co4ley co3lit col3l4
+colli4e col2n 5cology co5lom 5colon col5oniz 5color color3i 2colou 3com co3ma co4mato
+com4be comed4 com3er com3pi com4t 3con. 2cona con2al 2conci concy4 con4dr conger4
+3conic 4co5nid con4if con4is co5nit co3niu conni2 6connoitr 3cono conspir5a cont2 contan4
+con5ti coo3e cooker4y coo4la coo4p cooper4y co3or3 co3pa co4pag 4cope co4phy cop1i
+4copic cop3ie 3co3pis co3po copol5y co4pr 3copy3 co3py. co3q 2cora co4rac cor3al
+co4ram co3rat 4corb c4ord cord3an cordel4 cordi4 4cordl core4la cor4ic 4corism cork4e
+corn4e 2coro coro3n4 4corp. 3corr cor4rel. 3cor3t cos3tal costi4 costu4 co4su co3ta
+cot4er c4otia co4tic co3tin cotin3i co4tit 4coto4s c4ott cotti4e cotu4l cou5ple cour3a
+6coustici cous4y cout4e couter4 3cov1 co3v2a co4ve4 cov4el cov3er covet5 covi4 co4w
+4cowa cow5h 4coz2 cp4s c1q 4cq. c4quem c4queri c4ques. cr2 cra2 c4rack
+2c3racy crad4 cra3n4i 4crano cra4p crap3i crap5u cras5t 3crat. 4c3ra3tes 3cratic 4c3ratiz
+crawl3 3cre. cread4 2crean cre3at 3cred1 credit5ab cre6mas cre4natu crene4 cre4p crep3i
+2creta cre4te creti4 cre4vi cre4w 4crg cri2 c4ria cri4b 4criba crib3er c4ridi
+cri5f c4rin 5crine 4crinou 4crip 4cris cris4e c4risi crit1 5c2rit3i cro3ch cro4dr
+cro4f cro4mar c4ron. c4ropi cro4pl cro4po c4rops cros4ci cro4set crosi4 crot4e c4ru
+4cru. cru3c4 cruf4 crum4b 5crus crus4e cru3t cruti3 4cry. cry4ly 5crys 2cs2
+4cs. 4csi c4so. 4csp c3sta 2c1t 4c4t. 4cta c4tab ctag4i cta4r3 ctar4y
+4c2te c4ted c3t4er c4ter. cter3is cter4o ctex4 c4tg cth4 4cti c4t1ib c3tic
+cti2m3i c3tina c4ting cti4nos c4tish cti4vi ctiv6ise. ctiv6isti ct3l 4c3to cto1m ctomor6
+ctori4e ctro3c ctrop4 ctro3t c4ts 4ctu ctur3a ctyl3i cty4log cty4loi ct4z c2u
+cuad4 cub2 cu4be cu3b4i 3cue 4cuee c4uf 3c4ui cui4a cuis4 cu1l c1ula
+c3ula. cu4lam c4ulare c4ule 3culia cullo4 1cult cul5ta cul4te 4cultie cul4tis 3cultu
+1c4um. cu2ma 4cuman c4umb 4cume cumen4is 3cumi cu4mo cum1s 5cumu c4un cun2a
+cund4 4cundin cu5n4e cun4h 3cu3n4i cun5n cu4ph 4cupl 1cur curan4 cura3r cu3rat
+cu4rativ cur4bl cur4d cur5dl cur4f c4u1ri cu2rin cu2ris cur4l 6currency cu4rum cur4vey
+3c4us 4cusan 4cusec cuss4 cus5sin cus3t cu4tanc cutch4 cu2te 3cuted cuti4e 3cutin
+cutin3i 3cutio c3utri cuy4 c2v 4cx. 1cy 3cy. cy1a cy4bel 4cyc. cy4cla
+4cyl. 4cyla cyme4 cyn3i cy3o cy2p cy3ph 4cypod. cy4s cy4tiu c2z cz4e
+4d's 2d. 1da 3d2a. 2d1ab d4aba d2abe d4a4br 3dac da4ces 4dach4 da4di
+3dae dae4ni 2dag d3age. da4gr da3gu da4hi dah4l 4dahy 3dai daik4 dail4
+4dair dak4e da3la da4le 4dalid dal4if 4dalir4 da2m2 dam3ag dama4n d5amant damas4
+da4mo damp4ie 3dan. 3dana dand4 3dane d4ang dan3ge 4dani. dani4l 5dantic dan4tr
+d2ap 4dapho 3daptab 5dap4te 3dapti dar2 3dar. 2dard d3ardi da4ri 4daris dar4i4us
+darmer4 d4art das4tu 3dat dat4c da4til datilo4 da4tol da3tu dau4b daugh3 dau4r
+dau4t 3dav dav5er da3vi daw4t 4daxi 3day 2db dblind4 2d1c dcas4 4dcl
+dcol4 2d1d2 d4d. d3de d3dh d3di d4dib 4d3d4l ddys4 4d4e. 1dea deaf5e
+deal4a de3am de1an de4as dea4th 4deaw de2bit de4bra. de4but 1de1c 3deca deca3d
+de2cag de4cane 4decar de4cast de4cat de3ce 4deces de4cile de4cili de4clo decol3 dec3o3ro
+de3c4r 2decto 2d1ed deda4 3ded3i 4dedl de3du 1dee deem3 def4 4def. de4fini
+def5lag de4flor deform6i de1g4 3de1i 4deico de4im de4k dek4e de5ki 3del. de4la.
+de4lano del4at del3eg dele4m de4li. de4lia deli4a. delib3 deli4e de2l3iq de4lis. de4lit
+de3lo 3delp del4st de2lug 1d4em dem3ago deman4 dema3t de4mero 3demic dem3ic. 4demicia
+de4mo. demon3o demor5 1den d4ena 3dena. de4nar4 d4enb 2denc d4enci 4denes deni4e
+de6nol d4ens. den3sa d2ent 2dent. 3dental dentar4 d4ente4 3d4ent4i d4env de3o d3eog
+3deol 1d4ep de3pa depau6 de3pic dep6ilato de2pu d3eq 3d4ere der5el de3rid 4derie
+der3k4 derle4 3derm der2n d4erne dern3i der4ob de5rogato d4er4ol d4erop der4or. d6er3os
+3derou derpi4e d5ership der3t derto4 4dertot 1des d4es. desal4 desar4 des4c descar4
+3desce des3ec de4sei des3ic des5igna 4desn de2so des3o3l de3spon des3ti 3destri 4desy
+3de1t de3ta de3te de4ti de4to det2r de4tri 3deu de1v dev3as3 de3ve devel3
+de4ver dev3il de3v4o de4war. 3dex 4deye dez4i 2df dfas4 4dfo4 2d2g dg5ab
+d4ge dgel4i dge2o dg1er dge4ta dg5ete dg1i d3gr d3gu dg3y 2dh 4dh.
+d1h4e d4hel d4hen 3dhi 4dhib d3hou dhun4 dhy2 3d4i. 1di3a 3d4iac 4diad
+3diae di4aln d4iam di4am. dia4n dias6tro 3diat dia4z 2di3b di4bat d1ibl d4ibo
+di4bu 3dib3ul di4cam d3icap di3cea dic4ed di1ch d4icin4 d5icine 3dicit 4dic4l diclin4
+3d4ict dic4te 3diculo 3did didy4n d4ie. 2died 3di1en di4erl die3v 5d4iff d3ifi
+d4ific. d4ifu 3dig 4digal di2g1i 4digr 4digy di3i di4lem dil3et di4l3i 3d4ill4
+4dillu d2im2 di3mi4 dimin3 di4mis di4mou 2din 3d4in. 3dina 4dinag dina4l di4narc
+din4e 3dine. din4gu 3dini 4dinite di3niz din4kl di3o 3dioa di4oc. 4dioco dio4de
+3diog dion4 di4or. diora4 d4iori dio3te diother6m d4iph dipha4 di4pla dipo4c dir4
+di4ral 3di1re di4ref di4rel di4ren di4res 4d5iro dirt3 d2i4s1 3d4is. dis4ant dises3
+dish4a dis3i dis5pi diss4 dis3t2 dis5ti d1ita 4ditat dith4 3diti 6ditione. d3ity
+3d4ius 1di1v2 dives4 div4i 4divid. 4diviv di3vo 2d2iz 4dja djective6 d4jes d4ji
+d4jt 2dk d1l2 2dla d4lac 3dle. 3dled dle4i 3dlel dles4 d4lest 3dlew
+2dli 2dlo dlor4 2dlu4 2dly 2d1m 4dm4e dmin3 dmin4d dmis3 4dmo dm4s
+2d1n 4d4n. 4d3na dney4l dni4 4dno 1d2o 3do. do1a doac4e 3do3b dob4l
+dochei4 do3cr doc3um do3de doder6mi 4dody 3doe dof4 4doff 3dog 4dogr 3doi
+4doit do2la dol4g dol3ic do4l3is 2dolit dol4li do3lom dol2or do4lou dol4u 3d4om
+domen4 do3mes do4mete dom1i dom3ic 4domid do4mine do4miz 4domou 3don 4donai 4donij
+do5nisti 4donit do2nou do4ny 3d4oo doo3d4 3dop dop4a dope4 dophi4 4dopto 3d4or2
+4dorat 4dor4ic dor3if dork4 dor3m dor3ou dort4e 3dos do4sag doss4e doster4 3do2t
+do3th 4dotr 4dotu do4u dou4c dous4t 4dout do2v 4dovary 4dowa dow4ie 4downe
+4downi 3do4x doz3i 2d1p2 4dqu 1dr2 4dr. dra2 dra4b 4drace. drag3on dra4gr
+4drail drala4 drav4 dra4w dr4e 5dre. dre4i dres4se 4drh 3dria dria4n dri4b
+4drik d4ril driple6 4droe. droga4 drogen3 3droi 4droll d4rom 4dromal drom3ic 4d5romou
+4dromy 4droot drophobi6 drop4o dross3 4drow dru3i dru3p 4drut dry4e 2ds2 ds3b
+d3sc 4d1s4e d1sh d4shu 4dsl ds3m ds4mi dso4 dsor4 d3s4p d4spo d1s4t4
+dsth4 d4stin dswor4 d4sy 2dt d4ta. d4tes d2th d4tia d4tis 1du 2d1u1a
+dual6iza d4uar du3bi dubi5t du2c d3uca 3duce 3duci 3duct duct4in 3due du3el
+du4gou duik4 2dul d3ulen d4ul4i 3dult 5dum. dum4bl d3umbr dume4 3dun dunc4
+4dung du4ni dun4nite 4dup. du4pa du4pe du4pin dup4l 3dupli 3dur 4durol 3d4us
+dus4i dus4ta d1v dvan4c dvert3e 4dvi dvi4se 2d1w dwar4 dw4e d2wel4 dwif4
+dwifer4 1dy dya4n 4dydi dy4fe 4dyl. 4dyll. d4ym 3dy1n 4dyno dyo4 d4ys1
+dys5e dy4su dyte4 dz2 4dza4 dzo4 2e. 2ea2 e1a. 4e3a3b e4aba e4abe
+eabi4 each1 each3i ea3co4 eac4s e3act e2ad1 eadapt6 eaddress6 4eade ea4d3i e3adj
+e3admi e3ador e3ae eaf5en ea4fi ea4fy e4a3ger ea3gl ea4hi eak1 e4ak. eal3a
+eal4at eal3er eal3i ea4lis eal3l e2alm eal3o ealth3 ea3ma e4am3er eam3i eam3y
+e1an. e3and e4ane ean3er ean3i e3anic eano4r e4ans ean4tr e4apa e4ape e4api
+ea4py ear3a ear4at ear4c e2are e4argua ear3in e4armo ear2n ear2t eart3e e4ar4th3
+e2arw ear2y easan4 eas4l eas4t e4ast. east3e easty4la e3ate. eat3en ea4t3er e4ath
+eathe4n eath3er ea4thy eat3ie e3at4if e3atio e3ativ ea4to. eator4i e1atr eat3ri e4a3t4u4
+4e2au eaus4 eav3en 4ea4vi ea3w eb2 4eb. e3ba2 e4bara ebarba4r ebe4c e4bel.
+e4bend 4eber 4ebic e4bis4 eb4l e4boan ebok4 e2bona eb4or e3br e4braw e4brio
+e4bris. ebro4p e4bry ebs4 eb4t3 eb3uli eb3ulo 4ebu4r ebusi4 e4buta 4eby 2ec
+e4c' 4e4c. 4eca e2cad eca3de ecag2 e2cago ec5agon. ec3ah e4cali e4calo ecami4
+e4can. e4cana e4cano e4care ecas4t ec3c4 eccar4 ec4clu ecd4 3ecdo4 e1ce e3cel3
+ecenar4 e3cer ecer4n e4chea 3e3chis 3e3chiz ech5ua ech4we eci3a. eci6able e4ciar eci6ativ
+ec5ificat ec3ifie ec3ify e4cig e4cilit ec1i3m4 e3cio ecip3r e4cist e3cite ec3i3th ec4k
+e4clam e2c5lec e4clina ecli6nato6 e4clino e4clog e4clom e3clu e4co. e2cog e4col. e4colle
+ecolor3 e4comme ec5ommend ecom3p ecompari6 e6compen ecompos6e ec3onci e4condi e3co4p e2cor ec3o3ra
+e4cord. ec3o3rou e2cosp ecos4s e4cow e1cr e3cra e2crea e4crem ecrep3 e4creto ec4ri
+ecrit3 ec3rom ec3st ec4te ecti4no ectiv4iz ecu4bitu ec1ul e4c3ula e3culi e4cuma e3cun
+e3cur e4cury e4cus4a e3cute 2eda ed1ag e4dah e4dalu edan4te e3dar eda4tis e4dativ
+e4dato 2edd4 ed4dite 4e1de edek4 ede4mo ed2en edentar5 ede3p e2der ed3era e3des.
+ed3es3ta e3destr ede2v e4dey 4edgel4 e4dh 2edi e3dia ed1ib e2dica ed3icab ed3icat
+edi1e ed6ifica e4dik ed3ime e3dio ed1it e4dita e4ditiv e3diu ediv4 ed4j e2dl
+1edn e2dole edo2no e4dony edriv6en e4droe 4edt ed4ta 2e2du ed4ua 5educa 2ee2
+4e4e. e4e3b4 ee4b. ee4c eech3i e2ed1 eed3in e3ed3u ee3h ee3i4 eek1 e4el.
+eel3ab ee3lan e4eler e4em. eemo4 e4en. e6encoun e4ened e4ener. een3in ee4no eensbor4
+ee3nu eep1 eep3i ee3ru eesep4 e2est. eet3i ee3va e4eve e4evin ee3w e1ex3
+eexa4 eex4plos 2ef 4e4f. e3fa efal4l e4fana efe4 e2fer ef5ere efic4 3eficia
+efici6ary e4fila e4finit ef5i5nite ef4l e4flag ef5lagr e4flora e4flu e3fo eform6it e2frag
+efrig3 ef4t eft4il 4e3fu efu3e e2fug efun4 efu4t e4futa 4ega. egaci4 4egal
+egam4e eg4an 3eganc e4gano eg4are e4garin egas4 e3gel egel4e ege4m egen1 e2g3end3
+eger4a eger4e eg4gr e3ghe e2gi2 e3gi4a eg3ib eg2ic e3gil eg3ime e3gio eg1is
+e3git1 e2gle eg3li eg4my 4egn eg4no e3go e4god ego3i e4goli e4gor. ego3ris
+4egos ego3ti e4grad6a egrammat6 4egraphy e4gri. e2gu e3gui e4guin. eg1ul e5gur 2e1h2
+e3ha e3he ehear4s e4hen. e3hi eh3me e3ho ehr4 e3hu ehy2 ehydro3 2ei
+4ei. ei4a e3ian e4ib e1ic. ei4ce ei3d4e 4eif eig2 eil4e eil3ing e3illu
+e4imar e4imo e4ims e1i2n e4inag ein3au ein4e e5ing. e4inho ein3i e4ins. 4e4i1o
+ei4ov eip4i eip4t eir4d eire4 eir4i e4isa e4is4e eiss4l ei3su e3itera eiterat6
+ei2v eiv3er e3ja e4jel e2jud ej3udi ejun4 ejus3 2ek ekam4 eka3t ekate5
+e5kater e3kee ek4n ek4s e4l. e1la el3abl e4lacy e4lae e4laf e3lagi e4lagin
+e3lai 4elan el3anch e3land elan4i el3ano e4lano. e4lapi elas3 5elast e4lates elat3in
+e4latin. elati5niz e4l3ativ e4latori e4latory e4latur elav4 e4layl el4di el4do. e4le. elea4
+e4lean e3leas e4leat el3eb e3lec ele4ch e4lee e4l1eg el3ega e4lem el3eme 3elemen
+e4lena e3lene elen4i e4leno elen4t e4leo eleono4 e4l3ep ele3ph elepi4 el3e4r 4eles
+e4lese e3let. el3eto eleton5 e4leu e4lev el3eva e5le4v3e el2f 4elf. elgi4 e1li
+e3l4ia e4liar elib3e e4libi e4libl el3ic. el3ica eli4ca. el4iced e3lici el4id. e4lidl
+el3igib e4lign 4elik e4lim. e2lin e3lina e3l4ine el3ing eli3on e3lios e4liph elir3
+e4lira e2lis eli4sa eli4sor e4list e3liu eliv3 e2liz el3ki el4labl 4ellan. elle4r
+el3li 4ellif ellif5l 4ellit 4ello 4ellu ellu5r 4elm. elme4 e1lon elo4na e3loni
+e4lono el3op. el3opa el3oq e3lor 4elot 4e3lov e3low elr4 el3si el4tan el4ti
+el4try e1lu elui4 elus6te e3ly 4ely. ely4a 3elyt el3ytr e4lyu e4m. em3ab
+emagnet5 e2mago em4al e3man. e2mana em3anat e3manc eman4d e4mane eman4n e3m4ar e4mare
+emargi5 e3mas e2mat e3mate em3atoc em5atolo em3atop e6matoriu e6mature. e4mav e4m3b4 ember6m
+em5bl emblem3 3embo embod3 5embry e1m2e e4meab e4medie eme4diev e4mel emeli4 eme4lia
+e3m4en ementa5r e4m3era e4mere e4merol e4mery e4m4es 4emet4 e4mete emica4 em3id4 4emie
+e4mige e4migran emili4a em3im emin4 em3inen e4mingt e2mini e3miou e4mi3p emi5pa emi1r
+emi4rus emis4c em3i3s4p em4ite. em4iti emi3v emm4 5emniz emod3u e3mog e4molit emon3e3
+e4mone. emon3is e4moniti emon3ol emo4nu e3moph em4or. emor4a e4mora. e4m3orr e4mory e4mosc
+e4moso e4mosp e4mosu emo4te emp2 em3pe emper4e em3p4i 3empir empo3 e4ms e4mu.
+em3ula em3ulo emun4 e4mv em4y emy3tho 4en't e4n. e1na 4ena. e2nac e3nade
+enadi4 e3nae en5age. e3n4a4l ena2m e2nan en5ancy e4nar4d e3nari 4enary 4enbu 4enc.
+en4ces 4encia 4encio 2en2d end6aged en3dam en4d3an en4dato en4ded en3dic 4endre en4dry
+end4wr endwrit4 e5neal e3nei 4e4nel enem4 4enen e3n4eo enep4 en3er enervat6i 4enes
+e3nes. e4nese en3esi e4nesse enes3t en4eti e3neu eneu4ri e3nev3o ene4w en4fer eng2
+en4gel en5gine en4gle eng3li 4en3gu engue4 4enhairt 4enia e3nia. en4ian e4nias. en3ic
+eni4dea e3nign e3nil en3ing enion4 e4nip eni4r en3ish e4niso en3ita en3itu en6izer
+4en3k enka4 4enna ennar4 enne3a 4en4nim 4enny e1no 4eno. eno4e 4enol e4nold4
+e4nom. enom4ic enon4i 4enopho 4enor en3orr e4nors 4e4nosin eno3th e3n4ou e2nov 4e3now
+enro4 en2se ens4es ensi4n 4ensk ensur4a en4swe e4nt en4tage en5tar 4ente. 4entem
+enth4 3enthet en4thou enti6pe enti4r ent4is 4entiv en2tiz en4tox entre3p 4ents en3twi
+4e4nu. en4ual en4uf 4enul e3num e1nun en3ure e3nus e4nuses en3v e3ny. enyl3
+enz4 4enzi 2e1o 4e3o. eob3l eob4u e3oc eo3ch eoder4 eo3e eoe6c eo4es
+e3og e3ol eo3la 4eo1li eo4logus e5ome e4omin eon4as e4opar eo3po eora4 eor3d
+eo3re e2org eo6rient. eo4r1o e3os eo3sin eo3sta eostra4 e3ot eo4t4e eo3th eoti4
+eo2to eox3 eoxi3 4e2pa e3pac4 e3pai e4pana epar2 e4para ep3a3rab epari4 e3pas
+epa4tia epa4tic epau6p e3pav e3pay e4pech e4peh epend3 epen4t e4pert e4pet e2pha
+epha3la ephe2d ephem3 ephe4u e3phi e4phia 4e4phonis 4ephony e4phos 4ephr ephtha4 ephy4
+ep1i ep3ica ep3ice ep3id ep3igl ep3i3l 4epin. e4pion ep3iso epi3t ep3ita ep3ith
+epix4 ep3iz eple4r e2pli ep3lic e4plorat e2poch epol4 ep3o3nem e4positi e4potis e4pp
+ep4pes eppli4 epra4n e2pre ep3reca ep3red ep3reh epre4m ep3rese e2prob ep5robat epro4c
+epro4l eprom5i ep3si ept2 ep5tib epub3 ep3urat e2put ep3uta e1q e4q. e4qq
+eq3uab e4quer e4quie e6quine. e2q3ui3s e2quit er1 e4r' er3ab era3ch e5racio er4ah
+e3rai e4raim erak4 1eral 3erali 4eralia era4lo era4ma e5raphica era3pi er4aps e4ra4r
+era4s 4er4asi er4ass. er6ators 4eraz er4bage. er4bie er4bly 2er3c 4erca 4erd. er5da
+erder4o erdi4e erdit4 erdo4s 2ere 4ere. 4erea e3real er3eb ere2c ere4co eredi4a
+er5edu er5ee. ere6forma 3er3eig er3emb e4remou er3en 4erene 6erens eren4tis 4ereo er3er
+eres4i er3ess er3est. er3este er3ett er3ex ere4z 4er3ges 4ergia erg3in er4git ergi4u
+erha4 2eri 4eri. 4e1ria e3ria. 4er4ib eribe4 4eric er5icu 4erides erid4l eri4dop
+e3rien 4erii er4imet 4erinc er3ine 4e1rio er4ion e4rioni e3rior erio3ra erior3i e4rioso
+eriot4i e3riou 4erip e5ript eripter6a eri4q er3ir 4erity 4eriu e5rivativ e3rive 4erk
+er3l erlan4d erm2 4er3me er4mel. ermen4 er4mer. er3m4i ermon3i er4mor. erna4c ernali4a
+ernau4 4erne. er4nen er2ni ern4ie 4ernit 4e1r4o. e3roci erodacty6 e4rogeni e3roic eroid4
+4eroli 4eroll e4rometr e4ron. eronau4 eron4is 4e3room ero4tol 4eroun 4erow 4e4rox erp4
+er3pe 4erpen erpi4er erport4 2err4 erre4fo error3 2e4rs ersar4ia 4erse erse4h erse4p
+ers4es ersh4i ers3ib ersi4e ersi4u er3sk 4ersl 4ertas erte4n ert3er. ert4h er4thag
+4ertic er3tin er4tish er4tite 4ertiu er4tl er3tw 4eru. e3ruc eru4e 4er3ul 4erum
+4erun e3rup er3ur 2erv 4erva. 4erve erv3er. 4ervo 4erwal 4e4rx er4yo erys4
+2es. es4a2 e2sag esalin4 e4salp esal4t e4sam esar4g esar4io 4esb4 es3ca es4cara
+es5chea es4cia e4scienc 4esco e4scot e1s4cr e2scu ese2 es3ecr e4seil e3sel esel4l
+es3enc e4sentee e4sentl e1s4er e4serva es4es 4es4h e1shi esi2 4esia 4e2sic es3icc
+esiccat6e esic3u e2sid eside4 es3iden e3sidi esido4 e2sig es5ignat esil3i esil4l e2sim
+es3ima e4sin e4sip esir3o esis4 esis5tiv 4esit es3ita esk4 e4skil e3skin 4esm
+e4sn esocepha6 e2sol eso3la eso3li es3olut es4ome e4son4 e5son. es3o3na es4oph e4sorc
+e4so3te esp4 es3per e4spi es5pirat espond3 espon4ti ess4abi es2sib ess3ing es4sis es4site
+4essn es4sy 1est. 4esta. es5tabli es5tame e4stant e4stau e4sted 4estep e4ster. es3th4
+6esthetiz es4tho e2sti estic4i es3tif es3tig es5tina es4tip es3tit4 2estl 4esto es4tor
+e5strai e5strict e4stur es2u 4esuc e4sue esui4 e4sult e2surr es3urre es4us e1sy
+esychas4 e4syl. esystem4 e4sz e2t e4t. 4eta. e4tab e5tabul etae3 e3tai e3tak
+et5allis et3alo 4et1am etan4 e4tant et1ap eta3ph e3t4ar3 etas4 e4tat. e3tate4 eta4th
+e3tati etax4 etch3er e3tea e3tec e4ted etel2 e3tele e3tel4l e4tely e4tem e3tenc
+e4tene e3tent 2eteo 4eterm e3tern eter3ni eterog6e e3tes e3tet ethar3 e4thea 4e4thel
+e3there e3theri e4thic 5ethn ethod3 e4th1y 4etia e4tiam eti4b et1ic et4ica. et3icis
+e4ticl e4ticule et4id e3tim etin4 et3ina eti4p e3tir et2is et5ish e5titio et3itiv
+4etiu eti4us e4tm etma4 e4tn e3to 4eto. e4toes e4toid e4toma et3ona 4etone
+e4tony e4tope e4topl etor4ic. e4towa e5tox et4raci et4rag e3tran e3trat e3tre4 etrea4
+e4trel et1ri et4rid et4ril e4t3rim et4rio etro5f4 et3rog e3tropi etro3s e3tru e4trum
+1e3try et4st et4su e4tt 3ettan et4ten et4tes et4tine. 4ettl 4etto et3ua e3tud
+etu4i et3ula e3tum e3tun e3tu4r 4etv ety3le 4e4tz 2eu1 4eu. e4u3b2 euc4e
+eu3ci euck4 eu4cy eu2i eul2 e1um. eu4mi eun4e eun4o eunu4 eupa4 euphe3
+4eur eu3ra eu4ram eu4ras eury4l 4eus e1us. eus4p eut4e2 eu3ti e3util eu3to
+euton3 eu4zl e2vale ev3ane e2vans evap3 evardi4 e4vart evass4 evas3t 3evate 3evati
+e4vatt e3vea e4vei e4v3el. ev5elatio ev3ell evel3o e4vena even4i even6ta e2ven4u ev3er.
+e4verat e2vere ev3eren ev4ers ever4to e4ver2y e3vet e4vev eviar4y e3viat e4v3i3d evi4e4
+e2vil evil3i e3vinc 4eving evit4er e3viti eviv3a e2vo e3vo. ev3ocab evol3a ev3ole
+e4v3olu e4von e5voro e3vot ev3r evv4 ev3y 2ew e4w. ewal4l e3wee e4wic
+ew3ie e3wif ew3ish e4witt ew3l e3wo e2x 4ex. ex3a exac5e exae4 exas4t
+3ex3c exci4t ex3e 3exh ex3i exi4an. 4exm exon4a 3ex3p ex5ul e2y e4y.
+ey4al 4e5yar ey3de 3eye. eye3l eyk4 eyl4 ey4na eyne4 eyo4g ey3or eyp4
+eys4 ey3se ey3t 2ez 4ez. e4zant. ez2e e4zel ezi4a e3zo e3zu e4z3z
+1f 4f's 2f. f2a 3fa. fa2b fab4b fa4b3u 3fa2c fa4ce fa3cie fac5u
+4fael faer4 4fage fain4 3fal fald4e falder4 fal4l3e fal4lin falo4n fal4sie falut4
+4famati fa4min 3fan 4fana. fanat3i fa4ne 4fanie fani4l 4fans 3far far3ad far4m3
+fa4ro. 4fars far4sp farth4 fash3 fas3ten fa2t fa3ta fatar4 fa3the fa4tiz 4fato
+fat3ua fault3 faus4 fau4v faw4 faya4 fay4al. 2fb 2fc fca4 fcas4 2fd
+fe2 2fe. feath3 f4eb fe4bris 2feca fec4ta fed1 feel3 4fees 3fei2 fek4
+fe3li fem3 fem4a fe4mer femi3 femor4 fen2 4fen. 3fend 3fens feof4 f2er.
+2fera fer3e fer4es feri4a. feri4as 4f1ero fer4ob fe3roc fer4op 3ferr 4ferse 3fert
+4fertit fer3v 3f2es 4fesa fes4sa fessing4 fes3ta 3feu fe3v4 2ff2 4f4f. 4ffa
+4ffe f4fed f3fen ffer3 ffer4o f3fet 4ffi f3fic ffich4 f4fie ff4ie. ff3ily
+ff5iness ffin3i f4fis 4ffl f3fle f5fle. 4ff3n ffor3e f4fr. f4frai 4ffs f3fu
+ffus3ib f4fy 2fg fgh4 fgha4 2fh f4i. 3fi3a 5fiab 4fian. fi3b fi4bo
+fi4bu 4f1ic. 4fica. fi4cab 4f3ical 4f3ican 4ficate 6ficatin 5ficatio 6ficato 2fic4e 4f3icen
+4fices fich4e 3fici fi3cie 4ficis 4ficit fi4cl 4fics 4ficulti 3fid fi3de4l fid3i
+4fido fi4do. fi3du 3fie 5fied 5fiel4 fier4 4fies fi4f fift4 3fi2g fight3
+fig1u2 4fik fi5lad fil3am fi4latu fil3i fil2l fil4m fin2 3fin. fin3ab fi3nal
+find5 4fing. fin3ge fin4ial. fin3is fin4nic. fin4nis fi4noi fi2r2 fires4 fish3 3fishe
+f3ishly f3ishn 5fist fis4tia fi2t f3it3a fi4te f4iter fi4u 3fix fiz2 f2j
+2fk f2l2 4fl. 3fla fla4c fla4ge flag3el 4flagr fla4my fla4s fla3v f4le
+3fle. fle4a flen4 fler4 4f5less fleu4ro 4fley 4fli. flich4 4flik flin4 flint3
+4flis 3flo flo1r 4florat flor4i flo4rie flo4rin. floy4 flu1e flu3i flu4t 2fm
+2fn f3ne f2o 3foc fo4e 3fol 4fola fo1l4i foli5a fomo4 fon4a foni4
+fonni4 fonta4 fon4tal 3foo fool3 3for2 fo6rab fo4ram. fo4ras fo3rat6 for3b for4c
+fo4rea for3ei fore5r 4for4mate for3n4 fos3 fote4 3fou fough4 foun4dr fouri6er. fout4
+fow4 2fp fper4 fr2 4fraf frag4o f4rai fran3c fras4 fra4tr fre2d frel4
+f4re2s fri2 4frid fri4ga frig3e fri3k fril4 fro2 4frob fro4ni4 frost3 frot4ta
+f4ru 4fru. frui4 frus3 2fs2 fsa4 fsur4 2f2t 4f4t. 4fte 4ft1i ft3l
+f4tm 4fto f5ton 3f4u. fuck4i fue4gi fu3el 4fug fu4gu 3ful 4fulo fu2m
+fu3ma 3fun fun4a fu3n4e 3fur fu4rat fu3ri fu6riate. 3fus fu3sil fus2s3 fuss5i
+fu4s3t fu2ta 4futab fuz2 fuzz3 4fve 2fw fy1 3fy. 3fyi 5fyin fy4k
+f4yo 2g. 1g2a 3g4a. gaar4 ga4ba 4gabo ga3br gac4 4gach gadge4 gad4h
+gadi4 gadis6 ga4dit ga5dr 3g4ae 4gaeu gagam4 gag4n gah4 3ga4i gais4 3gal.
+gal4a 4galay ga3len g4ali gal4ib 3galis gal5ler gal4lin galma4 ga1lo galo4pi 2gam
+gam4a 5gamb gambi4e games4 3gamic g3a3mis g3amou g3amy 3gan 4ganap gan3gl gan4gla
+gan3i gan4im 4ganip gan6iser ganis4ti 4gann 4ganof ga4nome gans4e 2gapo ga4py gar3den
+g4area gar4it garn4 ga3r4o 5gart gar4ti ga2s ga4se gask4 gas4me ga4so gas4per.
+g4ass4 3gas3t 3gate 4gatee 4gatew 4gatha gath5er. gath4i 3gatin 3gatio g3ativi gativ6ism
+ga4tiz 4gatorin 4gatu 3gau2 gaus4 gauta4 gauti4 gav4a ga4ve gav3el gay4a 2gaz
+2gb 2gc g4c. g3ch g4cy 2g1d gd4i g4dy gdyni4 4g4e. ge1a 4geab
+ge2ar 2ged 4ged. ge4dal 3gee 4gef geiss4 gel4a 2gele gel3ic ge4lid ge4lig
+4gelik gel4in g4ella. g3ellat g4elli 2gem 4gema gemar4 gem3i ge4mo gemon4is 1ge2n
+ge3nar 4genary 3genc 3gene gen3es 4genes. 4genet. gen4fe gen1i geni4al 3genic geni2o
+2genis gen3it gen4ite geni4u 2geno g4enoi genom4i 4g3enou gens4e 3gent gen3tle ge4nuse
+4g1e3ny 1geo ge4of 3geog ge4ol. 4geole ge2on ge2or ge2ou ger4an 2gere 3geria
+germa4no 2gero 1g2es 4gese 3gesi gesi5a ges3tat get4a ge4tar get1i 4geto ge4try
+3gett 3geu geus4t 2gf g4fet 2g1g2 ggar4t gge4d g5gedl g3gedn g3ger g3gi
+ggi4a gg4l gglom3 gglu3 g3go ggo4t ggran3 gg4s 2gh2 4gh. g3ham ghar4i
+ghas4 gh3b gh4es. gh3f gh3h ghi4b gh3in ghi4o gh3l 4ghn g5horn g3hous
+ght1 gh4ten 3g4i. 1gi2a gi3al giale4 gian4t giar2 giar4c gia3ri gi4at gia4to
+1gib gib4e g1ic g4ici gi4cl 3gid3i 3gien gi1es gi4et gi3ga gigam4 g4ih
+gi4le g4iliu 2gim g3imen g4in. gin2a gi3nab g4ind 3ginee giner4 g4ines. 2ging
+gin5ger gin4h gini4a g4int 1gio 3gion 4giose giotro4 3giou gipa4 gip5s 3gir2
+4giriti girl3 1gis g1isl giss4 g2ist. gis3te g1i3ta gita4l gi4tall g4ite 1giti
+4gitim. gitin4 gius4 3giv 1giz 4gji 2gk g3k4i4 4gko gl2 4gl. gla2
+gla3b gla4d glam3 4gland. g4lar glas2 glas4s glazi4 1g4le 3gle. gle4an 3gled
+4glen. 2gles g5less 4gley 2glia gli4b 4glie. g3lig 4glik g4lim 3glion g3lish
+4glisti 1glo globi4 4glod 4glog glom3e glo4n glo1r glou4 glo4v 4glu. glu4me
+glu3ti 3glyc g4lym 3gly4p 4glyphy glyr4 2g1m 4gma2 gma6tos gmentar5 2g1n2 g4n.
+g4na. g4nac. g4nace gna4g g3nal gnar4 g4nard gna4s gnat4a g3nati gnet5ise gnet4t
+3gneu gneu4ry g4ni. gni4an gn4ic g3ni4f gnif4ic. gn3ing g4nio4 gnis4 g3nit gniz2a
+gn3l gn3m gn4o g4no. g2nol gnom4 gnon4 gno3ra g2ny 1go 3go. 3goa
+go4bl go3c g3ocy 4godo goer4 3g2o2g 4gogr 4goh 3goi goid4 go3is gold4i
+4golit gol4le go4mer 2gon2 g2on. go1na4 g4onar g4one. 3gonia 3g4onic go3nid 4goni4e
+gon4io gon4ism 4gonist 3goniu go3nom gon3op 4gonu 4gony g3ony. 3goo4 gor3at gor3ou
+4gosa 4goso goster4 g4ot 3go4th 3gou 4gour. 4gout. go2v1 gover4 govin4 gowa4
+2gp gper4 gpi2 1gr2 g2ra2 gra4ces 4grag. 3gram grama4 3gran granar4 grang5er
+grani4t gran4te 2grap gra4pe 3graph. 4grapha. 6grapher 3graphi 5graphic 4graphis gra4py grar3
+gras4 gra4tin gra4tis 4gray. 3g4ree greg4 gre2l 4gressis gre4t 4greth gre4v g2ri
+2gric g3ricu 4grif grif5fi grigen4 gri2m grin4d 4grity gri4z g4ro2 groc4 grol4l
+4grope groph4 4gropo gro3sc grue4l gruf4 gruff3 grum4p gry4p 2gs2 g4s. g3sp
+g4spo 4g1s4t gstar4 2g1t2 4gta g4th gth3e gting4 1gu 3gu. 3gu2a gua3d2
+guar3a guay4 gu4dr 2g4u4e 4gue. 4gued 4guef guel4 gue4la 4gues. gu4gl guia4
+3guid 3guil gu2in gui3na 2gu1l gul4lab gul4p gum4a gu4mis 3gu4n 2guo 4g3uou
+4gup 2gur gurd4 g1ure gu4rio 3gus gu4si gus3tat 4guta gu4th gut4s guya4
+4gva 4gve 2g1w 4gwa g4wane 4gwe 1gy 2gy2a gy4bi 4gygu 4gyh 2gyn
+gy4ne gyn4i g3yny 4gypt. gy1r gy5ra gy4t 4gze gz4w h'4i 2h. h2a.
+4habad ha4baz habi2 ha4bile h3abl ha4col h2ad ha4dar ha4deu had4j had3ow haf4
+ha4gan hag2i hag3ic hag3io h3agis hag4on h3a3gy h4ah ha4han haid4 hail4i 4hairt
+ha4it ha4ki hal2 ha3lami hal4an ha6lange. ha4lar h2ali hal3ic h3aliti hal5mi ha1lo
+ha4loc ha4lone ham3it hamma4 hamme4 ha4my h2an2 ha2nat handel4 han3er h4ang han4ge
+hang3er han4i han5ic hani4l h3anis ha5nisti h3a3niz han4k han3n ha4no. h5anol h3anous
+ha4nov 4hansh hao2 ha3ot hap3er ha4p3l h4apu h2ar har3ac ha3ran hard5en. har3d4i
+haren4 hare4u har4f har2g har4ga har4ia har4iz har2mi ha3ros4 har2p har4tis hary4
+hass4 h4a2t ha4tiz hauc4 4haud haugh3 hau4l hauli4 5hause ha2v ha4ve havel4
+havi2 hay4a ha2z haz3ar 2hb h3bo h3b4r 2h1c hcas4 4hcl hcom4b 4hcr
+2h1d hdra4 hd4u 4h4e. 3h4e4a4d he3an hea4p hear2 3heart heart3i h3east3 heathe4
+hea5then heat3r hea4v heav3i hebe4i hebra3 he4bri he4bro he4cl hec3t hectom4 h4ed
+4hed. hed4dit hede4 he4done hed3u hee4n hega4 he4gi he4ia he4il he2in hein4i
+he1is he4j 4hek hekho4 hel4ep hel3ico heli4e he3li3o hel4lie hel4lis hel4ly h3elor
+helo4t hel2p hely4 he2m he4matei h4eme hemer3 hemilu6 hem4ise. hem4ith he4mon he4m3or
+hem4pe he2na he3nes he4nias heni4e hen3is hen3iz henom3 4henu he4o. heo3ri he4os.
+h3eosi heos4t he2p hepta4v he2q her4ali her4bal her4by her4d here3a he3redi heres4
+heret6ic. here4v he4ri. h3eries herit3a he3riti herlan4 her4mel hermi4t hernali4 her4ome her2op
+her4or hers4e hert4e h3erw h3es. hesan4 he4sho hes3it hess4e hes4sit h2est hes3ter
+hes3tr het1 hete4 het4ed h3e3teri he3tis he3t2iz het4tine heun4 4h4ev he3vis hex3
+hexas4 h4ey. 2hf2 4hfu 4hg. h3go h1h h4i. hia4n hian4g hi4ap hi4au
+h5iave hi3be hi4bo hibra4 h1ic hi4c4e h3ici h4id hid4it hi4do hi4dy hien4
+h3ier. h3i1es hi3est hif4fer hi4fl h3ify hi4get high3 hight4 h4ih hi4lad hi4li.
+hilib4 hi4lin h3iliz hillar4 hiller4y hil4loc hilo4mo h3i3lou h1ily hi4lyr h2im hima4
+hi4mac4 hi4mar him4it h4ina hin4der. hin4derm hin4ea hine4al h3ing. 4hi3no h4inom 4hinu
+4hi1o hio4d hi4oed h4iol hi2on hiop4i hi4or hi2p hiprot4 hiq4 hir2 hirel4
+hirst3 his4a hi4se his3el hi4sor hist2 his5tam his3tl his4try h4i2t 4hite hith3er
+hi4top hi2v hiv3al hiv4al. hi2z h1k 4hki 4hko 2hl hlag4 h3lan h3lea
+hle4b hlep4 hle4t h1li hl4o1 hlor2i hlo5ric hloro3 hlo6rou hls4 2h1m2 4hm.
+hma2 hma4g h3man hmel4 h3men hmet6ic. hmi4r 2h1n2 4hn. h4nen hn4i hni4e
+h4nol. hnos4 h2o ho4ag4 ho3bo ho4co h4oda h3od3is h5odiz hoen4 ho2g hog3o
+h4oi4c h4ois ho4it ho4lam ho4lap ho4l3ar holat6 3hold1 hol5er holes3t ho4ley hol3ic
+ho4mas ho4me3s ho4mogr ho4mopho homo3t homy4 ho4my. hon4a ho4nas ho4nau hond4 ho4ne.
+ho3nem ho5net hon2g hon4is ho3niz hon4oc ho3nog ho4o 3hood hoo4k hoo4p hooper4
+hoot3e hopes4 hophyl6lo ho4pl h3opoe hor2 h4or. 4ho3ra ho4rab horar4 ho3reo ho3reti
+horian4 hor3ic horo4b hor4on hor4s 3horse hors3i ho4ry. hos4e hosi4 hos3p ho4tho
+hoto1 h4oug 3houn houp4 3house ho2v hove4 hov3el ho4via 2h1p 4hpa hpem4
+hpri4 2h2r 4hra hral4li hra4sa h4r4e hrea4 hreat3 hren4e hre4no hre4s hr4i
+h5rig hri4s hroat3 hro3mic hro4mis hro3n4is h4rops hr4y h3ryma hs2 4hs. hs4e
+h3sh h4shu h4si2 hsin4 hsink4 h1s4t h4stag hsti4 h2t h4t. htab4 ht1e4
+h4ten. hten3i h4t3eo ht2er h1th4 htha4la hthe4us h4this h3thy hthyla4 ht3l 4hto
+h4ts htu4 h2u hu2a huat4 huf4 huff3i hu4ge hugh4e hu4mis hum4p hump4y
+hun4e hunk4e hun4t hur2 hura4d hu4rat hur4c hu1ri hu6rise. hur4l hurs4i hur4t
+hus4s hus3t4 hu2t huta4 huz4i h1v 4hv. h4vh 2h1w2 4h2wa hwar4 h3ward4
+hwat4 h3way hw4e hy1 hy4' hya4c hya5li hy4bi hyen4 hy3gi hygro3 hyi4
+h4yli hy2m 4hymi hy3o hy4pre h4yr hy4rh hyr4i hyro4g hyroi2 hy4s2 hys3e3a
+hys3i3a 4hyt hyx3 2i. 2i1a i3ab i4abel iabi4 i3ac. 4iacal iace3t ia4chi
+iaci4 4iaco iac5o5na i3ad ia3de i3ae iaf4 4iag i2age i4agu 4ia4h i4ai
+i4ald iale4u i3alit i2am ia4mi i4amo ia2n ia4na 4ianao ian3at ianchi4 i4anco
+4ianh ian3i 4ianii ian4ite 4ianne. 4iano i4ano. ia4nop ianop4s 4iansk iaon4 ia3pa
+ia4pl i4app i3arc i2ari i3arie i4arri iar3t 4i3as ias4c ia4sic iass4 ias6trop
+i3at ia4tic ia4toa i4atoo ia2tr iat5ric. i4att ia3tu i4aus ia3v iave4 5iavel
+i4avo 4iax3 ia3zi i2b i4b. 2iba ib4as i4bata i4bb 4ibbo 4ibe. i3b4el
+ibe4la 2iber ib3era iber4o i4b4es ibe4t i4bia i3bi4d ibid3i ib3ila i4b3in i4bio
+ib3it. ibi4ta i4b3ite ib3ito i4bium i3bl 4ibla i4bn i3bo 4ibo. 4i4bol 4ibon
+i3br ibra4c 4ibran 2ibri i4bria i4b5rio i4bs i4bul ib3ula ib2un ib1ut ib3uta
+ib3ute i4by i4c. 2ica. i4caa ica4ba ica3c 4icaca i3cal i4cald 4icam icap3i
+3icapp i3cari i4cast. 4icata. 4icch iccu4 2ice 4icef ice3ro i4cest i3cet 2ich
+4ich. i1cha i4chag ichar4 4iche. i3che4n ichen4e ichen5o 4ichi ich3ic ich4i4e ichi4l
+ich3in ichi3ni i1ch4o2 i4choi i2chom i4chore. 4ichot i1chr 4icht i3chy 2ici 6icia
+4icic i4cic. i3cid4 i3cien i2cif i4cila icillar4 4ic3in4a i2c3ip i5cipi i3cis 4ic1it
+2ic4k 4ick. 4icke icker4y ick5l 4i4clo. ic3ly ic1n4 4ico. 4icog. i2cola 4i2c5oli
+ico4mat icom4e i6como 4icope ico3ti 4icou 4icoy 2i1cr icre3 4i4cri icro1 2ict
+4icta icti2m3 ic4tis ictu2 ic2t3ua 2icu1 4ic1ul ic3ula i3cule ic3ulo i3cult ic3ulu
+ic4um ic3uo 3icur 4icylat 2id i4d. idacty4 ida4d i4dai i4dak ida4l i4dam
+i4dani i4danu 4idasa idau4 4id3d4 ide1a i2dect id5ed idel4e ideli4a i3den ide4na
+id3er. id3era 3idesc ide4se i4detr idewa4 id4g idgel4 idger4 i2d2i i4d3ia i4d3ic.
+id3ica idi4d id4ie id3if id4il i3d4im i3dine i4d3ing id3ino i4d3io i4d3i3t id3iu
+4id4j id3n 4idni i4dobl ido2l idol3a i4domi i4dones i4dophy id3ow i4dri i4drop
+4ids i2du1 i3duc id1ul idu4n id3uo idur4 idw4 i4dyd i2dym ie2 2i4e.
+4iebr 4iec. 4ie4ce i3ect 2i2ed i4ed. ie4fe ief5l iego3 4ieh 2iel ie3la
+iel4d ieman4 iemp4 2ien ie4na 3ien3at ien4e ien4g ie4n3i i4eno 4ieno. ient4a
+ien4tag i3enti4 4iento ien4tr 4ie3p iepra4 i1er i4er' ier4c i4erd 4ier4e i4erg
+2ieri i4erly i4ern 4iero 4i4ers 4iert i4erwa i4es. ie3se i1est i3est. 4i3et
+ie3ta i4eter i4eton i4et4r ie3ty i4eu 4iev iev3er 2iew ie4we i1ex i3ezo
+i2f 2i4f. i3fa ifar3 4ifat 2ife i4f1er ifer4e 4iferi i4ff 4iffe if2fi
+if4fia 4iffu i3fi i4fi. i5fia 4ificant i4fice i5fie 4ifil i4fing 4i3fl i3fo
+i4fo. iform3i i4ft1 i3fu 4ifug if3uga i5fuge i3fy i5fy. i5fyi 2ig 4ig.
+igam4e i4gand 3igarc i4gatori i1ge2 igens4 igen4to i2ger ig3era ig3eren ig3ero i4geta
+ig4fe igg4 igh4t ight3e ight3i i2gia ig3i5at i3gib ig1il ig1in 4i3gio i4gios
+i2g3it4 ig2l igli4 i3gly ig2n 4ign. ign3ab ig3nat 3ignate ign3er ign3in 4ignm
+igno3m i5gnon. i2go2 3i3g4oc i5gon. igon4is ig3o3no i3gop igor3a i4gri i2gu i4guat
+i3gu2i ig3ul igulat4 i4g3uo ig1u2r 4i2gy i1h iha4n iheret6 ihil3i 4ihin i4hk
+i4hs ihun4 i4hz 2i1i2 4ii. i3id i4is. 2ij ijan4 4ije i4jl i4jn
+2ik 4ik. i1ka i3kan 4ike ikin4 i5kin. ik4l ik4w 2il. i1la i4labe
+i4lade i4laf i4lana ila4ne ila4p3 ilar2 ila3ra i4laru ila4s i3lat i4lato i5lator.
+i4latur 4ild il4du i4le. ilea4 il4ed i3leg 4il3er iles4 i4lest ile4tr i5lev
+ilev4er ilh4 il1i i4l3ia ili4al. ili2an il5ias ili6ativ il2ib ili6ca. 4ilie il3ien
+i4liki i3line il3ing. il3io ilion4 iliora4 il2is 4il4is. 2ilit il3ita il4ite ili4tur
+il3iu 4ilius iliv4 i1l2iz iliza6bi i4l4k 4ilk. 2ill ill3abl ill4e 4ille. ille4i
+illi2a illin4 4illio illo4c il4lock il4lust. il4mi 4ilni 4ilob ilo4e 4i4logi ilo4mon
+4ilop il1oq il5oquis i3lo2t 4ilp ilpa4 il2ti i1l4u il1v il4y ily4a i4lyra
+4im. i4maa i4mace 4imach i4machu i2mag 4imak iman4i i4mano 4imaru i5mat 4imato.
+4imav 2ime 4ime. ime3l i2mene imenta5ry i5meriz im5etry imf4 imfer4 4imh im1i
+4imi. i4m3ia im4ico im3ida imi5la 4im5ing imin3i imi4nu i6minutio imi5ny imi4on im4i4p
+i1mis i4miss im3iti 4i4mity imma3t 4imn4 i3mo imo4ch i4moi i4mola imo4nian imo3no
+i4moth i4mout impa4l im4pers. im4pha imput3a 4imr imro4 i2mu 4imu. im3ul 4imw
+2in. i1na 4i5na. inab4 4inace i4nach 4inad ina4la inal4iz i4nam ina4mo in4ann
+i4narch i4nare i3nari inar4is inar4it in3aug inav4 ina4z 2inb incar3 incel4 4inche
+in4cor. in4cr. 4inda 4indee inde4fi inde4l in4dermo 4indl indor4se 6indromis ind4wi 2ine
+4ine. in1e3a in3eal in3ear in3eat in5ega i4neit 4inel i3nell ine3m in3emat i1nen
+i2n3eo inep4 3ine4ph3 in3er iner4s in4er4v i4nese i2nest i4nesw i1n4et i4neth ine4tr
+in3ew in3f4 infat3 in4fin. 1i4ng 4inga ing5ab 4ingbu 4ingd 4inge ing3en. 5ingenu
+4inghe 2ingi in2gl 4ingla 2ingle 4ingo ingov4 4ingr 4ingtow 4ingu 4ingy inhag4
+4inhar 4inhol 2i2n1i 4ini. in3ia 4inian 4in3ic i4nic. in4ica. in3in i4ning in3io
+iniona4 5i5nisc in3ish in3ist in3itiv i3nitr 4i4n3ity i4n3iu 2ink in4ke4 in4ki in3kl
+in4ky 2in3l inlan4 in4nag inname4 4inni inno4m i1no 4ino. i2no4c i4nodon i2nog
+i4noge in5ogen. inoi4s inoki4 i4noli i3nom 4inomi i3non4 inos4t 4inot. i4nota i4noti
+4inour inow4e in4ri. insati4 in4siani insis4 insist3 4insk 3insu insur5a i4n1t 4int.
+4inta in4tee in4ter. inter3e intes3 intest4 4inthi in4thod in4tin in4tres intro3 2inu
+inud4 4i3nus 3inv4 4invil i2ny 4i3ny4l3 2io 4io. i1o1a i1o3b i1oc io4cel
+4iocu i1od io4dep 4iodic io5dize io5do i1oe ioe4co i1og ioga4 6iographa i3oi
+i3ol 4iol. io5late. iol5a5ter io4list 4iolou i1om iomer4y io2n ion3a ion4ac ion4ag
+ionar4i4a i2o4ne 4ione. ion3i 4ioni. i3onic ion4it iono4my i3op ior2a iora4bi iora4m
+io3rati i4ord io4rit i4orm i3os 4iosi 4ioso io3sp io3sta 4ios4to i1o2t io3ta4
+io3tel iotempo4 io3th iother6my iot1i iot4s io3v iovi4 i3ox3 2ip i3pa 4ipala
+ipa4n i4par ip3aro i5part ipat4edn i4pathi i2pe ipe3da iper4ac i4phat 4i1phe 5ipheno
+i3pho i4phora iphori4 i4phyo 4ip1i i4pia ip4ic ip3i1e ip3ing i5pinn ipis4t ip3it
+i2pl i4plac i3ply ipo4ce 4ipoda i4pode i4pody ipol4i i4pom ipor4 i4poro 4ipot
+ipow4 4i4pp ip4pel ipri4e i4pry ip4sal 4i4pt2 ip4tal i2pu ip1ul i3pur 2iq
+i1qua iq3uef iquet4 iq1ui 2ir 4ir. i1ra 4i3ra. i4rado i3ral 4iram i4rama
+iran4 irassi4 ir4at i3ratio ir4cal ir4ch ir2d ir4do ir3dr ire5ar i1rec irec6trix
+i4refu irel4i i4rely i3ren iren4t i4r3er iret4 i4rety irev3o ir3g irhi4 ir1i
+i3ri. i4ria ir3ica ir3i3de ir3ido iriga4 iri6gibl ir4im i4rin ir3ing i1r2is ir4ites
+ir4ius 5i5r2iz ir2l ir2m ir4mand irm5ativ irm6it ir4ni i1ro i5rog i3ron iro4ny
+iro4po irov4 irre4f irre4la irri3 5irrit irru4 4ir2s ir4ty. ir3u3l i5run i3rus
+i4russi irv4 ir1y i2s 2i4s. 4isa. 2isab isa4me 4isan i4sandr i3s4ant. isar4i
+isas3 4isau isa3ve 2is3c iscar4y is4ces is4cio 4iscot iscov3 4isd i3sec 4i3sep
+is3er iser3a is3es ises3t iset4i i3seu 4isex ish1 4ishan 4ishc ish4ch i5shev3
+2ishi isho4 ishon3 is1i 4isib 4is2ic is5ido 4isi4e is3il is4iny 4isio i4sior
+isi4p i4sise i4sisi is3i4ta is3itiv is3ito 2isiv 2isk is1l is4la. 4islao 4ismi
+ismis6sib 4ismo ismolo6 ismome4 4ismu i3so iso5b is4od is4ol iso3la 4isor is3p
+ispan4 is4pec ispen6si is4ph i3sphe is4pi i4spie 4is1q isro4 2is1s 4issa2 4isse
+is3s4i 4ista is3tak is4tat 4iste. istem4i is3ten. ist3enc ist4er is3teri i4sth is3t2i
+ist3ib 4isticha is4tide. is4tif 4istiu is4tiv ist2l 4is3to istoi4 is4tolic is4tom is3tr
+3istry is3tu istur2 is1u3a isub4u i5sul is3w is4we is4y i5syl i3sym i4t.
+it2a 4ita. itab4 4itac i4taco i4tag 4itai 4i4tak4 ita4l3i i4taly 4i4tam ita3mi4
+ita4ne i3tani ita4n3o 4itante ita4p i3tar ita3riz itar3y 4i3t4as4 i4tasi i3tat 4itato.
+i2te i3tell i3tem3i i3tent i4t3eo 2it1er 4itero it4erp 2i2th 3ithel i4them 4ithi
+i4this 4ithmi ith3r 2i2ti 4itia. i4t1ic it3ica it3ici 4itics it3ig i4t3il it1im
+iti4n it3ish it3ism i4tisti i4tiu i4tiva itiv3i i4tly i3to 4ito. i4tok 4itol
+i6tology i4tom i4toph i4tora itori4d 4itoso itpro4 itr4 i4trame 4itre i4trem i4trep
+i2tri 4itric it4ro. 4itropy i4try 4its it4sa it4sy i4t3t4 4itt. 4itta. 4ittae
+4itte4 ittel4e 4it5ti itti4t ittu4 i4t1ua i3tud itu4de itu3di3 4itu3e 4itui i4tui.
+it1ul itulat6 i3tum i4t3uo 2itur itur4a i4turgy itur4n 1i3ty it4y. 4itya i4tyi
+i4tyl i4tyo i4tyr i4tys 4itz it4za 2i1u iuli4e i3um iu2mi 4iu4o 4iupo
+4iur i4ush i4usi ius4t 2iv 4iv. 4iva. 4ive i4vel iv3ell iv3en. i4ver.
+iv3eri ives4t ivest4i iv1i iv3ia i4vid. ivil2 iv5il. ivi3lis i3vine iv3io ivi4p
+4i4vis. iv3ise i2vo 4ivor i4v3oro i4vot iv3v i1w iwan4 i4ww 2ix 4ixe
+ix3i ixiv3 ixo2 ixo4d ix4yl 2i1y i4y. i3y4a i4ys i4yy 4iza. 2izab
+4izal 4izar iz3ard i4zato 4izd i4zel izi2 iz4ie iz4it izz4 iz5zin 1j
+2j. ja2 3ja. jac3u ja4de ja4g jama4 ja4mas jame4s 4jang ja4pon4is jargo4
+jargon3 jas4c jas3p 4jav javar4 jazz3 2jd je2 jeal3 je4b 3jec jectiv6is
+jeel4 je3j 4jel. jella4 jel4lo 4jem. jemap4 jem4i jen4u jeop3 2jep jepu4
+4jer. jer4a jer4om jeron4 j4es 4jes. 4jesty jes3u3 jeun4 jew1 jh4v jh4w
+j2i2 jil4 jim4p jing4 jink4 4jis 2jj j4je 2jk 4jl. 4jli 2jm
+4jn. 4jna jo2 jo4b jo4ce jo4i2 4joie join4tr joli4o jon4a jo4p jo3ra
+jos4e jo5sep joss4 jo4su jour4no jo3vi jow4 2jp 2jr 2js 4jt. 4jta
+ju4a ju5bi 3judg jui4 4jul ju4le ju4lia. ju4lian. ju4li4u jum2 jump3 3jun
+jun4a jun4e jun4gi juni4u jun3k4e jun4u 3jur jurid3 jus4r jus4ter ju4ti juve3
+4jvo 2k. 3k4a. 4k1ab kaha4 3kai kain4i kais4 kak4 3kal2 k4ala 4kalah
+ka4ley ka1li ka4lia kal4id ka4lis. kalit4 4kalm kam4e kam4i 1kan ka4na kana4k
+kang4w kanon4 kan4ti ka3o kao3l kap4i ka4pl kar4s ka4sa kash4e 5kateri 4kath
+ka4thy 4kati ka4tol ka4trine ka5za 4kbe kbin4 4kbl k1c k4cy k1d ke4an
+keat4 4k4ed keda4 ke4dr 1kee keel4e 3keep3 ke4ge kegel4 keiz4 kem4i kena4
+ke4n3i ken4ia ken4ti k4enz keper4 ke4pl keple4 k1er. k4era 4kerm ker4ni k4err
+ker4si k4esi 3keta keth4 k4e4tr k4evi ke5ya 2kf 4kfe 2kh 4kh. kha4k
+khani4 khano4 khay4 khe4da khet4 5khov kho4vi khuz4 k4i. kian4g ki4ato ki4bl
+ki4d k1ie 4kier 4ki1es k4iew kil1o3 kilom4 4kil4s k1ily k4im k4in' k4ind
+3kind. kin3ema 3kinesi k3iness kin2g king5l king4s k4ingt 3kin4i kin4kly k4inl k4inn
+kir2 kis2 k1ish k4ist ki2t ki4ty k4iz k1k2 k1l2 klavi4 kld4 4kles4
+kle4sh 4kley k4lid 4klik k4lio k1m kn2 kne2 kn4i kni4fi 3k2no4 knol4
+knot3 k4nu knur4 1ko ko4cytot ko4hi 3koi4 ko4it kold4i 4kolos kone4 koon4
+koop4 ko3pe kopen4 kop4f ko3ra kor4t kov3s k1p2 kpa4t 4kpo kram4 kre4
+kroo4 krot4 2ks2 k4s. k4sar ks3b k4sco k4shea ksnif4 ks4p 4ks4t ks3v
+k1t kt4a kth4 ktom4 1ku ku4a kuch4 ku4dr k4um kun4z ku4o k3up
+2k1w kwar4 4kwe 4kwo 2ky kydi4 ky4e 3kylo ky4mi kyp4 ky4pr ky4ri
+2l' 4l'o l4's 2l. l2a 3l4a. 5laam la3be 4labeg lab3ic 2labl la5bore
+la3bori l4a4bri lab5yr la2c lac3ab 3laceo la4ces 5la3chia lach3r l4aci lack4y 4laco
+laco4p lac3t 6lacteric 3lactic 4ladel ladi4e ladi4o. lad5is lado4c 4ladol la4dop la3dy
+4laeo laes3 lae4v laf4f la4fi 4lafo 4laga4 la4gan lage4 lag3ell la4geo 4lagine
+la4gist 4lag4o 3lah. la4hab laim3a lai4n 4laira laish4 4lakl la3lia 4lalist 4lalt
+la3mar lam4bi lam4d la5melli la4met 4lamid lam3or3 4lampu l4an. lan4a 4lanac la5natio
+l3ancho l4an2d 3land. 4landin 4laned lanel4 4lanes lan4ic lani4e lan4if lanne4 lano4ch
+lans4i lanta4g lan4tr lao4 la5od5 lap3ar 4lapax 4laph la4pl lapla4 laps3i lapu4r
+1la2r1 3lar. lar2a la4ran 4larbor 4larct lard4er lar2g lar4ge lar3i la4rine 3l4arm
+la4ro. 4larop 4larsh 4larus larynge6 la4sa las4e lask4 lasmi4 las5ph las3ty 1la2t
+l3a3tal 4latat la4te 4lateli 4lateriu 4latesh lath3er 4lathi 4latho la4thy 3latia l3atil
+latil3i la4tim 4latine l5atine. lat3ini 4latinit 2latis lat3it 4l3ativi 4latom laton4 4l1a3tr
+l3atro l3atry lat4ur la4ty 4latya lau4dat laudi4o laun5d launt5 lau3si 2lava la4vato
+laver4a lavi4e lav3is 4lawa lax3 4layl. lays4 la2z 4laze lazi4e la4zin 2lb
+l4b. l3ba lban4 l3be lber4d lbin4 l3bo l6bous lbun4 2l1c2 l4c. l3ca
+lcali4 lcas4 l3ce l3ci lcia4 lci4nab lci6nato lci3tr l4cm l3co lco4n lco3ra
+l4cose l4cou l4cs l4ct lcu1 2ld l4d. 4lde lde4ba ldens4 lder4al ld4er4o
+l4des ldh4 ldi2 l4dia l4d3ish l4dist l4dit ldiv4 ldivi4 ld3l l4dox l4dry
+ld4ti l4dup l2dy 2l2e l4e. le4a4d lea4f 4leano4 le2ar lea4s leas3a least4e
+leath3 4leati leator4 4leaz le4bel le4bit l4e4bri 1lec 4lec. 4leca le4che lech3er
+l4e4chi lech4w 3lecit 3lect lect4a 3lecula 6lecy 4l4ed. l3edi 4ledl 4ledn le2e
+lee4l 4leem l5efact le4gad 3le3gal l3egan le1gi 3lego lego5rize 4legy le4ia lei4c
+le4ina leit4e lek4 3lel. 4lelik lem3ati l4emb 4lem4e le4met 3lemic lem5ish 3lemma
+lemper4 4lenar. 3lenc lend4w len4e le3nec 4leneu 3leng 4lenga len4gl le5ni5e len3is
+le4nite 4lenor 3lent 4lentin 4lentu lentur4 4lenty le3o leob4 leo4ch 3leog le4omi
+4leph le3pha le4pi. l4epin lepi4p le4pus l3era l4era. ler4al ler4e leres4 lern4
+l4e1r2o 3lero. le4ron 3lert 3l4es 4les. 4lesb 5lescenc 4lesd les4e 4lesee 4lesg
+4lesh 4lesk 4lesl 4lesm 4leso le4sow 4lesr lessar4 les4sen less4i 5lessn 4lestin
+4lestit 4lesto 4lesv le3ta 4letag le3thal leth4i 3letic 4leti4e le4tom le4try 3lets
+4leui 4lev. 4leva l3evat lev3el le4ven 4levil levis4 levit4e lex3 lexi4an 4lexini
+3ley l4ey. 4leyar 4leye. 4leys 4leyvo 2lf l4f' 4lf. l3fa lfani4 l4fant
+lfa4ti lf4fia lf3h lfi4e lfilar4 l2fl l4fla l3fo l3fu lfu4ra l4fy 2l1g2
+l4g. l3ga2 lga4m lgan4 lgar3 lgar4y l4gea l4gev lgi2 l2gin lg3ing lgi4u
+l3go lg4r l3gu 2l1h 4lha 4l3he lh4j l3ho l4ho. 1l4i. l4iae lian4it
+li2ar liar3is libe4l lib3er lib4er. 5libera li3b4i4 2lic l4icata 3licen l4i3che l3icho
+li4cic li4cid. 3licio liclin4 l4icn lico4t li4cr lic4te 5lic3ul l3idar l4idas l3idat
+li4dea lid3i lidi4as 3lidif 4li4dil 3lidit li4dom l2ie l4ie4b lief4 4liem lie4n
+l3ien3a li4ery li1e4s 4lifat li4fe lif4f li4fl lig3am 3ligat lig3ere 2ligib 5ligino
+3l4ign lig3nan li3g4o l3igop lig2u l4ihi 4lihu 3l4ik 4likar 4liko lil4i lilit4
+3liloq 4limani. lim4bl limenta5r l4i4mi lim4ic limit5ab limo4g lim4pl l4imu l2in 1lin.
+3lina. li4nall li4nant 4linar 4linas li4natu 5lindric 3lin3ea li4nen 4linet 2ling 3lingt
+lingto4 3lingu li4nid lin3iz linoi4 linos4 li4nosi 3linq l4ins lin4sh lin4t lint3i
+linu4 3liog 4liog. li4ol. lio3r liorat6i 3liot l4ip lipa4t li3pe li4pec lipe4d
+4lipha 4lip4i li4pol liptic4 lipu4r li4pus 4liqua 6lique. lir4a 4lirat li5re lir3i
+lir4ty 3lis. li4sa. li3sad lisar4 li4sato l4isb 4liseu 2lish 4lishl 4lishn 4lis4p
+l4iste lis3ten lis3ter 4listine l4it. 2lita l3itan l3itar lit4c 1l2ite l4iter li3t4er.
+4lites 1li4th lith3op 1liti 3litica 3litio 4litiv li4tor l4itr l4itu li4tui 5liturg
+2l3ity li4ve liv4ed live3l liv3er lix3 l4iy 4lizin. l2j 2l2k 4lk. l3ka
+lka1l l4kat l4kaw lk1er lket4 4lki lk3y. 2l1l2 l4l. llab3o llad4er lladi4o
+llai4 lland4 llan4i l4lao llap2 llapu4 llas4ti l3lat ll3b ll3d 4lle l4le.
+l3lea l3lec l4led l3l4eg lle4in l3le2l llel3i l3l4em l3len lle4no ll4er lle5r4a
+l3lero l5lers. l4lese l3let l4leta l4lete. lle3v ll3f ll3g l4l3h l3lia l3lic
+llif5lu l3lig llil4 llim4e llinar4 llin4iz lli4nos l5lio lli4ol llipe4 ll4it l4l3m
+l4l3n l3lo l4locke llogu4 llo4mi llopa4 llo4pe l4lov llow4el ll3p l4lr4 l4ls
+ll3t l3lu llu3c llumin4 l4lv ll3w l3ly. lly4e lly3g 2l1m l4m. l3ma
+l4mab lma4to lm4e l4mes lme4t lm3ie l4mil l4ming l2mis 4l3mo lmo5na lmon4dy
+lm4sh lmu2d l2my 2l1n2 4ln4e lnia4 1l4o. lo2a 3load l2ob lo4bal lobi4n
+l6o3bl 4lock' 4locky 4locya l2od 3lodic 5lodio l3odr l4odro l2oe loes4 loeti4
+l2of log3a3r l4ogen l3oget 3logia 3logic log4n 1logu logu3i 4logy lohu4 loid4
+loi4t loiz4 4lole lol4i l2om 3lom. 5lomatic lom3er lo3mi lo4mic 3lomit 4lomitic
+lo4mona lomul4 lomulti4 l2on2 1lon. lon4e 4loned 1long longer4 lo1n4i 3lonia loni4e
+l3onis 4lonoi 2lonyl lood3 4lool looz4 l2op lop3in lopi4t l3opm 4loq. l4ora.
+lora4d 4lorc l4orch lor4dy l4orem lore4t lo2rh l4oric lori4e lori4n l3oriz loro3e
+loro3m lorometh5 loro3p l2o2s lo4se los3in l5osophic 5losophis 5losophiz l4osophy l2ot lo5tha
+loth4i4e lotin4 lo2to 4loton lo2tr l4ott l2ou lou4c lou4de lou3i 4lour. lour4d
+4lout lout4r lo2v lo4ve l2ow1 loy4d 4loys 2l1p2 lpa4c l4per l4pes. lpe4t
+lp3f 4lph4 l4phant l4phar lpha4t lphe4n lphi6a. lphi4d l4phor lp4i l4pier l4pies
+lpi4tal l2ple l3po lp3t lpu4 l4py. 2l1r lre4 lr4i lri4o 4lro 2ls2
+4l4s. lsa4my ls3b l4s4c 4lse lsem4 l4sew lshe3v l4sib lsin4 ls4it ls4k
+4l3s4p 4l1s4t4 lstaf4 lsth4 l4stin l4stu 2lt l4t. lta4na l4tans l4tant l4tativ
+l4taz l3ten lte4riu l2th l3tha lthy4 lth3y. lti3a lt4ib l3tic l2tie l4tily
+ltin4 lti3p ltira6c ltis4 l4tish l4tism l4tist. ltiv2 lt4j lt3l ltm4 l3to
+l4tol l4tose ltra4bl ltra3m ltu2r ltur3a ltur3i l2u l4u. 4l3u1a lual4 l4uar
+2lub lubi4 l3ubl lub4li lu3br 3luce 4lucel lu3ci luct4 luc5ta 4lucti lu2d
+lud5ib 2lue lu1en luf4 lu1i lui4a 4lu3id3 lu1l4 l4um. lum4bl 2lume 4luminic
+4luminiu 3lumni 4lumnis 4lumny lun2 lu3na lun3de lun4e 2lunt l3unta luntar3 lu3n4u
+lu4ny 4luo luop4 4lur. lu3ra lur4b lur4c 3lu3ro lu3so luss4 lus3t lus4t5i
+lutan4 5lutato luth4 lu2tis 4lutiz lutton3 4lu4va 4luyl 2lv 4lva l4vable. l3vag
+lvan4 lvar4y l3ven l3vet l5vin. l5vini lv4v 2l1w lw4e lx4a 1l2y l4y.
+4lya 3lybd 4ly4bi 2lyc ly4cid ly4cina ly4cra l4y4dom 4lyer l4y2g lygen4 l4yk
+4lylo 4lyme ly4mene 4lymo 3lymp4 4lymu lyn2 lyn4c l4yny 4lyo 2lyp l3ypl
+ly4poi ly3ra 4lyra. lyr3i lyr4m 2lys 3lyse 4lysi lys4t 3ly4ti ly4tom 4lytr
+4lyus l4yx 4lyzate 4lyzato 3lyze l4zg l4zi lzin4 lzo4 l4zy 2m. 1m2a
+3m4a. maar4 4maas 4maaz 2m1ab mabe4 ma4bin m4abo mace4t 2mach mache4 ma5chine
+mack4ere ma2cl mac1r mac3t mac3u m4ad mad3ic mado4 3mae mae4n 4maep ma2g
+magal4 mag3a3z mager4 3magg maggluti6 2mag3i 3magn ma3go 2magog magor4 4magr 4maha
+maho4 3m4ai4 maid3e maini4 main4ie 3mak 4maka. 4maku 3mal m6al. mal3ap ma4lat
+m4ale 4malek 4malge mal4ib ma3l4in mal5le 4malley malli4 4malloy mal4m ma5lou 4mal2t
+mal4ti 4malu 4maly 2mamb man3ag manar4 mana4s 2manat manc2 3manci 3mand ma3nen
+ma4nes 4manes. m4ang 5mania man5if mani4l man3it 3mann ma4noi mans4l m4ant ma2nu
+maph3r map4pe ma3q m4ar2a marbel3 4mares mar3g mar2i mar4ial 4marif mari4o. mar3it
+ma3riz ma5rol mar4shi mar4st 4marty. 4maru mar3v4 mar2y. m4as 3mas. masal4 mas4ce
+mas4e ma4sic ma4sor 3mas3t mas4th mas4tl ma3s2u 4masv 3mata 4matal mat4c 3ma3ter
+ma4ter. m3ateu ma4this 4mathy ma4tik. m4atin mati4nal 3matio ma3tis 4matod ma2tog 4matogl
+ma6toph matopho4 4matopod ma6tosc 4matose 2matou ma2tri ma3tu ma4tura maug4 maus4e max3
+maz4a ma4zl 2mb m4b. 4mba mbal4i mbardi4 mba4t 4mbe mbel3 m4bem m3ber
+m4berie mbia4 mbian4 m3bic mbid4 mbi3en m4bies m4bik m2b3ing mbis4 mbi4v mb4l
+mblem3a m5blin mbm4 mb4o mbo5na 4mbr mb4sa m3bu mbus3t mbus5ti mbut4 mbys4
+2mc mca4 mc4h mck4 mcma4 mc4o m4da. 4mdo me2 4m4e. meal3 meam4
+me3b 3mech me3co 2m4ed 4med. me4dan 3me3des 3medi med3ic me3die 4medied 4medil
+4medis med4it. m5e5dy me3f meg2 3meg3a1 megam4 3m4ei meion4 mel3anc 3melia me5lie
+4melik 3melio melli4a mel2t memo3 memor4 1m2en men2a me3nab men3ac men4ag 3mend
+me3ne 4meness mene4u 4menh me3nia meno4m menos4 mens4 men4sc mensu3 mensur4 men4sw
+3m4ent 4mentac men4tate men2te ment3er me3nu4 me3o meog4 4meon 3meop 4meosi 3meo3t
+me3p me4pa meral4i 3merc merd4 merdi4 3mere 4merel mer3et 5mer2g 3meria 3meric
+4merici m4eride mer4im mer6ob meroblas6 mer4og mer4ol 4merol. m3eron 4merso m4eru mer5us
+4meryv 4mesb 4mesd mes3en 4mes4i mes4n me4s1o mest4 4mesta 4meste 3mesti mestic4
+4mestr 1met1a me4ta. met4abl me4tai 3metal 4me4tar met2as m1e3te me4ten 3meteo m4etes
+1meth 4meth. 3metha meth4i 4methr meth6ylam 3metic 4metin me4toe me4ton 4metop 5metre
+3m4etri 4metrid 4metris me4tru mew4 me3wa mex4ia 2mf mf4e mfer4o mfoun4 2mg
+2mh 3m4i. 1mi3a 3m4ia. mia4m mian3a mianop4 4miar 3mias mi3b m1ica mi5chel
+mi4chen4 m3icil micker4 3micro m4id. mid2a m5idal m3idat mi4da4z mid3ic m4idn mi4done
+2mie4 m4ient mi1es mif4f 3miga 4miges m4igra mi4la. mi4lag mil4de mi3let mil4h
+1m2ili mili4a. mili4al 4milie 4milis m4ilk 3mill milli4e mil4te 4mily mimed4 mime4t
+mi4mi. mim5ic mi4mis min2 m4in. mi3na m4ind 3mine. mi3nee m3ineer mi4nei mines4t
+m4inia mini4fo 3minio m4i4nit mi3niz min5ne5 mi3no mi1o m4iolo mi4ona 4mioni m4iot
+m3ip mi3pe 4mipl miq4 3mir. mir2a mi4ram mi4ri mi4russ m2is 3m4is. mis1a
+m4isco mi4see 4mises 2mish mi4si mis5le 1miss 4misso mis4sy. mis3ta mister4 mi4tal
+mit2er 4mith m4itic m3itiv mit3iz 1m4itt m4iu m3iv4 mivi4 m2iz 4mko mk4s
+2m1l2 m3le m3li mli4n 2m1m2 m3ma mma4da mman2 m4mandab mmar2 mmari4o mma6top
+m4md mmeas6ure mme4da mmeli4 mmem3 mme4n m3m4i mmi6nato mmi4p mmis4a mmi4t m4mk
+mmoni4a. mmu1 m3mul mmu4ne 2m1n2 m4n' m3na mnar4y mnav3 4mne m4nem m4ner
+m2n3in mnon4 mnosper4 1m2o m4o. mo2a 4mochore mo4choro mo4chron mocli4 mo4coo 2mocr
+5mocrac 5mocratis 5mocratiz 3mocy 3mo2d mo4d1e mod3ul 4mody. moer4 mo4gena mo4g5e5niz mo4ges
+mo4i 4moi. moid4 moig4 moi4t 4moix 4moki mok4s mo3la 4mola. mo3lin4 4moliti
+4mollit 4molog. 4mologue mol4or 5moly moma6 4momi 3mon mon2a 4monas. 4monb mon4dia
+mo4ne 4monen mon3e3t 4monf mo4niani 4monid. 4monl monni4 mo3noe mon3olo mon3os 4monto
+mon4tro mon3u mo4num 4monym moo4s 4moot 4mopau 3mophi 4mophoni mo2r m3or4ab mor3al
+mo4rar 4morat mo4rax morbi4 4moredn moreli4 m4org 3moria mo4ries 4morin morit4 m3oriz
+mor6iza 4moro mo3ros 5morp m3orrh 3mos 4mosac mos4e mosil4 4mosite 4mosm 4mosor
+mo4sp m4ost mo3sta 4mosur mo4sy mo4tes 4mothy 4motis moto2 motor5i m6otropis mot4tle.
+moun4te 3mou4s 4mousine mous4se 4mout. mo2v mo4vi movi4e 4moyi 2m1p m4pab mpac4
+mpa4i mpais4 mpan4d mpan3e mpani4a mpa5no m4pantl mpa4nus mpa3rab mpar4te mpa4s m5pa1t
+mpa4tr m4paz mpe4dit mpe4l m4pen. m2per. mper6ato mpe3ria m3pet mpe3tr mph2 mphan3g
+mphi4m mph4y m4phy. m2pi mp4ic mp3ie mp4ie. m3pig m3pile mpin4 m3pir mp3is
+mp4le mp5les m4plev mpoti4 m4pous m4pout mpo4v5 mpress6in mpri4 mprin4 mpro3m mps4es
+4mpt mp4ter mp5tu mptuar4 mp4u2 mpug4 mput3ab m4pv m2py mp3y. 2m1r mro4d
+2ms2 4m4s. 4m1s4e m4spo m1s4t4 2mt2 m4tis mt4s 1mu muci4 mu4cl 4muel
+2mul m4ulc mul4i mul4ler mul4lit 3muls m2ul3t4 multi3 3m4um 3mu1n2 mund4 mun4e
+mun4ga. muni4f mun4is m4ur mu3ra mur3d4 mu4re murmu4 3m4us mus3t 3muta muth4i
+mu4tis 2m1v 4mvi 2mw mwal4 mw4e 1my 2mya4 myal4i my4an my3c my4cer
+my4col. 4myda my4do my1e my4log my4los 4myne my1o 4myr my4ri myr3ia myro4
+mys3 mys4i mys4u my4ti mz4e m4zl n2' 2n. 3n4a. 2nab naba4l n4abase.
+4nacen 3n4aceo 4nachl na4cho 4nacif nac4r 2nact 2nad nad4de 3nadia nadi4e nadi4r
+3nado. 3naea 4naec 3naem n3aero naes3 naeth4 2nag n4agena n3ager na5go n4agu
+n4ah 5nah. 4naigret na4is n4aj nak2 nal4go na3li3a nal3ie 4nalin na4lit 4nalla
+4n2alo n5alogic 5nal5ogis 4nalt 3nalysi 4nalysin name4ne na4met n5a3mid n4amme4 4namy. n2an
+nanach5 3nance na4nes nan4ic nank4 n4anna nanom4 nan4tes 4nantiz nan4tr 2nap n4aph5o
+napi4 na4pos n4apu nar1 3nar. n4ara n2ar3c n5archis nar4di 4naret nar3i 3naria
+nar4iac na4rin nar4ite nar4l 4narou narri4 nar3t n4as. n4asa na4sa. nas5c na4sh
+3nasi na4sit n4asm. nass4 n2as3t 4nasth 3nastic 1n2at na3ta nat4ab nata4k nata4l
+nat4en 3nathem na3tho nat3ici 4natina nati4u n5atomic 5nato5mis 5natomiz na4tro 3natu natu4a
+nat3ura nat4u4ran nat4u4rat 2nau 3nau. naud2 nau3di n3augu 3nauti 4nauto nautog4 nav3i
+naxa4 3nay n4az 2nb2 n4b. nbak4 n4bd n3be nbeat4 nbes4 nb4l n5bli
+n3bu 2n1c n4c. nca2 ncaco4 ncampho4 ncapsul4 ncar3c n4caria n5ceri nc4es n4ces.
+n4cev n2ch n4chate nch3er n3chia nchi4ni n3chi4s nchis4es n3cho ncho5a ncho4lin n3chu
+n3cib n3cil ncil3a n3cina n3cip n4ck nc4l nclat4 ncle4 n3c4o ncorre4 ncov4er.
+nc4r ncre4v n4cs n4ct nc4tad nct4e ncu4ra n4cx n3cy ncy4cli 2n1d n4d.
+nd3age n3dal ndama4 nda4na. n2da4r nd3ard n3dea n3d4ec n4ded. ndeform6 n3del ndel4li
+nd3enc nd4ens n3denta nde4ra n3deri n3dero ndes5cent nde3t nd3g nd3ho n3d4ia nd5ibi
+ndi6cativ n3dice ndic4to n3dic3u ndi4en n3d4if nd3ing n3dio nd4it nd4iu n4div. n4d4j
+n2dl n3dler n3do n4dof ndo4mi ndoo4r ndop4 n4dov n4dq n3d4r n4drat n4ds
+nd4sia nd4te n3d4u ndu4a. n4duc. nduct4i n4dunc ndus3 n4d4v nd4win nd4y n4dz
+n2e 4ne' 2n4e. ne1a n4ea. 5nealo ne4ap n3eari ne4art ne2as ne4ata n3eate
+n3eati 3neau ne2b n4ebe nebro4 ne2c n3ecd 4ne2d n4ed. n3edic ned3u neep4
+5neficen n3efici n3efit ne4fr 4negade neg5ativ ne3gr n3egy 1n4ei neid4 3neir4 neis4
+nek4e 4nela ne4let neli4a ne2lig nel3in n4elv n4ely 4nemari nem4ati nemer4y nem4i
+n4emia 3ne3mic ne4mog ne4mone n4en. ne2na 4nene 3nent. ne4ny 1ne3o neo4t4 3neph
+4nephore ne5phriti n3eq n3era ne3rad nera4l3 nera4m ne3r4as n4erd n4ere ne3rea n3er3g
+n4eri 3neric ner5ist ne3rod n4er4ol ner4ri n4ersv ner4vi n4erw 1nes 2n4es. 4nesbo
+nes4co 4nesd 4nesec 4nesen 4nesh 4nesm ne4sot 4nesp 2nesq 3n4ess nes3ti nes3tr
+4nesv 4neswe n4et. ne3ta ne4tag n3etar netel4 4neter 3net1i ne4ti. 5n4etic 4netie
+n4etn ne4toi ne4top n3e3t4r ne4try net4s n4ett 1neu 4neui 3neuro neu4ry. 3neut4
+neva4d nev4e nevers4 4nevi nevo4c nev3ol newal4 news3 n3ex3 nexami4 nexci4 n4ey.
+n4eya n4ez 2nf2 n4f. nfalo4 n4fers nfi2 nf4l n5fla nfu3sib 2ng 4n4g.
+n2gab ngal4le ngal4li ng4am ngan4i ngar4i ngar4y n3gat ng3c ngd4 nge4a. n3geal
+n4ged n1gel n2gen. ngen4er. ngeni2 n3gere n3gero nger4on nge4t ngh4 n3gi3a n3gib4
+ng2ic ngin4 ng3ing n3giu n2g3iz n4gj n4gk4 4ngl n3gli3o n4gm ngn4 ngna4
+ngol4l n4gour n3gr n4gr. n4gs n4gt ngth3 n4gue n3gul ngu4s n4gv n4gw
+n2gy n4gz 2n1h2 nha2 n4ha. nhab3 nhabit5an nhag4i nhas4 nhil4l 4nho nhs4
+nhu4me nhun4 n2i 3n4i. 1nia n4iac nia4g 4ni4ap 4niard ni3ba 2nibl n3ic.
+n4icc n4ice n4ici n5icil n4ick n4i2co nic3o3t n3ics n4icu nic3ul 3nicula n4icy
+nid2 3n4id. n4ida 3nide. n5idine n4idir n4i4do. ni4dob n4idu nie4l ni4et n4ifer
+nif2f nif4fi ni4fin n4ifo nift2 ni5fy nig4i n5igmatic n4ii n4ij nik4 ni3ki
+n4ila ni4la. ni4lam 3nile n4i3lin n4ility n4illi n4ilo 4nilw n3im nim3ag nima4te
+n4ime 4nimea nimi3ta ni3miz n4in. n4ina nindi6c n4ine 3nine. nin4erti ni4net ninvo4c
+nio2 n4ioc 2n3ion niona4t nio4r n4ios 1ni1ou n4i2p nipa4 4niple nipo3 nipre4
+3nipu 3nique. n1is n4is. 2n3ism nis4ma. n4ison nis4p nissari4 n3is3te n3istr n4it.
+nit3ab n3ital nitar3 nitar4iu nith4 4nith. ni4thi ni3tho 3nition 3nitis. 1ni3tr 3nitro
+nit4s ni4ur ni4use 1n4iv 4niv. 3niva ni2van nive4l 4njo nju4ra 2n2k n4k.
+4nka n4kal nka4v n4kb 4nke n3kee nk3en. nker4s nk4e4t n4kf n4kh nk3ho
+n4kie nk3ines nk2l n4kp n4ks n3ku n4kw n4ky. n3kyl 2n1l2 nlan2 nlan4d5
+nlar2 nlas4t nlau4 4n3le2 nlev3 n3li2 nlis4 nlo2 n3lu nlu3b n3ly 2n1m2
+n3ma n3me nmemo4ra nmensu4 nmercu4 nmin3i nmo2 nmon2 n3mu 2n1n2 n4n. n3na2
+nnaba4 nnait4 nname4n nnan4 nnar4y nna4ti. nnat3u3 nn4e2 n4ne. nne4ce n4necy n5nel
+nne4le nnel3i nner4o n3net n4nh n3n4i n4nian nni4cu n4nime n5nin n4nism nnit4
+nni4v nni2va n4niza n4nk n4nl n3no nno4mi n4ns nn4u n3ny nnym4 n2o
+3n4o. 4noam no3be nobli4 n4oce no4cer noco4 n4ocon n4ocr 2noc3u n3ocul no2dal
+4nodrome 4noem n4oet 2nof no1g 4noga nogam6e nogen4is no2gr 1noi 5noint noi4sa
+4nok no2la 4nold4e 4nolei no1li 4no3lit n3olith 4nomac no5mad3 3nom3al 6nomal. 4noman
+no5mer. 4nometa no5me6tri 3nomic nom5ina no3mis n3omou 4n3omy. nomyce4 6nomycet no2n3 non4age
+non4ar4y noncu4 no4ne 5none. none4a none4s non5f nong4 3nonic 4nonicit non4it n3oniz
+4nono nonos5 nonta4 noo4t 2nop n4op. n5ophob n5opht no4phys nop4l 3nop3o3l 4nopolyl
+no4pre nopter4o no4rab no4rary norator4 norm4 nor3ma nor4thin no4ry 4nosce nos4ed no4sic
+no1sp 4nosph nos3t n6ostr 4notap 4notau 5no4te n3othei no3tice noti4e no3tis noti4t
+no3tiz no2to 1nou 4nouk 4nouro 4nout 3nov. nove2 nov3e4l nov4ell 4nover no4vis
+2now nowl3 now3s nox3 2n1p2 np4a2 n5par npat3en npa3tr n3pe npecu4li npe4d
+nper3 nphenol4 nphi2 nphil3 npi2 npi4t np4l npo3e npoin4 npom4 npre4fa npri4
+npross4 n3ps npub3 n1q n3qu nquil4la n1r2 n4r. n3ra nra4k nras4 nrav3e
+n3re1 nre2co nre4com nre3d nre2e nre4lat nres4t nret2 nri4de 4nro nro4b n4r4r
+n4r4w 2n1s2 n4s. nsa4na nsan3i 4n4s3b ns4c nsco4 n3scr n4scry ns3d nsde4
+nsec5utiv ns4ed nse2l nse4la ns3elem n5sen. nse4na nsep3 n4ses ns3f n4s3g n3sh
+n3si nsi4d nsist3e ns4i3t n4sit. nsi4ta n4site ns4k n2sl ns4lau ns4lay ns1mi
+nsmo4 n3so n4soce nso2l nsol3ab nso3na n4sorb nspar3e n3spi2 nspir5ato nspiri4 nspor6ti
+nspro4 ns3r ns3s4 ns4t2 n3ste n3su nsu3a nsubmers6 nsu5li nsur4ab n4suret n4sute
+ns3v nsw4 n3swe n4sz 2nt 4n4t. 4nta nta4be nt3abi n4tage. nta4gen ntagi4u
+ntag4n ntago3 n3tai nta4le n4talka ntam3i nta4na nt3anc ntan4go ntan4i4 n3tar n4tarc
+ntar4ia. ntar4is n3tas n5tatio n6tativ n1te n3tee nte4l3 nt4en n4ten. n3tena nt2er
+n2ter. n3tera nter5c nter3es nt4eri n6terman. ntero2 n3tes. nte4t ntev4 nt3g n1th2
+nth4e n4thel n3thi n4this n4thodo n3ti ntiar4 nti3di n4tie. nti3eg nti2er n4ties
+nti4fi n4tily nti4nal n4tines n4ting nt4ingt nti4nou ntin3ue nti3p nti4pate ntip4s nti1r
+ntiradi6c ntis4 nti3sc n4tish n4tism nt4ist n4tite nti4us n4tiz n3to nto4cr ntomi4
+n5ton ntoni4e nton4is nt4r ntrac5ta ntrar2 ntrion4 n4tro. ntro3s n4trose ntro3v n3try
+nt4sa nt4si nt4so n3twin nt4z n1u1a n4ua. nuan4 nu6atel 1n4uc nu4ch nuch3i
+3nucl nu4de nud4i nudo4 nu4e nuf4 n3ufa nu1i n3uin nu4is4 3nuk null4
+nul4lar n3ulo 1num n4um. num4bly 4numen 2numi nu4mis. nu4na 1nunc nuniform6 n1uo
+nu4p 4nup. nur2 n4ura nur3b nur4l 4nury 1n2us 3nus. nus4c nu4th nuti4l
+2n1v2 n4v. n3va nva5les nvar3 n3ve2 nvel6ope. nvermi4 nvers6a 4n3v4i nvict4u nvig1
+n4vt 2n1w nwi4 n3wo n2x nx3i n2y 1ny. 4ny2a n4y2c 3nych3i nyer4
+3nyin n4yl nyla6m ny4li 3nym. 3nym3ic 4n3ymo nyth4 2n1z2 nza4l nzi4a n4zit
+n4zk o'2 o'4c o'4d o'4f 2o. oa2 2o1a. o3ab oab6o o3ace oac4er
+oach5er o5act oa4d1 o3ag1 oag4r o4ag4y o3a5les oalesc6 o1an oan4er oan3i 4oann
+oa6no oa4p o3app oar2 oar3i oar4s oas4t oat5er o2b 4o4b. o3ba 4oba.
+ob3abi o4bad. obadil4 obah4 oba4li o4balo 4o4bb4 ob4bes o3bedi obe3li4 obe4lia o3ben
+o3bi obil2 obiliar4 o4bing 3obin3i obi4no o4bins obit4e 3o4bj objectiv6 o3b4la o4blem
+oble4s obor4 o3bot o3br o4bre o4bs4 ob1ul o4c. o3ca o4cag oca4la o4calu
+o4cat. o4catel o4cativ oc4cas. occul4 o3ce 4ocer o4c3er3o o4cess. o1ch ochei4o o3chem3
+o3chet o4chic ochine4 ochle3 o4chop o4chorou o4chosp o4chrois o5chrom ochron4 och3t oci4ab
+ocid4 oci4l o4cile 2ocio ocio4n o4cip oc4k oc4l4 o4clam o3co o4cod ocoe4
+ocolor4 ocommuni6 4oconi oco4py oco4q o4cosa oc3rac ocran4 oc5ratis ocre3a oc4ter oc4tu.
+oc3ul oc3ume oc3uo o2cura oc3urat ocurato6 ocus5si o3cuti o3cy 4o4d. od2a oda4g
+o2dal. o4dam o3dan o4dant ode2 o3dec odec3a odel4s ode4mat o4den. o4depe oder4i
+odern3 o4des. o4desis o3dia o4d1ic od4ico odidac4 odi6dacti od1if odif4i o4diga o3dio
+odio4d o3d4iu od4j o4doa odoac4 o4doe o2doli o4dolo o4dom odom4it o2domo o4dop
+odor3i odor3o o4dosc 3o3dou o4dov o4droma o4dromo odro4s odu2 o4duct. od3ula odwil4
+o4e1a oe1i2 oe5ia oe1l o1e3le o3emp o3enc oendo6c oe3n4i o4eno o3enz oeod4
+o1er o4er4a o3erc oer4i oe5rotic o4er4u o4eso o4ess4 o2et oetas5 o3ethy 4o3et1i
+oeti4u oet4s o1ev oev3e o3ex o2f2 o3fa ofa4n o3fe of3fe of3fi offi4e
+of4fl of4fo 4offr off3s ofi2 o3fic ofi3ci of3it3 o4fle o3fo o3fu o4ful
+o4fy 4og. o2ga o4gal o3game og3amo o4gano og3a3ri o3gas 2ogat og5atori og5atory
+o1ge 4oge. oge4l o5gen. ogen4ism o4g3eno o3geo2 o4ges. 3ogeti o4gh 4ogic 1ogis
+o3gist og1it 1ogiz o1g2l o2gli o4glie o3glo ogn4 og4nac og4ne o2go o4go.
+o4gog o5gol o3goni o4gonis og3ony 3ogous 4ographa o6gress. ogrol4 2o2gu 1ogy 4ogyn4
+2ogyr4 o1h2 o3ha2 o4ham. o3he ohe4a o4hg o4hin o4hm o4hn o3ho oho4l1
+4ohs 4o3hu o4hv ohypo4 2oi o4i. oian4 o1ic. oi4ce oi3ch o4ico o4id.
+oi2d3ec oid4er 4oides oid4h oid4ic oid5is oi4do oi3es oig2 oi3ki oi4l oil3a
+oile4t oil3i oi2n o3inc oino4 oin4ti o4ir o4is. ois4c o4isi 4o5ism o5isti
+oit2 o4it. o3ite. oit4i o4i4ty o4jv 2ok ok4am o1ken ok4es ok4ev o3kina
+o3kine o4kn 5okous ok4sa ok4u okur4ti oky4m ol4' o4l. o1la ola4be ola4br
+o4lac olack4 o4lalis o4lami o3lan olan4i o4lapa o3lar3 o4larc olar6is. o4larl o4lars
+o3las3 olas4c olass4 o2lat ol3atr 4olc olch4 o4l2d ol4d1e o4le. ole1a oleast4
+ole4cr ol4e4d o3lei o3len ole4nod o4l3er o3let o3leu o4l2f ol4fe olf4fi 4olg
+o3li. o1lia o5liat ol1ic o3lice ol3ich ol5ick ol3ida o3lidi oli4e oli4f ol3igo
+4olik o3lilo o3line ol3ing. o3lini o3li3o o4lip 4ol3ish o3lism o1lit ol3ita o3lit4e
+o3lith oliv4e 4olk o4ll olla4gi 4oll4e ol3l4i ol4lingl ollin4i olli4no 4olln ollo4p
+ol3ly olmak4e o3lo. ol6ob o5log. ol3oge o4logist ol4ogr o2l3ogy o5lomb o3lomi o3lon.
+ol1or olor3is olo4ry 1o3lou o4lour o4lp o4l1s4 ol2t olt5is o1lu ol3ub o4luce
+4o2lun3 ol3unt o3lus o4luy 4ol2v ol4va olv3er. olx4 o2ly ol3y3a ol3yc ol3yh
+4o4lyl ol3yp o4l1ys4 2om. o4mab o2mac om3achy o2mada o4madh omad3i o4mah o2mal
+omal2i o4malle o4malo o4many o3mas oma4tik o4maton ombil4 om4bl ombo4r om4bry ombus3
+o2me 4omely om3ena omene4 omen4i ome3no o3meo om3er5a ome4ri om3eriz o3mest o3me4ta
+o4meter o3meth om5e5tris o4metry ome3w o3mia om1ic 4omic. 4omica om3ici o3mid o3mim
+omi4mi om1in om5ina. om3inen omin4ic. 4omins omi4se o4mish o4missa o3mist o3miu o1miz
+om3l omma6to ommut5ab omni4f omno3 o3m4o omo4geni o6mometr o4monas o4monid o4mony o4mopa
+o4mophon omo3th o4mp om3pil omp4l ompress6 ompro3 omp4te om4sh om4ti omy3 omy4t
+omz4 on1 o4n. 4ona. 2onab onabor4 on4ace onactu6 on3age on4agen ona4nat o3nanc
+ona4ne ona4po onapos6 o5narchia o5narchic 4onard onar4i4a. on4asm o3nasti on3b onback4 on3c
+oncer4 on4chat 3oncila 3oncile oncu4m ond4d ond3ent ondur4 ondu5ra o2ne one4ag 4o3neal
+one4at one4gat o3nei o3nemat o3neo on3er 2o4nes o5nesi on3est o4net2 o3neur o4nev
+on3ey on5fl 4o4ng onge2 onger4o on2gi ong5is onglu3 on3go ongrel3 on3h o3n4ia
+o4n3ic on3if on4ife on3ing o1ni1o o3nis. o4n3ish on4iti on3ito o1n4iu on3key onk4i
+onk4s 2on3l on3m onma4tu onmerce4 onn4 onni4e onni2v on3oc ono4ce on4ocu on5oh
+ono2l o4nol. onoma4t on3omis on3omo o4n3omy ono4phy onopo3 onopter4 6onora onos4 o4nost
+onosti4 on3osy on3p4 onpart4i onpre4p onpre6se on3r 4onra onre4fo onre4la ons4 onsa4n
+onsel4 onse4n onsid3 4onsk onspir5at ontag4 onta4l ontam3 ontana4 ont2i onti2e onti4f
+4ontin onti4s ontortu4 on4tros on2u o3nuc o4nume onuti4 o4n3v onva5le on3w 4onymu
+o3nys onza4 2oo2 ood1 ood3i ooe4l oo3ey oo4f oof3i oo3i oo4id ook1
+ook3ie o4ol. oo4lan ooly4 4oom1 oo4n3i oo4pe oop4er' oop3i oo4pl oo4ri. oos3in
+oo3sp oos4t o4ot. ootch4i oot3er oo4ti ooz3i o2p o4p. o3pac 4opaeu op3ag4
+o4pagu o3pai o3pa4l o3pan opar6o o3patho op3athy 3o3pau o3pe3a o3pec o4pec. ope3di
+opeg4 o3pei o3pell o3pen o4peng op1er 3opera oper4a. 4operag opes4t o3pex op4fr
+o1ph oph4e ophe4l opheli4 o3phen o5pher. o5phia o3phie oph5ilis oph3ora o3phori oph3oro
+o3phr 4ophrasi o4piab op3ic o4p3ing o3pini o1pis o3pit opi4th o3piu o3piz o3pl
+3oplec o4p3li4 o4plo 3opme op3oda o4pody opog4e o3poi 4opol. opo4lat op3olis opoly3
+opo5ly. opol5ym o3pom o3pon o4ponis o4pophy o4popy o3por o4posit o4posp o3pou oppe4
+oppress4 o3pr opra4 opress4 4opresso oprin4 o4prod opro6f op3rol ops4 4ops. opse4
+op3si opsi3a o4pt opter4oi opu1 op1ul o1py. o4pylo o1q oqu4 o5qua 4oque.
+o4r. o2ra o3ra. 4orac o4race. o4raceo o3rad ora4da orade4 o4rades o3rae o4rag
+or3age 4orah 4o3rai 4o4rak4 ora4l o4ralist o5r4alit o3ram ora4ma or3ange o3rar o4rar.
+orargy4 o3ras o4rasm orati4 ora4tis ora4tivi o5rav oravi4a. o3rax orber4 or3bi orbi4e
+orbi4f o4rc orca4 or3ches orch4i4er 4orchu 4ord. or4dal ordeli4 or4dit o3re1a orea4l
+o4rear o3rece or3eig ore4lat oreli4a o3rell oremon6 o4rence o3rens o4rent o4renz o3resc
+o3resis or3est. ores4tr o4reth o3retic ore4v 4org. orga6na. 2orge 2orgi or4gis o3rhi
+o2rhy o3ri. 4o3r4ia orib2 o2r1ic 4oric. or4ico o4rid. o4rida ori4dea ori3di o4ridl
+o3rie ori4en. ori4f 4orifa ori5ge o3rigi o1ril o5rill o4r3ing o4rinu o1rio o4rip
+o2ris or3ish orit4e o4rity o3riu or2m or4mater orm4e ormen4 ormini4 orm3is 4ormu
+or4ner orni4a or4n3ie 4orno oro3a o3roc oro3et o4rogl o3roi or4on. oro3n4e oro3ph
+2or4os o3rota orote4 oro4ti or3oug orphy5 orpo3 or3r4 orrob3 o4r2s orsa4l or4sen.
+ors3in orst4 or3ste o4rt ort5ab or5tent ort3er. orth3e or3th4i or4tier. or4tres or4ty.
+o1ru o4r3ul o4rv or3w o1ry ory4da ory4o os2 o4s. os3ab o4sace. os4ad
+os4a4g o4salin o4sam os4an o4sanne os4ar osari4o o3sau2 os4ce o4schi os4ciat o1sco
+o2s3cul os3e3cu 4osek osem4 os4f osgen4 4os4h o5sho os4ie osi4g osil4l o3sim
+osina4 o4si4nan o3sine os3ing os3itiv os3ito o4situ osk4e os3m o3so. o4sod os5om.
+o2sop4 os5ophis os3ophy os4or o4soth 4osov os4pa o3spec osper4mi os3pero ospirit4 os3sa
+os4sai oss3c ossem4 ossil3 ossin4 oss3t osta4l os3tate os4tax oste3a o5stem os4tend.
+os4thy osti4b os3tile ost3m os4tome 4ostomo os4tor os3tu ostu4m os4tut o1s4ty o3su
+o4sue osulphu6 osur3g os3we o1sy4 osymme4 o2syne osyphi4 o4t. ot2a 4otag otam4e
+o2tan otan4i ot5any ota4p o3tar ota5riz o4tasi o3tat o3tax ote2 o1tei o3teli2
+o3ten o4tenl o4tenoi otepa4 o2ter ot3er. ot4er4a oter6ism o3tes o4testa otes4tiv otet4
+oth5ecat oth3er. o4theral o4thou o2ti ot1ic o4tic. ot5icis o3tif o3til o4ting. o3tini
+oti4po o3tist o3tit otiv4is o4t3l oto5f4 o4tog. otoion4 o2tom o5toma ot3o3mis ot3omiz
+ot3omy o5tone otone4g oton4g o4tonus o4topy otor5is o4toro o3tra o2tri o6trophe o5trophi
+o4trophy o4tropo otru4d o4try ot5ryo o4tt 4otte ottra4 otu3b oturi4e o4ty. ot1yl
+oty3le o2u2 4oua oua4c oub4 ou5bl oubt3 ou4ce ouch3i ou4den ou3ette 4ouga
+4ouge oug4h ough4t o4ui ou3is 4oul oul4d ou3m 4oun2 oun4cy ound3i oun4dry
+ounk4 oun4sl oun3ter oun4ti ou4p oupha4 2our our3ag our4an our4c our4de our1i
+our3is our4no. our3ous our4th o4us1 ou4se 4ousia ou4so ous4p ous4to ous4tr out1
+outch2 outre4 4ou3v ou4verne ouw4 o4ux o1v o5vak o3var ovar4y ov4ella o2ven
+ove5na oven4i over3e overgent6 over3i o3v4ers ove4t ovet5o o2vi o3via o3vip o3vis
+o4visa ov4it 3o3viz o4vk 4o3v4o ovol4t o4vr ov4y o2w 2ow. ow5al owa4n
+o3way ow3di owd3l o4w1e owe4l ow3er owg4 ow3i o5witz. 4owo owof4 o4w3r
+ows4a ow3sh ow3y ox3a oxam4 oxa4n oxcom4 oxe3m ox3i 4oxidas ox5im ox4on.
+o4xu ox3y oxyl3a 3oxys 2oy oy1a oy4ad oycot4 oy4da oysi4 o4zal o4zene
+oz2i o3zo1 oz4s 4p's 2p. 1p2a pa4ba pabys4 pa2c pa4ca pa4ce pach4e
+pac3it 4pac4r pac4u 3pae pagan3 page4 pag4n p4agulu pagy4 pah4 p4ai pain2
+pain4t pais4t paja4 pa4k4i pa2l pal4ab pal5an pald4 p4ale palet4 3p4ali pa4lik
+pal3in p4all p4aloi pan4a panc4 pan3el pan4gler pa4nia pa4nic pan5ici pani4o pan4is
+panni4e pan5op pan4ti paot4 3pap pa3pa pa3pe papel4 pa4pet 4paph papi4 3paq
+p4ar. par1a 5paras p5aratio par4chi par4din p4a4re 3paren pa3riet 4parina par3iso 5parit
+4paro pa3roc pa3rol parot4ic p3arou 5parox 4partee 4pasm pas3qui 3pass pat4edl pa5tel
+pa4ters 3path. 3pathic 3pathol 4pa3thy 3p4atic pa4tin pa4toi 3patr patro4 pau2l4 3paus
+3pave pavi4e pa4z 2pb pbel4 p4ble 4pbr 2p1c pcervi4 2pd 1pe2 4pe.
+4peab pe4ak 3pean pear4l pe4ba. pecas4 4pecha pe3cie pecti4v 2p4ed 4ped. pe4dar
+peda4t pe4date 3pede pedes3t 3pedi pe4di. ped3im pe4dio pe5dol 4pee4d pe3f pefoun4
+peg4i 4peha pei2 3pe3ia peip4 peir4 pek4 peki4 4pelet 4pelik pelli4e pe4lo
+pel4ter pel4tr pe4nan p4enc4 pend3e pe3nia pen4ic pen4is pen3i3t p4enn 5penny pens4e
+pentar4i pen4tho pe3nu 3pep pe4pe pep4i pep3s per3a p4era. 4peralta 4perand percen4
+pere4t 3per3g 3peri pe3rial per3ic per3ig per3il per3im per3in per3ios3 periot4 per3it
+4perl. perlu6n p4erm per4mism per3n pernatu6 6persedel 4persedy persh4 pe3rus per3v p2es
+pes4car pes4th pes3ti p4et 3pet. 3petalo pe3ten pe4tio pet5iola pe3tra pe4tra. pet4rog.
+pe4try 3peu peu3t 4pev 2pex3 3pexi 2pf pfal4 2pg 4ph. pha4co phag2
+3phage. 3phagia phak4 5phalia 3phalic ph5a5lis ph3alit 3phant 4phantu 3p4har phare4 4phareu
+phar3is 4phars 3phas 3phat 4phe. 4phea 4phed phe2dr 4phelio 3phem 4phep 4pheret
+ph4es 4phese 3phet 4phet. 4phets 4phial phi4b phi4di 3phil. 3phile 3philia 3philic
+phi3lis ph5ilism phi4ma phi4n ph5iol 3phis 4phiste 4phistop 4phis4tr phi3th 3phiz phl4
+phle4 4phli 5phloe 1pho 3phob 4phobl 4phobo ph5omo 3phon phon4e 4pho3n4o ph5onou
+4phony 3phore 4phori. 3phoria 3phoric 4phorn 3phos 3pho3t4 4photy 4phox 3phra 4phrasi
+3phre ph3ro3d phros4 ph3t phu3i phu4ra 3phus 3phy phyc4 4phyg phy3la phy3le
+phyl4i 4phyly phyr4 phyro4 4physa 4physis 4physit 4phytou p2i 3pia pi4ag pia4n4
+4pianu p3ic. pi6cable pi4ceo p4ici pi4cie pi4cil p4icl picom4 p4i4cr pi4cy. pid4e
+pi3der pid4io 3p4idit p4idol p4idur 3p4ie4c pi1en p4ieno pier4 pi1es pi4ete pi3ez
+pif4 pi4fl pi3geo p3iglo pigni4 p3igram p4ii p4ik p6ilatory pi4lik pil3ing pi3lo
+pi4mol pinc4 pin3d4 pin4ery pi4net p4ini 3pinio pink3 pi3no p4int pin4ta. 3pi3o
+4pioc pi4ole pion4a 4piony p4i2p pi4pag pi4ped pi4perin pi4phor pip3i pipis4 piq4
+p4ir pir3ic piri4ti pir4y 2pis p4is. 3pisc piscar4 4piscope pis4p pistem4 pis3th
+3pisti pis4tr pi5tab pi4te pit2er pi4tl pi4to 3pit3om 4pitomic pi5tou pit4r pittel4
+3pitu pi4ty pi4v piza4 p3izo 2p1k 1p2l2 2pl. 3p4la2 pla4co 4placu 4plad
+pla3g planc4e 4pland plan5et 4planos 4plap plar4 plas3te 4plasy plat3in plau3s 5ple.
+ple4a4 p4lec 3pled plee4 3ple3g2 ple4ga plenar4 4plene. p4lent pleo4c ple4ri 4ples
+plev3 4plev. 3plex 4pley pl4i 3p4lie 4plig 4plik pli4nan 4plit 4plj plo4d
+4plof 4plog 4plol plum4be plu2mi plur4 ply4m 2p1m 2p1n p2neu 4pno 1p2o2
+poad4 po4cer pochlo6 4pocri pocrin6 3pod. 4po3da4 4podes po3di 3podia 5podic. 4podis
+5podiu 4po3do po4dos po4dot po3dy 4pody. podyna4 3poe po4e. poe5i poendo6 po3e4t1
+poet3i po3ge poge4ny po3gl pohepa4 po4i 3poi3e poi3k poin4t po3ken pok4ier 3p4ol.
+po3la po4lam pold4 po4les 4poli. polian4 4polis polit2 3polita p3o3liz poll4 pollin4
+4pologa 4pologia 4pologu po5loni po4l3y poly3s 3pomo po6mology pomp4 pon4ac pond3en po3nen
+pon4g 3poni po4nia 4ponin. 4ponist 4ponite ponti4 4pony 4popau po4phy 4pophyt pop4l
+popla4 p3ople poploi4 pop1u 4popy. po3r4a po4rade 4poree po4res p4ori po4rif po5rife
+por4it por5ten 4porto por4tre por4ty 3pos pos3a pos5edl 4posem pos3in 4posio pos3it.
+4posph pos3s pos5tasi pos4th 4postol pos4tom 3pota 4potace po3te poth5eca 3potheo poth5es
+3poti poti4e po4tor potri4 poun4d3 3pour 4pousl po4ve po4w3 pow4n pox4a 2p1p2
+p4p' 4pp. 4ppa ppal4 ppara4t ppar3e 4ppe ppeli4 ppend6ant ppe4s p4pes. ppet4i
+ppe4tr pph4 4p3p4i 4pp4l 4ppo ppo4d ppoin4 ppo5site 4ppr ppro4c 4ppu p4pv
+1pr2 4pr. prac3 4prae prai4 pral4 pra4ni praorbi4 4prava 4praw pre1 prec4
+3preci pre5co pre3e pre4ene pre4fac pre3i pre2j prel4 pre3le prem4 pre4mis pre3p
+pre4p. preph4 pre4posi pres4o 3press pres4sag pres4u pre3t4r p4ri. pri4b 4prico pri4cy
+pri2e pri4es 2prima p5riman4 prin2 pring3 prin6kler pri4nod prin4t pri4s pris3o pri4val
+4privat pri4z pro4bl prob5le p4roci 4prodo pro3e pro3i pro6ject. pro3l2 prola4m prolo2
+prolo6gis promp4 pro5no pro4pis propu4 pro1r pro4sp pross4i pro5sto pro1t prov5al provo4
+4prox. pru4c prun4 pru3r 2ps2 4p4s. ps3ab p4sal4m psa4m p4sb ps4est p1sh
+p2sib psi4f psi2n ps3ing 4p1s4t p4sv p1sy. 3psyc 2p1t 4p4t. p2tan pt3ana
+ptas4 p5tat 4pte pt3ed pt2er pter6ol pter4om p3t2i p4tib pti4f pti1m p4tin
+pt3ing pt4is ptiv6ism 4ptl pto4mato p4tru p3tu ptur3a pt4y 1pu pu3a 4pub.
+pu3be pub3l pue4 pueri4 puf4 pu4ga pu3gi pugli4 pu4gr pu5iss p1ula pulei4
+p4uli. 4puma pu2mi p4un2 pu4n3is 5punt pupi4 puppe4 pu1ra pu4ram puran4 pur3c
+pu1ri 4purim pu4rism pu4rist. puri3t puru3 3pus pu4sio pus3t 3put. 3pute pu4to
+4pv. p4va 4pvi 2p1w py4al p4ye py3el pyg4ia. 4pyla 4pylit py1o py4s
+pyxi4 2q. 4qaz qi4b 4qq. q4to qu2 2quab q3uabl 4qua3m 3quatic qua3v
+4que. 4quelic 3queo 4querr 3ques ques4s 3quet. qu4h qui3a 4quiem q4uin 3quin.
+quinar4y 3quip 4quipa 6quipoise q2uis qui4sa 2quita quiv1 4quiv. qui4ve 4quivok 4quivoq
+qu4o2 q4wa r2' 4r's 2r. r2a. 2rab raba4r rab4be. ra4bidi ra4bis ra3b4u
+r4ac. ra4ca. r4acar racas4s ra3che ra3chi ra4chide 5rachn r3achu r2aci rac3ic 4racid.
+4racki 4racl 4racot r4act2a rac4tan r2ad ra4dan radapt4 ra1di r4adic ra3dis r4adism
+rado4 4rador ra3dr ra4dul 4rady3 r4afe r4agino 4ragon ra3g4r ragra4 ra4gro r4ah.
+4rainer ra3ist r4ak ra5k4l 2ral rala4z r4alite r4allu ra4l3og r4a4lu r4alys r4amba
+ram5bl ramel3i 4ramer r4a4mete r2ami 5ramida r3a3midi 6ramini 4ramis ra4mit r4amu ran2
+ranar4y r4and ran3di ran4dies ran4din 4randr ran4ge rang5eri ran4gui r4a3nia ran4if ra3nio
+rani4to ran3n 3rannic r3anniz ranopi4 rans3el ran4sur ran4tr ran3ty ran1u ra4ny 3raphe
+4raphed 4raphes 3raphis 3r4aphy ra3pis r4apn 4rapody r4apsi 4rapte rap5ul ra3py r4ara
+4rarc rar4chat rar6chist rar3ef 4rarg r4ariu 4rarl r2as. ra4sal rasca4 r4ased ra3seo
+ra3si 4r4asia r4asin ras4p ras4sie 6rasticho r4as4u rat4en4 rat4er3 ra4tid ra4tin. ra4tivis
+r4atiz 2rato ra4toc 4ratom r4atus raud3u raugh4 raus4 raux4 rave2 rav3el ra4ver
+rav3er. raver4sa ravet4 rav3it rawa4k rax3 r4axe 4raxel ra5zen razi4 4razzi rb2
+r4b. 4rba rb3ab rbal3a rbar2 rbarba4 r3bea rbe2l rbel3iz rbe4ri rber4n r4bes
+r3bic r4bicide rbicy4 r3bid rbi4fi r2bing rb3ing. rbit4 r4bles rb5less. r4bn r3b4o
+rbo3liz rbo4rac rbo6real. rbrat4 r3bu rbulk4y rbu3ri rbut4t 2r1c2 r4c. r3ca rca4b
+r4canto rcap3i rcat6as r4cea r4ced r5cede r3cel rcelo4 r4cem rcen4ta rcep4te r3cera
+rcer4eb r4cest r4cf 4r2ch2 r3cha r4ch3er. rcher4o r3chest r3chet r3chi rchid4 rch3m
+r3cho r3ci r5cib rci3c r4ck rcle4 r3co r4cog rcollec4 rcor4i rcor4n4 r4cq
+r4c3t rc4te r3c4u rcu2m3 rcuti4 2rd r4d' r4d. r4dal. r5dam r2dan rd4ancy
+rde2c rdec3o3 r3del rdeli4a rdel4li rde4mo rdeni4 rdepend6a rder4or r1di r3dia rdi4en
+r3dio rd3ise r4d3ism rdit4e r3diu rdi4vo rd3iz rdli4l r4dm r4dn r4dop rdo4sa
+rdo5ta r4ds r3d4u r2e 4r4e. 4reab re3add re3adm 4re3ado re1al 3reali re1an
+4rearm reas3i re4ast reast6e reas5y rea4th r6ebrate. rebu4 recas4 re3co4r re2cre rec3rea
+1rect 4rectc 4rectd 4rectex rec6trix. re4cus4 2r4ed 4red. red2e rede4m re2dic red3ica
+re4dit 4reditam re2dol redoni4 4reem re5endo ref4 ref5era ref5f refu2 4reful re6fuse.
+4reg. reg3im regis3 reg4l reg5n 4rego re4gol re4gory re1i2 rein3a re4ist. reit4er.
+rek4 re4lati re5latin re5latio re3lea re5len4 4relet re4ley rel3ish re4lude re6ludin 4rely.
+re3mat r4emen re4mene re5mic remi4e re4mif 4remous r3emp r4en' r4en. 3rena. 4renai
+re4nar renatu4 r4enb r4ene ren4eq 4renes r4eni re4nif r4eno ren3ov r4ens ren4tag
+r4ente 5renthes ren4tist 4renz. re3o reo4e 2reot reo4tr re3pa repen4 rep3it 4replei
+reposito6 rep5roba re3quit rer4 r3er. rerat4e r4ere rerec3o reren4 r4eri r4eroo res5ag
+resar4i resel4 4resh r4esi res4im resin3 res4m re3spe res4see ress3ib res6so. res4to
+re5stric res4try re3ta re5tabu retal3 3retar re3tel re5tem re3ten ret4er re4ters re3th
+4rethy re4tic. ret2r re3tra ret3ro re3tu re3u2p 4reux re1v rev3ale revic2 rex3
+rexa4 r3exe r3ext re4za 2rf2 r4fab r4fer. rfer4ent r4fie rfi4l rflo4 rfo3ra
+rfu2 r4fv r4fy 2r1g2 4r4g. r3g4a r4gab r4gag4 rgans4 rga4s r2ge2 rge3m
+r3gen r3geo r3gery r3get rgia4 rg4im r2gi2n rg3ing rgini4 rg4l rglar4y r4gn
+r3go rgon3is rgon3iz rgo4p rgo4t r4gret r4gual rguer4 r4gues rgu4mi 4rh. rha4b
+rhag4o rhas4 rhe3al rhel4 rhen4ic rhepa4 rhe4um rh4i 4rhil rhi3z rhod4 rhon4i
+rhu4me rhumer4 rhy2 rhya4 2rhyd r4hym 3rhyt 1r4i. ria4ch 4riad ria4da ri2ag
+3riah 1rial 4rialisa 4rialla ri3a4m riam4e ri3an rian4it ri4ano ri3ar 4riat. 2riatr
+2riba rib3al ri4bel ribe4r rib3er. rib3i r4ibo ribra4 r4ib2u r4icc ricente4 ri4chi
+2rici ricid5a 4riciu ri4cles r4i4clo ri4coc r4icol ri6com r4icop ri4cy. 4ridae ri4dean
+r3i3dec 3r4idic 3ridio 4r4idiu ri4doph r4i4ed rie4f ri3e4l ri1en 3rienc 4rientee ri3er
+ries4 3rietal 2riev 4r4ifican ri5fy ri2g rigen4t rig3er righ4 rigi4l 3rigin 4rigin.
+ri3gl ri3i ri3ka ril2 4ril. ri1li riliter6 riliza6b ril6let. rilli2 rilli4u 4rillo4
+ri4lo. ri3loc r4ima. 5riman4d r4imin rim6inan rim3it r4in. r2i3na r4inch rindi4a rin4dy
+rin4e rine4p ring5hal 4ringn rin4io rin6kler. r4in4o ri4nodo ri4nou rint5er. r4inth rin4ti
+4rinus ri3o2 r4iola. r6iolate r4ion. rion4is r4ior 4riosov rio4t1 riot3o ri2p ripho4
+riphthon6 ri4phy riple6g rip5lica ri4pol4 ri4pur ri3q r3irr ris4c 4risch ris5en 4risiu
+5risiv riso4p ris4p 4risp. r4iss r2ist rister4 risti4ch ri2t ri3tal 4rites ri5tes.
+ri4tiat rit3ic ri4tist r4itos rit4s ritur4 rit4y r4iup r4i2v ri3val riv5ativ riv3el
+riven4 riv3er riv3et 4rix riy4 2riz ri4ze riz4zer r4ji 2r2k r4k. rka4n
+r5kat rk1er r3ket r3kin. r5kins 4rkp rkpa4 rkt4 r1l2 r4l. rlan4di rlan4t
+rlas4 r3le r4le. r4led r4ler r4lest r4leto rle4tr r4levi r4leye r4leyv 4rli
+rl4in rl3ish r4lk4 r3lo rlunar4 rlus4 r1m r4m. 4rma rm3ab rmace4 r4maes
+r4mald r4malg r4mallo r3man. rmaph3 r4mater. rma6toc rma4tog rma4top rm5atory rme3at rme3c
+rm5edl rme4la r3men r2mer r4mest rm4et rm3h 4rmi r3m2ic r3mid2 r2ming rmini4f
+rm4i4p rmi4tia rm4iv rm3l r4mn r3mo rmoe3 rmo4rie r3mu r5myl rmyster4 r4n.
+r1na r4nabl rna4cl r3nad rna4l rnal4li r4nanc r4naro rnar6y rnat3u r3nau rnau4t
+4rne r3nea r4nee rne4g r3ne4l rneli4 r2ner r4n3er. r4nesb r3nest r3net r3ney
+4rnh r1ni r3nia r2n3ib r3nic r4nies r2n3in rn4io rn3ist r3n4it r4nite r2niz
+r4nk r1no rnop4 r4nove rnt4 r1n2u r4nup r2ny ro3al r4oan ro4an. roar3
+rob3ab r4obe. ro4bile ro4bin rob5ing 4robiu ro3bl r6obla ro4ble rob5lem rob3or roc4e
+roce4l ro4chos r2oci rocio4 4rocit ro1cr rocre3 r2od ro4dan roden4 r4odi ro3dis
+3rodit r4oed roe3l 6roetha rof3f ro5fil roge4a rogen3i ro4geu rog4i 4roglu r4ogy
+ro1ic 3roica roi5der rok4e rola4mi 4roles ro1li4 rollo4 ro3ly ro5lyse r4ome. ro3mel
+rom2i romi4na romonta4 rom4p romp4t ron2 ro1na ro3nau rone4g ron4em ron4er r3one4t3
+ron4gr r2oni ron4ism ro3nist ron4ten r4onti r4oo rook4s 3room. roo4n ro4o4t 3root.
+r4opae ro5par roparie4 ro3pel 4ropia ro5pin. ro3pis ro3po 5ropolita ro4posi 3ropous r4ops
+4ropsi ro3py 4roq ro5rati rorato4 rore4b 4rors r2os ros4a ro4san. ro4sann ro1sc
+ro5shi rosi4e ro4sot ros3per ros4s ros4te ro4sy. r2ot rotam4 rote4l rot4er4 5roteri
+4rotesi rotes4ti ro4thes ro4tic rot3id4 4ro3tis ro4tonu rot3s rot4tag roturi4 rot4y4 ro4u
+rou3b r4ousi 4rouss. rous4t ro2v rov5al. rov3el rov5en. ro4vo4c rox3 4rox. 4roxi
+ro3zen rozi4 2r1p2 rpass6i r3pedo rpentar4 r4per. rpe4ti rph2 rphy5r rp4i r2p3ing
+rp5ing. rp4l rpla4s rploi4 r4pn rpo3r rpo4ri rpo4s rpos4t rpre4te rpri4e rpro4m
+rp4s rp3t2 rpu4ris r1q rqu4 rques4 2r1r2 r4r. 4r3r4a rr4e rre4co rrec4tit
+rre4for rre4fu rre4i r2reo rre4pa rresol6 rre4th rrev3o rrh4 rrhe3a rrhon4 r3ri
+rri2a rric3u rri4en rri4o rris4te rritual6 r4rk r4rm r4rn r3ro rrob3o rro4da
+rrog4 rro4l rrol4l rron4 rror3i r4rs r3ru rrubi4 rru3g rru4p rrur4 r4rv
+r3ry 2r1s2 4r4s. rs3ab r3sal rsal4t rsar4ia. rs3b rs4c rs3d 4r2se r3se4a
+r3sec rse3cu rsel4 r3sen rse4no rse4ph rser4 rs4es. rse4u r3se3v rsever6at r3sey
+r3sh r4shie r4shy r2sib r3sic4 rsica4 rs3ing rsis4 rsist6 r3s4it r2sk4 r3ski
+r3so2 rson3at rspo4 4rs4t rst4e r3su rsu5an rsuggest6 rs3v 2rt 4r4t. 4rta
+rt5abi r4tage. r3tar rtar3i r4tase r3tat 4r2te r3tea r3teb r4ted r3tee r3te4l
+r3tem r3tere r3teri r3terl r3tes4 r3tex r4tf rth4a r4thei rth4erly rth2i rth4in
+rtho4gr r4thors rthusi4 r3thy rt1ib r3tic r4ties r3tif rtil2 rti3lis r4tily r4tines
+r4ting r3tins rt4inv r4tipl r4tism r4tist. r4tistr r3tit rt4j r4tles rt5let r4tly
+r3to r4toma r4topl rto4te r4tress r4troo r4ts rt4sho r3tu rtub4 rtur4be r3twi
+rtyr3i r2u2 ru3a ruant4 ru3be ru3bi ru3ci ru4cin ru3e2l rue4li ru3en r4ug
+ru3ga ru3id ru3in r4uk ru3ma rum4bi rum5bl ru3me ru3mi 4rumn rum4ph run4e
+run4s run4t ru3o rup2 3rupt ru3ra rur4e ru3ri r4us rushing6 3rusp ru3ta
+rut5is 4rutz r1v r4v. rva4d rvato6ry r2ve rv4el r3ven rven3i r3ves rves4t
+r3vet r3vey 4rvi r5vi5en r4vies r3vil r3vin. rvi4p rvisi4 rviso6 rvis4u 4rvy
+r1w r4w. 4r3wa rwet4l r3wi 4rxe rx4y ry1a rya4t ry4di r2y2g ryg3i3
+4rylas ryllo4 ry4loc ry4lyl ry3ne 5rynga r5ynx ry1o ryopi4 ry2p ry4ph rys4e
+rys4i ry4so rys4ton ry3te rytel4 ryth4i 3rythro 6rythrops rz2 4rzu 2s. 1sa
+3s4a. 2s1ab sa4bat sab4o 3sacch sa3che sa4cl s4acr sa3cral sacros4 s3act s4adda
+s4ade sa4dom s4age sa4gi sag4n s4ah4 saha4 3sai sail3 4saim 4saise 3s4ak
+sa4lar sal4at s4a4le sal4id sa3lie s4alin sali6na. 4salind sa3line sal4ish sal3iv 4salmi
+sal4mon. salti4e sal4ty sa3ma sambi4 sa4men 4sami sa4mo sa4my. 3s4an. sa4n5at 3sanc
+3sand san4di san4dy san4gl sanhe4 san4in san3it 4sanite san4tr sa4n4u s4aph sap4i
+sa3pie s4ar. sar4a sar4ce sard4 4sarea. sar4gu sar4iae sar4ios 4sarm sa3ro sar2y
+s4as. sa4si sas3s4 3s2at sa3ta sa4tir 4satl satra4 sat1u 3saur s4ava sava4g
+sa4vel sa4v3i2 sa3vo4 4savu 5saw. 3say 2sb s4b. s3ba sban4 s3be sbehav6
+sb4j s3bo sbor3o 4s3bu s2c2 4s4c. sc4a scag4 scal4d sca5len sca4lig sca4ly
+scan4t sca4p sca4r scar3ab scar4c scar2f scar4p scas4 s1ce s4ced s4cene s4cen4i
+scerp5 scet3 sch4 2sch. s4cha. s4chal s4che s5cheat schil5l s4cho s3cib scic4ulu
+s4cio. s4cion sci3p4 s4cist scit4 sci5ta sc4l4 scle1 scler4 4scly 4sco. scocar4
+scof4 4scog sco4le 4scom 1scop 3scope 3scopic 4scopis 4sco3py s4coto scov3e sc4r
+scra4 scro4 4scrys 2scue 2s3cula scu4riu scu4ru 2s1d s4d. s3da s2e 4s4e.
+3se2a. sead4 seak4 sear4 seas4 3seat se4aw secer4 se3cl se2co secon4 3sect
+sec3ul se4cy 2se2d s4ed. sed3en sedil4 sed3im s3edn 3s4ee 2sef4 sefa4 s4e2g
+seg4n seg1r 2seh se4hen 3se2i 4seik sek4 3sel. se4la. se4lagi s3eleme selemen4
+selen4 4seles se5leu 3s4elf sel4ic seli4e 4seline 1sell 5selle. 4sellen 2sely4 sem1
+sem4a semain4 semal4 se3man se5mati sem5b 3sembl 2sem4e semer4 3sem3i3 se4mi. sem4ic.
+semi5p semis4 semit4is sem4m sem4or 1sen senar4y sen5ato 2senc 4sene sen4h 3s4eni
+sen6ic. 3seno se4nol se4nou 3sens sen4ti. 4sentis 4sents s4e2p sep3a se4pal sepa3r
+se4pho sepho4r 3sept se3q ser2 2s3er. sera4d se5raphic ser3at s4erd ser4e 3s4eri
+se3ria ser3ic 3s4erl sermon3 se3rol 4ser3p s4err s4ers 1sert 4sertico 4sertl s4e5ru4
+3serv 5servab 4servas serv3er 4ser3vo 2ses s3es. se4sa s4esc ses4o ses3q 3sess
+s3est. 3s4et 4seta 4seterr seti4 4seto 4se4tr s4eu 3seur 3seus 3seve sev3en
+sevi4 4sewo 3s4ex 4sexp 1sey 2sf2 s4f. s3fe sfea3 s3fi2 s3fo 2s1g2
+4sga s3gr s2h 4s4h. 3sha. 3shad shad5i shad3o sha4ga sha4ko sh4al sha4man.
+sh4ap shar2 sharmo3 sharmon4 sharp3 4s4hc sh4chi shdraw4 shea4 4shead s4hed sheel4
+4shei s5heim shel4li 4shen shep3 4sh3es 5shev3e she3vi s4hf s4hi 3shi. shic4
+4sh3ier 4shies shim4i 4sh3ines sh4ino sh3i2o 3shi4p 1shir s4hk 4sh1l 4shm shmi4
+4shn4 1sho2 sh4od 4shol shoot3 sho4p sho4r 4shors short3 s4hp s4hr shriv4er
+4s4ht 5shug 4shum 4s4hw s4hy shys4 1si 3s4i. 3si2a2 s4ia. si3ac s4iaca
+4siad s4ian3 si3b siber4 si3ca 2sicc s4ich sicil4 sicili4 sico4t 3sicu sic3ul
+si2d 3side. si4dec sidel4 side4n s3ident sid3er 3sidera s2ie 3s4ie. sie4n si4era
+2si1es 4sies. siev4e si3f si4fe siga4 3sigh 3signal 3signed 5signi 4sih siha4
+s4ij sik4i 3sil. si3la 4silar sil4e siler4 si2li sili4ciu sil3i4e 4silin. 4silisc
+4silisk sil3iz 4sillu sil4ty 2si5ly s2im 2sima s4imac s3imal sime4ne sim4ply 2s1in
+3sin. 3sina sina4m 4si4nant 4sind 3sine. 4sing s3ing. sin4gan s4ingh sin3gle s3ingly
+s4ingst s4ingt s4ini sin3if sin4in sini4s sin4it s4inn si4nou 4sins sin4th 4sinth.
+sinus5 3sio2 4siod sio3p 4sioru 3sip si4pr s4i2r sir3ou 3s2is sis4a 4sish
+sis4p sist3en 4sisth 2s2it si3ta si4tab 3sitio si5to sito4rie sit4s 3situ 4situs
+s3ity s4iu 3siv siv3i si2z s2k 2s4k. s4kala ske4 4skee skel3e sk4et
+s4kil ski4r s4kl sk4v sky3 sl2 s4l. sla2 slam3 slan4t s4laug 3s2lav
+slav3er s4le. slen3 4s3let 2sley sli2 3s4lip sli4v sl4l 2slo 2slu2 s3luc
+2sm2 s4m. sma2 sma3g s3man sman4n smel4 s3mer s1mic smi4no s3mis smis4sa
+3smith smo2 s4mo4k smold4 s4moo smo4t smoth3 smu2 4smui smut3ab s4my sn2
+4s4n. s4nal sna4p snatu4 s1ne sne4f snel4 s4ni4 snif2 snive4 snoo4 s4nou
+1so soa4 so3b 4soc. 4socc 4socea 2so2ch so3ci soci3o 4soct 4socu sodro4
+3soe soer4 soev3 s2o2g sogam6e 3soh 4sois sol2 3sol. solal4 so3lat 6solativ
+so4lato sold4 sol3di so2li so3lic sol5id. so3lil 4soliti s4olo s4o6lutiv so4luto 3solv
+3so2m so3ma s4ome. s4omel s4omen som4i 3s2on so3nan son4ar sond4a soni4e 4sonm
+sonni4 so2no soo4t so4ped soper4 s4opha so4phe 3sophic so6phism s3ophiz sop4i so4po
+sor2 sor4b sor3c 4sorci sor3d 4soret 4sorg4 so1ri so6riate 4sorit s4orn sor4ta
+3sory 3sos sosi4 4sosm 4so3t4er soter6is soth4i sot4s sout4 south3 4sova so2ve
+sover3 so3vi 4sowen 2sox s2p 4s4p. spal4l spa4ni span5ic spar3en spato4 spavi4
+s4pb sp4e 3s4pea s4pec3u s4ped s4pee4 spel4l spen4g spens4 4speo spe4r 3s4perm
+sper4min sper4mis sper4on s3perou s6persede sph4 s3pha s4phe s5phem sphen4 spher4o s3pho
+s4pi. sp4ic spi4cy 4spid spi3de s4pie 4spiec 4spier spi4f s4pil2 spi4li s4pin
+sp3ing spion4 s4pis s4pli s4ply s4pn s4pom s4pon spon2d 3spons spoo4 1spor
+4spora. 3spori 4sporou spor4tie spro4c spu2 s4pum sput3ab s4py s4q. s3quer squin4
+squit4 2s1r s4r. s4ram sre4c sre2p s4ri. s4ro. sro4b sr4t 2ss s4s.
+s4sab s4sais s3sal s3san ssap4 ssar4t s4sc ssect4ib s1sel s3semb ssem4ic s1ses
+ssev3 s2s3ho ss2i ssi4a s2sibl ssico4 ss4id s2sie ss3ies ssil3i ss3ingl s3sini
+ssir4 s3s4it ssi4us s4s3l ssman4 s4s1n s3so sso4le sso3na ssoni4 sso6riat ssor4t
+sso4ru s4sov sspel4 s4spo4 s3su ss3w ssy4r5 s2t 4s4t. st2a2 s4tad staffi4
+4stag. stame4 s4tan. stand3 s4tani sta4p staph3 s4tas. s4tasia 3s4tat. 3s4tatic stat3u
+4staur s4taxi st3c ste2 4ste. 3stead ste3at s4ted s4te4g s4teles stel4ic st3ence
+sten3i s3tenin ste4no sten3ot ster4na. stern5iz s4terr 4stet. stew5a 2s4tf 2s1th s4tha
+s3the s4thea s4them s4thex sth4i sth4l stho4l stholi4 s4thou s4thyo stia4 s4tib
+s3tic s5tica 3stick 2s3tid s4tie stif4 s3tifi s3tify sti4g3i 5stigmi s4tih s3tima
+3s4timu sti3na s4ting st3ing. s3tini s4tipu 3s4tir s3tis s4tisp 4stl s3tled s4tli
+4s4tm stmen4t s4tn4 4sto. stoba4 4stoe s4tof s4togn stoi4a s4tok stol4e stom3ar
+3s4tome. 4stomo s3tomy st4on 4ston. 3stone 4stonp sto4pi sto2r s5tor. sto3ral 4storat
+s4torb storbi4 s4tord s4tore s4torg s4torm s4toss s4tota stot4in 2stow s4tp st6pra
+st2r 4str. stra4l5ia strep3 s4tride s4trol. s4trop. 4stro5phe strot4 stroth4 3stroy 3struc
+st1s4 stti4 s4tu2d s3tul s3tuo s4tup s4tur. stur2b 4sture 4s4tw 4stya 3s4tyl
+styl4ic s4tyr 1su2 s4u. su3ab su3al su5ant su4b3 succi4na 3sud sudo4 suf3
+sug3ar su5ic su3in sui4t3 3s4ul sul4te 4sulto 3sum sumer4 sun4a sunam4 suni4t
+4suno s4u3o su3p su4per. supra3 4surani su3rat sur4d 4sureth sur4gy sur3v s2us3
+3s4us. sus4a 4sush sus4i sus4y 4suter sut4s 4suy su3z 2s1v s4v. s4var
+svel4 4s3vi svil4 s4viz s4vp s2w2 s4w. swam4p sw4e sweat3 s4wee swel4
+swell3i 3swer 4s5wic swiv3 2swo sy2b syb5a5 sy4bi 3s4yl syl3l syl4p 1sym
+sym4i 3symm sy4mond 1sy2n3 4syn. syph3i syr2 sy4ro 3sy4s3 s2z 4sz. s4z4a
+sz4i 4szk 4t's 2t. 1ta 3t4a. 4taa 2tab t4abas ta4ber tabi4a tab3li
+5tab5olis tab3u 3taceo tachi4 tach3yp 4tacid ta5cis tac3it ta3cl 4tacol 4tacon t4ad
+ta4dl 3tae1 4taeb tae3r2 6taerist taf4fer taf4fr ta2g tage2 t4agn tago3n4 t4ah
+3tah. 3tai. 3tail tai5lor 4tainers 4tainf talem4 ta4len ta4lic 4talie ta4ling. ta3lini
+taliv4 tal4k 4talkal tal6lan t2alli t4alloc t4allot talo4g t4alp 4taly. t4ameris tam4ie
+ta4mis4 4tamm t2an t3anal tanan4 ta4nat 2tanc tan4ce tan2d tand3a ta4nes t4ang
+tan4gui 4tani. 3tan5ic tani4e ta4nin tan4iz ta4nom ta4nou 4tansc 4tansi tan4tan. 2tap
+ta4pa t4ape t4aph. ta4pi t4app t2a2r2 t4ar. ta4ran taran4ti 4tarct 3t4ar4d tar3g
+targu4 3tari tar3ie tar4is. tar4ism tar4ius tark4i tar3n tar4te 4tarth tarvel4 3tary
+4taryt 3t4as. tas4c 3tasm tassem4 tas4sie tas4t t2asta 3tastas 4tasth ta3sy ta5tar
+t4ath ta4the t4ati 4tatica 3tatiz ta4toc ta4tol ta4tos 4tatrop tat4ta ta4tu 4tatun
+4tauc tau4m tavan4 tave4s tawa4 taw5n4 tax3 taxim4 tazo4l 2tb2 4tb. t4bili
+tb4l t3bu 2tc tcau4 t3ce 4tch1 tche4 tch3eri tchet4ti tch3i t4chl t4cho
+tc4i tci4t t1cr 2t1d2 tdev4 4t4e. 3teac teach3 3te1an 4teat te3ato 3teau
+3tebr 1tec te4can te3ce te3chi 3techn t3e3chu 4te4col 3tect 2t1ed tee4l tee3pl
+t4eer. tefi4 teg2 te3gi 3tegic teg4n t3egor te4gri teg3um teher4 te2i tei4n
+te4k t2el 3tel. 3teleg tel3eo 3telep teler4 4teless tel3ev teli4e tel4lab 3telle
+4tello. tel4o 4tely. te2m t4ema 4temen 3tem3iz temp4 tempt3i 4tenac. 3tenan ten3ant
+t3enat t4enci 3tend ten4d3a 3tene. 4tenes te4ni te5nia ten3in te4no. te4n4or 3tens4
+4tens. 5tensi ten4tag ten4tee 3tenti ten4tie t4enu ten3ur 4tenus 4teny 3te3o teob4
+4teocr teo4r1 teorbi4 tep4i te4pl 1ter ter5an 3terb 3terc terci4 t4e4re ter5ec
+3tered ter4enti ter3est tere4v 3ter5f 4teri. 3te3ria 5terie. ter5ine t4ering 3te3rio ter4is.
+ter3ist 3te3riu 4terj. 4terjum t2erl 3t4erm ter4mor 5ternity ter3o teroge6no ter4oma tero2s
+ter4os. 3terp t4erpe 3terr 3ters ter3t terte4 3ter3v tervar4i 1t4es 3tesc te2si
+tes3im tes4o 3tesq 4tess. test3ab tes5tam 4testan tes3tat 4testr tes5tu 4tesv te4th
+3teti 4teto tet1r 3teu2 teuc4 teur3i teu3t te3ve tev4i tewom4 3tex. texam4
+texami4 2tf2 tfal4 4t3fu 2t1g2 4tg. 4t3ga 4t3ge2 tgen3 tgeni4a t2h 4th.
+5thaemi tha4lat thal5m tha4lo tha3no thar3g 5thargic 5thart thatch4e 4thau thaz4 4thead
+th3eas theat4e 3theci 4theg 3the1i 4theid 4thelb the3m 4the4mo 1then 3theni the4ol.
+4thep 3thera 5there. 3therea 4thereg th3erf 3theria th3erin 3therm th3ern th3ery th4es
+the4sh thes3p 3thet 4theta thet4e 4thetec th3e3ter 4theth 4theto 4thet4y 3theu 4thexa
+th4ey 2thf 4thh 3thiaz 4thica 4thina thin2g 3think 3thi3o thion4 thiop4 3this
+4thisc 3thiz 2th3l 4thm thn4 1tho 3thodic 4thof tho4la 4thole tholi4a thol4ic.
+5tholica 5tholicis 5tholiciz 5thologis 5thology thon2 4t3hoo th3opo 4thore thor3o 4thorse tho2t
+4thour 4thouse 4thov 1thr thral4l thre4 thren4 4throd. thro4n thron3i 4ths 1thu
+4thum4 3thus thy4b th1yl3 3thyo 3thyro th2ys 1ti 3ti. 3t4i2a 4tiam. tia4r
+ti3ari 2ti3b tib5ia ti4bit ti4biu 4t1ibl 2tic t4icac ti4cas tich3i 3ticia ti4cil
+3ticit 4tick 3ticl 3tico 4ticoen 4tict 3tic3u 4ticuf 4ticut tid2 4tidae ti2dal
+3tide. ti3ego 3tien tier4i ti1es 4ties. ti3f 3tif. 3ti4fe tif4f tight4y 3t4i2gi
+tig3i5a 4tigm t4igr 3tigu ti4j 3tik tik4e 4tilb 3tilen 3til2i 4tilik til6ise.
+tilit4 tili4tu til6ize. t4illary til4lit 4tillu t4iln ti3lob tim2 ti3ma 3timab tim3b
+3time timet4a ti4mete 3timo timon4i tim3u 4timul 2tin 3t4in. 5ti3nad 3tine. 3tined
+t4ingb ting4e tin4gi 4tingl 4tingn tin4gr 5tingu 3tinic t4init tin4j ti4nose 4tinsk
+t4in4t 5tinus t4invi 3tio2 4tio3la 4tiolu 4tipas. ti4pater ti3pe ti6peda ti3ph ti4pho
+ti3pl ti4pod ti4pot tipri4 tip4sa 4tipul t4iq 4tir. 3tire tiren4 ti4ret tir2i
+5tir3ic tir3in 4tiris 4tiriz 3tis. tisa4m ti3san tis4c 4tisec tiser4 2t1isf tish4c
+4tishm tisi4 tis4l tiso4p ti3s4p 4tispu tisso4 t2ist tistal4 3tisti 4tistici tis4tr
+ti3su ti3sy t2it ti3ta tita4n 4titc tit4e t4itia 3tition tit4is ti3tl tit4li
+ti4tol ti3tr 3t4iu 3tiv ti3v2a ti4v3is ti4voc t3i3zen t4jan tj4e tju4 t1k
+tk4i4 4tky 2t1l2 4t4l. 4tla t4lal tlan2 tland3 tl4e 3t4le. 3tled. 4tlee
+3tlem 4tless 4tley 4tlie 4tlik tlil4 2t1m 4tma 4tm4e 4tmo tmos5p 2t1n
+4tn' 4tn4a tna4si 4tne tnton4 1t2o 3to. toas4 toat4 3to3b toba4l to4be.
+3toca 3tocr to3crat 3tode 4todu toe4a to4ed 4toest tof4i 3tog 4togly 4togne
+4togo 4toh. 4tohm 3toid toi4di toile4 2tok tok4l 4toko t5okou 4to3ky tol3em
+tolici4 tolo4n 3tom. 4tomal to4mall tomar3 to4matis to4matiz to4matop 3tome 4tomen tome4r
+2tomi 3t4o4mic 5tomic. 5tomica t3omist tomoto4 4tomou tom4s tomu4 2tomy ton2 t4on.
+5tona4l to5nalit toneast4 tone4ga to5net 3tonic ton4io 6tonish. 6tonishm tonni4 tonsi4 to2ny
+tooe4 4toor to3pa 4topau 4tope. 3toph 4tophel 4topoe to5py 4topy. 3tor 5to5ratio
+torbi4t 4tordi to4rea 4torer 4torga to1ri tori4de tori4en tor3iz 4torm. torpo4 torth4
+to3ry 3tos tos4e to3sp 4tosph tos4s tostel4 3tot 4tota. to3tem to3the to2to
+totro4 totu4 4toua 4tound. tour4a tovar4 4tovis 4towah 3tow4n 5town. tows4 3tox3
+tox5i 2t1p2 tpeli4 tpelli4 tph4 tpi4 tport4 4tpr t6pran tpre4 1tr2 4t4r.
+4tra' 3tra. tracas4 tra3ch t4racid 4tradd tra2ga 4tragalu t4rago 4tragu 3tral t4rame
+4tramen tra3mi t4ranc t4rand 3trans 4trans. trans3a t4rapt t4rar 4trarch. trar6chis tras4
+tra5ven 4travi4o4 t4razz t2r4e 3tre. tre4ad 4treal treci4 t4reg tre4i t4re2m tre4ma
+2treo tre2p 4treph trep3o3n 5tresc t4ri. 3t2ri3a 4triate. 3t2rib 4trib. trib3a tri4be
+3t4rice t5richa 3tricia t4rid. 3t2rie 4trij t4rill trilli4 4trime 2trimo t4rin trinar4
+trion4a t4rios tri4ph tri4pu t2ris trisylla6 t2rit trith4 tri4tia trit3ur t4riu 3trix
+triza4b trob4 tro3e trof4i t4rogeny trogo4 t6rograp tro4i tron4e tron4g tron3i 4trony
+4troom t4roph 4trophy. 3tropic 4tropis tropos4 4t3ropou 2t3ropy t4ror 4tros. tro3sp 3trot
+troth4e trous4e t4rox 4truc tru4de tru4e 4trug tru3i tru5si t4ruv 3try. 2ts2
+4t4s. t4sa. tsan4 4ts3b ts4c t4schl ts4e tsel4 4tsf t1sh t4shor ts4i
+t3sky ts3m tsot4 t1s4p 4t1s4t4 tsta4 t4sug4 t4suk t4sus tsut4 ts3v 4tsy
+t4sy. t4syn4 2t1t2 t4t' 4t4t. 4t3ta ttak4 ttar4iu t4tb t3ted t4teme ttend3
+tte4r t4tes. t4teso t4tg 4t3ti tti5a tti2d tti4la t5tingl t4tins t4tite tt4j
+t4tk t3t4l t4tm4 t4tn tto2n ttori4 ttra4m ttrib3 t4try t4ts ttu4o ttu4p
+ttur3 1tu tu1a tuag4 t6ualiser t6ualizer tub2 tu3b4e tu4bel tu3bu 4tuc. tuca4
+tu4des tu2di tud3ie tu3di3n tud3y 2tue t3u3en t4uf4 3tu3i3 tuil4 tu4is tuit4
+2tu1l 4tuln 3tum. 4tumb 3tumi tump3 tun4 tund4 tu4ne tu3nic tun5in tunk4
+tuo2 4tup. tu6rabl tura4m tu6rativ 3turb tur4ber 3ture 4turet4 tur4f 5turgic 3turi
+tu3rie tur3is tur3iz tur3o turre4 4turt turti4 3t4us tuss4 tu4ta tu4val tuy4e
+2t1v 2tw2 4twa t4wain twee4n 3twine twir4 twis4 twist5 4two twor6thil 4twy
+txi4 1ty2 4tya 4tye tyers4 4tyf ty3i t3y3lat tyle4u t3ymo ty4mol. 4tyoc
+3typ typo4t 4typu t4ys 4tysc 4tyu 4tyw 2t2z tz4e tzg4 tz4il 4t4zl
+tzo4 tzs4 2u. ua2 ua3b 4uac uad1 uadi4 uaf4 uag4i uain2 uaint3
+u1al ual4a ua3ma ua4mas ua4mu ua3na uanan4 u4ane u4a3p uar3an 4uar4d u4are
+uarri4an uar3te u1at uat4edn ua4tr 4uau uay4a u2b1 ub2a ubb4 ub5bl ub3c4
+ub3d ubde2 u4be. u4bele u3b4er u5beri ubi4as u3bic u4bin4g 4u4bis u3b4it ubi5ta
+ubl4 ub3li ub3m ubor3 ubor4a ub3p u3bri u4bro 4ubs4 u4b2u ub4ul u5bulat
+ub4y 2uc u3ca 4ucah ucar4 3ucat ucate4 ucay4 uc3c uccum4 4uce u4cep
+u3chu4 uc1ib u3cif ucig4 uci4p u3c2it u4c4k3 4uc4l ucle3 u3co uco3p u1cr
+uc4rac uc6ratize uct4a uc4te u1cu ucuro4 ucy4 u4cy. uda3i u4dam u3dan u4dax
+ud3d4 u3den u4dene u4dep ud3er. ud4er4a uder4s udev4 udg3eo udge4t u1di u2dian
+ud2ib udic4e 4udiciab u2die ud3ied u3dim udi3ni u3dino u3dio u2dis4 ud3ish ud4it
+udi4u u3do3 udop4 u4dru u2du ud3ule u2dy 4udz ue4a ueb4 uebe4 u4ed
+ue4gia uehon4 ue2li ue4lia u4elo uel4p uen4ce u4ene u4eni u4eno4 uere4 ueri4l
+uer2r uer4y u4es2 ues4th ues3tr uet2 ue4tr 2u2f2 4uf. u3fa 4ufa. 3ufac
+4uff uff3ab uff3ing uf3fl uf5fle uf4i u3f4l u4flo uf4r u3f4u 2ug u3gal
+4ugao ugar4i u3gat u4gh ug4ha ugh4es ugh3i ught2 ugh3te 4ugi ugi4e ugli4a
+ugmen4 ug4ne 4u3go u4gout ugre4 u3gu u4gul ugz4 u3ha uhe3 uh4s ui2
+4ui. ui4a. ui4ab ui3al ui3a4n ui4at uiber4 ui4bu u2ic ui4de uid3i 4uidit
+ui3e ui4er uie4ti uig2 u2il ui3la uil4d u4ile uil3iz uil4lo. uil2t3 ui3nar
+uine4a uin4ty uin4u4 ui3o 4uip ui3po 4uiq 4uir uirel4 uir4ite uirre4 uis2
+u4is. ui4sat uiset4 uis3in u5issa uis4tr ui4tab ui4tr uitz4 u4iv ujer4 u4jt
+2uk u1ka 4uke ukem4 u3kh 4ul. u3l4a ula4ca. u4lai 6ularis. 4ulb ul4bl
+ul3c 4ulca 4ulchra ul4e 4u3lea 4u5lei uleit4 ulei4u u3len 4uleo u4les u3let
+4uleu u4ley 4ulf ulfa4t ul2ger ul2gi ulg3in ul4gy u1li 4uli4a ulian4i u3lic
+ul4ie4 uli4m u4lina ul3ing ulin3i ul5ish u3l4it ul4iu 4ull ul4labi ul4larb ul4lard
+ul4ler. ull4i ullian4 ul4lite ul4loc ullo4d ul4low uln4 u3l4o 4ulok ulo4mi ulon4
+uloni4 4ulp ulpha4 ul4pie ulpi4ta ul4py 4uls 4ult ult5ant ulti3l u1l4u 4ulu.
+ulu4n ul3v ulw4 4uly4 u5ly. u4m. um3ab u5mac u4mag u2mam uma5ro uma4s
+u3mat uma6top 4umba um4bie um2bin u1m2e 3umell u3men umen4s u4mer. u6mer6ic. u1mi
+u2mic umid3 u3mig u2ming umi3ni umin4is u4mism. um4nis u3mo umoni4 umo4nit umon4o
+umon4t u5mor5o um2p umpe4 um4phy ump3i ump3y u4ms4 umt4 u3mu1 umu4le u2my
+un1 4una. un5abl un4alas una4mo un4ani un4ary unat4ic. una4tr u4naut unb4 un5bl
+2unc uncer4a unde6mon und2i un5dit un4dro. un4dry. un3e une2a uneb4 unek4 u4nep
+un4er un5ero uner4r u4nes une4so un4et unf4 unfi4bro unflo4 unful4l ung4a unga4m
+un4ger. un4gia ung4l un5gu un4ia4 un4ic u3nic. u3n4if uniflo4 unig3 uni4j uni2m
+u4nin un5ing u2n3io u3nip un4iq u4n3ish un4ism u1n4it uni4us u3ni1v u4nj un3l
+un3m unmatu4 4unn4 unne4c unob3l unof3 unon4e uno4pr un3p4 u4n3r4 unrav3 unre4co
+unremis6 unrep4u un3s4 unsca4 unscru6ta unsepa4 unta4l 3untar untar3y untel4l un3ten un4ter.
+un4terj unti4t unti4u un3tr unu4c unuch3 un3v unvict4 unvo2 uny2 unzi4 u1o
+4uo. uob4 uodio4 uolan4 u4om4 u2on4 uop4e uopi4 u2or u3o3re uor3idi uo2s
+uo2t u3ou u4ov 2u1p u4p. u4pab upat4 u3p4e u4ped uper3 u4peralt upercivi6
+uperlu6 up4ha upha4n uphe3m uphi4 u4p3ing upi4p upl4 u3ple u4plet u4pp uppe4t
+uppor4 upre4 up1s u4pt upt3ib u3p4u uqui4 4ur. 4u3ra. u3rac 4urad ura4da
+4urae ur3agi 4urale u4ram. ura4ma u4r3anc ura5no ur4ant u3rar2 u3r4as u4rasi u1r4at
+u4rb urbabili6 ur4ber. ur2bin urb3ing ur2c4 urd4a urdis4 ur4dish urd4w u1rea 3urea.
+u5reo ur3er ures4 u1ret ure4tic ur4fer ur4f3i ur4fr u4rg urg3in u3ria uri4ac
+uri4at. u1r4ic uric3u u3rid 4ur2ie u3rien u2ring u3rio uri4ol ur2it uri3ta uriti4u
+ur4lies. urmoun4 urmu4r u4rn 4urni urni4e urn4is ur4nov 4uro u3r4o. uroce4 u3roi
+u4rol. uro3p uro2t urovi4 urox4 urpo4 urpre4 urr4 4urren urre4t ur4rit ur2s
+ursu5a urten4 ur4tho ur4ty u1ru ur4vie ury4d ury4lo u2s u4s. u5sad u3s4an
+us4ap us4as us3c us4ch us4cr use3a use4o usep4 us3es u4set us4h1 4ush2a
+4usi. us4ia usi3an u3sic us4ie us5ies usil4i4 u3sill u4sin us4it us1n us4o
+u3sor 4us3p us4pa usper4 us4po us4ri 2uss2 ussel4 us4seli uss4i ust3ab us4th
+ustha4 us4tia us4tivel us4tiven us4tly ustmen4 us3to2 ustom3a us4top us3tr us3tu us4ty
+u3s4u usur4e usur2p usyn4 2ut 4u4t. ut2a uta4h u3tal uta4ma u3t4an u4tance
+utan4i 3utar3y u3tatio utb4 u4tc4 utca4 utci4 u4te4co u3te3i u3tell ut4em ut4en
+ute4or ute4r u2t3er. uter5in uter4me uter4op u2tes ut3g uth4ic uthor3 u4thr utiabili6
+u3tic u3til2 u4tily ut4im u3tina uti6nate. u3tini u3tino 4utio u4tish utj4 utk4
+u4t3l4 uto4mata u3ton utre4m ut4rop ut1s4 ut4sy ut3t uttel4 ut4tit utto2 u3tu
+u4tup utura4 ut1w utyr5 u1v u4valu u4ved uvel4 uve3n u4verneu u3vi uvii4
+u4vis u3vu uw4e u2x 4ux. ux3i uxili4 uxle4 uxm4 uxt4 uxu1r uya4n
+uyk4 uz2e uz4is uz4ze 2v. 1va 3va. 2v1ab v4aba v4abh 3v4ac va3ca
+vac3il vac3u 2vag va4gen vager4 v4agg v4a4gi 5vagina vaha4 3vai vail3a v2al
+val4a va1le val4er va3leri valer4y va5lesc vali2 val3ia va3lie val4ise 3vall val4len
+valli4 val3or valor3i val3u 4valu. vam4ph vampi4 va4na van4ce van4ch 4vanco 2vane
+van1g 4vang. vange4 van4i vani4e van5it va3niz va3no van4u va4pi vapor3i va3ra
+vard4 vardi4e va3riet var6iola var4is varle4 vars4 4varts va4ru 2vasa v5asat 5vasc
+va4se vas3ec vass4i 2vast v3as3ta vastat6i 4vatar 3vate 4vatina 3vatio vats4 4vatt.
+v4ce 2vd 4v4e. 2vea 3veal ve4b ve2bl 2ved v4ed. 4veda v3edl veg1e3
+vehe3 ve2i vei4o 2vel v3eled v3eler ve2li v4elin. v3el3is veli4u v4ella. vel3ler
+3velo vel4od vel3op 4veloy vel4t vel3v v4ely4 2vem ve5nan veng3i ven3ie veno4
+ve2n3o2m vens4e 3vent ven4tag ven6tat 4venth ven4tis ven4ua 4vep v4era. ver4an. 4verati
+verc4 5vere. ver3ea ver3ei ver3em 2veren 4vereu ve2ri ver4ia 4verie veri3ta ver3m4
+verma4n vermi6no 4verneur 1vers v4ers. 3verte vert3er 3verti ver4tit ver3u 6verwear. v2es
+4ves. ve4sac 3vesc ve2si ves3p ves3ti vet3e vet5ou 4veve vey3o 4vh. 3v4i.
+v4ian vi4ano 4viar vi4ary vias4 vi4ata vi3b vi4be vi4bi vi4bri vi2car vi4ce
+4viced 4vicen 3vich. 5vict victi2 vic2t3u 3v4icu vi2d 4v3iden 3vid3i 4vid4i4v v4ie.
+vi4en vie4r vi4erw 3viet viet5i vi4eto vie4w vi3f vi4fe 4v3iga v4ign v4ig1o
+vigor3 vi4gou vii4u 3vik vik4i v4ile. vil2i v2ili2a vil3if 3ville 4villed 2vin
+v2ina 3vina. vi4nato 3vinci 3vine. vi4net vin4ic vini4f vi4nom v4i3ny4 vi1o vio3l
+vio4lis v3i2or5 viot4 vi4pa vi3pe 3viru v2is vis5ag 4visat 3visc v3isec 3visi
+vi4sis vis3i4t 3viso vis1u3 vi3ta v4ital vita3m v3itat vitato4 v4ite vitori4 vi2t1r
+vi4tra vit4ro vit4ry vit4u vi2v viv3al 4vivis v4iza v4ized 4vizz 2vk 4vki
+vli4 2vn 1vo vo4cato voet4 3vog 3voi2 voi4c void3 4voird vo4j 3vok
+vo2la vol3at 3volt 4vol4to vol3un 3volv vom3i von4a 4vonar 4vonp vont4 v4oq
+vo2r 3vor4c vo4ri 5vorot v3orou 4vos vo2t 4vot. 3vote 4votee 3voti 3vour
+vour3i 3vout vo3vi 3vow vowe4 4vowi 3voy 4vp. vra4 v4reu vro4n 2vs
+v3ski v3sky 2vt 4vt. 4vty 1vu 6vulgati 3vur 2vv v4va vv4i v3vy
+vy4e v4zi 2w. 1wa 4w1ab w4abs wa2g wagi4 3wak wa4kan wak3en wal4k
+wallad4 wal4ley wam4pl wa4ne 4wane. wa4ny waq4 war2 war4d warde4 war4er warmon6
+warri4 war4t was4 wash3 wasp3 was5s4 waster4 w4at 3wa3te wat4i wat4ta wat4th
+wau4f wavel4 3way. wc4t wd4i wdo4 wdus4 we2 wear2 wea3r4ie wear4ine wea3ry
+wea4t weath3 we4b w2ed weep3 4weet3 weev4 weil4 weir4 wel3i wel2l wel4ta
+we4ly 4w1er w3eri wern4 w4err wer4s wes4e west1 western5 w4et 4wett. w4ey
+wf2 wg4r wgra4 1wh2 4wh. wha4 whan4 whar4 whel2 whi4 who4 why4
+w2i2 w4i. w4ia w4i4c w4i4d wid3o w4iec wield3 wien4 wi3er wi3est wi4f
+3wife wi4g wign4 will3in wil4lo. wilm4 4wim wimp4 w4in. win2d win4dr win2g
+win3i w4inn w4ins wir4l 1w4ise wis4p5 w4i4t with3 4witt. w4kn w4l. wl3ed
+wl4ey wl3ing wl4ings w1m wm4e w2n1 wn4de w4n3er w3nes wnfal4 wn3i wn4ia
+wn4ingt wnpa4 1wo2 wok4 wol2 wolf4f wol3l 3wom3 wo4ma won4e won4g won4t
+woo4 3wood woozi4er wor4c wor2d wor4sen 3wort wo3ven wows4 wp2 1wr2 wr4e
+3wri2 w2s ws4ab ws4er w3s4k wsma4 w3so ws4pe ws4t 2wt wtu4 wuh4
+wum4 wur2 wur4l wut4 wuz4 4ww. 2wy2 wyc5l wydi4 wyom4 w2z x1
+2x. xac4 x4aca xac5er x3ae xa2g xal2 xamer6a xa4m3i xami4nab xa4na x4andro
+xap4 xar4 x4ario xas3p xas4ti xato4 x4au x4c. x3ce xchan4 x3ci xci4t3a
+xcom4b xcu4 xcub4 2xe2 x4e. x3ec xe3cr xec5utiv xec3uto x4ed x5edl x5edn
+xe3g xel4 xe3mi xer2 xe4ra xer4gu xe3ro x3es xhi2 xhil3 xhila3 xhu2
+2xi x3ia xi3b xibi4 xica4l x3id2 xi3di xi4dic xi4din x3ie xi3f x3ig
+xig4r x3il xili4a xiliar4 xi4mis x3in x5ine xi4no x3io xi4p x3is xist5ent.
+xis4ti x3iv xiv3i x4ix x3le xle4i xm4e xn4t x3o. xochro4 xo4di xo2g
+xogen4 xon4ar xop4 xo5r2a xospo4 xo2t x4p. xpan4d x3pe xpec2 xpect6ed. xpecto3
+xpe3d2 xpen4c xper2 xpres4sa x4pt xpun4 x4r. xs2 xt2 x4t. x3ti xt4r
+xtra5ve xtre4me xtro3v xu1a xu3b xu4l2 xulian4 xulli4 x5ult xuper4 4xus xy1
+xyb4 xyl3at x4yle xy4s x3y3t y4'l y4'r y2a. y1ab y4abe ya4co yac4t
+yaen4 y4ageu 4y4ai ya4j y1al y4ala ya5lin y2am 5yam4a y1an 3yang ya3nid
+y4ank yan4ode 1y2ar y4ard 4yaro ya4s yaw4p y4az yb4a yba5r 4ybd y4bele
+y4bia 4y4biu yb4o ybrid3 y1c y5cem 3ycep yc3er3 y4ceri4 yce4te ych2 ychasi4
+ychas4ti ych3n y5cho ychor4 y3ci y4cida y4cif y4cinal y4cliu yclos4 yc3n4 ycog4
+yco3p yco3s ycosta4 ycot4t 4ycra ycran4 y4crat yctag4 y1d y4d' y4dad y4dali
+y4dam yd4di y2de y3den y3der 4y2d5ia y4dic ydi4o ydi4v yd4l 4y4domo 4y3dr
+y4driat ydroc4 ydro3s ydro3t 4y4e. ye4a yeas4 yeat4 y4ed ye3le ye3lo yel4p
+ye4m yen2 ye3n4i ye4o y1e4r y4era. yer4e y2erf y4erl yers4e yes3te yet2
+ye4u4 yeus4 3yev y4fed yfire4 4yga y2gap yge2 ygen3 2y2gi yg3i3a y3gie
+4ygo ygro3s 4ygy y1h yhisto6 yh4v yh4w y1i y3i4a y4ie yk4e yk4j
+ykn4 y2l y4l. y5lae yl3am y3lar4 y3lax 4yld y4le. y3ledo2 4ylem ylen4
+y4lest yl1ic 4ylid4 yl3ism y3lit 4yll yl3la yllar4 yl3li yllo4m yllo4n 4ylna
+y3lo y4loch yl4on yl2p yl4ph ylphe4 ylphi4 4ylsu 4yl3t y3lum y3lus yl3v
+y3ly 2ym 4ym. 4yma ymbo4 ymbol3 ym4c y3men 4ymer 4y2mi 5y5miz y3mo
+ymo4b 4ymol. y4monds ympa3 ymphan3 ym4phe ymp4i ymple4 2yn y1na y4nae yna3mit
+y4namy y4n4ar ynar4chi y4nast. yn3c ynde4 y2ne yn4ep yn4et yn1g yng4a 5yngec
+6yngologi y2ni ynia4 yn2n yno4e ynos4 3ynou yn1t yntro4 3yny. 4ynya yo3de
+yog4i y3oi 5yoke yoky4 yom4i yon2 y3one4 y1op yopi4t 2yp y2pa y4paes
+yp4e yper3 yperpu4 y4pes ypeta4 y4peu 4yphag yphe2 yph3il y3pho 4yphon ypho4t
+4yp3i yp4ico 3yplo ypo3a ypo3c y4pocr y3pogr ypo4lite ypo3n ypos5tas ypos4to y4poth.
+y4pou y4pre. y4pri yp3s yp2ta ypt3an yp3y y3ra. y3rag y2re y5rene. y4rhi
+y4ria yriam4 y4r1ic yr4if 5yrint yr4le y4rm yr4ma yrme3 y4rn y1ro y4rod
+yro3st yrro4 y2s ysal2 ysca4 yscrin4 ys3e3al ys4el ys4es y3sh ys2i y4siac.
+ys3i3al y4sias ys3ic y3sid ys3io 3y5sis y5sit 4ysk ysme4 ys4o ysom4 yss4
+ys4sal ysse4 ys3t ystem3 ystem4l ysthe4u ys4tl ys4toi ys4tone ysto4p ystri6 y3su
+y4sur ys4us 3y3sy 2y2t y4t. ytan4 yte4l ytel4l 3y3ten yte4r y4teu y3them
+y4th3i ytho4gr yth3op yth3ro yt1i y4til y4tio ytish4 y4tium y3to 4ytom y4tomo
+y4tomy ytos4t y3tr ytt4 y3tu yub4 y4uc yu4go. yu4le y1v y1w yw4c
+ywon4 2y2x 4yx3e yx3i yxi4a. yxi4d 4yxo 4yy4a 2yz y2za y4zan y4zygy
+2z. 1za1 3za. 2z1ab za4ch 4zaf za4g 3zal za4la 4zald zale4 3zan
+4zank za4nu za4q 2zar2 z4ar. za2rat zar4ia za4ry zas4 za4st 3zat 4zath
+za4u 2zb 2ze. zeal3 ze4bra. ze4da zeg4 3zel. zel4le ze4n zen4e 4zener
+zenti4 ze4p z1er zer4a zer4o z4ert zevi4 zg4e 4zgi zh4d z1i 3zi.
+3zia. zi4at zib4 zi4be4 4zic. 3z4ie. zi4ery zi1es z4if zi4k 4zilin z4ilo
+4z4im 2zin2 3zin. z4in4c zinc3i zind4 zin4e 3zine. z3ing. 4ziot zir4ca zi4r4i
+4zirit 4zky z5ky. 1z2l2 4zla 3zle 4zlo 1zo zo1a 4zoam zocer4 zo1i
+zoker4 zo4lam zolan4 4zolin 4zolo 3zo2n zonar4 zo4ne zon4if zo1o zoo4i zook4
+2zop 3zor zori4l zos4e 2zot zo3ti zo4tic z3ra zs4c z4so4 zuid4 zu4o
+4zwi 3zyg zy2ga zym4 z1z2 z3za z4zed 4zzi z3zl z3zo zzu4 z4zw
diff --git a/crates/text/examples/hyphgen.rs b/crates/text/examples/hyphgen.rs
new file mode 100644
index 00000000..520cee91
--- /dev/null
+++ b/crates/text/examples/hyphgen.rs
@@ -0,0 +1,174 @@
+//! Regenerates the bundled English hyphenation data from the Moby Hyphenator II word list.
+//!
+//! ```text
+//! curl -LO https://www.gutenberg.org/files/3204/files/mhyph.txt   # Project Gutenberg #3204, public domain
+//! cargo run --release -p craft-text --features generator --example hyphgen -- mhyph.txt crates/text/assets/hyphen [--validate]
+//! ```
+//!
+//! Writes `en-us.dic` (the word list, front-coded and deflated; see `craft_text::hyphen::dict`)
+//! and `en-us.pat` (Liang patterns trained from the list by `craft_text::hyphen::patgen`).
+//! `--validate` first trains on 90% of the words and reports accuracy on the held-out 10%.
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use craft_text::hyphen::dict::{Dictionary, hyphenated};
+use craft_text::hyphen::patgen::{self, DEFAULT_LEVELS};
+
+/// Mac OS Roman, 0x80..=0xFF (the list's encoding; 0xA5 `•` marks breaks).
+const MAC_ROMAN_HIGH: &str =
+    "ÄÅÇÉÑÖÜáàâäãåçéèêëíìîïñóòôöõúùûü†°¢£§•¶ß®©™´¨≠ÆØ∞±≤≥¥µ∂∑∏π∫ªºΩæø¿¡¬√ƒ≈∆«»…\u{A0}ÀÃÕŒœ–—“”‘’÷◊ÿŸ⁄€‹›fifl‡·‚„‰ÂÊÁËÈÍÎÏÌÓÔ\u{F8FF}ÒÚÛÙıˆ˜¯˘˙˚¸˝˛ˇ";
+
+fn mac_roman(bytes: &[u8]) -> String {
+    let high: Vec<char> = MAC_ROMAN_HIGH.chars().collect();
+    assert_eq!(high.len(), 128);
+    bytes.iter().map(|&b| if b < 0x80 { b as char } else { high[b as usize - 0x80] }).collect()
+}
+
+const BREAK: char = '•';
+
+fn is_word_char(c: char) -> bool {
+    c.is_alphabetic() || c == '\'' || c == BREAK
+}
+
+/// `(lowercase word, mask)` of one token like `Aa•ron's`, or None if it isn't a plain word.
+fn token(t: &str) -> Option<(String, u64)> {
+    let t = t.trim_matches('\'');
+    if t.is_empty() || !t.chars().all(is_word_char) || t.starts_with(BREAK) || t.ends_with(BREAK) {
+        return None;
+    }
+    let mut w = String::new();
+    let mut m = 0u64;
+    let mut n = 0usize;
+    for c in t.chars() {
+        if c == BREAK {
+            if n < 64 {
+                m |= 1 << n;
+            }
+        } else {
+            w.extend(c.to_lowercase());
+            n += 1;
+        }
+    }
+    ((1..64).contains(&n) && w.chars().count() == n).then_some((w, m))
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let validate = args.iter().any(|a| a == "--validate");
+    let pos: Vec<&String> = args.iter().filter(|a| !a.starts_with("--")).collect();
+    let Some(src) = pos.first() else {
+        eprintln!("usage: hyphgen <mhyph.txt> [out-dir] [--validate]");
+        std::process::exit(2);
+    };
+    let out_dir = PathBuf::from(pos.get(1).map_or("crates/text/assets/hyphen", |s| s.as_str()));
+    let text = mac_roman(&std::fs::read(src).expect("read word list"));
+
+    // key → (lowercase-origin masks, other masks); compound parts only fill gaps.
+    let mut primary: HashMap<String, (Vec<u64>, Vec<u64>)> = HashMap::new();
+    let mut parts: HashMap<String, u64> = HashMap::new();
+    let mut entries = 0usize;
+    for line in text.lines() {
+        let line = line.trim_end_matches('\r').trim();
+        if line.is_empty() {
+            continue;
+        }
+        entries += 1;
+        if let Some((w, m)) = token(line) {
+            let lower = !line.chars().any(char::is_uppercase);
+            let e = primary.entry(w).or_default();
+            if lower { e.0.push(m) } else { e.1.push(m) }
+        } else {
+            for t in line.split([' ', '-', '/']) {
+                if let Some((w, m)) = token(t) {
+                    parts.entry(w).or_insert(m);
+                }
+            }
+        }
+    }
+    let mut list: Vec<(String, u64)> = primary
+        .into_iter()
+        .map(|(w, (lower, other))| {
+            // Prefer lowercase entries; where spellings disagree (re•cord / rec•ord) keep only the
+            // breaks they share.
+            let v = if lower.is_empty() { other } else { lower };
+            (w, v.iter().fold(u64::MAX, |a, b| a & b))
+        })
+        .collect();
+    let have: std::collections::HashSet<String> = list.iter().map(|x| x.0.clone()).collect();
+    let extra: Vec<(String, u64)> = parts.into_iter().filter(|(w, _)| !have.contains(w)).collect();
+    println!("{entries} entries → {} words (+{} from compounds)", list.len(), extra.len());
+    list.extend(extra);
+    let dict = Dictionary::from_entries(list);
+    let bytes = dict.to_bytes();
+    std::fs::create_dir_all(&out_dir).expect("mkdir");
+    std::fs::write(out_dir.join("en-us.dic"), &bytes).expect("write en-us.dic");
+    let back = Dictionary::from_bytes(&bytes).expect("roundtrip");
+    assert_eq!(back.len(), dict.len());
+    println!("en-us.dic: {} words, {} bytes", dict.len(), bytes.len());
+
+    // Training data: plain lowercase ASCII words (+ apostrophes).
+    let train: Vec<(Vec<char>, Vec<usize>)> = dict
+        .iter()
+        .filter(|(w, _)| w.chars().all(|c| c.is_ascii_lowercase() || c == '\''))
+        .map(|(w, m)| (w.chars().collect(), (1..w.len().min(64)).filter(|&i| m & (1 << i) != 0).collect()))
+        .collect();
+    println!("training on {} words", train.len());
+    let mut log = |s: String| println!("  {s}");
+    // Optional override for tuning: HYPHGEN_LEVELS="1,4,1,2,20;2,5,2,1,8;…" (min,max,good,bad,threshold).
+    let custom: Option<Vec<patgen::Level>> = std::env::var("HYPHGEN_LEVELS").ok().map(|s| {
+        s.split(';')
+            .map(|l| {
+                let v: Vec<u32> = l.split(',').map(|x| x.trim().parse().expect("number")).collect();
+                patgen::Level { min_len: v[0] as usize, max_len: v[1] as usize, good_weight: v[2], bad_weight: v[3], threshold: v[4] }
+            })
+            .collect()
+    });
+    let levels = custom.as_deref().unwrap_or(DEFAULT_LEVELS);
+    if validate {
+        let (fit, hold): (Vec<_>, Vec<_>) = train.iter().cloned().enumerate().partition(|(i, _)| i % 10 != 0);
+        let fit: Vec<_> = fit.into_iter().map(|x| x.1).collect();
+        let hold: Vec<_> = hold.into_iter().map(|x| x.1).collect();
+        let p = patgen::train(&fit, levels, &mut log);
+        let s = patgen::score(&p, &hold);
+        println!(
+            "held-out: {} words, {} breaks: found {} ({:.1}%), missed {}, wrong {} ({:.2}% of reported)",
+            s.words,
+            s.breaks,
+            s.found,
+            100.0 * s.found as f64 / s.breaks.max(1) as f64,
+            s.missed(),
+            s.wrong,
+            100.0 * s.wrong as f64 / (s.found + s.wrong).max(1) as f64
+        );
+    }
+    if std::env::var_os("HYPHGEN_VALIDATE_ONLY").is_some() {
+        return;
+    }
+    let pats = patgen::train(&train, levels, &mut log);
+    let s = patgen::score(&pats, &train);
+    println!(
+        "training set: found {}/{} ({:.1}%), wrong {} — {} patterns",
+        s.found,
+        s.breaks,
+        100.0 * s.found as f64 / s.breaks.max(1) as f64,
+        s.wrong,
+        pats.len()
+    );
+    let mut out = String::new();
+    out.push_str("% Craft US English hyphenation patterns (Liang/TeX notation).\n");
+    out.push_str("% Generated by crates/text/examples/hyphgen.rs: trained with craft-text's patgen-style trainer\n");
+    out.push_str("% from the Moby Hyphenator II word list by Grady Ward (public domain, Project Gutenberg #3204).\n");
+    out.push_str("% Released into the public domain (CC0-1.0) by the DesignCraft and craft-libs contributors.\n");
+    for line in pats.to_tex().chunks(12) {
+        out.push_str(&line.join(" "));
+        out.push('\n');
+    }
+    std::fs::write(out_dir.join("en-us.pat"), &out).expect("write en-us.pat");
+    println!("en-us.pat: {} patterns, {} bytes", pats.len(), out.len());
+    for w in ["hyphenation", "typography", "composition", "photographer", "unquestionably", "localization", "blockchain", "smartphone"] {
+        let c: Vec<char> = w.chars().collect();
+        let m = pats.points(&c).unwrap_or_default().iter().fold(0u64, |m, &i| m | 1 << i);
+        println!("  patterns: {}", hyphenated(w, m));
+    }
+}
diff --git a/crates/text/src/bidi/mod.rs b/crates/text/src/bidi/mod.rs
new file mode 100644
index 00000000..39fef7d7
--- /dev/null
+++ b/crates/text/src/bidi/mod.rs
@@ -0,0 +1,367 @@
+//! Bidirectional text (UAX #9) for document layout, on plain text and independent of fonts.
+//!
+//! The pipeline is the one the algorithm prescribes: [`Paragraph::new`] resolves embedding levels
+//! once for the whole logical paragraph (or for each paragraph, in text with paragraph
+//! separators); shaping and line breaking happen in logical order; then each line is reordered on
+//! its own. [`Paragraph::line_levels`] applies rule L1 and
+//! [`Paragraph::visual_runs`] rule L2 to a byte range of the paragraph. For lines built from other
+//! units (clusters, glyphs, cells), [`line_levels`] and [`visual_order`] apply the same rules to
+//! slices of levels. [`mirror`] gives the character for rule L4; drawing it, or a font's mirrored
+//! glyph, is left to the shaper.
+//!
+//! Levels are `u8` embedding levels: even runs left to right, odd runs right to left.
+
+use std::ops::Range;
+
+use unicode_bidi::BidiClass::{self, AL, AN, B, BN, FSI, LRE, LRI, LRO, PDF, PDI, R, RLE, RLI, RLO, S, WS};
+use unicode_bidi::{BidiInfo, Level, bidi_class};
+
+/// A paragraph's base direction (rules P2–P3, or the higher-level protocol HL1 when set).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+#[non_exhaustive]
+pub enum Direction {
+    /// Left to right: paragraph level 0.
+    Ltr,
+    /// Right to left: paragraph level 1.
+    Rtl,
+    /// From the first strong character, left to right when there is none.
+    Auto,
+}
+
+/// A directional override (LRO or RLO … PDF) over a byte range of a paragraph: every character in
+/// it is treated as strongly left to right or right to left.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct Override {
+    pub range: Range<usize>,
+    pub rtl: bool,
+}
+
+/// A maximal run of one embedding level in a line, as [`Paragraph::visual_runs`] returns it.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+#[non_exhaustive]
+pub struct Run {
+    /// Byte range in the paragraph text, in logical order.
+    pub range: Range<usize>,
+    pub level: u8,
+}
+
+impl Run {
+    /// Is the run displayed right to left (its characters from the end of `range` to its start)?
+    pub fn is_rtl(&self) -> bool {
+        self.level % 2 == 1
+    }
+}
+
+/// Resolved embedding levels (rules up to I2) for a paragraph's text, one per byte.
+///
+/// A paragraph separator (`\n`, U+2029 and the other class B characters) inside the text ends a
+/// paragraph and belongs to it; the next one starts after it with its own paragraph level, which
+/// `Direction::Auto` resolves from that paragraph's own first strong character. Rule L1 uses the
+/// level of the paragraph each byte is in.
+#[derive(Clone, Debug)]
+pub struct Paragraph<'t> {
+    text: &'t str,
+    levels: Vec<u8>,
+    /// Each paragraph's byte range and level, in order and covering the text; never empty.
+    paragraphs: Vec<(Range<usize>, u8)>,
+}
+
+impl<'t> Paragraph<'t> {
+    /// Resolve the levels of `text`. Text with nothing right to left in a left-to-right or `Auto`
+    /// paragraph skips the algorithm.
+    pub fn new(text: &'t str, base: Direction) -> Self {
+        if base != Direction::Rtl && !needs_bidi(text) {
+            let paragraphs = split_paragraphs(text).into_iter().map(|r| (r, 0)).collect();
+            return Self { text, levels: vec![0; text.len()], paragraphs };
+        }
+        let (levels, paragraphs) = resolve(text, base);
+        Self { text, levels, paragraphs }
+    }
+
+    /// Like [`new`](Self::new), with directional overrides. Overrides that are empty, out of
+    /// range, off char boundaries or overlapping an earlier one are ignored. An override that
+    /// spans a paragraph separator continues in the next paragraph; the separator keeps its
+    /// paragraph's level.
+    pub fn with_overrides(text: &'t str, base: Direction, overrides: &[Override]) -> Self {
+        let mut sorted: Vec<&Override> = overrides.iter().filter(|o| o.range.start < o.range.end && text.get(o.range.clone()).is_some()).collect();
+        sorted.sort_by_key(|o| o.range.start);
+        // The text with LRO/RLO … PDF around each override, and where each source char went.
+        let mut wrapped = String::with_capacity(text.len() + sorted.len() * 6);
+        let mut at: Vec<usize> = Vec::with_capacity(text.len());
+        let mut copy = |wrapped: &mut String, piece: Range<usize>| {
+            if let Some(s) = text.get(piece) {
+                for (_, c) in s.char_indices() {
+                    at.extend(std::iter::repeat_n(wrapped.len(), c.len_utf8()));
+                    wrapped.push(c);
+                }
+            }
+        };
+        let mut pos = 0;
+        for o in sorted {
+            if o.range.start < pos {
+                continue;
+            }
+            copy(&mut wrapped, pos..o.range.start);
+            // A paragraph separator ends every embedding (rule X8), so the override is closed
+            // before each separator and opened again after it.
+            let mut start = o.range.start;
+            while start < o.range.end {
+                let rest = text.get(start..o.range.end).unwrap_or_default();
+                let (end, next) = rest
+                    .char_indices()
+                    .find(|&(_, c)| bidi_class(c) == B)
+                    .map_or((o.range.end, o.range.end), |(i, c)| (start + i, start + i + c.len_utf8()));
+                if start < end {
+                    wrapped.push(if o.rtl { '\u{202E}' } else { '\u{202D}' });
+                    copy(&mut wrapped, start..end);
+                    wrapped.push('\u{202C}');
+                }
+                copy(&mut wrapped, end..next);
+                start = next;
+            }
+            pos = o.range.end;
+        }
+        if pos == 0 {
+            return Self::new(text, base);
+        }
+        copy(&mut wrapped, pos..text.len());
+        let (wrapped_levels, wrapped_paragraphs) = resolve(&wrapped, base);
+        // The inserted controls are not separators, so the paragraphs are the same ones; their
+        // ranges map back through `at`, which is ascending.
+        let back = |w: usize| at.partition_point(|&a| a < w);
+        let paragraphs: Vec<(Range<usize>, u8)> = wrapped_paragraphs.iter().map(|(r, l)| (back(r.start)..back(r.end), *l)).collect();
+        let levels = at.iter().enumerate().map(|(b, &w)| wrapped_levels.get(w).copied().unwrap_or_else(|| level_in(&paragraphs, b))).collect();
+        Self { text, levels, paragraphs }
+    }
+
+    pub fn text(&self) -> &'t str {
+        self.text
+    }
+
+    /// The first paragraph's embedding level: 0 or 1. Text with paragraph separators has one
+    /// level per paragraph: see [`paragraphs`](Self::paragraphs).
+    pub fn level(&self) -> u8 {
+        self.paragraphs.first().map_or(0, |p| p.1)
+    }
+
+    /// Is the first paragraph right to left?
+    pub fn is_rtl(&self) -> bool {
+        self.level() % 2 == 1
+    }
+
+    /// Each paragraph's byte range (its separator included) and embedding level, in order. There
+    /// is always at least one; empty text has one empty paragraph.
+    pub fn paragraphs(&self) -> &[(Range<usize>, u8)] {
+        &self.paragraphs
+    }
+
+    /// The embedding level of the paragraph containing byte `byte` (the last one's past the end).
+    pub fn paragraph_level_at(&self, byte: usize) -> u8 {
+        level_in(&self.paragraphs, byte)
+    }
+
+    /// Does any line need reordering (is any level above 0)?
+    pub fn needs_reordering(&self) -> bool {
+        self.levels.iter().any(|l| *l > 0)
+    }
+
+    /// The level of each byte of the text.
+    pub fn levels(&self) -> &[u8] {
+        &self.levels
+    }
+
+    pub fn into_levels(self) -> Vec<u8> {
+        self.levels
+    }
+
+    /// The level of the character at byte `byte` (the last paragraph's level past the end).
+    pub fn level_at(&self, byte: usize) -> u8 {
+        self.levels.get(byte).copied().unwrap_or_else(|| self.paragraph_level_at(byte))
+    }
+
+    /// The level of each character, in order.
+    pub fn char_levels(&self) -> Vec<u8> {
+        self.text.char_indices().map(|(b, _)| self.level_at(b)).collect()
+    }
+
+    /// Rule L1 for the line `line` (a byte range of the text): the level of each of its bytes,
+    /// with segment and paragraph separators, whitespace before them and whitespace at the end of
+    /// the line at their paragraph's level; zero-width joiners and tag characters keep the level of
+    /// the char before them. Empty when `line` is not a char-boundary range of the text. A line
+    /// should lie within one paragraph; one that crosses a separator takes each byte's own
+    /// paragraph level here and is reordered as a whole by [`visual_runs`](Self::visual_runs).
+    pub fn line_levels(&self, line: Range<usize>) -> Vec<u8> {
+        let Some(s) = self.text.get(line.clone()) else { return Vec::new() };
+        let mut out: Vec<u8> = line.clone().map(|b| self.level_at(b)).collect();
+        let mut trailing = true;
+        for (b, c) in s.char_indices().rev() {
+            if l1_reset(bidi_class(c), &mut trailing)
+                && let Some(bytes) = out.get_mut(b..b + c.len_utf8())
+            {
+                bytes.fill(self.paragraph_level_at(line.start + b));
+            }
+        }
+        let mut prev = None;
+        for (b, c) in s.char_indices() {
+            if joins_previous(c)
+                && let Some(l) = prev
+                && let Some(bytes) = out.get_mut(b..b + c.len_utf8())
+            {
+                bytes.fill(l);
+            }
+            prev = out.get(b).copied();
+        }
+        out
+    }
+
+    /// Rules L1 and L2 for the line `line`: its runs of one level, left to right as displayed.
+    /// Empty when `line` is not a char-boundary range of the text.
+    pub fn visual_runs(&self, line: Range<usize>) -> Vec<Run> {
+        let levels = self.line_levels(line.clone());
+        let Some(s) = self.text.get(line.clone()) else { return Vec::new() };
+        let mut runs: Vec<Run> = Vec::new();
+        for (b, c) in s.char_indices() {
+            let level = levels.get(b).copied().unwrap_or_else(|| self.paragraph_level_at(line.start + b));
+            let end = line.start + b + c.len_utf8();
+            match runs.last_mut() {
+                Some(run) if run.level == level => run.range.end = end,
+                _ => runs.push(Run { range: line.start + b..end, level }),
+            }
+        }
+        let run_levels: Vec<u8> = runs.iter().map(|r| r.level).collect();
+        visual_order(&run_levels).into_iter().filter_map(|i| runs.get(i).cloned()).collect()
+    }
+}
+
+/// Rule L1 over a line's characters `chars` and their resolved `levels`: segment and paragraph
+/// separators, any whitespace before them and whitespace at the end of the line take `para_level`;
+/// zero-width joiners and tag characters keep the level of the char before them. Missing levels are
+/// taken as `para_level`.
+pub fn line_levels(chars: &[char], levels: &[u8], para_level: u8) -> Vec<u8> {
+    let mut out = levels.to_vec();
+    out.resize(chars.len(), para_level);
+    let mut trailing = true;
+    for (i, c) in chars.iter().enumerate().rev() {
+        if l1_reset(bidi_class(*c), &mut trailing)
+            && let Some(l) = out.get_mut(i)
+        {
+            *l = para_level;
+        }
+    }
+    for i in 1..out.len() {
+        if chars.get(i).is_some_and(|&c| joins_previous(c))
+            && let Some(&l) = out.get(i - 1)
+            && let Some(cur) = out.get_mut(i)
+        {
+            *cur = l;
+        }
+    }
+    out
+}
+
+/// Zero-width joiners and tag characters extend the grapheme cluster of the char before them
+/// (UAX #29), so they take its level. Rule L1 counts them as whitespace and would otherwise give a
+/// trailing one the paragraph level, splitting its cluster across two runs.
+fn joins_previous(c: char) -> bool {
+    matches!(c, '\u{200C}' | '\u{200D}' | '\u{E0020}'..='\u{E007F}')
+}
+
+/// Rule L2: the display order, left to right, of items with these levels (indices into `levels`).
+/// From the highest level down to the lowest odd one, every maximal run at that level or higher is
+/// reversed.
+pub fn visual_order(levels: &[u8]) -> Vec<usize> {
+    let mut order: Vec<usize> = (0..levels.len()).collect();
+    let Some(min_odd) = levels.iter().copied().filter(|l| l % 2 == 1).min() else { return order };
+    let max = levels.iter().copied().max().unwrap_or(0);
+    let level_at = |order: &[usize], i: usize| order.get(i).and_then(|&o| levels.get(o)).copied().unwrap_or(0);
+    for lvl in (min_odd..=max).rev() {
+        let mut i = 0;
+        while i < order.len() {
+            if level_at(&order, i) < lvl {
+                i += 1;
+                continue;
+            }
+            let mut j = i;
+            while j < order.len() && level_at(&order, j) >= lvl {
+                j += 1;
+            }
+            if let Some(run) = order.get_mut(i..j) {
+                run.reverse();
+            }
+            i = j;
+        }
+    }
+    order
+}
+
+/// The mirrored counterpart of `c` (Bidi_Mirroring_Glyph), for a character at an odd level (rule
+/// L4): `(` for `)`, `»` for `«`. `None` when it has none; some Bidi_Mirrored characters (`∑`)
+/// need a mirrored glyph from the font instead.
+pub fn mirror(c: char) -> Option<char> {
+    unicode_bidi_mirroring::get_mirrored(c)
+}
+
+/// Does anything in the text need the full algorithm (strong right-to-left characters, Arabic
+/// numbers or explicit embeddings)?
+fn needs_bidi(text: &str) -> bool {
+    text.chars().any(|c| matches!(bidi_class(c), R | AL | AN | LRE | RLE | LRO | RLO | PDF | LRI | RLI | FSI | PDI))
+}
+
+/// Levels per byte of `text`, and each paragraph's byte range and level.
+fn resolve(text: &str, base: Direction) -> (Vec<u8>, Vec<(Range<usize>, u8)>) {
+    let default = match base {
+        Direction::Ltr => Some(Level::ltr()),
+        Direction::Rtl => Some(Level::rtl()),
+        Direction::Auto => None,
+    };
+    let info = BidiInfo::new(text, default);
+    let mut paragraphs: Vec<(Range<usize>, u8)> = info.paragraphs.iter().map(|p| (p.range.clone(), p.level.number())).collect();
+    if paragraphs.is_empty() {
+        paragraphs.push((0..text.len(), u8::from(base == Direction::Rtl)));
+    }
+    let levels = (0..text.len()).map(|b| info.levels.get(b).map_or_else(|| level_in(&paragraphs, b), |l| l.number())).collect();
+    (levels, paragraphs)
+}
+
+/// The byte ranges of the paragraphs in `text` as rule P1 (and unicode-bidi) splits them: each
+/// ends after a paragraph separator, and there is always at least one.
+fn split_paragraphs(text: &str) -> Vec<Range<usize>> {
+    let mut out = Vec::new();
+    let mut start = 0;
+    for (b, c) in text.char_indices() {
+        if bidi_class(c) == B {
+            out.push(start..b + c.len_utf8());
+            start = b + c.len_utf8();
+        }
+    }
+    if start < text.len() || out.is_empty() {
+        out.push(start..text.len());
+    }
+    out
+}
+
+/// The level of the paragraph containing byte `byte`; the last paragraph's past the end.
+fn level_in(paragraphs: &[(Range<usize>, u8)], byte: usize) -> u8 {
+    let i = paragraphs.partition_point(|(r, _)| r.end <= byte);
+    paragraphs.get(i).or(paragraphs.last()).map_or(0, |p| p.1)
+}
+
+/// Rule L1 walking a line backwards: whether the character of class `class` takes the paragraph
+/// level. `trailing` is true while everything after it up to the line end or a separator is
+/// whitespace.
+fn l1_reset(class: BidiClass, trailing: &mut bool) -> bool {
+    match class {
+        S | B => {
+            *trailing = true;
+            true
+        }
+        WS | FSI | LRI | RLI | PDI | BN | LRE | RLE | LRO | RLO | PDF => *trailing,
+        _ => {
+            *trailing = false;
+            false
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/text/src/bidi/tests.rs b/crates/text/src/bidi/tests.rs
new file mode 100644
index 00000000..58a450fb
--- /dev/null
+++ b/crates/text/src/bidi/tests.rs
@@ -0,0 +1,254 @@
+use super::*;
+
+fn rev(s: &str) -> String {
+    s.chars().rev().collect()
+}
+
+/// Byte offset of char `n` of `s`.
+fn at(s: &str, n: usize) -> usize {
+    s.char_indices().nth(n).map_or(s.len(), |(i, _)| i)
+}
+
+/// The line as displayed, left to right, built from its visual runs.
+fn shown(p: &Paragraph<'_>, line: Range<usize>) -> String {
+    p.visual_runs(line).iter().map(|r| if r.is_rtl() { rev(&p.text()[r.range.clone()]) } else { p.text()[r.range.clone()].to_string() }).collect()
+}
+
+fn shown_all(text: &str, base: Direction) -> String {
+    shown(&Paragraph::new(text, base), 0..text.len())
+}
+
+#[test]
+fn mixed_arabic_latin_numbers_and_brackets() {
+    let s = "سنة 2024 (Retrait) فقط";
+    let p = Paragraph::new(s, Direction::Rtl);
+    let l = p.char_levels();
+    let chars: Vec<char> = s.chars().collect();
+    assert_eq!(l.len(), chars.len());
+    // Arabic letters at the paragraph level 1; European digits and Latin at 2.
+    assert_eq!(l[0], 1);
+    assert_eq!(&l[4..8], &[2, 2, 2, 2]);
+    assert_eq!(&l[10..17], &[2; 7]);
+    assert_eq!(l[19], 1);
+    // Brackets around Latin inside a right-to-left paragraph take the embedding direction (N0).
+    assert_eq!(l[9] % 2, 1, "( is right to left");
+    assert_eq!(l[17] % 2, 1, ") is right to left");
+    // The Arabic words reversed, Latin and digits kept, the brackets swapped (the shaper mirrors
+    // them back, rule L4). Char-level reordering and byte runs agree.
+    let order = visual_order(&line_levels(&chars, &l, p.level()));
+    let vis: String = order.iter().map(|&i| chars[i]).collect();
+    assert_eq!(vis, "طقف )Retrait( 2024 ةنس");
+    assert_eq!(shown(&p, 0..s.len()), vis);
+}
+
+#[test]
+fn levels_for_persian_with_latin_and_numbers() {
+    let p = Paragraph::new("plain English", Direction::Ltr);
+    assert!(!p.needs_reordering(), "pure left-to-right paragraphs skip the algorithm");
+    assert_eq!(p.levels(), &[0; 13]);
+    let s = "سلام Word ۱۴۰۳";
+    let p = Paragraph::new(s, Direction::Rtl);
+    assert_eq!(p.levels().len(), s.len());
+    assert!(p.needs_reordering());
+    assert_eq!(p.level_at(0), 1, "Persian letters are right to left");
+    assert_eq!(p.level_at(at(s, 5)), 2, "Latin inside a right-to-left paragraph is embedded at level 2");
+    assert_eq!(p.level_at(at(s, 10)), 2, "Persian digits are numbers: left to right inside right-to-left text");
+    assert_eq!(p.level_at(s.len()), 1, "past the end: the paragraph level");
+    // In a left-to-right paragraph Persian is embedded at level 1.
+    let s = "Hello سلام";
+    let p = Paragraph::new(s, Direction::Ltr);
+    assert_eq!((p.level_at(0), p.level_at(at(s, 6))), (0, 1));
+    // A right-to-left paragraph of Latin text keeps it left to right inside it.
+    assert_eq!(Paragraph::new("ab", Direction::Rtl).char_levels(), vec![2, 2]);
+}
+
+#[test]
+fn auto_direction_follows_the_first_strong_character() {
+    assert!(Paragraph::new("سلام Word", Direction::Auto).is_rtl());
+    assert!(!Paragraph::new("Word سلام", Direction::Auto).is_rtl());
+    assert!(Paragraph::new("123 سلام", Direction::Auto).is_rtl(), "digits are weak");
+    assert_eq!(Paragraph::new("123", Direction::Auto).level(), 0);
+    assert_eq!(Paragraph::new("", Direction::Auto).level(), 0);
+    assert_eq!(Paragraph::new("", Direction::Rtl).level(), 1);
+    assert_eq!(Paragraph::new("Word", Direction::Rtl).level(), 1, "an explicit direction wins");
+}
+
+#[test]
+fn whole_lines_read_in_display_order() {
+    let s = "سلام دنیا";
+    assert_eq!(shown_all(s, Direction::Rtl), rev(s));
+    assert_eq!(shown_all("Hello سلام world", Direction::Ltr), "Hello مالس world");
+    // "Price 250 toman" in Persian, with a Latin product name, Persian punctuation and digits:
+    // numbers and Latin keep their order, the words around them read right to left, and the final
+    // full stop is at the paragraph's end (the far left).
+    let s = "قیمت 250 تومان برای Word، امسال ۱۴۰۳.";
+    let want = format!(".۱۴۰۳ {} ،Word {} {} 250 {}", rev("امسال"), rev("برای"), rev("تومان"), rev("قیمت"));
+    assert_eq!(shown_all(s, Direction::Rtl), want);
+}
+
+#[test]
+fn each_line_is_reordered_on_its_own() {
+    // A right-to-left paragraph of Latin words broken after "ab ": the trailing space takes the
+    // paragraph level (rule L1), so it sits at the line's end edge, on the left.
+    let p = Paragraph::new("ab cd", Direction::Rtl);
+    assert_eq!(p.visual_runs(0..3), vec![Run { range: 2..3, level: 1 }, Run { range: 0..2, level: 2 }]);
+    assert_eq!(p.visual_runs(3..5), vec![Run { range: 3..5, level: 2 }]);
+    // Line ranges that aren't char-boundary ranges of the text give nothing.
+    let p = Paragraph::new("سلام", Direction::Rtl);
+    assert!(p.visual_runs(1..2).is_empty());
+    assert!(p.line_levels(0..99).is_empty());
+    #[allow(clippy::reversed_empty_ranges)]
+    let backwards = 4..2;
+    assert!(p.visual_runs(backwards).is_empty());
+    assert!(p.visual_runs(2..2).is_empty());
+}
+
+#[test]
+fn l1_resets_trailing_whitespace_and_tabs() {
+    let chars: Vec<char> = "ab\tcd  ".chars().collect();
+    assert_eq!(line_levels(&chars, &[2; 7], 1), vec![2, 2, 1, 2, 2, 1, 1]);
+    assert_eq!(Paragraph::new("ab\tcd  ", Direction::Rtl).line_levels(0..7), vec![2, 2, 1, 2, 2, 1, 1]);
+    // Short level slices never panic.
+    assert_eq!(line_levels(&['a', 'b'], &[], 1), vec![1, 1]);
+}
+
+#[test]
+fn visual_order_follows_rule_l2() {
+    // The example from UAX #9 / unicode-bidi.
+    assert_eq!(visual_order(&[0, 0, 0, 1, 1, 1, 2, 2]), vec![0, 1, 2, 6, 7, 5, 4, 3]);
+    assert!(visual_order(&[]).is_empty());
+    assert_eq!(visual_order(&[0, 0]), vec![0, 1]);
+    assert_eq!(visual_order(&[1, 1, 1]), vec![2, 1, 0]);
+    // Numbers (level 2) inside right-to-left text keep their order.
+    assert_eq!(visual_order(&[1, 2, 2, 1]), vec![3, 1, 2, 0]);
+    assert_eq!(visual_order(&[125, 125]), vec![1, 0]);
+    assert_eq!(visual_order(&[255, 0, 255]), vec![0, 1, 2]);
+}
+
+#[test]
+fn overrides_force_a_direction() {
+    let p = Paragraph::with_overrides("abc def", Direction::Ltr, &[Override { range: 0..3, rtl: true }]);
+    assert_eq!(p.levels().len(), 7);
+    assert_eq!(shown(&p, 0..7), "cba def");
+    let s = "سلام دنیا";
+    let p = Paragraph::with_overrides(s, Direction::Rtl, &[Override { range: 0..at(s, 4), rtl: false }]);
+    assert_eq!(shown(&p, 0..s.len()), format!("{} سلام", rev("دنیا")));
+    // Overrides off char boundaries, empty, out of range or overlapping an earlier one are ignored.
+    let bad = [Override { range: 1..2, rtl: false }, Override { range: 3..3, rtl: false }, Override { range: 0..99, rtl: false }];
+    assert_eq!(Paragraph::with_overrides(s, Direction::Rtl, &bad).levels(), Paragraph::new(s, Direction::Rtl).levels());
+    let overlapping = [Override { range: 2..5, rtl: true }, Override { range: 0..3, rtl: true }];
+    assert_eq!(shown(&Paragraph::with_overrides("abcdef", Direction::Ltr, &overlapping), 0..6), "cbadef");
+}
+
+#[test]
+fn each_paragraph_has_its_own_level() {
+    // The second paragraph resolves right to left on its own, so rule L1 puts its trailing space at
+    // level 1: at the line's end edge, on the left.
+    let s = "a\nאב ";
+    let p = Paragraph::new(s, Direction::Auto);
+    assert_eq!(p.paragraphs(), &[(0..2, 0), (2..7, 1)]);
+    assert_eq!((p.level(), p.is_rtl()), (0, false), "level() is the first paragraph's");
+    assert_eq!((p.paragraph_level_at(1), p.paragraph_level_at(2), p.level_at(s.len())), (0, 1, 1));
+    assert_eq!(p.line_levels(2..7), vec![1; 5]);
+    assert_eq!(p.visual_runs(2..7), vec![Run { range: 2..7, level: 1 }]);
+    assert_eq!(p.line_levels(0..2), vec![0, 0]);
+    // Left-to-right text skips the algorithm but still splits paragraphs.
+    assert_eq!(Paragraph::new("ab\u{2029}c", Direction::Ltr).paragraphs(), &[(0..5, 0), (5..6, 0)]);
+    assert_eq!(Paragraph::new("", Direction::Auto).paragraphs(), &[(0..0, 0)]);
+}
+
+#[test]
+fn overrides_continue_across_paragraph_separators() {
+    let s = "ab\ncd";
+    let p = Paragraph::with_overrides(s, Direction::Ltr, &[Override { range: 0..5, rtl: true }]);
+    assert_eq!(p.paragraphs(), &[(0..3, 0), (3..5, 0)]);
+    assert_eq!(p.line_levels(0..3), vec![1, 1, 0], "the separator keeps the paragraph level");
+    assert_eq!(shown(&p, 0..3), "ba\n");
+    assert_eq!(shown(&p, 3..5), "dc");
+    // Each paragraph still resolves its own direction.
+    let s = "a\nאב ";
+    let p = Paragraph::with_overrides(s, Direction::Auto, &[Override { range: 0..1, rtl: false }]);
+    assert_eq!(p.paragraphs(), &[(0..2, 0), (2..7, 1)]);
+    assert_eq!(p.visual_runs(2..7), vec![Run { range: 2..7, level: 1 }]);
+}
+
+#[test]
+fn mirrored_characters() {
+    assert_eq!(mirror('('), Some(')'));
+    assert_eq!(mirror(']'), Some('['));
+    assert_eq!(mirror('«'), Some('»'));
+    assert_eq!(mirror('a'), None);
+    assert_eq!(mirror('∑'), None, "mirrored, but only by glyph");
+}
+
+#[test]
+fn hostile_text_never_panics() {
+    // Explicit embeddings, isolates, unmatched pops, marks with no base, deep nesting.
+    let rlo = "\u{202E}".repeat(200);
+    let junk = [
+        "\u{202B}\u{202B}\u{202C}\u{202C}\u{202C}abc\u{2067}سلام\u{2069}\u{2069}",
+        "\u{064E}\u{064E}\u{200C}\u{200D}",
+        "\u{200F}\u{200E}\t\u{200F}\n\u{200E}",
+        "(((((((((سلام]]]]]]]",
+        "a\u{2029}سلام\u{2029}b",
+        &rlo,
+    ];
+    for s in junk {
+        for base in [Direction::Ltr, Direction::Rtl, Direction::Auto] {
+            let overrides = [Override { range: 0..s.len() / 2, rtl: true }, Override { range: s.len() / 2..s.len(), rtl: false }];
+            for p in [Paragraph::new(s, base), Paragraph::with_overrides(s, base, &overrides)] {
+                assert_eq!(p.levels().len(), s.len());
+                let paras = p.paragraphs();
+                assert_eq!((paras.first().map(|p| p.0.start), paras.last().map(|p| p.0.end)), (Some(0), Some(s.len())), "{s:?}");
+                assert!(paras.windows(2).all(|w| w[0].0.end == w[1].0.start), "{s:?}");
+                let bounds: Vec<usize> = (0..=s.len()).filter(|&b| s.is_char_boundary(b)).collect();
+                for &b in &bounds {
+                    for line in [0..b, b..s.len()] {
+                        let runs = p.visual_runs(line.clone());
+                        assert_eq!(runs.iter().map(|r| r.range.len()).sum::<usize>(), line.len(), "{s:?} {line:?}");
+                        assert!(runs.iter().all(|r| !r.range.is_empty() && line.start <= r.range.start && r.range.end <= line.end));
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn runs_never_split_a_grapheme_cluster() {
+    use unicode_segmentation::UnicodeSegmentation;
+    let cases = [
+        // Arabic with harakat, among Latin and digits.
+        ("كَتَبَ abc مُحَمَّدٌ 123 بِسْمِ", Direction::Rtl),
+        ("see كَتَبَ, مُحَمَّدٌ here", Direction::Ltr),
+        // Hebrew with niqqud (and a dagesh-shin-dot stack).
+        ("שָׁלוֹם hello עוֹלָם", Direction::Rtl),
+        ("hello שָׁלוֹם world", Direction::Ltr),
+        // A Devanagari conjunct (virama, and an explicit half form with ZWJ) in right-to-left text.
+        ("سلام क्षत्रिय क्\u{200D}ष سلام", Direction::Rtl),
+        ("سلام क्\u{200D} ", Direction::Rtl),
+        // A combining mark after a Latin letter in a right-to-left paragraph, and after a Hebrew
+        // letter in a left-to-right one, each at a run edge.
+        ("שלום e\u{0301}te\u{0301} עולם", Direction::Rtl),
+        ("שלום cafe\u{0301}", Direction::Rtl),
+        ("café ש\u{05B8}\u{05BC} next", Direction::Ltr),
+        ("abc ש\u{05B8}", Direction::Ltr),
+        ("a\u{0301}\u{0302}ש", Direction::Auto),
+    ];
+    for (s, base) in cases {
+        let p = Paragraph::new(s, base);
+        let bounds: Vec<usize> = s.grapheme_indices(true).map(|(i, _)| i).chain([s.len()]).collect();
+        for &a in &bounds {
+            for &b in bounds.iter().filter(|&&b| b > a) {
+                for r in p.visual_runs(a..b) {
+                    assert!(bounds.contains(&r.range.start) && bounds.contains(&r.range.end), "{s:?} line {a}..{b}: run {r:?}");
+                }
+            }
+        }
+    }
+    // The char-level L1 keeps a trailing joiner with its conjunct too.
+    let s = "سلام क्\u{200D} ";
+    let chars: Vec<char> = s.chars().collect();
+    let l = line_levels(&chars, &Paragraph::new(s, Direction::Rtl).char_levels(), 1);
+    assert_eq!((l[6], l[7], l[8]), (2, 2, 1));
+}
diff --git a/crates/text/src/hyphen/dict.rs b/crates/text/src/hyphen/dict.rs
new file mode 100644
index 00000000..28b71a77
--- /dev/null
+++ b/crates/text/src/hyphen/dict.rs
@@ -0,0 +1,159 @@
+//! Hyphenation exception dictionary: lowercase words with their break points.
+//!
+//! On-disk format (`assets/en-us.dic`): raw-deflate of
+//! `"DCHYPH1\n"` followed by one line per word, sorted by the plain word's bytes. Each line is
+//! front-coded against the previous one: a byte with the shared prefix length (in bytes of the
+//! hyphenated form), then the rest of the hyphenated form (`-` at every break), then `\n`.
+
+/// Sorted word list with a break bitmask per word (bit `i` = hyphen before char `i`).
+#[derive(Clone, Debug, Default)]
+pub struct Dictionary {
+    words: String,
+    offs: Vec<u32>,
+    masks: Vec<u64>,
+}
+
+const MAGIC: &[u8] = b"DCHYPH1\n";
+
+impl Dictionary {
+    pub fn len(&self) -> usize {
+        self.masks.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.masks.is_empty()
+    }
+
+    fn word(&self, i: usize) -> &str {
+        &self.words[self.offs[i] as usize..self.offs[i + 1] as usize]
+    }
+
+    /// Break mask of an exact (already lowercased) word.
+    pub fn get(&self, word: &str) -> Option<u64> {
+        let (mut lo, mut hi) = (0usize, self.len());
+        while lo < hi {
+            let mid = (lo + hi) / 2;
+            match self.word(mid).as_bytes().cmp(word.as_bytes()) {
+                std::cmp::Ordering::Less => lo = mid + 1,
+                std::cmp::Ordering::Greater => hi = mid,
+                std::cmp::Ordering::Equal => return Some(self.masks[mid]),
+            }
+        }
+        None
+    }
+
+    /// Iterate `(word, mask)`.
+    pub fn iter(&self) -> impl Iterator<Item = (&str, u64)> + '_ {
+        (0..self.len()).map(|i| (self.word(i), self.masks[i]))
+    }
+
+    /// Deserialize data written by `Dictionary::to_bytes`.
+    pub(crate) fn decode(data: &[u8]) -> Result<Dictionary, String> {
+        let raw = miniz_oxide::inflate::decompress_to_vec(data).map_err(|e| format!("hyphenation dictionary: inflate failed: {e:?}"))?;
+        let body = raw.strip_prefix(MAGIC).ok_or("hyphenation dictionary: bad header")?;
+        let mut d = Dictionary { words: String::with_capacity(body.len()), offs: vec![0], masks: Vec::new() };
+        let mut cur: Vec<u8> = Vec::new();
+        let mut i = 0;
+        while i < body.len() {
+            let p = body[i] as usize;
+            let end = body[i + 1..].iter().position(|&b| b == b'\n').map(|e| i + 1 + e).ok_or("hyphenation dictionary: truncated")?;
+            if p > cur.len() {
+                return Err("hyphenation dictionary: bad prefix".into());
+            }
+            cur.truncate(p);
+            cur.extend_from_slice(&body[i + 1..end]);
+            i = end + 1;
+            let s = std::str::from_utf8(&cur).map_err(|_| "hyphenation dictionary: bad utf-8")?;
+            let (w, m) = parse_hyphenated(s);
+            d.words.push_str(&w);
+            d.offs.push(d.words.len() as u32);
+            d.masks.push(m);
+        }
+        Ok(d)
+    }
+}
+
+#[cfg(any(test, feature = "generator"))]
+impl Dictionary {
+    /// Build from `(lowercase word, break mask)` pairs (sorted and de-duplicated here; the first
+    /// entry of a duplicate wins).
+    pub fn from_entries(mut entries: Vec<(String, u64)>) -> Dictionary {
+        entries.sort_by(|a, b| a.0.as_bytes().cmp(b.0.as_bytes()));
+        entries.dedup_by(|b, a| a.0 == b.0);
+        let mut d = Dictionary { words: String::new(), offs: vec![0], masks: Vec::with_capacity(entries.len()) };
+        for (w, m) in entries {
+            d.words.push_str(&w);
+            d.offs.push(d.words.len() as u32);
+            d.masks.push(m);
+        }
+        d
+    }
+
+    /// Serialize (deflate-compressed).
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let mut raw = MAGIC.to_vec();
+        let mut prev: Vec<u8> = Vec::new();
+        for (w, m) in self.iter() {
+            let h = hyphenated(w, m).into_bytes();
+            let p = prev.iter().zip(&h).take_while(|(a, b)| a == b).count().min(255);
+            raw.push(p as u8);
+            raw.extend_from_slice(&h[p..]);
+            raw.push(b'\n');
+            prev = h;
+        }
+        miniz_oxide::deflate::compress_to_vec(&raw, 10)
+    }
+
+    /// Deserialize data written by [`Dictionary::to_bytes`].
+    pub fn from_bytes(data: &[u8]) -> Result<Dictionary, String> {
+        Dictionary::decode(data)
+    }
+}
+
+/// `word` with `-` before every char whose bit is set in `mask`.
+#[cfg(any(test, feature = "generator"))]
+pub fn hyphenated(word: &str, mask: u64) -> String {
+    let mut s = String::with_capacity(word.len() + 8);
+    for (i, c) in word.chars().enumerate() {
+        if i > 0 && i < 64 && mask & (1 << i) != 0 {
+            s.push('-');
+        }
+        s.push(c);
+    }
+    s
+}
+
+/// A word written with `-` at its breaks, as `(word, break mask)`.
+pub fn parse_hyphenated(s: &str) -> (String, u64) {
+    let mut w = String::with_capacity(s.len());
+    let mut m = 0u64;
+    let mut n = 0;
+    for c in s.chars() {
+        if c == '-' {
+            if n > 0 && n < 64 {
+                m |= 1 << n;
+            }
+        } else {
+            w.push(c);
+            n += 1;
+        }
+    }
+    (w, m)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn roundtrip() {
+        let e: Vec<(String, u64)> = ["ty-pog-ra-phy", "cat", "hap-pen", "o'clock", "naïve-té", "naïve"].iter().map(|s| parse_hyphenated(s)).collect();
+        let d = Dictionary::from_entries(e);
+        let back = Dictionary::from_bytes(&d.to_bytes()).unwrap();
+        assert_eq!(back.len(), 6);
+        assert_eq!(back.get("typography").map(|m| hyphenated("typography", m)), Some("ty-pog-ra-phy".to_string()));
+        assert_eq!(back.get("cat"), Some(0));
+        assert_eq!(back.get("naïveté").map(|m| hyphenated("naïveté", m)), Some("naïve-té".to_string()));
+        assert!(back.get("dog").is_none());
+    }
+}
diff --git a/crates/text/src/hyphen/mod.rs b/crates/text/src/hyphen/mod.rs
new file mode 100644
index 00000000..76d1416f
--- /dev/null
+++ b/crates/text/src/hyphen/mod.rs
@@ -0,0 +1,509 @@
+//! Hyphenation points for text layout. English uses the bundled dictionary and patterns below.
+//! Other languages use the Liang patterns compiled into [`hypher`], one cargo feature per
+//! language (`spanish`, `german`, …, or `all-languages`); their licenses are listed in NOTICE.
+//!
+//! English lookup order for each word:
+//! 1. the **dictionary** ([`Dictionary::en_us`]) — the public-domain Moby Hyphenator II word list
+//!    by Grady Ward (~160k words), stored compactly in `assets/hyphen/en-us.dic`; simple
+//!    inflections (`'s`, `-s`, `-es`, `-ed`, `-d`) inherit the breaks of their stem;
+//! 2. **Liang patterns** (`assets/hyphen/en-us.pat`) for words not in the dictionary — our own
+//!    pattern set, trained from the same list by the patgen-style trainer behind the `generator`
+//!    feature (`examples/hyphgen.rs` regenerates both files);
+//! 3. a small syllable **heuristic** for words outside the pattern alphabet.
+//!
+//! Then the paragraph's limits ([`Limits`]) are applied.
+
+#[cfg(feature = "generator")]
+pub mod dict;
+#[cfg(not(feature = "generator"))]
+mod dict;
+#[cfg(feature = "generator")]
+pub mod patgen;
+mod patterns;
+
+use std::sync::OnceLock;
+
+pub use dict::Dictionary;
+#[cfg(feature = "generator")]
+pub use patterns::Patterns;
+#[cfg(not(feature = "generator"))]
+use patterns::Patterns;
+
+static EN_US_DIC: &[u8] = include_bytes!("../../assets/hyphen/en-us.dic");
+static EN_US_PAT: &str = include_str!("../../assets/hyphen/en-us.pat");
+
+impl Dictionary {
+    /// The bundled US English dictionary (decoded on first use; empty if the data is corrupt).
+    pub fn en_us() -> &'static Dictionary {
+        static D: OnceLock<Dictionary> = OnceLock::new();
+        D.get_or_init(|| Dictionary::decode(EN_US_DIC).unwrap_or_default())
+    }
+}
+
+impl Patterns {
+    /// The bundled US English patterns (parsed on first use).
+    pub fn en_us() -> &'static Patterns {
+        static P: OnceLock<Patterns> = OnceLock::new();
+        P.get_or_init(|| Patterns::parse(EN_US_PAT))
+    }
+}
+
+/// Hyphenation limits from the paragraph's Hyphenation settings.
+#[derive(Clone, Copy, Debug)]
+pub struct Limits {
+    pub min_word: usize,
+    pub after_first: usize,
+    pub before_last: usize,
+    pub capitalized: bool,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Limits { min_word: 5, after_first: 2, before_last: 2, capitalized: true }
+    }
+}
+
+/// The hyphenator for a run of text.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Lang {
+    /// The bundled dictionary, patterns and heuristic.
+    English,
+    /// Patterns compiled into [`hypher`] (one cargo feature per language).
+    Patterns(PatternLang),
+}
+
+/// A language whose patterns are compiled into [`hypher`]; obtained from [`Lang::for_language`].
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub struct PatternLang(hypher::Lang);
+
+/// English names of every language hypher can hyphenate, with their ISO 639-1 codes. Languages
+/// whose cargo feature is off are not compiled into hypher, so `from_iso` returns None for them.
+const LANGUAGES: &[(&str, [u8; 2])] = &[
+    ("afrikaans", *b"af"),
+    ("albanian", *b"sq"),
+    ("assamese", *b"as"),
+    ("belarusian", *b"be"),
+    ("bengali", *b"bn"),
+    ("bangla", *b"bn"),
+    ("bulgarian", *b"bg"),
+    ("catalan", *b"ca"),
+    ("croatian", *b"hr"),
+    ("czech", *b"cs"),
+    ("danish", *b"da"),
+    ("dutch", *b"nl"),
+    ("estonian", *b"et"),
+    ("finnish", *b"fi"),
+    ("french", *b"fr"),
+    ("galician", *b"gl"),
+    ("georgian", *b"ka"),
+    ("german", *b"de"),
+    ("greek", *b"el"),
+    ("gujarati", *b"gu"),
+    ("hindi", *b"hi"),
+    ("hungarian", *b"hu"),
+    ("icelandic", *b"is"),
+    ("italian", *b"it"),
+    ("kannada", *b"kn"),
+    ("kurmanji", *b"ku"),
+    ("latin", *b"la"),
+    ("lithuanian", *b"lt"),
+    ("malayalam", *b"ml"),
+    ("marathi", *b"mr"),
+    ("mongolian", *b"mn"),
+    ("norwegian", *b"no"),
+    ("bokmål", *b"nb"),
+    ("bokmal", *b"nb"),
+    ("nynorsk", *b"nn"),
+    ("oriya", *b"or"),
+    ("odia", *b"or"),
+    ("panjabi", *b"pa"),
+    ("punjabi", *b"pa"),
+    ("polish", *b"pl"),
+    ("portuguese", *b"pt"),
+    ("russian", *b"ru"),
+    ("sanskrit", *b"sa"),
+    ("serbian", *b"sr"),
+    ("slovak", *b"sk"),
+    ("slovenian", *b"sl"),
+    ("slovene", *b"sl"),
+    ("spanish", *b"es"),
+    ("castilian", *b"es"),
+    ("swedish", *b"sv"),
+    ("tamil", *b"ta"),
+    ("telugu", *b"te"),
+    ("turkish", *b"tr"),
+    ("turkmen", *b"tk"),
+    ("ukrainian", *b"uk"),
+];
+
+impl Lang {
+    /// The hyphenator for a language name or locale code: an English name as InDesign and IDML
+    /// write it ("Spanish", "German: 2006 Reform", "$ID/Norwegian: Bokmal"), or a locale code
+    /// (`es`, `es_ES`, `pt-BR`, `de_DE_2006`). Case and punctuation don't matter. None when the
+    /// language is unknown or its cargo feature is off.
+    pub fn for_language(language: &str) -> Option<Lang> {
+        if language.starts_with("English") {
+            return Some(Lang::English);
+        }
+        let language = language.trim();
+        let language = language.strip_prefix("$ID/").unwrap_or(language);
+        let l = language.to_lowercase();
+        let words: Vec<&str> = l.split(|c: char| !c.is_alphanumeric()).filter(|w| !w.is_empty()).collect();
+        let first = *words.first()?;
+        let code = match locale_language(&words) {
+            Some((code, script)) => {
+                let code = <[u8; 2]>::try_from(code.as_bytes()).ok()?;
+                // Patterns for one script find nothing in another: `sr-Latn` has none.
+                if script.is_some_and(|script| script != pattern_script(code)) {
+                    return None;
+                }
+                if code == *b"en" {
+                    return Some(Lang::English);
+                }
+                code
+            }
+            None if first == "english" => return Some(Lang::English),
+            None => LANGUAGES.iter().find(|(name, _)| *name == first)?.1,
+        };
+        hypher::Lang::from_iso(code).map(|l| Lang::Patterns(PatternLang(l)))
+    }
+}
+
+/// The script of hypher's patterns for the language `code`, lowercase, as its documentation
+/// lists them.
+fn pattern_script(code: [u8; 2]) -> &'static str {
+    match &code {
+        b"as" | b"bn" => "beng",
+        b"be" | b"bg" | b"mn" | b"ru" | b"sr" | b"uk" => "cyrl",
+        b"hi" | b"mr" | b"sa" => "deva",
+        b"ka" => "geor",
+        b"el" => "grek",
+        b"gu" => "gujr",
+        b"pa" => "guru",
+        b"kn" => "knda",
+        b"ml" => "mlym",
+        b"or" => "orya",
+        b"ta" => "taml",
+        b"te" => "telu",
+        _ => "latn",
+    }
+}
+
+/// The language and script of a locale code split into lowercase `words`: a language (2 or 3
+/// letters), then optionally a script (4 letters), a region (2 letters or 3 digits) and a reform
+/// year (4 digits), in that order.
+fn locale_language<'a>(words: &[&'a str]) -> Option<(&'a str, Option<&'a str>)> {
+    fn letters(w: &str, n: std::ops::RangeInclusive<usize>) -> bool {
+        n.contains(&w.len()) && w.bytes().all(|b| b.is_ascii_lowercase())
+    }
+    fn digits(w: &str, n: usize) -> bool {
+        w.len() == n && w.bytes().all(|b| b.is_ascii_digit())
+    }
+    let (&lang, mut rest) = words.split_first()?;
+    if !letters(lang, 2..=3) {
+        return None;
+    }
+    let script = rest.first().copied().filter(|w| letters(w, 4..=4));
+    if script.is_some() {
+        rest = &rest[1..];
+    }
+    let region = |w: &str| letters(w, 2..=2) || digits(w, 3);
+    let year = |w: &str| digits(w, 4);
+    for subtag in [region as fn(&str) -> bool, year] {
+        if let Some((&w, tail)) = rest.split_first()
+            && subtag(w)
+        {
+            rest = tail;
+        }
+    }
+    rest.is_empty().then_some((lang, script))
+}
+
+/// Where a word's break points came from.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Source {
+    Dictionary,
+    Patterns,
+    Heuristic,
+    None,
+}
+
+fn is_apostrophe(c: char) -> bool {
+    matches!(c, '\'' | '’' | 'ʼ')
+}
+
+/// Letters, apostrophes, and the combining marks and joiners inside a word: a virama or a
+/// decomposed accent doesn't split it.
+fn is_word_char(c: char) -> bool {
+    c.is_alphabetic() || is_apostrophe(c) || is_mark(c) || is_joiner(c)
+}
+
+/// A combining mark (general category M): it belongs to the letter before it.
+fn is_mark(c: char) -> bool {
+    use unicode_general_category::{GeneralCategory, get_general_category};
+    matches!(get_general_category(c), GeneralCategory::NonspacingMark | GeneralCategory::SpacingMark | GeneralCategory::EnclosingMark)
+}
+
+/// Zero-width joiner and non-joiner, which shape the letters on both sides.
+fn is_joiner(c: char) -> bool {
+    matches!(c, '\u{200C}' | '\u{200D}')
+}
+
+/// Unrestricted break points of one lowercase core (letters and `'` only, no leading/trailing `'`).
+fn core_breaks(core: &[char], lang: Lang) -> (Vec<usize>, Source) {
+    let n = core.len();
+    if n < 2 {
+        return (vec![], Source::None);
+    }
+    if let Lang::Patterns(PatternLang(l)) = lang {
+        // The whole core, apostrophes included: French, Italian and Catalan patterns encode
+        // elisions (`l'or-ga-ni-sa-tion`, `del-l'am-mi-ni-stra-zio-ne`).
+        let s: String = core.iter().collect();
+        let mut out = Vec::new();
+        let mut at = 0;
+        let syl: Vec<&str> = hypher::hyphenate_bounded(&s, l, 1, 1).collect();
+        if let Some((_, init)) = syl.split_last() {
+            for part in init {
+                at += part.chars().count();
+                out.push(at);
+            }
+        }
+        return (out, Source::Patterns);
+    }
+    let dict = Dictionary::en_us();
+    let s: String = core.iter().collect();
+    let from_mask = |m: u64, len: usize| (1..len.min(64)).filter(|&i| m & (1 << i) != 0).collect::<Vec<_>>();
+    if let Some(m) = dict.get(&s) {
+        return (from_mask(m, n), Source::Dictionary);
+    }
+    // Inflections inherit the stem's breaks (the suffix adds no break of its own).
+    for suf in ["'s", "s", "es", "ed", "d"] {
+        if let Some(stem) = s.strip_suffix(suf)
+            && stem.chars().count() >= 2
+            && let Some(m) = dict.get(stem)
+        {
+            return (from_mask(m, stem.chars().count()), Source::Dictionary);
+        }
+    }
+    let pats = Patterns::en_us();
+    if !pats.is_empty()
+        && let Some(p) = pats.points(core)
+    {
+        return (p, Source::Patterns);
+    }
+    (heuristic_points(core), Source::Heuristic)
+}
+
+/// Unrestricted break points of `word` as byte offsets (a hyphen goes before the char that starts
+/// there), handling case, apostrophes (`don't`, `’s`), surrounding punctuation and compounds (each
+/// letter run is hyphenated separately). No break is ever placed next to an apostrophe or
+/// non-letter, before a combining mark or next to a joiner; marks and joiners don't end a run.
+pub fn word_breaks(word: &str) -> (Vec<usize>, Source) {
+    word_breaks_in(word, Lang::English)
+}
+
+/// [`word_breaks`] for a language.
+pub fn word_breaks_in(word: &str, lang: Lang) -> (Vec<usize>, Source) {
+    let (pts, src) = char_breaks(word, lang);
+    (byte_offsets(word, pts), src)
+}
+
+/// Char indices into `word` as byte offsets.
+fn byte_offsets(word: &str, pts: Vec<usize>) -> Vec<usize> {
+    let starts: Vec<usize> = word.char_indices().map(|(b, _)| b).collect();
+    pts.into_iter().filter_map(|p| starts.get(p).copied()).collect()
+}
+
+/// [`word_breaks_in`] as char indices.
+fn char_breaks(word: &str, lang: Lang) -> (Vec<usize>, Source) {
+    let chars: Vec<char> = word.chars().collect();
+    let mut out = Vec::new();
+    let mut src = Source::None;
+    let mut i = 0;
+    while i < chars.len() {
+        if !is_word_char(chars[i]) {
+            i += 1;
+            continue;
+        }
+        let mut j = i;
+        while j < chars.len() && is_word_char(chars[j]) {
+            j += 1;
+        }
+        let (mut a, mut b) = (i, j);
+        while a < b && is_apostrophe(chars[a]) {
+            a += 1;
+        }
+        while b > a && is_apostrophe(chars[b - 1]) {
+            b -= 1;
+        }
+        let core: Vec<char> = chars[a..b].iter().map(|&c| if is_apostrophe(c) { '\'' } else { c.to_lowercase().next().unwrap_or(c) }).collect();
+        let (pts, s) = core_breaks(&core, lang);
+        if src == Source::None {
+            src = s;
+        }
+        // Never before a mark or next to a joiner: that would split a shaping cluster.
+        let allowed = |p: usize| match (core.get(p.wrapping_sub(1)), core.get(p)) {
+            (Some(&x), Some(&y)) => x != '\'' && y != '\'' && !is_mark(y) && !is_joiner(x) && !is_joiner(y),
+            _ => false,
+        };
+        out.extend(pts.into_iter().filter(|&p| p > 0 && allowed(p)).map(|p| a + p));
+        i = j;
+    }
+    (out, src)
+}
+
+/// Allowed hyphenation points in `word` as byte offsets (a hyphen goes before the char that
+/// starts there), with the paragraph limits applied to each letter run.
+pub fn hyphen_points(word: &str, lim: &Limits) -> Vec<usize> {
+    hyphen_points_in(word, lim, Lang::English)
+}
+
+/// [`hyphen_points`] for a language.
+pub fn hyphen_points_in(word: &str, lim: &Limits, lang: Lang) -> Vec<usize> {
+    byte_offsets(word, char_points(word, lim, lang))
+}
+
+/// [`hyphen_points_in`] as char indices.
+fn char_points(word: &str, lim: &Limits, lang: Lang) -> Vec<usize> {
+    let chars: Vec<char> = word.chars().collect();
+    let (pts, _) = char_breaks(word, lang);
+    if pts.is_empty() {
+        return pts;
+    }
+    let min_before = lim.after_first.max(1);
+    let min_after = lim.before_last.max(1);
+    // Counted once, so each point's checks take constant time however long the word: letters and
+    // uppercase letters before each char, and the letter run (trimmed of apostrophes) of each char.
+    let (mut letters, mut upper) = (Vec::with_capacity(chars.len() + 1), Vec::with_capacity(chars.len() + 1));
+    let (mut l, mut u) = (0usize, 0usize);
+    for c in &chars {
+        letters.push(l);
+        upper.push(u);
+        if c.is_alphabetic() {
+            l += 1;
+            u += usize::from(c.is_uppercase());
+        }
+    }
+    letters.push(l);
+    upper.push(u);
+    let mut run_of: Vec<(usize, usize)> = vec![(0, 0); chars.len()];
+    let mut i = 0;
+    while i < chars.len() {
+        let mut j = i;
+        while chars.get(j).is_some_and(|c| is_word_char(*c)) {
+            j += 1;
+        }
+        let (mut a, mut b) = (i, j);
+        while a < b && chars.get(a).is_some_and(|c| is_apostrophe(*c)) {
+            a += 1;
+        }
+        while b > a && chars.get(b - 1).is_some_and(|c| is_apostrophe(*c)) {
+            b -= 1;
+        }
+        for r in run_of.get_mut(i..j).into_iter().flatten() {
+            *r = (a, b);
+        }
+        i = j.max(i + 1);
+    }
+    let count = |v: &[usize], a: usize, b: usize| v.get(b).zip(v.get(a)).map_or(0, |(y, x)| y.saturating_sub(*x));
+    pts.into_iter()
+        .filter(|&p| {
+            // A point lies between two letters of one run; the char after it gives the run.
+            let Some(&(a, b)) = run_of.get(p) else { return false };
+            let n = count(&letters, a, b);
+            if n < lim.min_word.max(2) {
+                return false;
+            }
+            if n > 1 && count(&upper, a, b) == n {
+                return false;
+            }
+            if !lim.capitalized && chars.get(a).is_some_and(|c| c.is_uppercase()) {
+                return false;
+            }
+            count(&letters, a, p) >= min_before && count(&letters, p, b) >= min_after
+        })
+        .collect()
+}
+
+/// `word` with `-` at every hyphenation point (tests and diagnostics).
+pub fn hyphenate_word(word: &str, lim: &Limits) -> String {
+    let pts = hyphen_points(word, lim);
+    let mut s = String::with_capacity(word.len() + pts.len());
+    for (i, ch) in word.char_indices() {
+        if pts.contains(&i) {
+            s.push('-');
+        }
+        s.push(ch);
+    }
+    s
+}
+
+// ---------- heuristic fallback (words outside the pattern alphabet) ----------
+
+fn is_vowel(c: char) -> bool {
+    matches!(c.to_ascii_lowercase(), 'a' | 'e' | 'i' | 'o' | 'u' | 'y') || (c.is_alphabetic() && !c.is_ascii())
+}
+
+fn onset_pair(a: char, b: char) -> bool {
+    let (a, b) = (a.to_ascii_lowercase(), b.to_ascii_lowercase());
+    matches!(
+        (a, b),
+        ('c' | 's' | 't' | 'p' | 'w' | 'g', 'h')
+            | ('b' | 'c' | 'd' | 'f' | 'g' | 'k' | 'p' | 't', 'r')
+            | ('b' | 'c' | 'f' | 'g' | 'k' | 'p' | 's', 'l')
+            | ('q', 'u')
+            | ('s', 't' | 'p' | 'c' | 'k')
+    )
+}
+
+/// Syllable heuristic: V-CV ("ty-po"), VC-CV ("hap-pen"), keeping onset clusters ("gra-phy").
+fn heuristic_points(c: &[char]) -> Vec<usize> {
+    let n = c.len();
+    if n < 4 || !c.iter().all(|c| c.is_alphabetic()) {
+        return vec![];
+    }
+    let v: Vec<bool> = c.iter().map(|&x| is_vowel(x)).collect();
+    // Both parts need a sounded vowel: a trailing silent `e`, `ed` or `es` doesn't count. The part
+    // after `i` is `c[i..end]`, `end` before that ending; computed once, so each point is O(1).
+    let end = |i: usize| {
+        if n - i >= 2 && (c.ends_with(&['e', 'd']) || c.ends_with(&['e', 's'])) {
+            n - 2
+        } else if c.ends_with(&['e']) {
+            n - 1
+        } else {
+            n
+        }
+    };
+    // UTF-8 bytes before each char, and the first vowel at or after each char.
+    let mut bytes = Vec::with_capacity(n + 1);
+    let mut acc = 0usize;
+    for ch in c {
+        bytes.push(acc);
+        acc += ch.len_utf8();
+    }
+    bytes.push(acc);
+    let mut next_vowel = vec![n; n + 1];
+    for i in (0..n).rev() {
+        next_vowel[i] = if v[i] { i } else { next_vowel[i + 1] };
+    }
+    let mut out = vec![];
+    let mut vowel_before = false;
+    for i in 1..n {
+        vowel_before |= v[i - 1];
+        let ok = if v[i - 1] && !v[i] {
+            (i + 1 < n && v[i + 1]) || (i + 2 < n && onset_pair(c[i], c[i + 1]) && v[i + 2])
+        } else if !v[i - 1] && !v[i] {
+            i >= 2 && v[i - 2] && i + 1 < n && v[i + 1] && !onset_pair(c[i - 1], c[i]) && c[i - 1] != c[i] || (c[i - 1] == c[i] && i >= 2 && v[i - 2])
+        } else {
+            false
+        };
+        let e = end(i);
+        if ok && next_vowel[i] < e && bytes[e] - bytes[i] > 1 && vowel_before {
+            out.push(i);
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/text/src/hyphen/patgen.rs b/crates/text/src/hyphen/patgen.rs
new file mode 100644
index 00000000..eea88b2a
--- /dev/null
+++ b/crates/text/src/hyphen/patgen.rs
@@ -0,0 +1,251 @@
+//! A small patgen-style trainer (ours): learns Liang hyphenation patterns from a hyphenated word
+//! list, level by level. Odd levels add hyphenating patterns, even levels add inhibiting ones.
+//!
+//! At level `L`, for every pattern length, each inter-letter position whose current value is
+//! below `L` is classified as *good* (applying value `L` would fix it) or *bad* (it would break a
+//! position that is currently right). A candidate (letters + value position) is selected when
+//! `good·good_weight − bad·bad_weight ≥ threshold`; selected patterns are applied to every word
+//! before the next length is considered. Used offline by `examples/hyphgen.rs`.
+
+use super::patterns::{Alphabet, FxMap, MAX_PATTERN_LEN, Patterns, apply, pack};
+
+/// Parameters of one level.
+#[derive(Clone, Copy, Debug)]
+pub struct Level {
+    pub min_len: usize,
+    pub max_len: usize,
+    pub good_weight: u32,
+    pub bad_weight: u32,
+    pub threshold: u32,
+}
+
+/// Defaults tuned on the Moby list (see `examples/hyphgen.rs`).
+pub const DEFAULT_LEVELS: &[Level] = &[
+    Level { min_len: 1, max_len: 4, good_weight: 1, bad_weight: 2, threshold: 20 },
+    Level { min_len: 2, max_len: 5, good_weight: 2, bad_weight: 1, threshold: 8 },
+    Level { min_len: 3, max_len: 6, good_weight: 1, bad_weight: 4, threshold: 7 },
+    Level { min_len: 3, max_len: 7, good_weight: 3, bad_weight: 2, threshold: 2 },
+    Level { min_len: 4, max_len: 8, good_weight: 1, bad_weight: 20, threshold: 6 },
+    Level { min_len: 4, max_len: 8, good_weight: 3, bad_weight: 1, threshold: 2 },
+];
+
+struct Word {
+    /// Padded codes: boundary, letters…, boundary.
+    codes: Vec<u8>,
+    /// Correct hyphen before padded char `p`.
+    hyph: Vec<bool>,
+    vals: Vec<u8>,
+}
+
+/// Accuracy of a pattern set over a word list.
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub struct Score {
+    pub words: usize,
+    pub breaks: usize,
+    pub found: usize,
+    pub wrong: usize,
+}
+
+impl Score {
+    pub fn missed(&self) -> usize {
+        self.breaks.saturating_sub(self.found)
+    }
+}
+
+/// Train patterns from `(lowercase word, break char indices)` pairs. `log` receives progress lines.
+pub fn train(words: &[(Vec<char>, Vec<usize>)], levels: &[Level], log: &mut dyn FnMut(String)) -> Patterns {
+    let mut alpha = Alphabet::default();
+    let mut data: Vec<Word> = Vec::with_capacity(words.len());
+    'w: for (w, br) in words {
+        let mut codes = Vec::with_capacity(w.len() + 2);
+        codes.push(1);
+        for &c in w {
+            let Some(k) = alpha.intern(c) else { continue 'w };
+            codes.push(k);
+        }
+        codes.push(1);
+        let mut hyph = vec![false; codes.len() + 1];
+        for &b in br {
+            if b > 0 && b < w.len() {
+                hyph[b + 1] = true;
+            }
+        }
+        let vals = vec![0; codes.len() + 1];
+        data.push(Word { codes, hyph, vals });
+    }
+    let mut pats: FxMap<u64, Box<[u8]>> = FxMap::default();
+    let mut max_len = 0usize;
+    for (li, lv) in levels.iter().enumerate() {
+        let level = (li + 1) as u8;
+        let hyphenating = level % 2 == 1;
+        for len in lv.min_len..=lv.max_len.min(MAX_PATTERN_LEN) {
+            // (packed letters | dot) → (good, bad)
+            let mut counts: FxMap<u64, (u32, u32)> = FxMap::default();
+            for w in &data {
+                let n = w.codes.len();
+                // Positions strictly between the word's letters.
+                for p in 2..n - 1 {
+                    let v = w.vals[p];
+                    if v >= level {
+                        continue;
+                    }
+                    let (good, bad) = if hyphenating {
+                        (w.hyph[p] && v % 2 == 0, !w.hyph[p] && v % 2 == 0)
+                    } else {
+                        (!w.hyph[p] && v % 2 == 1, w.hyph[p] && v % 2 == 1)
+                    };
+                    if !good && !bad {
+                        continue;
+                    }
+                    for dot in 0..=len {
+                        if p < dot || p - dot + len > n {
+                            continue;
+                        }
+                        let s = p - dot;
+                        let key = pack(&w.codes[s..s + len]) | ((dot as u64) << 54);
+                        let e = counts.entry(key).or_default();
+                        if good {
+                            e.0 += 1;
+                        } else {
+                            e.1 += 1;
+                        }
+                    }
+                }
+            }
+            // Select.
+            let mut new: FxMap<u64, Box<[u8]>> = FxMap::default();
+            let mut selected = 0usize;
+            for (key, (g, b)) in counts {
+                // Widened first: u32 × u32 fills a u64, and the difference needs a sign.
+                let score = i128::from(g) * i128::from(lv.good_weight) - i128::from(b) * i128::from(lv.bad_weight);
+                if g > 0 && score >= i128::from(lv.threshold) {
+                    let dot = ((key >> 54) & 15) as usize;
+                    let letters = key & !(15u64 << 54);
+                    let e = new.entry(letters).or_insert_with(|| vec![0u8; len + 1].into_boxed_slice());
+                    e[dot] = level;
+                    selected += 1;
+                }
+            }
+            if selected == 0 {
+                continue;
+            }
+            for w in &mut data {
+                apply(&new, len, &w.codes, &mut w.vals);
+            }
+            for (k, v) in new {
+                let e = pats.entry(k).or_insert_with(|| vec![0u8; len + 1].into_boxed_slice());
+                for (a, b) in e.iter_mut().zip(v.iter()) {
+                    *a = (*a).max(*b);
+                }
+            }
+            max_len = max_len.max(len);
+            let sc = score_vals(&data);
+            log(format!("level {level} len {len}: +{selected} patterns ({} total); found {}/{} wrong {}", pats.len(), sc.found, sc.breaks, sc.wrong));
+        }
+    }
+    // Re-express through the public pattern type (TeX strings) so the alphabet matches at runtime.
+    let tmp = Patterns::from_parts(alpha, pats, max_len);
+    let mut out = Patterns::default();
+    out.add_letters(words.iter().flat_map(|w| w.0.iter().copied()));
+    for t in tmp.to_tex() {
+        out.insert(&t);
+    }
+    out
+}
+
+fn score_vals(data: &[Word]) -> Score {
+    let mut s = Score { words: data.len(), ..Default::default() };
+    for w in data {
+        for p in 2..w.codes.len() - 1 {
+            let on = w.vals[p] % 2 == 1;
+            if w.hyph[p] {
+                s.breaks += 1;
+                if on {
+                    s.found += 1;
+                }
+            } else if on {
+                s.wrong += 1;
+            }
+        }
+    }
+    s
+}
+
+/// Score `pats` against a word list.
+pub fn score(pats: &Patterns, words: &[(Vec<char>, Vec<usize>)]) -> Score {
+    let mut s = Score::default();
+    for (w, br) in words {
+        let Some(pts) = pats.points(w) else { continue };
+        s.words += 1;
+        s.breaks += br.len();
+        for p in &pts {
+            if br.contains(p) {
+                s.found += 1;
+            } else {
+                s.wrong += 1;
+            }
+        }
+    }
+    s
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn w(s: &str) -> (Vec<char>, Vec<usize>) {
+        let mut chars = Vec::new();
+        let mut br = Vec::new();
+        for c in s.chars() {
+            if c == '-' {
+                br.push(chars.len());
+            } else {
+                chars.push(c);
+            }
+        }
+        (chars, br)
+    }
+
+    /// Weights near `u32::MAX` select the pattern instead of overflowing.
+    #[test]
+    fn large_weights_do_not_overflow() {
+        let words = vec![(vec!['a', 'b'], vec![1]); 2];
+        let levels = [Level { min_len: 1, max_len: 1, good_weight: 1 << 31, bad_weight: 1, threshold: 1 }];
+        let patterns = train(&words, &levels, &mut |_| {});
+        assert_eq!(patterns.points(&['a', 'b']), Some(vec![1]));
+    }
+
+    #[test]
+    fn learns_a_tiny_list() {
+        let list: Vec<_> = [
+            "hap-pen",
+            "hap-pens",
+            "hap-pened",
+            "pen-cil",
+            "pen-cils",
+            "rab-bit",
+            "rab-bits",
+            "kit-ten",
+            "kit-tens",
+            "but-ter",
+            "bet-ter",
+            "let-ter",
+            "lit-ter",
+            "sit-ter",
+        ]
+        .iter()
+        .map(|s| w(s))
+        .collect();
+        let levels = [
+            Level { min_len: 1, max_len: 4, good_weight: 1, bad_weight: 1, threshold: 2 },
+            Level { min_len: 1, max_len: 5, good_weight: 1, bad_weight: 1, threshold: 1 },
+        ];
+        let p = train(&list, &levels, &mut |_| {});
+        let sc = score(&p, &list);
+        assert_eq!(sc.breaks, list.len());
+        assert!(sc.found >= sc.breaks - 1, "{sc:?}");
+        assert!(sc.wrong <= 1, "{sc:?}");
+        // Generalises to an unseen word with the same shape.
+        assert_eq!(p.points(&"bitter".chars().collect::<Vec<_>>()).unwrap(), vec![3]);
+    }
+}
diff --git a/crates/text/src/hyphen/patterns.rs b/crates/text/src/hyphen/patterns.rs
new file mode 100644
index 00000000..a5dff954
--- /dev/null
+++ b/crates/text/src/hyphen/patterns.rs
@@ -0,0 +1,241 @@
+//! Liang hyphenation patterns (TeX notation, e.g. `.ab1c`, `4t1ion`): parsing and application.
+//!
+//! The bundled English set is *ours*: trained from the public-domain Moby Hyphenator word list by
+//! the crate's patgen-style trainer (see `examples/hyphgen.rs`). Patterns are stored in a hash map keyed by the
+//! packed letter string, so applying them to a word costs `O(len × max_pattern_len)` lookups.
+
+use std::collections::HashMap;
+use std::hash::{BuildHasherDefault, Hasher};
+
+/// Word-boundary marker in patterns.
+pub(crate) const DOT: char = '.';
+/// Longest pattern the packed key supports.
+pub(crate) const MAX_PATTERN_LEN: usize = 9;
+
+/// Small, fast multiplicative hasher for packed `u64` keys (FxHash-style).
+#[derive(Default, Clone, Copy)]
+pub(crate) struct FxHasher(u64);
+
+impl Hasher for FxHasher {
+    fn finish(&self) -> u64 {
+        self.0
+    }
+    fn write(&mut self, bytes: &[u8]) {
+        for &b in bytes {
+            self.write_u64(b as u64);
+        }
+    }
+    fn write_u64(&mut self, i: u64) {
+        self.0 = (self.0.rotate_left(5) ^ i).wrapping_mul(0x51_7c_c1_b7_27_22_0a_95);
+    }
+}
+
+pub(crate) type FxMap<K, V> = HashMap<K, V, BuildHasherDefault<FxHasher>>;
+
+/// Maps characters to 6-bit codes (1 = word boundary, 2.. = letters); 0 = not in the alphabet.
+#[derive(Clone, Debug)]
+pub(crate) struct Alphabet {
+    ascii: [u8; 128],
+    other: Vec<(char, u8)>,
+    next: u8,
+}
+
+impl Default for Alphabet {
+    fn default() -> Self {
+        let mut a = Alphabet { ascii: [0; 128], other: Vec::new(), next: 2 };
+        a.ascii[DOT as usize] = 1;
+        a
+    }
+}
+
+impl Alphabet {
+    pub(crate) fn code(&self, c: char) -> u8 {
+        if (c as u32) < 128 { self.ascii[c as usize] } else { self.other.iter().find(|x| x.0 == c).map_or(0, |x| x.1) }
+    }
+    /// Code for `c`, adding it if new (None when the 6-bit alphabet is full).
+    pub(crate) fn intern(&mut self, c: char) -> Option<u8> {
+        let k = self.code(c);
+        if k != 0 {
+            return Some(k);
+        }
+        if self.next >= 63 {
+            return None;
+        }
+        let k = self.next;
+        self.next += 1;
+        if (c as u32) < 128 {
+            self.ascii[c as usize] = k;
+        } else {
+            self.other.push((c, k));
+        }
+        Some(k)
+    }
+}
+
+/// Packed key of a code string (≤ [`MAX_PATTERN_LEN`] codes).
+#[inline]
+pub(crate) fn pack(codes: &[u8]) -> u64 {
+    let mut k = 0u64;
+    for &c in codes {
+        k = (k << 6) | c as u64;
+    }
+    k | ((codes.len() as u64) << 58)
+}
+
+/// A compiled pattern set.
+#[derive(Clone, Debug, Default)]
+pub struct Patterns {
+    alpha: Alphabet,
+    /// Packed letters → inter-letter values (`len + 1` entries).
+    map: FxMap<u64, Box<[u8]>>,
+    max_len: usize,
+}
+
+impl Patterns {
+    /// Parse TeX-style patterns: whitespace-separated, `%`/`#` start a comment line.
+    pub fn parse(text: &str) -> Patterns {
+        let mut p = Patterns::default();
+        for line in text.lines() {
+            let line = line.trim();
+            if line.is_empty() || line.starts_with('%') || line.starts_with('#') {
+                continue;
+            }
+            for tok in line.split_whitespace() {
+                p.insert(tok);
+            }
+        }
+        p
+    }
+
+    /// Add one pattern like `a1b`; returns false if it can't be represented.
+    pub(crate) fn insert(&mut self, pat: &str) -> bool {
+        let mut codes = Vec::with_capacity(pat.len());
+        let mut vals = vec![0u8];
+        for c in pat.chars() {
+            if let Some(d) = c.to_digit(10) {
+                *vals.last_mut().unwrap_or(&mut 0) = d as u8;
+            } else {
+                let Some(k) = self.alpha.intern(c) else { return false };
+                codes.push(k);
+                vals.push(0);
+            }
+        }
+        if codes.is_empty() || codes.len() > MAX_PATTERN_LEN {
+            return false;
+        }
+        self.max_len = self.max_len.max(codes.len());
+        self.map.insert(pack(&codes), vals.into_boxed_slice());
+        true
+    }
+
+    #[cfg(feature = "generator")]
+    pub(crate) fn from_parts(alpha: Alphabet, map: FxMap<u64, Box<[u8]>>, max_len: usize) -> Patterns {
+        Patterns { alpha, map, max_len }
+    }
+
+    /// Make `letters` part of the alphabet even if no pattern mentions them.
+    #[cfg(feature = "generator")]
+    pub(crate) fn add_letters(&mut self, letters: impl IntoIterator<Item = char>) {
+        for c in letters {
+            let _ = self.alpha.intern(c);
+        }
+    }
+
+    #[cfg(any(test, feature = "generator"))]
+    pub fn len(&self) -> usize {
+        self.map.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.map.is_empty()
+    }
+
+    /// Inter-letter values for a lowercase word: `out[i]` is the value *before* char `i`
+    /// (`out.len() == word.len() + 1`). None if a char is outside the pattern alphabet.
+    pub(crate) fn values(&self, word: &[char]) -> Option<Vec<u8>> {
+        let mut codes = Vec::with_capacity(word.len() + 2);
+        codes.push(1);
+        for &c in word {
+            let k = self.alpha.code(c);
+            if k == 0 {
+                return None;
+            }
+            codes.push(k);
+        }
+        codes.push(1);
+        let mut vals = vec![0u8; codes.len() + 1];
+        apply(&self.map, self.max_len, &codes, &mut vals);
+        // Padded position p sits before padded char p; word char i is padded char i + 1.
+        Some(vals[1..codes.len()].to_vec())
+    }
+
+    /// Break points (char indices, a hyphen goes before that char) of a lowercase word.
+    pub fn points(&self, word: &[char]) -> Option<Vec<usize>> {
+        let v = self.values(word)?;
+        Some((1..word.len()).filter(|&i| v[i] % 2 == 1).collect())
+    }
+
+    /// The patterns in TeX notation (sorted by letters), e.g. for writing a pattern file.
+    #[cfg(any(test, feature = "generator"))]
+    pub fn to_tex(&self) -> Vec<String> {
+        let mut rev: Vec<(u8, char)> =
+            (0u8..128).filter(|&c| self.alpha.ascii[c as usize] != 0).map(|c| (self.alpha.ascii[c as usize], c as char)).collect();
+        rev.extend(self.alpha.other.iter().map(|&(c, k)| (k, c)));
+        let ch = |k: u8| rev.iter().find(|x| x.0 == k).map_or('?', |x| x.1);
+        let mut out: Vec<(String, String)> = self
+            .map
+            .iter()
+            .map(|(&key, vals)| {
+                let n = (key >> 58) as usize;
+                let letters: Vec<char> = (0..n).map(|i| ch(((key >> (6 * (n - 1 - i))) & 63) as u8)).collect();
+                let mut s = String::new();
+                for (i, l) in letters.iter().enumerate() {
+                    if vals[i] > 0 {
+                        s.push(char::from(b'0' + vals[i]));
+                    }
+                    s.push(*l);
+                }
+                if vals[n] > 0 {
+                    s.push(char::from(b'0' + vals[n]));
+                }
+                (letters.into_iter().collect(), s)
+            })
+            .collect();
+        out.sort();
+        out.into_iter().map(|x| x.1).collect()
+    }
+}
+
+/// Apply `map` to padded `codes`, raising `vals` (len = codes.len() + 1).
+#[inline]
+pub(crate) fn apply(map: &FxMap<u64, Box<[u8]>>, max_len: usize, codes: &[u8], vals: &mut [u8]) {
+    let n = codes.len();
+    for s in 0..n {
+        let mut k = 0u64;
+        for len in 1..=max_len.min(n - s) {
+            k = (k << 6) | codes[s + len - 1] as u64;
+            if let Some(v) = map.get(&(k | ((len as u64) << 58))) {
+                for (slot, &x) in vals.iter_mut().skip(s).zip(v.iter()) {
+                    *slot = (*slot).max(x);
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn liang_example() {
+        // The classic example from Liang's thesis: "hy-phen-ation".
+        let p = Patterns::parse("hy3ph he2n hena4 hen5at 1na n2at 1tio 2io o2n");
+        let w: Vec<char> = "hyphenation".chars().collect();
+        assert_eq!(p.points(&w).unwrap(), vec![2, 6]);
+        let mut tex = p.to_tex();
+        tex.sort();
+        assert!(tex.contains(&"hen5at".to_string()));
+        assert!(p.values(&['h', 'é']).is_none());
+    }
+}
diff --git a/crates/text/src/hyphen/tests.rs b/crates/text/src/hyphen/tests.rs
new file mode 100644
index 00000000..f786a5e3
--- /dev/null
+++ b/crates/text/src/hyphen/tests.rs
@@ -0,0 +1,364 @@
+use super::*;
+
+fn h(w: &str) -> String {
+    hyphenate_word(w, &Limits::default())
+}
+
+#[test]
+fn bundled_data_loads() {
+    assert!(Dictionary::en_us().len() > 150_000, "{}", Dictionary::en_us().len());
+    assert!(Patterns::en_us().len() > 1000, "{}", Patterns::en_us().len());
+}
+
+#[test]
+fn dictionary_words() {
+    assert_eq!(h("happen"), "hap-pen");
+    assert_eq!(h("typography"), "ty-pog-ra-phy");
+    assert_eq!(h("composition"), "com-po-si-tion");
+    assert_eq!(h("hyphenation"), "hy-phen-a-tion");
+    assert_eq!(h("international"), "in-ter-na-tion-al");
+    assert_eq!(h("cat"), "cat");
+    assert!(!h("changed").contains('-'));
+    assert_eq!(h("NASA"), "NASA");
+    assert_eq!(word_breaks("publication").1, Source::Dictionary);
+}
+
+#[test]
+fn case_apostrophes_and_punctuation() {
+    assert_eq!(h("Typography"), "Ty-pog-ra-phy");
+    assert_eq!(h("TYPOGRAPHY"), "TYPOGRAPHY");
+    assert_eq!(h("typography,"), "ty-pog-ra-phy,");
+    assert_eq!(h("“typography”"), "“ty-pog-ra-phy”");
+    assert_eq!(h("typography's"), "ty-pog-ra-phy's");
+    assert_eq!(h("typography’s"), "ty-pog-ra-phy’s");
+    assert_eq!(h("'typography'"), "'ty-pog-ra-phy'");
+    // Compounds: each part separately, never next to the hyphen.
+    assert_eq!(h("typography-composition"), "ty-pog-ra-phy-com-po-si-tion");
+    // Points are byte offsets: the opening quote takes three bytes.
+    assert_eq!(hyphen_points("“typography”", &Limits::default()), vec![5, 8, 10]);
+}
+
+#[test]
+fn inflections_inherit_the_stem() {
+    assert_eq!(h("ripples"), "rip-ples");
+    assert_eq!(h("gradients"), "gra-di-ents");
+    assert_eq!(h("restrained"), "re-strained");
+}
+
+#[test]
+fn patterns_cover_unknown_words() {
+    // Not in the word list: the trained patterns decide.
+    let (pts, src) = word_breaks("hyperlocalization");
+    assert_eq!(src, Source::Patterns);
+    assert!(pts.len() >= 4, "{}", h("hyperlocalization"));
+    let (_, src) = word_breaks("zzyzx");
+    assert_ne!(src, Source::Dictionary);
+}
+
+#[test]
+fn limits_are_respected() {
+    let lim = Limits { min_word: 5, after_first: 3, before_last: 3, capitalized: false };
+    for w in ["typography", "hyphenation", "justification", "Paragraph", "beautiful"] {
+        for p in hyphen_points(w, &lim) {
+            assert!(p >= 3 && p <= w.chars().count() - 3, "{w} {p}");
+        }
+    }
+    assert!(hyphen_points("Paragraph", &lim).is_empty());
+    let lim = Limits { min_word: 12, ..Limits::default() };
+    assert!(hyphen_points("typography", &lim).is_empty());
+}
+
+#[test]
+fn language_names_and_codes() {
+    for name in ["English", "English: USA", "english", "$ID/English: UK", "en", "en_US", "en-GB", "EN", "en-Latn-US"] {
+        assert_eq!(Lang::for_language(name), Some(Lang::English), "{name}");
+    }
+    assert_eq!(Lang::for_language("en-Cyrl"), None);
+    // Each language resolves by name and by code exactly when its feature is on.
+    for &(name, code) in LANGUAGES {
+        let want = hypher::Lang::from_iso(code).map(|l| Lang::Patterns(PatternLang(l)));
+        let code = std::str::from_utf8(&code).unwrap();
+        let mut title = name.chars();
+        let title: String = title.next().map(|c| c.to_uppercase().chain(title).collect()).unwrap_or_default();
+        let upper = code.to_uppercase();
+        let script = pattern_script(code.as_bytes().try_into().unwrap());
+        for spelling in [
+            name.to_string(),
+            format!("{title}: Reform"),
+            format!("$ID/{title}"),
+            code.to_string(),
+            format!("{code}_{upper}"),
+            format!("{code}-419"),
+            format!("{code}_{upper}_2006"),
+            format!("{code}-{script}"),
+            format!("{code}-{script}-{upper}"),
+            format!("{code}-1996"),
+            format!("{code}-{script}-1996"),
+        ] {
+            assert_eq!(Lang::for_language(&spelling), want, "{spelling}");
+        }
+        let other = if script == "latn" { "Cyrl" } else { "Latn" };
+        assert_eq!(Lang::for_language(&format!("{code}-{other}-{upper}")), None, "{code}: patterns of another script");
+        assert_eq!(Lang::for_language(&format!("{code}_{upper}_x")), None, "{code}: not a locale code");
+    }
+    for unknown in ["", "[No Language]", "Klingon", "zh_CN", "Chinese: Simplified", "tlh"] {
+        assert_eq!(Lang::for_language(unknown), None, "{unknown}");
+    }
+}
+
+#[cfg(feature = "all-languages")]
+#[test]
+fn every_language_is_available() {
+    for &(name, code) in LANGUAGES {
+        if code == *b"sk" && !cfg!(feature = "slovak-gpl") {
+            continue;
+        }
+        assert!(hypher::Lang::from_iso(code).is_some(), "{name}");
+        assert!(Lang::for_language(name).is_some(), "{name}");
+    }
+}
+
+/// A virama doesn't split a word: the limits count the whole word, and no point falls before a
+/// mark or next to a joiner.
+#[cfg(feature = "hindi")]
+#[test]
+fn indic_word_limits_span_viramas() {
+    let hi = Lang::for_language("hi").unwrap();
+    // न म स ् क ा र: unrestricted points before म, स and र; only स has two letters on each side.
+    assert_eq!(word_breaks_in("नमस्कार", hi).0, vec![3, 6, 18]);
+    assert_eq!(hyphen_points_in("नमस्कार", &Limits::default(), hi), vec![6]);
+    for w in ["नमस्कार", "हिन्दुस्तानी", "प्रौद्योगिकी", "विश्वविद्यालय", "क्ष\u{200D}त्रिय"]
+    {
+        for p in word_breaks_in(w, hi).0 {
+            let (before, after) = w.split_at(p);
+            let (Some(x), Some(y)) = (before.chars().next_back(), after.chars().next()) else { panic!("{w} at {p}") };
+            assert!(!is_mark(y) && !is_joiner(x) && !is_joiner(y), "{w} at {p}");
+        }
+    }
+}
+
+/// Slovak's patterns are GPL-2.0-or-later: only their own feature turns them on, never
+/// `all-languages`.
+#[test]
+fn all_languages_leaves_out_the_gpl_slovak_patterns() {
+    let manifest = include_str!("../../Cargo.toml");
+    let all = manifest.split("all-languages = [").nth(1).and_then(|s| s.split(']').next()).unwrap_or_default();
+    assert!(all.contains("\"spanish\""), "all-languages list not found");
+    assert!(!all.contains("slovak"), "{all}");
+    assert!(manifest.contains("\nslovak-gpl = [\"hyphen\", \"hypher/slovak\"]"));
+}
+
+#[cfg(feature = "spanish")]
+#[test]
+fn spanish_uses_the_bezos_patterns() {
+    let es = Lang::for_language("Spanish").unwrap();
+    assert_eq!(es, Lang::for_language("es_ES").unwrap());
+    let h = |w: &str| {
+        let pts = hyphen_points_in(w, &Limits::default(), es);
+        assert!(pts.iter().all(|&p| w.is_char_boundary(p)), "{w} {pts:?}");
+        w.char_indices().map(|(i, c)| if pts.contains(&i) { format!("-{c}") } else { c.to_string() }).collect::<String>()
+    };
+    // Offsets are bytes: `ú` and `ó` take two each.
+    assert_eq!(hyphen_points_in("música", &Limits::default(), es), vec![3, 5]);
+    assert_eq!(hyphen_points_in("ejército", &Limits::default(), es), vec![5, 7]);
+    assert_eq!(h("transición"), "tran-si-ción");
+    assert_eq!(h("pingüino"), "pin-güino");
+    assert_eq!(h("Construcción"), "Cons-truc-ción");
+    assert_eq!(h("desesperación"), "de-ses-pe-ra-ción");
+    assert_eq!(h("teatro"), "tea-tro", "a vowel run stays whole");
+    assert_eq!(h("calle"), "ca-lle", "ll stays whole");
+    #[cfg(not(feature = "french"))]
+    assert!(Lang::for_language("French").is_none(), "only languages built in");
+}
+
+/// An elided article or preposition keeps the breaks of the word after it, and no break falls
+/// next to the apostrophe.
+#[cfg(feature = "french")]
+#[test]
+fn french_elisions_keep_their_breaks() {
+    let fr = Lang::for_language("French").unwrap();
+    let h = |w: &str| {
+        let pts = hyphen_points_in(w, &Limits::default(), fr);
+        w.char_indices().map(|(i, c)| if pts.contains(&i) { format!("-{c}") } else { c.to_string() }).collect::<String>()
+    };
+    assert_eq!(h("organisation"), "or-ga-ni-sa-tion");
+    assert_eq!(h("l'organisation"), "l'or-ga-ni-sa-tion");
+    assert_eq!(h("L’organisation"), "L’or-ga-ni-sa-tion");
+    assert_eq!(h("d'information"), "d'in-for-ma-tion");
+    assert_eq!(h("aujourd'hui"), "au-jour-d'hui");
+}
+
+/// The fastest of three timings of `f`, after a warm-up.
+fn fastest(f: impl Fn()) -> f64 {
+    f();
+    (0..3)
+        .map(|_| {
+            let t = std::time::Instant::now();
+            f();
+            t.elapsed().as_secs_f64()
+        })
+        .fold(f64::INFINITY, f64::min)
+}
+
+/// `hyphen_points`' limit checks as first written (a rescan of the letter run per point): the
+/// reference for the linear version.
+fn hyphen_points_ref(word: &str, lim: &Limits) -> Vec<usize> {
+    let chars: Vec<char> = word.chars().collect();
+    let (pts, _) = char_breaks(word, Lang::English);
+    let min_before = lim.after_first.max(1);
+    let min_after = lim.before_last.max(1);
+    let run_of = |p: usize| {
+        let mut a = p;
+        while a > 0 && is_word_char(chars[a - 1]) {
+            a -= 1;
+        }
+        let mut b = p;
+        while b < chars.len() && is_word_char(chars[b]) {
+            b += 1;
+        }
+        while a < b && is_apostrophe(chars[a]) {
+            a += 1;
+        }
+        while b > a && is_apostrophe(chars[b - 1]) {
+            b -= 1;
+        }
+        (a, b)
+    };
+    pts.into_iter()
+        .filter(|&p| {
+            let (a, b) = run_of(p);
+            let run = &chars[a..b];
+            let letters = run.iter().filter(|c| c.is_alphabetic()).count();
+            if letters < lim.min_word.max(2) {
+                return false;
+            }
+            if letters > 1 && run.iter().filter(|c| c.is_alphabetic()).all(|c| c.is_uppercase()) {
+                return false;
+            }
+            if !lim.capitalized && run[0].is_uppercase() {
+                return false;
+            }
+            let before = chars[a..p].iter().filter(|c| c.is_alphabetic()).count();
+            let after = chars[p..b].iter().filter(|c| c.is_alphabetic()).count();
+            before >= min_before && after >= min_after
+        })
+        .collect()
+}
+
+/// `heuristic_points` as first written (the right part rebuilt per point): the reference.
+fn heuristic_ref(c: &[char]) -> Vec<usize> {
+    let n = c.len();
+    if n < 4 || !c.iter().all(|c| c.is_alphabetic()) {
+        return vec![];
+    }
+    let v: Vec<bool> = c.iter().map(|&x| is_vowel(x)).collect();
+    let mut out = vec![];
+    for i in 1..n {
+        let ok = if v[i - 1] && !v[i] {
+            (i + 1 < n && v[i + 1]) || (i + 2 < n && onset_pair(c[i], c[i + 1]) && v[i + 2])
+        } else if !v[i - 1] && !v[i] {
+            i >= 2 && v[i - 2] && i + 1 < n && v[i + 1] && !onset_pair(c[i - 1], c[i]) && c[i - 1] != c[i] || (c[i - 1] == c[i] && i >= 2 && v[i - 2])
+        } else {
+            false
+        };
+        let right: String = c[i..].iter().collect();
+        let core = right.strip_suffix("ed").or_else(|| right.strip_suffix("es")).or_else(|| right.strip_suffix('e')).unwrap_or(&right);
+        if ok && core.chars().any(is_vowel) && core.len() > 1 && v[..i].iter().any(|x| *x) {
+            out.push(i);
+        }
+    }
+    out
+}
+
+#[test]
+fn linear_limits_and_heuristic_match_the_reference() {
+    let long = "hyphenation".repeat(40);
+    let words = [
+        "",
+        "x",
+        "''",
+        "a'b'c",
+        "cat",
+        "happen",
+        "hyphenation",
+        "Typography's",
+        "TYPOGRAPHY",
+        "Typography",
+        "typography’s",
+        "'typography'",
+        "“typography”,",
+        "typography-composition",
+        "don't",
+        "rock'n'roll",
+        "naïveté",
+        "crème-brûlée",
+        "Ünïcödé",
+        "ÉTUDE",
+        "strengths",
+        "ee",
+        "bed",
+        "hopped",
+        "rhythmed",
+        "aeiouy",
+        "xxyyzz",
+        "bookkeeper",
+        "ʼtwas",
+        "mid-1990s",
+        "twenty-one",
+        "école",
+        "Ålesund",
+        "smørrebrød",
+        "cafe\u{301}-cre\u{300}me",
+        "e\u{301}tude",
+        "नमस्कार",
+        "hopes",
+        "hoped",
+        "taed",
+        "teeed",
+        &long,
+    ];
+    for w in words {
+        for min_word in [2, 5, 7] {
+            for (after_first, before_last) in [(1, 1), (2, 2), (3, 2), (2, 4)] {
+                for capitalized in [true, false] {
+                    let lim = Limits { min_word, after_first, before_last, capitalized };
+                    assert_eq!(hyphen_points(w, &lim), byte_offsets(w, hyphen_points_ref(w, &lim)), "{w:?} {lim:?}");
+                }
+            }
+        }
+        let c: Vec<char> = w.to_lowercase().chars().collect();
+        assert_eq!(heuristic_points(&c), heuristic_ref(&c), "{w:?}");
+    }
+}
+
+#[test]
+#[ignore = "wall-clock timing; run with --ignored"]
+fn hyphenating_a_long_word_is_linear() {
+    // A word of n letters against one of 4n: linear ~4x the time, the old rescans ~16x. One in
+    // the pattern alphabet, one outside it (the syllable heuristic).
+    let pattern = |k: usize| "hyphenation".repeat(k);
+    let heuristic = |k: usize| "smørrebrød".repeat(k);
+    assert_eq!(word_breaks(&heuristic(2)).1, Source::Heuristic);
+    // Each timing repeats the call so the shorter one is milliseconds, well above timer noise.
+    let ratios: Vec<(String, f64)> = [(pattern as fn(usize) -> String, 20), (heuristic, 40)]
+        .into_iter()
+        .map(|(word, repeat)| {
+            let (small, big) = (word(400), word(1600));
+            let time = |w: &str| fastest(|| (0..repeat).for_each(|_| drop(hyphen_points(w, &Limits::default()))));
+            let (t1, t4) = (time(&small), time(&big));
+            let ratio = t4 / t1.max(1e-9);
+            let what = format!("{}…: t(n) {t1:.4} s, t(4n) {t4:.4} s, ratio {ratio:.1}", word(1).chars().take(10).collect::<String>());
+            eprintln!("{what}");
+            (what, ratio)
+        })
+        .collect();
+    for (what, ratio) in ratios {
+        assert!(ratio < 8.0, "4x the letters, not linear: {what}");
+    }
+}
+
+#[test]
+fn heuristic_fallback() {
+    let c: Vec<char> = "happen".chars().collect();
+    assert_eq!(heuristic_points(&c), vec![3]);
+}
diff --git a/crates/text/src/lib.rs b/crates/text/src/lib.rs
new file mode 100644
index 00000000..07795c31
--- /dev/null
+++ b/crates/text/src/lib.rs
@@ -0,0 +1,25 @@
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+//! Shared text processing for the Craft apps. It sits below the composer: layout code calls it on
+//! plain text and a language before it shapes and places glyphs.
+//!
+//! Modules, each behind the cargo feature of the same name:
+//! - [`hyphen`] (default): hyphenation points, with bundled US English data and optional
+//!   hypher patterns for 47 more languages (Slovak, under the GPL, only with `slovak-gpl`).
+//! - [`segment`] (default): line-break opportunities (UAX #14 with kinsoku), and word breaks for
+//!   Thai, Lao, Khmer and Burmese with their language features.
+//! - [`bidi`] (default): bidirectional text (UAX #9): embedding levels, line reordering and
+//!   mirroring.
+//! - [`linebreak`] (default): line breaking on a font-independent box/glue/penalty model.
+//!
+//! Language features (`spanish`, `german`, …, `all-languages`) add data for that language and
+//! turn on the modules that use it.
+
+#[cfg(feature = "bidi")]
+pub mod bidi;
+#[cfg(feature = "hyphen")]
+pub mod hyphen;
+#[cfg(feature = "linebreak")]
+pub mod linebreak;
+#[cfg(feature = "segment")]
+pub mod segment;
diff --git a/crates/text/src/linebreak/greedy.rs b/crates/text/src/linebreak/greedy.rs
new file mode 100644
index 00000000..b6dcb606
--- /dev/null
+++ b/crates/text/src/linebreak/greedy.rs
@@ -0,0 +1,108 @@
+//! Greedy first fit: each line takes as much as fits.
+
+use super::{INFINITE_PENALTY, Item, Kind, Line, Params, Sums, clamp_measure};
+
+/// Break `items` first fit: each line ends at the last break where it still fits its measure
+/// `width(k)` with its shrink. A line with no such break ends at the last [`Item::emergency`]
+/// break that fits, else before the first box that overflows (never after an
+/// [`Item::no_break`]).
+pub fn greedy(items: &[Item], width: &dyn Fn(usize) -> f64, p: &Params) -> Vec<Line> {
+    greedy_with(items, width, p, &|_, _, k| items.get(k).map_or(0.0, |i| i.width))
+}
+
+/// [`greedy`] with box widths that depend on position: `advance(line, x, k)` is the width of box
+/// `k` when it starts `x` from the start of line `line` (a tab reaching its stop). It returns
+/// `items[k].width` for other boxes.
+pub fn greedy_with(items: &[Item], width: &dyn Fn(usize) -> f64, p: &Params, advance: &dyn Fn(usize, f64, usize) -> f64) -> Vec<Line> {
+    let p = &p.sanitized();
+    let width = |k: usize| clamp_measure(width(k));
+    let s = Sums::new(items);
+    let m = items.len();
+    // Japanese "push out first": break where the line fits without shrinking when there is one.
+    let avoid_shrink = p.shrink_weight > p.stretch_weight;
+    let zone = p.rag.map_or(0.0, |r| r.hyphenation_zone);
+    let zoned = |b: usize| zone > 0.0 && items.get(b).is_some_and(|i| i.is_flagged() && i.hyphenation);
+    let no_break_before = |k: usize| k > 0 && items.get(k - 1).is_some_and(|i| i.kind == Kind::Penalty && i.cost >= INFINITE_PENALTY);
+    let mut out = Vec::new();
+    let mut start = 0;
+    let mut line = 0;
+    let mut hyphens = 0;
+    loop {
+        let measure = width(line);
+        // extra[k - start]: width the boxes before item `k` gained from `advance`.
+        let mut extra = Vec::new();
+        let mut ext = 0.0;
+        let mut last_ok = None;
+        let mut last_natural = None;
+        let mut last_emergency = None;
+        // (break, line width there)
+        let mut last_space: Option<(usize, f64)> = None;
+        let mut k = start;
+        let (end, next) = loop {
+            extra.push(ext);
+            let Some(it) = items.get(k) else { break (m, m) };
+            if s.is_break(k) {
+                if it.is_forced() {
+                    break (k, s.next_start(k));
+                }
+                let blocked = it.is_flagged() && p.hyphen_limit > 0 && hyphens >= p.hyphen_limit;
+                let f = s.fit(start, k, Some(it), false, measure, p, ext);
+                if !blocked && f.feasible {
+                    if it.emergency {
+                        last_emergency = Some(k);
+                    } else {
+                        last_ok = Some(k);
+                        if f.width <= measure + p.overrun {
+                            last_natural = Some(k);
+                        }
+                    }
+                }
+                if it.kind == Kind::Glue {
+                    last_space = Some((k, f.width));
+                }
+            } else if it.kind == Kind::Box {
+                let x = s.fit(start, k, None, false, measure, p, ext).width;
+                ext += advance(line, x, k) - it.width;
+                if k > start {
+                    // Would a line ending right after this box overflow? (The following break's
+                    // hang and edge elasticity apply; a hyphen is checked at its own break.)
+                    let after = items.get(k + 1).filter(|i| i.kind != Kind::Box).map(|i| Item { width: 0.0, emergency: false, ..*i });
+                    let f = s.fit(start, k + 1, after.as_ref(), false, measure, p, ext);
+                    if avoid_shrink
+                        && f.width > measure + p.overrun
+                        && let Some(b) = last_natural
+                    {
+                        break (b, s.next_start(b));
+                    }
+                    if !f.feasible {
+                        match (last_ok, last_emergency) {
+                            (Some(b), _) => {
+                                // Hyphenation zone: break before the word if that leaves little space.
+                                if zoned(b)
+                                    && let Some((sp, xs)) = last_space
+                                    && measure - xs < zone
+                                {
+                                    break (sp, s.next_start(sp));
+                                }
+                                break (b, s.next_start(b));
+                            }
+                            (None, Some(b)) => break (b, s.next_start(b)),
+                            (None, None) if !no_break_before(k) => break (k, k),
+                            (None, None) => {}
+                        }
+                    }
+                }
+            }
+            k += 1;
+        };
+        hyphens = if items.get(end).is_some_and(Item::is_flagged) { hyphens + 1 } else { 0 };
+        let ext_end = extra.get(end.saturating_sub(start)).copied().unwrap_or(ext);
+        out.push(s.line(start, end, next, measure, p, ext_end));
+        if next >= m {
+            break;
+        }
+        start = next;
+        line += 1;
+    }
+    out
+}
diff --git a/crates/text/src/linebreak/knuth_plass.rs b/crates/text/src/linebreak/knuth_plass.rs
new file mode 100644
index 00000000..71f63c2d
--- /dev/null
+++ b/crates/text/src/linebreak/knuth_plass.rs
@@ -0,0 +1,223 @@
+//! Knuth–Plass total fit: the breaks that minimise the paragraph's summed demerits.
+
+use super::{Item, Kind, Line, Params, Sums, clamp_measure, fitness_class};
+
+/// Give up (return `None`) beyond this many active breaks.
+const MAX_ACTIVE: usize = 4096;
+/// Ratios beyond this are rated as this (an unstretchable line is infinitely loose).
+const MAX_RATIO: f64 = 10_000.0;
+/// Demerits of an overfull line accepted because nothing else reaches a break.
+const OVERFULL_DEMERITS: f64 = 1e8;
+
+#[derive(Clone, Copy, Debug)]
+struct Node {
+    /// The break this node ends a line at.
+    pos: usize,
+    /// First item of the next line.
+    start: usize,
+    /// Number of the next line.
+    line: usize,
+    fitness: Option<u8>,
+    demerits: f64,
+    /// Consecutive lines ending at flagged breaks, up to here.
+    hyphens: usize,
+    flagged: bool,
+    prev: Option<usize>,
+}
+
+/// The best way found to reach the current break for one (line class, fitness, hyphen state).
+/// Line classes are line numbers below [`Params::uniform_from`], then one class for the rest.
+struct Candidate {
+    line: usize,
+    fitness: u8,
+    hyphens: usize,
+    demerits: f64,
+    from: usize,
+}
+
+/// One total-fit pass over `items`. `width(k)` is the measure of line `k`; set
+/// [`Params::uniform_from`] when it varies. Returns `None` when no set of breaks keeps every line
+/// within [`Params::tolerance`] (unless [`Params::overfull`]), or past the active-break limit.
+pub fn knuth_plass(items: &[Item], width: &dyn Fn(usize) -> f64, p: &Params) -> Option<Vec<Line>> {
+    let p = &p.sanitized();
+    let width = |k: usize| clamp_measure(width(k));
+    let s = Sums::new(items);
+    let m = items.len();
+    let limit = p.hyphen_limit;
+    // Hyphen states 0..=limit; unlimited still tells a flagged line (1) from others (0).
+    let max_hyphens = if limit == 0 { 1 } else { limit };
+    let zone = p.rag.map_or(0.0, |r| r.hyphenation_zone);
+    let mut nodes = vec![Node { pos: 0, start: 0, line: 0, fitness: p.first_fitness, demerits: 0.0, hyphens: 0, flagged: false, prev: None }];
+    let mut active: Vec<usize> = vec![0];
+    let mut keep: Vec<usize> = Vec::new();
+    let mut best: Vec<Candidate> = Vec::new();
+    // The last break at a space (glue), for the hyphenation zone.
+    let mut last_space: Option<usize> = None;
+    for b in 0..=m {
+        if !s.is_break(b) {
+            continue;
+        }
+        let item = items.get(b);
+        let forced = s.forced(b);
+        let flagged = item.is_some_and(Item::is_flagged);
+        let cost = item.filter(|i| i.kind == Kind::Penalty).map_or(0.0, |i| i.cost);
+        best.clear();
+        keep.clear();
+        let mut last_removed = None;
+        for &a in &active {
+            let Some(n) = nodes.get(a).copied() else { continue };
+            // The node's next line starts after `b` (the penalties between were discarded): no
+            // line ends here, but one may end at a later break.
+            if b < n.start {
+                keep.push(a);
+                continue;
+            }
+            let measure = width(n.line);
+            let f = s.measure(n.start, b, measure, p);
+            // An overfull node is dropped even at a penalty with width (a hyphen), as in TeX,
+            // although a later break without that width might still fit.
+            if f.feasible && !forced {
+                keep.push(a);
+            } else {
+                last_removed = Some(a);
+            }
+            if !f.feasible || (f.ratio > p.tolerance && !forced) {
+                continue;
+            }
+            if flagged {
+                if limit > 0 && n.hyphens >= limit {
+                    continue;
+                }
+                // Hyphenation zone: break at the space before the word instead when that leaves
+                // less than the zone at the line end.
+                if zone > 0.0
+                    && item.is_some_and(|i| i.hyphenation)
+                    && let Some(sp) = last_space.filter(|&sp| sp >= n.start)
+                    && measure - s.measure(n.start, sp, measure, p).width < zone
+                {
+                    continue;
+                }
+            }
+            let weight = if f.ratio > 0.0 {
+                p.stretch_weight
+            } else if f.ratio < 0.0 {
+                p.shrink_weight
+            } else {
+                1.0
+            };
+            let badness = (weight * 100.0 * f.ratio.abs().min(MAX_RATIO).powi(3)).min(p.max_badness);
+            let lp = p.line_penalty + badness;
+            let mut d = if forced {
+                lp * lp
+            } else if cost >= 0.0 {
+                lp * lp + cost * cost
+            } else {
+                lp * lp - cost * cost
+            };
+            if flagged && n.flagged {
+                d += p.flagged_demerits;
+            }
+            // A ragged line ending at a forced break says nothing about the rag: it keeps its
+            // neighbour's class.
+            let class = fitness_class(f.ratio, &p.fitness);
+            let fitness = if forced && p.rag.is_some() { n.fitness.unwrap_or(class) } else { class };
+            if n.fitness.is_some_and(|nf| fitness.abs_diff(nf) > 1) {
+                d += p.fitness_demerits;
+            }
+            let hyphens = if flagged { (n.hyphens + 1).min(max_hyphens) } else { 0 };
+            let line = (n.line + 1).min(p.uniform_from);
+            let demerits = n.demerits + d;
+            match best.iter_mut().find(|c| c.line == line && c.fitness == fitness && c.hyphens == hyphens) {
+                Some(c) if c.demerits <= demerits => {}
+                Some(c) => {
+                    c.demerits = demerits;
+                    c.from = a;
+                }
+                None => best.push(Candidate { line, fitness, hyphens, demerits, from: a }),
+            }
+        }
+        if p.overfull
+            && keep.is_empty()
+            && best.is_empty()
+            && let Some(a) = last_removed
+            && let Some(n) = nodes.get(a)
+        {
+            // An overfull line ending here would leave the next line empty up to a forced break:
+            // end it at that forced break instead. Nor may it pass the hyphen limit: it ends at a
+            // later break.
+            let empty_next = !forced && s.items.get(s.next_start(b)).is_some_and(Item::is_forced);
+            let too_many_hyphens = flagged && limit > 0 && n.hyphens >= limit;
+            if empty_next || too_many_hyphens {
+                keep.push(a);
+            } else {
+                best.push(Candidate {
+                    line: (n.line + 1).min(p.uniform_from),
+                    fitness: 0,
+                    hyphens: 0,
+                    demerits: n.demerits + OVERFULL_DEMERITS,
+                    from: a,
+                });
+            }
+        }
+        std::mem::swap(&mut active, &mut keep);
+        if item.is_some_and(|i| i.kind == Kind::Glue) {
+            last_space = Some(b);
+        } else if forced {
+            last_space = None;
+        }
+        if best.is_empty() {
+            if active.is_empty() {
+                return None;
+            }
+            continue;
+        }
+        let start = s.next_start(b);
+        // Knuth's pruning: within a line class and hyphen state, a node more than the fitness
+        // demerits behind the best can never win.
+        for c in &best {
+            let min = best.iter().filter(|o| o.line == c.line && o.hyphens == c.hyphens).map(|o| o.demerits).fold(f64::INFINITY, f64::min);
+            if c.demerits > min + p.fitness_demerits {
+                continue;
+            }
+            let Some(prev) = nodes.get(c.from).copied() else { continue };
+            nodes.push(Node {
+                pos: b,
+                start,
+                line: prev.line + 1,
+                fitness: Some(c.fitness),
+                demerits: c.demerits,
+                hyphens: if flagged { prev.hyphens + 1 } else { 0 },
+                flagged,
+                prev: Some(c.from),
+            });
+            active.push(nodes.len() - 1);
+        }
+        if active.len() > MAX_ACTIVE {
+            return None;
+        }
+    }
+    let end = if s.ends_forced() { m - 1 } else { m };
+    let last = active
+        .iter()
+        .copied()
+        .filter(|&a| nodes.get(a).is_some_and(|n| n.pos == end && n.prev.is_some()))
+        .min_by(|&a, &b| nodes[a].demerits.total_cmp(&nodes[b].demerits))?;
+    let mut chain = Vec::new();
+    let mut cur = Some(last);
+    while let Some(i) = cur {
+        let n = nodes.get(i)?;
+        if n.prev.is_some() {
+            chain.push(n.pos);
+        }
+        cur = n.prev;
+    }
+    chain.reverse();
+    let mut start = 0;
+    let mut lines = Vec::with_capacity(chain.len());
+    for (k, &b) in chain.iter().enumerate() {
+        let next = s.next_start(b);
+        lines.push(s.line(start, b, next, width(k), p, 0.0));
+        start = next;
+    }
+    Some(lines)
+}
diff --git a/crates/text/src/linebreak/mod.rs b/crates/text/src/linebreak/mod.rs
new file mode 100644
index 00000000..d34d50b2
--- /dev/null
+++ b/crates/text/src/linebreak/mod.rs
@@ -0,0 +1,637 @@
+//! Line breaking on Knuth and Plass's box/glue/penalty model, independent of fonts.
+//!
+//! A composer turns a paragraph's shaped glyphs into [`Item`]s (boxes for glyphs or words, glue
+//! for spaces, penalties for other break opportunities), calls a breaker, and places the glyphs of
+//! each returned [`Line`]. Widths are in the caller's units.
+//!
+//! - [`knuth_plass`]: one total-fit pass at [`Params::tolerance`].
+//! - [`break_paragraph`]: Knuth–Plass passes at rising tolerances, the last accepting overfull
+//!   lines, then [`greedy`] if no pass succeeds. [`Breaks::method`] says which produced the lines.
+//! - [`greedy`] / [`greedy_with`]: first fit, each line takes as much as fits.
+//! - [`balanced`]: the line count of [`break_paragraph`] with lines as even as possible.
+//! - [`overlong`]: runs of boxes wider than the measure, where a composer may add
+//!   [`Item::emergency`] breaks.
+//!
+//! Elasticity comes in [`TIERS`] tiers, used in order: tier 0 (word spaces), then tier 1 (letter
+//! spacing), then tier 2 (glyph scaling). Each tier is charged [`Params::tier_cost`] per unit of
+//! its ratio, so a breaker prefers word-space changes, then letter spacing, then glyph scaling.
+//!
+//! Breakers take the measure of line `k` from `width(k)`. They clamp each measure to
+//! `0.0..=f64::MAX` (NaN counts as 0) and treat lines from [`Params::uniform_from`] on as having
+//! the same measure.
+
+mod greedy;
+mod knuth_plass;
+#[cfg(test)]
+mod tests;
+
+use std::ops::Range;
+
+pub use greedy::{greedy, greedy_with};
+pub use knuth_plass::knuth_plass;
+
+/// Number of elasticity tiers: word space, letter space, glyph scale.
+pub const TIERS: usize = 3;
+
+/// Stretch or shrink per tier.
+pub type Tiers = [f64; TIERS];
+
+/// A penalty at least this high forbids a break; one at most its negative forces a break.
+pub const INFINITE_PENALTY: f64 = 10_000.0;
+
+/// Cost of an [`Item::emergency`] break: high, so a paragraph takes no more than it must, but legal.
+pub const EMERGENCY_PENALTY: f64 = 5_000.0;
+
+/// What an [`Item`] is.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum Kind {
+    /// Fixed material (a glyph, a word). Never a break.
+    Box,
+    /// Elastic space. A break when it follows a box; discarded at the start of a line.
+    Glue,
+    /// A break opportunity with a cost; adds its width when a line ends there.
+    Penalty,
+}
+
+/// Tier-0 stretch and shrink that a line gains at one of its ends (see [`Item::edge`]).
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub struct Edge {
+    pub stretch: f64,
+    pub shrink: f64,
+}
+
+/// One item of a paragraph.
+///
+/// Build items from a constructor ([`Item::boxed`], [`Item::glue`], [`Item::penalty`], …) and
+/// override the optional fields with struct update syntax, such as
+/// `Item { hang: 2.0, ..Item::glue(3.0, 1.5, 0.6) }`. Fields added later get neutral values in the
+/// constructors, so code written this way keeps compiling.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Item {
+    pub kind: Kind,
+    /// Natural width (boxes, glue), or the width a line broken here gains (penalties: a hyphen).
+    pub width: f64,
+    /// Stretch per tier. Boxes may carry letter-spacing and glyph-scaling stretch.
+    pub stretch: Tiers,
+    /// Shrink per tier.
+    pub shrink: Tiers,
+    /// Glue: infinite stretch. A line holding fill glue gives it all its leftover space.
+    pub fill: bool,
+    /// Glue: the unit in which stretch past every tier is rated. Lines whose glue has none rate it
+    /// against their total stretch.
+    pub overflow: f64,
+    /// Penalty cost: [`INFINITE_PENALTY`] forbids the break, its negative forces it.
+    pub cost: f64,
+    /// Penalty: a flagged (hyphen) break. Consecutive flagged lines cost
+    /// [`Params::flagged_demerits`] and count toward [`Params::hyphen_limit`].
+    pub flagged: bool,
+    /// Breaks: width a line ending here gives back (punctuation hanging into the margin).
+    /// Boxes: width a line starting with this box gives back.
+    pub hang: f64,
+    /// Tier-0 stretch and shrink that a line ending at this break (glue, penalties) or starting
+    /// with this box gains; negative values remove elasticity. The line's tier-0 totals are
+    /// clamped at zero.
+    pub edge: Edge,
+    /// Penalty: an automatic or discretionary hyphenation point, subject to
+    /// [`Rag::hyphenation_zone`].
+    pub hyphenation: bool,
+    /// Penalty: a break inside a word wider than the measure. A justified line ending here that
+    /// must stretch is rated by its leftover space as a fraction of the measure, so the fullest
+    /// piece wins.
+    pub emergency: bool,
+}
+
+const BLANK: Item = Item {
+    kind: Kind::Box,
+    width: 0.0,
+    stretch: [0.0; TIERS],
+    shrink: [0.0; TIERS],
+    fill: false,
+    overflow: 0.0,
+    cost: 0.0,
+    flagged: false,
+    hang: 0.0,
+    edge: Edge { stretch: 0.0, shrink: 0.0 },
+    hyphenation: false,
+    emergency: false,
+};
+
+impl Item {
+    /// A box of `width`.
+    pub const fn boxed(width: f64) -> Item {
+        Item { width, ..BLANK }
+    }
+    /// Glue of natural `width` with tier-0 `stretch` and `shrink`.
+    pub const fn glue(width: f64, stretch: f64, shrink: f64) -> Item {
+        Item { kind: Kind::Glue, width, stretch: [stretch, 0.0, 0.0], shrink: [shrink, 0.0, 0.0], ..BLANK }
+    }
+    /// Glue of zero width and infinite stretch: ends a paragraph (before [`Item::forced`]) whose
+    /// last line is not justified.
+    pub const fn fill() -> Item {
+        Item { kind: Kind::Glue, fill: true, ..BLANK }
+    }
+    /// A break opportunity costing `cost`, adding `width` when taken.
+    pub const fn penalty(width: f64, cost: f64, flagged: bool) -> Item {
+        Item { kind: Kind::Penalty, width, cost, flagged, ..BLANK }
+    }
+    /// A forced break.
+    pub const fn forced() -> Item {
+        Item::penalty(0.0, -INFINITE_PENALTY, false)
+    }
+    /// A break that is never taken (keeps [`greedy`] from splitting two boxes).
+    pub const fn no_break() -> Item {
+        Item::penalty(0.0, INFINITE_PENALTY, false)
+    }
+    /// An emergency break inside an overlong word (see [`overlong`]).
+    pub const fn emergency() -> Item {
+        Item { emergency: true, ..Item::penalty(0.0, EMERGENCY_PENALTY, false) }
+    }
+    fn is_forced(&self) -> bool {
+        self.kind == Kind::Penalty && self.cost <= -INFINITE_PENALTY
+    }
+    fn is_flagged(&self) -> bool {
+        self.kind == Kind::Penalty && self.flagged
+    }
+}
+
+/// Ragged (unjustified) setting. Spaces keep their width; a line is rated by its leftover space
+/// against a rag stretch, as if every line ended with glue of that stretch.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Rag {
+    /// Rag stretch of every line, in width units.
+    pub stretch: f64,
+    /// Rag stretch of every line, as a fraction of its measure (added to `stretch`).
+    pub width_fraction: f64,
+    /// A line ending at a forced break that is shorter than this fraction of its measure is rated
+    /// by the shortfall instead of its leftover space (0 = off). Such lines otherwise cost nothing.
+    pub short_last: f64,
+    /// The unit of that shortfall, as a fraction of the measure.
+    pub short_last_unit: f64,
+    /// Hyphenation zone: a [`Item::hyphenation`] break is not taken when breaking at the space
+    /// before its word would leave less than this much space at the end of the line (0 = off).
+    pub hyphenation_zone: f64,
+}
+
+impl Default for Rag {
+    fn default() -> Self {
+        Rag { stretch: 0.0, width_fraction: 1.0 / 6.0, short_last: 0.0, short_last_unit: 1.0 / 3.0, hyphenation_zone: 0.0 }
+    }
+}
+
+/// How lines are rated and chosen.
+///
+/// Breakers clamp `flagged_demerits` and `fitness_demerits` to at least 0, with NaN counting as 0
+/// (negative demerits would let pruning drop the best candidate). Other fields are used as given.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Params {
+    /// Largest adjustment ratio of a line not ending at a forced break ([`knuth_plass`]).
+    pub tolerance: f64,
+    /// When no line reaches a break, accept the overfull line from the last node that could
+    /// ([`knuth_plass`]), so the pass always succeeds.
+    pub overfull: bool,
+    /// Added to every line's badness before squaring.
+    pub line_penalty: f64,
+    /// Added when two consecutive lines end at flagged breaks.
+    pub flagged_demerits: f64,
+    /// Added when neighbouring lines' fitness classes differ by more than one.
+    pub fitness_demerits: f64,
+    /// Upper ratio bounds of fitness classes 0 (tight, `r <` bound), 1 and 2 (`r <=` bound);
+    /// class 3 (very loose) is above.
+    pub fitness: [f64; 3],
+    /// Fitness class assumed before the first line; `None`: the first line pays no fitness demerits.
+    pub first_fitness: Option<u8>,
+    /// Most consecutive lines ending at flagged breaks (0 = unlimited). A hard constraint: a
+    /// Knuth–Plass pass that cannot meet it fails, and [`greedy`] breaks before the word instead.
+    pub hyphen_limit: usize,
+    /// Ratio charged per unit of each tier.
+    pub tier_cost: Tiers,
+    /// Badness cap (badness is `100·|r|³`, times the weight below).
+    pub max_badness: f64,
+    /// Badness multiplier of stretched lines.
+    pub stretch_weight: f64,
+    /// Badness multiplier of shrunk lines. [`greedy`] avoids shrinking when this exceeds
+    /// `stretch_weight`.
+    pub shrink_weight: f64,
+    /// A line longer than its measure by at most this fits exactly (rounded widths).
+    pub overrun: f64,
+    /// First line index from which `width(k)` no longer changes. [`knuth_plass`] keeps the ways
+    /// to reach a break apart by line number only for earlier lines; from here on they compete
+    /// directly, which keeps the number of active breaks small.
+    ///
+    /// The default 0 suits a constant measure. A caller whose measures vary (a first-line indent,
+    /// a drop cap, a shaped frame) must set it to the first index of the constant tail, such as 1
+    /// for a first-line indent; with a smaller value the lines still get their own measures, but
+    /// the breaks may not be the best ones. Large values make long paragraphs slow and can exceed
+    /// the active-break limit, so that [`break_paragraph`] falls back to [`greedy`].
+    pub uniform_from: usize,
+    /// Ragged setting; `None` justifies.
+    pub rag: Option<Rag>,
+}
+
+impl Default for Params {
+    fn default() -> Self {
+        Params {
+            tolerance: 2.5,
+            overfull: false,
+            line_penalty: 10.0,
+            flagged_demerits: 3000.0,
+            fitness_demerits: 3000.0,
+            fitness: [-0.5, 0.5, 1.0],
+            first_fitness: Some(1),
+            hyphen_limit: 0,
+            tier_cost: [1.0, 0.75, 1.0],
+            max_badness: f64::INFINITY,
+            stretch_weight: 1.0,
+            shrink_weight: 1.0,
+            overrun: 1e-6,
+            uniform_from: 0,
+            rag: None,
+        }
+    }
+}
+
+impl Params {
+    /// These parameters with the clamps documented on [`Params`] applied.
+    fn sanitized(&self) -> Params {
+        let non_negative = |x: f64| if x.is_nan() { 0.0 } else { x.max(0.0) };
+        Params { flagged_demerits: non_negative(self.flagged_demerits), fitness_demerits: non_negative(self.fitness_demerits), ..*self }
+    }
+}
+
+/// A measure from a caller's `width`, clamped to `0.0..=f64::MAX` (NaN counts as 0).
+fn clamp_measure(m: f64) -> f64 {
+    if m.is_nan() { 0.0 } else { m.clamp(0.0, f64::MAX) }
+}
+
+/// One line chosen by a breaker.
+#[derive(Clone, Copy, Debug, PartialEq)]
+#[non_exhaustive]
+pub struct Line {
+    /// First item on the line.
+    pub start: usize,
+    /// The break: items `start..end` are on the line. `items.len()` for a paragraph that does not
+    /// end with a forced break; a box's index where [`greedy`] split a word with no break in it.
+    pub end: usize,
+    /// First item of the next line (glue and penalties after the break are discarded).
+    pub next: usize,
+    /// Natural width: boxes and glue on the line, plus the break's penalty width, minus hangs.
+    pub width: f64,
+    /// The line's measure.
+    pub measure: f64,
+    /// Adjustment ratio as rated: positive stretches, negative shrinks. Each tier adds
+    /// [`Params::tier_cost`] per unit used, so a line that fits may shrink below −1; an overfull
+    /// line has a negative [`excess`](Self::excess) instead.
+    pub ratio: f64,
+    /// Fraction of each tier's stretch (positive) or shrink (negative) the line uses.
+    pub tiers: Tiers,
+    /// Width the tiers leave: taken by fill glue or the rag, stretch past every tier when
+    /// justified (spread over the glue's `overflow`, else its stretch), or the overfull amount
+    /// when negative.
+    pub excess: f64,
+    /// Ended at a flagged penalty.
+    pub flagged: bool,
+    /// Ended at a forced break or the paragraph end.
+    pub forced: bool,
+}
+
+/// Runs of boxes, as item ranges, whose width fully shrunk exceeds `measure`: words no line can
+/// hold. A composer adds [`Item::emergency`] breaks inside them where its script allows.
+pub fn overlong(items: &[Item], measure: f64) -> Vec<Range<usize>> {
+    let mut out = Vec::new();
+    // (first box, last box, width)
+    let mut run: Option<(usize, usize, f64)> = None;
+    let mut close = |run: &mut Option<(usize, usize, f64)>| {
+        if let Some((first, last, w)) = run.take()
+            && w > measure
+        {
+            out.push(first..last + 1);
+        }
+    };
+    for (k, it) in items.iter().enumerate() {
+        match it.kind {
+            Kind::Box => {
+                let w = it.width - it.shrink.iter().sum::<f64>();
+                run = Some(run.map_or((k, k, w), |(first, _, acc)| (first, k, acc + w)));
+            }
+            Kind::Penalty if it.cost >= INFINITE_PENALTY => {}
+            Kind::Glue | Kind::Penalty => close(&mut run),
+        }
+    }
+    close(&mut run);
+    out
+}
+
+/// Which breaker produced a paragraph's lines.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum Method {
+    /// The [`knuth_plass`] pass at `tolerances[pass]`.
+    KnuthPlass { pass: usize },
+    /// [`greedy`], because every Knuth–Plass pass failed or there were none.
+    Greedy,
+}
+
+/// Lines from [`break_paragraph`] or [`balanced`].
+#[derive(Clone, Debug, PartialEq)]
+#[non_exhaustive]
+pub struct Breaks {
+    pub lines: Vec<Line>,
+    /// The breaker that produced `lines`.
+    pub method: Method,
+    /// [`balanced`] evened the lines. Always false from [`break_paragraph`].
+    pub balanced: bool,
+}
+
+/// [`knuth_plass`] at each of `tolerances` in turn, the last pass also accepting overfull lines;
+/// [`greedy`] if every pass fails or `tolerances` is empty. The last pass fails only past the
+/// active-break limit (see [`Params::uniform_from`]).
+pub fn break_paragraph(items: &[Item], width: &dyn Fn(usize) -> f64, params: &Params, tolerances: &[f64]) -> Breaks {
+    for (pass, &tolerance) in tolerances.iter().enumerate() {
+        let overfull = params.overfull || pass + 1 == tolerances.len();
+        if let Some(lines) = knuth_plass(items, width, &Params { tolerance, overfull, ..*params }) {
+            return Breaks { lines, method: Method::KnuthPlass { pass }, balanced: false };
+        }
+    }
+    Breaks { lines: greedy(items, width, params), method: Method::Greedy, balanced: false }
+}
+
+/// Paragraphs with more items than this are not balanced (each balancing step breaks the whole
+/// paragraph again).
+pub const MAX_BALANCED_ITEMS: usize = 6000;
+
+/// Balance lines: keep [`break_paragraph`]'s line count but make the lines as even as possible,
+/// by breaking against the narrowest scaled measure that still gives that many lines. The lines
+/// are measured against the real `width`. Meant for ragged text; justified text is balanced the
+/// same way, so its lines stretch more.
+///
+/// Returns [`break_paragraph`]'s lines with [`Breaks::balanced`] false when the paragraph has
+/// fewer than two lines, a forced break before its last line, more than [`MAX_BALANCED_ITEMS`]
+/// items, or when no narrower measure keeps the line count.
+pub fn balanced(items: &[Item], width: &dyn Fn(usize) -> f64, params: &Params, tolerances: &[f64]) -> Breaks {
+    let base = break_paragraph(items, width, params, tolerances);
+    let n = base.lines.len();
+    if n < 2 || items.len() > MAX_BALANCED_ITEMS || base.lines[..n - 1].iter().any(|l| l.forced) {
+        return base;
+    }
+    let attempt = |f: f64| -> Option<Breaks> {
+        let w = |j: usize| clamp_measure(width(j)) * f;
+        let b = break_paragraph(items, &w, params, tolerances);
+        (b.lines.len() == n && b.lines.iter().enumerate().all(|(j, l)| l.width <= w(j) + params.overrun)).then_some(b)
+    };
+    let (mut lo, mut hi) = (0.3, 1.0);
+    let mut best = None;
+    for _ in 0..14 {
+        let mid = (lo + hi) / 2.0;
+        match attempt(mid) {
+            Some(lines) => {
+                best = Some(lines);
+                hi = mid;
+            }
+            None => lo = mid,
+        }
+    }
+    let Some(best) = best else { return base };
+    let sums = Sums::new(items);
+    let p = params.sanitized();
+    let lines = best.lines.iter().enumerate().map(|(j, l)| sums.line(l.start, l.end, l.next, clamp_measure(width(j)), &p, 0.0)).collect();
+    Breaks { lines, method: best.method, balanced: true }
+}
+
+/// How a line fits its measure.
+#[derive(Clone, Copy, Debug)]
+struct Fit {
+    width: f64,
+    ratio: f64,
+    tiers: Tiers,
+    excess: f64,
+    /// Fits with the shrink available.
+    feasible: bool,
+}
+
+/// Prefix sums of a paragraph's items, for measuring any line in constant time.
+struct Sums<'a> {
+    items: &'a [Item],
+    /// Before item `k`: width of boxes and glue, their stretch and shrink, glue overflow and the
+    /// number of fill glues.
+    w: Vec<f64>,
+    y: Vec<Tiers>,
+    z: Vec<Tiers>,
+    over: Vec<f64>,
+    fill: Vec<u32>,
+}
+
+impl<'a> Sums<'a> {
+    fn new(items: &'a [Item]) -> Self {
+        let m = items.len();
+        let (mut w, mut y, mut z, mut over, mut fill) =
+            (Vec::with_capacity(m + 1), Vec::with_capacity(m + 1), Vec::with_capacity(m + 1), Vec::with_capacity(m + 1), Vec::with_capacity(m + 1));
+        let (mut sw, mut sy, mut sz, mut so, mut sf) = (0.0, [0.0; TIERS], [0.0; TIERS], 0.0, 0);
+        for it in items {
+            w.push(sw);
+            y.push(sy);
+            z.push(sz);
+            over.push(so);
+            fill.push(sf);
+            if it.kind != Kind::Penalty {
+                sw += it.width;
+                for t in 0..TIERS {
+                    sy[t] += it.stretch[t];
+                    sz[t] += it.shrink[t];
+                }
+            }
+            if it.kind == Kind::Glue {
+                so += it.overflow;
+                sf += u32::from(it.fill);
+            }
+        }
+        w.push(sw);
+        y.push(sy);
+        z.push(sz);
+        over.push(so);
+        fill.push(sf);
+        Sums { items, w, y, z, over, fill }
+    }
+
+    fn len(&self) -> usize {
+        self.items.len()
+    }
+
+    /// The paragraph ends with a forced penalty (else its end is an implicit forced break).
+    fn ends_forced(&self) -> bool {
+        self.items.last().is_some_and(Item::is_forced)
+    }
+
+    /// Is `b` a legal break? `len()` is one unless the items end with a forced penalty.
+    fn is_break(&self, b: usize) -> bool {
+        match self.items.get(b) {
+            None => b == self.len() && !self.ends_forced(),
+            Some(it) => match it.kind {
+                Kind::Box => false,
+                Kind::Penalty => it.cost < INFINITE_PENALTY,
+                Kind::Glue => b > 0 && self.items.get(b - 1).is_some_and(|p| p.kind == Kind::Box),
+            },
+        }
+    }
+
+    fn forced(&self, b: usize) -> bool {
+        self.items.get(b).map_or(b >= self.len(), Item::is_forced)
+    }
+
+    /// First item of the line after a break at `b`: glue and penalties are discarded up to the next
+    /// box or forced break.
+    fn next_start(&self, b: usize) -> usize {
+        let mut i = b + 1;
+        while let Some(it) = self.items.get(i) {
+            if it.kind == Kind::Box || it.is_forced() {
+                break;
+            }
+            i += 1;
+        }
+        i.min(self.len())
+    }
+
+    fn at(&self, k: usize) -> (f64, Tiers, Tiers, f64, u32) {
+        let k = k.min(self.len());
+        (
+            self.w.get(k).copied().unwrap_or(0.0),
+            self.y.get(k).copied().unwrap_or_default(),
+            self.z.get(k).copied().unwrap_or_default(),
+            self.over.get(k).copied().unwrap_or(0.0),
+            self.fill.get(k).copied().unwrap_or(0),
+        )
+    }
+
+    /// How items `start..end` fit `measure`, ending at `brk` (a glue or penalty whose hang, edge
+    /// elasticity and penalty width apply; `None` at the paragraph end or a split between boxes).
+    /// `extra` is added to the natural width (boxes whose width depends on position).
+    #[allow(clippy::too_many_arguments)]
+    fn fit(&self, start: usize, end: usize, brk: Option<&Item>, forced: bool, measure: f64, p: &Params, extra: f64) -> Fit {
+        let (w0, y0, z0, o0, f0) = self.at(start);
+        let (w1, y1, z1, o1, f1) = self.at(end);
+        let (start_hang, start_edge) =
+            self.items.get(start).filter(|i| i.kind == Kind::Box && end > start).map_or((0.0, Edge::default()), |b| (b.hang, b.edge));
+        let (pw, end_hang, end_edge, emergency) = brk
+            .filter(|i| i.kind != Kind::Box)
+            .map_or((0.0, 0.0, Edge::default(), false), |i| (if i.kind == Kind::Penalty { i.width } else { 0.0 }, i.hang, i.edge, i.emergency));
+        let width = w1 - w0 + pw - start_hang - end_hang + extra;
+        let mut y = [0.0; TIERS];
+        let mut z = [0.0; TIERS];
+        for t in 0..TIERS {
+            y[t] = y1[t] - y0[t];
+            z[t] = z1[t] - z0[t];
+        }
+        y[0] = (y[0] + start_edge.stretch + end_edge.stretch).max(0.0);
+        z[0] = (z[0] + start_edge.shrink + end_edge.shrink).max(0.0);
+        let mut d = measure - width;
+        if d < 0.0 && d > -p.overrun {
+            d = 0.0;
+        }
+        let free = |ratio: f64| Fit { width, ratio, tiers: [0.0; TIERS], excess: d, feasible: true };
+        if d < 0.0 {
+            let (ratio, tiers, excess, feasible) = tiered(d, &z, 0.0, &p.tier_cost);
+            return Fit { width, ratio, tiers, excess, feasible };
+        }
+        if let Some(rag) = p.rag {
+            if forced && rag.short_last > 0.0 {
+                let short = measure * rag.short_last - width;
+                let unit = measure * rag.short_last_unit;
+                return free(if short <= 0.0 {
+                    0.0
+                } else if unit > 0.0 {
+                    short / unit
+                } else {
+                    f64::INFINITY
+                });
+            }
+            if f1 > f0 {
+                return free(0.0);
+            }
+            let s = rag.stretch + rag.width_fraction * measure;
+            return free(if d <= 0.0 {
+                0.0
+            } else if s > 0.0 {
+                d / s
+            } else {
+                f64::INFINITY
+            });
+        }
+        if f1 > f0 {
+            return free(0.0);
+        }
+        let (mut ratio, tiers, excess, feasible) = tiered(d, &y, o1 - o0, &p.tier_cost);
+        if emergency && ratio > 0.0 && measure > 0.0 {
+            ratio = d / measure;
+        }
+        Fit { width, ratio, tiers, excess, feasible }
+    }
+
+    /// Measure the break at `b` for a line starting at `start` (`b == len()`: the paragraph end).
+    fn measure(&self, start: usize, b: usize, measure: f64, p: &Params) -> Fit {
+        self.fit(start, b, self.items.get(b), self.forced(b), measure, p, 0.0)
+    }
+
+    fn line(&self, start: usize, end: usize, next: usize, measure: f64, p: &Params, extra: f64) -> Line {
+        let brk = self.items.get(end).filter(|i| i.kind != Kind::Box);
+        let forced = brk.map_or(end >= self.len(), Item::is_forced);
+        let f = self.fit(start, end, brk, forced, measure, p, extra);
+        Line {
+            start,
+            end,
+            next,
+            width: f.width,
+            measure,
+            ratio: f.ratio,
+            tiers: f.tiers,
+            excess: f.excess,
+            flagged: brk.is_some_and(Item::is_flagged),
+            forced,
+        }
+    }
+}
+
+/// Adjustment ratio for `d` units of stretch (`d > 0`) or shrink (`d < 0`) from tier capacities
+/// `cap`, used in tier order and charged `cost` per unit of each tier's ratio. Returns the ratio,
+/// the fraction of each tier used (negative when shrinking), the width left over and whether the
+/// line is feasible: shrinking past every tier is not. Stretch past every tier is rated in units
+/// of `over`, or of the total stretch when `over` is zero.
+fn tiered(d: f64, cap: &Tiers, over: f64, cost: &Tiers) -> (f64, Tiers, f64, bool) {
+    const EPS: f64 = 1e-9;
+    let mut used = [0.0; TIERS];
+    if d.abs() < EPS {
+        return (0.0, used, d, true);
+    }
+    let sign = d.signum();
+    let mut rem = d.abs();
+    let mut r = 0.0;
+    for t in 0..TIERS {
+        if cap[t] > EPS && rem > EPS {
+            let take = rem.min(cap[t]);
+            r += cost[t] * take / cap[t];
+            used[t] = sign * take / cap[t];
+            rem -= take;
+        }
+    }
+    let excess = sign * rem;
+    if d < 0.0 {
+        return (-r, used, excess, rem <= 1e-6);
+    }
+    if rem > 1e-6 {
+        let unit = if over > EPS { over } else { cap.iter().sum::<f64>() };
+        r = if unit > EPS { r + rem / unit } else { f64::INFINITY };
+    }
+    (r, used, excess, true)
+}
+
+/// Fitness class 0 (tight) … 3 (very loose) of ratio `r`.
+fn fitness_class(r: f64, bounds: &[f64; 3]) -> u8 {
+    if r < bounds[0] {
+        0
+    } else if r <= bounds[1] {
+        1
+    } else if r <= bounds[2] {
+        2
+    } else {
+        3
+    }
+}
diff --git a/crates/text/src/linebreak/tests.rs b/crates/text/src/linebreak/tests.rs
new file mode 100644
index 00000000..a9cc150b
--- /dev/null
+++ b/crates/text/src/linebreak/tests.rs
@@ -0,0 +1,476 @@
+//! Breaker tests on a monospaced model: letters are 6 units wide, spaces 3, hyphens 4. Parameter
+//! sets mirror vectorcraft's and designcraft's composers.
+
+use super::*;
+
+const CHAR: f64 = 6.0;
+const SPACE: f64 = 3.0;
+const HYPHEN: f64 = 4.0;
+
+const COPY: &str = "Typography is the craft of arranging type to make written language legible, readable and appealing when displayed. \
+The arrangement of type involves selecting typefaces, point sizes, line lengths, line spacing and letter spacing, and adjusting the space \
+between pairs of letters.";
+
+/// A paragraph's items and the text each item stands for.
+struct Para {
+    items: Vec<Item>,
+    text: Vec<String>,
+}
+
+impl Para {
+    /// A box per word and glue per space (elastic unless ragged); with `hyphen_cost`, a
+    /// hyphenation point every two letters inside words of six letters or more. Ends with fill and
+    /// a forced break.
+    fn new(text: &str, p: &Params, hyphen_cost: Option<f64>) -> Para {
+        let mut para = Para { items: Vec::new(), text: Vec::new() };
+        for (i, word) in text.split(' ').enumerate() {
+            if i > 0 {
+                let glue = if p.rag.is_some() { Item::glue(SPACE, 0.0, 0.0) } else { Item::glue(SPACE, SPACE / 2.0, SPACE / 5.0) };
+                para.push(glue, " ");
+            }
+            let chars: Vec<char> = word.chars().collect();
+            let points: Vec<usize> = match hyphen_cost {
+                Some(_) if chars.len() >= 6 => (2..chars.len() - 2).step_by(2).collect(),
+                _ => Vec::new(),
+            };
+            let mut from = 0;
+            for &at in points.iter().chain([chars.len()].iter()) {
+                let piece: String = chars[from..at].iter().collect();
+                para.push(Item::boxed(width_of(&piece)), &piece);
+                if at < chars.len() {
+                    para.push(Item { hyphenation: true, ..Item::penalty(HYPHEN, hyphen_cost.unwrap_or(0.0), true) }, "");
+                }
+                from = at;
+            }
+        }
+        para.push(Item::fill(), "");
+        para.push(Item::forced(), "");
+        para
+    }
+
+    fn push(&mut self, item: Item, text: &str) {
+        self.items.push(item);
+        self.text.push(text.to_string());
+    }
+
+    fn lines(&self, lines: &[Line]) -> Vec<String> {
+        lines
+            .iter()
+            .map(|l| {
+                let s: String = self.text[l.start..l.end.min(self.text.len())].concat();
+                let s = s.trim_end().to_string();
+                if l.flagged { s + "-" } else { s }
+            })
+            .collect()
+    }
+}
+
+fn width_of(s: &str) -> f64 {
+    s.chars().map(|c| if c == ' ' { SPACE } else { CHAR }).sum()
+}
+
+fn vectorcraft(ragged: bool) -> Params {
+    Params {
+        fitness_demerits: if ragged { 1000.0 } else { 10_000.0 },
+        fitness: if ragged { [0.15, 0.4, 0.75] } else { [-0.5, 0.5, 1.0] },
+        first_fitness: None,
+        max_badness: 10_000.0,
+        rag: ragged.then_some(Rag {
+            stretch: 0.0,
+            width_fraction: 1.0 / 6.0,
+            short_last: 1.0 / 3.0,
+            short_last_unit: 1.0 / 3.0,
+            hyphenation_zone: 0.0,
+        }),
+        ..Params::default()
+    }
+}
+
+/// vectorcraft's every-line composer: a strict pass, then a loose one, then single-line.
+fn every_line(items: &[Item], width: f64, ragged: bool) -> Vec<Line> {
+    let p = vectorcraft(ragged);
+    let w = |_| width;
+    let loose = if ragged { f64::INFINITY } else { 4.0 };
+    knuth_plass(items, &w, &Params { tolerance: 1.0, ..p })
+        .or_else(|| knuth_plass(items, &w, &Params { tolerance: loose, ..p }))
+        .unwrap_or_else(|| greedy(items, &w, &p))
+}
+
+fn designcraft(ragged: bool) -> Params {
+    Params {
+        hyphen_limit: 3,
+        overrun: 0.01,
+        uniform_from: 0,
+        rag: ragged.then_some(Rag { stretch: 24.0, width_fraction: 0.0, ..Rag::default() }),
+        ..Params::default()
+    }
+}
+
+const PASSES: [f64; 3] = [2.5, 12.0, f64::INFINITY];
+
+/// Lines are contiguous and cover every item.
+fn assert_covers(items: &[Item], lines: &[Line]) {
+    assert_eq!(lines.first().map(|l| l.start), Some(0));
+    for pair in lines.windows(2) {
+        assert_eq!(pair[0].next, pair[1].start, "{lines:?}");
+    }
+    assert_eq!(lines.last().map(|l| l.next), Some(items.len()));
+}
+
+#[test]
+fn tiers_are_used_in_order() {
+    let cost = Params::default().tier_cost;
+    // Word stretch alone.
+    let (r, used, _, ok) = tiered(5.0, &[10.0, 10.0, 10.0], 10.0, &cost);
+    assert!(ok && (r - 0.5).abs() < 1e-9 && used == [0.5, 0.0, 0.0]);
+    // Word saturated, half the letter tier.
+    let (r, used, _, _) = tiered(15.0, &[10.0, 10.0, 10.0], 10.0, &cost);
+    assert!((r - (1.0 + 0.5 * cost[1])).abs() < 1e-9 && used == [1.0, 0.5, 0.0]);
+    // Beyond every tier: unbounded word spacing.
+    let (r, _, excess, _) = tiered(40.0, &[10.0, 10.0, 10.0], 10.0, &cost);
+    assert!(r > 2.0 && (excess - 10.0).abs() < 1e-9);
+    // Shrink beyond the tiers is infeasible.
+    assert!(!tiered(-25.0, &[10.0, 10.0, 0.0], 0.0, &cost).3);
+    assert!(tiered(-15.0, &[10.0, 10.0, 0.0], 0.0, &cost).3);
+}
+
+#[test]
+fn lines_fit_and_cover_the_paragraph() {
+    let text = [COPY; 2].join(" ");
+    for ragged in [false, true] {
+        for hyphen in [None, Some(50.0)] {
+            let p = vectorcraft(ragged);
+            let para = Para::new(&text, &p, hyphen);
+            for (name, lines) in [("every-line", every_line(&para.items, 180.0, ragged)), ("greedy", greedy(&para.items, &|_| 180.0, &p))] {
+                assert!(lines.len() > 10, "{name}");
+                assert_covers(&para.items, &lines);
+                for l in &lines {
+                    assert!(l.excess >= -p.overrun, "{name} ragged={ragged} {l:?}");
+                    if ragged {
+                        assert!(l.width <= 180.0 + 1e-6, "{name} {l:?}");
+                    }
+                }
+                assert!(lines.last().is_some_and(|l| l.forced));
+            }
+        }
+    }
+}
+
+/// Every-line breaking spreads the spacing more evenly than greedy breaking.
+#[test]
+fn every_line_is_more_even_than_greedy() {
+    let text = [COPY; 2].join(" ");
+    let p = vectorcraft(false);
+    let para = Para::new(&text, &p, None);
+    for width in [150.0, 190.0, 240.0] {
+        let worst = |lines: &[Line]| lines[..lines.len() - 1].iter().map(|l| l.ratio).fold(0.0, f64::max);
+        let (kp, gr) = (worst(&every_line(&para.items, width, false)), worst(&greedy(&para.items, &|_| width, &p)));
+        assert!(kp <= gr + 1e-9, "{width}: every-line worst ratio {kp} vs greedy {gr}");
+    }
+}
+
+/// Ragged: every-line breaks before a word that would fit, so the last line is not a lone short
+/// word; greedy keeps filling the first line.
+#[test]
+fn every_line_balances_ragged_lines() {
+    const S: &str = "Destroy all creatures with toughness X or less.";
+    let width = width_of("Destroy all creatures with toughness X or") + 2.0;
+    let p = vectorcraft(true);
+    let para = Para::new(S, &p, None);
+    assert_eq!(para.lines(&greedy(&para.items, &|_| width, &p)), ["Destroy all creatures with toughness X or", "less."]);
+    assert_eq!(para.lines(&every_line(&para.items, width, true)), ["Destroy all creatures with toughness X", "or less."]);
+}
+
+/// Every-line evens the rag of a long ragged paragraph: the leftover space is no worse than greedy
+/// breaking, with at most one line more. Hyphenated, it trades some rag for fewer hyphens.
+#[test]
+fn every_line_evens_the_rag() {
+    let text = [COPY; 2].join(" ");
+    let p = vectorcraft(true);
+    for (width, hyphen) in [(150.0, None), (190.0, None), (240.0, Some(25.0)), (310.0, None)] {
+        let para = Para::new(&text, &p, hyphen);
+        let rag = |lines: &[Line]| {
+            for l in lines {
+                assert!(l.width <= width + 1e-6, "{width}: {l:?}");
+            }
+            let slack = lines[..lines.len() - 1].iter().map(|l| (width - l.width).powi(2)).sum::<f64>();
+            (slack, lines.len(), lines.iter().filter(|l| l.flagged).count())
+        };
+        let ((kp, kp_n, kp_hy), (gr, gr_n, gr_hy)) = (rag(&every_line(&para.items, width, true)), rag(&greedy(&para.items, &|_| width, &p)));
+        if hyphen.is_some() {
+            assert!(kp_hy < gr_hy, "{width}: {kp_hy} hyphens vs greedy {gr_hy}");
+        } else {
+            assert!(kp <= gr + 1e-6, "{width}: rag {kp} vs greedy {gr}");
+        }
+        assert!(kp_n <= gr_n + 1, "{width}: {kp_n} lines vs {gr_n}");
+    }
+}
+
+/// Greedy: each line takes as many words as fit.
+#[test]
+fn greedy_fills_each_line() {
+    let width = 190.0;
+    let p = vectorcraft(true);
+    let para = Para::new(COPY, &p, None);
+    let lines = para.lines(&greedy(&para.items, &|_| width, &p));
+    for pair in lines.windows(2) {
+        let next_word = pair[1].split(' ').next().unwrap_or_default();
+        assert!(width_of(&format!("{} {next_word}", pair[0])) > width, "{pair:?}");
+    }
+}
+
+#[test]
+fn hyphen_limit_is_a_hard_constraint() {
+    let text = [COPY; 4].join(" ");
+    for limit in [1, 2, 9] {
+        let p = Params { hyphen_limit: limit, ..designcraft(false) };
+        let para = Para::new(&text, &p, Some(0.0));
+        for lines in [break_paragraph(&para.items, &|_| 130.0, &p, &PASSES).lines, greedy(&para.items, &|_| 130.0, &p)] {
+            let mut run = 0;
+            for l in &lines {
+                run = if l.flagged { run + 1 } else { 0 };
+                assert!(run <= limit, "{run} consecutive hyphens with limit {limit}");
+            }
+            assert!(lines.iter().any(|l| l.flagged));
+        }
+    }
+}
+
+#[test]
+fn hyphenation_zone_limits_ragged_hyphens() {
+    let text = [COPY; 4].join(" ");
+    let measure = 110.0;
+    let count = |zone: f64, every_line: bool| {
+        let base = designcraft(true);
+        let p = Params { rag: base.rag.map(|r| Rag { hyphenation_zone: zone, ..r }), ..base };
+        let para = Para::new(&text, &p, Some(0.0));
+        let lines = if every_line { break_paragraph(&para.items, &|_| measure, &p, &PASSES).lines } else { greedy(&para.items, &|_| measure, &p) };
+        // A hyphenated line leaves at least the zone after the last space before its last word.
+        for l in lines.iter().filter(|l| l.flagged) {
+            if let Some(space) = (l.start..l.end).rfind(|&k| para.items[k].kind == Kind::Glue) {
+                let before: f64 = para.items[l.start..space].iter().filter(|i| i.kind != Kind::Penalty).map(|i| i.width).sum();
+                assert!(measure - before >= zone, "every_line={every_line} zone {zone}: {:?}", para.lines(&[*l]));
+            }
+        }
+        lines.iter().filter(|l| l.flagged).count()
+    };
+    for every_line in [true, false] {
+        let (free, zoned, huge) = (count(0.0, every_line), count(36.0, every_line), count(1000.0, every_line));
+        // A huge zone leaves only words that start a line hyphenable.
+        assert!(free > 0 && zoned > 0 && huge * 4 <= free, "every_line={every_line}: {free} {zoned} {huge}");
+    }
+}
+
+#[test]
+fn balanced_lines_even_a_headline() {
+    let p = Params { rag: Some(Rag { stretch: 24.0, width_fraction: 0.0, ..Rag::default() }), ..designcraft(true) };
+    let para = Para::new("Balanced headlines read better than a stub", &p, None);
+    let w = |_| 150.0;
+    let plain = break_paragraph(&para.items, &w, &p, &PASSES).lines;
+    let bal = balanced(&para.items, &w, &p, &PASSES);
+    assert!(bal.balanced);
+    let bal = bal.lines;
+    assert!(plain.len() >= 2 && plain.len() == bal.len(), "{:?} vs {:?}", para.lines(&plain), para.lines(&bal));
+    let spread = |lines: &[Line]| lines.iter().map(|l| l.width).fold(f64::MIN, f64::max) - lines.iter().map(|l| l.width).fold(f64::MAX, f64::min);
+    assert!(spread(&bal) < spread(&plain), "{:?} vs {:?}", para.lines(&bal), para.lines(&plain));
+    assert!(bal.iter().all(|l| l.measure == 150.0));
+}
+
+/// A word wider than the measure breaks at its emergency points, or, for greedy without them,
+/// before the box that overflows.
+#[test]
+fn an_overlong_word_breaks_at_the_measure() {
+    let build = |emergency: bool, ragged: bool| {
+        let p = designcraft(ragged);
+        let glue = if ragged { Item::glue(SPACE, 0.0, 0.0) } else { Item::glue(SPACE, SPACE / 2.0, SPACE / 5.0) };
+        let mut items = vec![Item::boxed(4.0 * CHAR), glue];
+        for i in 0..60 {
+            if i > 0 && emergency {
+                items.push(Item::emergency());
+            }
+            items.push(Item::boxed(CHAR));
+        }
+        items.extend([glue, Item::boxed(3.0 * CHAR), glue, Item::boxed(2.0 * CHAR), Item::fill(), Item::forced()]);
+        (items, p)
+    };
+    let (plain, _) = build(false, false);
+    assert_eq!(overlong(&plain, 72.0), vec![2..62]);
+    for ragged in [false, true] {
+        let (items, p) = build(true, ragged);
+        let (no_points, _) = build(false, ragged);
+        for (name, lines) in [
+            ("every-line", break_paragraph(&items, &|_| 72.0, &p, &PASSES).lines),
+            ("greedy", greedy(&items, &|_| 72.0, &p)),
+            ("greedy, no emergency points", greedy(&no_points, &|_| 72.0, &p)),
+        ] {
+            assert!(lines.len() >= 6, "{name} ragged={ragged}: {lines:?}");
+            for l in &lines {
+                assert!(l.width <= 72.0 + 0.01, "{name} ragged={ragged}: {l:?}");
+            }
+        }
+    }
+}
+
+#[test]
+fn forced_breaks_end_lines_and_the_paragraph_end_is_one() {
+    let p = designcraft(false);
+    // No forced penalty at the end: the paragraph end is the last break.
+    let items = [Item::boxed(30.0), Item::glue(SPACE, 1.5, 0.6), Item::boxed(30.0), Item::fill(), Item::forced(), Item::boxed(30.0)];
+    for lines in [break_paragraph(&items, &|_| 100.0, &p, &PASSES).lines, greedy(&items, &|_| 100.0, &p)] {
+        assert_eq!(lines.iter().map(|l| (l.start, l.end, l.forced)).collect::<Vec<_>>(), [(0, 4, true), (5, 6, true)]);
+        // The last line is justified: it has no fill and nothing to stretch.
+        assert!(lines[1].ratio.is_infinite());
+    }
+    // Empty paragraph: one empty line.
+    for lines in [break_paragraph(&[], &|_| 100.0, &p, &PASSES).lines, greedy(&[], &|_| 100.0, &p)] {
+        assert_eq!(lines.iter().map(|l| (l.start, l.end, l.next)).collect::<Vec<_>>(), [(0, 0, 0)]);
+    }
+}
+
+/// The measure is per line: a first-line indent narrows line 0 only.
+#[test]
+fn each_line_gets_its_own_measure() {
+    let p = Params { uniform_from: 1, ..vectorcraft(true) };
+    let para = Para::new(COPY, &p, None);
+    let w = |k: usize| if k == 0 { 120.0 } else { 200.0 };
+    for lines in [break_paragraph(&para.items, &w, &p, &[1.0, f64::INFINITY]).lines, greedy(&para.items, &w, &p)] {
+        for (k, l) in lines.iter().enumerate() {
+            assert_eq!(l.measure, w(k));
+            assert!(l.width <= w(k) + 1e-6, "{k}: {l:?}");
+        }
+        assert!(lines[1].width > 120.0);
+    }
+}
+
+/// Punctuation hanging into the margin gives its width back: the line fits with the word after it.
+#[test]
+fn a_hanging_break_gives_its_width_back() {
+    let p = designcraft(true);
+    let items = |hang: f64| {
+        [
+            Item::boxed(60.0),
+            Item::glue(5.0, 0.0, 0.0),
+            Item::boxed(40.0),
+            Item { hang, ..Item::glue(5.0, 0.0, 0.0) },
+            Item::boxed(30.0),
+            Item::fill(),
+            Item::forced(),
+        ]
+    };
+    for (hang, end) in [(0.0, 1), (5.0, 3)] {
+        let items = items(hang);
+        for lines in [break_paragraph(&items, &|_| 100.0, &p, &PASSES).lines, greedy(&items, &|_| 100.0, &p)] {
+            assert_eq!(lines[0].end, end, "hang {hang}: {lines:?}");
+        }
+    }
+}
+
+/// Justification uses word spacing first, then letter spacing.
+#[test]
+fn justification_uses_tiers_in_order() {
+    let p = designcraft(false);
+    let letters = Item { stretch: [0.0, 10.0, 0.0], ..Item::boxed(40.0) };
+    let items = [letters, Item::glue(10.0, 6.0, 0.0), letters, Item::forced()];
+    let lines = break_paragraph(&items, &|_| 100.0, &p, &PASSES).lines;
+    let l = lines[0];
+    assert_eq!(l.tiers, [1.0, 0.2, 0.0]);
+    assert!((l.ratio - (1.0 + 0.2 * p.tier_cost[1])).abs() < 1e-9, "{l:?}");
+}
+
+/// Letter spacing and glyph scaling absorb what word spacing alone cannot in a narrow column.
+#[test]
+fn letter_and_glyph_tiers_ease_a_narrow_column() {
+    let worst = |box_stretch: f64| {
+        let p = designcraft(false);
+        let mut para = Para::new(COPY, &p, Some(275.0));
+        for it in para.items.iter_mut().filter(|i| i.kind == Kind::Box) {
+            it.stretch = [0.0, it.width * box_stretch, it.width * box_stretch];
+            it.shrink = [0.0, it.width * box_stretch / 2.0, it.width * box_stretch / 2.0];
+        }
+        let lines = break_paragraph(&para.items, &|_| 100.0, &p, &PASSES).lines;
+        lines[..lines.len() - 1].iter().map(|l| l.ratio).fold(0.0, f64::max)
+    };
+    let (words, all) = (worst(0.0), worst(0.03));
+    assert!(all < words, "{all} vs {words}");
+}
+
+/// A long ragged paragraph with a constant measure breaks by Knuth–Plass under the default
+/// parameters and effectcraft's infinitely tolerant rag, without reaching the active-break limit.
+#[test]
+fn a_long_ragged_paragraph_stays_on_knuth_plass() {
+    let mut seed = 1u32;
+    let mut items = Vec::new();
+    for i in 0..5000 {
+        if i > 0 {
+            items.push(Item::glue(1.0, 0.0, 0.0));
+        }
+        seed = seed.wrapping_mul(1_103_515_245).wrapping_add(12_345);
+        items.push(Item::boxed(f64::from(3 + (seed >> 16) % 5)));
+    }
+    items.extend([Item::fill(), Item::forced()]);
+    let default = Params { rag: Some(Rag::default()), ..Params::default() };
+    let effectcraft = Params { rag: Some(Rag { width_fraction: 1.0, ..Rag::default() }), ..Params::default() };
+    for (p, tolerances) in [(default, &[2.5][..]), (effectcraft, &[f64::INFINITY][..])] {
+        let b = break_paragraph(&items, &|_| 60.0, &p, tolerances);
+        assert_eq!(b.method, Method::KnuthPlass { pass: 0 }, "{p:?}");
+        assert_covers(&items, &b.lines);
+    }
+}
+
+/// A NaN measure counts as 0 and negative fitness demerits as 0.
+#[test]
+fn invalid_params_are_clamped() {
+    let p = designcraft(false);
+    let para = Para::new(COPY, &p, None);
+    let lines = break_paragraph(&para.items, &|_| f64::NAN, &p, &PASSES).lines;
+    assert_eq!(lines, break_paragraph(&para.items, &|_| 0.0, &p, &PASSES).lines);
+    assert!(lines.iter().all(|l| l.measure == 0.0 && !l.excess.is_nan()));
+    let negative = Params { fitness_demerits: -5000.0, ..p };
+    let zero = Params { fitness_demerits: 0.0, ..p };
+    assert_eq!(break_paragraph(&para.items, &|_| 150.0, &negative, &PASSES), break_paragraph(&para.items, &|_| 150.0, &zero, &PASSES));
+}
+
+/// Two consecutive breaks: the line after the first starts past the second, which must not end a
+/// line `4..3` from there.
+#[test]
+fn lines_never_end_before_they_start() {
+    let items = [
+        Item::boxed(10.0),
+        Item::glue(1.0, 0.0, 0.0),
+        Item::penalty(0.0, -1000.0, false),
+        Item::penalty(0.0, -1000.0, false),
+        Item::boxed(10.0),
+        Item::fill(),
+        Item::forced(),
+    ];
+    let p = Params { rag: Some(Rag { width_fraction: 1.0, ..Rag::default() }), ..Params::default() };
+    let lines = break_paragraph(&items, &|_| 11.0, &p, &[2.5, f64::INFINITY]).lines;
+    assert!(lines.iter().all(|l| l.start <= l.end && l.end <= l.next), "{lines:?}");
+    assert_covers(&items, &lines);
+}
+
+fn spans(lines: &[Line]) -> Vec<(usize, usize)> {
+    lines.iter().map(|l| (l.start, l.end)).collect()
+}
+
+/// A final word wider than the measure is one overfull line: the fill before the forced break
+/// doesn't end it and leave an empty line. Consecutive forced breaks still make an empty line.
+#[test]
+fn an_overlong_last_word_adds_no_empty_line() {
+    let fill = [Item::boxed(20.0), Item::fill(), Item::forced()];
+    assert_eq!(spans(&break_paragraph(&fill, &|_| 11.0, &Params::default(), &[2.5, f64::INFINITY]).lines), [(0, 2)]);
+    let forced = [Item::boxed(20.0), Item::forced(), Item::forced()];
+    assert_eq!(spans(&break_paragraph(&forced, &|_| 11.0, &Params::default(), &[2.5, f64::INFINITY]).lines), [(0, 1), (2, 2)]);
+}
+
+/// Overfull lines keep the hyphen limit too: with a limit of 1, no two consecutive lines end at a
+/// hyphen even when every line is overfull.
+#[test]
+fn overfull_lines_keep_the_hyphen_limit() {
+    let items =
+        [Item::boxed(10.0), Item::penalty(1.0, 0.0, true), Item::boxed(10.0), Item::penalty(1.0, 0.0, true), Item::boxed(10.0), Item::forced()];
+    let p = Params { hyphen_limit: 1, ..Params::default() };
+    let lines = break_paragraph(&items, &|_| 5.0, &p, &[2.5, f64::INFINITY]).lines;
+    assert!(lines.windows(2).all(|w| !(w[0].flagged && w[1].flagged)), "{lines:?}");
+    assert_eq!(spans(&lines), [(0, 1), (2, 5)]);
+}
diff --git a/crates/text/src/segment/complex.rs b/crates/text/src/segment/complex.rs
new file mode 100644
index 00000000..57a625a2
--- /dev/null
+++ b/crates/text/src/segment/complex.rs
@@ -0,0 +1,50 @@
+//! Word breaks inside Thai, Lao, Khmer and Burmese runs. UAX #14 gives these scripts class SA
+//! ("complex context") and leaves breaking inside them to a dictionary; ICU4X's segmenter supplies
+//! it, with its dictionaries or, with the `lstm` feature, its LSTM models. Only runs of the scripts
+//! whose language feature is on are segmented.
+
+use icu_segmenter::options::LineBreakOptions;
+use icu_segmenter::{LineSegmenter, LineSegmenterBorrowed};
+use unicode_linebreak::{BreakClass, break_property};
+
+/// Builds ICU4X's line segmenter with one model for the complex scripts. The models are static
+/// data; building the segmenter only looks them up.
+pub(super) type Model = fn(LineBreakOptions<'static>) -> LineSegmenterBorrowed<'static>;
+
+/// The model `line_breaks` uses: the LSTM models with the `lstm` feature, else the dictionaries.
+#[cfg(feature = "lstm")]
+pub(super) const MODEL: Model = LineSegmenter::new_lstm;
+#[cfg(not(feature = "lstm"))]
+pub(super) const MODEL: Model = LineSegmenter::new_dictionary;
+
+/// Byte offsets inside `text` where a run of an enabled script may break between words, in order.
+/// Run starts and ends are left to UAX #14.
+pub(super) fn word_breaks(text: &str, model: Model) -> Vec<usize> {
+    let mut out = Vec::new();
+    let mut segmenter = None;
+    let mut run_start = None;
+    let ends = text.char_indices().map(|(i, c)| (i, segmented(c))).chain(std::iter::once((text.len(), false)));
+    for (i, inside) in ends {
+        match (run_start, inside) {
+            (None, true) => run_start = Some(i),
+            (Some(start), false) => {
+                run_start = None;
+                let Some(run) = text.get(start..i) else { continue };
+                let seg = *segmenter.get_or_insert_with(|| model(LineBreakOptions::default()));
+                out.extend(seg.segment_str(run).filter(|&o| o > 0 && o < run.len()).map(|o| start + o));
+            }
+            _ => {}
+        }
+    }
+    out
+}
+
+/// A character of an enabled script that UAX #14 leaves to the word segmenter.
+fn segmented(c: char) -> bool {
+    let u = c as u32;
+    let enabled = (cfg!(feature = "thai") && matches!(u, 0x0E00..=0x0E7F))
+        || (cfg!(feature = "lao") && matches!(u, 0x0E80..=0x0EFF))
+        || (cfg!(feature = "khmer") && matches!(u, 0x1780..=0x17FF | 0x19E0..=0x19FF))
+        || (cfg!(feature = "burmese") && matches!(u, 0x1000..=0x109F | 0xA9E0..=0xA9FF | 0xAA60..=0xAA7F));
+    enabled && break_property(u) == BreakClass::ComplexContext
+}
diff --git a/crates/text/src/segment/kinsoku.rs b/crates/text/src/segment/kinsoku.rs
new file mode 100644
index 00000000..c4d52ba0
--- /dev/null
+++ b/crates/text/src/segment/kinsoku.rs
@@ -0,0 +1,119 @@
+//! Kinsoku character sets (JLREQ 3.1.7–3.1.8, CLREQ 3.1.7). The sets are VectorCraft's, with the
+//! additions listed in the crate README.
+
+use super::Kinsoku;
+
+/// Whether kinsoku lets a line break between `before` and `after` (`None`: the end of the
+/// paragraph). `Hard` keeps every character of the set off the line start and end; `Soft` lets
+/// 々, ー and small kana start a line; `None` allows every break. Breaks with no East Asian
+/// character on either side are always allowed, so Latin text keeps its own rules.
+pub fn kinsoku_allows(before: char, after: Option<char>, mode: Kinsoku) -> bool {
+    if mode == Kinsoku::None || (!is_east_asian(before) && !after.is_some_and(is_east_asian)) {
+        return true;
+    }
+    let start_ok = |c: char| !no_line_start(c) || (mode == Kinsoku::Soft && soft_line_start(c));
+    !no_line_end(before) && after.is_none_or(start_ok)
+}
+
+/// East Asian text for kinsoku: Han, kana, bopomofo, Hangul syllables and compatibility jamo, CJK
+/// punctuation and symbols, full-width and half-width forms. Not the ideographic space, conjoining
+/// jamo or the (combining and spacing) kana sound marks, which never take a break before them.
+pub(crate) fn is_east_asian(c: char) -> bool {
+    matches!(c as u32,
+        0x2E80..=0x2FFF          // radicals, ideographic description
+        | 0x3001..=0x3096        // CJK symbols and punctuation, hiragana
+        | 0x309D..=0x30FF        // hiragana iteration marks, katakana
+        | 0x3100..=0x312F        // bopomofo
+        | 0x3131..=0x318F        // Hangul compatibility jamo
+        | 0x3190..=0x33FF        // kanbun, strokes, small katakana, enclosed and compatibility forms
+        | 0x3400..=0x4DBF        // CJK extension A
+        | 0x4E00..=0x9FFF        // CJK unified ideographs
+        | 0xAC00..=0xD7A3        // Hangul syllables
+        | 0xF900..=0xFAFF        // compatibility ideographs
+        | 0xFE30..=0xFE4F        // CJK compatibility forms
+        | 0xFF01..=0xFF9D        // full-width forms, half-width katakana
+        | 0xFFA0..=0xFFEF        // half-width Hangul, full-width signs
+        | 0x20000..=0x3FFFF) // supplementary ideographs
+}
+
+/// A character that can't start a line: closing brackets and quotes, hyphens, dividing
+/// punctuation, middle dots, colons, full stops and commas, iteration marks, the prolonged sound
+/// mark, small kana, kana sound marks and postfixed abbreviations (JLREQ cl-02 to cl-07, cl-09 to
+/// cl-11, cl-13).
+pub(crate) fn no_line_start(c: char) -> bool {
+    matches!(c,
+        ')' | ']' | '}' | ',' | '.' | ':' | ';' | '!' | '?' | '»' | '’' | '”' | '‐' | '–' | '‼' | '⁇' | '⁈' | '⁉'
+        | '、' | '。' | '〉' | '》' | '」' | '』' | '】' | '〕' | '〗' | '〙' | '〛' | '〞' | '〟' | '〜' | '゠' | '・' | '｠'
+        | 'ー' | 'ゝ' | 'ゞ' | 'ヽ' | 'ヾ' | '々' | '〻' | '゛' | '゜'
+        | 'ぁ' | 'ぃ' | 'ぅ' | 'ぇ' | 'ぉ' | 'っ' | 'ゃ' | 'ゅ' | 'ょ' | 'ゎ' | 'ゕ' | 'ゖ'
+        | 'ァ' | 'ィ' | 'ゥ' | 'ェ' | 'ォ' | 'ッ' | 'ャ' | 'ュ' | 'ョ' | 'ヮ' | 'ヵ' | 'ヶ' | 'ㇰ'..='ㇿ'
+        | '！' | '％' | '）' | '，' | '．' | '：' | '；' | '？' | '］' | '｝' | '～' | '｡' | '｣' | '､' | '･' | 'ｰ' | 'ｧ'..='ｯ'
+        | 'ﾞ' | 'ﾟ' | '￠')
+}
+
+/// A character of [`no_line_start`] that may start a line under [`Kinsoku::Soft`]: 々, the
+/// prolonged sound mark ー (JLREQ cl-10) and small kana (cl-11), as JLREQ's level 3 rules allow
+/// (Appendix C.3, <https://www.w3.org/TR/jlreq/#addendum_a3>). Half-width forms aren't in those
+/// classes.
+pub(crate) fn soft_line_start(c: char) -> bool {
+    matches!(
+        c,
+        '々' | 'ー'
+            | 'ぁ'
+            | 'ぃ'
+            | 'ぅ'
+            | 'ぇ'
+            | 'ぉ'
+            | 'っ'
+            | 'ゃ'
+            | 'ゅ'
+            | 'ょ'
+            | 'ゎ'
+            | 'ゕ'
+            | 'ゖ'
+            | 'ァ'
+            | 'ィ'
+            | 'ゥ'
+            | 'ェ'
+            | 'ォ'
+            | 'ッ'
+            | 'ャ'
+            | 'ュ'
+            | 'ョ'
+            | 'ヮ'
+            | 'ヵ'
+            | 'ヶ'
+            | 'ㇰ'..='ㇿ'
+    )
+}
+
+/// A character that can't end a line: opening brackets and quotes, and prefixed abbreviations
+/// (JLREQ cl-01, cl-12).
+pub(crate) fn no_line_end(c: char) -> bool {
+    matches!(
+        c,
+        '(' | '['
+            | '{'
+            | '«'
+            | '‘'
+            | '“'
+            | '〈'
+            | '《'
+            | '「'
+            | '『'
+            | '【'
+            | '〔'
+            | '〖'
+            | '〘'
+            | '〚'
+            | '〝'
+            | '（'
+            | '［'
+            | '｛'
+            | '｟'
+            | '｢'
+            | '＄'
+            | '￡'
+            | '￥'
+    )
+}
diff --git a/crates/text/src/segment/mod.rs b/crates/text/src/segment/mod.rs
new file mode 100644
index 00000000..ebfbd420
--- /dev/null
+++ b/crates/text/src/segment/mod.rs
@@ -0,0 +1,164 @@
+//! Line-break opportunities for text layout: where a composer may end a line, as byte offsets into
+//! the paragraph. Font-independent; measuring and choosing among the breaks stays in the composer.
+//!
+//! [`line_breaks`] starts from the Unicode line-breaking algorithm (UAX #14, through
+//! [`unicode_linebreak`]) and adjusts it:
+//! - **Kinsoku** ([`Kinsoku`]): the Japanese and Chinese line-start and line-end rules (JLREQ,
+//!   CLREQ). Closing brackets, commas, full stops, small kana and the like don't start a line;
+//!   opening brackets don't end one. The rules apply only next to East Asian characters, so text
+//!   without them gets UAX #14's breaks unchanged.
+//! - **Korean words** ([`Options::korean_words`]): Korean set word by word, breaking at spaces.
+//! - **Thai, Lao, Khmer and Burmese**: UAX #14 leaves these scripts (class SA) to a dictionary and
+//!   never breaks inside a run of them. With the language feature (`thai`, `lao`, `khmer`,
+//!   `burmese`) the run is split into words by ICU4X's segmenter: its dictionaries by default, its
+//!   much smaller LSTM models with the `lstm` feature.
+//!
+//! [`Options::for_language`] picks the options for a paragraph's language. When no opportunity
+//! leaves a line short enough, [`emergency_breaks`] gives the places to break a word anyway:
+//! between grapheme clusters, never inside one.
+//!
+//! Composers that build their own opportunity lists can filter them with [`kinsoku_allows`].
+
+#[cfg(any(feature = "thai", feature = "lao", feature = "khmer", feature = "burmese"))]
+mod complex;
+mod kinsoku;
+#[cfg(test)]
+mod tests;
+
+use std::ops::Range;
+
+use unicode_linebreak::{BreakClass, BreakOpportunity, break_property};
+
+pub use kinsoku::kinsoku_allows;
+use kinsoku::{is_east_asian, soft_line_start};
+use unicode_segmentation::UnicodeSegmentation;
+
+/// Which kinsoku (line-start and line-end) rules apply.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+#[non_exhaustive]
+pub enum Kinsoku {
+    /// No kinsoku: a line may also break between any two East Asian characters, punctuation
+    /// included.
+    None,
+    /// Closing brackets, commas, full stops, iteration marks, the prolonged sound mark, small kana
+    /// and the like don't start a line; opening brackets don't end one.
+    #[default]
+    Hard,
+    /// As `Hard`, except that 々, the prolonged sound mark ー and small kana may start a line
+    /// (JLREQ's relaxed rules, Appendix C.3).
+    Soft,
+}
+
+/// How [`line_breaks`] adjusts UAX #14.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub struct Options {
+    pub kinsoku: Kinsoku,
+    /// Set Korean word by word (KLREQ): no break between two Hangul letters or Han ideographs
+    /// (hanja), only at spaces and punctuation. For Korean-language text only, since Han
+    /// ideographs count as Korean letters. Off, Korean breaks between syllables as UAX #14 does.
+    pub korean_words: bool,
+}
+
+impl Options {
+    /// The options for text in `language`, a BCP 47 tag such as `ja` or `ko-KR` (`None`: unknown).
+    /// Korean is set word by word; every other language, and an unknown one, gets the defaults.
+    /// Thai, Lao, Khmer and Burmese words are found by script, whatever the language.
+    pub fn for_language(language: Option<&str>) -> Self {
+        let primary = language.and_then(|tag| tag.split(['-', '_']).next()).unwrap_or_default();
+        Self { korean_words: primary.eq_ignore_ascii_case("ko"), ..Self::default() }
+    }
+}
+
+/// A place where a line may end: the next line starts at byte `offset`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+#[non_exhaustive]
+pub struct Break {
+    pub offset: usize,
+    /// The line must end here (after a newline or another hard break, and at the end of the text).
+    pub mandatory: bool,
+}
+
+/// Line-break opportunities in `text`, in order. The last one is the end of the text (mandatory);
+/// empty text has none.
+pub fn line_breaks(text: &str, options: &Options) -> Vec<Break> {
+    #[cfg(any(feature = "thai", feature = "lao", feature = "khmer", feature = "burmese"))]
+    let words = complex::word_breaks(text, complex::MODEL);
+    #[cfg(not(any(feature = "thai", feature = "lao", feature = "khmer", feature = "burmese")))]
+    let words = Vec::new();
+    breaks_with_words(text, options, words)
+}
+
+/// [`line_breaks`], given the word breaks inside Thai, Lao, Khmer and Burmese runs (sorted).
+fn breaks_with_words(text: &str, options: &Options, words: Vec<usize>) -> Vec<Break> {
+    if text.is_empty() {
+        return Vec::new();
+    }
+    let mut uax = unicode_linebreak::linebreaks(text).peekable();
+    let mut words = words.into_iter().peekable();
+    let mut out = Vec::new();
+    // The last character before the boundary that isn't a combining mark: kinsoku looks at the
+    // character a mark belongs to.
+    let mut base: Option<char> = None;
+    let mut after_mark = false;
+    for (i, c) in text.char_indices() {
+        if i > 0 {
+            // Both lists are sorted by offset: take the entry for `i` from each, if it has one.
+            let uax_here = uax.next_if(|&(o, _)| o == i).map(|(_, op)| op);
+            let word = words.next_if(|&o| o == i).is_some();
+            let allowed = uax_here.is_some() || word;
+            let brk = if uax_here == Some(BreakOpportunity::Mandatory) {
+                Some(true)
+            } else {
+                adjust(allowed, base, after_mark, c, options).then_some(false)
+            };
+            if let Some(mandatory) = brk {
+                out.push(Break { offset: i, mandatory });
+            }
+        }
+        after_mark = is_mark(c);
+        if !after_mark {
+            base = Some(c);
+        }
+    }
+    out.push(Break { offset: text.len(), mandatory: true });
+    out
+}
+
+/// Emergency breaks for `text[range]`, a piece between two [`line_breaks`] that is too long for a
+/// line: byte offsets into `text`, strictly inside `range` and in order, between extended grapheme
+/// clusters (UAX #29). An emoji ZWJ sequence, a flag or a letter with its marks stays whole. Empty
+/// if `range` isn't on char boundaries of `text`.
+pub fn emergency_breaks(text: &str, range: Range<usize>) -> Vec<usize> {
+    let Some(piece) = text.get(range.clone()) else { return Vec::new() };
+    piece.grapheme_indices(true).skip(1).map(|(o, _)| range.start + o).collect()
+}
+
+/// Whether a line may break between `before` and `after`, given whether UAX #14 (or the word
+/// segmenter) allows it. `after_mark`: the character right before the boundary is a combining
+/// mark, joiner or variation selector that belongs to `before`.
+fn adjust(allowed: bool, before: Option<char>, after_mark: bool, after: char, options: &Options) -> bool {
+    let Some(before) = before else { return allowed };
+    // The East Asian breaks UAX #14 lacks go only between two base characters: never inside a
+    // cluster, so not after a joiner or before a mark.
+    let east_asian_pair = !after_mark && is_east_asian(before) && is_east_asian(after) && !is_mark(after);
+    let allowed = match options.kinsoku {
+        Kinsoku::None => allowed || east_asian_pair,
+        // UAX #14 keeps small kana, ー and 々 (classes CJ and NS) off the line start.
+        Kinsoku::Soft => (allowed || (east_asian_pair && soft_line_start(after))) && kinsoku_allows(before, Some(after), Kinsoku::Soft),
+        Kinsoku::Hard => allowed && kinsoku_allows(before, Some(after), Kinsoku::Hard),
+    };
+    allowed && !(options.korean_words && is_korean_letter(before) && is_korean_letter(after))
+}
+
+/// A combining mark, variation selector or joiner (UAX #14 classes CM and ZWJ): it belongs to the
+/// character before it.
+fn is_mark(c: char) -> bool {
+    matches!(break_property(c as u32), BreakClass::CombiningMark | BreakClass::ZeroWidthJoiner)
+}
+
+/// Hangul in every form, and Han ideographs (read as hanja).
+fn is_korean_letter(c: char) -> bool {
+    matches!(c as u32,
+        0x1100..=0x11FF | 0x3131..=0x318F | 0xA960..=0xA97F | 0xAC00..=0xD7FF | 0xFFA0..=0xFFDC
+        | 0x3400..=0x4DBF | 0x4E00..=0x9FFF | 0xF900..=0xFAFF | 0x20000..=0x3FFFF)
+}
diff --git a/crates/text/src/segment/tests.rs b/crates/text/src/segment/tests.rs
new file mode 100644
index 00000000..d1d2a0f4
--- /dev/null
+++ b/crates/text/src/segment/tests.rs
@@ -0,0 +1,242 @@
+use super::kinsoku::{no_line_end, no_line_start};
+use super::*;
+
+fn opts(kinsoku: Kinsoku) -> Options {
+    Options { kinsoku, ..Options::default() }
+}
+
+/// Byte offsets of the breaks before the end of the text.
+fn offsets(text: &str, options: &Options) -> Vec<usize> {
+    line_breaks(text, options).iter().map(|b| b.offset).filter(|&o| o < text.len()).collect()
+}
+
+/// The text from each break before the end to the next break.
+fn pieces(text: &str, options: &Options) -> Vec<String> {
+    let mut from = 0;
+    let mut out = Vec::new();
+    for b in line_breaks(text, options) {
+        out.push(text.get(from..b.offset).unwrap_or_default().to_string());
+        from = b.offset;
+    }
+    out
+}
+
+/// The character each line after the first could start with.
+fn starts(text: &str, options: &Options) -> Vec<char> {
+    offsets(text, options).iter().filter_map(|&o| text.get(o..).and_then(|t| t.chars().next())).collect()
+}
+
+#[test]
+fn kinsoku_keeps_closing_marks_off_line_starts_and_opening_ones_off_line_ends() {
+    for (a, b) in
+        [('字', '。'), ('弧', '」'), ('」', '、'), ('ャ', 'ー'), ('カ', 'ッ'), ('「', 'か'), ('（', '雅'), ('字', '〞'), ('１', '％'), ('＄', '１')]
+    {
+        assert!(!kinsoku_allows(a, Some(b), Kinsoku::Hard), "{a}{b}");
+    }
+    for (a, b) in [('。', '雅'), ('」', 'は'), ('字', '「'), ('の', '演')] {
+        assert!(kinsoku_allows(a, Some(b), Kinsoku::Hard), "{a}{b}");
+    }
+    assert!(kinsoku_allows('。', None, Kinsoku::Hard));
+    // No East Asian character on either side: Latin rules apply.
+    assert!(kinsoku_allows(' ', Some('–'), Kinsoku::Hard));
+    assert!(!kinsoku_allows('字', Some(')'), Kinsoku::Hard));
+}
+
+/// Soft kinsoku lets 々, ー and small kana (JLREQ cl-09's 々, cl-10, cl-11) start a line and keeps
+/// the rest of the set (half-width forms aren't in those classes); None allows any break.
+#[test]
+fn soft_kinsoku_lets_small_kana_and_the_prolonged_sound_mark_start_a_line() {
+    for (a, b) in [('ャ', 'ー'), ('カ', 'ッ'), ('時', '々'), ('ト', 'ㇰ'), ('か', 'ゃ')] {
+        assert!(!kinsoku_allows(a, Some(b), Kinsoku::Hard), "{a}{b}");
+        assert!(kinsoku_allows(a, Some(b), Kinsoku::Soft), "{a}{b}");
+    }
+    for (a, b) in [('字', '。'), ('弧', '」'), ('「', 'か'), ('ｶ', 'ｯ'), ('ｶ', 'ｰ'), ('字', 'ゝ')] {
+        assert!(!kinsoku_allows(a, Some(b), Kinsoku::Soft), "{a}{b}");
+        assert!(kinsoku_allows(a, Some(b), Kinsoku::None), "{a}{b}");
+    }
+}
+
+#[test]
+fn no_break_puts_a_closing_mark_at_a_line_start_or_an_opening_one_at_a_line_end() {
+    let text = "あいうえお。かきくけ「こさしすせそ」";
+    let breaks = offsets(text, &Options::default());
+    assert!(breaks.len() > 10, "{breaks:?}");
+    for o in breaks {
+        let (head, tail) = text.split_at(o);
+        let (Some(last), Some(first)) = (head.chars().next_back(), tail.chars().next()) else { continue };
+        assert!(!no_line_start(first) && !no_line_end(last), "break at {o}: {last}|{first}");
+    }
+}
+
+/// あカッ breaks before ッ with Soft and None (a small kana may start a line) and not with Hard; a
+/// full stop never starts a line, Soft or not.
+#[test]
+fn kinsoku_mode_decides_whether_a_small_kana_may_start_a_line() {
+    assert_eq!(starts("あカッ", &opts(Kinsoku::Hard)), ['カ']);
+    assert_eq!(starts("あカッ", &opts(Kinsoku::Soft)), ['カ', 'ッ']);
+    assert_eq!(starts("あカッ", &opts(Kinsoku::None)), ['カ', 'ッ']);
+    assert_eq!(starts("あカ。", &opts(Kinsoku::Soft)), ['カ']);
+    assert_eq!(starts("あカ。", &opts(Kinsoku::None)), ['カ', '。']);
+}
+
+#[test]
+fn kinsoku_adjusts_uax14_next_to_east_asian_text_only() {
+    let ja = "日本語、「漢字」。テスト";
+    let on = starts(ja, &opts(Kinsoku::Hard));
+    for c in ['、', '」', '。', '漢'] {
+        assert!(!on.contains(&c), "kinsoku: no line starts with {c}: {on:?}");
+    }
+    assert!(on.contains(&'「') && on.contains(&'テ'), "{on:?}");
+    let off = starts(ja, &opts(Kinsoku::None));
+    for c in ['、', '」', '。', '漢'] {
+        assert!(off.contains(&c), "no kinsoku: a line may start with {c}: {off:?}");
+    }
+    let en = "Hello wonderful (world), 50%.";
+    for k in [Kinsoku::None, Kinsoku::Soft] {
+        assert_eq!(starts(en, &opts(k)), starts(en, &opts(Kinsoku::Hard)));
+    }
+    assert_eq!(starts(en, &Options::default()), ['w', '(', '5']);
+}
+
+#[test]
+fn breaks_are_byte_offsets_and_newlines_are_mandatory() {
+    let b = line_breaks("a b\nc", &Options::default());
+    let got: Vec<(usize, bool)> = b.iter().map(|b| (b.offset, b.mandatory)).collect();
+    assert_eq!(got, [(2, false), (4, true), (5, true)]);
+    assert!(line_breaks("", &Options::default()).is_empty());
+    // A variation selector belongs to its ideograph: no break before it, kinsoku reads the base.
+    assert_eq!(pieces("字\u{FE00}字\u{FE00}。", &Options::default()), ["字\u{FE00}", "字\u{FE00}。"]);
+}
+
+/// The East Asian breaks that None and Soft add to UAX #14 never split a cluster: not after a
+/// joiner, not before a combining mark or variation selector.
+#[test]
+fn no_kinsoku_mode_breaks_inside_a_cluster() {
+    for k in [Kinsoku::None, Kinsoku::Soft, Kinsoku::Hard] {
+        let o = opts(k);
+        assert_eq!(pieces("日本\u{200D}語", &o), ["日", "本\u{200D}語"], "{k:?}");
+        assert_eq!(pieces("あカ\u{200D}ッ", &o), ["あ", "カ\u{200D}ッ"], "{k:?}");
+        assert_eq!(pieces("葛\u{E0100}城", &o), ["葛\u{E0100}", "城"], "{k:?}");
+        assert_eq!(pieces("字\u{3099}\u{FE00}字", &o), ["字\u{3099}\u{FE00}", "字"], "{k:?}");
+    }
+}
+
+#[test]
+fn korean_words_break_at_spaces_only() {
+    let text = "한국어 문장(文章)입니다";
+    assert_eq!(pieces(text, &Options::default()), ["한", "국", "어 ", "문", "장", "(文", "章)", "입", "니", "다"]);
+    let words = Options { korean_words: true, ..Options::default() };
+    assert_eq!(pieces(text, &words), ["한국어 ", "문장", "(文章)", "입니다"]);
+}
+
+#[cfg(not(feature = "thai"))]
+#[test]
+fn thai_without_its_feature_breaks_as_uax14() {
+    assert_eq!(pieces("ภาษาไทยภาษาไทย ไทย", &Options::default()), ["ภาษาไทยภาษาไทย ", "ไทย"]);
+}
+
+/// Each model available in this build, for the complex-script tests.
+#[cfg(any(feature = "thai", feature = "lao", feature = "khmer", feature = "burmese"))]
+fn models() -> Vec<(&'static str, complex::Model)> {
+    use icu_segmenter::LineSegmenter;
+    #[allow(unused_mut)]
+    let mut models: Vec<(&str, complex::Model)> = vec![("dictionary", LineSegmenter::new_dictionary)];
+    #[cfg(feature = "lstm")]
+    models.push(("lstm", LineSegmenter::new_lstm));
+    models
+}
+
+/// Breaks every model puts in `words.concat()` fall between two of `words`, and there are at least
+/// `min` of them. `words` splits compounds where a model may break them.
+#[cfg(any(feature = "thai", feature = "lao", feature = "khmer", feature = "burmese"))]
+fn assert_word_breaks(words: &[&str], min: usize) {
+    let text = words.concat();
+    let bounds: Vec<usize> = words
+        .iter()
+        .scan(0, |end, w| {
+            *end += w.len();
+            Some(*end)
+        })
+        .collect();
+    for (name, model) in models() {
+        let breaks = breaks_with_words(&text, &Options::default(), complex::word_breaks(&text, model));
+        let inside: Vec<usize> = breaks.iter().map(|b| b.offset).filter(|&o| o < text.len()).collect();
+        let shown: Vec<&str> = std::iter::once(0)
+            .chain(inside.iter().copied())
+            .zip(inside.iter().copied().chain([text.len()]))
+            .filter_map(|(a, b)| text.get(a..b))
+            .collect();
+        assert!(inside.iter().all(|o| bounds.contains(o)), "{name}: {shown:?}");
+        assert!(inside.len() >= min, "{name}: {shown:?}");
+    }
+}
+
+#[cfg(feature = "thai")]
+#[test]
+fn thai_breaks_between_words() {
+    assert_word_breaks(&["Thai: ", "ภาษา", "ไทย", "เป็น", "ภาษา", "ราชการ", "ของ", "ประเทศ", "ไทย."], 6);
+}
+
+#[cfg(feature = "lao")]
+#[test]
+fn lao_breaks_between_words() {
+    assert_word_breaks(&["ພາສາ", "ລາວ", "ເປັນ", "ພາສາ", "ລາດ", "ຊະ", "ການ", "ຂອງ", "ປະເທດ", "ລາວ"], 5);
+}
+
+#[cfg(feature = "khmer")]
+#[test]
+fn khmer_breaks_between_words() {
+    assert_word_breaks(&["ភាសា", "ខ្មែរ", "ជា", "ភាសា", "ផ្លូវ", "ការ", "នៃ", "ប្រទេស", "កម្ពុជា"], 5);
+}
+
+/// Burmese may break between any two syllables, and the LSTM model splits some words there
+/// (မြန်|မာ): the expected breaks are the syllable boundaries.
+#[cfg(feature = "burmese")]
+#[test]
+fn burmese_breaks_between_syllables() {
+    let syllables = ["မြန်", "မာ", "ဘာ", "သာ", "စ", "ကား", "သည်", "မြန်", "မာ", "နိုင်", "ငံ", "၏", "ရုံး", "သုံး", "ဘာ", "သာ", "စ", "ကား", "ဖြစ်", "သည်"];
+    assert_word_breaks(&syllables, 5);
+}
+
+/// Chinese full-width punctuation: no line starts with a closing mark, none ends with an opening
+/// one.
+#[test]
+fn chinese_kinsoku_keeps_punctuation_with_its_text() {
+    let text = "他说：“《红楼梦》是一部小说，（很长）。”";
+    let o = Options::for_language(Some("zh-Hans"));
+    let breaks = offsets(text, &o);
+    assert!(breaks.len() > 8, "{:?}", pieces(text, &o));
+    for b in breaks {
+        let (head, tail) = text.split_at(b);
+        let (Some(last), Some(first)) = (head.chars().next_back(), tail.chars().next()) else { continue };
+        assert!(!"：”》，）。".contains(first), "line starts with {first}: {:?}", pieces(text, &o));
+        assert!(!"“《（".contains(last), "line ends with {last}: {:?}", pieces(text, &o));
+    }
+}
+
+#[test]
+fn language_picks_korean_words() {
+    for tag in ["ko", "ko-KR", "KO_kr"] {
+        assert!(Options::for_language(Some(tag)).korean_words, "{tag}");
+    }
+    for tag in [Some("ja"), Some("kok"), Some("en-KO"), None] {
+        assert_eq!(Options::for_language(tag), Options::default(), "{tag:?}");
+    }
+}
+
+/// Emergency breaks fall between grapheme clusters: never inside an emoji ZWJ sequence, a flag, a
+/// skin-tone modifier or a letter with its combining marks.
+#[test]
+fn emergency_breaks_keep_grapheme_clusters_whole() {
+    let family = "👨\u{200D}👩\u{200D}👧\u{200D}👦";
+    let text = format!("ab{family}e\u{301}🇯🇵👍🏽");
+    let breaks = emergency_breaks(&text, 0..text.len());
+    let a = family.len() + 2;
+    let b = a + "e\u{301}".len();
+    let c = b + "🇯🇵".len();
+    assert_eq!(breaks, [1, 2, a, b, c]);
+    // Offsets are into `text`; a range off a char boundary has none.
+    assert_eq!(emergency_breaks(&text, 1..b), [2, a]);
+    assert!(emergency_breaks(&text, 3..b).is_empty());
+    assert!(emergency_breaks("", 0..0).is_empty());
+}
diff --git a/crates/ui/Cargo.toml b/crates/ui/Cargo.toml
index b30fb177..e7df43f4 100644
--- a/crates/ui/Cargo.toml
+++ b/crates/ui/Cargo.toml
@@ -11,15 +11,73 @@ description = "Reusable egui controls and icon catalogs for Craft frontends"
 workspace = true
 
 [dependencies]
+craft-fonts-build = { workspace = true }
+craft-i18n = { workspace = true }
 egui = { workspace = true }
+epaint = { version = "0.37", default-features = false }
+log = "0.4"
 serde = { version = "1", features = ["derive"], optional = true }
+# Same version as epaint's, for reading a face's character map.
+skrifa = { version = "0.44", default-features = false, features = ["std"] }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+# Screenshot and input tests of an app's screens (the screen-testing feature).
+egui_kittest = { version = "0.37", features = ["snapshot", "wgpu"], optional = true }
+# The versions egui_system_font_provider 0.37 uses.
+fontique = { version = "0.11.1", default-features = false, features = ["system", "fontconfig-dlopen"], optional = true }
+unicode-script = { version = "0.5.8", optional = true }
+
+# Fetching served fonts (`fonts::UiFonts::served_faces`); already in every eframe web build.
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+js-sys = "0.3"
+wasm-bindgen = "0.2"
+wasm-bindgen-futures = "0.4"
+web-sys = { version = "0.3", features = ["Window", "RequestInit", "Response", "console"] }
+
+# Fading a native window while it is dragged (`NSWindow.alphaValue`); winit already uses these.
+[target.'cfg(target_os = "macos")'.dependencies]
+objc2 = "0.6"
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "objc2-core-foundation", "NSApplication", "NSEvent", "NSResponder", "NSScreen", "NSWindow"] }
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "NSArray", "NSEnumerator", "NSString"] }
 
 [features]
+default = []
 serde = ["dep:serde"]
+# Floating windows may move to their own OS windows (desktop egui backends with viewports).
+native-windows = []
+# Draw colour glyphs (COLR, sbix, CBDT), e.g. colour emoji.
+color_fonts = ["epaint/color_fonts"]
+# Find installed fonts for characters the app's faces lack (desktop only).
+system_fonts = ["dep:fontique", "dep:unicode-script"]
+# `docking::testing`: a headless driver for application docking tests.
+testing = []
+# craft_ui::testing: per-language screenshot tests and IME smoke tests with egui_kittest
+# (desktop only).
+screen-testing = ["dep:egui_kittest"]
 
 [dev-dependencies]
-egui = { workspace = true, features = ["default_fonts"] }
+# serde: the IME tests read events that only the suite's egui fork has from JSON.
+egui = { workspace = true, features = ["default_fonts", "serde"] }
 serde_json = "1"
 egui_extras = { version = "0.37", default-features = false, features = ["svg"] }
-egui_kittest = { version = "0.37", features = ["wgpu"] }
 image = { version = "0.25", default-features = false, features = ["png"] }
+
+[[example]]
+name = "docking_native"
+required-features = ["native-windows"]
+
+[[test]]
+name = "screens"
+required-features = ["screen-testing"]
+
+[target.'cfg(not(target_arch = "wasm32"))'.dev-dependencies]
+egui_kittest = { version = "0.37", features = ["wgpu"] }
+eframe = { version = "0.37", default-features = false, features = ["wgpu", "x11", "default_fonts"] }
+
+# The browser test (tests/web_fonts.rs).
+[target.'cfg(target_arch = "wasm32")'.dev-dependencies]
+js-sys = "0.3"
+wasm-bindgen = "0.2"
+wasm-bindgen-futures = "0.4"
+wasm-bindgen-test = "0.3"
+web-sys = { version = "0.3", features = ["Window", "Response"] }
diff --git a/crates/ui/README.md b/crates/ui/README.md
index f093a549..3906429e 100644
--- a/crates/ui/README.md
+++ b/crates/ui/README.md
@@ -5,9 +5,11 @@ embedded SVG catalogs; `buttons` paints accessible icon buttons; `tabs` handles
 interaction; `layout` provides toolbar fitting, split geometry and resize handles; `theme` shares widget-state styling.
 `docking` supplies transactional panel moves and an optional docking surface.
 `printing` supplies printer/job controls and asynchronous feedback used by WordCraft and GridCraft.
+`fonts` installs the UI font stack, the same fallback order in every app.
+`localized` supplies number fields that write and read the user's region's numbers.
 The current delivery covers nine creative apps (DesignCraft, VectorCraft, PhotoCraft, FilmCraft, EffectCraft, CADCraft, PDFCraft, LightCraft and SoundCraft); prior basic and office adapters are separate. The [suite audit](../../docs/ui-components-audit.md#adoption-and-acceptance)
-records their scope and acceptance limits. Assets, complete themes, localization and command handling
-remain in each application. No icons, fonts or application engines are bundled.
+records their scope and acceptance limits. Assets (font files included), complete themes, localization
+and command handling remain in each application. No icons, fonts or application engines are bundled.
 
 ## SVG catalogs
 
@@ -107,12 +109,19 @@ indices and widths, overflow indices, and the actual reserved overflow width. It
 tabs before hiding them, keeps input order and retains the selected tab. Tiny strips may reduce
 its width to zero. Negative/non-finite dimensions become zero and large dimensions are bounded.
 The work is linear in tab count with at most 32 fitting passes; the caller caps its own tab count.
+Docking tab strips use this policy, with `DockStyle::min_tab_width` as the minimum.
+
+`tabs::fit_whole(natural_widths, selected, available, overflow_width)` keeps every shown tab at its
+natural width and sends the rest to overflow. Tabs are shown in order up to the first that does not
+fit; the selected tab is always shown in its logical place, taking the place of the last tabs that
+fit when it lies past them. Only a selected tab wider than the strip minus the overflow button is
+narrowed.
 
 `tabs::Tab` registers a tab at a supplied rectangle and invokes the application's painter:
 
 ```rust
 fn tab(ui: &mut egui::Ui, rect: egui::Rect, selected: bool) -> egui::Response {
-    craft_ui::tabs::Tab::new(ui.id().with("layers-tab"), "Layers", selected)
+    craft_ui::tabs::Tab::new(ui.scope_id().with("layers-tab"), "Layers", selected)
         .sense(egui::Sense::click_and_drag())
         .show_at(ui, rect, |ui, response| {
             let fill = if response.hovered() { egui::Color32::GRAY } else { egui::Color32::DARK_GRAY };
@@ -207,10 +216,249 @@ fn style_widgets(visuals: &mut egui::Visuals, palette: WidgetPalette, text: Colo
 }
 ```
 
-This is a mechanism for coloring widgets, not a shared theme schema. Fonts, complete palettes,
+This is a mechanism for coloring widgets, not a shared theme schema. Complete palettes,
 selection colors, shadows, spacing, context storage and preference serialization remain in each
-application. See the [eight-app comparison](../../docs/theme-infrastructure.md) for the exact
-common operation and the differences preserved by the adapters.
+application; fonts are installed by `fonts`, below. See the
+[eight-app comparison](../../docs/theme-infrastructure.md) for the exact common operation and the
+differences preserved by the adapters.
+
+## UI fonts
+
+egui draws a character only if one of its installed faces has it, so an app's labels, layer names
+and file names show boxes for any script its faces miss. `fonts::UiFonts` builds every app's UI
+font stack in the same order:
+
+1. the app's own faces for the family (UI face, semibold, mono), or egui's default faces for a
+   family the app has none for;
+2. craft-fonts faces for the UI language;
+3. craft-fonts faces for every other script the app ships, so a Japanese interface still draws
+   Arabic file names;
+4. installed system fonts (see below), set to regular weight so variable fonts don't draw Thin;
+5. emoji faces (system emoji first, then the colour, web and monochrome faces the app embeds) and,
+   behind the app's own faces, egui's default faces.
+
+When the faces of step 1 don't cover the UI language's main script (Arabic, Thai, Georgian), that
+script's face goes first. egui takes a row's height from a family's first face, so the language's
+own face sets the row height and its marks aren't clipped. Han, kana and Hangul sit inside the em
+square and fit a Latin row, so Chinese, Japanese and Korean UIs keep the Latin face first: Latin
+text draws in the app's face in every language, and CJK characters fall back to the language's
+face. Rows and widgets keep the same height in every one of these languages as in a Latin UI:
+CJK faces sit on the first face's baseline inside its row, scaled down only if a glyph would
+otherwise leave the row (Noto Sans CJK and BIZ UDPGothic at the same size don't need it), with
+crates.io egui and the suite's patched egui alike. `UiFonts::cjk_rows(CjkRows::Grow)` opts into
+the CJK face's taller line instead. The app's theme sets the minimum widget height for rows of its
+own face; when the UI language's script face leads the stack and has taller rows, `install` adds
+the difference to the theme's height, and takes it off again when a later install needs less. The
+theme's height and padding stay the app's: a theme applied after `install` is fitted at the start
+of the next pass, so the result doesn't depend on which comes first. On the suite's patched egui
+(`FontTweak::set_baseline_fallback`, which the other craft faces and installed text faces turn
+on), other fallback glyphs sit on the row's baseline and rows grow to fit them by themselves; emoji
+and symbol faces (colour glyphs, or "Emoji" or "Symbol" in the name) stay centred. With crates.io
+egui those fallbacks are centred. Monospace keeps the app's or egui's mono face first. Han characters take the regional face the language needs: `zh-TW` gets the
+Traditional (TC) face, then Hong Kong, then Simplified; `zh-HK` the Hong Kong face first; `ja` the
+Japanese face; `ko` the Korean one.
+
+The app keeps its font files: its `build.rs` embeds the craft-fonts faces it wants from
+`fonts/manifest.txt` with `craft-fonts-build`, and craft-ui never depends on craft-fonts. A crate
+below the UI (an app's engine or font crate, without egui) holds the table as
+`craft_fonts_build::EmbeddedFace` values (storytold/craft-libs#213), and the UI converts each into
+a `fonts::CraftFace` with `From`. Apps embed with `Embed::subset_to(catalogs)`, which takes the
+CJK faces as craft-fonts' interface faces (`Noto Sans TC UI`, BIZ UDPGothic Regular) and cuts them
+at build time to the characters the translation catalogs use (about 3 MB for all five with
+FilmCraft's catalogs). A character a cut face lacks, such as one in a file name, comes from
+another region's interface face that has it, then from the installed system fonts; the build
+warns when a catalog has characters no embedded face covers. Preferences name the full family
+(`Noto Sans TC`) and also apply to its interface face (`Noto Sans TC UI`).
+
+The app configures its own faces, a preferred face per script, extra named families (a semibold
+family, a family led by Arabic for the runs it shapes itself), emoji faces, and whether system
+fonts come before or after the craft faces for other scripts. `UiFonts::stack` returns a `Stack`
+whose chains the app can still edit (`insert`, `replace`, `remove`) before `Stack::install`.
+`Stack::after_system` (a `FaceList`) holds the faces asked after the system fonts, readable with
+`get` and `faces`; `Stack::flat_definitions` appends them to each chain, for a context that takes
+its fonts only through `set_fonts`.
+
+`fonts::I18nScripts` reads each language's scripts and Han forms from craft-i18n; an app with its
+own table implements `fonts::LanguageScripts` instead.
+
+```rust
+use craft_fonts_build::EmbeddedFace;
+use craft_ui::fonts::{CraftFace, Family, I18nScripts, UiFonts};
+use egui::{FontData, FontFamily};
+
+pub static CRAFT_FONTS: &[EmbeddedFace] = include!(concat!(env!("OUT_DIR"), "/craft_fonts.rs"));
+
+fn install_fonts(ctx: &egui::Context, ui_language: &str) {
+    let craft_faces: Vec<CraftFace> = CRAFT_FONTS.iter().copied().map(CraftFace::from).collect();
+    UiFonts::new(&I18nScripts)
+        .app_face("ui", FontData::from_static(UI_FONT), &[FontFamily::Proportional])
+        .app_face("ui-semibold", FontData::from_static(UI_SEMIBOLD), &[FontFamily::Name("semibold".into())])
+        .app_face("mono", FontData::from_static(MONO_FONT), &[FontFamily::Monospace])
+        .family(Family::named("semibold").weight(600))
+        .craft_faces(&craft_faces)
+        .languages(OFFERED_LANGUAGES)
+        .ui_language(ui_language)
+        .install(ctx);
+}
+```
+
+Call `install` again when the UI language changes.
+
+### Web builds
+
+A web build serves the craft-fonts faces beside its wasm instead of embedding them, so the wasm
+stays small and an English interface never downloads Chinese. `craft-fonts-build`'s
+`Embed::serve` copies the faces into a directory and writes a table of `fonts::ServedFace`s (URL,
+size, Subresource Integrity hash and the characters the face maps, no bytes);
+`UiFonts::served_faces` takes it in place of `craft_faces`. Each face's characters are its
+`cmap`'s code point ranges, packed as LEB128 gaps and lengths: about 3 KB for a CJK interface face
+cut to an app's catalogs, a few hundred bytes for Noto Sans, the symbol faces or an emoji face. The
+stack orders served faces exactly as embedded ones, and on the web `Stack::install` fetches them:
+
+- the UI language's faces at once (`Stack::ui_downloads`: the best face for each of its scripts
+  the app's faces lack, per family, so a semibold family brings the bold face);
+- for a character no installed face has, the one face that draws it (`Stack::downloads_for`):
+  the first face in the family's order whose file maps the character and whose scripts fit it.
+  Noto Sans draws Latin, Greek and Cyrillic letters the app's faces lack (Vietnamese ẫ), the
+  symbol faces (Noto Sans Symbols, Symbols 2, Math) keyboard keys, arrows and other text symbols
+  (⌘ ⌥ ⇧ ⎋ ⏎), the emoji faces emoji. A Han character takes the interface face of the UI
+  language's region first (Simplified, Traditional, Hong Kong, Japanese or Korean), then the
+  other offered languages' and the rest in manifest order;
+- a served emoji face (`Emoji::served`) the first time text needs an emoji.
+
+A character no served face maps, such as a rare Han character none of the cut interface faces
+has, fetches nothing: egui's web glyph rasterizer draws it with the browser's fonts, or it shows
+as a missing glyph. A file that
+fails to download leaves its characters to the next face that draws them and is fetched again
+after 2 seconds, then after twice as long with each further failure, up to 10 minutes. Each face is
+added when its file arrives, and the context repaints; text falls back to the faces after it until
+then. Fetched files stay in memory for later installs, such as a language switch, and the
+browser's HTTP cache keeps them across page loads. `fonts::loading(ctx)` is true while the UI
+language's files are on their way, for an app that would rather draw nothing than Latin fallbacks
+in its first frames.
+
+`build.rs`:
+
+```rust
+fn main() {
+    println!("cargo::rerun-if-changed=build.rs");
+    // CJK faces as craft-fonts' interface faces, cut to the app's catalogs (`catalogs` as in
+    // craft-fonts-build's README; `subset` feature on the build-dependency).
+    let fonts = craft_fonts_build::Embed::new().subset_to(catalogs("myapp"));
+    let written = if craft_fonts_build::target_is_wasm() {
+        // Served by the page as `fonts/`; see Trunk.toml.
+        fonts.serve("web/fonts", "fonts/").write("craft_fonts.rs")
+    } else {
+        fonts.write("craft_fonts.rs")
+    };
+    if let Err(e) = written {
+        println!("cargo::error={e}");
+    }
+}
+```
+
+The app:
+
+```rust
+// The embedded table is written as `EmbeddedFace` literals, the served one as `ServedFace`s.
+use craft_ui::fonts::{CraftFace as EmbeddedFace, I18nScripts, ServedFace, UiFonts};
+
+#[cfg(not(target_arch = "wasm32"))]
+static CRAFT_FONTS: &[EmbeddedFace] = include!(concat!(env!("OUT_DIR"), "/craft_fonts.rs"));
+#[cfg(target_arch = "wasm32")]
+static CRAFT_FONTS: &[ServedFace] = include!(concat!(env!("OUT_DIR"), "/craft_fonts.rs"));
+
+fn install_fonts(ctx: &egui::Context, ui_language: &str) {
+    let fonts = UiFonts::new(&I18nScripts).app_face("ui", FontData::from_static(UI_FONT), &[FontFamily::Proportional]);
+    #[cfg(not(target_arch = "wasm32"))]
+    let fonts = fonts.craft_faces(CRAFT_FONTS);
+    #[cfg(target_arch = "wasm32")]
+    let fonts = fonts.served_faces(CRAFT_FONTS);
+    fonts.languages(OFFERED_LANGUAGES).ui_language(ui_language).install(ctx);
+}
+
+impl eframe::App for App {
+    fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+        if craft_ui::fonts::loading(ui.ctx()) {
+            return; // The fetch repaints when it arrives.
+        }
+        // …
+    }
+}
+```
+
+Call `install_fonts` from the `eframe::App` creator, so the fetches start before the first frame.
+The served directory has to reach the site next to the wasm; with Trunk, copy it in a hook
+(`Trunk.toml`):
+
+```toml
+[[hooks]]
+stage = "post_build"
+command = "sh"
+command_arguments = ["-c", "cp -R web/fonts \"$TRUNK_STAGING_DIR/fonts\""]
+```
+
+A relative `serve` directory is under the package whose `build.rs` runs it; a crate deeper in the
+workspace can pass `concat!(env!("CARGO_MANIFEST_DIR"), "/../../web/fonts")` instead. Keep the
+directory out of version control. A build filters faces for the web as for the desktop (`scripts`,
+`filter`), e.g. to leave out bold faces.
+
+Two features, both off by default, change what every craft-ui user draws, so the app turns them on:
+
+- `system_fonts` (desktop): the stack asks the installed fonts, at regular weight, and `install`
+  replaces the context's font providers, including the one eframe adds. One index of the
+  installed fonts serves every UI language, so a language switch doesn't scan them again.
+  `install` starts building it on a background thread; until it is ready, text draws with the
+  stack's own faces, and the context repaints when it arrives. Without it,
+  `install` keeps the providers the context has (eframe's `system_fonts`, for one) and asks the
+  stack's own faces after them. `UiFonts::system_provider` supplies a provider either way, and
+  `SystemFonts::Off` drops system fonts.
+- `color_fonts`: colour glyphs (COLR, sbix, CBDT), for colour emoji.
+
+egui 0.37's default faces have only a few monochrome emoji and lack symbols such as ⊞ ☰ 🔍. On
+the web there are no system fonts, so emoji draw as boxes unless the app sets an `Emoji` face.
+`UiFonts::egui_face` puts one of egui's own faces into a family, e.g. Hack in the proportional
+family for ⇧ and ▸.
+
+Each app tests its coverage with `fonts::assert_covers`: it checks every shipped translation and a
+sample of content scripts against the stack without system fonts, and fails naming the language,
+message key and character that has no glyph. Build the stack with `.system_fonts(SystemFonts::Off)`
+in that test, and run it with `CRAFT_FONTS_DIR` set so it sees the faces a release embeds. For
+languages the app leaves to installed fonts, `fonts::assert_covers_with_system` asks the stack's
+system provider too; `fonts::system_font_provider(locale)` gives egui's provider (with
+`system_fonts`), shared per locale, for `UiFonts::system_provider` or such a check. At run time,
+`Stack::covers_language(language, with_system)` says whether the stack draws a language's scripts,
+for leaving a language out of the app's menu on a machine that can't show it.
+
+## Testing screens in each language
+
+The `screen-testing` feature adds `testing::Screens`, for an app's screenshot tests of its key screens in
+Arabic, Japanese, Traditional Chinese (Taiwan), Korean, Thai and Vietnamese (`testing::LANGUAGES`).
+Each language gets an egui_kittest harness with the app's font stack installed for that UI language
+and system fonts off, so snapshots match on every machine and a character no face draws fails the
+test. Right-to-left languages lay the screen out from the right. The app's UI closure receives the
+`Locale` (language tag and direction) and picks its strings from it.
+
+```rust,ignore
+use craft_ui::testing::{KOREAN, Screens, compose};
+
+let screens = Screens::new("rename").size([320.0, 150.0]).fonts(|fonts| fonts.craft_faces(FACES));
+// Compares tests/snapshots/rename-ar.png, rename-ja.png, …; UPDATE_SNAPSHOTS=1 writes them.
+screens.snapshots(|ui, locale| rename_dialog(ui, locale));
+
+// IME smoke test: a scripted 2-Set Korean composition into the focused field.
+let mut harness = screens.harness_state("ko", |ui, locale, state: &mut Dialog| state.ui(ui, locale), Dialog::default());
+harness.get_by_role(egui::accesskit::Role::TextInput).focus();
+compose(&mut harness, &KOREAN);
+assert_eq!(harness.state().name, "한");
+```
+
+`compose` sends the preedit and commit events an input method sends (`KOREAN`, `JAPANESE`,
+`PINYIN`, `TELEX`), which egui's `TextEdit` and canvases reading `Event::Ime` both take. The module
+documentation has the recipe for a shortcut smoke test on a non-Latin layout through craft-keymap.
+`tests/screens.rs` is a complete example. egui's default proportional face has no Vietnamese
+letters such as ổ, so an app relying on it fails the `vi` screens until its own face covers them. The per-release manual checks are in
+[language-testing.md](../../docs/language-testing.md).
 
 ## Print settings and feedback
 
@@ -232,10 +480,120 @@ represented by `None`, independently of explicit one-sided, long-edge or short-e
 Receipts and backend errors remain unmodified data for the app to display. These controls work
 on WASM too; browser PDF printing remains an app-owned service.
 
+## Localized numbers
+
+`localized::LocaleNumbers` writes numbers in the region's digits, decimal mark and grouping and
+reads back any digits. Build it from the app's `I18n` with `.with_catalog(&i18n, lang)`, so the
+error tooltips come from the catalog rows keyed by `localized::MESSAGES` (English where a row is
+missing). `LocalizedDragValue` puts it on an `egui::DragValue`.
+
+`NumberField` is the panel and dialog field. It reads text on commit and keeps text it can't
+read, outlined, with the reason in a tooltip.
+
+```rust
+let label = ui.label(i18n.t(lang, "Width"));
+let frame = Recessed { fill: t.input, stroke: Stroke::new(1.0, t.input_border), ..Recessed::from_style(ui.style()) };
+let r = ui.add(NumberField::new(&mut width, &numbers).range(0.0..=1e4).step(1.0).unit(Unit::translated(&i18n, lang, "{n} px"))
+    .recessed(frame).scrub_label(&label).mixed(widths_differ));
+```
+
+- `.recessed(Recessed)` draws the sunken box: fill, border, focus border, radius, height, margin.
+- `.scrub_label(&label)` names the field and scrubs it when the label is dragged: a step every two
+  points. A click on the label focuses the field, and Escape puts the value back. The response
+  carries the label's drag flags, so the app can make the drag one undo step.
+- Arrow keys, the wheel over the focused field and scrubbing step to the next multiple of `step`
+  (5.1 up to 6, down to 5); Shift steps ten, Ctrl/Cmd a tenth where the decimals show it.
+- `.mixed(true)` with `.placeholder(text)` shows a blank field for values that differ between
+  objects. The value stays until the user enters a number, which is `changed()` even when equal.
+- `localized::focus_first_field(ctx, true)` when a dialog opens: the first enabled field drawn
+  takes the focus with its text selected.
+
+## Screenshot completion
+
+`capture::CaptureSlot` is a one-result slot for egui 0.37's one-shot screenshot callback. It is not a
+capture scheduler: request IDs, output paths, deadlines, settling frames, geometry epochs and the
+aggregate admission reservation stay in the application. The slot owns strong `Context` and
+`ViewportId` handles only in the live request; the callback holds a weak reference, so closing the
+request cannot leave a callback-owned context cycle. Keep the slot in the application's request
+record, outside egui-owned storage: a slot stored in `egui::Memory::data` or a registered plugin
+would form a `Context` → slot → `Context` cycle.
+
+```rust
+use craft_ui::capture::{CaptureError, CaptureSlot};
+use egui::{Context, ViewportCommand, ViewportId};
+
+fn issue_capture(ctx: &Context, viewport: ViewportId) -> CaptureSlot {
+    // A per-image bound, not the application's aggregate admission budget.
+    let (slot, callback) = CaptureSlot::new(ctx, viewport, 128 * 1024 * 1024);
+    // A pending screenshot command requests the paint that hidden windows need.
+    ctx.send_viewport_cmd_to(viewport, ViewportCommand::Screenshot(callback));
+    slot
+}
+
+fn report_capture(slot: &CaptureSlot) {
+    if let Some(result) = slot.take() {
+        match result {
+            Ok(image) => {
+                // Validate the app-owned request/geometry epoch, then encode and reply.
+                let _ = image;
+            }
+            Err(error) => {
+                // Report the completion error through the app's request record.
+                let _: CaptureError = error;
+            }
+        }
+    }
+}
+```
+
+`take` returns the image or completion error at most once; `None` means pending, cancelled, already
+taken or dropped at that moment. The slot cannot distinguish those closed states, so the
+application's request record owns the pending/closed distinction and the associated timeout or
+error reply.
+
+Completion checks a non-zero width and height, `width * height * size_of::<Color32>()` with checked
+arithmetic, a pixel buffer that matches the reported dimensions, and the per-image byte bound. A
+zero width or height is `MalformedImage`; an overflowing pixel or byte count is
+`DimensionsOverflow`. `CaptureError` is `#[non_exhaustive]`, so match the known variants with a
+wildcard arm. The slot releases its mutex before requesting a repaint, and `cancel`/`Drop` replace
+the state and drop any retained image only after unlocking, so a large image is not freed while
+another thread is completing.
+Both accepted images and rejection errors wake the owning viewport so the application can take
+the result and reply promptly.
+
+Every retry needs a fresh `CaptureSlot` and a fresh callback from `CaptureSlot::new`. A callback is
+one-shot and a slot never accepts a second completion, even after `take` removed the first result.
+Issue an explicit screenshot command only once per slot, after the application has settled the
+frame it wants. The first delivered frame wins; later frames delivered to the same callback are
+discarded. A completion is published before the wake: a completion racing `cancel` or `Drop`
+may already have published its result, so it can still deliver one harmless extra repaint after
+cancellation. If the cancellation won, the image is released and a later `take` returns `None`; if
+`take` won first, the caller already owns the result. A completion that observes the cancelled or
+taken state stores no image and does not wake. Cancellation and wakeup are therefore not one atomic
+step, and the helper never blocks a completing thread under its lock.
+
+`complete` calls `Context::request_repaint_of`, which takes egui's context lock. Completing from an
+ordinary `Ui` closure, an egui 0.37 plugin hook or a renderer/worker thread is fine: these run outside
+the context lock. Repaint observers and request-repaint callbacks run under that lock, so completing
+there would deadlock. An observer can take or cancel a slot because those operations only use the
+slot lock, but further `Context` access must happen outside the observer.
+
+Correlation is based on callback ownership. The helper cannot detect a callback sent to the wrong
+viewport if the returned image otherwise fits its bound. The application must route each callback
+to its recorded viewport and validate its request and geometry; native multi-window tests must
+verify the actual pixels as well as callback routing.
+
+## Text reading areas
+
+`text::align_galley_rows` positions already shaped rows inside a fixed-width reading area without changing glyphs or logical text. Supply a per-row alignment, for example the paragraph direction from the application shaper. The helper uses stock egui APIs and keeps cached glyph meshes shared. Its logical rectangle is the requested width; ink may overflow, so clip the painter when drawing cards. Use it for read-only painting, keeping the original galley for editable hit testing.
+
 ## Compatibility and checks
 
 The crate uses egui 0.37 and Rust 1.95 or later. Its production dependency disables egui's default
-features so fonts and rendering features remain the application's choice. See the
+features, so egui's bundled fonts and rendering features remain the application's choice. It has
+no default features; see [UI fonts](#ui-fonts) for `color_fonts` and `system_fonts`, and
+[Testing screens in each language](#testing-screens-in-each-language) for `screen-testing`;
+`testing` adds the headless docking driver `docking::testing`. See the
 [suite audit](../../docs/ui-components-audit.md) for candidates, policies and adoption order.
 
 Validation:
diff --git a/crates/ui/examples/docking_native.rs b/crates/ui/examples/docking_native.rs
new file mode 100644
index 00000000..753a4d57
--- /dev/null
+++ b/crates/ui/examples/docking_native.rs
@@ -0,0 +1,64 @@
+//! Docking with floating panels in their own OS windows. Run with
+//! `cargo run -p craft-ui --example docking_native --features native-windows`.
+//!
+//! Prints every action it applies and every native window's place, for checking moves by
+//! hand or under a headless X server.
+
+use craft_ui::docking::{DockArea, DockContent, DockStyle, Floating, Layout, Node};
+use craft_ui::layout::{SplitAxis, SplitSize};
+
+struct Panels;
+
+impl DockContent<u32> for Panels {
+    fn body(&mut self, ui: &mut egui::Ui, panel: &u32) {
+        ui.label(format!("Body of panel {panel}"));
+    }
+
+    /// Return the example content's logical and accessibility label, `Panel {panel}`.
+    fn logical_label(&self, panel: &u32) -> String {
+        format!("Panel {panel}")
+    }
+}
+
+struct App {
+    layout: Layout<u32>,
+}
+
+impl eframe::App for App {
+    /// Render the dock, apply every returned action with default permissions, print floating
+    /// window places, and forward residual native-window events to the host.
+    fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+        let style = DockStyle::from_ui(ui);
+        let out = DockArea::new(egui::Id::unique("dock")).show_content(ui, &self.layout, &style, &mut Panels);
+        if !out.actions.is_empty() {
+            println!("actions {:?}", out.actions);
+            if let Err(error) = self.layout.apply_all(out.actions, |_| Default::default()) {
+                println!("rejected {error:?}");
+            }
+            for window in &self.layout.floating {
+                println!("window {} panels {:?} native {:?}", window.id, window.panels().collect::<Vec<_>>(), window.native);
+            }
+        }
+        if !out.forwarded_events.is_empty() {
+            println!("forwarded {:?} {:?}", out.forwarded_events, out.forwarded_modifiers);
+        }
+    }
+}
+
+fn main() -> eframe::Result {
+    let tabs = |panels: &[u32]| Node::Tabs { panels: panels.to_vec(), active: 0 };
+    let layout = Layout {
+        root: Some(Node::Split {
+            axis: SplitAxis::Horizontal,
+            size: SplitSize::Ratio(0.5),
+            first: Box::new(tabs(&[1, 2])),
+            second: Box::new(tabs(&[3, 4])),
+        }),
+        floating: vec![Floating::single(vec![5, 6], 0, [300.0, 200.0, 320.0, 260.0]), Floating::single(vec![7], 0, [700.0, 300.0, 260.0, 200.0])],
+    };
+    let options = eframe::NativeOptions {
+        viewport: egui::ViewportBuilder::default().with_inner_size([1000.0, 700.0]).with_position([0.0, 0.0]),
+        ..Default::default()
+    };
+    eframe::run_native("Docking", options, Box::new(|_| Ok(Box::new(App { layout }))))
+}
diff --git a/crates/ui/examples/ui_hotpaths.rs b/crates/ui/examples/ui_hotpaths.rs
new file mode 100644
index 00000000..9deb6fa5
--- /dev/null
+++ b/crates/ui/examples/ui_hotpaths.rs
@@ -0,0 +1,784 @@
+//! Test-only headless performance harness for craft-ui hot paths.
+//!
+//! Run through the server task workflow, e.g. `cargo run -p craft-ui --example ui_hotpaths --locked`.
+//! Set `CRAFT_UI_PERF_OUT` to write the raw JSON report (otherwise stdout); `CRAFT_UI_PERF_LABEL`
+//! is copied into the report. Frames are `Context::run_ui` plus `Context::tessellate`; texture
+//! deltas are counted but never uploaded, and no GPU, window, compositor or native input path is
+//! exercised. Fonts are egui's bundled `default_fonts` unless `CRAFT_UI_PERF_FONT` points at a
+//! pinned fixture file (recorded by the parent with its hash). Bodies, geometry, interactions and
+//! the mesh fingerprint are collected on the final measured frame; the hover probe is a separate
+//! unmeasured frame and never contributes to timings or counters.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    env,
+    error::Error,
+    hint::black_box,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use craft_ui::{
+    docking::{DockArea, DockError, DockStyle, Floating, Layout, Node, Permissions},
+    layout::{SplitAxis, SplitSize, fit_toolbar, split_rect},
+    tabs,
+};
+use egui::{Context, Id, Rect, pos2, vec2};
+use serde_json::{Value, json};
+
+const WARMUPS: usize = 50;
+const MIN_WARMUP: Duration = Duration::from_secs(3);
+const MICRO_SAMPLES: usize = 50;
+const MICRO_BATCH: usize = 16;
+const FRAME_SAMPLES: usize = 1000;
+const EPS: f32 = 0.1;
+
+#[derive(Default)]
+struct Frames {
+    times_ns: Vec<u64>,
+    warmups: usize,
+    warmup_elapsed_ns: u64,
+    next_frame: usize,
+    mesh_hash: u64,
+    bodies: BTreeMap<u32, Rect>,
+    shapes: usize,
+    vertices: usize,
+    indices: usize,
+    set_images: usize,
+    set_bytes: usize,
+    free_images: usize,
+    repaint_frames: usize,
+    passes: Vec<usize>,
+    galleys_after_warmup: usize,
+}
+
+/// Run all micro and dock/integration cases at 1× and 2×, gate each case, and emit the schema-3
+/// JSON report to `CRAFT_UI_PERF_OUT` (or stdout). Fails when no bundled or fixture font is
+/// available.
+fn main() -> Result<(), Box<dyn Error>> {
+    let (fonts, font_names) = font_definitions()?;
+    if font_names.is_empty() {
+        return Err("the example needs egui's bundled default_fonts or CRAFT_UI_PERF_FONT".into());
+    }
+    let mut micro = Vec::new();
+    for scale in [1.0f32, 2.0] {
+        for count in [1usize, 8, 64, 4096] {
+            let natural: Vec<_> = tab_widths(count).into_iter().map(|width| width * scale).collect();
+            let selected = count / 2;
+            for available in [96.0f32, 640.0, 1920.0] {
+                let (available, minimum, overflow) = (available * scale, 48.0 * scale, 64.0 * scale);
+                check_tabs(&natural, selected, available, minimum, overflow)?;
+                micro.push(micro_entry(
+                    "tabs_fit",
+                    json!({"tabs": count, "available": available, "selected": selected, "minimum_width": minimum,
+                           "overflow_width": overflow, "size_scale": scale}),
+                    || {
+                        let natural = black_box(&natural);
+                        black_box(tabs::fit(natural, black_box(selected), black_box(available), black_box(minimum), black_box(overflow)));
+                    },
+                ));
+            }
+        }
+        for (shape, rect, axis) in [
+            ("normal", Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0 * scale, 600.0 * scale)), SplitAxis::Horizontal),
+            ("tiny", Rect::from_min_size(pos2(0.0, 0.0), vec2(120.0 * scale, 80.0 * scale)), SplitAxis::Vertical),
+        ] {
+            let (gap, minimum) = (4.0 * scale, 24.0 * scale);
+            let span = match axis {
+                SplitAxis::Horizontal => rect.width(),
+                SplitAxis::Vertical => rect.height(),
+            };
+            // Dock layout uses `SplitSize::FixedFirst` (`docking/surface.rs`), so both fixed modes are
+            // measured next to the ratio case for every shape and scale.
+            for size in [SplitSize::Ratio(0.31), SplitSize::FixedFirst(span * 0.3), SplitSize::FixedSecond(span * 0.3)] {
+                let layout = check_split(rect, axis, size, gap, minimum)?;
+                micro.push(micro_entry(
+                    "split_rect",
+                    json!({"shape": shape, "axis": format!("{axis:?}"), "size": format!("{size:?}"), "gap": gap, "minimum": minimum,
+                           "size_scale": scale}),
+                    || {
+                        black_box(split_rect(black_box(rect), black_box(axis), black_box(size), black_box(gap), black_box(minimum)));
+                    },
+                ));
+                micro.push(micro_entry(
+                    "split_resized",
+                    json!({"shape": shape, "axis": format!("{axis:?}"), "size": format!("{size:?}"), "delta": 12.0 * scale,
+                           "minimum": minimum, "size_scale": scale}),
+                    || {
+                        black_box(black_box(layout).resized(black_box(size), black_box(12.0 * scale), black_box(minimum)));
+                    },
+                ));
+            }
+        }
+        for groups in [8usize, 4096] {
+            let natural: Vec<_> = toolbar_widths(groups).into_iter().map(|width| width * scale).collect();
+            let available = 1920.0 * scale;
+            check_toolbar(&natural, available, 6.0 * scale, 40.0 * scale)?;
+            micro.push(micro_entry(
+                "fit_toolbar",
+                json!({"groups": groups, "available": available, "spacing": 6.0 * scale, "overflow_width": 40.0 * scale,
+                       "size_scale": scale}),
+                || {
+                    let natural = black_box(&natural);
+                    black_box(fit_toolbar(natural, black_box(available), black_box(6.0 * scale), black_box(40.0 * scale)));
+                },
+            ));
+        }
+    }
+    let mut dock = Vec::new();
+    for (tag, panels, floating) in [("dock4", 4u32, true), ("dock32", 32u32, false)] {
+        for viewport in [[800.0f32, 600.0], [1440.0, 900.0]] {
+            for scale in [1.0f32, 2.0] {
+                dock.push(run_case(Case { label: tag, kind: "dock", panels, floating, side_panel: false, viewport, scale }, &fonts)?);
+            }
+        }
+    }
+    let mut integration = Vec::new();
+    for viewport in [[800.0f32, 600.0], [1440.0, 900.0]] {
+        for scale in [1.0f32, 2.0] {
+            integration.push(run_case(
+                Case { label: "panel_integration", kind: "panel_integration", panels: 6, floating: false, side_panel: true, viewport, scale },
+                &fonts,
+            )?);
+        }
+    }
+    let case_counts = json!({"micro": micro.len(), "dock": dock.len(), "panel_integration": integration.len()});
+    let report = json!({
+        "schema": 3, "harness": "craft-ui/examples/ui_hotpaths",
+        "label": env::var("CRAFT_UI_PERF_LABEL").unwrap_or_default(),
+        "os": env::consts::OS, "arch": env::consts::ARCH,
+        "package_version": env!("CARGO_PKG_VERSION"), "debug_assertions": cfg!(debug_assertions),
+        "build_profile": if cfg!(debug_assertions) { "debug" } else { "release" },
+        "theme": "dark",
+        "render_config": {"visuals": "dark", "animation_time": 0.0, "text_cursor_blink": false, "max_texture_side": 4096,
+            "window_focused": true, "clock": "frame index / 60 Hz", "pixels_per_point": [1.0, 2.0]},
+        "notes": [
+            "CPU-only headless measurement; no GPU renderer, native window, compositor or input.",
+            "Dock frame scope is Context::run_ui + Context::tessellate; texture deltas are counted, not uploaded.",
+            "Fonts are egui default_fonts or the CRAFT_UI_PERF_FONT fixture; no installed system fonts.",
+            "Micro samples are mean-of-batch nanoseconds; frame samples are individual frame nanoseconds.",
+            "Every micro operation black-boxes its inputs and result so loop-invariant hoisting cannot erase the measured work.",
+            "Individual micro latencies are diagnostic only: below about one microsecond the single-call timer overhead dominates.",
+            "Bodies, geometry, interactions and the mesh fingerprint come from the final measured frame; the hover probe is a separate unmeasured frame.",
+        ],
+        "minimum_warmups": WARMUPS, "minimum_warmup_ns": MIN_WARMUP.as_nanos(), "micro_samples": MICRO_SAMPLES, "micro_batch": MICRO_BATCH, "frame_samples": FRAME_SAMPLES,
+        "fonts": {"source": font_source(), "font_file": env::var_os("CRAFT_UI_PERF_FONT").map(|path| path.to_string_lossy().into_owned()), "font_names": font_names,
+            "families": fonts.families.iter().map(|(family, names)| (format!("{family:?}"), names)).collect::<BTreeMap<_, _>>()},
+        "micro": micro, "dock": dock, "panel_integration": integration,
+        "case_counts": case_counts,
+    });
+    let text = serde_json::to_string_pretty(&report)?;
+    if let Ok(path) = env::var("CRAFT_UI_PERF_OUT") {
+        std::fs::write(&path, &text)?;
+        eprintln!("ui_hotpaths: wrote {path} ({} bytes)", text.len());
+    } else {
+        println!("{text}");
+    }
+    Ok(())
+}
+
+/// Synthetic tab widths from 40 to 119 pt, cycling with `(i * 17) % 80`.
+fn tab_widths(count: usize) -> Vec<f32> {
+    (0..count).map(|i| 40.0 + ((i * 17) % 80) as f32).collect()
+}
+
+/// Synthetic toolbar widths from 24 to 71 pt, cycling with `(i * 13) % 48`.
+fn toolbar_widths(count: usize) -> Vec<f32> {
+    (0..count).map(|i| 24.0 + ((i * 13) % 48) as f32).collect()
+}
+
+/// Time `op` after at least 50 warmup calls and 3 seconds, record 50 batch-mean samples (2000
+/// operations per batch for split cases, 16 otherwise), and also record diagnostic single-call
+/// latencies. Returns the counts, samples and summaries without p95/p99 where noted.
+fn micro_entry(name: &str, params: Value, mut op: impl FnMut()) -> Value {
+    let warmup_start = Instant::now();
+    let mut warmups = 0;
+    while warmups < WARMUPS || warmup_start.elapsed() < MIN_WARMUP {
+        op();
+        warmups += 1;
+    }
+    let warmup_elapsed_ns = warmup_start.elapsed().as_nanos() as u64;
+    let mut samples = Vec::with_capacity(MICRO_SAMPLES);
+    let batch = if name.starts_with("split_") { 2000 } else { MICRO_BATCH };
+    for _ in 0..MICRO_SAMPLES {
+        let start = Instant::now();
+        for _ in 0..batch {
+            op();
+        }
+        samples.push((start.elapsed().as_nanos() as u64) / batch as u64);
+    }
+    let mut summary = summarize(&samples);
+    if let Some(stats) = summary.as_object_mut() {
+        stats.remove("p95_ns");
+        stats.remove("p99_ns");
+    }
+    let mut individual = Vec::with_capacity(MICRO_SAMPLES);
+    for _ in 0..MICRO_SAMPLES {
+        let start = Instant::now();
+        op();
+        individual.push(start.elapsed().as_nanos() as u64);
+    }
+    let mut latency = summarize(&individual);
+    if let Some(stats) = latency.as_object_mut() {
+        stats.remove("p99_ns");
+    }
+    let (sample_count, individual_count) = (samples.len(), individual.len());
+    json!({"name": name, "params": params, "sample_kind": "mean_of_batch_ns", "iterations_per_sample": batch,
+           "operations": warmups + MICRO_SAMPLES * batch + MICRO_SAMPLES,
+           "warmups": warmups, "warmup_elapsed_ns": warmup_elapsed_ns, "samples": sample_count, "samples_ns": samples,
+           "stats": summary, "individual_samples": individual_count, "individual_latency_ns": individual,
+           "individual_latency_stats": latency,
+           "individual_latency_note": "diagnostic only; timer overhead dominates single sub-microsecond calls"})
+}
+
+/// Sort a copy of `samples` and return count, median, p95, p99, min and max in nanoseconds.
+fn summarize(samples: &[u64]) -> Value {
+    let mut sorted = samples.to_vec();
+    sorted.sort_unstable();
+    json!({"count": sorted.len(), "median_ns": percentile(&sorted, 50), "p95_ns": percentile(&sorted, 95),
+           "p99_ns": percentile(&sorted, 99), "min_ns": sorted.first().copied().unwrap_or(0),
+           "max_ns": sorted.last().copied().unwrap_or(0)})
+}
+
+/// Nearest-rank percentile of an ascending slice. Empty input returns 0; the index is clamped to
+/// the last element.
+fn percentile(sorted: &[u64], percent: usize) -> u64 {
+    if sorted.is_empty() {
+        return 0;
+    }
+    sorted[(sorted.len() * percent).div_ceil(100).saturating_sub(1).min(sorted.len() - 1)]
+}
+
+/// Use egui's bundled fonts, or an empty definition set with the `CRAFT_UI_PERF_FONT` file inserted
+/// first in both proportional and monospace families. Returns the used font names.
+fn font_definitions() -> Result<(egui::FontDefinitions, Vec<String>), Box<dyn Error>> {
+    let mut fonts = egui::FontDefinitions::default();
+    if let Some(path) = env::var_os("CRAFT_UI_PERF_FONT") {
+        fonts = egui::FontDefinitions::empty();
+        let name = "perf-fixture".to_owned();
+        fonts.font_data.insert(name.clone(), Arc::new(egui::FontData::from_owned(std::fs::read(&path)?)));
+        for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
+            fonts.families.entry(family).or_default().insert(0, name.clone());
+        }
+    }
+    let names = fonts.font_data.keys().cloned().collect();
+    Ok((fonts, names))
+}
+
+/// Describe the report's font source: the pinned `CRAFT_UI_PERF_FONT` file when
+/// set, otherwise egui's bundled default fonts.
+fn font_source() -> &'static str {
+    if env::var_os("CRAFT_UI_PERF_FONT").is_some() { "CRAFT_UI_PERF_FONT (pinned fixture file)" } else { "egui default_fonts (bundled)" }
+}
+
+/// A headless context at `scale` with the given fonts, dark visuals, zero animation time and no
+/// cursor blinking.
+fn context(scale: f32, fonts: &egui::FontDefinitions) -> Context {
+    let ctx = Context::default();
+    ctx.set_pixels_per_point(scale);
+    ctx.set_fonts(fonts.clone());
+    ctx.set_visuals(egui::Visuals::dark());
+    ctx.all_styles_mut(|style| {
+        style.animation_time = 0.0;
+        style.visuals.text_cursor.blink = false;
+    });
+    ctx
+}
+
+/// A headless screen rectangle from `(0, 0)` to `viewport[0] × viewport[1]`.
+fn screen_rect(viewport: [f32; 2]) -> Rect {
+    Rect::from_min_size(pos2(0.0, 0.0), vec2(viewport[0], viewport[1]))
+}
+
+/// A focused 60 Hz input for `viewport` with a bounded texture side for headless frames.
+fn raw_input(viewport: [f32; 2], frame: usize) -> egui::RawInput {
+    egui::RawInput {
+        screen_rect: Some(screen_rect(viewport)),
+        time: Some(frame as f64 / 60.0),
+        focused: true,
+        max_texture_side: Some(4096),
+        ..Default::default()
+    }
+}
+
+/// Check that tab fitting partitions every index exactly once, uses finite nonnegative widths,
+/// stays within `available` (plus epsilon) including the overflow control, and keeps the selected
+/// tab (clamped to the last tab).
+fn check_tabs(natural: &[f32], selected: usize, available: f32, minimum: f32, overflow: f32) -> Result<(), Box<dyn Error>> {
+    let fit = tabs::fit(natural, selected, available, minimum, overflow);
+    let mut seen = vec![false; natural.len()];
+    let mut sum = 0.0f32;
+    for (index, width) in &fit.shown {
+        if *index >= natural.len() || seen[*index] || !width.is_finite() || *width < 0.0 {
+            return Err(format!("tabs_fit invalid shown entry ({index}, {width})").into());
+        }
+        seen[*index] = true;
+        sum += *width;
+    }
+    for index in &fit.overflow {
+        if *index >= natural.len() || seen[*index] {
+            return Err(format!("tabs_fit invalid overflow index {index}").into());
+        }
+        seen[*index] = true;
+    }
+    if seen.iter().any(|shown| !*shown) || sum + fit.overflow_width > available + EPS {
+        return Err(format!("tabs_fit did not partition {available}: sum={sum} overflow={}", fit.overflow_width).into());
+    }
+    let selected = selected.min(natural.len().saturating_sub(1));
+    if !natural.is_empty() && !fit.shown.iter().any(|(index, _)| *index == selected) {
+        return Err("tabs_fit dropped the selected tab".into());
+    }
+    Ok(())
+}
+
+/// Check a split layout: both panes are positive and sum to the span minus the gap, do not overlap
+/// or escape, `resized` stays finite, and an inverted rect is rejected. Returns the layout.
+fn check_split(rect: Rect, axis: SplitAxis, size: SplitSize, gap: f32, minimum: f32) -> Result<craft_ui::layout::SplitLayout, Box<dyn Error>> {
+    let layout = split_rect(rect, axis, size, gap, minimum).ok_or("split_rect returned None")?;
+    let (span, first, second) = match axis {
+        SplitAxis::Horizontal => (rect.width(), layout.first.width(), layout.second.width()),
+        SplitAxis::Vertical => (rect.height(), layout.first.height(), layout.second.height()),
+    };
+    let (divider_end, second_start) = match axis {
+        SplitAxis::Horizontal => (layout.divider.max.x, layout.second.min.x),
+        SplitAxis::Vertical => (layout.divider.max.y, layout.second.min.y),
+    };
+    if !(first > 0.0 && second > 0.0) || (first + second + gap.min(span) - span).abs() > EPS {
+        return Err(format!("split_rect geometry: first={first} second={second} span={span}").into());
+    }
+    if divider_end > second_start + EPS || !rect.expand(EPS).contains_rect(layout.first) || !rect.expand(EPS).contains_rect(layout.second) {
+        return Err("split_rect panes overlap or escape their rect".into());
+    }
+    let next = layout.resized(size, 12.0, minimum).ok_or("split_resized returned None")?;
+    let finite = match next {
+        SplitSize::Ratio(v) | SplitSize::FixedFirst(v) | SplitSize::FixedSecond(v) => v.is_finite(),
+    };
+    if !finite {
+        return Err("split_resized returned a non-finite size".into());
+    }
+    if split_rect(Rect::from_min_max(pos2(10.0, 10.0), pos2(0.0, 0.0)), axis, size, gap, minimum).is_some() {
+        return Err("split_rect accepted an inverted rect".into());
+    }
+    Ok(layout)
+}
+
+/// Check that toolbar fitting is an exact prefix partition: shown widths match the natural widths,
+/// overflow is the remaining suffix, a nonempty overflow reserves a positive control, and a
+/// zero-width group is rejected.
+fn check_toolbar(natural: &[f32], available: f32, spacing: f32, overflow: f32) -> Result<(), Box<dyn Error>> {
+    let fit = fit_toolbar(natural, available, spacing, overflow).ok_or("fit_toolbar returned None")?;
+    let mut expected = 0;
+    for (index, width) in &fit.shown {
+        if *index >= natural.len() || *index != expected || (*width - natural[*index]).abs() > EPS {
+            return Err(format!("fit_toolbar broken prefix at {index}").into());
+        }
+        expected += 1;
+    }
+    if fit.overflow.iter().any(|index| *index < expected) || expected + fit.overflow.len() != natural.len() {
+        return Err("fit_toolbar did not partition the groups".into());
+    }
+    if !fit.overflow.is_empty() && fit.overflow_width <= 0.0 {
+        return Err("fit_toolbar overflowed without reserving a control".into());
+    }
+    if fit_toolbar(&[0.0], available, spacing, overflow).is_some() {
+        return Err("fit_toolbar accepted a zero-width group".into());
+    }
+    Ok(())
+}
+
+/// A one-panel tabs node with the panel active.
+fn leaf(panel: u32) -> Node<u32> {
+    Node::Tabs { panels: vec![panel], active: 0 }
+}
+
+/// A balanced recursive split fixture over `panels`, alternating the axis with `depth`.
+fn tree(panels: &[u32], depth: usize) -> Node<u32> {
+    if panels.len() == 1 {
+        return leaf(panels[0]);
+    }
+    let mid = panels.len() / 2;
+    Node::Split {
+        axis: if depth.is_multiple_of(2) { SplitAxis::Horizontal } else { SplitAxis::Vertical },
+        size: SplitSize::Ratio(0.5),
+        first: Box::new(tree(&panels[..mid], depth + 1)),
+        second: Box::new(tree(&panels[mid..], depth + 1)),
+    }
+}
+
+/// The benchmark layout: with `with_floating`, a fixed 240 pt second column beside a vertical split
+/// plus floating window id 1; otherwise a balanced tree over `panels`.
+fn dock_layout(panels: u32, with_floating: bool) -> Layout<u32> {
+    if with_floating {
+        Layout {
+            root: Some(Node::Split {
+                axis: SplitAxis::Horizontal,
+                size: SplitSize::FixedSecond(240.0),
+                first: Box::new(Node::Split {
+                    axis: SplitAxis::Vertical,
+                    size: SplitSize::Ratio(0.55),
+                    first: Box::new(leaf(0)),
+                    second: Box::new(leaf(1)),
+                }),
+                second: Box::new(leaf(2)),
+            }),
+            floating: vec![Floating::single(vec![3], 0, [80.0, 70.0, 300.0, 220.0]).with_id(1)],
+        }
+    } else {
+        let all: Vec<u32> = (0..panels).collect();
+        Layout { root: Some(tree(&all, 0)), floating: Vec::new() }
+    }
+}
+
+/// Return the benchmark content's logical label, `Panel {panel}`.
+fn panel_label(panel: &u32) -> String {
+    format!("Panel {panel}")
+}
+
+/// Count texture-set images, their color bytes, and freed images in `delta`.
+fn texture_counts(delta: &egui::TexturesDelta) -> (usize, usize, usize) {
+    let mut images = 0;
+    let mut bytes = 0;
+    for deltas in delta.set.values() {
+        for image in deltas {
+            images += 1;
+            let egui::ImageData::Color(data) = &image.image;
+            bytes += data.as_raw().len();
+        }
+    }
+    (images, bytes, delta.free.len())
+}
+
+/// Sum mesh vertices and indices, rejecting renderer callbacks because benchmark fixtures must not
+/// produce them.
+fn count_mesh(primitives: &[egui::epaint::ClippedPrimitive]) -> Result<(usize, usize), Box<dyn Error>> {
+    let (mut vertices, mut indices) = (0, 0);
+    for clipped in primitives {
+        match &clipped.primitive {
+            egui::epaint::Primitive::Mesh(mesh) => {
+                vertices += mesh.vertices.len();
+                indices += mesh.indices.len();
+            }
+            egui::epaint::Primitive::Callback(_) => return Err("the benchmark fixtures must not produce renderer callbacks".into()),
+        }
+    }
+    Ok((vertices, indices))
+}
+
+// Fingerprint of one frame's tessellated primitives, beyond equal vertex/index counts. Texture IDs and
+// clip bounds are included. This is a 64-bit FNV-1a checksum, not an exact mesh identity. Timings stop
+// before this evidence collection.
+/// A 64-bit FNV-1a fingerprint over primitive count, clip rects, texture ids, vertex data and
+/// indices. This is a diagnostic checksum, not exact mesh identity; callbacks are rejected.
+fn mesh_hash(primitives: &[egui::epaint::ClippedPrimitive]) -> Result<u64, Box<dyn Error>> {
+    let mut hash = 0xcbf29ce484222325u64;
+    let mut feed = |bytes: &[u8]| {
+        for byte in bytes {
+            hash ^= u64::from(*byte);
+            hash = hash.wrapping_mul(0x100000001b3);
+        }
+    };
+    feed(&(primitives.len() as u64).to_le_bytes());
+    for clipped in primitives {
+        for value in [clipped.clip_rect.min.x, clipped.clip_rect.min.y, clipped.clip_rect.max.x, clipped.clip_rect.max.y] {
+            feed(&value.to_bits().to_le_bytes());
+        }
+        match &clipped.primitive {
+            egui::epaint::Primitive::Mesh(mesh) => {
+                feed(&[0]);
+                match mesh.texture_id {
+                    egui::TextureId::Managed(id) => {
+                        feed(&[0]);
+                        feed(&id.to_le_bytes());
+                    }
+                    egui::TextureId::User(id) => {
+                        feed(&[1]);
+                        feed(&id.to_le_bytes());
+                    }
+                }
+                feed(&(mesh.vertices.len() as u64).to_le_bytes());
+                feed(&(mesh.indices.len() as u64).to_le_bytes());
+                for vertex in &mesh.vertices {
+                    for value in [vertex.pos.x, vertex.pos.y, vertex.uv.x, vertex.uv.y] {
+                        feed(&value.to_bits().to_le_bytes());
+                    }
+                    feed(&vertex.color.to_array());
+                }
+                for index in &mesh.indices {
+                    feed(&index.to_le_bytes());
+                }
+            }
+            egui::epaint::Primitive::Callback(_) => return Err("the benchmark fixtures must not produce renderer callbacks".into()),
+        }
+    }
+    Ok(hash)
+}
+
+/// Run `FRAME_SAMPLES` measured frames after at least 50 warmup frames and 3 seconds. Times and
+/// completed passes are recorded for every measured frame; the final measured frame also collects
+/// bodies and the shapes, mesh counts and hash reported in the result. Texture and repaint counters
+/// aggregate over measured frames, and texture deltas are cleared each frame.
+fn measure_frames(
+    ctx: &Context,
+    viewport: [f32; 2],
+    paint: &mut impl FnMut(&mut egui::Ui, &mut BTreeMap<u32, Rect>, bool),
+) -> Result<Frames, Box<dyn Error>> {
+    let mut result = Frames::default();
+    result.times_ns.reserve(FRAME_SAMPLES);
+    result.passes.reserve(FRAME_SAMPLES);
+    let warmup_start = Instant::now();
+    let mut frame = 0;
+    while result.times_ns.len() < FRAME_SAMPLES {
+        let warming = frame < WARMUPS || warmup_start.elapsed() < MIN_WARMUP;
+        if !warming && result.times_ns.is_empty() {
+            result.galleys_after_warmup = ctx.fonts(|fonts| fonts.num_galleys_in_cache());
+            result.warmup_elapsed_ns = warmup_start.elapsed().as_nanos() as u64;
+        }
+        // The last measured frame also collects panel bodies, so bodies, geometry and mesh evidence all
+        // describe the same rendered frame as the reported timings.
+        let collect = !warming && result.times_ns.len() + 1 == FRAME_SAMPLES;
+        result.bodies.clear();
+        let start = Instant::now();
+        let mut output = ctx.run_ui(raw_input(viewport, frame), |ui| paint(ui, &mut result.bodies, collect));
+        let ppp = output.pixels_per_point;
+        let shapes = output.shapes.len();
+        let primitives = ctx.tessellate(output.shapes, ppp);
+        if !warming {
+            result.times_ns.push(start.elapsed().as_nanos() as u64);
+            result.passes.push(output.platform_output.num_completed_passes);
+            result.shapes = shapes;
+            (result.vertices, result.indices) = count_mesh(&primitives)?;
+            result.mesh_hash = mesh_hash(&primitives)?;
+            let (sets, bytes, frees) = texture_counts(&output.textures_delta);
+            result.set_images += sets;
+            result.set_bytes += bytes;
+            result.free_images += frees;
+            if output.viewport_output.get(&egui::ViewportId::ROOT).is_some_and(|output| output.repaint_delay != std::time::Duration::MAX) {
+                result.repaint_frames += 1;
+            }
+        } else {
+            result.warmups += 1;
+        }
+        output.textures_delta.clear();
+        frame += 1;
+    }
+    result.next_frame = frame;
+    Ok(result)
+}
+
+/// Check every recorded body is positive, finite and inside the viewport; non-floating bodies may
+/// not overlap by more than 0.5 pt. Returns the body count.
+fn check_bodies(screen: Rect, bodies: &BTreeMap<u32, Rect>, floating: &BTreeSet<u32>) -> Result<usize, Box<dyn Error>> {
+    for (panel, rect) in bodies {
+        if !rect.is_positive() || !rect.min.is_finite() || !rect.max.is_finite() {
+            return Err(format!("panel {panel} has empty or invalid body geometry {rect:?}").into());
+        }
+        if !screen.expand(EPS * 4.0).contains_rect(*rect) {
+            return Err(format!("panel {panel} body {rect:?} escapes the viewport {screen:?}").into());
+        }
+    }
+    let static_rects: Vec<(u32, Rect)> = bodies.iter().filter(|(panel, _)| !floating.contains(*panel)).map(|(panel, rect)| (*panel, *rect)).collect();
+    for (i, (a, first)) in static_rects.iter().enumerate() {
+        for (b, second) in static_rects.iter().skip(i + 1) {
+            let overlap = first.intersect(*second);
+            if overlap.width() > 0.5 && overlap.height() > 0.5 {
+                return Err(format!("static panels {a} and {b} overlap: {overlap:?}").into());
+            }
+        }
+    }
+    Ok(bodies.len())
+}
+
+/// Check every interaction owned by the dock has a response with a positive hit rect inside the
+/// viewport. Returns the interaction count.
+fn check_interactions(ctx: &Context, dock_id: Id, screen: Rect) -> Result<usize, Box<dyn Error>> {
+    let owned = ctx.data(|data| data.get_temp::<Vec<Id>>(dock_id.with("owned-interactions"))).unwrap_or_default();
+    if owned.is_empty() {
+        return Err("dock rendered no owned interactions".into());
+    }
+    for id in &owned {
+        let response = ctx.read_response(*id).ok_or_else(|| format!("missing response for dock interaction {id:?}"))?;
+        if !response.interact_rect.is_positive() {
+            return Err(format!("dock interaction {id:?} has empty hit rect {:?}", response.interact_rect).into());
+        }
+        if !screen.expand(EPS * 4.0).contains_rect(response.interact_rect) {
+            return Err(format!("dock interaction {id:?} hit rect {:?} escapes the viewport", response.interact_rect).into());
+        }
+    }
+    Ok(owned.len())
+}
+
+/// Move the pointer to the first body's tab center in a separate unmeasured frame and require the
+/// tab to hover; returns the probe JSON. The probe is excluded from timings and counters.
+fn probe_tab_hover(
+    ctx: &Context,
+    viewport: [f32; 2],
+    dock_id: Id,
+    bodies: &BTreeMap<u32, Rect>,
+    frame: usize,
+    paint: &mut impl FnMut(&mut egui::Ui, &mut BTreeMap<u32, Rect>, bool),
+) -> Result<Value, Box<dyn Error>> {
+    let panel = bodies.keys().next().copied().ok_or("no panel body for hover probe")?;
+    let tab_id = dock_id.with(("tab", panel));
+    let rect = ctx.read_response(tab_id).ok_or("no tab response for hover probe")?.rect;
+    let mut input = raw_input(viewport, frame);
+    input.events.push(egui::Event::PointerMoved(rect.center()));
+    let mut probe_bodies = BTreeMap::new();
+    ctx.run_ui(input, |ui| paint(ui, &mut probe_bodies, true)).textures_delta.clear();
+    if !ctx.read_response(tab_id).is_some_and(|response| response.hovered()) {
+        return Err(format!("pointer at {panel}'s tab center did not hover its tab").into());
+    }
+    Ok(json!({"panel": panel, "tab_center": [rect.center().x, rect.center().y], "hovered": true,
+               "scope": "separate unmeasured frame after the samples; excluded from timings and counters"}))
+}
+
+struct Case<'a> {
+    label: &'a str,
+    kind: &'a str,
+    panels: u32,
+    floating: bool,
+    side_panel: bool,
+    viewport: [f32; 2],
+    scale: f32,
+}
+
+/// Render the fixture dock through `DockArea`, optionally recording each panel body's rect on the
+/// collection frame, and return the dock error.
+fn render_dock(
+    ui: &mut egui::Ui,
+    dock_id: Id,
+    layout: &Layout<u32>,
+    bodies: &mut BTreeMap<u32, Rect>,
+    style: &DockStyle,
+    collect: bool,
+) -> Option<DockError> {
+    DockArea::new(dock_id)
+        .show(
+            ui,
+            layout,
+            style,
+            panel_label,
+            |_| Permissions::default(),
+            |ui, panel| {
+                if collect {
+                    bodies.insert(*panel, ui.max_rect());
+                }
+            },
+        )
+        .error
+}
+
+struct Scene {
+    dock_id: Id,
+    side_panel: bool,
+    style: Option<DockStyle>,
+    error: Option<DockError>,
+    dock_rect: Rect,
+    left_rect: Option<Rect>,
+    central_rect: Option<Rect>,
+}
+
+impl Scene {
+    /// Render the dock inside an optional 180 pt left panel and central panel, capturing panel geometry
+    /// and preserving the first dock error; otherwise render at the available rect.
+    fn render(&mut self, layout: &Layout<u32>, ui: &mut egui::Ui, bodies: &mut BTreeMap<u32, Rect>, collect: bool) {
+        if self.style.is_none() {
+            self.style = Some(DockStyle::from_ui(ui));
+        }
+        let Self { dock_id, side_panel, style, error, dock_rect, left_rect, central_rect } = self;
+        let Some(style) = style.as_ref() else { return };
+        if *side_panel {
+            let _ = egui::Panel::left("ui-perf-left").resizable(false).exact_size(180.0).show(ui, |ui| {
+                *left_rect = Some(ui.max_rect());
+                ui.label("Left panel");
+            });
+            let _ = egui::CentralPanel::default().show(ui, |ui| {
+                *central_rect = Some(ui.max_rect());
+                let next = render_dock(ui, *dock_id, layout, bodies, style, collect);
+                if error.is_none() {
+                    *error = next;
+                }
+            });
+        } else {
+            *dock_rect = ui.available_rect_before_wrap();
+            let next = render_dock(ui, *dock_id, layout, bodies, style, collect);
+            if error.is_none() {
+                *error = next;
+            }
+        }
+    }
+}
+
+/// Run one case end to end: validate the layout, measure frames, gate sample count, warmup, one
+/// completed pass per frame and dock error, check body count, interactions and geometry, run the
+/// hover probe, and return the case JSON.
+fn run_case(case: Case<'_>, fonts: &egui::FontDefinitions) -> Result<Value, Box<dyn Error>> {
+    let ctx = context(case.scale, fonts);
+    let dock_id = Id::unique(("ui-perf", case.label));
+    let layout = dock_layout(case.panels, case.floating);
+    layout.validate()?;
+    let floating: BTreeSet<u32> = layout.floating.iter().flat_map(|group| group.panels().copied()).collect();
+    let mut scene =
+        Scene { dock_id, side_panel: case.side_panel, style: None, error: None, dock_rect: Rect::NOTHING, left_rect: None, central_rect: None };
+    let frames = {
+        let mut paint = |ui: &mut egui::Ui, bodies: &mut BTreeMap<u32, Rect>, collect: bool| scene.render(&layout, ui, bodies, collect);
+        measure_frames(&ctx, case.viewport, &mut paint)?
+    };
+    if frames.times_ns.len() != FRAME_SAMPLES {
+        return Err(format!("{} recorded {} of {FRAME_SAMPLES} frame samples", case.label, frames.times_ns.len()).into());
+    }
+    if frames.warmups < WARMUPS || frames.warmup_elapsed_ns < MIN_WARMUP.as_nanos() as u64 {
+        return Err(format!("{} failed its warmup gate: warmups={} elapsed_ns={}", case.label, frames.warmups, frames.warmup_elapsed_ns).into());
+    }
+    if frames.passes.len() != frames.times_ns.len() || frames.passes.iter().any(|passes| *passes != 1) {
+        return Err(format!("{} has measured frames without exactly one completed pass: {:?}", case.label, frames.passes).into());
+    }
+    if let Some(error) = scene.error {
+        return Err(format!("{} reported {error}", case.label).into());
+    }
+    let screen = screen_rect(case.viewport);
+    let body_count = check_bodies(screen, &frames.bodies, &floating)?;
+    let interaction_count = check_interactions(&ctx, dock_id, screen)?;
+    if body_count != case.panels as usize {
+        return Err(format!("{} rendered {body_count} of {} panel bodies", case.label, case.panels).into());
+    }
+    let geometry = if case.side_panel {
+        let left = scene.left_rect.ok_or("left panel did not render")?;
+        let central = scene.central_rect.ok_or("central panel did not render")?;
+        if !left.is_positive() || !central.is_positive() || left.right() > central.left() + EPS {
+            return Err(format!("left/central panel geometry is invalid: left={left:?} central={central:?}").into());
+        }
+        json!({"left_rect": [left.min.x, left.min.y, left.width(), left.height()],
+               "central_rect": [central.min.x, central.min.y, central.width(), central.height()]})
+    } else {
+        let dock_rect = scene.dock_rect;
+        if !dock_rect.is_positive() {
+            return Err(format!("{} had an empty available rect", case.label).into());
+        }
+        json!({"dock_rect": [dock_rect.min.x, dock_rect.min.y, dock_rect.width(), dock_rect.height()]})
+    };
+    let hover_probe = {
+        let mut probe = |ui: &mut egui::Ui, bodies: &mut BTreeMap<u32, Rect>, collect: bool| scene.render(&layout, ui, bodies, collect);
+        probe_tab_hover(&ctx, case.viewport, dock_id, &frames.bodies, frames.next_frame, &mut probe)?
+    };
+    let frame_stats = summarize(&frames.times_ns);
+    Ok(json!({
+        "case": case.label, "kind": case.kind, "panels": case.panels, "floating": case.floating,
+        "viewport_points": case.viewport, "viewport_physical": [case.viewport[0] * case.scale, case.viewport[1] * case.scale],
+        "pixels_per_point": case.scale, "frames": frames.times_ns.len(), "warmups": frames.warmups,
+        "warmup_elapsed_ns": frames.warmup_elapsed_ns,
+        "last_measured_mesh_fnv64": format!("{:016x}", frames.mesh_hash),
+        "last_measured_mesh_scope": "64-bit FNV-1a fingerprint of the final measured frame's primitives; not an exact identity",
+        "frame_scope": "Context::run_ui + Context::tessellate",
+        "frame_times_ns": frames.times_ns, "frame_stats": frame_stats,
+        "passes_per_frame": frames.passes,
+        "counter_scope": "shapes, vertices, indices and the mesh fingerprint describe the final measured frame, which also collects bodies and geometry; texture and repaint counters are summed over all measured frames",
+        "checks_scope": "final measured frame",
+        "galleys_after_warmup": frames.galleys_after_warmup,
+        "shapes": frames.shapes, "vertices": frames.vertices, "indices": frames.indices,
+        "texture_set_images": frames.set_images, "texture_set_bytes": frames.set_bytes,
+        "texture_free_images": frames.free_images, "repaint_frames": frames.repaint_frames,
+        "galleys": ctx.fonts(|fonts| fonts.num_galleys_in_cache()),
+        "hover_probe": hover_probe,
+        "checks": {"bodies": body_count, "interactions": interaction_count, "geometry": geometry},
+    }))
+}
diff --git a/crates/ui/src/capture.rs b/crates/ui/src/capture.rs
new file mode 100644
index 00000000..848469ff
--- /dev/null
+++ b/crates/ui/src/capture.rs
@@ -0,0 +1,251 @@
+//! One-shot completion slots for screenshot requests.
+//!
+//! Applications retain request IDs, output paths, deadlines, settling policy, geometry epochs and
+//! aggregate admission budgets. This module only correlates one capture with one slot, checks the
+//! retained image against a per-image byte bound, and wakes the owning viewport.
+//!
+//! [`CaptureSlot::new`] does not issue a screenshot command. Send the returned [`egui::ScreenshotCallback`]
+//! with [`egui::ViewportCommand::Screenshot`] when the application decides the capture is due, or
+//! complete it directly from a headless renderer. The callback holds only a weak reference to the
+//! slot, so dropping or cancelling the request releases its image and makes late results inert.
+//!
+//! Every retry needs a fresh slot and a fresh callback from [`CaptureSlot::new`]; a callback is
+//! one-shot, and a slot ignores completions after its result was taken, cancelled or dropped. The
+//! slot does not track whether a request is still open: keep that pending/closed distinction in the
+//! application's request record.
+//!
+//! A completion that publishes its result just before a concurrent [`CaptureSlot::cancel`] or drop
+//! can still deliver its single wakeup afterwards. That extra repaint is harmless: if the
+//! cancellation won, the image is released and a later [`CaptureSlot::take`] returns `None`; if
+//! `take` won first, the caller already owns the result and nothing else changes. A completion that
+//! observes a cancelled or taken slot stores no image and does not wake. Cancellation and completion
+//! are therefore not atomic with respect to the wakeup, and this module never waits for another
+//! thread while holding the slot lock.
+//!
+//! [`CaptureSlot`] holds a strong [`egui::Context`]. Keep it in the application's request record;
+//! storing it in `Context`-owned data (`egui::Memory::data` or a registered plugin) forms a
+//! `Context` → slot → `Context` cycle that keeps both alive.
+
+use std::mem::size_of;
+use std::sync::{Arc, Mutex, MutexGuard, PoisonError, Weak};
+
+use egui::{Color32, ColorImage, Context, ScreenshotCallback, ViewportId};
+
+/// Why a completed screenshot was rejected and released.
+///
+/// The enum is `#[non_exhaustive]`: consumers should match the known variants and use a wildcard
+/// arm for a future rejection reason.
+#[non_exhaustive]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CaptureError {
+    /// The checked `width * height` pixel count, or its `width * height * size_of::<Color32>()`
+    /// byte count, overflowed `usize`.
+    DimensionsOverflow { width: usize, height: usize },
+    /// The pixel buffer does not match the reported image dimensions, or the image has zero width
+    /// or height.
+    MalformedImage { width: usize, height: usize, pixels: usize },
+    /// The checked image size exceeds the slot's per-image byte bound.
+    ImageTooLarge { bytes: usize, max_bytes: usize },
+}
+
+impl core::fmt::Display for CaptureError {
+    /// Format a human-readable rejection reason. The wording is informative only and is not an
+    /// API contract; the variants keep checked-overflow, malformed-image and size-cap cases
+    /// distinguishable.
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Self::DimensionsOverflow { width, height } => {
+                write!(f, "screenshot dimensions {width}×{height} overflow the checked pixel or byte count")
+            }
+            Self::MalformedImage { width, height, pixels } => write!(f, "screenshot has {pixels} pixels for its {width}×{height} dimensions"),
+            Self::ImageTooLarge { bytes, max_bytes } => write!(f, "screenshot uses {bytes} bytes, over the {max_bytes}-byte per-image limit"),
+        }
+    }
+}
+
+impl std::error::Error for CaptureError {}
+
+enum SlotState {
+    Pending,
+    Ready(Result<Arc<ColorImage>, CaptureError>),
+    Taken,
+    Cancelled,
+}
+
+struct Shared {
+    state: Mutex<SlotState>,
+    /// The live request owns the strong context; the callback only upgrades it briefly to wake.
+    context: Context,
+    viewport: ViewportId,
+    max_image_bytes: usize,
+}
+
+/// The live request side of a capture. Keep it alive until the result is taken or the request is
+/// cancelled; dropping it cancels the completion and releases any retained image.
+///
+/// This type is `Send + Sync`; the application may hold it in its request record and poll
+/// [`Self::take`] from its logic pass. Do not store it in `Context`-owned storage: the slot holds a
+/// strong [`egui::Context`], so `egui::Memory::data` or a registered plugin would create a cycle.
+#[must_use = "the slot must be kept alive to receive and take the screenshot"]
+pub struct CaptureSlot {
+    shared: Arc<Shared>,
+}
+
+impl CaptureSlot {
+    /// Create a completion slot and its one-shot callback.
+    ///
+    /// `max_image_bytes` bounds the single retained image only. The application must separately
+    /// reserve its aggregate in-flight/completed budget before issuing the request.
+    ///
+    /// This function does not send a viewport command. If the request is issued in a UI pass, send
+    /// the callback with [`egui::ViewportCommand::Screenshot`]; a pending screenshot command itself
+    /// requests the paint needed while the window is hidden. Issue that command at most once per
+    /// slot, after the application has settled the frame it wants; every retry needs a fresh slot
+    /// and callback.
+    pub fn new(context: &Context, viewport: ViewportId, max_image_bytes: usize) -> (Self, ScreenshotCallback) {
+        let shared = Arc::new(Shared { state: Mutex::new(SlotState::Pending), context: context.clone(), viewport, max_image_bytes });
+        let weak = Arc::downgrade(&shared);
+        let callback = ScreenshotCallback::new(move |image| complete(&weak, image));
+        (Self { shared }, callback)
+    }
+
+    /// Take the completed result, at most once.
+    ///
+    /// Returns `None` while the capture is pending, after it was cancelled or dropped, and after a
+    /// previous call already took the image or error. The slot cannot distinguish those states;
+    /// the application's request record owns the pending/closed distinction. Invalid images are
+    /// returned as an error so the application can report completion failure with its own request
+    /// identity.
+    pub fn take(&self) -> Option<Result<Arc<ColorImage>, CaptureError>> {
+        let mut state = lock(&self.shared.state);
+        if !matches!(&*state, SlotState::Ready(_)) {
+            return None;
+        }
+        match core::mem::replace(&mut *state, SlotState::Taken) {
+            SlotState::Ready(result) => Some(result),
+            _ => None,
+        }
+    }
+
+    /// Cancel the request and release any completed image.
+    ///
+    /// A completion that published its result before this call may still deliver one harmless
+    /// repaint afterwards; the slot retains no image and a later [`Self::take`] returns `None`. A
+    /// completion that observes the cancellation stores no image and does not wake. Calling `cancel`
+    /// after [`Self::take`] is harmless. Any retained image is dropped after the slot mutex is
+    /// unlocked.
+    pub fn cancel(&self) {
+        close(&self.shared);
+    }
+
+    #[cfg(test)]
+    /// Nonblocking probe used by the wakeup test to prove that the slot mutex is free while the
+    /// repaint observer runs.
+    fn lock_is_free(&self) -> bool {
+        self.shared.state.try_lock().is_ok()
+    }
+
+    #[cfg(test)]
+    /// Count strong references to the shared slot state, proving callbacks retain none.
+    fn state_strong_count(&self) -> usize {
+        Arc::strong_count(&self.shared)
+    }
+
+    #[cfg(test)]
+    /// A weak handle to the shared state, used to inject a second completion directly when egui has
+    /// already consumed the public callback.
+    fn state_weak(&self) -> Weak<Shared> {
+        Arc::downgrade(&self.shared)
+    }
+}
+
+impl Drop for CaptureSlot {
+    /// Cancel the request as the slot goes away. A later completion upgrades no live state and
+    /// releases its image, a retained ready image is dropped, and no repaint is requested. Results
+    /// already taken by the caller are unaffected.
+    fn drop(&mut self) {
+        close(&self.shared);
+    }
+}
+
+impl core::fmt::Debug for CaptureSlot {
+    /// Format only the viewport and omit the remaining fields. The retained image and error payload
+    /// are deliberately hidden so logging cannot hold or dump screenshot contents.
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        f.debug_struct("CaptureSlot").field("viewport", &self.shared.viewport).finish_non_exhaustive()
+    }
+}
+
+/// Lock the slot state, recovering from poisoning instead of panicking. The guard must be
+/// released before entering the egui context or a repaint observer; completion and close do so
+/// before waking the viewport.
+fn lock(state: &Mutex<SlotState>) -> MutexGuard<'_, SlotState> {
+    state.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+/// Mark the slot closed and drop any retained image after releasing the mutex.
+fn close(shared: &Shared) {
+    let previous = {
+        let mut state = lock(&shared.state);
+        core::mem::replace(&mut *state, SlotState::Cancelled)
+    };
+    drop(previous);
+}
+
+/// Validate a completed image, store it, and wake the owning viewport.
+///
+/// The slot lock is released before calling into the context, so a repaint observer may call
+/// [`CaptureSlot::take`] or [`CaptureSlot::cancel`] re-entrantly. Inside an observer, only consume or
+/// release that value; any further `Context` access must happen outside the observer.
+/// [`egui::Context::request_repaint_of`] takes egui's context lock. Ordinary `Ui` closures and egui
+/// 0.37 plugin hooks run outside that lock, as do renderer/worker callbacks. Repaint observers and
+/// request-repaint callbacks run under it: completing from either would deadlock when requesting
+/// the repaint. This function never waits under the slot lock.
+fn complete(weak: &Weak<Shared>, image: Arc<ColorImage>) {
+    let Some(shared) = weak.upgrade() else {
+        // The request was dropped; the image is released here without a reply.
+        return;
+    };
+    let result = checked_image(image, shared.max_image_bytes);
+    let should_wake = {
+        let mut state = lock(&shared.state);
+        if matches!(&*state, SlotState::Pending) {
+            *state = SlotState::Ready(result);
+            true
+        } else {
+            // Cancelled, already taken, or (defensively) completed twice: drop the image.
+            false
+        }
+    };
+    // The slot lock is released before calling into the context, so a repaint observer may take
+    // the result or cancel the request re-entrantly without deadlocking.
+    if should_wake {
+        shared.context.request_repaint_of(shared.viewport);
+    }
+}
+
+/// Validate `image` against the slot's per-image byte bound before publishing it.
+///
+/// Zero width or height is malformed before any arithmetic; the pixel count and its byte size use
+/// checked multiplication; the buffer length must equal `width * height`; and only then is the
+/// byte count compared with `max_image_bytes`, rejecting a count greater than it (equality is
+/// accepted). `max_image_bytes` bounds this one image, not an aggregate request budget. Returns the
+/// same `Arc` without waking the viewport or requesting a repaint.
+fn checked_image(image: Arc<ColorImage>, max_image_bytes: usize) -> Result<Arc<ColorImage>, CaptureError> {
+    let [width, height] = image.size;
+    if width == 0 || height == 0 {
+        return Err(CaptureError::MalformedImage { width, height, pixels: image.pixels.len() });
+    }
+    let pixels = width.checked_mul(height).ok_or(CaptureError::DimensionsOverflow { width, height })?;
+    let bytes = pixels.checked_mul(size_of::<Color32>()).ok_or(CaptureError::DimensionsOverflow { width, height })?;
+    if image.pixels.len() != pixels {
+        return Err(CaptureError::MalformedImage { width, height, pixels: image.pixels.len() });
+    }
+    if bytes > max_image_bytes {
+        return Err(CaptureError::ImageTooLarge { bytes, max_bytes: max_image_bytes });
+    }
+    Ok(image)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui/src/capture/tests.rs b/crates/ui/src/capture/tests.rs
new file mode 100644
index 00000000..dd666d71
--- /dev/null
+++ b/crates/ui/src/capture/tests.rs
@@ -0,0 +1,491 @@
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Barrier};
+
+use super::*;
+
+/// Allocate a filled `Arc<ColorImage>` fixture of `size` with every pixel set to `color`.
+fn image(size: [usize; 2], color: egui::Color32) -> Arc<ColorImage> {
+    Arc::new(ColorImage::filled(size, color))
+}
+
+/// Install a repaint observer and return the viewport requests it records.
+fn observe_repaints(ctx: &Context) -> Arc<Mutex<Vec<ViewportId>>> {
+    let requests = Arc::new(Mutex::new(Vec::new()));
+    let observed = requests.clone();
+    ctx.set_repaint_observer(move |info| observed.lock().unwrap().push(info.viewport_id));
+    requests
+}
+
+#[test]
+/// Compile-time assertion that `CaptureSlot` and `ScreenshotCallback` are `Send + Sync`.
+fn slot_is_send_and_sync() {
+    /// Compile-time helper requiring `T: Send + Sync`; the enclosing test uses it to
+    /// assert the public capture types are thread-safe.
+    fn assert_send_sync<T: Send + Sync>() {}
+    assert_send_sync::<CaptureSlot>();
+    assert_send_sync::<ScreenshotCallback>();
+}
+
+#[test]
+/// Two independent slots for different viewports may complete in reverse order; each `take`
+/// returns exactly its own image and dimensions.
+fn distinct_requests_complete_in_reverse_order() {
+    let ctx = Context::default();
+    let first_viewport = ViewportId::from_hash_of("first-window");
+    let second_viewport = ViewportId::from_hash_of("second-window");
+    let (first, first_callback) = CaptureSlot::new(&ctx, first_viewport, 1024);
+    let (second, second_callback) = CaptureSlot::new(&ctx, second_viewport, 1024);
+    let first_image = image([2, 1], egui::Color32::RED);
+    let second_image = image([1, 3], egui::Color32::BLUE);
+
+    // The renderer may answer the later request first.
+    second_callback.complete(second_image.clone());
+    first_callback.complete(first_image.clone());
+
+    let taken_first = first.take().unwrap().unwrap();
+    let taken_second = second.take().unwrap().unwrap();
+    assert!(Arc::ptr_eq(&taken_first, &first_image));
+    assert!(Arc::ptr_eq(&taken_second, &second_image));
+    assert_eq!(taken_first.size, [2, 1]);
+    assert_eq!(taken_second.size, [1, 3]);
+}
+
+#[test]
+/// Slots keep separate results and byte caps: a 2×2 image over the first slot's 4-byte cap is
+/// rejected as too large while the second stays pending, then the second accepts its own image and
+/// a taken slot remains empty.
+fn slots_do_not_share_results_or_byte_bounds() {
+    let ctx = Context::default();
+    let first_viewport = ViewportId::from_hash_of("first-slot");
+    let second_viewport = ViewportId::from_hash_of("second-slot");
+    let (first, first_callback) = CaptureSlot::new(&ctx, first_viewport, 4);
+    let (second, second_callback) = CaptureSlot::new(&ctx, second_viewport, 16);
+
+    let rejected_for_first = image([2, 2], egui::Color32::RED);
+    first_callback.complete(rejected_for_first);
+
+    assert!(second.take().is_none(), "completing one slot leaves the other pending");
+    assert!(matches!(first.take(), Some(Err(CaptureError::ImageTooLarge { bytes: 16, max_bytes: 4 }))));
+
+    let accepted_for_second = image([2, 2], egui::Color32::BLUE);
+    second_callback.complete(accepted_for_second.clone());
+    assert!(Arc::ptr_eq(&second.take().unwrap().unwrap(), &accepted_for_second));
+    assert!(first.take().is_none(), "a taken slot stays empty");
+}
+
+#[test]
+/// Cloned callbacks share one completion: the first result wins, the losing image is released, and
+/// `take` yields the result only once.
+fn callback_clones_share_one_completion_and_take_is_single_use() {
+    let ctx = Context::default();
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    let duplicate = callback.clone();
+    let first_image = image([1, 1], egui::Color32::RED);
+    let second_image = image([1, 1], egui::Color32::BLUE);
+    let weak_loser = Arc::downgrade(&second_image);
+
+    callback.complete(first_image.clone());
+    duplicate.complete(second_image);
+    assert!(weak_loser.upgrade().is_none(), "the losing completion releases its image");
+
+    let taken = slot.take().unwrap().unwrap();
+    assert!(Arc::ptr_eq(&taken, &first_image), "the first completion wins");
+    assert!(slot.take().is_none(), "the result is taken once");
+}
+
+#[test]
+/// After `take`, both a duplicate callback and a direct completion release their images without
+/// storing a result or requesting a repaint.
+fn duplicate_completion_after_take_neither_stores_nor_wakes() {
+    let ctx = Context::default();
+    let requests = observe_repaints(&ctx);
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    let duplicate_callback = callback.clone();
+    let first_image = image([1, 1], egui::Color32::RED);
+    callback.complete(first_image.clone());
+    assert!(Arc::ptr_eq(&slot.take().unwrap().unwrap(), &first_image));
+    assert_eq!(requests.lock().unwrap().len(), 1, "the first completion wakes");
+
+    let duplicate_image = image([1, 1], egui::Color32::BLUE);
+    let weak_duplicate = Arc::downgrade(&duplicate_image);
+    duplicate_callback.complete(duplicate_image);
+
+    assert!(weak_duplicate.upgrade().is_none(), "a duplicate after take is released");
+    assert!(slot.take().is_none());
+    assert_eq!(requests.lock().unwrap().len(), 1, "a duplicate after take does not wake");
+
+    // Deliver a second completion straight to the slot; egui already consumed its callback.
+    let direct_image = image([1, 1], egui::Color32::GREEN);
+    let weak_direct = Arc::downgrade(&direct_image);
+    complete(&slot.state_weak(), direct_image);
+    assert!(weak_direct.upgrade().is_none(), "a direct second completion after take is released");
+    assert!(slot.take().is_none());
+    assert_eq!(requests.lock().unwrap().len(), 1, "a direct second completion after take does not wake");
+}
+
+#[test]
+/// An early `take` returns `None` without closing the request; a later completion still delivers.
+fn take_before_completion_is_empty_and_keeps_the_request_open() {
+    let ctx = Context::default();
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    assert!(slot.take().is_none());
+    let expected = image([1, 1], egui::Color32::RED);
+    callback.complete(expected.clone());
+    assert!(Arc::ptr_eq(&slot.take().unwrap().unwrap(), &expected));
+}
+
+#[test]
+/// Cancelling before completion releases a late image, leaves `take` empty, and suppresses the
+/// repaint wakeup.
+fn cancel_releases_late_images_without_waking() {
+    let ctx = Context::default();
+    let requests = observe_repaints(&ctx);
+    let viewport = ViewportId::from_hash_of("cancelled-window");
+    let (slot, callback) = CaptureSlot::new(&ctx, viewport, 1024);
+    slot.cancel();
+
+    let late_image = image([2, 2], egui::Color32::RED);
+    let weak_image = Arc::downgrade(&late_image);
+    callback.complete(late_image.clone());
+    drop(late_image);
+
+    assert!(weak_image.upgrade().is_none(), "a cancelled slot releases the late image");
+    assert!(slot.take().is_none());
+    assert!(requests.lock().unwrap().is_empty(), "cancellation suppresses the wakeup");
+}
+
+#[test]
+/// A ready slot retains its image and has woken once; `cancel` releases the image and does not wake
+/// again.
+fn cancel_after_ready_releases_the_image() {
+    let ctx = Context::default();
+    let requests = observe_repaints(&ctx);
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    let completed = image([2, 2], egui::Color32::RED);
+    let weak_image = Arc::downgrade(&completed);
+    callback.complete(completed.clone());
+    drop(completed);
+    assert!(weak_image.upgrade().is_some(), "the ready slot retains the image");
+    assert_eq!(requests.lock().unwrap().len(), 1, "the completion woke the viewport");
+
+    slot.cancel();
+
+    assert!(weak_image.upgrade().is_none(), "cancel releases a ready image");
+    assert!(slot.take().is_none());
+    assert_eq!(requests.lock().unwrap().len(), 1, "cancellation itself does not wake");
+}
+
+#[test]
+/// Dropping the slot releases an image that is only retained by the completed slot.
+fn dropping_the_slot_releases_a_completed_image() {
+    let ctx = Context::default();
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    let completed = image([2, 2], egui::Color32::RED);
+    callback.complete(completed.clone());
+    let weak_image = Arc::downgrade(&completed);
+    drop(completed);
+    assert!(weak_image.upgrade().is_some(), "the slot retains the completed image");
+
+    drop(slot);
+    assert!(weak_image.upgrade().is_none(), "dropping the slot releases its image");
+}
+
+#[test]
+/// A completion after the slot is dropped releases the image and does not wake the viewport.
+fn late_completion_after_drop_is_inert() {
+    let ctx = Context::default();
+    let requests = observe_repaints(&ctx);
+    let viewport = ViewportId::ROOT;
+    let (slot, callback) = CaptureSlot::new(&ctx, viewport, 1024);
+    drop(slot);
+
+    let late_image = image([1, 1], egui::Color32::RED);
+    let weak_image = Arc::downgrade(&late_image);
+    callback.complete(late_image.clone());
+    drop(late_image);
+
+    assert!(weak_image.upgrade().is_none());
+    assert!(requests.lock().unwrap().is_empty(), "a late result does not wake the viewport");
+}
+
+#[test]
+/// Callbacks hold only a weak reference: the slot state has one strong owner, dropping the slot
+/// releases the context and state, and a later completion is inert.
+fn callback_retains_only_a_weak_reference_to_live_state() {
+    let ctx = Context::default();
+    let requests = observe_repaints(&ctx);
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    let callback_clone = callback.clone();
+    assert_eq!(slot.state_strong_count(), 1, "the callback must not own the slot state");
+
+    let weak_state = slot.state_weak();
+    drop(slot);
+    assert!(weak_state.upgrade().is_none(), "dropping the slot releases its context and state");
+
+    let late_image = image([1, 1], egui::Color32::RED);
+    let weak_image = Arc::downgrade(&late_image);
+    callback_clone.complete(late_image.clone());
+    drop(late_image);
+    assert!(weak_image.upgrade().is_none());
+    assert!(requests.lock().unwrap().is_empty());
+}
+
+#[test]
+/// A completion distinguishes the per-image size cap, a malformed pixel buffer, and overflow of
+/// the pixel or byte count; a returned error is taken at most once.
+fn rejects_oversized_malformed_and_overflowing_images() {
+    let ctx = Context::default();
+
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 16);
+    callback.complete(image([3, 3], egui::Color32::RED));
+    assert!(matches!(slot.take(), Some(Err(CaptureError::ImageTooLarge { bytes: 36, max_bytes: 16 }))));
+    assert!(slot.take().is_none(), "a completion error is reported once");
+
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    callback.complete(Arc::new(ColorImage { size: [2, 2], source_size: egui::Vec2::ZERO, pixels: vec![egui::Color32::RED; 3] }));
+    assert!(matches!(slot.take(), Some(Err(CaptureError::MalformedImage { width: 2, height: 2, pixels: 3 }))));
+
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    callback.complete(Arc::new(ColorImage { size: [usize::MAX, 2], source_size: egui::Vec2::ZERO, pixels: Vec::new() }));
+    assert!(matches!(slot.take(), Some(Err(CaptureError::DimensionsOverflow { width, height })) if width == usize::MAX && height == 2));
+
+    // The pixel count fits but the byte count does not.
+    let wide = usize::MAX / 2;
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    callback.complete(Arc::new(ColorImage { size: [wide, 1], source_size: egui::Vec2::ZERO, pixels: Vec::new() }));
+    assert!(matches!(slot.take(), Some(Err(CaptureError::DimensionsOverflow { width, height })) if width == wide && height == 1));
+}
+
+#[test]
+/// Oversized and malformed images are dropped immediately and each rejection still wakes the error
+/// consumer exactly once before `take` reports it.
+fn rejected_oversized_and_malformed_images_are_released_before_take() {
+    let ctx = Context::default();
+    let requests = observe_repaints(&ctx);
+
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 16);
+    let oversized = image([3, 3], egui::Color32::RED);
+    let weak_oversized = Arc::downgrade(&oversized);
+    callback.complete(oversized);
+    assert!(weak_oversized.upgrade().is_none(), "an oversized image is released");
+    assert_eq!(*requests.lock().unwrap(), [ViewportId::ROOT], "rejection wakes the error consumer");
+    assert!(matches!(slot.take(), Some(Err(CaptureError::ImageTooLarge { bytes: 36, max_bytes: 16 }))));
+
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    let malformed = Arc::new(ColorImage { size: [2, 2], source_size: egui::Vec2::ZERO, pixels: vec![egui::Color32::RED; 3] });
+    let weak_malformed = Arc::downgrade(&malformed);
+    callback.complete(malformed);
+    assert!(weak_malformed.upgrade().is_none(), "a malformed image is released");
+    assert_eq!(*requests.lock().unwrap(), [ViewportId::ROOT, ViewportId::ROOT]);
+    assert!(matches!(slot.take(), Some(Err(CaptureError::MalformedImage { width: 2, height: 2, pixels: 3 }))));
+}
+
+#[test]
+/// Any zero width or height is rejected as malformed before overflow or size-cap decisions, even
+/// for extreme extents such as `usize::MAX × 0`.
+fn zero_area_images_are_rejected_even_with_extreme_extents() {
+    let ctx = Context::default();
+
+    for size in [[0, 4], [4, 0], [0, 0], [usize::MAX, 0], [0, usize::MAX]] {
+        let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+        callback.complete(Arc::new(ColorImage { size, source_size: egui::Vec2::ZERO, pixels: Vec::new() }));
+        let rejected = slot.take();
+        assert!(
+            matches!(rejected, Some(Err(CaptureError::MalformedImage { width, height, pixels }))
+                if width == size[0] && height == size[1] && pixels == 0),
+            "zero-area image {size:?} must be rejected"
+        );
+    }
+}
+
+#[test]
+/// A 2×2 image at exactly the 16-byte cap is accepted: the bound is inclusive.
+fn accepts_an_image_exactly_at_the_byte_bound() {
+    let ctx = Context::default();
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 16);
+    let exact = image([2, 2], egui::Color32::GREEN);
+    callback.complete(exact.clone());
+    assert!(Arc::ptr_eq(&slot.take().unwrap().unwrap(), &exact));
+}
+
+#[test]
+/// A worker thread completes a child-window slot; every recorded wake belongs to that slot's
+/// viewport and the expected image is delivered.
+fn another_thread_completes_and_wakes_only_the_owning_viewport() {
+    let ctx = Context::default();
+    let requests = observe_repaints(&ctx);
+    let viewport = ViewportId::from_hash_of("child-window");
+    let (slot, callback) = CaptureSlot::new(&ctx, viewport, 1024);
+    let expected = image([1, 1], egui::Color32::RED);
+    let sent = expected.clone();
+
+    let handle = std::thread::spawn(move || callback.complete(sent));
+    handle.join().unwrap();
+
+    let requested = requests.lock().unwrap();
+    assert!(!requested.is_empty(), "completion wakes the owning viewport");
+    assert!(requested.iter().all(|requested_viewport| *requested_viewport == viewport), "completion wakes only the owning viewport: {requested:?}");
+    drop(requested);
+    assert!(Arc::ptr_eq(&slot.take().unwrap().unwrap(), &expected));
+}
+
+#[test]
+/// The repaint observer can `take` the image re-entrantly: `try_lock` succeeds during the wakeup,
+/// proving the slot lock is released before `request_repaint_of`.
+fn wakeup_runs_after_the_slot_lock_is_released() {
+    let ctx = Context::default();
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 1024);
+    let slot = Arc::new(slot);
+    let weak_slot = Arc::downgrade(&slot);
+    let observed = Arc::new(AtomicBool::new(false));
+    let lock_free = Arc::new(AtomicBool::new(true));
+    let taken = Arc::new(AtomicBool::new(false));
+    let observer_observed = observed.clone();
+    let observer_lock_free = lock_free.clone();
+    let observer_taken = taken.clone();
+    ctx.set_repaint_observer(move |info| {
+        if info.viewport_id == ViewportId::ROOT {
+            observer_observed.store(true, Ordering::SeqCst);
+            if let Some(slot) = weak_slot.upgrade() {
+                if slot.lock_is_free() {
+                    observer_taken.store(slot.take().is_some(), Ordering::SeqCst);
+                } else {
+                    observer_lock_free.store(false, Ordering::SeqCst);
+                }
+            }
+        }
+    });
+
+    callback.complete(image([1, 1], egui::Color32::RED));
+
+    assert!(observed.load(Ordering::SeqCst), "completion wakes the owning viewport");
+    assert!(lock_free.load(Ordering::SeqCst), "the slot lock is released before the wakeup");
+    assert!(taken.load(Ordering::SeqCst), "the observer can consume the image reentrantly");
+    assert!(slot.take().is_none());
+}
+
+/// Complete, cancel and take all racing on one slot. Every interleaving must leave at most one
+/// wake and at most one taken result, and every image must be released once the slot and result
+/// are dropped.
+#[test]
+fn complete_cancel_and_take_race_without_retaining_or_double_waking() {
+    const RACE_TRIALS: usize = 100;
+
+    for trial in 0..RACE_TRIALS {
+        let ctx = Context::default();
+        let requests = observe_repaints(&ctx);
+        let viewport = ViewportId::from_hash_of("race-window");
+        let (slot, callback) = CaptureSlot::new(&ctx, viewport, 4096);
+        let slot = Arc::new(slot);
+        let completed = image([1, 1], egui::Color32::RED);
+        let weak_image = Arc::downgrade(&completed);
+        let barrier = Arc::new(Barrier::new(3));
+
+        let taken = std::thread::scope(|scope| {
+            let completion_barrier = barrier.clone();
+            let completion_image = completed.clone();
+            scope.spawn(move || {
+                completion_barrier.wait();
+                callback.complete(completion_image);
+            });
+
+            let cancel_barrier = barrier.clone();
+            let cancel_slot = slot.clone();
+            scope.spawn(move || {
+                cancel_barrier.wait();
+                cancel_slot.cancel();
+            });
+
+            barrier.wait();
+            slot.take()
+        });
+
+        let wake_count = requests.lock().unwrap().len();
+        assert!(wake_count <= 1, "trial {trial}: one completion wakes at most once, got {wake_count}");
+        if taken.is_some() {
+            assert_eq!(wake_count, 1, "trial {trial}: a published result wakes exactly once");
+        }
+        if let Some(result) = &taken {
+            match result {
+                Ok(taken_image) => assert!(Arc::ptr_eq(taken_image, &completed), "trial {trial}: only the completed image is returned"),
+                Err(error) => panic!("trial {trial}: a valid image was rejected: {error:?}"),
+            }
+        }
+
+        drop(taken);
+        drop(slot);
+        drop(completed);
+        assert!(weak_image.upgrade().is_none(), "trial {trial}: the slot and any taken result release the image");
+    }
+}
+
+#[test]
+/// A zero byte budget rejects any nonempty image as too large and wakes once.
+fn zero_budget_rejects_a_nonempty_image_and_wakes() {
+    let ctx = Context::default();
+    let requests = observe_repaints(&ctx);
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 0);
+    callback.complete(image([1, 1], egui::Color32::GREEN));
+    assert!(matches!(slot.take(), Some(Err(CaptureError::ImageTooLarge { bytes: 4, max_bytes: 0 }))));
+    assert_eq!(*requests.lock().unwrap(), [ViewportId::ROOT]);
+}
+
+#[test]
+/// Two threads racing on `take` produce exactly one result, and a subsequent take is empty.
+fn concurrent_takers_receive_the_result_exactly_once() {
+    let ctx = Context::default();
+    let (slot, callback) = CaptureSlot::new(&ctx, ViewportId::ROOT, 4);
+    let expected = image([1, 1], egui::Color32::GREEN);
+    callback.complete(expected.clone());
+    let barrier = Barrier::new(3);
+    let results = std::thread::scope(|scope| {
+        let first = scope.spawn(|| {
+            barrier.wait();
+            slot.take()
+        });
+        let second = scope.spawn(|| {
+            barrier.wait();
+            slot.take()
+        });
+        barrier.wait();
+        [first.join().unwrap(), second.join().unwrap()]
+    });
+    assert_eq!(results.iter().filter(|result| result.is_some()).count(), 1);
+    for result in results.into_iter().flatten() {
+        assert!(Arc::ptr_eq(&result.unwrap(), &expected));
+    }
+    assert!(slot.take().is_none());
+}
+
+#[test]
+/// A renderer thread can complete a capture while a UI closure is blocked; the image is delivered
+/// and the owning child viewport is woken exactly once.
+fn renderer_completion_during_a_live_ui_pass_can_wake_and_deliver() {
+    let ctx = Context::default();
+    let requests = observe_repaints(&ctx);
+    let viewport = ViewportId::from_hash_of("render-readback");
+    let (slot, callback) = CaptureSlot::new(&ctx, viewport, 4);
+    let expected = image([1, 1], egui::Color32::GREEN);
+    let sent = expected.clone();
+    let (start_tx, start_rx) = std::sync::mpsc::channel();
+    let (done_tx, done_rx) = std::sync::mpsc::channel();
+    std::thread::scope(|scope| {
+        scope.spawn(move || {
+            start_rx.recv().unwrap();
+            callback.complete(sent);
+            done_tx.send(()).unwrap();
+        });
+        let mut start_tx = Some(start_tx);
+        let mut output = ctx.run_ui(Default::default(), |ui| {
+            ui.label("A live frame while readback completes");
+            if let Some(tx) = start_tx.take() {
+                tx.send(()).unwrap();
+                done_rx.recv_timeout(std::time::Duration::from_secs(3)).expect("readback must complete while the UI closure is active");
+            }
+        });
+        // This synchronization test has no renderer to apply the atlas upload.
+        output.textures_delta.clear();
+    });
+    assert!(Arc::ptr_eq(&slot.take().unwrap().unwrap(), &expected));
+    assert_eq!(requests.lock().unwrap().iter().filter(|id| **id == viewport).count(), 1);
+}
diff --git a/crates/ui/src/direction/mod.rs b/crates/ui/src/direction/mod.rs
new file mode 100644
index 00000000..37079b83
--- /dev/null
+++ b/crates/ui/src/direction/mod.rs
@@ -0,0 +1,429 @@
+//! Interface direction for right-to-left languages (Arabic, Hebrew, Persian, Urdu, …).
+//!
+//! In a right-to-left interface the chrome mirrors, as in right-to-left macOS and Windows apps:
+//! the panel that sits at the left moves to the right, rows and menu bars start at the right,
+//! menus open under their button's right edge, and back arrows point right. Content keeps its
+//! geometry: [`Unmirrored`] is the suite-wide list of what never mirrors.
+//!
+//! egui has no direction for a whole context. A `Ui` runs left to right unless its layout says
+//! otherwise, and panels, popups and hand-painted positions name a side. Call sites name the
+//! reading start or end through these helpers instead of left or right. Rows nested in a [`row`]
+//! follow it on their own: egui starts a `ui.horizontal*` row from the right when its parent
+//! layout runs right to left.
+//!
+//! # Setting the direction
+//!
+//! [`resolve`] picks the direction for the UI language: the `CRAFT_UI_DIRECTION` environment
+//! variable first (`rtl` or `ltr`, for checking a mirrored layout before a right-to-left catalog
+//! exists), then the app's [`Setting`], then the language's script ([`craft_i18n::direction`]).
+//! [`apply`] stores it on the context; call it at startup and whenever the language changes.
+//! Every helper reads it from a [`HasDirection`]: a `Context`, a `Ui`, or a [`Direction`] itself.
+//! Tests force a direction by calling [`apply`] on their own context.
+//!
+//! # egui's own chrome
+//!
+//! The suite's egui fork adds `Style::right_to_left`, which mirrors submenus, scroll bars,
+//! collapsing-header triangles and window title bars. When the app patches that fork in, [`apply`]
+//! sets it on every theme's style; with crates.io egui, egui's own chrome stays left to right.
+//! Installing a whole new [`egui::Style`] resets the field, so call [`apply`] after changing theme.
+
+use egui::{Align, Align2, AsIdSalt, Context, Id, InnerResponse, Key, Layout, Panel, Rect, RectAlign, Ui, pos2, vec2};
+
+pub use craft_i18n::Direction;
+
+/// The environment variable that forces a direction whatever the language and setting.
+pub const ENV_VAR: &str = "CRAFT_UI_DIRECTION";
+
+/// Where the interface direction comes from: an app setting, usually hidden in a debug section.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize), serde(rename_all = "lowercase"))]
+pub enum Setting {
+    /// Follow the UI language.
+    #[default]
+    Language,
+    /// Left to right whatever the language.
+    Ltr,
+    /// Right to left whatever the language.
+    Rtl,
+}
+
+impl Setting {
+    /// The direction this setting gives for a UI language tag.
+    pub fn direction(self, ui_language: &str) -> Direction {
+        match self {
+            Setting::Language => craft_i18n::direction(ui_language),
+            Setting::Ltr => Direction::Ltr,
+            Setting::Rtl => Direction::Rtl,
+        }
+    }
+
+    /// `language`, `ltr` or `rtl`, any case, as [`ENV_VAR`] and settings files spell them.
+    pub fn parse(value: &str) -> Option<Setting> {
+        match value.trim().to_ascii_lowercase().as_str() {
+            "language" => Some(Setting::Language),
+            "ltr" => Some(Setting::Ltr),
+            "rtl" => Some(Setting::Rtl),
+            _ => None,
+        }
+    }
+}
+
+/// The interface direction for a UI language tag: [`ENV_VAR`] when set to `rtl` or `ltr`, then
+/// `setting`, then the language's script.
+pub fn resolve(ui_language: &str, setting: Setting) -> Direction {
+    env_setting().filter(|s| *s != Setting::Language).unwrap_or(setting).direction(ui_language)
+}
+
+fn env_setting() -> Option<Setting> {
+    static ENV: std::sync::OnceLock<Option<Setting>> = std::sync::OnceLock::new();
+    *ENV.get_or_init(|| Setting::parse(&std::env::var(ENV_VAR).ok()?))
+}
+
+fn key() -> Id {
+    Id::unique("craft_ui::direction")
+}
+
+/// Draw the interface on `ctx` in `dir` from the next layout on.
+pub fn apply(ctx: &Context, dir: Direction) {
+    ctx.data_mut(|d| d.insert_temp(key(), dir));
+    ctx.all_styles_mut(|style| style.set_right_to_left(dir == Direction::Rtl));
+}
+
+/// The suite's egui fork has an inherent `Style::set_right_to_left`; crates.io egui has neither
+/// the method nor the field. A method call picks an inherent method over a trait method of the
+/// same name, so [`apply`] reaches egui's method on the fork and this no-op everywhere else. The
+/// same source thus builds against both without a feature.
+#[allow(dead_code, reason = "unused when egui has the inherent method")]
+trait SetRightToLeft {
+    fn set_right_to_left(&mut self, _right_to_left: bool) {}
+}
+
+impl SetRightToLeft for egui::Style {}
+
+/// Anything the interface direction can be read from.
+pub trait HasDirection {
+    fn direction(&self) -> Direction;
+}
+
+impl HasDirection for Direction {
+    fn direction(&self) -> Direction {
+        *self
+    }
+}
+
+impl HasDirection for Context {
+    /// The direction last [`apply`]-ed to this context; left to right before that.
+    fn direction(&self) -> Direction {
+        self.data(|d| d.get_temp(key())).unwrap_or(Direction::Ltr)
+    }
+}
+
+impl HasDirection for Ui {
+    fn direction(&self) -> Direction {
+        self.ctx().direction()
+    }
+}
+
+/// Is the interface drawn right to left?
+pub fn is_rtl(d: &impl HasDirection) -> bool {
+    d.direction() == Direction::Rtl
+}
+
+// Panels and layouts.
+
+/// A side panel at the reading start: left, or right in a right-to-left interface.
+pub fn start_panel(d: &impl HasDirection, id_salt: impl AsIdSalt) -> Panel {
+    if is_rtl(d) { Panel::right(id_salt) } else { Panel::left(id_salt) }
+}
+
+/// A side panel at the reading end: right, or left in a right-to-left interface.
+pub fn end_panel(d: &impl HasDirection, id_salt: impl AsIdSalt) -> Panel {
+    if is_rtl(d) { Panel::left(id_salt) } else { Panel::right(id_salt) }
+}
+
+/// A vertically centred row in reading order.
+pub fn row(d: &impl HasDirection) -> Layout {
+    if is_rtl(d) { Layout::right_to_left(Align::Center) } else { Layout::left_to_right(Align::Center) }
+}
+
+/// A vertically centred row that starts from the reading end, for groups pinned to the far end
+/// of a bar: a dialog's buttons, a title bar's controls, a status bar's zoom field.
+pub fn trailing(d: &impl HasDirection) -> Layout {
+    if is_rtl(d) { Layout::left_to_right(Align::Center) } else { Layout::right_to_left(Align::Center) }
+}
+
+/// A top-down column with its items against the reading start.
+pub fn column(d: &impl HasDirection) -> Layout {
+    Layout::top_down(start_align(d))
+}
+
+/// [`Ui::horizontal`] in reading order. Use it where the parent runs top down (a panel, a
+/// column); inside a [`row`], `ui.horizontal` already follows the parent.
+pub fn horizontal<R>(ui: &mut Ui, add: impl FnOnce(&mut Ui) -> R) -> InnerResponse<R> {
+    let size = vec2(ui.available_size_before_wrap().x, ui.spacing().interact_size.y);
+    let layout = row(ui);
+    ui.allocate_ui_with_layout(size, layout, add)
+}
+
+/// A left-to-right row whatever the interface direction, for content on the [`Unmirrored`] list
+/// placed inside a mirrored row: a transport bar, a slider with its value, a timecode.
+pub fn unmirrored_row<R>(ui: &mut Ui, _what: Unmirrored, add: impl FnOnce(&mut Ui) -> R) -> InnerResponse<R> {
+    let size = vec2(ui.available_size_before_wrap().x, ui.spacing().interact_size.y);
+    ui.allocate_ui_with_layout(size, Layout::left_to_right(Align::Center), add)
+}
+
+// Hand-painted positions.
+
+/// The horizontal alignment of the reading start: [`Align::Min`], or [`Align::Max`] right to left.
+pub fn start_align(d: &impl HasDirection) -> Align {
+    if is_rtl(d) { Align::Max } else { Align::Min }
+}
+
+/// The x of `rect`'s reading-start edge.
+pub fn start_x(d: &impl HasDirection, rect: Rect) -> f32 {
+    if is_rtl(d) { rect.right() } else { rect.left() }
+}
+
+/// The x of `rect`'s reading-end edge.
+pub fn end_x(d: &impl HasDirection, rect: Rect) -> f32 {
+    if is_rtl(d) { rect.left() } else { rect.right() }
+}
+
+/// `1.0`, or `-1.0` right to left: multiply an x offset written for left to right by it, as in
+/// `start_x(ui, rect) + forward(ui) * padding`.
+pub fn forward(d: &impl HasDirection) -> f32 {
+    if is_rtl(d) { -1.0 } else { 1.0 }
+}
+
+/// An anchor written for left to right, mirrored in a right-to-left interface.
+pub fn align2(d: &impl HasDirection, ltr: Align2) -> Align2 {
+    if is_rtl(d) { ltr.flipped_x() } else { ltr }
+}
+
+// Popups.
+
+/// A popup alignment written for left to right, mirrored in a right-to-left interface.
+pub fn popup(d: &impl HasDirection, ltr: RectAlign) -> RectAlign {
+    if is_rtl(d) { ltr.flipped_x() } else { ltr }
+}
+
+/// A menu below its button, under the button's reading-start edge.
+pub fn below(d: &impl HasDirection) -> RectAlign {
+    popup(d, RectAlign::BOTTOM_START)
+}
+
+/// A menu above its button, over the button's reading-start edge.
+pub fn above(d: &impl HasDirection) -> RectAlign {
+    popup(d, RectAlign::TOP_START)
+}
+
+/// A flyout beside its item, towards the reading end, top edges level: a tool's flyout, a
+/// hand-made submenu.
+pub fn beside(d: &impl HasDirection) -> RectAlign {
+    popup(d, RectAlign::RIGHT_START)
+}
+
+// Arrow keys.
+
+/// A move along a row or list in reading order.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Step {
+    Previous,
+    Next,
+}
+
+/// What the left and right arrow keys mean in a mirrored row (tabs, a toolbar, a segmented
+/// control, a breadcrumb): `ArrowRight` moves to the previous item right to left. `None` for any
+/// other key. Over [`Unmirrored`] content (nudging on a canvas, stepping a timeline or a slider)
+/// read the keys as they are.
+pub fn step(d: &impl HasDirection, key: Key) -> Option<Step> {
+    let (previous, next) = if is_rtl(d) { (Key::ArrowRight, Key::ArrowLeft) } else { (Key::ArrowLeft, Key::ArrowRight) };
+    if key == previous {
+        Some(Step::Previous)
+    } else if key == next {
+        Some(Step::Next)
+    } else {
+        None
+    }
+}
+
+/// The arrow key that makes `step`, as a shortcut label shows it.
+pub fn step_key(d: &impl HasDirection, step: Step) -> Key {
+    match (step, is_rtl(d)) {
+        (Step::Previous, false) | (Step::Next, true) => Key::ArrowLeft,
+        (Step::Next, false) | (Step::Previous, true) => Key::ArrowRight,
+    }
+}
+
+/// The step pressed this frame on the arrow keys, if any; the keys stay in the input.
+pub fn pressed_step(ctx: &Context) -> Option<Step> {
+    ctx.input(|i| [Key::ArrowLeft, Key::ArrowRight].into_iter().find(|k| i.key_pressed(*k))).and_then(|k| step(ctx, k))
+}
+
+// Icons.
+
+/// Icon pairs that are each other's mirror image: right to left, each name draws as the other.
+/// Names follow Lucide, which the suite's icon sets use; an app with other names maps them first.
+///
+/// They point along the reading direction: back and forward, previous and next, collapse and
+/// expand a side panel, a reply and a forward.
+pub const SWAPPED_ICONS: &[(&str, &str)] = &[
+    ("arrow-left", "arrow-right"),
+    ("arrow-big-left", "arrow-big-right"),
+    ("arrow-left-to-line", "arrow-right-to-line"),
+    ("arrow-left-from-line", "arrow-right-from-line"),
+    ("chevron-left", "chevron-right"),
+    ("chevrons-left", "chevrons-right"),
+    ("chevron-first", "chevron-last"),
+    ("circle-arrow-left", "circle-arrow-right"),
+    ("circle-chevron-left", "circle-chevron-right"),
+    ("square-chevron-left", "square-chevron-right"),
+    ("move-left", "move-right"),
+    ("panel-left", "panel-right"),
+    ("panel-left-close", "panel-right-close"),
+    ("panel-left-open", "panel-right-open"),
+    ("reply", "forward"),
+];
+
+/// Icons with no mirrored counterpart that are drawn flipped right to left: what they show starts
+/// at the reading start. Indent and outdent (nesting in an outline, a list or a layer tree),
+/// bulleted lists, signing in and out, sending.
+pub const FLIPPED_ICONS: &[&str] =
+    &["indent-increase", "indent-decrease", "indent", "outdent", "list", "list-checks", "list-tree", "log-in", "log-out", "send", "send-horizontal"];
+
+/// Icons that look directional but keep their drawing right to left. [`icon`] returns every name
+/// not in [`SWAPPED_ICONS`] or [`FLIPPED_ICONS`] unchanged; this list records the decisions.
+///
+/// - Undo and redo: history runs in time, which the suite draws left to right (timelines, media
+///   transport). The buttons still sit in reading order, since their row mirrors.
+/// - Rotate, refresh and flip: they act on the canvas, which doesn't mirror, so counterclockwise
+///   stays counterclockwise.
+/// - Media transport: see [`Unmirrored::MediaTransport`].
+/// - Paragraph alignment (`align-left`, `text-align-start`, …): document text has its own
+///   direction. Pass the paragraph's [`Direction`] to [`icon`] where an icon means its start or end.
+/// - Object alignment and distribution: they name edges of the canvas.
+/// - Numbered lists: the digits would mirror.
+pub const KEPT_ICONS: &[&str] = &[
+    "undo",
+    "redo",
+    "undo-2",
+    "redo-2",
+    "undo-dot",
+    "redo-dot",
+    "rotate-ccw",
+    "rotate-cw",
+    "refresh-ccw",
+    "refresh-cw",
+    "flip-horizontal",
+    "flip-horizontal-2",
+    "flip-vertical",
+    "flip-vertical-2",
+    "play",
+    "pause",
+    "skip-back",
+    "skip-forward",
+    "step-back",
+    "step-forward",
+    "rewind",
+    "fast-forward",
+    "align-left",
+    "align-right",
+    "text-align-start",
+    "text-align-end",
+    "align-start-vertical",
+    "align-end-vertical",
+    "align-horizontal-justify-start",
+    "align-horizontal-justify-end",
+    "align-horizontal-distribute-start",
+    "align-horizontal-distribute-end",
+    "list-ordered",
+];
+
+/// An icon to draw for the interface direction.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Icon<'a> {
+    /// The icon to look up in the app's set.
+    pub name: &'a str,
+    /// Draw it mirrored, through [`Icon::uv`].
+    pub flip: bool,
+}
+
+impl Icon<'_> {
+    /// The texture coordinates to draw the icon with, for [`egui::Image::uv`] or
+    /// [`egui::Painter::image`]: the whole texture, mirrored when [`Icon::flip`] is set.
+    pub fn uv(&self) -> Rect {
+        if self.flip { Rect::from_min_max(pos2(1.0, 0.0), pos2(0.0, 1.0)) } else { Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)) }
+    }
+}
+
+/// The icon to draw for `name`: its mirror-image counterpart or a flipped drawing right to left
+/// ([`SWAPPED_ICONS`], [`FLIPPED_ICONS`]), and `name` as it is otherwise.
+pub fn icon<'a>(d: &impl HasDirection, name: &'a str) -> Icon<'a> {
+    let plain = Icon { name, flip: false };
+    if !is_rtl(d) {
+        return plain;
+    }
+    for &(a, b) in SWAPPED_ICONS {
+        if name == a {
+            return Icon { name: b, flip: false };
+        }
+        if name == b {
+            return Icon { name: a, flip: false };
+        }
+    }
+    Icon { name, flip: FLIPPED_ICONS.contains(&name) }
+}
+
+// What never mirrors.
+
+/// The suite-wide list of what keeps its left-to-right geometry in a right-to-left interface.
+/// These show the content itself, or follow a convention that holds in right-to-left locales too.
+/// Their surroundings (the panel, the toolbar, the labels) still mirror. Lay such content out
+/// with [`unmirrored_row`] or a fixed [`Layout::left_to_right`], never with [`row`].
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Unmirrored {
+    /// Document canvases and viewports, with everything drawn over them: selections, crop and
+    /// mask overlays, guides, handles and transform gizmos. Arrow keys nudge in screen space.
+    Canvas,
+    /// Photos, previews and thumbnail contents, with marks pinned to their corners (flags,
+    /// ratings, badges, Before and After labels). A grid of thumbnails follows reading order.
+    Image,
+    /// Rulers: units count from the document's origin.
+    Ruler,
+    /// Timelines, tracks, waveforms, keyframe lanes and playheads: time runs left to right.
+    Timeline,
+    /// Tone curves, histograms, graphs and plots: their axes are mathematical.
+    Graph,
+    /// Gradients, colour ramps, hue strips, colour wheels and two-dimensional colour pickers.
+    ColourRamp,
+    /// Sliders: the value increases to the right, and the value field sits on the same side.
+    SliderValue,
+    /// Play, pause, step, skip and rewind: their order and arrows, which match the timeline.
+    MediaTransport,
+    /// Code, expressions, file paths and URLs: left-to-right text, aligned left.
+    Code,
+    /// Number fields with their units, coordinates and sizes: digits run left to right, and x
+    /// comes before y.
+    Number,
+    /// Timecodes, durations and frame counters.
+    Timecode,
+}
+
+impl Unmirrored {
+    pub const ALL: [Unmirrored; 11] = [
+        Unmirrored::Canvas,
+        Unmirrored::Image,
+        Unmirrored::Ruler,
+        Unmirrored::Timeline,
+        Unmirrored::Graph,
+        Unmirrored::ColourRamp,
+        Unmirrored::SliderValue,
+        Unmirrored::MediaTransport,
+        Unmirrored::Code,
+        Unmirrored::Number,
+        Unmirrored::Timecode,
+    ];
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui/src/direction/tests.rs b/crates/ui/src/direction/tests.rs
new file mode 100644
index 00000000..5f0887d1
--- /dev/null
+++ b/crates/ui/src/direction/tests.rs
@@ -0,0 +1,207 @@
+use super::*;
+use egui::{Pos2, RawInput, Response};
+
+const WIDTH: f32 = 600.0;
+
+fn context(dir: Direction) -> Context {
+    let ctx = Context::default();
+    apply(&ctx, dir);
+    ctx
+}
+
+fn frame(ctx: &Context, add: impl FnMut(&mut Ui)) {
+    let raw = RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(WIDTH, 400.0))), ..Default::default() };
+    ctx.run_ui(raw, add).textures_delta.clear();
+}
+
+/// Centre x of a panel shown with `panel` and of a label in the space left.
+fn panel_and_rest(dir: Direction, panel: fn(&Context, &'static str) -> Panel) -> (f32, f32) {
+    let ctx = context(dir);
+    let (mut side, mut rest) = (0.0, 0.0);
+    for _ in 0..2 {
+        frame(&ctx, |ui| {
+            side = panel(ui.ctx(), "side").show(ui, |ui| ui.label("side")).response.rect.center().x;
+            rest = ui.label("rest").rect.center().x;
+        });
+    }
+    (side, rest)
+}
+
+/// Centre x of two labels added in order with `layout`.
+fn two_in(dir: Direction, layout: fn(&Ui) -> Layout) -> (f32, f32) {
+    let ctx = context(dir);
+    let mut xs = (0.0, 0.0);
+    frame(&ctx, |ui| {
+        let layout = layout(ui);
+        ui.with_layout(layout, |ui| {
+            let first: Response = ui.label("first");
+            let second = ui.label("second");
+            xs = (first.rect.center().x, second.rect.center().x);
+        });
+    });
+    xs
+}
+
+#[test]
+fn direction_is_per_context_and_left_to_right_until_applied() {
+    let ctx = Context::default();
+    assert_eq!(ctx.direction(), Direction::Ltr);
+    apply(&ctx, Direction::Rtl);
+    assert!(is_rtl(&ctx));
+    assert_eq!(Context::default().direction(), Direction::Ltr);
+    apply(&ctx, Direction::Ltr);
+    assert!(!is_rtl(&ctx));
+}
+
+#[test]
+fn setting_overrides_the_language() {
+    assert_eq!(Setting::Language.direction("ar"), Direction::Rtl);
+    assert_eq!(Setting::Language.direction("he-IL"), Direction::Rtl);
+    assert_eq!(Setting::Language.direction("en"), Direction::Ltr);
+    assert_eq!(Setting::Rtl.direction("en"), Direction::Rtl);
+    assert_eq!(Setting::Ltr.direction("fa"), Direction::Ltr);
+    assert_eq!(Setting::parse(" RTL "), Some(Setting::Rtl));
+    assert_eq!(Setting::parse("ltr"), Some(Setting::Ltr));
+    assert_eq!(Setting::parse("language"), Some(Setting::Language));
+    assert_eq!(Setting::parse("ar"), None);
+    assert_eq!(Setting::parse(""), None);
+}
+
+#[test]
+fn start_panel_lands_at_the_right_in_rtl() {
+    let (side, rest) = panel_and_rest(Direction::Ltr, start_panel);
+    assert!(side < WIDTH / 2.0 && side < rest, "{side} {rest}");
+    let (side, rest) = panel_and_rest(Direction::Rtl, start_panel);
+    assert!(side > WIDTH / 2.0 && side > rest, "{side} {rest}");
+    let (side, _) = panel_and_rest(Direction::Rtl, end_panel);
+    assert!(side < WIDTH / 2.0, "{side}");
+}
+
+#[test]
+fn rows_run_in_reading_order() {
+    let (first, second) = two_in(Direction::Ltr, row);
+    assert!(first < second);
+    let (first, second) = two_in(Direction::Rtl, row);
+    assert!(first > second);
+    assert!(first > WIDTH / 2.0, "a right-to-left row starts at the right: {first}");
+    let (first, _) = two_in(Direction::Rtl, trailing);
+    assert!(first < WIDTH / 2.0, "a trailing group starts at the reading end: {first}");
+    let (first, _) = two_in(Direction::Ltr, trailing);
+    assert!(first > WIDTH / 2.0, "{first}");
+}
+
+#[test]
+fn nested_rows_follow_and_unmirrored_rows_do_not() {
+    let ctx = context(Direction::Rtl);
+    let (mut nested, mut fixed) = ((0.0, 0.0), (0.0, 0.0));
+    frame(&ctx, |ui| {
+        horizontal(ui, |ui| {
+            ui.horizontal(|ui| nested = (ui.label("a").rect.center().x, ui.label("b").rect.center().x));
+        });
+        horizontal(ui, |ui| {
+            unmirrored_row(ui, Unmirrored::MediaTransport, |ui| fixed = (ui.label("a").rect.center().x, ui.label("b").rect.center().x));
+        });
+    });
+    assert!(nested.0 > nested.1, "{nested:?}");
+    assert!(fixed.0 < fixed.1, "{fixed:?}");
+}
+
+#[test]
+fn positions_and_popups_mirror() {
+    let r = Rect::from_min_max(pos2(10.0, 0.0), pos2(50.0, 10.0));
+    let (ltr, rtl) = (Direction::Ltr, Direction::Rtl);
+    assert_eq!((start_x(&ltr, r), end_x(&ltr, r), forward(&ltr)), (10.0, 50.0, 1.0));
+    assert_eq!((start_x(&rtl, r), end_x(&rtl, r), forward(&rtl)), (50.0, 10.0, -1.0));
+    assert_eq!(start_align(&rtl), Align::Max);
+    assert_eq!(column(&rtl).horizontal_align(), Align::Max);
+    assert_eq!(align2(&rtl, Align2::LEFT_TOP), Align2::RIGHT_TOP);
+    assert_eq!(below(&ltr), RectAlign::BOTTOM_START);
+    assert_eq!(below(&rtl), RectAlign::BOTTOM_END);
+    assert_eq!(above(&rtl), RectAlign::TOP_END);
+    assert_eq!(beside(&ltr), RectAlign::RIGHT_START);
+    assert_eq!(beside(&rtl), RectAlign::LEFT_START);
+}
+
+#[test]
+fn arrow_keys_follow_the_visual_direction() {
+    let (ltr, rtl) = (Direction::Ltr, Direction::Rtl);
+    assert_eq!(step(&ltr, Key::ArrowLeft), Some(Step::Previous));
+    assert_eq!(step(&ltr, Key::ArrowRight), Some(Step::Next));
+    assert_eq!(step(&rtl, Key::ArrowLeft), Some(Step::Next));
+    assert_eq!(step(&rtl, Key::ArrowRight), Some(Step::Previous));
+    assert_eq!(step(&rtl, Key::ArrowUp), None);
+    for d in [ltr, rtl] {
+        for s in [Step::Previous, Step::Next] {
+            assert_eq!(step(&d, step_key(&d, s)), Some(s));
+        }
+    }
+
+    let ctx = context(Direction::Rtl);
+    let mut pressed = None;
+    let press = egui::Event::Key { key: Key::ArrowRight, physical_key: None, pressed: true, repeat: false, modifiers: Default::default() };
+    let raw = RawInput { events: vec![press], ..Default::default() };
+    ctx.run_ui(raw, |ui| pressed = pressed_step(ui.ctx())).textures_delta.clear();
+    assert_eq!(pressed, Some(Step::Previous));
+}
+
+#[test]
+fn directional_icons_flip_from_one_list() {
+    let (ltr, rtl) = (Direction::Ltr, Direction::Rtl);
+    assert_eq!(icon(&ltr, "chevron-left"), Icon { name: "chevron-left", flip: false });
+    assert_eq!(icon(&rtl, "chevron-left"), Icon { name: "chevron-right", flip: false });
+    assert_eq!(icon(&rtl, "panel-right-close"), Icon { name: "panel-left-close", flip: false });
+    assert_eq!(icon(&rtl, "indent-increase"), Icon { name: "indent-increase", flip: true });
+    assert_eq!(icon(&ltr, "indent-increase").uv(), Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)));
+    assert_eq!(icon(&rtl, "indent-increase").uv().left(), 1.0);
+    for name in KEPT_ICONS.iter().chain(["brush", "layers"].iter()) {
+        assert_eq!(icon(&rtl, name), Icon { name, flip: false }, "{name}");
+    }
+
+    let mut names: Vec<&str> =
+        SWAPPED_ICONS.iter().flat_map(|&(a, b)| [a, b]).chain(FLIPPED_ICONS.iter().copied()).chain(KEPT_ICONS.iter().copied()).collect();
+    let count = names.len();
+    names.sort_unstable();
+    names.dedup();
+    assert_eq!(names.len(), count, "an icon is on one list only");
+}
+
+#[test]
+fn every_unmirrored_kind_is_listed_once() {
+    for (i, kind) in Unmirrored::ALL.into_iter().enumerate() {
+        // A new kind fails to compile here until it is placed in `ALL`.
+        let position = match kind {
+            Unmirrored::Canvas => 0,
+            Unmirrored::Image => 1,
+            Unmirrored::Ruler => 2,
+            Unmirrored::Timeline => 3,
+            Unmirrored::Graph => 4,
+            Unmirrored::ColourRamp => 5,
+            Unmirrored::SliderValue => 6,
+            Unmirrored::MediaTransport => 7,
+            Unmirrored::Code => 8,
+            Unmirrored::Number => 9,
+            Unmirrored::Timecode => 10,
+        };
+        assert_eq!(position, i, "{kind:?}");
+    }
+}
+
+/// `Style::right_to_left` as egui's `Debug` output shows it: `None` on crates.io egui, which has
+/// no such field, so the test builds against both.
+fn style_rtl(ctx: &Context, theme: egui::Theme) -> Option<bool> {
+    let debug = format!("{:?}", ctx.style_of(theme));
+    debug.contains("right_to_left").then(|| debug.contains("right_to_left: true"))
+}
+
+#[test]
+fn apply_mirrors_egui_chrome_where_egui_can() {
+    let ctx = context(Direction::Rtl);
+    let patched = style_rtl(&ctx, egui::Theme::Dark).is_some();
+    for theme in [egui::Theme::Dark, egui::Theme::Light] {
+        assert_eq!(style_rtl(&ctx, theme), patched.then_some(true), "{theme:?}");
+    }
+    apply(&ctx, Direction::Ltr);
+    for theme in [egui::Theme::Dark, egui::Theme::Light] {
+        assert_eq!(style_rtl(&ctx, theme), patched.then_some(false), "{theme:?}");
+    }
+}
diff --git a/crates/ui/src/docking/chrome.rs b/crates/ui/src/docking/chrome.rs
new file mode 100644
index 00000000..9e3aa2bc
--- /dev/null
+++ b/crates/ui/src/docking/chrome.rs
@@ -0,0 +1,488 @@
+//! Floating window chrome: an opaque frame with anchored resize handles, and a title bar with an
+//! optional title, ▾ menu button and ×. [`super::DockArea`] draws its floating windows with
+//! these; other hosts (task panes) use them with their own ids and actions. Nothing here changes
+//! a layout: the caller turns the responses into its own commands.
+
+use std::sync::Arc;
+
+use egui::{
+    Color32, Context, FontId, Galley, Id, Key, LayerId, Order, Pos2, Rect, Response, Sense, Stroke, StrokeKind, Ui, Vec2, WidgetText, pos2, vec2,
+};
+
+use super::{DockStyle, PanelLimits, resize::AnchoredResize};
+
+/// Height of a floating window's title bar.
+pub const TITLE_HEIGHT: f32 = 14.0;
+
+/// Names of the resize handles, appended to the frame id: `id.with(name)`.
+pub const RESIZE_HANDLES: [&str; 8] =
+    ["resize", "resize-left", "resize-right", "resize-bottom", "resize-bottom-left", "resize-top", "resize-top-left", "resize-top-right"];
+
+/// Height of the top resize band of a resizable frame. The frame's contents start below it, so
+/// the band takes no moves or clicks from a title bar.
+pub const RESIZE_BAND: f32 = 4.0;
+
+/// Colors and font of the frame and title bar.
+#[derive(Clone, Debug)]
+pub struct ChromeStyle {
+    /// Painted under the contents, so the window stays opaque when the contents are not.
+    pub background: Color32,
+    pub stroke: Stroke,
+    pub title_background: Color32,
+    pub text: Color32,
+    pub weak_text: Color32,
+    pub accent: Color32,
+    /// Fill of a selected or hovered control, such as an icon rail's open item.
+    pub active_background: Color32,
+    pub font: FontId,
+    /// Mirror the title bar: buttons at the left, the title at the right.
+    pub right_to_left: bool,
+}
+
+impl ChromeStyle {
+    pub fn from_ui(ui: &Ui) -> Self {
+        Self::from_visuals(ui.visuals())
+    }
+
+    /// The colors [`Self::from_dock`] takes from [`DockStyle::from_visuals`], without building
+    /// the dock style's labels.
+    pub fn from_visuals(visuals: &egui::Visuals) -> Self {
+        Self {
+            background: visuals.window_fill,
+            stroke: visuals.window_stroke,
+            title_background: visuals.extreme_bg_color,
+            text: visuals.text_color(),
+            weak_text: visuals.weak_text_color(),
+            accent: visuals.selection.stroke.color,
+            active_background: visuals.widgets.active.bg_fill,
+            font: FontId::proportional(12.0),
+            right_to_left: false,
+        }
+    }
+
+    pub fn from_dock(style: &DockStyle) -> Self {
+        Self {
+            background: style.floating_background,
+            stroke: style.floating_stroke,
+            title_background: style.tab_background,
+            text: style.text,
+            weak_text: style.inactive_text,
+            accent: style.accent,
+            active_background: style.active_background,
+            font: style.font.clone(),
+            right_to_left: style.right_to_left,
+        }
+    }
+}
+
+/// Resize handle hit rects and the edges they move: every side and corner. The top handles
+/// fill the band above the contents; the others lie over the contents' edges.
+fn handles(rect: Rect) -> [(&'static str, Rect, Vec2); 8] {
+    let band_bottom = (rect.top() + RESIZE_BAND).min(rect.bottom());
+    let left_corner = (rect.left() + 12.0).min(rect.right());
+    let right_corner = (rect.right() - 12.0).max(rect.left());
+    [
+        ("resize", Rect::from_min_max((rect.max - vec2(12.0, 12.0)).max(rect.min), rect.max), vec2(1.0, 1.0)),
+        (
+            "resize-left",
+            Rect::from_min_max(pos2(rect.left(), rect.top() + 12.0), pos2((rect.left() + 4.0).min(rect.right()), rect.bottom() - 12.0)),
+            vec2(-1.0, 0.0),
+        ),
+        (
+            "resize-right",
+            Rect::from_min_max(pos2((rect.right() - 4.0).max(rect.left()), rect.top() + 12.0), pos2(rect.right(), rect.bottom() - 12.0)),
+            vec2(1.0, 0.0),
+        ),
+        (
+            "resize-bottom",
+            Rect::from_min_max(pos2(rect.left() + 12.0, (rect.bottom() - 4.0).max(rect.top())), pos2(rect.right() - 12.0, rect.bottom())),
+            vec2(0.0, 1.0),
+        ),
+        (
+            "resize-bottom-left",
+            Rect::from_min_max(pos2(rect.left(), (rect.bottom() - 12.0).max(rect.top())), pos2(left_corner, rect.bottom())),
+            vec2(-1.0, 1.0),
+        ),
+        ("resize-top", Rect::from_min_max(pos2(left_corner, rect.top()), pos2(right_corner, band_bottom)), vec2(0.0, -1.0)),
+        ("resize-top-left", Rect::from_min_max(rect.min, pos2(left_corner, band_bottom)), vec2(-1.0, -1.0)),
+        ("resize-top-right", Rect::from_min_max(pos2(right_corner, rect.top()), pos2(rect.right(), band_bottom)), vec2(1.0, -1.0)),
+    ]
+}
+
+/// An opaque in-window frame on its own `Order::Middle` layer, `id`, at `rect`.
+pub struct FloatingFrame<'a> {
+    id: Id,
+    rect: Rect,
+    bounds: Option<Rect>,
+    limits: PanelLimits,
+    resizable: bool,
+    resize_label: &'a str,
+    opacity: f32,
+}
+
+/// What a [`FloatingFrame`] did this frame.
+pub struct FrameResponse<R> {
+    pub inner: R,
+    /// Where the frame was drawn, inside its bounds.
+    pub rect: Rect,
+    pub layer: LayerId,
+    /// The rect a resize handle asks for: pointer drags anchored at the opposite edges, or
+    /// arrow keys on a focused handle (8 pt per press). Escape and focus loss end a resize.
+    pub resized: Option<Rect>,
+    /// The handle whose pointer resize started this frame.
+    pub resize_started: Option<Id>,
+    /// Every handle's response, for focus and gesture bookkeeping.
+    pub handles: Vec<Response>,
+}
+
+impl<'a> FloatingFrame<'a> {
+    pub fn new(id: Id, rect: Rect) -> Self {
+        Self { id, rect, bounds: None, limits: PanelLimits::default(), resizable: true, resize_label: "Resize window", opacity: 1.0 }
+    }
+
+    /// The frame stays inside `bounds`; the default is the viewport's content rect.
+    pub fn bounds(mut self, bounds: Rect) -> Self {
+        self.bounds = Some(bounds);
+        self
+    }
+
+    /// Size limits of a resize, top resize band included. The frame itself is drawn at the
+    /// given rect.
+    pub fn limits(mut self, limits: PanelLimits) -> Self {
+        self.limits = limits;
+        self
+    }
+
+    pub fn resizable(mut self, resizable: bool) -> Self {
+        self.resizable = resizable;
+        self
+    }
+
+    /// Accessibility label of the resize handles.
+    pub fn resize_label(mut self, label: &'a str) -> Self {
+        self.resize_label = label;
+        self
+    }
+
+    /// Opacity of everything drawn in the frame, contents included (default 1.0).
+    pub fn opacity(mut self, opacity: f32) -> Self {
+        self.opacity = opacity;
+        self
+    }
+
+    pub fn layer(id: Id) -> LayerId {
+        LayerId::new(Order::Middle, id)
+    }
+
+    /// Draw the frame, then `add_contents` with the rect for its contents (the frame's rect below
+    /// the top resize band when resizable), then the outline and handles.
+    pub fn show<R>(self, ctx: &Context, style: &ChromeStyle, add_contents: impl FnOnce(&mut Ui, Rect) -> R) -> FrameResponse<R> {
+        let bounds = self.bounds.unwrap_or_else(|| ctx.content_rect());
+        let rect = clamp(self.rect, bounds);
+        let area = egui::Area::new(self.id)
+            .fade_in(false)
+            .order(Order::Middle)
+            .fixed_pos(rect.min)
+            .default_size(rect.size())
+            .movable(false)
+            .constrain_to(bounds);
+        let shown = area.show(ctx, |ui| {
+            ui.multiply_opacity(self.opacity);
+            // Drawn at `rect` itself, also in egui's first (sizing) pass of a new area.
+            ui.set_min_size(rect.size());
+            ui.allocate_rect(rect, Sense::hover());
+            ui.painter().rect_filled(rect, 0.0, style.background);
+            let contents =
+                if self.resizable { Rect::from_min_max(pos2(rect.left(), (rect.top() + RESIZE_BAND).min(rect.bottom())), rect.max) } else { rect };
+            let inner = add_contents(ui, contents);
+            ui.painter().rect_stroke(rect, 0.0, style.stroke, StrokeKind::Outside);
+            let (resized, resize_started, handles) = if self.resizable { self.handles(ui, rect, bounds, style) } else { (None, None, Vec::new()) };
+            FrameResponse { inner, rect, layer: Self::layer(self.id), resized, resize_started, handles }
+        });
+        shown.inner
+    }
+
+    /// Draw the resize handles around `rect` and return `(resized, started, responses)`.
+    ///
+    /// `resized` is set only for an enabled, uncancelled handle whose clamped next rect differs
+    /// from the current one. `started` names the handle whose drag began, which can remain set after
+    /// Escape or focus loss cancels that drag. Keyboard arrow steps move an edge by 8 pt; pointer
+    /// drags derive the next rect from the cursor relative to the press origin. Limits clamp the
+    /// proposal. Stored pointer anchors are removed on cancellation or once the primary button is
+    /// released. Handles are accessibility buttons; the diagonal one is painted while hovered,
+    /// dragged or focused.
+    fn handles(&self, ui: &mut Ui, rect: Rect, bounds: Rect, style: &ChromeStyle) -> (Option<Rect>, Option<Id>, Vec<Response>) {
+        let mut resized = None;
+        let mut started = None;
+        let mut responses = Vec::new();
+        let limits = PanelLimits { min: self.limits.min.max(vec2(40.0, RESIZE_BAND + TITLE_HEIGHT + 20.0)).min(self.limits.max), ..self.limits };
+        let canceled = ui.input(|input| input.key_pressed(Key::Escape)) || crate::focus::lost(ui.ctx());
+        for (name, handle, direction) in handles(rect) {
+            if !super::targets::usable(handle) {
+                continue;
+            }
+            let cursor = if direction.x == 0.0 {
+                egui::CursorIcon::ResizeVertical
+            } else if direction.y == 0.0 {
+                egui::CursorIcon::ResizeHorizontal
+            } else if direction.x == direction.y {
+                egui::CursorIcon::ResizeNwSe
+            } else {
+                egui::CursorIcon::ResizeNeSw
+            };
+            let response = ui.interact(handle, self.id.with(name), Sense::drag()).on_hover_cursor(cursor);
+            response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), self.resize_label));
+            let anchor_id = response.id.with("pointer-anchor");
+            crate::layout::drag_focus(ui, &response);
+            if response.drag_started()
+                && let Some(origin) = ui.input(|i| i.pointer.press_origin())
+                && let Some(anchor) = AnchoredResize::new(rect, origin, direction)
+            {
+                ui.ctx().data_mut(|data| data.insert_temp(anchor_id, anchor));
+                started = Some(response.id);
+            }
+            let mut delta = Vec2::ZERO;
+            if response.has_focus() {
+                ui.memory_mut(|memory| {
+                    memory.set_focus_lock_filter(
+                        response.id,
+                        egui::EventFilter { horizontal_arrows: true, vertical_arrows: true, ..Default::default() },
+                    )
+                });
+                ui.input_mut(|input| {
+                    for (key, step) in [
+                        (Key::ArrowLeft, vec2(-8.0, 0.0)),
+                        (Key::ArrowRight, vec2(8.0, 0.0)),
+                        (Key::ArrowUp, vec2(0.0, -8.0)),
+                        (Key::ArrowDown, vec2(0.0, 8.0)),
+                    ] {
+                        if input.consume_key(egui::Modifiers::NONE, key) {
+                            delta += step;
+                        }
+                    }
+                });
+            }
+            let next = if response.dragged() || response.drag_stopped() {
+                ui.ctx()
+                    .data(|data| data.get_temp::<AnchoredResize>(anchor_id))
+                    .and_then(|anchor| ui.ctx().pointer_interact_pos().and_then(|pointer| anchor.rect(pointer, bounds, limits)))
+            } else if delta != Vec2::ZERO {
+                AnchoredResize::new(rect, rect.max, direction).and_then(|anchor| anchor.rect(rect.max + delta, bounds, limits))
+            } else {
+                None
+            };
+            if response.enabled()
+                && !canceled
+                && let Some(next) = next.filter(|next| *next != rect)
+            {
+                resized = Some(next);
+            }
+            if canceled || !ui.input(|input| input.pointer.primary_down()) {
+                ui.ctx().data_mut(|data| data.remove::<AnchoredResize>(anchor_id));
+            }
+            if name == "resize" && (response.hovered() || response.dragged() || response.has_focus()) {
+                ui.painter().line_segment([handle.left_bottom(), handle.right_top()], Stroke::new(2.0, style.accent));
+            }
+            responses.push(response);
+        }
+        (resized, started, responses)
+    }
+}
+
+/// A drop preview: a 2 pt accent outline inside `rect`, filled with 15% accent when `filled`.
+/// Docking draws its drag ghosts with it, and with
+/// [`crate::docking::DockStyle::side_edge_zones`] the region a drop takes; the pane host draws
+/// every destination with it.
+pub fn drop_preview(painter: &egui::Painter, rect: Rect, accent: Color32, filled: bool) {
+    let fill = if filled { accent.gamma_multiply(0.15) } else { Color32::TRANSPARENT };
+    painter.rect(rect, 0.0, fill, Stroke::new(2.0, accent), StrokeKind::Inside);
+}
+
+/// Keep `rect` inside `bounds`, shrinking it when it is larger.
+pub fn clamp(rect: Rect, bounds: Rect) -> Rect {
+    if !super::targets::usable(bounds) {
+        return rect;
+    }
+    let size = rect.size().max(vec2(1.0, 1.0)).min(bounds.size());
+    let min = rect.min.max(bounds.min).min(bounds.max - size);
+    Rect::from_min_size(min, size)
+}
+
+/// `text` on one line no wider than `width`, cut at the end with '…'. egui does not wrap a
+/// host's pre-laid-out `WidgetText::Galley` again, so that one is laid out again from its job.
+pub(super) fn truncated(ui: &Ui, text: WidgetText, width: f32, font: FontId) -> Arc<Galley> {
+    let galley = text.into_galley(ui, Some(egui::TextWrapMode::Truncate), width, font);
+    if galley.size().x <= width + 0.5 {
+        return galley;
+    }
+    let mut job = (*galley.job).clone();
+    job.wrap = egui::text::TextWrapping::truncate_at_width(width);
+    ui.painter().layout_job(job)
+}
+
+/// A title bar: an optional title, an optional ▾ menu button and an optional ×, by default 10 pt
+/// in from the right edge, mirrored when [`ChromeStyle::right_to_left`] is set. The bar senses
+/// clicks and drags; double-clicks are the caller's.
+pub struct TitleBar<'a> {
+    id: Id,
+    move_label: &'a str,
+    title: Option<WidgetText>,
+    menu: Option<&'a str>,
+    close: Option<&'a str>,
+    /// The ×'s hit area and glyph, where the caller places them.
+    close_at: Option<(Rect, Rect)>,
+    movable: bool,
+}
+
+/// The parts of a [`TitleBar`] that were shown.
+pub struct TitleResponse {
+    /// Drag to move; double-click is the caller's (docking minimizes every group).
+    pub bar: Response,
+    pub menu: Option<Response>,
+    pub close: Option<Response>,
+}
+
+impl<'a> TitleBar<'a> {
+    /// `id` is the bar's own; the buttons use `id.with("menu")` and `id.with("close")`.
+    /// `move_label` names the bar for accessibility.
+    pub fn new(id: Id, move_label: &'a str) -> Self {
+        Self { id, move_label, title: None, menu: None, close: None, close_at: None, movable: true }
+    }
+
+    /// Text at the leading edge, cut with '…' to fit.
+    pub fn title(mut self, title: impl Into<WidgetText>) -> Self {
+        self.title = Some(title.into());
+        self
+    }
+
+    /// Show a ▾ button with this accessibility label.
+    pub fn menu(mut self, label: &'a str) -> Self {
+        self.menu = Some(label);
+        self
+    }
+
+    /// Show a × button with this accessibility label.
+    pub fn close(mut self, label: &'a str) -> Self {
+        self.close = Some(label);
+        self
+    }
+
+    /// Place the × at `glyph`, taking clicks in `hit`: rects as drawn, already mirrored in a
+    /// right-to-left layout. By default the × is a square the bar's height, its center 10 pt
+    /// in from the trailing edge.
+    pub fn close_at(mut self, hit: Rect, glyph: Rect) -> Self {
+        self.close_at = Some((hit, glyph));
+        self
+    }
+
+    /// Whether the bar shows the grab cursor. It senses drags either way.
+    pub fn movable(mut self, movable: bool) -> Self {
+        self.movable = movable;
+        self
+    }
+
+    /// Draw the title bar into `rect` and return its responses.
+    ///
+    /// `close_at` rects are in logical points, already mirrored in a right-to-left layout; without it
+    /// the × is a square the bar's height centered 10 pt in from the trailing edge. Menu and close
+    /// buttons reserve space on the trailing side, the draggable bar excludes them, and a title is
+    /// truncated to the bar's remaining width. The bar senses clicks and drags, while double-click
+    /// behavior (for example minimizing or closing) is the caller's. A right-to-left style mirrors
+    /// the layout; `move_label` remains the accessible name of the drag surface. The bar's own id
+    /// is used, with `"menu"` and `"close"` child ids for the buttons.
+    pub fn show(self, ui: &mut Ui, rect: Rect, style: &ChromeStyle) -> TitleResponse {
+        let painter = ui.painter().with_clip_rect(rect.intersect(ui.clip_rect()));
+        painter.rect_filled(rect, 0.0, style.title_background);
+        let side = rect.height();
+        // Laid out left to right, then mirrored in a right-to-left layout.
+        let mirror = |r: Rect| {
+            if style.right_to_left {
+                Rect::from_x_y_ranges((rect.left() + rect.right() - r.right())..=(rect.left() + rect.right() - r.left()), r.y_range())
+            } else {
+                r
+            }
+        };
+        let close_rect = self.close.map(|_| match self.close_at {
+            Some((hit, _)) => mirror(hit),
+            None => Rect::from_center_size(pos2(rect.right() - 10.0, rect.center().y), vec2(side, side)),
+        });
+        let menu_right = close_rect.map_or(rect.right() - 3.0, |close| close.left() - 2.0);
+        let menu_rect = self.menu.map(|_| Rect::from_min_max(pos2(menu_right - side, rect.top()), pos2(menu_right, rect.bottom())));
+        let buttons = menu_rect.or(close_rect).map_or(rect.right(), |r| r.left());
+        let bar_rect = mirror(Rect::from_min_max(rect.min, pos2(buttons.max(rect.left()), rect.bottom())));
+        let (close_rect, menu_rect) = (close_rect.map(mirror), menu_rect.map(mirror));
+        let bar = ui.interact(bar_rect, self.id, Sense::click_and_drag());
+        let bar = if self.movable { bar.on_hover_cursor(egui::CursorIcon::Grab) } else { bar };
+        bar.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), self.move_label));
+        if let Some(title) = self.title {
+            let galley = truncated(ui, title, (bar_rect.width() - 12.0).max(0.0), style.font.clone());
+            let x = if style.right_to_left { bar_rect.right() - 6.0 - galley.size().x } else { bar_rect.left() + 6.0 };
+            painter.galley(pos2(x, rect.center().y - galley.size().y * 0.5), galley, style.text);
+        }
+        if bar.has_focus() {
+            painter.rect_stroke(bar_rect.shrink(1.0), 0.0, Stroke::new(1.0, style.accent), StrokeKind::Inside);
+        }
+        let button = |ui: &mut Ui, rect: Rect, name: &str, label: &str| {
+            let response = ui.interact(rect, self.id.with(name), Sense::click());
+            response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), label));
+            let color = if response.hovered() || response.has_focus() { style.text } else { style.weak_text };
+            (response, Stroke::new(1.2, color))
+        };
+        let menu = menu_rect.zip(self.menu).map(|(menu_rect, label)| {
+            let (response, stroke) = button(ui, menu_rect, "menu", label);
+            let c = menu_rect.center();
+            painter.add(egui::Shape::convex_polygon(vec![c + vec2(-3.5, -1.5), c + vec2(3.5, -1.5), c + vec2(0.0, 2.5)], stroke.color, Stroke::NONE));
+            response
+        });
+        let close = close_rect.zip(self.close).map(|(close_rect, label)| {
+            let (response, stroke) = button(ui, close_rect, "close", label);
+            let r = self.close_at.map_or_else(|| Rect::from_center_size(close_rect.center(), Vec2::splat((side * 0.5).max(4.0))), |(_, glyph)| glyph);
+            painter.line_segment([r.left_top(), r.right_bottom()], stroke);
+            painter.line_segment([r.right_top(), r.left_bottom()], stroke);
+            response
+        });
+        TitleResponse { bar, menu, close }
+    }
+}
+
+/// One step of a title-bar move, from [`live_move`].
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum MoveStep {
+    /// The rect follows the pointer, inside the bounds.
+    Moving(Rect),
+    /// Escape or window focus loss ended the move: the rect it started from.
+    Canceled(Rect),
+    /// Released over `pointer`, with the rect where it was dropped.
+    Dropped { rect: Rect, pointer: Pos2 },
+}
+
+/// Move `rect` with a drag on `bar` (usually [`TitleResponse::bar`]). The rect and the press
+/// position at drag start are kept in egui memory under the bar's id, so the window follows the
+/// pointer without drift. Escape or window focus loss ends the move and returns the start rect;
+/// the rest of that drag is ignored. `None` when the bar is not being moved.
+pub fn live_move(ctx: &Context, bar: &Response, rect: Rect, bounds: Rect) -> Option<MoveStep> {
+    let key = bar.id.with("live-move");
+    if bar.drag_started()
+        && let Some(origin) = ctx.input(|input| input.pointer.press_origin())
+    {
+        ctx.data_mut(|data| data.insert_temp(key, (rect, origin)));
+    }
+    let (start, origin) = ctx.data(|data| data.get_temp::<(Rect, Pos2)>(key))?;
+    let forget = || ctx.data_mut(|data| data.remove::<(Rect, Pos2)>(key));
+    if ctx.input(|input| input.key_pressed(Key::Escape)) || crate::focus::lost(ctx) {
+        forget();
+        return Some(MoveStep::Canceled(start));
+    }
+    let pointer = ctx.pointer_latest_pos().unwrap_or(origin);
+    let moved = clamp(start.translate(pointer - origin), bounds);
+    if bar.drag_stopped() {
+        forget();
+        return Some(MoveStep::Dropped { rect: moved, pointer });
+    }
+    if bar.dragged() {
+        return Some(MoveStep::Moving(moved));
+    }
+    // The drag ended without a release on this bar (the bar was not shown).
+    forget();
+    None
+}
diff --git a/crates/ui/src/docking/command.rs b/crates/ui/src/docking/command.rs
new file mode 100644
index 00000000..7db19eb4
--- /dev/null
+++ b/crates/ui/src/docking/command.rs
@@ -0,0 +1,608 @@
+//! The shared docking command vocabulary (feature `serde`).
+//!
+//! Applications deserialize a control command's JSON params, with its id under `"command"`,
+//! into [`DockCommand`] and apply it. craft-ui does not depend on `serde_json`.
+//!
+//! ```ignore
+//! let mut params = params.clone();
+//! params["command"] = json!(id);
+//! let command: DockCommand<PanelId> = serde_json::from_value(params)?;
+//! let space = float_space(ctx, DOCK_ID).unwrap_or_else(|| FloatSpace::new(ctx.content_rect()));
+//! command.apply(&mut app.workspace, style.right_to_left, &space, |p| app.permissions(p))?;
+//! ```
+
+use std::hash::Hash;
+
+use serde::{Deserialize, Deserializer, Serialize};
+
+use super::{
+    Action, DockError, FloatSpace, Layout, Permissions, Placement, Side, Target, Workspace, Zone, dock_model::Place, surface::DEFAULT_FLOAT,
+};
+use crate::layout::SplitSize;
+
+/// A docking command, tagged by its control id under `"command"`.
+///
+/// Ids and params (`?` marks optional ones):
+///
+/// | Id | Params |
+/// |---|---|
+/// | `window.panel.layout` | `{action}`: a serialized [`Action`] |
+/// | `window.panel.move` | `{panel, anchor, zone?, before?, group?, placement?}` |
+/// | `window.panel.float` | `{panel, x?, y?, width?, height?, group?, column?}` |
+/// | `window.panel.dock` | `{panel, anchor?, zone?, before?, group?, column?, side?}` |
+/// | `window.panel.activate`, `.close`, `.closeGroup`, `.closeOthers` | `{panel}` |
+/// | `window.panel.minimize` | `{panel, minimized?}`; without `minimized` it toggles |
+/// | `window.panel.iconic` | `{panel, iconic?}`; without `iconic` it toggles |
+/// | `window.panel.window` | `{panel, native?}` (desktop) |
+/// | `window.workspace`, `.new`, `.delete` | `{name}` |
+/// | `window.workspace.reset`, `ui.dock.reset` | `{}` |
+/// | `window.workspace.lock` | `{locked?}`; without `locked` it toggles |
+/// | `ui.dock` | `{action}`, or `{operation, …}`, see [`DockOperation`] |
+///
+/// `zone` is `tab` (the default for `move` and `dock`), `center`, `left`, `right`, `top`,
+/// `bottom`, `above` or `below` (a new group in a dock column, or a split in a floating window). The side
+/// zones map onto the anchor's container with [`Placement::for_zone`]. `before`
+/// names the tab to insert before; `null` appends. `group` moves the panel's whole group,
+/// `column` its dock column. `side` is `Start` or `End`.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "command", bound(serialize = "P: Serialize", deserialize = "P: Deserialize<'de>"))]
+#[non_exhaustive]
+pub enum DockCommand<P> {
+    #[serde(rename = "window.panel.layout")]
+    Layout { action: Action<P> },
+    #[serde(rename = "window.panel.move")]
+    Move {
+        panel: P,
+        anchor: P,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        zone: Option<ZoneName>,
+        #[serde(default, deserialize_with = "present", skip_serializing_if = "Option::is_none")]
+        before: Option<Option<P>>,
+        #[serde(default)]
+        group: bool,
+        /// A serialized [`Placement`]; it takes precedence over `zone` and `before`.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        placement: Option<Placement<P>>,
+    },
+    #[serde(rename = "window.panel.float")]
+    Float {
+        panel: P,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        x: Option<f32>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        y: Option<f32>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        width: Option<f32>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        height: Option<f32>,
+        #[serde(default)]
+        group: bool,
+        #[serde(default)]
+        column: bool,
+    },
+    /// To `anchor`; else to a new column of the dock on `side` (a new dock when it has none);
+    /// else with a `left`, `right`, `top` or `bottom` zone to a new frame on that outer edge
+    /// ([`Placement::Edge`]); else a floating panel joins the first dock group (or frame) as a
+    /// tab, and a docked one stays. A hidden panel without `anchor` and `side` is shown at its
+    /// last location, then moved to the edge a zone names.
+    #[serde(rename = "window.panel.dock")]
+    Dock {
+        panel: P,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        anchor: Option<P>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        zone: Option<ZoneName>,
+        #[serde(default, deserialize_with = "present", skip_serializing_if = "Option::is_none")]
+        before: Option<Option<P>>,
+        #[serde(default)]
+        group: bool,
+        #[serde(default)]
+        column: bool,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        side: Option<Side>,
+    },
+    /// Select a panel; a hidden one is shown at its last location first.
+    #[serde(rename = "window.panel.activate")]
+    Activate { panel: P },
+    #[serde(rename = "window.panel.close")]
+    Close { panel: P },
+    #[serde(rename = "window.panel.closeGroup")]
+    CloseGroup { panel: P },
+    #[serde(rename = "window.panel.closeOthers")]
+    CloseOthers { panel: P },
+    #[serde(rename = "window.panel.minimize")]
+    Minimize {
+        panel: P,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        minimized: Option<bool>,
+    },
+    #[serde(rename = "window.panel.iconic")]
+    Iconic {
+        panel: P,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        iconic: Option<bool>,
+    },
+    /// Move the panel's floating window to its own OS window (`native`, the default) or back.
+    /// A docked panel's group floats first.
+    #[serde(rename = "window.panel.window")]
+    Window {
+        panel: P,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        native: Option<bool>,
+    },
+    /// Switch to a named workspace. The application owns named workspaces.
+    #[serde(rename = "window.workspace")]
+    Workspace { name: String },
+    #[serde(rename = "window.workspace.new")]
+    NewWorkspace { name: String },
+    #[serde(rename = "window.workspace.delete")]
+    DeleteWorkspace { name: String },
+    /// Reset the current workspace to its saved or built-in arrangement (application-owned).
+    #[serde(rename = "window.workspace.reset", alias = "ui.dock.reset")]
+    ResetWorkspace {},
+    #[serde(rename = "window.workspace.lock")]
+    Lock {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        locked: Option<bool>,
+    },
+    /// The `ui.dock` shape of LightCraft, PDFCraft, CADCraft and SoundCraft.
+    #[serde(rename = "ui.dock")]
+    UiDock(UiDock<P>),
+}
+
+/// `ui.dock` params: a raw action, or an operation.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(untagged, bound(serialize = "P: Serialize", deserialize = "P: Deserialize<'de>"))]
+pub enum UiDock<P> {
+    Action { action: Action<P> },
+    Operation(DockOperation<P>),
+}
+
+/// A `ui.dock` operation, tagged by `operation`. `move` takes `target` (the anchor), `zone`
+/// (default `center`) and `before`, which only applies to a center move.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "operation", rename_all = "camelCase", bound(serialize = "P: Serialize", deserialize = "P: Deserialize<'de>"))]
+#[non_exhaustive]
+pub enum DockOperation<P> {
+    /// Show a panel at its last location and select it.
+    Open {
+        panel: P,
+    },
+    Close {
+        panel: P,
+    },
+    Activate {
+        panel: P,
+    },
+    Float {
+        panel: P,
+        rect: [f32; 4],
+    },
+    MoveFloating {
+        panel: P,
+        rect: [f32; 4],
+    },
+    Move {
+        panel: P,
+        target: P,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        zone: Option<ZoneName>,
+        #[serde(default, deserialize_with = "present", skip_serializing_if = "Option::is_none")]
+        before: Option<Option<P>>,
+    },
+    SetStackOpen {
+        panel: P,
+        open: bool,
+    },
+    /// `height` is required; `null` clears it.
+    ResizeStack {
+        panel: P,
+        #[serde(deserialize_with = "required")]
+        height: Option<f32>,
+    },
+    ResizeSplit {
+        path: Vec<bool>,
+        size: SplitSize,
+    },
+}
+
+/// A drop zone by name, as control protocols write it. PascalCase [`Zone`] names also parse.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ZoneName {
+    Tab,
+    #[serde(alias = "Center")]
+    Center,
+    #[serde(alias = "Left")]
+    Left,
+    #[serde(alias = "Right")]
+    Right,
+    #[serde(alias = "Top")]
+    Top,
+    #[serde(alias = "Bottom")]
+    Bottom,
+    Above,
+    Below,
+}
+
+/// A present field, `null` included: `Some(None)` for `null`, `None` when absent.
+fn present<'de, D: Deserializer<'de>, T: Deserialize<'de>>(deserializer: D) -> Result<Option<T>, D::Error> {
+    T::deserialize(deserializer).map(Some)
+}
+
+/// A required field that may be `null`.
+fn required<'de, D: Deserializer<'de>, T: Deserialize<'de>>(deserializer: D) -> Result<T, D::Error> {
+    T::deserialize(deserializer)
+}
+
+/// Where a command puts what it moves relative to `anchor`: `zone` and `before`, with side
+/// zones mapped by [`Placement::for_zone`]. `default` is the zone when none is given.
+struct Zoned<'a, P> {
+    layout: &'a Layout<P>,
+    right_to_left: bool,
+}
+
+impl<P: Clone + Eq + Hash> Zoned<'_, P> {
+    fn placement(&self, anchor: &P, zone: Option<ZoneName>, before: &Option<Option<P>>, default: ZoneName) -> Result<Placement<P>, DockError> {
+        let side = |zone| Placement::for_zone(self.layout, anchor, zone, self.right_to_left);
+        Ok(match (zone.unwrap_or(default), before.clone()) {
+            (ZoneName::Tab | ZoneName::Center, Some(before)) => Placement::Tab { before },
+            (ZoneName::Tab, None) => Placement::Tab { before: None },
+            (ZoneName::Center, None) => Placement::Split(Zone::Center),
+            (_, Some(_)) => return Err(DockError::InvalidPlacement),
+            (ZoneName::Left, None) => side(Zone::Left)?,
+            (ZoneName::Right, None) => side(Zone::Right)?,
+            (ZoneName::Top, None) => side(Zone::Top)?,
+            (ZoneName::Bottom, None) => side(Zone::Bottom)?,
+            (ZoneName::Above, None) => Placement::Group { below: false, height: None },
+            (ZoneName::Below, None) => Placement::Group { below: true, height: None },
+        })
+    }
+}
+
+/// How much of the layout a command moves.
+#[derive(Clone, Copy)]
+enum Unit {
+    Panel,
+    Group,
+    Column,
+}
+
+impl Unit {
+    fn of(group: bool, column: bool) -> Self {
+        if column {
+            Self::Column
+        } else if group {
+            Self::Group
+        } else {
+            Self::Panel
+        }
+    }
+
+    /// The action that moves this unit of `panel` to `to`. A floating panel's column is its
+    /// whole window.
+    fn to<P: Clone + Eq + Hash>(self, layout: &Layout<P>, panel: &P, to: Target<P>) -> Result<Action<P>, DockError> {
+        let floating = matches!(layout.place(panel), Some(Place::Floating { .. }));
+        let panel = panel.clone();
+        Ok(match (self, to) {
+            (Self::Panel, Target::At { anchor, placement }) => Action::Move { panel, anchor, placement },
+            (Self::Panel, to) => Action::MovePanel { panel, to },
+            (Self::Group, to) => Action::MoveGroup { panel, to },
+            (Self::Column, to) if floating => Action::MoveWindow { panel, to },
+            (Self::Column, to) => Action::MoveColumn { panel, to },
+        })
+    }
+}
+
+impl<P> DockCommand<P> {
+    /// Every command id, for an application's command registry.
+    pub const IDS: &'static [&'static str] = &[
+        "window.panel.layout",
+        "window.panel.move",
+        "window.panel.float",
+        "window.panel.dock",
+        "window.panel.activate",
+        "window.panel.close",
+        "window.panel.closeGroup",
+        "window.panel.closeOthers",
+        "window.panel.minimize",
+        "window.panel.iconic",
+        "window.panel.window",
+        "window.workspace",
+        "window.workspace.new",
+        "window.workspace.delete",
+        "window.workspace.reset",
+        "window.workspace.lock",
+        "ui.dock",
+        "ui.dock.reset",
+    ];
+
+    /// Named workspaces and Reset belong to the application, which handles these commands
+    /// before [`Self::apply`].
+    pub fn is_app_owned(&self) -> bool {
+        matches!(self, Self::Workspace { .. } | Self::NewWorkspace { .. } | Self::DeleteWorkspace { .. } | Self::ResetWorkspace {})
+    }
+}
+
+impl<P: Clone + Eq + Hash> DockCommand<P> {
+    /// The layout actions this command makes on `workspace`, to apply all or none.
+    /// Showing a hidden panel and Lock change more than the layout, and named workspaces
+    /// belong to the application: those return [`DockError::NotAllowed`]; use [`Self::apply`].
+    /// A panel or anchor that is not shown returns [`DockError::MissingPanel`] or
+    /// [`DockError::MissingTarget`].
+    ///
+    /// `left`, `right`, `top` and `bottom` zones follow [`Placement::for_zone`]: beside a docked
+    /// anchor they make a new column or group, and `right_to_left` is the
+    /// [`super::DockStyle::right_to_left`] the layout is drawn with.
+    ///
+    /// `space` is where `window.panel.float` floats what it moves when it gives no rect: at the
+    /// size a drag would float it at, inside the dock area and clear of the app's menu bar. Pass
+    /// [`super::float_space`] of the area that draws `workspace`. Given `x`, `y`, `width` and
+    /// `height` replace the matching values, and a group or column that is already a whole
+    /// floating window keeps its rect.
+    ///
+    /// An outer edge dock wraps the part between the docks. [`Self::to_actions_with`] also
+    /// knows which panels are protected, so it wraps the canvas column where a drag would.
+    pub fn to_actions(&self, workspace: &Workspace<P>, right_to_left: bool, space: &FloatSpace<P>) -> Result<Vec<Action<P>>, DockError> {
+        self.to_actions_with(workspace, right_to_left, space, |_| Permissions::default())
+    }
+
+    /// [`Self::to_actions`] with the `permissions` the actions are applied with. An outer edge
+    /// dock wraps what a drag to that edge would: the canvas column where the area narrows its
+    /// edge band to it, else the part between the docks. `space` says whether the area draws
+    /// with [`super::DockStyle::side_edge_zones`], which never narrows.
+    pub fn to_actions_with(
+        &self,
+        workspace: &Workspace<P>,
+        right_to_left: bool,
+        space: &FloatSpace<P>,
+        permissions: impl Fn(&P) -> Permissions,
+    ) -> Result<Vec<Action<P>>, DockError> {
+        let layout = &workspace.layout;
+        let zoned = Zoned { layout, right_to_left };
+        let shown = |panel: &P| if layout.contains(panel) { Ok(()) } else { Err(DockError::MissingPanel) };
+        let one = |action: Action<P>| Ok(vec![action]);
+        match self {
+            Self::Layout { action } | Self::UiDock(UiDock::Action { action }) => one(action.clone()),
+            Self::Move { panel, anchor, zone, before, group, placement: given } => {
+                shown(panel)?;
+                let placement = match given {
+                    Some(placement) => placement.clone(),
+                    None => zoned.placement(anchor, *zone, before, ZoneName::Tab)?,
+                };
+                one(Unit::of(*group, false).to(layout, panel, Target::At { anchor: anchor.clone(), placement })?)
+            }
+            Self::Float { panel, x, y, width, height, group, column } => {
+                shown(panel)?;
+                let given = [*x, *y, *width, *height];
+                let window = layout.floating.iter().find(|w| w.contains(panel)).map(|w| w.rect);
+                let rect = |base: [f32; 4]| {
+                    let mut rect = base;
+                    for (value, given) in rect.iter_mut().zip(given) {
+                        *value = given.unwrap_or(*value);
+                    }
+                    rect
+                };
+                let any = given.iter().any(Option::is_some);
+                let unit = Unit::of(*group, *column);
+                let lone = layout.floating.iter().any(|w| w.contains(panel) && w.panels().count() == 1);
+                let whole =
+                    layout.floating.iter().any(|w| w.contains(panel) && matches!(w.root, super::Node::Tabs { .. } | super::Node::Stack { .. }));
+                // The rect a drag would float the unit at, inside the area.
+                let placed = || {
+                    let docked = layout.location(panel).ok().and_then(|l| l.group).and_then(|g| g.column).map(|c| c.width);
+                    let fallback = egui::vec2(docked.filter(|_| !matches!(unit, Unit::Panel)).unwrap_or(DEFAULT_FLOAT.x), DEFAULT_FLOAT.y);
+                    let size = match unit {
+                        Unit::Panel => space.panel(panel),
+                        Unit::Group => space.group(panel),
+                        Unit::Column => space.column(panel),
+                    };
+                    rect(space.place(size.unwrap_or(fallback)))
+                };
+                match (unit, window) {
+                    (Unit::Panel, Some(base)) if lone => one(Action::MoveFloating { panel: panel.clone(), rect: rect(base) }),
+                    (Unit::Column, Some(base)) => one(Action::MoveFloating { panel: panel.clone(), rect: rect(base) }),
+                    // Without given values the window keeps its rect and native state.
+                    (Unit::Group, Some(base)) if whole => one(unit.to(layout, panel, Target::Float { rect: any.then(|| rect(base)) })?),
+                    (Unit::Panel, _) => one(Action::Float { panel: panel.clone(), rect: placed() }),
+                    (unit, _) => one(unit.to(layout, panel, Target::Float { rect: Some(placed()) })?),
+                }
+            }
+            Self::Dock { panel, anchor, zone, before, group, column, side } => {
+                shown(panel)?;
+                let unit = Unit::of(*group, *column);
+                if let Some(anchor) = anchor {
+                    let placement = zoned.placement(anchor, *zone, before, ZoneName::Tab)?;
+                    return one(unit.to(layout, panel, Target::At { anchor: anchor.clone(), placement })?);
+                }
+                if let Some(side) = side {
+                    let to = match last_column(layout, *side) {
+                        Some(column) => match column.into_iter().find(|p| !members(layout, panel, unit).contains(p)) {
+                            Some(anchor) => Target::At { anchor, placement: Placement::Column { after: true } },
+                            // What moves already is that dock's last column.
+                            None => return Ok(Vec::new()),
+                        },
+                        None => Target::NewDock { side: *side },
+                    };
+                    let unit = match (unit, &to) {
+                        (Unit::Panel, Target::NewDock { .. }) if group_len(layout, panel) == Some(1) => Unit::Group,
+                        (unit, _) => unit,
+                    };
+                    return one(unit.to(layout, panel, to)?);
+                }
+                let members = members(layout, panel, unit);
+                if let Some(zone) = self.edge() {
+                    if before.is_some() {
+                        return Err(DockError::InvalidPlacement);
+                    }
+                    // The model narrows the edge on a protected anchor, as `Workspace::apply` checks it.
+                    let protected = |p: &P| {
+                        let policy = if workspace.locked { permissions(p).locked() } else { permissions(p) };
+                        policy.is_protected()
+                    };
+                    let narrowed = !space.side_edge_zones && layout.edge_narrows(zone, &protected);
+                    let anchor = layout.edge_anchor(narrowed, &protected, &|p| members.contains(p)).ok_or(DockError::MissingTarget)?;
+                    return one(unit.to(layout, panel, Target::At { anchor, placement: Placement::Edge(zone) })?);
+                }
+                if !matches!(layout.place(panel), Some(Place::Floating { .. })) {
+                    return Ok(Vec::new());
+                }
+                let panels = layout.panels();
+                let free = || panels.iter().copied().filter(|p| !members.contains(p));
+                let docked = free().find(|p| matches!(layout.place(p), Some(Place::Dock { .. })));
+                let framed = || free().find(|p| matches!(layout.place(p), Some(Place::Node(_))));
+                let anchor = docked.or_else(framed).cloned().ok_or(DockError::MissingTarget)?;
+                one(unit.to(layout, panel, Target::At { anchor, placement: Placement::Tab { before: None } })?)
+            }
+            Self::Activate { panel } => {
+                shown(panel)?;
+                one(Action::Activate { panel: panel.clone() })
+            }
+            Self::Close { panel } => one(Action::Close { panel: panel.clone() }),
+            Self::CloseGroup { panel } => one(Action::CloseGroup { panel: panel.clone() }),
+            Self::CloseOthers { panel } => one(Action::CloseOthers { panel: panel.clone() }),
+            Self::Minimize { panel, minimized } => {
+                let place = layout.place(panel).ok_or(DockError::MissingPanel)?;
+                // An accordion entry is minimized while it is closed.
+                let current = match &place {
+                    Place::Node(path) => match layout.root.as_ref().and_then(|root| super::dock_model::node_at(root, path)) {
+                        Some(super::Node::Stack { entries }) => entries.iter().any(|e| &e.panel == panel && !e.open),
+                        _ => false,
+                    },
+                    Place::Floating { window, .. } => layout.floating.get(*window).is_some_and(|w| w.minimized),
+                    place => layout.group(place).is_some_and(|g| g.minimized),
+                };
+                one(Action::SetMinimized { panel: panel.clone(), minimized: minimized.unwrap_or(!current) })
+            }
+            Self::Iconic { panel, iconic } => {
+                let location = layout.location(panel)?;
+                let current = location.group.and_then(|g| g.column).is_some_and(|c| c.iconic);
+                one(Action::SetIconic { panel: panel.clone(), iconic: iconic.unwrap_or(!current) })
+            }
+            Self::Window { panel, native } => {
+                shown(panel)?;
+                if !native.unwrap_or(true) {
+                    return one(Action::SetNative { panel: panel.clone(), rect: None });
+                }
+                let mut actions = Vec::new();
+                let mut scratch = layout.clone();
+                if !scratch.floating.iter().any(|w| w.contains(panel)) {
+                    let float = Action::MoveGroup { panel: panel.clone(), to: Target::Float { rect: None } };
+                    scratch.apply(float.clone())?;
+                    actions.push(float);
+                }
+                let rect = scratch.floating.iter().find(|w| w.contains(panel)).map(|w| w.rect).ok_or(DockError::MissingPanel)?;
+                actions.push(Action::SetNative { panel: panel.clone(), rect: Some(rect) });
+                Ok(actions)
+            }
+            Self::UiDock(UiDock::Operation(operation)) => match operation {
+                DockOperation::Open { panel } | DockOperation::Activate { panel } => {
+                    shown(panel)?;
+                    one(Action::Activate { panel: panel.clone() })
+                }
+                DockOperation::Close { panel } => one(Action::Close { panel: panel.clone() }),
+                DockOperation::Float { panel, rect } => one(Action::Float { panel: panel.clone(), rect: *rect }),
+                DockOperation::MoveFloating { panel, rect } => one(Action::MoveFloating { panel: panel.clone(), rect: *rect }),
+                DockOperation::Move { panel, target, zone, before } => {
+                    let placement = zoned.placement(target, *zone, before, ZoneName::Center)?;
+                    one(Action::Move { panel: panel.clone(), anchor: target.clone(), placement })
+                }
+                DockOperation::SetStackOpen { panel, open } => one(Action::SetStackOpen { panel: panel.clone(), open: *open }),
+                DockOperation::ResizeStack { panel, height } => one(Action::ResizeStack { panel: panel.clone(), height: *height }),
+                DockOperation::ResizeSplit { path, size } => one(Action::ResizeSplit { path: path.clone(), size: *size }),
+            },
+            Self::Workspace { .. } | Self::NewWorkspace { .. } | Self::DeleteWorkspace { .. } | Self::ResetWorkspace {} | Self::Lock { .. } => {
+                Err(DockError::NotAllowed)
+            }
+        }
+    }
+
+    /// Apply the command to `workspace`, all or nothing, and return the panels it closed so
+    /// the application can release their state. Showing a hidden panel restores its last
+    /// location, and a panel never laid out opens as [`Action::Open`] without an anchor does
+    /// ([`Workspace::set_visible`]); Lock sets [`Workspace::locked`]. Application-owned commands
+    /// ([`Self::is_app_owned`]) return [`DockError::NotAllowed`] and change nothing.
+    /// `space` is where `window.panel.float` floats, as for [`Self::to_actions_with`].
+    pub fn apply(
+        &self,
+        workspace: &mut Workspace<P>,
+        right_to_left: bool,
+        space: &FloatSpace<P>,
+        permissions: impl Fn(&P) -> Permissions,
+    ) -> Result<Vec<P>, DockError> {
+        let show = match self {
+            Self::Activate { panel }
+            | Self::Dock { panel, anchor: None, side: None, .. }
+            | Self::UiDock(UiDock::Operation(DockOperation::Open { panel } | DockOperation::Activate { panel })) => Some(panel),
+            _ => None,
+        };
+        if let Some(panel) = show.filter(|p| !workspace.layout.contains(p)) {
+            if self.edge().is_none() {
+                workspace.set_visible(panel.clone(), true, None, &permissions)?;
+                return Ok(Vec::new());
+            }
+            // Shown, then moved to the edge, all or nothing.
+            let mut shown = workspace.clone();
+            shown.set_visible(panel.clone(), true, None, &permissions)?;
+            let closed = shown.apply_all(self.to_actions_with(&shown, right_to_left, space, &permissions)?, &permissions)?;
+            *workspace = shown;
+            return Ok(closed);
+        }
+        if let Self::Lock { locked } = self {
+            workspace.locked = locked.unwrap_or(!workspace.locked);
+            return Ok(Vec::new());
+        }
+        let actions = self.to_actions_with(workspace, right_to_left, space, &permissions)?;
+        workspace.apply_all(actions, permissions)
+    }
+}
+
+impl<P> DockCommand<P> {
+    /// The outer edge `window.panel.dock` goes to: a side zone without an anchor or side.
+    fn edge(&self) -> Option<Zone> {
+        match self {
+            Self::Dock { anchor: None, side: None, zone: Some(zone), .. } => match zone {
+                ZoneName::Left => Some(Zone::Left),
+                ZoneName::Right => Some(Zone::Right),
+                ZoneName::Top => Some(Zone::Top),
+                ZoneName::Bottom => Some(Zone::Bottom),
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+}
+
+/// The panels of the last column of the dock on `side`, or `None` without such a dock.
+fn last_column<P: Clone + Eq + Hash>(layout: &Layout<P>, side: Side) -> Option<Vec<P>> {
+    let path = layout.dock_path(side)?;
+    let node = layout.root.as_ref().and_then(|root| super::dock_model::node_at(root, &path))?;
+    match node {
+        super::Node::Dock { columns, .. } => Some(columns.last()?.groups.iter().flat_map(|g| g.panels.iter().cloned()).collect()),
+        _ => None,
+    }
+}
+
+fn group_len<P: Clone + Eq + Hash>(layout: &Layout<P>, panel: &P) -> Option<usize> {
+    layout.members(panel, super::dock_model::Unit::Group).ok().map(|members| members.len())
+}
+
+/// The panels that move with `panel`.
+fn members<P: Clone + Eq + Hash>(layout: &Layout<P>, panel: &P, unit: Unit) -> Vec<P> {
+    match unit {
+        Unit::Panel => vec![panel.clone()],
+        Unit::Group => layout.members(panel, super::dock_model::Unit::Group).unwrap_or_default(),
+        Unit::Column => match layout.place(panel) {
+            Some(Place::Dock { path, column, .. }) => match layout.root.as_ref().and_then(|root| super::dock_model::node_at(root, &path)) {
+                Some(super::Node::Dock { columns, .. }) => {
+                    columns.get(column).map(|c| c.groups.iter().flat_map(|g| g.panels.iter().cloned()).collect()).unwrap_or_default()
+                }
+                _ => Vec::new(),
+            },
+            Some(Place::Floating { .. }) => {
+                layout.floating.iter().find(|w| w.contains(panel)).map(|w| w.panels().cloned().collect()).unwrap_or_default()
+            }
+            _ => vec![panel.clone()],
+        },
+    }
+}
diff --git a/crates/ui/src/docking/command_tests.rs b/crates/ui/src/docking/command_tests.rs
new file mode 100644
index 00000000..c6ac3f1d
--- /dev/null
+++ b/crates/ui/src/docking/command_tests.rs
@@ -0,0 +1,481 @@
+//! `DockCommand`: every documented shape parses and maps to atomic layout actions.
+#![cfg(feature = "serde")]
+
+use std::collections::BTreeSet;
+
+use serde_json::{Value, json};
+
+use super::*;
+use crate::layout::{SplitAxis, SplitSize};
+
+type P = String;
+
+fn s(panel: &str) -> P {
+    panel.to_owned()
+}
+
+fn permissions(panel: &P) -> Permissions {
+    if panel == "canvas" { Permissions::PROTECTED } else { Permissions::default() }
+}
+
+/// A start dock with one column of `[layers, channels]` and `[history]` beside the canvas, a
+/// floating `color`, and `swatches` hidden from history's group.
+fn workspace() -> Workspace<P> {
+    let groups = vec![Group::new(vec![s("layers"), s("channels")], 0), Group::new(vec![s("history"), s("swatches")], 0)];
+    let dock = Node::Dock { side: Side::Start, columns: vec![Column::new(groups, 240.0)] };
+    let canvas = Node::Tabs { panels: vec![s("canvas")], active: 0 };
+    let layout = Layout {
+        root: Some(Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedFirst(240.0), first: Box::new(dock), second: Box::new(canvas) }),
+        floating: vec![Floating::single(vec![s("color")], 0, [300.0, 200.0, 200.0, 150.0])],
+    };
+    let mut workspace = Workspace::new(layout);
+    workspace.apply(Action::Close { panel: s("swatches") }, permissions).unwrap();
+    workspace
+}
+
+/// An 800x600 dock area that has drawn nothing.
+fn space() -> FloatSpace<P> {
+    FloatSpace::new(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(800.0, 600.0)))
+}
+
+fn parse(params: Value) -> Result<DockCommand<P>, serde_json::Error> {
+    serde_json::from_value(params)
+}
+
+/// The actions `params` makes on a fresh workspace.
+fn actions(params: Value) -> Vec<Action<P>> {
+    let command = parse(params.clone()).unwrap_or_else(|e| panic!("{params}: {e}"));
+    command.to_actions_with(&workspace(), false, &space(), permissions).unwrap_or_else(|e| panic!("{params}: {e}"))
+}
+
+/// Apply `params` to a fresh workspace; return it and the panels closed.
+fn applied(params: Value) -> (Workspace<P>, Vec<P>) {
+    let mut workspace = workspace();
+    let command = parse(params.clone()).unwrap_or_else(|e| panic!("{params}: {e}"));
+    let closed = command.apply(&mut workspace, false, &space(), permissions).unwrap_or_else(|e| panic!("{params}: {e}"));
+    (workspace, closed)
+}
+
+/// `params` parses but applying it fails with `error` and changes nothing.
+fn rejected(params: Value, error: DockError) {
+    let mut workspace = workspace();
+    let before = workspace.clone();
+    let command = parse(params.clone()).unwrap_or_else(|e| panic!("{params}: {e}"));
+    assert_eq!(command.apply(&mut workspace, false, &space(), permissions), Err(error), "{params}");
+    assert_eq!(workspace, before, "{params}");
+}
+
+fn tab(before: Option<&str>) -> Placement<P> {
+    Placement::Tab { before: before.map(s) }
+}
+
+#[test]
+fn dock_commands_parse_every_documented_shape_and_map_to_atomic_actions() {
+    let mut seen = BTreeSet::new();
+    let mut id = |params: Value| {
+        seen.insert(params["command"].as_str().unwrap().to_owned());
+        params
+    };
+
+    // The raw action form, in both protocols.
+    let raw = json!({"MoveFloating": {"panel": "color", "rect": [44, 66, 360, 450]}});
+    let moved = vec![Action::MoveFloating { panel: s("color"), rect: [44.0, 66.0, 360.0, 450.0] }];
+    assert_eq!(actions(id(json!({"command": "window.panel.layout", "action": raw}))), moved);
+    assert_eq!(actions(id(json!({"command": "ui.dock", "action": raw}))), moved);
+
+    // move: tab by default, before a tab or appended, zones, a serialized placement, a group.
+    let mv = |placement| vec![Action::Move { panel: s("history"), anchor: s("layers"), placement }];
+    let base = json!({"command": "window.panel.move", "panel": "history", "anchor": "layers"});
+    let with = |extra: Value| {
+        let mut params = base.clone();
+        params.as_object_mut().unwrap().extend(extra.as_object().unwrap().clone());
+        params
+    };
+    assert_eq!(actions(id(base.clone())), mv(tab(None)));
+    assert_eq!(actions(with(json!({"before": "channels"}))), mv(tab(Some("channels"))));
+    assert_eq!(actions(with(json!({"zone": "center", "before": null}))), mv(tab(None)));
+    assert_eq!(actions(with(json!({"zone": "center"}))), mv(Placement::Split(Zone::Center)));
+    assert_eq!(actions(with(json!({"zone": "Left"}))), mv(Placement::Column { after: false }));
+    assert_eq!(actions(with(json!({"zone": "below"}))), mv(Placement::Group { below: true, height: None }));
+    assert_eq!(actions(with(json!({"placement": {"Column": {"after": true}}}))), mv(Placement::Column { after: true }));
+    assert_eq!(
+        actions(with(json!({"group": true, "zone": "above"}))),
+        vec![Action::MoveGroup {
+            panel: s("history"),
+            to: Target::At { anchor: s("layers"), placement: Placement::Group { below: false, height: None } }
+        }]
+    );
+
+    // float: a docked panel, a lone floating panel, a group and a column.
+    assert_eq!(
+        actions(id(json!({"command": "window.panel.float", "panel": "layers", "x": 10, "y": 20}))),
+        vec![Action::Float { panel: s("layers"), rect: [10.0, 20.0, 260.0, 320.0] }]
+    );
+    assert_eq!(
+        actions(json!({"command": "window.panel.float", "panel": "color", "width": 320})),
+        vec![Action::MoveFloating { panel: s("color"), rect: [300.0, 200.0, 320.0, 150.0] }]
+    );
+    assert_eq!(
+        actions(json!({"command": "window.panel.float", "panel": "layers", "group": true})),
+        vec![Action::MoveGroup { panel: s("layers"), to: Target::Float { rect: Some([24.0, 24.0, 240.0, 320.0]) } }]
+    );
+    assert_eq!(
+        actions(json!({"command": "window.panel.float", "panel": "history", "column": true})),
+        vec![Action::MoveColumn { panel: s("history"), to: Target::Float { rect: Some([24.0, 24.0, 240.0, 320.0]) } }]
+    );
+
+    // dock: to an anchor, to a side, back into the dock, and a hidden panel to its last place.
+    assert_eq!(
+        actions(id(json!({"command": "window.panel.dock", "panel": "color", "anchor": "history", "zone": "tab"}))),
+        vec![Action::Move { panel: s("color"), anchor: s("history"), placement: tab(None) }]
+    );
+    assert_eq!(
+        actions(json!({"command": "window.panel.dock", "panel": "color", "side": "End"})),
+        vec![Action::MoveGroup { panel: s("color"), to: Target::NewDock { side: Side::End } }]
+    );
+    let new_column = Target::At { anchor: s("layers"), placement: Placement::Column { after: true } };
+    assert_eq!(
+        actions(json!({"command": "window.panel.dock", "panel": "color", "column": true, "side": "Start"})),
+        vec![Action::MoveWindow { panel: s("color"), to: new_column.clone() }]
+    );
+    assert_eq!(
+        actions(json!({"command": "window.panel.dock", "panel": "history", "group": true, "side": "Start"})),
+        vec![Action::MoveGroup { panel: s("history"), to: new_column }]
+    );
+    assert_eq!(
+        actions(json!({"command": "window.panel.dock", "panel": "color"})),
+        vec![Action::Move { panel: s("color"), anchor: s("layers"), placement: tab(None) }]
+    );
+    assert_eq!(actions(json!({"command": "window.panel.dock", "panel": "layers"})), vec![]);
+    let (shown, _) = applied(json!({"command": "window.panel.dock", "panel": "swatches"}));
+    assert!(shown.layout.contains(&s("swatches")) && shown.hidden.is_empty());
+
+    // activate shows a hidden panel; close actions report what they closed.
+    let (shown, _) = applied(id(json!({"command": "window.panel.activate", "panel": "swatches"})));
+    assert!(shown.layout.contains(&s("swatches")));
+    assert_eq!(actions(json!({"command": "window.panel.activate", "panel": "channels"})), vec![Action::Activate { panel: s("channels") }]);
+    assert_eq!(applied(id(json!({"command": "window.panel.close", "panel": "channels"}))).1, vec![s("channels")]);
+    assert_eq!(applied(id(json!({"command": "window.panel.closeGroup", "panel": "channels"}))).1, vec![s("layers"), s("channels")]);
+    assert_eq!(applied(id(json!({"command": "window.panel.closeOthers", "panel": "channels"}))).1, vec![s("layers")]);
+
+    // minimize and iconic toggle without a value.
+    assert_eq!(
+        actions(id(json!({"command": "window.panel.minimize", "panel": "layers"}))),
+        vec![Action::SetMinimized { panel: s("layers"), minimized: true }]
+    );
+    assert_eq!(
+        actions(json!({"command": "window.panel.minimize", "panel": "layers", "minimized": false})),
+        vec![Action::SetMinimized { panel: s("layers"), minimized: false }]
+    );
+    assert_eq!(
+        actions(id(json!({"command": "window.panel.iconic", "panel": "history"}))),
+        vec![Action::SetIconic { panel: s("history"), iconic: true }]
+    );
+
+    // window: a floating window goes native at its rect; a docked group floats first.
+    assert_eq!(
+        actions(id(json!({"command": "window.panel.window", "panel": "color"}))),
+        vec![Action::SetNative { panel: s("color"), rect: Some([300.0, 200.0, 200.0, 150.0]) }]
+    );
+    let docked = actions(json!({"command": "window.panel.window", "panel": "layers"}));
+    assert!(
+        matches!(docked.as_slice(), [Action::MoveGroup { to: Target::Float { rect: None }, .. }, Action::SetNative { rect: Some(_), .. }]),
+        "{docked:?}"
+    );
+    assert_eq!(
+        actions(json!({"command": "window.panel.window", "panel": "color", "native": false})),
+        vec![Action::SetNative { panel: s("color"), rect: None }]
+    );
+
+    // Named workspaces and Reset belong to the application.
+    for params in [
+        json!({"command": "window.workspace", "name": "Painting"}),
+        json!({"command": "window.workspace.new", "name": "Mine"}),
+        json!({"command": "window.workspace.delete", "name": "Mine"}),
+        json!({"command": "window.workspace.reset"}),
+        json!({"command": "ui.dock.reset"}),
+    ] {
+        let command = parse(id(params.clone())).unwrap();
+        assert!(command.is_app_owned(), "{params}");
+        rejected(params, DockError::NotAllowed);
+    }
+    assert_eq!(parse(json!({"command": "ui.dock.reset"})).unwrap(), DockCommand::ResetWorkspace {});
+
+    // Lock toggles or sets.
+    assert!(applied(id(json!({"command": "window.workspace.lock"}))).0.locked);
+    assert!(!applied(json!({"command": "window.workspace.lock", "locked": false})).0.locked);
+
+    // The small apps' ui.dock operations.
+    let op = |params: Value| {
+        let mut params = params;
+        params["command"] = json!("ui.dock");
+        params
+    };
+    let (shown, _) = applied(op(json!({"operation": "open", "panel": "swatches"})));
+    assert!(shown.layout.contains(&s("swatches")));
+    assert_eq!(actions(op(json!({"operation": "close", "panel": "layers"}))), vec![Action::Close { panel: s("layers") }]);
+    assert_eq!(actions(op(json!({"operation": "activate", "panel": "channels"}))), vec![Action::Activate { panel: s("channels") }]);
+    assert_eq!(
+        actions(op(json!({"operation": "float", "panel": "layers", "rect": [1, 2, 300, 200]}))),
+        vec![Action::Float { panel: s("layers"), rect: [1.0, 2.0, 300.0, 200.0] }]
+    );
+    assert_eq!(
+        actions(op(json!({"operation": "moveFloating", "panel": "color", "rect": [1, 2, 300, 200]}))),
+        vec![Action::MoveFloating { panel: s("color"), rect: [1.0, 2.0, 300.0, 200.0] }]
+    );
+    let to_layers = |placement| vec![Action::Move { panel: s("color"), anchor: s("layers"), placement }];
+    assert_eq!(actions(op(json!({"operation": "move", "panel": "color", "target": "layers"}))), to_layers(Placement::Split(Zone::Center)));
+    assert_eq!(
+        actions(op(json!({"operation": "move", "panel": "color", "target": "layers", "zone": "left"}))),
+        to_layers(Placement::Column { after: false })
+    );
+    assert_eq!(actions(op(json!({"operation": "move", "panel": "color", "target": "layers", "before": null}))), to_layers(tab(None)));
+    assert_eq!(
+        actions(op(json!({"operation": "move", "panel": "color", "target": "layers", "before": "channels"}))),
+        to_layers(tab(Some("channels")))
+    );
+    assert_eq!(
+        actions(op(json!({"operation": "setStackOpen", "panel": "layers", "open": false}))),
+        vec![Action::SetStackOpen { panel: s("layers"), open: false }]
+    );
+    assert_eq!(
+        actions(op(json!({"operation": "resizeStack", "panel": "layers", "height": null}))),
+        vec![Action::ResizeStack { panel: s("layers"), height: None }]
+    );
+    assert_eq!(
+        actions(op(json!({"operation": "resizeStack", "panel": "layers", "height": 120}))),
+        vec![Action::ResizeStack { panel: s("layers"), height: Some(120.0) }]
+    );
+    assert_eq!(
+        actions(op(json!({"operation": "resizeSplit", "path": [], "size": {"Ratio": 0.35}}))),
+        vec![Action::ResizeSplit { path: vec![], size: SplitSize::Ratio(0.35) }]
+    );
+
+    let ids: BTreeSet<String> = DockCommand::<P>::IDS.iter().map(|id| (*id).to_owned()).collect();
+    assert_eq!(seen, ids, "one case per id");
+
+    // Bad params: parse errors, or a DockError with nothing changed.
+    for params in [
+        json!({"command": "window.panel.unknown", "panel": "layers"}),
+        json!({"command": "window.panel.move", "panel": "layers"}),
+        json!({"command": "window.panel.move", "panel": "layers", "anchor": "history", "zone": "middle"}),
+        json!({"command": "window.panel.minimize", "panel": "layers", "minimized": "yes"}),
+        op(json!({"operation": "spin", "panel": "layers"})),
+        op(json!({"operation": "float", "panel": "layers", "rect": [1, 2, 3]})),
+        op(json!({"operation": "resizeStack", "panel": "layers"})),
+        op(json!({"operation": "setStackOpen", "panel": "layers"})),
+        op(json!({"operation": "move", "panel": "layers"})),
+    ] {
+        assert!(parse(params.clone()).is_err(), "{params}");
+    }
+    rejected(json!({"command": "window.panel.move", "panel": "layers", "anchor": "nowhere"}), DockError::MissingTarget);
+    rejected(json!({"command": "window.panel.move", "panel": "nowhere", "anchor": "layers"}), DockError::MissingPanel);
+    rejected(
+        json!({"command": "window.panel.move", "panel": "layers", "anchor": "history", "zone": "left", "before": null}),
+        DockError::InvalidPlacement,
+    );
+    rejected(json!({"command": "window.panel.float", "panel": "layers", "width": 1e30}), DockError::InvalidGeometry);
+    rejected(json!({"command": "window.panel.move", "panel": "canvas", "anchor": "layers"}), DockError::NotAllowed);
+    rejected(op(json!({"operation": "moveFloating", "panel": "color", "rect": [0, 0, -5, 10]})), DockError::InvalidGeometry);
+    rejected(
+        op(json!({"operation": "move", "panel": "color", "target": "layers", "zone": "top", "before": "channels"})),
+        DockError::InvalidPlacement,
+    );
+    rejected(op(json!({"operation": "resizeSplit", "path": [true, true, true], "size": {"Ratio": 0.5}})), DockError::MissingTarget);
+    // A docked group cannot float into a native window when locked.
+    let mut locked = workspace();
+    locked.locked = true;
+    let before = locked.clone();
+    assert!(parse(json!({"command": "window.panel.window", "panel": "layers"})).unwrap().apply(&mut locked, false, &space(), permissions).is_err());
+    assert_eq!(locked, before);
+}
+
+#[test]
+fn side_zones_map_to_the_placement_the_anchor_container_takes_in_either_direction() {
+    let command =
+        |zone: &str, anchor: &str| parse(json!({"command": "window.panel.move", "panel": "history", "anchor": anchor, "zone": zone})).unwrap();
+    let placed = |zone: &str, anchor: &str, rtl: bool| match command(zone, anchor).to_actions_with(&workspace(), rtl, &space(), permissions) {
+        Ok(actions) => match actions.as_slice() {
+            [Action::Move { placement, .. }] => Ok(placement.clone()),
+            other => panic!("{other:?}"),
+        },
+        Err(error) => Err(error),
+    };
+    // A start dock is on the left edge left to right, on the right edge right to left.
+    assert_eq!(placed("right", "layers", false), Ok(Placement::Column { after: true }));
+    assert_eq!(placed("right", "layers", true), Ok(Placement::Column { after: false }));
+    assert_eq!(placed("left", "layers", true), Ok(Placement::Column { after: true }));
+    assert_eq!(placed("top", "layers", false), Ok(Placement::Group { below: false, height: None }));
+    // A floating window is a tree like the docked layout's.
+    assert_eq!(placed("bottom", "color", false), Ok(Placement::Split(Zone::Bottom)));
+    assert_eq!(placed("left", "color", false), Ok(Placement::Split(Zone::Left)));
+    assert_eq!(placed("left", "canvas", true), Ok(Placement::Split(Zone::Left)));
+
+    let (workspace, _) = applied(json!({"command": "window.panel.move", "panel": "history", "anchor": "layers", "zone": "right"}));
+    let Some(Node::Split { first, .. }) = &workspace.layout.root else { panic!() };
+    let Node::Dock { columns, .. } = &**first else { panic!() };
+    assert_eq!(columns.len(), 2);
+    assert_eq!(columns[1].groups[0].panels, vec![s("history")]);
+}
+
+/// `layers` prefers 200x150 when it floats.
+struct Sized;
+
+impl DockContent<P> for Sized {
+    fn body(&mut self, _: &mut egui::Ui, _: &P) {}
+    fn permissions(&self, panel: &P) -> Permissions {
+        permissions(panel)
+    }
+    fn floating_size(&self, panel: &P) -> Option<egui::Vec2> {
+        (panel == "layers").then_some(egui::vec2(200.0, 150.0))
+    }
+}
+
+#[test]
+fn float_without_a_rect_takes_the_drag_size_inside_the_dock_area() {
+    // The area starts under a 30 pt menu bar.
+    let area = egui::Rect::from_min_max(egui::pos2(0.0, 30.0), egui::pos2(800.0, 600.0));
+    let d = testing::DockDriver::new(workspace().layout, Sized).with_area(area);
+    let space = float_space::<P>(&d.ctx, d.id).expect("the area records its float space");
+    assert_eq!(space.area, area);
+    let float = |params: Value| parse(params).unwrap().to_actions_with(&workspace(), false, &space, permissions).unwrap();
+
+    let panel = float(json!({"command": "window.panel.float", "panel": "layers"}));
+    // The floating_size width, and an empty body's least fitted height under its 150 points.
+    assert_eq!(panel, vec![Action::Float { panel: s("layers"), rect: [24.0, 54.0, 200.0, 120.0] }], "floating_size, inset in the area");
+    let [Action::MoveGroup { to: Target::Float { rect: Some([x, y, width, height]) }, .. }] =
+        float(json!({"command": "window.panel.float", "panel": "history", "group": true}))[..]
+    else {
+        panic!()
+    };
+    assert_eq!([x, y], [24.0, 54.0]);
+    assert!(width > 100.0 && width <= 240.0 && height <= 320.0, "the docked group's size, capped: {width}x{height}");
+
+    // Given values stay exactly; a lone floating window keeps its rect.
+    let given = float(json!({"command": "window.panel.float", "panel": "layers", "x": 5, "y": 6, "width": 100, "height": 90}));
+    assert_eq!(given, vec![Action::Float { panel: s("layers"), rect: [5.0, 6.0, 100.0, 90.0] }]);
+    let color = float(json!({"command": "window.panel.float", "panel": "color", "group": true}));
+    assert_eq!(color, vec![Action::MoveGroup { panel: s("color"), to: Target::Float { rect: None } }]);
+
+    // Without recorded sizes a unit floats at the layout's size, shrunk into a small area.
+    let small = FloatSpace::new(egui::Rect::from_min_size(egui::pos2(0.0, 30.0), egui::vec2(200.0, 200.0)));
+    let applied = parse(json!({"command": "window.panel.float", "panel": "layers", "group": true})).unwrap().to_actions_with(
+        &workspace(),
+        false,
+        &small,
+        permissions,
+    );
+    assert_eq!(applied, Ok(vec![Action::MoveGroup { panel: s("layers"), to: Target::Float { rect: Some([0.0, 30.0, 200.0, 200.0]) } }]));
+
+    // A host seeds the size of a panel the area never drew; a recorded size still wins.
+    let seeded = FloatSpace::new(area).with_panel_size(s("layers"), egui::vec2(180.0, 240.0));
+    let applied =
+        parse(json!({"command": "window.panel.float", "panel": "layers"})).unwrap().to_actions_with(&workspace(), false, &seeded, permissions);
+    assert_eq!(applied, Ok(vec![Action::Float { panel: s("layers"), rect: [24.0, 54.0, 180.0, 240.0] }]));
+    let recorded = space.clone().with_panel_size(s("layers"), egui::vec2(180.0, 240.0));
+    assert_eq!(float_with(&recorded, "layers"), vec![Action::Float { panel: s("layers"), rect: [24.0, 54.0, 200.0, 120.0] }]);
+}
+
+fn float_with(space: &FloatSpace<P>, panel: &str) -> Vec<Action<P>> {
+    parse(json!({"command": "window.panel.float", "panel": panel})).unwrap().to_actions_with(&workspace(), false, space, permissions).unwrap()
+}
+
+#[test]
+fn dock_to_a_side_without_a_dock_takes_one_panel_out_of_a_shared_group() {
+    let params = json!({"command": "window.panel.dock", "panel": "layers", "side": "End"});
+    assert_eq!(actions(params.clone()), vec![Action::MovePanel { panel: s("layers"), to: Target::NewDock { side: Side::End } }]);
+    let (workspace, _) = applied(params);
+    let side = |panel: &str| workspace.layout.location(&s(panel)).unwrap().group.and_then(|g| g.column).map(|c| c.side);
+    assert_eq!(side("layers"), Some(Side::End));
+    assert_eq!(side("channels"), Some(Side::Start));
+}
+
+#[test]
+fn minimize_without_a_value_toggles_an_accordion_entry_both_ways() {
+    let entry = |panel: &str| StackEntry { panel: s(panel), open: true, height: None };
+    let mut workspace = Workspace::new(Layout { root: Some(Node::Stack { entries: vec![entry("layers"), entry("history")] }), floating: Vec::new() });
+    let toggle = parse(json!({"command": "window.panel.minimize", "panel": "layers"})).unwrap();
+    toggle.apply(&mut workspace, false, &space(), permissions).unwrap();
+    assert_eq!(workspace.layout.panel_state(&s("layers")), PanelState::Open);
+    toggle.apply(&mut workspace, false, &space(), permissions).unwrap();
+    assert_eq!(workspace.layout.panel_state(&s("layers")), PanelState::Front);
+}
+
+#[test]
+fn dock_with_a_side_zone_and_no_anchor_makes_an_outer_edge_frame() {
+    let edge = |panel: &str, zone| Action::Move { panel: s(panel), anchor: s("layers"), placement: Placement::Edge(zone) };
+    assert_eq!(actions(json!({"command": "window.panel.dock", "panel": "color", "zone": "left"})), vec![edge("color", Zone::Left)]);
+    assert_eq!(actions(json!({"command": "window.panel.dock", "panel": "history", "zone": "bottom"})), vec![edge("history", Zone::Bottom)]);
+    let (moved, _) = applied(json!({"command": "window.panel.dock", "panel": "color", "zone": "right"}));
+    assert!(matches!(moved.layout.place(&s("color")), Some(crate::docking::dock_model::Place::Node(_))), "{:?}", moved.layout);
+    let (shown, _) = applied(json!({"command": "window.panel.dock", "panel": "swatches", "zone": "top"}));
+    assert!(
+        matches!(shown.layout.place(&s("swatches")), Some(crate::docking::dock_model::Place::Node(_))) && shown.hidden.is_empty(),
+        "{:?}",
+        shown.layout
+    );
+    rejected(json!({"command": "window.panel.dock", "panel": "color", "zone": "left", "before": null}), DockError::InvalidPlacement);
+}
+
+/// The frame beside `panel`'s own: what an edge split with `panel` wrapped.
+fn wrapped(layout: &Layout<P>, panel: &str) -> Option<Node<P>> {
+    let Some(dock_model::Place::Node(path)) = layout.place(&s(panel)) else { return None };
+    let (last, parent) = path.split_last()?;
+    layout.root.as_ref().and_then(|root| dock_model::node_at(root, &[parent, &[!last]].concat())).cloned()
+}
+
+#[test]
+fn an_outer_edge_dock_wraps_the_canvas_column_whatever_the_tree_order() {
+    let tabs = |panel: &str| Node::Tabs { panels: vec![s(panel)], active: 0 };
+    let side =
+        |first, second| Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::Ratio(0.5), first: Box::new(first), second: Box::new(second) };
+    let canvas_first = side(tabs("canvas"), side(tabs("layers"), tabs("history")));
+    let canvas_later = side(side(tabs("layers"), tabs("canvas")), tabs("history"));
+    for root in [canvas_first, canvas_later] {
+        let layout = Layout { root: Some(root), floating: vec![Floating::single(vec![s("color")], 0, [300.0, 200.0, 200.0, 150.0])] };
+        let command = parse(json!({"command": "window.panel.dock", "panel": "color", "zone": "top"})).unwrap();
+        let mut workspace = Workspace::new(layout.clone());
+        command.apply(&mut workspace, false, &space(), permissions).unwrap();
+        assert_eq!(wrapped(&workspace.layout, "color"), Some(tabs("canvas")), "{:?}", workspace.layout);
+        // An area drawn with side edge zones never narrows its edge to the canvas column.
+        let mut workspace = Workspace::new(layout.clone());
+        command.apply(&mut workspace, false, &space().with_side_edge_zones(true), permissions).unwrap();
+        let mut whole = layout;
+        whole.floating.clear();
+        assert_eq!(wrapped(&workspace.layout, "color"), whole.root, "{:?}", workspace.layout);
+    }
+}
+
+#[test]
+fn dock_to_the_side_a_panel_already_leads_the_last_column_of() {
+    // Layers leads the dock's only column: it moves out to a new column after it.
+    let (workspace, _) = applied(json!({"command": "window.panel.dock", "panel": "layers", "side": "Start"}));
+    assert!(matches!(workspace.layout.place(&s("layers")), Some(dock_model::Place::Dock { column: 1, .. })));
+    assert!(matches!(workspace.layout.place(&s("channels")), Some(dock_model::Place::Dock { column: 0, .. })));
+    // The whole column already is the last one: nothing to do.
+    assert_eq!(actions(json!({"command": "window.panel.dock", "panel": "layers", "column": true, "side": "Start"})), vec![]);
+}
+
+#[test]
+fn showing_a_panel_never_laid_out_opens_it_in_the_first_dock_group_or_at_an_edge() {
+    // "brushes" is in neither the layout nor `hidden`.
+    for params in [
+        json!({"command": "window.panel.activate", "panel": "brushes"}),
+        json!({"command": "window.panel.dock", "panel": "brushes"}),
+        json!({"command": "ui.dock", "operation": "open", "panel": "brushes"}),
+    ] {
+        let (shown, _) = applied(params.clone());
+        assert!(
+            matches!(shown.layout.place(&s("brushes")), Some(dock_model::Place::Dock { column: 0, group: 0, .. })),
+            "{params}: {:?}",
+            shown.layout
+        );
+        assert_eq!(shown.layout.panel_state(&s("brushes")), PanelState::Front, "{params}");
+    }
+    // No dock, and the only frame is a protected canvas: a new frame at the edge, not a tab.
+    let mut workspace = Workspace::new(Layout { root: Some(Node::Tabs { panels: vec![s("canvas")], active: 0 }), floating: Vec::new() });
+    let command = parse(json!({"command": "window.panel.activate", "panel": "brushes"})).unwrap();
+    command.apply(&mut workspace, false, &space(), permissions).unwrap();
+    assert!(matches!(workspace.layout.place(&s("brushes")), Some(dock_model::Place::Node(_))), "{:?}", workspace.layout);
+    assert_ne!(workspace.layout.place(&s("brushes")), workspace.layout.place(&s("canvas")));
+}
diff --git a/crates/ui/src/docking/desktop.rs b/crates/ui/src/docking/desktop.rs
new file mode 100644
index 00000000..7fb47211
--- /dev/null
+++ b/crates/ui/src/docking/desktop.rs
@@ -0,0 +1,75 @@
+//! Which of the application's windows lies under a point on the desktop (feature
+//! `native-windows`). Points and rects are in desktop logical points.
+
+use egui::{Pos2, Rect};
+
+/// Where a desktop point falls.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(super) enum Over {
+    /// The floating native window with this [`super::Floating::id`], at this point in its own
+    /// coordinates.
+    Window(u64, Pos2),
+    /// The main window, at this point in its coordinates.
+    Main(Pos2),
+    /// None of the application's windows.
+    Desktop,
+}
+
+/// The window under `point`: the first of `windows` (floating native windows by id and desktop
+/// rect, front first) that holds it, where the first `front` of them lie in front of `main`
+/// (the main window's content) and the rest behind it. The window `dragged` follows the pointer
+/// by its bar and is never its own target.
+pub(super) fn window_at(point: Pos2, windows: &[(u64, Rect)], front: usize, main: Option<Rect>, dragged: Option<u64>) -> Over {
+    if !point.is_finite() {
+        return Over::Desktop;
+    }
+    let (before, behind) = windows.split_at(front.min(windows.len()));
+    let hit = |windows: &[(u64, Rect)]| {
+        windows.iter().find(|(id, rect)| Some(*id) != dragged && rect.contains(point)).map(|(id, rect)| Over::Window(*id, point - rect.min.to_vec2()))
+    };
+    hit(before)
+        .or_else(|| main.filter(|main| main.contains(point)).map(|main| Over::Main(point - main.min.to_vec2())))
+        .or_else(|| hit(behind))
+        .unwrap_or(Over::Desktop)
+}
+
+#[cfg(test)]
+mod tests {
+    use egui::{pos2, vec2};
+
+    use super::*;
+
+    fn rect(x: f32, y: f32, w: f32, h: f32) -> Rect {
+        Rect::from_min_size(pos2(x, y), vec2(w, h))
+    }
+
+    #[test]
+    fn the_front_window_wins_then_the_main_window_then_the_desktop() {
+        let main = Some(rect(100.0, 50.0, 800.0, 600.0));
+        // Window 2 lies over window 1, and both over the main window.
+        let windows = [(2, rect(300.0, 100.0, 200.0, 200.0)), (1, rect(250.0, 80.0, 200.0, 200.0))];
+        assert_eq!(window_at(pos2(350.0, 150.0), &windows, 2, main, None), Over::Window(2, pos2(50.0, 50.0)));
+        assert_eq!(window_at(pos2(260.0, 90.0), &windows, 2, main, None), Over::Window(1, pos2(10.0, 10.0)));
+        assert_eq!(window_at(pos2(120.0, 60.0), &windows, 2, main, None), Over::Main(pos2(20.0, 10.0)));
+        assert_eq!(window_at(pos2(20.0, 20.0), &windows, 2, main, None), Over::Desktop);
+        // A floating window outside the main window.
+        let windows = [(3, rect(1000.0, 0.0, 100.0, 100.0))];
+        assert_eq!(window_at(pos2(1050.0, 40.0), &windows, 2, main, None), Over::Window(3, pos2(50.0, 40.0)));
+        // Unknown main window, a point that is not one.
+        assert_eq!(window_at(pos2(120.0, 60.0), &[], 0, None, None), Over::Desktop);
+        assert_eq!(window_at(pos2(f32::NAN, 60.0), &windows, 2, main, None), Over::Desktop);
+        // A normal window behind the main window is reached only past the main window's edge.
+        let windows = [(4, rect(50.0, 40.0, 200.0, 200.0))];
+        assert_eq!(window_at(pos2(120.0, 60.0), &windows, 0, main, None), Over::Main(pos2(20.0, 10.0)));
+        assert_eq!(window_at(pos2(60.0, 45.0), &windows, 0, main, None), Over::Window(4, pos2(10.0, 5.0)));
+    }
+
+    #[test]
+    fn the_dragged_window_is_looked_through() {
+        let main = Some(rect(0.0, 0.0, 800.0, 600.0));
+        let windows = [(2, rect(300.0, 100.0, 200.0, 200.0)), (1, rect(250.0, 80.0, 200.0, 200.0))];
+        assert_eq!(window_at(pos2(350.0, 150.0), &windows, 2, main, Some(2)), Over::Window(1, pos2(100.0, 70.0)));
+        assert_eq!(window_at(pos2(350.0, 150.0), &windows, 2, main, Some(1)), Over::Window(2, pos2(50.0, 50.0)));
+        assert_eq!(window_at(pos2(480.0, 280.0), &windows, 2, main, Some(2)), Over::Main(pos2(480.0, 280.0)));
+    }
+}
diff --git a/crates/ui/src/docking/dock_model.rs b/crates/ui/src/docking/dock_model.rs
new file mode 100644
index 00000000..12e8468d
--- /dev/null
+++ b/crates/ui/src/docking/dock_model.rs
@@ -0,0 +1,998 @@
+//! Docks, columns, groups and floating windows: their types and the structural edits behind
+//! group, column and window moves.
+//!
+//! A group, column or floating window is named by a panel it contains. Edits run on a proposed
+//! copy of the layout, so a helper that fails part-way leaves nothing behind.
+
+use std::{collections::HashMap, hash::Hash};
+
+use super::model::{DockError, Floating, Layout, MAX_DEPTH, MAX_NODES, MAX_PANELS, Node, Placement, Zone, valid_height, valid_rect, valid_width};
+use crate::layout::{SplitAxis, SplitSize};
+
+/// Width of a new column when nothing better is known.
+pub(super) const DEFAULT_COLUMN_WIDTH: f32 = 240.0;
+/// Rect of a new floating window when the caller gives none and the source has no size.
+const DEFAULT_FLOAT: [f32; 4] = [48.0, 48.0, 260.0, 320.0];
+
+/// The window edge a [`Node::Dock`] sits on, in reading order so right-to-left interfaces
+/// mirror. `Start` is the edge of a horizontal split's first child (left in a left-to-right
+/// layout); the renderer maps it to a physical edge from the layout direction.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[non_exhaustive]
+pub enum Side {
+    Start,
+    End,
+}
+
+/// Tabs that move, minimize and size together in a dock column.
+#[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[cfg_attr(feature = "serde", serde(bound(deserialize = "P: serde::Deserialize<'de>")))]
+pub struct Group<P> {
+    pub panels: Vec<P>,
+    pub active: usize,
+    /// Only the tab strip shows. `height` is kept for when the group expands again.
+    #[cfg_attr(feature = "serde", serde(default))]
+    pub minimized: bool,
+    /// Preferred height in points, set when the user resizes the group; `None` shares the free
+    /// height of the column or stack, or in a dock column takes
+    /// [`DockContent::dock_heights`](crate::docking::DockContent::dock_heights).
+    #[cfg_attr(feature = "serde", serde(default))]
+    pub height: Option<f32>,
+}
+
+impl<P> Group<P> {
+    pub fn new(panels: Vec<P>, active: usize) -> Self {
+        Self { panels, active, minimized: false, height: None }
+    }
+
+    pub fn active_panel(&self) -> Option<&P> {
+        self.panels.get(self.active)
+    }
+}
+
+/// One column of a dock: groups from top to bottom.
+#[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[cfg_attr(feature = "serde", serde(bound(deserialize = "P: serde::Deserialize<'de>")))]
+pub struct Column<P> {
+    pub groups: Vec<Group<P>>,
+    /// Expanded width in points.
+    pub width: f32,
+    /// Collapsed to one icon per panel.
+    #[cfg_attr(feature = "serde", serde(default))]
+    pub iconic: bool,
+    /// Width while iconic; labels show beside the icons when it is wide enough.
+    #[cfg_attr(feature = "serde", serde(default))]
+    pub iconic_width: Option<f32>,
+}
+
+impl<P> Column<P> {
+    pub fn new(groups: Vec<Group<P>>, width: f32) -> Self {
+        Self { groups, width, iconic: false, iconic_width: None }
+    }
+}
+
+/// Where a group, column or floating window goes.
+#[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[non_exhaustive]
+pub enum Target<P> {
+    /// Relative to the panel `anchor`, which must not be part of what moves.
+    At { anchor: P, placement: Placement<P> },
+    /// A new dock on an edge that has none (or an empty one). The root becomes the other side
+    /// of a horizontal split.
+    NewDock { side: Side },
+    /// A new floating window. `None` keeps the source's size at a default position.
+    Float { rect: Option<[f32; 4]> },
+}
+
+impl<P: Clone + Eq + Hash> Placement<P> {
+    /// The placement for a drop zone on `anchor`'s group, in the vocabulary its container
+    /// accepts. `zone` is physical: `Left` is the left half on screen in either direction.
+    ///
+    /// | Anchor in | `Center` | `Top`, `Bottom` | `Left`, `Right` |
+    /// |---|---|---|---|
+    /// | the split tree or a floating window | [`Placement::Split`] | `Split` | `Split` |
+    /// | a dock column | `Split(Center)` (join as tabs) | [`Placement::Group`] above or below | [`Placement::Column`] on that side |
+    ///
+    /// A dock's `Column { after }` counts from its window edge, which depends on the dock's
+    /// side and `right_to_left` (see [`Side`]); this picks `after` so the new column lands on
+    /// the zone's side of the anchor's column.
+    pub fn for_zone(layout: &Layout<P>, anchor: &P, zone: Zone, right_to_left: bool) -> Result<Self, DockError> {
+        let place = layout.place(anchor).ok_or(DockError::MissingTarget)?;
+        Ok(match (place, zone) {
+            (Place::Node(_) | Place::Floating { .. }, zone) | (_, zone @ Zone::Center) => Placement::Split(zone),
+            (Place::Dock { .. }, Zone::Top | Zone::Bottom) => Placement::Group { below: zone == Zone::Bottom, height: None },
+            (Place::Dock { path, .. }, _) => {
+                let side = match layout.root.as_ref().and_then(|root| node_at(root, &path)) {
+                    Some(Node::Dock { side, .. }) => *side,
+                    _ => return Err(DockError::MissingTarget),
+                };
+                // The physical edge of the dock: Start is left in a left-to-right layout.
+                let left_edge = (side == Side::Start) != right_to_left;
+                // `after` is away from the window edge: rightwards for a left dock.
+                Placement::Column { after: (zone == Zone::Right) == left_edge }
+            }
+        })
+    }
+}
+
+/// What the Window menu shows for a panel. The model does not track the z-order of floating
+/// windows, so `Front` means "showing": the active tab of an expanded group in an expanded column.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum PanelState {
+    Hidden,
+    Open,
+    Front,
+}
+
+/// The group a closed panel was in, when that group was in a dock.
+#[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct GroupLocation {
+    pub minimized: bool,
+    pub height: Option<f32>,
+    /// The column, when the group was docked.
+    pub column: Option<ColumnLocation>,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct ColumnLocation {
+    pub side: Side,
+    pub width: f32,
+    pub iconic: bool,
+    pub iconic_width: Option<f32>,
+}
+
+/// Where a panel is. Paths lead from the root: false is a split's first child, true its second.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) enum Place {
+    /// A `Tabs` or `Stack` node.
+    Node(Vec<bool>),
+    Dock {
+        path: Vec<bool>,
+        column: usize,
+        group: usize,
+    },
+    /// A `Tabs` or `Stack` node of a floating window's tree.
+    Floating {
+        window: usize,
+        path: Vec<bool>,
+    },
+}
+
+impl Place {
+    /// The tree (`None` for the docked layout, else a floating window) and the path of a
+    /// `Tabs` or `Stack` node.
+    pub(super) fn tree_path(&self) -> Option<(Option<usize>, &[bool])> {
+        match self {
+            Place::Node(path) => Some((None, path)),
+            Place::Floating { window, path } => Some((Some(*window), path)),
+            Place::Dock { .. } => None,
+        }
+    }
+}
+
+/// Which container a whole-container action names.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum Unit {
+    Group,
+    Column,
+    Window,
+}
+
+/// Groups in transit, with the size and state of the container they came from.
+pub(super) struct Moving<P> {
+    pub groups: Vec<Group<P>>,
+    /// A floating window's whole tree, whose leaves are `groups`. A split or a new window
+    /// takes the tree; docks take the groups.
+    pub node: Option<Node<P>>,
+    pub minimized: bool,
+    pub width: Option<f32>,
+    pub iconic: bool,
+    pub iconic_width: Option<f32>,
+    pub rect: Option<[f32; 4]>,
+    pub native: Option<[f32; 4]>,
+    /// The id of a whole floating window in transit, which a new window keeps.
+    pub id: Option<u64>,
+}
+
+impl<P> Moving<P> {
+    pub fn group(group: Group<P>) -> Self {
+        Self { groups: vec![group], node: None, minimized: false, width: None, iconic: false, iconic_width: None, rect: None, native: None, id: None }
+    }
+
+    fn into_column(self, width: f32) -> Column<P> {
+        Column { groups: self.groups, width: self.width.unwrap_or(width), iconic: self.iconic, iconic_width: self.iconic_width }
+    }
+}
+
+pub(super) fn node_at<'a, P>(mut node: &'a Node<P>, path: &[bool]) -> Option<&'a Node<P>> {
+    for second_child in path {
+        let Node::Split { first, second, .. } = node else { return None };
+        node = if *second_child { second } else { first };
+    }
+    Some(node)
+}
+
+pub(super) fn node_at_mut<'a, P>(mut node: &'a mut Node<P>, path: &[bool]) -> Option<&'a mut Node<P>> {
+    for second_child in path {
+        let Node::Split { first, second, .. } = node else { return None };
+        node = if *second_child { second } else { first };
+    }
+    Some(node)
+}
+
+/// Every `Tabs`, `Stack` and `Dock` node of a tree with its path, first to last. Stops at
+/// [`MAX_NODES`] for an invalid tree.
+pub(super) fn leaves<P>(root: &Node<P>) -> Vec<(&Node<P>, Vec<bool>)> {
+    let mut out = Vec::new();
+    let mut visit = vec![(root, Vec::new())];
+    let mut visited = 0usize;
+    while let Some((node, path)) = visit.pop() {
+        visited = visited.saturating_add(1);
+        if visited > MAX_NODES {
+            break;
+        }
+        match node {
+            Node::Split { first, second, .. } => {
+                let mut second_path = path.clone();
+                second_path.push(true);
+                let mut first_path = path;
+                first_path.push(false);
+                visit.push((second, second_path));
+                visit.push((first, first_path));
+            }
+            leaf => out.push((leaf, path)),
+        }
+    }
+    out
+}
+
+/// The panels of a tree in order, without recursion; at most [`MAX_PANELS`].
+pub(super) fn tree_panels<P>(root: &Node<P>) -> Vec<&P> {
+    let mut panels = Vec::new();
+    for (leaf, _) in leaves(root) {
+        let room = MAX_PANELS.saturating_sub(panels.len());
+        match leaf {
+            Node::Tabs { panels: group, .. } => panels.extend(group.iter().take(room)),
+            Node::Stack { entries } => panels.extend(entries.iter().map(|e| &e.panel).take(room)),
+            Node::Dock { columns, .. } => panels.extend(columns.iter().flat_map(|c| &c.groups).flat_map(|g| &g.panels).take(room)),
+            Node::Split { .. } => {}
+        }
+    }
+    panels
+}
+
+/// The shown panel of a tree's first group.
+#[cfg(feature = "native-windows")]
+pub(super) fn first_active<P>(root: &Node<P>) -> Option<&P> {
+    match leaves(root).into_iter().next()?.0 {
+        Node::Tabs { panels, active } => panels.get(*active),
+        Node::Stack { entries } => entries.first().map(|e| &e.panel),
+        Node::Split { .. } | Node::Dock { .. } => None,
+    }
+}
+
+/// The groups of a tree, first to last: what a dock column takes from a floating window.
+pub(super) fn tree_groups<P: Clone>(root: &Node<P>) -> Vec<Group<P>> {
+    let mut groups = Vec::new();
+    for (leaf, _) in leaves(root) {
+        match leaf {
+            Node::Tabs { panels, active } => groups.push(Group::new(panels.clone(), *active)),
+            Node::Stack { entries } => groups.push(Group::new(entries.iter().map(|e| e.panel.clone()).collect(), 0)),
+            Node::Dock { columns, .. } => groups.extend(columns.iter().flat_map(|c| c.groups.iter().cloned())),
+            Node::Split { .. } => {}
+        }
+    }
+    groups
+}
+
+/// Groups stacked top to bottom as a tree: each group over a vertical split of the ones below
+/// it, sized by their heights, with an equal share where a group has none.
+pub(super) fn stack_tree<P>(groups: Vec<Group<P>>) -> Option<Node<P>> {
+    let height = |g: &Group<P>| g.height.filter(|h| h.is_finite() && *h > 0.0);
+    let known: Vec<f32> = groups.iter().filter_map(height).collect();
+    let share = if known.is_empty() { 1.0 } else { known.iter().sum::<f32>() / known.len() as f32 };
+    let weights: Vec<f32> = groups.iter().map(|g| height(g).unwrap_or(share)).collect();
+    let mut node = None;
+    let mut below = 0.0;
+    for (group, weight) in groups.into_iter().zip(weights).rev() {
+        let tabs = Node::Tabs { panels: group.panels, active: group.active };
+        node = Some(match node {
+            None => tabs,
+            Some(rest) => {
+                let ratio = (weight / (weight + below)).clamp(0.0, 1.0);
+                Node::Split { axis: SplitAxis::Vertical, size: SplitSize::Ratio(ratio), first: Box::new(tabs), second: Box::new(rest) }
+            }
+        });
+        below += weight;
+    }
+    node
+}
+
+/// Put `new` on the `zone` side of the frame at `path`: the frame splits into two halves and
+/// every other frame keeps its size.
+pub(super) fn split_frame<P>(root: &mut Node<P>, path: &[bool], new: Node<P>, zone: Zone) -> bool {
+    let axis = if matches!(zone, Zone::Top | Zone::Bottom) { SplitAxis::Vertical } else { SplitAxis::Horizontal };
+    let new_first = matches!(zone, Zone::Top | Zone::Left);
+    let Some(node) = node_at_mut(root, path) else { return false };
+    let old = std::mem::replace(node, Node::Tabs { panels: Vec::new(), active: 0 });
+    let (first, second) = if new_first { (new, old) } else { (old, new) };
+    *node = Node::Split { axis, size: SplitSize::Ratio(0.5), first: Box::new(first), second: Box::new(second) };
+    true
+}
+
+/// The depth along the frame `path` of the split whose size a [`Placement::SplitSized`] on
+/// `zone` replaces: the nearest enclosing split along the zone's axis (`on_axis` at a depth)
+/// whose divider runs along the frame's `zone` side, else, for a frame at the edge of its
+/// area on that side, the nearest one along its opposite side.
+pub(super) fn sized_split_depth(path: &[bool], zone: Zone, on_axis: impl Fn(usize) -> bool) -> Option<usize> {
+    // A divider on the frame's start side (left or top) belongs to a split holding the frame
+    // in its second child.
+    let start = matches!(zone, Zone::Left | Zone::Top);
+    let nearest = |second: bool| (0..path.len()).rev().find(|&depth| path.get(depth) == Some(&second) && on_axis(depth));
+    nearest(start).or_else(|| nearest(!start))
+}
+
+/// [`split_frame`] with the sizes of [`Placement::SplitSized`]: the new split takes `size`, and
+/// the split [`sized_split_depth`] finds takes `outer`. False when there is no such split, or a
+/// dock is beyond it.
+pub(super) fn split_frame_sized<P>(root: &mut Node<P>, path: &[bool], new: Node<P>, zone: Zone, size: SplitSize, outer: SplitSize) -> bool {
+    let axis = if matches!(zone, Zone::Top | Zone::Bottom) { SplitAxis::Vertical } else { SplitAxis::Horizontal };
+    let enclosing =
+        sized_split_depth(path, zone, |depth| matches!(node_at(root, &path[..depth]), Some(Node::Split { axis: own, .. }) if *own == axis));
+    let Some(depth) = enclosing else { return false };
+    let Some(Node::Split { size: own, first, second, .. }) = node_at_mut(root, &path[..depth]) else { return false };
+    if zone == Zone::Center || matches!(**first, Node::Dock { .. }) || matches!(**second, Node::Dock { .. }) {
+        return false;
+    }
+    *own = outer;
+    if !split_frame(root, path, new, zone) {
+        return false;
+    }
+    match node_at_mut(root, path) {
+        Some(Node::Split { size: own, .. }) => {
+            *own = size;
+            true
+        }
+        _ => false,
+    }
+}
+
+/// Insert `new` at `index` and select the member at `index + selected`.
+fn splice<P>(panels: &mut Vec<P>, active: &mut usize, index: usize, new: Vec<P>, selected: usize) {
+    let index = index.min(panels.len());
+    let count = new.len();
+    panels.splice(index..index, new);
+    *active = index + selected.min(count.saturating_sub(1));
+}
+
+impl<P: Clone + Eq + Hash> Layout<P> {
+    /// The layout without its sizes and rectangles: which panels are where, and their state.
+    /// A run of splits along one axis nests one way (`a | (b | c)`), since nesting it the
+    /// other way only moves sizes between its members.
+    pub(super) fn shape(&self) -> Layout<P> {
+        fn run<'a, P>(node: &'a Node<P>, axis: SplitAxis, out: &mut Vec<&'a Node<P>>) {
+            match node {
+                Node::Split { axis: own, first, second, .. } if *own == axis => {
+                    run(first, axis, out);
+                    run(second, axis, out);
+                }
+                node => out.push(node),
+            }
+        }
+        fn node<P: Clone>(n: &Node<P>) -> Node<P> {
+            match n {
+                Node::Split { axis, .. } => {
+                    let mut members = Vec::new();
+                    run(n, *axis, &mut members);
+                    let mut shaped = members.into_iter().rev().map(node);
+                    let last = shaped.next().unwrap_or(Node::Tabs { panels: Vec::new(), active: 0 });
+                    shaped.fold(last, |second, first| Node::Split {
+                        axis: *axis,
+                        size: SplitSize::Ratio(0.5),
+                        first: Box::new(first),
+                        second: Box::new(second),
+                    })
+                }
+                Node::Tabs { panels, active } => Node::Tabs { panels: panels.clone(), active: *active },
+                Node::Stack { entries } => Node::Stack { entries: entries.iter().map(|e| super::StackEntry { height: None, ..e.clone() }).collect() },
+                Node::Dock { side, columns } => Node::Dock {
+                    side: *side,
+                    columns: columns
+                        .iter()
+                        .map(|c| Column {
+                            groups: c.groups.iter().map(|g| Group { height: None, ..g.clone() }).collect(),
+                            width: 0.0,
+                            iconic: c.iconic,
+                            iconic_width: None,
+                        })
+                        .collect(),
+                },
+            }
+        }
+        Layout {
+            root: self.root.as_ref().map(node),
+            floating: self
+                .floating
+                .iter()
+                .map(|w| Floating { root: node(&w.root), rect: [0.0; 4], native: None, monitor: None, monitor_size: None, ..w.clone() })
+                .collect(),
+        }
+    }
+
+    /// Whether `other` arranges the panels as this layout does: equal apart from split sizes,
+    /// column widths, group heights and window rectangles. A drop that leads from one to the
+    /// other changes nothing the user would see as a move.
+    pub(super) fn same_arrangement(&self, other: &Self) -> bool {
+        self.shape() == other.shape()
+    }
+
+    pub(super) fn place(&self, panel: &P) -> Option<Place> {
+        for (w, window) in self.floating.iter().enumerate() {
+            for (leaf, path) in leaves(&window.root) {
+                if leaf_holds(leaf, panel) {
+                    return Some(Place::Floating { window: w, path });
+                }
+            }
+        }
+        for (leaf, path) in self.root.as_ref().map(leaves).unwrap_or_default() {
+            match leaf {
+                Node::Dock { columns, .. } => {
+                    for (c, column) in columns.iter().enumerate() {
+                        if let Some(g) = column.groups.iter().position(|group| group.panels.contains(panel)) {
+                            return Some(Place::Dock { path, column: c, group: g });
+                        }
+                    }
+                }
+                leaf if leaf_holds(leaf, panel) => return Some(Place::Node(path)),
+                _ => {}
+            }
+        }
+        None
+    }
+
+    /// [`Self::place`] of every panel, from one traversal: the renderer looks up many panels a
+    /// frame.
+    pub(super) fn places(&self) -> HashMap<P, Place> {
+        fn note<P: Clone + Eq + Hash>(places: &mut HashMap<P, Place>, leaf: &Node<P>, place: &dyn Fn() -> Place) {
+            match leaf {
+                Node::Tabs { panels, .. } => {
+                    for panel in panels {
+                        places.entry(panel.clone()).or_insert_with(place);
+                    }
+                }
+                Node::Stack { entries } => {
+                    for entry in entries {
+                        places.entry(entry.panel.clone()).or_insert_with(place);
+                    }
+                }
+                _ => {}
+            }
+        }
+        let mut places = HashMap::new();
+        for (w, window) in self.floating.iter().enumerate() {
+            for (leaf, path) in leaves(&window.root) {
+                note(&mut places, leaf, &|| Place::Floating { window: w, path: path.clone() });
+            }
+        }
+        for (leaf, path) in self.root.as_ref().map(leaves).unwrap_or_default() {
+            if let Node::Dock { columns, .. } = leaf {
+                for (c, column) in columns.iter().enumerate() {
+                    for (g, group) in column.groups.iter().enumerate() {
+                        for panel in &group.panels {
+                            places.entry(panel.clone()).or_insert_with(|| Place::Dock { path: path.clone(), column: c, group: g });
+                        }
+                    }
+                }
+            } else {
+                note(&mut places, leaf, &|| Place::Node(path.clone()));
+            }
+        }
+        places
+    }
+
+    /// The docked layout (`None`) or a floating window's tree.
+    pub(super) fn tree(&self, window: Option<usize>) -> Option<&Node<P>> {
+        match window {
+            None => self.root.as_ref(),
+            Some(window) => self.floating.get(window).map(|w| &w.root),
+        }
+    }
+
+    pub(super) fn tree_mut(&mut self, window: Option<usize>) -> Option<&mut Node<P>> {
+        match window {
+            None => self.root.as_mut(),
+            Some(window) => self.floating.get_mut(window).map(|w| &mut w.root),
+        }
+    }
+
+    /// The docked layout's tree, then each floating window's.
+    pub(super) fn trees_mut(&mut self) -> impl Iterator<Item = &mut Node<P>> {
+        self.root.iter_mut().chain(self.floating.iter_mut().map(|w| &mut w.root))
+    }
+
+    /// The `Tabs` or `Stack` node at a tree place.
+    pub(super) fn node_of(&self, place: &Place) -> Option<&Node<P>> {
+        let (window, path) = place.tree_path()?;
+        node_at(self.tree(window)?, path)
+    }
+
+    fn node_of_mut(&mut self, place: &Place) -> Option<&mut Node<P>> {
+        let (window, path) = place.tree_path()?;
+        node_at_mut(self.tree_mut(window)?, path)
+    }
+
+    pub(super) fn dock_path(&self, side: Side) -> Option<Vec<bool>> {
+        let mut visit: Vec<(&Node<P>, Vec<bool>)> = self.root.iter().map(|node| (node, Vec::new())).collect();
+        let mut visited = 0usize;
+        while let Some((node, path)) = visit.pop() {
+            visited = visited.saturating_add(1);
+            if visited > MAX_NODES {
+                return None;
+            }
+            match node {
+                Node::Split { first, second, .. } => {
+                    let mut second_path = path.clone();
+                    second_path.push(true);
+                    let mut first_path = path;
+                    first_path.push(false);
+                    visit.push((second, second_path));
+                    visit.push((first, first_path));
+                }
+                Node::Dock { side: s, .. } if *s == side => return Some(path),
+                _ => {}
+            }
+        }
+        None
+    }
+
+    /// The node an edge split at `zone` wraps: the root, or the part between the docks. Where
+    /// neither side of a side-by-side split is a dock and only one holds a `canvas` panel,
+    /// that side: the canvas column, without the side frames. A top (bottom) edge also
+    /// descends a split of rows into its first (last) row when only that row holds a `canvas`
+    /// panel, so a full-width row below (above) the canvas keeps its edge.
+    pub(in crate::docking) fn edge_path(&self, zone: Zone, canvas: &dyn Fn(&P) -> bool) -> Vec<bool> {
+        let holds = |node: &Node<P>| tree_panels(node).into_iter().any(canvas);
+        let mut path = Vec::new();
+        let mut node = self.root.as_ref();
+        while let Some(Node::Split { axis, first, second, .. }) = node {
+            if path.len() > MAX_DEPTH {
+                break;
+            }
+            let second_side = match (axis, &**first, &**second) {
+                (SplitAxis::Horizontal, Node::Dock { .. }, _) => true,
+                (SplitAxis::Horizontal, _, Node::Dock { .. }) => false,
+                (SplitAxis::Vertical, ..) => match (zone, holds(first), holds(second)) {
+                    (Zone::Top, true, false) => false,
+                    (Zone::Bottom, false, true) => true,
+                    _ => break,
+                },
+                _ => match (holds(first), holds(second)) {
+                    (true, false) => false,
+                    (false, true) => true,
+                    _ => break,
+                },
+            };
+            path.push(second_side);
+            node = Some(if second_side { second } else { first });
+        }
+        path
+    }
+
+    /// Whether an edge drop at `zone` that narrows by `canvas` wraps less than one that does
+    /// not: the edge area is narrower than the part between the docks.
+    pub(in crate::docking) fn edge_narrows(&self, zone: Zone, canvas: &dyn Fn(&P) -> bool) -> bool {
+        self.edge_path(zone, canvas) != self.edge_path(zone, &|_| false)
+    }
+
+    /// The docked panel, other than `skip`, that a [`Placement::Edge`] anchors on so the drop
+    /// wraps the edge area it shows: a `protected` one where that area is narrowed to the
+    /// canvas column (`narrowed`), else one that is not protected, since a protected anchor
+    /// narrows the model's edge. Any docked panel when every one is protected.
+    pub(in crate::docking) fn edge_anchor(&self, narrowed: bool, protected: &dyn Fn(&P) -> bool, skip: &dyn Fn(&P) -> bool) -> Option<P> {
+        let docked: Vec<&P> =
+            self.panels().into_iter().filter(|p| !skip(p) && matches!(self.place(p), Some(Place::Dock { .. } | Place::Node(_)))).collect();
+        docked.iter().find(|p| protected(p) == narrowed).or(docked.first()).map(|p| (*p).clone())
+    }
+
+    pub(super) fn columns_mut(&mut self, path: &[bool]) -> Option<&mut Vec<Column<P>>> {
+        match self.root.as_mut().and_then(|root| node_at_mut(root, path)) {
+            Some(Node::Dock { columns, .. }) => Some(columns),
+            _ => None,
+        }
+    }
+
+    pub(super) fn column(&self, place: &Place) -> Option<&Column<P>> {
+        let Place::Dock { path, column, .. } = place else { return None };
+        match self.root.as_ref().and_then(|root| node_at(root, path)) {
+            Some(Node::Dock { columns, .. }) => columns.get(*column),
+            _ => None,
+        }
+    }
+
+    pub(super) fn column_mut(&mut self, place: &Place) -> Option<&mut Column<P>> {
+        let Place::Dock { path, column, .. } = place else { return None };
+        self.columns_mut(path)?.get_mut(*column)
+    }
+
+    /// The dock group at `place`; `None` for a `Tabs` or `Stack` node.
+    pub(super) fn group(&self, place: &Place) -> Option<&Group<P>> {
+        match place {
+            Place::Dock { group, .. } => self.column(place)?.groups.get(*group),
+            Place::Node(_) | Place::Floating { .. } => None,
+        }
+    }
+
+    pub(super) fn group_mut(&mut self, place: &Place) -> Option<&mut Group<P>> {
+        match place {
+            Place::Dock { group, .. } => self.column_mut(place)?.groups.get_mut(*group),
+            Place::Node(_) | Place::Floating { .. } => None,
+        }
+    }
+
+    /// Remove the node at `path` of the docked layout; its parent split collapses into the
+    /// sibling.
+    pub(super) fn take_node(&mut self, path: &[bool]) -> Option<Node<P>> {
+        self.take_node_in(None, path)
+    }
+
+    /// [`Self::take_node`] in the docked layout (`None`) or a floating window, which closes
+    /// when its root goes.
+    fn take_node_in(&mut self, window: Option<usize>, path: &[bool]) -> Option<Node<P>> {
+        let Some((second_child, parent_path)) = path.split_last() else {
+            return match window {
+                None => self.root.take(),
+                Some(window) => (window < self.floating.len()).then(|| self.floating.remove(window).root),
+            };
+        };
+        let parent = self.tree_mut(window).and_then(|root| node_at_mut(root, parent_path))?;
+        if !matches!(parent, Node::Split { .. }) {
+            return None;
+        }
+        match std::mem::replace(parent, Node::Tabs { panels: Vec::new(), active: 0 }) {
+            Node::Split { first, second, .. } => {
+                let (taken, kept) = if *second_child { (second, first) } else { (first, second) };
+                *parent = *kept;
+                Some(*taken)
+            }
+            other => {
+                *parent = other;
+                None
+            }
+        }
+    }
+
+    /// The members of the group, column or floating window containing `panel`, in order.
+    /// An accordion entry is a group of one.
+    pub(super) fn members(&self, panel: &P, unit: Unit) -> Result<Vec<P>, DockError> {
+        let place = self.place(panel).ok_or(DockError::MissingPanel)?;
+        match (unit, &place) {
+            (Unit::Group, Place::Node(_) | Place::Floating { .. }) => match self.node_of(&place) {
+                Some(Node::Tabs { panels, .. }) => Ok(panels.clone()),
+                Some(Node::Stack { .. }) => Ok(vec![panel.clone()]),
+                _ => Err(DockError::MissingPanel),
+            },
+            (Unit::Group, _) => self.group(&place).map(|g| g.panels.clone()).ok_or(DockError::MissingPanel),
+            (Unit::Column, Place::Dock { .. }) => {
+                let column = self.column(&place).ok_or(DockError::MissingPanel)?;
+                Ok(column.groups.iter().flat_map(|g| g.panels.iter().cloned()).collect())
+            }
+            (Unit::Window, Place::Floating { window, .. }) => {
+                let window = self.floating.get(*window).ok_or(DockError::MissingPanel)?;
+                Ok(window.panels().cloned().collect())
+            }
+            (Unit::Column | Unit::Window, _) => Err(DockError::InvalidPlacement),
+        }
+    }
+
+    pub(super) fn take_unit(&mut self, panel: &P, unit: Unit) -> Result<Moving<P>, DockError> {
+        match unit {
+            Unit::Group => self.take_group(panel),
+            Unit::Column => self.take_column(panel),
+            Unit::Window => self.take_window(panel),
+        }
+    }
+
+    fn take_group(&mut self, panel: &P) -> Result<Moving<P>, DockError> {
+        let place = self.place(panel).ok_or(DockError::MissingPanel)?;
+        match place {
+            Place::Node(_) | Place::Floating { .. } => {
+                let (window, path) = place.tree_path().map(|(w, p)| (w, p.to_vec())).ok_or(DockError::MissingPanel)?;
+                // A group leaving a floating window keeps its width; the window's only group
+                // takes the window's rect along.
+                let source = window.and_then(|w| self.floating.get(w)).map(|w| (w.rect, w.native, w.minimized, w.id));
+                let whole = |moving: Moving<P>| match source {
+                    Some((rect, native, minimized, id)) if path.is_empty() => {
+                        Moving { width: rect.get(2).copied(), rect: Some(rect), native, minimized, id: Some(id), ..moving }
+                    }
+                    Some((rect, ..)) => Moving { width: rect.get(2).copied(), ..moving },
+                    None => moving,
+                };
+                if let Some(Node::Stack { entries }) = self.node_of_mut(&place)
+                    && entries.len() > 1
+                    && let Some(index) = entries.iter().position(|e| &e.panel == panel)
+                {
+                    let entry = entries.remove(index);
+                    let group = Group { panels: vec![entry.panel], active: 0, minimized: !entry.open, height: entry.height };
+                    let moving = whole(Moving::group(group));
+                    return Ok(Moving { rect: None, native: None, id: None, ..moving });
+                }
+                match self.take_node_in(window, &path) {
+                    Some(Node::Tabs { panels, active }) => Ok(whole(Moving::group(Group::new(panels, active)))),
+                    Some(Node::Stack { mut entries }) if entries.len() == 1 => {
+                        let entry = entries.remove(0);
+                        Ok(whole(Moving::group(Group { panels: vec![entry.panel], active: 0, minimized: !entry.open, height: entry.height })))
+                    }
+                    _ => Err(DockError::MissingPanel),
+                }
+            }
+            Place::Dock { path, column, group } => {
+                let columns = self.columns_mut(&path).ok_or(DockError::MissingPanel)?;
+                let source = columns.get_mut(column).ok_or(DockError::MissingPanel)?;
+                if group >= source.groups.len() {
+                    return Err(DockError::MissingPanel);
+                }
+                let taken = source.groups.remove(group);
+                let width = source.width;
+                if source.groups.is_empty() {
+                    columns.remove(column);
+                }
+                if columns.is_empty() {
+                    self.take_node(&path);
+                }
+                Ok(Moving { width: Some(width), ..Moving::group(taken) })
+            }
+        }
+    }
+
+    fn take_column(&mut self, panel: &P) -> Result<Moving<P>, DockError> {
+        let Some(Place::Dock { path, column, .. }) = self.place(panel) else { return Err(DockError::InvalidPlacement) };
+        let columns = self.columns_mut(&path).ok_or(DockError::MissingPanel)?;
+        if column >= columns.len() {
+            return Err(DockError::MissingPanel);
+        }
+        let taken = columns.remove(column);
+        if columns.is_empty() {
+            self.take_node(&path);
+        }
+        Ok(Moving {
+            groups: taken.groups,
+            node: None,
+            minimized: false,
+            width: Some(taken.width),
+            iconic: taken.iconic,
+            iconic_width: taken.iconic_width,
+            rect: None,
+            native: None,
+            id: None,
+        })
+    }
+
+    fn take_window(&mut self, panel: &P) -> Result<Moving<P>, DockError> {
+        let Some(Place::Floating { window, .. }) = self.place(panel) else { return Err(DockError::InvalidPlacement) };
+        if window >= self.floating.len() {
+            return Err(DockError::MissingPanel);
+        }
+        let taken = self.floating.remove(window);
+        Ok(Moving {
+            groups: tree_groups(&taken.root),
+            node: Some(taken.root),
+            minimized: taken.minimized,
+            width: taken.rect.get(2).copied(),
+            iconic: false,
+            iconic_width: None,
+            rect: Some(taken.rect),
+            native: taken.native,
+            id: Some(taken.id),
+        })
+    }
+
+    /// Insert groups taken by [`Self::take_unit`] (or a new single-panel group).
+    /// `canvas` is the protected-panel test an outer edge drop narrows by ([`Self::edge_path`]).
+    pub(super) fn insert_moving(&mut self, moving: Moving<P>, to: Target<P>, canvas: &dyn Fn(&P) -> bool) -> Result<(), DockError> {
+        if moving.groups.is_empty() || moving.groups.iter().any(|g| g.panels.is_empty()) {
+            return Err(DockError::MissingPanel);
+        }
+        match to {
+            Target::Float { rect } => {
+                let native = if rect.is_none() { moving.native } else { None };
+                let rect = rect.or(moving.rect).unwrap_or_else(|| {
+                    let [x, y, width, height] = DEFAULT_FLOAT;
+                    [x, y, moving.width.unwrap_or(width), height]
+                });
+                if !valid_rect(rect) {
+                    return Err(DockError::InvalidGeometry);
+                }
+                let root = match moving.node {
+                    Some(node) => node,
+                    None => stack_tree(moving.groups).ok_or(DockError::MissingPanel)?,
+                };
+                let window = Floating { native, minimized: moving.minimized, ..Floating::new(root, rect) };
+                self.floating.push(Floating { id: moving.id.unwrap_or(window.id), ..window });
+                Ok(())
+            }
+            Target::NewDock { side } => {
+                if let Some(path) = self.dock_path(side) {
+                    let columns = self.columns_mut(&path).ok_or(DockError::MissingTarget)?;
+                    if !columns.is_empty() {
+                        return Err(DockError::InvalidPlacement);
+                    }
+                    columns.push(moving.into_column(DEFAULT_COLUMN_WIDTH));
+                    return Ok(());
+                }
+                let column = moving.into_column(DEFAULT_COLUMN_WIDTH);
+                self.add_dock(side, column);
+                Ok(())
+            }
+            Target::At { anchor, placement } => {
+                let place = self.place(&anchor).ok_or(DockError::MissingTarget)?;
+                match placement {
+                    Placement::Tab { before } => {
+                        let index = match &before {
+                            Some(before) => {
+                                if self.place(before).as_ref() != Some(&place) {
+                                    return Err(DockError::MissingTarget);
+                                }
+                                self.index_in(&place, before)
+                            }
+                            None => None,
+                        };
+                        self.merge(&place, index, moving)
+                    }
+                    Placement::Split(Zone::Center) => {
+                        let index = self.index_in(&place, &anchor).map(|i| i + 1);
+                        self.merge(&place, index, moving)
+                    }
+                    Placement::Split(zone) => {
+                        let (window, path) = place.tree_path().ok_or(DockError::InvalidPlacement)?;
+                        let new = match moving.node {
+                            Some(node) => node,
+                            None => {
+                                let (panels, active) = flatten(moving.groups);
+                                Node::Tabs { panels, active }
+                            }
+                        };
+                        let root = self.tree_mut(window).ok_or(DockError::MissingTarget)?;
+                        if split_frame(root, path, new, zone) { Ok(()) } else { Err(DockError::MissingTarget) }
+                    }
+                    Placement::SplitSized { zone, size, outer } => {
+                        let (window, path) = place.tree_path().ok_or(DockError::InvalidPlacement)?;
+                        let new = match moving.node {
+                            Some(node) => node,
+                            None => {
+                                let (panels, active) = flatten(moving.groups);
+                                Node::Tabs { panels, active }
+                            }
+                        };
+                        let root = self.tree_mut(window).ok_or(DockError::MissingTarget)?;
+                        if split_frame_sized(root, path, new, zone, size, outer) { Ok(()) } else { Err(DockError::InvalidPlacement) }
+                    }
+                    // A floating window is a tree: a group above or below splits the anchor's group.
+                    Placement::Group { below, .. } if matches!(place, Place::Floating { .. }) => {
+                        let zone = if below { Zone::Bottom } else { Zone::Top };
+                        self.insert_moving(moving, Target::At { anchor, placement: Placement::Split(zone) }, canvas)
+                    }
+                    Placement::Group { below, height } => {
+                        if !valid_height(height) {
+                            return Err(DockError::InvalidGeometry);
+                        }
+                        let mut moving = moving;
+                        if height.is_some() {
+                            moving.groups.iter_mut().for_each(|group| group.height = height);
+                        }
+                        let (groups, index) = match &place {
+                            Place::Dock { group, .. } => (&mut self.column_mut(&place).ok_or(DockError::MissingTarget)?.groups, *group),
+                            Place::Node(_) | Place::Floating { .. } => return Err(DockError::InvalidPlacement),
+                        };
+                        let index = (index + usize::from(below)).min(groups.len());
+                        groups.splice(index..index, moving.groups);
+                        Ok(())
+                    }
+                    Placement::Edge(zone) => {
+                        if zone == Zone::Center || matches!(place, Place::Floating { .. }) {
+                            return Err(DockError::InvalidPlacement);
+                        }
+                        // A protected anchor narrows the edge to the canvas column.
+                        let path = if canvas(&anchor) { self.edge_path(zone, canvas) } else { self.edge_path(zone, &|_| false) };
+                        let node = self.root.as_mut().and_then(|root| node_at_mut(root, &path)).ok_or(DockError::MissingTarget)?;
+                        if matches!(node, Node::Dock { .. }) {
+                            return Err(DockError::InvalidPlacement);
+                        }
+                        let (panels, active) = flatten(moving.groups);
+                        let new = Node::Tabs { panels, active };
+                        let old = std::mem::replace(node, Node::Tabs { panels: Vec::new(), active: 0 });
+                        let axis = if matches!(zone, Zone::Top | Zone::Bottom) { SplitAxis::Vertical } else { SplitAxis::Horizontal };
+                        let (first, second, size) = if matches!(zone, Zone::Top | Zone::Left) { (new, old, 0.25) } else { (old, new, 0.75) };
+                        *node = Node::Split { axis, size: SplitSize::Ratio(size), first: Box::new(first), second: Box::new(second) };
+                        Ok(())
+                    }
+                    Placement::Column { after } => {
+                        let Place::Dock { path, column, .. } = &place else { return Err(DockError::InvalidPlacement) };
+                        let columns = self.columns_mut(path).ok_or(DockError::MissingTarget)?;
+                        let width = columns.get(*column).map_or(DEFAULT_COLUMN_WIDTH, |c| c.width);
+                        let index = (column + usize::from(after)).min(columns.len());
+                        columns.insert(index, moving.into_column(width));
+                        Ok(())
+                    }
+                }
+            }
+        }
+    }
+
+    /// Wrap the root in a horizontal split with a new dock on `side`. The split's fixed size is
+    /// the column width.
+    pub(super) fn add_dock(&mut self, side: Side, column: Column<P>) {
+        let width = column.width;
+        let dock = Node::Dock { side, columns: vec![column] };
+        self.root = Some(match self.root.take() {
+            None => dock,
+            Some(root) => {
+                let (first, second, size) = match side {
+                    Side::Start => (dock, root, SplitSize::FixedFirst(width)),
+                    Side::End => (root, dock, SplitSize::FixedSecond(width)),
+                };
+                Node::Split { axis: SplitAxis::Horizontal, size, first: Box::new(first), second: Box::new(second) }
+            }
+        });
+    }
+
+    fn index_in(&self, place: &Place, panel: &P) -> Option<usize> {
+        match place {
+            Place::Node(_) | Place::Floating { .. } => match self.node_of(place)? {
+                Node::Tabs { panels, .. } => panels.iter().position(|p| p == panel),
+                Node::Stack { entries } => entries.iter().position(|e| &e.panel == panel),
+                _ => None,
+            },
+            _ => self.group(place)?.panels.iter().position(|p| p == panel),
+        }
+    }
+
+    /// Join every moving panel to the group at `place`, before `index` or at the end. The first
+    /// moving group's active panel becomes active.
+    fn merge(&mut self, place: &Place, index: Option<usize>, moving: Moving<P>) -> Result<(), DockError> {
+        let (panels, selected) = flatten(moving.groups);
+        match place {
+            Place::Node(_) | Place::Floating { .. } => match self.node_of_mut(place) {
+                Some(Node::Tabs { panels: target, active }) => {
+                    splice(target, active, index.unwrap_or(target.len()), panels, selected);
+                    Ok(())
+                }
+                Some(Node::Stack { entries }) => {
+                    let index = index.unwrap_or(entries.len()).min(entries.len());
+                    entries.splice(index..index, panels.into_iter().map(|panel| super::StackEntry { panel, open: true, height: None }));
+                    Ok(())
+                }
+                _ => Err(DockError::MissingTarget),
+            },
+            _ => {
+                let group = self.group_mut(place).ok_or(DockError::MissingTarget)?;
+                let end = group.panels.len();
+                splice(&mut group.panels, &mut group.active, index.unwrap_or(end), panels, selected);
+                Ok(())
+            }
+        }
+    }
+}
+
+fn leaf_holds<P: PartialEq>(leaf: &Node<P>, panel: &P) -> bool {
+    match leaf {
+        Node::Tabs { panels, .. } => panels.contains(panel),
+        Node::Stack { entries } => entries.iter().any(|e| &e.panel == panel),
+        Node::Split { .. } | Node::Dock { .. } => false,
+    }
+}
+
+/// All panels in order, and the index of the first group's active panel among them.
+fn flatten<P>(groups: Vec<Group<P>>) -> (Vec<P>, usize) {
+    let selected = groups.first().map_or(0, |g| g.active.min(g.panels.len().saturating_sub(1)));
+    (groups.into_iter().flat_map(|g| g.panels).collect(), selected)
+}
+
+pub(super) fn valid_column<P>(column: &Column<P>) -> bool {
+    valid_width(column.width) && column.iconic_width.is_none_or(valid_width)
+}
diff --git a/crates/ui/src/docking/dock_tests.rs b/crates/ui/src/docking/dock_tests.rs
new file mode 100644
index 00000000..a984f696
--- /dev/null
+++ b/crates/ui/src/docking/dock_tests.rs
@@ -0,0 +1,1061 @@
+//! [D] Docks: columns, stacked groups, seams, column bars and their drops.
+
+use super::*;
+use crate::layout::{SplitAxis, SplitSize};
+use egui::{Context, Event, Id, Modifiers, PointerButton, Pos2, RawInput, Rect, UiBuilder, pos2, vec2};
+
+const AREA: &str = "dock-area";
+
+fn group(panels: &[u32]) -> Group<u32> {
+    Group::new(panels.to_vec(), 0)
+}
+
+/// A dock on `side` with `columns` (each a list of groups, 240 wide) beside canvas 0.
+fn docked(side: Side, columns: &[&[&[u32]]]) -> Layout<u32> {
+    let dock = Node::Dock { side, columns: columns.iter().map(|groups| Column::new(groups.iter().map(|g| group(g)).collect(), 240.0)).collect() };
+    let canvas = Node::Tabs { panels: vec![0], active: 0 };
+    let (first, second, size) = match side {
+        Side::Start => (dock, canvas, SplitSize::FixedFirst(240.0)),
+        Side::End => (canvas, dock, SplitSize::FixedSecond(240.0)),
+    };
+    Layout { root: Some(Node::Split { axis: SplitAxis::Horizontal, size, first: Box::new(first), second: Box::new(second) }), floating: Vec::new() }
+}
+
+fn with_floating(mut layout: Layout<u32>, windows: &[(u32, [f32; 4])]) -> Layout<u32> {
+    layout.floating.extend(windows.iter().map(|(panel, rect)| Floating::single(vec![*panel], 0, *rect)));
+    layout
+}
+
+fn columns(layout: &Layout<u32>, side: Side) -> Vec<Vec<Vec<u32>>> {
+    fn find(node: &Node<u32>, side: Side) -> Option<Vec<Vec<Vec<u32>>>> {
+        match node {
+            Node::Dock { side: s, columns } if *s == side => {
+                Some(columns.iter().map(|c| c.groups.iter().map(|g| g.panels.clone()).collect()).collect())
+            }
+            Node::Split { first, second, .. } => find(first, side).or_else(|| find(second, side)),
+            _ => None,
+        }
+    }
+    layout.root.as_ref().and_then(|root| find(root, side)).unwrap_or_default()
+}
+
+fn column(layout: &Layout<u32>, index: usize) -> Column<u32> {
+    fn find(node: &Node<u32>) -> Option<&Vec<Column<u32>>> {
+        match node {
+            Node::Dock { columns, .. } => Some(columns),
+            Node::Split { first, second, .. } => find(first).or_else(|| find(second)),
+            _ => None,
+        }
+    }
+    layout.root.as_ref().and_then(find).and_then(|c| c.get(index)).cloned().unwrap()
+}
+
+#[derive(Default)]
+struct TestContent {
+    min_height: f32,
+}
+
+impl DockContent<u32> for TestContent {
+    fn body(&mut self, ui: &mut egui::Ui, _: &u32) {
+        ui.label("Body");
+    }
+    fn permissions(&self, panel: &u32) -> Permissions {
+        if *panel == 0 { Permissions::PROTECTED } else { Permissions::default() }
+    }
+    fn limits(&self, _: &u32) -> PanelLimits {
+        PanelLimits { min: vec2(0.0, self.min_height), ..PanelLimits::default() }
+    }
+}
+
+/// Renders a layout in a 600x600 area of an 800x600 window and applies what it emits.
+struct Driver {
+    ctx: Context,
+    layout: Layout<u32>,
+    content: TestContent,
+    focused: bool,
+    right_to_left: bool,
+    shapes: Vec<egui::epaint::ClippedShape>,
+    time: f64,
+}
+
+impl Driver {
+    fn new(layout: Layout<u32>) -> Self {
+        Self::with(layout, TestContent::default(), false)
+    }
+
+    fn with(layout: Layout<u32>, content: TestContent, right_to_left: bool) -> Self {
+        Self::start(Self { ctx: Context::default(), layout, content, focused: true, right_to_left, shapes: Vec::new(), time: 0.0 })
+    }
+
+    /// A window egui never heard has focus (macOS can make it key without a `Focused` event).
+    fn never_focused(layout: Layout<u32>) -> Self {
+        Self::start(Self {
+            ctx: Context::default(),
+            layout,
+            content: TestContent::default(),
+            focused: false,
+            right_to_left: false,
+            shapes: Vec::new(),
+            time: 0.0,
+        })
+    }
+
+    /// Run three empty frames so floating areas finish their sizing pass, then
+    /// return the driver.
+    fn start(mut driver: Self) -> Self {
+        // Floating areas settle after their sizing pass.
+        for _ in 0..3 {
+            driver.step(vec![]);
+        }
+        driver
+    }
+
+    /// One 800×600 frame with injected events and the driver's focus/right-to-left settings.
+    /// Renders the dock in a 600×600 scope, clears texture deltas, records shapes, and returns
+    /// `DockOutput`.
+    fn frame(&mut self, events: Vec<Event>) -> DockOutput<u32> {
+        let mut output = DockOutput::default();
+        self.time += 1.0 / 60.0;
+        let input = RawInput {
+            screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0))),
+            events,
+            focused: self.focused,
+            time: Some(self.time),
+            ..Default::default()
+        };
+        let (layout, content, rtl) = (&self.layout, &mut self.content, self.right_to_left);
+        let mut full = self.ctx.run_ui(input, |ui| {
+            let mut style = DockStyle::from_ui(ui);
+            style.right_to_left = rtl;
+            ui.scope_builder(UiBuilder::new().max_rect(Rect::from_min_size(Pos2::ZERO, vec2(600.0, 600.0))), |ui| {
+                output = DockArea::new(Id::unique(AREA)).show_content(ui, layout, &style, content);
+            });
+        });
+        full.textures_delta.clear();
+        self.shapes = full.shapes;
+        output
+    }
+
+    fn step(&mut self, events: Vec<Event>) -> DockOutput<u32> {
+        let output = self.frame(events);
+        assert!(output.error.is_none(), "{output:?}");
+        let permissions = |p: &u32| self.content.permissions(p);
+        for action in &output.actions {
+            self.layout.apply_with_permissions(action.clone(), permissions).unwrap();
+        }
+        output
+    }
+
+    /// Read the response rectangle for the dock widget named `name` and scoped to
+    /// `panel`.
+    fn rect(&self, name: &str, panel: u32) -> Rect {
+        self.ctx.read_response(Id::unique(AREA).with((name, Some(&panel)))).unwrap().rect
+    }
+
+    /// Read the response rectangle for `panel`'s tab.
+    fn tab(&self, panel: u32) -> Rect {
+        self.ctx.read_response(Id::unique(AREA).with(("tab", &panel))).unwrap().rect
+    }
+
+    fn hold(&mut self, from: Pos2, to: Pos2) -> DockOutput<u32> {
+        self.step(vec![Event::PointerMoved(from)]);
+        self.step(vec![button(from, true)]);
+        self.step(vec![Event::PointerMoved(from + vec2(8.0, 6.0))]);
+        self.step(vec![Event::PointerMoved(to)])
+    }
+
+    fn drag(&mut self, from: Pos2, to: Pos2) -> DockOutput<u32> {
+        self.hold(from, to);
+        self.step(vec![button(to, false)])
+    }
+
+    fn click(&mut self, at: Pos2) -> DockOutput<u32> {
+        self.step(vec![Event::PointerMoved(at), button(at, true)]);
+        self.step(vec![button(at, false)])
+    }
+
+    /// Two frames: egui reports a moved widget's rect a frame late.
+    fn settle(&mut self) {
+        self.step(vec![]);
+        self.step(vec![]);
+    }
+
+    fn wait(&mut self) {
+        for _ in 0..45 {
+            self.step(vec![]);
+        }
+    }
+
+    /// Whether the last frame painted the result preview of `rect`: a 2 pt outline with a light
+    /// fill, inset 1 pt.
+    fn previewed(&self, rect: Rect) -> bool {
+        let rect = rect.shrink(1.0);
+        let shapes = || {
+            self.shapes.iter().filter_map(|c| match &c.shape {
+                egui::Shape::Rect(r) if r.rect == rect => Some(r),
+                _ => None,
+            })
+        };
+        shapes()
+            .filter(|r| r.fill == egui::Color32::TRANSPARENT && r.stroke.width == 2.0)
+            .any(|outline| shapes().any(|r| r.stroke.width == 0.0 && r.fill == outline.stroke.color.gamma_multiply(0.08)))
+    }
+
+    /// The rect of the group whose strip starts with `panel`'s tab, in the column whose bar
+    /// names `column`: down to the next group's tab, `next`, or the window's bottom.
+    fn group_rect(&self, panel: u32, next: Option<u32>, column: u32) -> Rect {
+        let tab = self.tab(panel);
+        let bottom = next.map_or(600.0, |next| self.tab(next).top());
+        Rect::from_x_y_ranges(self.column_of(column).x_range(), tab.top()..=bottom)
+    }
+
+    /// The rect of the dock column whose bar names `panel`.
+    fn column_of(&self, panel: u32) -> Rect {
+        let bar = self.rect("column-bar", panel).union(self.rect("column-collapse", panel));
+        Rect::from_x_y_ranges(bar.x_range(), bar.top()..=600.0)
+    }
+
+    /// Whether the last frame painted the filled insertion line `line`.
+    fn painted(&self, line: Rect) -> bool {
+        self.shapes.iter().any(|clipped| match &clipped.shape {
+            egui::Shape::Rect(shape) => shape.rect == line && shape.fill != egui::Color32::TRANSPARENT,
+            _ => false,
+        })
+    }
+}
+
+fn button(pos: Pos2, pressed: bool) -> Event {
+    Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE }
+}
+
+fn key(key: egui::Key) -> Event {
+    Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE }
+}
+
+fn moved(actions: &[Action<u32>]) -> Option<(u32, &Target<u32>)> {
+    actions.iter().find_map(|a| match a {
+        Action::MoveGroup { panel, to } | Action::MoveColumn { panel, to } => Some((*panel, to)),
+        _ => None,
+    })
+}
+
+fn hline(y: f32, x: std::ops::RangeInclusive<f32>) -> Rect {
+    Rect::from_x_y_ranges(x, (y - 2.0)..=(y + 2.0))
+}
+
+fn vline(x: f32, y: std::ops::RangeInclusive<f32>) -> Rect {
+    Rect::from_x_y_ranges((x - 2.0)..=(x + 2.0), y)
+}
+
+/// A floating group's drag bar.
+fn bar(d: &Driver, panel: u32) -> Pos2 {
+    d.rect("drag-bar", panel).center()
+}
+
+// Geometry of `docked(Start, ..)`: the dock is 0..240 wide, its column bar 14 high, and two open
+// groups share 14..600, meeting at y = 307.
+
+#[test]
+fn group_dropped_on_a_seam_inserts_between_and_previews_the_rect_it_takes() {
+    let layout = with_floating(docked(Side::Start, &[&[&[2], &[3]]]), &[(5, [400.0, 300.0, 150.0, 150.0])]);
+    let mut d = Driver::new(layout);
+    assert_eq!(d.tab(3).top(), 307.0);
+    let seam = pos2(120.0, 309.0);
+    d.hold(bar(&d, 5), seam);
+    let held = d.shapes.clone();
+    let out = d.step(vec![button(seam, false)]);
+    d.settle();
+    let rect = d.group_rect(5, Some(3), 2);
+    d.shapes = held;
+    assert!(d.previewed(rect), "group 5's rect between groups 2 and 3: {rect:?}");
+    assert_eq!(moved(&out.actions), Some((5, &Target::At { anchor: 2, placement: Placement::Group { below: true, height: None } })));
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2], vec![5], vec![3]]]);
+    assert!(d.layout.floating.is_empty());
+}
+
+#[test]
+fn a_tab_dropped_on_a_seam_or_column_edge_moves_only_that_panel() {
+    let mut d = Driver::new(docked(Side::Start, &[&[&[2, 3], &[4]]]));
+    let out = d.drag(d.tab(3).center(), pos2(120.0, 309.0));
+    assert_eq!(out.actions, vec![Action::Move { panel: 3, anchor: 2, placement: Placement::Group { below: true, height: None } }]);
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2], vec![3], vec![4]]]);
+    d.settle();
+    d.drag(d.tab(4).center(), pos2(246.0, 200.0));
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2], vec![3]], vec![vec![4]]]);
+}
+
+#[test]
+fn group_dropped_on_a_top_or_bottom_band_stacks_above_or_below() {
+    for (at, expected) in [
+        // The top quarter of group 2's body, and the bottom quarter of group 3's.
+        (pos2(120.0, 14.0 + 26.0 + 20.0), vec![vec![5], vec![2], vec![3]]),
+        (pos2(120.0, 590.0), vec![vec![2], vec![3], vec![5]]),
+        // The middle of a body joins as tabs.
+        (pos2(120.0, 450.0), vec![vec![2], vec![3, 5]]),
+    ] {
+        let layout = with_floating(docked(Side::Start, &[&[&[2], &[3]]]), &[(5, [400.0, 300.0, 150.0, 150.0])]);
+        let mut d = Driver::new(layout);
+        d.drag(bar(&d, 5), at);
+        assert_eq!(columns(&d.layout, Side::Start), vec![expected], "{at:?}");
+    }
+}
+
+#[test]
+fn a_dock_groups_top_and_bottom_thirds_stack_its_sides_make_columns_and_its_middle_joins() {
+    // Group 3's body is 0..240 across and 333..600 down. Each drop beside previews the rect
+    // group 5 then takes: in the column, below the group `Some` names, or a whole column.
+    for (at, expected, result) in [
+        (pos2(120.0, 360.0), vec![vec![vec![2], vec![5], vec![3]]], Some(Some(3))),
+        (pos2(120.0, 580.0), vec![vec![vec![2], vec![3], vec![5]]], Some(None)),
+        (pos2(30.0, 466.0), vec![vec![vec![5]], vec![vec![2], vec![3]]], None),
+        (pos2(200.0, 466.0), vec![vec![vec![2], vec![3]], vec![vec![5]]], None),
+        (pos2(120.0, 466.0), vec![vec![vec![2], vec![3, 5]]], None),
+    ] {
+        let layout = with_floating(docked(Side::Start, &[&[&[2], &[3]]]), &[(5, [400.0, 300.0, 150.0, 150.0])]);
+        let mut d = Driver::new(layout);
+        d.hold(bar(&d, 5), at);
+        let held = d.shapes.clone();
+        d.step(vec![button(at, false)]);
+        assert_eq!(columns(&d.layout, Side::Start), expected, "{at:?}");
+        d.settle();
+        let rect = match result {
+            Some(next) => d.group_rect(5, next, 2),
+            None if expected.len() == 2 => d.column_of(5),
+            None => continue,
+        };
+        d.shapes = held;
+        assert!(d.previewed(rect), "{at:?}: the rect group 5 takes, {rect:?}");
+    }
+}
+
+#[test]
+fn with_side_edge_zones_a_dock_groups_side_zones_are_40_pt_deep() {
+    // Group 3's body is 0..240 across and 333..600 down. 60 pt in from its left edge and 57
+    // below its top are in its outer thirds but past 40 pt: the middle, which joins it.
+    for (at, expected) in [
+        (pos2(30.0, 466.0), vec![vec![vec![5]], vec![vec![2], vec![3]]]),
+        (pos2(120.0, 360.0), vec![vec![vec![2], vec![5], vec![3]]]),
+        (pos2(60.0, 466.0), vec![vec![vec![2], vec![3, 5]]]),
+        (pos2(120.0, 390.0), vec![vec![vec![2], vec![3, 5]]]),
+    ] {
+        let layout = with_floating(docked(Side::Start, &[&[&[2], &[3]]]), &[(5, [400.0, 300.0, 150.0, 150.0])]);
+        let mut d = testing::DockDriver::new(layout, TestContent::default())
+            .with_area(Rect::from_min_size(Pos2::ZERO, vec2(600.0, 600.0)))
+            .with_style(|s| s.side_edge_zones = true);
+        let tab = d.hit(&Hit::Tab(5)).unwrap_or_else(|| panic!("tab 5")).center();
+        d.drag(tab, at);
+        assert_eq!(columns(&d.layout, Side::Start), expected, "{at:?}");
+    }
+}
+
+#[test]
+fn a_group_edge_scrolled_out_of_view_previews_its_line_at_the_views_edge() {
+    // Groups 306 pt high from y = 14: group 3 spans 320..626 and its body's bottom third starts
+    // at 533, above the window's bottom.
+    let layout = with_floating(docked(Side::Start, &[&[&[2], &[3], &[4]]]), &[(5, [400.0, 300.0, 150.0, 150.0])]);
+    let mut d = Driver::with(layout, TestContent { min_height: 280.0 }, false);
+    let at = pos2(120.0, 580.0);
+    d.hold(bar(&d, 5), at);
+    assert!(d.painted(hline(598.0, 0.0..=240.0)), "the line at the view's bottom");
+    d.step(vec![button(at, false)]);
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2], vec![3], vec![5], vec![4]]]);
+}
+
+#[test]
+fn in_a_scrolled_column_a_stack_previews_the_rect_at_the_scroll_offset() {
+    // Groups 306 pt high from y = 14: group 3 spans 320..626 before scrolling.
+    let layout = with_floating(docked(Side::Start, &[&[&[2], &[3], &[4]]]), &[(5, [400.0, 300.0, 150.0, 150.0])]);
+    let mut d = Driver::with(layout, TestContent { min_height: 280.0 }, false);
+    let over = d.tab(2).center();
+    d.step(vec![
+        Event::PointerMoved(over),
+        Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Point,
+            delta: vec2(0.0, -200.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
+        },
+    ]);
+    d.wait();
+    let group = d.tab(3);
+    assert!(group.top() < 250.0, "scrolled up: {group:?}");
+    // Group 3's top third stacks 5 above it, where 3 is now.
+    let at = pos2(120.0, group.bottom() + 40.0);
+    d.hold(bar(&d, 5), at);
+    let held = d.shapes.clone();
+    d.step(vec![button(at, false)]);
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2], vec![5], vec![3], vec![4]]]);
+    d.settle();
+    let rect = d.group_rect(5, Some(3), 2);
+    d.shapes = held;
+    assert!(d.previewed(rect), "the rect group 5 takes, {rect:?}");
+}
+
+#[test]
+fn a_stripless_dock_groups_top_third_stacks_above_it() {
+    // Canvas 9 in the middle; protected panel 0 alone in the lower group draws no tab strip, so
+    // its body is 307..600.
+    let mut layout = with_floating(docked(Side::Start, &[&[&[2], &[0]]]), &[(5, [400.0, 300.0, 150.0, 150.0])]);
+    if let Some(Node::Split { second, .. }) = &mut layout.root {
+        **second = Node::Tabs { panels: vec![9], active: 0 };
+    }
+    let mut d = Driver::new(layout);
+    d.drag(bar(&d, 5), pos2(120.0, 330.0));
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2], vec![5], vec![0]]]);
+}
+
+#[test]
+fn dock_bands_are_28_pt_wide() {
+    let window = || with_floating(docked(Side::Start, &[&[&[2], &[3]]]), &[(5, [400.0, 300.0, 150.0, 150.0])]);
+    let target = |layout: Layout<u32>, at: Pos2| {
+        let mut d = Driver::new(layout);
+        let out = d.drag(bar(&d, 5), at);
+        moved(&out.actions).map(|(_, to)| to.clone())
+    };
+    let column_after = Target::At { anchor: 2, placement: Placement::Column { after: true } };
+    // 14 pt either side of the dock's inner edge at 240; past it, the protected canvas.
+    assert_eq!(target(window(), pos2(253.0, 300.0)), Some(column_after.clone()));
+    assert_ne!(target(window(), pos2(255.0, 300.0)), Some(column_after));
+    // 28 pt along the window edge without a dock.
+    assert_eq!(target(window(), pos2(573.0, 300.0)), Some(Target::NewDock { side: Side::End }));
+    assert_ne!(target(window(), pos2(571.0, 300.0)), Some(Target::NewDock { side: Side::End }));
+    // 28 pt along the bottom of the part between the docks, which splits at the root.
+    assert!(matches!(target(window(), pos2(420.0, 573.0)), Some(Target::At { placement: Placement::Edge(Zone::Bottom), .. })));
+    assert!(!matches!(target(window(), pos2(420.0, 571.0)), Some(Target::At { placement: Placement::Edge(_), .. })));
+    // 14 pt either side of a seam. In a 400 pt column, 16 pt in from the window edge and 13
+    // above the seam at 307 is relatively nearer group 2's left than its bottom, but the seam
+    // takes it; 15 above, the left third makes a column.
+    let wide = || {
+        let mut layout = with_floating(docked(Side::Start, &[&[&[2], &[3]]]), &[(5, [450.0, 300.0, 100.0, 150.0])]);
+        if let Some(Node::Split { size, first, .. }) = &mut layout.root {
+            *size = SplitSize::FixedFirst(400.0);
+            if let Node::Dock { columns, .. } = &mut **first {
+                columns.iter_mut().for_each(|c| c.width = 400.0);
+            }
+        }
+        layout
+    };
+    assert_eq!(target(wide(), pos2(16.0, 294.0)), Some(Target::At { anchor: 2, placement: Placement::Group { below: true, height: None } }));
+    assert_eq!(target(wide(), pos2(16.0, 292.0)), Some(Target::At { anchor: 2, placement: Placement::Column { after: false } }));
+}
+
+#[test]
+fn group_dropped_on_a_column_edge_makes_a_new_column() {
+    // The dock's inner edge: a column after the existing one, previewed full height.
+    let layout = with_floating(docked(Side::Start, &[&[&[2], &[3]]]), &[(5, [400.0, 300.0, 150.0, 150.0])]);
+    let mut d = Driver::new(layout.clone());
+    let edge = pos2(246.0, 200.0);
+    d.hold(bar(&d, 5), edge);
+    let held = d.shapes.clone();
+    let out = d.step(vec![button(edge, false)]);
+    d.settle();
+    let rect = d.column_of(5);
+    assert_eq!((rect.left(), rect.top(), rect.bottom()), (240.0, 0.0, 600.0));
+    let shapes = std::mem::replace(&mut d.shapes, held);
+    assert!(d.previewed(rect), "the new column's rect, the full height of the dock");
+    d.shapes = shapes;
+    assert_eq!(moved(&out.actions), Some((5, &Target::At { anchor: 2, placement: Placement::Column { after: true } })));
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2], vec![3]], vec![vec![5]]]);
+    assert_eq!(column(&d.layout, 1).width, 150.0, "the new column keeps the window's width");
+
+    // The window edge of the outermost column: a column before it.
+    let mut d = Driver::new(layout);
+    d.drag(bar(&d, 5), pos2(3.0, 200.0));
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![5]], vec![vec![2], vec![3]]]);
+}
+
+#[test]
+fn group_dropped_on_the_window_edge_without_a_dock_makes_a_new_dock() {
+    for (side, at, new) in [(Side::Start, pos2(595.0, 200.0), Side::End), (Side::End, pos2(4.0, 200.0), Side::Start)] {
+        let layout = with_floating(docked(side, &[&[&[2]]]), &[(5, [300.0, 300.0, 150.0, 150.0])]);
+        let mut d = Driver::new(layout);
+        d.hold(bar(&d, 5), at);
+        let x = if new == Side::End { 598.0 } else { 2.0 };
+        assert!(d.painted(vline(x, 0.0..=600.0)), "{new:?}: a vertical line at the window edge");
+        let held = d.shapes.clone();
+        let out = d.step(vec![button(at, false)]);
+        d.settle();
+        let rect = d.column_of(5);
+        let shapes = std::mem::replace(&mut d.shapes, held);
+        assert!(!d.previewed(rect), "{new:?}: no rect of the new dock's column");
+        d.shapes = shapes;
+        assert_eq!(moved(&out.actions), Some((5, &Target::NewDock { side: new })));
+        assert_eq!(columns(&d.layout, new), vec![vec![vec![5]]]);
+        assert_eq!(columns(&d.layout, side), vec![vec![vec![2]]]);
+        // The new dock is drawn on its edge, its »/« button at the window edge.
+        d.settle();
+        let button = d.rect("column-collapse", 5);
+        assert!(if new == Side::End { button.right() == 600.0 } else { button.left() == 0.0 }, "{button:?}");
+    }
+}
+
+#[test]
+fn tab_dragged_to_the_window_edge_without_a_dock_makes_a_dock_of_that_panel() {
+    let mut d = testing::DockDriver::new(docked(Side::Start, &[&[&[2, 3]]]), TestContent::default());
+    let tab = d.hit(&Hit::Tab(3)).unwrap_or_else(|| panic!("{:?}", d.hits()));
+    let out = d.drag(tab.center(), pos2(795.0, 300.0));
+    assert!(out.actions.contains(&Action::MovePanel { panel: 3, to: Target::NewDock { side: Side::End } }), "{:?}", out.actions);
+    assert_eq!(columns(&d.layout, Side::End), vec![vec![vec![3]]]);
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2]]]);
+}
+
+#[test]
+/// A group dropped on a column's tab strip joins as a tab, on a group body
+/// appends as its last tab, and in the empty space below starts a new group.
+fn a_column_takes_groups_anywhere_in_it_and_as_tabs() {
+    let windows = [(5, [400.0, 40.0, 150.0, 120.0]), (6, [400.0, 220.0, 150.0, 120.0]), (7, [400.0, 400.0, 150.0, 120.0])];
+    let mut d = Driver::new(with_floating(docked(Side::Start, &[&[&[2], &[3]]]), &windows));
+    // Onto group 3's tab strip: joins as a tab.
+    d.drag(bar(&d, 5), pos2(d.tab(3).right() + 20.0, d.tab(3).center().y));
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2], vec![3, 5]]]);
+    // Onto the middle of group 2's body: joins as the last tab.
+    d.drag(bar(&d, 6), pos2(120.0, 160.0));
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2, 6], vec![3, 5]]]);
+    // Into the room under the groups, every group minimized: below the last group.
+    d.step(vec![Event::PointerMoved(pos2(700.0, 10.0))]);
+    let mut minimized = d.layout.clone();
+    for panel in [2, 3] {
+        minimized.apply(Action::SetMinimized { panel, minimized: true }).unwrap();
+    }
+    d.layout = minimized;
+    d.step(vec![]);
+    d.drag(bar(&d, 7), pos2(120.0, 500.0));
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2, 6], vec![3, 5], vec![7]]]);
+}
+
+#[test]
+/// A column of five groups with a 160 pt minimum is taller than the window; scrolling up over its
+/// tab strip moves the last tab more than 100 pt into view.
+fn a_column_too_tall_for_the_window_scrolls() {
+    let groups: [&[u32]; 5] = [&[2], &[3], &[4], &[5], &[6]];
+    let mut d = Driver::with(docked(Side::Start, &[&groups]), TestContent { min_height: 160.0 }, false);
+    let last = d.tab(6);
+    assert!(last.top() > 600.0, "the last group starts below the window: {last:?}");
+    let over = d.tab(2).center();
+    for _ in 0..6 {
+        d.step(vec![
+            Event::PointerMoved(over),
+            Event::MouseWheel {
+                source: egui::MouseWheelSource::Unknown,
+                unit: egui::MouseWheelUnit::Point,
+                delta: vec2(0.0, -200.0),
+                phase: egui::TouchPhase::Move,
+                modifiers: Modifiers::NONE,
+            },
+        ]);
+    }
+    d.wait();
+    let moved = d.tab(6);
+    assert!(moved.top() < last.top() - 100.0, "scrolled up: {moved:?} from {last:?}");
+}
+
+#[test]
+/// Dragging a column bar to the window edge moves the column first; dragging it
+/// away from the dock floats every group in the column and shows a follow ghost.
+fn column_bar_drag_moves_the_column_and_away_from_a_dock_floats_its_groups() {
+    let mut d = Driver::new(docked(Side::Start, &[&[&[2], &[3]], &[&[5]]]));
+    // The second column to the window edge: it becomes the first.
+    let out = d.drag(d.rect("column-bar", 5).center(), pos2(3.0, 200.0));
+    assert_eq!(moved(&out.actions), Some((5, &Target::At { anchor: 2, placement: Placement::Column { after: false } })));
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![5]], vec![vec![2], vec![3]]]);
+    d.settle();
+    // Away from the dock: a floating window holding the column's groups.
+    let source = Rect::from_min_max(pos2(240.0, 0.0), pos2(480.0, 600.0));
+    assert_eq!(d.rect("column-bar", 2).left(), 240.0 + 18.0);
+    let grab = d.rect("column-bar", 2).center();
+    d.hold(grab, pos2(560.0, 300.0));
+    // The column's width; a docked column floats at most 320 pt tall.
+    let size = vec2(source.width(), 320.0);
+    let ghost = egui::Rect::from_min_size(pos2(560.0, 300.0) - (grab - source.min), size);
+    let ghost = egui::Rect::from_min_size(ghost.min.min(pos2(800.0, 600.0) - size).max(Pos2::ZERO), size);
+    assert!(
+        d.shapes.iter().any(|s| matches!(&s.shape, egui::Shape::Rect(r) if r.rect == ghost && r.fill != egui::Color32::TRANSPARENT)),
+        "a ghost of the column follows the pointer"
+    );
+    let out = d.step(vec![button(pos2(560.0, 300.0), false)]);
+    assert!(matches!(moved(&out.actions), Some((2, Target::Float { .. }))), "{:?}", out.actions);
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![5]]]);
+    assert_eq!(d.layout.floating[0].groups(), vec![group(&[2]), group(&[3])]);
+}
+
+#[test]
+/// Escape, focus loss, pointer exit and `cancel_drag` each end a held column drag without emitting
+/// actions or a group drop; the release changes nothing and the layout equals the original.
+fn column_drag_escape_focus_loss_pointer_exit_and_cancel_drag_leave_the_layout_unchanged() {
+    let layout = docked(Side::Start, &[&[&[2], &[3]], &[&[5]]]);
+    for case in ["escape", "focus", "exit", "cancel"] {
+        let mut d = Driver::new(layout.clone());
+        let target = pos2(3.0, 200.0);
+        let held = d.hold(d.rect("column-bar", 5).center(), target);
+        assert_eq!(held.group_drag, Some(5), "{case}");
+        let out = match case {
+            "escape" => d.step(vec![key(egui::Key::Escape)]),
+            "focus" => {
+                d.focused = false;
+                let out = d.step(vec![]);
+                d.focused = true;
+                out
+            }
+            "exit" => d.step(vec![Event::PointerGone]),
+            _ => {
+                cancel_drag::<u32>(&d.ctx, Id::unique(AREA));
+                d.step(vec![Event::PointerMoved(target + vec2(1.0, 0.0))])
+            }
+        };
+        assert!(out.actions.is_empty(), "{case}: {out:?}");
+        let out = d.step(vec![Event::PointerMoved(target), button(target, false)]);
+        assert!(out.actions.is_empty() && out.group_drag.is_none(), "{case}: {out:?}");
+        assert_eq!(d.layout, layout, "{case}");
+        assert!(!is_dragging::<u32>(&d.ctx, Id::unique(AREA)), "{case}");
+    }
+}
+
+#[test]
+fn column_and_group_dividers_resize_and_minimized_groups_keep_their_height() {
+    let mut d = Driver::new(docked(Side::Start, &[&[&[2], &[4]]]));
+    // The dock's inner edge widens its column; the canvas gives way.
+    d.drag(pos2(240.0, 300.0), pos2(280.0, 300.0));
+    assert_eq!(column(&d.layout, 0).width, 280.0);
+    d.settle();
+    assert_eq!(d.rect("column-bar", 2).right(), 280.0);
+    // The divider between the groups saves both heights.
+    d.wait();
+    d.drag(pos2(120.0, 307.0), pos2(120.0, 357.0));
+    let groups = column(&d.layout, 0).groups;
+    assert_eq!((groups[0].height, groups[1].height), (Some(343.0), Some(243.0)));
+    d.settle();
+    assert_eq!(d.tab(4).top(), 357.0);
+    // Minimized, the lower group keeps its saved height and the upper one takes the room.
+    d.layout.apply(Action::SetMinimized { panel: 4, minimized: true }).unwrap();
+    d.settle();
+    assert_eq!(column(&d.layout, 0).groups[1].height, Some(243.0));
+    assert_eq!(d.tab(4).top(), 600.0 - 26.0);
+}
+
+#[test]
+fn a_group_divider_dragged_past_the_lower_groups_minimum_shrinks_the_next_group() {
+    let mut d = Driver::new(docked(Side::Start, &[&[&[2], &[3], &[4]]]));
+    let divider = d.rect("group-resize", 2).center();
+    d.drag(divider, divider + vec2(0.0, 500.0));
+    // Groups 3 and 4 are at their minimum: a tab strip and a 40 pt body.
+    let heights = column(&d.layout, 0).groups.iter().map(|g| g.height).collect::<Vec<_>>();
+    assert_eq!(heights[1..], [Some(66.0), Some(66.0)], "{heights:?}");
+}
+
+#[test]
+fn double_click_on_a_docked_tab_minimizes_and_clicking_another_tab_expands() {
+    let mut d = Driver::new(docked(Side::Start, &[&[&[2, 3], &[4]]]));
+    let minimized = |d: &Driver| column(&d.layout, 0).groups[0].minimized;
+    let tab = d.tab(2).center();
+    d.click(tab);
+    d.click(tab);
+    assert!(minimized(&d));
+    d.settle();
+    assert_eq!(d.tab(4).top(), 14.0 + 26.0, "the minimized group takes its strip");
+    d.wait();
+    d.click(d.tab(3).center());
+    assert!(!minimized(&d));
+    assert_eq!(column(&d.layout, 0).groups[0].active_panel(), Some(&3));
+}
+
+#[test]
+fn collapse_button_and_column_bar_double_click_emit_set_iconic() {
+    let mut d = Driver::new(docked(Side::Start, &[&[&[2], &[3]]]));
+    let iconic = |d: &Driver| column(&d.layout, 0).iconic;
+    let button = d.rect("column-collapse", 2).center();
+    let out = d.click(button);
+    assert_eq!(out.actions, vec![Action::SetIconic { panel: 2, iconic: true }]);
+    assert!(iconic(&d));
+    d.wait();
+    d.click(d.rect("column-collapse", 2).center());
+    assert!(!iconic(&d));
+    d.wait();
+    let bar = d.rect("column-bar", 2).center();
+    d.click(bar);
+    d.click(bar);
+    assert!(iconic(&d));
+}
+
+#[test]
+fn dock_targets_respect_occlusion_by_floating_windows() {
+    // Window 5 covers the column's seam at x 150..240; window 6 is dragged.
+    let windows = [(5, [150.0, 250.0, 200.0, 150.0]), (6, [400.0, 450.0, 150.0, 120.0])];
+    let layout = with_floating(docked(Side::Start, &[&[&[2], &[3]]]), &windows);
+    let mut d = Driver::new(layout.clone());
+    let out = d.drag(bar(&d, 6), pos2(200.0, 309.0));
+    assert!(matches!(moved(&out.actions), Some((6, Target::At { anchor: 5, .. }))), "joins the window in front: {:?}", out.actions);
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2], vec![3]]]);
+    // Left of the window, the seam takes it.
+    let mut d = Driver::new(layout);
+    d.drag(bar(&d, 6), pos2(100.0, 309.0));
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2], vec![6], vec![3]]]);
+}
+
+#[test]
+fn right_to_left_mirrors_docks_their_edges_and_new_docks() {
+    let layout = with_floating(docked(Side::Start, &[&[&[2], &[3]]]), &[(5, [100.0, 300.0, 150.0, 150.0])]);
+    let mut d = Driver::with(layout.clone(), TestContent::default(), true);
+    // The start dock is on the right, its »/« button at the window edge.
+    let column_bar = d.rect("column-bar", 2);
+    assert_eq!((column_bar.left(), column_bar.right()), (360.0, 600.0 - 18.0));
+    // Its inner edge is on the left: dragging it left widens the column.
+    d.drag(pos2(360.0, 300.0), pos2(320.0, 300.0));
+    assert_eq!(column(&d.layout, 0).width, 280.0);
+    // The left window edge has no dock: a new end dock.
+    d.wait();
+    let out = d.drag(bar(&d, 5), pos2(4.0, 200.0));
+    assert_eq!(moved(&out.actions), Some((5, &Target::NewDock { side: Side::End })));
+    d.settle();
+    assert_eq!(d.rect("column-collapse", 5).left(), 0.0);
+}
+
+#[test]
+/// Dropping a column's first tab just past its own edge anchors it after the
+/// other column's panel; a panel alone in its column stays in place.
+fn a_column_s_first_tab_dropped_on_its_own_column_edge_anchors_on_another_panel() {
+    // Two columns, 0..240 and 240..480; the dragged tab is the first panel of the last one.
+    let wide = |columns: &[&[&[u32]]]| {
+        let mut layout = docked(Side::Start, columns);
+        if let Some(Node::Split { size, .. }) = &mut layout.root {
+            *size = SplitSize::FixedFirst(480.0);
+        }
+        layout
+    };
+    let mut d = Driver::new(wide(&[&[&[2]], &[&[3, 4]]]));
+    let out = d.drag(d.tab(3).center(), pos2(484.0, 300.0));
+    assert_eq!(out.actions, vec![Action::Move { panel: 3, anchor: 4, placement: Placement::Column { after: true } }]);
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![2]], vec![vec![4]], vec![vec![3]]]);
+
+    // Alone in its column, the panel stays where it is.
+    let layout = wide(&[&[&[2]], &[&[3]]]);
+    let mut d = Driver::new(layout.clone());
+    let out = d.drag(d.tab(3).center(), pos2(484.0, 300.0));
+    assert_eq!(out.actions, vec![]);
+    assert_eq!(d.layout, layout);
+}
+
+#[test]
+/// A driver that never reported window focus can still drag tab 3 to a column edge (moving it after
+/// panel 4). When focus arrives and is then lost mid-drag, releasing emits no action and restores the
+/// original layout.
+fn a_window_that_never_reported_focus_drags_tabs_and_losing_focus_cancels_a_drag() {
+    let mut layout = docked(Side::Start, &[&[&[2]], &[&[3, 4]]]);
+    if let Some(Node::Split { size, .. }) = &mut layout.root {
+        *size = SplitSize::FixedFirst(480.0);
+    }
+    let to = pos2(484.0, 300.0);
+    let mut d = Driver::never_focused(layout.clone());
+    let out = d.drag(d.tab(3).center(), to);
+    assert_eq!(out.actions, vec![Action::Move { panel: 3, anchor: 4, placement: Placement::Column { after: true } }]);
+
+    // Focus that arrives during the drag and goes again ends it.
+    let mut d = Driver::never_focused(layout.clone());
+    d.hold(d.tab(3).center(), to);
+    d.focused = true;
+    d.step(vec![Event::WindowFocused(true)]);
+    assert!(is_dragging::<u32>(&d.ctx, Id::unique(AREA)));
+    d.focused = false;
+    d.step(vec![Event::WindowFocused(false)]);
+    let out = d.step(vec![button(to, false)]);
+    assert!(out.actions.is_empty(), "{out:?}");
+    assert_eq!(d.layout, layout);
+    assert!(!is_dragging::<u32>(&d.ctx, Id::unique(AREA)));
+}
+
+#[test]
+fn a_dock_wider_than_the_window_shrinks_to_fit_and_resizes() {
+    let widths = render::fit_widths(&[(600.0, Some(40.0)), (600.0, Some(40.0)), (48.0, None)], 800.0);
+    assert!((widths.iter().sum::<f32>() - 800.0).abs() < 0.01 && widths[2] == 48.0, "{widths:?}");
+    assert_eq!(render::fit_widths(&[(600.0, Some(300.0)), (600.0, Some(300.0))], 400.0), vec![300.0, 300.0]);
+
+    // Three 600-wide columns saved on a larger screen, in an 800-wide window.
+    let mut layout = docked(Side::Start, &[&[&[1]], &[&[2]], &[&[3]]]);
+    if let Some(Node::Split { first, .. }) = &mut layout.root
+        && let Node::Dock { columns, .. } = &mut **first
+    {
+        for column in columns {
+            column.width = 600.0;
+        }
+    }
+    let mut d = testing::DockDriver::new(layout, TestContent::default());
+    for panel in [1, 2, 3] {
+        let divider = d.hit(&Hit::Divider(Divider::Column(panel))).unwrap();
+        assert!(d.hit(&Hit::Tab(panel)).is_some_and(|tab| tab.width() > 0.0), "{panel}");
+        assert!(divider.right() < 800.0, "{panel}: {divider:?}");
+    }
+    let divider = d.hit(&Hit::Divider(Divider::Column(1))).unwrap().center();
+    d.press(divider);
+    d.move_to(divider + vec2(-8.0, 0.0));
+    let out = d.move_to(divider + vec2(-30.0, 0.0));
+    assert!(out.error.is_none() && !out.actions.is_empty(), "{out:?}");
+    for action in &out.actions {
+        assert!(matches!(action, Action::ResizeColumn { width, .. } if *width > 0.0), "{action:?}");
+    }
+    d.release(divider + vec2(-30.0, 0.0));
+    let total: f32 = (0..3).map(|i| column(&d.layout, i).width).sum();
+    assert!(total < 800.0, "{total}");
+    assert!((d.hit(&Hit::Divider(Divider::Column(1))).unwrap().center().x - (divider.x - 30.0)).abs() < 1.0);
+}
+
+#[test]
+fn screen_reader_values_follow_the_column_width_on_either_edge() {
+    use egui::accesskit::{Action as A, ActionData, ActionRequest, TreeId};
+    for (side, right_to_left) in [(Side::End, false), (Side::Start, true), (Side::Start, false)] {
+        let mut d = testing::DockDriver::new(docked(side, &[&[&[2]]]), TestContent::default()).with_style(move |s| s.right_to_left = right_to_left);
+        d.ctx.enable_accesskit();
+        d.settle();
+        let id = DockArea::<u32>::hit_id(d.id, &Hit::Divider(Divider::Column(2)));
+        let request =
+            |action, data| Event::AccessKitActionRequest(ActionRequest { action, target_tree: TreeId::ROOT, target_node: id.accesskit_id(), data });
+        let case = format!("{side:?}, right to left {right_to_left}");
+        let out = d.frame(vec![request(A::SetValue, Some(ActionData::NumericValue(300.0)))]);
+        assert_eq!(out.actions, vec![Action::ResizeColumn { panel: 2, width: 300.0 }], "{case}");
+        let out = d.frame(vec![request(A::Increment, None)]);
+        assert_eq!(out.actions, vec![Action::ResizeColumn { panel: 2, width: 248.0 }], "{case}");
+        // Arrow keys stay physical: right moves the divider right.
+        d.ctx.memory_mut(|m| m.request_focus(id));
+        d.frame(vec![]);
+        let out = d.frame(vec![key(egui::Key::ArrowRight)]);
+        let wider = d.hit(&Hit::Divider(Divider::Column(2))).unwrap().center().x < 400.0;
+        let width = if wider { 248.0 } else { 232.0 };
+        assert_eq!(out.actions, vec![Action::ResizeColumn { panel: 2, width }], "{case}");
+    }
+}
+
+#[test]
+fn an_unanchored_open_prefers_the_end_dock_and_an_edge_frame_takes_a_quarter() {
+    let start = Node::Dock { side: Side::Start, columns: vec![Column::new(vec![group(&[1])], 240.0)] };
+    let end = docked(Side::End, &[&[&[2]]]).root.unwrap();
+    let mut layout = Layout {
+        root: Some(Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedFirst(240.0), first: Box::new(start), second: Box::new(end) }),
+        floating: Vec::new(),
+    };
+    layout.apply(Action::Open { panel: 9, anchor: None }).unwrap();
+    assert_eq!(columns(&layout, Side::End), vec![vec![vec![2, 9]]]);
+    assert_eq!(columns(&layout, Side::Start), vec![vec![vec![1]]]);
+    // A minimized group and an iconic column are passed over: the panel would not show there.
+    let start = Node::Dock { side: Side::Start, columns: vec![Column::new(vec![group(&[1])], 240.0)] };
+    let mut end = docked(Side::End, &[&[&[2]]]).root.unwrap();
+    if let Node::Split { second, .. } = &mut end
+        && let Node::Dock { columns, .. } = second.as_mut()
+    {
+        columns[0].groups[0].minimized = true;
+    }
+    let mut layout = Layout {
+        root: Some(Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedFirst(240.0), first: Box::new(start), second: Box::new(end) }),
+        floating: Vec::new(),
+    };
+    let mut iconic = layout.clone();
+    layout.apply(Action::Open { panel: 9, anchor: None }).unwrap();
+    assert_eq!(columns(&layout, Side::Start), vec![vec![vec![1, 9]]]);
+    if let Some(Node::Split { first, .. }) = &mut iconic.root
+        && let Node::Dock { columns, .. } = first.as_mut()
+    {
+        columns[0].iconic = true;
+    }
+    iconic.apply(Action::Open { panel: 9, anchor: None }).unwrap();
+    assert!(matches!(iconic.place(&9), Some(dock_model::Place::Node(_))), "{iconic:?}");
+
+    // No dock: a frame at the right edge, a quarter of the width.
+    let mut layout = Layout { root: Some(Node::Tabs { panels: vec![0], active: 0 }), floating: Vec::new() };
+    layout.apply(Action::Open { panel: 9, anchor: None }).unwrap();
+    let Some(Node::Split { axis: SplitAxis::Horizontal, size, second, .. }) = &layout.root else { panic!("{layout:?}") };
+    assert_eq!(*size, SplitSize::Ratio(0.75));
+    assert_eq!(**second, Node::Tabs { panels: vec![9], active: 0 });
+}
+
+/// Panels 1-3 as a creative app's Color, Properties and Layers: Layers fills the column and asks
+/// for room for about ten rows.
+struct Creative;
+
+impl DockContent<u32> for Creative {
+    fn body(&mut self, ui: &mut egui::Ui, _: &u32) {
+        ui.label("Body");
+    }
+    fn permissions(&self, panel: &u32) -> Permissions {
+        if *panel == 0 { Permissions::PROTECTED } else { Permissions::default() }
+    }
+    fn limits(&self, panel: &u32) -> PanelLimits {
+        PanelLimits { min: vec2(0.0, if *panel == 3 { 120.0 } else { 60.0 }), ..PanelLimits::default() }
+    }
+    fn dock_heights(&self, panel: &u32) -> Option<DockHeights> {
+        match panel {
+            1 => Some(DockHeights::new(160.0).compact(100.0)),
+            2 => Some(DockHeights::new(220.0).compact(130.0)),
+            3 => Some(DockHeights::new(300.0).fill(480.0)),
+            _ => None,
+        }
+    }
+}
+
+/// Color, Properties and Layers docked in a window `height` tall, with saved `heights`.
+fn sized_column(height: f32, heights: [Option<f32>; 3]) -> testing::DockDriver<u32, Creative> {
+    let mut layout = docked(Side::Start, &[&[&[1], &[2], &[3]]]);
+    if let Some(Node::Split { first, .. }) = &mut layout.root
+        && let Node::Dock { columns, .. } = first.as_mut()
+    {
+        columns[0].groups.iter_mut().zip(heights).for_each(|(g, h)| g.height = h);
+    }
+    let mut d = testing::DockDriver::new(layout, Creative);
+    d.screen = Rect::from_min_size(Pos2::ZERO, vec2(1440.0, height));
+    d.area = d.screen;
+    d.settle();
+    d
+}
+
+/// Heights of the column's groups as drawn, from their tabs' tops.
+fn drawn_heights(d: &testing::DockDriver<u32, Creative>) -> [f32; 3] {
+    let top = |p| d.hit(&Hit::Tab(p)).unwrap().top();
+    [top(2) - top(1), top(3) - top(2), d.area.bottom() - top(3)]
+}
+
+#[test]
+fn a_default_column_gives_the_filler_its_fill_height() {
+    let strip = DockStyle::from_visuals(&egui::Visuals::dark()).tab_height;
+    // A 900 pt window: Properties, nearest Layers, gives way towards its compact height so
+    // Layers gets the height it asks for; Color keeps its default.
+    let d = sized_column(900.0, [None; 3]);
+    let [color, properties, layers] = drawn_heights(&d);
+    assert!((layers - (480.0 + strip)).abs() < 0.5, "{:?}", drawn_heights(&d));
+    assert_eq!(color, 160.0 + strip, "{:?}", drawn_heights(&d));
+    assert!(properties < 220.0 + strip && properties >= 130.0 + strip, "{:?}", drawn_heights(&d));
+    // A tall window: both at their defaults, Layers takes the rest.
+    let d = sized_column(1200.0, [None; 3]);
+    let [color, properties, layers] = drawn_heights(&d);
+    assert_eq!((color, properties), (160.0 + strip, 220.0 + strip));
+    assert!(layers > 480.0 + strip);
+    // Nothing is saved until the user resizes a group.
+    assert!(column(&d.layout, 0).groups.iter().all(|g| g.height.is_none()));
+}
+
+#[test]
+fn shared_groups_with_different_minimums_fit_an_exact_room() {
+    let open = |min: f32, content: Option<DockHeights>| render::GroupSize { minimized: false, saved: None, min, content };
+    let column = [open(50.0, Some(DockHeights::new(186.0))), open(86.0, None), open(146.0, None)];
+    assert_eq!(render::group_heights(&column, 26.0, 418.0), vec![186.0, 86.0, 146.0]);
+    assert_eq!(render::group_heights(&column, 26.0, 518.0), vec![186.0, 166.0, 166.0]);
+}
+
+#[test]
+fn a_group_asking_for_a_fill_fills_the_column_beside_groups_without_dock_heights() {
+    let open = |min: f32, content: Option<DockHeights>| render::GroupSize { minimized: false, saved: None, min, content };
+    let column = [open(86.0, Some(DockHeights::new(186.0))), open(86.0, None), open(146.0, Some(DockHeights::new(326.0).fill(506.0)))];
+    assert_eq!(render::group_heights(&column, 26.0, 1000.0), vec![186.0, 86.0, 728.0]);
+}
+
+#[test]
+fn defaults_give_way_to_the_filler_but_user_heights_stay() {
+    let open = |saved: Option<f32>, min: f32, content: Option<DockHeights>| render::GroupSize { minimized: false, saved, min, content };
+    let color = Some(DockHeights::new(186.0).compact(126.0));
+    let properties = Some(DockHeights::new(246.0).compact(156.0));
+    let layers = Some(DockHeights::new(326.0).fill(506.0));
+    let column = [open(None, 86.0, color), open(None, 86.0, properties), open(None, 146.0, layers)];
+    // Tall: defaults, the filler takes the rest.
+    assert_eq!(render::group_heights(&column, 26.0, 1200.0), vec![186.0, 246.0, 768.0]);
+    // Short: the default nearest the filler gives way first; Color keeps its default.
+    assert_eq!(render::group_heights(&column, 26.0, 863.0), vec![186.0, 171.0, 506.0]);
+    // Shorter: Properties is at its compact height before Color gives way.
+    assert_eq!(render::group_heights(&column, 26.0, 818.0), vec![156.0, 156.0, 506.0]);
+    // Shorter than the compact heights and the fill: every group gives way towards its minimum.
+    let hs = render::group_heights(&column, 26.0, 400.0);
+    assert!(hs.iter().zip(&column).all(|(h, g)| *h >= g.min - 0.01), "{hs:?}");
+    assert!((hs.iter().sum::<f32>() - 400.0).abs() < 0.01 && hs[0] < 126.0 && hs[1] < 156.0, "{hs:?}");
+    // Heights the user set stay; only the defaults give way.
+    let mine = [open(Some(200.0), 86.0, color), open(None, 86.0, properties), open(None, 146.0, layers)];
+    assert_eq!(render::group_heights(&mine, 26.0, 838.0), vec![200.0, 156.0, 482.0]);
+    // In a drawn column too: Layers gets less than it asks for rather than the user's heights.
+    let d = sized_column(900.0, [Some(200.0), Some(340.0), None]);
+    assert_eq!(drawn_heights(&d), [200.0, 340.0, 900.0 - 14.0 - 540.0]);
+}
+
+/// Dock columns left and right of protected canvas 0, as in a creative app: group [1, 7] above
+/// [2] at the left, [3] above [4] at the right, each column 200 wide, and a floating window
+/// holding group [5, 6].
+fn creative() -> testing::DockDriver<u32, TestContent> {
+    let dock = |side, groups: &[&[u32]]| Node::Dock { side, columns: vec![Column::new(groups.iter().map(|g| group(g)).collect(), 200.0)] };
+    let canvas = Node::Tabs { panels: vec![0], active: 0 };
+    let inner = Node::Split {
+        axis: SplitAxis::Horizontal,
+        size: SplitSize::FixedSecond(200.0),
+        first: Box::new(canvas),
+        second: Box::new(dock(Side::End, &[&[3], &[4]])),
+    };
+    let root = Node::Split {
+        axis: SplitAxis::Horizontal,
+        size: SplitSize::FixedFirst(200.0),
+        first: Box::new(dock(Side::Start, &[&[1, 7], &[2]])),
+        second: Box::new(inner),
+    };
+    let layout = Layout { root: Some(root), floating: vec![Floating::single(vec![5, 6], 0, [300.0, 200.0, 200.0, 160.0])] };
+    testing::DockDriver::new(layout, TestContent::default()).with_style(|s| {
+        s.side_edge_zones = false;
+        s.new_dock_zones = true;
+        s.float_on_empty_drop = true;
+        s.title_bar_docks = true;
+    })
+}
+
+/// The rect of the result preview the last frame painted: a 2 pt accent outline with a light
+/// fill.
+fn result_preview<C: DockContent<u32>>(d: &testing::DockDriver<u32, C>) -> Option<Rect> {
+    let fill = DockStyle::default().accent.gamma_multiply(0.08);
+    d.shapes()
+        .iter()
+        .find_map(|clipped| match &clipped.shape {
+            egui::Shape::Rect(shape) if shape.fill == fill && shape.stroke.width == 0.0 => Some(shape.rect),
+            _ => None,
+        })
+        .filter(|rect| d.outlined(*rect))
+}
+
+#[test]
+fn a_group_dropped_on_the_window_edge_makes_a_column_there_and_previews_the_edge_line() {
+    // Group [1, 7] heads the left column, so the column's window edge is named by panel 1: the
+    // drop names the column by panel 2 instead and moves the whole group out.
+    let mut d = creative();
+    let at = pos2(3.0, 300.0);
+    d.hold(d.hit(&Hit::DragBar(1)).unwrap().center(), at);
+    assert!(d.filled(Rect::from_x_y_ranges(0.0..=4.0, 0.0..=600.0)), "the line along the window edge");
+    assert_eq!(result_preview(&d), None);
+    let out = d.release(at);
+    assert_eq!(out.actions, vec![Action::MoveGroup { panel: 1, to: Target::At { anchor: 2, placement: Placement::Column { after: false } } }]);
+    assert_eq!(columns(&d.layout, Side::Start), vec![vec![vec![1, 7]], vec![vec![2]]]);
+
+    // A floating window's group at the right window edge.
+    let mut d = creative();
+    let at = pos2(797.0, 300.0);
+    d.hold(d.hit(&Hit::DragBar(5)).unwrap().center(), at);
+    assert!(d.filled(Rect::from_x_y_ranges(796.0..=800.0, 0.0..=600.0)), "the line along the window edge");
+    assert_eq!(result_preview(&d), None);
+    let out = d.release(at);
+    assert_eq!(out.actions, vec![Action::MoveGroup { panel: 5, to: Target::At { anchor: 3, placement: Placement::Column { after: false } } }]);
+    assert_eq!(columns(&d.layout, Side::End), vec![vec![vec![5, 6]], vec![vec![3], vec![4]]]);
+
+    // The bottom edge band between the docks: the line along the canvas's bottom.
+    let mut d = creative();
+    let at = pos2(400.0, 597.0);
+    d.hold(d.hit(&Hit::DragBar(5)).unwrap().center(), at);
+    assert!(d.filled(Rect::from_x_y_ranges(204.0..=596.0, 596.0..=600.0)), "the line along the canvas's bottom edge");
+    assert_eq!(result_preview(&d), None);
+    let out = d.release(at);
+    assert!(
+        matches!(&out.actions[..], [Action::MoveGroup { panel: 5, to: Target::At { placement: Placement::Edge(Zone::Bottom), .. } }]),
+        "{:?}",
+        out.actions
+    );
+}
+
+#[test]
+fn a_tab_dropped_beside_a_dock_group_previews_the_rect_it_takes() {
+    // The bottom third of group [2], the left column's last group: a new group below it.
+    let mut d = creative();
+    let at = pos2(100.0, 560.0);
+    d.hold(d.hit(&Hit::Tab(6)).unwrap().center(), at);
+    let preview = result_preview(&d);
+    let out = d.release(at);
+    assert_eq!(out.actions, vec![Action::Move { panel: 6, anchor: 2, placement: Placement::Group { below: true, height: None } }]);
+    d.settle();
+    let rect = Rect::from_x_y_ranges(0.0..=200.0, d.hit(&Hit::Tab(6)).unwrap().top()..=600.0);
+    assert_eq!(preview, Some(rect.shrink(1.0)), "group 6's rect below group 2");
+}
diff --git a/crates/ui/src/docking/drop_tests.rs b/crates/ui/src/docking/drop_tests.rs
new file mode 100644
index 00000000..b70ec5c2
--- /dev/null
+++ b/crates/ui/src/docking/drop_tests.rs
@@ -0,0 +1,587 @@
+//! Drop targets of the default profile over frames: a group body's thirds, the tab outline,
+//! the fallback where a side has no room, and the root edge band.
+
+use std::collections::HashMap;
+
+use super::testing::DockDriver;
+use super::*;
+use crate::layout::{SplitAxis, SplitSize};
+use egui::{Color32, Pos2, Rect, pos2, vec2};
+
+/// Panel bodies by their rects; `rules` are the permissions of panels that differ from the
+/// default, `min_width` every panel's least width.
+#[derive(Default)]
+struct Bodies {
+    bodies: HashMap<u32, Rect>,
+    rules: HashMap<u32, Permissions>,
+    min_width: f32,
+}
+
+impl DockContent<u32> for Bodies {
+    fn body(&mut self, ui: &mut egui::Ui, panel: &u32) {
+        self.bodies.insert(*panel, ui.max_rect());
+    }
+    fn permissions(&self, panel: &u32) -> Permissions {
+        self.rules.get(panel).copied().unwrap_or_default()
+    }
+    fn limits(&self, _: &u32) -> PanelLimits {
+        PanelLimits { min: vec2(self.min_width, 0.0), ..PanelLimits::default() }
+    }
+}
+
+type Driver = DockDriver<u32, Bodies>;
+
+/// Frames `[1]` and `[2, 3]` side by side, each half of the area.
+fn frames() -> Layout<u32> {
+    Layout {
+        root: Some(Node::Split {
+            axis: SplitAxis::Horizontal,
+            size: SplitSize::Ratio(0.5),
+            first: Box::new(Node::Tabs { panels: vec![1], active: 0 }),
+            second: Box::new(Node::Tabs { panels: vec![2, 3], active: 1 }),
+        }),
+        floating: Vec::new(),
+    }
+}
+
+fn driver(rules: &[(u32, Permissions)]) -> Driver {
+    DockDriver::new(frames(), Bodies { rules: rules.iter().copied().collect(), ..Bodies::default() })
+}
+
+/// The body of `panel` and its group's rect, the 26 pt strip included.
+fn group(d: &Driver, panel: u32) -> (Rect, Rect) {
+    let body = d.content.bodies.get(&panel).copied().unwrap_or_else(|| panic!("panel {panel} not drawn"));
+    (body, Rect::from_min_max(pos2(body.left(), body.top() - 26.0), body.max))
+}
+
+fn tab(d: &Driver, panel: u32) -> Pos2 {
+    d.hit(&Hit::Tab(panel)).unwrap_or_else(|| panic!("tab {panel}")).center()
+}
+
+/// The fill of the last frame's rect shape at `rect` that has no stroke.
+fn fill_at(d: &Driver, rect: Rect) -> Option<Color32> {
+    d.shapes().iter().find_map(|clipped| match &clipped.shape {
+        egui::Shape::Rect(shape) if shape.rect == rect && shape.stroke.width == 0.0 && shape.fill != Color32::TRANSPARENT => Some(shape.fill),
+        _ => None,
+    })
+}
+
+/// The 4 pt line along `rect`'s edge on `zone`'s side, inside it.
+fn line(rect: Rect, zone: Zone) -> Rect {
+    match zone {
+        Zone::Left => Rect::from_x_y_ranges(rect.left()..=(rect.left() + 4.0), rect.y_range()),
+        Zone::Right => Rect::from_x_y_ranges((rect.right() - 4.0)..=rect.right(), rect.y_range()),
+        Zone::Top => Rect::from_x_y_ranges(rect.x_range(), rect.top()..=(rect.top() + 4.0)),
+        Zone::Bottom | Zone::Center => Rect::from_x_y_ranges(rect.x_range(), (rect.bottom() - 4.0)..=rect.bottom()),
+    }
+}
+
+fn accent() -> Color32 {
+    DockStyle::default().accent
+}
+
+#[test]
+fn a_drop_on_a_groups_outer_third_docks_beside_it_with_its_rect_and_its_middle_joins_with_an_outline() {
+    let d = driver(&[]);
+    let (body, rect) = group(&d, 1);
+    let (w, h) = (body.width(), body.height());
+    let line = |zone| line(rect, zone);
+    for (zone, at) in [
+        (Zone::Left, pos2(body.left() + w * 0.3, body.center().y)),
+        (Zone::Right, pos2(body.right() - w * 0.3, body.center().y)),
+        (Zone::Top, pos2(body.center().x, body.top() + h * 0.3)),
+        (Zone::Bottom, pos2(body.center().x, body.bottom() - h * 0.3)),
+        // In the top left corner, the top is relatively nearer.
+        (Zone::Top, pos2(body.left() + w * 0.25, body.top() + h * 0.2)),
+    ] {
+        let mut d = driver(&[]);
+        d.hold(tab(&d, 3), at);
+        assert!(!d.outlined(rect.shrink(1.0)), "{zone:?}");
+        let out = previews_result(driver(&[]), tab(&d, 3), at, |d| group(d, 3).1);
+        assert_eq!(out, vec![Action::Move { panel: 3, anchor: 1, placement: Placement::Split(zone) }], "{zone:?}");
+    }
+    // The middle and the tab strip join: the group's outline with a light fill, no line.
+    for at in [body.center(), pos2(rect.center().x, rect.top() + 13.0)] {
+        let mut d = driver(&[]);
+        d.hold(tab(&d, 3), at);
+        assert!(d.outlined(rect.shrink(1.0)), "{at:?}");
+        assert_eq!(fill_at(&d, rect.shrink(1.0)), Some(accent().gamma_multiply(0.08)), "{at:?}: a light fill");
+        assert!([Zone::Left, Zone::Right, Zone::Top, Zone::Bottom].into_iter().all(|z| !d.filled(line(z))), "{at:?}");
+        let out = d.release(at);
+        assert!(
+            matches!(&out.actions[..], [Action::Move { panel: 3, anchor: 1, placement: Placement::Tab { .. } | Placement::Split(Zone::Center) }]),
+            "{:?}",
+            out.actions
+        );
+    }
+    // A group's drag bar previews with the same painter.
+    let mut d = driver(&[]);
+    let bar = d.hit(&Hit::DragBar(2)).unwrap().center();
+    d.hold(bar, body.center());
+    assert!(d.outlined(rect.shrink(1.0)));
+}
+
+#[test]
+fn without_new_dock_zones_a_group_that_takes_no_tabs_maps_its_whole_body_to_its_edges() {
+    let canvas = Permissions { accepts_tabs: false, ..Permissions::default() };
+    let start = || driver(&[(1, canvas)]).with_style(|style| style.new_dock_zones = false);
+    let d = start();
+    let (body, rect) = group(&d, 1);
+    for (zone, at) in [(Zone::Left, body.center() - vec2(10.0, 0.0)), (Zone::Top, body.center() - vec2(0.0, 10.0))] {
+        let out = previews_result(start(), tab(&d, 3), at, |d| group(d, 3).1);
+        assert_eq!(out, vec![Action::Move { panel: 3, anchor: 1, placement: Placement::Split(zone) }], "{zone:?}");
+    }
+    // Its strip joins nothing.
+    let mut d = start();
+    let out = d.drag(tab(&d, 3), pos2(rect.center().x, rect.top() + 13.0));
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::Move { anchor: 1, placement: Placement::Tab { .. }, .. })), "{:?}", out.actions);
+}
+
+#[test]
+fn a_side_without_room_joins_as_a_tab_or_offers_nothing() {
+    // Two 400 pt frames of panels at least 300 wide: neither has room for two halves side by
+    // side, but both have room for two halves stacked.
+    let narrow = |rules: &[(u32, Permissions)]| {
+        DockDriver::new(frames(), Bodies { rules: rules.iter().copied().collect(), min_width: 300.0, ..Bodies::default() })
+    };
+    let d = narrow(&[]);
+    let (body, rect) = group(&d, 1);
+    let left = pos2(body.left() + body.width() * 0.25, body.center().y);
+    let mut d = narrow(&[]);
+    d.hold(tab(&d, 3), left);
+    assert!(d.outlined(rect.shrink(1.0)), "the tab outline");
+    let out = d.release(left);
+    assert_eq!(out.actions, vec![Action::Move { panel: 3, anchor: 1, placement: Placement::Split(Zone::Center) }]);
+    let top = pos2(body.center().x, body.top() + body.height() * 0.2);
+    let mut d = narrow(&[]);
+    let out = d.drag(tab(&d, 3), top);
+    assert_eq!(out.actions, vec![Action::Move { panel: 3, anchor: 1, placement: Placement::Split(Zone::Top) }]);
+    // A group that takes no tabs offers nothing there.
+    let mut d = narrow(&[(1, Permissions { accepts_tabs: false, ..Permissions::default() })]);
+    d.hold(tab(&d, 3), left);
+    assert!(!d.outlined(rect.shrink(1.0)));
+    let out = d.release(left);
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::Move { anchor: 1, .. })), "{:?}", out.actions);
+}
+
+#[test]
+fn the_root_edge_band_is_28_pt_and_previews_a_line_along_the_layouts_edge() {
+    let d = driver(&[]);
+    let (body, _) = group(&d, 1);
+    let x = body.center().x;
+    let window = Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0));
+    let out = previews_line(driver(&[]), tab(&d, 3), pos2(x, 573.0), line(window, Zone::Bottom));
+    assert!(matches!(&out[..], [Action::Move { panel: 3, placement: Placement::Edge(Zone::Bottom), .. }]), "{out:?}");
+    let mut d = driver(&[]);
+    d.drag(tab(&d, 3), pos2(x, 573.0));
+    d.settle();
+    let (_, rect) = group(&d, 3);
+    assert_eq!((rect.left(), rect.right(), rect.bottom()), (0.0, 800.0, 600.0), "along the layout's whole bottom edge");
+    // Past the band, the group's own bottom third.
+    let mut d = driver(&[]);
+    let out = d.drag(tab(&d, 3), pos2(x, 571.0));
+    assert_eq!(out.actions, vec![Action::Move { panel: 3, anchor: 1, placement: Placement::Split(Zone::Bottom) }]);
+    // The band reaches only 4 pt past its line into a tab strip, which joins the group.
+    let mut d = driver(&[]);
+    let out = d.drag(tab(&d, 3), pos2(x, 12.0));
+    assert!(matches!(&out.actions[..], [Action::Move { panel: 3, anchor: 1, placement: Placement::Tab { .. } }]), "{:?}", out.actions);
+    let mut d = driver(&[]);
+    let out = d.drag(tab(&d, 3), pos2(x, 7.0));
+    assert!(matches!(&out.actions[..], [Action::Move { panel: 3, placement: Placement::Edge(Zone::Top), .. }]), "{:?}", out.actions);
+}
+
+fn tabs(panels: &[u32]) -> Node<u32> {
+    Node::Tabs { panels: panels.to_vec(), active: 0 }
+}
+
+fn split(axis: SplitAxis, size: SplitSize, first: Node<u32>, second: Node<u32>) -> Node<u32> {
+    Node::Split { axis, size, first: Box::new(first), second: Box::new(second) }
+}
+
+/// Side frame `[1]`, canvas 0 and side frame `[2, 3]` side by side, 200, 400 and 200 pt wide.
+fn canvas_columns() -> Layout<u32> {
+    let sides = split(SplitAxis::Horizontal, SplitSize::FixedSecond(200.0), tabs(&[0]), Node::Tabs { panels: vec![2, 3], active: 1 });
+    Layout { root: Some(split(SplitAxis::Horizontal, SplitSize::FixedFirst(200.0), tabs(&[1]), sides)), floating: Vec::new() }
+}
+
+fn canvas_driver(canvas: Permissions, style: impl Fn(&mut DockStyle) + 'static) -> Driver {
+    DockDriver::new(canvas_columns(), Bodies { rules: [(0, canvas)].into(), ..Bodies::default() }).with_style(style)
+}
+
+fn moves(out: &DockOutput<u32>) -> bool {
+    out.actions.iter().any(|a| matches!(a, Action::Move { .. } | Action::MovePanel { .. }))
+}
+
+#[test]
+fn between_side_frames_the_outer_edge_band_covers_only_the_canvas_column() {
+    let d = canvas_driver(Permissions::PROTECTED, |_| {});
+    let (canvas, _) = group(&d, 0);
+    let (side, _) = group(&d, 1);
+    let at = pos2(canvas.center().x, 590.0);
+    let mut d = canvas_driver(Permissions::PROTECTED, |_| {});
+    // The line along the canvas column's bottom.
+    let out = previews_line(canvas_driver(Permissions::PROTECTED, |_| {}), tab(&d, 3), at, line(canvas, Zone::Bottom));
+    assert_eq!(out, vec![Action::Move { panel: 3, anchor: 0, placement: Placement::Edge(Zone::Bottom) }]);
+    d.drag(tab(&d, 3), at);
+    // The side frames keep their full height.
+    let column = split(SplitAxis::Vertical, SplitSize::Ratio(0.75), tabs(&[0]), tabs(&[3]));
+    let sides = split(SplitAxis::Horizontal, SplitSize::FixedSecond(200.0), column, tabs(&[2]));
+    assert_eq!(d.layout.root, Some(split(SplitAxis::Horizontal, SplitSize::FixedFirst(200.0), tabs(&[1]), sides)));
+    // Under a side frame, its own bottom third.
+    let mut d = canvas_driver(Permissions::PROTECTED, |_| {});
+    let out = d.drag(tab(&d, 3), pos2(side.center().x, 590.0));
+    assert_eq!(out.actions, vec![Action::Move { panel: 3, anchor: 1, placement: Placement::Split(Zone::Bottom) }]);
+}
+
+#[test]
+fn between_docks_the_outer_edge_band_covers_the_part_between_them() {
+    let dock = |side, panels: &[u32]| Node::Dock { side, columns: vec![Column::new(vec![Group::new(panels.to_vec(), 0)], 200.0)] };
+    let middle = split(SplitAxis::Vertical, SplitSize::Ratio(0.7), tabs(&[0]), tabs(&[4]));
+    let inner = split(SplitAxis::Horizontal, SplitSize::FixedSecond(200.0), middle.clone(), dock(Side::End, &[2, 3]));
+    let layout =
+        Layout { root: Some(split(SplitAxis::Horizontal, SplitSize::FixedFirst(200.0), dock(Side::Start, &[1]), inner)), floating: Vec::new() };
+    let driver = || DockDriver::new(layout.clone(), Bodies { rules: [(0, Permissions::PROTECTED)].into(), ..Bodies::default() });
+    let d = driver();
+    let (canvas, _) = group(&d, 0);
+    let (timeline, _) = group(&d, 4);
+    let area = Rect::from_x_y_ranges(canvas.x_range(), (canvas.top() - 26.0)..=timeline.bottom());
+    let at = pos2(canvas.center().x, 590.0);
+    // The line along the bottom between the docks.
+    let out = previews_line(driver(), tab(&d, 3), at, line(area, Zone::Bottom));
+    assert!(matches!(&out[..], [Action::Move { panel: 3, placement: Placement::Edge(Zone::Bottom), .. }]), "{out:?}");
+    let mut d = driver();
+    d.drag(tab(&d, 3), at);
+    let Some(Node::Split { second, .. }) = &d.layout.root else { panic!("{:?}", d.layout) };
+    let Node::Split { first, .. } = &**second else { panic!("{:?}", d.layout) };
+    assert_eq!(**first, split(SplitAxis::Vertical, SplitSize::Ratio(0.75), middle, tabs(&[3])));
+}
+
+/// The frame beside `panel`'s own: what an edge split with `panel` wrapped.
+fn wrapped(layout: &Layout<u32>, panel: u32) -> Option<Node<u32>> {
+    let Some(dock_model::Place::Node(path)) = layout.place(&panel) else { return None };
+    let (last, parent) = path.split_last()?;
+    layout.root.as_ref().and_then(|root| dock_model::node_at(root, &[parent, &[!last]].concat())).cloned()
+}
+
+#[test]
+fn over_a_full_width_row_the_top_edge_band_covers_only_the_canvas_column_above_it() {
+    // SoundCraft's Edit window: side frame 1, canvas 0 and side frame [2, 3] over a full-width
+    // editor 4.
+    let Some(upper) = canvas_columns().root else { panic!() };
+    let root = split(SplitAxis::Vertical, SplitSize::Ratio(0.7), upper.clone(), tabs(&[4]));
+    let layout = Layout { root: Some(root), floating: Vec::new() };
+    let driver = || DockDriver::new(layout.clone(), Bodies { rules: [(0, Permissions::PROTECTED)].into(), ..Bodies::default() });
+    let d = driver();
+    let (canvas, _) = group(&d, 0);
+    let at = pos2(canvas.center().x, 5.0);
+    // The line along the canvas column's top, not the window's.
+    let out = previews_line(driver(), tab(&d, 3), at, line(canvas, Zone::Top));
+    assert_eq!(out, vec![Action::Move { panel: 3, anchor: 0, placement: Placement::Edge(Zone::Top) }]);
+    let mut d = driver();
+    d.drag(tab(&d, 3), at);
+    assert_eq!(wrapped(&d.layout, 3), Some(tabs(&[0])), "{:?}", d.layout);
+}
+
+#[test]
+fn an_outer_edge_drop_wraps_the_area_it_previews_when_the_app_applies_other_permissions() {
+    // Frame [2, 3] and canvas 0 beside frame 1, which is protected only while drawing (PDFCraft's
+    // bare tools mode): drawn, the edge band is not narrowed to the canvas.
+    let inner = split(SplitAxis::Horizontal, SplitSize::Ratio(0.5), Node::Tabs { panels: vec![2, 3], active: 1 }, tabs(&[0]));
+    let layout = Layout { root: Some(split(SplitAxis::Horizontal, SplitSize::Ratio(0.7), inner, tabs(&[1]))), floating: Vec::new() };
+    let drawn = [(0, Permissions::PROTECTED), (1, Permissions::PROTECTED)];
+    let driver = || DockDriver::new(layout.clone(), Bodies { rules: drawn.into(), ..Bodies::default() });
+    let d = driver();
+    let (canvas, _) = group(&d, 0);
+    let at = pos2(canvas.center().x, 5.0);
+    let mut d = driver();
+    d.hold(tab(&d, 3), at);
+    assert!(d.filled(line(Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0)), Zone::Top)), "the line along the window's top");
+    assert_eq!(result_preview(&d), None);
+    let out = d.release(at);
+    let mut applied = layout.clone();
+    let apply = |p: &u32| if *p == 0 { Permissions::PROTECTED } else { Permissions::default() };
+    applied.apply_all(out.actions.clone(), apply).unwrap_or_else(|e| panic!("{e}: {:?}", out.actions));
+    let mut rest = layout;
+    rest.apply(Action::Close { panel: 3 }).unwrap();
+    assert_eq!(wrapped(&applied, 3), rest.root, "{:?}", out.actions);
+}
+
+#[test]
+fn drop_edges_limit_the_outer_edges_and_the_canvas_sides() {
+    let left_right = |style: &mut DockStyle| style.drop_edges = Sides::LEFT_RIGHT;
+    let d = canvas_driver(Permissions::PROTECTED, left_right);
+    // The canvas has no tab strip: its body is its frame.
+    let (canvas, _) = group(&d, 0);
+    let (side, _) = group(&d, 1);
+    // Without top and bottom, no outer edge takes a drop: left and right are docks here.
+    for at in [pos2(canvas.center().x, 590.0), pos2(canvas.left() + 5.0, 300.0), pos2(canvas.right() - 5.0, 300.0)] {
+        let mut d = canvas_driver(Permissions::PROTECTED, left_right);
+        d.hold(tab(&d, 3), at);
+        assert!(!d.filled(line(canvas, Zone::Bottom)), "{at:?}");
+        let out = d.release(at);
+        assert!(!moves(&out), "{at:?}: {:?}", out.actions);
+    }
+    // A side frame keeps all four sides.
+    for (zone, y) in [(Zone::Bottom, 590.0), (Zone::Top, side.top() + side.height() * 0.2)] {
+        let mut d = canvas_driver(Permissions::PROTECTED, left_right);
+        let out = d.drag(tab(&d, 3), pos2(side.center().x, y));
+        assert_eq!(out.actions, vec![Action::Move { panel: 3, anchor: 1, placement: Placement::Split(zone) }], "{zone:?}");
+    }
+    // No drop edges: no outer edge takes a drop.
+    for at in [pos2(canvas.center().x, 590.0), pos2(canvas.center().x, 5.0), pos2(canvas.left() + 5.0, 300.0), pos2(canvas.right() - 5.0, 300.0)] {
+        let mut d = canvas_driver(Permissions::PROTECTED, |style| style.drop_edges = Sides::NONE);
+        let out = d.drag(tab(&d, 3), at);
+        assert!(!moves(&out), "{at:?}: {:?}", out.actions);
+    }
+}
+
+#[test]
+fn without_new_dock_zones_a_canvas_that_takes_splits_takes_them_only_on_its_drop_edges() {
+    let beside = Permissions { accepts_splits: true, ..Permissions::PROTECTED };
+    let d = canvas_driver(beside, |_| {});
+    let (body, _) = group(&d, 0);
+    // Nearer the bottom than the left, and right of center nearer the right than the top.
+    let low = pos2(body.left() + body.width() * 0.3, body.bottom() - 40.0);
+    let high = pos2(body.right() - body.width() * 0.3, body.top() + 40.0);
+    for (edges, zones) in [
+        (DockStyle::default().drop_edges, [Some(Zone::Bottom), Some(Zone::Top)]),
+        (Sides::LEFT_RIGHT, [Some(Zone::Left), Some(Zone::Right)]),
+        (Sides::NONE, [None, None]),
+    ] {
+        for (at, zone) in [low, high].into_iter().zip(zones) {
+            let split_frames = move |style: &mut DockStyle| {
+                style.new_dock_zones = false;
+                style.drop_edges = edges;
+            };
+            let mut d = canvas_driver(beside, split_frames);
+            let out = d.drag(tab(&d, 3), at);
+            match zone {
+                Some(zone) => assert_eq!(out.actions, vec![Action::Move { panel: 3, anchor: 0, placement: Placement::Split(zone) }], "{edges:?}"),
+                None => assert!(!moves(&out), "{edges:?}: {:?}", out.actions),
+            }
+            // With new dock zones the canvas body takes no drop on any side.
+            let mut d = canvas_driver(beside, move |style| style.drop_edges = edges);
+            let out = d.drag(tab(&d, 3), at);
+            assert!(!moves(&out), "{edges:?}: {:?}", out.actions);
+        }
+    }
+}
+
+/// Whether the last frame painted a drop preview: an accent line, outline or fill.
+fn previews(d: &Driver) -> bool {
+    let accent = accent();
+    d.shapes().iter().any(|clipped| match &clipped.shape {
+        egui::Shape::Rect(shape) => shape.fill == accent || shape.fill == accent.gamma_multiply(0.08) || shape.stroke.color == accent,
+        egui::Shape::Path(path) => path.fill != Color32::TRANSPARENT && path.fill == accent.gamma_multiply(0.3),
+        _ => false,
+    })
+}
+
+fn ratio_split(axis: SplitAxis, ratio: f32, first: Node<u32>, second: Node<u32>) -> Node<u32> {
+    Node::Split { axis, size: SplitSize::Ratio(ratio), first: Box::new(first), second: Box::new(second) }
+}
+
+#[test]
+fn a_drop_that_changes_only_sizes_shows_nothing_and_does_nothing() {
+    // CADCraft's sidebar: Layers (2) alone above Properties (3) and a third group (4), beside
+    // the canvas (1); and the same with the column as one two-group split.
+    let nested = ratio_split(SplitAxis::Vertical, 0.3, tabs(&[2]), ratio_split(SplitAxis::Vertical, 0.5, tabs(&[3]), tabs(&[4])));
+    let flat = ratio_split(SplitAxis::Vertical, 0.3, tabs(&[2]), tabs(&[3]));
+    for column in [nested, flat] {
+        let layout = Layout { root: Some(ratio_split(SplitAxis::Horizontal, 0.6, tabs(&[1]), column)), floating: Vec::new() };
+        let start = || DockDriver::new(layout.clone(), Bodies::default());
+        let d = start();
+        let (body, _) = group(&d, 3);
+        let top = pos2(body.center().x, body.top() + body.height() * 0.2);
+        // Properties' bottom third moves Layers, with the rect it takes.
+        let below = pos2(body.center().x, body.bottom() - body.height() * 0.2);
+        previews_result(start(), tab(&d, 2), below, |d| group(d, 2).1);
+        // Its top third would put Layers back where it is.
+        let mut d = start();
+        d.hold(tab(&d, 2), top);
+        assert!(!previews(&d), "no outline or fill");
+        let out = d.release(top);
+        assert!(out.actions.is_empty(), "{:?}", out.actions);
+        assert_eq!(d.layout, layout);
+    }
+    // A lone frame's tab on the layout edge its frame already holds.
+    let layout = Layout { root: Some(ratio_split(SplitAxis::Vertical, 0.75, tabs(&[1]), tabs(&[4]))), floating: Vec::new() };
+    let mut d = DockDriver::new(layout.clone(), Bodies::default());
+    let at = pos2(400.0, 590.0);
+    d.hold(tab(&d, 4), at);
+    assert!(!previews(&d));
+    let out = d.release(at);
+    assert!(out.actions.is_empty(), "{:?}", out.actions);
+    assert_eq!(d.layout, layout);
+}
+
+#[test]
+fn a_dock_drop_that_changes_only_heights_shows_nothing_and_does_nothing() {
+    // A dock column of a sized lone group (2) above another (3), beside the canvas (1).
+    let column = Column::new(vec![Group { height: Some(150.0), ..Group::new(vec![2], 0) }, Group::new(vec![3], 0)], 240.0);
+    let dock = Node::Dock { side: Side::End, columns: vec![column] };
+    let root = Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedSecond(240.0), first: Box::new(tabs(&[1])), second: Box::new(dock) };
+    let layout = Layout { root: Some(root), floating: Vec::new() };
+    let start = || DockDriver::new(layout.clone(), Bodies::default());
+    let d = start();
+    let (body, rect) = group(&d, 3);
+    let (upper, _) = group(&d, 2);
+    // Below the lower group moves the upper one, with the rect it takes.
+    let mut d = start();
+    d.hold(tab(&d, 2), pos2(body.center().x, body.bottom() - body.height() * 0.2));
+    assert!(previews(&d));
+    // The lower group's top third and the seam between them put the group back where it is.
+    for at in [pos2(body.center().x, body.top() + body.height() * 0.2), pos2(body.center().x, (upper.bottom() + rect.top()) * 0.5)] {
+        let mut d = start();
+        d.hold(tab(&d, 2), at);
+        assert!(!previews(&d), "{at:?}: no preview");
+        let out = d.release(at);
+        assert!(out.actions.is_empty(), "{at:?}: {:?}", out.actions);
+        assert_eq!(d.layout, layout);
+    }
+}
+
+#[test]
+fn a_header_drag_of_a_windows_only_group_looks_through_its_window() {
+    // Group 4 floats alone over frame 1's left part.
+    let mut layout = frames();
+    layout.floating.push(Floating::single(vec![4], 0, [40.0, 150.0, 300.0, 260.0]));
+    let start = || DockDriver::new(layout.clone(), Bodies::default());
+    let d = start();
+    let (body, rect) = group(&d, 1);
+    let window = Rect::from_min_size(pos2(40.0, 150.0), vec2(300.0, 260.0));
+    let at = pos2(body.left() + body.width() * 0.25, body.center().y);
+    assert!(window.contains(at));
+    let bar = d.hit(&Hit::DragBar(4)).unwrap().center();
+    // Frame 1's left third, behind the window.
+    let out = previews_result(start(), bar, at, |d| {
+        let (_, group) = group(d, 4);
+        assert_eq!(group.left(), rect.left());
+        group
+    });
+    assert_eq!(out, vec![Action::MoveGroup { panel: 4, to: Target::At { anchor: 1, placement: Placement::Split(Zone::Left) } }]);
+}
+
+#[test]
+fn a_header_drag_in_a_window_of_two_groups_still_offers_the_other_group() {
+    let mut layout = frames();
+    let tree = ratio_split(SplitAxis::Vertical, 0.5, tabs(&[4]), tabs(&[5]));
+    layout.floating.push(Floating::new(tree, [40.0, 100.0, 300.0, 400.0]));
+    let start = || DockDriver::new(layout.clone(), Bodies::default());
+    let d = start();
+    let (body, rect) = group(&d, 5);
+    let mut d = start();
+    let bar = d.hit(&Hit::DragBar(4)).unwrap().center();
+    d.hold(bar, body.center());
+    assert!(d.outlined(rect.shrink(1.0)), "group 5 joins");
+    let out = d.release(body.center());
+    assert!(
+        matches!(
+            &out.actions[..],
+            [Action::MoveGroup { panel: 4, to: Target::At { anchor: 5, placement: Placement::Tab { .. } | Placement::Split(Zone::Center) } }]
+        ),
+        "{:?}",
+        out.actions
+    );
+}
+
+#[test]
+fn a_drop_beside_a_frame_too_narrow_to_halve_takes_room_from_its_neighbour() {
+    // Frame 2 is 60 pt wide beside frame 1; group 4 floats over frame 1.
+    let root =
+        Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedSecond(60.0), first: Box::new(tabs(&[1])), second: Box::new(tabs(&[2])) };
+    let layout = Layout { root: Some(root), floating: vec![Floating::single(vec![4], 0, [100.0, 100.0, 200.0, 200.0])] };
+    let start = || DockDriver::new(layout.clone(), Bodies::default());
+    let d = start();
+    let (body, rect) = group(&d, 2);
+    let at = pos2(body.left() + 8.0, body.center().y);
+    // The preview is the rect the group takes left of frame 2.
+    let out = previews_result(start(), tab(&d, 4), at, |d| group(d, 4).1);
+    assert!(matches!(&out[..], [Action::Move { panel: 4, anchor: 2, placement: Placement::SplitSized { zone: Zone::Left, .. } }]), "{out:?}");
+    let mut d = start();
+    d.drag(tab(&d, 4), at);
+    d.settle();
+    assert!((group(&d, 2).1.width() - rect.width()).abs() < 1.0, "frame 2 keeps its width");
+    assert!(group(&d, 4).1.width() >= 40.0);
+}
+
+/// The rect of the result preview the last frame painted: a 2 pt accent outline with a light
+/// fill.
+fn result_preview(d: &Driver) -> Option<Rect> {
+    let fill = accent().gamma_multiply(0.08);
+    d.shapes()
+        .iter()
+        .find_map(|clipped| match &clipped.shape {
+            egui::Shape::Rect(shape) if shape.fill == fill && shape.stroke.width == 0.0 => Some(shape.rect),
+            _ => None,
+        })
+        .filter(|rect| d.outlined(*rect))
+}
+
+/// Drags `from` to `at` and releases: the preview while held is the drop line `line`, with no
+/// result rect. Returns the drop's actions.
+fn previews_line(mut d: Driver, from: Pos2, at: Pos2, line: Rect) -> Vec<Action<u32>> {
+    d.hold(from, at);
+    assert!(d.filled(line), "the line {line:?}");
+    assert_eq!(result_preview(&d), None);
+    let out = d.release(at);
+    d.settle();
+    out.actions
+}
+
+/// Drags `from` to `at` and back to rest: the preview while held is the rect `rect_of` reads
+/// once the drop is applied, inset by its 1 pt margin. Returns the drop's actions.
+fn previews_result(mut d: Driver, from: Pos2, at: Pos2, rect_of: impl Fn(&Driver) -> Rect) -> Vec<Action<u32>> {
+    d.hold(from, at);
+    let preview = result_preview(&d);
+    let out = d.release(at);
+    d.settle();
+    assert_eq!(preview, Some(rect_of(&d).shrink(1.0)), "{:?}", out.actions);
+    out.actions
+}
+
+#[test]
+fn a_drop_beside_a_frame_previews_the_rect_the_group_takes() {
+    let d = driver(&[]);
+    let (body, _) = group(&d, 1);
+    let at = pos2(body.left() + body.width() * 0.2, body.center().y);
+    let out = previews_result(driver(&[]), tab(&d, 3), at, |d| group(d, 3).1);
+    assert_eq!(out, vec![Action::Move { panel: 3, anchor: 1, placement: Placement::Split(Zone::Left) }]);
+    // A whole group the same.
+    let bar = d.hit(&Hit::DragBar(2)).unwrap().center();
+    // Panel 3 is the group's selected tab, the one it draws.
+    let out = previews_result(driver(&[]), bar, at, |d| group(d, 3).1);
+    assert_eq!(out, vec![Action::MoveGroup { panel: 2, to: Target::At { anchor: 1, placement: Placement::Split(Zone::Left) } }]);
+}
+
+/// A 240 pt dock column at the start, group `[2]` above `[3, 4]`, beside frame 1.
+fn dock_driver() -> Driver {
+    let column = Column::new(vec![Group::new(vec![2], 0), Group::new(vec![3, 4], 0)], 240.0);
+    let dock = Node::Dock { side: Side::Start, columns: vec![column] };
+    let root = Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedFirst(240.0), first: Box::new(dock), second: Box::new(tabs(&[1])) };
+    DockDriver::new(Layout { root: Some(root), floating: Vec::new() }, Bodies::default())
+}
+
+/// The rect of the dock column of `panel`'s group, its bar included, when that group fills it.
+fn column_of(d: &Driver, panel: u32) -> Rect {
+    let bar = d.hit(&Hit::ColumnBar(panel)).unwrap_or_else(|| panic!("column bar {panel}"));
+    let (body, _) = group(d, panel);
+    Rect::from_x_y_ranges(body.x_range(), bar.top()..=body.bottom())
+}
+
+#[test]
+fn a_dock_drop_previews_the_rect_the_group_or_column_takes() {
+    let d = dock_driver();
+    let (upper, _) = group(&d, 2);
+    // Above group 2: a new group at the column's top.
+    let at = pos2(upper.center().x, upper.top() + 10.0);
+    let out = previews_result(dock_driver(), tab(&d, 4), at, |d| group(d, 4).1);
+    assert_eq!(out, vec![Action::Move { panel: 4, anchor: 2, placement: Placement::Group { below: false, height: None } }]);
+    // The column's inner edge: a new column after it, the full height.
+    let out = previews_result(dock_driver(), tab(&d, 4), pos2(upper.right() + 6.0, 200.0), |d| column_of(d, 4));
+    assert_eq!(out, vec![Action::Move { panel: 4, anchor: 2, placement: Placement::Column { after: true } }]);
+    // The window's right edge: a new dock, previewed by the line along that edge.
+    let window = Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0));
+    let out = previews_line(dock_driver(), tab(&d, 4), pos2(795.0, 200.0), line(window, Zone::Right));
+    assert_eq!(out, vec![Action::MovePanel { panel: 4, to: Target::NewDock { side: Side::End } }]);
+}
diff --git a/crates/ui/src/docking/floating_tests.rs b/crates/ui/src/docking/floating_tests.rs
new file mode 100644
index 00000000..34d1a4b2
--- /dev/null
+++ b/crates/ui/src/docking/floating_tests.rs
@@ -0,0 +1,847 @@
+//! Floating windows (title bar, stacks, close), the split-tree settings (outer edge, Maximize,
+//! Ctrl/Cmd undock, frame menu items), hidden panels, native windows and the public chrome.
+
+use super::*;
+use crate::layout::{SplitAxis, SplitSize};
+use egui::{Context, Event, Id, Modifiers, PointerButton, RawInput, Rect, Vec2, pos2, vec2};
+
+const AREA: &str = "floating-area";
+
+fn tabs(panels: &[u32], active: usize) -> Node<u32> {
+    Node::Tabs { panels: panels.to_vec(), active }
+}
+
+/// `[1] | [2, 3]` with panel 3 selected.
+fn frames() -> Layout<u32> {
+    Layout {
+        root: Some(Node::Split {
+            axis: SplitAxis::Horizontal,
+            size: SplitSize::FixedFirst(300.0),
+            first: Box::new(tabs(&[1], 0)),
+            second: Box::new(tabs(&[2, 3], 1)),
+        }),
+        floating: Vec::new(),
+    }
+}
+
+/// A start dock (`[2, 3]` above `[4]`) beside protected canvas 0; window W1 stacks `[5]` above
+/// `[6, 7]`; window W2 holds `[8]`.
+fn workspace() -> Layout<u32> {
+    Layout {
+        root: Some(Node::Split {
+            axis: SplitAxis::Horizontal,
+            size: SplitSize::FixedFirst(240.0),
+            first: Box::new(Node::Dock {
+                side: Side::Start,
+                columns: vec![Column::new(vec![Group::new(vec![2, 3], 1), Group::new(vec![4], 0)], 240.0)],
+            }),
+            second: Box::new(tabs(&[0], 0)),
+        }),
+        floating: vec![
+            Floating::stack(vec![Group::new(vec![5], 0), Group::new(vec![6, 7], 1)], [300.0, 80.0, 240.0, 300.0]).unwrap(),
+            Floating::single(vec![8], 0, [560.0, 300.0, 200.0, 200.0]),
+        ],
+    }
+}
+
+#[derive(Default)]
+struct Content {
+    native: bool,
+    keep: Vec<u32>,
+    /// Canvas 0 accepts side splits, as an app that opens panels beside it does.
+    beside: bool,
+    drawn: Vec<u32>,
+    /// A preview the host draws for every drag, from `resolve_drag`.
+    host_preview: Option<Rect>,
+}
+
+impl DockContent<u32> for Content {
+    fn body(&mut self, ui: &mut egui::Ui, panel: &u32) {
+        self.drawn.push(*panel);
+        ui.label("Body");
+    }
+    fn logical_label(&self, panel: &u32) -> String {
+        format!("Panel {panel}")
+    }
+    fn permissions(&self, panel: &u32) -> Permissions {
+        match *panel {
+            0 if self.beside => Permissions { accepts_splits: true, ..Permissions::PROTECTED },
+            0 => Permissions::PROTECTED,
+            _ => Permissions::default(),
+        }
+    }
+    fn allow_native(&self, _: &u32) -> bool {
+        self.native
+    }
+    fn resolve_drag(&mut self, _: &Context, _: &DockStyle, _: &DropRequest<'_, u32>) -> Option<DropFeedback> {
+        self.host_preview.map(|rect| DropFeedback { preview: Some(rect), insertion: None })
+    }
+}
+
+#[derive(Clone, Copy, PartialEq)]
+enum Hide {
+    None,
+    All,
+    Keep,
+}
+
+/// The style of an editor whose layout is one split tree of tab groups, as FilmCraft sets it.
+pub(super) fn frame_style(style: &mut DockStyle) {
+    style.side_edge_zones = true;
+    style.new_dock_zones = false;
+    style.close_others_item = true;
+    style.maximize_item = true;
+    style.command_press_floats = true;
+    style.float_on_empty_drop = false;
+    style.title_bar_docks = false;
+    style.float_hint = true;
+    style.wheel_selects_tabs = true;
+    style.middle_click_closes_tabs = true;
+    style.float_label = "Undock Panel".into();
+    style.float_group_label = "Undock Panel Group".into();
+    style.close_group_label = "Close Panel Group".into();
+}
+
+struct Driver {
+    ctx: Context,
+    layout: Layout<u32>,
+    content: Content,
+    split_tree: bool,
+    maximized: Option<u32>,
+    hide: Hide,
+    modifiers: Modifiers,
+    time: f64,
+    /// What the last frame painted.
+    shapes: Vec<egui::epaint::ClippedShape>,
+}
+
+impl Driver {
+    /// Create a floating test driver and run two empty frames to settle sizing.
+    fn new(layout: Layout<u32>, split_tree: bool) -> Self {
+        let mut driver = Self {
+            ctx: Context::default(),
+            layout,
+            content: Content::default(),
+            split_tree,
+            maximized: None,
+            hide: Hide::None,
+            modifiers: Modifiers::NONE,
+            time: 0.0,
+            shapes: Vec::new(),
+        };
+        driver.step(vec![]);
+        driver.step(vec![]);
+        driver
+    }
+
+    /// One 800×600 frame with an inserted modifier event, optional split-tree style/native
+    /// windows/maximized frame/hidden panels. Clears texture deltas and returns `DockOutput`.
+    fn frame(&mut self, mut events: Vec<Event>) -> DockOutput<u32> {
+        let mut output = DockOutput::default();
+        events.insert(0, Event::ModifiersChanged(self.modifiers));
+        self.time += 1.0 / 60.0;
+        let input = RawInput {
+            screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0))),
+            events,
+            focused: true,
+            time: Some(self.time),
+            ..Default::default()
+        };
+        let (layout, content, split_tree, maximized, hide) = (&self.layout, &mut self.content, self.split_tree, self.maximized, self.hide);
+        let keep: Vec<u32> = content.keep.clone();
+        let keep = move |p: &u32| keep.contains(p);
+        let full = self.ctx.run_ui(input, |ui| {
+            let mut style = DockStyle::from_ui(ui);
+            if split_tree {
+                frame_style(&mut style);
+            }
+            let hide = match hide {
+                Hide::None => HidePanels::None,
+                Hide::All => HidePanels::All,
+                Hide::Keep => HidePanels::Except(&keep),
+            };
+            output =
+                DockArea::new(Id::unique(AREA)).native_windows(true).maximized(maximized).hide_panels(hide).show_content(ui, layout, &style, content);
+        });
+        let mut full = full;
+        full.textures_delta.clear();
+        self.shapes = full.shapes;
+        output
+    }
+
+    fn step(&mut self, events: Vec<Event>) -> DockOutput<u32> {
+        let output = self.frame(events);
+        assert!(output.error.is_none(), "{output:?}");
+        for action in &output.actions {
+            self.layout.apply_with_permissions(action.clone(), |p| self.content.permissions(p)).unwrap();
+        }
+        output
+    }
+
+    fn response(&self, id: Id) -> Option<Rect> {
+        self.ctx.read_response(id).map(|r| r.rect)
+    }
+
+    /// Read the response rectangle of the move bar whose first panel is `first`.
+    fn title(&self, first: u32) -> Rect {
+        self.response(Id::unique(AREA).with(("move-group", Some(&first)))).unwrap()
+    }
+
+    /// Read `panel`'s tab response rectangle, or `None` when it is not rendered.
+    fn tab(&self, panel: u32) -> Option<Rect> {
+        self.response(Id::unique(AREA).with(("tab", &panel)))
+    }
+
+    fn hold(&mut self, from: egui::Pos2, to: egui::Pos2) -> DockOutput<u32> {
+        self.step(vec![Event::PointerMoved(from), button(from, true)]);
+        self.step(vec![Event::PointerMoved(from + vec2(8.0, 6.0))]);
+        self.step(vec![Event::PointerMoved(to)])
+    }
+
+    fn drag(&mut self, from: egui::Pos2, to: egui::Pos2) -> DockOutput<u32> {
+        self.hold(from, to);
+        self.step(vec![button(to, false)])
+    }
+
+    fn click(&mut self, at: egui::Pos2) -> DockOutput<u32> {
+        self.step(vec![Event::PointerMoved(at), button(at, true)]);
+        self.step(vec![button(at, false)])
+    }
+
+    /// Opacity of the floating window that the last frame drew at `rect`: the alpha of its
+    /// opaque background fill.
+    fn window_opacity(&self, rect: [f32; 4]) -> Option<f32> {
+        let rect = Rect::from_min_size(pos2(rect[0], rect[1]), vec2(rect[2], rect[3]));
+        fn find(shape: &egui::Shape, rect: Rect) -> Option<f32> {
+            match shape {
+                egui::Shape::Vec(shapes) => shapes.iter().find_map(|s| find(s, rect)),
+                egui::Shape::Rect(r) if r.rect.min.distance(rect.min) < 0.5 && r.rect.max.distance(rect.max) < 0.5 && r.fill.a() > 0 => {
+                    Some(f32::from(r.fill.a()) / 255.0)
+                }
+                _ => None,
+            }
+        }
+        self.shapes.iter().find_map(|s| find(&s.shape, rect))
+    }
+
+    fn wait(&mut self) {
+        for _ in 0..45 {
+            self.step(vec![]);
+        }
+    }
+}
+
+fn done(mut full: egui::FullOutput) {
+    full.textures_delta.clear();
+}
+
+fn button(pos: egui::Pos2, pressed: bool) -> Event {
+    Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE }
+}
+
+fn window_of(layout: &Layout<u32>, panel: u32) -> Option<&Floating<u32>> {
+    layout.floating.iter().find(|w| w.contains(&panel))
+}
+
+fn groups_of(window: &Floating<u32>) -> Vec<Vec<u32>> {
+    window.groups().iter().map(|g| g.panels.clone()).collect()
+}
+
+#[test]
+fn title_bar_drag_moves_every_stacked_group_and_drops_into_a_dock_as_stacked_groups() {
+    // The window follows the pointer with every group; Escape puts it back.
+    let mut d = Driver::new(workspace(), false);
+    let title = d.title(5).center();
+    d.hold(title, title + vec2(40.0, 30.0));
+    assert_eq!(d.layout.floating[0].rect, [340.0, 110.0, 240.0, 300.0]);
+    assert_eq!(groups_of(&d.layout.floating[0]), vec![vec![5], vec![6, 7]]);
+    d.step(vec![Event::Key { key: egui::Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE }]);
+    d.step(vec![button(title + vec2(40.0, 30.0), false)]);
+    assert_eq!(d.layout, workspace());
+
+    // Released over another window's lower band: its tree goes below that window's group,
+    // unless that leaves a group without room; then its panels join that group.
+    let out = d.drag(title, pos2(660.0, 480.0));
+    assert!(
+        out.actions.contains(&Action::MoveWindow { panel: 5, to: Target::At { anchor: 8, placement: Placement::Split(Zone::Center) } }),
+        "{:?}",
+        out.actions
+    );
+    assert_eq!(d.layout.floating.len(), 1);
+    assert_eq!(groups_of(&d.layout.floating[0]), vec![vec![8, 5, 6, 7]]);
+
+    // Released over a docked group's strip: every panel joins it as tabs.
+    let mut d = Driver::new(workspace(), false);
+    let title = d.title(5).center();
+    let strip = d.tab(4).unwrap().center();
+    let out = d.drag(title, strip);
+    assert!(out.actions.iter().any(|a| matches!(a, Action::MoveWindow { panel: 5, to: Target::At { anchor: 4, .. } })), "{:?}", out.actions);
+    assert!(window_of(&d.layout, 5).is_none() && window_of(&d.layout, 7).is_none());
+    assert_eq!(d.layout.place(&4), d.layout.place(&6));
+
+    // Released over the canvas: the window stays where it was moved and hosts get the release.
+    let mut d = Driver::new(workspace(), false);
+    let title = d.title(5).center();
+    let out = d.drag(title, pos2(500.0, 300.0));
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::MoveWindow { .. })), "{:?}", out.actions);
+    assert_eq!(out.group_drop, Some((5, pos2(500.0, 300.0))));
+    assert_eq!(groups_of(window_of(&d.layout, 5).unwrap()), vec![vec![5], vec![6, 7]]);
+}
+
+#[test]
+/// Releasing a floating window's title bar on a dock seam stacks its group
+/// between the target groups; releasing on the edge band makes an end dock.
+fn title_bar_drag_onto_dock_targets_docks_the_window() {
+    // Released on the seam between two docked groups: the window's group stacks between them.
+    let mut d = Driver::new(workspace(), false);
+    let title = d.title(8).center();
+    let seam = pos2(120.0, d.tab(4).unwrap().top());
+    let out = d.drag(title, seam);
+    assert!(
+        out.actions
+            .contains(&Action::MoveWindow { panel: 8, to: Target::At { anchor: 2, placement: Placement::Group { below: true, height: None } } }),
+        "{:?}",
+        out.actions
+    );
+    assert!(window_of(&d.layout, 8).is_none());
+    let Some(Node::Split { first, .. }) = &d.layout.root else { panic!("{:?}", d.layout.root) };
+    let Node::Dock { columns, .. } = first.as_ref() else { panic!("{first:?}") };
+    let stacked: Vec<_> = columns[0].groups.iter().map(|g| g.panels.clone()).collect();
+    assert_eq!(stacked, vec![vec![2, 3], vec![8], vec![4]]);
+
+    // Released on the new-dock band along the right edge: the window becomes an end dock.
+    let mut d = Driver::new(workspace(), false);
+    let title = d.title(5).center();
+    let out = d.drag(title, pos2(796.0, 300.0));
+    assert!(out.actions.contains(&Action::MoveWindow { panel: 5, to: Target::NewDock { side: Side::End } }), "{:?}", out.actions);
+    assert!(window_of(&d.layout, 5).is_none() && window_of(&d.layout, 6).is_none());
+}
+
+#[test]
+/// A group dragged to another floating window's top band splits that window like a frame; the gap
+/// between groups is not a target, and the window divider resizes both sides.
+fn a_floating_window_is_a_tree_whose_groups_split_and_resize_like_frames() {
+    // A group dragged by its bar to another window's top band splits that window's group.
+    let mut d = Driver::new(workspace(), false);
+    let bar = d.response(Id::unique(AREA).with(("drag-bar", Some(&6u32)))).unwrap().center();
+    let out = d.drag(bar, pos2(660.0, 360.0));
+    assert!(
+        out.actions.contains(&Action::MoveGroup { panel: 6, to: Target::At { anchor: 8, placement: Placement::Split(Zone::Top) } }),
+        "{:?}",
+        out.actions
+    );
+    assert_eq!(groups_of(window_of(&d.layout, 8).unwrap()), vec![vec![6, 7], vec![8]]);
+    assert_eq!(groups_of(window_of(&d.layout, 5).unwrap()), vec![vec![5]]);
+
+    // The gap between two groups of a window is no target.
+    let mut d = Driver::new(workspace(), false);
+    let tab = d.tab(8).unwrap().center();
+    let gap = pos2(420.0, d.tab(6).unwrap().top() - 2.0);
+    d.drag(tab, gap);
+    assert_eq!(d.layout, workspace());
+
+    // The divider between them resizes both.
+    let mut d = Driver::new(workspace(), false);
+    let divider = d.response(DockArea::hit_id(Id::unique(AREA), &Hit::Divider(Divider::WindowSplit(5u32, Vec::new())))).unwrap().center();
+    d.drag(divider, divider + vec2(0.0, 40.0));
+    let Node::Split { size: SplitSize::Ratio(ratio), .. } = window_of(&d.layout, 5).unwrap().root else { panic!("{:?}", d.layout) };
+    assert!(ratio > 0.6, "{ratio}");
+}
+
+#[test]
+/// Double-clicking the window title toggles minimization of the whole window; the close box sits
+/// 10 pt in from the trailing edge and emits `CloseWindow`, removing every panel in the window.
+fn title_bar_double_click_minimizes_every_group_and_close_box_closes_the_window() {
+    let mut d = Driver::new(workspace(), false);
+    let title = d.title(5).center();
+    d.click(title);
+    d.click(title);
+    assert!(window_of(&d.layout, 5).unwrap().minimized);
+    d.wait();
+    d.click(title);
+    d.click(title);
+    assert!(!window_of(&d.layout, 5).unwrap().minimized);
+
+    let close = d.response(Id::unique(AREA).with(("move-group", Some(&5u32))).with("close")).unwrap();
+    assert_eq!(close.center().x, 530.0, "× sits 10 pt in from the right edge");
+    let before = d.layout.clone();
+    d.wait();
+    let out = d.click(close.center());
+    assert_eq!(out.actions, vec![Action::CloseWindow { panel: 5 }]);
+    assert_eq!(before.closed_by(&Action::CloseWindow { panel: 5 }), Ok(vec![5, 6, 7]));
+    assert!(window_of(&d.layout, 6).is_none() && d.layout.contains(&8));
+}
+
+#[test]
+fn closed_floating_window_reopens_each_panel_at_its_last_rect() {
+    let mut layout = workspace();
+    let locations: Vec<_> = [5, 6, 7].map(|p| (p, layout.location(&p).unwrap())).into();
+    layout.apply(Action::CloseWindow { panel: 6 }).unwrap();
+    for (panel, location) in locations {
+        layout.restore(panel, &location).unwrap();
+        assert_eq!(window_of(&layout, panel).unwrap().rect, [300.0, 80.0, 240.0, 300.0], "{panel}");
+    }
+}
+
+#[test]
+fn ctrl_drag_from_a_frame_strip_undocks_to_a_floating_window() {
+    let mut d = Driver::new(frames(), true);
+    let tab = d.tab(3).unwrap().center();
+    let other = d.tab(1).unwrap().center();
+    d.modifiers = Modifiers::COMMAND;
+    d.hold(tab, other);
+    d.modifiers = Modifiers::NONE;
+    let out = d.step(vec![button(other, false)]);
+    assert!(matches!(out.actions.as_slice(), [Action::Float { panel: 3, .. }]), "{:?}", out.actions);
+    assert!(window_of(&d.layout, 3).is_some());
+
+    // Without the modifier the same drag joins the other frame.
+    let mut d = Driver::new(frames(), true);
+    let out = d.drag(tab, other);
+    assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 3, anchor: 1, .. }]), "{:?}", out.actions);
+}
+
+#[test]
+fn outer_edge_band_splits_at_the_root() {
+    // With side edge zones: all four edges.
+    let mut d = Driver::new(frames(), true);
+    let tab = d.tab(3).unwrap().center();
+    let out = d.drag(tab, pos2(3.0, 300.0));
+    assert!(out.actions.contains(&Action::Move { panel: 3, anchor: 1, placement: Placement::Edge(Zone::Left) }), "{:?}", out.actions);
+    let Some(Node::Split { axis: SplitAxis::Horizontal, first, .. }) = &d.layout.root else { panic!("{:?}", d.layout) };
+    assert_eq!(**first, tabs(&[3], 0));
+
+    // The defaults: the bottom edge of the part between the docks, for a Timeline.
+    let mut d = Driver::new(Layout { floating: Vec::new(), ..workspace() }, false);
+    let tab = d.tab(2).unwrap().center();
+    let out = d.drag(tab, pos2(500.0, 597.0));
+    assert!(out.actions.iter().any(|a| matches!(a, Action::Move { panel: 2, placement: Placement::Edge(Zone::Bottom), .. })), "{:?}", out.actions);
+    let Some(Node::Split { first, second, .. }) = &d.layout.root else { panic!() };
+    assert!(matches!(**first, Node::Dock { .. }));
+    assert!(matches!(&**second, Node::Split { axis: SplitAxis::Vertical, second, .. } if **second == tabs(&[2], 0)));
+
+    // Its left and right edges are the docks' (new columns and docks), not root splits.
+    let mut d = Driver::new(Layout { floating: Vec::new(), ..workspace() }, false);
+    let tab = d.tab(4).unwrap().center();
+    let out = d.drag(tab, pos2(246.0, 300.0));
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::Move { placement: Placement::Edge(_), .. })), "{:?}", out.actions);
+}
+
+#[test]
+/// With split-tree chrome, a drop 7 pt inside the outer edge targets the edge
+/// dock, while a drop at 10 pt targets frame [1]'s split zone.
+fn the_split_tree_outer_edge_band_is_8_pt() {
+    let mut d = Driver::new(frames(), true);
+    let tab = d.tab(3).unwrap().center();
+    let out = d.drag(tab, pos2(7.0, 300.0));
+    assert!(out.actions.contains(&Action::Move { panel: 3, anchor: 1, placement: Placement::Edge(Zone::Left) }), "{:?}", out.actions);
+    // Past it, frame [1]'s left side zone.
+    let mut d = Driver::new(frames(), true);
+    let out = d.drag(tab, pos2(10.0, 300.0));
+    assert!(out.actions.contains(&Action::Move { panel: 3, anchor: 1, placement: Placement::Split(Zone::Left) }), "{:?}", out.actions);
+}
+
+#[test]
+/// Maximizing a frame makes it start at the area edge; another frame's tab is not rendered and the
+/// hidden floating window's move-group response is absent, so dragging its title emits no move. A
+/// floating panel cannot be maximized.
+fn maximized_frame_fills_the_area_and_other_frames_do_not_render_or_take_input() {
+    let mut layout = frames();
+    layout.floating.push(Floating::single(vec![5], 0, [400.0, 300.0, 200.0, 150.0]));
+    let mut d = Driver::new(layout.clone(), true);
+    let window_title = d.title(5).center();
+    d.maximized = Some(2);
+    d.step(vec![]);
+    d.step(vec![]);
+    assert_eq!(d.tab(2).unwrap().left(), 0.0, "the maximized frame starts at the area's edge");
+    assert!(d.tab(1).is_none());
+    assert!(d.response(Id::unique(AREA).with(("move-group", Some(&5u32)))).is_none());
+    let out = d.drag(window_title, window_title + vec2(30.0, 30.0));
+    assert!(out.actions.iter().all(|a| !matches!(a, Action::MoveFloating { .. } | Action::MoveWindow { .. })), "{:?}", out.actions);
+
+    // A floating panel does not maximize.
+    let mut d = Driver::new(layout, true);
+    d.maximized = Some(5);
+    d.step(vec![]);
+    d.step(vec![]);
+    assert!(d.tab(1).is_some());
+}
+
+#[test]
+/// The tab context menu exposes the expected group actions without Minimize; Close Other emits
+/// `CloseOthers` leaving only the chosen tab, and Maximize Frame emits `ToggleMaximize`.
+fn close_other_panels_keeps_only_the_chosen_tab() {
+    use egui_kittest::{Harness, kittest::Queryable};
+    type State = (Content, Vec<Action<u32>>, Vec<DockEvent<u32>>);
+    let mut h = Harness::builder().with_size(vec2(800.0, 600.0)).build_ui_state(
+        |ui, (content, actions, events): &mut State| {
+            let mut style = DockStyle::from_ui(ui);
+            frame_style(&mut style);
+            let out = DockArea::new(Id::unique(AREA)).native_windows(true).show_content(ui, &frames(), &style, content);
+            actions.extend(out.actions);
+            events.extend(out.events);
+        },
+        (Content::default(), Vec::new(), Vec::new()),
+    );
+    h.run_steps(2);
+    let at = h.ctx.read_response(Id::unique(AREA).with(("tab", &3u32))).unwrap().rect.center();
+    let open_menu = |h: &mut Harness<'_, State>| {
+        h.input_mut().events.extend([
+            Event::PointerMoved(at),
+            Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: true, modifiers: Modifiers::NONE },
+        ]);
+        h.run_steps(1);
+        h.input_mut().events.push(Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: false, modifiers: Modifiers::NONE });
+        h.run_steps(2);
+    };
+    open_menu(&mut h);
+    for label in ["Undock Panel", "Close Panel Group", "Undock Panel Group", "Close Other Panels in Group", "Maximize Frame"] {
+        assert_eq!(h.query_all_by_label(label).count(), 1, "{label}");
+    }
+    assert_eq!(h.query_all_by_label("Minimize").count(), 0);
+    h.get_by_label("Close Other Panels in Group").click();
+    h.run_steps(2);
+    assert_eq!(h.state().1, vec![Action::CloseOthers { panel: 3 }]);
+    let mut layout = frames();
+    layout.apply(Action::CloseOthers { panel: 3 }).unwrap();
+    assert!(layout.contains(&3) && !layout.contains(&2));
+
+    open_menu(&mut h);
+    h.get_by_label("Maximize Frame").click();
+    h.run_steps(2);
+    assert_eq!(h.state().2, vec![DockEvent::ToggleMaximize { panel: 3 }]);
+}
+
+#[test]
+/// Hiding every panel draws no tabs and leaves the layout unchanged; the
+/// `Except` set keeps only its panels, with a retained window below the resize band.
+fn hide_panels_keeps_protected_panels_and_the_except_set() {
+    let mut d = Driver::new(workspace(), false);
+    d.hide = Hide::All;
+    d.step(vec![]);
+    d.step(vec![]);
+    for panel in [2, 3, 4, 5, 6, 8] {
+        assert!(d.tab(panel).is_none(), "{panel}");
+    }
+    assert!(d.layout == workspace(), "hiding leaves the layout unchanged");
+
+    d.hide = Hide::Keep;
+    d.content.keep = vec![4, 6];
+    d.step(vec![]);
+    d.step(vec![]);
+    assert_eq!(d.tab(4).map(|r| r.left()), Some(0.0));
+    assert!(d.tab(6).is_some());
+    for panel in [2, 3, 5, 7, 8] {
+        assert!(d.tab(panel).is_none(), "{panel}");
+    }
+    // A window keeps its rect with its hidden groups left out.
+    d.step(vec![]);
+    assert_eq!(d.title(6).min, pos2(300.0, 84.0), "below the resize band");
+}
+
+#[test]
+/// A protected canvas that accepts splits is still kept when every panel is hidden, and draws
+/// neither a tab nor a drag bar.
+fn a_canvas_that_accepts_splits_is_still_protected() {
+    let mut d = Driver::new(workspace(), false);
+    d.content.beside = true;
+    d.hide = Hide::All;
+    d.step(vec![]);
+    d.content.drawn.clear();
+    d.step(vec![]);
+    assert_eq!(d.content.drawn, vec![0], "hiding every panel keeps the canvas");
+    assert!(d.tab(0).is_none());
+    assert!(d.response(DockArea::<u32>::hit_id(Id::unique(AREA), &Hit::DragBar(0))).is_none());
+}
+
+#[test]
+/// When viewports are embedded, a floating window marked native draws in the
+/// main window at its usual rect without emitting actions.
+fn native_window_falls_back_in_window_when_viewports_are_embedded() {
+    let mut layout = workspace();
+    layout.floating[0].native = Some([1200.0, 900.0, 240.0, 300.0]);
+    let mut d = Driver::new(layout.clone(), false);
+    d.content.native = true;
+    assert!(d.ctx.embed_viewports());
+    let out = d.step(vec![]);
+    assert!(out.actions.is_empty(), "{out:?}");
+    assert_eq!(d.title(5).min, pos2(300.0, 84.0));
+    assert_eq!(d.layout, layout);
+}
+
+#[cfg(feature = "native-windows")]
+#[test]
+/// With real viewports, a close event from a native window's backend produces `CloseWindow` and
+/// removes all of that window's panels.
+fn native_window_close_closes_its_panels() {
+    use std::{cell::Cell, rc::Rc};
+    let close = Rc::new(Cell::new(false));
+    let requested = close.clone();
+    // A backend with real viewports: the child reports its place and, when asked, a close.
+    Context::set_immediate_viewport_renderer(move |ctx, mut viewport| {
+        let mut info = egui::ViewportInfo {
+            outer_rect: Some(Rect::from_min_size(pos2(1210.0, 905.0), vec2(250.0, 330.0))),
+            inner_rect: Some(Rect::from_min_size(pos2(1210.0, 935.0), vec2(250.0, 300.0))),
+            ..Default::default()
+        };
+        if requested.get() {
+            info.events.push(egui::ViewportEvent::Close);
+        }
+        let input = RawInput {
+            viewport_id: viewport.ids.this,
+            viewports: std::iter::once((viewport.ids.this, info)).collect(),
+            screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(250.0, 300.0))),
+            ..Default::default()
+        };
+        done(ctx.run_ui(input, |ui| (viewport.viewport_ui_cb)(ui)));
+    });
+    let mut layout = workspace();
+    layout.floating[0].native = Some([1200.0, 900.0, 240.0, 300.0]);
+    let mut d = Driver::new(Layout::default(), false);
+    d.ctx.set_embed_viewports(false);
+    d.content.native = true;
+    d.layout = layout;
+    d.step(vec![]);
+    assert!(d.response(Id::unique(AREA).with(("move-group", Some(&5u32)))).is_none(), "drawn in its own OS window");
+    // Where the window system put its content, once a report that late is no longer the
+    // opening move landing.
+    let reported = (0..60).any(|_| d.step(vec![]).actions.contains(&Action::SetNative { panel: 5, rect: Some([1210.0, 935.0, 250.0, 300.0]) }));
+    assert!(reported, "{:?}", d.layout.floating[0].native);
+
+    close.set(true);
+    let out = d.step(vec![]);
+    assert!(out.actions.contains(&Action::CloseWindow { panel: 5 }), "{:?}", out.actions);
+    assert!(window_of(&d.layout, 5).is_none() && !d.layout.contains(&6) && !d.layout.contains(&7));
+}
+
+#[test]
+/// `FloatingFrame` and `TitleBar` work without a dock area: close and menu clicks register, the bar
+/// drag reports its delta, and an edge drag resizes the frame.
+fn chrome_frame_and_title_bar_work_without_a_dock_area() {
+    use chrome::{ChromeStyle, FloatingFrame, TitleBar};
+    let ctx = Context::default();
+    let id = Id::unique("task-pane");
+    let rect = Rect::from_min_size(pos2(100.0, 100.0), vec2(300.0, 200.0));
+    let mut time = 0.0;
+    let mut frame = |events: Vec<Event>| {
+        time += 1.0 / 60.0;
+        let input =
+            RawInput { screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0))), events, time: Some(time), ..Default::default() };
+        let mut result = None;
+        done(ctx.run_ui(input, |ui| {
+            let style = ChromeStyle::from_ui(ui);
+            let shown = FloatingFrame::new(id, rect).show(ui.ctx(), &style, |ui, inner| {
+                let title = Rect::from_min_size(inner.min, vec2(inner.width(), 22.0));
+                let bar = TitleBar::new(id.with("title"), "Move pane").title("Styles").menu("Pane menu").close("Close pane").show(ui, title, &style);
+                (bar.bar.dragged(), bar.bar.drag_delta(), bar.menu.is_some_and(|r| r.clicked()), bar.close.is_some_and(|r| r.clicked()))
+            });
+            result = Some((shown.inner, shown.resized));
+        }));
+        result.unwrap()
+    };
+    frame(vec![]);
+    frame(vec![]);
+    type Shown = ((bool, Vec2, bool, bool), Option<Rect>);
+    let click = |frame: &mut dyn FnMut(Vec<Event>) -> Shown, at| {
+        frame(vec![Event::PointerMoved(at), button(at, true)]);
+        frame(vec![button(at, false)])
+    };
+    let ((_, _, _, closed), _) = click(&mut frame, pos2(390.0, 111.0));
+    assert!(closed, "× 10 pt in from the right");
+    let ((_, _, menu, _), _) = click(&mut frame, pos2(374.0, 111.0));
+    assert!(menu, "▾ left of ×");
+
+    frame(vec![Event::PointerMoved(pos2(200.0, 110.0)), button(pos2(200.0, 110.0), true)]);
+    frame(vec![Event::PointerMoved(pos2(210.0, 115.0))]);
+    let ((dragged, delta, ..), _) = frame(vec![Event::PointerMoved(pos2(230.0, 125.0))]);
+    assert!(dragged && delta == vec2(20.0, 10.0), "{delta:?}");
+    frame(vec![button(pos2(230.0, 125.0), false)]);
+
+    let edge = pos2(398.0, 200.0);
+    frame(vec![Event::PointerMoved(edge), button(edge, true)]);
+    frame(vec![Event::PointerMoved(edge + vec2(10.0, 0.0))]);
+    let (_, resized) = frame(vec![Event::PointerMoved(edge + vec2(50.0, 0.0))]);
+    assert_eq!(resized, Some(Rect::from_min_size(rect.min, vec2(350.0, 200.0))));
+}
+
+#[test]
+/// Hidden panels give up their split space; the remaining split hit is named by its layout path and
+/// dragging it emits `ResizeSplit` for exactly that path while the nested ratio changes.
+fn hidden_panels_leave_their_split_and_resizing_names_the_layout_path() {
+    let layout = Layout {
+        root: Some(Node::Split {
+            axis: SplitAxis::Horizontal,
+            size: SplitSize::FixedFirst(200.0),
+            first: Box::new(tabs(&[9], 0)),
+            second: Box::new(Node::Split {
+                axis: SplitAxis::Vertical,
+                size: SplitSize::Ratio(0.5),
+                first: Box::new(tabs(&[1], 0)),
+                second: Box::new(tabs(&[2], 0)),
+            }),
+        }),
+        floating: Vec::new(),
+    };
+    let mut d = Driver::new(layout, true);
+    d.hide = Hide::Keep;
+    d.content.keep = vec![1, 2];
+    d.step(vec![]);
+    d.step(vec![]);
+    assert_eq!(d.tab(1).map(|r| r.left()), Some(0.0), "the hidden frame's space goes to the others");
+    // Hits and widget ids name the split by its layout path, as `ResizeSplit` does.
+    let hit = Hit::Divider(Divider::Split(vec![true]));
+    assert!(DockArea::<u32>::hit_rects(&d.ctx, Id::unique(AREA)).iter().any(|(h, _)| *h == hit), "the hits name the layout path");
+    let divider = d.response(DockArea::<u32>::hit_id(Id::unique(AREA), &hit)).unwrap().center();
+    let out = d.hold(divider, divider + vec2(0.0, 60.0));
+    assert!(out.actions.iter().any(|a| matches!(a, Action::ResizeSplit { path, .. } if path == &vec![true])), "{:?}", out.actions);
+    let Some(Node::Split { size: SplitSize::FixedFirst(200.0), second, .. }) = &d.layout.root else { panic!("{:?}", d.layout) };
+    assert!(matches!(**second, Node::Split { size, .. } if size != SplitSize::Ratio(0.5)));
+}
+
+#[test]
+/// Hiding floating window 5 removes its coverage of the dock seam, so dragging
+/// window 8 there stacks its group between panels 3 and 4.
+fn a_hidden_floating_window_does_not_cover_dock_targets() {
+    // Window 5 covers the column's seam at x 150..240 until it is hidden.
+    let mut layout = workspace();
+    layout.floating = vec![Floating::single(vec![5], 0, [150.0, 250.0, 200.0, 150.0]), Floating::single(vec![8], 0, [560.0, 300.0, 200.0, 200.0])];
+    let mut d = Driver::new(layout, false);
+    d.hide = Hide::Keep;
+    d.content.keep = vec![2, 3, 4, 8];
+    d.step(vec![]);
+    d.step(vec![]);
+    d.drag(d.title(8).center(), pos2(200.0, 309.0));
+    let Some(Node::Split { first, .. }) = &d.layout.root else { panic!("{:?}", d.layout.root) };
+    let Node::Dock { columns, .. } = &**first else { panic!("{first:?}") };
+    let groups: Vec<Vec<u32>> = columns[0].groups.iter().map(|g| g.panels.clone()).collect();
+    assert_eq!(groups, vec![vec![2, 3], vec![8], vec![4]]);
+}
+
+#[test]
+/// Each top resize edge sits directly above the title bar and keeps the opposite edges while
+/// dragging; the title bar still moves the window, and a focused top edge responds to arrow keys.
+fn top_edges_resize_from_the_band_above_the_title_bar() {
+    // W2 holds [8] at [560, 300, 200, 200]; each top handle keeps the opposite edges.
+    let area = Id::unique(AREA);
+    for (edge, by, expected) in [
+        (ResizeEdge::Top, vec2(0.0, -40.0), [560.0, 260.0, 200.0, 240.0]),
+        (ResizeEdge::TopLeft, vec2(-30.0, 20.0), [530.0, 320.0, 230.0, 180.0]),
+        (ResizeEdge::TopRight, vec2(20.0, -10.0), [560.0, 290.0, 220.0, 210.0]),
+    ] {
+        let mut d = Driver::new(workspace(), false);
+        let handle = d.response(DockArea::hit_id(area, &Hit::Resize(8u32, edge))).unwrap();
+        assert_eq!(handle.bottom(), d.title(8).top(), "{edge:?} lies above the title bar");
+        d.drag(handle.center(), handle.center() + by);
+        assert_eq!(window_of(&d.layout, 8).unwrap().rect, expected, "{edge:?}");
+    }
+    // The title bar still moves the window, and arrow keys move the focused top edge.
+    let mut d = Driver::new(workspace(), false);
+    let title = d.title(8);
+    d.drag(pos2(title.center().x, title.top() + 1.0), pos2(title.center().x - 50.0, title.top() + 1.0));
+    assert_eq!(window_of(&d.layout, 8).unwrap().rect, [510.0, 300.0, 200.0, 200.0]);
+    d.ctx.memory_mut(|m| m.request_focus(DockArea::hit_id(area, &Hit::Resize(8u32, ResizeEdge::Top))));
+    d.step(vec![Event::Key { key: egui::Key::ArrowUp, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE }]);
+    assert_eq!(window_of(&d.layout, 8).unwrap().rect, [510.0, 292.0, 200.0, 208.0]);
+}
+
+#[test]
+/// Undock Panel Group from one group of a stacked floating window emits `MoveGroup` to a float and
+/// separates exactly that group; a window with only one group has no undock entry.
+fn undock_panel_group_floats_one_group_of_a_floating_window() {
+    use egui_kittest::{Harness, kittest::Queryable};
+    let stacked = || Layout {
+        root: Some(tabs(&[1], 0)),
+        floating: vec![Floating::stack(vec![Group::new(vec![5], 0), Group::new(vec![6, 7], 0)], [300.0, 80.0, 300.0, 400.0]).unwrap()],
+    };
+    type State = (Content, Layout<u32>, Vec<Action<u32>>);
+    let mut h = Harness::builder().with_size(vec2(800.0, 600.0)).build_ui_state(
+        |ui, (content, layout, actions): &mut State| {
+            let mut style = DockStyle::from_ui(ui);
+            frame_style(&mut style);
+            let out = DockArea::new(Id::unique(AREA)).native_windows(true).show_content(ui, layout, &style, content);
+            actions.extend(out.actions);
+        },
+        (Content::default(), stacked(), Vec::new()),
+    );
+    h.run_steps(2);
+    let menu = |h: &mut Harness<'_, State>, panel: u32| {
+        let at = h.ctx.read_response(Id::unique(AREA).with(("tab", &panel))).unwrap().rect.center();
+        h.input_mut().events.extend([
+            Event::PointerMoved(at),
+            Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: true, modifiers: Modifiers::NONE },
+        ]);
+        h.run_steps(1);
+        h.input_mut().events.push(Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: false, modifiers: Modifiers::NONE });
+        h.run_steps(2);
+    };
+    menu(&mut h, 6);
+    h.get_by_label("Undock Panel Group").click();
+    h.run_steps(2);
+    let actions = std::mem::take(&mut h.state_mut().2);
+    assert!(matches!(&actions[..], [Action::MoveGroup { panel: 6, to: Target::Float { rect: Some(_) } }]), "{actions:?}");
+    let mut layout = stacked();
+    layout.apply_all(actions, |_| Permissions::default()).unwrap();
+    assert_eq!(layout.floating.iter().map(groups_of).collect::<Vec<_>>(), vec![vec![vec![5]], vec![vec![6, 7]]]);
+
+    // A window's only group has nothing to undock from.
+    h.state_mut().1 = layout;
+    h.run_steps(2);
+    menu(&mut h, 5);
+    assert_eq!(h.query_all_by_label("Undock Panel Group").count(), 0);
+}
+
+#[test]
+fn a_title_bar_drag_fades_over_a_preview_the_host_draws() {
+    let mut d = Driver::new(workspace(), false);
+    d.content.host_preview = Some(Rect::from_min_size(pos2(20.0, 20.0), vec2(100.0, 100.0)));
+    let title = d.title(8).center();
+    d.step(vec![Event::PointerMoved(title), button(title, true)]);
+    d.step(vec![Event::PointerMoved(title + vec2(8.0, 6.0))]);
+    d.step(vec![Event::PointerMoved(pos2(650.0, 150.0))]);
+    let rect = window_of(&d.layout, 8).unwrap().rect;
+    d.step(vec![]);
+    let shown = d.window_opacity(rect).unwrap();
+    assert!((shown - 0.75).abs() < 0.01, "{shown}");
+}
+
+#[test]
+fn an_in_window_floating_window_fades_only_while_its_title_bar_drag_highlights_a_drop_target() {
+    let mut d = Driver::new(workspace(), false);
+    let strip = d.tab(4).unwrap().center();
+    let empty = pos2(650.0, 150.0);
+    // Opacity of window W2 (dragged) and W1 once the pointer rests at `at`: the window draws
+    // before the preview, so it fades a frame after the target lights up.
+    let over = |d: &mut Driver, at: egui::Pos2| {
+        d.step(vec![Event::PointerMoved(at)]);
+        let (dragged, other) = (window_of(&d.layout, 8).unwrap().rect, window_of(&d.layout, 5).unwrap().rect);
+        d.step(vec![]);
+        (d.window_opacity(dragged).unwrap(), d.window_opacity(other).unwrap())
+    };
+    let shown = |d: &Driver| d.window_opacity(window_of(&d.layout, 8).unwrap().rect).unwrap();
+    let grab = |d: &mut Driver| {
+        let title = d.title(8).center();
+        d.step(vec![Event::PointerMoved(title), button(title, true)]);
+        d.step(vec![Event::PointerMoved(title + vec2(8.0, 6.0))]);
+    };
+    assert_eq!(shown(&d), 1.0);
+    grab(&mut d);
+    assert_eq!(over(&mut d, empty), (1.0, 1.0), "over empty space");
+    let (dragged, other) = over(&mut d, strip);
+    assert!((dragged - 0.75).abs() < 0.01 && other == 1.0, "over a drop target: {dragged}, {other}");
+    assert_eq!(over(&mut d, empty).0, 1.0, "after leaving the target");
+    assert!((over(&mut d, strip).0 - 0.75).abs() < 0.01);
+    // Released off the target the window stays floating, opaque.
+    d.step(vec![Event::PointerMoved(empty), button(empty, false)]);
+    d.step(vec![]);
+    assert_eq!(shown(&d), 1.0, "after the release");
+    assert!(window_of(&d.layout, 8).is_some());
+
+    // Escape over a target puts the window back, opaque.
+    grab(&mut d);
+    assert!((over(&mut d, strip).0 - 0.75).abs() < 0.01);
+    d.step(vec![Event::Key { key: egui::Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE }]);
+    d.step(vec![]);
+    assert_eq!(shown(&d), 1.0, "after Escape");
+    d.step(vec![button(strip, false)]);
+    assert!(window_of(&d.layout, 8).is_some());
+}
diff --git a/crates/ui/src/docking/group_tests.rs b/crates/ui/src/docking/group_tests.rs
new file mode 100644
index 00000000..d6b28adc
--- /dev/null
+++ b/crates/ui/src/docking/group_tests.rs
@@ -0,0 +1,844 @@
+//! Whole-group gestures: drag bar, top border, drop resolution, minimize and the floating frame.
+
+use super::*;
+use crate::layout::{SplitAxis, SplitSize};
+use egui::{Color32, Context, Event, Id, Modifiers, PointerButton, RawInput, Rect, UiBuilder, Vec2, pos2, vec2};
+
+const AREA: &str = "group-area";
+
+#[path = "trial_tests.rs"]
+mod trial;
+
+fn tabs(panels: &[u32], active: usize) -> Node<u32> {
+    Node::Tabs { panels: panels.to_vec(), active }
+}
+
+/// `[1] | [2, 3]` with panel 3 selected.
+fn frames() -> Layout<u32> {
+    Layout {
+        root: Some(Node::Split {
+            axis: SplitAxis::Horizontal,
+            size: SplitSize::FixedFirst(300.0),
+            first: Box::new(tabs(&[1], 0)),
+            second: Box::new(tabs(&[2, 3], 1)),
+        }),
+        floating: Vec::new(),
+    }
+}
+
+/// A start dock with one column holding `[2, 3]` (3 selected) above `[4]`, beside canvas 0.
+fn docked() -> Layout<u32> {
+    Layout {
+        root: Some(Node::Split {
+            axis: SplitAxis::Horizontal,
+            size: SplitSize::FixedFirst(240.0),
+            first: Box::new(Node::Dock {
+                side: Side::Start,
+                columns: vec![Column::new(vec![Group::new(vec![2, 3], 1), Group::new(vec![4], 0)], 240.0)],
+            }),
+            second: Box::new(tabs(&[0], 0)),
+        }),
+        floating: Vec::new(),
+    }
+}
+
+#[derive(Default)]
+struct TestContent {
+    protected: Vec<u32>,
+    header: f32,
+    header_clicks: usize,
+    /// The strip width the last header was sized for.
+    strip_width: std::cell::Cell<f32>,
+    /// Width the extra tabs ask for, and the rect they were last drawn in.
+    extra: f32,
+    extra_rect: Option<Rect>,
+    floating_size: Option<Vec2>,
+    host_owned: bool,
+    whole_group: bool,
+    /// Height every body takes; `None` draws a one-line label.
+    body_height: Option<f32>,
+    /// Every body takes its whole rect.
+    fill: bool,
+}
+
+impl DockContent<u32> for TestContent {
+    /// Test body that fills its rect when `fill` is set, otherwise takes the
+    /// configured height or draws a one-line `Body` label.
+    fn body(&mut self, ui: &mut egui::Ui, _: &u32) {
+        if self.fill {
+            ui.allocate_rect(ui.max_rect(), egui::Sense::hover());
+            return;
+        }
+        match self.body_height {
+            Some(height) => _ = ui.allocate_exact_size(vec2(10.0, height), egui::Sense::hover()),
+            None => _ = ui.label("Body"),
+        }
+    }
+    fn logical_label(&self, panel: &u32) -> String {
+        format!("Panel {panel}")
+    }
+    /// Mark panels in `protected` as protected and leave the rest with default
+    /// permissions.
+    fn permissions(&self, panel: &u32) -> Permissions {
+        if self.protected.contains(panel) { Permissions::PROTECTED } else { Permissions::default() }
+    }
+    fn floating_size(&self, _: &u32) -> Option<Vec2> {
+        self.floating_size
+    }
+    fn resolve_drag(&mut self, _: &Context, _: &DockStyle, request: &DropRequest<'_, u32>) -> Option<DropFeedback> {
+        self.whole_group |= request.whole_group;
+        self.host_owned.then(DropFeedback::default)
+    }
+    fn group_header_width(&self, _: &[u32], _: &u32, _: bool, strip_width: f32) -> f32 {
+        self.strip_width.set(strip_width);
+        self.header
+    }
+    fn group_header(&mut self, ui: &mut egui::Ui, _: &[u32], _: &u32, _: bool) {
+        if ui.button("≡").clicked() {
+            self.header_clicks += 1;
+        }
+    }
+    fn group_extra_tabs_width(&self, _: &[u32], _: &u32, _: bool) -> f32 {
+        self.extra
+    }
+    fn group_extra_tabs(&mut self, ui: &mut egui::Ui, _: &[u32], _: &u32, _: bool) {
+        self.extra_rect = Some(ui.max_rect());
+    }
+}
+
+/// Renders a layout through `show_content` in `area` of an 800x600 window and applies what
+/// it emits, the way an application's command handler would.
+struct Driver {
+    ctx: Context,
+    layout: Layout<u32>,
+    content: TestContent,
+    area: Rect,
+    modifiers: Modifiers,
+    focused: bool,
+    transparent: bool,
+    /// Applied to the style every frame.
+    tweak: fn(&mut DockStyle),
+    shapes: Vec<egui::epaint::ClippedShape>,
+    time: f64,
+}
+
+impl Driver {
+    fn new(layout: Layout<u32>) -> Self {
+        Self::with(layout, TestContent::default(), Rect::from_min_size(pos2(0.0, 0.0), vec2(600.0, 600.0)))
+    }
+
+    /// Create a group test driver for `layout`, `content` and `area`, then settle
+    /// two frames.
+    fn with(layout: Layout<u32>, content: TestContent, area: Rect) -> Self {
+        let mut driver = Self {
+            ctx: Context::default(),
+            layout,
+            content,
+            area,
+            modifiers: Modifiers::NONE,
+            focused: true,
+            transparent: false,
+            tweak: |_| {},
+            shapes: Vec::new(),
+            time: 0.0,
+        };
+        driver.step(vec![]);
+        driver.step(vec![]);
+        driver
+    }
+
+    /// One 800×600 frame with inserted modifier events and optional transparent/tweaked style or
+    /// custom area. Captures shapes, clears texture deltas, and returns `DockOutput`.
+    fn frame(&mut self, mut events: Vec<Event>) -> DockOutput<u32> {
+        let mut output = DockOutput::default();
+        events.insert(0, Event::ModifiersChanged(self.modifiers));
+        self.time += 1.0 / 60.0;
+        let input = RawInput {
+            screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0))),
+            events,
+            focused: self.focused,
+            time: Some(self.time),
+            ..Default::default()
+        };
+        let (layout, content, area, transparent, tweak) = (&self.layout, &mut self.content, self.area, self.transparent, self.tweak);
+        let mut full = self.ctx.run_ui(input, |ui| {
+            let mut style = DockStyle::from_ui(ui);
+            if transparent {
+                style.background = Color32::TRANSPARENT;
+                style.tab_background = Color32::TRANSPARENT;
+            }
+            tweak(&mut style);
+            ui.scope_builder(UiBuilder::new().max_rect(area), |ui| {
+                output = DockArea::new(Id::unique(AREA)).show_content(ui, layout, &style, content);
+            });
+        });
+        full.textures_delta.clear();
+        self.shapes = full.shapes;
+        output
+    }
+
+    /// Run one frame, assert it reports no error, and apply each returned action
+    /// with the content's permissions.
+    fn step(&mut self, events: Vec<Event>) -> DockOutput<u32> {
+        let output = self.frame(events);
+        assert!(output.error.is_none(), "{output:?}");
+        let permissions = |p: &u32| self.content.permissions(p);
+        for action in &output.actions {
+            self.layout.apply_with_permissions(action.clone(), permissions).unwrap();
+        }
+        output
+    }
+
+    /// Read the response rectangle for the dock widget named `name` and scoped to
+    /// `panel`.
+    fn rect(&self, name: &str, panel: u32) -> Rect {
+        self.ctx.read_response(Id::unique(AREA).with((name, Some(&panel)))).unwrap().rect
+    }
+
+    /// Read the response rectangle for `panel`'s tab.
+    fn tab(&self, panel: u32) -> Rect {
+        self.ctx.read_response(Id::unique(AREA).with(("tab", &panel))).unwrap().rect
+    }
+
+    /// Press at `from`, pass the drag threshold, move to `to`; returns the last move's output.
+    fn hold(&mut self, from: egui::Pos2, to: egui::Pos2) -> DockOutput<u32> {
+        self.step(vec![Event::PointerMoved(from), button(from, true)]);
+        self.step(vec![Event::PointerMoved(from + vec2(8.0, 6.0))]);
+        self.step(vec![Event::PointerMoved(to)])
+    }
+
+    /// A full drag; returns the release frame's output.
+    fn drag(&mut self, from: egui::Pos2, to: egui::Pos2) -> DockOutput<u32> {
+        self.hold(from, to);
+        self.step(vec![button(to, false)])
+    }
+
+    /// Lets egui's double- and triple-click windows pass.
+    fn wait(&mut self) {
+        for _ in 0..45 {
+            self.step(vec![]);
+        }
+    }
+
+    fn click(&mut self, at: egui::Pos2) -> DockOutput<u32> {
+        self.step(vec![Event::PointerMoved(at), button(at, true)]);
+        self.step(vec![button(at, false)])
+    }
+}
+
+fn button(pos: egui::Pos2, pressed: bool) -> Event {
+    Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE }
+}
+
+fn key(key: egui::Key) -> Event {
+    Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE }
+}
+
+fn moved_group(actions: &[Action<u32>]) -> Option<&Target<u32>> {
+    actions.iter().find_map(|a| match a {
+        Action::MoveGroup { to, .. } => Some(to),
+        _ => None,
+    })
+}
+
+#[test]
+/// A group bar dropped on another strip emits one `MoveGroup` and keeps panel
+/// order and the active panel; dropped on empty space it floats at its docked
+/// width and 600 pt height; inside a column it joins the group below.
+fn docked_two_tab_group_drags_by_its_bar_and_keeps_order_and_active_tab() {
+    // Onto another group's strip: one MoveGroup, both panels in order, 3 still selected.
+    let mut d = Driver::new(frames());
+    let bar = d.rect("drag-bar", 2);
+    assert!(bar.width() >= 40.0);
+    let out = d.drag(bar.center(), d.tab(1).center());
+    assert!(matches!(moved_group(&out.actions), Some(Target::At { anchor: 1, placement: Placement::Tab { .. } })), "{:?}", out.actions);
+    assert_eq!(out.actions.len(), 1);
+    assert!(out.group_drop.is_none(), "a resolved target leaves group_drop empty");
+    assert_eq!(d.layout.root, Some(tabs(&[1, 2, 3], 2)));
+
+    // Onto empty space: a floating window at the group's docked size.
+    let mut d = Driver::new(frames());
+    let border = d.rect("drag-border", 2);
+    let bar = d.rect("drag-bar", 2);
+    let out = d.drag(bar.center(), pos2(700.0, 200.0));
+    let Some(Target::Float { rect: Some([_, _, width, height]) }) = moved_group(&out.actions) else { panic!("{:?}", out.actions) };
+    assert_eq!((*width, *height), (border.width(), 600.0));
+    assert_eq!(out.group_drop, Some((2, pos2(700.0, 200.0))));
+    assert_eq!(d.layout.root, Some(tabs(&[1], 0)));
+    assert_eq!(d.layout.floating[0].groups(), vec![Group::new(vec![2, 3], 1)]);
+
+    // The same group in a dock column joins the group below it.
+    let mut d = Driver::new(docked());
+    let bar = d.rect("drag-bar", 2);
+    let out = d.drag(bar.center(), d.tab(4).center());
+    assert!(matches!(moved_group(&out.actions), Some(Target::At { anchor: 4, .. })), "{:?}", out.actions);
+    let Some(Node::Split { first, .. }) = &d.layout.root else { panic!() };
+    let Node::Dock { columns, .. } = first.as_ref() else { panic!() };
+    assert_eq!(columns[0].groups.len(), 1);
+    assert_eq!(columns[0].groups[0].panels, vec![4, 2, 3]);
+    assert_eq!(columns[0].groups[0].active_panel(), Some(&3));
+}
+
+#[test]
+/// In a 300 pt strip with eight tabs and a 24 pt header, the drag bar keeps at least 40 pt and ends
+/// at the header; tabs shrink and overflow before it is narrowed, and dragging it floats all eight
+/// panels as one group.
+fn drag_bar_survives_a_strip_full_of_tabs() {
+    let layout = Layout { root: Some(tabs(&[1, 2, 3, 4, 5, 6, 7, 8], 0)), floating: Vec::new() };
+    let content = TestContent { header: 24.0, ..Default::default() };
+    let mut d = Driver::with(layout, content, Rect::from_min_size(pos2(0.0, 0.0), vec2(300.0, 400.0)));
+    let bar = d.rect("drag-bar", 1);
+    assert!(bar.width() >= 40.0, "{bar:?}");
+    assert_eq!(bar.right(), 300.0 - 24.0, "the bar ends at the header");
+    assert_eq!(d.content.strip_width.get(), 300.0, "the header is sized for the whole strip");
+    assert!(d.ctx.read_response(Id::unique(AREA).with(("overflow", &1u32))).is_some(), "tabs shrink, then overflow, before the bar narrows");
+    let out = d.drag(bar.center(), pos2(500.0, 300.0));
+    assert!(matches!(moved_group(&out.actions), Some(Target::Float { .. })), "{:?}", out.actions);
+    assert_eq!(d.layout.floating[0].groups()[0].panels.len(), 8);
+}
+
+#[test]
+/// The extra tabs follow the last panel tab, before the drag bar and the header. In a narrow row
+/// they shrink to the minimum tab width while the panel tabs overflow, and the bar keeps its
+/// width; a tab dropped on them goes after the last panel tab.
+fn extra_tabs_follow_the_panel_tabs_and_overflow_with_them() {
+    let content = TestContent { header: 24.0, extra: 100.0, ..Default::default() };
+    let layout = Layout { root: Some(tabs(&[1, 2], 0)), floating: Vec::new() };
+    let mut d = Driver::with(layout, content, Rect::from_min_size(pos2(0.0, 0.0), vec2(600.0, 400.0)));
+    let (extra, bar) = (d.content.extra_rect.expect("extra tabs drawn"), d.rect("drag-bar", 1));
+    assert_eq!((extra.left(), extra.width()), (d.tab(2).right(), 100.0));
+    assert_eq!((bar.left(), bar.right()), (extra.right(), 600.0 - 24.0), "the bar and the header follow");
+    d.drag(d.tab(1).center(), extra.center());
+    assert_eq!(d.layout.root, Some(tabs(&[2, 1], 1)), "a drop on the extra tabs appends");
+
+    let content = TestContent { header: 24.0, extra: 100.0, ..Default::default() };
+    let layout = Layout { root: Some(tabs(&[1, 2, 3], 0)), floating: Vec::new() };
+    let d = Driver::with(layout, content, Rect::from_min_size(pos2(0.0, 0.0), vec2(200.0, 400.0)));
+    let overflow = d.ctx.read_response(Id::unique(AREA).with(("overflow", &1u32))).expect("the panel tabs overflow").rect;
+    let (extra, bar) = (d.content.extra_rect.expect("extra tabs drawn"), d.rect("drag-bar", 1));
+    assert_eq!(overflow.left(), d.tab(1).right());
+    assert_eq!(extra.left(), overflow.right(), "the extra tabs follow the overflow button");
+    let min = DockStyle::default().min_tab_width;
+    assert!(extra.width() >= min - 0.5 && extra.width() < 100.0, "{extra:?}");
+    assert_eq!((bar.left(), bar.right()), (extra.right(), 200.0 - 24.0));
+    assert!(bar.width() >= 40.0, "{bar:?}");
+}
+
+/// Panels with ordinary names.
+struct Named;
+
+impl DockContent<u32> for Named {
+    fn body(&mut self, ui: &mut egui::Ui, _: &u32) {
+        ui.label("Body");
+    }
+    fn logical_label(&self, panel: &u32) -> String {
+        if *panel == 1 { "Properties" } else { "Layers" }.into()
+    }
+}
+
+#[test]
+fn narrow_frames_shrink_their_tabs_before_the_rest_overflow() {
+    let texts = |d: &testing::DockDriver<u32, Named>| {
+        let mut out = Vec::new();
+        fn walk(shape: &egui::Shape, out: &mut Vec<egui::epaint::TextShape>) {
+            match shape {
+                egui::Shape::Vec(shapes) => shapes.iter().for_each(|s| walk(s, out)),
+                egui::Shape::Text(text) => out.push(text.clone()),
+                _ => {}
+            }
+        }
+        d.shapes().iter().for_each(|clipped| walk(&clipped.shape, &mut out));
+        out
+    };
+    let layout = Layout { root: Some(tabs(&[1, 2], 0)), floating: Vec::new() };
+    let area = |width: f32| Rect::from_min_size(pos2(0.0, 0.0), vec2(width, 300.0));
+
+    // Both tabs show, cut to fit, with their labels inside them.
+    let d = testing::DockDriver::new(layout.clone(), Named).with_area(area(168.0));
+    assert!(d.hit(&Hit::Overflow(1)).is_none(), "no overflow while the tabs fit at their minimum width");
+    let min = DockStyle::default().min_tab_width;
+    for (panel, name) in [(1, "Properties"), (2, "Layers")] {
+        let tab = d.hit(&Hit::Tab(panel)).unwrap_or_else(|| panic!("{name} is hidden"));
+        assert!(tab.width() >= min - 0.5, "{name}: {tab:?}");
+        let label = texts(&d).into_iter().find(|t| t.galley.text() == name && tab.contains(t.pos)).unwrap_or_else(|| panic!("no {name} label"));
+        assert!(tab.contains_rect(label.visual_bounding_rect()), "{name}: {:?} outside {tab:?}", label.visual_bounding_rect());
+    }
+    let properties = texts(&d).into_iter().find(|t| t.galley.text() == "Properties").unwrap();
+    assert!(properties.galley.elided, "the wider tab shrinks to make room");
+
+    // Too narrow for both at their minimum width: the active tab stays, the other is listed.
+    let mut d = testing::DockDriver::new(layout, Named).with_area(area(120.0));
+    assert!(d.hit(&Hit::Tab(1)).is_some() && d.hit(&Hit::Tab(2)).is_none());
+    let overflow = d.hit(&Hit::Overflow(1)).expect("an overflow button");
+    d.click(overflow.center());
+    d.settle();
+    let listed = texts(&d).into_iter().find(|t| t.galley.text() == "Layers").expect("the menu lists Layers");
+    assert!(listed.pos.y >= overflow.bottom(), "{listed:?}");
+    let out = d.click(listed.visual_bounding_rect().center());
+    assert!(out.actions.contains(&Action::Activate { panel: 2 }), "{:?}", out.actions);
+}
+
+#[test]
+fn top_border_drags_the_group_and_the_menu_button_only_clicks() {
+    let content = TestContent { header: 30.0, ..Default::default() };
+    let mut d = Driver::with(frames(), content, Rect::from_min_size(pos2(0.0, 0.0), vec2(600.0, 600.0)));
+    let border = d.rect("drag-border", 2);
+    assert!(border.height() <= 4.0);
+    // The band lies over the tabs and wins there.
+    let over_tab = pos2(d.tab(2).center().x, border.center().y);
+    let menu = pos2(576.0, d.tab(2).center().y);
+
+    // Pressing ≡ and dragging moves nothing; clicking it reaches the host.
+    let held = d.hold(menu, menu + vec2(0.0, 200.0));
+    assert!(held.group_drag.is_none());
+    let out = d.step(vec![button(menu + vec2(0.0, 200.0), false)]);
+    assert!(out.actions.iter().all(|a| !matches!(a, Action::MoveGroup { .. } | Action::Move { .. } | Action::Float { .. })), "{:?}", out.actions);
+    // A press in the header focuses the group's shown panel, like a press on its tab.
+    let pressed = d.step(vec![Event::PointerMoved(menu), button(menu, true)]);
+    assert_eq!(pressed.focused, Some(3));
+    d.step(vec![button(menu, false)]);
+    assert_eq!(d.content.header_clicks, 1);
+
+    let out = d.drag(over_tab, d.tab(1).center());
+    assert!(matches!(moved_group(&out.actions), Some(Target::At { anchor: 1, .. })), "{:?}", out.actions);
+    assert_eq!(d.layout.root, Some(tabs(&[1, 2, 3], 2)));
+}
+
+#[test]
+fn group_drop_on_a_frame_edge_splits_and_on_a_protected_canvas_floats() {
+    let canvas = || TestContent { protected: vec![1], ..Default::default() };
+    let area = Rect::from_min_size(pos2(0.0, 0.0), vec2(600.0, 600.0));
+    let mut d = Driver::with(frames(), TestContent::default(), area);
+    let out = d.drag(d.rect("drag-bar", 2).center(), pos2(40.0, 300.0));
+    assert!(matches!(moved_group(&out.actions), Some(Target::At { anchor: 1, placement: Placement::Split(Zone::Left) })), "{:?}", out.actions);
+    let Some(Node::Split { first, second, .. }) = &d.layout.root else { panic!() };
+    assert_eq!(**first, tabs(&[2, 3], 1));
+    assert_eq!(**second, tabs(&[1], 0));
+
+    // A protected canvas takes nothing, at its center or its edge: no join, no split, no
+    // preview; the group floats there.
+    for at in [pos2(150.0, 300.0), pos2(40.0, 300.0)] {
+        let mut d = Driver::with(frames(), canvas(), area);
+        let out = d.drag(d.rect("drag-bar", 2).center(), at);
+        assert!(matches!(moved_group(&out.actions), Some(Target::Float { .. })), "{:?}", out.actions);
+        assert_eq!(d.layout.root, Some(tabs(&[1], 0)));
+    }
+}
+
+#[test]
+/// Holding Ctrl or Command at release turns either a group-bar drop or a tab
+/// drop into a float instead of a dock.
+fn ctrl_or_cmd_held_at_release_always_floats() {
+    for modifiers in [Modifiers::CTRL, Modifiers::MAC_CMD, Modifiers::COMMAND] {
+        let mut d = Driver::new(frames());
+        let target = d.tab(1).center();
+        d.hold(d.rect("drag-bar", 2).center(), target);
+        d.modifiers = modifiers;
+        let out = d.step(vec![button(target, false)]);
+        assert!(matches!(moved_group(&out.actions), Some(Target::Float { .. })), "{modifiers:?}: {:?}", out.actions);
+        assert_eq!(d.layout.root, Some(tabs(&[1], 0)));
+
+        // A tab drag floats the same way.
+        let mut d = Driver::new(frames());
+        let target = d.tab(1).center();
+        d.hold(d.tab(3).center(), target);
+        d.modifiers = modifiers;
+        let out = d.step(vec![button(target, false)]);
+        assert!(out.actions.iter().any(|a| matches!(a, Action::Float { panel: 3, .. })), "{modifiers:?}: {:?}", out.actions);
+    }
+}
+
+#[test]
+/// Escape, focus loss, pointer exit and `cancel_drag` each end a held group drag with no actions or
+/// drop; releasing changes nothing and the layout equals the original.
+fn group_drag_escape_focus_loss_pointer_exit_and_cancel_drag_leave_the_layout_unchanged() {
+    for case in ["escape", "focus", "exit", "cancel"] {
+        let mut d = Driver::new(frames());
+        let target = d.tab(1).center();
+        let held = d.hold(d.rect("drag-bar", 2).center(), target);
+        assert_eq!(held.group_drag, Some(2));
+        let out = match case {
+            "escape" => d.step(vec![key(egui::Key::Escape)]),
+            "focus" => {
+                d.focused = false;
+                let out = d.step(vec![]);
+                d.focused = true;
+                out
+            }
+            "exit" => d.step(vec![Event::PointerGone]),
+            _ => {
+                cancel_drag::<u32>(&d.ctx, Id::unique(AREA));
+                d.step(vec![Event::PointerMoved(target + vec2(1.0, 0.0))])
+            }
+        };
+        assert!(out.actions.is_empty() && out.group_drop.is_none(), "{case}: {out:?}");
+        let out = d.step(vec![Event::PointerMoved(target), button(target, false)]);
+        assert!(out.actions.is_empty() && out.group_drop.is_none() && out.group_drag.is_none(), "{case}: {out:?}");
+        assert_eq!(d.layout, frames(), "{case}");
+        assert!(!is_dragging::<u32>(&d.ctx, Id::unique(AREA)), "{case}");
+    }
+}
+
+#[test]
+fn floated_panel_fits_its_content_up_to_floating_size_not_the_column_height() {
+    for size in [Some(vec2(200.0, 150.0)), None] {
+        let mut layout = docked();
+        let Some(Node::Split { first, .. }) = &mut layout.root else { panic!() };
+        **first = Node::Dock { side: Side::Start, columns: vec![Column::new(vec![Group::new(vec![2, 3], 1)], 240.0)] };
+        let content = TestContent { protected: vec![0], floating_size: size, body_height: Some(200.0), ..Default::default() };
+        let mut d = Driver::with(layout, content, Rect::from_min_size(pos2(0.0, 0.0), vec2(600.0, 600.0)));
+        let out = d.drag(d.tab(3).center(), pos2(700.0, 100.0));
+        let Some([_, _, width, height]) = out.actions.iter().find_map(|a| match a {
+            Action::Float { panel: 3, rect } => Some(*rect),
+            _ => None,
+        }) else {
+            panic!("{:?}", out.actions)
+        };
+        let fitted = crate::docking::chrome::TITLE_HEIGHT + d.rect("drag-bar", 2).height() + 200.0;
+        match size {
+            Some(size) => assert_eq!((width, height), (size.x, size.y)),
+            None => assert_eq!(height, fitted),
+        }
+    }
+}
+
+#[test]
+fn floating_window_is_opaque_with_a_transparent_host_background() {
+    let layout = Layout { root: Some(tabs(&[1], 0)), floating: vec![Floating::single(vec![5, 6], 1, [80.0, 70.0, 300.0, 220.0])] };
+    let mut d = Driver::new(layout);
+    d.transparent = true;
+    d.step(vec![]);
+    let window = Rect::from_min_size(pos2(80.0, 70.0), vec2(300.0, 220.0));
+    let fill = d.ctx.global_style().visuals.window_fill;
+    assert_ne!(fill, Color32::TRANSPARENT);
+    fn filled(shape: &egui::Shape, rect: Rect, fill: Color32) -> bool {
+        match shape {
+            egui::Shape::Rect(shape) => shape.rect == rect && shape.fill == fill,
+            egui::Shape::Vec(shapes) => shapes.iter().any(|shape| filled(shape, rect, fill)),
+            _ => false,
+        }
+    }
+    assert!(d.shapes.iter().any(|clipped| filled(&clipped.shape, window, fill)), "no opaque fill under the floating window");
+}
+
+#[test]
+fn double_click_on_a_floating_tab_or_bar_minimizes_and_another_tab_expands() {
+    let layout = Layout { root: Some(tabs(&[1], 0)), floating: vec![Floating::single(vec![5, 6], 1, [80.0, 70.0, 300.0, 220.0])] };
+    let mut d = Driver::new(layout);
+    let minimized = |d: &Driver| d.layout.floating[0].minimized;
+    let tab = d.tab(6).center();
+    d.click(tab);
+    let out = d.click(tab);
+    assert!(out.actions.contains(&Action::SetMinimized { panel: 6, minimized: true }), "{:?}", out.actions);
+    assert!(minimized(&d));
+    d.wait();
+
+    // Another tab of the minimized group expands it and selects that tab.
+    let other = d.tab(5).center();
+    d.click(other);
+    assert!(!minimized(&d));
+    assert_eq!(d.layout.floating[0].groups()[0].active_panel(), Some(&5));
+
+    d.wait();
+    let bar = d.rect("drag-bar", 5).center();
+    d.click(bar);
+    d.click(bar);
+    assert!(minimized(&d));
+    d.wait();
+    d.click(bar);
+    d.click(bar);
+    assert!(!minimized(&d));
+}
+
+#[test]
+fn release_over_own_position_is_a_noop() {
+    let mut d = Driver::new(frames());
+    let bar = d.rect("drag-bar", 2);
+    let out = d.drag(bar.center(), bar.center() + vec2(0.0, 200.0));
+    assert!(out.actions.is_empty() && out.group_drop.is_none(), "{out:?}");
+    assert_eq!(d.layout, frames());
+}
+
+#[test]
+fn floating_border_and_drag_bar_move_and_cancel_as_a_group() {
+    for name in ["drag-border", "drag-bar"] {
+        // Nothing docked: a header drag of a window's only group looks through the window.
+        let layout = Layout { root: None, floating: vec![Floating::single(vec![5, 6], 1, [80.0, 70.0, 300.0, 220.0])] };
+        let mut d = Driver::new(layout.clone());
+        let from = d.rect(name, 5).center();
+        d.hold(from, from + vec2(50.0, 40.0));
+        assert_eq!(d.layout, layout, "{name}: a ghost moves, not the window");
+        d.step(vec![key(egui::Key::Escape)]);
+        d.step(vec![button(from + vec2(50.0, 40.0), false)]);
+        assert_eq!(d.layout, layout, "{name}");
+
+        let out = d.drag(from, from + vec2(50.0, 40.0));
+        assert!(matches!(moved_group(&out.actions), Some(Target::Float { .. })), "{name}: {:?}", out.actions);
+        let [x, y, w, h] = d.layout.floating[0].rect;
+        assert_eq!([x, y, w, h], [130.0, 110.0, 300.0, 220.0], "{name}");
+        assert_eq!(d.layout.floating[0].groups()[0], Group::new(vec![5, 6], 1));
+    }
+}
+
+#[test]
+/// Moving a floating window by eight fractional pointer steps lands within one
+/// point of the accumulated 80.3 × 60.7 pt offset, without step-rounding drift.
+fn floating_border_movement_does_not_accumulate_fractional_step_rounding() {
+    let layout = Layout { root: None, floating: vec![Floating::single(vec![5, 6], 1, [80.0, 70.0, 300.0, 220.0])] };
+    let mut d = Driver::new(layout);
+    let from = d.rect("drag-border", 5).center();
+    d.step(vec![Event::PointerMoved(from), button(from, true)]);
+    for index in 1..=8 {
+        d.step(vec![Event::PointerMoved(from + vec2(80.3, 60.7) * (index as f32 / 8.0))]);
+    }
+    d.step(vec![button(from + vec2(80.3, 60.7), false)]);
+    let [x, y, ..] = d.layout.floating[0].rect;
+    assert!((x - 160.3).abs() <= 1.0 && (y - 130.7).abs() <= 1.0, "{x} {y}");
+}
+
+#[test]
+/// With host-owned headers, dragging either the border or the bar reaches
+/// `whole_group`, emits no action or group drop, and leaves the layout unchanged.
+fn docked_header_drag_reaches_the_host_hook_and_preserves_the_group() {
+    for name in ["drag-border", "drag-bar"] {
+        let content = TestContent { host_owned: true, ..Default::default() };
+        let mut d = Driver::with(frames(), content, Rect::from_min_size(pos2(0.0, 0.0), vec2(600.0, 600.0)));
+        let out = d.drag(d.rect(name, 2).center(), pos2(70.0, 300.0));
+        assert!(d.content.whole_group, "{name}");
+        assert!(out.actions.is_empty() && out.group_drop.is_none(), "{name}: the host owns the release");
+        assert_eq!(d.layout, frames());
+    }
+}
+
+#[test]
+/// A lone protected panel renders neither a tab nor a drag bar, while another group still has its
+/// bar.
+fn a_lone_protected_panel_draws_no_strip_and_no_bar() {
+    struct Bare;
+    impl DockContent<u32> for Bare {
+        /// A bare content body that draws nothing.
+        fn body(&mut self, _: &mut egui::Ui, _: &u32) {}
+        /// Mark panel 1 protected and leave every other panel with default permissions.
+        fn permissions(&self, panel: &u32) -> Permissions {
+            if *panel == 1 { Permissions::PROTECTED } else { Permissions::default() }
+        }
+    }
+    let ctx = Context::default();
+    for _ in 0..2 {
+        ctx.run_ui(RawInput { screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0))), ..Default::default() }, |ui| {
+            DockArea::new(Id::unique(AREA)).show_content(ui, &frames(), &DockStyle::from_ui(ui), &mut Bare);
+        })
+        .textures_delta
+        .clear();
+    }
+    assert!(ctx.read_response(Id::unique(AREA).with(("drag-bar", Some(&1u32)))).is_none());
+    assert!(ctx.read_response(Id::unique(AREA).with(("tab", &1u32))).is_none());
+    assert!(ctx.read_response(Id::unique(AREA).with(("drag-bar", Some(&2u32)))).is_some());
+}
+
+#[test]
+/// The drag bar's context menu contains Close Tab Group, Minimize, Float Tab Group and Move Group
+/// To; clicking Close emits `CloseGroup`, and Enter on the focused bar opens the menu.
+fn drag_bar_menu_has_the_group_items_and_opens_from_the_keyboard() {
+    use egui_kittest::{Harness, kittest::Queryable};
+    let mut h = Harness::builder().with_size(vec2(800.0, 600.0)).build_ui_state(
+        |ui, (content, actions): &mut (TestContent, Vec<Action<u32>>)| {
+            let out = DockArea::new(Id::unique(AREA)).show_content(ui, &docked(), &DockStyle::from_ui(ui), content);
+            actions.extend(out.actions);
+        },
+        (TestContent { protected: vec![0], ..Default::default() }, Vec::new()),
+    );
+    h.run_steps(2);
+    let bar_id = Id::unique(AREA).with(("drag-bar", Some(&2u32)));
+    let at = h.ctx.read_response(bar_id).unwrap().rect.center();
+    h.input_mut().events.extend([
+        Event::PointerMoved(at),
+        Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: true, modifiers: Modifiers::NONE },
+    ]);
+    h.run_steps(1);
+    h.input_mut().events.push(Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(2);
+    for label in ["Close Tab Group", "Minimize", "Float Tab Group", "Move Group To"] {
+        assert_eq!(h.query_all_by_label(label).count(), 1, "{label}");
+    }
+    h.get_by_label("Close Tab Group").click();
+    h.run_steps(2);
+    assert!(h.state().1.contains(&Action::CloseGroup { panel: 3 }), "{:?}", h.state().1);
+
+    h.ctx.memory_mut(|memory| memory.request_focus(bar_id));
+    h.run_steps(1);
+    assert!(DockArea::<u32>::new(Id::unique(AREA)).chrome_has_focus(&h.ctx, &docked()));
+    h.input_mut().events.push(key(egui::Key::Enter));
+    h.run_steps(2);
+    assert!(egui::Popup::is_any_open(&h.ctx));
+}
+
+#[test]
+/// Dragging one group out of a two-group floating stack floats only that group
+/// at the stack width and its recorded height in the stack.
+fn a_group_dragged_out_of_a_floating_stack_tears_out_alone() {
+    let stack = Floating::stack(vec![Group::new(vec![5], 0), Group::new(vec![6, 7], 1)], [80.0, 70.0, 300.0, 400.0]).unwrap();
+    let layout = Layout { root: Some(tabs(&[1], 0)), floating: vec![stack] };
+    let mut d = Driver::new(layout);
+    let from = d.rect("drag-bar", 6).center();
+    let out = d.drag(from, pos2(700.0, 300.0));
+    assert!(matches!(moved_group(&out.actions), Some(Target::Float { rect: Some([_, _, 300.0, 189.0]) })), "{:?}", out.actions);
+    assert_eq!(d.layout.floating.len(), 2);
+    assert_eq!(d.layout.floating[0].groups(), vec![Group::new(vec![5], 0)]);
+    assert_eq!(d.layout.floating[1].groups(), vec![Group::new(vec![6, 7], 1)]);
+}
+
+#[test]
+/// A docked panel floats at the title bar plus strip plus recorded content height, with a 120 pt
+/// minimum and the 320 pt docked cap; a host floating size supplies the width and caps the height,
+/// and a group uses its active panel's content height.
+fn a_short_docked_panel_floats_at_its_content_height_up_to_its_floating_size() {
+    let title = crate::docking::chrome::TITLE_HEIGHT;
+    let float = |body: f32, floating_size: Option<Vec2>| {
+        let content = TestContent { body_height: Some(body), floating_size, ..Default::default() };
+        let mut d = Driver::with(docked(), content, Rect::from_min_size(pos2(0.0, 0.0), vec2(600.0, 600.0)));
+        let strip = d.rect("drag-bar", 4).height();
+        let recorded = crate::docking::float_space::<u32>(&d.ctx, Id::unique(AREA)).unwrap().panel(&4).unwrap();
+        let target = pos2(400.0, 300.0);
+        d.hold(d.tab(4).center(), target);
+        d.modifiers = Modifiers::COMMAND;
+        let out = d.step(vec![button(target, false)]);
+        let Some([_, _, width, height]) = out.actions.iter().find_map(|a| match a {
+            Action::Float { panel: 4, rect } => Some(*rect),
+            _ => None,
+        }) else {
+            panic!("{:?}", out.actions)
+        };
+        assert_eq!(recorded, vec2(width, height), "a command floats at the size a drag does");
+        (strip, vec2(width, height))
+    };
+    let (strip, size) = float(150.0, None);
+    assert_eq!(size.y, title + strip + 150.0);
+    assert_eq!(float(0.0, None).1.y, 120.0, "an empty panel floats at the least fitted height");
+    assert_eq!(float(600.0, None).1.y, 320.0, "a tall docked panel keeps the docked cap");
+    // The host's floating size gives the width and the most height.
+    assert_eq!(float(150.0, Some(vec2(300.0, 360.0))).1, vec2(300.0, title + strip + 150.0));
+    assert_eq!(float(150.0, Some(vec2(300.0, 160.0))).1, vec2(300.0, 160.0));
+
+    // A group takes its active panel's content height.
+    let content = TestContent { body_height: Some(150.0), ..Default::default() };
+    let mut d = Driver::with(docked(), content, Rect::from_min_size(pos2(0.0, 0.0), vec2(600.0, 600.0)));
+    let target = pos2(400.0, 300.0);
+    d.hold(d.rect("drag-bar", 2).center(), target);
+    d.modifiers = Modifiers::COMMAND;
+    let out = d.step(vec![button(target, false)]);
+    let Some(Target::Float { rect: Some([_, _, _, height]) }) = moved_group(&out.actions) else { panic!("{:?}", out.actions) };
+    assert_eq!(*height, title + strip + 150.0);
+}
+
+#[test]
+/// A fill-height panel floats at the 320 pt docked cap without a host size
+/// and at the host's height when one is supplied.
+fn a_panel_that_fills_its_frame_floats_at_its_floating_size_or_320() {
+    let float = |floating_size: Option<Vec2>| {
+        let content = TestContent { fill: true, floating_size, ..Default::default() };
+        let mut d = Driver::with(frames(), content, Rect::from_min_size(pos2(0.0, 0.0), vec2(600.0, 600.0)));
+        let target = pos2(400.0, 300.0);
+        d.hold(d.tab(3).center(), target);
+        d.modifiers = Modifiers::COMMAND;
+        let out = d.step(vec![button(target, false)]);
+        out.actions
+            .iter()
+            .find_map(|a| match a {
+                Action::Float { panel: 3, rect } => Some(rect[3]),
+                _ => None,
+            })
+            .unwrap_or_else(|| panic!("{:?}", out.actions))
+    };
+    assert_eq!(float(None), 320.0);
+    assert_eq!(float(Some(vec2(300.0, 400.0))), 400.0);
+}
+
+#[test]
+/// Keyboard focus on a tab is kept across a user drag, but a layout reset that moves the tab clears
+/// it and reports no new focus; closing the panel also gives focus up.
+fn tab_focus_follows_only_the_users_input() {
+    let mut d = Driver::new(docked());
+    let tab = Id::unique(AREA).with(("tab", &4u32));
+    // Keyboard focus as Tab gives it.
+    d.ctx.memory_mut(|m| m.request_focus(tab));
+    d.step(vec![]);
+    assert!(d.ctx.memory(|m| m.has_focus(tab)));
+
+    // A reset that moves the panel takes its focus away and reports no new focus.
+    let mut reset = docked();
+    let Some(Node::Split { first, .. }) = &mut reset.root else { panic!() };
+    let Node::Dock { columns, .. } = first.as_mut() else { panic!() };
+    columns[0].groups.reverse();
+    d.layout = reset;
+    let out = d.step(vec![]);
+    assert_eq!(out.focused, None);
+    d.step(vec![]);
+    assert_eq!(d.ctx.memory(|m| m.focused()), None, "the moved tab gives up keyboard focus");
+
+    // A user drag keeps the dragged tab's focus where the user put it.
+    let mut d = Driver::new(docked());
+    d.ctx.memory_mut(|m| m.request_focus(tab));
+    d.drag(d.tab(4).center(), d.tab(2).center());
+    d.step(vec![]);
+    assert!(d.layout.place(&4) != docked().place(&4));
+    assert!(d.ctx.memory(|m| m.has_focus(tab)), "a tab moved by the user keeps focus");
+
+    // A closed panel's tab gives focus up too.
+    let out = d.step(vec![]);
+    assert!(out.actions.is_empty());
+    d.layout.apply(Action::Close { panel: 4 }).unwrap();
+    d.step(vec![]);
+    d.step(vec![]);
+    assert_eq!(d.ctx.memory(|m| m.focused()), None);
+}
+
+#[test]
+/// Wheel selection is off by default. With the floating frame style, wheel up selects the previous
+/// tab and stops at the first, trackpad points accumulate into a notch, huge deltas clamp at both
+/// ends, and middle-click closes the tab.
+fn frame_tabs_follow_the_wheel_and_close_on_a_middle_click() {
+    let second = |d: &Driver| match &d.layout.root {
+        Some(Node::Split { second, .. }) => (**second).clone(),
+        _ => panic!("{:?}", d.layout.root),
+    };
+    let wheel = |unit, y| Event::MouseWheel {
+        source: egui::MouseWheelSource::Unknown,
+        unit,
+        delta: vec2(0.0, y),
+        phase: egui::TouchPhase::Move,
+        modifiers: Modifiers::NONE,
+    };
+    let middle = |pos, pressed| Event::PointerButton { pos, button: PointerButton::Middle, pressed, modifiers: Modifiers::NONE };
+
+    // Off by default.
+    let mut d = Driver::new(frames());
+    let over = d.tab(2).center();
+    d.step(vec![Event::PointerMoved(over), wheel(egui::MouseWheelUnit::Line, 1.0)]);
+    d.step(vec![middle(over, true)]);
+    d.step(vec![middle(over, false)]);
+    assert_eq!(second(&d), tabs(&[2, 3], 1));
+
+    let mut d = Driver::new(frames());
+    d.tweak = super::floating_tests::frame_style;
+    d.step(vec![]);
+    let over = d.tab(2).center();
+    d.step(vec![Event::PointerMoved(over), wheel(egui::MouseWheelUnit::Line, 1.0)]);
+    assert_eq!(second(&d), tabs(&[2, 3], 0), "wheel up selects the previous tab");
+    d.step(vec![wheel(egui::MouseWheelUnit::Line, 1.0)]);
+    assert_eq!(second(&d), tabs(&[2, 3], 0), "and stops at the first");
+    d.step(vec![wheel(egui::MouseWheelUnit::Point, -30.0)]);
+    assert_eq!(second(&d), tabs(&[2, 3], 0), "trackpad scrolling adds up to a notch");
+    let out = d.step(vec![wheel(egui::MouseWheelUnit::Point, -30.0)]);
+    assert_eq!(second(&d), tabs(&[2, 3], 1));
+    assert_eq!(out.focused, Some(3));
+    d.step(vec![wheel(egui::MouseWheelUnit::Line, -1e30)]);
+    assert_eq!(second(&d), tabs(&[2, 3], 1), "a huge delta stops at the last tab");
+    d.step(vec![wheel(egui::MouseWheelUnit::Line, 1e30)]);
+    assert_eq!(second(&d), tabs(&[2, 3], 0), "and at the first");
+
+    d.step(vec![middle(over, true)]);
+    let out = d.step(vec![middle(over, false)]);
+    assert_eq!(out.actions, vec![Action::Close { panel: 2 }]);
+    assert_eq!(second(&d), tabs(&[3], 0));
+}
diff --git a/crates/ui/src/docking/hits.rs b/crates/ui/src/docking/hits.rs
new file mode 100644
index 00000000..3e59e022
--- /dev/null
+++ b/crates/ui/src/docking/hits.rs
@@ -0,0 +1,230 @@
+//! Where each docking gesture starts, for control protocols and tests.
+
+use std::{collections::HashMap, fmt::Debug, hash::Hash};
+
+use egui::{Context, Id, LayerId, Order, Rect};
+
+use super::{DockArea, Floating, Layout, Node, render::RESIZE_HANDLES};
+
+/// A rendered docking control that starts a gesture. Groups, columns and windows are named by
+/// their first panel.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[non_exhaustive]
+pub enum Hit<P> {
+    /// A tab: click activates, drag moves the panel (S1).
+    Tab(P),
+    /// A group's drag bar: drag moves the group; a right click, Enter or Space opens the group
+    /// menu (S2).
+    DragBar(P),
+    /// The top border of a group's strip: drag moves the group (S3).
+    Border(P),
+    /// The "…" button of a group whose tabs overflow; named by the active panel.
+    Overflow(P),
+    /// [D] A column bar: drag moves the column (S6).
+    ColumnBar(P),
+    /// [D] The »/« button of a column bar (M2).
+    Collapse(P),
+    /// An accordion entry's −/+ button.
+    StackToggle(P),
+    /// A floating window's title bar (S5).
+    Title(P),
+    /// A floating window's × button.
+    Close(P),
+    /// [D] A panel's icon in an iconic column (S7, M5).
+    Icon(P),
+    /// [D] The grip above an icon group (S8).
+    IconGrip(P),
+    /// A floating window's resize handle.
+    Resize(P, ResizeEdge),
+    Divider(Divider<P>),
+}
+
+/// The edge or corner a floating window's resize handle moves.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[non_exhaustive]
+pub enum ResizeEdge {
+    Left,
+    Right,
+    Bottom,
+    BottomLeft,
+    BottomRight,
+    Top,
+    TopLeft,
+    TopRight,
+}
+
+/// A divider that resizes what is on either side of it.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[non_exhaustive]
+pub enum Divider<P> {
+    /// A split, by its path from the root (see [`super::Action::ResizeSplit`]).
+    Split(Vec<bool>),
+    /// Below the accordion entry of this panel.
+    Stack(P),
+    /// [D] The inner edge of the column holding this panel first.
+    Column(P),
+    /// Below the dock group holding this panel first.
+    Group(P),
+    /// Where the divider of a split inside another split ends on the outer split's divider,
+    /// by the outer and the inner split's paths. Dragging it moves both dividers.
+    Intersection(Vec<bool>, Vec<bool>),
+    /// A divider in the floating window holding the panel, by its path from the window's root.
+    WindowSplit(P, Vec<bool>),
+    WindowIntersection(P, Vec<bool>, Vec<bool>),
+}
+
+fn key(area: Id) -> Id {
+    area.with("hit-rects")
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> DockArea<'_, P> {
+    /// Every gesture source the area drew in its last frame, with its rect in points. Hosts
+    /// return these from a `ui.docking` control method beside the layout and `focused`; tests
+    /// drag from their centers.
+    pub fn hit_rects(ctx: &Context, id: Id) -> Vec<(Hit<P>, Rect)> {
+        let Some((layout, rects)) = ctx.data(|d| d.get_temp::<Recorded<P>>(key(id))) else { return Vec::new() };
+        let mut names = named(id, &layout);
+        rects.into_iter().filter_map(|(id, rect)| Some((names.remove(&id)?, rect))).collect()
+    }
+
+    /// The egui widget id of the control `hit` names in the area `id`, for tests and
+    /// automation that focus a control or read its response.
+    pub fn hit_id(id: Id, hit: &Hit<P>) -> Id {
+        match hit {
+            Hit::Tab(p) => id.with(("tab", p)),
+            Hit::Icon(p) => id.with(("icon", p)),
+            Hit::Overflow(p) => id.with(("overflow", p)),
+            Hit::StackToggle(p) => id.with(("collapse", p)),
+            Hit::Divider(Divider::Stack(p)) => id.with(("stack-resize", p)),
+            Hit::DragBar(p) => id.with(("drag-bar", Some(p))),
+            Hit::Border(p) => id.with(("drag-border", Some(p))),
+            Hit::IconGrip(p) => id.with(("icon-grip", Some(p))),
+            Hit::ColumnBar(p) => id.with(("column-bar", Some(p))),
+            Hit::Collapse(p) => id.with(("column-collapse", Some(p))),
+            Hit::Divider(Divider::Column(p)) => id.with(("column-resize", Some(p))),
+            Hit::Divider(Divider::Group(p)) => id.with(("group-resize", Some(p))),
+            Hit::Divider(Divider::Split(path)) => id.with(("split", path)),
+            Hit::Divider(Divider::Intersection(outer, inner)) => id.with(("intersection", outer, inner)),
+            Hit::Divider(Divider::WindowSplit(p, path)) => id.with(("window-split", p, path)),
+            Hit::Divider(Divider::WindowIntersection(p, outer, inner)) => id.with(("window-intersection", p, outer, inner)),
+            Hit::Title(p) => id.with(("move-group", Some(p))),
+            Hit::Close(p) => id.with(("move-group", Some(p))).with("close"),
+            Hit::Resize(p, edge) => {
+                let name = match edge {
+                    ResizeEdge::BottomRight => RESIZE_HANDLES[0],
+                    ResizeEdge::Left => RESIZE_HANDLES[1],
+                    ResizeEdge::Right => RESIZE_HANDLES[2],
+                    ResizeEdge::Bottom => RESIZE_HANDLES[3],
+                    ResizeEdge::BottomLeft => RESIZE_HANDLES[4],
+                    ResizeEdge::Top => RESIZE_HANDLES[5],
+                    ResizeEdge::TopLeft => RESIZE_HANDLES[6],
+                    ResizeEdge::TopRight => RESIZE_HANDLES[7],
+                };
+                id.with(("floating", p)).with(name)
+            }
+        }
+    }
+
+    /// The egui layer of a floating window in the area `id`; `None` for an empty window. Of two
+    /// layers, the later in `ctx.memory(|m| m.layer_ids())` is drawn on top, and
+    /// `ctx.memory(|m| m.area_rect(layer.id))` is the window's rect. A window the area does not
+    /// draw (all its panels hidden, or a frame maximized) keeps its last rect there: check
+    /// `ctx.memory(|m| m.areas().is_visible(&layer))` before treating it as covering anything.
+    pub fn floating_layer(id: Id, window: &Floating<P>) -> Option<LayerId> {
+        window.panels().next().map(|first| LayerId::new(Order::Middle, id.with(("floating", first))))
+    }
+}
+
+/// Every control the area `area` can draw for `layout`, by widget id.
+pub(super) fn named<P: Clone + Eq + Hash + Debug + Send + Sync + 'static>(area: Id, layout: &Layout<P>) -> HashMap<Id, Hit<P>> {
+    let mut names: HashMap<Id, Hit<P>> = HashMap::new();
+    let mut name = |hit: Hit<P>| {
+        names.insert(DockArea::<P>::hit_id(area, &hit), hit);
+    };
+    for panel in layout.panels() {
+        let p = || panel.clone();
+        for hit in [
+            Hit::Tab(p()),
+            Hit::Icon(p()),
+            Hit::Overflow(p()),
+            Hit::StackToggle(p()),
+            Hit::Divider(Divider::Stack(p())),
+            Hit::DragBar(p()),
+            Hit::Border(p()),
+            Hit::IconGrip(p()),
+            Hit::ColumnBar(p()),
+            Hit::Collapse(p()),
+            Hit::Divider(Divider::Column(p())),
+            Hit::Divider(Divider::Group(p())),
+            Hit::Title(p()),
+            Hit::Close(p()),
+        ] {
+            name(hit);
+        }
+        for edge in [
+            ResizeEdge::BottomRight,
+            ResizeEdge::Left,
+            ResizeEdge::Right,
+            ResizeEdge::Bottom,
+            ResizeEdge::BottomLeft,
+            ResizeEdge::Top,
+            ResizeEdge::TopLeft,
+            ResizeEdge::TopRight,
+        ] {
+            name(Hit::Resize(p(), edge));
+        }
+    }
+    if let Some(root) = &layout.root {
+        name_splits(root, &mut |path, outer| match outer {
+            None => name(Hit::Divider(Divider::Split(path))),
+            Some(outer) => name(Hit::Divider(Divider::Intersection(outer, path))),
+        });
+    }
+    for window in &layout.floating {
+        let Some(key) = window.panels().next() else { continue };
+        name_splits(&window.root, &mut |path, outer| match outer {
+            None => name(Hit::Divider(Divider::WindowSplit(key.clone(), path))),
+            Some(outer) => name(Hit::Divider(Divider::WindowIntersection(key.clone(), outer, path))),
+        });
+    }
+    names
+}
+
+/// Every split of a tree by its path (`None`), and every pair of a split and a split inside it
+/// (`Some(outer)`), whose dividers may meet.
+fn name_splits<P>(root: &Node<P>, name: &mut dyn FnMut(Vec<bool>, Option<Vec<bool>>)) {
+    let mut nodes = vec![(root, Vec::<bool>::new())];
+    let mut splits: Vec<Vec<bool>> = Vec::new();
+    while let Some((node, path)) = nodes.pop() {
+        if splits.len() > super::model::MAX_NODES {
+            break;
+        }
+        if let Node::Split { first, second, .. } = node {
+            name(path.clone(), None);
+            for outer in splits.iter().filter(|outer| path.starts_with(outer)) {
+                name(path.clone(), Some(outer.clone()));
+            }
+            splits.push(path.clone());
+            let mut second_path = path.clone();
+            second_path.push(true);
+            let mut first_path = path;
+            first_path.push(false);
+            nodes.push((second, second_path));
+            nodes.push((first, first_path));
+        }
+    }
+}
+
+/// The layout of the last frame and the rects of the controls it registered, by widget id.
+type Recorded<P> = (Layout<P>, Vec<(Id, Rect)>);
+
+/// Store the rects of the controls the renderer registered this frame. They are named only
+/// when [`DockArea::hit_rects`] asks, which tests and automation do, not every frame.
+pub(super) fn record<P: Clone + Eq + Hash + Debug + Send + Sync + 'static>(ctx: &Context, area: Id, layout: &Layout<P>, owned: &[Id]) {
+    let rects: Vec<(Id, Rect)> =
+        owned.iter().filter_map(|id| Some((*id, ctx.read_response(*id)?.rect))).filter(|(_, rect)| rect.is_positive()).collect();
+    ctx.data_mut(|d| d.insert_temp::<Recorded<P>>(key(area), (layout.clone(), rects)));
+}
diff --git a/crates/ui/src/docking/iconic_tests.rs b/crates/ui/src/docking/iconic_tests.rs
new file mode 100644
index 00000000..0a353f2c
--- /dev/null
+++ b/crates/ui/src/docking/iconic_tests.rs
@@ -0,0 +1,435 @@
+//! [D] Iconic columns, flyouts and hit rects, driven through `testing::DockDriver`.
+
+use super::testing::DockDriver;
+use super::*;
+use crate::layout::{SplitAxis, SplitSize};
+use egui::{Key, Pos2, Rect, pos2, vec2};
+
+struct Content;
+
+impl DockContent<u32> for Content {
+    fn body(&mut self, ui: &mut egui::Ui, _: &u32) {
+        ui.label("Body");
+    }
+    fn logical_label(&self, panel: &u32) -> String {
+        format!("Panel {panel}")
+    }
+    fn permissions(&self, panel: &u32) -> Permissions {
+        if *panel == 0 { Permissions::PROTECTED } else { Permissions::default() }
+    }
+}
+
+type Driver = DockDriver<u32, Content>;
+
+/// A name and a test for one kind of [`Hit`].
+type Check<'a> = (&'a str, &'a dyn Fn(&Hit<u32>) -> bool);
+
+/// A left dock with one column of `groups`, iconic when `iconic`, beside canvas 0.
+fn docked(groups: &[&[u32]], iconic: bool) -> Layout<u32> {
+    let mut column = Column::new(groups.iter().map(|g| Group::new(g.to_vec(), 0)).collect(), 240.0);
+    column.iconic = iconic;
+    let dock = Node::Dock { side: Side::Start, columns: vec![column] };
+    let canvas = Node::Tabs { panels: vec![0], active: 0 };
+    Layout {
+        root: Some(Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedFirst(240.0), first: Box::new(dock), second: Box::new(canvas) }),
+        floating: Vec::new(),
+    }
+}
+
+fn first_column(layout: &Layout<u32>) -> Column<u32> {
+    match &layout.root {
+        Some(Node::Split { first, .. }) => match first.as_ref() {
+            Node::Dock { columns, .. } => columns.first().cloned().unwrap(),
+            other => panic!("no dock: {other:?}"),
+        },
+        other => panic!("no split: {other:?}"),
+    }
+}
+
+fn groups(layout: &Layout<u32>) -> Vec<Vec<u32>> {
+    first_column(layout).groups.iter().map(|g| g.panels.clone()).collect()
+}
+
+fn hit(d: &Driver, hit: Hit<u32>) -> Rect {
+    d.hit(&hit).unwrap_or_else(|| panic!("{hit:?} in {:?}", d.hits()))
+}
+
+fn open(d: &Driver) -> Option<u32> {
+    flyout::<u32>(&d.ctx, d.id)
+}
+
+fn texts(d: &Driver) -> Vec<String> {
+    d.shapes()
+        .iter()
+        .filter_map(|clipped| match &clipped.shape {
+            egui::Shape::Text(text) => Some(text.galley.text().to_owned()),
+            _ => None,
+        })
+        .collect()
+}
+
+const CANVAS: Pos2 = pos2(600.0, 400.0);
+
+#[test]
+fn collapsed_column_shows_one_icon_per_panel_with_group_separators() {
+    let d = DockDriver::new(docked(&[&[1, 2], &[3]], true), Content);
+    let (one, two, three) = (hit(&d, Hit::Icon(1)), hit(&d, Hit::Icon(2)), hit(&d, Hit::Icon(3)));
+    let (grip1, grip3) = (hit(&d, Hit::IconGrip(1)), hit(&d, Hit::IconGrip(3)));
+    assert_eq!(one.width(), 36.0, "the column takes the style's iconic width");
+    assert_eq!(one.bottom(), two.top(), "a group's icons follow each other");
+    assert_eq!(three.top() - two.bottom(), 7.0, "groups are apart by the separator, with no room for a grip");
+    assert_eq!((grip1.top(), grip1.bottom()), (one.top(), one.top() + 4.0), "the first group's band is its top edge");
+    assert_eq!((grip3.top(), grip3.bottom()), (two.bottom(), three.top() + 4.0), "a later group's band covers the separator");
+    assert!(d.hit(&Hit::Tab(1)).is_none(), "an iconic column draws no tabs");
+}
+
+#[test]
+fn widening_an_iconic_column_shows_labels() {
+    let mut d = DockDriver::new(docked(&[&[1, 2], &[3]], true), Content);
+    assert!(!texts(&d).iter().any(|t| t == "Panel 1"));
+    let edge = hit(&d, Hit::Divider(Divider::Column(1)));
+    let out = d.drag(edge.center(), pos2(150.0, edge.center().y));
+    assert!(out.error.is_none());
+    let width = first_column(&d.layout).iconic_width.unwrap();
+    assert!((100.0..=160.0).contains(&width), "{width}");
+    d.settle();
+    let labels = texts(&d);
+    assert!(["Panel 1", "Panel 2", "Panel 3"].iter().all(|l| labels.iter().any(|t| t == l)), "{labels:?}");
+    let edge = hit(&d, Hit::Divider(Divider::Column(1)));
+    d.drag(edge.center(), pos2(20.0, edge.center().y));
+    d.settle();
+    assert_eq!(first_column(&d.layout).iconic_width, Some(36.0));
+    assert!(!texts(&d).iter().any(|t| t == "Panel 1"));
+}
+
+#[test]
+/// An icon click activates its panel and opens a canvas-side flyout; another
+/// icon switches it, and the same icon closes it even with auto-collapse off. Escape
+/// and outside presses close it only with auto-collapse on; a programmatic raise opens it.
+fn icon_click_opens_a_flyout_on_the_canvas_side_and_auto_collapse_closes_it() {
+    let mut d = DockDriver::new(docked(&[&[1, 2], &[3]], true), Content);
+    let icon = hit(&d, Hit::Icon(2)).center();
+    let out = d.click(icon);
+    assert!(out.actions.contains(&Action::Activate { panel: 2 }));
+    d.settle();
+    assert_eq!(open(&d), Some(2));
+    let column = hit(&d, Hit::Icon(1));
+    let tab = hit(&d, Hit::Tab(2));
+    assert!(tab.left() >= column.right(), "the flyout opens on the canvas side: {tab:?}");
+    assert!(tab.top() <= hit(&d, Hit::IconGrip(1)).bottom(), "beside its group");
+    assert_eq!(first_column(&d.layout).groups.first().map(|g| g.active), Some(1));
+
+    // Another icon switches flyouts, the same icon closes.
+    d.click(hit(&d, Hit::Icon(3)).center());
+    d.settle();
+    assert_eq!(open(&d), Some(3));
+    assert!(d.hit(&Hit::Tab(2)).is_none());
+    d.click(hit(&d, Hit::Icon(3)).center());
+    d.settle();
+    assert_eq!(open(&d), None);
+
+    // Escape and a press outside close it.
+    d.click(icon);
+    d.settle();
+    d.key(Key::Escape);
+    d.settle();
+    assert_eq!(open(&d), None);
+    d.click(icon);
+    d.settle();
+    let inside = hit(&d, Hit::Tab(2)).center();
+    d.click(inside);
+    d.settle();
+    assert_eq!(open(&d), Some(2), "a press inside keeps it");
+    d.click(CANVAS);
+    d.settle();
+    assert_eq!(open(&d), None);
+
+    // Auto-Collapse off: it stays until an icon closes it.
+    d.auto_collapse = false;
+    d.click(icon);
+    d.settle();
+    d.key(Key::Escape);
+    d.click(CANVAS);
+    d.settle();
+    assert_eq!(open(&d), Some(2));
+    d.click(icon);
+    d.settle();
+    assert_eq!(open(&d), None);
+
+    // U3: raising an iconic panel, as the Window menu does, opens its flyout.
+    d.raise = Some(3);
+    d.settle();
+    assert_eq!(open(&d), Some(3));
+}
+
+#[test]
+/// Choosing Auto-Collapse Iconic Panels from the iconic column's menu emits a
+/// `DockEvent::ToggleAutoCollapse` event rather than mutating the layout directly.
+fn auto_collapse_toggle_is_a_column_menu_event() {
+    use egui_kittest::{Harness, kittest::Queryable};
+    let layout = docked(&[&[1, 2]], true);
+    let mut h = Harness::builder().with_size(vec2(800.0, 600.0)).build_ui_state(
+        |ui, events: &mut Vec<DockEvent<u32>>| {
+            let out = DockArea::new(egui::Id::unique("menu")).show_content(ui, &layout, &DockStyle::from_ui(ui), &mut Content);
+            events.extend(out.events);
+        },
+        Vec::new(),
+    );
+    h.run_steps(2);
+    let bar = h.ctx.read_response(egui::Id::unique("menu").with(("column-bar", Some(&1u32)))).unwrap().rect.center();
+    h.input_mut().events.extend([
+        egui::Event::PointerMoved(bar),
+        egui::Event::PointerButton { pos: bar, button: egui::PointerButton::Secondary, pressed: true, modifiers: egui::Modifiers::NONE },
+    ]);
+    h.run_steps(1);
+    h.input_mut().events.push(egui::Event::PointerButton {
+        pos: bar,
+        button: egui::PointerButton::Secondary,
+        pressed: false,
+        modifiers: egui::Modifiers::NONE,
+    });
+    h.run_steps(2);
+    h.get_by_label("Auto-Collapse Iconic Panels").click();
+    h.run_steps(2);
+    assert_eq!(h.state(), &vec![DockEvent::ToggleAutoCollapse]);
+}
+
+#[test]
+fn dragging_a_flyout_strip_floats_its_group() {
+    let mut d = DockDriver::new(docked(&[&[1, 2], &[3]], true), Content);
+    d.click(hit(&d, Hit::Icon(1)).center());
+    d.settle();
+    // A one-line body: the flyout and the floated group take the least fitted height.
+    let flyout = d.ctx.memory(|m| m.area_rect(d.id.with("flyout"))).unwrap();
+    assert_eq!(flyout.height(), 120.0);
+    let bar = hit(&d, Hit::DragBar(1));
+    let out = d.drag(bar.center(), CANVAS);
+    let [Action::MoveGroup { panel: 1, to: Target::Float { rect: Some(rect) } }] = out.actions.as_slice() else { panic!("{:?}", out.actions) };
+    assert_eq!(rect[3], 120.0);
+    assert_eq!(groups(&d.layout), vec![vec![3]]);
+    assert_eq!(d.layout.floating.len(), 1);
+    assert_eq!(d.layout.floating.first().map(|w| w.panels().copied().collect::<Vec<_>>()), Some(vec![1, 2]));
+    d.settle();
+    assert_eq!(open(&d), None, "the flyout closes with its group gone");
+
+    // A tab dragged out of a flyout floats that panel alone.
+    d.click(hit(&d, Hit::Icon(3)).center());
+    d.settle();
+    let tab = hit(&d, Hit::Tab(3));
+    let out = d.drag(tab.center(), pos2(450.0, 200.0));
+    assert!(matches!(out.actions.as_slice(), [Action::Float { panel: 3, .. }]), "{:?}", out.actions);
+}
+
+#[test]
+fn icon_and_icon_group_grip_drags_move_a_panel_and_a_group() {
+    let mut d = DockDriver::new(docked(&[&[1, 2], &[3]], true), Content);
+    let before = d.layout.clone();
+    // Escape, focus loss and cancel_drag end an icon drag with no change.
+    let icon = hit(&d, Hit::Icon(2)).center();
+    d.hold(icon, CANVAS);
+    d.key(Key::Escape);
+    d.release(CANVAS);
+    d.hold(icon, CANVAS);
+    d.focus(false);
+    d.focus(true);
+    d.release(CANVAS);
+    d.hold(icon, CANVAS);
+    cancel_drag::<u32>(&d.ctx, d.id);
+    d.release(CANVAS);
+    assert_eq!(d.layout, before);
+
+    let out = d.drag(icon, CANVAS);
+    let Some(Action::Float { panel: 2, rect }) = out.actions.first() else { panic!("{:?}", out.actions) };
+    assert_eq!((rect[2], rect[3]), (240.0, 320.0), "a panel floated from its icon takes the column's expanded width");
+    assert_eq!(groups(&d.layout), vec![vec![1], vec![3]]);
+
+    let grip = hit(&d, Hit::IconGrip(3)).center();
+    let out = d.drag(grip, pos2(450.0, 250.0));
+    assert!(matches!(out.actions.as_slice(), [Action::MoveGroup { panel: 3, to: Target::Float { .. } }]), "{:?}", out.actions);
+    assert_eq!(groups(&d.layout), vec![vec![1]]);
+}
+
+#[test]
+fn group_dropped_on_an_iconic_column_joins_as_an_icon_group() {
+    let mut layout = docked(&[&[1], &[2]], true);
+    layout.floating.push(Floating::single(vec![5, 6], 0, [300.0, 200.0, 240.0, 200.0]));
+    let mut d = DockDriver::new(layout, Content);
+    let bar = hit(&d, Hit::DragBar(5)).center();
+    let one = hit(&d, Hit::Icon(1));
+    let target = pos2(one.center().x, one.bottom() - 2.0);
+    d.hold(bar, target);
+    let column = Rect::from_min_max(pos2(0.0, 14.0), pos2(36.0, 600.0));
+    assert!(d.outlined(column.shrink(1.0)), "the column is outlined");
+    let line = Rect::from_x_y_ranges(column.x_range(), (one.bottom() - 2.0)..=(one.bottom() + 2.0));
+    assert!(d.filled(line), "with the insertion line under group 1");
+    let out = d.release(target);
+    assert!(
+        out.actions
+            .contains(&Action::MoveGroup { panel: 5, to: Target::At { anchor: 1, placement: Placement::Group { below: true, height: None } } }),
+        "{:?}",
+        out.actions
+    );
+    assert_eq!(groups(&d.layout), vec![vec![1], vec![5, 6], vec![2]]);
+    assert!(first_column(&d.layout).iconic);
+}
+
+/// A group dropped on the window edge beside an iconic column at that edge docks in a new column
+/// there: the preview is the edge line alone, without the column's outline.
+#[test]
+fn an_edge_drop_next_to_an_iconic_column_highlights_only_the_edge() {
+    let mut layout = docked(&[&[1], &[2]], true);
+    layout.floating.push(Floating::single(vec![5, 6], 0, [300.0, 200.0, 240.0, 200.0]));
+    let mut d = DockDriver::new(layout, Content);
+    let bar = hit(&d, Hit::DragBar(5)).center();
+    let target = pos2(2.0, 300.0);
+    d.hold(bar, target);
+    let column = Rect::from_min_max(pos2(0.0, 14.0), pos2(36.0, 600.0));
+    assert!(d.filled(Rect::from_x_y_ranges(0.0..=4.0, 0.0..=600.0)), "the edge line");
+    assert!(!d.outlined(column.shrink(1.0)), "the iconic column is not outlined");
+    d.release(target);
+    let Some(Node::Split { first, .. }) = &d.layout.root else { panic!("{:?}", d.layout.root) };
+    let Node::Dock { columns, .. } = first.as_ref() else { panic!("{first:?}") };
+    let panels: Vec<Vec<u32>> = columns.iter().map(|c| c.groups.iter().flat_map(|g| g.panels.clone()).collect()).collect();
+    assert_eq!(panels, vec![vec![5, 6], vec![1, 2]]);
+    assert!(!columns[0].iconic && columns[1].iconic);
+}
+
+/// Every kind of gesture source has a rect, and dragging from it does something.
+#[test]
+fn hit_rects_cover_every_gesture_source() {
+    let mut expanded = Column::new(vec![Group::new(vec![1, 2, 3, 4, 5, 6, 7], 0), Group::new(vec![8], 0)], 150.0);
+    expanded.width = 150.0;
+    let mut icons = Column::new(vec![Group::new(vec![9], 0)], 240.0);
+    icons.iconic = true;
+    let dock = Node::Dock { side: Side::Start, columns: vec![icons, expanded] };
+    let stack = Node::Stack { entries: vec![StackEntry { panel: 10, open: true, height: None }, StackEntry { panel: 11, open: true, height: None }] };
+    let frames = Node::Split {
+        axis: SplitAxis::Vertical,
+        size: SplitSize::Ratio(0.5),
+        first: Box::new(Node::Tabs { panels: vec![0], active: 0 }),
+        second: Box::new(stack),
+    };
+    let window = Floating::stack(vec![Group::new(vec![12], 0), Group::new(vec![13], 0)], [500.0, 60.0, 220.0, 300.0]).unwrap();
+    let layout = Layout {
+        root: Some(Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedFirst(200.0), first: Box::new(dock), second: Box::new(frames) }),
+        floating: vec![window],
+    };
+    let d = DockDriver::new(layout.clone(), Content);
+    let hits = d.hits();
+    let kinds = |f: &dyn Fn(&Hit<u32>) -> bool| hits.iter().filter(|(h, _)| f(h)).count();
+    let expected: [Check<'_>; 15] = [
+        ("tab", &|h| matches!(h, Hit::Tab(_))),
+        ("drag bar", &|h| matches!(h, Hit::DragBar(_))),
+        ("border", &|h| matches!(h, Hit::Border(_))),
+        ("overflow", &|h| matches!(h, Hit::Overflow(_))),
+        ("column bar", &|h| matches!(h, Hit::ColumnBar(_))),
+        ("collapse", &|h| matches!(h, Hit::Collapse(_))),
+        ("stack toggle", &|h| matches!(h, Hit::StackToggle(_))),
+        ("title", &|h| matches!(h, Hit::Title(12))),
+        ("close", &|h| matches!(h, Hit::Close(12))),
+        ("icon", &|h| matches!(h, Hit::Icon(9))),
+        ("icon grip", &|h| matches!(h, Hit::IconGrip(9))),
+        ("resize", &|h| matches!(h, Hit::Resize(12, _))),
+        ("split", &|h| matches!(h, Hit::Divider(Divider::Split(_)))),
+        ("column divider", &|h| matches!(h, Hit::Divider(Divider::Column(_)))),
+        ("group divider", &|h| matches!(h, Hit::Divider(Divider::Group(_)))),
+    ];
+    for (name, kind) in expected {
+        assert!(kinds(kind) > 0, "{name}: {hits:?}");
+    }
+    assert!(hits.iter().any(|(h, _)| matches!(h, Hit::Divider(Divider::Stack(10)))));
+    assert_eq!(hits.iter().filter(|(h, _)| matches!(h, Hit::Resize(..))).count(), 8);
+    for (hit, rect) in hits.iter().filter(|(h, _)| !matches!(h, Hit::Overflow(_) | Hit::Collapse(_) | Hit::StackToggle(_) | Hit::Close(_))) {
+        let mut d = DockDriver::new(layout.clone(), Content);
+        let from = rect.center();
+        let moved = d.hold(from, from + vec2(-30.0, 40.0));
+        let dragging = is_dragging::<u32>(&d.ctx, d.id);
+        let released = d.release(from + vec2(-30.0, 40.0));
+        assert!(dragging || !moved.actions.is_empty() || !released.actions.is_empty(), "{hit:?} at {rect:?} does nothing");
+    }
+    for (hit, rect) in hits.iter().filter(|(h, _)| matches!(h, Hit::Overflow(_) | Hit::Collapse(_) | Hit::StackToggle(_) | Hit::Close(_))) {
+        let mut d = DockDriver::new(layout.clone(), Content);
+        let out = d.click(rect.center());
+        let opened = egui::Popup::is_any_open(&d.ctx);
+        assert!(opened || !out.actions.is_empty(), "{hit:?} at {rect:?} does nothing");
+    }
+}
+
+/// Paints panel 1's icon as a dot in code; panel 2 has neither a painted icon nor an image.
+struct Painted;
+
+impl DockContent<u32> for Painted {
+    fn body(&mut self, _: &mut egui::Ui, _: &u32) {}
+    fn logical_label(&self, panel: &u32) -> String {
+        format!("Panel {panel}")
+    }
+    fn paint_icon(&mut self, painter: &egui::Painter, rect: Rect, panel: &u32, color: egui::Color32) -> bool {
+        if *panel != 1 {
+            return false;
+        }
+        painter.circle_filled(rect.center(), 3.0, color);
+        true
+    }
+}
+
+#[test]
+fn an_icon_painted_in_code_replaces_the_initial_and_others_fall_back() {
+    let d = DockDriver::new(docked(&[&[1, 2]], true), Painted);
+    let (one, two) = (d.hit(&Hit::Icon(1)).unwrap(), d.hit(&Hit::Icon(2)).unwrap());
+    let dots: Vec<Pos2> = d
+        .shapes()
+        .iter()
+        .filter_map(|clipped| match &clipped.shape {
+            egui::Shape::Circle(circle) if circle.radius == 3.0 => Some(circle.center),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(dots.len(), 1, "{dots:?}");
+    assert!(one.contains(dots[0]) && !two.contains(dots[0]), "the dot sits in panel 1's cell: {dots:?}");
+    let initials: Vec<Pos2> = d
+        .shapes()
+        .iter()
+        .filter_map(|clipped| match &clipped.shape {
+            egui::Shape::Text(text) if text.galley.text() == "P" => Some(text.pos),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(initials.len(), 1, "only panel 2 draws its initial: {initials:?}");
+    assert!(two.contains(initials[0]));
+}
+
+#[test]
+fn chrome_has_focus_covers_every_drawn_control() {
+    let mut layout = docked(&[&[1, 2], &[3]], true);
+    layout.floating.push(Floating::single(vec![5, 6], 0, [400.0, 100.0, 240.0, 200.0]));
+    let mut d = Driver::new(layout, Content);
+    d.settle();
+    let hits = d.hits();
+    assert!(hits.iter().any(|(h, _)| matches!(h, Hit::Icon(_))), "{hits:?}");
+    assert!(hits.iter().any(|(h, _)| matches!(h, Hit::IconGrip(_))), "{hits:?}");
+    assert!(hits.iter().any(|(h, _)| matches!(h, Hit::Resize(_, ResizeEdge::Left))), "{hits:?}");
+    for (hit, _) in hits {
+        d.ctx.memory_mut(|m| m.request_focus(DockArea::<u32>::hit_id(d.id, &hit)));
+        assert!(DockArea::<u32>::new(d.id).chrome_has_focus(&d.ctx, &d.layout), "{hit:?}");
+    }
+}
+
+#[test]
+fn floating_windows_stay_inside_the_float_bounds() {
+    // The app's title bar strip (top 30 pt) is outside the bounds: a window saved there is
+    // drawn below it, and a title bar drag towards it stops at its edge. Command keeps the
+    // drag from docking.
+    let mut layout = docked(&[&[1]], false);
+    layout.floating.push(Floating::single(vec![5], 0, [400.0, 0.0, 240.0, 200.0]));
+    let mut d = DockDriver::new(layout, Content);
+    d.float_bounds = Some(Rect::from_min_max(pos2(0.0, 30.0), pos2(800.0, 600.0)));
+    d.settle();
+    let title = hit(&d, Hit::Title(5));
+    assert!(title.top() >= 30.0, "{title:?}");
+    d.modifiers = egui::Modifiers::COMMAND;
+    d.drag(title.center(), pos2(title.center().x, 2.0));
+    d.modifiers = egui::Modifiers::NONE;
+    d.settle();
+    let title = hit(&d, Hit::Title(5));
+    assert!(title.top() >= 30.0, "{title:?}");
+}
diff --git a/crates/ui/src/docking/ime_tests.rs b/crates/ui/src/docking/ime_tests.rs
new file mode 100644
index 00000000..d16c653d
--- /dev/null
+++ b/crates/ui/src/docking/ime_tests.rs
@@ -0,0 +1,113 @@
+//! IME descriptors of editors in native floating windows (feature `native-windows`).
+
+use egui::{Event, Id, ImeEvent, Rect, ViewportId, output::IMEOutput, pos2, vec2};
+
+use super::testing::DockDriver;
+use super::{DockContent, Floating, Layout, Node};
+use crate::ime::{Composer, Edit};
+use crate::layout::{SplitAxis, SplitSize};
+
+/// Desktop position of the main window's content.
+const ORIGIN: egui::Pos2 = pos2(100.0, 50.0);
+
+struct Content {
+    /// The panel whose canvas takes text through `composer`.
+    editor: u32,
+    composer: Composer,
+    typed: String,
+    /// A panel whose body clears the pass's IME descriptor, as an app's own editor that
+    /// publishes after each body does when it has nothing to show.
+    clears: Option<u32>,
+    /// The bodies drawn in the last frame, with the viewport each was drawn in.
+    drawn: Vec<(u32, ViewportId)>,
+}
+
+impl Content {
+    fn new(editor: u32) -> Self {
+        Self { editor, composer: Composer::new().with_owner(Id::unique("editor")), typed: String::new(), clears: None, drawn: Vec::new() }
+    }
+}
+
+impl DockContent<u32> for Content {
+    fn body(&mut self, ui: &mut egui::Ui, panel: &u32) {
+        self.drawn.push((*panel, ui.ctx().viewport_id()));
+        if *panel == self.editor {
+            for edit in self.composer.update(ui.ctx(), true) {
+                if let Edit::Insert(text) = edit {
+                    self.typed.push_str(&text);
+                }
+            }
+            self.composer.set_caret(ui.ctx(), Rect::from_min_size(ui.max_rect().min + vec2(8.0, 8.0), vec2(1.0, 16.0)));
+        }
+        if self.clears == Some(*panel) {
+            ui.ctx().output_mut(|o| o.ime = None);
+        }
+    }
+}
+
+fn tabs(panels: &[u32]) -> Node<u32> {
+    Node::Tabs { panels: panels.to_vec(), active: 0 }
+}
+
+/// Frame `[1, 2]`, and a native window with panel 5 above panel 6.
+fn layout() -> Layout<u32> {
+    let split = Node::Split { axis: SplitAxis::Vertical, size: SplitSize::Ratio(0.5), first: Box::new(tabs(&[5])), second: Box::new(tabs(&[6])) };
+    Layout { root: Some(tabs(&[1, 2])), floating: vec![Floating::new(split, [300.0, 80.0, 240.0, 300.0])] }
+}
+
+fn driver(content: Content) -> DockDriver<u32, Content> {
+    DockDriver::new(layout(), content).with_native_host(ORIGIN)
+}
+
+fn preedit(text: &str) -> Event {
+    Event::Ime(ImeEvent::Preedit { text: text.into(), active_range_chars: None })
+}
+
+/// The window's id and the descriptor its OS window published last.
+fn window_ime(d: &DockDriver<u32, Content>) -> (u64, Option<IMEOutput>) {
+    let id = d.layout.floating[0].id;
+    let viewport = d.viewport(id);
+    (id, d.host().windows.get(&viewport).and_then(|w| w.ime.clone()))
+}
+
+#[test]
+#[allow(clippy::expect_used)]
+fn a_composition_in_a_native_window_publishes_on_that_window() {
+    let mut d = driver(Content::new(5));
+    let (id, _) = window_ime(&d);
+    d.window_step(id, vec![preedit("に")]);
+    assert_eq!(d.content.composer.preedit().map(|p| p.text), Some("に"));
+    let (_, ime) = window_ime(&d);
+    let ime = ime.expect("the window publishes the editor's descriptor");
+    assert_eq!(ime.owner, Id::unique("editor"));
+    // At the caret, in the window's own coordinates.
+    let caret = ime.cursor_rect;
+    assert!(caret.min.x < 240.0 && caret.min.y < 300.0, "{caret:?}");
+    assert!(d.ime().is_none(), "the main window publishes nothing");
+
+    // Docked, the editor publishes on the main window.
+    let mut d = driver(Content::new(1));
+    d.step(vec![preedit("に")]);
+    assert_eq!(d.ime().map(|ime| ime.owner), Some(Id::unique("editor")));
+    assert!(window_ime(&d).1.is_none());
+}
+
+#[test]
+#[allow(clippy::expect_used)]
+fn a_body_after_the_editors_keeps_the_window_composing() {
+    let mut d = driver(Content { clears: Some(6), ..Content::new(5) });
+    let (id, _) = window_ime(&d);
+    d.content.drawn.clear();
+    d.window_step(id, vec![preedit("に")]);
+    let viewport = d.viewport(id);
+    assert!(d.content.drawn.ends_with(&[(5, viewport), (6, viewport)]), "{:?}", d.content.drawn);
+    let first = window_ime(&d).1.expect("the editor publishes");
+    for _ in 0..2 {
+        d.window_step(id, Vec::new());
+        let ime = window_ime(&d).1.expect("the window keeps publishing");
+        assert_eq!((ime.owner, ime.context_generation), (first.owner, first.context_generation), "the same IME context");
+        assert!(!ime.should_interrupt_composition);
+    }
+    d.window_step(id, vec![Event::Ime(ImeEvent::Commit("日".into()))]);
+    assert_eq!(d.content.typed, "日");
+}
diff --git a/crates/ui/src/docking/labels.rs b/crates/ui/src/docking/labels.rs
new file mode 100644
index 00000000..3ad3a9ff
--- /dev/null
+++ b/crates/ui/src/docking/labels.rs
@@ -0,0 +1,84 @@
+//! One keyed hook for every label in [`DockStyle`].
+
+use super::DockStyle;
+
+impl DockStyle {
+    /// Replace every `*_label` field with `translate(key)`, keeping the English default where it
+    /// returns `None`. The defaults of menu items are in title case; those of controls, which
+    /// only screen readers announce, in sentence case. An application translates the docking
+    /// chrome in one place:
+    ///
+    /// ```
+    /// fn dock_style(ui: &egui::Ui) -> craft_ui::docking::DockStyle {
+    ///     craft_ui::docking::DockStyle::from_ui(ui).localized(|key| match key {
+    ///         "dock.close" => Some("Fermer le panneau".to_owned()),
+    ///         _ => None,
+    ///     })
+    /// }
+    /// ```
+    ///
+    /// | Key | Field | English default |
+    /// |---|---|---|
+    /// | `dock.float` | `float_label` | Float Panel |
+    /// | `dock.close` | `close_label` | Close Panel |
+    /// | `dock.movePanelTo` | `move_panel_to_label` | Move Panel to Group |
+    /// | `dock.panels` | `panels_label` | Panels |
+    /// | `dock.resize` | `resize_label` | Resize panels |
+    /// | `dock.resizeWindow` | `resize_window_label` | Resize panel window |
+    /// | `dock.moveGroup` | `move_group_label` | Move tab group |
+    /// | `dock.closeGroup` | `close_group_label` | Close Tab Group |
+    /// | `dock.minimize` | `minimize_label` | Minimize |
+    /// | `dock.expand` | `expand_label` | Expand |
+    /// | `dock.floatGroup` | `float_group_label` | Float Tab Group |
+    /// | `dock.moveGroupTo` | `move_group_to_label` | Move Group To |
+    /// | `dock.moveColumn` | `move_column_label` | Move panel column |
+    /// | `dock.collapseToIcons` | `collapse_to_icons_label` | Collapse to Icons |
+    /// | `dock.expandPanels` | `expand_panels_label` | Expand Panels |
+    /// | `dock.collapseColumn` | `collapse_column_label` | Collapse column to icons |
+    /// | `dock.expandColumn` | `expand_column_label` | Expand column |
+    /// | `dock.moveWindow` | `move_window_label` | Move panel window |
+    /// | `dock.closeWindow` | `close_window_label` | Close panel window |
+    /// | `dock.closeOthers` | `close_others_label` | Close Other Panels in Group |
+    /// | `dock.maximize` | `maximize_label` | Maximize Frame |
+    /// | `dock.restoreFrame` | `restore_frame_label` | Restore Frame Size |
+    /// | `dock.autoCollapse` | `auto_collapse_label` | Auto-Collapse Iconic Panels |
+    /// | `dock.floatHint` | `float_hint_label` | Hold {key} to undock |
+    #[must_use]
+    pub fn localized(mut self, translate: impl Fn(&str) -> Option<String>) -> Self {
+        for (key, label) in self.labels_mut() {
+            if let Some(text) = translate(key) {
+                *label = text;
+            }
+        }
+        self
+    }
+
+    fn labels_mut(&mut self) -> [(&'static str, &mut String); 24] {
+        [
+            ("dock.float", &mut self.float_label),
+            ("dock.close", &mut self.close_label),
+            ("dock.movePanelTo", &mut self.move_panel_to_label),
+            ("dock.panels", &mut self.panels_label),
+            ("dock.resize", &mut self.resize_label),
+            ("dock.resizeWindow", &mut self.resize_window_label),
+            ("dock.moveGroup", &mut self.move_group_label),
+            ("dock.closeGroup", &mut self.close_group_label),
+            ("dock.minimize", &mut self.minimize_label),
+            ("dock.expand", &mut self.expand_label),
+            ("dock.floatGroup", &mut self.float_group_label),
+            ("dock.moveGroupTo", &mut self.move_group_to_label),
+            ("dock.moveColumn", &mut self.move_column_label),
+            ("dock.collapseToIcons", &mut self.collapse_to_icons_label),
+            ("dock.expandPanels", &mut self.expand_panels_label),
+            ("dock.collapseColumn", &mut self.collapse_column_label),
+            ("dock.expandColumn", &mut self.expand_column_label),
+            ("dock.moveWindow", &mut self.move_window_label),
+            ("dock.closeWindow", &mut self.close_window_label),
+            ("dock.closeOthers", &mut self.close_others_label),
+            ("dock.maximize", &mut self.maximize_label),
+            ("dock.restoreFrame", &mut self.restore_frame_label),
+            ("dock.autoCollapse", &mut self.auto_collapse_label),
+            ("dock.floatHint", &mut self.float_hint_label),
+        ]
+    }
+}
diff --git a/crates/ui/src/docking/mod.rs b/crates/ui/src/docking/mod.rs
index a7bf3f98..b7985b82 100644
--- a/crates/ui/src/docking/mod.rs
+++ b/crates/ui/src/docking/mod.rs
@@ -5,13 +5,62 @@
 //! Validate deserialized layouts before rendering them. Every transaction checks its complete
 //! input and commits only a valid result; a rejected move cannot lose the source panel.
 
+pub mod chrome;
+#[cfg(feature = "serde")]
+mod command;
+#[cfg(feature = "native-windows")]
+mod desktop;
+mod dock_model;
+mod hits;
+mod labels;
 mod model;
+#[cfg(feature = "native-windows")]
+mod placement;
+mod render;
+mod resize;
 mod surface;
 mod targets;
+#[cfg(any(test, feature = "testing"))]
+pub mod testing;
+mod workspace;
 
-pub use model::{Action, DockError, Floating, Layout, Location, MAX_DEPTH, MAX_PANELS, Node, Permissions, Placement, StackEntry, Zone};
-pub use surface::{DockArea, DockContent, DockOutput, DockStyle, PanelLimits, begin_drag, cancel_drag};
-pub use targets::{DropProposal, DropTarget, drop_zone, resolve_drop, zone_rect};
+#[cfg(feature = "serde")]
+pub use command::{DockCommand, DockOperation, UiDock, ZoneName};
+pub use dock_model::{Column, ColumnLocation, Group, GroupLocation, PanelState, Side, Target};
+pub use hits::{Divider, Hit, ResizeEdge};
+pub use model::{Action, DockError, Floating, Layout, Location, MAX_DEPTH, MAX_PANELS, Monitor, Node, Permissions, Placement, StackEntry, Zone};
+pub use render::{close_flyout, flyout, open_flyout};
+pub use surface::{
+    DockArea, DockContent, DockEvent, DockHeights, DockOutput, DockStyle, DropFeedback, DropRequest, FloatSpace, HidePanels, PanelLimits,
+    WindowFiles, WindowKind, begin_drag, cancel_drag, float_space, is_dragging, route_app_drag, send_keys, typing_window,
+};
+pub use targets::{
+    DropProposal, DropTarget, SIDE_EDGE_ZONE_DEPTH, Sides, ZoneRule, body_zone, drop_zone, resolve_drop, resolve_drop_by, tab_insertion_marker,
+    zone_rect, zone_shape,
+};
+pub use workspace::Workspace;
+
+use surface::{Drag, GroupDrag, GroupGesture};
 
+#[cfg(test)]
+mod command_tests;
+#[cfg(test)]
+mod dock_tests;
+#[cfg(test)]
+mod drop_tests;
+#[cfg(test)]
+mod floating_tests;
+#[cfg(test)]
+mod group_tests;
+#[cfg(test)]
+mod iconic_tests;
+#[cfg(all(test, feature = "native-windows"))]
+mod ime_tests;
+#[cfg(test)]
+mod model_tests;
+#[cfg(all(test, feature = "native-windows"))]
+mod native_tests;
+#[cfg(test)]
+mod split_tests;
 #[cfg(test)]
 mod tests;
diff --git a/crates/ui/src/docking/model.rs b/crates/ui/src/docking/model.rs
index 36c3bdbc..0c90c140 100644
--- a/crates/ui/src/docking/model.rs
+++ b/crates/ui/src/docking/model.rs
@@ -1,11 +1,15 @@
 use std::{collections::HashSet, fmt, hash::Hash};
 
+use super::dock_model::{
+    Column, ColumnLocation, Group, GroupLocation, Moving, PanelState, Place, Side, Target, Unit, node_at, split_frame, split_frame_sized,
+    tree_panels, valid_column,
+};
 use crate::layout::{SplitAxis, SplitSize};
 
 /// Limits are checked before cloning or recursively modifying an application layout.
 pub const MAX_DEPTH: usize = 64;
 pub const MAX_PANELS: usize = 4096;
-const MAX_NODES: usize = MAX_PANELS * 2;
+pub(super) const MAX_NODES: usize = MAX_PANELS * 2;
 const MAX_EXTENT: f32 = 1_000_000.0;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -20,6 +24,7 @@ pub enum Zone {
 
 #[derive(Clone, Debug, PartialEq)]
 #[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[non_exhaustive]
 pub enum Node<P> {
     Split {
         axis: SplitAxis,
@@ -35,6 +40,13 @@ pub enum Node<P> {
     Stack {
         entries: Vec<StackEntry<P>>,
     },
+    /// One window edge's dock, columns from the window edge inwards. A dock is the root or,
+    /// following only same-side children of horizontal splits, at its window edge. At most one
+    /// per side. An empty dock (no columns) is valid and accepts [`Target::NewDock`].
+    Dock {
+        side: Side,
+        columns: Vec<Column<P>>,
+    },
 }
 
 #[derive(Clone, Debug, PartialEq)]
@@ -45,19 +57,238 @@ pub struct StackEntry<P> {
     pub height: Option<f32>,
 }
 
-#[derive(Clone, Debug, PartialEq)]
-#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+/// A floating window: a tree of groups like the docked layout's, without docks.
+///
+/// Serde reads the v1 shape `{panels, active, rect}` as one group, and a stack of groups
+/// `{groups, rect}` as a vertical split of them, sized by their heights. A window with one
+/// group (not minimized, no native rect) writes the v1 shape, so older builds can read files
+/// that use no newer feature. Every window writes its `id`; a window read without one gets a
+/// fresh one.
+///
+/// Equality ignores `id`: two windows with the same contents and place are the same layout.
+#[derive(Clone, Debug)]
 pub struct Floating<P> {
-    pub panels: Vec<P>,
-    pub active: usize,
+    /// Names the window across panel moves, and its OS window with feature `native-windows`.
+    /// Unique within a layout: [`Self::new`] draws a fresh id, [`Self::with_id`] sets one,
+    /// loading keeps the saved id (or draws one when it is missing or taken), and merging
+    /// windows keeps the receiving window's.
+    pub id: u64,
+    /// `Split`, `Tabs` and `Stack` nodes; a `Dock` is invalid here.
+    pub root: Node<P>,
     /// `[x, y, width, height]` in logical points, in the application's egui viewport.
     pub rect: [f32; 4],
+    /// Desktop rect while the window is in its own OS window.
+    pub native: Option<[f32; 4]>,
+    /// The monitor holding the center of `native`, from [`super::DockArea::monitors`].
+    pub monitor: Option<Monitor>,
+    /// Without a monitor list: the size of the monitor egui reported for the native window.
+    pub monitor_size: Option<[f32; 2]>,
+    /// Only the title bar shows.
+    pub minimized: bool,
+}
+
+impl<P: PartialEq> PartialEq for Floating<P> {
+    fn eq(&self, other: &Self) -> bool {
+        self.root == other.root
+            && self.rect == other.rect
+            && self.native == other.native
+            && self.monitor == other.monitor
+            && self.monitor_size == other.monitor_size
+            && self.minimized == other.minimized
+    }
+}
+
+/// A display, in desktop logical points. Applications on an egui with monitor reports fill
+/// [`super::DockArea::monitors`] with these; native floating windows store the one they are on.
+#[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct Monitor {
+    pub name: Option<String>,
+    /// `[x, y, width, height]` on the desktop.
+    pub rect: [f32; 4],
+    /// Physical pixels per logical point.
+    pub scale: f32,
+}
+
+/// A window id no other window of this process has drawn, from a random start so ids saved
+/// by earlier runs are unlikely to repeat.
+pub(super) fn fresh_window_id() -> u64 {
+    use std::hash::{BuildHasher, Hasher};
+    use std::sync::{
+        OnceLock,
+        atomic::{AtomicU64, Ordering},
+    };
+    static NEXT: OnceLock<AtomicU64> = OnceLock::new();
+    let next = NEXT.get_or_init(|| AtomicU64::new(std::collections::hash_map::RandomState::new().build_hasher().finish() >> 1));
+    next.fetch_add(1, Ordering::Relaxed)
+}
+
+impl<P> Floating<P> {
+    /// A window holding `root`. Each call makes a new window, with a fresh [`Self::id`]: build
+    /// a layout once and keep it, or give its windows ids with [`Self::with_id`]. A layout
+    /// built anew each frame without them opens new OS windows each frame.
+    pub fn new(root: Node<P>, rect: [f32; 4]) -> Self {
+        Self { id: fresh_window_id(), root, rect, native: None, monitor: None, monitor_size: None, minimized: false }
+    }
+
+    /// A window with one group. Each call makes a new window, as [`Self::new`] does.
+    pub fn single(panels: Vec<P>, active: usize, rect: [f32; 4]) -> Self {
+        Self::new(Node::Tabs { panels, active }, rect)
+    }
+
+    /// The window with `id`, for a layout the app builds in code, such as a default layout:
+    /// built with the same id, it is the same window, and the same OS window, on every frame.
+    /// Ids must be unique within a layout.
+    pub fn with_id(mut self, id: u64) -> Self {
+        self.id = id;
+        self
+    }
+
+    pub fn panels(&self) -> impl Iterator<Item = &P> {
+        tree_panels(&self.root).into_iter()
+    }
+
+    /// Groups stacked top to bottom, as a v1 layout stored them: each group over a vertical
+    /// split of the ones below it, sized by their heights. `None` without groups. Each call
+    /// makes a new window, as [`Self::new`] does.
+    pub fn stack(groups: Vec<Group<P>>, rect: [f32; 4]) -> Option<Self> {
+        super::dock_model::stack_tree(groups).map(|root| Self::new(root, rect))
+    }
+
+    /// The window's groups, first to last.
+    #[cfg(test)]
+    pub(crate) fn groups(&self) -> Vec<Group<P>>
+    where
+        P: Clone,
+    {
+        super::dock_model::tree_groups(&self.root)
+    }
+
+    /// True when a group of this window holds `panel`. Takes any borrowed form of `P`, such
+    /// as `&str` for `String` panels.
+    pub fn contains<Q: ?Sized + PartialEq>(&self, panel: &Q) -> bool
+    where
+        P: std::borrow::Borrow<Q>,
+    {
+        self.panels().any(|p| p.borrow() == panel)
+    }
+}
+
+#[cfg(feature = "serde")]
+mod floating_serde {
+    use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+    use super::{Floating, Group, Monitor, Node, fresh_window_id};
+    use crate::docking::dock_model::stack_tree;
+
+    #[derive(Serialize)]
+    struct V1<'a, P> {
+        id: u64,
+        panels: &'a [P],
+        active: usize,
+        rect: [f32; 4],
+    }
+
+    #[derive(Serialize)]
+    struct Tree<'a, P> {
+        id: u64,
+        root: &'a Node<P>,
+        rect: [f32; 4],
+        #[serde(skip_serializing_if = "Option::is_none")]
+        native: Option<[f32; 4]>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        monitor: Option<&'a Monitor>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        monitor_size: Option<[f32; 2]>,
+        #[serde(skip_serializing_if = "std::ops::Not::not")]
+        minimized: bool,
+    }
+
+    impl<P: Serialize> Serialize for Floating<P> {
+        fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+            match &self.root {
+                Node::Tabs { panels, active } if !self.minimized && self.native.is_none() => {
+                    V1 { id: self.id, panels, active: *active, rect: self.rect }.serialize(serializer)
+                }
+                root => Tree {
+                    id: self.id,
+                    root,
+                    rect: self.rect,
+                    native: self.native,
+                    monitor: self.monitor.as_ref(),
+                    monitor_size: self.monitor_size,
+                    minimized: self.minimized,
+                }
+                .serialize(serializer),
+            }
+        }
+    }
+
+    #[derive(Deserialize)]
+    #[serde(bound(deserialize = "P: Deserialize<'de>"))]
+    struct Repr<P> {
+        #[serde(default)]
+        id: Option<u64>,
+        root: Option<Node<P>>,
+        groups: Option<Vec<Group<P>>>,
+        panels: Option<Vec<P>>,
+        #[serde(default)]
+        active: usize,
+        rect: [f32; 4],
+        #[serde(default)]
+        native: Option<[f32; 4]>,
+        #[serde(default)]
+        monitor: Option<Monitor>,
+        #[serde(default)]
+        monitor_size: Option<[f32; 2]>,
+        #[serde(default)]
+        minimized: bool,
+    }
+
+    /// Floating windows with a fresh id for each one whose id an earlier window took.
+    pub(super) fn unique_ids<'de, D: Deserializer<'de>, P: Deserialize<'de>>(deserializer: D) -> Result<Vec<Floating<P>>, D::Error> {
+        let mut windows = Vec::<Floating<P>>::deserialize(deserializer)?;
+        let mut seen = std::collections::HashSet::new();
+        for window in &mut windows {
+            while !seen.insert(window.id) {
+                window.id = fresh_window_id();
+            }
+        }
+        Ok(windows)
+    }
+
+    impl<'de, P: Deserialize<'de>> Deserialize<'de> for Floating<P> {
+        fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+            let repr = Repr::<P>::deserialize(deserializer)?;
+            let mut minimized = repr.minimized;
+            let root = match (repr.root, repr.groups, repr.panels) {
+                (Some(root), None, None) => root,
+                (None, Some(groups), None) => {
+                    minimized |= !groups.is_empty() && groups.iter().all(|g| g.minimized);
+                    stack_tree(groups).ok_or_else(|| serde::de::Error::invalid_length(0, &"at least one group"))?
+                }
+                (None, None, Some(panels)) => Node::Tabs { panels, active: repr.active },
+                (None, None, None) => return Err(serde::de::Error::missing_field("root")),
+                _ => return Err(serde::de::Error::duplicate_field("root")),
+            };
+            Ok(Floating {
+                id: repr.id.unwrap_or_else(fresh_window_id),
+                root,
+                rect: repr.rect,
+                native: repr.native,
+                monitor: repr.monitor,
+                monitor_size: repr.monitor_size,
+                minimized,
+            })
+        }
+    }
 }
 
 #[derive(Clone, Debug, PartialEq)]
 #[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
 pub struct Layout<P> {
     pub root: Option<Node<P>>,
+    #[cfg_attr(feature = "serde", serde(deserialize_with = "floating_serde::unique_ids"))]
     pub floating: Vec<Floating<P>>,
 }
 
@@ -67,13 +298,42 @@ impl<P> Default for Layout<P> {
     }
 }
 
-#[derive(Clone, Debug, PartialEq, Eq)]
+#[derive(Clone, Debug, PartialEq)]
 #[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[non_exhaustive]
 pub enum Placement<P> {
     /// Insert before this existing destination member, or append. Also reorders a group.
     Tab { before: Option<P> },
-    /// Center inserts after the anchor; sides create a new half-size split.
+    /// Center inserts after the anchor; sides split the anchor's frame into two halves, and
+    /// every other frame keeps its size. Sides apply to `Tabs` and `Stack` nodes only.
     Split(Zone),
+    /// A side [`Placement::Split`] that gives the new frame its own room instead of half the
+    /// anchor's frame: the new split takes `size`, and `outer` replaces the size of the nearest
+    /// enclosing split whose divider runs along the anchor frame's `zone` side, so the frames
+    /// beyond that divider give the room. An anchor at the edge of its area on that side takes
+    /// the nearest such split along its opposite side instead. The renderer offers it beside a
+    /// frame too small to halve. `Center`, and an anchor without either divider or with a dock
+    /// beyond it, are invalid.
+    SplitSized { zone: Zone, size: SplitSize, outer: SplitSize },
+    /// A new group above or below the anchor's group in a dock column. On an anchor in a
+    /// floating window, a split of the anchor's group above or below.
+    /// `height` is the inserted group's preferred height ([`super::Group::height`]); `None`
+    /// keeps a moved group's own height, or shares the free height for a new group.
+    Group {
+        below: bool,
+        #[cfg_attr(feature = "serde", serde(default, skip_serializing_if = "Option::is_none"))]
+        height: Option<f32>,
+    },
+    /// A new column before (towards the window edge) or after the anchor's column.
+    Column { after: bool },
+    /// A new frame along one edge of the docked layout, a quarter of its width or height: the
+    /// root is split, or in a layout with docks, the part between them. The anchor names any
+    /// docked panel. A protected anchor ([`Permissions::is_protected`], applied through
+    /// [`Layout::apply_with_permissions`]) narrows the part to the canvas column: where neither
+    /// side of a side-by-side split is a dock and only one holds a protected panel, that side;
+    /// for `Top` (`Bottom`), also the first (last) row of a split of rows when only that row
+    /// holds one. `Center` is invalid.
+    Edge(Zone),
 }
 
 /// A closed panel's former placement. Applications may retain this beside visibility flags.
@@ -92,10 +352,16 @@ pub struct Location<P> {
     /// rather than accidentally inserting beside only its first leaf when restoring.
     #[cfg_attr(feature = "serde", serde(default))]
     pub sibling: Vec<P>,
+    /// Group and column state when the panel was in a dock. Applies when
+    /// restoring creates a new group, column or dock for the panel.
+    #[cfg_attr(feature = "serde", serde(default))]
+    pub group: Option<GroupLocation>,
 }
 
+/// Groups, columns and floating windows are named by a panel they contain.
 #[derive(Clone, Debug, PartialEq)]
 #[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[non_exhaustive]
 pub enum Action<P> {
     Move {
         panel: P,
@@ -113,6 +379,11 @@ pub enum Action<P> {
         panel: P,
     },
     /// Reveal a registered, currently absent panel. Applications validate their panel registry.
+    /// `anchor` names the group it joins as the last tab. Without one it becomes the root of an
+    /// empty layout, else joins the first dock group that accepts tabs and is shown (not
+    /// minimized, not in an iconic column; the end-side dock's first), else gets a new frame a
+    /// quarter wide at the right edge of the docked area
+    /// ([`Placement::Edge`]).
     Open {
         panel: P,
         anchor: Option<P>,
@@ -123,7 +394,7 @@ pub enum Action<P> {
         anchor: P,
         placement: Placement<P>,
     },
-    /// Reposition/resize a floating group, identified by one of its panels.
+    /// Reposition/resize a floating window, identified by one of its panels.
     MoveFloating {
         panel: P,
         rect: [f32; 4],
@@ -133,6 +404,13 @@ pub enum Action<P> {
         path: Vec<bool>,
         size: SplitSize,
     },
+    /// [`Action::ResizeSplit`] in the floating window holding `panel`, with a path from its
+    /// root.
+    ResizeWindowSplit {
+        panel: P,
+        path: Vec<bool>,
+        size: SplitSize,
+    },
     SetStackOpen {
         panel: P,
         open: bool,
@@ -141,28 +419,122 @@ pub enum Action<P> {
         panel: P,
         height: Option<f32>,
     },
+    /// Move the group containing `panel` with its order, active tab and minimized state.
+    /// `Target::At` with `Tab` or `Split(Center)` merges every member. An accordion entry is a
+    /// group of one. A target inside the group is a no-op.
+    MoveGroup {
+        panel: P,
+        to: Target<P>,
+    },
+    /// Move the dock column containing `panel`. `Float` makes a window of its groups.
+    MoveColumn {
+        panel: P,
+        to: Target<P>,
+    },
+    /// Dock or merge the floating window containing `panel`, every group included.
+    MoveWindow {
+        panel: P,
+        to: Target<P>,
+    },
+    /// Close Tab Group.
+    CloseGroup {
+        panel: P,
+    },
+    /// × on a floating window: closes all its panels.
+    CloseWindow {
+        panel: P,
+    },
+    /// Close Other Panels in Group.
+    CloseOthers {
+        panel: P,
+    },
+    /// Minimize a dock group to its tab strip, or the floating window holding the panel to its
+    /// title bar (and the strip of its only group). On an accordion entry, closes it.
+    SetMinimized {
+        panel: P,
+        minimized: bool,
+    },
+    SetIconic {
+        panel: P,
+        iconic: bool,
+    },
+    ResizeColumn {
+        panel: P,
+        width: f32,
+    },
+    /// Preferred height of a dock group or of an accordion entry.
+    ResizeGroup {
+        panel: P,
+        height: Option<f32>,
+    },
+    ResizeIconic {
+        panel: P,
+        width: Option<f32>,
+    },
+    /// Put the floating window in its own OS window at `rect`, or back in the app window.
+    SetNative {
+        panel: P,
+        rect: Option<[f32; 4]>,
+    },
+    /// Record the monitor of the native window holding `panel`: from the application's
+    /// monitor list, or else only the size egui reported.
+    SetMonitor {
+        panel: P,
+        monitor: Option<Monitor>,
+        monitor_size: Option<[f32; 2]>,
+    },
+    /// Move one panel, without the rest of its group. `Target::At` is [`Action::Move`];
+    /// `NewDock` and `Float` give the panel a group of its own.
+    MovePanel {
+        panel: P,
+        to: Target<P>,
+    },
 }
 
-/// Rendering and command adapters can protect a document canvas while leaving panels movable.
+/// What may happen to a panel. [`Layout::apply_with_permissions`] enforces these for every
+/// action, whoever issues it. They also decide which gestures and menu items the renderer
+/// offers; [`super::DockStyle::close_menu_items`] and [`super::DockStyle::close_button`] hide
+/// the built-in close controls of a panel that stays closable by command.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct Permissions {
     pub movable: bool,
     pub floatable: bool,
     pub closable: bool,
+    /// Other panels may join this panel's group as tabs.
     pub accepts_tabs: bool,
+    /// Other panels may split this panel's frame (`Placement::Split` with a side zone).
+    /// Outer-edge frames ([`Placement::Edge`]) are not splits of the anchor.
+    pub accepts_splits: bool,
 }
 
 impl Default for Permissions {
     fn default() -> Self {
-        Self { movable: true, floatable: true, closable: true, accepts_tabs: true }
+        Self { movable: true, floatable: true, closable: true, accepts_tabs: true, accepts_splits: true }
     }
 }
 
 impl Permissions {
-    pub const PROTECTED: Self = Self { movable: false, floatable: false, closable: false, accepts_tabs: false };
+    /// A document canvas: it stays docked and open, and takes neither tabs nor side splits.
+    /// A group dropped on it floats there. An application that opens panels beside its canvas
+    /// uses `Permissions { accepts_splits: true, ..Permissions::PROTECTED }`.
+    pub const PROTECTED: Self = Self { movable: false, floatable: false, closable: false, accepts_tabs: false, accepts_splits: false };
+
+    /// A canvas: it can neither move, close nor take tabs. `accepts_splits` and `floatable`
+    /// do not matter, so a canvas that opens panels beside it still counts.
+    pub fn is_protected(self) -> bool {
+        !self.movable && !self.closable && !self.accepts_tabs
+    }
+
+    /// Lock Workspace: nothing moves, floats or closes; tab and split drops keep their policy.
+    /// [`super::Workspace::apply`] applies this when the workspace is locked; an application
+    /// with a global lock preference applies it in its own permissions callback.
+    pub fn locked(self) -> Self {
+        Self { movable: false, floatable: false, closable: false, ..self }
+    }
 }
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
 pub enum DockError {
     LimitExceeded,
     DuplicatePanel,
@@ -172,6 +544,8 @@ pub enum DockError {
     InvalidGeometry,
     InvalidPlacement,
     NotAllowed,
+    /// Saved by a newer version of the docking format.
+    UnsupportedVersion,
 }
 
 impl fmt::Display for DockError {
@@ -185,6 +559,7 @@ impl fmt::Display for DockError {
             Self::InvalidGeometry => "docking geometry is not finite and bounded",
             Self::InvalidPlacement => "docking destination does not support this placement",
             Self::NotAllowed => "this panel does not allow the requested docking operation",
+            Self::UnsupportedVersion => "docking data was saved by a newer version",
         })
     }
 }
@@ -195,6 +570,16 @@ pub(super) fn valid_rect(rect: [f32; 4]) -> bool {
     rect.iter().all(|v| v.is_finite() && v.abs() <= MAX_EXTENT) && rect.get(2).is_some_and(|v| *v > 0.0) && rect.get(3).is_some_and(|v| *v > 0.0)
 }
 
+/// A floating window's saved monitor and monitor size, each where given.
+fn valid_monitor(monitor: Option<&Monitor>, monitor_size: Option<[f32; 2]>) -> bool {
+    monitor.is_none_or(|m| valid_rect(m.rect) && m.scale.is_finite() && m.scale > 0.0)
+        && monitor_size.is_none_or(|[w, h]| valid_rect([0.0, 0.0, w, h]))
+}
+
+pub(super) fn valid_width(width: f32) -> bool {
+    width.is_finite() && width > 0.0 && width <= MAX_EXTENT
+}
+
 fn valid_size(size: SplitSize) -> bool {
     match size {
         SplitSize::Ratio(r) => r.is_finite() && (0.0..=1.0).contains(&r),
@@ -202,7 +587,7 @@ fn valid_size(size: SplitSize) -> bool {
     }
 }
 
-fn valid_height(height: Option<f32>) -> bool {
+pub(super) fn valid_height(height: Option<f32>) -> bool {
     height.is_none_or(|v| v.is_finite() && (0.0..=MAX_EXTENT).contains(&v))
 }
 
@@ -211,7 +596,8 @@ fn valid_active(len: usize, active: usize) -> bool {
 }
 
 impl<P: Clone + Eq + Hash> Layout<P> {
-    /// Check depth, allocation bounds, geometry, selection and globally unique panel ownership.
+    /// Check depth, allocation bounds, geometry, selection, globally unique panel ownership and
+    /// that no frame, group, column or window is empty.
     /// Traversal is iterative, including for an invalid, excessively deep supplied tree.
     pub fn validate(&self) -> Result<(), DockError> {
         if self.floating.len() > MAX_PANELS {
@@ -219,41 +605,76 @@ impl<P: Clone + Eq + Hash> Layout<P> {
         }
         let mut seen = HashSet::new();
         let mut count = 0usize;
-        let mut visit = self.root.as_ref().map(|n| vec![(n, 1usize)]).unwrap_or_default();
-        while let Some((node, depth)) = visit.pop() {
+        let mut docks = (false, false);
+        // Each node carries whether it touches the window's start and end edges.
+        let mut visit = self.root.as_ref().map(|n| vec![(n, 1usize, true, true)]).unwrap_or_default();
+        while let Some((node, depth, start, end)) = visit.pop() {
             count = count.saturating_add(1);
             if depth > MAX_DEPTH || count > MAX_NODES {
                 return Err(DockError::LimitExceeded);
             }
             match node {
-                Node::Split { size, first, second, .. } => {
+                Node::Split { axis, size, first, second } => {
                     if !valid_size(*size) {
                         return Err(DockError::InvalidGeometry);
                     }
-                    visit.push((second, depth + 1));
-                    visit.push((first, depth + 1));
+                    let horizontal = *axis == SplitAxis::Horizontal;
+                    visit.push((second, depth + 1, false, end && horizontal));
+                    visit.push((first, depth + 1, start && horizontal, false));
                 }
-                Node::Tabs { panels, active } => {
-                    check_tabs(panels, *active, &mut seen)?;
-                }
-                Node::Stack { entries } => {
-                    if entries.len() > MAX_PANELS {
+                Node::Dock { side, columns } => {
+                    let (at_edge, taken) = match side {
+                        Side::Start => (start, &mut docks.0),
+                        Side::End => (end, &mut docks.1),
+                    };
+                    if !at_edge || *taken {
+                        return Err(DockError::InvalidPlacement);
+                    }
+                    *taken = true;
+                    if columns.len() > MAX_PANELS {
                         return Err(DockError::LimitExceeded);
                     }
-                    for entry in entries {
-                        if !valid_height(entry.height) {
+                    for column in columns {
+                        if !valid_column(column) || column.groups.is_empty() {
                             return Err(DockError::InvalidGeometry);
                         }
-                        check_panel(&entry.panel, &mut seen)?;
+                        count = count.saturating_add(column.groups.len().saturating_add(1));
+                        if count > MAX_NODES {
+                            return Err(DockError::LimitExceeded);
+                        }
+                        for group in &column.groups {
+                            check_group(group, &mut seen)?;
+                        }
                     }
                 }
+                Node::Tabs { .. } | Node::Stack { .. } => check_leaf(node, &mut seen)?,
             }
         }
         for floating in &self.floating {
-            if !valid_rect(floating.rect) || floating.panels.is_empty() {
+            if !valid_rect(floating.rect)
+                || floating.native.is_some_and(|r| !valid_rect(r))
+                || !valid_monitor(floating.monitor.as_ref(), floating.monitor_size)
+            {
                 return Err(DockError::InvalidGeometry);
             }
-            check_tabs(&floating.panels, floating.active, &mut seen)?;
+            let mut visit = vec![(&floating.root, 1usize)];
+            while let Some((node, depth)) = visit.pop() {
+                count = count.saturating_add(1);
+                if depth > MAX_DEPTH || count > MAX_NODES {
+                    return Err(DockError::LimitExceeded);
+                }
+                match node {
+                    Node::Split { size, first, second, .. } => {
+                        if !valid_size(*size) {
+                            return Err(DockError::InvalidGeometry);
+                        }
+                        visit.push((second, depth + 1));
+                        visit.push((first, depth + 1));
+                    }
+                    Node::Dock { .. } => return Err(DockError::InvalidPlacement),
+                    Node::Tabs { .. } | Node::Stack { .. } => check_leaf(node, &mut seen)?,
+                }
+            }
         }
         Ok(())
     }
@@ -275,10 +696,14 @@ impl<P: Clone + Eq + Hash> Layout<P> {
                 }
                 Node::Tabs { panels: group, .. } => panels.extend(group.iter().take(MAX_PANELS - panels.len())),
                 Node::Stack { entries } => panels.extend(entries.iter().map(|e| &e.panel).take(MAX_PANELS - panels.len())),
+                Node::Dock { columns, .. } => {
+                    let members = columns.iter().flat_map(|c| c.groups.iter()).flat_map(|g| g.panels.iter());
+                    panels.extend(members.take(MAX_PANELS - panels.len()));
+                }
             }
         }
-        for group in self.floating.iter().take(MAX_PANELS) {
-            panels.extend(group.panels.iter().take(MAX_PANELS - panels.len()));
+        for window in self.floating.iter().take(MAX_PANELS) {
+            panels.extend(window.panels().take(MAX_PANELS - panels.len()));
         }
         panels
     }
@@ -287,19 +712,94 @@ impl<P: Clone + Eq + Hash> Layout<P> {
         self.panels().contains(&panel)
     }
 
+    /// The panels `panel` can join as a tab: every panel in another group whose permissions
+    /// accept tabs. A "Move Panel to Group" menu with an empty answer has nothing to offer and
+    /// stays hidden.
+    pub fn move_targets(&self, panel: &P, permissions: impl Fn(&P) -> Permissions) -> Vec<&P> {
+        let own = self.place(panel);
+        self.panels()
+            .into_iter()
+            .filter(|target| *target != panel && permissions(target).accepts_tabs && (own.is_none() || self.place(target) != own))
+            .collect()
+    }
+
     /// Capture a panel's nearest surviving group/split neighbor before hiding it.
     pub fn location(&self, panel: &P) -> Result<Location<P>, DockError> {
         self.validate()?;
-        if let Some(group) = self.floating.iter().find(|g| g.panels.contains(panel)) {
-            let mut location = group_location(&group.panels, panel).ok_or(DockError::MissingPanel)?;
-            location.floating = Some(group.rect);
+        let place = self.place(panel).ok_or(DockError::MissingPanel)?;
+        let (groups, group, column) = match &place {
+            Place::Node(_) => return self.root.as_ref().and_then(|node| node_location(node, panel)).ok_or(DockError::MissingPanel),
+            Place::Floating { window, .. } => {
+                let window = self.floating.get(*window).ok_or(DockError::MissingPanel)?;
+                let mut location = node_location(&window.root, panel).ok_or(DockError::MissingPanel)?;
+                location.floating = Some(window.rect);
+                return Ok(location);
+            }
+            Place::Dock { path, group, .. } => {
+                let side = match self.root.as_ref().and_then(|root| node_at(root, path)) {
+                    Some(Node::Dock { side, .. }) => *side,
+                    _ => return Err(DockError::MissingPanel),
+                };
+                let column = self.column(&place).ok_or(DockError::MissingPanel)?;
+                let state = ColumnLocation { side, width: column.width, iconic: column.iconic, iconic_width: column.iconic_width };
+                (&column.groups, *group, Some(state))
+            }
+        };
+        let own = groups.get(group).ok_or(DockError::MissingPanel)?;
+        let mut location = group_location(&own.panels, panel).ok_or(DockError::MissingPanel)?;
+        location.group = Some(GroupLocation { minimized: own.minimized, height: own.height, column });
+        if location.anchor.is_some() {
             return Ok(location);
         }
-        self.root.as_ref().and_then(|node| node_location(node, panel)).ok_or(DockError::MissingPanel)
+        // Alone in its group: anchor to the neighboring group, then the neighboring column.
+        let first = |g: Option<&Group<P>>| g.and_then(|g| g.panels.first()).cloned();
+        if let Some(anchor) = first(groups.get(group + 1)) {
+            location.anchor = Some(anchor);
+            location.placement = Placement::Group { below: false, height: None };
+        } else if let Some(anchor) = first(group.checked_sub(1).and_then(|i| groups.get(i))) {
+            location.anchor = Some(anchor);
+            location.placement = Placement::Group { below: true, height: None };
+        } else if groups.len() == 1
+            && let Place::Dock { path, column, .. } = &place
+            && let Some(Node::Dock { columns, .. }) = self.root.as_ref().and_then(|root| node_at(root, path))
+        {
+            let first_of = |c: Option<&Column<P>>| first(c.and_then(|c| c.groups.first()));
+            if let Some(anchor) = first_of(columns.get(column + 1)) {
+                location.anchor = Some(anchor);
+                location.placement = Placement::Column { after: false };
+            } else if let Some(anchor) = first_of(column.checked_sub(1).and_then(|i| columns.get(i))) {
+                location.anchor = Some(anchor);
+                location.placement = Placement::Column { after: true };
+            }
+        }
+        Ok(location)
+    }
+
+    /// Hidden, open behind another tab or in a collapsed container, or showing.
+    pub fn panel_state(&self, panel: &P) -> PanelState {
+        let showing = match self.place(panel) {
+            None => return PanelState::Hidden,
+            Some(place @ (Place::Node(_) | Place::Floating { .. })) => {
+                let minimized = matches!(place, Place::Floating { window, .. } if self.floating.get(window).is_some_and(|w| w.minimized));
+                !minimized
+                    && match self.node_of(&place) {
+                        Some(Node::Tabs { panels, active }) => panels.get(*active) == Some(panel),
+                        Some(Node::Stack { entries }) => entries.iter().any(|e| &e.panel == panel && e.open),
+                        _ => false,
+                    }
+            }
+            Some(place) => {
+                let iconic = self.column(&place).is_some_and(|c| c.iconic);
+                self.group(&place).is_some_and(|g| !g.minimized && g.active_panel() == Some(panel)) && !iconic
+            }
+        };
+        if showing { PanelState::Front } else { PanelState::Open }
     }
 
     /// Restore an absent panel at a captured location. Missing anchors are reported without
-    /// changes, allowing the app to choose an explicit default. Unrelated tabs retain selection.
+    /// changes, allowing the app to choose an explicit default; a floating panel whose
+    /// window is gone floats at its last rect instead. A tab whose next tab is not in the
+    /// anchor's group goes last. Unrelated tabs retain selection.
     pub fn restore(&mut self, panel: P, location: &Location<P>) -> Result<(), DockError> {
         self.validate()?;
         if self.contains(&panel) {
@@ -308,23 +808,54 @@ impl<P: Clone + Eq + Hash> Layout<P> {
         if location.size.is_some_and(|s| !valid_size(s)) || location.stack.is_some_and(|(_, h)| !valid_height(h)) {
             return Err(DockError::InvalidGeometry);
         }
-        let mut proposed = self.clone();
-        if let Some(rect) = location.floating {
-            if !valid_rect(rect) {
-                return Err(DockError::InvalidGeometry);
+        let state = location.group.as_ref();
+        if state.is_some_and(|s| {
+            !valid_height(s.height) || s.column.is_some_and(|c| !valid_width(c.width) || c.iconic_width.is_some_and(|w| !valid_width(w)))
+        }) {
+            return Err(DockError::InvalidGeometry);
+        }
+        // A restore that creates a group, column or dock gives it the saved state.
+        let moving = || {
+            let group =
+                Group { panels: vec![panel.clone()], active: 0, minimized: state.is_some_and(|s| s.minimized), height: state.and_then(|s| s.height) };
+            let column = state.and_then(|s| s.column);
+            Moving {
+                width: column.map(|c| c.width),
+                iconic: column.is_some_and(|c| c.iconic),
+                iconic_width: column.and_then(|c| c.iconic_width),
+                ..Moving::group(group)
             }
-            if let Some(anchor) = &location.anchor {
-                if !proposed.floating.iter().any(|g| g.panels.contains(anchor)) {
-                    return Err(DockError::MissingTarget);
+        };
+        let mut proposed = self.clone();
+        if location.floating.is_some_and(|rect| !valid_rect(rect)) {
+            return Err(DockError::InvalidGeometry);
+        }
+        let window_open = location.anchor.as_ref().is_some_and(|anchor| proposed.floating.iter().any(|w| w.contains(anchor)));
+        if let Some(rect) = location.floating.filter(|_| !window_open) {
+            // A window that closed as a whole reopens at its last rect.
+            proposed.insert_moving(moving(), Target::Float { rect: Some(rect) }, &|_| false)?;
+        } else if let Some(anchor) = &location.anchor
+            && matches!(location.placement, Placement::Group { .. } | Placement::Column { .. })
+        {
+            if !proposed.contains(anchor) {
+                return Err(DockError::MissingTarget);
+            }
+            proposed.insert_moving(moving(), Target::At { anchor: anchor.clone(), placement: location.placement.clone() }, &|_| false)?;
+        } else if let Some(column) = state.and_then(|s| s.column).filter(|_| location.anchor.is_none()) {
+            // Alone in its dock: back at that edge, as the outermost column if a dock exists.
+            match proposed.dock_path(column.side) {
+                Some(path) => {
+                    let columns = proposed.columns_mut(&path).ok_or(DockError::MissingTarget)?;
+                    let Moving { groups, .. } = moving();
+                    columns.insert(0, Column { groups, width: column.width, iconic: column.iconic, iconic_width: column.iconic_width });
                 }
-                proposed.apply_inner(Action::OpenAt { panel: panel.clone(), anchor: anchor.clone(), placement: location.placement.clone() })?;
-            } else {
-                proposed.floating.push(Floating { panels: vec![panel.clone()], active: 0, rect });
+                None => proposed.insert_moving(moving(), Target::NewDock { side: column.side }, &|_| false)?,
             }
         } else if let Some(anchor) = &location.anchor {
             if !proposed.contains(anchor) {
                 return Err(DockError::MissingTarget);
             }
+            let mut around = false;
             if let Placement::Split(zone @ (Zone::Left | Zone::Right | Zone::Top | Zone::Bottom)) = location.placement
                 && !location.sibling.is_empty()
             {
@@ -335,19 +866,19 @@ impl<P: Clone + Eq + Hash> Layout<P> {
                 if members.len() != location.sibling.len() || !members.contains(anchor) {
                     return Err(DockError::InvalidPlacement);
                 }
-                let inserted = proposed
-                    .root
-                    .as_mut()
-                    .is_some_and(|root| restore_around_subtree(root, &panel, &members, zone, location.size.unwrap_or(SplitSize::Ratio(0.5))));
-                if !inserted {
-                    return Err(DockError::MissingTarget);
-                }
-            } else {
-                proposed.apply_inner(Action::OpenAt { panel: panel.clone(), anchor: anchor.clone(), placement: location.placement.clone() })?;
-                if let Some(size) = location.size
-                    && let Some(root) = proposed.root.as_mut()
-                {
-                    restore_parent_size(root, &panel, size);
+                let size = location.size.unwrap_or(SplitSize::Ratio(0.5));
+                around = proposed.trees_mut().any(|root| restore_around_subtree(root, &panel, &members, zone, size));
+            }
+            // A subtree that changed since (a migrated or reconciled layout) splits the anchor.
+            if !around {
+                // The tab that followed may have closed or moved since; the panel then goes last.
+                let placement = match &location.placement {
+                    Placement::Tab { before: Some(before) } if !proposed.same_group(before, anchor) => Placement::Tab { before: None },
+                    placement => placement.clone(),
+                };
+                proposed.apply_inner(Action::OpenAt { panel: panel.clone(), anchor: anchor.clone(), placement }, &|_| false)?;
+                if let Some(size) = location.size {
+                    proposed.trees_mut().any(|root| restore_parent_size(root, &panel, size));
                 }
             }
         } else if proposed.root.is_none() {
@@ -355,13 +886,13 @@ impl<P: Clone + Eq + Hash> Layout<P> {
         } else {
             return Err(DockError::MissingTarget);
         }
-        if let Some((open, height)) = location.stack
-            && let Some(root) = proposed.root.as_mut()
-        {
-            restore_stack_kind(root, &panel);
-            if let Some(entry) = stack_entry_mut(root, &panel) {
-                entry.open = open;
-                entry.height = height;
+        if let Some((open, height)) = location.stack {
+            for root in proposed.trees_mut() {
+                restore_stack_kind(root, &panel);
+                if let Some(entry) = stack_entry_mut(root, &panel) {
+                    entry.open = open;
+                    entry.height = height;
+                }
             }
         }
         proposed.validate()?;
@@ -369,44 +900,139 @@ impl<P: Clone + Eq + Hash> Layout<P> {
         Ok(())
     }
 
-    pub fn apply(&mut self, action: Action<P>) -> Result<(), DockError> {
+    /// Open an absent panel as a frame at the outer edge of the docked area, taking most of it:
+    /// the last resort for a panel that must stay shown, such as a protected canvas.
+    pub(super) fn open_at_edge(&mut self, panel: P) -> Result<(), DockError> {
+        let mut proposed = self.clone();
+        if self.root.is_none() {
+            proposed.root = Some(Node::Tabs { panels: vec![panel], active: 0 });
+        } else {
+            let anchor = self
+                .panels()
+                .into_iter()
+                .find(|p| matches!(self.place(p), Some(Place::Dock { .. } | Place::Node(_))))
+                .cloned()
+                .ok_or(DockError::MissingTarget)?;
+            proposed.apply_inner(Action::OpenAt { panel: panel.clone(), anchor, placement: Placement::Edge(Zone::Right) }, &|_| false)?;
+            if let Some(root) = proposed.root.as_mut() {
+                restore_parent_size(root, &panel, SplitSize::Ratio(0.25));
+            }
+        }
+        proposed.validate()?;
+        *self = proposed;
+        Ok(())
+    }
+
+    /// [`Self::apply_with_permissions`] with default permissions.
+    pub fn apply(&mut self, action: Action<P>) -> Result<Vec<P>, DockError> {
         self.apply_with_permissions(action, |_| Permissions::default())
     }
 
-    /// Check application policy before making an atomic change. The callback must be stable
-    /// throughout one call. Registry validation remains with the application, particularly Open.
-    pub fn apply_with_permissions(&mut self, action: Action<P>, permissions: impl Fn(&P) -> Permissions) -> Result<(), DockError> {
+    /// Check application policy before making an atomic change, and return the panels the
+    /// action closed (see [`Self::closed_by`]) so the application can release their state.
+    /// The callback must be stable throughout one call. Registry validation remains with the
+    /// application, particularly Open.
+    pub fn apply_with_permissions(&mut self, action: Action<P>, permissions: impl Fn(&P) -> Permissions) -> Result<Vec<P>, DockError> {
         self.validate()?;
+        let action = match action {
+            Action::Open { panel, anchor: None } if self.root.is_some() && !self.contains(&panel) => {
+                let (anchor, placement) = self.open_place(&permissions).ok_or(DockError::MissingTarget)?;
+                Action::OpenAt { panel, anchor, placement }
+            }
+            action => action,
+        };
         match &action {
             Action::Move { panel, anchor, placement } | Action::OpenAt { panel, anchor, placement } => {
-                if !permissions(panel).movable {
+                // Opening an absent panel moves nothing, so it works in a locked workspace too.
+                let opens = matches!(action, Action::OpenAt { .. }) && !self.contains(panel);
+                if !opens && !permissions(panel).movable {
                     return Err(DockError::NotAllowed);
                 }
-                let tab = matches!(placement, Placement::Tab { .. } | Placement::Split(Zone::Center));
-                if tab && !permissions(anchor).accepts_tabs {
+                if !placement_allowed(placement, permissions(anchor)) {
                     return Err(DockError::NotAllowed);
                 }
             }
             Action::Float { panel, .. } if !permissions(panel).floatable || !permissions(panel).movable => return Err(DockError::NotAllowed),
             Action::Close { panel } if !permissions(panel).closable => return Err(DockError::NotAllowed),
-            // The rectangle belongs to the whole floating group, so every member must allow it.
+            // The rectangle belongs to the whole floating window, so every panel in it must allow it.
             Action::MoveFloating { panel, .. }
                 if !permissions(panel).movable
-                    || self.floating.iter().find(|g| g.panels.contains(panel)).is_some_and(|g| g.panels.iter().any(|p| !permissions(p).movable)) =>
+                    || self.floating.iter().find(|w| w.contains(panel)).is_some_and(|w| w.panels().any(|p| !permissions(p).movable)) =>
             {
                 return Err(DockError::NotAllowed);
             }
             Action::Open { anchor: Some(anchor), .. } if !permissions(anchor).accepts_tabs => return Err(DockError::NotAllowed),
+            Action::MovePanel { panel, to } => {
+                let policy = permissions(panel);
+                let allowed = policy.movable
+                    && match to {
+                        Target::Float { .. } => policy.floatable,
+                        Target::At { anchor, placement } => placement_allowed(placement, permissions(anchor)),
+                        Target::NewDock { .. } => true,
+                    };
+                if !allowed {
+                    return Err(DockError::NotAllowed);
+                }
+            }
+            Action::MoveGroup { panel, to } | Action::MoveColumn { panel, to } | Action::MoveWindow { panel, to } => {
+                let members = self.members(panel, unit_of(&action))?;
+                if members.iter().any(|p| !permissions(p).movable) {
+                    return Err(DockError::NotAllowed);
+                }
+                match to {
+                    Target::Float { .. } if members.iter().any(|p| !permissions(p).floatable) => return Err(DockError::NotAllowed),
+                    Target::At { anchor, placement } if !members.contains(anchor) && !placement_allowed(placement, permissions(anchor)) => {
+                        return Err(DockError::NotAllowed);
+                    }
+                    _ => {}
+                }
+            }
+            Action::CloseGroup { panel } | Action::CloseWindow { panel } | Action::CloseOthers { panel } => {
+                let others = matches!(action, Action::CloseOthers { .. });
+                let members = self.members(panel, unit_of(&action))?;
+                if members.iter().filter(|p| !others || *p != panel).any(|p| !permissions(p).closable) {
+                    return Err(DockError::NotAllowed);
+                }
+            }
+            Action::SetNative { panel, rect: Some(_) } if self.members(panel, Unit::Window)?.iter().any(|p| !permissions(p).floatable) => {
+                return Err(DockError::NotAllowed);
+            }
             _ => {}
         }
+        let closed = self.closed_by(&action)?;
         let mut proposed = self.clone();
-        proposed.apply_inner(action)?;
+        proposed.apply_inner(action, &|p| permissions(p).is_protected())?;
         proposed.validate()?;
         *self = proposed;
-        Ok(())
+        Ok(closed)
     }
 
-    fn apply_inner(&mut self, action: Action<P>) -> Result<(), DockError> {
+    /// Apply every action in order, or none: the first rejection leaves the layout unchanged.
+    /// Returns every panel the actions closed, in order.
+    pub fn apply_all(&mut self, actions: impl IntoIterator<Item = Action<P>>, permissions: impl Fn(&P) -> Permissions) -> Result<Vec<P>, DockError> {
+        let mut proposed = self.clone();
+        let mut closed = Vec::new();
+        for action in actions {
+            closed.extend(proposed.apply_with_permissions(action, &permissions)?);
+        }
+        *self = proposed;
+        Ok(closed)
+    }
+
+    /// The panels a close action (`Close`, `CloseGroup`, `CloseWindow`, `CloseOthers`) would
+    /// remove, in group order. Empty for other actions. The apply methods return the same
+    /// list; this one answers before applying.
+    pub fn closed_by(&self, action: &Action<P>) -> Result<Vec<P>, DockError> {
+        Ok(match action {
+            Action::Close { panel } => vec![panel.clone()],
+            Action::CloseGroup { panel } | Action::CloseWindow { panel } => self.members(panel, unit_of(action))?,
+            Action::CloseOthers { panel } => self.members(panel, Unit::Group)?.into_iter().filter(|p| p != panel).collect(),
+            _ => Vec::new(),
+        })
+    }
+
+    /// `canvas` is the protected-panel test an outer edge drop narrows by.
+    fn apply_inner(&mut self, action: Action<P>, canvas: &dyn Fn(&P) -> bool) -> Result<(), DockError> {
         match action {
             Action::Move { panel, anchor, placement } => {
                 if panel == anchor {
@@ -425,36 +1051,45 @@ impl<P: Clone + Eq + Hash> Layout<P> {
                     }
                 }
                 let entry = self.take(&panel).ok_or(DockError::MissingPanel)?;
-                self.insert(entry, &anchor, placement)
+                self.insert(entry, &anchor, placement, canvas)
             }
             Action::Float { panel, rect } => {
                 if !valid_rect(rect) {
                     return Err(DockError::InvalidGeometry);
                 }
+                // A window's only panel keeps the window's id.
+                let lone = self.floating.iter().find(|w| w.contains(&panel)).filter(|w| w.panels().count() == 1).map(|w| w.id);
                 let entry = self.take(&panel).ok_or(DockError::MissingPanel)?;
-                self.floating.push(Floating { panels: vec![entry.panel], active: 0, rect });
+                let window = Floating::single(vec![entry.panel], 0, rect);
+                self.floating.push(Floating { id: lone.unwrap_or(window.id), ..window });
                 Ok(())
             }
             Action::Close { panel } => self.take(&panel).map(|_| ()).ok_or(DockError::MissingPanel),
             Action::Activate { panel } => {
-                if self.root.as_mut().is_some_and(|node| activate(node, &panel)) {
+                let place = self.place(&panel).ok_or(DockError::MissingPanel)?;
+                if let Some(group) = self.group_mut(&place) {
+                    // Selecting a panel shows it: a minimized group expands.
+                    group.active = group.panels.iter().position(|p| p == &panel).ok_or(DockError::MissingPanel)?;
+                    group.minimized = false;
                     return Ok(());
                 }
-                for group in &mut self.floating {
-                    if let Some(i) = group.panels.iter().position(|p| p == &panel) {
-                        group.active = i;
-                        return Ok(());
-                    }
+                if let Place::Floating { window, .. } = place
+                    && let Some(window) = self.floating.get_mut(window)
+                {
+                    window.minimized = false;
+                }
+                if self.trees_mut().any(|node| activate(node, &panel)) {
+                    return Ok(());
                 }
                 Err(DockError::MissingPanel)
             }
             Action::Open { panel, anchor } => {
                 if self.contains(&panel) {
-                    return self.apply_inner(Action::Activate { panel });
+                    return self.apply_inner(Action::Activate { panel }, canvas);
                 }
                 let entry = StackEntry { panel, open: true, height: None };
                 if let Some(anchor) = anchor {
-                    self.insert(entry, &anchor, Placement::Tab { before: None })
+                    self.insert(entry, &anchor, Placement::Tab { before: None }, canvas)
                 } else if self.root.is_none() {
                     self.root = Some(Node::Tabs { panels: vec![entry.panel], active: 0 });
                     Ok(())
@@ -464,21 +1099,21 @@ impl<P: Clone + Eq + Hash> Layout<P> {
             }
             Action::OpenAt { panel, anchor, placement } => {
                 if self.contains(&panel) {
-                    return self.apply_inner(Action::Move { panel, anchor, placement });
+                    return self.apply_inner(Action::Move { panel, anchor, placement }, canvas);
                 }
                 if let Placement::Tab { before: Some(before) } = &placement
                     && !self.same_group(before, &anchor)
                 {
                     return Err(DockError::MissingTarget);
                 }
-                self.insert(StackEntry { panel, open: true, height: None }, &anchor, placement)
+                self.insert(StackEntry { panel, open: true, height: None }, &anchor, placement, canvas)
             }
             Action::MoveFloating { panel, rect } => {
                 if !valid_rect(rect) {
                     return Err(DockError::InvalidGeometry);
                 }
-                let group = self.floating.iter_mut().find(|g| g.panels.contains(&panel)).ok_or(DockError::MissingPanel)?;
-                group.rect = rect;
+                let window = self.floating.iter_mut().find(|g| g.contains(&panel)).ok_or(DockError::MissingPanel)?;
+                window.rect = rect;
                 Ok(())
             }
             Action::ResizeSplit { path, size } => {
@@ -488,17 +1123,20 @@ impl<P: Clone + Eq + Hash> Layout<P> {
                 if !valid_size(size) {
                     return Err(DockError::InvalidGeometry);
                 }
-                let mut node = self.root.as_mut().ok_or(DockError::MissingTarget)?;
-                for second_child in path {
-                    let Node::Split { first, second, .. } = node else { return Err(DockError::MissingTarget) };
-                    node = if second_child { second } else { first };
+                resize_split(self.root.as_mut().ok_or(DockError::MissingTarget)?, &path, size)
+            }
+            Action::ResizeWindowSplit { panel, path, size } => {
+                if path.len() >= MAX_DEPTH {
+                    return Err(DockError::LimitExceeded);
                 }
-                let Node::Split { size: old, .. } = node else { return Err(DockError::MissingTarget) };
-                *old = size;
-                Ok(())
+                if !valid_size(size) {
+                    return Err(DockError::InvalidGeometry);
+                }
+                let window = self.floating.iter_mut().find(|w| w.contains(&panel)).ok_or(DockError::MissingPanel)?;
+                resize_split(&mut window.root, &path, size)
             }
             Action::SetStackOpen { panel, open } => {
-                let entry = self.root.as_mut().and_then(|n| stack_entry_mut(n, &panel)).ok_or(DockError::MissingPanel)?;
+                let entry = self.trees_mut().find_map(|n| stack_entry_mut(n, &panel)).ok_or(DockError::MissingPanel)?;
                 entry.open = open;
                 Ok(())
             }
@@ -506,58 +1144,205 @@ impl<P: Clone + Eq + Hash> Layout<P> {
                 if !valid_height(height) {
                     return Err(DockError::InvalidGeometry);
                 }
-                let entry = self.root.as_mut().and_then(|n| stack_entry_mut(n, &panel)).ok_or(DockError::MissingPanel)?;
+                let entry = self.trees_mut().find_map(|n| stack_entry_mut(n, &panel)).ok_or(DockError::MissingPanel)?;
                 entry.height = height;
                 Ok(())
             }
+            Action::MoveGroup { ref panel, ref to } | Action::MoveColumn { ref panel, ref to } | Action::MoveWindow { ref panel, ref to } => {
+                let unit = unit_of(&action);
+                if let Target::At { anchor, .. } = to
+                    && self.members(panel, unit)?.contains(anchor)
+                {
+                    // Dropped on itself.
+                    return Ok(());
+                }
+                let moving = self.take_unit(panel, unit)?;
+                self.insert_moving(moving, to.clone(), canvas)
+            }
+            Action::MovePanel { panel, to } => match to {
+                Target::At { anchor, placement } => self.apply_inner(Action::Move { panel, anchor, placement }, canvas),
+                to => {
+                    let entry = self.take(&panel).ok_or(DockError::MissingPanel)?;
+                    self.insert_moving(Moving::group(Group::new(vec![entry.panel], 0)), to, canvas)
+                }
+            },
+            Action::CloseGroup { ref panel } | Action::CloseWindow { ref panel } => self.take_unit(panel, unit_of(&action)).map(|_| ()),
+            Action::CloseOthers { panel } => {
+                for other in self.members(&panel, Unit::Group)? {
+                    if other != panel {
+                        self.take(&other).ok_or(DockError::MissingPanel)?;
+                    }
+                }
+                Ok(())
+            }
+            Action::SetMinimized { panel, minimized } => {
+                let place = self.place(&panel).ok_or(DockError::MissingPanel)?;
+                if let Some(group) = self.group_mut(&place) {
+                    group.minimized = minimized;
+                    return Ok(());
+                }
+                if let Place::Floating { window, .. } = place {
+                    self.floating.get_mut(window).ok_or(DockError::MissingPanel)?.minimized = minimized;
+                    return Ok(());
+                }
+                let entry = self.trees_mut().find_map(|n| stack_entry_mut(n, &panel)).ok_or(DockError::InvalidPlacement)?;
+                entry.open = !minimized;
+                Ok(())
+            }
+            Action::ResizeGroup { panel, height } => {
+                if !valid_height(height) {
+                    return Err(DockError::InvalidGeometry);
+                }
+                let place = self.place(&panel).ok_or(DockError::MissingPanel)?;
+                if let Some(group) = self.group_mut(&place) {
+                    group.height = height;
+                    return Ok(());
+                }
+                let entry = self.trees_mut().find_map(|n| stack_entry_mut(n, &panel)).ok_or(DockError::InvalidPlacement)?;
+                entry.height = height;
+                Ok(())
+            }
+            Action::SetIconic { panel, iconic } => {
+                self.column_of(&panel)?.iconic = iconic;
+                Ok(())
+            }
+            Action::ResizeColumn { panel, width } => {
+                if !valid_width(width) {
+                    return Err(DockError::InvalidGeometry);
+                }
+                self.column_of(&panel)?.width = width;
+                Ok(())
+            }
+            Action::ResizeIconic { panel, width } => {
+                if width.is_some_and(|w| !valid_width(w)) {
+                    return Err(DockError::InvalidGeometry);
+                }
+                self.column_of(&panel)?.iconic_width = width;
+                Ok(())
+            }
+            Action::SetNative { panel, rect } => {
+                if rect.is_some_and(|r| !valid_rect(r)) {
+                    return Err(DockError::InvalidGeometry);
+                }
+                let window = self.floating.iter_mut().find(|g| g.contains(&panel)).ok_or(DockError::InvalidPlacement)?;
+                window.native = rect;
+                if rect.is_none() {
+                    window.monitor = None;
+                    window.monitor_size = None;
+                }
+                Ok(())
+            }
+            Action::SetMonitor { panel, monitor, monitor_size } => {
+                if !valid_monitor(monitor.as_ref(), monitor_size) {
+                    return Err(DockError::InvalidGeometry);
+                }
+                let window = self.floating.iter_mut().find(|g| g.contains(&panel)).ok_or(DockError::InvalidPlacement)?;
+                window.monitor = monitor;
+                window.monitor_size = monitor_size;
+                Ok(())
+            }
         }
     }
 
-    fn same_group(&self, panel: &P, anchor: &P) -> bool {
-        fn in_node<P: Eq>(node: &Node<P>, panel: &P, anchor: &P) -> bool {
-            match node {
-                Node::Tabs { panels, .. } => panels.contains(panel) && panels.contains(anchor),
-                Node::Stack { entries } => entries.iter().any(|e| &e.panel == panel) && entries.iter().any(|e| &e.panel == anchor),
-                Node::Split { first, second, .. } => in_node(first, panel, anchor) || in_node(second, panel, anchor),
-            }
-        }
-        self.root.as_ref().is_some_and(|n| in_node(n, panel, anchor))
-            || self.floating.iter().any(|g| g.panels.contains(panel) && g.panels.contains(anchor))
+    fn column_of(&mut self, panel: &P) -> Result<&mut Column<P>, DockError> {
+        let place = self.place(panel).ok_or(DockError::MissingPanel)?;
+        self.column_mut(&place).ok_or(DockError::InvalidPlacement)
     }
 
-    fn take(&mut self, panel: &P) -> Option<StackEntry<P>> {
+    fn same_group(&self, panel: &P, anchor: &P) -> bool {
+        let place = self.place(panel);
+        place.is_some() && place == self.place(anchor)
+    }
+
+    pub(super) fn take(&mut self, panel: &P) -> Option<StackEntry<P>> {
         let mut removed = None;
         self.root = self.root.take().and_then(|n| remove_node(n, panel, &mut removed));
         if removed.is_some() {
             return removed;
         }
-        for group in &mut self.floating {
-            if let Some(p) = remove_tab(&mut group.panels, &mut group.active, panel) {
-                removed = Some(StackEntry { panel: p, open: true, height: None });
-                break;
+        if let Some(index) = self.floating.iter().position(|w| w.contains(panel))
+            && let Some(window) = self.floating.get_mut(index)
+        {
+            let root = std::mem::replace(&mut window.root, Node::Tabs { panels: Vec::new(), active: 0 });
+            match remove_node(root, panel, &mut removed) {
+                Some(root) => window.root = root,
+                None => {
+                    self.floating.remove(index);
+                }
             }
         }
-        self.floating.retain(|g| !g.panels.is_empty());
         removed
     }
 
-    fn insert(&mut self, entry: StackEntry<P>, anchor: &P, placement: Placement<P>) -> Result<(), DockError> {
-        if let Some(group) = self.floating.iter_mut().find(|g| g.panels.contains(anchor)) {
-            let index = match placement {
-                Placement::Tab { before } => before.as_ref().and_then(|p| group.panels.iter().position(|q| q == p)).unwrap_or(group.panels.len()),
-                Placement::Split(Zone::Center) => group.panels.iter().position(|p| p == anchor).map_or(group.panels.len(), |i| i + 1),
-                Placement::Split(_) => return Err(DockError::InvalidPlacement),
-            };
-            group.panels.insert(index, entry.panel);
-            group.active = index;
-            return Ok(());
+    /// Where [`Action::Open`] without an anchor puts an absent panel in a layout with a root:
+    /// the end of the first shown dock group that accepts tabs, in the end-side dock if one has
+    /// such a group, else a new frame at the right edge of the docked area.
+    fn open_place(&self, permissions: impl Fn(&P) -> Permissions) -> Option<(P, Placement<P>)> {
+        let docked: Vec<(&P, Place)> = self
+            .panels()
+            .into_iter()
+            .filter_map(|p| Some((p, self.place(p)?)))
+            .filter(|(_, place)| !matches!(place, Place::Floating { .. }))
+            .collect();
+        let side = |place: &Place| match place {
+            Place::Dock { path, .. } => match self.root.as_ref().and_then(|root| node_at(root, path)) {
+                Some(Node::Dock { side, .. }) => Some(*side),
+                _ => None,
+            },
+            _ => None,
+        };
+        // A minimized group or an iconic column would leave the panel open but not shown.
+        let shown = |place: &Place| match place {
+            Place::Dock { group, .. } => self.column(place).is_some_and(|c| !c.iconic && c.groups.get(*group).is_some_and(|g| !g.minimized)),
+            _ => false,
+        };
+        let groups = docked.iter().filter(|(p, place)| side(place).is_some() && shown(place) && permissions(p).accepts_tabs);
+        if let Some((panel, _)) = groups.clone().find(|(_, place)| side(place) == Some(Side::End)).or_else(|| groups.clone().next()) {
+            return Some(((*panel).clone(), Placement::Tab { before: None }));
         }
-        if let Some(root) = self.root.as_mut()
-            && insert_node(root, &entry, anchor, &placement)
+        // A canvas anchor would narrow the edge to the canvas column.
+        let edge = docked.iter().find(|(p, _)| !permissions(p).is_protected()).or(docked.first());
+        edge.map(|(panel, _)| ((*panel).clone(), Placement::Edge(Zone::Right)))
+    }
+
+    fn insert(&mut self, entry: StackEntry<P>, anchor: &P, placement: Placement<P>, canvas: &dyn Fn(&P) -> bool) -> Result<(), DockError> {
+        let place = self.place(anchor).ok_or(DockError::MissingTarget)?;
+        let tree = place.tree_path().map(|(window, path)| (window, path.to_vec()));
+        let Some((window, path)) = tree.filter(|_| !matches!(placement, Placement::Group { .. } | Placement::Column { .. } | Placement::Edge(_)))
+        else {
+            let group = Group::new(vec![entry.panel], 0);
+            return self.insert_moving(Moving::group(group), Target::At { anchor: anchor.clone(), placement }, canvas);
+        };
+        let root = self.tree_mut(window).ok_or(DockError::MissingTarget)?;
+        if let Placement::Split(zone) = placement
+            && zone != Zone::Center
         {
-            return Ok(());
+            let new = Node::Tabs { panels: vec![entry.panel], active: 0 };
+            return if split_frame(root, &path, new, zone) { Ok(()) } else { Err(DockError::MissingTarget) };
         }
-        Err(DockError::MissingTarget)
+        if let Placement::SplitSized { zone, size, outer } = placement {
+            let new = Node::Tabs { panels: vec![entry.panel], active: 0 };
+            return if split_frame_sized(root, &path, new, zone, size, outer) { Ok(()) } else { Err(DockError::InvalidPlacement) };
+        }
+        if insert_node(root, &entry, anchor, &placement) { Ok(()) } else { Err(DockError::MissingTarget) }
+    }
+}
+
+/// Whether the anchor's permissions take this placement: tabs need `accepts_tabs`, side
+/// splits `accepts_splits`.
+fn placement_allowed<P>(placement: &Placement<P>, anchor: Permissions) -> bool {
+    match placement {
+        Placement::Tab { .. } | Placement::Split(Zone::Center) => anchor.accepts_tabs,
+        Placement::Split(_) | Placement::SplitSized { .. } => anchor.accepts_splits,
+        _ => true,
+    }
+}
+
+fn unit_of<P>(action: &Action<P>) -> Unit {
+    match action {
+        Action::MoveColumn { .. } => Unit::Column,
+        Action::MoveWindow { .. } | Action::CloseWindow { .. } => Unit::Window,
+        _ => Unit::Group,
     }
 }
 
@@ -571,6 +1356,41 @@ fn check_panel<'a, P: Eq + Hash>(panel: &'a P, seen: &mut HashSet<&'a P>) -> Res
     Ok(())
 }
 
+/// A `Tabs` or `Stack` node: not empty, a valid selection and heights, panels not seen before.
+fn check_leaf<'a, P: Eq + Hash>(node: &'a Node<P>, seen: &mut HashSet<&'a P>) -> Result<(), DockError> {
+    match node {
+        Node::Tabs { panels, active } => {
+            if panels.is_empty() {
+                return Err(DockError::InvalidGeometry);
+            }
+            check_tabs(panels, *active, seen)
+        }
+        Node::Stack { entries } => {
+            if entries.is_empty() {
+                return Err(DockError::InvalidGeometry);
+            }
+            if entries.len() > MAX_PANELS {
+                return Err(DockError::LimitExceeded);
+            }
+            for entry in entries {
+                if !valid_height(entry.height) {
+                    return Err(DockError::InvalidGeometry);
+                }
+                check_panel(&entry.panel, seen)?;
+            }
+            Ok(())
+        }
+        Node::Split { .. } | Node::Dock { .. } => Ok(()),
+    }
+}
+
+fn check_group<'a, P: Eq + Hash>(group: &'a Group<P>, seen: &mut HashSet<&'a P>) -> Result<(), DockError> {
+    if group.panels.is_empty() || !valid_height(group.height) {
+        return Err(DockError::InvalidGeometry);
+    }
+    check_tabs(&group.panels, group.active, seen)
+}
+
 fn check_tabs<'a, P: Eq + Hash>(panels: &'a [P], active: usize, seen: &mut HashSet<&'a P>) -> Result<(), DockError> {
     if panels.len() > MAX_PANELS {
         return Err(DockError::LimitExceeded);
@@ -614,9 +1434,33 @@ fn remove_node<P: Clone + Eq>(node: Node<P>, panel: &P, removed: &mut Option<Sta
                 (node, None) | (None, node) => node,
             }
         }
+        Node::Dock { side, mut columns } => {
+            // A dock that was already empty stays; one emptied by this removal collapses.
+            let had_columns = !columns.is_empty();
+            for column in &mut columns {
+                for group in &mut column.groups {
+                    if let Some(panel) = remove_tab(&mut group.panels, &mut group.active, panel) {
+                        *removed = Some(StackEntry { panel, open: true, height: None });
+                    }
+                }
+                column.groups.retain(|g| !g.panels.is_empty());
+            }
+            columns.retain(|c| !c.groups.is_empty());
+            (!had_columns || !columns.is_empty()).then_some(Node::Dock { side, columns })
+        }
     }
 }
 
+fn resize_split<P>(mut node: &mut Node<P>, path: &[bool], size: SplitSize) -> Result<(), DockError> {
+    for second_child in path {
+        let Node::Split { first, second, .. } = node else { return Err(DockError::MissingTarget) };
+        node = if *second_child { second } else { first };
+    }
+    let Node::Split { size: old, .. } = node else { return Err(DockError::MissingTarget) };
+    *old = size;
+    Ok(())
+}
+
 fn activate<P: Eq>(node: &mut Node<P>, panel: &P) -> bool {
     match node {
         Node::Tabs { panels, active } => {
@@ -636,6 +1480,7 @@ fn activate<P: Eq>(node: &mut Node<P>, panel: &P) -> bool {
             }
         }
         Node::Split { first, second, .. } => activate(first, panel) || activate(second, panel),
+        Node::Dock { .. } => false,
     }
 }
 
@@ -643,7 +1488,7 @@ fn stack_entry_mut<'a, P: Eq>(node: &'a mut Node<P>, panel: &P) -> Option<&'a mu
     match node {
         Node::Stack { entries } => entries.iter_mut().find(|e| &e.panel == panel),
         Node::Split { first, second, .. } => stack_entry_mut(first, panel).or_else(|| stack_entry_mut(second, panel)),
-        Node::Tabs { .. } => None,
+        Node::Tabs { .. } | Node::Dock { .. } => None,
     }
 }
 
@@ -652,23 +1497,16 @@ fn insert_node<P: Clone + Eq>(node: &mut Node<P>, entry: &StackEntry<P>, anchor:
         Node::Split { first, second, .. } => return insert_node(first, entry, anchor, placement) || insert_node(second, entry, anchor, placement),
         Node::Tabs { panels, .. } => panels.contains(anchor),
         Node::Stack { entries } => entries.iter().any(|e| &e.panel == anchor),
+        Node::Dock { .. } => false,
     };
     if !here {
         return false;
     }
-    if let Placement::Split(zone @ (Zone::Left | Zone::Right | Zone::Top | Zone::Bottom)) = placement {
-        let old = std::mem::replace(node, Node::Tabs { panels: Vec::new(), active: 0 });
-        let new = Node::Tabs { panels: vec![entry.panel.clone()], active: 0 };
-        let axis = if matches!(zone, Zone::Top | Zone::Bottom) { SplitAxis::Vertical } else { SplitAxis::Horizontal };
-        let (first, second) = if matches!(zone, Zone::Top | Zone::Left) { (new, old) } else { (old, new) };
-        *node = Node::Split { axis, size: SplitSize::Ratio(0.5), first: Box::new(first), second: Box::new(second) };
-        return true;
-    }
     match node {
         Node::Tabs { panels, active } => {
             let index = match placement {
                 Placement::Tab { before } => before.as_ref().and_then(|p| panels.iter().position(|q| q == p)).unwrap_or(panels.len()),
-                Placement::Split(_) => panels.iter().position(|p| p == anchor).map_or(panels.len(), |i| i + 1),
+                _ => panels.iter().position(|p| p == anchor).map_or(panels.len(), |i| i + 1),
             };
             panels.insert(index, entry.panel.clone());
             *active = index;
@@ -676,11 +1514,11 @@ fn insert_node<P: Clone + Eq>(node: &mut Node<P>, entry: &StackEntry<P>, anchor:
         Node::Stack { entries } => {
             let index = match placement {
                 Placement::Tab { before } => before.as_ref().and_then(|p| entries.iter().position(|e| &e.panel == p)).unwrap_or(entries.len()),
-                Placement::Split(_) => entries.iter().position(|e| &e.panel == anchor).map_or(entries.len(), |i| i + 1),
+                _ => entries.iter().position(|e| &e.panel == anchor).map_or(entries.len(), |i| i + 1),
             };
             entries.insert(index, entry.clone());
         }
-        Node::Split { .. } => return false,
+        Node::Split { .. } | Node::Dock { .. } => return false,
     }
     true
 }
@@ -689,7 +1527,7 @@ fn group_location<P: Clone + Eq>(panels: &[P], panel: &P) -> Option<Location<P>>
     let index = panels.iter().position(|p| p == panel)?;
     let anchor = panels.iter().find(|p| *p != panel).cloned();
     let before = panels.get(index + 1).cloned();
-    Some(Location { floating: None, anchor, placement: Placement::Tab { before }, size: None, stack: None, sibling: Vec::new() })
+    Some(Location { floating: None, anchor, placement: Placement::Tab { before }, size: None, stack: None, sibling: Vec::new(), group: None })
 }
 
 fn first_panel<P>(node: &Node<P>) -> Option<&P> {
@@ -697,6 +1535,7 @@ fn first_panel<P>(node: &Node<P>) -> Option<&P> {
         Node::Tabs { panels, .. } => panels.first(),
         Node::Stack { entries } => entries.first().map(|e| &e.panel),
         Node::Split { first, second, .. } => first_panel(first).or_else(|| first_panel(second)),
+        Node::Dock { columns, .. } => columns.iter().flat_map(|c| c.groups.iter()).find_map(|g| g.panels.first()),
     }
 }
 
@@ -733,6 +1572,7 @@ fn node_location<P: Clone + Eq>(node: &Node<P>, panel: &P) -> Option<Location<P>
             }
             Some(location)
         }
+        Node::Dock { .. } => None,
     }
 }
 
@@ -773,6 +1613,7 @@ fn node_members<'a, P>(node: &'a Node<P>, members: &mut Vec<&'a P>) {
             node_members(first, members);
             node_members(second, members);
         }
+        Node::Dock { columns, .. } => members.extend(columns.iter().flat_map(|c| c.groups.iter()).flat_map(|g| g.panels.iter())),
     }
 }
 
diff --git a/crates/ui/src/docking/model_tests.rs b/crates/ui/src/docking/model_tests.rs
new file mode 100644
index 00000000..4df96d21
--- /dev/null
+++ b/crates/ui/src/docking/model_tests.rs
@@ -0,0 +1,800 @@
+use super::dock_model::{Place, node_at};
+use super::*;
+use crate::layout::{SplitAxis, SplitSize};
+
+pub(super) fn g(panels: &[u32], active: usize) -> Group<u32> {
+    Group::new(panels.to_vec(), active)
+}
+
+fn tabs(panels: &[u32], active: usize) -> Node<u32> {
+    Node::Tabs { panels: panels.to_vec(), active }
+}
+
+fn hsplit(size: SplitSize, first: Node<u32>, second: Node<u32>) -> Node<u32> {
+    Node::Split { axis: SplitAxis::Horizontal, size, first: Box::new(first), second: Box::new(second) }
+}
+
+/// Canvas 1 above frame tabs [11, 12]; an end dock with column A ([2, 3], [4]) and column B
+/// ([5]); a floating window with groups [6, 7] and [8].
+pub(super) fn docked() -> Layout<u32> {
+    let middle =
+        Node::Split { axis: SplitAxis::Vertical, size: SplitSize::Ratio(0.7), first: Box::new(tabs(&[1], 0)), second: Box::new(tabs(&[11, 12], 1)) };
+    let dock =
+        Node::Dock { side: Side::End, columns: vec![Column::new(vec![g(&[2, 3], 1), g(&[4], 0)], 180.0), Column::new(vec![g(&[5], 0)], 120.0)] };
+    Layout {
+        root: Some(hsplit(SplitSize::FixedSecond(300.0), middle, dock)),
+        floating: vec![Floating::stack(vec![g(&[6, 7], 1), g(&[8], 0)], [100.0, 100.0, 300.0, 400.0]).unwrap()],
+    }
+}
+
+pub(super) const ALL: [u32; 10] = [1, 2, 3, 4, 5, 6, 7, 8, 11, 12];
+
+fn sorted(layout: &Layout<u32>) -> Vec<u32> {
+    let mut panels: Vec<u32> = layout.panels().into_iter().copied().collect();
+    panels.sort_unstable();
+    panels
+}
+
+/// Members, active panel and minimized state of the group holding `panel`.
+fn group_state(layout: &Layout<u32>, panel: u32) -> (Vec<u32>, u32, bool) {
+    match layout.place(&panel).unwrap() {
+        place @ (Place::Node(_) | Place::Floating { .. }) => match layout.node_of(&place).unwrap() {
+            Node::Tabs { panels, active } => (panels.clone(), panels[*active], false),
+            other => panic!("{other:?}"),
+        },
+        place => {
+            let group = layout.group(&place).unwrap();
+            (group.panels.clone(), group.panels[group.active], group.minimized)
+        }
+    }
+}
+
+fn dock(layout: &Layout<u32>, side: Side) -> &Vec<Column<u32>> {
+    let path = layout.dock_path(side).unwrap();
+    let Some(Node::Dock { columns, .. }) = node_at(layout.root.as_ref().unwrap(), &path) else { panic!() };
+    columns
+}
+
+fn panels_of(groups: &[Group<u32>]) -> Vec<Vec<u32>> {
+    groups.iter().map(|g| g.panels.clone()).collect()
+}
+
+#[test]
+fn group_moves_keep_order_active_tab_and_minimized_state() {
+    let targets = [
+        Target::At { anchor: 5, placement: Placement::Group { below: true, height: None } },
+        Target::At { anchor: 5, placement: Placement::Column { after: true } },
+        Target::At { anchor: 8, placement: Placement::Group { below: false, height: None } },
+        Target::NewDock { side: Side::Start },
+        Target::Float { rect: Some([20.0, 20.0, 200.0, 300.0]) },
+        Target::Float { rect: None },
+    ];
+    // A frame Tabs node, a column group and a floating group.
+    for source in [11, 2, 6] {
+        for to in &targets {
+            let mut layout = docked();
+            if source != 11 {
+                layout.apply(Action::SetMinimized { panel: source, minimized: true }).unwrap();
+            }
+            let before = group_state(&layout, source);
+            layout.apply(Action::MoveGroup { panel: source, to: to.clone() }).unwrap_or_else(|e| panic!("{source} {to:?}: {e}"));
+            let after = group_state(&layout, source);
+            assert_eq!((&after.0, after.1), (&before.0, before.1), "{source} {to:?}");
+            // A group keeps its minimized state from dock to dock; a floating window's tree
+            // has no minimized groups.
+            if matches!((source, layout.place(&source)), (2, Some(Place::Dock { .. }))) {
+                assert_eq!(after.2, before.2, "{source} {to:?}");
+            }
+            assert_eq!(sorted(&layout), ALL);
+        }
+    }
+    // Into a frame split the group becomes a Tabs node with the same order and selection.
+    let mut layout = docked();
+    layout.apply(Action::MoveGroup { panel: 6, to: Target::At { anchor: 1, placement: Placement::Split(Zone::Left) } }).unwrap();
+    assert_eq!(group_state(&layout, 6), (vec![6, 7], 7, false));
+    assert_eq!(layout.floating[0].groups().len(), 1);
+}
+
+#[test]
+fn group_merge_into_tabs_inserts_every_member_before_the_anchor_tab() {
+    let mut layout = docked();
+    layout.apply(Action::MoveGroup { panel: 6, to: Target::At { anchor: 2, placement: Placement::Tab { before: Some(3) } } }).unwrap();
+    assert_eq!(group_state(&layout, 2), (vec![2, 6, 7, 3], 7, false));
+    assert_eq!(panels_of(&layout.floating[0].groups()), [vec![8]]);
+
+    let mut layout = docked();
+    layout.apply(Action::MoveGroup { panel: 2, to: Target::At { anchor: 11, placement: Placement::Tab { before: Some(12) } } }).unwrap();
+    assert_eq!(group_state(&layout, 11), (vec![11, 2, 3, 12], 3, false));
+    assert_eq!(panels_of(&dock(&layout, Side::End)[0].groups), [vec![4]]);
+
+    // A target inside the moving group is a no-op; a protected anchor refuses tabs.
+    let before = docked();
+    let mut layout = before.clone();
+    layout.apply(Action::MoveGroup { panel: 2, to: Target::At { anchor: 3, placement: Placement::Tab { before: None } } }).unwrap();
+    assert_eq!(layout, before);
+    let protect = |p: &u32| if *p == 1 { Permissions::PROTECTED } else { Permissions::default() };
+    let to = Target::At { anchor: 1, placement: Placement::Tab { before: None } };
+    assert_eq!(layout.apply_with_permissions(Action::MoveGroup { panel: 2, to }, protect), Err(DockError::NotAllowed));
+    assert_eq!(layout, before);
+}
+
+#[test]
+fn column_moves_and_floats_keep_every_group() {
+    let mut layout = docked();
+    layout.apply(Action::SetIconic { panel: 4, iconic: true }).unwrap();
+    layout.apply(Action::MoveColumn { panel: 2, to: Target::NewDock { side: Side::Start } }).unwrap();
+    let Some(Node::Split { size, first, .. }) = &layout.root else { panic!() };
+    assert_eq!(*size, SplitSize::FixedFirst(180.0));
+    assert!(matches!(**first, Node::Dock { side: Side::Start, .. }));
+    let start = dock(&layout, Side::Start);
+    assert_eq!(start.len(), 1);
+    assert_eq!(panels_of(&start[0].groups), [vec![2, 3], vec![4]]);
+    assert_eq!((start[0].width, start[0].iconic, start[0].groups[0].active), (180.0, true, 1));
+    assert_eq!(panels_of(&dock(&layout, Side::End)[0].groups), [vec![5]]);
+
+    // The last column leaves the end dock, which collapses.
+    layout.apply(Action::MoveColumn { panel: 5, to: Target::At { anchor: 2, placement: Placement::Column { after: false } } }).unwrap();
+    assert!(layout.dock_path(Side::End).is_none());
+    let start = dock(&layout, Side::Start);
+    assert_eq!(start.iter().map(|c| c.width).collect::<Vec<_>>(), [120.0, 180.0]);
+
+    layout.apply(Action::MoveColumn { panel: 3, to: Target::Float { rect: None } }).unwrap();
+    let window = layout.floating.last().unwrap();
+    assert_eq!(panels_of(&window.groups()), [vec![2, 3], vec![4]]);
+    assert_eq!(window.rect[2], 180.0);
+    assert_eq!(sorted(&layout), ALL);
+    assert_eq!(layout.apply(Action::MoveColumn { panel: 11, to: Target::Float { rect: None } }), Err(DockError::InvalidPlacement));
+}
+
+#[test]
+fn window_docks_as_stacked_groups_or_merges_as_tabs() {
+    let mut layout = docked();
+    layout.apply(Action::MoveWindow { panel: 8, to: Target::At { anchor: 4, placement: Placement::Group { below: true, height: None } } }).unwrap();
+    assert_eq!(panels_of(&dock(&layout, Side::End)[0].groups), [vec![2, 3], vec![4], vec![6, 7], vec![8]]);
+    assert!(layout.floating.is_empty());
+
+    let mut layout = docked();
+    layout.apply(Action::MoveWindow { panel: 8, to: Target::At { anchor: 11, placement: Placement::Tab { before: None } } }).unwrap();
+    assert_eq!(group_state(&layout, 11), (vec![11, 12, 6, 7, 8], 7, false));
+
+    let mut layout = docked();
+    layout.apply(Action::MoveWindow { panel: 6, to: Target::NewDock { side: Side::Start } }).unwrap();
+    let start = dock(&layout, Side::Start);
+    assert_eq!((panels_of(&start[0].groups), start[0].width), (vec![vec![6, 7], vec![8]], 300.0));
+
+    let before = docked();
+    let mut layout = before.clone();
+    layout.apply(Action::MoveWindow { panel: 7, to: Target::At { anchor: 8, placement: Placement::Tab { before: None } } }).unwrap();
+    assert_eq!(layout, before);
+    assert_eq!(layout.apply(Action::MoveWindow { panel: 2, to: Target::Float { rect: None } }), Err(DockError::InvalidPlacement));
+}
+
+#[test]
+fn close_group_and_close_window_record_a_restorable_location_per_member() {
+    let mut workspace = Workspace::new(docked());
+    let allow = |_: &u32| Permissions::default();
+    assert_eq!(workspace.apply(Action::CloseGroup { panel: 3 }, allow).unwrap(), [2, 3]);
+    assert_eq!(workspace.hidden.iter().map(|(p, _)| *p).collect::<Vec<_>>(), [2, 3]);
+    assert_eq!(panels_of(&dock(&workspace.layout, Side::End)[0].groups), [vec![4]]);
+    workspace.set_visible(2, true, None, |_| Permissions::default()).unwrap();
+    workspace.set_visible(3, true, None, |_| Permissions::default()).unwrap();
+    assert_eq!(panels_of(&dock(&workspace.layout, Side::End)[0].groups), [vec![2, 3], vec![4]]);
+
+    assert_eq!(workspace.layout.closed_by(&Action::CloseWindow { panel: 7 }).unwrap(), [6, 7, 8]);
+    assert_eq!(workspace.apply(Action::CloseWindow { panel: 7 }, allow).unwrap(), [6, 7, 8]);
+    assert!(workspace.layout.floating.is_empty());
+    assert_eq!(workspace.hidden.len(), 3);
+    for panel in [6, 7, 8] {
+        workspace.set_visible(panel, true, None, |_| Permissions::default()).unwrap();
+    }
+    assert_eq!(workspace.layout.floating.len(), 1);
+    assert_eq!(panels_of(&workspace.layout.floating[0].groups()), [vec![6, 7], vec![8]]);
+    assert_eq!(workspace.layout.floating[0].rect, [100.0, 100.0, 300.0, 400.0]);
+
+    workspace.apply(Action::CloseOthers { panel: 12 }, allow).unwrap();
+    assert_eq!(group_state(&workspace.layout, 12).0, [12]);
+    workspace.set_visible(11, true, None, |_| Permissions::default()).unwrap();
+    assert_eq!(group_state(&workspace.layout, 12).0, [11, 12]);
+    assert!(workspace.hidden.is_empty());
+    assert_eq!(sorted(&workspace.layout), ALL);
+
+    // A member that may not close keeps the whole group open.
+    let keep = |p: &u32| if *p == 4 { Permissions { closable: false, ..Permissions::default() } } else { Permissions::default() };
+    let before = workspace.clone();
+    assert_eq!(workspace.apply(Action::CloseGroup { panel: 4 }, keep), Err(DockError::NotAllowed));
+    assert_eq!(workspace, before);
+}
+
+#[test]
+fn panels_closed_one_by_one_reopen_into_one_group() {
+    let allow = |_: &u32| Permissions::default();
+    let rect = [100.0, 100.0, 300.0, 400.0];
+    let cycle = |workspace: &mut Workspace<u32>, close: &[u32], reopen: &[u32]| {
+        for &panel in close {
+            workspace.set_visible(panel, false, None, allow).unwrap();
+        }
+        for &panel in reopen {
+            workspace.set_visible(panel, true, None, allow).unwrap_or_else(|e| panic!("{close:?} {reopen:?} {panel}: {e}"));
+        }
+        assert!(workspace.hidden.is_empty());
+    };
+    let orders2 = [[2, 3], [3, 2]];
+    for close in orders2 {
+        for reopen in orders2 {
+            let mut workspace = Workspace::new(docked());
+            cycle(&mut workspace, &close, &reopen);
+            let columns = dock(&workspace.layout, Side::End);
+            assert_eq!(
+                columns.iter().map(|c| panels_of(&c.groups)).collect::<Vec<_>>(),
+                [vec![vec![2, 3], vec![4]], vec![vec![5]]],
+                "{close:?} {reopen:?}"
+            );
+        }
+    }
+    let orders2 = [[10, 20], [20, 10]];
+    for close in orders2 {
+        for reopen in orders2 {
+            let mut workspace = Workspace::new(Layout { root: Some(tabs(&[1], 0)), floating: vec![Floating::single(vec![10, 20], 0, rect)] });
+            cycle(&mut workspace, &close, &reopen);
+            let [window] = &workspace.layout.floating[..] else { panic!("{close:?} {reopen:?}: {:?}", workspace.layout.floating) };
+            assert_eq!((window.panels().copied().collect::<Vec<_>>(), window.rect), (vec![10, 20], rect), "{close:?} {reopen:?}");
+        }
+    }
+    // Three tabs: the locations do not always record the order, only the window.
+    let orders3 = [[10, 20, 30], [10, 30, 20], [20, 10, 30], [20, 30, 10], [30, 10, 20], [30, 20, 10]];
+    for close in orders3 {
+        for reopen in orders3 {
+            let mut workspace = Workspace::new(Layout { root: Some(tabs(&[1], 0)), floating: vec![Floating::single(vec![10, 20, 30], 0, rect)] });
+            cycle(&mut workspace, &close, &reopen);
+            let [window] = &workspace.layout.floating[..] else { panic!("{close:?} {reopen:?}: {:?}", workspace.layout.floating) };
+            let mut panels: Vec<u32> = window.panels().copied().collect();
+            panels.sort_unstable();
+            assert_eq!(panels, [10, 20, 30], "{close:?} {reopen:?}");
+        }
+    }
+}
+
+#[test]
+fn a_panel_reopened_through_a_hidden_neighbour_keeps_its_own_group_state() {
+    let allow = |_: &u32| Permissions::default();
+    let dock_of = |columns: Vec<Column<u32>>| Layout {
+        root: Some(hsplit(SplitSize::FixedSecond(480.0), tabs(&[1], 0), Node::Dock { side: Side::End, columns })),
+        floating: Vec::new(),
+    };
+    // Groups [2] and [3] stacked with their own heights: 2 comes back at its height, not 3's.
+    let stacked = dock_of(vec![
+        Column::new(vec![Group { height: Some(120.0), ..g(&[2], 0) }, Group { height: Some(300.0), ..g(&[3], 0) }], 240.0),
+        Column::new(vec![g(&[5], 0)], 240.0),
+    ]);
+    let mut workspace = Workspace::new(stacked);
+    workspace.set_visible(2, false, None, allow).unwrap();
+    workspace.set_visible(3, false, None, allow).unwrap();
+    workspace.set_visible(2, true, None, allow).unwrap();
+    let group = |w: &Workspace<u32>, panel: u32| {
+        dock(&w.layout, Side::End).iter().flat_map(|c| c.groups.iter()).find(|g| g.panels.contains(&panel)).cloned().unwrap()
+    };
+    assert_eq!(group(&workspace, 2).height, Some(120.0), "{:?}", workspace.layout);
+    workspace.set_visible(3, true, None, allow).unwrap();
+    assert_eq!(group(&workspace, 3).height, Some(300.0), "{:?}", workspace.layout);
+
+    // [2] beside an icon-only column holding [3]: 2 comes back in a column of its own width,
+    // not as an icon.
+    let iconic = Column { iconic: true, ..Column::new(vec![g(&[3], 0)], 200.0) };
+    let mut workspace = Workspace::new(dock_of(vec![Column::new(vec![g(&[2], 0)], 260.0), iconic]));
+    workspace.set_visible(2, false, None, allow).unwrap();
+    workspace.set_visible(3, false, None, allow).unwrap();
+    workspace.set_visible(2, true, None, allow).unwrap();
+    let column = dock(&workspace.layout, Side::End).iter().find(|c| c.groups.iter().any(|g| g.panels.contains(&2))).cloned().unwrap();
+    assert!(!column.iconic, "{:?}", workspace.layout);
+    assert_eq!(column.width, 260.0);
+}
+
+#[test]
+fn panels_closed_one_by_one_reopen_on_their_own_sides() {
+    let allow = |_: &u32| Permissions::default();
+    let orders = [[2, 3], [3, 2]];
+    let frames = Layout {
+        root: Some(hsplit(SplitSize::Ratio(0.3), tabs(&[1], 0), hsplit(SplitSize::Ratio(0.5), tabs(&[2], 0), tabs(&[3], 0)))),
+        floating: Vec::new(),
+    };
+    let columns = Layout {
+        root: Some(hsplit(
+            SplitSize::FixedSecond(480.0),
+            tabs(&[1], 0),
+            Node::Dock { side: Side::End, columns: vec![Column::new(vec![g(&[2], 0)], 240.0), Column::new(vec![g(&[3], 0)], 240.0)] },
+        )),
+        floating: Vec::new(),
+    };
+    for close in orders {
+        for reopen in orders {
+            let mut workspace = Workspace::new(frames.clone());
+            for (panel, visible) in close.iter().map(|p| (*p, false)).chain(reopen.iter().map(|p| (*p, true))) {
+                workspace.set_visible(panel, visible, None, allow).unwrap();
+            }
+            let order: Vec<u32> = workspace.layout.panels().into_iter().copied().collect();
+            assert_eq!(order, [1, 2, 3], "{close:?} {reopen:?}: {:?}", workspace.layout);
+            assert!(order.iter().all(|p| matches!(workspace.layout.place(p), Some(Place::Node(_)))));
+            assert_ne!(workspace.layout.place(&2), workspace.layout.place(&3), "{close:?} {reopen:?}");
+
+            let mut workspace = Workspace::new(columns.clone());
+            for (panel, visible) in close.iter().map(|p| (*p, false)).chain(reopen.iter().map(|p| (*p, true))) {
+                workspace.set_visible(panel, visible, None, allow).unwrap();
+            }
+            let groups: Vec<_> = dock(&workspace.layout, Side::End).iter().map(|c| panels_of(&c.groups)).collect();
+            assert_eq!(groups, [vec![vec![2]], vec![vec![3]]], "{close:?} {reopen:?}");
+        }
+    }
+    // A panel that sat at the edge beside a hidden one keeps that one's own location: 3 opens
+    // right of 1, not as a tab beside 2.
+    let mut workspace = Workspace::new(Layout { root: Some(tabs(&[1], 0)), floating: Vec::new() });
+    let at = |anchor: u32, placement: Placement<u32>| Location {
+        floating: None,
+        anchor: Some(anchor),
+        placement,
+        size: None,
+        stack: None,
+        sibling: Vec::new(),
+        group: None,
+    };
+    workspace.hidden = vec![(2, at(3, Placement::Edge(Zone::Right))), (3, at(1, Placement::Split(Zone::Right)))];
+    workspace.set_visible(2, true, None, allow).unwrap();
+    workspace.set_visible(3, true, None, allow).unwrap();
+    assert!(matches!(workspace.layout.place(&3), Some(Place::Node(_))));
+    assert_ne!(workspace.layout.place(&2), workspace.layout.place(&3), "{:?}", workspace.layout);
+    // Past the edge frame the chain keeps its forward anchors: 4 does not anchor on 3 while 3
+    // anchors on 4, and both still reopen.
+    let mut workspace = Workspace::new(Layout { root: Some(tabs(&[1], 0)), floating: Vec::new() });
+    workspace.hidden =
+        vec![(2, at(3, Placement::Edge(Zone::Right))), (3, at(4, Placement::Split(Zone::Right))), (4, at(1, Placement::Split(Zone::Right)))];
+    workspace.set_visible(2, true, None, allow).unwrap();
+    assert_eq!(workspace.hidden.iter().find(|(p, _)| *p == 4).and_then(|(_, l)| l.anchor), Some(1), "{:?}", workspace.hidden);
+    workspace.set_visible(3, true, None, allow).unwrap();
+    workspace.set_visible(4, true, None, allow).unwrap();
+    assert!(workspace.hidden.is_empty() && [1, 2, 3, 4].iter().all(|p| workspace.layout.contains(p)), "{:?}", workspace.layout);
+}
+
+#[test]
+fn restore_into_a_column_group_seam_and_new_column_round_trips() {
+    let column_a = Column::new(vec![g(&[2, 3], 1), Group { minimized: true, height: Some(150.0), ..g(&[4], 0) }, g(&[9], 0)], 180.0);
+    let column_b = Column { iconic: true, iconic_width: Some(48.0), ..Column::new(vec![g(&[5], 0)], 120.0) };
+    let end = Node::Dock { side: Side::End, columns: vec![column_a, column_b] };
+    let start = Node::Dock { side: Side::Start, columns: vec![Column::new(vec![g(&[10], 0)], 200.0)] };
+    let original = Layout {
+        root: Some(hsplit(SplitSize::FixedFirst(200.0), start, hsplit(SplitSize::FixedSecond(300.0), tabs(&[1], 0), end))),
+        floating: vec![Floating::stack(vec![g(&[6], 0), Group { height: Some(90.0), ..g(&[7], 0) }], [10.0, 10.0, 200.0, 300.0]).unwrap()],
+    };
+    original.validate().unwrap();
+    // 4: the seam between [2, 3] and [9]; 9: below [4]; 5: a new column after A; 10: alone in
+    // its dock; 3: a tab; 7: below a floating group.
+    for panel in [4, 9, 5, 10, 3, 7] {
+        let mut layout = original.clone();
+        let location = layout.location(&panel).unwrap();
+        #[cfg(feature = "serde")]
+        let location: Location<u32> = serde_json::from_str(&serde_json::to_string(&location).unwrap()).unwrap();
+        layout.apply(Action::Close { panel }).unwrap();
+        layout.restore(panel, &location).unwrap_or_else(|e| panic!("{panel}: {e} {location:?}"));
+        assert_eq!(layout, original, "{panel}: {location:?}");
+    }
+}
+
+#[test]
+fn dock_validation_rejects_two_docks_per_side_nested_docks_empty_columns_and_bad_widths() {
+    docked().validate().unwrap();
+    let empty_dock = |side| Node::Dock { side, columns: Vec::new() };
+    Layout { root: Some(hsplit(SplitSize::FixedFirst(10.0), empty_dock(Side::Start), tabs(&[1], 0))), floating: Vec::new() }.validate().unwrap();
+
+    let two = hsplit(SplitSize::Ratio(0.5), empty_dock(Side::Start), empty_dock(Side::Start));
+    let nested = Node::Split {
+        axis: SplitAxis::Vertical,
+        size: SplitSize::Ratio(0.5),
+        first: Box::new(empty_dock(Side::Start)),
+        second: Box::new(tabs(&[1], 0)),
+    };
+    let wrong_side = hsplit(SplitSize::Ratio(0.5), empty_dock(Side::End), tabs(&[1], 0));
+    for root in [two, nested, wrong_side] {
+        assert_eq!(Layout { root: Some(root), floating: Vec::new() }.validate(), Err(DockError::InvalidPlacement));
+    }
+
+    let with_column = |column: Column<u32>| Layout { root: Some(Node::Dock { side: Side::End, columns: vec![column] }), floating: Vec::new() };
+    let bad = [
+        Column::new(Vec::new(), 100.0),
+        Column::new(vec![g(&[], 0)], 100.0),
+        Column::new(vec![g(&[2], 1)], 100.0),
+        Column::new(vec![Group { height: Some(f32::NAN), ..g(&[2], 0) }], 100.0),
+        Column::new(vec![g(&[2], 0)], 0.0),
+        Column::new(vec![g(&[2], 0)], -5.0),
+        Column::new(vec![g(&[2], 0)], f32::INFINITY),
+        Column::new(vec![g(&[2], 0)], 2.0e6),
+        Column { iconic_width: Some(f32::NAN), ..Column::new(vec![g(&[2], 0)], 100.0) },
+    ];
+    for column in bad {
+        assert!(with_column(column.clone()).validate().is_err(), "{column:?}");
+    }
+
+    let mut duplicate = docked();
+    duplicate.floating[0].root = Node::Tabs { panels: vec![6, 7, 2], active: 0 };
+    assert_eq!(duplicate.validate(), Err(DockError::DuplicatePanel));
+    let mut empty_window = docked();
+    empty_window.floating[0].root = Node::Tabs { panels: Vec::new(), active: 0 };
+    assert_eq!(empty_window.validate(), Err(DockError::InvalidGeometry));
+    let mut docked_window = docked();
+    docked_window.floating[0].root = Node::Dock { side: Side::End, columns: vec![Column::new(vec![g(&[6, 7], 0)], 100.0)] };
+    assert_eq!(docked_window.validate(), Err(DockError::InvalidPlacement));
+    let mut native = docked();
+    native.floating[0].native = Some([0.0, 0.0, -1.0, 10.0]);
+    assert_eq!(native.validate(), Err(DockError::InvalidGeometry));
+    let mut monitor = docked();
+    monitor.floating[0].monitor = Some(super::Monitor { name: None, rect: [0.0, 0.0, 1920.0, 1080.0], scale: f32::NAN });
+    assert_eq!(monitor.validate(), Err(DockError::InvalidGeometry));
+    let mut monitor_size = docked();
+    monitor_size.floating[0].monitor_size = Some([f32::NAN, 1080.0]);
+    assert_eq!(monitor_size.validate(), Err(DockError::InvalidGeometry));
+    let mut layout = docked();
+    assert_eq!(layout.apply(Action::ResizeColumn { panel: 2, width: f32::NAN }), Err(DockError::InvalidGeometry));
+    assert_eq!(layout.apply(Action::ResizeColumn { panel: 11, width: 50.0 }), Err(DockError::InvalidPlacement));
+    assert_eq!(layout, docked());
+}
+
+#[test]
+fn a_locked_workspace_records_its_native_windows() {
+    let mut workspace = Workspace::new(docked());
+    workspace.locked = true;
+    for rect in [[0.0, 0.0, 300.0, 400.0], [40.0, 30.0, 300.0, 400.0]] {
+        workspace.apply(Action::SetNative { panel: 6, rect: Some(rect) }, |_| Permissions::default()).unwrap();
+        assert_eq!(workspace.layout.floating[0].native, Some(rect));
+    }
+}
+
+#[test]
+fn locked_workspace_rejects_structure_but_allows_activate_open_minimize_and_resize() {
+    let mut workspace = Workspace::new(docked());
+    let allow = |_: &u32| Permissions::default();
+    workspace.apply(Action::Close { panel: 12 }, allow).unwrap();
+    workspace.locked = true;
+    let before = workspace.clone();
+    let refused = [
+        Action::Move { panel: 2, anchor: 5, placement: Placement::Tab { before: None } },
+        Action::MoveGroup { panel: 2, to: Target::Float { rect: None } },
+        Action::MoveColumn { panel: 5, to: Target::NewDock { side: Side::Start } },
+        Action::MoveWindow { panel: 6, to: Target::At { anchor: 4, placement: Placement::Group { below: true, height: None } } },
+        Action::Float { panel: 4, rect: [0.0, 0.0, 100.0, 100.0] },
+        Action::MoveFloating { panel: 6, rect: [0.0, 0.0, 100.0, 100.0] },
+        Action::Close { panel: 4 },
+        Action::CloseGroup { panel: 4 },
+        Action::CloseWindow { panel: 6 },
+    ];
+    for action in refused {
+        assert_eq!(workspace.apply(action.clone(), allow), Err(DockError::NotAllowed), "{action:?}");
+        assert_eq!(workspace, before);
+    }
+    assert_eq!(workspace.set_visible(4, false, None, |_| Permissions::default()), Err(DockError::NotAllowed));
+    let allowed = [
+        Action::Activate { panel: 2 },
+        Action::Open { panel: 12, anchor: Some(11) },
+        Action::SetMinimized { panel: 4, minimized: true },
+        Action::SetIconic { panel: 5, iconic: true },
+        Action::ResizeColumn { panel: 5, width: 160.0 },
+        Action::ResizeGroup { panel: 4, height: Some(120.0) },
+        Action::ResizeIconic { panel: 5, width: Some(60.0) },
+        Action::ResizeSplit { path: Vec::new(), size: SplitSize::FixedSecond(320.0) },
+    ];
+    workspace.apply_all(allowed, allow).unwrap();
+    assert!(workspace.hidden.is_empty());
+    assert_eq!(workspace.layout.panel_state(&12), PanelState::Front);
+    assert_eq!(workspace.layout.panel_state(&4), PanelState::Open);
+    assert_eq!(workspace.layout.panel_state(&5), PanelState::Open);
+    assert_eq!(workspace.layout.panel_state(&2), PanelState::Front);
+    assert_eq!(workspace.layout.panel_state(&3), PanelState::Open);
+    // Opening at a chosen place works too; moving a shown panel there does not.
+    workspace.apply(Action::OpenAt { panel: 13, anchor: 11, placement: Placement::Split(Zone::Bottom) }, allow).unwrap();
+    assert!(workspace.layout.contains(&13));
+    assert_eq!(
+        workspace.apply(Action::OpenAt { panel: 2, anchor: 11, placement: Placement::Split(Zone::Bottom) }, allow),
+        Err(DockError::NotAllowed)
+    );
+}
+
+#[test]
+fn hiding_a_panel_that_may_not_close_is_refused() {
+    let mut workspace = Workspace::new(docked());
+    let canvas = |p: &u32| if *p == 1 { Permissions { accepts_splits: true, ..Permissions::PROTECTED } } else { Permissions::default() };
+    assert_eq!(workspace.set_visible(1, false, None, canvas), Err(DockError::NotAllowed));
+    assert!(workspace.layout.contains(&1) && workspace.hidden.is_empty());
+    workspace.set_visible(2, false, None, canvas).unwrap();
+    assert!(!workspace.layout.contains(&2));
+}
+
+#[test]
+fn reconcile_drops_unknown_panels_and_places_missing_registered_ones() {
+    let default = Workspace::new(docked());
+    let mut workspace = default.clone();
+    workspace.layout.apply(Action::Close { panel: 5 }).unwrap();
+    workspace.layout.apply(Action::Close { panel: 12 }).unwrap();
+    workspace.layout.apply(Action::OpenAt { panel: 99, anchor: 2, placement: Placement::Tab { before: None } }).unwrap();
+    let stray = workspace.layout.location(&99).unwrap();
+    workspace.hidden.push((98, stray));
+    let registered = |p: &u32| *p < 90;
+    workspace.reconcile(registered, |_| Permissions::default(), &default);
+    workspace.validate().unwrap();
+    // Unregistered panels wait in `hidden` and come back once registered.
+    assert_eq!(workspace.hidden.iter().map(|(p, _)| *p).collect::<Vec<_>>(), [98, 99]);
+    assert_eq!(sorted(&workspace.layout), ALL);
+    workspace.set_visible(99, true, None, |_| Permissions::default()).unwrap();
+    assert_eq!(group_state(&workspace.layout, 2).0, [2, 3, 99]);
+    assert_eq!(dock(&workspace.layout, Side::End).len(), 2);
+    assert_eq!(group_state(&workspace.layout, 11).0, [11, 12]);
+
+    let mut broken = default.clone();
+    broken.layout.floating[0].rect[2] = -1.0;
+    broken.reconcile(registered, |_| Permissions::default(), &default);
+    assert_eq!(broken.layout, default.layout);
+}
+
+#[test]
+fn reset_returns_to_saved_or_default() {
+    let default = docked();
+    let mut workspace = Workspace::new(default.clone());
+    workspace.apply(Action::MoveGroup { panel: 6, to: Target::NewDock { side: Side::Start } }, |_| Permissions::default()).unwrap();
+    workspace.reset(&default);
+    assert_eq!(workspace.layout, default);
+
+    let mut saved = default.clone();
+    saved.apply(Action::Close { panel: 8 }).unwrap();
+    saved.apply(Action::MoveGroup { panel: 11, to: Target::Float { rect: None } }).unwrap();
+    workspace.saved = Some(saved.clone());
+    workspace.reset(&default);
+    assert_eq!(workspace.layout, saved);
+    assert_eq!(workspace.hidden.iter().map(|(p, _)| *p).collect::<Vec<_>>(), [8]);
+    workspace.validate().unwrap();
+}
+
+#[cfg(feature = "serde")]
+mod serde_tests {
+    use super::*;
+    use serde_json::{Value, json};
+
+    #[test]
+    fn a_saved_stack_of_groups_loads_as_a_vertical_split_by_their_heights() {
+        let saved = json!({
+            "groups": [{"panels": [4], "active": 0, "height": 100.0}, {"panels": [5, 6], "active": 1, "height": 300.0}],
+            "rect": [1.0, 2.0, 300.0, 400.0],
+        });
+        let window: Floating<u32> = serde_json::from_value(saved).unwrap();
+        let expected = Node::Split {
+            axis: SplitAxis::Vertical,
+            size: SplitSize::Ratio(0.25),
+            first: Box::new(Node::Tabs { panels: vec![4], active: 0 }),
+            second: Box::new(Node::Tabs { panels: vec![5, 6], active: 1 }),
+        };
+        assert_eq!((window.root, window.minimized), (expected, false));
+        let all_minimized = json!({"groups": [{"panels": [4], "active": 0, "minimized": true}], "rect": [1.0, 2.0, 300.0, 400.0]});
+        let window: Floating<u32> = serde_json::from_value(all_minimized).unwrap();
+        assert_eq!((window.root, window.minimized), (Node::Tabs { panels: vec![4], active: 0 }, true));
+    }
+
+    #[test]
+    fn single_plain_floating_window_writes_the_v1_shape() {
+        let rect = [1.0, 2.0, 300.0, 200.0];
+        let plain = Floating::single(vec![4u32, 5], 1, rect);
+        assert_eq!(serde_json::to_value(&plain).unwrap(), json!({"id": plain.id, "panels": [4, 5], "active": 1, "rect": rect}));
+        let minimized = Floating { minimized: true, ..Floating::single(vec![4u32], 0, rect) };
+        let stacked = Floating::stack(vec![g(&[4], 0), g(&[5], 0)], rect).unwrap();
+        let native = Floating { native: Some(rect), ..Floating::single(vec![4u32], 0, rect) };
+        for window in [minimized, stacked, native] {
+            let value = serde_json::to_value(&window).unwrap();
+            assert!(value.get("root").is_some() && value.get("panels").is_none(), "{value}");
+            assert_eq!(value["id"], json!(window.id), "{value}");
+            assert_eq!(serde_json::from_value::<Floating<u32>>(value).unwrap(), window);
+        }
+        assert!(serde_json::from_value::<Floating<u32>>(json!({"rect": rect})).is_err());
+    }
+
+    #[test]
+    fn in_window_windows_keep_their_ids_through_a_save() {
+        let rect = [1.0, 2.0, 300.0, 200.0];
+        let layout = Layout {
+            root: None,
+            floating: vec![Floating::single(vec![4u32], 0, rect).with_id(7), Floating::stack(vec![g(&[5], 0), g(&[6], 0)], rect).unwrap().with_id(8)],
+        };
+        let saved = serde_json::to_string(&layout).unwrap();
+        let loaded: Layout<u32> = serde_json::from_str(&saved).unwrap();
+        assert_eq!(loaded, layout);
+        assert_eq!(loaded.floating.iter().map(|w| w.id).collect::<Vec<_>>(), [7, 8]);
+    }
+
+    #[test]
+    fn v2_round_trips() {
+        let mut workspace = Workspace::new(docked());
+        workspace.apply(Action::CloseGroup { panel: 4 }, |_| Permissions::default()).unwrap();
+        workspace.apply(Action::SetNative { panel: 8, rect: Some([5.0, 5.0, 400.0, 300.0]) }, |_| Permissions::default()).unwrap();
+        workspace.saved = Some(docked());
+        workspace.locked = true;
+        let text = serde_json::to_string(&workspace).unwrap();
+        let parsed: Workspace<u32> = serde_json::from_str(&text).unwrap();
+        assert_eq!(parsed, workspace);
+        assert_eq!(serde_json::from_str::<Value>(&text).unwrap()["version"], json!(2));
+
+        let mut old = parsed.clone();
+        old.version = 1;
+        let mut value = serde_json::to_value(&old).unwrap();
+        value.as_object_mut().unwrap().remove("version");
+        assert_eq!(serde_json::from_value::<Workspace<u32>>(value).unwrap().version, 1);
+        old.version = 3;
+        assert_eq!(old.validate(), Err(DockError::UnsupportedVersion));
+    }
+
+    #[derive(Clone, Copy, Debug)]
+    enum Kind {
+        Layout,
+        Workspace,
+        Hidden,
+    }
+
+    /// App, file contents, and the JSON pointers to its docking values.
+    type Fixture = (&'static str, &'static str, &'static [(&'static str, Kind)]);
+
+    #[test]
+    fn v1_layout_json_parses_unchanged() {
+        use Kind::*;
+        let fixtures: [Fixture; 7] = [
+            (
+                "designcraft",
+                include_str!("../../tests/fixtures/v1/designcraft.json"),
+                &[
+                    ("/docking", Layout),
+                    ("/dockingHidden", Hidden),
+                    ("/customWorkspaces/0/docking", Layout),
+                    ("/customWorkspaces/0/dockingHidden", Hidden),
+                ],
+            ),
+            ("vectorcraft", include_str!("../../tests/fixtures/v1/vectorcraft.json"), &[("/docking", Layout), ("/docking_hidden", Hidden)]),
+            ("lightcraft", include_str!("../../tests/fixtures/v1/lightcraft.json"), &[("/docking", Workspace)]),
+            ("pdfcraft", include_str!("../../tests/fixtures/v1/pdfcraft.json"), &[("/docking", Workspace)]),
+            ("cadcraft", include_str!("../../tests/fixtures/v1/cadcraft.json"), &[("/workspace/docking", Workspace)]),
+            ("soundcraft", include_str!("../../tests/fixtures/v1/soundcraft.json"), &[("/docking", Workspace), ("/mix_docking", Workspace)]),
+            (
+                "photocraft",
+                include_str!("../../tests/fixtures/v1/photocraft.json"),
+                &[("/docking", Layout), ("/docking_hidden", Hidden), ("/panel_layout/docking", Layout), ("/panel_layout/dockingHidden", Hidden)],
+            ),
+        ];
+        for (app, text, fields) in fixtures {
+            let file: Value = serde_json::from_str(text).unwrap();
+            for (pointer, kind) in fields {
+                let value = file.pointer(pointer).unwrap_or_else(|| panic!("{app}{pointer}")).clone();
+                let layout_value = match kind {
+                    Layout => value.clone(),
+                    Workspace => value["layout"].clone(),
+                    Hidden => {
+                        let hidden: std::collections::BTreeMap<String, Location<String>> = serde_json::from_value(value).unwrap();
+                        assert!(!hidden.is_empty(), "{app}{pointer}");
+                        continue;
+                    }
+                };
+                if let Workspace = kind {
+                    let workspace: super::Workspace<String> = serde_json::from_value(value).unwrap_or_else(|e| panic!("{app}{pointer}: {e}"));
+                    workspace.validate().unwrap_or_else(|e| panic!("{app}{pointer}: {e}"));
+                    assert_eq!(workspace.version, 1);
+                    for (panel, location) in &workspace.hidden {
+                        let mut layout = workspace.layout.clone();
+                        layout.restore(panel.clone(), location).unwrap_or_else(|e| panic!("{app}{pointer} {panel}: {e}"));
+                    }
+                }
+                let layout: super::Layout<String> = serde_json::from_value(layout_value.clone()).unwrap_or_else(|e| panic!("{app}{pointer}: {e}"));
+                layout.validate().unwrap_or_else(|e| panic!("{app}{pointer}: {e}"));
+                // Nothing new is in use, so the layout writes back exactly as read, plus the
+                // fresh id of each floating window.
+                let mut written = serde_json::to_value(&layout).unwrap();
+                for (window, value) in layout.floating.iter().zip(written["floating"].as_array_mut().unwrap()) {
+                    assert_eq!(value.as_object_mut().unwrap().remove("id"), Some(json!(window.id)), "{app}{pointer}");
+                }
+                assert_eq!(written, layout_value, "{app}{pointer}");
+            }
+        }
+    }
+
+    #[test]
+    fn every_app_fixture_reconciles_with_its_canvas_shown() {
+        let s = |p: &str| p.to_owned();
+        let permissions = |p: &String| if p == "canvas" { Permissions::PROTECTED } else { Permissions::default() };
+        // The canvas between a start dock and the properties, which no fixture matches exactly.
+        let beside = super::Layout {
+            root: Some(Node::Split {
+                axis: SplitAxis::Horizontal,
+                size: SplitSize::FixedFirst(240.0),
+                first: Box::new(Node::Dock {
+                    side: Side::Start,
+                    columns: vec![Column::new(vec![Group::new(vec![s("layers"), s("pages")], 0)], 240.0)],
+                }),
+                second: Box::new(Node::Split {
+                    axis: SplitAxis::Horizontal,
+                    size: SplitSize::Ratio(0.75),
+                    first: Box::new(Node::Tabs { panels: vec![s("canvas")], active: 0 }),
+                    second: Box::new(Node::Tabs { panels: vec![s("properties"), s("stroke")], active: 0 }),
+                }),
+            }),
+            floating: Vec::new(),
+        };
+        // The canvas with no anchor to go back beside.
+        let alone = super::Layout { root: Some(Node::Tabs { panels: vec![s("canvas")], active: 0 }), floating: Vec::new() };
+        let fixtures = [
+            ("designcraft", include_str!("../../tests/fixtures/v1/designcraft.json"), "/docking"),
+            ("designcraft", include_str!("../../tests/fixtures/v1/designcraft.json"), "/customWorkspaces/0/docking"),
+            ("vectorcraft", include_str!("../../tests/fixtures/v1/vectorcraft.json"), "/docking"),
+            ("lightcraft", include_str!("../../tests/fixtures/v1/lightcraft.json"), "/docking/layout"),
+            ("pdfcraft", include_str!("../../tests/fixtures/v1/pdfcraft.json"), "/docking/layout"),
+            ("cadcraft", include_str!("../../tests/fixtures/v1/cadcraft.json"), "/workspace/docking/layout"),
+            ("soundcraft", include_str!("../../tests/fixtures/v1/soundcraft.json"), "/docking/layout"),
+            ("soundcraft", include_str!("../../tests/fixtures/v1/soundcraft.json"), "/mix_docking/layout"),
+            ("photocraft", include_str!("../../tests/fixtures/v1/photocraft.json"), "/docking"),
+            ("photocraft", include_str!("../../tests/fixtures/v1/photocraft.json"), "/panel_layout/docking"),
+        ];
+        for (app, text, pointer) in fixtures {
+            let file: Value = serde_json::from_str(text).unwrap();
+            let mut saved: super::Layout<String> = serde_json::from_value(file.pointer(pointer).unwrap().clone()).unwrap();
+            let own = saved.contains(&s("canvas")).then(|| saved.clone());
+            saved.take(&s("canvas"));
+            for default in own.iter().chain([&beside, &alone]) {
+                let mut workspace = super::Workspace::new(saved.clone());
+                // A file written while the canvas could still be lost.
+                if let Ok(location) = default.location(&s("canvas")) {
+                    workspace.hidden.push((s("canvas"), location));
+                }
+                for mut workspace in [super::Workspace::new(saved.clone()), workspace] {
+                    workspace.reconcile(|_| true, permissions, &super::Workspace::new(default.clone()));
+                    workspace.validate().unwrap_or_else(|e| panic!("{app}{pointer}: {e}"));
+                    assert!(workspace.layout.contains(&s("canvas")), "{app}{pointer}: {:?}", workspace.layout);
+                    assert!(workspace.hidden.iter().all(|(p, _)| p != "canvas"), "{app}{pointer}");
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn edge_placement_splits_the_part_between_the_docks_or_the_root() {
+    // Dock layout: a floating window lands under the frames, beside the end dock.
+    let mut layout = docked();
+    layout.apply(Action::MoveWindow { panel: 6, to: Target::At { anchor: 1, placement: Placement::Edge(Zone::Bottom) } }).unwrap();
+    let Some(Node::Split { first, second, .. }) = &layout.root else { panic!("{layout:?}") };
+    assert!(matches!(&**second, Node::Dock { .. }));
+    let Node::Split { axis: SplitAxis::Vertical, size: SplitSize::Ratio(size), second: bottom, .. } = &**first else { panic!("{first:?}") };
+    assert_eq!(*size, 0.75);
+    assert_eq!(**bottom, tabs(&[6, 7, 8], 1));
+    assert!(layout.floating.is_empty());
+
+    // Frame layout: one panel takes the whole left edge.
+    let mut frames = Layout { root: Some(hsplit(SplitSize::Ratio(0.5), tabs(&[1], 0), tabs(&[2, 3], 0))), floating: Vec::new() };
+    frames.apply(Action::Move { panel: 3, anchor: 1, placement: Placement::Edge(Zone::Left) }).unwrap();
+    let Some(Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::Ratio(size), first, .. }) = &frames.root else { panic!() };
+    assert_eq!((*size, &**first), (0.25, &tabs(&[3], 0)));
+
+    let before = frames.clone();
+    assert_eq!(frames.apply(Action::Move { panel: 2, anchor: 1, placement: Placement::Edge(Zone::Center) }), Err(DockError::InvalidPlacement));
+    assert_eq!(frames, before);
+}
+
+#[test]
+fn a_sized_split_sets_the_new_split_and_the_enclosing_one_beside_the_anchor() {
+    // 1 | (2 | 3): 4 goes left of 3, and the split between 2 and 3 gives the room.
+    let layout = Layout {
+        root: Some(hsplit(SplitSize::Ratio(0.5), tabs(&[1], 0), hsplit(SplitSize::FixedSecond(60.0), tabs(&[2], 0), tabs(&[3], 0)))),
+        floating: vec![Floating::single(vec![4], 0, [0.0, 0.0, 100.0, 100.0])],
+    };
+    let sized = |zone| Placement::SplitSized { zone, size: SplitSize::FixedFirst(100.0), outer: SplitSize::FixedSecond(164.0) };
+    let mut moved = layout.clone();
+    moved.apply(Action::Move { panel: 4, anchor: 3, placement: sized(Zone::Left) }).unwrap();
+    let inner = hsplit(SplitSize::FixedSecond(164.0), tabs(&[2], 0), hsplit(SplitSize::FixedFirst(100.0), tabs(&[4], 0), tabs(&[3], 0)));
+    assert_eq!(moved.root, Some(hsplit(SplitSize::Ratio(0.5), tabs(&[1], 0), inner)));
+    // 1 has no divider on its left: the split on its right gives the room.
+    let mut moved = layout.clone();
+    moved.apply(Action::Move { panel: 4, anchor: 1, placement: sized(Zone::Left) }).unwrap();
+    let rest = hsplit(SplitSize::FixedSecond(60.0), tabs(&[2], 0), tabs(&[3], 0));
+    assert_eq!(moved.root, Some(hsplit(SplitSize::FixedSecond(164.0), hsplit(SplitSize::FixedFirst(100.0), tabs(&[4], 0), tabs(&[1], 0)), rest)));
+    // 1 has no divider above or below it, and a center is no side.
+    for (anchor, zone) in [(1, Zone::Top), (3, Zone::Center)] {
+        let mut moved = layout.clone();
+        assert_eq!(moved.apply(Action::Move { panel: 4, anchor, placement: sized(zone) }), Err(DockError::InvalidPlacement), "{anchor} {zone:?}");
+        assert_eq!(moved, layout);
+    }
+}
diff --git a/crates/ui/src/docking/native_tests.rs b/crates/ui/src/docking/native_tests.rs
new file mode 100644
index 00000000..f872ddae
--- /dev/null
+++ b/crates/ui/src/docking/native_tests.rs
@@ -0,0 +1,2767 @@
+//! Floating windows in their own OS windows (feature `native-windows`), drawn by the driver's
+//! stand-in for OS windows.
+
+use egui::{Color32, Event, Key, Modifiers, PointerButton, Pos2, Rect, ViewportCommand, epaint::ClippedShape, pos2, vec2};
+
+use super::render::{
+    APPKIT_CORNER, DragPointer, INACTIVE_PALETTE, MACOS_CLOSE, WindowDrag, appkit_resize_areas, close_rects, drag_opacity, resize_bands, wayland,
+};
+use super::testing::DockDriver;
+use super::{Action, DockContent, Floating, Hit, Layout, Monitor, Node, Permissions, Placement, Target, WindowKind, Workspace};
+use crate::layout::{SplitAxis, SplitSize};
+
+/// Desktop position of the main window's content.
+const ORIGIN: Pos2 = pos2(100.0, 50.0);
+
+#[derive(Default)]
+struct Content {
+    /// Panels that may not close.
+    fixed: Vec<u32>,
+    /// The protected canvas that takes splits beside it, as PhotoCraft's does.
+    canvas: Option<u32>,
+    /// Panels that stay in-window.
+    in_window: Vec<u32>,
+    /// Viewer panels: their windows are normal windows.
+    normal: Vec<u32>,
+    /// The panel with a text field, what it holds, and whether it takes focus next frame.
+    text: Option<u32>,
+    typed: String,
+    focus_text: bool,
+    /// The text field gives up keyboard focus on the next frame.
+    blur_text: bool,
+    /// The panel with a button that takes focus.
+    focused_button: Option<u32>,
+    /// The panel with a counter button, its clicks, and where it was drawn.
+    counter: Option<u32>,
+    count: usize,
+    counter_rect: Option<Rect>,
+    /// Pointer buttons pressed in each panel's body.
+    pressed: Vec<(u32, PointerButton)>,
+    /// A panel body saw hovered or dropped files.
+    saw_files: bool,
+    /// Input visible to a selected panel, including native control events while blocked.
+    input_probe: Option<u32>,
+    events: Vec<Event>,
+    raw_events: Vec<Event>,
+    /// The panel with an app drag source, and where it was drawn.
+    source: Option<u32>,
+    /// How the source marks its drag as one that carries something.
+    marks: Marks,
+    source_rect: Option<Rect>,
+    /// The source's drag so far, and how often its drag stopped.
+    source_delta: egui::Vec2,
+    source_stopped: usize,
+    /// How often the source's body saw a primary-button release in its input.
+    source_releases: usize,
+    /// The source asks egui to run its window's pass again, once, the next time it draws.
+    discard_next: bool,
+    /// The source asks for that many more passes, drawn or not, before the frame completes.
+    discard_passes: usize,
+    /// A drop site asks for its window's pass again when it reads a release.
+    discard_drop: bool,
+    /// Panels whose bodies are app drop sites: where each saw the pointer, and where a release
+    /// came with the pointer inside.
+    drop_sites: Vec<u32>,
+    hovers: Vec<(u32, Pos2)>,
+    drops: Vec<(u32, Pos2)>,
+    /// Drop sites whose release found egui's drag-and-drop payload.
+    payload_drops: Vec<u32>,
+    /// Key and clipboard events panel 1 saw in the main window, and the text field's panel in
+    /// its own window.
+    main_keys: Vec<Event>,
+    field_keys: Vec<Event>,
+}
+
+/// How a test's app drag source marks its drag.
+#[derive(Default)]
+enum Marks {
+    /// It does not: a plain egui drag, such as a slider's.
+    #[default]
+    Nothing,
+    /// [`super::route_app_drag`] for this area, each frame while it drags.
+    Route(egui::Id),
+    /// An egui drag-and-drop payload, its panel.
+    Payload,
+}
+
+impl DockContent<u32> for Content {
+    /// Test body that probes native input: records events/raw events, text focus and typing, button
+    /// focus, a click counter, drag source state, drop sites and payloads, file hover/drop, and
+    /// primary/secondary presses inside the body.
+    fn body(&mut self, ui: &mut egui::Ui, panel: &u32) {
+        ui.label(format!("panel {panel}"));
+        if self.input_probe == Some(*panel) {
+            (self.events, self.raw_events) = ui.input(|i| (i.events.clone(), i.raw.events.clone()));
+        }
+        if self.text == Some(*panel) {
+            let field = ui.text_edit_singleline(&mut self.typed);
+            if std::mem::take(&mut self.focus_text) {
+                field.request_focus();
+            }
+            if std::mem::take(&mut self.blur_text) {
+                field.surrender_focus();
+            }
+        }
+        if self.focused_button == Some(*panel) {
+            ui.button("OK").request_focus();
+        }
+        if self.counter == Some(*panel) {
+            let response = ui.button("Add");
+            self.count += usize::from(response.clicked());
+            self.counter_rect = Some(response.rect);
+        }
+        if self.source == Some(*panel) {
+            let response = ui.allocate_response(vec2(120.0, 60.0), egui::Sense::drag());
+            self.source_rect = Some(response.rect);
+            self.source_delta += response.drag_delta();
+            self.source_stopped += usize::from(response.drag_stopped());
+            self.source_releases += usize::from(ui.input(|i| i.pointer.primary_released()));
+            let discard = std::mem::take(&mut self.discard_next);
+            let more = self.discard_passes > 0;
+            if more {
+                self.discard_passes -= 1;
+            }
+            if discard || more {
+                ui.ctx().request_discard("the source's pass runs twice");
+            }
+            match self.marks {
+                Marks::Route(area) if response.dragged() => super::route_app_drag(ui.ctx(), area),
+                Marks::Payload => response.dnd_set_drag_payload(*panel),
+                _ => {}
+            }
+        }
+        // As apps' drop sites do: the pointer over the body, and a release there.
+        if self.drop_sites.contains(panel)
+            && let Some(pos) = ui.ctx().pointer_hover_pos().filter(|p| ui.max_rect().contains(*p))
+        {
+            self.hovers.push((*panel, pos));
+            if ui.input(|i| i.pointer.any_released()) {
+                self.drops.push((*panel, pos));
+                if egui::DragAndDrop::has_payload_of_type::<u32>(ui.ctx()) {
+                    self.payload_drops.push(*panel);
+                }
+                if std::mem::take(&mut self.discard_drop) {
+                    ui.ctx().request_discard("a drop site's pass runs twice");
+                }
+            }
+        }
+        self.saw_files |= ui.input(|i| !i.raw.hovered_files.is_empty() || !i.raw.dropped_files.is_empty());
+        let main = ui.ctx().viewport_id() == egui::ViewportId::ROOT;
+        if (main && *panel == 1) || (!main && self.text == Some(*panel)) {
+            let keys = ui.input(|i| {
+                i.events.iter().filter(|e| matches!(e, Event::Key { .. } | Event::Copy | Event::Cut | Event::Paste(_))).cloned().collect::<Vec<_>>()
+            });
+            (if main { &mut self.main_keys } else { &mut self.field_keys }).extend(keys);
+        }
+        if ui.rect_contains_pointer(ui.max_rect()) {
+            let pressed = [PointerButton::Primary, PointerButton::Secondary].into_iter().filter(|b| ui.input(|i| i.pointer.button_pressed(*b)));
+            self.pressed.extend(pressed.map(|b| (*panel, b)));
+        }
+    }
+
+    fn logical_label(&self, panel: &u32) -> String {
+        format!("Panel {panel}")
+    }
+
+    fn permissions(&self, panel: &u32) -> Permissions {
+        if self.canvas == Some(*panel) {
+            return Permissions { accepts_splits: true, ..Permissions::PROTECTED };
+        }
+        Permissions { closable: !self.fixed.contains(panel), ..Permissions::default() }
+    }
+
+    fn allow_native(&self, panel: &u32) -> bool {
+        !self.in_window.contains(panel)
+    }
+
+    fn window_kind(&self, panel: &u32) -> WindowKind {
+        if self.normal.contains(panel) { WindowKind::Normal } else { WindowKind::Palette }
+    }
+}
+
+fn tabs(panels: &[u32]) -> Node<u32> {
+    Node::Tabs { panels: panels.to_vec(), active: 0 }
+}
+
+/// Frames `[1, 2]` and `[3, 4]`, and window `[5, 6]` when `floating`.
+fn layout(floating: bool) -> Layout<u32> {
+    Layout {
+        root: Some(Node::Split {
+            axis: SplitAxis::Horizontal,
+            size: SplitSize::Ratio(0.5),
+            first: Box::new(tabs(&[1, 2])),
+            second: Box::new(tabs(&[3, 4])),
+        }),
+        floating: if floating { vec![Floating::single(vec![5, 6], 0, [300.0, 80.0, 240.0, 300.0])] } else { Vec::new() },
+    }
+}
+
+fn driver(layout: Layout<u32>) -> DockDriver<u32, Content> {
+    DockDriver::new(layout, Content::default()).with_style(|s| s.command_press_floats = true).with_native_host(ORIGIN)
+}
+
+#[allow(clippy::expect_used)]
+fn window(d: &DockDriver<u32, Content>, panel: u32) -> &Floating<u32> {
+    d.layout.floating.iter().find(|w| w.contains(&panel)).expect("floating")
+}
+
+/// The window's OS window rect, and how many frames it drew.
+fn os_window(d: &DockDriver<u32, Content>, panel: u32) -> Option<(Rect, usize)> {
+    let viewport = d.viewport(window(d, panel).id);
+    d.host().windows.get(&viewport).map(|w| (w.rect, w.frames))
+}
+
+fn button(pos: Pos2, pressed: bool) -> Event {
+    Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE }
+}
+
+#[test]
+fn every_float_opens_in_its_own_os_window() {
+    // Undock Panel.
+    let mut d = driver(layout(false));
+    d.layout.apply(Action::Float { panel: 2, rect: [200.0, 100.0, 300.0, 200.0] }).unwrap();
+    let out = d.step(vec![]);
+    assert!(out.actions.contains(&Action::SetNative { panel: 2, rect: Some([300.0, 150.0, 300.0, 200.0]) }), "{:?}", out.actions);
+    assert_eq!(window(&d, 2).native, Some([300.0, 150.0, 300.0, 200.0]));
+    assert_eq!(os_window(&d, 2).map(|(rect, _)| rect), Some(Rect::from_min_size(pos2(300.0, 150.0), vec2(300.0, 200.0))));
+    assert!(d.hit(&Hit::Title(2)).is_none(), "not drawn in the main window");
+
+    // Undock Panel Group.
+    let mut d = driver(layout(false));
+    d.layout.apply(Action::MoveGroup { panel: 3, to: Target::Float { rect: Some([20.0, 30.0, 250.0, 200.0]) } }).unwrap();
+    d.step(vec![]);
+    assert_eq!(window(&d, 3).native, Some([120.0, 80.0, 250.0, 200.0]));
+    assert!(os_window(&d, 4).is_some());
+
+    // Ctrl/Cmd-drag.
+    let mut d = driver(layout(false));
+    let (tab, to) = (d.hit(&Hit::Tab(1)).unwrap().center(), pos2(600.0, 400.0));
+    d.modifiers = Modifiers::COMMAND;
+    d.hold(tab, to);
+    d.modifiers = Modifiers::NONE;
+    let out = d.release(to);
+    assert!(matches!(out.actions.as_slice(), [Action::Float { panel: 1, .. }]), "{:?}", out.actions);
+    d.step(vec![]);
+    let [x, y, ..] = window(&d, 1).rect;
+    assert_eq!(window(&d, 1).native.map(|r| [r[0], r[1]]), Some([x + ORIGIN.x, y + ORIGIN.y]));
+    assert!(os_window(&d, 1).is_some());
+
+    // A restored layout.
+    let mut d = driver(layout(true));
+    d.settle();
+    assert_eq!(window(&d, 5).native, Some([400.0, 130.0, 240.0, 300.0]));
+    assert!(os_window(&d, 5).is_some_and(|(_, frames)| frames > 0));
+
+    // A panel that must stay in-window keeps its window there.
+    let mut d = driver(layout(false));
+    d.content.in_window = vec![5, 6];
+    d.layout = layout(true);
+    d.settle();
+    assert_eq!(window(&d, 5).native, None);
+    assert!(d.hit(&Hit::Title(5)).is_some());
+    assert!(d.host().windows.is_empty());
+}
+
+#[test]
+fn closing_the_os_window_closes_its_panels() {
+    let mut d = driver(layout(true));
+    let viewport = d.viewport(window(&d, 5).id);
+    d.host().windows.get_mut(&viewport).unwrap().close = true;
+    let out = d.step(vec![]);
+    assert!(out.actions.contains(&Action::CloseWindow { panel: 5 }), "{:?}", out.actions);
+    assert!(!d.layout.contains(&5) && !d.layout.contains(&6));
+    let frames = d.host().windows[&viewport].frames;
+    d.settle();
+    assert_eq!(d.host().windows[&viewport].frames, frames, "no longer drawn");
+
+    // The bar's × does the same.
+    let mut d = driver(layout(true));
+    let id = window(&d, 5).id;
+    let out = d.window_click(id, pos2(230.0, 9.0));
+    assert!(out.actions.contains(&Action::CloseWindow { panel: 5 }), "{:?}", out.actions);
+}
+
+#[test]
+fn the_os_close_of_a_window_that_may_not_close_is_cancelled() {
+    // A panel that may not close, or a locked area.
+    for locked in [false, true] {
+        let mut d = driver(layout(true));
+        if locked {
+            d.locked = true;
+        } else {
+            d.content.fixed = vec![6];
+        }
+        let viewport = d.viewport(window(&d, 5).id);
+        let sent = d.host().commands.len();
+        d.host().windows.get_mut(&viewport).unwrap().close = true;
+        let out = d.step(vec![]);
+        assert!(!out.actions.iter().any(|a| matches!(a, Action::CloseWindow { .. })), "locked {locked}: {:?}", out.actions);
+        assert!(out.error.is_none(), "locked {locked}: {:?}", out.error);
+        assert!(d.host().commands[sent..].contains(&(viewport, ViewportCommand::CancelClose)), "locked {locked}: cancelled");
+        assert!(d.layout.contains(&5) && d.layout.contains(&6));
+    }
+}
+
+#[test]
+fn a_window_keeps_its_id_and_os_window_when_its_first_panel_moves_out() {
+    let mut d = driver(layout(true));
+    let id = window(&d, 5).id;
+    let (_, frames) = os_window(&d, 6).unwrap();
+    d.layout.apply(Action::Move { panel: 5, anchor: 1, placement: Placement::Tab { before: None } }).unwrap();
+    d.settle();
+    assert_eq!(window(&d, 6).id, id);
+    assert_eq!(d.host().windows.len(), 1, "the same OS window");
+    assert!(os_window(&d, 6).unwrap().1 > frames);
+
+    // Moving a whole window keeps its id; merging into another keeps the receiver's.
+    let mut layout = layout(true);
+    layout.floating.push(Floating::single(vec![7], 0, [10.0, 10.0, 200.0, 200.0]));
+    let (first, second) = (layout.floating[0].id, layout.floating[1].id);
+    assert_ne!(first, second);
+    layout.apply(Action::MoveWindow { panel: 5, to: Target::Float { rect: Some([0.0, 0.0, 300.0, 300.0]) } }).unwrap();
+    assert_eq!(layout.floating.iter().find(|w| w.contains(&5)).unwrap().id, first);
+    layout.apply(Action::Float { panel: 7, rect: [50.0, 50.0, 200.0, 200.0] }).unwrap();
+    assert_eq!(layout.floating.iter().find(|w| w.contains(&7)).unwrap().id, second);
+    layout.apply(Action::MoveWindow { panel: 7, to: Target::At { anchor: 5, placement: Placement::Tab { before: None } } }).unwrap();
+    assert_eq!(layout.floating.len(), 1);
+    assert_eq!(layout.floating[0].id, first);
+    // A group split out of a window makes a new one.
+    layout.apply(Action::MovePanel { panel: 7, to: Target::Float { rect: Some([0.0, 0.0, 200.0, 200.0]) } }).unwrap();
+    let ids: Vec<u64> = layout.floating.iter().map(|w| w.id).collect();
+    assert!(ids.contains(&first) && ids.len() == 2 && ids[0] != ids[1], "{ids:?}");
+}
+
+#[test]
+fn a_moved_window_reports_its_place_and_monitor() {
+    let mut d = driver(layout(true));
+    d.monitors = vec![Monitor { name: Some("left".into()), rect: [0.0, 0.0, 1920.0, 1080.0], scale: 1.0 }];
+    let viewport = d.viewport(window(&d, 5).id);
+    d.host().windows.get_mut(&viewport).unwrap().rect = Rect::from_min_size(pos2(700.0, 200.0), vec2(240.0, 300.0));
+    let out = d.step(vec![]);
+    assert!(out.actions.contains(&Action::SetNative { panel: 5, rect: Some([700.0, 200.0, 240.0, 300.0]) }), "{:?}", out.actions);
+    assert_eq!(window(&d, 5).rect, [600.0, 150.0, 240.0, 300.0], "the in-window rect follows");
+    assert_eq!(window(&d, 5).monitor.as_ref().and_then(|m| m.name.as_deref()), Some("left"));
+
+    // Without a monitor list, the size egui reports.
+    let mut d = driver(layout(true));
+    d.host().monitor_size = Some(vec2(2560.0, 1440.0));
+    d.settle();
+    assert_eq!((window(&d, 5).monitor.clone(), window(&d, 5).monitor_size), (None, Some([2560.0, 1440.0])));
+}
+
+#[test]
+fn a_restored_window_opens_on_a_connected_monitor() {
+    let left = Monitor { name: Some("left".into()), rect: [0.0, 0.0, 1920.0, 1080.0], scale: 1.0 };
+    let right = Monitor { name: Some("right".into()), rect: [1920.0, 0.0, 2560.0, 1440.0], scale: 2.0 };
+    let mut saved = layout(true);
+    saved.floating[0].native = Some([3000.0, 100.0, 240.0, 300.0]);
+    saved.floating[0].monitor = Some(right.clone());
+
+    // Its monitor is connected: where it was.
+    let mut d = DockDriver::new(Layout::default(), Content::default()).with_native_host(ORIGIN);
+    d.monitors = vec![left.clone(), right];
+    d.layout = saved.clone();
+    d.settle();
+    assert_eq!(os_window(&d, 5).unwrap().0.min, pos2(3000.0, 100.0));
+
+    // Unplugged: the main window's monitor, at the same offset.
+    let mut d = DockDriver::new(Layout::default(), Content::default()).with_native_host(ORIGIN);
+    d.monitors = vec![left];
+    d.layout = saved;
+    d.settle();
+    assert_eq!(os_window(&d, 5).unwrap().0.min, pos2(1080.0, 100.0));
+    assert_eq!(window(&d, 5).native, Some([1080.0, 100.0, 240.0, 300.0]));
+    assert_eq!(window(&d, 5).monitor.as_ref().and_then(|m| m.name.as_deref()), Some("left"));
+}
+
+/// The last `InnerSize`, `MinInnerSize` and `MaxInnerSize` sent to `viewport`.
+fn size_commands(d: &DockDriver<u32, Content>, viewport: egui::ViewportId) -> [Option<egui::Vec2>; 3] {
+    let mut sizes = [None; 3];
+    for (_, c) in d.host().commands.iter().filter(|(v, _)| *v == viewport) {
+        match c {
+            ViewportCommand::InnerSize(s) => sizes[0] = Some(*s),
+            ViewportCommand::MinInnerSize(s) => sizes[1] = Some(*s),
+            ViewportCommand::MaxInnerSize(s) => sizes[2] = Some(*s),
+            _ => {}
+        }
+    }
+    sizes
+}
+
+#[test]
+fn a_minimized_native_window_shrinks_to_its_bar_and_keeps_its_expanded_size() {
+    let mut d = driver(layout(true));
+    let viewport = d.viewport(window(&d, 5).id);
+    let open = os_window(&d, 5).unwrap().0;
+    let (native, rect) = (window(&d, 5).native, window(&d, 5).rect);
+    assert_eq!(native, Some([open.left(), open.top(), 240.0, 300.0]));
+
+    // Its bar and its group's tab strip, at the same width and top-left corner; only the width
+    // resizes.
+    let collapsed = BAR + super::DockStyle::default().tab_height;
+    d.layout.apply(Action::SetMinimized { panel: 5, minimized: true }).unwrap();
+    d.settle();
+    assert_eq!(os_window(&d, 5).unwrap().0, Rect::from_min_size(open.min, vec2(240.0, collapsed)));
+    let [_, min, max] = size_commands(&d, viewport);
+    assert_eq!((min.map(|s| s.y), max.map(|s| s.y)), (Some(collapsed), Some(collapsed)));
+
+    // The layout keeps the expanded size after the window reports the collapsed one, past the
+    // wait for commanded moves, and takes a new width.
+    for _ in 0..40 {
+        d.step(vec![]);
+    }
+    assert_eq!((window(&d, 5).native, window(&d, 5).rect), (native, rect));
+    d.host().windows.get_mut(&viewport).unwrap().rect = Rect::from_min_size(open.min, vec2(300.0, collapsed));
+    for _ in 0..40 {
+        d.step(vec![]);
+    }
+    assert_eq!(window(&d, 5).native, Some([open.left(), open.top(), 300.0, 300.0]));
+    assert_eq!(window(&d, 5).rect[2..], [300.0, 300.0]);
+
+    // Expanded: the saved height comes back, and the height resizes again.
+    d.layout.apply(Action::SetMinimized { panel: 5, minimized: false }).unwrap();
+    d.settle();
+    assert_eq!(os_window(&d, 5).unwrap().0, Rect::from_min_size(open.min, vec2(300.0, 300.0)));
+    assert_eq!(size_commands(&d, viewport), [Some(vec2(300.0, 300.0)), Some(vec2(160.0, 100.0)), Some(egui::Vec2::INFINITY)]);
+    // The limits change before the size: the OS clamps a new size to the limits it has.
+    let commands: Vec<_> = d.host().commands.iter().filter(|(v, _)| *v == viewport).map(|(_, c)| c.clone()).collect();
+    let last = |f: fn(&ViewportCommand) -> bool| commands.iter().rposition(f);
+    assert!(last(|c| matches!(c, ViewportCommand::MaxInnerSize(_))) < last(|c| matches!(c, ViewportCommand::InnerSize(_))), "{commands:?}");
+    assert_eq!(window(&d, 5).native, Some([open.left(), open.top(), 300.0, 300.0]));
+}
+
+#[test]
+fn a_locked_area_moves_no_native_window_and_records_where_the_os_put_it() {
+    let mut d = driver(layout(true));
+    d.locked = true;
+    let id = window(&d, 5).id;
+    let viewport = d.viewport(id);
+    let sent = d.host().commands.len();
+    d.window_step(id, vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+    d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+    let out = d.window_step(id, vec![Event::PointerMoved(pos2(70.0, 9.0)), button(pos2(70.0, 9.0), false)]);
+    assert!(out.actions.is_empty(), "{:?}", out.actions);
+    let moves = d.host().commands[sent..]
+        .iter()
+        .filter(|(v, c)| *v == viewport && matches!(c, ViewportCommand::OuterPosition(_) | ViewportCommand::StartDrag))
+        .count();
+    assert_eq!(moves, 0, "the bar is inert");
+
+    // The window system moves the window anyway: the locked workspace takes its new place.
+    let mut workspace = Workspace { locked: true, ..Workspace::new(d.layout.clone()) };
+    d.host().windows.get_mut(&viewport).unwrap().rect = Rect::from_min_size(pos2(700.0, 200.0), vec2(240.0, 300.0));
+    for _ in 0..60 {
+        let out = d.step(vec![]);
+        assert!(!out.actions.iter().any(|a| matches!(a, Action::MoveFloating { .. })), "{:?}", out.actions);
+        workspace.apply_all(out.actions, |_| Permissions::default()).unwrap();
+    }
+    assert_eq!(workspace.layout.floating[0].native, Some([700.0, 200.0, 240.0, 300.0]));
+}
+
+#[test]
+fn dragging_the_bar_moves_the_os_window() {
+    let mut d = driver(layout(true));
+    let id = window(&d, 5).id;
+    let viewport = d.viewport(id);
+    d.window_step(id, vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+    // Each move is relative to where the window was last moved.
+    d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+    d.window_step(id, vec![Event::PointerMoved(pos2(70.0, 9.0))]);
+    let moves: Vec<Pos2> = d
+        .host()
+        .commands
+        .iter()
+        .filter_map(|(v, c)| match c {
+            ViewportCommand::OuterPosition(pos) if *v == viewport => Some(*pos),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(moves.last(), Some(&pos2(450.0, 140.0)), "{moves:?}");
+    // Past the main window's right edge, the desktop: released there, it stays.
+    d.window_step(id, vec![Event::PointerMoved(pos2(540.0, 9.0))]);
+    let out = d.window_step(id, vec![button(pos2(40.0, 9.0), false)]);
+    assert!(out.actions.iter().all(|a| matches!(a, Action::SetNative { .. } | Action::MoveFloating { .. })), "{:?}", out.actions);
+    d.step(vec![]);
+    assert_eq!(window(&d, 5).native, Some([950.0, 140.0, 240.0, 300.0]));
+
+    // Without a reported position (Wayland) the window system moves it.
+    let mut d = driver(layout(true));
+    d.host().no_position = true;
+    d.step(vec![]);
+    d.window_step(id_of(&d), vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+    d.window_step(id_of(&d), vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+    assert!(d.host().commands.iter().any(|(_, c)| *c == ViewportCommand::StartDrag));
+}
+
+fn id_of(d: &DockDriver<u32, Content>) -> u64 {
+    window(d, 5).id
+}
+
+#[test]
+fn palettes_stay_shown_at_the_normal_level_while_the_app_is_inactive() {
+    use egui::{ViewportId, WindowLevel};
+    let mut d = driver(layout(true));
+    let palette = d.viewport(window(&d, 5).id);
+    let focus = |d: &mut DockDriver<u32, Content>, window: Option<ViewportId>, frames: usize| {
+        d.host().focus = window;
+        for _ in 0..frames {
+            d.step(vec![]);
+        }
+    };
+    let level = |d: &DockDriver<u32, Content>| d.host().windows[&palette].level;
+    let told = |d: &DockDriver<u32, Content>| d.host().commands.iter().any(|(v, c)| *v == palette && matches!(c, ViewportCommand::Visible(_)));
+    assert_eq!(level(&d), Some(WindowLevel::AlwaysOnTop));
+    // Focus moving to the palette, with a frame of none between, keeps it on top.
+    focus(&mut d, None, 1);
+    focus(&mut d, Some(palette), 30);
+    assert_eq!(level(&d), Some(WindowLevel::AlwaysOnTop));
+    // Another application: the palette drops behind it after the delay, and shows on, so
+    // files dragged from that application can reach it.
+    focus(&mut d, None, 10);
+    assert_eq!(level(&d), Some(WindowLevel::AlwaysOnTop), "not yet");
+    focus(&mut d, None, 10);
+    assert_eq!(level(&d), Some(INACTIVE_PALETTE));
+    // Back: on top again.
+    focus(&mut d, Some(ViewportId::ROOT), 1);
+    assert_eq!(level(&d), Some(WindowLevel::AlwaysOnTop));
+    // Blocked by a modal, it stays at the normal level, away and back.
+    d.input_blocked = true;
+    focus(&mut d, None, 20);
+    assert_eq!(level(&d), Some(WindowLevel::Normal));
+    focus(&mut d, Some(ViewportId::ROOT), 5);
+    assert_eq!(level(&d), Some(WindowLevel::Normal));
+    assert!(d.host().windows[&palette].visible);
+    assert!(!told(&d), "{:?}", d.host().commands);
+}
+
+#[test]
+fn viewer_windows_stay_shown_at_normal_level() {
+    let mut layout = layout(false);
+    layout.floating = vec![
+        Floating::single(vec![5], 0, [300.0, 80.0, 240.0, 300.0]),
+        Floating::single(vec![6], 0, [560.0, 80.0, 240.0, 300.0]),
+        // A palette in front of a viewer's tab: the viewer makes the window normal.
+        Floating::single(vec![7, 8], 0, [820.0, 80.0, 240.0, 300.0]),
+    ];
+    let mut d = driver(layout);
+    d.content.normal = vec![5, 8];
+    d.step(vec![]);
+    let [viewer, palette, mixed] = [5, 6, 7].map(|p| d.viewport(window(&d, p).id));
+    let level = |d: &DockDriver<u32, Content>, v| d.host().windows[&v].level;
+    assert_eq!(level(&d, viewer), Some(egui::WindowLevel::Normal));
+    assert_eq!(level(&d, palette), Some(egui::WindowLevel::AlwaysOnTop));
+    assert_eq!(level(&d, mixed), Some(egui::WindowLevel::Normal));
+    // Another application: the palette drops behind it; the viewers stay at the normal level.
+    d.host().focus = None;
+    for _ in 0..20 {
+        d.step(vec![]);
+    }
+    assert_eq!(
+        [viewer, palette, mixed].map(|v| level(&d, v)),
+        [Some(egui::WindowLevel::Normal), Some(INACTIVE_PALETTE), Some(egui::WindowLevel::Normal)]
+    );
+    d.host().focus = Some(egui::ViewportId::ROOT);
+    d.step(vec![]);
+    assert_eq!(level(&d, palette), Some(egui::WindowLevel::AlwaysOnTop));
+    assert_eq!(level(&d, viewer), Some(egui::WindowLevel::Normal));
+    assert!(!d.host().commands.iter().any(|(_, c)| matches!(c, ViewportCommand::Visible(_))), "no window hides");
+}
+
+#[test]
+fn the_app_comes_forward_with_its_viewers_when_it_is_activated() {
+    use egui::{ViewportId, WindowLevel};
+    let start = || {
+        let mut layout = layout(false);
+        layout.floating = vec![
+            Floating::single(vec![5], 0, [300.0, 80.0, 240.0, 300.0]),
+            Floating::single(vec![6], 0, [560.0, 80.0, 240.0, 300.0]),
+            Floating::single(vec![7], 0, [820.0, 80.0, 240.0, 300.0]),
+        ];
+        let mut d = driver(layout);
+        d.content.normal = vec![5, 7];
+        d.step(vec![]);
+        let [back, palette, front] = [5, 6, 7].map(|p| d.viewport(window(&d, p).id));
+        (d, back, palette, front)
+    };
+    let focus = |d: &mut DockDriver<u32, Content>, window: Option<ViewportId>, frames: usize| {
+        d.host().focus = window;
+        for _ in 0..frames {
+            d.step(vec![]);
+        }
+    };
+    let levels = |d: &mut DockDriver<u32, Content>| -> Vec<(ViewportId, WindowLevel)> {
+        let mut host = d.host();
+        assert!(!host.commands.iter().any(|(_, c)| matches!(c, ViewportCommand::Focus)), "no window takes focus");
+        let levels = host.commands.iter().filter_map(|(v, c)| if let ViewportCommand::WindowLevel(l) = c { Some((*v, *l)) } else { None }).collect();
+        host.commands.clear();
+        levels
+    };
+    // Each window once, in this order: the main window's commands are the root's.
+    let raised = |order: &[ViewportId]| -> Vec<(ViewportId, WindowLevel)> {
+        if cfg!(target_os = "macos") {
+            return Vec::new();
+        }
+        order.iter().flat_map(|v| [(*v, WindowLevel::AlwaysOnTop), (*v, WindowLevel::Normal)]).collect()
+    };
+    const MAIN: ViewportId = ViewportId::ROOT;
+
+    let (mut d, back, palette, front) = start();
+    // Focus moving between the app's own windows, with a frame of none between two, raises
+    // nothing.
+    focus(&mut d, Some(back), 2);
+    focus(&mut d, None, 1);
+    focus(&mut d, Some(front), 2);
+    focus(&mut d, Some(MAIN), 2);
+    assert_eq!(levels(&mut d), []);
+    // Another application, then back through the main window: the viewers are raised back to
+    // front and the main window last, without focus; the palette only goes back on top.
+    focus(&mut d, None, 20);
+    focus(&mut d, Some(MAIN), 10);
+    assert_eq!(levels(&mut d), raised(&[back, front, MAIN]));
+    assert!(d.host().windows[&palette].visible);
+    // Back through the back viewer: it is raised last, so it stays in front, and the main
+    // window comes forward behind it.
+    focus(&mut d, None, 20);
+    focus(&mut d, Some(back), 10);
+    assert_eq!(levels(&mut d), raised(&[front, MAIN, back]));
+    // A queued viewer that turns into a palette before its turn is not raised: the raise
+    // would leave it at the normal level.
+    focus(&mut d, None, 20);
+    focus(&mut d, Some(MAIN), 1);
+    d.content.normal = vec![7];
+    focus(&mut d, Some(MAIN), 10);
+    assert_eq!(levels(&mut d), raised(&[front, MAIN]));
+
+    // A press in the main window brings it in front of the viewers that opened over it, though
+    // it kept focus.
+    let (mut d, back, _, front) = start();
+    d.click(pos2(100.0, 300.0));
+    levels(&mut d);
+    focus(&mut d, None, 20);
+    focus(&mut d, Some(back), 10);
+    assert_eq!(levels(&mut d), raised(&[front, MAIN, back]));
+
+    // While a modal blocks input, the main window with the modal is raised last, even when
+    // the app is activated through a viewer.
+    d.input_blocked = true;
+    focus(&mut d, None, 20);
+    focus(&mut d, Some(front), 10);
+    assert_eq!(levels(&mut d), raised(&[back, front, MAIN]));
+}
+
+#[test]
+fn unused_keys_in_a_native_window_reach_the_app() {
+    let mut d = driver(layout(true));
+    let id = window(&d, 5).id;
+    let key = Event::Key { key: Key::S, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::COMMAND };
+    d.modifiers = Modifiers::COMMAND;
+    let out = d.window_step(id, vec![key.clone(), Event::Text("s".into()), Event::Copy, Event::PointerMoved(pos2(50.0, 50.0))]);
+    d.modifiers = Modifiers::NONE;
+    assert_eq!(out.forwarded_events, vec![key, Event::Text("s".into()), Event::Copy]);
+    assert_eq!(out.forwarded_modifiers, Some(Modifiers::COMMAND));
+    // Keys of the main window stay its own.
+    let out = d.key(Key::A);
+    assert!(out.forwarded_events.is_empty());
+}
+
+#[cfg(feature = "serde")]
+#[test]
+fn a_native_window_saves_its_id_place_and_monitor() {
+    let mut layout = layout(true);
+    let monitor = Monitor { name: Some("DP-1".into()), rect: [-1920.0, 0.0, 1920.0, 1080.0], scale: 1.5 };
+    layout.floating[0].native = Some([-1500.0, 100.0, 240.0, 300.0]);
+    layout.floating[0].monitor = Some(monitor);
+    layout.floating.push(Floating {
+        monitor_size: Some([2560.0, 1440.0]),
+        native: Some([5.0, 5.0, 300.0, 200.0]),
+        ..Floating::single(vec![7], 0, [0.0, 0.0, 300.0, 200.0])
+    });
+    let json = serde_json::to_string(&layout).unwrap();
+    let back: Layout<u32> = serde_json::from_str(&json).unwrap();
+    assert_eq!(back, layout);
+    assert_eq!(back.floating.iter().map(|w| w.id).collect::<Vec<_>>(), layout.floating.iter().map(|w| w.id).collect::<Vec<_>>());
+
+    // Old layouts get fresh ids, and copies of one id unique ones.
+    let old = r#"{"root": null, "floating": [{"panels": [5], "active": 0, "rect": [0, 0, 100, 100]}, {"panels": [6], "active": 0, "rect": [0, 0, 100, 100]}]}"#;
+    let old: Layout<u32> = serde_json::from_str(old).unwrap();
+    assert_ne!(old.floating[0].id, old.floating[1].id);
+    let mut copies = layout.clone();
+    copies.floating[1].id = copies.floating[0].id;
+    let copies: Layout<u32> = serde_json::from_str(&serde_json::to_string(&copies).unwrap()).unwrap();
+    assert_eq!(copies.floating[0].id, layout.floating[0].id);
+    assert_ne!(copies.floating[1].id, copies.floating[0].id);
+    // An in-window window writes its id too.
+    let in_window = Floating::single(vec![1u32], 0, [0.0, 0.0, 9.0, 9.0]).with_id(3);
+    assert!(serde_json::to_string(&in_window).unwrap().contains(r#""id":3"#));
+}
+
+/// Height of the bar at the top of a native window.
+const BAR: f32 = 18.0;
+/// A tab row's middle in a native window, below the bar.
+const TAB_ROW: f32 = BAR + 13.0;
+
+/// Window `[5, 6]` of [`layout`] and window `[7]` below it, apart on the desktop.
+fn two_windows() -> Layout<u32> {
+    let mut layout = layout(true);
+    layout.floating.push(Floating::single(vec![7], 0, [20.0, 420.0, 240.0, 150.0]));
+    layout
+}
+
+fn in_root(d: &DockDriver<u32, Content>, panel: u32) -> bool {
+    d.layout.contains(&panel) && !d.layout.floating.iter().any(|w| w.contains(&panel))
+}
+
+#[test]
+fn a_tab_dragged_past_the_main_windows_edge_floats_at_the_desktop_point() {
+    let mut d = driver(layout(false));
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    // Left of the main window, which starts at x = 100 on the desktop.
+    let out = pos2(-60.0, 120.0);
+    d.hold(tab, out);
+    // The pointer leaves the window: with native windows that is no release.
+    let gone = d.leave();
+    assert!(gone.actions.is_empty(), "{:?}", gone.actions);
+    let released = d.release(out);
+    assert!(matches!(released.actions.as_slice(), [Action::Float { panel: 1, .. }]), "{:?}", released.actions);
+    d.step(vec![]);
+    // The point grabbed (where the drag began, past the nudge) stays under the pointer: the
+    // tab's group starts at the window's top-left, below the bar.
+    let (desktop, grab) = (ORIGIN + out.to_vec2(), tab + vec2(8.0, 6.0));
+    let min = pos2(desktop.x - grab.x, desktop.y - grab.y - BAR);
+    let native = window(&d, 1).native.unwrap();
+    assert_eq!(pos2(native[0], native[1]), min);
+    assert_eq!(os_window(&d, 1).unwrap().0.min, min);
+}
+
+#[test]
+fn a_tab_dragged_out_and_back_docks_in_the_main_window() {
+    let mut d = driver(layout(false));
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    d.hold(tab, pos2(-60.0, 120.0));
+    d.leave();
+    // Back over the middle of frame [3, 4].
+    let back = pos2(600.0, 300.0);
+    d.move_to(back);
+    let out = d.release(back);
+    assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 1, anchor: 3 | 4, .. }]), "{:?}", out.actions);
+    assert!(d.layout.floating.is_empty());
+}
+
+#[test]
+fn a_tab_from_a_native_window_docks_in_a_frame_of_the_main_window() {
+    let mut d = driver(layout(true));
+    let id = window(&d, 5).id;
+    // Frame [1, 2] at x = 100 in the main window, on the desktop.
+    let local = d.window_local(id, ORIGIN + vec2(100.0, 300.0)).unwrap();
+    d.window_hold(id, pos2(15.0, TAB_ROW), local);
+    let out = d.window_release(id, local);
+    assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 5, anchor: 1 | 2, .. }]), "{:?}", out.actions);
+    assert!(in_root(&d, 5));
+    assert!(window(&d, 6).contains(&6));
+}
+
+#[test]
+fn a_tab_from_a_native_window_joins_another_native_windows_tab_row() {
+    let mut d = driver(two_windows());
+    let (from, to) = (window(&d, 5).id, window(&d, 7).id);
+    let row = d.host().windows[&d.viewport(to)].rect.min + vec2(200.0, TAB_ROW);
+    let local = d.window_local(from, row).unwrap();
+    d.window_hold(from, pos2(15.0, TAB_ROW), local);
+    let out = d.window_release(from, local);
+    assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 5, anchor: 7, placement: Placement::Tab { .. } }]), "{:?}", out.actions);
+    assert!(window(&d, 7).contains(&5));
+}
+
+#[test]
+fn dragging_the_bar_onto_the_main_window_docks_the_whole_window() {
+    let mut d = driver(layout(true));
+    let id = window(&d, 5).id;
+    d.window_step(id, vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+    d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+    // The pointer over the tab row of frame [3, 4], which starts at x = 400 in the main window.
+    // A moving window joins a group there; it splits only groups of other floating windows.
+    let local = d.window_local(id, ORIGIN + vec2(450.0, 13.0)).unwrap();
+    d.window_step(id, vec![Event::PointerMoved(local)]);
+    let out = d.window_step(id, vec![button(pos2(40.0, 9.0), false)]);
+    assert!(out.actions.iter().any(|a| matches!(a, Action::MoveWindow { panel: 5, to: Target::At { anchor: 3 | 4, .. } })), "{:?}", out.actions);
+    assert!(d.layout.floating.is_empty());
+    assert!(in_root(&d, 5) && in_root(&d, 6));
+}
+
+#[test]
+fn dragging_the_only_tab_of_a_native_window_moves_the_window() {
+    let mut layout = layout(false);
+    layout.floating.push(Floating::single(vec![7], 0, [300.0, 80.0, 240.0, 200.0]));
+    let mut d = driver(layout);
+    let id = window(&d, 7).id;
+    d.window_hold(id, pos2(15.0, TAB_ROW), pos2(1000.0, TAB_ROW));
+    let out = d.window_release(id, pos2(15.0, TAB_ROW));
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::Float { .. } | Action::Move { .. })), "{:?}", out.actions);
+    d.step(vec![]);
+    assert_eq!(d.layout.floating.len(), 1);
+    assert_eq!(window(&d, 7).id, id, "the same window");
+    // It followed the pointer onto the desktop, the pressed point under it: the nudge moved it
+    // by (8, 6), then the pointer went 1000 - 15 points right of the press.
+    assert_eq!(window(&d, 7).native.map(|r| [r[0], r[1]]), Some([408.0 + 985.0, 136.0]));
+}
+
+#[test]
+fn leaving_the_window_ends_a_drag_only_with_embedded_viewports() {
+    // Native viewports: the release still arrives, so leaving is no drop.
+    let mut d = driver(layout(false));
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    d.hold(tab, pos2(790.0, 300.0));
+    let out = d.leave();
+    assert!(out.actions.is_empty(), "{:?}", out.actions);
+    assert!(super::is_dragging::<u32>(&d.ctx, d.id));
+    d.step(vec![]);
+    assert!(super::is_dragging::<u32>(&d.ctx, d.id));
+
+    // Embedded: leaving floats the panel at the edge, as before.
+    let mut d = DockDriver::new(layout(false), Content::default());
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    d.hold(tab, pos2(790.0, 300.0));
+    let out = d.leave();
+    assert!(matches!(out.actions.as_slice(), [Action::Float { panel: 1, .. }]), "{:?}", out.actions);
+}
+
+#[test]
+fn escape_cancels_a_drag_outside_the_window() {
+    let mut d = driver(layout(false));
+    let before = d.layout.clone();
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    d.hold(tab, pos2(-60.0, 120.0));
+    d.leave();
+    d.key(Key::Escape);
+    let out = d.release(pos2(-60.0, 120.0));
+    assert!(out.actions.is_empty(), "{:?}", out.actions);
+    assert_eq!(d.layout, before);
+}
+
+/// Shapes drawn in `color`: a drop preview's outline, or a fill.
+fn accented(shapes: &[ClippedShape], color: Color32) -> usize {
+    shapes
+        .iter()
+        .filter(|clipped| match &clipped.shape {
+            egui::Shape::Rect(rect) => rect.stroke.color == color || rect.fill == color,
+            egui::Shape::Path(path) => path.fill == color.gamma_multiply(0.25),
+            _ => false,
+        })
+        .count()
+}
+
+#[test]
+fn the_preview_is_drawn_in_the_window_under_the_pointer() {
+    let accent = Color32::from_rgb(250, 10, 200);
+    let mut d = DockDriver::new(two_windows(), Content::default())
+        .with_style(move |s| {
+            s.accent = accent;
+            s.float_hint = false;
+        })
+        .with_native_host(ORIGIN);
+    let to = window(&d, 7).id;
+    let viewport = d.viewport(to);
+    let (main_before, window_before) = (accented(d.shapes(), accent), accented(&d.host().windows[&viewport].shapes, accent));
+    // Tab 1 of the main window over window [7]'s body.
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    let body = d.host().windows[&viewport].rect.center() - ORIGIN.to_vec2();
+    d.hold(tab, body);
+    d.move_to(body);
+    assert!(accented(&d.host().windows[&viewport].shapes, accent) > window_before, "drawn in the destination");
+    assert_eq!(accented(d.shapes(), accent), main_before, "not in the source");
+    let out = d.release(body);
+    assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 1, anchor: 7, .. }]), "{:?}", out.actions);
+}
+
+/// The texts drawn in `shapes`.
+fn texts(shapes: &[ClippedShape]) -> Vec<String> {
+    fn walk(shape: &egui::Shape, out: &mut Vec<String>) {
+        match shape {
+            egui::Shape::Vec(shapes) => shapes.iter().for_each(|s| walk(s, out)),
+            egui::Shape::Text(text) => out.push(text.galley.text().to_owned()),
+            _ => {}
+        }
+    }
+    let mut out = Vec::new();
+    shapes.iter().for_each(|clipped| walk(&clipped.shape, &mut out));
+    out
+}
+
+#[test]
+fn the_undock_hint_is_drawn_in_the_window_under_the_pointer() {
+    let key = if egui::os::OperatingSystem::from_target_os() == egui::os::OperatingSystem::Mac { "⌘" } else { "Ctrl" };
+    let hint = format!("Hold {key} to undock");
+    let hinted = |shapes: &[ClippedShape]| texts(shapes).contains(&hint);
+    let driver = || {
+        DockDriver::new(two_windows(), Content::default())
+            .with_style(|s| {
+                s.command_press_floats = true;
+                s.float_hint = true;
+            })
+            .with_native_host(ORIGIN)
+    };
+
+    // Tab 1 of the main window over window [7]'s body.
+    let mut d = driver();
+    let viewport = d.viewport(window(&d, 7).id);
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    let body = d.host().windows[&viewport].rect.center() - ORIGIN.to_vec2();
+    d.hold(tab, body);
+    d.move_to(body);
+    assert!(hinted(&d.host().windows[&viewport].shapes), "{:?}", texts(&d.host().windows[&viewport].shapes));
+    assert!(!hinted(d.shapes()), "not in the source");
+
+    // Tab 5 of window [5, 6] over frame [1, 2] of the main window.
+    let mut d = driver();
+    let id = window(&d, 5).id;
+    let viewport = d.viewport(id);
+    let local = d.window_local(id, ORIGIN + vec2(100.0, 300.0)).unwrap();
+    d.window_hold(id, pos2(15.0, TAB_ROW), local);
+    assert!(hinted(d.shapes()), "{:?}", texts(d.shapes()));
+    assert!(!hinted(&d.host().windows[&viewport].shapes), "not in the source");
+}
+
+/// Zone outlines: closed 1 pt paths without a fill.
+fn zone_outlines(shapes: &[ClippedShape]) -> usize {
+    shapes
+        .iter()
+        .filter(|clipped| matches!(&clipped.shape, egui::Shape::Path(path) if path.closed && path.fill == Color32::TRANSPARENT && path.stroke.width == 1.0))
+        .count()
+}
+
+#[test]
+fn drop_zones_are_drawn_in_the_window_under_the_pointer() {
+    let mut d = DockDriver::new(two_windows(), Content::default())
+        .with_style(|s| {
+            s.side_edge_zones = true;
+            s.float_hint = false;
+        })
+        .with_native_host(ORIGIN);
+    let viewport = d.viewport(window(&d, 7).id);
+    // Tab 1 of the main window over window [7]'s body, too short to split top or bottom: its
+    // left and right sides, center and strip.
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    let body = d.host().windows[&viewport].rect.center() - ORIGIN.to_vec2();
+    d.hold(tab, body);
+    d.move_to(body);
+    assert_eq!(zone_outlines(&d.host().windows[&viewport].shapes), 4, "drawn in the destination");
+    assert_eq!(zone_outlines(d.shapes()), 0, "not in the source");
+}
+
+#[test]
+fn a_command_drag_floats_even_over_another_window() {
+    let mut d = driver(two_windows());
+    let viewport = d.viewport(window(&d, 7).id);
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    let over = d.host().windows[&viewport].rect.center() - ORIGIN.to_vec2();
+    d.modifiers = Modifiers::COMMAND;
+    d.hold(tab, over);
+    let out = d.release(over);
+    assert!(matches!(out.actions.as_slice(), [Action::Float { panel: 1, .. }]), "{:?}", out.actions);
+    d.step(vec![]);
+    let native = window(&d, 1).native.unwrap();
+    let desktop = ORIGIN + over.to_vec2();
+    assert_eq!(pos2(native[0], native[1]), pos2(desktop.x - tab.x - 8.0, desktop.y - tab.y - 6.0 - BAR));
+}
+
+#[test]
+fn without_window_positions_a_drag_out_of_a_native_window_floats() {
+    let mut d = driver(two_windows());
+    d.host().no_position = true;
+    d.settle();
+    let id = window(&d, 5).id;
+    // Over window [7] on the desktop, which cannot be known: a new window.
+    d.window_hold(id, pos2(15.0, TAB_ROW), pos2(-200.0, 400.0));
+    let out = d.window_release(id, pos2(-200.0, 400.0));
+    assert!(matches!(out.actions.as_slice(), [Action::Float { panel: 5, .. }]), "{:?}", out.actions);
+    // The only tab left moves its window, by handing the move to the window system. A press
+    // where the last one was, this soon, would be a double-click.
+    let id = window(&d, 6).id;
+    for _ in 0..40 {
+        d.step(vec![]);
+    }
+    d.window_hold(id, pos2(15.0, TAB_ROW), pos2(120.0, 200.0));
+    assert!(d.host().commands.iter().any(|(v, c)| *v == d.viewport(id) && *c == ViewportCommand::StartDrag));
+    let out = d.window_release(id, pos2(120.0, 200.0));
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::Float { .. } | Action::Move { .. })), "{:?}", out.actions);
+}
+
+/// Drag window `panel`'s bar until the pointer is at `to` in the main window, and release.
+fn drag_bar_to(d: &mut DockDriver<u32, Content>, panel: u32, to: Pos2) -> super::DockOutput<u32> {
+    let id = window(d, panel).id;
+    d.window_step(id, vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+    d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+    let Some(local) = d.window_local(id, ORIGIN + to.to_vec2()) else { return Default::default() };
+    d.window_step(id, vec![Event::PointerMoved(local)]);
+    d.window_step(id, vec![button(pos2(40.0, 9.0), false)])
+}
+
+fn window_move(out: &super::DockOutput<u32>) -> Option<&Target<u32>> {
+    out.actions.iter().find_map(|a| match a {
+        Action::MoveWindow { to, .. } => Some(to),
+        _ => None,
+    })
+}
+
+#[test]
+fn a_native_windows_bar_docks_it_at_frame_edges_and_dock_lines_but_not_a_body_center() {
+    // The right edge zone of frame [3, 4], 40 pt in, clear of the new-dock band along the window's edge.
+    let mut d = driver(layout(true));
+    let out = drag_bar_to(&mut d, 5, pos2(760.0, 300.0));
+    assert!(matches!(window_move(&out), Some(Target::At { anchor: 3 | 4, placement: Placement::Split(super::Zone::Right) })), "{:?}", out.actions);
+    assert!(d.layout.floating.is_empty());
+    assert!(in_root(&d, 5) && in_root(&d, 6));
+
+    // The middle of the frame is no target for a whole window.
+    let mut d = driver(layout(true));
+    let out = drag_bar_to(&mut d, 5, pos2(600.0, 300.0));
+    assert_eq!(window_move(&out), None, "{:?}", out.actions);
+    assert!(window(&d, 5).contains(&6));
+
+    // The seam between the dock's two groups, which meet at y = 307.
+    let dock = Node::Dock {
+        side: super::Side::Start,
+        columns: vec![super::Column::new(vec![super::Group::new(vec![2], 0), super::Group::new(vec![3], 0)], 240.0)],
+    };
+    let mut docked = layout(true);
+    docked.root =
+        Some(Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedFirst(240.0), first: Box::new(dock), second: Box::new(tabs(&[1])) });
+    let mut d = driver(docked);
+    let out = drag_bar_to(&mut d, 5, pos2(120.0, 309.0));
+    assert_eq!(window_move(&out), Some(&Target::At { anchor: 2, placement: Placement::Group { below: true, height: None } }), "{:?}", out.actions);
+    assert!(d.layout.floating.is_empty());
+    assert!(in_root(&d, 5) && in_root(&d, 6));
+}
+
+#[test]
+fn over_a_canvas_body_a_window_stays_floating_and_a_tab_floats_while_the_edge_bands_dock() {
+    // PhotoCraft: a dock column of [2] above [3, 4] beside canvas 0, which takes splits, and
+    // window [5, 6] floating.
+    let accent = Color32::from_rgb(250, 10, 200);
+    let dock = Node::Dock {
+        side: super::Side::Start,
+        columns: vec![super::Column::new(vec![super::Group::new(vec![2], 0), super::Group::new(vec![3, 4], 0)], 240.0)],
+    };
+    let root = Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedFirst(240.0), first: Box::new(dock), second: Box::new(tabs(&[0])) };
+    let layout = Layout { root: Some(root), floating: vec![Floating::single(vec![5, 6], 0, [300.0, 80.0, 240.0, 200.0])] };
+    let start = || {
+        DockDriver::new(layout.clone(), Content { canvas: Some(0), ..Content::default() })
+            .with_style(move |s| {
+                s.accent = accent;
+                s.float_hint = false;
+            })
+            .with_native_host(ORIGIN)
+    };
+    // The canvas spans x = 244 to 800 and the whole height: no tab strip.
+    for at in [pos2(520.0, 150.0), pos2(520.0, 450.0)] {
+        let mut d = start();
+        let before = accented(d.shapes(), accent);
+        let id = window(&d, 5).id;
+        d.window_step(id, vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+        d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+        let local = d.window_local(id, ORIGIN + at.to_vec2()).unwrap();
+        d.window_step(id, vec![Event::PointerMoved(local)]);
+        d.step(vec![]);
+        assert_eq!(accented(d.shapes(), accent), before, "{at:?}: no preview");
+        let out = d.window_step(id, vec![button(pos2(40.0, 9.0), false)]);
+        assert_eq!(window_move(&out), None, "{at:?}: {:?}", out.actions);
+        assert!(window(&d, 5).contains(&6), "{at:?}");
+    }
+    // A docked tab dropped there floats.
+    let mut d = start();
+    let tab = d.hit(&Hit::Tab(3)).unwrap().center();
+    let out = d.drag(tab, pos2(520.0, 450.0));
+    assert!(matches!(out.actions.as_slice(), [Action::Float { panel: 3, .. }]), "{:?}", out.actions);
+    // The window's right edge, where no dock is yet, and the bottom edge band beside the canvas
+    // still dock the window.
+    let mut d = start();
+    let out = drag_bar_to(&mut d, 5, pos2(795.0, 300.0));
+    assert_eq!(window_move(&out), Some(&Target::NewDock { side: super::Side::End }), "{:?}", out.actions);
+    let mut d = start();
+    let out = drag_bar_to(&mut d, 5, pos2(520.0, 590.0));
+    assert!(matches!(window_move(&out), Some(Target::At { placement: Placement::Edge(super::Zone::Bottom), .. })), "{:?}", out.actions);
+}
+
+#[test]
+fn escape_during_a_bar_drag_puts_the_window_back() {
+    let mut d = driver(layout(true));
+    let id = window(&d, 5).id;
+    let viewport = d.viewport(id);
+    d.window_step(id, vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+    d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+    d.window_step(id, vec![Event::PointerMoved(pos2(140.0, 59.0))]);
+    assert_ne!(d.host().windows[&viewport].rect.min, pos2(400.0, 130.0), "moved");
+    let escape = Event::Key { key: Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE };
+    d.window_step(id, vec![escape]);
+    assert_eq!(d.host().windows[&viewport].rect.min, pos2(400.0, 130.0));
+    // The release that follows docks nothing, wherever it is.
+    let out = d.window_step(id, vec![button(pos2(40.0, 9.0), false)]);
+    assert_eq!(window_move(&out), None, "{:?}", out.actions);
+    d.step(vec![]);
+    assert_eq!(window(&d, 5).native.map(|r| [r[0], r[1]]), Some([400.0, 130.0]));
+}
+
+#[test]
+fn the_window_focused_last_is_in_front_where_windows_overlap() {
+    // Window [7] overlaps window [5, 6] on the desktop, at (550, 280) among others.
+    let mut layout = layout(true);
+    layout.floating.push(Floating::single(vec![7], 0, [350.0, 150.0, 240.0, 150.0]));
+    let overlap = pos2(550.0, 280.0) - ORIGIN.to_vec2();
+    for (front, anchors) in [(7, vec![7]), (5, vec![5, 6]), (7, vec![7])] {
+        let mut d = driver(layout.clone());
+        let viewport = d.viewport(window(&d, front).id);
+        d.host().focus = Some(viewport);
+        d.step(vec![]);
+        d.host().focus = Some(egui::ViewportId::ROOT);
+        d.step(vec![]);
+        let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+        let out = d.drag(tab, overlap);
+        let anchor = out.actions.iter().find_map(|a| match a {
+            Action::Move { panel: 1, anchor, .. } => Some(*anchor),
+            _ => None,
+        });
+        assert!(anchor.is_some_and(|a| anchors.contains(&a)), "front {front}: {:?}", out.actions);
+    }
+}
+
+/// Every `OuterPosition` sent to `viewport`, in order.
+fn moves(d: &DockDriver<u32, Content>, viewport: egui::ViewportId) -> Vec<Pos2> {
+    d.host()
+        .commands
+        .iter()
+        .filter_map(|(v, c)| match c {
+            ViewportCommand::OuterPosition(pos) if *v == viewport => Some(*pos),
+            _ => None,
+        })
+        .collect()
+}
+
+fn escape() -> Event {
+    Event::Key { key: Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE }
+}
+
+#[test]
+fn a_window_made_this_session_opens_where_it_was_put() {
+    // egui reports the monitor's size but no monitor list. A tab dropped on the desktop right
+    // of the main window's monitor opens there.
+    let size = Some(vec2(1920.0, 1080.0));
+    let mut d = driver(layout(false));
+    d.host().monitor_size = size;
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    let out = pos2(2400.0, 120.0);
+    d.hold(tab, out);
+    d.release(out);
+    d.settle();
+    let desktop = ORIGIN + out.to_vec2();
+    let min = pos2(desktop.x - tab.x - 8.0, desktop.y - tab.y - 6.0 - BAR);
+    let native = window(&d, 1).native.unwrap();
+    assert_eq!(pos2(native[0], native[1]), min);
+    assert_eq!(os_window(&d, 1).unwrap().0.min, min);
+
+    // Undock Panel, to a place off that monitor.
+    let mut d = driver(layout(false));
+    d.host().monitor_size = size;
+    d.layout.apply(Action::Float { panel: 2, rect: [2400.0, 100.0, 300.0, 200.0] }).unwrap();
+    d.settle();
+    assert_eq!(window(&d, 2).native, Some([2500.0, 150.0, 300.0, 200.0]));
+
+    // A loaded layout's window still opens on the main window's monitor.
+    let mut saved = layout(true);
+    saved.floating[0].native = Some([2500.0, 100.0, 240.0, 300.0]);
+    let mut d = driver(Layout::default());
+    d.host().monitor_size = size;
+    d.layout = saved;
+    d.settle();
+    assert_eq!(window(&d, 5).native, Some([1680.0, 100.0, 240.0, 300.0]));
+    assert_eq!(os_window(&d, 5).unwrap().0.min, pos2(1680.0, 100.0));
+}
+
+#[test]
+fn a_changed_layout_moves_the_os_window() {
+    let mut d = driver(layout(true));
+    let viewport = d.viewport(id_of(&d));
+    assert_eq!(window(&d, 5).native, Some([400.0, 130.0, 240.0, 300.0]));
+    // An undo of a move, a reset, or a layout reloaded with the same ids.
+    d.layout.floating[0].native = Some([700.0, 200.0, 260.0, 320.0]);
+    let out = d.step(vec![]);
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::SetNative { .. })), "{:?}", out.actions);
+    d.settle();
+    assert_eq!(d.host().windows[&viewport].rect, Rect::from_min_size(pos2(700.0, 200.0), vec2(260.0, 320.0)));
+    assert_eq!(window(&d, 5).native, Some([700.0, 200.0, 260.0, 320.0]));
+
+    // Off every monitor: onto the nearest, and the layout follows.
+    d.monitors = vec![Monitor { name: Some("left".into()), rect: [0.0, 0.0, 1920.0, 1080.0], scale: 1.0 }];
+    d.layout.floating[0].native = Some([5000.0, 200.0, 260.0, 320.0]);
+    d.settle();
+    assert_eq!(d.host().windows[&viewport].rect.min, pos2(1660.0, 200.0));
+    assert_eq!(window(&d, 5).native, Some([1660.0, 200.0, 260.0, 320.0]));
+
+    // A bar drag that leaves too little of the bar on a monitor ends with the window on it.
+    let id = id_of(&d);
+    let grab = pos2(40.0, 9.0);
+    d.window_step(id, vec![Event::PointerMoved(grab), button(grab, true)]);
+    let far = d.window_local(id, pos2(1950.0, 300.0)).unwrap();
+    d.window_step(id, vec![Event::PointerMoved(far)]);
+    let far = d.window_local(id, pos2(1950.0, 300.0)).unwrap();
+    d.window_step(id, vec![Event::PointerMoved(far), button(far, false)]);
+    d.settle();
+    assert_eq!(d.host().windows[&viewport].rect.min, pos2(1660.0, 291.0));
+    assert_eq!(window(&d, 5).native, Some([1660.0, 291.0, 260.0, 320.0]));
+}
+
+#[test]
+fn a_bar_drag_follows_the_pointer_when_moves_land_late() {
+    let mut d = driver(layout(true));
+    d.host().lag = true;
+    let id = id_of(&d);
+    let viewport = d.viewport(id);
+    let grab = pos2(40.0, 9.0);
+    let mut pointer = d.host().windows[&viewport].rect.min + grab.to_vec2();
+    d.window_step(id, vec![Event::PointerMoved(grab), button(grab, true)]);
+    // On to the desktop right of the main window, where the release docks nothing.
+    for _ in 0..6 {
+        pointer += vec2(90.0, -20.0);
+        // The window system reports the pointer relative to where the window is now.
+        let local = d.window_local(id, pointer).unwrap();
+        d.window_step(id, vec![Event::PointerMoved(local)]);
+        assert_eq!(moves(&d, viewport).last(), Some(&(pointer - grab.to_vec2())), "no overshoot");
+    }
+    // Frames with no pointer move leave it, though the last move has landed since.
+    let sent = moves(&d, viewport).len();
+    for _ in 0..3 {
+        d.step(vec![]);
+    }
+    assert_eq!(moves(&d, viewport).len(), sent, "no creep");
+    assert_eq!(d.host().windows[&viewport].rect.min, pointer - grab.to_vec2());
+    let local = d.window_local(id, pointer).unwrap();
+    d.window_step(id, vec![button(local, false)]);
+    d.settle();
+    let to = pointer - grab.to_vec2();
+    assert_eq!(d.host().windows[&viewport].rect.min, to);
+    assert_eq!(window(&d, 5).native.map(|r| [r[0], r[1]]), Some([to.x, to.y]));
+}
+
+#[test]
+fn a_native_windows_content_is_its_origin_where_its_frame_differs() {
+    // A title bar's height between the window's outer position and its content.
+    let mut d = DockDriver::new(Layout::default(), Content::default()).with_native_host(ORIGIN);
+    d.host().frame = vec2(0.0, 28.0);
+    d.layout = layout(true);
+    d.settle();
+    // It opened with its frame there, then moved so its content is.
+    let id = id_of(&d);
+    let viewport = d.viewport(id);
+    assert_eq!(d.host().windows[&viewport].rect.min, pos2(400.0, 130.0));
+    assert_eq!(window(&d, 5).native, Some([400.0, 130.0, 240.0, 300.0]));
+
+    // Its bar moves it by its outer position, here onto the desktop right of the main window.
+    let grab = pos2(40.0, 9.0);
+    d.window_step(id, vec![Event::PointerMoved(grab), button(grab, true)]);
+    d.window_step(id, vec![Event::PointerMoved(grab + vec2(520.0, 20.0))]);
+    assert_eq!(moves(&d, viewport).last(), Some(&pos2(920.0, 122.0)));
+    d.window_step(id, vec![button(grab, false)]);
+    d.settle();
+    assert_eq!(d.host().windows[&viewport].rect.min, pos2(920.0, 150.0));
+    assert_eq!(window(&d, 5).native.map(|r| [r[0], r[1]]), Some([920.0, 150.0]));
+
+    // Its tab drops where the pointer is on the desktop: the main window's tab row of [3, 4].
+    let row = d.window_local(id, ORIGIN + vec2(450.0, 13.0)).unwrap();
+    d.window_hold(id, pos2(15.0, TAB_ROW), row);
+    let out = d.window_release(id, row);
+    assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 5, anchor: 3 | 4, placement: Placement::Tab { .. } }]), "{:?}", out.actions);
+}
+
+#[test]
+fn the_only_tab_of_a_native_window_docks_it_with_title_bar_docks_off() {
+    let mut layout = layout(false);
+    layout.floating.push(Floating::single(vec![7], 0, [300.0, 80.0, 240.0, 200.0]));
+    let driver = || DockDriver::new(layout.clone(), Content::default()).with_style(|s| s.title_bar_docks = false).with_native_host(ORIGIN);
+    let mut d = driver();
+    let id = window(&d, 7).id;
+    let row = ORIGIN + vec2(450.0, 13.0);
+    let from = pos2(15.0, TAB_ROW);
+    d.window_step(id, vec![Event::PointerMoved(from), button(from, true)]);
+    d.window_step(id, vec![Event::PointerMoved(from + vec2(8.0, 6.0))]);
+    for _ in 0..2 {
+        let local = d.window_local(id, row).unwrap();
+        d.window_step(id, vec![Event::PointerMoved(local)]);
+    }
+    let local = d.window_local(id, row).unwrap();
+    let out = d.window_step(id, vec![button(local, false)]);
+    assert!(matches!(window_move(&out), Some(Target::At { anchor: 3 | 4, .. })), "{:?}", out.actions);
+    assert!(in_root(&d, 7));
+
+    // Its bar keeps to `title_bar_docks`.
+    let mut d = driver();
+    let out = drag_bar_to(&mut d, 7, pos2(450.0, 13.0));
+    assert_eq!(window_move(&out), None, "{:?}", out.actions);
+    assert!(!in_root(&d, 7));
+}
+
+#[test]
+fn the_only_tab_of_a_native_window_fills_and_joins_a_frame_bodys_center() {
+    let mut layout = layout(false);
+    layout.floating.push(Floating::single(vec![7], 0, [300.0, 80.0, 240.0, 200.0]));
+    let style = |s: &mut super::DockStyle| {
+        s.side_edge_zones = true;
+        s.title_bar_docks = false;
+        s.float_hint = false;
+    };
+    let mut d = DockDriver::new(layout, Content::default()).with_style(style).with_native_host(ORIGIN);
+    let id = window(&d, 7).id;
+    // The middle of frame [3, 4], in the main window.
+    let middle = pos2(600.0, 300.0);
+    let from = pos2(15.0, TAB_ROW);
+    d.window_step(id, vec![Event::PointerMoved(from), button(from, true)]);
+    d.window_step(id, vec![Event::PointerMoved(from + vec2(8.0, 6.0))]);
+    for _ in 0..2 {
+        let local = d.window_local(id, ORIGIN + middle.to_vec2()).unwrap();
+        d.window_step(id, vec![Event::PointerMoved(local)]);
+    }
+    // The center rectangle is the only zone around the pointer: outlined and filled.
+    let zone = |filled: bool| {
+        d.shapes().iter().any(|clipped| match &clipped.shape {
+            egui::Shape::Path(path) => {
+                path.closed && (path.fill != Color32::TRANSPARENT) == filled && Rect::from_points(&path.points).contains(middle)
+            }
+            _ => false,
+        })
+    };
+    assert!(zone(false), "outlined");
+    assert!(zone(true), "filled");
+    let local = d.window_local(id, ORIGIN + middle.to_vec2()).unwrap();
+    let out = d.window_step(id, vec![button(local, false)]);
+    assert!(matches!(window_move(&out), Some(Target::At { anchor: 3 | 4, placement: Placement::Split(super::Zone::Center) })), "{:?}", out.actions);
+    assert!(in_root(&d, 7));
+}
+
+#[test]
+fn a_native_window_forwards_no_keys_while_one_of_its_widgets_has_focus() {
+    let mut d = driver(layout(true));
+    (d.content.text, d.content.focus_text) = (Some(5), true);
+    d.settle();
+    let key = Event::Key { key: Key::S, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::COMMAND };
+    let out = d.window_step(id_of(&d), vec![key, Event::Text("s".into())]);
+    assert!(out.forwarded_events.is_empty(), "{:?}", out.forwarded_events);
+    assert_eq!(d.content.typed, "s");
+
+    // A focused button's Enter is its own.
+    let mut d = driver(layout(true));
+    d.content.focused_button = Some(5);
+    d.settle();
+    let enter = Event::Key { key: Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE };
+    let out = d.window_step(id_of(&d), vec![enter]);
+    assert!(out.forwarded_events.is_empty(), "{:?}", out.forwarded_events);
+}
+
+#[test]
+fn the_input_hook_rewrites_each_native_windows_input_before_its_widgets_see_it() {
+    // As an app maps Ctrl+click to a secondary click on macOS.
+    let mut d = driver(layout(true)).with_native_input_hook(|_, input| {
+        for event in &mut input.events {
+            if let Event::PointerButton { button, .. } = event {
+                *button = PointerButton::Secondary;
+            }
+        }
+    });
+    let id = id_of(&d);
+    d.window_click(id, pos2(60.0, 150.0));
+    assert_eq!(d.content.pressed, vec![(5, PointerButton::Secondary)]);
+
+    // The main window's input is the app's own `raw_input_hook`'s.
+    d.content.pressed.clear();
+    d.click(pos2(100.0, 300.0));
+    assert_eq!(d.content.pressed, vec![(1, PointerButton::Primary)]);
+}
+
+#[derive(Debug)]
+struct File(std::path::PathBuf);
+
+impl egui::DroppedFile for File {
+    fn path(&self) -> &std::path::Path {
+        &self.0
+    }
+
+    fn bytes(&self) -> Result<Vec<u8>, String> {
+        Ok(Vec::new())
+    }
+}
+
+#[test]
+fn files_dragged_onto_a_native_window_are_reported_with_its_panel() {
+    let mut d = driver(layout(true));
+    let (id, viewport) = (id_of(&d), d.viewport(id_of(&d)));
+    let hovered = egui::HoveredFile { path: Some("a.png".into()), mime: String::new() };
+    d.host().windows.get_mut(&viewport).unwrap().hovered_files = vec![hovered.clone()];
+    let out = d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 150.0))]);
+    let [files] = out.window_files.as_slice() else { panic!("{:?}", out.window_files) };
+    assert_eq!((files.window, files.viewport, files.panel, files.pos), (id, viewport, 5, Some(pos2(60.0, 150.0))));
+    assert_eq!(files.hovered, vec![hovered]);
+    assert!(files.dropped.is_empty());
+
+    {
+        let mut host = d.host();
+        let window = host.windows.get_mut(&viewport).unwrap();
+        window.hovered_files.clear();
+        window.dropped_files = vec![std::sync::Arc::new(File("a.png".into()))];
+    }
+    let out = d.window_step(id, Vec::new());
+    let [files] = out.window_files.as_slice() else { panic!("{:?}", out.window_files) };
+    assert_eq!(files.panel, 5);
+    assert_eq!(files.dropped.iter().map(|f| f.path().to_path_buf()).collect::<Vec<_>>(), vec![std::path::PathBuf::from("a.png")]);
+    assert!(d.step(Vec::new()).window_files.is_empty());
+}
+
+#[test]
+fn a_blocked_native_window_reports_no_files() {
+    let mut d = driver(layout(true));
+    let (id, viewport) = (id_of(&d), d.viewport(id_of(&d)));
+    d.input_blocked = true;
+    d.step(Vec::new());
+    let drop = |d: &mut DockDriver<u32, Content>| {
+        let mut host = d.host();
+        let window = host.windows.get_mut(&viewport).unwrap();
+        window.hovered_files = vec![egui::HoveredFile { path: Some("a.png".into()), mime: String::new() }];
+        window.dropped_files = vec![std::sync::Arc::new(File("a.png".into()))];
+    };
+    drop(&mut d);
+    let out = d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 150.0))]);
+    assert!(out.window_files.is_empty(), "{:?}", out.window_files);
+    assert!(!d.content.saw_files);
+
+    d.input_blocked = false;
+    drop(&mut d);
+    let out = d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 150.0))]);
+    assert_eq!(out.window_files.len(), 1);
+    assert!(d.content.saw_files);
+}
+
+#[test]
+fn escape_or_focus_loss_ends_a_drag_a_native_window_owns() {
+    // Escape cancels it, and is no shortcut.
+    let mut d = driver(layout(true));
+    let id = id_of(&d);
+    let over = d.window_local(id, ORIGIN + vec2(600.0, 300.0)).unwrap();
+    d.window_hold(id, pos2(15.0, TAB_ROW), over);
+    let out = d.window_step(id, vec![escape()]);
+    assert!(out.forwarded_events.is_empty(), "{:?}", out.forwarded_events);
+    let out = d.window_release(id, over);
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::Move { .. } | Action::Float { .. })), "{:?}", out.actions);
+    assert!(window(&d, 5).contains(&6));
+
+    // Escape during a bar drag is no shortcut either.
+    let mut d = driver(layout(true));
+    d.window_step(id_of(&d), vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+    d.window_step(id_of(&d), vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+    let out = d.window_step(id_of(&d), vec![escape()]);
+    assert!(out.forwarded_events.is_empty(), "{:?}", out.forwarded_events);
+
+    // Escape pressed in the main window, which has keyboard focus, cancels a drag the native
+    // window owns.
+    let mut d = driver(layout(true));
+    let id = id_of(&d);
+    let viewport = d.viewport(id);
+    d.window_step(id, vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+    d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+    d.window_step(id, vec![Event::PointerMoved(pos2(140.0, 59.0))]);
+    d.key(Key::Escape);
+    assert_eq!(d.host().windows[&viewport].rect.min, pos2(400.0, 130.0), "back where it was");
+    let out = d.window_step(id, vec![button(pos2(40.0, 9.0), false)]);
+    assert_eq!(window_move(&out), None, "{:?}", out.actions);
+
+    // Another application takes focus: cancelled.
+    let mut d = driver(layout(true));
+    let id = id_of(&d);
+    d.window_hold(id, pos2(15.0, TAB_ROW), over);
+    d.host().focus = None;
+    d.window_step(id, vec![Event::PointerMoved(over)]);
+    d.host().focus = Some(d.viewport(id));
+    let out = d.window_release(id, over);
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::Move { .. } | Action::Float { .. })), "{:?}", out.actions);
+    assert!(!super::is_dragging::<u32>(&d.ctx, d.id));
+}
+
+#[test]
+fn escape_in_a_focused_native_window_cancels_a_main_window_drag() {
+    let mut d = driver(two_windows());
+    let id = window(&d, 7).id;
+    let viewport = d.viewport(id);
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    let body = d.host().windows[&viewport].rect.center() - ORIGIN.to_vec2();
+    d.hold(tab, body);
+    d.host().focus = Some(viewport);
+    let out = d.window_step(id, vec![escape()]);
+    assert!(out.forwarded_events.is_empty(), "the Escape is no shortcut: {:?}", out.forwarded_events);
+    d.step(vec![Event::PointerMoved(body)]);
+    let out = d.release(body);
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::Move { .. } | Action::MovePanel { .. } | Action::Float { .. })), "{:?}", out.actions);
+    assert!(!super::is_dragging::<u32>(&d.ctx, d.id));
+}
+
+#[test]
+fn a_main_window_without_focus_still_drags_a_tab_into_another_group() {
+    let mut d = driver(layout(false));
+    d.host().focus = None;
+    d.settle();
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    let over = d.hit(&Hit::Tab(3)).unwrap().center();
+    d.hold(tab, over);
+    assert!(super::is_dragging::<u32>(&d.ctx, d.id));
+    let out = d.release(over);
+    assert!(out.actions.iter().any(|a| matches!(a, Action::Move { panel: 1, .. })), "{:?}", out.actions);
+}
+
+#[test]
+fn focus_moving_to_a_native_window_mid_drag_keeps_the_drag() {
+    let mut d = driver(two_windows());
+    let viewport = d.viewport(window(&d, 7).id);
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    let body = d.host().windows[&viewport].rect.center() - ORIGIN.to_vec2();
+    d.hold(tab, body);
+    d.host().focus = Some(viewport);
+    d.step(vec![Event::WindowFocused(false), Event::PointerMoved(body)]);
+    assert!(super::is_dragging::<u32>(&d.ctx, d.id));
+    let out = d.release(body);
+    assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 1, anchor: 7, .. }]), "{:?}", out.actions);
+}
+
+#[test]
+fn a_drag_ends_when_its_native_window_or_panel_goes() {
+    let pointer = |d: &DockDriver<u32, Content>| d.ctx.data(|data| data.get_temp::<DragPointer>(d.id.with("drag-pointer")));
+    let moving = |d: &DockDriver<u32, Content>| d.ctx.data(|data| data.get_temp::<WindowDrag>(d.id.with("window-drag")));
+
+    // The window closes during a tab drag it owns.
+    let mut d = driver(layout(true));
+    let id = id_of(&d);
+    let over = d.window_local(id, ORIGIN + vec2(600.0, 300.0)).unwrap();
+    d.window_hold(id, pos2(15.0, TAB_ROW), over);
+    let viewport = d.viewport(id);
+    d.host().windows.get_mut(&viewport).unwrap().close = true;
+    d.step(vec![]);
+    d.settle();
+    assert!(!d.layout.contains(&5));
+    assert!(!super::is_dragging::<u32>(&d.ctx, d.id));
+    assert_eq!(pointer(&d), None);
+
+    // The dragged panel is closed by the application.
+    let mut d = driver(layout(true));
+    let id = id_of(&d);
+    d.window_hold(id, pos2(15.0, TAB_ROW), over);
+    d.layout.apply(Action::Close { panel: 5 }).unwrap();
+    let out = d.window_release(id, over);
+    assert!(out.error.is_none() && !out.actions.iter().any(|a| matches!(a, Action::Move { .. } | Action::Float { .. })), "{:?}", out.actions);
+    d.settle();
+    assert!(!super::is_dragging::<u32>(&d.ctx, d.id));
+    assert_eq!(pointer(&d), None);
+
+    // The window closes during its own bar drag.
+    let mut d = driver(layout(true));
+    let id = id_of(&d);
+    d.window_step(id, vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+    d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+    assert!(moving(&d).is_some());
+    d.layout.apply(Action::CloseWindow { panel: 5 }).unwrap();
+    d.settle();
+    assert_eq!(moving(&d), None);
+    assert_eq!(pointer(&d), None);
+    // The main window's drags work as before.
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    let out = d.drag(tab, pos2(600.0, 300.0));
+    assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 1, anchor: 3 | 4, .. }]), "{:?}", out.actions);
+}
+
+/// Press at `from` in the native window of panel 5, move the pointer by `by` on the desktop
+/// and release. Returns the window's OS rect, the resize the window handed to the window
+/// system, and the driver.
+#[cfg(not(target_os = "macos"))]
+fn press_and_drag(from: Pos2, by: egui::Vec2) -> (Rect, Option<egui::ResizeDirection>, DockDriver<u32, Content>) {
+    let mut d = driver(layout(true));
+    let id = window(&d, 5).id;
+    let viewport = d.viewport(id);
+    let press = os_window(&d, 5).map_or(Pos2::ZERO, |(rect, _)| rect.min) + from.to_vec2();
+    d.window_step(id, vec![Event::PointerMoved(from), button(from, true)]);
+    // The pointer is where it was moved on the desktop, wherever the window is now.
+    let local = |d: &DockDriver<u32, Content>, step: egui::Vec2| d.window_local(id, press + step).unwrap_or_default();
+    for step in [vec2(3.0, 3.0), by] {
+        let pos = local(&d, step);
+        d.window_step(id, vec![Event::PointerMoved(pos)]);
+    }
+    let pos = local(&d, by);
+    d.window_step(id, vec![Event::PointerMoved(pos), button(pos, false)]);
+    d.step(vec![]);
+    let resize = d.host().commands.iter().find_map(|(v, c)| match c {
+        ViewportCommand::BeginResize(direction) if *v == viewport => Some(*direction),
+        _ => None,
+    });
+    (os_window(&d, 5).map_or(Rect::NOTHING, |(rect, _)| rect), resize, d)
+}
+
+// On macOS AppKit resizes the window and there are no bands; the macOS × layout has its own
+// test.
+#[cfg(not(target_os = "macos"))]
+#[test]
+fn the_bars_close_button_wins_over_the_resize_bands() {
+    use egui::ResizeDirection as D;
+    let mut d = driver(layout(true));
+    let id = window(&d, 5).id;
+    let viewport = d.viewport(id);
+    // The × of the 240 pt wide window spans 215..233 across and the whole bar down. Its top
+    // right is next to the window's top-right corner, but it closes the window.
+    let out = d.window_click(id, pos2(232.0, 1.0));
+    assert!(out.actions.contains(&Action::CloseWindow { panel: 5 }), "{:?}", out.actions);
+    assert!(!d.host().commands.iter().any(|(v, c)| *v == viewport && matches!(c, ViewportCommand::BeginResize(_))), "not resized");
+
+    // Beside it, at the window's edges, the bands hand the resize to the window system.
+    let resize = |from: Pos2| press_and_drag(from, vec2(20.0, 20.0)).1;
+    assert_eq!(resize(pos2(238.0, 2.0)), Some(D::NorthEast), "the top-right corner");
+    assert_eq!(resize(pos2(237.0, 15.0)), Some(D::NorthEast), "the corner beside the ×");
+    assert_eq!(resize(pos2(237.0, 100.0)), Some(D::East), "the right edge");
+    assert_eq!(resize(pos2(120.0, 1.0)), Some(D::North), "the top edge above the bar");
+    assert_eq!(resize(pos2(2.0, 298.0)), Some(D::SouthWest), "the bottom-left corner");
+    // Inside a corner's L, the bar moves the window, here to the middle of frame [1, 2].
+    let rect = |x0: f32, y0: f32, x1: f32, y1: f32| Rect::from_min_max(pos2(x0, y0), pos2(x1, y1));
+    let (moved, resize, _) = press_and_drag(pos2(10.0, 10.0), vec2(-110.0, 150.0));
+    assert_eq!((moved, resize), (rect(290.0, 280.0, 530.0, 580.0), None));
+}
+
+#[test]
+/// Resize bands avoid the close button, are at most 6 pt deep, use 16 pt
+/// corners along each edge, and leave the bar below the top band inert.
+fn resize_bands_are_a_few_points_deep_and_leave_out_the_bar_buttons() {
+    let rect = Rect::from_min_size(Pos2::ZERO, vec2(240.0, 300.0));
+    let close = Rect::from_center_size(pos2(224.0, 9.0), vec2(18.0, 18.0));
+    let bands = resize_bands(rect, &[close]);
+    let at = |p: Pos2| bands.iter().find(|(_, band)| band.contains(p)).map(|(direction, _)| *direction);
+    for (_, band) in &bands {
+        assert!(!band.intersect(close).is_positive(), "{band:?} covers the ×");
+        assert!(band.width().min(band.height()) <= 6.0, "{band:?} is deeper than an edge band");
+    }
+    // Each edge resizes along its whole length, outside the ×, from 16 pt corners.
+    use egui::ResizeDirection as D;
+    // Which of an edge's three parts `v` is in: the first corner, the edge, the last corner.
+    let part = |v: f32, length: f32| usize::from(v >= 16.0) + usize::from(v > length - 16.0);
+    for i in 0..240 {
+        let x = i as f32 + 0.5;
+        let top = [D::NorthWest, D::North, D::NorthEast][part(x, 240.0)];
+        assert_eq!(at(pos2(x, 0.5)), (!close.contains(pos2(x, 0.5))).then_some(top), "top at {x}");
+        assert_eq!(at(pos2(x, 5.5)), (!close.contains(pos2(x, 5.5))).then_some(top), "6 pt down at {x}");
+        assert_eq!(at(pos2(x, 299.5)), Some([D::SouthWest, D::South, D::SouthEast][part(x, 240.0)]), "bottom at {x}");
+    }
+    for i in 0..300 {
+        let y = i as f32 + 0.5;
+        assert_eq!(at(pos2(0.5, y)), Some([D::NorthWest, D::West, D::SouthWest][part(y, 300.0)]), "left at {y}");
+        assert_eq!(at(pos2(239.5, y)), Some([D::NorthEast, D::East, D::SouthEast][part(y, 300.0)]), "right at {y}");
+    }
+    assert_eq!(at(pos2(10.0, 10.0)), None, "a corner is an L along its edges");
+    assert_eq!(at(pos2(120.0, 6.5)), None, "the bar below the top band");
+}
+
+#[test]
+/// On macOS the close glyph sits 8 pt from the trailing corner in both directions; its hit area
+/// extends 10 pt away from the corner, reaches the bar bottom, leaves the drag area clear, and stays
+/// reachable outside AppKit's corner resize region.
+fn on_macos_the_close_glyph_sits_by_the_corner_and_its_hit_area_reaches_away_from_it() {
+    use crate::docking::chrome::{ChromeStyle, TitleBar};
+    use crate::docking::placement::BAR_HEIGHT;
+    let ctx = egui::Context::default();
+    let full = Rect::from_min_size(Pos2::ZERO, vec2(240.0, 300.0));
+    let bar = Rect::from_min_size(full.min, vec2(full.width(), BAR_HEIGHT));
+    for right_to_left in [false, true] {
+        let (hit, glyph) = close_rects(bar, MACOS_CLOSE, right_to_left);
+        // Distances from the corner the × sits by: across from the trailing edge, and down.
+        let across = |x: f32| if right_to_left { x - full.left() } else { full.right() - x };
+        let (glyph_near, glyph_far) = (across(glyph.right()).min(across(glyph.left())), across(glyph.right()).max(across(glyph.left())));
+        assert_eq!((glyph_near, glyph.top(), glyph.width(), glyph.height()), (8.0, 4.5, 9.0, 9.0), "the glyph by the corner");
+        let (hit_near, hit_far) = (across(hit.right()).min(across(hit.left())), across(hit.right()).max(across(hit.left())));
+        assert_eq!(hit_near, glyph_near, "the hit area reaches no closer to the corner than the glyph");
+        assert_eq!(hit_far, glyph_far + 10.0, "the hit area reaches away from the corner");
+        assert_eq!((hit.top(), hit.bottom()), (glyph.top(), BAR_HEIGHT), "the hit area reaches down to the bar's bottom, not below");
+        // AppKit's corner area takes the presses nearest the corner; the rest reach the ×.
+        let [top_left, top_right, ..] = appkit_resize_areas(full);
+        let corner = if right_to_left { top_left } else { top_right };
+        assert_eq!(corner.width(), APPKIT_CORNER);
+        assert!(hit_far - APPKIT_CORNER >= 10.0, "{hit:?} has too little room outside {corner:?}");
+
+        let mut shown = None;
+        let mut output = ctx.run_ui(egui::RawInput { screen_rect: Some(full), ..Default::default() }, |ui| {
+            let style = ChromeStyle { right_to_left, ..ChromeStyle::from_ui(ui) };
+            let response = TitleBar::new(egui::Id::unique("bar"), "Move").title("Panel").close("Close").close_at(hit, glyph).show(ui, bar, &style);
+            shown = response.close.map(|close| (close.rect, response.bar.rect));
+        });
+        output.textures_delta.clear();
+        let (close, drag) = shown.unwrap_or((Rect::NOTHING, Rect::NOTHING));
+        assert_eq!(close, hit, "the bar takes clicks for the × in its hit area");
+        assert!(!drag.intersect(hit).is_positive(), "the bar's drag area {drag:?} leaves the × alone");
+    }
+}
+
+/// [`layout`] built anew, its window with id 7 when `with_id`.
+fn rebuilt_layout(with_id: bool) -> Layout<u32> {
+    let mut layout = layout(true);
+    if with_id {
+        layout.floating = layout.floating.into_iter().map(|w| w.with_id(7)).collect();
+    }
+    layout
+}
+
+#[test]
+fn a_layout_built_each_frame_with_ids_keeps_its_os_window() {
+    let mut d = driver(rebuilt_layout(true));
+    let viewport = d.viewport(7);
+    for _ in 0..4 {
+        d.layout = rebuilt_layout(true);
+        d.step(vec![]);
+    }
+    assert_eq!(d.host().windows.keys().copied().collect::<Vec<_>>(), [viewport], "one OS window, the same each frame");
+}
+
+#[cfg(debug_assertions)]
+#[test]
+fn a_layout_built_each_frame_without_ids_is_warned_about() {
+    let warned = |d: &DockDriver<u32, Content>| d.ctx.data(|m| m.get_temp::<bool>(d.id.with("native-rebuilt"))).unwrap_or(false);
+    let mut d = driver(rebuilt_layout(false));
+    for _ in 0..4 {
+        d.layout = rebuilt_layout(false);
+        d.step(vec![]);
+    }
+    assert!(warned(&d));
+    assert!(d.host().windows.len() > 1, "a new OS window each frame");
+
+    // A layout kept across frames, and one rebuilt with ids, are not.
+    let mut d = driver(layout(true));
+    d.layout = rebuilt_layout(false);
+    for _ in 0..4 {
+        d.step(vec![]);
+    }
+    assert!(!warned(&d), "loaded once");
+    let mut d = driver(rebuilt_layout(true));
+    for _ in 0..4 {
+        d.layout = rebuilt_layout(true);
+        d.step(vec![]);
+    }
+    assert!(!warned(&d));
+}
+
+/// Fill of the overlay over a blocked native window in [`blocked_driver`].
+const DIM: Color32 = Color32::from_rgba_premultiplied(10, 20, 30, 120);
+
+fn blocked_driver() -> DockDriver<u32, Content> {
+    let mut d = DockDriver::new(layout(true), Content { counter: Some(5), ..Content::default() })
+        .with_style(|s| s.blocked_dim = DIM)
+        .with_native_host(ORIGIN);
+    d.settle();
+    d
+}
+
+/// Whether the native window `viewport` drew the overlay over all of its content.
+fn dimmed(d: &DockDriver<u32, Content>, viewport: egui::ViewportId) -> bool {
+    let full = Rect::from_min_size(Pos2::ZERO, d.host().windows[&viewport].rect.size());
+    d.host().windows[&viewport].shapes.iter().any(|c| matches!(&c.shape, egui::Shape::Rect(r) if r.fill == DIM && r.rect == full))
+}
+
+#[test]
+/// While input is blocked, a native window is dimmed, loses always-on-top,
+/// ignores clicks, drags, key presses and close requests, but still forwards key
+/// releases; unblocking restores normal input and activation.
+fn a_native_window_takes_no_input_while_the_app_blocks_it() {
+    let mut d = blocked_driver();
+    let id = id_of(&d);
+    let viewport = d.viewport(id);
+    let counter = d.content.counter_rect.unwrap().center();
+    let tab = pos2(90.0, TAB_ROW);
+    let key = Event::Key { key: Key::S, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::COMMAND };
+    let level = |d: &DockDriver<u32, Content>| d.host().windows[&viewport].level;
+    assert!(!dimmed(&d, viewport));
+    assert_eq!(level(&d), Some(egui::WindowLevel::AlwaysOnTop));
+
+    d.input_blocked = true;
+    d.step(vec![]);
+    assert!(dimmed(&d, viewport), "drawn dimmed");
+    assert_eq!(level(&d), Some(egui::WindowLevel::Normal), "the main window can cover the palette");
+    let out = d.window_click(id, tab);
+    assert!(out.actions.is_empty(), "{:?}", out.actions);
+    d.window_click(id, counter);
+    assert_eq!(d.content.count, 0, "the body takes no click");
+    let out = d.window_step(id, vec![key.clone(), Event::Text("s".into())]);
+    assert!(out.forwarded_events.is_empty(), "{:?}", out.forwarded_events);
+    // A key released while blocked still reaches the app, which may have seen it go down.
+    let release = Event::Key { key: Key::S, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::COMMAND };
+    let out = d.window_step(id, vec![release.clone()]);
+    assert_eq!(out.forwarded_events, vec![release]);
+    // The bar starts no move, of the dock area's or the window system's.
+    let sent = d.host().commands.len();
+    d.window_hold(id, pos2(40.0, 9.0), pos2(140.0, 59.0));
+    assert!(d.ctx.data(|data| data.get_temp::<WindowDrag>(d.id.with("window-drag"))).is_none());
+    assert!(
+        !d.host().commands[sent..].iter().any(|(v, c)| *v == viewport && matches!(c, ViewportCommand::StartDrag | ViewportCommand::OuterPosition(_)))
+    );
+    let out = d.window_release(id, pos2(140.0, 59.0));
+    assert!(out.actions.is_empty(), "{:?}", out.actions);
+    // The OS close request is cancelled.
+    d.host().windows.get_mut(&viewport).unwrap().close = true;
+    let out = d.step(vec![]);
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::CloseWindow { .. })), "{:?}", out.actions);
+    assert!(d.host().commands.contains(&(viewport, ViewportCommand::CancelClose)));
+
+    // Unblocked, the same input works again.
+    d.input_blocked = false;
+    d.step(vec![]);
+    assert!(!dimmed(&d, viewport));
+    assert_eq!(level(&d), Some(egui::WindowLevel::AlwaysOnTop));
+    d.window_click(id, counter);
+    assert_eq!(d.content.count, 1);
+    let out = d.window_click(id, tab);
+    assert!(out.actions.contains(&Action::Activate { panel: 6 }), "{:?}", out.actions);
+    let out = d.window_step(id, vec![key.clone()]);
+    assert_eq!(out.forwarded_events, vec![key]);
+}
+
+#[test]
+/// A blocked native window rejects typing but preserves native control-event order: IME reset
+/// completion and focus loss reach both event and raw-event readers, while a shortcut release is
+/// still forwarded to the host.
+fn a_blocked_native_window_preserves_ordered_ime_reset_completions() {
+    let mut d = blocked_driver();
+    let id = id_of(&d);
+    let viewport = d.viewport(id);
+    d.content.input_probe = Some(5);
+    d.input_blocked = true;
+    let request_id = d.ctx.request_ime_reset(viewport).unwrap();
+    let completed = Event::ImeResetCompleted { request_id };
+    let focus = Event::WindowFocused(false);
+    let release = Event::Key { key: Key::S, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::COMMAND };
+    let out = d.window_step(id, vec![Event::Text("blocked".into()), completed.clone(), release.clone(), focus.clone()]);
+    assert_eq!(d.content.events, vec![completed.clone(), focus.clone()], "panel input keeps control order while rejecting typing");
+    assert_eq!(d.content.raw_events, vec![completed, focus], "raw readers receive the same native controls");
+    assert_eq!(out.forwarded_events, vec![release], "shortcut releases still reach the host");
+    assert!(d.content.typed.is_empty());
+}
+
+#[test]
+fn a_blocked_palette_stays_shown_and_behind_the_main_window_when_the_app_returns() {
+    use egui::{ViewportId, WindowLevel};
+    let mut d = blocked_driver();
+    let palette = d.viewport(id_of(&d));
+    d.input_blocked = true;
+    d.step(vec![]);
+    d.host().commands.clear();
+    let focus = |d: &mut DockDriver<u32, Content>, window: Option<ViewportId>| {
+        d.host().focus = window;
+        for _ in 0..20 {
+            d.step(vec![]);
+        }
+    };
+    // Away and back, it stays shown at the normal level: showing it or putting it on top could
+    // raise it over the modal, and showing it would, on macOS, give it focus.
+    focus(&mut d, None);
+    assert!(d.host().windows[&palette].visible);
+    focus(&mut d, Some(palette));
+    let host = d.host();
+    assert_eq!(host.windows[&palette].level, Some(WindowLevel::Normal));
+    assert!(!host.commands.iter().any(|(v, c)| *v == palette && matches!(c, ViewportCommand::Visible(_))), "{:?}", host.commands);
+    // Activated through the palette, the main window comes in front of it, with no viewers.
+    let levels: Vec<_> = host.commands.iter().filter(|(_, c)| matches!(c, ViewportCommand::WindowLevel(_))).cloned().collect();
+    let expected = if cfg!(target_os = "macos") {
+        Vec::new()
+    } else {
+        [WindowLevel::AlwaysOnTop, WindowLevel::Normal].map(|l| (ViewportId::ROOT, ViewportCommand::WindowLevel(l))).to_vec()
+    };
+    assert_eq!(levels, expected);
+}
+
+/// A menu's key equivalent, as an app's menu glue reports it in the main window's input.
+fn menu_key(key: Key) -> Vec<Event> {
+    let press = |pressed| Event::Key { key, physical_key: None, pressed, repeat: false, modifiers: Modifiers::COMMAND };
+    vec![press(true), press(false)]
+}
+
+#[test]
+fn menu_keys_go_to_the_focused_text_field_of_the_native_window_with_the_keyboard() {
+    let has = |events: &[Event], key: Key| events.iter().any(|e| matches!(e, Event::Key { key: k, .. } if *k == key));
+    let pasted = |d: &DockDriver<u32, Content>, viewport| d.host().commands.contains(&(viewport, ViewportCommand::RequestPaste));
+    let mut d = driver(layout(true));
+    let viewport = d.viewport(id_of(&d));
+    (d.content.text, d.content.focus_text) = (Some(5), true);
+    d.host().focus = Some(viewport);
+    d.settle();
+    assert_eq!(super::typing_window(&d.ctx), Some(viewport));
+    // Between frames, where an app's `raw_input_hook` asks, the answer is the last frame's.
+    d.content.blur_text = true;
+    d.step(vec![]);
+    assert_eq!(super::typing_window(&d.ctx), None, "right after the field loses focus");
+    d.content.focus_text = true;
+    d.step(vec![]);
+    assert_eq!(super::typing_window(&d.ctx), Some(viewport), "right after the field takes focus");
+    d.step(menu_key(Key::V));
+    assert!(!has(&d.content.main_keys, Key::V), "{:?}", d.content.main_keys);
+    assert!(pasted(&d, viewport), "the field's window asks for the clipboard text");
+    d.step(menu_key(Key::C));
+    assert!(!has(&d.content.main_keys, Key::C));
+    assert!(d.content.field_keys.contains(&Event::Copy), "{:?}", d.content.field_keys);
+    // Saving is the app's, from any window.
+    d.step(menu_key(Key::S));
+    assert!(has(&d.content.main_keys, Key::S));
+    assert!(!has(&d.content.field_keys, Key::S));
+
+    // Under a block the window's field is inert: the main window keeps every key.
+    d.input_blocked = true;
+    d.settle();
+    assert_eq!(super::typing_window(&d.ctx), None);
+    d.host().commands.clear();
+    d.step(menu_key(Key::V));
+    assert!(has(&d.content.main_keys, Key::V));
+    assert!(!pasted(&d, viewport));
+
+    // With no focused field, nothing moves.
+    let mut d = driver(layout(true));
+    let viewport = d.viewport(id_of(&d));
+    d.content.text = Some(5);
+    d.host().focus = Some(viewport);
+    d.settle();
+    d.step(menu_key(Key::V));
+    assert!(has(&d.content.main_keys, Key::V));
+    assert!(d.content.field_keys.is_empty(), "{:?}", d.content.field_keys);
+    assert!(!pasted(&d, viewport));
+}
+
+#[test]
+fn a_focused_field_and_a_held_press_stay_inert_across_a_block() {
+    let mut d = blocked_driver();
+    let id = id_of(&d);
+    d.content.text = Some(5);
+    d.content.focus_text = true;
+    d.step(vec![]);
+    d.window_step(id, vec![Event::Text("a".into())]);
+    assert_eq!(d.content.typed, "a");
+    // The field loses focus when the block starts, and stays without it after.
+    d.input_blocked = true;
+    d.step(vec![]);
+    let out = d.window_step(id, vec![Event::Text("b".into())]);
+    assert!(out.forwarded_events.is_empty(), "{:?}", out.forwarded_events);
+    d.input_blocked = false;
+    d.step(vec![]);
+    let out = d.window_step(id, vec![Event::Text("c".into())]);
+    assert_eq!(d.content.typed, "a");
+    assert_eq!(out.forwarded_events, vec![Event::Text("c".into())]);
+
+    // A press made while blocked and released after is no click.
+    let counter = d.content.counter_rect.unwrap().center();
+    d.input_blocked = true;
+    d.step(vec![]);
+    d.window_step(id, vec![Event::PointerMoved(counter), button(counter, true)]);
+    d.input_blocked = false;
+    d.step(vec![]);
+    d.window_step(id, vec![button(counter, false)]);
+    assert_eq!(d.content.count, 0);
+}
+
+#[test]
+fn blocking_input_hands_focus_from_a_native_window_to_the_main_window() {
+    let focus_main = |d: &DockDriver<u32, Content>| {
+        d.host().commands.iter().filter(|(v, c)| *v == egui::ViewportId::ROOT && matches!(c, ViewportCommand::Focus)).count()
+    };
+    let steps = |d: &mut DockDriver<u32, Content>, n: usize| {
+        for _ in 0..n {
+            d.step(vec![]);
+        }
+    };
+    let focused_float = || {
+        let mut d = blocked_driver();
+        let viewport = d.viewport(id_of(&d));
+        d.host().focus = Some(viewport);
+        d.step(vec![]);
+        d.input_blocked = true;
+        d
+    };
+    // A dialog opened from a floating panel needs the keys there, in the main window: once,
+    // after a short wait.
+    let mut d = focused_float();
+    steps(&mut d, 2);
+    assert_eq!(focus_main(&d), 0, "not yet: an OS dialog may still take focus");
+    steps(&mut d, 30);
+    assert_eq!(focus_main(&d), 1);
+    // An OS dialog took focus meanwhile: no window of the area has it, so nothing is sent.
+    let mut d = focused_float();
+    d.step(vec![]);
+    d.host().focus = None;
+    steps(&mut d, 30);
+    assert_eq!(focus_main(&d), 0);
+    // Blocking ended before the wait was over.
+    let mut d = focused_float();
+    d.step(vec![]);
+    d.input_blocked = false;
+    steps(&mut d, 30);
+    assert_eq!(focus_main(&d), 0);
+    // With the main window focused already, nothing is sent.
+    let mut d = blocked_driver();
+    d.input_blocked = true;
+    steps(&mut d, 30);
+    assert_eq!(focus_main(&d), 0);
+}
+
+#[test]
+fn blocking_input_cancels_a_drag_in_progress() {
+    // A tab drag a native window owns.
+    let mut d = blocked_driver();
+    let id = id_of(&d);
+    let over = d.window_local(id, ORIGIN + vec2(600.0, 300.0)).unwrap();
+    d.window_hold(id, pos2(15.0, TAB_ROW), over);
+    assert!(super::is_dragging::<u32>(&d.ctx, d.id));
+    d.input_blocked = true;
+    d.step(vec![]);
+    assert!(!super::is_dragging::<u32>(&d.ctx, d.id));
+    let out = d.window_release(id, over);
+    assert!(!out.actions.iter().any(|a| matches!(a, Action::Move { .. } | Action::Float { .. })), "{:?}", out.actions);
+
+    // A bar drag.
+    let mut d = blocked_driver();
+    let id = id_of(&d);
+    d.window_hold(id, pos2(40.0, 9.0), pos2(140.0, 59.0));
+    assert!(d.ctx.data(|data| data.get_temp::<WindowDrag>(d.id.with("window-drag"))).is_some());
+    d.input_blocked = true;
+    d.step(vec![]);
+    assert!(d.ctx.data(|data| data.get_temp::<WindowDrag>(d.id.with("window-drag"))).is_none());
+}
+
+#[test]
+fn replacing_the_layout_or_cancel_drag_ends_a_bar_drag() {
+    let moving = |d: &DockDriver<u32, Content>| d.ctx.data(|data| data.get_temp::<WindowDrag>(d.id.with("window-drag")));
+    for replace in [false, true] {
+        let mut d = driver(layout(true));
+        let id = id_of(&d);
+        d.window_step(id, vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+        d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+        assert!(moving(&d).is_some());
+        d.step(vec![]);
+        if replace {
+            // The same window where the OS has it, beside swapped frames.
+            let mut replacement = layout(true);
+            replacement.root = Some(Node::Split {
+                axis: SplitAxis::Horizontal,
+                size: SplitSize::Ratio(0.5),
+                first: Box::new(tabs(&[3, 4])),
+                second: Box::new(tabs(&[1, 2])),
+            });
+            replacement.floating[0] = Floating { native: window(&d, 5).native, ..replacement.floating[0].clone().with_id(id) };
+            d.layout = replacement;
+        } else {
+            super::cancel_drag::<u32>(&d.ctx, d.id);
+        }
+        d.settle();
+        assert_eq!(moving(&d), None);
+        // The OS window goes where the layout has it.
+        let before = os_window(&d, 5).unwrap().0;
+        let native = window(&d, 5).native.unwrap();
+        assert_eq!(before.min, pos2(native[0], native[1]));
+        d.window_step(id, vec![Event::PointerMoved(pos2(90.0, 39.0))]);
+        d.window_step(id, vec![Event::PointerMoved(pos2(120.0, 59.0))]);
+        assert_eq!(moving(&d), None);
+        assert_eq!(os_window(&d, 5).unwrap().0, before);
+        let out = d.window_step(id, vec![button(pos2(120.0, 59.0), false)]);
+        assert!(!out.actions.iter().any(|a| matches!(a, Action::Move { .. } | Action::MoveWindow { .. })), "{:?}", out.actions);
+    }
+}
+
+#[test]
+fn replacing_the_layout_ends_a_divider_drag_in_a_native_window() {
+    let resizes = |out: &super::DockOutput<u32>| out.actions.iter().filter(|a| matches!(a, Action::ResizeWindowSplit { .. })).count();
+    let split = |d: &DockDriver<u32, Content>| match &window(d, 5).root {
+        Node::Split { size, .. } => *size,
+        root => panic!("{root:?}"),
+    };
+    for replace in [false, true] {
+        let mut start = layout(false);
+        let mut float = Floating::single(vec![5], 0, [300.0, 80.0, 240.0, 300.0]);
+        float.root =
+            Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::Ratio(0.5), first: Box::new(tabs(&[5])), second: Box::new(tabs(&[6])) };
+        start.floating.push(float);
+        let mut d = driver(start);
+        d.settle();
+        let id = id_of(&d);
+        let out = d.window_hold(id, pos2(120.0, 150.0), pos2(150.0, 150.0));
+        assert!(resizes(&out) > 0, "{:?}", out.actions);
+        if replace {
+            d.layout.root = Some(Node::Split {
+                axis: SplitAxis::Horizontal,
+                size: SplitSize::Ratio(0.5),
+                first: Box::new(tabs(&[3, 4])),
+                second: Box::new(tabs(&[1, 2])),
+            });
+        }
+        let before = split(&d);
+        let mut moved = 0;
+        for x in [160.0, 170.0, 180.0] {
+            moved += resizes(&d.window_step(id, vec![Event::PointerMoved(pos2(x, 150.0))]));
+        }
+        moved += resizes(&d.window_release(id, pos2(180.0, 150.0)));
+        if replace {
+            assert_eq!(moved, 0);
+            assert_eq!(split(&d), before);
+        } else {
+            assert!(moved > 0);
+            assert_ne!(split(&d), before);
+        }
+    }
+}
+
+/// [`layout`] with window `[5, 6]` saved as a native window at `NATIVE`.
+fn saved_native() -> Layout<u32> {
+    let mut layout = layout(true);
+    layout.floating[0].native = Some(NATIVE);
+    layout
+}
+
+const NATIVE: [f32; 4] = [700.0, 400.0, 240.0, 300.0];
+
+#[test]
+fn with_native_windows_off_a_float_stays_in_the_app_window_and_keeps_its_native_rect() {
+    let mut d = DockDriver::new(saved_native(), Content::default());
+    d.native_windows = false;
+    let mut d = d.with_native_host(ORIGIN);
+    assert!(d.host().windows.is_empty() && d.host().commands.is_empty());
+    assert!(d.hit(&Hit::Title(5)).is_some(), "drawn in the main window");
+    assert_eq!(window(&d, 5).native, Some(NATIVE));
+
+    // Its tab docks again by drag, in the main window.
+    let tab = d.hit(&Hit::Tab(5)).unwrap().center();
+    let out = d.drag(tab, pos2(600.0, 300.0));
+    assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 5, anchor: 3 | 4, .. }]), "{:?}", out.actions);
+    assert!(in_root(&d, 5));
+    assert_eq!(window(&d, 6).native, Some(NATIVE));
+    assert!(d.host().windows.is_empty() && d.host().commands.is_empty());
+
+    // The same workspace opens as a native window where native windows are on.
+    let mut d = driver(saved_native());
+    d.settle();
+    assert_eq!(os_window(&d, 5).map(|(rect, _)| rect), Some(Rect::from_min_size(pos2(700.0, 400.0), vec2(240.0, 300.0))));
+}
+
+#[test]
+fn wayland_is_a_main_window_that_never_reported_a_position() {
+    use super::render::Session;
+    let mut d = driver(layout(false));
+    d.host().no_position = true;
+    d.step(vec![]);
+    assert!(wayland(&d.ctx, Session::Wayland));
+    assert!(wayland(&d.ctx, Session::Unknown), "a real window without a Wayland variable");
+    assert!(!wayland(&d.ctx, Session::Other), "X11");
+    // X11 (forced under a Wayland session) reports it; minimized, it reports none again.
+    d.host().no_position = false;
+    d.step(vec![]);
+    assert!(!wayland(&d.ctx, Session::Wayland));
+    d.host().no_position = true;
+    d.step(vec![]);
+    assert!(!wayland(&d.ctx, Session::Wayland));
+    // A context with no real window (a headless test) and no display variables at all.
+    let ctx = egui::Context::default();
+    ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
+    assert!(!wayland(&ctx, Session::Unknown));
+}
+
+#[test]
+fn the_session_follows_winits_environment_rule() {
+    use super::render::{Session, session};
+    let with = |vars: &'static [&'static str]| move |name: &str| vars.contains(&name);
+    assert_eq!(session(true, with(&["WAYLAND_DISPLAY", "DISPLAY"])), Session::Wayland);
+    assert_eq!(session(true, with(&["WAYLAND_SOCKET"])), Session::Wayland);
+    assert_eq!(session(true, with(&["DISPLAY"])), Session::Other);
+    assert_eq!(session(true, with(&[])), Session::Unknown);
+    assert_eq!(session(false, with(&["WAYLAND_DISPLAY"])), Session::Other);
+}
+
+/// A driver whose panel `source` has an app drag source and whose panels `sites` are drop sites.
+fn app_drag(layout: Layout<u32>, source: u32, sites: &[u32]) -> DockDriver<u32, Content> {
+    let mut d = driver(layout);
+    (d.content.source, d.content.drop_sites, d.content.marks) = (Some(source), sites.to_vec(), Marks::Route(d.id));
+    d.settle();
+    d
+}
+
+#[allow(clippy::expect_used)]
+fn source(d: &DockDriver<u32, Content>) -> Pos2 {
+    d.content.source_rect.expect("source drawn").center()
+}
+
+#[test]
+fn an_app_drag_from_the_main_window_reaches_a_native_windows_panel() {
+    // Panel 3's frame lies under window [5, 6], which takes the drop.
+    let mut d = app_drag(layout(true), 1, &[3, 5]);
+    let id = window(&d, 5).id;
+    let local = pos2(120.0, 200.0);
+    let point = d.host().windows[&d.viewport(id)].rect.min + local.to_vec2() - ORIGIN.to_vec2();
+    d.hold(source(&d), point);
+    assert!(d.content.hovers.contains(&(5, local)), "{:?}", d.content.hovers);
+    d.release(point);
+    d.step(vec![]);
+    assert_eq!(d.content.drops, vec![(5, local)]);
+    assert!(!d.content.hovers.iter().any(|(panel, _)| *panel == 3), "{:?}", d.content.hovers);
+}
+
+#[test]
+fn a_stop_withdraws_a_routed_release_no_window_read_but_not_the_owners() {
+    let mut d = app_drag(layout(true), 5, &[1]);
+    let id = window(&d, 5).id;
+    let local = d.window_local(id, ORIGIN + vec2(100.0, 300.0)).unwrap();
+    d.window_hold(id, source(&d), local);
+    // The release is queued for the main window's next pass, and the drag is cancelled first.
+    d.window_release(id, local);
+    super::cancel_drag::<u32>(&d.ctx, d.id);
+    d.step(vec![]);
+    d.step(vec![]);
+    assert_eq!(d.content.drops, vec![]);
+    // The owner still gets its own release.
+    assert_eq!(d.content.source_stopped, 1);
+}
+
+#[test]
+fn a_plain_egui_drag_over_a_native_window_keeps_its_moves_and_is_not_routed() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    d.content.marks = Marks::Nothing;
+    let id = window(&d, 5).id;
+    let over = d.host().windows[&d.viewport(id)].rect.center() - ORIGIN.to_vec2();
+    let from = source(&d);
+    d.hold(from, over);
+    d.move_to(over + vec2(20.0, 10.0));
+    let moved = over + vec2(20.0, 10.0) - from;
+    assert!((d.content.source_delta - moved).length() < 0.01, "{:?}, not {moved:?}", d.content.source_delta);
+    d.release(over);
+    d.step(vec![]);
+    assert!(d.content.hovers.is_empty(), "{:?}", d.content.hovers);
+    assert!(d.content.drops.is_empty(), "{:?}", d.content.drops);
+    assert_eq!(d.content.source_stopped, 1);
+}
+
+#[test]
+fn an_egui_payload_reaches_a_window_drawn_before_the_owner() {
+    // The main window draws before the native window that owns the drag.
+    let mut d = app_drag(layout(true), 5, &[1]);
+    d.content.marks = Marks::Payload;
+    let id = window(&d, 5).id;
+    let local = d.window_local(id, ORIGIN + vec2(100.0, 300.0)).unwrap();
+    d.window_hold(id, source(&d), local);
+    d.window_release(id, local);
+    d.step(vec![]);
+    d.step(vec![]);
+    assert_eq!(d.content.payload_drops, vec![1]);
+    assert!(!egui::DragAndDrop::has_any_payload(&d.ctx));
+}
+
+#[test]
+fn an_owner_that_discards_its_release_pass_keeps_the_payload_for_the_target() {
+    let mut d = app_drag(layout(true), 5, &[1]);
+    d.content.marks = Marks::Payload;
+    let id = window(&d, 5).id;
+    let local = d.window_local(id, ORIGIN + vec2(100.0, 300.0)).unwrap();
+    d.window_hold(id, source(&d), local);
+    // The owner's pass that holds its release runs twice.
+    d.content.discard_next = true;
+    d.window_release(id, local);
+    d.step(vec![]);
+    d.step(vec![]);
+    assert_eq!(d.content.payload_drops, vec![1]);
+}
+
+#[test]
+fn pointer_events_after_a_held_release_wait_behind_it() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    let id = window(&d, 5).id;
+    let point = d.host().windows[&d.viewport(id)].rect.min + vec2(120.0, 200.0) - ORIGIN.to_vec2();
+    d.hold(source(&d), point);
+    let delta = d.content.source_delta;
+    // The release over the native window, then the pointer back on the source and a new press,
+    // in one input.
+    let at = source(&d);
+    d.step(vec![button(point, false), Event::PointerMoved(at), button(at, true)]);
+    assert_eq!(d.content.source_delta, delta, "no move after the release reaches the source's drag");
+    d.step(vec![]);
+    assert!(d.ctx.input(|i| i.pointer.primary_down()), "the new press outlives the held release");
+}
+
+#[test]
+fn the_owners_drag_stops_a_pass_after_its_release_over_another_window() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    let id = window(&d, 5).id;
+    let local = pos2(120.0, 200.0);
+    let point = d.host().windows[&d.viewport(id)].rect.min + local.to_vec2() - ORIGIN.to_vec2();
+    d.hold(source(&d), point);
+    d.release(point);
+    assert_eq!((d.content.drops.clone(), d.content.source_stopped), (vec![(5, local)], 0));
+    // The owner saw the pointer go, and holds its release and the pointer's going once.
+    assert_eq!(d.ctx.input(|i| i.pointer.hover_pos()), None);
+    let held = super::render::held_events(&d.ctx, egui::ViewportId::ROOT);
+    assert!(matches!(held.as_slice(), [Event::PointerButton { pressed: false, .. }, Event::PointerGone]), "{held:?}");
+    d.step(vec![]);
+    assert_eq!(d.content.source_stopped, 1);
+    assert_eq!(d.ctx.dragged_id(), None);
+}
+
+#[test]
+fn a_press_right_after_a_routed_release_outlives_the_held_release() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    let id = window(&d, 5).id;
+    let point = d.host().windows[&d.viewport(id)].rect.min + vec2(120.0, 200.0) - ORIGIN.to_vec2();
+    d.hold(source(&d), point);
+    d.release(point);
+    // The owner's held release comes before a press in its next input.
+    let at = source(&d);
+    d.step(vec![Event::PointerMoved(at), button(at, true)]);
+    assert!(d.ctx.input(|i| i.pointer.primary_down()));
+}
+
+#[test]
+fn a_routed_release_clicks_nothing_in_the_target() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    d.content.counter = Some(5);
+    d.step(vec![]);
+    let id = window(&d, 5).id;
+    let button = d.content.counter_rect.unwrap().center();
+    let point = d.host().windows[&d.viewport(id)].rect.min + button.to_vec2() - ORIGIN.to_vec2();
+    d.hold(source(&d), point);
+    d.release(point);
+    d.step(vec![]);
+    assert_eq!(d.content.drops, vec![(5, button)]);
+    assert_eq!(d.content.count, 0);
+}
+
+#[test]
+fn an_app_drag_from_a_native_window_reaches_the_main_window() {
+    let mut d = app_drag(layout(true), 5, &[1]);
+    let id = window(&d, 5).id;
+    // Frame [1, 2], left of the native window on the desktop.
+    let point = pos2(100.0, 300.0);
+    let local = d.window_local(id, ORIGIN + point.to_vec2()).unwrap();
+    d.window_hold(id, source(&d), local);
+    d.window_release(id, local);
+    d.step(vec![]);
+    d.step(vec![]);
+    assert_eq!(d.content.drops, vec![(1, point)]);
+    assert!(d.content.hovers.contains(&(1, point)), "{:?}", d.content.hovers);
+}
+
+#[test]
+fn an_app_drag_between_native_windows_drops_in_the_front_one() {
+    // Window [7] overlaps window [5, 6] at (550, 280) on the desktop; window [8] is apart.
+    let mut layout = layout(true);
+    layout.floating.push(Floating::single(vec![7], 0, [350.0, 150.0, 240.0, 150.0]));
+    layout.floating.push(Floating::single(vec![8], 0, [20.0, 420.0, 240.0, 150.0]));
+    let overlap = pos2(550.0, 280.0);
+    for front in [7, 5] {
+        let mut d = app_drag(layout.clone(), 8, &[5, 7]);
+        let viewport = d.viewport(window(&d, front).id);
+        d.host().focus = Some(viewport);
+        d.step(vec![]);
+        d.host().focus = Some(egui::ViewportId::ROOT);
+        d.step(vec![]);
+        let (owner, target) = (window(&d, 8).id, window(&d, front).id);
+        let local = d.window_local(owner, overlap).unwrap();
+        d.window_hold(owner, source(&d), local);
+        d.window_release(owner, local);
+        d.step(vec![]);
+        d.step(vec![]);
+        assert_eq!(d.content.drops, vec![(front, d.window_local(target, overlap).unwrap())], "front {front}");
+    }
+}
+
+#[test]
+fn an_app_drag_released_outside_every_window_drops_nowhere() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    let id = window(&d, 5).id;
+    let over = d.host().windows[&d.viewport(id)].rect.center() - ORIGIN.to_vec2();
+    d.hold(source(&d), over);
+    assert!(d.content.hovers.iter().any(|(panel, _)| *panel == 5), "{:?}", d.content.hovers);
+    // Left of the main window, over no window of the app: the native window sees the pointer go.
+    let out = pos2(-60.0, 120.0);
+    d.move_to(out);
+    d.content.hovers.clear();
+    d.move_to(out);
+    d.release(out);
+    d.step(vec![]);
+    assert!(d.content.hovers.is_empty(), "{:?}", d.content.hovers);
+    assert!(d.content.drops.is_empty(), "{:?}", d.content.drops);
+}
+
+/// Hold an app drag from panel 1 over window [5, 6] and release it there.
+fn drag_onto_window(d: &mut DockDriver<u32, Content>) {
+    let id = window(d, 5).id;
+    let over = d.host().windows[&d.viewport(id)].rect.center() - ORIGIN.to_vec2();
+    d.hold(source(d), over);
+    d.release(over);
+    d.step(vec![]);
+    d.step(vec![]);
+}
+
+#[test]
+fn no_app_drag_is_routed_where_windows_report_no_positions() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    d.host().no_position = true;
+    d.step(vec![]);
+    drag_onto_window(&mut d);
+    assert!(d.content.hovers.is_empty(), "{:?}", d.content.hovers);
+    assert!(d.content.drops.is_empty(), "{:?}", d.content.drops);
+}
+
+#[test]
+fn a_blocked_native_window_gets_no_app_drag() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    d.input_blocked = true;
+    d.settle();
+    drag_onto_window(&mut d);
+    assert!(d.content.hovers.is_empty(), "{:?}", d.content.hovers);
+    assert!(d.content.drops.is_empty(), "{:?}", d.content.drops);
+}
+
+#[test]
+fn escape_and_cancel_drag_end_the_routing_of_an_app_drag() {
+    for cancel in [false, true] {
+        let mut d = app_drag(layout(true), 1, &[5]);
+        let id = window(&d, 5).id;
+        let over = d.host().windows[&d.viewport(id)].rect.center() - ORIGIN.to_vec2();
+        d.hold(source(&d), over);
+        assert!(!d.content.hovers.is_empty(), "cancel {cancel}");
+        if cancel {
+            super::cancel_drag::<u32>(&d.ctx, d.id);
+            d.step(vec![]);
+        } else {
+            d.key(Key::Escape);
+        }
+        d.content.hovers.clear();
+        d.move_to(over);
+        d.release(over);
+        d.step(vec![]);
+        assert!(d.content.hovers.is_empty(), "cancel {cancel}: {:?}", d.content.hovers);
+        assert!(d.content.drops.is_empty(), "cancel {cancel}: {:?}", d.content.drops);
+    }
+}
+
+#[test]
+/// Dragging a tab onto a native window's body emits a tab `Move` rather than
+/// an app body drag and leaves the content's drops empty.
+fn a_tab_drag_onto_a_native_window_is_no_app_drag() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    let id = window(&d, 5).id;
+    let over = d.host().windows[&d.viewport(id)].rect.center() - ORIGIN.to_vec2();
+    let tab = d.hit(&Hit::Tab(1)).unwrap().center();
+    let out = d.drag(tab, over);
+    d.step(vec![]);
+    assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 1, anchor: 5 | 6, .. }]), "{:?}", out.actions);
+    assert!(d.content.drops.is_empty(), "{:?}", d.content.drops);
+}
+
+/// `cancel_drag` from an app's per-area native input hook (`DockArea::native_input_hook`)
+/// runs while egui holds the `NativeInput` plugin lock. It must not try to lock that plugin
+/// again: in a debug build the original deadlocks, and egui's debug mutex panics after its
+/// 10 s deadlock bound.
+#[test]
+fn cancel_drag_from_a_native_input_hook_returns() {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    };
+
+    let cancel = Arc::new(AtomicBool::new(false));
+    let flag = cancel.clone();
+    let mut d = driver(layout(true)).with_native_input_hook(move |ctx, _input| {
+        if flag.swap(false, Ordering::SeqCst) {
+            // `driver` uses this area id.
+            super::cancel_drag::<u32>(ctx, egui::Id::unique("dock-driver"));
+        }
+    });
+    let id = id_of(&d);
+    d.settle();
+
+    // The hook runs for the native window's input, inside `NativeInput::input_hook`.
+    cancel.store(true, Ordering::SeqCst);
+    d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 150.0))]);
+    assert!(!cancel.load(Ordering::SeqCst), "the hook did not run");
+}
+
+/// `send_keys` from the per-area native input hook, inside `Plugin::input_hook`, returns
+/// without locking the plugin again, and the keys reach that window's next input.
+#[test]
+fn send_keys_from_a_native_input_hook_returns_and_delivers() {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    };
+
+    let send = Arc::new(AtomicBool::new(false));
+    let flag = send.clone();
+    let mut d = driver(layout(true)).with_native_input_hook(move |ctx, input| {
+        if flag.swap(false, Ordering::SeqCst) {
+            super::send_keys(ctx, input.viewport_id, vec![Event::Copy]);
+        }
+    });
+    let id = id_of(&d);
+    d.content.text = Some(5);
+    d.settle();
+    send.store(true, Ordering::SeqCst);
+    d.window_step(id, vec![]);
+    assert!(!send.load(Ordering::SeqCst), "the hook did not run");
+    d.step(vec![]);
+    d.window_step(id, vec![]);
+    assert!(d.content.field_keys.contains(&Event::Copy), "{:?}", d.content.field_keys);
+}
+
+/// An app drag with a release queued for the main window: `cancel_drag` from the per-area
+/// native input hook (inside `Plugin::input_hook`, with egui holding the `NativeInput` plugin
+/// lock) returns without deadlocking, withdraws that release, and leaves the owner's own
+/// release.
+#[test]
+fn cancel_drag_from_a_native_input_hook_withdraws_a_queued_release() {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    };
+
+    let cancel = Arc::new(AtomicBool::new(false));
+    let flag = cancel.clone();
+    let mut d = app_drag(layout(true), 5, &[1]).with_native_input_hook(move |ctx, _input| {
+        if flag.swap(false, Ordering::SeqCst) {
+            // `driver` uses this area id.
+            super::cancel_drag::<u32>(ctx, egui::Id::unique("dock-driver"));
+        }
+    });
+    let id = window(&d, 5).id;
+    // The release is over the main window: it is queued for the main window's next pass.
+    let local = d.window_local(id, ORIGIN + vec2(100.0, 300.0)).unwrap();
+    d.window_hold(id, source(&d), local);
+    cancel.store(true, Ordering::SeqCst);
+    d.window_release(id, local);
+    assert!(!cancel.load(Ordering::SeqCst), "the hook did not run");
+    assert!(d.content.drops.is_empty(), "{:?}", d.content.drops);
+    assert_eq!(d.content.source_stopped, 0, "the owner's own release is still held");
+    d.step(vec![]);
+    d.step(vec![]);
+    assert!(d.content.drops.is_empty(), "{:?}", d.content.drops);
+    assert_eq!(d.content.source_stopped, 1, "the owner still gets its own release");
+    assert!(super::render::held_events(&d.ctx, egui::ViewportId::ROOT).is_empty());
+    assert!(super::render::held_events(&d.ctx, d.viewport(id)).is_empty());
+}
+
+/// A main-window owner that asks for its release pass to be discarded still gets its release
+/// exactly once, and the native target reads the payload exactly once.
+#[test]
+fn a_root_owner_that_discards_its_release_pass_drops_the_payload_once() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    d.content.marks = Marks::Payload;
+    let id = window(&d, 5).id;
+    let local = pos2(120.0, 200.0);
+    let point = d.host().windows[&d.viewport(id)].rect.min + local.to_vec2() - ORIGIN.to_vec2();
+    d.hold(source(&d), point);
+
+    d.content.discard_next = true;
+    d.release(point);
+    assert_eq!(d.content.drops, vec![(5, local)]);
+    assert_eq!(d.content.payload_drops, vec![5]);
+    // The owner's release may arrive in the same frame's rerun.
+    assert_eq!(d.content.source_stopped, 1);
+    assert_eq!(d.content.source_releases, 1, "the owner receives its release once");
+
+    d.step(vec![]);
+    assert_eq!(d.content.drops, vec![(5, local)], "the target drops once");
+    assert_eq!(d.content.payload_drops, vec![5], "the payload drops once");
+    assert_eq!(d.content.source_stopped, 1, "the owner gets its release once");
+    assert_eq!(d.content.source_releases, 1, "the owner receives its release once");
+    assert!(!egui::DragAndDrop::has_any_payload(&d.ctx));
+    assert!(super::render::held_events(&d.ctx, egui::ViewportId::ROOT).is_empty());
+}
+
+/// A native target that asks for its release pass to be discarded reads the release and the
+/// payload once; its rerun has no events, and the owner's held release follows a pass later.
+#[test]
+fn a_target_that_discards_its_release_pass_drops_the_payload_once() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    d.content.marks = Marks::Payload;
+    d.content.discard_drop = true;
+    let id = window(&d, 5).id;
+    let local = pos2(120.0, 200.0);
+    let point = d.host().windows[&d.viewport(id)].rect.min + local.to_vec2() - ORIGIN.to_vec2();
+    d.hold(source(&d), point);
+
+    d.release(point);
+    assert_eq!(d.content.drops, vec![(5, local)]);
+    assert_eq!(d.content.payload_drops, vec![5]);
+    assert_eq!(d.content.source_stopped, 0, "the owner's release is held for a later pass");
+    assert_eq!(d.content.source_releases, 0, "the owner's release is held for a later pass");
+
+    d.step(vec![]);
+    assert_eq!(d.content.drops, vec![(5, local)], "the target drops once");
+    assert_eq!(d.content.payload_drops, vec![5], "the payload drops once");
+    assert_eq!(d.content.source_stopped, 1, "the owner gets its release once");
+    assert_eq!(d.content.source_releases, 1, "the owner receives its release once");
+    assert!(!egui::DragAndDrop::has_any_payload(&d.ctx));
+    assert!(super::render::held_events(&d.ctx, egui::ViewportId::ROOT).is_empty());
+}
+
+/// Several discarded passes in one frame neither duplicate nor lose the routed release: the
+/// target's drop and payload read, and the owner's release, happen exactly once.
+#[test]
+fn repeated_discards_deliver_the_release_and_drop_once() {
+    let mut d = app_drag(layout(true), 1, &[5]);
+    d.content.marks = Marks::Payload;
+    let id = window(&d, 5).id;
+    let local = pos2(120.0, 200.0);
+    let point = d.host().windows[&d.viewport(id)].rect.min + local.to_vec2() - ORIGIN.to_vec2();
+    d.hold(source(&d), point);
+
+    d.ctx.memory_mut(|memory| memory.options.max_passes = std::num::NonZeroUsize::new(4).unwrap());
+    d.content.discard_passes = 3;
+    d.release(point);
+    assert_eq!(d.content.drops, vec![(5, local)], "the target drops once");
+    assert_eq!(d.content.payload_drops, vec![5], "the payload drops once");
+    assert_eq!(d.content.source_stopped, 1, "the owner gets its release once");
+    assert_eq!(d.content.source_releases, 1, "the owner receives its release once");
+
+    // The frame ran its fourth, completing pass here; the release and payload are gone.
+    d.step(vec![]);
+    assert_eq!(d.content.drops, vec![(5, local)]);
+    assert_eq!(d.content.payload_drops, vec![5]);
+    assert_eq!(d.content.source_stopped, 1);
+    assert_eq!(d.content.source_releases, 1);
+    assert!(!egui::DragAndDrop::has_any_payload(&d.ctx));
+    assert!(super::render::held_events(&d.ctx, egui::ViewportId::ROOT).is_empty());
+}
+
+#[test]
+fn a_native_window_fades_only_while_its_bar_drag_highlights_a_drop_target() {
+    let bar_to = |d: &mut DockDriver<u32, Content>, to: Pos2| {
+        let id = window(d, 5).id;
+        let local = d.window_local(id, ORIGIN + to.to_vec2()).unwrap();
+        d.window_step(id, vec![Event::PointerMoved(local)]);
+        drag_opacity(&d.ctx, d.id)
+    };
+    let grab = |d: &mut DockDriver<u32, Content>| {
+        let id = window(d, 5).id;
+        d.window_step(id, vec![Event::PointerMoved(pos2(40.0, 9.0)), button(pos2(40.0, 9.0), true)]);
+        d.window_step(id, vec![Event::PointerMoved(pos2(60.0, 19.0))]);
+        id
+    };
+    // A bar that only moves its window highlights nothing.
+    let mut d = driver(layout(true)).with_style(|s| {
+        s.command_press_floats = true;
+        s.title_bar_docks = false;
+    });
+    grab(&mut d);
+    assert_eq!(bar_to(&mut d, pos2(760.0, 300.0)), 1.0, "a move that cannot dock");
+
+    let mut d = driver(layout(true));
+    let id = grab(&mut d);
+    // Past the main window's right side: the desktop.
+    assert_eq!(bar_to(&mut d, pos2(1000.0, 300.0)), 1.0, "over empty space");
+    // The right edge zone of frame [3, 4].
+    assert_eq!(bar_to(&mut d, pos2(760.0, 300.0)), 0.75, "over a drop target");
+    // The middle of the frame is no target for a whole window.
+    assert_eq!(bar_to(&mut d, pos2(600.0, 300.0)), 1.0, "after leaving the target");
+    assert_eq!(bar_to(&mut d, pos2(760.0, 300.0)), 0.75);
+    // With Cmd/Ctrl held the drop floats and nothing is highlighted.
+    d.modifiers = Modifiers::COMMAND;
+    assert_eq!(bar_to(&mut d, pos2(760.0, 300.0)), 1.0, "a floating drop");
+    d.modifiers = Modifiers::NONE;
+    assert_eq!(bar_to(&mut d, pos2(760.0, 300.0)), 0.75);
+    d.window_step(id, vec![button(pos2(40.0, 9.0), false)]);
+    assert_eq!(drag_opacity(&d.ctx, d.id), 1.0, "after the drop");
+}
+
+/// A driver whose window system moves a native window for a bar drag, as AppKit does.
+fn os_driver(layout: Layout<u32>) -> DockDriver<u32, Content> {
+    let d = driver(layout);
+    d.host().moves_windows = true;
+    d
+}
+
+/// Where window [5, 6]'s bar is pressed, in its coordinates.
+const GRAB: Pos2 = pos2(40.0, 9.0);
+
+/// Press window [5, 6]'s bar.
+fn os_press(d: &mut DockDriver<u32, Content>) -> u64 {
+    let id = id_of(d);
+    d.window_step(id, vec![Event::PointerMoved(GRAB), button(GRAB, true)]);
+    id
+}
+
+fn bar_dragging(d: &DockDriver<u32, Content>) -> bool {
+    d.ctx.data(|data| data.get_temp::<WindowDrag>(d.id.with("window-drag"))).is_some()
+}
+
+#[test]
+fn the_window_system_moves_a_native_window_for_its_bar_drag() {
+    let mut d = os_driver(layout(true));
+    let id = id_of(&d);
+    let viewport = d.viewport(id);
+    let before = moves(&d, viewport).len();
+    let sent = d.host().commands.len();
+    os_press(&mut d);
+    assert!(d.host().commands[sent..].iter().any(|(v, c)| *v == viewport && *c == ViewportCommand::StartDrag), "on the press");
+    // Over the right edge zone of frame [3, 4]. The window reports its place where the drag
+    // began, so the target is found from the cursor.
+    let target = ORIGIN + vec2(760.0, 300.0);
+    os_bar_drag_on(&mut d, id, target);
+    assert_eq!(d.host().windows[&viewport].rect.min, target - GRAB.to_vec2());
+    assert_eq!(drag_opacity(&d.ctx, d.id), 0.75, "over a drop target");
+    // Escape does not cancel it.
+    d.window_step(id, vec![escape()]);
+    assert!(bar_dragging(&d));
+    assert_eq!(d.host().windows[&viewport].rect.min, target - GRAB.to_vec2());
+    // Released on the desktop right of the main window, it stays where the cursor left it.
+    let desktop = ORIGIN + vec2(1000.0, 300.0);
+    d.window_pointer(id, desktop);
+    assert_eq!(drag_opacity(&d.ctx, d.id), 1.0, "over empty space");
+    let out = d.window_release(id, GRAB);
+    assert_eq!(window_move(&out), None, "{:?}", out.actions);
+    d.settle();
+    let to = desktop - GRAB.to_vec2();
+    assert_eq!(window(&d, 5).native, Some([to.x, to.y, 240.0, 300.0]));
+    assert_eq!(moves(&d, viewport).len(), before, "the app moved the window");
+}
+
+/// Move the cursor of the bar drag of window `id` to the desktop point `to` in two steps.
+fn os_bar_drag_on(d: &mut DockDriver<u32, Content>, id: u64, to: Pos2) {
+    let from = d.host().windows[&d.viewport(id)].rect.min + GRAB.to_vec2();
+    d.window_pointer(id, from.lerp(to, 0.5));
+    d.window_pointer(id, to);
+}
+
+#[test]
+fn a_bar_drag_the_window_system_moves_ends_once_on_the_first_release_reported() {
+    // The window system reports the release a frame before egui: the window docks then.
+    let mut d = os_driver(layout(true));
+    let id = os_press(&mut d);
+    os_bar_drag_on(&mut d, id, ORIGIN + vec2(760.0, 300.0));
+    d.host().held = false;
+    let out = d.step(vec![]);
+    assert!(matches!(window_move(&out), Some(Target::At { anchor: 3 | 4, placement: Placement::Split(super::Zone::Right) })), "{:?}", out.actions);
+    assert!(in_root(&d, 5) && in_root(&d, 6));
+
+    // With Cmd held it only moves, and egui's release without Cmd a frame later docks nothing.
+    let mut d = os_driver(layout(true));
+    let id = os_press(&mut d);
+    let viewport = d.viewport(id);
+    d.modifiers = Modifiers::COMMAND;
+    let target = ORIGIN + vec2(760.0, 300.0);
+    os_bar_drag_on(&mut d, id, target);
+    assert_eq!(drag_opacity(&d.ctx, d.id), 1.0, "a floating drop");
+    d.host().held = false;
+    let out = d.step(vec![]);
+    assert_eq!(window_move(&out), None, "{:?}", out.actions);
+    assert!(!bar_dragging(&d));
+    d.modifiers = Modifiers::NONE;
+    let sent = d.host().commands.len();
+    let out = d.window_release(id, GRAB);
+    assert_eq!(window_move(&out), None, "{:?}", out.actions);
+    assert!(!bar_dragging(&d));
+    assert!(
+        !d.host().commands[sent..].iter().any(|(v, c)| *v == viewport && matches!(c, ViewportCommand::StartDrag | ViewportCommand::OuterPosition(_)))
+    );
+    d.settle();
+    let to = target - GRAB.to_vec2();
+    assert_eq!(window(&d, 5).native.map(|r| [r[0], r[1]]), Some([to.x, to.y]));
+
+    // A click on the bar over the main window docks and moves nothing.
+    let mut d = os_driver(layout(true));
+    let native = window(&d, 5).native;
+    let id = os_press(&mut d);
+    let out = d.window_release(id, GRAB);
+    assert!(out.actions.is_empty(), "{:?}", out.actions);
+    d.settle();
+    assert_eq!(window(&d, 5).native, native);
+}
diff --git a/crates/ui/src/docking/placement.rs b/crates/ui/src/docking/placement.rs
new file mode 100644
index 00000000..82856c8d
--- /dev/null
+++ b/crates/ui/src/docking/placement.rs
@@ -0,0 +1,248 @@
+//! Where native floating windows go on the desktop (feature `native-windows`). Rects are
+//! `[x, y, width, height]` in desktop logical points.
+
+use egui::{Pos2, Rect, Vec2, pos2};
+
+use super::Monitor;
+
+/// Largest native window, and the farthest it may sit from the desktop origin.
+const MAX_SIZE: f32 = 16_384.0;
+const MAX_POSITION: f32 = 100_000.0;
+const MIN_SIZE: [f32; 2] = [160.0, 100.0];
+/// Height of the bar at the top of a native window.
+pub(super) const BAR_HEIGHT: f32 = 18.0;
+/// How much of a window's bar must lie on one monitor for the window to be reachable: wide
+/// enough to grab, and half its height.
+const REACHABLE: [f32; 2] = [40.0, BAR_HEIGHT / 2.0];
+
+/// A rect safe to hand to the windowing system: finite, its size and position bounded.
+/// Hostile workspace files and bad monitor reports included.
+pub(super) fn sanitized(rect: [f32; 4]) -> [f32; 4] {
+    let finite = |v: f32, fallback: f32| if v.is_finite() { v } else { fallback };
+    let [x, y, w, h] = rect;
+    [
+        finite(x, 0.0).clamp(-MAX_POSITION, MAX_POSITION),
+        finite(y, 0.0).clamp(-MAX_POSITION, MAX_POSITION),
+        finite(w, 420.0).clamp(MIN_SIZE[0], MAX_SIZE),
+        finite(h, 320.0).clamp(MIN_SIZE[1], MAX_SIZE),
+    ]
+}
+
+fn usable(monitor: &Monitor) -> bool {
+    let [x, y, w, h] = monitor.rect;
+    [x, y, w, h].iter().all(|v| v.is_finite() && v.abs() <= MAX_POSITION) && w > 0.0 && h > 0.0
+}
+
+fn to_rect([x, y, w, h]: [f32; 4]) -> Rect {
+    Rect::from_min_size(pos2(x, y), Vec2::new(w, h))
+}
+
+/// The monitor holding the center of `rect`, else the one nearest to it. None for an empty
+/// list.
+pub(super) fn monitor_of(monitors: &[Monitor], rect: [f32; 4]) -> Option<&Monitor> {
+    let center = to_rect(rect).center();
+    let monitors = || monitors.iter().filter(|m| usable(m));
+    monitors()
+        .find(|m| to_rect(m.rect).contains(center))
+        .or_else(|| monitors().min_by(|a, b| to_rect(a.rect).distance_sq_to_pos(center).total_cmp(&to_rect(b.rect).distance_sq_to_pos(center))))
+}
+
+/// Whether enough of the bar along the top of `rect` lies on one of `monitors` to grab it.
+fn reachable(rect: [f32; 4], monitors: &[Monitor]) -> bool {
+    let [x, y, w, _] = rect;
+    let bar = to_rect([x, y, w, BAR_HEIGHT]);
+    monitors.iter().filter(|m| usable(m)).any(|m| {
+        let on = bar.intersect(to_rect(m.rect));
+        on.width() >= REACHABLE[0].min(w) && on.height() >= REACHABLE[1]
+    })
+}
+
+/// `rect` made safe, and moved wholly onto the nearest of `monitors` when too little of its
+/// bar lies on any to grab it. Without a monitor list, only made safe.
+pub(super) fn kept_reachable(rect: [f32; 4], monitors: &[Monitor]) -> [f32; 4] {
+    let rect = sanitized(rect);
+    if !monitors.iter().any(usable) || reachable(rect, monitors) {
+        return rect;
+    }
+    monitor_of(monitors, rect).map_or(rect, |m| clamp_onto(rect, m.rect))
+}
+
+/// `rect` moved, and shrunk if it must be, to lie wholly on `area`.
+fn clamp_onto(rect: [f32; 4], area: [f32; 4]) -> [f32; 4] {
+    let [x, y, w, h] = rect;
+    let [ax, ay, aw, ah] = area;
+    let (w, h) = (w.min(aw), h.min(ah));
+    // `ax + aw - w` can round below `ax` when `w == aw`, so no `clamp`, which panics then.
+    sanitized([x.min(ax + aw - w).max(ax), y.min(ay + ah - h).max(ay), w, h])
+}
+
+/// Where a native window from a saved layout opens.
+///
+/// - Its saved monitor (`monitor`), found in `monitors` by name or else by rect, is connected:
+///   the saved rect, moved in proportion if that monitor's rect changed, and onto it if too
+///   little of its bar lies on a monitor to grab it.
+/// - It is not: the main window's monitor, at the same offset from its origin.
+/// - No monitor list: the main window's monitor as egui reports it, by its size alone. Its
+///   origin is taken as the multiple of that size nearest below the main window's center,
+///   which holds for a row or grid of monitors of one size.
+///
+/// A window that moves to another monitor ends up wholly on it.
+pub(super) fn restore(saved: [f32; 4], monitor: Option<&Monitor>, monitors: &[Monitor], main: Option<Rect>, monitor_size: Option<Vec2>) -> [f32; 4] {
+    let saved = sanitized(saved);
+    let main = main.filter(|r| r.is_finite()).map(|r| [r.left(), r.top(), r.width().max(1.0), r.height().max(1.0)]);
+    if !monitors.iter().any(usable) {
+        let (Some(main), Some(size)) = (main, monitor_size.filter(|s| s.is_finite() && s.x >= 1.0 && s.y >= 1.0)) else { return saved };
+        let center = to_rect(main).center();
+        let origin = Pos2::new((center.x / size.x).floor() * size.x, (center.y / size.y).floor() * size.y);
+        return clamp_onto(saved, [origin.x, origin.y, size.x, size.y]);
+    }
+    let main_monitor = main.and_then(|main| monitor_of(monitors, main)).or_else(|| monitors.iter().find(|m| usable(m)));
+    let connected = monitor.and_then(|old| {
+        let by_name = old.name.as_ref().and_then(|name| monitors.iter().filter(|m| usable(m)).find(|m| m.name.as_ref() == Some(name)));
+        by_name.or_else(|| monitors.iter().filter(|m| usable(m)).find(|m| m.rect == old.rect)).map(|now| (old, now))
+    });
+    let [x, y, w, h] = saved;
+    match (connected, monitor) {
+        (Some((old, now)), _) if old.rect == now.rect => {
+            if reachable(saved, monitors) {
+                saved
+            } else {
+                clamp_onto(saved, now.rect)
+            }
+        }
+        (Some((old, now)), _) => {
+            let [ox, oy, ow, oh] = old.rect;
+            let [nx, ny, nw, nh] = now.rect;
+            let (sx, sy) = if usable(old) { (nw / ow, nh / oh) } else { (1.0, 1.0) };
+            clamp_onto([nx + (x - ox) * sx, ny + (y - oy) * sy, w, h], now.rect)
+        }
+        (None, Some(old)) => {
+            let Some(target) = main_monitor else { return saved };
+            let [ox, oy, ..] = old.rect;
+            let [tx, ty, ..] = target.rect;
+            let (dx, dy) = if usable(old) { (x - ox, y - oy) } else { (0.0, 0.0) };
+            clamp_onto([tx + dx, ty + dy, w, h], target.rect)
+        }
+        // No saved monitor: the window stays where its bar can be grabbed.
+        (None, None) => {
+            if reachable(saved, monitors) {
+                return saved;
+            }
+            main_monitor.map_or(saved, |target| clamp_onto(saved, target.rect))
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::vec2;
+
+    fn monitor(name: &str, rect: [f32; 4], scale: f32) -> Monitor {
+        Monitor { name: Some(name.into()), rect, scale }
+    }
+
+    fn main_at(x: f32, y: f32) -> Option<Rect> {
+        Some(Rect::from_min_size(pos2(x, y), vec2(1200.0, 800.0)))
+    }
+
+    const LEFT: [f32; 4] = [0.0, 0.0, 1920.0, 1080.0];
+    const RIGHT: [f32; 4] = [1920.0, 0.0, 2560.0, 1440.0];
+
+    #[test]
+    fn a_connected_monitor_keeps_the_saved_rect() {
+        let monitors = [monitor("left", LEFT, 1.0), monitor("right", RIGHT, 2.0)];
+        let saved = [2400.0, 300.0, 400.0, 500.0];
+        assert_eq!(restore(saved, Some(&monitors[1]), &monitors, main_at(100.0, 100.0), None), saved);
+        // Renamed, but the same rect.
+        let renamed = Monitor { name: Some("DP-2".into()), ..monitors[1].clone() };
+        assert_eq!(restore(saved, Some(&renamed), &monitors, main_at(100.0, 100.0), None), saved);
+        // Partly off its monitor, as the user left it.
+        let edge = [4300.0, 300.0, 400.0, 500.0];
+        assert_eq!(restore(edge, Some(&monitors[1]), &monitors, main_at(100.0, 100.0), None), edge);
+        // Wholly off it, or with only its body on it: back onto it.
+        let off = [5000.0, 300.0, 400.0, 500.0];
+        assert_eq!(restore(off, Some(&monitors[1]), &monitors, main_at(100.0, 100.0), None), [4080.0, 300.0, 400.0, 500.0]);
+        let above = [2400.0, -10.0, 400.0, 500.0];
+        assert_eq!(restore(above, Some(&monitors[1]), &monitors, main_at(100.0, 100.0), None), [2400.0, 0.0, 400.0, 500.0]);
+    }
+
+    #[test]
+    fn a_window_is_kept_where_its_bar_can_be_grabbed() {
+        let monitors = [monitor("left", LEFT, 1.0), monitor("right", RIGHT, 2.0)];
+        // Across the seam, or mostly off screen with enough of its bar on one.
+        for rect in [[1800.0, 100.0, 400.0, 300.0], [-360.0, 1071.0, 400.0, 300.0]] {
+            assert_eq!(kept_reachable(rect, &monitors), rect);
+        }
+        assert_eq!(kept_reachable([-370.0, 100.0, 400.0, 300.0], &monitors), [0.0, 100.0, 400.0, 300.0]);
+        assert_eq!(kept_reachable([500.0, 1075.0, 400.0, 300.0], &monitors), [500.0, 780.0, 400.0, 300.0]);
+        assert_eq!(kept_reachable([9000.0, 100.0, 400.0, 300.0], &monitors), [4080.0, 100.0, 400.0, 300.0]);
+        // No monitor list: only made safe.
+        assert_eq!(kept_reachable([9000.0, f32::NAN, 400.0, 300.0], &[]), [9000.0, 0.0, 400.0, 300.0]);
+    }
+
+    #[test]
+    fn a_missing_monitor_moves_the_window_to_the_main_window_monitor() {
+        let saved_on = monitor("right", RIGHT, 2.0);
+        let monitors = [monitor("left", LEFT, 1.0)];
+        // Same offset from the monitor's origin.
+        assert_eq!(restore([2020.0, 50.0, 400.0, 500.0], Some(&saved_on), &monitors, main_at(100.0, 100.0), None), [100.0, 50.0, 400.0, 500.0]);
+        // Clamped wholly on screen, shrunk if larger than the monitor.
+        assert_eq!(restore([4000.0, 1200.0, 400.0, 500.0], Some(&saved_on), &monitors, main_at(100.0, 100.0), None), [1520.0, 580.0, 400.0, 500.0]);
+        assert_eq!(restore([1920.0, 0.0, 3000.0, 1300.0], Some(&saved_on), &monitors, main_at(100.0, 100.0), None), [0.0, 0.0, 1920.0, 1080.0]);
+    }
+
+    #[test]
+    fn a_resized_monitor_moves_the_window_in_proportion() {
+        let old = monitor("left", LEFT, 1.0);
+        let monitors = [monitor("left", [0.0, 0.0, 960.0, 540.0], 2.0)];
+        assert_eq!(restore([960.0, 540.0, 200.0, 200.0], Some(&old), &monitors, main_at(0.0, 0.0), None), [480.0, 270.0, 200.0, 200.0]);
+        assert_eq!(restore([1800.0, 1000.0, 200.0, 200.0], Some(&old), &monitors, main_at(0.0, 0.0), None), [760.0, 340.0, 200.0, 200.0]);
+    }
+
+    #[test]
+    fn negative_coordinates_and_mixed_scales() {
+        let monitors = [monitor("left", [-2560.0, -200.0, 2560.0, 1440.0], 2.0), monitor("main", LEFT, 1.0)];
+        assert_eq!(monitor_of(&monitors, [-500.0, 0.0, 300.0, 300.0]).and_then(|m| m.name.as_deref()), Some("left"));
+        assert_eq!(monitor_of(&monitors, [100.0, 0.0, 300.0, 300.0]).and_then(|m| m.name.as_deref()), Some("main"));
+        // Off every monitor: the nearest.
+        assert_eq!(monitor_of(&monitors, [-3000.0, 2000.0, 100.0, 100.0]).and_then(|m| m.name.as_deref()), Some("left"));
+        let saved = [-1000.0, -100.0, 300.0, 300.0];
+        assert_eq!(restore(saved, Some(&monitors[0]), &monitors, main_at(100.0, 100.0), None), saved);
+        // Unplugged: the same offset on the main window's monitor, at its own scale.
+        let rest = &monitors[1..];
+        assert_eq!(restore(saved, Some(&monitors[0]), rest, main_at(100.0, 100.0), None), [1560.0, 100.0, 300.0, 300.0]);
+        // A main window on the left monitor takes the window there.
+        let main = monitor("main", LEFT, 1.0);
+        assert_eq!(restore([100.0, 100.0, 400.0, 300.0], Some(&main), &monitors[..1], main_at(-2000.0, 0.0), None), [-2460.0, -100.0, 400.0, 300.0]);
+    }
+
+    #[test]
+    fn without_a_monitor_list_the_window_goes_on_the_main_window_monitor_by_size() {
+        let size = Some(vec2(1920.0, 1080.0));
+        let saved = [2500.0, 300.0, 400.0, 500.0];
+        assert_eq!(restore(saved, None, &[], main_at(100.0, 100.0), size), [1520.0, 300.0, 400.0, 500.0]);
+        assert_eq!(restore(saved, None, &[], main_at(2000.0, 100.0), size), saved);
+        assert_eq!(restore(saved, None, &[], main_at(-1500.0, 100.0), size), [-400.0, 300.0, 400.0, 500.0]);
+        // Nothing known: the saved rect, made safe.
+        assert_eq!(restore([f32::NAN, 1e9, 10.0, 400.0], None, &[], None, None), [0.0, 100_000.0, 160.0, 400.0]);
+    }
+
+    #[test]
+    fn clamping_onto_a_fractional_origin_does_not_panic() {
+        let area = [910.6667, 0.333_33, 1280.0, 720.0];
+        let [x, y, w, h] = clamp_onto([0.0, 2000.0, 1280.0, 900.0], area);
+        assert_eq!([w, h], [1280.0, 720.0]);
+        assert!((x - area[0]).abs() < 0.01 && (y - area[1]).abs() < 0.01, "{x} {y}");
+        let [x, ..] = clamp_onto([5000.0, 0.0, 2000.0, 100.0], area);
+        assert!((x - area[0]).abs() < 0.01, "{x}");
+    }
+
+    #[test]
+    fn a_window_without_a_saved_monitor_stays_on_screen() {
+        let monitors = [monitor("left", LEFT, 1.0), monitor("right", RIGHT, 2.0)];
+        let on = [2000.0, 100.0, 400.0, 300.0];
+        assert_eq!(restore(on, None, &monitors, main_at(100.0, 100.0), None), on);
+        assert_eq!(restore([5000.0, 100.0, 400.0, 300.0], None, &monitors, main_at(100.0, 100.0), None), [1520.0, 100.0, 400.0, 300.0]);
+    }
+}
diff --git a/crates/ui/src/docking/render/body_drag.rs b/crates/ui/src/docking/render/body_drag.rs
new file mode 100644
index 00000000..0d5d5b4a
--- /dev/null
+++ b/crates/ui/src/docking/render/body_drag.rs
@@ -0,0 +1,290 @@
+//! App drags in panel bodies across OS windows (feature `native-windows`).
+//!
+//! egui gives each window only its own input, and the window where the button went down gets
+//! the pointer until the release. An app's drag that began in a panel body (a media item onto
+//! a timeline in another window) would never show its pointer or release to the window it is
+//! over. So while one that carries something lasts (an egui drag-and-drop payload, or
+//! [`crate::docking::route_app_drag`]), the owner's input hook ([`super::native`]'s plugin)
+//! sends each pointer move over another of the app's windows to that window, in its
+//! coordinates, as `PointerMoved`, `PointerGone` when the pointer leaves it, and the release as
+//! a primary `PointerButton` there. The owner sees the pointer gone while it is over another
+//! window, so its own panels under that window see no hover and no drop.
+//!
+//! A window drawn after the owner in the same pass gets the events in that pass: the main
+//! window owning the drag reaches every native window at once. The main window, and a native
+//! window drawn before the owner, get them on the next pass, which the hook asks for. The
+//! owner's own release then waits a pass too, so its payload outlives the target's read.
+
+use std::{collections::HashMap, fmt::Debug, hash::Hash};
+
+use egui::{Context, Event, Id, Key, PointerButton, Pos2, RawInput, Rect, ViewportId};
+
+use super::Renderer;
+use super::native::{WindowDrag, body_input, content_of};
+use crate::docking::desktop::{Over, window_at};
+use crate::docking::{Drag, GroupDrag};
+
+/// The application's windows on the desktop, as the main window last mapped them.
+#[derive(Clone, Debug, Default)]
+pub(super) struct Desktop {
+    /// The main window's content, where known.
+    pub main: Option<Rect>,
+    /// Shown native windows' content, front first, and how many lie in front of the main window.
+    pub windows: Vec<(u64, Rect)>,
+    pub front: usize,
+    /// The viewport of each native window.
+    pub viewports: Vec<(u64, ViewportId)>,
+}
+
+impl Desktop {
+    /// The window under the desktop point `point`, and the point in its coordinates.
+    fn at(&self, point: Pos2) -> Option<(ViewportId, Pos2)> {
+        match window_at(point, &self.windows, self.front, Some(self.main?), None) {
+            Over::Main(local) => Some((ViewportId::ROOT, local)),
+            Over::Window(window, local) => self.viewports.iter().find(|(w, _)| *w == window).map(|(_, viewport)| (*viewport, local)),
+            Over::Desktop => None,
+        }
+    }
+}
+
+/// A dock area's app drag in a panel body, in the input plugin.
+#[derive(Debug)]
+pub(super) struct BodyRoute {
+    area: Id,
+    /// The window the drag began in, and the widget egui drags there.
+    owner: ViewportId,
+    /// [`crate::docking::Floating::id`] of the owner; `None` for the main window.
+    window: Option<u64>,
+    id: Id,
+    desktop: Desktop,
+    /// The window other than the owner that the pointer is over.
+    target: Option<ViewportId>,
+    /// Nothing more is routed until the drag ends: released, or ended by Escape, a focus loss,
+    /// input blocking or [`crate::docking::cancel_drag`].
+    ended: bool,
+}
+
+/// Events waiting for each viewport's next input, with the main window's pass that queued them
+/// and the dock area whose route queued each.
+pub(super) type Queued = HashMap<ViewportId, (u64, Vec<(Id, Event)>)>;
+
+/// Each owner's held release and the pointer events after it, with the main window's pass that
+/// held them: delivered in a later pass only, never taken back.
+pub(super) type Held = HashMap<ViewportId, (u64, Vec<Event>)>;
+
+fn queue(queued: &mut Queued, pass: u64, area: Id, viewport: ViewportId, event: Event) {
+    let (at, events) = queued.entry(viewport).or_default();
+    *at = pass;
+    events.push((area, event));
+}
+
+impl BodyRoute {
+    /// The owner's input before egui reads it: each pointer event over another of the app's
+    /// windows goes to that window, and the owner sees the pointer gone. Returns whether
+    /// anything was queued. Where the owner reports no desktop position nothing is routed.
+    pub(super) fn route(&mut self, input: &mut RawInput, queued: &mut Queued, held: &mut Held, pass: u64) -> bool {
+        if input.viewport_id != self.owner || self.ended {
+            return false;
+        }
+        let Some((origin, _)) = input.viewports.get(&input.viewport_id).and_then(content_of) else { return false };
+        let (mut routed, mut holding) = (false, false);
+        let mut events = Vec::with_capacity(input.events.len());
+        for event in std::mem::take(&mut input.events) {
+            // Pointer events after a held release wait behind it, in order.
+            if holding && matches!(event, Event::PointerMoved(_) | Event::PointerButton { .. } | Event::PointerGone) {
+                held.entry(self.owner).or_default().1.push(event);
+                continue;
+            }
+            let (pos, release) = match &event {
+                Event::PointerMoved(pos) => (*pos, None),
+                Event::PointerButton { pos, button: PointerButton::Primary, pressed: false, modifiers } => (*pos, Some(*modifiers)),
+                _ => {
+                    events.push(event);
+                    continue;
+                }
+            };
+            if self.ended {
+                events.push(event);
+                continue;
+            }
+            let over = pos.is_finite().then(|| self.desktop.at(origin + pos.to_vec2())).flatten().filter(|(v, _)| *v != self.owner);
+            let target = over.map(|(viewport, _)| viewport);
+            if let Some(left) = self.target.filter(|left| Some(*left) != target) {
+                queue(queued, pass, self.area, left, Event::PointerGone);
+                routed = true;
+            }
+            self.target = target;
+            if let Some((viewport, local)) = over {
+                queue(queued, pass, self.area, viewport, Event::PointerMoved(local));
+                if let Some(modifiers) = release {
+                    let release = Event::PointerButton { pos: local, button: PointerButton::Primary, pressed: false, modifiers };
+                    queue(queued, pass, self.area, viewport, release);
+                    // The owner's own release waits for its input in a later pass of the main
+                    // window (not a discarded pass's rerun), so its drag, and an egui
+                    // drag-and-drop payload, last until a window drawn before it has read the
+                    // release. A stop never takes it back, or the button would stay down.
+                    let (at, held_events) = held.entry(self.owner).or_default();
+                    *at = pass;
+                    held_events.extend([event, Event::PointerGone]);
+                    holding = true;
+                    routed = true;
+                    (self.ended, self.target) = (true, None);
+                    events.push(Event::PointerGone);
+                    continue;
+                }
+                routed = true;
+                events.push(Event::PointerGone);
+            } else {
+                events.push(event);
+            }
+            if release.is_some() {
+                (self.ended, self.target) = (true, None);
+            }
+        }
+        input.events = events;
+        routed
+    }
+}
+
+/// End `area`'s routing: the window the pointer was over sees it go. `remove`: the drag is
+/// over, so another may start. Otherwise the routing was stopped (Escape, a focus loss, input
+/// blocking, [`crate::docking::cancel_drag`]), and events it queued that no window has read
+/// yet are taken back, so a release queued before the stop reaches no window.
+fn end_route(ctx: &Context, area: Id, remove: bool) {
+    let body = body_input(ctx);
+    let queued = {
+        let mut input = body.lock();
+        let input = &mut *input;
+        if let Some(route) = input.routes.get_mut(&area) {
+            let mut gone: Vec<ViewportId> = route.target.take().into_iter().collect();
+            route.ended = true;
+            if remove {
+                input.routes.remove(&area);
+            } else {
+                for (viewport, (_, events)) in &mut input.queued {
+                    let before = events.len();
+                    events.retain(|(from, _)| *from != area);
+                    if events.len() != before && !gone.contains(viewport) {
+                        gone.push(*viewport);
+                    }
+                }
+            }
+            for viewport in &gone {
+                queue(&mut input.queued, input.pass, area, *viewport, Event::PointerGone);
+            }
+            Some(!gone.is_empty())
+        } else {
+            None
+        }
+    };
+    if queued == Some(true) {
+        ctx.request_repaint_of(ViewportId::ROOT);
+    }
+}
+
+/// [`crate::docking::cancel_drag`]: an app drag in a panel body goes on, but no longer reaches
+/// other windows.
+pub(in crate::docking) fn cancel_body_route(ctx: &Context, area: Id) {
+    end_route(ctx, area, false);
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
+    /// In the main window, once the desktop is mapped and before native windows draw: give the
+    /// routing the map, and end it where it cannot go on. `native`: viewports are native.
+    pub(super) fn map_body_route(&mut self, ctx: &Context, native: bool) {
+        let desktop = self.desktop();
+        let owner = {
+            let body = body_input(ctx);
+            let mut input = body.lock();
+            input.routes.get_mut(&self.id).map(|route| {
+                route.desktop = desktop;
+                route.window
+            })
+        };
+        // Windows are no longer native, or the owner closed.
+        let natives = &self.cross.viewports;
+        if owner.is_some_and(|window| !native || window.is_some_and(|w| !natives.iter().any(|(id, _)| *id == w))) {
+            end_route(ctx, self.id, true);
+        }
+        if native {
+            self.route_body_drag(ctx, None);
+        }
+    }
+
+    fn desktop(&self) -> Desktop {
+        Desktop { main: self.cross.main, windows: self.cross.windows.clone(), front: self.cross.front, viewports: self.cross.viewports.clone() }
+    }
+
+    /// After the window drawing now (`window`; `None` for the main window) drew its panels'
+    /// bodies: start routing an app drag that began in one of them, and end it when the drag
+    /// is over. An Escape in any of the app's windows, a focus loss and input blocking end it.
+    pub(super) fn route_body_drag(&mut self, ctx: &Context, window: Option<u64>) {
+        let (area, viewport, dragged) = (self.id, ctx.viewport_id(), ctx.dragged_id());
+        let route = {
+            let body = body_input(ctx);
+            let input = body.lock();
+            input.routes.get(&area).map(|r| (r.owner, r.id))
+        };
+        let stops = self.input_blocked || self.cross.focus_lost || ctx.input(|i| i.key_pressed(Key::Escape));
+        match route {
+            Some((owner, id)) if owner == viewport && dragged != Some(id) => end_route(ctx, area, true),
+            Some(_) if stops => end_route(ctx, area, false),
+            Some(_) => {}
+            None => {
+                let Some(id) = dragged.filter(|id| !stops && self.starts_in_body(ctx, *id)) else { return };
+                let route = BodyRoute { area, owner: viewport, window, id, desktop: self.desktop(), target: None, ended: false };
+                let _ = body_input(ctx).lock().routes.insert(area, route);
+            }
+        }
+    }
+
+    /// Whether egui's drag of `id` in the window drawing now is the app's and carries something:
+    /// pressed with the primary button in a panel body, none of the area's own controls or
+    /// drags, and with an egui drag-and-drop payload or [`crate::docking::route_app_drag`]
+    /// called this frame or the last. Other drags (sliders, scrollbars, text selection, canvas
+    /// pans) keep the owner's pointer.
+    fn starts_in_body(&self, ctx: &Context, id: Id) -> bool {
+        let payload = ctx.plugin_opt::<egui::DragAndDrop>().is_some() && egui::DragAndDrop::has_any_payload(ctx);
+        let main = ctx.cumulative_pass_nr_for(ViewportId::ROOT);
+        let asked = ctx.data(|d| d.get_temp::<u64>(app_drag_key(self.id))).is_some_and(|at| at + 1 >= main);
+        if !payload && !asked {
+            return false;
+        }
+        let (area, viewport) = (self.id, ctx.viewport_id());
+        let (down, press) = ctx.input(|i| (i.pointer.primary_down(), i.pointer.press_origin()));
+        let (pressed, owned, dock) = ctx.data(|d| {
+            let pressed = d.get_temp::<Pos2>(body_press_key(area, viewport));
+            let owned = d.get_temp::<Vec<Id>>(area.with("owned-interactions")).is_some_and(|ids| ids.contains(&id))
+                || d.get_temp::<Id>(area.with("pointer-resize")) == Some(id);
+            let dock = d.get_temp::<Drag<P>>(area.with("drag")).is_some()
+                || d.get_temp::<GroupDrag<P>>(area.with("group-drag")).is_some()
+                || d.get_temp::<WindowDrag>(area.with("window-drag")).is_some();
+            (pressed, owned, dock)
+        });
+        down && press.is_some() && pressed == press && !owned && !dock && !self.owned_interactions.contains(&id)
+    }
+}
+
+/// The main window's pass in which the app last called [`crate::docking::route_app_drag`].
+fn app_drag_key(area: Id) -> Id {
+    area.with("route-app-drag")
+}
+
+/// [`crate::docking::route_app_drag`].
+pub(in crate::docking) fn mark_app_drag(ctx: &Context, area: Id) {
+    let main = ctx.cumulative_pass_nr_for(ViewportId::ROOT);
+    ctx.data_mut(|d| d.insert_temp(app_drag_key(area), main));
+}
+
+/// The events held for `viewport`'s input in a later pass.
+#[cfg(test)]
+pub(in crate::docking) fn held_events(ctx: &Context, viewport: ViewportId) -> Vec<Event> {
+    let body = body_input(ctx);
+    let events = body.lock().held.get(&viewport).map(|(_, events)| events.clone());
+    events.unwrap_or_default()
+}
+
+/// Where the last press in one of the area's panel bodies in `viewport` began.
+pub(super) fn body_press_key(area: Id, viewport: ViewportId) -> Id {
+    area.with(("body-press", viewport))
+}
diff --git a/crates/ui/src/docking/render/cross.rs b/crates/ui/src/docking/render/cross.rs
new file mode 100644
index 00000000..0b1dea9a
--- /dev/null
+++ b/crates/ui/src/docking/render/cross.rs
@@ -0,0 +1,460 @@
+//! Drags across OS windows (feature `native-windows`, where viewports are native).
+//!
+//! The window where a drag started owns it: the window system sends it the pointer's moves
+//! and the release while the button is held, inside the window or not. Each frame the owner
+//! writes the pointer, with its own desktop origin, under the area's `"drag-pointer"`. The
+//! context's data is shared by every viewport. The window under the desktop point (floating
+//! windows first, front first, then the main window) shows the drop preview in its own
+//! frame, with the targets it drew. The release is resolved at the end of the main window's
+//! frame, after every native window has drawn.
+
+use std::{fmt::Debug, hash::Hash};
+
+use egui::{Context, Key, Pos2, Rect, Ui, Vec2, vec2};
+
+use super::floating::WindowHit;
+use super::native::{BAR_HEIGHT, WindowDrag};
+use super::preview::DragInput;
+use super::{Renderer, clamp_float, dock::group_action};
+use crate::docking::desktop::{Over, window_at};
+use crate::docking::targets::DockDrop;
+use crate::docking::{Action, Drag, DropTarget, Floating, GroupDrag, GroupGesture, Target, cancel_drag};
+
+/// Key of [`DragPointer`] in the context's data, under the area's id.
+pub(super) const POINTER: &str = "drag-pointer";
+/// Key of an Escape that reached one of the application's windows other than the drag's
+/// owner. Keys go to the window with keyboard focus, which need not be the one dragging.
+const ESCAPE: &str = "drag-escape";
+/// Key of whether a native window's bar drag highlighted a drop target on the last frame, under
+/// the area's id: [`Cross::highlighted`] as [`Renderer::end_cross`] left it.
+pub(super) const HIGHLIGHTED: &str = "drag-highlighted";
+
+/// The pointer of a drag, as the window that owns the drag last saw it.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(in crate::docking) struct DragPointer {
+    /// [`Floating::id`] of the owning native window; `None` for the main window.
+    pub owner: Option<u64>,
+    /// Desktop position of the owner's (0, 0). `None` where the window system reports no
+    /// positions (Wayland).
+    pub origin: Option<Pos2>,
+    /// In the owner's coordinates. Kept while egui reports no position.
+    pub local: Option<Pos2>,
+    pub down: bool,
+    pub released: bool,
+    pub escape: bool,
+    /// Ctrl or Cmd held: the drop floats.
+    pub command: bool,
+    /// The window a bar drag moves. It follows the pointer and is never its own target.
+    pub window: Option<u64>,
+    /// That drag began on the window's only tab or group: it docks whatever
+    /// [`crate::docking::DockStyle::title_bar_docks`] says.
+    pub docks: bool,
+}
+
+impl DragPointer {
+    fn desktop(&self) -> Option<Pos2> {
+        Some(self.origin? + self.local?.to_vec2())
+    }
+}
+
+/// A native window's drop targets from its frame, in its own coordinates.
+pub(in crate::docking) struct Surface<P> {
+    pub window: u64,
+    /// Desktop position of the window's (0, 0), where known.
+    pub origin: Option<Pos2>,
+    /// The window's content, in its coordinates.
+    pub bounds: Rect,
+    pub targets: Vec<DropTarget<P>>,
+    pub dock_targets: Vec<DockDrop<P>>,
+    pub windows: Vec<WindowHit<P>>,
+}
+
+/// Where a drag's pointer is.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Dest {
+    Main(Pos2),
+    Window(u64, Pos2),
+    /// Over no window of the application: the desktop point, where known.
+    Desktop(Option<Pos2>),
+}
+
+/// What one frame of a dock area knows of its OS windows.
+pub(in crate::docking) struct Cross<P> {
+    /// Viewports are native: drags cross windows.
+    pub on: bool,
+    /// The application's windows lost focus this pass: one had it on the last pass, none now.
+    pub focus_lost: bool,
+    /// The main window's content on the desktop, where known.
+    pub main: Option<Rect>,
+    /// Shown native windows' desktop rects, front first.
+    pub windows: Vec<(u64, Rect)>,
+    /// How many of `windows` lie in front of the main window.
+    pub front: usize,
+    /// Targets of the native windows drawn this frame.
+    pub surfaces: Vec<Surface<P>>,
+    /// The drag's pointer, as its owner wrote it this frame.
+    pub pointer: Option<DragPointer>,
+    /// A bar drag released this frame.
+    pub release: Option<(WindowDrag, DragPointer)>,
+    /// Resolving a native window's bar drag over the main window: frame edge zones count.
+    pub bar: bool,
+    /// Where the native window drawing now was told to move its content this frame.
+    pub moved: Option<Pos2>,
+    /// Resolving a window move that docks whatever `title_bar_docks` says.
+    pub docks: bool,
+    /// A native window's bar drag highlighted a drop target this frame, in whichever window
+    /// drew its preview.
+    pub highlighted: bool,
+    /// A native window's dragged widget is one of the area's controls: egui keeps a drag per
+    /// viewport.
+    pub held: bool,
+    /// The panel whose body is under the pointer in the native window drawing now.
+    pub pointed: Option<P>,
+    /// The viewport of each native window drawn this frame.
+    pub viewports: Vec<(u64, egui::ViewportId)>,
+}
+
+impl<P> Default for Cross<P> {
+    fn default() -> Self {
+        Self {
+            on: false,
+            focus_lost: false,
+            main: None,
+            windows: Vec::new(),
+            front: 0,
+            surfaces: Vec::new(),
+            pointer: None,
+            release: None,
+            bar: false,
+            moved: None,
+            docks: false,
+            highlighted: false,
+            held: false,
+            pointed: None,
+            viewports: Vec::new(),
+        }
+    }
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
+    /// Write the pointer of the drag this window owns. `origin` is the window's desktop
+    /// origin for this frame's input; `window` the bar drag it is.
+    pub(super) fn record_pointer(&mut self, ctx: &Context, owner: Option<u64>, origin: Option<Pos2>, window: Option<&WindowDrag>) -> DragPointer {
+        let key = self.id.with(POINTER);
+        let kept = ctx.data(|d| d.get_temp::<DragPointer>(key)).filter(|p| p.owner == owner).and_then(|p| p.local);
+        let elsewhere = ctx.data_mut(|d| d.remove_temp::<bool>(self.id.with(ESCAPE))).unwrap_or(false);
+        let pointer = ctx.input(|i| DragPointer {
+            owner,
+            origin,
+            local: i.pointer.latest_pos().or(i.pointer.interact_pos()).filter(|p| p.is_finite()).or(kept),
+            down: i.pointer.primary_down(),
+            released: i.pointer.primary_released(),
+            escape: elsewhere || i.key_pressed(Key::Escape),
+            command: i.modifiers.command || i.modifiers.ctrl || i.modifiers.mac_cmd,
+            window: window.map(|w| w.window),
+            docks: window.is_some_and(|w| w.docks),
+        });
+        self.write_pointer(ctx, pointer);
+        pointer
+    }
+
+    /// Write `pointer` as the drag's for this frame. An Escape from another window is no
+    /// cancel of a drag that the window system carries out.
+    pub(super) fn write_pointer(&mut self, ctx: &Context, pointer: DragPointer) {
+        let id = self.id;
+        ctx.data_mut(|d| {
+            d.remove::<bool>(id.with(ESCAPE));
+            d.insert_temp(id.with(POINTER), pointer);
+        });
+        self.cross.pointer = Some(pointer);
+    }
+
+    /// In a window that does not own the drag (`window`, `None` for the main window): an Escape
+    /// pressed here cancels the drag, and is no shortcut.
+    pub(super) fn escape_elsewhere(&self, ctx: &Context, window: Option<u64>) {
+        let owner = ctx.data(|d| d.get_temp::<DragPointer>(self.id.with(POINTER))).filter(|p| p.down).map(|p| p.owner);
+        if owner.is_some_and(|owner| owner != window) && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, Key::Escape)) {
+            ctx.data_mut(|d| d.insert_temp(self.id.with(ESCAPE), true));
+        }
+    }
+
+    /// Where the drag's pointer is. Without desktop positions only the owner's own window is
+    /// known, and a point outside it is on the desktop. `current` is a window drawing now.
+    fn destination(&self, pointer: &DragPointer, current: Option<&Surface<P>>) -> Option<Dest> {
+        if let (Some(point), Some(main)) = (pointer.desktop(), self.cross.main) {
+            return Some(match window_at(point, &self.cross.windows, self.cross.front, Some(main), pointer.window) {
+                Over::Main(local) => Dest::Main(local),
+                Over::Window(id, local) => Dest::Window(id, local),
+                Over::Desktop => Dest::Desktop(Some(point)),
+            });
+        }
+        let local = pointer.local?;
+        let Some(owner) = pointer.owner else { return Some(Dest::Main(local)) };
+        let bounds = current.into_iter().chain(&self.cross.surfaces).find(|s| s.window == owner).map(|s| s.bounds);
+        Some(if bounds.is_some_and(|b| b.contains(local)) { Dest::Window(owner, local) } else { Dest::Desktop(None) })
+    }
+
+    /// Run `f` with a native window's targets and bounds in place of the main window's.
+    fn within<R>(&mut self, surface: &mut Surface<P>, f: impl FnOnce(&mut Self) -> R) -> R {
+        std::mem::swap(&mut self.targets, &mut surface.targets);
+        std::mem::swap(&mut self.dock_targets, &mut surface.dock_targets);
+        std::mem::swap(&mut self.frame.windows, &mut surface.windows);
+        let bounds = std::mem::replace(&mut self.float_bounds, surface.bounds);
+        let blockers = std::mem::take(&mut self.blockers);
+        // A native window has no docks.
+        let groups = std::mem::take(&mut self.dock_groups);
+        let result = f(self);
+        self.dock_groups = groups;
+        std::mem::swap(&mut self.targets, &mut surface.targets);
+        std::mem::swap(&mut self.dock_targets, &mut surface.dock_targets);
+        std::mem::swap(&mut self.frame.windows, &mut surface.windows);
+        (self.float_bounds, self.blockers) = (bounds, blockers);
+        result
+    }
+
+    /// [`Self::within`] the native window `window` drawn this frame.
+    fn within_window<R>(&mut self, window: u64, f: impl FnOnce(&mut Self) -> R) -> Option<R> {
+        let index = self.cross.surfaces.iter().position(|s| s.window == window)?;
+        let mut surface = self.cross.surfaces.swap_remove(index);
+        let result = self.within(&mut surface, f);
+        self.cross.surfaces.push(surface);
+        Some(result)
+    }
+
+    /// The offset from the owner's coordinates to those of a window at `to`.
+    fn shift(&self, pointer: &DragPointer, to: Option<Pos2>) -> Vec2 {
+        match (pointer.origin, to) {
+            (Some(from), Some(to)) => from - to,
+            _ => Vec2::ZERO,
+        }
+    }
+
+    fn origin_of(&self, window: u64) -> Option<Pos2> {
+        self.cross.surfaces.iter().find(|s| s.window == window).and_then(|s| s.origin)
+    }
+
+    /// A tab drag at the end of the main window's frame. Over the main window it returns the
+    /// drag in the main window's coordinates and the input to finish it with; elsewhere it
+    /// docks in another window or floats a new one on release.
+    pub(super) fn cross_tab(&mut self, ctx: &Context, drag: &Drag<P>, input: DragInput) -> Option<(Drag<P>, DragInput)> {
+        let Some(pointer) = self.cross.pointer.filter(|p| self.cross.on && p.window.is_none() && p.local.is_some()) else {
+            return Some((drag.clone(), input));
+        };
+        let input = DragInput { escape: input.escape || pointer.escape, ..self.input_of(&pointer, pointer.local) };
+        if input.escape || !input.focused || (!input.down && !input.released) {
+            return Some((drag.clone(), input));
+        }
+        let float_only = pointer.command || drag.undock;
+        let floats_out = float_only && pointer.released && pointer.desktop().is_some();
+        match self.destination(&pointer, None)? {
+            Dest::Main(local) if !floats_out => {
+                let shift = self.shift(&pointer, self.cross.main.map(|m| m.min));
+                let drag = Drag { origin: drag.origin + shift, source: drag.source.translate(shift), ..drag.clone() };
+                return Some((drag, DragInput { pointer: Some(local), ..input }));
+            }
+            _ if !pointer.released => {}
+            Dest::Window(window, local) if !float_only => {
+                let shift = self.shift(&pointer, self.origin_of(window));
+                let drag = Drag { origin: drag.origin + shift, source: drag.source.translate(shift), ..drag.clone() };
+                let action = self.within_window(window, |r| {
+                    let proposal = r.tab_proposal(&drag.panel, local).filter(|p| !p.noop && local.distance(drag.origin) >= 2.0)?;
+                    Some(Action::Move { panel: drag.panel.clone(), anchor: proposal.anchor, placement: proposal.placement })
+                });
+                self.push_checked(action.flatten(), &drag.panel);
+            }
+            _ if !self.permissions(&drag.panel).floatable => {}
+            _ => {
+                let size = self.float_size(&drag.panel, drag.source.size());
+                let grab = drag.grab.min(vec2(size.x, self.style.tab_height)) + vec2(0.0, BAR_HEIGHT);
+                let rect = self.desktop_float(&pointer, size, grab);
+                let action = Action::Float { panel: drag.panel.clone(), rect: [rect.left(), rect.top(), rect.width(), rect.height()] };
+                self.push_checked(Some(action), &drag.panel);
+            }
+        }
+        if pointer.released {
+            cancel_drag::<P>(ctx, self.id);
+        }
+        None
+    }
+
+    /// A group or column drag at the end of the main window's frame, like [`Self::cross_tab`].
+    pub(super) fn cross_group(&mut self, ui: &Ui, drag: &GroupDrag<P>, input: DragInput) -> Option<(GroupDrag<P>, DragInput)> {
+        let Some(pointer) = self.cross.pointer.filter(|p| self.cross.on && p.window.is_none() && p.local.is_some()) else {
+            return Some((drag.clone(), input));
+        };
+        if drag.gesture == GroupGesture::Window {
+            return Some((drag.clone(), input));
+        }
+        let input = self.input_of(&pointer, pointer.local);
+        if input.escape || !input.focused || (!input.down && !input.released) {
+            return Some((drag.clone(), input));
+        }
+        let floats_out = pointer.command && pointer.released && pointer.desktop().is_some();
+        let ctx = ui.ctx();
+        match self.destination(&pointer, None)? {
+            Dest::Main(local) if !floats_out => {
+                let shift = self.shift(&pointer, self.cross.main.map(|m| m.min));
+                let drag = GroupDrag { origin: drag.origin + shift, source: drag.source.translate(shift), ..drag.clone() };
+                return Some((drag, DragInput { pointer: Some(local), ..input }));
+            }
+            _ if !pointer.released => {}
+            Dest::Window(window, local) if !pointer.command => {
+                let shift = self.shift(&pointer, self.origin_of(window));
+                let drag = GroupDrag { origin: drag.origin + shift, source: drag.source.translate(shift), ..drag.clone() };
+                let action = self.within_window(window, |r| {
+                    let proposal = r.group_proposal(&drag, local).filter(|p| !p.noop && local.distance(drag.origin) >= 2.0)?;
+                    Some(group_action(&drag, Target::At { anchor: proposal.anchor, placement: proposal.placement }))
+                });
+                self.push_checked(action.flatten(), &drag.panel);
+            }
+            _ => {
+                let size = self.group_float_size(&drag.members, drag.source.size());
+                let grab = (drag.origin - drag.source.min).clamp(Vec2::ZERO, size) + vec2(0.0, BAR_HEIGHT);
+                let rect = self.desktop_float(&pointer, size, grab);
+                let action = group_action(drag, Target::Float { rect: Some([rect.left(), rect.top(), rect.width(), rect.height()]) });
+                self.push_checked(Some(action), &drag.panel);
+            }
+        }
+        if pointer.released {
+            cancel_drag::<P>(ctx, self.id);
+        }
+        None
+    }
+
+    /// A bar drag of a native window, at the end of the main window's frame: the preview
+    /// over the main window, and the release.
+    pub(in crate::docking) fn finish_window_drag(&mut self, ui: &Ui) {
+        if let Some((drag, pointer)) = self.cross.release.take() {
+            self.drop_native_window(drag.window, &pointer);
+            return;
+        }
+        let Some(pointer) = self.cross.pointer.filter(|p| p.window.is_some() && !p.released) else { return };
+        let Some(drag) = pointer.window.and_then(|w| self.window_group_drag(w)) else { return };
+        if let Some(Dest::Main(local)) = self.destination(&pointer, None) {
+            (self.cross.bar, self.cross.docks) = (true, pointer.docks);
+            self.cross.highlighted |= self.paint_group_drag(ui, &drag, local, pointer.command);
+            (self.cross.bar, self.cross.docks) = (false, false);
+        }
+    }
+
+    /// Release of a bar drag: over a target in another window the whole window docks or
+    /// joins there. Over the desktop, or with Ctrl/Cmd held, it stays where it was moved.
+    fn drop_native_window(&mut self, window: u64, pointer: &DragPointer) {
+        let Some(drag) = self.window_group_drag(window).filter(|_| !pointer.command && (pointer.docks || self.style.title_bar_docks)) else { return };
+        match self.destination(pointer, None) {
+            Some(Dest::Main(local)) => {
+                (self.cross.bar, self.cross.docks) = (true, pointer.docks);
+                self.drop_window(&drag, local, false);
+                (self.cross.bar, self.cross.docks) = (false, false);
+            }
+            Some(Dest::Window(target, local)) => {
+                let action = self.within_window(target, |r| {
+                    let proposal = r.group_proposal(&drag, local).filter(|p| !p.noop)?;
+                    Some(group_action(&drag, Target::At { anchor: proposal.anchor, placement: proposal.placement }))
+                });
+                if let Some(action) = action.flatten() {
+                    self.output.actions.push(action);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// A native window's bar drag as a whole-window group drag.
+    fn window_group_drag(&self, window: u64) -> Option<GroupDrag<P>> {
+        let window: &Floating<P> = self.layout.floating.iter().find(|w| w.id == window)?;
+        let members: Vec<P> = window.panels().cloned().collect();
+        let panel = members.first()?.clone();
+        Some(GroupDrag { panel, original: window.rect, gesture: GroupGesture::Window, members, origin: Pos2::ZERO, source: Rect::NOTHING })
+    }
+
+    /// At the end of a native window's frame: the drop preview, and its undock hint, when the
+    /// drag's pointer is over this window.
+    pub(super) fn paint_cross(&mut self, ui: &Ui, surface: &mut Surface<P>) {
+        let ctx = ui.ctx();
+        let Some(pointer) = ctx.data(|d| d.get_temp::<DragPointer>(self.id.with(POINTER))).filter(|p| !p.released && p.down) else { return };
+        if let Some(Dest::Window(window, local)) = self.destination(&pointer, Some(&*surface))
+            && window == surface.window
+        {
+            let shift = self.shift(&pointer, surface.origin);
+            self.within(surface, |r| r.paint_drop(ui, &pointer, local, shift));
+        }
+    }
+
+    /// The preview of the drag at `local`, in the window drawing now. `shift` takes the
+    /// owner's coordinates to this window's.
+    fn paint_drop(&mut self, ui: &Ui, pointer: &DragPointer, local: Pos2, shift: Vec2) {
+        let ctx = ui.ctx();
+        if let Some(window) = pointer.window {
+            if let Some(drag) = self.window_group_drag(window) {
+                self.cross.docks = pointer.docks;
+                self.cross.highlighted |= self.paint_group_drag(ui, &drag, local, pointer.command);
+                self.cross.docks = false;
+            }
+            return;
+        }
+        if let Some(drag) = ctx.data(|d| d.get_temp::<Drag<P>>(self.id.with("drag"))) {
+            if pointer.command || drag.undock {
+                return;
+            }
+            let drag = Drag { origin: drag.origin + shift, source: drag.source.translate(shift), ..drag };
+            let proposal = self.tab_proposal(&drag.panel, local);
+            let painter = self.preview_painter(ctx);
+            self.paint_tab_proposal(ctx, &painter, &drag, proposal.as_ref(), local);
+        } else if let Some(drag) = ctx.data(|d| d.get_temp::<GroupDrag<P>>(self.id.with("group-drag"))).filter(|d| d.gesture != GroupGesture::Window)
+        {
+            let drag = GroupDrag { origin: drag.origin + shift, source: drag.source.translate(shift), ..drag };
+            self.paint_group_drag(ui, &drag, local, pointer.command);
+        }
+    }
+
+    /// End of the main window's frame: forget the pointer of a finished drag, and keep whether
+    /// a bar drag highlighted a drop target. The dragged window sets its opacity from that on
+    /// the next frame: it draws before the main window paints its preview.
+    pub(in crate::docking) fn end_cross(&mut self, ctx: &Context) {
+        let id = self.id;
+        ctx.data_mut(|d| d.insert_temp(id.with(HIGHLIGHTED), self.cross.highlighted));
+        let active = ctx.data(|d| {
+            d.get_temp::<Drag<P>>(id.with("drag")).is_some()
+                || d.get_temp::<GroupDrag<P>>(id.with("group-drag")).is_some()
+                || d.get_temp::<WindowDrag>(id.with("window-drag")).is_some()
+        });
+        if !active {
+            ctx.data_mut(|d| d.remove::<DragPointer>(id.with(POINTER)));
+        }
+    }
+
+    /// The drag's input as its owner saw it, at `pointer` in the coordinates of the window
+    /// finishing it. Leaving a window does not end the drag.
+    fn input_of(&self, pointer: &DragPointer, at: Option<Pos2>) -> DragInput {
+        DragInput {
+            pointer: at,
+            down: pointer.down,
+            released: pointer.released,
+            focused: !self.cross.focus_lost,
+            gone: false,
+            escape: pointer.escape,
+            command: pointer.command,
+            touch_ended: false,
+        }
+    }
+
+    /// The in-window rect of a window floated out at the desktop pointer with its top-left
+    /// `grab` from it. The new window opens at the main window's origin plus this rect. Where
+    /// positions are unknown the window system places it.
+    fn desktop_float(&self, pointer: &DragPointer, size: Vec2, grab: Vec2) -> Rect {
+        match (pointer.desktop(), self.cross.main) {
+            (Some(point), Some(main)) => Rect::from_min_size(point - grab - main.min.to_vec2(), size),
+            _ => clamp_float(Rect::from_min_size(self.float_bounds.min, size), self.float_bounds),
+        }
+    }
+
+    /// Push `action` when the model accepts it, focusing `panel`.
+    fn push_checked(&mut self, action: Option<Action<P>>, panel: &P) {
+        let Some(action) = action else { return };
+        if self.layout.clone().apply_with_permissions(action.clone(), |p| self.permissions(p)).is_ok() {
+            self.output.actions.push(action);
+            self.output.focused = Some(panel.clone());
+        }
+    }
+}
diff --git a/crates/ui/src/docking/render/dock.rs b/crates/ui/src/docking/render/dock.rs
new file mode 100644
index 00000000..878d909e
--- /dev/null
+++ b/crates/ui/src/docking/render/dock.rs
@@ -0,0 +1,814 @@
+//! [D] Docks: side docks of columns, each a column bar above stacked groups.
+//!
+//! Columns run from the window edge inwards. Every column's inner edge resizes it; the last
+//! column's inner edge is the dock's inner edge. Behavior follows VectorCraft `floating.rs`
+//! (column layout, drop geometry) and PhotoCraft `dock.rs` (group heights).
+
+use std::{fmt::Debug, hash::Hash};
+
+use egui::{Context, Key, Pos2, Rect, Sense, Stroke, StrokeKind, Ui, UiBuilder, pos2, vec2};
+
+use super::{GroupKind, Renderer, RowItem, row_drag, row_range, stripless};
+use crate::docking::{
+    Action, Column, DockEvent, DockHeights, DockStyle, DropTarget, Group, GroupDrag, GroupGesture, Node, Placement, Side, Target, Zone,
+    dock_model::Unit,
+    targets::{
+        DockDrop, DockTarget, SIDE_EDGE_ZONE_DEPTH, STRIP_REACH, body_zone, column_edge, drop_zone, horizontal_line, resolve_dock, usable,
+        vertical_line,
+    },
+};
+use crate::layout::{ResizeHandle, ResizeHandleStyle, SplitAxis};
+
+/// Width of the »/« button at the outer end of a column bar.
+const COLLAPSE_WIDTH: f32 = 18.0;
+
+/// [D] An open group of a dock column: its visible body, and the target and line of its left,
+/// right, top and bottom zones (see [`DockStyle::side_zone_fraction`]). The top and bottom
+/// stack a group above or below it; the left and right make a column on that side.
+#[derive(Clone, Debug)]
+pub(in crate::docking) struct DockGroup<P> {
+    body: Rect,
+    /// The group takes tabs, so its body has a middle that joins it.
+    center: bool,
+    sides: [Option<(DockTarget<P>, Rect)>; 4],
+}
+
+impl<P> DockGroup<P> {
+    fn side(&self, zone: Zone) -> Option<&(DockTarget<P>, Rect)> {
+        let index = match zone {
+            Zone::Left => 0,
+            Zone::Right => 1,
+            Zone::Top => 2,
+            Zone::Bottom => 3,
+            Zone::Center => return None,
+        };
+        self.sides.get(index)?.as_ref()
+    }
+}
+
+/// The physical window edge a dock sits on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(in crate::docking) enum Edge {
+    Left,
+    Right,
+}
+
+/// `Start` is the left edge in a left-to-right layout and the right edge in a right-to-left one.
+pub(in crate::docking) fn edge_of(side: Side, right_to_left: bool) -> Edge {
+    match (side, right_to_left) {
+        (Side::Start, false) | (Side::End, true) => Edge::Left,
+        (Side::Start, true) | (Side::End, false) => Edge::Right,
+    }
+}
+
+fn side_at(edge: Edge, right_to_left: bool) -> Side {
+    match (edge, right_to_left) {
+        (Edge::Left, false) | (Edge::Right, true) => Side::Start,
+        (Edge::Left, true) | (Edge::Right, false) => Side::End,
+    }
+}
+
+/// The rects of a dock beside `other` in `rect`, and the widest the dock may get.
+pub(in crate::docking) fn dock_rects<P>(
+    side: Side,
+    columns: &[Column<P>],
+    other: &Node<P>,
+    rect: Rect,
+    style: &DockStyle,
+    content: &dyn crate::docking::DockContent<P>,
+) -> (Rect, Rect, f32) {
+    let gap = style.gap;
+    let room = (rect.width() - gap - super::node_limits(other, style, content).min.x).clamp(0.0, rect.width());
+    let width = columns.iter().map(|c| column_width(c, style)).sum::<f32>().clamp(0.0, room);
+    let (dock, rest) = match edge_of(side, style.right_to_left) {
+        Edge::Left => (
+            Rect::from_min_max(rect.min, pos2(rect.left() + width, rect.bottom())),
+            Rect::from_min_max(pos2((rect.left() + width + gap).min(rect.right()), rect.top()), rect.max),
+        ),
+        Edge::Right => (
+            Rect::from_min_max(pos2(rect.right() - width, rect.top()), rect.max),
+            Rect::from_min_max(rect.min, pos2((rect.right() - width - gap).max(rect.left()), rect.bottom())),
+        ),
+    };
+    (dock, rest, room)
+}
+
+pub(in crate::docking) fn column_width<P>(column: &Column<P>, style: &DockStyle) -> f32 {
+    if column.iconic { column.iconic_width.unwrap_or(style.iconic_width).clamp(style.iconic_width, style.iconic_max_width) } else { column.width }
+}
+
+/// [D] A dock's columns as drawn in its rect: each column's width bounds, natural width with
+/// the floor it shrinks to, and the width [`fit_widths`] gives it, and each column with groups
+/// as `(index, width, rect)`, from the window edge inwards.
+pub(in crate::docking) struct DockColumns {
+    bounds: Vec<(f32, f32)>,
+    natural: Vec<(f32, Option<f32>)>,
+    widths: Vec<f32>,
+    pub(in crate::docking) rects: Vec<(usize, f32, Rect)>,
+}
+
+/// The rects of groups `heights` high, stacked from the top of `area`.
+pub(in crate::docking) fn stacked(area: Rect, heights: &[f32]) -> Vec<Rect> {
+    let mut top = area.top();
+    heights
+        .iter()
+        .map(|height| {
+            let rect = Rect::from_min_max(pos2(area.left(), top), pos2(area.right(), top + height));
+            top += height;
+            rect
+        })
+        .collect()
+}
+
+/// A group of a column, as [`group_heights`] sizes it. Heights include the tab strip.
+#[derive(Clone, Copy, Debug, Default)]
+pub(in crate::docking) struct GroupSize {
+    pub(in crate::docking) minimized: bool,
+    /// `Group::height`: set by the user; `None` or not finite when never resized.
+    pub(in crate::docking) saved: Option<f32>,
+    pub(in crate::docking) min: f32,
+    /// The content's [`DockHeights`](crate::docking::DockHeights), the strip added (to a
+    /// `fill` above 0 only, so 0 still means the group does not ask to fill).
+    pub(in crate::docking) content: Option<DockHeights>,
+}
+
+/// Heights of stacked groups in a column body `room` high. Minimized groups take `strip`,
+/// groups with a saved height keep it, and groups the user never resized whose content asks
+/// for a fill height share what is left. Without those, the groups without content heights
+/// share it, and when every open group has a height, the last one takes the rest. Other
+/// groups take their content's default height, or their minimum. Default heights shrink towards their compact heights until the
+/// filling groups get their content's fill height, then every height shrinks towards its
+/// minimum before the column overflows and scrolls. Default heights give way nearest the
+/// filling groups first; saved and default heights then shrink in proportion to their room.
+pub(in crate::docking) fn group_heights(groups: &[GroupSize], strip: f32, room: f32) -> Vec<f32> {
+    let saved = |g: &GroupSize| g.saved.filter(|h| h.is_finite());
+    let open: Vec<usize> = (0..groups.len()).filter(|i| groups.get(*i).is_some_and(|g| !g.minimized)).collect();
+    let unsaved = |i: &usize, test: fn(Option<DockHeights>) -> bool| groups.get(*i).is_some_and(|g| saved(g).is_none() && test(g.content));
+    let mut shared: Vec<usize> = open.iter().copied().filter(|i| unsaved(i, |c| c.is_some_and(|c| c.fill > 0.0))).collect();
+    if shared.is_empty() {
+        shared = open.iter().copied().filter(|i| unsaved(i, |c| c.is_none())).collect();
+    }
+    if shared.is_empty() {
+        shared.extend(open.last());
+    }
+    let sized: Vec<usize> = open.iter().copied().filter(|i| !shared.contains(i)).collect();
+    let mut defaulted: Vec<usize> = sized.iter().copied().filter(|i| groups.get(*i).is_some_and(|g| saved(g).is_none())).collect();
+    let mut heights: Vec<f32> = groups
+        .iter()
+        .enumerate()
+        .map(|(i, g)| {
+            if g.minimized {
+                strip
+            } else if shared.contains(&i) {
+                0.0
+            } else {
+                saved(g).or(g.content.map(|c| c.default)).unwrap_or(g.min).max(g.min)
+            }
+        })
+        .collect();
+    let mins: Vec<f32> = groups.iter().map(|g| if g.minimized { strip } else { g.min }).collect();
+    let compacts: Vec<f32> = groups.iter().zip(&mins).map(|(g, min)| g.content.map_or(*min, |c| c.compact).max(*min)).collect();
+    let fill: f32 = shared.iter().filter_map(|i| groups.get(*i)).map(|g| g.content.map_or(g.min, |c| c.fill).max(g.min)).sum();
+    // Nearest the filling groups first: one group gives way to its compact height before the next.
+    defaulted.sort_by_key(|i| shared.iter().map(|s| s.abs_diff(*i)).min());
+    let mut deficit = heights.iter().sum::<f32>() + fill - room;
+    for i in defaulted {
+        if deficit <= 0.0 {
+            break;
+        }
+        if let (Some(height), Some(floor)) = (heights.get_mut(i), compacts.get(i)) {
+            let give = (*height - floor).clamp(0.0, deficit);
+            *height -= give;
+            deficit -= give;
+        }
+    }
+    let shared_min: f32 = shared.iter().filter_map(|i| mins.get(*i)).sum();
+    give_way(&mut heights, &sized, &mins, shared_min - room);
+    let free = (room - heights.iter().sum::<f32>()).max(0.0);
+    // The shared groups split what is left evenly, each at least its minimum: groups whose
+    // minimum is above the even share take their minimum and the rest split the remainder.
+    let mut floors: Vec<f32> = shared.iter().filter_map(|i| mins.get(*i).copied()).collect();
+    floors.sort_by(|a, b| b.total_cmp(a));
+    let (mut rest, mut count) = (free, floors.len());
+    for floor in floors {
+        if count > 1 && floor > rest / count as f32 {
+            rest -= floor;
+            count -= 1;
+        } else {
+            break;
+        }
+    }
+    let share = rest / count.max(1) as f32;
+    for i in &shared {
+        if let (Some(height), Some(min)) = (heights.get_mut(*i), mins.get(*i)) {
+            *height = share.max(*min);
+        }
+    }
+    heights
+}
+
+/// Shrink the `which` heights in proportion towards their `floors` until the column's heights
+/// plus `extra` fit, or every one is at its floor.
+fn give_way(heights: &mut [f32], which: &[usize], floors: &[f32], extra: f32) {
+    let deficit = heights.iter().sum::<f32>() + extra;
+    let slack: f32 = which.iter().filter_map(|i| Some((heights.get(*i)? - floors.get(*i)?).max(0.0))).sum();
+    if deficit > 0.0 && slack > 0.0 {
+        let take = deficit.min(slack) / slack;
+        for i in which {
+            if let (Some(height), Some(floor)) = (heights.get_mut(*i), floors.get(*i)) {
+                *height -= (*height - floor).max(0.0) * take;
+            }
+        }
+    }
+}
+
+/// Column widths that fit `room`. Each entry is (width, floor); a column with a floor shrinks
+/// in proportion, never below its floor, and one without keeps its width. A dock saved on a
+/// larger screen still fits, as far as the floors allow.
+pub(in crate::docking) fn fit_widths(columns: &[(f32, Option<f32>)], room: f32) -> Vec<f32> {
+    let mut widths: Vec<f32> = columns.iter().map(|(w, _)| *w).collect();
+    for _ in 0..columns.len() {
+        let total: f32 = widths.iter().sum();
+        if total <= room {
+            break;
+        }
+        let flex: f32 = widths.iter().zip(columns).filter(|(w, (_, floor))| floor.is_some_and(|f| **w > f)).map(|(w, _)| *w).sum();
+        if flex <= 0.0 {
+            break;
+        }
+        let scale = ((room - (total - flex)) / flex).max(0.0);
+        for (width, (_, floor)) in widths.iter_mut().zip(columns) {
+            if let Some(floor) = *floor
+                && *width > floor
+            {
+                *width = (*width * scale).max(floor);
+            }
+        }
+    }
+    widths
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
+    /// A horizontal split with a dock child: the dock takes its columns' width on its physical
+    /// edge, the sibling the rest. False when neither child is a dock.
+    pub(super) fn dock_split(
+        &mut self,
+        ui: &mut Ui,
+        first: &Node<P>,
+        second: &Node<P>,
+        rect: Rect,
+        path: &mut Vec<bool>,
+        root: (&Node<P>, Rect),
+    ) -> bool {
+        let (dock_first, side, columns, other) = match (first, second) {
+            (Node::Dock { side, columns }, other) => (true, *side, columns, other),
+            (other, Node::Dock { side, columns }) => (false, *side, columns, other),
+            _ => return false,
+        };
+        let (dock, rest, room) = dock_rects(side, columns, other, rect, self.style, &*self.content);
+        self.dock(ui, side, columns, dock, room);
+        path.push(dock_first);
+        self.node(ui, other, rest, path, root);
+        path.pop();
+        true
+    }
+
+    /// One dock in `rect`, columns from its outer edge. `room` is the widest the dock may get.
+    pub(super) fn dock(&mut self, ui: &mut Ui, side: Side, columns: &[Column<P>], rect: Rect, room: f32) {
+        let edge = edge_of(side, self.style.right_to_left);
+        let (outer, inward) = match edge {
+            Edge::Left => (rect.left(), 1.0),
+            Edge::Right => (rect.right(), -1.0),
+        };
+        let (band_width, line_width) = (self.style.column_edge_band, self.style.drop_line_width);
+        if columns.is_empty() {
+            let (band, line) = column_edge(outer, rect.y_range(), band_width, line_width);
+            let band = band.union(Rect::from_x_y_ranges(
+                outer.min(outer + inward * self.style.new_dock_band)..=outer.max(outer + inward * self.style.new_dock_band),
+                rect.y_range(),
+            ));
+            self.dock_targets.push(DockDrop { target: DockTarget::NewDock { side }, band, line, outer: true });
+            return;
+        }
+        if usable(rect) {
+            ui.painter().rect_filled(rect, 0.0, self.style.background);
+        }
+        let DockColumns { bounds, natural, widths, rects } = self.dock_columns(side, columns, rect);
+        let scaled = widths.iter().zip(&natural).any(|(w, (n, _))| w != n);
+        let total: f32 = widths.iter().sum();
+        let mut drawn = Vec::new();
+        for (index, width, column_rect) in rects {
+            let Some(column) = columns.get(index) else { continue };
+            let Some(first) = column.groups.first().and_then(|g| g.panels.first()) else { continue };
+            let (x, inner) = match edge {
+                Edge::Left => (column_rect.left(), column_rect.right()),
+                Edge::Right => (column_rect.right(), column_rect.left()),
+            };
+            let groups = self.dock_groups.len();
+            self.column(ui, column, first, column_rect, edge);
+            let (outer_band, outer_line) = column_edge(x, rect.y_range(), band_width, line_width);
+            let (inner_band, inner_line) = column_edge(inner, rect.y_range(), band_width, line_width);
+            let before = (DockTarget::ColumnEdge { anchor: first.clone(), after: false }, outer_line);
+            let after = (DockTarget::ColumnEdge { anchor: first.clone(), after: true }, inner_line);
+            let (left, right) = match edge {
+                Edge::Left => (before.clone(), after.clone()),
+                Edge::Right => (after.clone(), before.clone()),
+            };
+            for group in self.dock_groups.iter_mut().skip(groups) {
+                group.sides[0] = Some(left.clone());
+                group.sides[1] = Some(right.clone());
+            }
+            if index == 0 {
+                // Inside the window, as the new-dock band's line is.
+                let line = vertical_line(x + inward * line_width * 0.5, rect.y_range(), line_width);
+                self.dock_targets.push(DockDrop { target: before.0, band: outer_band, line, outer: true });
+            }
+            self.dock_targets.push(DockDrop { target: after.0, band: inner_band, line: after.1, outer: false });
+            drawn.push((index, column, first, width, inner));
+        }
+        // Registered after the columns, so the narrow hit areas win at the edges.
+        for (index, column, first, width, inner) in drawn {
+            if width < 1.0 {
+                continue;
+            }
+            let others = total - widths.get(index).copied().unwrap_or_default();
+            let (lo, hi) = bounds.get(index).copied().unwrap_or_default();
+            let hi = hi.min(room - others).max(lo.min(room - others).max(0.0));
+            let lo = lo.min(hi);
+            let divider = Rect::from_x_y_ranges((inner - 1.0)..=(inner + 1.0), rect.y_range());
+            let response = ResizeHandle::new(
+                self.id.with(("column-resize", Some(first))),
+                SplitAxis::Horizontal,
+                divider,
+                &self.style.resize_label,
+                self.handle_style(),
+            )
+            .value(width, lo..=hi)
+            .reversed(inward < 0.0)
+            .show(ui);
+            self.register_interaction(ui.ctx(), response.response.id);
+            let next = (width + inward * response.delta).clamp(lo, hi);
+            if response.delta != 0.0 && next != width && next > 0.0 {
+                self.output.actions.push(if column.iconic {
+                    Action::ResizeIconic { panel: first.clone(), width: Some(next) }
+                } else {
+                    Action::ResizeColumn { panel: first.clone(), width: next }
+                });
+                // A dock shrunk to fit keeps the widths it was drawn at, so the resized column
+                // follows the pointer instead of being scaled again.
+                if scaled {
+                    for (other, (column, width)) in columns.iter().zip(&widths).enumerate() {
+                        let first = column.groups.first().and_then(|g| g.panels.first());
+                        if let Some(first) = first.filter(|_| other != index && !column.iconic && *width > 0.0) {
+                            self.output.actions.push(Action::ResizeColumn { panel: first.clone(), width: *width });
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    /// The columns of a dock drawn in `rect` ([`DockColumns`]).
+    pub(in crate::docking) fn dock_columns(&self, side: Side, columns: &[Column<P>], rect: Rect) -> DockColumns {
+        let (outer, inward) = match edge_of(side, self.style.right_to_left) {
+            Edge::Left => (rect.left(), 1.0),
+            Edge::Right => (rect.right(), -1.0),
+        };
+        let bounds: Vec<(f32, f32)> =
+            columns.iter().map(|c| if c.iconic { (self.style.iconic_width, self.style.iconic_max_width) } else { self.column_bounds(c) }).collect();
+        let natural: Vec<(f32, Option<f32>)> =
+            columns.iter().zip(&bounds).map(|(c, (lo, _))| (column_width(c, self.style), (!c.iconic).then_some(lo.max(1.0)))).collect();
+        let widths = fit_widths(&natural, rect.width());
+        let mut x = outer;
+        let mut rects = Vec::new();
+        for (index, column) in columns.iter().enumerate() {
+            if column.groups.first().and_then(|g| g.panels.first()).is_none() {
+                continue;
+            }
+            let fitted = widths.get(index).copied().unwrap_or_default();
+            let width = fitted.min((rect.width() - (x - outer).abs()).max(0.0));
+            let inner = x + inward * width;
+            rects.push((index, width, Rect::from_x_y_ranges(x.min(inner)..=x.max(inner), rect.y_range())));
+            x = inner;
+        }
+        DockColumns { bounds, natural, widths, rects }
+    }
+
+    /// A column drawn at `rect`: its bar, the body below it, and the heights of its groups in
+    /// the body, top to bottom (none when the column is iconic or its body is empty). Groups
+    /// taller than the body together scroll.
+    pub(in crate::docking) fn column_layout(&self, column: &Column<P>, rect: Rect) -> (Rect, Rect, Vec<f32>) {
+        let bar = Rect::from_min_max(rect.min, pos2(rect.right(), (rect.top() + self.style.column_bar_height).min(rect.bottom())));
+        let body = Rect::from_min_max(pos2(rect.left(), bar.bottom()), rect.max);
+        if column.iconic || !usable(body) {
+            return (bar, body, Vec::new());
+        }
+        let sizes: Vec<_> = column
+            .groups
+            .iter()
+            .map(|g| GroupSize { minimized: g.minimized, saved: g.height, min: self.group_min(g), content: self.dock_heights(g) })
+            .collect();
+        (bar, body, group_heights(&sizes, self.style.tab_height, body.height()))
+    }
+
+    fn handle_style(&self) -> ResizeHandleStyle {
+        ResizeHandleStyle { hovered: self.style.accent, dragged: self.style.accent, focused: self.style.accent }
+    }
+
+    /// Width bounds of an expanded column from its panels' limits.
+    fn column_bounds(&self, column: &Column<P>) -> (f32, f32) {
+        let mut lo = self.style.min_pane;
+        let mut hi = f32::INFINITY;
+        for panel in column.groups.iter().flat_map(|g| g.panels.iter()) {
+            let limits = self.limits(panel);
+            lo = lo.max(limits.min.x);
+            hi = hi.min(limits.max.x);
+        }
+        (lo, hi.max(lo))
+    }
+
+    /// Least height of an open group: its strip and the tallest minimum of its panels.
+    fn group_min(&self, group: &Group<P>) -> f32 {
+        let body = group.panels.iter().map(|p| self.limits(p).min.y).fold(self.style.min_pane, f32::max);
+        self.style.tab_height + body
+    }
+
+    /// The largest of each of the group's panels' [`DockHeights`], the tab strip added.
+    fn dock_heights(&self, group: &Group<P>) -> Option<DockHeights> {
+        let strip = self.style.tab_height;
+        group
+            .panels
+            .iter()
+            .filter_map(|p| self.content.dock_heights(p).filter(|h| h.valid()))
+            .reduce(|a, b| DockHeights { default: a.default.max(b.default), compact: a.compact.max(b.compact), fill: a.fill.max(b.fill) })
+            .map(|h| DockHeights {
+                default: h.default + strip,
+                compact: h.compact.min(h.default) + strip,
+                fill: if h.fill > 0.0 { h.fill + strip } else { 0.0 },
+            })
+    }
+
+    fn column(&mut self, ui: &mut Ui, column: &Column<P>, first: &P, rect: Rect, edge: Edge) {
+        if !usable(rect) {
+            return;
+        }
+        self.record_column_float(column.groups.iter().flat_map(|g| g.panels.iter().cloned()).collect(), rect);
+        let (bar, body, heights) = self.column_layout(column, rect);
+        self.column_bar(ui, column, first, bar, rect, edge);
+        if column.iconic && usable(body) {
+            self.iconic_column(ui, column, body, edge);
+        }
+        if column.iconic || !usable(body) {
+            ui.painter().rect_stroke(rect, 0.0, self.style.border, StrokeKind::Inside);
+            return;
+        }
+        let total: f32 = heights.iter().sum();
+        let start = self.targets.len();
+        if total > body.height() + 0.5 {
+            let mut child =
+                ui.new_child(UiBuilder::new().id_salt(("dock-column", first)).max_rect(body).layout(egui::Layout::top_down(egui::Align::Min)));
+            child.set_clip_rect(body.intersect(ui.clip_rect()));
+            let scrolled = egui::ScrollArea::vertical()
+                .id_salt(self.id.with(("column-scroll", first)))
+                .auto_shrink([false, false])
+                .scroll_source(egui::scroll_area::ScrollSource::SCROLL_BAR | egui::scroll_area::ScrollSource::MOUSE_WHEEL)
+                .show(&mut child, |ui| {
+                    let (content, _) = ui.allocate_exact_size(vec2(ui.available_width(), total), Sense::hover());
+                    self.column_groups(ui, column, &heights, content, body);
+                });
+            // Match the drawn content, including rubber-band displacement in egui 0.37.
+            self.column_scroll.insert(first.clone(), scrolled.state.unclamped_offset().y);
+        } else {
+            self.column_groups(ui, column, &heights, body, body);
+        }
+        // A group scrolled out of view takes nothing.
+        for target in self.targets.iter_mut().skip(start) {
+            target.rect = target.rect.intersect(body);
+            target.tab_strip = target.tab_strip.map(|strip| strip.intersect(body));
+            for (_, tab) in &mut target.tabs {
+                *tab = tab.intersect(body);
+            }
+        }
+        ui.painter().rect_stroke(rect, 0.0, self.style.border, StrokeKind::Inside);
+    }
+
+    /// Groups top to bottom in `area` (the scrolled content when the column scrolls), their
+    /// seams and bands clipped to the visible `view`, and the height dividers.
+    fn column_groups(&mut self, ui: &mut Ui, column: &Column<P>, heights: &[f32], area: Rect, view: Rect) {
+        let rects = stacked(area, heights);
+        for (group, rect) in column.groups.iter().zip(&rects) {
+            self.group(ui, &group.panels, group.active, group.minimized, *rect, GroupKind::Dock);
+        }
+        let top = rects.last().map_or(area.top(), |r| r.bottom());
+        let xs = view.x_range();
+        let half = self.style.seam_band * 0.5;
+        let width = self.style.drop_line_width;
+        // A line on an edge scrolled out of the view shows at the view's edge.
+        let line = |y: f32| horizontal_line(y.clamp(view.top() + width * 0.5, view.bottom() - width * 0.5), xs, width);
+        let push = |targets: &mut Vec<DockDrop<P>>, target: DockTarget<P>, band: Rect, line: Rect| {
+            let band = band.intersect(view);
+            if usable(band) {
+                targets.push(DockDrop { target, band, line, outer: false });
+            }
+        };
+        let mut previous: Option<&P> = None;
+        for (group, rect) in column.groups.iter().zip(&rects) {
+            let Some(anchor) = group.panels.first() else { continue };
+            if let Some(above) = previous {
+                let band = Rect::from_x_y_ranges(xs, (rect.top() - half)..=(rect.top() + half));
+                push(&mut self.dock_targets, DockTarget::Seam { anchor: above.clone() }, band, line(rect.top()));
+            }
+            let header = if stripless(&group.panels, &*self.content) { 0.0 } else { self.style.tab_height };
+            let body = Rect::from_min_max(pos2(rect.left(), (rect.top() + header).min(rect.bottom())), rect.max).intersect(view);
+            if !group.minimized && usable(body) {
+                let center = group.panels.get(group.active).is_some_and(|p| self.permissions(p).accepts_tabs);
+                let (above, below) =
+                    (DockTarget::GroupBand { anchor: anchor.clone(), below: false }, DockTarget::GroupBand { anchor: anchor.clone(), below: true });
+                // The left and right sides are the column's edges, set once the column is drawn.
+                self.dock_groups.push(DockGroup {
+                    body,
+                    center,
+                    sides: [None, None, Some((above, line(rect.top()))), Some((below, line(rect.bottom())))],
+                });
+            }
+            previous = Some(anchor);
+        }
+        // The room under the last group, when every group is minimized, stacks below it.
+        if let Some(last) = previous
+            && top < view.bottom()
+        {
+            let band = Rect::from_x_y_ranges(xs, top..=view.bottom());
+            push(&mut self.dock_targets, DockTarget::GroupBand { anchor: last.clone(), below: true }, band, line(top));
+        }
+        // Height dividers between an open group and the next open one, after the groups so
+        // their hit areas win at the boundary. The heights of the groups a drag changes are
+        // saved: the upper group, and the lower groups that give way in turn, or the reverse.
+        let open: Vec<usize> = (0..column.groups.len()).filter(|i| column.groups.get(*i).is_some_and(|g| !g.minimized)).collect();
+        let row: Vec<RowItem> = open
+            .iter()
+            .filter_map(|i| Some(RowItem { size: *heights.get(*i)?, min: self.group_min(column.groups.get(*i)?), max: f32::INFINITY }))
+            .collect();
+        for (index, pair) in open.windows(2).enumerate() {
+            let &[i, _] = pair else { continue };
+            let (Some(upper), Some(rect), Some(a)) = (column.groups.get(i), rects.get(i), heights.get(i)) else { continue };
+            let Some(first) = upper.panels.first() else { continue };
+            let (lo, hi) = row_range(&row, index);
+            let divider = Rect::from_x_y_ranges(rect.x_range(), (rect.bottom() - 1.0)..=(rect.bottom() + 1.0));
+            let response = ResizeHandle::new(
+                self.id.with(("group-resize", Some(first))),
+                SplitAxis::Vertical,
+                divider,
+                &self.style.resize_label,
+                self.handle_style(),
+            )
+            .value(*a, (a + lo)..=(a + hi))
+            .show(ui);
+            self.register_interaction(ui.ctx(), response.response.id);
+            if response.delta == 0.0 {
+                continue;
+            }
+            for ((group, item), next) in open.iter().filter_map(|g| column.groups.get(*g)).zip(&row).zip(row_drag(&row, index, response.delta)) {
+                if let Some(panel) = group.panels.first().filter(|_| next != item.size) {
+                    self.output.actions.push(Action::ResizeGroup { panel: panel.clone(), height: Some(next) });
+                }
+            }
+        }
+    }
+
+    /// The column bar: the »/« button at its outer end, the rest drags the column (S6),
+    /// toggles iconic on double-click (M2) and opens the column menu (U1).
+    fn column_bar(&mut self, ui: &mut Ui, column: &Column<P>, first: &P, bar: Rect, rect: Rect, edge: Edge) {
+        ui.painter().rect_filled(bar, 0.0, self.style.tab_background);
+        let width = COLLAPSE_WIDTH.min(bar.width());
+        let (button, grip) = match edge {
+            Edge::Left => (
+                Rect::from_min_max(bar.min, pos2(bar.left() + width, bar.bottom())),
+                Rect::from_min_max(pos2(bar.left() + width, bar.top()), bar.max),
+            ),
+            Edge::Right => (
+                Rect::from_min_max(pos2(bar.right() - width, bar.top()), bar.max),
+                Rect::from_min_max(bar.min, pos2(bar.right() - width, bar.bottom())),
+            ),
+        };
+        let label = if column.iconic { self.style.expand_panels_label.clone() } else { self.style.collapse_to_icons_label.clone() };
+        if usable(button) {
+            let response = ui.interact(button, self.id.with(("column-collapse", Some(first))), Sense::click());
+            self.register_interaction(ui.ctx(), response.id);
+            let button_label = if column.iconic { &self.style.expand_column_label } else { &self.style.collapse_column_label };
+            response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), button_label));
+            // The arrows point where the column goes: towards the window edge when it collapses.
+            let glyph = if (edge == Edge::Left) != column.iconic { "«" } else { "»" };
+            let color = if response.hovered() || response.has_focus() { self.style.text } else { self.style.inactive_text };
+            ui.painter().with_clip_rect(button).text(button.center(), egui::Align2::CENTER_CENTER, glyph, self.style.font.clone(), color);
+            if response.clicked() {
+                self.output.actions.push(Action::SetIconic { panel: first.clone(), iconic: !column.iconic });
+            }
+        }
+        if !usable(grip) {
+            return;
+        }
+        let movable = column.groups.iter().flat_map(|g| g.panels.iter()).all(|p| self.permissions(p).movable);
+        let response = ui.interact(grip, self.id.with(("column-bar", Some(first))), Sense::click_and_drag());
+        let response = if movable { response.on_hover_cursor(egui::CursorIcon::Grab) } else { response };
+        self.register_interaction(ui.ctx(), response.id);
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.move_column_label));
+        if movable && response.drag_started() {
+            let origin = ui.input(|i| i.pointer.press_origin()).or_else(|| ui.ctx().pointer_interact_pos()).unwrap_or(grip.center());
+            let drag = GroupDrag {
+                panel: first.clone(),
+                original: [rect.left(), rect.top(), rect.width(), rect.height()],
+                gesture: GroupGesture::Column,
+                members: column.groups.iter().flat_map(|g| g.panels.iter().cloned()).collect(),
+                origin,
+                source: rect,
+            };
+            ui.ctx().data_mut(|d| d.insert_temp(self.id.with("group-drag"), drag));
+        }
+        if response.double_clicked() {
+            self.output.actions.push(Action::SetIconic { panel: first.clone(), iconic: !column.iconic });
+        }
+        if response.has_focus() || response.hovered() {
+            ui.painter().with_clip_rect(grip).rect_stroke(
+                grip.shrink(1.0),
+                0.0,
+                Stroke::new(1.0, self.style.accent.gamma_multiply(0.5)),
+                StrokeKind::Inside,
+            );
+        }
+        let keyboard = response.has_focus() && ui.input(|i| i.key_pressed(Key::Enter) || i.key_pressed(Key::Space));
+        let command = if response.secondary_clicked() || keyboard {
+            Some(egui::SetOpenCommand::Bool(true))
+        } else if response.clicked() {
+            Some(egui::SetOpenCommand::Bool(false))
+        } else {
+            None
+        };
+        egui::Popup::menu(&response).open_memory(command).show(|ui| {
+            if self.menu_action(ui, &label) {
+                self.output.actions.push(Action::SetIconic { panel: first.clone(), iconic: !column.iconic });
+            }
+            if self.auto_collapse_item(ui) {
+                self.output.events.push(DockEvent::ToggleAutoCollapse);
+            }
+        });
+    }
+
+    /// Whether a floating window drawn this frame (other than the one following the pointer)
+    /// or a host overlay covers `pointer`. Covered dock targets take nothing.
+    fn dock_covered(&self, pointer: Pos2, moving: Option<&P>) -> bool {
+        self.blockers.iter().any(|r| r.contains(pointer))
+            || self.iconic.covers(pointer)
+            || self.frame.windows.iter().any(|window| window.window.contains(pointer) && !moving.is_some_and(|p| window.members.contains(p)))
+    }
+
+    /// Dock targets, with the new-dock bands along the docked area's left and right edges that
+    /// have no dock yet.
+    fn dock_candidates(&self) -> Vec<DockDrop<P>> {
+        let mut candidates = self.dock_targets.clone();
+        if !self.style.new_dock_zones || !usable(self.workspace) {
+            return candidates;
+        }
+        let rtl = self.style.right_to_left;
+        let ys = self.workspace.y_range();
+        for edge in [Edge::Left, Edge::Right] {
+            let side = side_at(edge, rtl);
+            if self.layout.dock_path(side).is_some() {
+                continue;
+            }
+            let (x, inward) = match edge {
+                Edge::Left => (self.workspace.left(), self.style.new_dock_band),
+                Edge::Right => (self.workspace.right(), -self.style.new_dock_band),
+            };
+            let band = Rect::from_x_y_ranges(x.min(x + inward)..=x.max(x + inward), ys);
+            let width = self.style.drop_line_width;
+            let line = vertical_line(x + inward.signum() * width * 0.5, ys, width);
+            candidates.push(DockDrop { target: DockTarget::NewDock { side }, band, line, outer: true });
+        }
+        candidates
+    }
+
+    /// Whether `pointer` is on the tab strip of the frontmost group under it, and that group
+    /// takes tabs: the strip joins the group, and border bands reach into it only
+    /// [`STRIP_REACH`] from their lines. Not with [`DockStyle::side_edge_zones`].
+    pub(super) fn in_tab_strip(&self, pointer: Pos2) -> bool {
+        self.in_tab_strip_past(pointer, &[])
+    }
+
+    /// [`Self::in_tab_strip`] past the groups holding any of `through`.
+    fn in_tab_strip_past(&self, pointer: Pos2, through: &[P]) -> bool {
+        let own = |t: &DropTarget<P>| t.tabs.iter().any(|(p, _)| through.contains(p));
+        !self.style.side_edge_zones
+            && self.targets.iter().rev().find(|t| usable(t.rect) && t.rect.contains(pointer) && !own(t)).is_some_and(|t| {
+                t.accepts_tabs && t.tab_strip.map(|strip| strip.intersect(t.rect)).is_some_and(|strip| usable(strip) && strip.contains(pointer))
+            })
+    }
+
+    /// The dock target at `pointer`: a band at a border, else a side zone of a dock group's
+    /// body ([`SIDE_EDGE_ZONE_DEPTH`] deep with [`DockStyle::side_edge_zones`]). The middle of a
+    /// group that takes tabs is none: the group's own target joins it. The groups holding
+    /// `through` (a floating window the drag looks through) hide no strip.
+    fn dock_drop(&self, pointer: Pos2, through: &[P]) -> Option<DockDrop<P>> {
+        let mut candidates = self.dock_candidates();
+        let strip = self.in_tab_strip_past(pointer, through);
+        if strip {
+            candidates.retain(|t| t.line.distance_to_pos(pointer) <= STRIP_REACH);
+        }
+        if let Some(drop) = resolve_dock(pointer, &candidates) {
+            return Some(drop.clone());
+        }
+        if strip {
+            return None;
+        }
+        let group = self.dock_groups.iter().find(|g| g.body.contains(pointer))?;
+        let zone = if self.style.side_edge_zones {
+            drop_zone(group.body, 0.0, SIDE_EDGE_ZONE_DEPTH, pointer)?
+        } else {
+            body_zone(group.body, 0.0, self.style.side_zone_fraction, group.center, pointer)?
+        };
+        let (target, line) = group.side(zone)?.clone();
+        Some(DockDrop { target, band: group.body, line, outer: false })
+    }
+
+    /// The dock target a whole group or column drag would take at `pointer`, with the action.
+    /// A target that leaves the layout unchanged is a no-op: `None` action. A target named by
+    /// one of the moving panels, such as the window edge of the moving group's own column, is
+    /// named by another panel of that column or group, as for a tab drag.
+    pub(super) fn dock_group_proposal(&self, drag: &GroupDrag<P>, pointer: Pos2) -> Option<(Option<Action<P>>, DockDrop<P>)> {
+        let through = self.looks_through(drag);
+        if self.dock_covered(pointer, through.then_some(&drag.panel)) {
+            return None;
+        }
+        let drop = self.dock_drop(pointer, if through { &drag.members } else { &[] })?;
+        let to = match drop.target.to() {
+            Target::At { anchor, placement } if drag.members.contains(&anchor) => {
+                let unit = if matches!(placement, Placement::Column { .. }) { Unit::Column } else { Unit::Group };
+                match self.layout.members(&anchor, unit).ok()?.into_iter().find(|p| !drag.members.contains(p)) {
+                    Some(anchor) => Target::At { anchor, placement },
+                    None => return Some((None, drop)),
+                }
+            }
+            to => to,
+        };
+        self.checked(group_action(drag, to)).map(|action| (action, drop))
+    }
+
+    /// The dock target a single tab drag would take: a new group, column or dock of that panel.
+    /// A panel alone in its group takes the group's state to a new dock; one that shares its
+    /// group leaves the other tabs behind (P6).
+    pub(super) fn dock_tab_proposal(&self, panel: &P, pointer: Pos2) -> Option<(Option<Action<P>>, DockDrop<P>)> {
+        if self.dock_covered(pointer, None) {
+            return None;
+        }
+        let drop = self.dock_drop(pointer, &[])?;
+        let action = match drop.target.to() {
+            // A target named by the dragged panel is its own group or column: another panel
+            // there names the same one. With none, the drop leaves the panel where it is.
+            Target::At { anchor, placement } if &anchor == panel => {
+                let unit = if matches!(placement, Placement::Column { .. }) { Unit::Column } else { Unit::Group };
+                match self.layout.members(panel, unit).ok()?.into_iter().find(|p| p != panel) {
+                    Some(anchor) => Action::Move { panel: panel.clone(), anchor, placement },
+                    None => return Some((None, drop)),
+                }
+            }
+            Target::At { anchor, placement } => Action::Move { panel: panel.clone(), anchor, placement },
+            to @ Target::NewDock { .. } if self.place(panel).and_then(|place| self.layout.group(place)).is_some_and(|g| g.panels.len() == 1) => {
+                Action::MoveGroup { panel: panel.clone(), to }
+            }
+            to @ Target::NewDock { .. } => Action::MovePanel { panel: panel.clone(), to },
+            Target::Float { .. } => return None,
+        };
+        self.checked(action).map(|action| (action, drop))
+    }
+
+    /// `Some(None)` when the action is valid but changes nothing apart from sizes
+    /// ([`crate::docking::Layout::same_arrangement`]), `None` when it is invalid.
+    fn checked(&self, action: Action<P>) -> Option<Option<Action<P>>> {
+        let mut candidate = self.layout.clone();
+        candidate.apply_with_permissions(action.clone(), |p| self.permissions(p)).ok()?;
+        Some((!candidate.same_arrangement(self.layout)).then_some(action))
+    }
+
+    /// The line of a drop that shows no result rect: on the window edge, into an iconic column,
+    /// or any dock drop with [`DockStyle::side_edge_zones`]. A line inside an iconic column also
+    /// outlines the column, unless it is on the window edge (`outer`): a column at that edge holds
+    /// the line, but the drop docks beside the column, not into it.
+    pub(super) fn paint_drop_line(&self, ctx: &Context, line: Rect, outer: bool) {
+        if usable(line) {
+            let painter = self.preview_painter(ctx);
+            if !outer {
+                self.iconic.outline(&painter, line, self.style);
+            }
+            painter.rect_filled(line, 1.0, self.style.accent);
+        }
+    }
+}
+
+/// The move a group gesture makes: the column for a column bar, every group for a window's
+/// title bar, else the group.
+pub(super) fn group_action<P: Clone>(drag: &GroupDrag<P>, to: Target<P>) -> Action<P> {
+    match drag.gesture {
+        GroupGesture::Column => Action::MoveColumn { panel: drag.panel.clone(), to },
+        GroupGesture::Window => Action::MoveWindow { panel: drag.panel.clone(), to },
+        GroupGesture::Group => Action::MoveGroup { panel: drag.panel.clone(), to },
+    }
+}
diff --git a/crates/ui/src/docking/render/floating.rs b/crates/ui/src/docking/render/floating.rs
new file mode 100644
index 00000000..256b128f
--- /dev/null
+++ b/crates/ui/src/docking/render/floating.rs
@@ -0,0 +1,272 @@
+use std::{fmt::Debug, hash::Hash};
+
+use egui::{Context, Id, Key, Pos2, Rect, Ui, pos2, vec2};
+
+use super::{GroupKind, Renderer, clamp_float, node_limits};
+use crate::docking::chrome::{ChromeStyle, FloatingFrame, RESIZE_BAND, TitleBar};
+use crate::docking::{Action, DropProposal, Floating, GroupDrag, GroupGesture, Node, PanelLimits, Placement, Target};
+
+pub(in crate::docking) use crate::docking::chrome::RESIZE_HANDLES;
+
+/// A floating window as drawn: what covers the layout behind it.
+pub(in crate::docking) struct WindowHit<P> {
+    pub(super) window: Rect,
+    /// Where the window's tree is drawn.
+    pub(super) body: Rect,
+    pub(super) members: Vec<P>,
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
+    pub(in crate::docking) fn floating(&mut self, ctx: &Context, windows: &[Floating<P>]) {
+        let screen = self.float_bounds;
+        if !crate::docking::targets::usable(screen) {
+            return;
+        }
+        let layers = ctx.memory(|memory| memory.layer_ids().collect::<Vec<_>>());
+        let mut windows: Vec<_> = windows.iter().collect();
+        windows.sort_by_key(|window| {
+            let id = window.panels().next().map(|panel| self.id.with(("floating", panel)));
+            layers.iter().position(|layer| Some(layer.id) == id).unwrap_or(usize::MAX)
+        });
+        #[cfg(feature = "native-windows")]
+        let windows = self.native_windows(ctx, windows);
+        for window in windows {
+            self.floating_window(ctx, window, screen);
+        }
+    }
+
+    /// Size limits of a floating window: its title bar and, unless it is minimized, its tree.
+    pub(super) fn window_limits(&self, window: &Floating<P>) -> PanelLimits {
+        let chrome = self.window_chrome(window);
+        let tree = node_limits(&window.root, self.style, &*self.content);
+        let body = match window.minimized {
+            true => (self.minimized_body(window), self.minimized_body(window)),
+            false => (tree.min.y, tree.max.y),
+        };
+        let min = vec2(tree.min.x, chrome + body.0).min(vec2(1_000_000.0, 1_000_000.0));
+        PanelLimits { min, max: vec2(tree.max.x, chrome + body.1).max(min).min(vec2(1_000_000.0, 1_000_000.0)) }
+    }
+
+    /// The height of a minimized window's body: the tab strip of its only group, or nothing.
+    pub(super) fn minimized_body(&self, window: &Floating<P>) -> f32 {
+        if matches!(window.root, Node::Tabs { .. }) { self.style.tab_height } else { 0.0 }
+    }
+
+    /// The title bar and, for a movable (resizable) window, the resize band above it.
+    fn window_chrome(&self, window: &Floating<P>) -> f32 {
+        let band = if window.panels().all(|panel| self.permissions(panel).movable) { RESIZE_BAND } else { 0.0 };
+        band + self.style.title_height
+    }
+
+    /// Where a floating window draws its tree, as [`Self::floating_window`] places it.
+    pub(super) fn window_body(&self, window: &Floating<P>) -> Rect {
+        let [x, y, width, height] = window.rect;
+        let limits = self.window_limits(window);
+        let size = vec2(width, height).max(limits.min).min(limits.max);
+        let rect = crate::docking::chrome::clamp(Rect::from_min_size(pos2(x, y), size), self.float_bounds);
+        Rect::from_min_max(pos2(rect.left(), (rect.top() + self.window_chrome(window)).min(rect.bottom())), rect.max)
+    }
+
+    fn floating_window(&mut self, ctx: &Context, window: &Floating<P>, screen: Rect) {
+        let Some(first) = window.panels().next() else { return };
+        let [x, y, width, height] = window.rect;
+        let limits = self.window_limits(window);
+        let size = vec2(width, height).max(limits.min).min(limits.max);
+        let rect = crate::docking::chrome::clamp(Rect::from_min_size(pos2(x, y), size), screen);
+        let id = self.id.with(("floating", first));
+        if self.activation.as_ref().is_some_and(|panel| window.contains(panel)) {
+            ctx.move_to_top(FloatingFrame::layer(id));
+        }
+        let movable = window.panels().all(|panel| self.permissions(panel).movable);
+        let style = ChromeStyle::from_dock(self.style);
+        let resize_label = self.style.resize_window_label.clone();
+        let opacity = self.drag_opacity(ctx, first);
+        let response =
+            FloatingFrame::new(id, rect).bounds(screen).limits(limits).resizable(movable).resize_label(&resize_label).opacity(opacity).show(
+                ctx,
+                &style,
+                |ui, contents| self.window_contents(ui, window, contents, rect, &style),
+            );
+        for handle in &response.handles {
+            self.register_interaction(ctx, handle.id);
+        }
+        let down = ctx.input(|i| i.pointer.primary_down());
+        ctx.data_mut(|data| {
+            let key = self.id.with("pointer-resize");
+            if let Some(started) = response.resize_started {
+                data.insert_temp(key, started);
+            } else if !down && data.get_temp::<Id>(key).is_some_and(|id| response.handles.iter().any(|h| h.id == id)) {
+                data.remove::<Id>(key);
+            }
+        });
+        if let Some(resized) = response.resized {
+            self.output
+                .actions
+                .push(Action::MoveFloating { panel: first.clone(), rect: [resized.left(), resized.top(), resized.width(), resized.height()] });
+        }
+    }
+
+    /// Opacity of the in-window floating window whose first panel is `first`: faded
+    /// ([`super::DRAG_OPACITY`]) while its title bar drag highlights a drop target, as the last
+    /// frame drew it ([`super::preview::GROUP_HIGHLIGHTED`]), else opaque. Its tabs and drag
+    /// bars only drag a ghost, so the window stays opaque for them.
+    fn drag_opacity(&self, ctx: &Context, first: &P) -> f32 {
+        let moving = ctx
+            .data(|d| d.get_temp::<GroupDrag<P>>(self.id.with("group-drag")))
+            .is_some_and(|drag| drag.gesture == GroupGesture::Window && drag.panel == *first);
+        let highlighted = ctx.data(|d| d.get_temp::<bool>(self.id.with(super::preview::GROUP_HIGHLIGHTED))).unwrap_or(false);
+        if moving && highlighted { super::DRAG_OPACITY } else { 1.0 }
+    }
+
+    /// The title bar, then the window's tree below it, in `contents`. Moves carry the whole
+    /// `frame`, resize band included.
+    fn window_contents(&mut self, ui: &mut Ui, window: &Floating<P>, contents: Rect, frame: Rect, style: &ChromeStyle) {
+        let title = Rect::from_min_max(contents.min, pos2(contents.right(), (contents.top() + self.style.title_height).min(contents.bottom())));
+        self.title_bar(ui, window, title, frame, style);
+        let body = Rect::from_min_max(pos2(contents.left(), title.bottom()), contents.max);
+        self.floating_body(ui, window, body, frame);
+    }
+
+    /// A floating window's tree in `body`, like the docked layout's: splits, groups, dividers
+    /// and intersections. A minimized window shows the tab strip of its only group, or nothing.
+    pub(super) fn floating_body(&mut self, ui: &mut Ui, window: &Floating<P>, body: Rect, frame: Rect) {
+        let Some(key) = window.panels().next().cloned() else { return };
+        match (&window.root, window.minimized) {
+            (Node::Tabs { panels, active }, true) => self.group(ui, panels, *active, true, body, GroupKind::Floating { window: frame }),
+            (_, true) => {}
+            (root, false) => {
+                let outer = self.tree.replace((key, frame));
+                self.node(ui, root, body, &mut Vec::new(), (root, body));
+                self.tree = outer;
+            }
+        }
+        self.frame.windows.push(WindowHit { window: frame, body, members: window.panels().cloned().collect() });
+    }
+
+    /// Drag moves the whole window live, double-click minimizes or expands it, × closes every
+    /// panel in it.
+    fn title_bar(&mut self, ui: &mut Ui, window: &Floating<P>, title: Rect, rect: Rect, style: &ChromeStyle) {
+        let Some(first) = window.panels().next() else { return };
+        let movable = window.panels().all(|p| self.permissions(p).movable);
+        let closable = self.style.close_button && window.panels().all(|p| self.permissions(p).closable);
+        let (move_label, close_label) = (self.style.move_window_label.clone(), self.style.close_window_label.clone());
+        let mut bar = TitleBar::new(self.id.with(("move-group", Some(first))), &move_label).movable(movable);
+        if closable {
+            bar = bar.close(&close_label);
+        }
+        let response = bar.show(ui, title, style);
+        self.register_interaction(ui.ctx(), response.bar.id);
+        if movable && response.bar.drag_started() {
+            let origin = ui.input(|i| i.pointer.press_origin()).or_else(|| ui.ctx().pointer_interact_pos()).unwrap_or(title.center());
+            let drag = GroupDrag {
+                panel: first.clone(),
+                original: [rect.left(), rect.top(), rect.width(), rect.height()],
+                gesture: GroupGesture::Window,
+                members: window.panels().cloned().collect(),
+                origin,
+                source: rect,
+            };
+            ui.ctx().data_mut(|d| d.insert_temp(self.id.with("group-drag"), drag));
+        }
+        if movable
+            && response.bar.dragged()
+            && let Some(drag) = ui.ctx().data(|d| d.get_temp::<GroupDrag<P>>(self.id.with("group-drag")))
+            && drag.gesture == GroupGesture::Window
+            && let Some(pointer) = ui.ctx().pointer_interact_pos()
+            && !ui.input(|i| i.key_pressed(Key::Escape))
+            && !crate::focus::lost(ui.ctx())
+        {
+            // From the press origin, so fractional pointer steps do not accumulate rounding.
+            let moved = clamp_float(drag.source.translate(pointer - drag.origin), self.float_bounds);
+            self.output.actions.push(Action::MoveFloating { panel: first.clone(), rect: [moved.left(), moved.top(), moved.width(), moved.height()] });
+        }
+        if response.bar.double_clicked() {
+            self.output.actions.push(Action::SetMinimized { panel: first.clone(), minimized: !window.minimized });
+        }
+        if let Some(close) = response.close {
+            self.register_interaction(ui.ctx(), close.id);
+            if close.clicked() {
+                self.output.actions.push(Action::CloseWindow { panel: first.clone() });
+            }
+        }
+    }
+
+    /// The title bar of a floating window occludes what lies behind it: a no-op proposal. Then
+    /// the layout's outer edge (P8). None leaves the pointer to the group targets. `skip_own`
+    /// looks through the window holding `members` (a window moving live).
+    pub(super) fn extra_proposal(&self, members: &[P], pointer: Pos2, skip_own: bool) -> Option<DropProposal<P>> {
+        let own = |panels: &[P]| panels.iter().any(|p| members.contains(p));
+        let window = self.frame.windows.iter().rev().find(|w| w.window.contains(pointer) && !(skip_own && own(&w.members)));
+        if let Some(window) = window {
+            let in_group = self.targets.iter().any(|t| t.rect.contains(pointer) && t.tabs.iter().any(|(p, _)| window.members.contains(p)));
+            if in_group {
+                return None;
+            }
+            let anchor = members.first()?.clone();
+            return Some(DropProposal { anchor, placement: Placement::Tab { before: None }, preview: Rect::NOTHING, insertion: None, noop: true });
+        }
+        let (anchor, zone, preview) = self.edge_proposal(members, pointer)?;
+        let lead = members.first()?.clone();
+        let action = match members {
+            [_] => Action::Move { panel: lead, anchor: anchor.clone(), placement: Placement::Edge(zone) },
+            _ => Action::MoveGroup { panel: lead, to: Target::At { anchor: anchor.clone(), placement: Placement::Edge(zone) } },
+        };
+        if !self.leaves_room(action) {
+            return None;
+        }
+        Some(DropProposal { anchor, placement: Placement::Edge(zone), preview, insertion: None, noop: false })
+    }
+
+    /// What a group drag carries: the whole window rect for the only group of a floating
+    /// window, so floating it again keeps the window's size; else the group's rect.
+    pub(super) fn drag_source(&self, owner: &super::group::TabGroup<'_, P>) -> Rect {
+        match owner.kind {
+            GroupKind::Floating { window } if owner.panels.first().is_some_and(|p| self.whole_window(p)) => window,
+            _ => owner.rect,
+        }
+    }
+
+    /// Whether a double-click or the group menu minimizes `owner`: a dock group, or the only
+    /// group of a floating window, which minimizes the window to that group's strip.
+    pub(super) fn minimizes(&self, owner: &super::group::TabGroup<'_, P>) -> bool {
+        match owner.kind {
+            GroupKind::Dock => true,
+            GroupKind::Floating { .. } => self.whole_window(owner.selected),
+            GroupKind::Frame => false,
+        }
+    }
+
+    /// Whether `panel`'s group is the whole tree of a floating window.
+    pub(super) fn whole_window(&self, panel: &P) -> bool {
+        matches!(self.place(panel), Some(crate::docking::dock_model::Place::Floating { path, .. }) if path.is_empty())
+    }
+
+    /// Whether moving a whole window docks it: [`crate::docking::DockStyle::title_bar_docks`],
+    /// or a native window moved by its only tab or group.
+    pub(super) fn title_bar_docks(&self) -> bool {
+        #[cfg(feature = "native-windows")]
+        if self.cross.docks {
+            return true;
+        }
+        self.style.title_bar_docks
+    }
+
+    /// Release of a title bar drag. The window already sits where it was dragged; a dock or
+    /// group target docks or merges every group in it, else hosts get the release in
+    /// `group_drop`.
+    pub(super) fn drop_window(&mut self, drag: &GroupDrag<P>, pointer: Pos2, float_only: bool) {
+        let float_only = float_only || !self.title_bar_docks();
+        if !float_only && let Some((action, _)) = self.dock_group_proposal(drag, pointer) {
+            self.output.actions.extend(action);
+            return;
+        }
+        let proposal = if float_only { None } else { self.group_proposal(drag, pointer) };
+        match proposal.filter(|p| !p.noop) {
+            Some(proposal) => {
+                let to = Target::At { anchor: proposal.anchor, placement: proposal.placement };
+                self.output.actions.push(super::dock::group_action(drag, to));
+            }
+            None => self.output.group_drop = Some((drag.panel.clone(), pointer)),
+        }
+    }
+}
diff --git a/crates/ui/src/docking/render/frame.rs b/crates/ui/src/docking/render/frame.rs
new file mode 100644
index 00000000..e1b7c429
--- /dev/null
+++ b/crates/ui/src/docking/render/frame.rs
@@ -0,0 +1,338 @@
+//! What the split tree adds around the groups: Maximize Frame, the outer edge band, hidden
+//! panels, the float hint and the group menu tail.
+
+use std::{borrow::Cow, collections::HashMap, fmt::Debug, hash::Hash};
+
+use egui::{Context, Pos2, Rect, pos2, vec2};
+
+use super::{GroupKind, Renderer, floating::WindowHit, group::TabGroup};
+use crate::docking::{
+    Action, Column, DockContent, DockEvent, Floating, Group, HidePanels, Layout, Node, Placement, Target, Zone,
+    dock_model::{Place, node_at, tree_panels},
+};
+
+/// How far below the pointer the float hint sits, clear of the cursor.
+const HINT_OFFSET: f32 = 28.0;
+
+/// What the renderer draws when it is not the layout itself, and the targets that depend on it.
+pub(in crate::docking) struct FrameState<P> {
+    /// View path to layout path of each split, when the view is not the layout.
+    paths: Option<HashMap<Vec<bool>, Vec<bool>>>,
+    /// The same for each floating window's splits, by the window's first shown panel.
+    window_paths: HashMap<P, HashMap<Vec<bool>, Vec<bool>>>,
+    /// The outer edge areas of top, bottom, left and right drops; none while a frame is
+    /// maximized.
+    edges: Option<[EdgeArea<P>; 4]>,
+    /// The panels the view leaves out.
+    hidden: Vec<P>,
+    pub(super) maximized: Option<P>,
+    /// Floating windows as drawn, back to front.
+    pub(super) windows: Vec<WindowHit<P>>,
+}
+
+/// The view node an outer edge drop wraps ([`Layout::edge_path`]), and its rect once drawn.
+struct EdgeArea<P> {
+    path: Vec<bool>,
+    /// The node is narrower than the part between the docks: the canvas column.
+    narrowed: bool,
+    panels: Vec<P>,
+    rect: Option<Rect>,
+}
+
+impl<P: Clone + Eq + Hash> EdgeArea<P> {
+    fn of(view: &Layout<P>, zone: Zone, canvas: &dyn Fn(&P) -> bool) -> Self {
+        let path = view.edge_path(zone, canvas);
+        let panels =
+            view.root.as_ref().and_then(|root| node_at(root, &path)).map_or(Vec::new(), |node| tree_panels(node).into_iter().cloned().collect());
+        Self { narrowed: view.edge_narrows(zone, canvas), path, panels, rect: None }
+    }
+}
+
+const EDGES: [Zone; 4] = [Zone::Top, Zone::Bottom, Zone::Left, Zone::Right];
+
+fn edge_areas<P: Clone + Eq + Hash>(view: &Layout<P>, canvas: &dyn Fn(&P) -> bool) -> [EdgeArea<P>; 4] {
+    EDGES.map(|zone| EdgeArea::of(view, zone, canvas))
+}
+
+/// The layout as shown: a maximized frame alone, and hidden panels left out. `narrow` narrows
+/// the outer edge area to the canvas column ([`Layout::edge_path`]).
+pub(in crate::docking) fn view<'a, P: Clone + Eq + Hash>(
+    layout: &'a Layout<P>,
+    maximized: Option<&P>,
+    hide: HidePanels<'_, P>,
+    content: &dyn DockContent<P>,
+    narrow: bool,
+) -> (Cow<'a, Layout<P>>, FrameState<P>) {
+    let protected = |p: &P| content.permissions(p).is_protected();
+    // The edge area narrows to the canvas column without side edge zones.
+    let canvas = |p: &P| narrow && protected(p);
+    let hidden = |p: &P| match hide {
+        HidePanels::None => false,
+        HidePanels::All => !protected(p),
+        HidePanels::Except(keep) => !protected(p) && !keep(p),
+    };
+    // Only a docked panel maximizes its frame.
+    let maximized = maximized.and_then(|panel| match layout.place(panel)? {
+        Place::Node(path) => Some((panel.clone(), path.clone(), layout.root.as_ref().and_then(|root| node_at(root, &path))?.clone())),
+        place @ Place::Dock { .. } => {
+            let group = layout.group(&place)?;
+            Some((panel.clone(), path_of(&place), Node::Tabs { panels: group.panels.clone(), active: group.active }))
+        }
+        Place::Floating { .. } => None,
+    });
+    let mut state = FrameState { paths: None, window_paths: HashMap::new(), edges: None, hidden: Vec::new(), maximized: None, windows: Vec::new() };
+    if maximized.is_none() && matches!(hide, HidePanels::None) {
+        state.edges = Some(edge_areas(layout, &canvas));
+        return (Cow::Borrowed(layout), state);
+    }
+    state.hidden = layout.panels().into_iter().filter(|p| hidden(p)).cloned().collect();
+    let mut paths = HashMap::new();
+    let view = match maximized {
+        Some((panel, path, node)) => {
+            state.maximized = Some(panel);
+            Layout { root: prune(&node, path, Vec::new(), &hidden, &mut paths), floating: Vec::new() }
+        }
+        None => {
+            let root = layout.root.as_ref().and_then(|root| prune(root, Vec::new(), Vec::new(), &hidden, &mut paths));
+            let mut floating = Vec::new();
+            for window in &layout.floating {
+                let mut paths = HashMap::new();
+                let Some(root) = prune(&window.root, Vec::new(), Vec::new(), &hidden, &mut paths) else { continue };
+                let shown = Floating { root, ..window.clone() };
+                if let Some(key) = shown.panels().next() {
+                    state.window_paths.insert(key.clone(), paths);
+                }
+                floating.push(shown);
+            }
+            Layout { root, floating }
+        }
+    };
+    if state.maximized.is_none() {
+        state.edges = Some(edge_areas(&view, &canvas));
+    }
+    state.paths = Some(paths);
+    (Cow::Owned(view), state)
+}
+
+fn path_of(place: &Place) -> Vec<bool> {
+    match place {
+        Place::Node(path) | Place::Dock { path, .. } => path.clone(),
+        Place::Floating { .. } => Vec::new(),
+    }
+}
+
+fn visible<P>(node: &Node<P>, hidden: &dyn Fn(&P) -> bool) -> bool {
+    match node {
+        Node::Split { first, second, .. } => visible(first, hidden) || visible(second, hidden),
+        Node::Tabs { panels, .. } => panels.iter().any(|p| !hidden(p)),
+        Node::Stack { entries } => entries.iter().any(|e| !hidden(&e.panel)),
+        Node::Dock { columns, .. } => columns.iter().flat_map(|c| &c.groups).flat_map(|g| &g.panels).any(|p| !hidden(p)),
+    }
+}
+
+/// `node` without hidden panels; a split with one visible side becomes that side. Records the
+/// layout path of every split kept.
+fn prune<P: Clone + PartialEq>(
+    node: &Node<P>,
+    path: Vec<bool>,
+    at: Vec<bool>,
+    hidden: &dyn Fn(&P) -> bool,
+    paths: &mut HashMap<Vec<bool>, Vec<bool>>,
+) -> Option<Node<P>> {
+    let child = |path: &[bool], side: bool| [path, &[side]].concat();
+    match node {
+        Node::Split { axis, size, first, second } => match (visible(first, hidden), visible(second, hidden)) {
+            (true, true) => {
+                let first = prune(first, child(&path, false), child(&at, false), hidden, paths)?;
+                let second = prune(second, child(&path, true), child(&at, true), hidden, paths)?;
+                paths.insert(at, path);
+                Some(Node::Split { axis: *axis, size: *size, first: Box::new(first), second: Box::new(second) })
+            }
+            (true, false) => prune(first, child(&path, false), at, hidden, paths),
+            (false, true) => prune(second, child(&path, true), at, hidden, paths),
+            (false, false) => None,
+        },
+        Node::Tabs { panels, active } => {
+            let group = prune_group(&Group::new(panels.clone(), *active), hidden)?;
+            Some(Node::Tabs { panels: group.panels, active: group.active })
+        }
+        Node::Stack { entries } => {
+            let entries: Vec<_> = entries.iter().filter(|e| !hidden(&e.panel)).cloned().collect();
+            (!entries.is_empty()).then_some(Node::Stack { entries })
+        }
+        Node::Dock { side, columns } => {
+            let columns: Vec<_> = columns
+                .iter()
+                .filter_map(|c| {
+                    let groups: Vec<_> = c.groups.iter().filter_map(|g| prune_group(g, hidden)).collect();
+                    (!groups.is_empty()).then(|| Column { groups, ..c.clone() })
+                })
+                .collect();
+            (!columns.is_empty()).then_some(Node::Dock { side: *side, columns })
+        }
+    }
+}
+
+/// A group without hidden panels; the selected panel stays selected when it is shown.
+fn prune_group<P: Clone + PartialEq>(group: &Group<P>, hidden: &dyn Fn(&P) -> bool) -> Option<Group<P>> {
+    let selected = group.active_panel();
+    let panels: Vec<P> = group.panels.iter().filter(|p| !hidden(p)).cloned().collect();
+    let active = selected.and_then(|s| panels.iter().position(|p| p == s)).unwrap_or(0);
+    (!panels.is_empty()).then(|| Group { panels, active, ..group.clone() })
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
+    pub(super) fn note_edge(&mut self, path: &[bool], rect: Rect) {
+        if self.tree.is_some() {
+            return;
+        }
+        for area in self.frame.edges.iter_mut().flatten().filter(|area| area.path == path) {
+            area.rect = Some(rect);
+        }
+    }
+
+    /// The layout path of a split drawn at view path `path`, in the tree being drawn.
+    pub(super) fn original_path(&self, path: &[bool]) -> Vec<bool> {
+        let paths = match &self.tree {
+            None => self.frame.paths.as_ref(),
+            Some((key, _)) => self.frame.window_paths.get(key),
+        };
+        paths.and_then(|paths| paths.get(path).cloned()).unwrap_or_else(|| path.to_vec())
+    }
+
+    /// The outer edge band under the pointer (P8): the top and bottom of
+    /// [`crate::docking::DockStyle::drop_edges`], all four with
+    /// [`crate::docking::DockStyle::side_edge_zones`]. Returns a docked anchor that is not
+    /// moving, the zone and the preview: a line along the edge area's whole edge, or with side
+    /// edge zones the quarter the new frame takes. Without them, on a tab strip that takes tabs,
+    /// the band reaches only [`crate::docking::targets::STRIP_REACH`] from the line.
+    pub(super) fn edge_proposal(&self, members: &[P], pointer: Pos2) -> Option<(P, Zone, Rect)> {
+        let sides = self.style.outer_edges();
+        let (distance, zone, area) = EDGES
+            .into_iter()
+            .filter(|zone| sides.contains(*zone))
+            .filter_map(|zone| {
+                let area = self.edge_area(zone)?.rect.filter(|area| area.contains(pointer))?;
+                let distance = match zone {
+                    Zone::Top => pointer.y - area.top(),
+                    Zone::Bottom => area.bottom() - pointer.y,
+                    Zone::Left => pointer.x - area.left(),
+                    Zone::Right | Zone::Center => area.right() - pointer.x,
+                };
+                Some((distance, zone, area))
+            })
+            .min_by(|a, b| a.0.total_cmp(&b.0))?;
+        let band = if self.style.side_edge_zones { crate::docking::targets::SIDE_EDGE_BAND } else { self.style.edge_band };
+        if distance > band.min(area.width() / 4.0).min(area.height() / 4.0) {
+            return None;
+        }
+        let line = crate::docking::targets::edge_line(area, zone, self.style.drop_line_width);
+        let reach = |line: Rect| line.distance_to_pos(pointer) <= crate::docking::targets::STRIP_REACH;
+        if !self.style.side_edge_zones && self.in_tab_strip(pointer) && !line.is_some_and(reach) {
+            return None;
+        }
+        let anchor = self.edge_anchor(members, zone)?;
+        if !self.style.side_edge_zones {
+            return Some((anchor, zone, line?));
+        }
+        let size = area.size() * 0.25;
+        let preview = match zone {
+            Zone::Left => Rect::from_min_size(area.min, vec2(size.x, area.height())),
+            Zone::Right => Rect::from_min_max(pos2(area.right() - size.x, area.top()), area.max),
+            Zone::Top => Rect::from_min_size(area.min, vec2(area.width(), size.y)),
+            Zone::Bottom | Zone::Center => Rect::from_min_max(pos2(area.left(), area.bottom() - size.y), area.max),
+        };
+        Some((anchor, zone, preview))
+    }
+
+    fn edge_area(&self, zone: Zone) -> Option<&EdgeArea<P>> {
+        self.frame.edges.as_ref()?.get(EDGES.iter().position(|edge| *edge == zone)?)
+    }
+
+    /// The docked anchor, not one of `members`, of an outer edge drop at `zone` that wraps the
+    /// edge area drawn: protected where that area is the canvas column, as the model narrows on
+    /// a protected anchor, else not. The drawn area and the model's can still differ (hidden
+    /// panels, a canvas test that differs from these permissions), so the drop is tried: an
+    /// anchor whose drop wraps other panels than the area shows gives way to one that is not
+    /// protected, and then to no edge target.
+    fn edge_anchor(&self, members: &[P], zone: Zone) -> Option<P> {
+        let area = self.edge_area(zone)?;
+        let protected = |p: &P| self.permissions(p).is_protected();
+        let skip = |p: &P| members.contains(p);
+        let lead = members.first()?;
+        let wraps_area = |anchor: &P| {
+            let to = Target::At { anchor: anchor.clone(), placement: Placement::Edge(zone) };
+            let action = match members {
+                [_] => Action::Move { panel: lead.clone(), anchor: anchor.clone(), placement: Placement::Edge(zone) },
+                _ => Action::MoveGroup { panel: lead.clone(), to },
+            };
+            let mut candidate = self.layout.clone();
+            if candidate.apply_with_permissions(action, |p| self.permissions(p)).is_err() {
+                // Left to the model's check.
+                return true;
+            }
+            let Some(Place::Node(path)) = candidate.place(lead) else { return false };
+            let Some((last, parent)) = path.split_last() else { return false };
+            let beside = [parent, &[!last]].concat();
+            let Some(wrapped) = candidate.root.as_ref().and_then(|root| node_at(root, &beside)) else { return false };
+            let shown = |p: &&P| !self.frame.hidden.contains(p) && !members.contains(p);
+            let wrapped: Vec<&P> = tree_panels(wrapped).into_iter().filter(shown).collect();
+            let drawn: Vec<&P> = area.panels.iter().filter(shown).collect();
+            wrapped.len() == drawn.len() && wrapped.iter().all(|p| drawn.contains(p))
+        };
+        let anchor = self.layout.edge_anchor(area.narrowed, &protected, &skip)?;
+        if wraps_area(&anchor) {
+            return Some(anchor);
+        }
+        self.layout.edge_anchor(false, &protected, &skip).filter(|other| *other != anchor && !protected(other) && wraps_area(other))
+    }
+
+    /// Under the pointer while a drag offers a docking target: which modifier floats the drop
+    /// instead. With native windows, the window under the pointer draws it, beside its preview.
+    pub(super) fn paint_float_hint(&self, ctx: &Context, pointer: Pos2) {
+        if !self.style.float_hint || self.style.float_hint_label.is_empty() {
+            return;
+        }
+        let key = if ctx.os() == egui::os::OperatingSystem::Mac { "⌘" } else { "Ctrl" };
+        let painter = self.preview_painter(ctx);
+        let galley = painter.layout_no_wrap(self.style.float_hint_label.replace("{key}", key), self.style.font.clone(), self.style.text);
+        let rect = Rect::from_center_size(pointer + vec2(0.0, HINT_OFFSET), galley.size() + vec2(12.0, 6.0));
+        let rect = crate::docking::chrome::clamp(rect, self.float_bounds);
+        painter.rect(rect, 4.0, self.style.floating_background, egui::Stroke::new(1.0, self.style.accent), egui::StrokeKind::Inside);
+        painter.galley(rect.center() - galley.size() * 0.5, galley, self.style.text);
+    }
+
+    /// Ctrl/Cmd held when a split-tree tab drag starts: the drop floats (S9).
+    pub(super) fn latch_undock(&self, ctx: &Context, kind: Option<GroupKind>) {
+        let command = ctx.input(|i| i.modifiers.command || i.modifiers.ctrl || i.modifiers.mac_cmd);
+        if self.style.command_press_floats && matches!(kind, Some(GroupKind::Frame | GroupKind::Floating { .. })) && command {
+            ctx.data_mut(|d| {
+                if let Some(drag) = d.get_temp::<crate::docking::Drag<P>>(self.id.with("drag")) {
+                    d.insert_temp(self.id.with("drag"), crate::docking::Drag { undock: true, ..drag });
+                }
+            });
+        }
+    }
+
+    /// The menu tail: Close Other Panels in Group and Maximize Frame when the style shows
+    /// them.
+    pub(super) fn frame_items(&mut self, ui: &mut egui::Ui, owner: &TabGroup<'_, P>, panel: &P) {
+        let others = owner.panels.iter().filter(|p| *p != panel).all(|p| self.permissions(p).closable);
+        if self.style.close_others_item
+            && owner.panels.len() > 1
+            && others
+            && self.style.close_menu_items
+            && self.menu_action(ui, &self.style.close_others_label.clone())
+        {
+            self.output.actions.push(Action::CloseOthers { panel: panel.clone() });
+        }
+        if self.style.maximize_item && owner.kind == GroupKind::Frame {
+            let restore = self.frame.maximized.as_ref().is_some_and(|m| owner.panels.contains(m));
+            let label = if restore { self.style.restore_frame_label.clone() } else { self.style.maximize_label.clone() };
+            if self.menu_action(ui, &label) {
+                let panel = if restore { self.frame.maximized.clone().unwrap_or_else(|| panel.clone()) } else { panel.clone() };
+                self.output.events.push(DockEvent::ToggleMaximize { panel });
+            }
+        }
+    }
+}
diff --git a/crates/ui/src/docking/render/group.rs b/crates/ui/src/docking/render/group.rs
new file mode 100644
index 00000000..e4e04cda
--- /dev/null
+++ b/crates/ui/src/docking/render/group.rs
@@ -0,0 +1,510 @@
+use std::{fmt::Debug, hash::Hash, sync::Arc};
+
+use egui::{Color32, Galley, Id, Key, Rect, Sense, Stroke, StrokeKind, Ui, UiBuilder, pos2, vec2};
+
+use super::{Renderer, clamp_float, stripless};
+use crate::docking::{Action, DockContent, DropTarget, GroupDrag, GroupGesture, Placement, Target, begin_drag, surface::TAB_PADDING};
+use crate::tabs;
+
+/// Where a group is drawn. It decides the drop targets the group offers and its gestures.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(in crate::docking) enum GroupKind {
+    /// A `Tabs` node of the split tree: side drops split it.
+    Frame,
+    /// A group in a dock column.
+    Dock,
+    /// A `Tabs` node of the floating window drawn at `window`: side drops split it.
+    Floating { window: Rect },
+}
+
+/// The group a tab belongs to, for its menu and minimize gestures.
+pub(super) struct TabGroup<'a, P> {
+    pub(super) panels: &'a [P],
+    pub(super) selected: &'a P,
+    pub(super) minimized: bool,
+    pub(super) kind: GroupKind,
+    pub(super) rect: Rect,
+}
+
+/// The top band of a strip that drags the whole group.
+const BORDER_BAND: f32 = 4.0;
+
+/// Width of the "…" button that lists the panels a strip has no room for.
+const OVERFLOW_WIDTH: f32 = 22.0;
+
+/// Points of smooth (trackpad) scrolling that make one wheel notch.
+const WHEEL_NOTCH: f32 = 40.0;
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
+    /// Draw one tab group at `rect`.
+    ///
+    /// An `active` index outside `panels` is a no-op. A lone protected panel is drawn stripless:
+    /// its whole rect is the body and its only tab has `Rect::NOTHING`. Side splits are offered
+    /// only for a `Frame` or `Floating` group whose selected panel accepts splits. Tab labels
+    /// shrink widest-first to the minimum width, then the remaining tabs move to the overflow menu;
+    /// hidden overflow tabs still appear in the drop target with `Rect::NOTHING`. The host's extra
+    /// tabs follow the panel tabs and fit with them ([`fit_with_extra`]). `minimized` hides the body
+    /// but keeps the strip. Tabs, strip, header and drag bar are mirrored in right-to-left layout.
+    pub(super) fn group(&mut self, ui: &mut Ui, panels: &[P], active: usize, minimized: bool, rect: Rect, kind: GroupKind) {
+        let Some(selected) = panels.get(active) else { return };
+        self.record_float(panels, rect.size(), rect.size());
+        let policy = self.permissions(selected);
+        let splits = matches!(kind, GroupKind::Frame | GroupKind::Floating { .. }) && policy.accepts_splits;
+        let rtl = self.style.right_to_left;
+        if stripless(panels, &*self.content) {
+            self.contents(ui, selected, rect);
+            self.targets.push(DropTarget {
+                anchor: selected.clone(),
+                rect,
+                tab_strip: None,
+                tabs: vec![(selected.clone(), Rect::NOTHING)],
+                allow_splits: splits,
+                accepts_tabs: policy.accepts_tabs,
+                right_to_left: rtl,
+            });
+            return;
+        }
+        let movable = panels.iter().all(|p| self.permissions(p).movable);
+        let strip = Rect::from_min_max(rect.min, pos2(rect.right(), (rect.top() + self.style.tab_height).min(rect.bottom())));
+        ui.painter().rect_filled(strip, 0.0, self.style.tab_background);
+        let floating = matches!(kind, GroupKind::Floating { .. });
+        // Laid out left to right, then mirrored in a right-to-left layout: tabs from the right
+        // edge, the header (the host's ≡) at the left.
+        let mirror = |r: Rect| {
+            if rtl {
+                Rect::from_x_y_ranges((strip.left() + strip.right() - r.right())..=(strip.left() + strip.right() - r.left()), r.y_range())
+            } else {
+                r
+            }
+        };
+        let requested = self.content.group_header_width(panels, selected, floating, strip.width());
+        let header_width = if requested.is_finite() { requested.clamp(0.0, strip.width()) } else { 0.0 };
+        if header_width > 0.0 {
+            let header = mirror(Rect::from_min_max(pos2(strip.right() - header_width, strip.top()), strip.max));
+            self.host_area(ui, "header", header, selected, |content, ui| content.group_header(ui, panels, selected, floating));
+        }
+        // The drag bar keeps its reserved width: tabs shrink, then overflow, before it narrows.
+        let bar_width = self.style.drag_bar_width.clamp(0.0, (strip.width() - header_width).max(0.0));
+        let tabs_width = (strip.width() - header_width - bar_width).max(0.0);
+        let widths: Vec<f32> = panels
+            .iter()
+            .map(|p| {
+                self.content
+                    .label(ui, p, &self.label_of(p), &self.style.font, self.style.text)
+                    .into_galley(ui, Some(egui::TextWrapMode::Extend), f32::INFINITY, self.style.font.clone())
+                    .size()
+                    .x
+                    + TAB_PADDING
+            })
+            .collect();
+        let wanted = self.content.group_extra_tabs_width(panels, selected, floating);
+        let wanted = if wanted.is_finite() { wanted.clamp(0.0, tabs_width) } else { 0.0 };
+        // The widest tabs shrink first, to a common width no narrower than `min_tab_width`; only
+        // when every tab at that width cannot fit do the rest go to the overflow menu. A tab
+        // narrower than its name cuts it with "…" and names it in a tooltip.
+        let (fit, extra_width) = fit_with_extra(&widths, active, tabs_width, wanted, self.style.min_tab_width);
+        let owner = TabGroup { panels, selected, minimized, kind, rect };
+        let mut x = strip.left();
+        let mut shown = Vec::new();
+        for (index, width) in &fit.shown {
+            let Some(panel) = panels.get(*index) else { continue };
+            let tab = mirror(Rect::from_min_size(pos2(x, strip.top()), vec2(*width, strip.height())));
+            self.tab(ui, panel, tab, *index == active, rect, Some(&owner));
+            shown.push((panel.clone(), tab));
+            x += width;
+        }
+        if !fit.overflow.is_empty() && fit.overflow_width > 0.0 {
+            let overflow = mirror(Rect::from_min_size(pos2(x, strip.top()), vec2(fit.overflow_width, strip.height())));
+            let response = ui.interact(overflow, self.id.with(("overflow", selected)), Sense::click());
+            self.register_interaction(ui.ctx(), response.id);
+            response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.panels_label));
+            ui.painter().with_clip_rect(overflow).text(overflow.center(), egui::Align2::CENTER_CENTER, "…", self.style.font.clone(), self.style.text);
+            egui::Popup::menu(&response).show(|ui| {
+                egui::ScrollArea::vertical().max_height(360.0).show(ui, |ui| {
+                    for index in &fit.overflow {
+                        if let Some(panel) = panels.get(*index)
+                            && self.menu_label(ui, panel).clicked()
+                        {
+                            self.output.actions.push(Action::Activate { panel: panel.clone() });
+                            self.output.focused = Some(panel.clone());
+                            ui.close();
+                        }
+                    }
+                });
+            });
+            x += fit.overflow_width;
+        }
+        let mut extra = Rect::NOTHING;
+        if extra_width > 0.0 {
+            extra = mirror(Rect::from_min_size(pos2(x, strip.top()), vec2(extra_width, strip.height())));
+            self.host_area(ui, "extra-tabs", extra, selected, |content, ui| content.group_extra_tabs(ui, panels, selected, floating));
+            x += extra_width;
+        }
+        let bar =
+            mirror(Rect::from_min_max(pos2(x.min(strip.right() - header_width), strip.top()), pos2(strip.right() - header_width, strip.bottom())));
+        self.group_handle(ui, "drag-bar", bar, &owner, movable);
+        // Registered last, so the band wins over the tabs below it.
+        let border = mirror(Rect::from_min_max(strip.min, pos2(strip.right() - header_width, (strip.top() + BORDER_BAND).min(strip.bottom()))));
+        self.group_handle(ui, "drag-border", border, &owner, movable);
+        if self.style.wheel_selects_tabs {
+            let tabs_area = mirror(Rect::from_min_max(strip.min, pos2(strip.right() - header_width, strip.bottom())));
+            self.wheel_tabs(ui, tabs_area, extra, panels, active);
+        }
+        // Logical order, hidden tabs included without a hit area, for no-op detection.
+        let tabs =
+            panels.iter().map(|panel| (panel.clone(), shown.iter().find(|(p, _)| p == panel).map_or(Rect::NOTHING, |(_, rect)| *rect))).collect();
+        self.targets.push(DropTarget {
+            anchor: selected.clone(),
+            rect,
+            tab_strip: Some(strip),
+            tabs,
+            allow_splits: splits,
+            accepts_tabs: policy.accepts_tabs,
+            right_to_left: rtl,
+        });
+        if !minimized {
+            self.contents(ui, selected, Rect::from_min_max(pos2(rect.left(), strip.bottom()), rect.max));
+        }
+        ui.painter().rect_stroke(rect, 0.0, self.style.border, StrokeKind::Inside);
+    }
+
+    /// A part of the strip the host draws (`header` or `extra-tabs`) at `rect`. A press in it
+    /// focuses the shown panel, as a press on its tab does.
+    fn host_area(&mut self, ui: &mut Ui, name: &'static str, rect: Rect, selected: &P, draw: impl FnOnce(&mut dyn DockContent<P>, &mut Ui)) {
+        let mut child = ui.new_child(UiBuilder::new().scope_id(self.id.with((name, selected))).max_rect(rect));
+        child.set_clip_rect(rect.intersect(ui.clip_rect()));
+        draw(&mut *self.content, &mut child);
+        if child.rect_contains_pointer(rect) && child.input(|i| i.pointer.any_pressed()) {
+            self.output.focused = Some(selected.clone());
+        }
+    }
+
+    /// The drag bar (`drag-bar`: drag, double-click, and the group menu on a right click, Enter
+    /// or Space) or the top border band (`drag-border`: drag only). Both move the whole group;
+    /// a left click on the bar only focuses it.
+    fn group_handle(&mut self, ui: &mut Ui, name: &'static str, hit: Rect, owner: &TabGroup<'_, P>, movable: bool) {
+        if !crate::docking::targets::usable(hit) {
+            return;
+        }
+        let bar = name == "drag-bar";
+        let sense = if bar { Sense::click_and_drag() } else { Sense::drag() };
+        let response = ui.interact(hit, self.id.with((name, owner.panels.first())), sense);
+        let response = if movable { response.on_hover_cursor(egui::CursorIcon::Grab) } else { response };
+        self.register_interaction(ui.ctx(), response.id);
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.move_group_label));
+        if movable && response.drag_started() {
+            self.start_group_drag(ui, owner.panels, self.drag_source(owner));
+        }
+        if !bar {
+            return;
+        }
+        if self.minimizes(owner) && response.double_clicked() {
+            self.output.actions.push(Action::SetMinimized { panel: owner.selected.clone(), minimized: !owner.minimized });
+        }
+        let active = response.has_focus() || response.hovered();
+        if active {
+            ui.painter().with_clip_rect(hit).rect_stroke(
+                hit.shrink(1.0),
+                0.0,
+                Stroke::new(1.0, self.style.accent.gamma_multiply(0.5)),
+                StrokeKind::Inside,
+            );
+        }
+        let keyboard = response.has_focus() && ui.input(|i| i.key_pressed(Key::Enter) || i.key_pressed(Key::Space));
+        let command = if response.secondary_clicked() || keyboard {
+            Some(egui::SetOpenCommand::Bool(true))
+        } else if response.clicked() {
+            Some(egui::SetOpenCommand::Bool(false))
+        } else {
+            None
+        };
+        egui::Popup::menu(&response).open_memory(command).show(|ui| self.group_menu(ui, owner, owner.selected));
+    }
+
+    /// The wheel over a group's strip: down selects the next tab, up the previous, one tab per
+    /// notch, stopping at the ends. Trackpad scrolling adds up to a notch. The host's extra tabs
+    /// (`extra`) keep the wheel for their own widgets.
+    fn wheel_tabs(&mut self, ui: &Ui, strip: Rect, extra: Rect, panels: &[P], active: usize) {
+        let key = self.id.with(("tab-wheel", panels.first()));
+        if !ui.rect_contains_pointer(strip) || ui.rect_contains_pointer(extra) {
+            ui.ctx().data_mut(|d| d.remove::<f32>(key));
+            return;
+        }
+        let notches: f32 = ui.input(|i| {
+            i.events
+                .iter()
+                .map(|event| match event {
+                    egui::Event::MouseWheel { unit, delta, modifiers, .. } if !modifiers.command && !modifiers.ctrl => match unit {
+                        egui::MouseWheelUnit::Point => delta.y / WHEEL_NOTCH,
+                        egui::MouseWheelUnit::Line | egui::MouseWheelUnit::Page => delta.y,
+                    },
+                    _ => 0.0,
+                })
+                .sum()
+        });
+        if notches == 0.0 || !notches.is_finite() {
+            return;
+        }
+        let total = ui.ctx().data(|d| d.get_temp::<f32>(key)).unwrap_or(0.0) + notches;
+        let steps = total.trunc();
+        ui.ctx().data_mut(|d| d.insert_temp(key, total - steps));
+        // A wheel turned down scrolls content up: a negative delta selects the next tab.
+        let to = (active as i64).saturating_sub(steps as i64).clamp(0, panels.len().saturating_sub(1) as i64) as usize;
+        if to != active
+            && let Some(panel) = panels.get(to)
+        {
+            self.output.actions.push(Action::Activate { panel: panel.clone() });
+            self.output.focused = Some(panel.clone());
+        }
+    }
+
+    fn start_group_drag(&mut self, ui: &Ui, panels: &[P], rect: Rect) {
+        let Some(first) = panels.first() else { return };
+        let origin = ui.input(|i| i.pointer.press_origin()).or_else(|| ui.ctx().pointer_interact_pos()).unwrap_or(rect.center());
+        let drag = GroupDrag {
+            panel: first.clone(),
+            original: [rect.left(), rect.top(), rect.width(), rect.height()],
+            gesture: GroupGesture::Group,
+            members: panels.to_vec(),
+            origin,
+            source: rect,
+        };
+        ui.ctx().data_mut(|d| d.insert_temp(self.id.with("group-drag"), drag));
+    }
+
+    /// The group items of the menu tail: Close Tab Group, Minimize or Expand, Float Tab Group
+    /// and Move Group To. `panel` is the panel whose menu this is.
+    fn group_menu(&mut self, ui: &mut Ui, owner: &TabGroup<'_, P>, panel: &P) {
+        let all = |check: &dyn Fn(crate::docking::Permissions) -> bool| owner.panels.iter().all(|p| check(self.permissions(p)));
+        let closable = self.style.close_menu_items && all(&|p| p.closable);
+        let movable = all(&|p| p.movable);
+        let floatable = movable && all(&|p| p.floatable);
+        if closable && self.menu_action(ui, &self.style.close_group_label.clone()) {
+            self.output.actions.push(Action::CloseGroup { panel: panel.clone() });
+        }
+        if self.minimizes(owner) {
+            let label = if owner.minimized { self.style.expand_label.clone() } else { self.style.minimize_label.clone() };
+            if self.menu_action(ui, &label) {
+                self.output.actions.push(Action::SetMinimized { panel: panel.clone(), minimized: !owner.minimized });
+            }
+        }
+        if owner.kind == GroupKind::Dock && self.menu_action(ui, &self.style.collapse_to_icons_label.clone()) {
+            self.output.actions.push(Action::SetIconic { panel: panel.clone(), iconic: true });
+        }
+        let whole_window = matches!(owner.kind, GroupKind::Floating { .. }) && self.whole_window(panel);
+        if floatable && !whole_window && self.menu_action(ui, &self.style.float_group_label.clone()) {
+            let size = self.group_float_size(owner.panels, owner.rect.size());
+            let rect = clamp_float(Rect::from_min_size(owner.rect.min + vec2(24.0, 24.0), size), self.float_bounds);
+            self.output.actions.push(Action::MoveGroup {
+                panel: panel.clone(),
+                to: Target::Float { rect: Some([rect.left(), rect.top(), rect.width(), rect.height()]) },
+            });
+        }
+        let targets = if movable { self.group_targets(owner.panels) } else { Vec::new() };
+        if !targets.is_empty() {
+            let logical = self.style.move_group_to_label.clone();
+            let text = self.content.action_label(ui, &logical, &self.style.font, self.style.text);
+            let response = ui.menu_button(text, |ui| {
+                egui::ScrollArea::vertical().max_height(360.0).show(ui, |ui| {
+                    for target in &targets {
+                        if self.menu_label(ui, target).clicked() {
+                            self.output.actions.push(Action::MoveGroup {
+                                panel: panel.clone(),
+                                to: Target::At { anchor: target.clone(), placement: Placement::Tab { before: None } },
+                            });
+                            ui.close();
+                        }
+                    }
+                });
+            });
+            response.response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &logical));
+        }
+        self.frame_items(ui, owner, panel);
+    }
+
+    /// A stock menu button with shaped text and its logical accessibility label; true when
+    /// clicked, after closing the menu.
+    pub(super) fn menu_action(&mut self, ui: &mut Ui, logical: &str) -> bool {
+        let text = self.content.action_label(ui, logical, &self.style.font, self.style.text);
+        let response = ui.button(text);
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), logical));
+        if response.clicked() {
+            ui.close();
+        }
+        response.clicked()
+    }
+
+    /// One anchor per other group that accepts a whole group as tabs, in layout order.
+    fn group_targets(&self, members: &[P]) -> Vec<P> {
+        let Some(first) = members.first() else { return Vec::new() };
+        let mut places = Vec::new();
+        let mut anchors = Vec::new();
+        for anchor in self.layout.move_targets(first, |p| self.permissions(p)) {
+            if members.contains(anchor) {
+                continue;
+            }
+            let Some(place) = self.place(anchor) else { continue };
+            if !places.contains(&place) {
+                places.push(place);
+                anchors.push(anchor.clone());
+            }
+        }
+        anchors
+    }
+
+    /// A stock menu button for `panel` whose visible text comes from
+    /// [`crate::docking::DockContent::label`] while its accessible name stays the logical `label_of`
+    /// value. The function only returns the response; the caller performs the menu action.
+    pub(super) fn menu_label(&mut self, ui: &mut Ui, panel: &P) -> egui::Response {
+        let logical = self.label_of(panel);
+        let text = self.content.label(ui, panel, &logical, &self.style.font, self.style.text);
+        let response = ui.button(text);
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &logical));
+        response
+    }
+
+    /// A tab's label, cut at the end with '…' to fit `width`.
+    pub(super) fn tab_label(&mut self, ui: &Ui, panel: &P, label: &str, color: Color32, width: f32) -> Arc<Galley> {
+        let text = self.content.label(ui, panel, label, &self.style.font, color);
+        crate::docking::chrome::truncated(ui, text, width, self.style.font.clone())
+    }
+
+    /// True while a tab's focus came from the pointer, which shows no focus outline. Tab or an
+    /// arrow key (keyboard navigation) clears it.
+    fn pointer_focus(&self, ui: &Ui, tab: Id) -> bool {
+        let key = tab.with("pointer-focus");
+        let navigated = ui.input(|i| [Key::Tab, Key::ArrowLeft, Key::ArrowRight, Key::ArrowUp, Key::ArrowDown].iter().any(|k| i.key_pressed(*k)));
+        if navigated {
+            ui.ctx().data_mut(|d| d.remove_temp::<bool>(key));
+        }
+        ui.ctx().data(|d| d.get_temp::<bool>(key)).unwrap_or(false)
+    }
+
+    /// Draw one tab inside `rect` and return its response.
+    ///
+    /// Clicking activates and focuses the panel. In a minimized group the first click expands and
+    /// records the time so that same click is not also interpreted as a double-click; a genuine
+    /// double-click toggles minimized only when the owner minimizes. Middle-click closes only when
+    /// the style enables it and the panel is closable. The context menu emits `Action`s, with float,
+    /// move and close entries gated by the panel's permissions. `owner: None` removes minimized
+    /// semantics and undock latching. An elided label exposes its full text as hover text.
+    pub(super) fn tab(&mut self, ui: &mut Ui, panel: &P, rect: Rect, active: bool, group: Rect, owner: Option<&TabGroup<'_, P>>) {
+        let minimized = owner.filter(|owner| self.minimizes(owner)).map(|owner| owner.minimized);
+        let policy = self.permissions(panel);
+        let label = self.label_of(panel);
+        let color = if active { self.style.text } else { self.style.inactive_text };
+        let galley = self.tab_label(ui, panel, &label, color, (rect.width() - TAB_PADDING).max(0.0));
+        let elided = galley.elided;
+        let tab_id = self.id.with(("tab", panel));
+        let pointer_focus = self.pointer_focus(ui, tab_id);
+        let response = tabs::Tab::new(tab_id, &label, active)
+            .sense(if policy.movable { Sense::click_and_drag() } else { Sense::click() })
+            .focus_stroke(if pointer_focus { Stroke::NONE } else { Stroke::new(1.0, self.style.accent) })
+            .show_at(ui, rect, |ui, response| {
+                let painter = ui.painter().with_clip_rect(rect.intersect(ui.clip_rect()));
+                painter.rect_filled(rect, 0.0, if active || response.hovered() { self.style.active_background } else { self.style.tab_background });
+                let at = pos2(rect.left() + TAB_PADDING * 0.5, rect.center().y - galley.size().y * 0.5);
+                painter.galley(at, galley.clone(), color);
+            });
+        let response = if elided { response.on_hover_text(&label) } else { response };
+        self.register_interaction(ui.ctx(), response.id);
+        if response.is_pointer_button_down_on() || response.clicked_by(egui::PointerButton::Primary) {
+            ui.ctx().data_mut(|d| d.insert_temp(tab_id.with("pointer-focus"), true));
+        }
+        // The click that expands a minimized group is not the first half of a double-click.
+        let expand_key = self.id.with(("expanded-by-click", owner.map(|owner| owner.panels.first())));
+        if response.clicked() {
+            self.output.actions.push(Action::Activate { panel: panel.clone() });
+            self.output.focused = Some(panel.clone());
+            if minimized == Some(true) {
+                // Activate already expands the group of its active tab.
+                if !active {
+                    self.output.actions.push(Action::SetMinimized { panel: panel.clone(), minimized: false });
+                }
+                let now = ui.input(|i| i.time);
+                ui.ctx().data_mut(|d| d.insert_temp(expand_key, now));
+            }
+        }
+        if let Some(minimized) = minimized
+            && response.double_clicked()
+        {
+            let (now, window) = (ui.input(|i| i.time), ui.ctx().options(|o| o.input_options.max_double_click_delay));
+            let expanded_by_first_click = ui.ctx().data_mut(|d| d.remove_temp::<f64>(expand_key)).is_some_and(|t| now - t <= window);
+            if !expanded_by_first_click {
+                self.output.actions.push(Action::SetMinimized { panel: panel.clone(), minimized: !minimized });
+            }
+        }
+        if self.style.middle_click_closes_tabs && policy.closable && response.clicked_by(egui::PointerButton::Middle) {
+            self.output.actions.push(Action::Close { panel: panel.clone() });
+        }
+        if policy.movable && response.drag_started() && begin_drag(ui.ctx(), self.id, panel.clone(), group) {
+            self.latch_undock(ui.ctx(), owner.map(|owner| owner.kind));
+        }
+        response.context_menu(|ui| {
+            self.content.panel_menu(ui, panel);
+            if policy.movable && policy.floatable {
+                let logical = self.style.float_label.clone();
+                let text = self.content.action_label(ui, &logical, &self.style.font, self.style.text);
+                let response = ui.button(text);
+                response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &logical));
+                if response.clicked() {
+                    let size = self.float_size(panel, group.size());
+                    let rect = clamp_float(Rect::from_min_size(group.min + vec2(24.0, 24.0), size), self.float_bounds);
+                    self.output.actions.push(Action::Float { panel: panel.clone(), rect: [rect.left(), rect.top(), rect.width(), rect.height()] });
+                    ui.close();
+                }
+            }
+            let targets: Vec<P> =
+                if policy.movable { self.layout.move_targets(panel, |p| self.permissions(p)).into_iter().cloned().collect() } else { Vec::new() };
+            if !targets.is_empty() {
+                let text = self.content.action_label(ui, &self.style.move_panel_to_label, &self.style.font, self.style.text);
+                let response = ui.menu_button(text, |ui| {
+                    egui::ScrollArea::vertical().max_height(360.0).show(ui, |ui| {
+                        for target in &targets {
+                            if self.menu_label(ui, target).clicked() {
+                                self.output.actions.push(Action::Move {
+                                    panel: panel.clone(),
+                                    anchor: target.clone(),
+                                    placement: Placement::Tab { before: None },
+                                });
+                                ui.close();
+                            }
+                        }
+                    });
+                });
+                response.response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.move_panel_to_label));
+            }
+            if policy.closable && self.style.close_menu_items {
+                let text = self.content.action_label(ui, &self.style.close_label, &self.style.font, self.style.text);
+                let response = ui.button(text);
+                response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.close_label));
+                if response.clicked() {
+                    self.output.actions.push(Action::Close { panel: panel.clone() });
+                    ui.close();
+                }
+            }
+            if let Some(owner) = owner {
+                ui.separator();
+                self.group_menu(ui, owner, panel);
+            }
+        });
+    }
+}
+
+/// Fit the panel tabs and the host's extra tabs (`extra` wide), which fit as one more tab that
+/// never overflows: in a row too narrow for every tab at its minimum width, the panel tabs
+/// overflow into the room the extra tabs leave at theirs. Returns the extra tabs' width.
+fn fit_with_extra(widths: &[f32], active: usize, available: f32, extra: f32, minimum: f32) -> (tabs::TabFit, f32) {
+    if extra <= 0.0 {
+        return (tabs::fit(widths, active, available, minimum, OVERFLOW_WIDTH), 0.0);
+    }
+    let all: Vec<f32> = widths.iter().copied().chain([extra]).collect();
+    let mut fit = tabs::fit(&all, active, available, minimum, OVERFLOW_WIDTH);
+    if fit.overflow.is_empty() {
+        let width = fit.shown.pop().filter(|(index, _)| *index == widths.len()).map_or(0.0, |(_, width)| width);
+        return (fit, width);
+    }
+    let fit = tabs::fit(widths, active, (available - extra.min(minimum)).max(0.0), minimum, OVERFLOW_WIDTH);
+    let used = fit.shown.iter().map(|(_, width)| width).sum::<f32>() + fit.overflow_width;
+    (fit, extra.min(available - used).max(0.0))
+}
diff --git a/crates/ui/src/docking/render/iconic.rs b/crates/ui/src/docking/render/iconic.rs
new file mode 100644
index 00000000..2ceda931
--- /dev/null
+++ b/crates/ui/src/docking/render/iconic.rs
@@ -0,0 +1,351 @@
+//! [D] Iconic columns: one icon per panel, groups apart, and the flyout an icon opens.
+//!
+//! Behavior follows VectorCraft `dock.rs` (icon column, flyouts beside it on the canvas side,
+//! names when the column is widened) and PhotoCraft `dock.rs` (Auto-Collapse Iconic Panels).
+
+use std::{fmt::Debug, hash::Hash};
+
+use egui::{Context, Id, Key, Order, Pos2, Rect, Sense, Stroke, StrokeKind, Ui, UiBuilder, pos2, vec2};
+
+use super::{GroupKind, Renderer, dock::Edge};
+use crate::docking::{
+    Column, DockStyle, Group, GroupDrag, GroupGesture, begin_drag,
+    chrome::{ChromeStyle, FloatingFrame},
+    is_dragging,
+    targets::{DockDrop, DockTarget, horizontal_line, usable},
+};
+
+/// How far an icon group's drag band reaches into its first icon. The band also covers the
+/// separator room above the group; it reserves no height of its own.
+const GROUP_BAND: f32 = 4.0;
+/// Room between two icon groups, with the separator line in its middle.
+const SEPARATOR: f32 = 7.0;
+/// Height of a flyout, or of a panel floated from an icon, when nothing else sizes it.
+const FLYOUT_HEIGHT: f32 = 320.0;
+
+/// The panel whose icon opened the flyout of an area.
+#[derive(Clone)]
+struct Open<P>(P);
+
+fn key(area: Id) -> Id {
+    area.with("flyout")
+}
+
+/// [D] Open the flyout of the group holding `panel`, when that group is in an iconic column.
+/// The flyout shows from the next frame on. [`crate::docking::DockArea::raise_panel`] does the
+/// same for a panel the Window menu opens.
+pub fn open_flyout<P: Clone + Send + Sync + 'static>(ctx: &Context, area_id: Id, panel: P) {
+    ctx.data_mut(|d| d.insert_temp(key(area_id), Open(panel)));
+}
+
+/// [D] Close the area's flyout.
+pub fn close_flyout<P: Clone + Send + Sync + 'static>(ctx: &Context, area_id: Id) {
+    ctx.data_mut(|d| d.remove::<Open<P>>(key(area_id)));
+}
+
+/// [D] The panel whose icon opened the area's flyout, while one is open.
+pub fn flyout<P: Clone + Send + Sync + 'static>(ctx: &Context, area_id: Id) -> Option<P> {
+    ctx.data(|d| d.get_temp::<Open<P>>(key(area_id))).map(|open| open.0)
+}
+
+/// The flyout last reported by [`crate::docking::DockEvent::FlyoutChanged`].
+#[derive(Clone)]
+struct Reported<P>(Option<P>);
+
+/// The flyout an iconic column asks for this frame.
+struct Request<P> {
+    group: Group<P>,
+    /// The icons of the group, where the flyout's top aligns.
+    icons: Rect,
+    /// The iconic column, which a press does not close the flyout in.
+    column: Rect,
+    edge: Edge,
+    /// The column's expanded width.
+    width: f32,
+}
+
+/// Per-frame iconic state of a renderer.
+pub(in crate::docking) struct Iconic<P> {
+    auto_collapse: bool,
+    /// Iconic column bodies drawn this frame, outlined by a drop into them (P9).
+    columns: Vec<Rect>,
+    /// Expanded column width of each panel drawn as an icon: a panel floated from its icon
+    /// takes it.
+    widths: Vec<(P, f32)>,
+    request: Option<Request<P>>,
+    /// The flyout drawn this frame; it occludes dock targets behind it.
+    rect: Option<Rect>,
+}
+
+impl<P: PartialEq> Iconic<P> {
+    pub(in crate::docking) fn new(auto_collapse: bool) -> Self {
+        Self { auto_collapse, columns: Vec::new(), widths: Vec::new(), request: None, rect: None }
+    }
+
+    pub(super) fn covers(&self, pointer: Pos2) -> bool {
+        self.rect.is_some_and(|rect| rect.contains(pointer))
+    }
+
+    /// Outline the iconic column an insertion line lies in.
+    pub(super) fn outline(&self, painter: &egui::Painter, line: Rect, style: &DockStyle) {
+        if let Some(column) = self.columns.iter().find(|column| column.shrink(1.0).contains(line.center())) {
+            painter.rect_stroke(column.shrink(1.0), 0.0, Stroke::new(2.0, style.accent), StrokeKind::Inside);
+        }
+    }
+
+    pub(super) fn float_width(&self, panel: &P) -> Option<f32> {
+        self.widths.iter().find(|(p, _)| p == panel).map(|(_, width)| *width)
+    }
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
+    fn row_height(&self) -> f32 {
+        self.style.icon_size + 10.0
+    }
+
+    fn icon_group_height(&self, group: &Group<P>) -> f32 {
+        group.panels.len() as f32 * self.row_height()
+    }
+
+    /// The body of an iconic column: icon groups top to bottom, scrolling when they do not fit.
+    pub(super) fn iconic_column(&mut self, ui: &mut Ui, column: &Column<P>, body: Rect, edge: Edge) {
+        self.iconic.columns.push(body);
+        for panel in column.groups.iter().flat_map(|g| g.panels.iter()) {
+            self.iconic.widths.push((panel.clone(), column.width));
+        }
+        // Opening a panel from the Window menu opens its flyout (U3).
+        if let Some(panel) = self.activation.as_ref().filter(|p| column.groups.iter().any(|g| g.panels.contains(p))) {
+            open_flyout(ui.ctx(), self.id, panel.clone());
+        }
+        let total: f32 =
+            column.groups.iter().map(|g| self.icon_group_height(g)).sum::<f32>() + column.groups.len().saturating_sub(1) as f32 * SEPARATOR;
+        if total > body.height() + 0.5 {
+            let Some(first) = column.groups.first().and_then(|g| g.panels.first()) else { return };
+            let mut child =
+                ui.new_child(UiBuilder::new().id_salt(("icon-column", first)).max_rect(body).layout(egui::Layout::top_down(egui::Align::Min)));
+            child.set_clip_rect(body.intersect(ui.clip_rect()));
+            egui::ScrollArea::vertical()
+                .id_salt(self.id.with(("icon-scroll", first)))
+                .auto_shrink([false, false])
+                .scroll_source(egui::scroll_area::ScrollSource::SCROLL_BAR | egui::scroll_area::ScrollSource::MOUSE_WHEEL)
+                .show(&mut child, |ui| {
+                    let (area, _) = ui.allocate_exact_size(vec2(ui.available_width(), total), Sense::hover());
+                    self.icon_groups(ui, column, area, body, edge);
+                });
+        } else {
+            self.icon_groups(ui, column, body, body, edge);
+        }
+    }
+
+    /// Icon groups in `area` (the scrolled content when the column scrolls), their drop bands
+    /// clipped to the visible `view`.
+    fn icon_groups(&mut self, ui: &mut Ui, column: &Column<P>, area: Rect, view: Rect, edge: Edge) {
+        let open = flyout::<P>(ui.ctx(), self.id);
+        let labels = view.width() >= self.style.iconic_label_width;
+        let xs = view.x_range();
+        let mut top = area.top();
+        let mut bands = Vec::new();
+        for (index, group) in column.groups.iter().enumerate() {
+            let Some(first) = group.panels.first() else { continue };
+            let band_top = if index > 0 { top } else { area.top() };
+            if index > 0 {
+                let y = top + SEPARATOR * 0.5;
+                ui.painter().with_clip_rect(view).hline(area.x_range().shrink(4.0), y, self.style.border);
+                top += SEPARATOR;
+            }
+            let rect = Rect::from_min_size(pos2(area.left(), top), vec2(area.width(), self.icon_group_height(group)));
+            let showing = open.as_ref().filter(|p| group.panels.contains(p));
+            let mut y = rect.top();
+            for panel in &group.panels {
+                let cell = Rect::from_min_size(pos2(rect.left(), y), vec2(rect.width(), self.row_height()));
+                self.icon(ui, panel, cell, labels, showing);
+                y = cell.bottom();
+            }
+            // After the icons, so the band wins the top of the first icon.
+            let band = Rect::from_min_max(pos2(rect.left(), band_top), pos2(rect.right(), (rect.top() + GROUP_BAND).min(rect.bottom())));
+            self.icon_grip(ui, group, band, rect.top(), column.width);
+            // The state again: a click above may have opened or closed this group's flyout.
+            if flyout::<P>(ui.ctx(), self.id).is_some_and(|p| group.panels.contains(&p)) {
+                self.iconic.request = Some(Request { group: group.clone(), icons: rect.intersect(view), column: view, edge, width: column.width });
+            }
+            bands.push((first.clone(), rect));
+            top = rect.bottom();
+        }
+        // P9: the upper half of an icon group inserts above it, the lower half and the room
+        // under the last group below it. The line sits on the group's edge.
+        let count = bands.len();
+        for (index, (anchor, rect)) in bands.into_iter().enumerate() {
+            let middle = rect.center().y;
+            let upper_top = if index == 0 { view.top() } else { rect.top() - SEPARATOR * 0.5 };
+            let lower_bottom = if index + 1 == count { view.bottom() } else { rect.bottom() + SEPARATOR * 0.5 };
+            for (below, ys, line) in [(false, upper_top..=middle, rect.top()), (true, middle..=lower_bottom, rect.bottom())] {
+                let band = Rect::from_x_y_ranges(xs, ys).intersect(view);
+                if usable(band) {
+                    let width = self.style.drop_line_width;
+                    let line = horizontal_line(line.clamp(view.top() + width * 0.5, view.bottom() - width * 0.5), xs, width);
+                    self.dock_targets.push(DockDrop { target: DockTarget::GroupBand { anchor: anchor.clone(), below }, band, line, outer: false });
+                }
+            }
+        }
+    }
+
+    /// The band on an icon group's top edge drags the whole group (S8). `top` is the group's
+    /// first icon's top, where a floated group's source starts.
+    fn icon_grip(&mut self, ui: &mut Ui, group: &Group<P>, grip: Rect, top: f32, width: f32) {
+        let Some(first) = group.panels.first() else { return };
+        let movable = group.panels.iter().all(|p| self.permissions(p).movable);
+        let response = ui.interact(grip, self.id.with(("icon-grip", Some(first))), Sense::drag());
+        let response = if movable { response.on_hover_cursor(egui::CursorIcon::Grab) } else { response };
+        self.register_interaction(ui.ctx(), response.id);
+        let height = group.height.filter(|h| h.is_finite()).unwrap_or(FLYOUT_HEIGHT);
+        let source = Rect::from_min_size(pos2(grip.left(), top), vec2(width.max(self.style.min_pane), height.max(self.style.tab_height)));
+        self.record_float(&group.panels, vec2(grip.width(), self.row_height()), source.size());
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.move_group_label));
+        if movable && response.drag_started() {
+            let origin = ui.input(|i| i.pointer.press_origin()).or_else(|| ui.ctx().pointer_interact_pos()).unwrap_or(grip.center());
+            let drag = GroupDrag {
+                panel: first.clone(),
+                original: [source.left(), source.top(), source.width(), source.height()],
+                gesture: GroupGesture::Group,
+                members: group.panels.clone(),
+                origin,
+                source,
+            };
+            ui.ctx().data_mut(|d| d.insert_temp(self.id.with("group-drag"), drag));
+            close_flyout::<P>(ui.ctx(), self.id);
+        }
+    }
+
+    /// One panel's icon: a click opens, switches or closes the flyout (M5); a drag moves the
+    /// panel (S7). `showing` is the panel whose icon opened this group's flyout.
+    fn icon(&mut self, ui: &mut Ui, panel: &P, cell: Rect, labels: bool, showing: Option<&P>) {
+        let movable = self.permissions(panel).movable;
+        let label = self.label_of(panel);
+        let response = ui.interact(cell, self.id.with(("icon", panel)), if movable { Sense::click_and_drag() } else { Sense::click() });
+        self.register_interaction(ui.ctx(), response.id);
+        let current = showing == Some(panel);
+        response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), current, &label));
+        let painter = ui.painter().with_clip_rect(cell.intersect(ui.clip_rect()));
+        if current || response.hovered() {
+            painter.rect_filled(cell.shrink(2.0), 3.0, self.style.active_background);
+        }
+        if response.has_focus() {
+            painter.rect_stroke(cell.shrink(1.0), 3.0, Stroke::new(1.0, self.style.accent), StrokeKind::Inside);
+        }
+        let size = self.style.icon_size;
+        let inset = ((self.style.iconic_width - size) * 0.5).max(2.0);
+        let icon = Rect::from_min_size(pos2(cell.left() + inset, cell.center().y - size * 0.5), vec2(size, size));
+        let color = if current { self.style.text } else { self.style.inactive_text };
+        if !self.content.paint_icon(&painter, icon, panel, color) {
+            if let Some(source) = self.content.icon(panel) {
+                egui::Image::new(source).tint(color).paint_at(ui, icon.intersect(cell));
+            } else {
+                let initial: String = label.chars().next().into_iter().flat_map(char::to_uppercase).collect();
+                painter.rect_stroke(icon, 3.0, Stroke::new(1.0, color), StrokeKind::Inside);
+                painter.text(icon.center(), egui::Align2::CENTER_CENTER, initial, self.style.font.clone(), color);
+            }
+        }
+        if labels {
+            let text = self.content.label(ui, panel, &label, &self.style.font, color);
+            let galley =
+                text.into_galley(ui, Some(egui::TextWrapMode::Truncate), (cell.right() - icon.right() - 12.0).max(0.0), self.style.font.clone());
+            painter.galley(pos2(icon.right() + 6.0, cell.center().y - galley.size().y * 0.5), galley, color);
+        } else if response.hovered() && !response.dragged() {
+            response.clone().on_hover_text(&label);
+        }
+        if response.clicked() {
+            if current {
+                close_flyout::<P>(ui.ctx(), self.id);
+            } else {
+                if showing.is_none() {
+                    ui.ctx().move_to_top(FloatingFrame::layer(self.id.with("flyout")));
+                }
+                open_flyout(ui.ctx(), self.id, panel.clone());
+                self.output.actions.push(crate::docking::Action::Activate { panel: panel.clone() });
+                self.output.focused = Some(panel.clone());
+            }
+        }
+        if movable && response.drag_started() && begin_drag(ui.ctx(), self.id, panel.clone(), cell) {
+            close_flyout::<P>(ui.ctx(), self.id);
+        }
+    }
+
+    /// The Auto-Collapse Iconic Panels item of a column menu (U1): true when chosen.
+    pub(super) fn auto_collapse_item(&mut self, ui: &mut Ui) -> bool {
+        let logical = self.style.auto_collapse_label.clone();
+        let text = self.content.action_label(ui, &logical, &self.style.font, self.style.text);
+        let mut on = self.iconic.auto_collapse;
+        let response = ui.add(egui::Checkbox::new(&mut on, text));
+        response.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, ui.is_enabled(), self.iconic.auto_collapse, &logical));
+        if response.clicked() {
+            ui.close();
+        }
+        response.clicked()
+    }
+
+    /// Draw the flyout an iconic column asked for, beside the column on the canvas side, or
+    /// forget a flyout whose group is no longer iconic. With Auto-Collapse, Escape or a press
+    /// outside the flyout and its column closes it.
+    pub(in crate::docking) fn flyout(&mut self, ctx: &Context) {
+        let Some(request) = self.iconic.request.take() else {
+            close_flyout::<P>(ctx, self.id);
+            return;
+        };
+        let Some(active) = request.group.active_panel().cloned() else { return };
+        let id = self.id.with("flyout");
+        if self.iconic.auto_collapse && self.flyout_dismissed(ctx, id, request.column) {
+            close_flyout::<P>(ctx, self.id);
+            return;
+        }
+        let bounds = self.workspace.intersect(self.float_bounds);
+        let width = request.width.max(self.style.min_pane).min(bounds.width());
+        let max = self
+            .content
+            .floating_size(&active)
+            .map(|size| size.y)
+            .or(request.group.height)
+            .filter(|h| h.is_finite() && *h > 0.0)
+            .unwrap_or(FLYOUT_HEIGHT);
+        // A flyout fits the content its panel last drew, up to that height.
+        let height = self
+            .fitted_height(&active, self.style.tab_height, max)
+            .unwrap_or(max)
+            .max(self.style.tab_height + self.style.min_pane)
+            .min(bounds.height());
+        let left = match request.edge {
+            Edge::Left => request.column.right(),
+            Edge::Right => request.column.left() - width,
+        };
+        let top = request.icons.top().min(bounds.bottom() - height).max(bounds.top());
+        let rect = Rect::from_min_size(pos2(left, top), vec2(width, height));
+        let style = ChromeStyle::from_dock(self.style);
+        let group = request.group;
+        let response = FloatingFrame::new(id, rect).bounds(bounds).resizable(false).show(ctx, &style, |ui, rect| {
+            self.group(ui, &group.panels, group.active, false, rect, GroupKind::Dock);
+        });
+        self.iconic.rect = Some(response.rect);
+    }
+
+    /// Report a flyout that differs from the last one reported.
+    pub(in crate::docking) fn report_flyout(&mut self, ctx: &Context) {
+        let shown = flyout::<P>(ctx, self.id);
+        let key = self.id.with("flyout-reported");
+        let reported = ctx.data(|d| d.get_temp::<Reported<P>>(key)).and_then(|r| r.0);
+        if shown != reported {
+            ctx.data_mut(|d| d.insert_temp(key, Reported(shown.clone())));
+            self.output.events.push(crate::docking::DockEvent::FlyoutChanged { panel: shown });
+        }
+    }
+
+    /// Escape (outside a drag) or a primary press outside the flyout, its column and any menu.
+    fn flyout_dismissed(&self, ctx: &Context, id: Id, column: Rect) -> bool {
+        let escape = !is_dragging::<P>(ctx, self.id) && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, Key::Escape));
+        let press = ctx.input(|i| i.pointer.primary_pressed().then(|| i.pointer.press_origin()).flatten());
+        let outside = press.is_some_and(|pos| {
+            let inside = ctx.memory(|m| m.area_rect(id)).is_some_and(|r| r.contains(pos)) || column.contains(pos);
+            let menu = ctx.layer_id_at(pos).is_some_and(|layer| matches!(layer.order, Order::Foreground | Order::Tooltip));
+            !inside && !menu
+        });
+        escape || outside
+    }
+}
diff --git a/crates/ui/src/docking/render/mod.rs b/crates/ui/src/docking/render/mod.rs
new file mode 100644
index 00000000..751e17b4
--- /dev/null
+++ b/crates/ui/src/docking/render/mod.rs
@@ -0,0 +1,523 @@
+use std::{collections::HashMap, fmt::Debug, hash::Hash};
+
+use egui::{Context, CursorIcon, Id, Rect, Sense, Ui, UiBuilder, Vec2, pos2, vec2};
+
+use crate::layout::{ResizeHandle, ResizeHandleStyle, SplitAxis};
+
+use super::{Action, DockContent, DockOutput, DockStyle, DropTarget, Layout, Node, PanelLimits, Permissions, dock_model::Place};
+
+#[cfg(feature = "native-windows")]
+mod body_drag;
+#[cfg(feature = "native-windows")]
+mod cross;
+mod dock;
+mod floating;
+mod frame;
+mod iconic;
+#[cfg(feature = "native-windows")]
+mod native;
+#[cfg(feature = "native-windows")]
+pub(in crate::docking) use native::WindowDrag;
+#[cfg(all(test, feature = "native-windows"))]
+pub(in crate::docking) use {
+    cross::DragPointer,
+    native::{APPKIT_CORNER, INACTIVE_PALETTE, MACOS_CLOSE, Session, appkit_resize_areas, close_rects, drag_opacity, resize_bands, session, wayland},
+};
+
+#[cfg(all(test, feature = "native-windows"))]
+pub(in crate::docking) use body_drag::held_events;
+#[cfg(feature = "native-windows")]
+pub(in crate::docking) use body_drag::{cancel_body_route, mark_app_drag};
+#[cfg(feature = "native-windows")]
+pub(in crate::docking) use native::{InputHook, WindowSystem, send_keys, set_input_hook, typing_window};
+
+/// How long after blocking starts a native window that still has the keyboard hands it to the
+/// main window: an OS dialog the app opens with the modal (a file dialog) takes focus a little
+/// later, and a Focus sent before then could raise the main window over it.
+#[cfg(feature = "native-windows")]
+const BLOCKED_FOCUS_WAIT: f64 = 0.2;
+
+/// Opacity of a floating window, in-window or native, while its bar, only tab or only tab row
+/// drags it over a drop target: the highlighted target under the window shows through it.
+pub(in crate::docking) const DRAG_OPACITY: f32 = 0.75;
+
+/// While input is blocked (`starts`: from this frame), a native window of the dock area `area`
+/// with the keyboard would drop the keys the modal needs, so once, after
+/// [`BLOCKED_FOCUS_WAIT`], the main window, where the modal is, takes the keyboard if one still
+/// has it. If focus went elsewhere meanwhile, such as to an OS dialog, nothing is sent.
+#[cfg(feature = "native-windows")]
+pub(in crate::docking) fn focus_main_from_native<P>(ctx: &Context, area: Id, layout: &Layout<P>, blocked: bool, starts: bool) {
+    let (key, now) = (area.with("blocked-focus"), ctx.input(|i| i.time));
+    if !blocked {
+        ctx.data_mut(|d| d.remove::<f64>(key));
+        return;
+    }
+    if starts {
+        ctx.data_mut(|d| d.insert_temp(key, now));
+    }
+    let Some(since) = ctx.data(|d| d.get_temp::<f64>(key)) else { return };
+    if now - since < BLOCKED_FOCUS_WAIT {
+        ctx.request_repaint_after(std::time::Duration::from_secs_f64(BLOCKED_FOCUS_WAIT - (now - since)));
+        return;
+    }
+    ctx.data_mut(|d| d.remove::<f64>(key));
+    let focused =
+        ctx.input(|i| layout.floating.iter().any(|w| i.raw.viewports.get(&native_viewport(area, w.id)).and_then(|v| v.focused) == Some(true)));
+    if focused {
+        ctx.send_viewport_cmd_to(egui::ViewportId::ROOT, egui::ViewportCommand::Focus);
+    }
+}
+
+/// The viewport of the native window `window` of the dock area `area`.
+#[cfg(feature = "native-windows")]
+pub(in crate::docking) fn native_viewport(area: Id, window: u64) -> egui::ViewportId {
+    native::viewport_id(area, window, 0)
+}
+
+pub(in crate::docking) use frame::{FrameState, view};
+
+pub(in crate::docking) use group::GroupKind;
+
+pub(in crate::docking) use iconic::Iconic;
+pub use iconic::{close_flyout, flyout, open_flyout};
+
+#[cfg(test)]
+pub(in crate::docking) use dock::{GroupSize, fit_widths, group_heights};
+pub(in crate::docking) use floating::RESIZE_HANDLES;
+mod group;
+mod preview;
+mod sizes;
+
+pub(in crate::docking) use sizes::{DROP_MARGIN, Drawn, RowItem, Sizer, row_drag, row_range};
+
+pub(super) struct Renderer<'a, P> {
+    pub(super) id: Id,
+    pub(super) style: &'a DockStyle,
+    pub(super) content: &'a mut dyn DockContent<P>,
+    pub(super) activation: Option<P>,
+    pub(super) blockers: Vec<Rect>,
+    /// [`crate::docking::DockArea::locked`].
+    pub(super) locked: bool,
+    pub(super) layout: &'a Layout<P>,
+    /// The docked area, for host drop requests.
+    pub(super) workspace: Rect,
+    /// Where floating windows, flyouts and drag ghosts go: [`crate::docking::DockArea::float_bounds`].
+    pub(super) float_bounds: Rect,
+    pub(super) targets: Vec<DropTarget<P>>,
+    /// [D] Seams, group bands, column edges and new-dock bands, see [`crate::docking::targets::DockDrop`].
+    pub(super) dock_targets: Vec<crate::docking::targets::DockDrop<P>>,
+    /// [D] The open groups of dock columns, whose body zones stack or make columns.
+    pub(super) dock_groups: Vec<dock::DockGroup<P>>,
+    /// [D] The scroll offset of each dock column that scrolls this frame, by its first panel.
+    pub(super) column_scroll: HashMap<P, f32>,
+    pub(super) owned_interactions: Vec<Id>,
+    pub(super) output: DockOutput<P>,
+    pub(super) frame: FrameState<P>,
+    /// [D] Flyout and iconic column state for this frame.
+    pub(super) iconic: Iconic<P>,
+    /// What a drag would float from each drawn panel, group and column, for commands.
+    pub(super) float_space: crate::docking::FloatSpace<P>,
+    /// Each panel's place in `layout`, and its entry in `float_space.contents`.
+    pub(super) places: HashMap<P, Place>,
+    pub(super) contents: HashMap<P, usize>,
+    /// Split dividers drawn so far, by view path, for the intersections of their ancestors.
+    pub(super) dividers: Vec<DrawnDivider>,
+    /// The floating window whose tree is being drawn: its first panel, which names it in
+    /// ids and actions, and its rect. `None` while the docked layout draws.
+    pub(super) tree: Option<(P, Rect)>,
+    /// [`crate::docking::DockArea::monitors`].
+    #[cfg_attr(not(feature = "native-windows"), allow(dead_code))]
+    pub(super) monitors: Vec<crate::docking::Monitor>,
+    /// [`crate::docking::DockArea::input_blocked`].
+    #[cfg_attr(not(feature = "native-windows"), allow(dead_code))]
+    pub(super) input_blocked: bool,
+    /// [`crate::docking::DockArea::native_windows`].
+    #[cfg_attr(not(feature = "native-windows"), allow(dead_code))]
+    pub(super) native_windows: Option<bool>,
+    /// The other OS windows a drag may cross into.
+    #[cfg(feature = "native-windows")]
+    pub(super) cross: cross::Cross<P>,
+    /// What the window system tells of the desktop pointer, and whether it moves a native
+    /// window for a bar drag.
+    #[cfg(feature = "native-windows")]
+    pub(super) window_system: WindowSystem,
+}
+
+pub(super) struct DrawnDivider {
+    path: Vec<bool>,
+    axis: SplitAxis,
+    divider: Rect,
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
+    pub(super) fn place(&self, panel: &P) -> Option<&Place> {
+        self.places.get(panel)
+    }
+
+    /// The height `panel`'s content last used: `Some(None)` when it filled its body.
+    pub(super) fn content_height(&self, panel: &P) -> Option<Option<f32>> {
+        self.contents.get(panel).and_then(|i| self.float_space.contents.get(*i)).map(|(_, height)| *height)
+    }
+
+    pub(super) fn label_of(&self, panel: &P) -> String {
+        self.content.logical_label(panel)
+    }
+
+    pub(super) fn permissions(&self, panel: &P) -> Permissions {
+        let permissions = self.content.permissions(panel);
+        if self.locked { permissions.locked() } else { permissions }
+    }
+
+    pub(super) fn limits(&self, panel: &P) -> PanelLimits {
+        self.content.limits(panel)
+    }
+
+    pub(super) fn register_interaction(&mut self, ctx: &Context, id: Id) {
+        // A validated tree has at most 2*MAX_PANELS nodes. Tabs, stack dividers,
+        // floating grips/corners and splits fit comfortably inside this fixed bound.
+        const CAP: usize = 8 * crate::docking::MAX_PANELS;
+        if self.owned_interactions.len() < CAP && !self.owned_interactions.contains(&id) {
+            self.owned_interactions.push(id);
+        }
+        // Retain prior-frame controls until return, and publish current controls before
+        // app callbacks. No Context lock spans a callback or a stop_dragging call.
+        ctx.data_mut(|d| {
+            let ids = d.get_temp_mut_or_default::<Vec<Id>>(self.id.with("owned-interactions"));
+            if ids.len() < CAP && !ids.contains(&id) {
+                ids.push(id);
+            }
+        });
+    }
+
+    /// Draws `node` at view path `path` in `rect`, in the tree `root` (its root node and rect),
+    /// which a dragged divider resizes beyond `node`.
+    pub(in crate::docking) fn node(&mut self, ui: &mut Ui, node: &Node<P>, rect: Rect, path: &mut Vec<bool>, root: (&Node<P>, Rect)) {
+        if !crate::docking::targets::usable(rect) {
+            return;
+        }
+        self.note_edge(path, rect);
+        match node {
+            Node::Split { axis: SplitAxis::Horizontal, first, second, .. } if self.dock_split(ui, first, second, rect, path, root) => {}
+            Node::Split { axis, size, first, second } => {
+                let sizer = self.sizer();
+                let Some(split) = sizer.split(*axis, *size, first, second, rect) else { return };
+                let (lo, hi) = sizer.range(root, path);
+                let mark = self.dividers.len();
+                path.push(false);
+                self.node(ui, first, split.first, path, root);
+                path.pop();
+                path.push(true);
+                self.node(ui, second, split.second, path, root);
+                path.pop();
+                // The divider's inner-edge hit margin must win over child scrollbars, just
+                // as accordion dividers win over the adjacent panel's content.
+                // Named by its layout path, which `ResizeSplit` takes and hits report.
+                let layout_path = self.original_path(path);
+                let response = ResizeHandle::new(
+                    self.split_id(&layout_path),
+                    *axis,
+                    split.divider,
+                    &self.style.resize_label,
+                    ResizeHandleStyle { hovered: self.style.accent, dragged: self.style.accent, focused: self.style.accent },
+                )
+                .value(split.first_size(), (split.first_size() + lo)..=(split.first_size() + hi))
+                .show(ui);
+                self.register_interaction(ui.ctx(), response.response.id);
+                if response.delta != 0.0 {
+                    let actions = self.divider_actions(root, path, response.delta);
+                    self.output.actions.extend(actions);
+                }
+                self.intersections(ui, (node, rect), path, split.divider, mark, root);
+                if self.dividers.len() < crate::docking::model::MAX_NODES {
+                    self.dividers.push(DrawnDivider { path: path.clone(), axis: *axis, divider: split.divider });
+                }
+            }
+            Node::Tabs { panels, active } => {
+                let kind = match &self.tree {
+                    None => GroupKind::Frame,
+                    Some((_, window)) => GroupKind::Floating { window: *window },
+                };
+                self.group(ui, panels, *active, false, rect, kind);
+            }
+            Node::Dock { side, columns } => self.dock(ui, *side, columns, rect, rect.width()),
+            Node::Stack { entries } => {
+                let total_header = (entries.len() as f32 * self.style.tab_height).min(rect.height());
+                let remaining = (rect.height() - total_header).max(0.0);
+                let total_wanted: f64 = entries.iter().filter(|e| e.open).map(|e| f64::from(e.height.unwrap_or(self.style.min_pane).max(1.0))).sum();
+                let header = self.style.tab_height.min(rect.height() / entries.len().max(1) as f32);
+                let mut top = rect.top();
+                let mut dividers = Vec::new();
+                for (index, entry) in entries.iter().enumerate() {
+                    let share = if entry.open && total_wanted > 0.0 {
+                        (f64::from(remaining) * f64::from(entry.height.unwrap_or(self.style.min_pane).max(1.0)) / total_wanted) as f32
+                    } else {
+                        0.0
+                    };
+                    let panel_rect = Rect::from_min_max(pos2(rect.left(), top), pos2(rect.right(), (top + header + share).min(rect.bottom())));
+                    let title_rect = Rect::from_min_max(panel_rect.min, pos2(panel_rect.right(), (top + header).min(panel_rect.bottom())));
+                    self.tab(ui, &entry.panel, title_rect, entry.open, panel_rect, None);
+                    let collapse = if self.style.right_to_left {
+                        Rect::from_min_max(title_rect.min, pos2((title_rect.left() + 18.0).min(title_rect.right()), title_rect.bottom()))
+                    } else {
+                        Rect::from_min_max(pos2((title_rect.right() - 18.0).max(title_rect.left()), title_rect.top()), title_rect.max)
+                    };
+                    let response = ui.interact(collapse, self.id.with(("collapse", &entry.panel)), Sense::click());
+                    self.register_interaction(ui.ctx(), response.id);
+                    response
+                        .widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, ui.is_enabled(), entry.open, self.label_of(&entry.panel)));
+                    ui.painter().with_clip_rect(collapse).text(
+                        collapse.center(),
+                        egui::Align2::CENTER_CENTER,
+                        if entry.open { "−" } else { "+" },
+                        self.style.font.clone(),
+                        self.style.text,
+                    );
+                    if response.clicked() {
+                        self.output.actions.push(Action::SetStackOpen { panel: entry.panel.clone(), open: !entry.open });
+                    }
+                    let body_rect = Rect::from_min_max(pos2(rect.left(), title_rect.bottom()), panel_rect.max);
+                    if entry.open {
+                        self.contents(ui, &entry.panel, body_rect);
+                    }
+                    self.targets.push(DropTarget {
+                        anchor: entry.panel.clone(),
+                        rect: panel_rect,
+                        tab_strip: Some(title_rect),
+                        tabs: vec![(entry.panel.clone(), title_rect)],
+                        allow_splits: self.permissions(&entry.panel).accepts_splits,
+                        accepts_tabs: self.permissions(&entry.panel).accepts_tabs,
+                        right_to_left: self.style.right_to_left,
+                    });
+                    top = panel_rect.bottom();
+                    if entry.open && remaining > 0.0 {
+                        dividers.push((index, Rect::from_min_max(pos2(rect.left(), top - 1.0), pos2(rect.right(), top + 1.0)).intersect(rect)));
+                    }
+                }
+                // Register dividers after the headers so their narrow hit regions win at the
+                // shared boundary. Closed entries retain their saved sizes and are skipped.
+                let scale = if total_wanted > 0.0 { f64::from(remaining) / total_wanted } else { 0.0 };
+                let body_limits = |panel: &P| {
+                    let mut limits = self.limits(panel);
+                    limits.min.y = limits.min.y.max(self.style.min_pane);
+                    limits.max = limits.max.max(limits.min);
+                    limits
+                };
+                let open: Vec<&crate::docking::StackEntry<P>> = entries.iter().filter(|entry| entry.open).collect();
+                let row: Vec<RowItem> = open
+                    .iter()
+                    .map(|entry| {
+                        let limits = body_limits(&entry.panel);
+                        let size = (f64::from(entry.height.unwrap_or(self.style.min_pane).max(1.0)) * scale) as f32;
+                        RowItem { size, min: limits.min.y, max: limits.max.y }
+                    })
+                    .collect();
+                for (index, divider) in dividers {
+                    let Some(first) = entries.get(index) else { continue };
+                    let Some(position) = open.iter().position(|entry| std::ptr::eq(*entry, first)) else { continue };
+                    let Some(first_size) = row.get(position).map(|item| item.size) else { continue };
+                    if position + 1 >= row.len() {
+                        continue;
+                    }
+                    let (lo, hi) = row_range(&row, position);
+                    let response = ResizeHandle::new(
+                        self.id.with(("stack-resize", &first.panel)),
+                        SplitAxis::Vertical,
+                        divider,
+                        &self.style.resize_label,
+                        ResizeHandleStyle { hovered: self.style.accent, dragged: self.style.accent, focused: self.style.accent },
+                    )
+                    .value(first_size, (first_size + lo)..=(first_size + hi))
+                    .show(ui);
+                    self.register_interaction(ui.ctx(), response.response.id);
+                    if response.delta != 0.0 && scale > 0.0 {
+                        for ((entry, item), next) in open.iter().zip(&row).zip(row_drag(&row, position, response.delta)) {
+                            if next != item.size {
+                                let height = (f64::from(next) / scale).clamp(1.0, 1_000_000.0) as f32;
+                                self.output.actions.push(Action::ResizeStack { panel: entry.panel.clone(), height: Some(height) });
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    pub(super) fn sizer(&self) -> Sizer<'_, P> {
+        Sizer { style: self.style, content: &*self.content }
+    }
+
+    /// `ResizeSplit` actions that move the divider of the split at view path `path` in the
+    /// tree `root` by `delta` points.
+    fn divider_actions(&self, root: (&Node<P>, Rect), path: &[bool], delta: f32) -> Vec<Action<P>> {
+        let sizes = self.sizer().drag(root, path, delta);
+        let resize = |path: Vec<bool>, size| match &self.tree {
+            None => Action::ResizeSplit { path, size },
+            Some((panel, _)) => Action::ResizeWindowSplit { panel: panel.clone(), path, size },
+        };
+        sizes.into_iter().map(|(path, size)| resize(self.original_path(&path), size)).collect()
+    }
+
+    /// The id of the divider of the split at `path` in the tree being drawn, as
+    /// [`crate::docking::DockArea::hit_id`] names it.
+    fn split_id(&self, path: &[bool]) -> Id {
+        match &self.tree {
+            None => self.id.with(("split", path)),
+            Some((panel, _)) => self.id.with(("window-split", panel, path)),
+        }
+    }
+
+    /// Four-way handles where a divider drawn inside the split `node` (since `mark`) ends on
+    /// the split's own divider: dragging one moves both dividers.
+    fn intersections(&mut self, ui: &mut Ui, (node, rect): (&Node<P>, Rect), path: &[bool], divider: Rect, mark: usize, root: (&Node<P>, Rect)) {
+        let Node::Split { axis, .. } = node else { return };
+        let side = (self.style.gap * 3.0).max(12.0);
+        let mut found = Vec::new();
+        for inner in self.dividers.get(mark..).unwrap_or_default() {
+            if inner.axis == *axis || !inner.divider.expand(1.0).intersects(divider) {
+                continue;
+            }
+            let center = match axis {
+                SplitAxis::Horizontal => pos2(divider.center().x, inner.divider.center().y),
+                SplitAxis::Vertical => pos2(inner.divider.center().x, divider.center().y),
+            };
+            found.push((inner.path.clone(), Rect::from_center_size(center, Vec2::splat(side)).intersect(rect)));
+        }
+        for (inner_path, hit) in found {
+            let Some(inner) = inner_path.get(path.len()..).and_then(|rest| crate::docking::dock_model::node_at(node, rest)) else { continue };
+            let (outer, inner_layout) = (self.original_path(path), self.original_path(&inner_path));
+            let id = match &self.tree {
+                None => self.id.with(("intersection", outer, inner_layout)),
+                Some((panel, _)) => self.id.with(("window-intersection", panel, outer, inner_layout)),
+            };
+            // Pointer only: each of the two dividers it joins already takes keyboard focus.
+            let response = ui.interact(hit, id, Sense::DRAG);
+            self.register_interaction(ui.ctx(), id);
+            if response.hovered() || response.dragged() {
+                ui.ctx().set_cursor_icon(CursorIcon::Move);
+            }
+            let delta = response.drag_delta();
+            if delta != Vec2::ZERO && delta.is_finite() {
+                let along = |axis: SplitAxis| if axis == SplitAxis::Horizontal { delta.x } else { delta.y };
+                let Node::Split { axis: inner_axis, .. } = inner else { continue };
+                let mut actions = self.divider_actions(root, path, along(*axis));
+                actions.extend(self.divider_actions(root, &inner_path, along(*inner_axis)));
+                self.output.actions.extend(actions);
+            }
+        }
+    }
+
+    /// Draw a panel body into `rect`.
+    ///
+    /// An unusable rect returns without painting. Otherwise the body runs in a clipped child scope,
+    /// and its minimum height is recorded against `rect.height()` for floating-size policy. Any
+    /// pointer press inside the body focuses the panel, including secondary and middle presses; with
+    /// native windows that press origin is stored for body-drag routing and the panel is recorded as
+    /// the pointed body. The panel's content map keeps the sizing entry for later frames.
+    pub(super) fn contents(&mut self, ui: &mut Ui, panel: &P, rect: Rect) {
+        if !crate::docking::targets::usable(rect) {
+            return;
+        }
+        ui.painter().rect_filled(rect, 0.0, self.style.background);
+        let mut child =
+            ui.new_child(UiBuilder::new().scope_id(self.id.with(("body", panel))).max_rect(rect).layout(egui::Layout::top_down(egui::Align::Min)));
+        child.set_clip_rect(rect.intersect(ui.clip_rect()));
+        self.content.body(&mut child, panel);
+        let at = self.contents.get(panel).copied();
+        let at = self.float_space.record_content(at, panel.clone(), child.min_rect().height(), rect.height());
+        self.contents.insert(panel.clone(), at);
+        // Any button: a canvas pans with the middle button and opens menus with the secondary.
+        if child.rect_contains_pointer(rect) && child.input(|i| i.pointer.any_pressed()) {
+            self.output.focused = Some(panel.clone());
+            #[cfg(feature = "native-windows")]
+            if let Some(press) = child.input(|i| i.pointer.press_origin()) {
+                let key = body_drag::body_press_key(self.id, child.ctx().viewport_id());
+                child.ctx().data_mut(|d| d.insert_temp(key, press));
+            }
+        }
+        #[cfg(feature = "native-windows")]
+        if child.rect_contains_pointer(rect) {
+            self.cross.pointed = Some(panel.clone());
+        }
+    }
+}
+
+/// A lone protected panel draws no tab strip and no drag bar.
+pub(in crate::docking) fn stripless<P>(panels: &[P], content: &dyn DockContent<P>) -> bool {
+    match panels {
+        [panel] => content.permissions(panel).is_protected(),
+        _ => false,
+    }
+}
+
+/// Size policy of a subtree, shared by the renderer and its measurements.
+pub(in crate::docking) fn node_limits<P>(node: &Node<P>, style: &DockStyle, content: &dyn DockContent<P>) -> PanelLimits {
+    match node {
+        Node::Dock { columns, .. } => {
+            let width: f32 = columns.iter().map(|c| dock::column_width(c, style)).sum();
+            PanelLimits { min: vec2(width.clamp(style.min_pane, 1_000_000.0), style.min_pane), ..PanelLimits::default() }
+        }
+        // A group is as large as its largest panel allows: a panel without a maximum lifts the
+        // maximum of the panels it joins.
+        Node::Tabs { panels, .. } => {
+            let mut limits = PanelLimits { min: Vec2::ZERO, max: if panels.is_empty() { PanelLimits::default().max } else { Vec2::ZERO } };
+            for panel in panels {
+                let policy = content.limits(panel);
+                limits.min = limits.min.max(policy.min).max(Vec2::splat(style.min_pane));
+                limits.max = limits.max.max(policy.max);
+            }
+            limits.max = limits.max.max(limits.min);
+            if !stripless(panels, content) {
+                limits.min.y = (limits.min.y + style.tab_height).min(1_000_000.0);
+                limits.max.y = (limits.max.y + style.tab_height).min(1_000_000.0);
+            }
+            limits
+        }
+        Node::Stack { entries } => {
+            let mut limits = PanelLimits::default();
+            if !entries.is_empty() {
+                limits.max.x = 0.0;
+            }
+            for entry in entries {
+                let policy = content.limits(&entry.panel);
+                limits.min.x = limits.min.x.max(policy.min.x).max(style.min_pane);
+                limits.min.y += if entry.open { policy.min.y.max(style.min_pane) } else { 0.0 } + style.tab_height;
+                limits.max.x = limits.max.x.max(policy.max.x);
+            }
+            limits.min = limits.min.min(Vec2::splat(1_000_000.0));
+            limits.max = limits.max.max(limits.min);
+            limits
+        }
+        Node::Split { axis, first, second, .. } => {
+            let a = node_limits(first, style, content);
+            let b = node_limits(second, style, content);
+            let limits = match axis {
+                SplitAxis::Horizontal => PanelLimits {
+                    min: vec2(a.min.x + b.min.x + style.gap, a.min.y.max(b.min.y)),
+                    max: vec2(a.max.x + b.max.x + style.gap, a.max.y.min(b.max.y)),
+                },
+                SplitAxis::Vertical => PanelLimits {
+                    min: vec2(a.min.x.max(b.min.x), a.min.y + b.min.y + style.gap),
+                    max: vec2(a.max.x.min(b.max.x), a.max.y + b.max.y + style.gap),
+                },
+            };
+            PanelLimits { min: limits.min.min(Vec2::splat(1_000_000.0)), max: limits.max.max(limits.min).min(Vec2::splat(1_000_000.0)) }
+        }
+    }
+}
+
+pub(super) fn clamp_float(rect: Rect, screen: Rect) -> Rect {
+    crate::docking::chrome::clamp(rect, screen)
+}
+
+pub(super) fn split_bounds(available: f32, axis: SplitAxis, first: PanelLimits, second: PanelLimits) -> (f32, f32) {
+    let (a_min, a_max, b_min, b_max) = match axis {
+        SplitAxis::Horizontal => (first.min.x, first.max.x, second.min.x, second.max.x),
+        SplitAxis::Vertical => (first.min.y, first.max.y, second.min.y, second.max.y),
+    };
+    let scale = if a_min + b_min > available { available / (a_min + b_min).max(1.0) } else { 1.0 };
+    let lo = (a_min * scale).min(available);
+    let hi = (available - b_min * scale).max(lo).min(available);
+    let constrained_lo = lo.max(available - b_max);
+    let constrained_hi = hi.min(a_max);
+    if constrained_lo <= constrained_hi { (constrained_lo, constrained_hi) } else { (lo, hi) }
+}
diff --git a/crates/ui/src/docking/render/native.rs b/crates/ui/src/docking/render/native.rs
new file mode 100644
index 00000000..f27f6058
--- /dev/null
+++ b/crates/ui/src/docking/render/native.rs
@@ -0,0 +1,1499 @@
+//! Floating windows in their own OS windows (feature `native-windows`). Where the backend has
+//! viewports, every floating window whose panels allow it is drawn with
+//! `show_viewport_immediate`. Palettes stay on top of the application's other windows, and
+//! drop to the normal level while none of its windows has focus, so they stay shown without
+//! covering other applications; viewers are normal windows that come forward when the
+//! application is activated. Where egui embeds viewports (wasm, tests) windows stay
+//! in-window at their in-window rect, and so do they on Wayland, unless the app turns native
+//! windows on ([`crate::docking::DockArea::native_windows`]). Tabs, groups and whole windows
+//! drag between OS windows (see `cross.rs`), and so do the app's drags in panel bodies
+//! (`body_drag.rs`).
+
+use std::{fmt::Debug, hash::Hash, sync::Arc};
+
+use egui::{
+    Color32, Context, CursorIcon, Event, Id, Key, LayerId, Modifiers, Order, Pos2, RawInput, Rect, ResizeDirection, Sense, Ui, UiBuilder, Vec2,
+    ViewportBuilder, ViewportClass, ViewportCommand, ViewportId, ViewportInfo, WindowLevel, pos2, vec2,
+};
+
+use super::Renderer;
+use super::body_drag::{BodyRoute, Held, Queued};
+use super::cross::{DragPointer, Surface};
+use crate::docking::chrome::{ChromeStyle, TitleBar};
+pub(in crate::docking) use crate::docking::placement::BAR_HEIGHT;
+use crate::docking::placement::{kept_reachable, monitor_of, restore, sanitized};
+use crate::docking::{Action, Drag, Floating, GroupDrag, GroupGesture, Node, WindowFiles, WindowKind};
+
+/// Smallest native window.
+const MIN_SIZE: [f32; 2] = [160.0, 100.0];
+/// How long none of the application's windows has focus before the application counts as
+/// inactive, so focus moving between our own windows does not.
+const AWAY_DELAY: f64 = 0.25;
+/// Whether normal windows are raised when the application is activated. macOS brings an
+/// application's windows forward itself: all of them on activation from the Dock or the
+/// application switcher, the clicked one alone on a click, as its own windows do.
+const RAISE_ON_ACTIVATION: bool = !cfg!(target_os = "macos");
+/// The level of a palette while the application is inactive, behind other applications'
+/// windows. On Windows `WindowLevel::Normal` is `HWND_NOTOPMOST`, which puts the window in
+/// front of every window that is not topmost, the activated application's too; `HWND_BOTTOM`
+/// sends it behind them without activating it.
+pub(in crate::docking) const INACTIVE_PALETTE: WindowLevel =
+    if cfg!(target_os = "windows") { WindowLevel::AlwaysOnBottom } else { WindowLevel::Normal };
+/// How long reports of a native window's place may lag a move the dock area commanded.
+const MOVE_WAIT: f64 = 0.5;
+/// How far the resize bands reach into a native window from its edges, where the window has
+/// no frame of its own to resize from.
+const EDGE: f32 = 6.0;
+/// How far a corner's grab runs along each of its two edges.
+const CORNER: f32 = 16.0;
+/// macOS keeps the window's frame, and AppKit resizes the window from its edges and corners.
+/// Elsewhere the window is undecorated and resizes from our bands, which hand the resize to
+/// the window system (`BeginResize`).
+const OS_RESIZES: bool = cfg!(target_os = "macos");
+/// How far AppKit's corner resize area reaches into a titled, resizable window along each
+/// edge. AppKit takes a press there before the content sees it, and shows its resize cursor.
+/// Measured on macOS 26 as a 19 pt square at each corner, 62 % of which would lie inside a
+/// square-cornered window: about 15 pt inside and 4 pt outside
+/// (<https://noheger.at/blog/2026/01/11/the-struggle-of-resizing-windows-on-macos-tahoe/>).
+/// There is no published measurement for earlier releases.
+pub(in crate::docking) const APPKIT_CORNER: f32 = 15.0;
+/// How far AppKit's edge resize area reaches into the content between the corners: a few
+/// points; most of it lies outside the window.
+const APPKIT_EDGE: f32 = 4.0;
+
+/// Where the × of a native window's bar sits and where it takes clicks, in points from the
+/// window's top and trailing edges, mirrored in a right-to-left layout.
+#[derive(Clone, Copy, Debug)]
+pub(in crate::docking) struct CloseLayout {
+    /// From the window's top edge to the top of the glyph.
+    pub glyph_top: f32,
+    /// From the window's trailing edge to the glyph's trailing side.
+    pub glyph_trailing: f32,
+    /// Width and height of the glyph.
+    pub glyph_size: f32,
+    /// How far the hit area reaches past the glyph to the left (to the right when mirrored).
+    pub hit_left: f32,
+    /// How far the hit area reaches past the glyph to the right (to the left when mirrored).
+    pub hit_right: f32,
+    /// How far the hit area reaches above the glyph.
+    pub hit_up: f32,
+    /// How far the hit area reaches below the glyph. Past the bar's bottom it takes clicks
+    /// from the tab strip under the bar.
+    pub hit_down: f32,
+}
+
+/// The × on macOS, where macOS puts the close button of its own windows: centered in the
+/// 18 pt bar, its trailing side 8 pt in. AppKit's corner resize area ([`APPKIT_CORNER`])
+/// covers its trailing half and takes presses there, so the hit area reaches away from the
+/// corner: left of the glyph, and down to the bar's bottom.
+pub(in crate::docking) const MACOS_CLOSE: CloseLayout =
+    CloseLayout { glyph_top: 4.5, glyph_trailing: 8.0, glyph_size: 9.0, hit_left: 10.0, hit_right: 0.0, hit_up: 0.0, hit_down: 4.5 };
+
+/// The × elsewhere: an 18 pt square the height of the bar, its trailing side 7 pt in so the
+/// side's resize band ([`EDGE`]) and the corner's grab run down beside it, with the glyph at
+/// its center.
+pub(in crate::docking) const OTHER_CLOSE: CloseLayout =
+    CloseLayout { glyph_top: 4.5, glyph_trailing: 11.5, glyph_size: 9.0, hit_left: 4.5, hit_right: 4.5, hit_up: 4.5, hit_down: 4.5 };
+
+/// Opacity of the native window that a bar drag of the area `area` moves, by the rule for every
+/// floating window ([`super::DRAG_OPACITY`]): faded while the drag highlights a drop target, as
+/// the last frame drew it ([`super::cross::HIGHLIGHTED`]), opaque over empty space, for a move
+/// that cannot dock and while Ctrl/Cmd keeps the drop floating. The window stays above the main
+/// window, so the highlighted target shows only through it.
+#[cfg(any(target_os = "macos", test))]
+pub(in crate::docking) fn drag_opacity(ctx: &Context, area: Id) -> f64 {
+    let dragging = ctx.data(|d| d.get_temp::<WindowDrag>(area.with("window-drag"))).is_some();
+    let highlighted = ctx.data(|d| d.get_temp::<bool>(area.with(super::cross::HIGHLIGHTED))).unwrap_or(false);
+    if dragging && highlighted { f64::from(super::DRAG_OPACITY) } else { 1.0 }
+}
+
+/// Sets the opacity of the AppKit windows titled `title`, never one titled `main` (the main
+/// window's title). egui has no viewport command for a window's opacity, and a transparent
+/// surface would need the main window transparent too (eframe picks one alpha mode for every
+/// viewport), so this goes to AppKit, which fades the content, corners and shadow together.
+/// The window is found by title: its native handle is a raw `NSView` pointer, and turning that
+/// into an `NSWindow` needs `unsafe`, which the workspace forbids. Two floats with one title
+/// fade together.
+#[cfg(target_os = "macos")]
+fn set_window_opacity(title: &str, main: Option<&str>, opacity: f64) {
+    if title.is_empty() || main == Some(title) {
+        return;
+    }
+    let Some(mtm) = objc2::MainThreadMarker::new() else { return };
+    let title = objc2_foundation::NSString::from_str(title);
+    for window in objc2_app_kit::NSApplication::sharedApplication(mtm).windows().iter() {
+        if window.title().isEqualToString(&title) && window.alphaValue() != opacity {
+            window.setAlphaValue(opacity);
+        }
+    }
+}
+
+/// What the window system tells of the desktop pointer, and whether it moves a native window
+/// for a bar drag itself.
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub(in crate::docking) enum WindowSystem {
+    /// The running one: AppKit on macOS tells the cursor, the button and the modifiers, and
+    /// moves a window for `StartDrag`; elsewhere none of these is told.
+    #[default]
+    Native,
+    /// A stand-in (`docking::testing::NativeHost`).
+    #[cfg(any(test, feature = "testing"))]
+    Host {
+        /// The cursor on the desktop, where told.
+        cursor: Option<Pos2>,
+        /// Whether the primary button is down, where told.
+        held: Option<bool>,
+        /// It moves a window for `StartDrag`, as AppKit does.
+        moves: bool,
+    },
+}
+
+impl WindowSystem {
+    /// Where the cursor is on the desktop, in egui's desktop points.
+    fn cursor(self, ctx: &Context) -> Option<Pos2> {
+        match self {
+            Self::Native => system_cursor(ctx),
+            #[cfg(any(test, feature = "testing"))]
+            Self::Host { cursor, .. } => cursor,
+        }
+        .filter(|p| p.is_finite())
+    }
+
+    /// Whether the primary button is down now. egui can report a release a frame after it.
+    fn primary_held(self) -> Option<bool> {
+        match self {
+            Self::Native => system_primary_held(),
+            #[cfg(any(test, feature = "testing"))]
+            Self::Host { held, .. } => held,
+        }
+    }
+
+    /// Whether Ctrl or Cmd is down now. AppKit sends no key events while it moves a window, so
+    /// egui's modifiers can be stale then.
+    fn command_held(self) -> Option<bool> {
+        match self {
+            Self::Native => system_command_held(),
+            #[cfg(any(test, feature = "testing"))]
+            Self::Host { .. } => None,
+        }
+    }
+
+    /// Whether it moves a native window for a bar drag (`StartDrag`), and tells the cursor
+    /// and the button meanwhile: AppKit does, smoothly, while a window moved from the app by
+    /// `OuterPosition` jitters there.
+    fn moves_windows(self) -> bool {
+        match self {
+            Self::Native => cfg!(target_os = "macos"),
+            #[cfg(any(test, feature = "testing"))]
+            Self::Host { moves, .. } => moves,
+        }
+    }
+}
+
+/// AppKit's cursor, in the desktop points egui reports window positions in. AppKit measures
+/// from the bottom-left of the primary screen (the one with the menu bar, first in
+/// `NSScreen::screens`), y up; winit flips window positions against that screen's height,
+/// whichever screen a window is on, so the cursor is flipped the same way. egui's points are
+/// AppKit's divided by the zoom factor.
+#[cfg(target_os = "macos")]
+fn system_cursor(ctx: &Context) -> Option<Pos2> {
+    let mtm = objc2::MainThreadMarker::new()?;
+    let primary = objc2_app_kit::NSScreen::screens(mtm).firstObject()?;
+    let at = objc2_app_kit::NSEvent::mouseLocation();
+    let height = primary.frame().size.height;
+    Some(pos2(at.x as f32, (height - at.y) as f32) / ctx.zoom_factor())
+}
+
+#[cfg(not(target_os = "macos"))]
+fn system_cursor(_: &Context) -> Option<Pos2> {
+    None
+}
+
+/// AppKit's primary button state, current when egui's lags.
+#[cfg(target_os = "macos")]
+fn system_primary_held() -> Option<bool> {
+    Some(objc2_app_kit::NSEvent::pressedMouseButtons() & 1 != 0)
+}
+
+#[cfg(not(target_os = "macos"))]
+fn system_primary_held() -> Option<bool> {
+    None
+}
+
+/// AppKit's Ctrl and Cmd state, current while it sends egui no key events.
+#[cfg(target_os = "macos")]
+fn system_command_held() -> Option<bool> {
+    use objc2_app_kit::{NSEvent, NSEventModifierFlags};
+    Some(NSEvent::modifierFlags_class().intersects(NSEventModifierFlags::Command | NSEventModifierFlags::Control))
+}
+
+#[cfg(not(target_os = "macos"))]
+fn system_command_held() -> Option<bool> {
+    None
+}
+
+/// Whether native windows outline their ×'s hit area, and on macOS AppKit's resize areas:
+/// `CRAFT_DOCK_DEBUG_CLOSE=1`, read once.
+fn debug_close() -> bool {
+    static ON: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
+    *ON.get_or_init(|| std::env::var("CRAFT_DOCK_DEBUG_CLOSE").is_ok_and(|v| v == "1"))
+}
+
+/// A drag of a native window's bar, in the context's data under the area's `"window-drag"`.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(in crate::docking) struct WindowDrag {
+    /// [`Floating::id`] of the dragged window.
+    pub window: u64,
+    /// Where the pointer pressed, in the window's local points.
+    pub grab: Vec2,
+    /// Desktop position of the window's content as last commanded, or under `os`, the
+    /// cursor less `grab`.
+    pub to: Pos2,
+    /// Desktop position of the window's content when the drag began, for Escape.
+    pub start: Pos2,
+    /// The drag began on the window's only tab or group, so it docks whatever
+    /// [`crate::docking::DockStyle::title_bar_docks`] says.
+    pub docks: bool,
+    /// The window system moves the window ([`WindowSystem::moves_windows`]).
+    pub os: bool,
+    /// The cursor has gone past the click distance from the press. Under `os` the drag starts
+    /// on the press, and until then it is a click, which docks nothing.
+    pub moved: bool,
+}
+
+/// What the dock area knows of a shown native window's place, in the context's data under
+/// the area's `("native-place", viewport)`. Rects are desktop rects of the window's content.
+#[derive(Clone, Copy, Debug)]
+struct Place {
+    /// Where it opened. The builder keeps it, so egui sends no move of its own.
+    spawn: [f32; 4],
+    /// As last reported or commanded. [`Floating::native`] follows it; a `native` that differs
+    /// was changed by the application (undo, reset, a reloaded layout), and the window moves.
+    known: [f32; 4],
+    /// Until when reports that differ from `known` are a commanded move that has not landed.
+    pending: Option<f64>,
+    /// The window system put the frame, not the content, where it opened: corrected once.
+    corrected: bool,
+    /// The height of its bar while minimized, as it was last told. `known` keeps the expanded
+    /// size meanwhile.
+    collapsed: Option<f32>,
+}
+
+/// Whether two rects differ by more than rounding.
+fn differs(a: [f32; 4], b: [f32; 4]) -> bool {
+    a.iter().zip(b).any(|(a, b)| (a - b).abs() > 0.5)
+}
+
+/// Desktop position of a viewport's content, and its offset from the window's outer
+/// position, where the window system reports both.
+pub(super) fn content_of(info: &ViewportInfo) -> Option<(Pos2, Vec2)> {
+    let (outer, inner) = (info.outer_rect?, info.inner_rect?);
+    (outer.min.is_finite() && inner.min.is_finite()).then(|| (inner.min, inner.min - outer.min))
+}
+
+/// The viewport of the native window `window` of the dock area `area`. The `n`th window with
+/// an id an earlier window of the same frame took gets its own.
+pub(in crate::docking) fn viewport_id(area: Id, window: u64, n: usize) -> ViewportId {
+    match n {
+        0 => ViewportId::from_hash_of((area, "native", window)),
+        n => ViewportId::from_hash_of((area, "native", window, n)),
+    }
+}
+
+/// The desktop rect of a native viewport's content. None when the backend reports no
+/// positions.
+fn placed(info: &ViewportInfo) -> Option<[f32; 4]> {
+    let (min, _) = content_of(info)?;
+    let size = info.inner_rect?.size();
+    size.is_finite().then(|| sanitized([min.x, min.y, size.x, size.y]))
+}
+
+/// What a native window's frame reports back to the main window.
+struct Report<P> {
+    closed: bool,
+    placed: Option<[f32; 4]>,
+    /// From the window's outer position to its content.
+    frame: Vec2,
+    monitor_size: Option<Vec2>,
+    /// Its drop targets, for drags from other windows.
+    surface: Option<Surface<P>>,
+}
+
+impl<P> Default for Report<P> {
+    fn default() -> Self {
+        Self { closed: false, placed: None, frame: Vec2::ZERO, monitor_size: None, surface: None }
+    }
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
+    /// Show the native windows and return the windows to draw in-window.
+    pub(super) fn native_windows<'w>(&mut self, ctx: &Context, windows: Vec<&'w Floating<P>>) -> Vec<&'w Floating<P>> {
+        let native = !ctx.embed_viewports() && self.native_windows.unwrap_or_else(|| !wayland(ctx, env_session()));
+        let origin = ctx.input(|i| i.viewport().inner_rect.map(|r| r.min)).filter(|p| p.is_finite()).unwrap_or(Pos2::ZERO);
+        let (active, activated) = if native { self.app_activity(ctx) } else { (true, false) };
+        self.cross.on = native;
+        let mut shown = Vec::new();
+        let mut in_window = Vec::new();
+        let mut ids = Vec::new();
+        let mut natives = Vec::new();
+        for window in windows {
+            // The application's own policy: a locked area keeps its native windows.
+            let allowed = window.panels().all(|p| self.content.allow_native(p) && self.content.permissions(p).floatable);
+            if !native || !allowed || window.panels().next().is_none() {
+                in_window.push(window);
+                continue;
+            }
+            // Every float is native: one still in-window opens over its place in the app window.
+            let rect = window.native.unwrap_or_else(|| {
+                let [x, y, w, h] = window.rect;
+                sanitized([origin.x + x, origin.y + y, w, h])
+            });
+            let n = ids.iter().filter(|id| **id == window.id).count();
+            ids.push(window.id);
+            natives.push((window, rect, viewport_id(self.id, window.id, n)));
+        }
+        if native {
+            #[cfg(debug_assertions)]
+            self.warn_rebuilt(ctx, &natives);
+            self.escape_elsewhere(ctx, None);
+            // A window closed or docked during its own bar drag ends the drag.
+            let key = self.id.with("window-drag");
+            if ctx.data(|d| d.get_temp::<WindowDrag>(key)).is_some_and(|d| !natives.iter().any(|(w, ..)| w.id == d.window)) {
+                ctx.data_mut(|d| d.remove::<WindowDrag>(key));
+            }
+            self.map_desktop(ctx, &natives, activated);
+            self.raise_next(ctx, &natives);
+            // The main window owns drags of the panels it draws.
+            let id = self.id;
+            let dragged = ctx.data(|d| {
+                d.get_temp::<Drag<P>>(id.with("drag")).map(|d| d.panel).or(d.get_temp::<GroupDrag<P>>(id.with("group-drag")).map(|d| d.panel))
+            });
+            if dragged.is_some_and(|panel| !natives.iter().any(|(w, ..)| w.contains(&panel))) {
+                let origin = self.cross.main.map(|m| m.min);
+                self.record_pointer(ctx, None, origin, None);
+            }
+            self.cross.viewports = natives.iter().map(|(w, _, viewport)| (w.id, *viewport)).collect();
+        }
+        self.map_body_route(ctx, native);
+        for (window, rect, viewport) in natives {
+            if let Some(key) = self.native_window(ctx, window, rect, viewport, active) {
+                shown.push(key);
+            }
+        }
+        // Forget where windows that are no longer native were told to open.
+        let key = self.id.with("native-shown");
+        let previous = ctx.data_mut(|d| d.remove_temp::<Vec<Id>>(key)).unwrap_or_default();
+        ctx.data_mut(|d| {
+            for id in previous.iter().filter(|id| !shown.contains(id)) {
+                d.remove::<Place>(*id);
+            }
+            d.insert_temp(key, shown);
+        });
+        in_window
+    }
+
+    /// Debug builds: warn once when for [`REBUILT_FRAMES`] frames running, every native window
+    /// is new, with the panels of the last frame's. The app builds its layout anew each frame
+    /// without [`Floating::with_id`], so each frame opens new OS windows. A layout loaded
+    /// again does it once.
+    #[cfg(debug_assertions)]
+    fn warn_rebuilt(&self, ctx: &Context, natives: &[(&Floating<P>, [f32; 4], ViewportId)]) {
+        let (key, warned) = (self.id.with("native-previous"), self.id.with("native-rebuilt"));
+        let current: Vec<(u64, Vec<P>)> = natives.iter().map(|(w, ..)| (w.id, w.panels().cloned().collect())).collect();
+        let (runs, previous) = ctx.data_mut(|d| d.remove_temp::<(usize, Vec<(u64, Vec<P>)>)>(key)).unwrap_or_default();
+        let runs = if rebuilt(&previous, &current) { runs + 1 } else { 0 };
+        if runs >= REBUILT_FRAMES && !ctx.data(|d| d.get_temp::<bool>(warned).unwrap_or(false)) {
+            log::warn!(
+                "craft-ui docking: the native floating windows get new ids every frame, so each frame opens new OS windows. \
+                 Keep the layout across frames, or give its windows ids with Floating::with_id."
+            );
+            ctx.data_mut(|d| d.insert_temp(warned, true));
+        }
+        ctx.data_mut(|d| d.insert_temp(key, (runs, current)));
+    }
+
+    /// The main window and the shown native windows on the desktop, front first: palettes
+    /// above the rest, each the window focused most recently first. A window whose position is
+    /// unknown is left out. `activated`: the application was just activated, so the main window
+    /// and its normal windows are raised (see [`Self::raise_next`]).
+    fn map_desktop(&mut self, ctx: &Context, natives: &[(&Floating<P>, [f32; 4], ViewportId)], activated: bool) {
+        let key = self.id.with("native-order");
+        // Focus order, front first; `None` is the main window.
+        let mut order = ctx.data(|d| d.get_temp::<Vec<Option<u64>>>(key)).unwrap_or_default();
+        order.retain(|id| id.is_none_or(|id| natives.iter().any(|(w, ..)| w.id == id)));
+        // The main window comes to the front when it gains focus, and on a press in it: the
+        // window system raises it then, though it may have kept focus.
+        let main_key = self.id.with("native-main-focused");
+        let (main_focused, pressed) = ctx.input(|i| (i.viewport().focused == Some(true), i.pointer.any_pressed()));
+        let gained = main_focused && !ctx.data(|d| d.get_temp::<bool>(main_key)).unwrap_or(false);
+        ctx.data_mut(|d| d.insert_temp(main_key, main_focused));
+        if gained || pressed || !order.contains(&None) {
+            let front = order.contains(&None);
+            order.retain(Option::is_some);
+            if front { order.insert(0, None) } else { order.push(None) }
+        }
+        let mut windows = Vec::new();
+        for (window, rect, viewport) in natives {
+            let info = ctx.input(|i| i.raw.viewports.get(viewport).cloned());
+            // A new window opens in front.
+            if info.as_ref().is_some_and(|i| i.focused == Some(true)) || !order.contains(&Some(window.id)) {
+                order.retain(|id| *id != Some(window.id));
+                order.insert(0, Some(window.id));
+            }
+            let [x, y, w, h] = *rect;
+            let placed = match info {
+                None => Some(Rect::from_min_size(pos2(x, y), vec2(w, h))),
+                Some(info) => placed(&info).map(|[x, y, w, h]| Rect::from_min_size(pos2(x, y), vec2(w, h))),
+            };
+            let normal = self.normal_window(window);
+            if let Some(placed) = placed.filter(|r| r.is_finite()) {
+                windows.push((window.id, placed, normal));
+            }
+        }
+        if activated && RAISE_ON_ACTIVATION {
+            // The back one first, so each lands in front of those raised before it, and the
+            // window just focused, at the front of the order, last.
+            // While input is blocked the main window, with the modal, ends in front.
+            if self.input_blocked {
+                order.retain(Option::is_some);
+                order.insert(0, None);
+            }
+            let queue: Vec<Option<u64>> = order
+                .iter()
+                .rev()
+                .filter(|id| id.is_none_or(|id| natives.iter().any(|(w, ..)| w.id == id && self.normal_window(w))))
+                .copied()
+                .collect();
+            // Blocked, the main window comes in front of a palette the app was activated through.
+            if self.input_blocked || queue.iter().any(Option::is_some) {
+                ctx.data_mut(|d| d.insert_temp(self.id.with("native-raise"), queue));
+            }
+        }
+        let rank = |id: Option<u64>| order.iter().position(|o| *o == id);
+        windows.sort_by_key(|(id, _, normal)| (*normal, rank(Some(*id))));
+        self.cross.front = windows.iter().filter(|(id, _, normal)| !normal || rank(Some(*id)) < rank(None)).count();
+        self.cross.windows = windows.into_iter().map(|(id, rect, _)| (id, rect)).collect();
+        ctx.data_mut(|d| d.insert_temp(key, order));
+        self.cross.main = ctx.input(|i| i.viewport().outer_rect.and(i.viewport().inner_rect)).filter(|r| r.is_finite());
+    }
+
+    /// Raise the next window [`Self::map_desktop`] queued when the application was activated,
+    /// the main window (`None`) or a normal window: one per pass, since egui sends the commands
+    /// of different viewports in no fixed order. Toggling the window level raises a window without focusing it: on Windows
+    /// `HWND_NOTOPMOST` puts the window in front of every window that is not topmost, and on
+    /// X11 the window manager raises a window as it takes `_NET_WM_STATE_ABOVE`. winit has no
+    /// plain raise. `ViewportCommand::Focus` would take focus from the window the user
+    /// activated, and egui-winit ignores it for a window that has focus, so focus could not be
+    /// handed back. `Visible(true)` does nothing to a shown window.
+    fn raise_next(&self, ctx: &Context, natives: &[(&Floating<P>, [f32; 4], ViewportId)]) {
+        let key = self.id.with("native-raise");
+        let Some(mut queue) = ctx.data_mut(|d| d.remove_temp::<Vec<Option<u64>>>(key)) else { return };
+        // A window that became a palette since activation keeps its `AlwaysOnTop` level.
+        let viewport = |id: Option<u64>| match id {
+            None => Some(ViewportId::ROOT),
+            Some(id) => natives.iter().find(|(w, ..)| w.id == id && self.normal_window(w)).map(|(.., v)| *v),
+        };
+        queue.retain(|id| viewport(*id).is_some());
+        if queue.is_empty() {
+            return;
+        }
+        if let Some(viewport) = viewport(queue.remove(0)) {
+            ctx.send_viewport_cmd_to(viewport, ViewportCommand::WindowLevel(WindowLevel::AlwaysOnTop));
+            ctx.send_viewport_cmd_to(viewport, ViewportCommand::WindowLevel(WindowLevel::Normal));
+        }
+        if !queue.is_empty() {
+            ctx.data_mut(|d| d.insert_temp(key, queue));
+            ctx.request_repaint();
+        }
+    }
+
+    /// Whether the application is active this frame: one of its windows has focus, or one had it
+    /// less than [`AWAY_DELAY`] ago. And whether it was just activated: one of its windows has
+    /// focus after none had it for that long. Losing focus again stops the raise of normal
+    /// windows that activation started.
+    fn app_activity(&mut self, ctx: &Context) -> (bool, bool) {
+        let (focused, now) = ctx.input(|i| {
+            let infos = || i.raw.viewports.values();
+            // A backend that reports no focus at all keeps the windows.
+            let focused = i.focused || infos().any(|v| v.focused == Some(true)) || infos().all(|v| v.focused.is_none());
+            (focused, i.time)
+        });
+        self.cross.focus_lost = crate::focus::turned_false(ctx, self.id.with("app-focus"), focused);
+        let key = self.id.with("native-last-focused");
+        let last = if focused { now } else { ctx.data(|d| d.get_temp::<f64>(key)).unwrap_or(now) };
+        let active = focused || now - last < AWAY_DELAY;
+        if active && !focused {
+            ctx.request_repaint_after(std::time::Duration::from_secs_f64((AWAY_DELAY - (now - last)).max(0.0)));
+        }
+        ctx.data_mut(|d| d.insert_temp(key, last));
+        let away_key = self.id.with("native-away");
+        let away = ctx.data(|d| d.get_temp::<bool>(away_key)).unwrap_or(false);
+        ctx.data_mut(|d| {
+            d.insert_temp(away_key, !focused && (away || !active));
+            if !focused {
+                d.remove::<Vec<Option<u64>>>(self.id.with("native-raise"));
+            }
+        });
+        (active, focused && away)
+    }
+
+    /// A window holding a viewer is a normal window, so it stacks with the main window; the rest
+    /// are palettes.
+    fn normal_window(&self, window: &Floating<P>) -> bool {
+        window.panels().any(|p| self.content.window_kind(p) == WindowKind::Normal)
+    }
+
+    /// One floating window in its own viewport. `active`: the application is active (see
+    /// [`Self::app_activity`]). Returns the key of its [`Place`].
+    fn native_window(&mut self, ctx: &Context, window: &Floating<P>, rect: [f32; 4], viewport: ViewportId, active: bool) -> Option<Id> {
+        let normal = self.normal_window(window);
+        let first = window.panels().next()?.clone();
+        let key = self.id.with(("native-place", viewport));
+        let now = ctx.input(|i| i.time);
+        let drag_key = self.id.with("window-drag");
+        let moving = |ctx: &Context| ctx.data(|d| d.get_temp::<WindowDrag>(drag_key)).is_some_and(|d| d.window == window.id);
+        let info = ctx.input(|i| i.raw.viewports.get(&viewport).cloned());
+        let frame = info.as_ref().and_then(content_of).map_or(Vec2::ZERO, |(_, frame)| frame);
+        // A minimized window shows its bar and what `floating_body` draws below it.
+        let collapsed = window.minimized.then(|| BAR_HEIGHT + self.minimized_body(window));
+        let shown = |[x, y, w, h]: [f32; 4]| [x, y, w, collapsed.unwrap_or(h)];
+        let mut place = match ctx.data(|d| d.get_temp::<Place>(key)) {
+            Some(mut place) => {
+                // The application changed the window's place (undo, reset, a reloaded layout):
+                // the OS window moves there, kept where its bar can be grabbed.
+                if !moving(ctx)
+                    && let Some(native) = window.native.filter(|native| differs(*native, place.known))
+                {
+                    let target = kept_reachable(native, &self.monitors);
+                    place_window(ctx, viewport, shown(target), frame);
+                    (place.known, place.pending) = (target, Some(now + MOVE_WAIT));
+                }
+                place
+            }
+            None => {
+                // A window of a loaded layout opens at its saved place, moved onto a connected
+                // monitor. One made this session opens where it was put.
+                let seen_key = self.id.with("native-seen");
+                let mut seen = ctx.data(|d| d.get_temp::<std::collections::HashSet<u64>>(seen_key)).unwrap_or_default();
+                let spawn = if window.native.is_some() && !seen.contains(&window.id) {
+                    let (main, size) = ctx.input(|i| (i.viewport().inner_rect, i.viewport().monitor_size));
+                    restore(rect, window.monitor.as_ref(), &self.monitors, main, size)
+                } else {
+                    sanitized(rect)
+                };
+                seen.insert(window.id);
+                ctx.data_mut(|d| d.insert_temp(seen_key, seen));
+                Place { spawn, known: spawn, pending: Some(now + MOVE_WAIT), corrected: false, collapsed: None }
+            }
+        };
+        // Minimized or expanded: the window keeps its top-left corner and width, and its
+        // height is fixed while it shows only its bar.
+        // The limits go first: the OS clamps the new size to the limits it has.
+        if place.collapsed != collapsed {
+            let (min, max) = match collapsed {
+                Some(height) => (vec2(MIN_SIZE[0], height), vec2(1_000_000.0, height)),
+                None => (Vec2::from(MIN_SIZE), Vec2::INFINITY),
+            };
+            ctx.send_viewport_cmd_to(viewport, ViewportCommand::MinInnerSize(min));
+            ctx.send_viewport_cmd_to(viewport, ViewportCommand::MaxInnerSize(max));
+            place_window(ctx, viewport, shown(place.known), frame);
+            (place.collapsed, place.pending) = (collapsed, Some(now + MOVE_WAIT));
+        }
+        let spawn = place.spawn;
+        let title = crate::docking::dock_model::first_active(&window.root).map(|p| self.label_of(p)).unwrap_or_default();
+        let builder = ViewportBuilder::default()
+            .with_title(title.clone())
+            .with_position([spawn[0], spawn[1]])
+            .with_inner_size([spawn[2], spawn[3]])
+            .with_min_inner_size(MIN_SIZE)
+            // A blocked palette could cover the modal, and its bar moves nothing: the main
+            // window can come in front of it at the normal level. While the application is
+            // inactive, its palettes stay shown behind other applications' windows
+            // (`INACTIVE_PALETTE`). egui sends the level only when it changes.
+            .with_window_level(match (normal || self.input_blocked, active) {
+                (true, _) => WindowLevel::Normal,
+                (false, true) => WindowLevel::AlwaysOnTop,
+                (false, false) => INACTIVE_PALETTE,
+            })
+            .with_taskbar(false);
+        // The bar replaces the OS title bar. macOS keeps the frame, with its title bar and
+        // buttons hidden: AppKit resizes a movable window from its edges and corners with its
+        // own cursors, and draws its rounded corners and standard shadow.
+        #[cfg(target_os = "macos")]
+        let builder = builder
+            .with_titlebar_shown(false)
+            .with_title_shown(false)
+            .with_fullsize_content_view(true)
+            .with_titlebar_buttons_shown(false)
+            .with_resizable(!self.input_blocked && window.panels().all(|p| self.permissions(p).movable));
+        #[cfg(not(target_os = "macos"))]
+        let builder = builder.with_decorations(false);
+        // While the application is inactive, raising a palette leaves focus with the application
+        // in use.
+        if (active || normal) && !self.input_blocked && self.activation.as_ref().is_some_and(|panel| window.contains(panel)) {
+            ctx.send_viewport_cmd_to(viewport, ViewportCommand::Focus);
+        }
+        let (targets, docks, windows) = (self.targets.len(), self.dock_targets.len(), self.frame.windows.len());
+        let blocked = self.input_blocked;
+        ctx.with_plugin(|input: &mut NativeInput| input.windows.insert(viewport, self.id));
+        let report = ctx.show_viewport_immediate(viewport, builder, |ui, class| {
+            // `cancel_drag` reaches this viewport's drag here.
+            let cancelled = ui.ctx().data(|d| d.get_temp::<Vec<Id>>(crate::docking::surface::native_cancel_key(self.id)));
+            if ui.ctx().dragged_id().is_some_and(|id| cancelled.is_some_and(|ids| ids.contains(&id))) {
+                ui.ctx().stop_dragging();
+            }
+            let full = ui.max_rect();
+            // An embedded fallback reads the main window's input: its close request, place,
+            // keys and resizes are not this window's.
+            let own = matches!(class, ViewportClass::Immediate | ViewportClass::Deferred);
+            let released = if blocked && own { block_input(ui) } else { Vec::new() };
+            ui.painter().rect_filled(full, 0.0, self.style.floating_background);
+            let buttons = self.native_bar(ui, window);
+            let body = Rect::from_min_max(pos2(full.left(), (full.top() + BAR_HEIGHT).min(full.bottom())), full.max);
+            self.cross.pointed = None;
+            if own {
+                crate::ime::window::begin_window(ui.ctx());
+            }
+            self.floating_body(ui, window, body, full);
+            if own {
+                self.content.window_drawn(ui);
+                crate::ime::window::finish_window(ui.ctx());
+            }
+            if own && !blocked && ui.ctx().text_edit_focused() {
+                let _ = body_input(ui.ctx()).lock().typing_next.insert(viewport);
+            }
+            self.cross.held |= ui.ctx().dragged_id().is_some_and(|id| self.owned_interactions.contains(&id));
+            if debug_close() {
+                debug_outlines(ui, full, &buttons);
+            }
+            if !own {
+                return Report::default();
+            }
+            if window.panels().all(|p| self.permissions(p).movable) {
+                if OS_RESIZES {
+                    leave_cursor_to_os(ui, full);
+                } else {
+                    resize_edges(ui, self.id.with(("native-edges", window.id)), full, &buttons);
+                }
+            }
+            let mut surface = Surface {
+                window: window.id,
+                origin: None,
+                bounds: full,
+                targets: self.targets.split_off(targets),
+                dock_targets: self.dock_targets.split_off(docks),
+                windows: self.frame.windows.split_off(windows),
+            };
+            surface.origin = self.window_gestures(ui, window);
+            if blocked {
+                (surface.targets, surface.dock_targets, surface.windows) = Default::default();
+                cover(ui, self.id.with(("native-blocked", window.id)), full, self.style.blocked_dim);
+                if !released.is_empty() {
+                    self.output.forwarded_modifiers = Some(ui.input(|i| i.modifiers));
+                    self.output.forwarded_events.extend(released);
+                }
+            } else {
+                self.paint_cross(ui, &mut surface);
+                self.route_body_drag(ui.ctx(), Some(window.id));
+                self.forward_events(ui);
+                self.report_files(ui, window, viewport);
+            }
+            ui.input(|i| Report {
+                closed: i.viewport().close_requested(),
+                placed: placed(i.viewport()),
+                frame: content_of(i.viewport()).map_or(Vec2::ZERO, |(_, frame)| frame),
+                monitor_size: i.viewport().monitor_size,
+                surface: Some(surface),
+            })
+        });
+        // Targets in another OS window are in its coordinates. An embedded fallback drew its
+        // targets in the main window's.
+        if report.surface.is_some() {
+            self.targets.truncate(targets);
+            self.dock_targets.truncate(docks);
+            self.frame.windows.truncate(windows);
+        }
+        self.cross.surfaces.extend(report.surface);
+        if let Some(to) = self.cross.moved.take() {
+            (place.known[0], place.known[1], place.pending) = (to.x, to.y, Some(now + MOVE_WAIT));
+        }
+        let moving = moving(ctx);
+        // Set every frame from the drag state and the last frame's preview, so leaving a target
+        // or any way a drag ends (a drop, Escape, a focus loss, the window closing) brings the
+        // window back to full opacity. AppKit finds the window by title, so a window sharing
+        // the dragged one's title stays faded with it.
+        #[cfg(target_os = "macos")]
+        {
+            let main = ctx.input(|i| i.raw.viewports.get(&ViewportId::ROOT).and_then(|v| v.title.clone()));
+            let drag = ctx.data(|d| d.get_temp::<WindowDrag>(drag_key));
+            let dragged = drag.as_ref().and_then(|drag| self.layout.floating.iter().find(|w| w.id == drag.window));
+            let this = dragged.and_then(|w| crate::docking::dock_model::first_active(&w.root)).is_some_and(|p| self.label_of(p) == title);
+            let opacity = if this { drag_opacity(ctx, self.id) } else { 1.0 };
+            set_window_opacity(&title, main.as_deref(), opacity);
+        }
+        // The collapsed height a minimized window reports is not the size to keep.
+        let reported = report.placed.map(|[x, y, w, h]| [x, y, w, if place.collapsed.is_some() { place.known[3] } else { h }]);
+        if let Some(placed) = reported.filter(|_| !moving) {
+            let waiting = place.pending.is_some_and(|until| now < until);
+            if !differs(placed, place.known) {
+                place.pending = None;
+            } else if waiting {
+                // The window system put the window's frame where its content should be.
+                let outer = pos2(placed[0], placed[1]) - report.frame;
+                if !place.corrected && report.frame.length() > 0.5 && outer.distance(pos2(place.known[0], place.known[1])) < 0.5 {
+                    place.corrected = true;
+                    ctx.send_viewport_cmd_to(viewport, ViewportCommand::OuterPosition(pos2(place.known[0], place.known[1]) - report.frame));
+                }
+            } else {
+                (place.known, place.pending) = (placed, None);
+            }
+        }
+        ctx.data_mut(|d| d.insert_temp(key, place));
+        if report.closed {
+            // Like the bar's ×: its panels close and reopen from the application's menu. A
+            // window the application would refuse to close stays open.
+            if !blocked && window.panels().all(|p| self.permissions(p).closable) {
+                self.output.actions.push(Action::CloseWindow { panel: first });
+                return Some(key);
+            }
+            ctx.send_viewport_cmd_to(viewport, ViewportCommand::CancelClose);
+        }
+        // The layout follows the window's place, once a bar drag is over.
+        let known = place.known;
+        if !moving && window.native.is_none_or(|native| differs(native, known)) {
+            self.output.actions.push(Action::SetNative { panel: first.clone(), rect: Some(known) });
+            // The in-window rect follows, for builds that draw the window in-window.
+            if window.panels().all(|p| self.permissions(p).movable) {
+                let origin = ctx.input(|i| i.viewport().inner_rect.map(|r| r.min)).filter(|p| p.is_finite()).unwrap_or(Pos2::ZERO);
+                let [x, y, w, h] = known;
+                self.output.actions.push(Action::MoveFloating { panel: first.clone(), rect: [x - origin.x, y - origin.y, w, h] });
+            }
+        }
+        let monitor = monitor_of(&self.monitors, known).cloned();
+        let size = match monitor {
+            Some(_) => None,
+            None => report.monitor_size.filter(|s| s.is_finite() && s.x > 0.0 && s.y > 0.0).map(|s| [s.x, s.y]),
+        };
+        if (monitor.is_some() || size.is_some()) && (monitor != window.monitor || size != window.monitor_size) {
+            self.output.actions.push(Action::SetMonitor { panel: first, monitor, monitor_size: size });
+        }
+        Some(key)
+    }
+
+    /// The bar at the top of a native window: its title and ×. Dragging it moves the window.
+    /// Returns the rects of its buttons.
+    fn native_bar(&mut self, ui: &mut Ui, window: &Floating<P>) -> Vec<Rect> {
+        let Some(first) = window.panels().next().cloned() else { return Vec::new() };
+        let full = ui.max_rect();
+        let style = ChromeStyle::from_dock(self.style);
+        let rect = Rect::from_min_size(full.min, vec2(full.width(), BAR_HEIGHT.min(full.height())));
+        ui.painter().rect_filled(rect, 0.0, style.title_background);
+        let (close_hit, close_glyph) = close_rects(rect, if OS_RESIZES { MACOS_CLOSE } else { OTHER_CLOSE }, style.right_to_left);
+        let movable = window.panels().all(|p| self.permissions(p).movable);
+        let closable = self.style.close_button && window.panels().all(|p| self.permissions(p).closable);
+        let (move_label, close_label) = (self.style.move_window_label.clone(), self.style.close_window_label.clone());
+        let title = crate::docking::dock_model::first_active(&window.root).map(|p| self.label_of(p)).unwrap_or_default();
+        // On macOS the bar keeps the arrow, as native title bars do: AppKit's resize areas
+        // cover its ends and top edge, and a cursor set over them flickers with AppKit's.
+        let mut bar = TitleBar::new(self.id.with(("native-bar", window.id)), &move_label).title(title).movable(movable && !OS_RESIZES);
+        if closable {
+            bar = bar.close(&close_label).close_at(close_hit, close_glyph);
+        }
+        let response = bar.show(ui, rect, &style);
+        if response.close.as_ref().is_some_and(|close| close.clicked()) {
+            self.output.actions.push(Action::CloseWindow { panel: first });
+        }
+        // Where the window system moves the window, it takes the press, as a title bar's;
+        // a drag that egui would only start past the click distance would lose the way there.
+        let start = if self.window_system.moves_windows() {
+            response.bar.is_pointer_button_down_on() && ui.input(|i| i.pointer.primary_pressed())
+        } else {
+            response.bar.drag_started()
+        };
+        if movable && start {
+            self.start_window_drag(ui, window.id, false);
+        }
+        response.close.iter().chain(&response.menu).map(|r| r.rect).collect()
+    }
+
+    /// After a native window's tree drew: a drag of its only tab, or of its only group, moves
+    /// the window as its bar does. Then the window follows a bar drag, and writes the pointer
+    /// of a drag it owns. Returns the desktop position of the window's content, where known.
+    fn window_gestures(&mut self, ui: &Ui, window: &Floating<P>) -> Option<Pos2> {
+        let ctx = ui.ctx();
+        let (drag_key, group_key) = (self.id.with("drag"), self.id.with("group-drag"));
+        let tab = ctx.data(|d| d.get_temp::<Drag<P>>(drag_key)).filter(|d| window.contains(&d.panel));
+        let group = ctx.data(|d| d.get_temp::<GroupDrag<P>>(group_key)).filter(|d| window.contains(&d.panel));
+        let lone = window.panels().count() == 1 && tab.is_some();
+        let whole = matches!(window.root, Node::Tabs { .. }) && group.as_ref().is_some_and(|g| g.gesture == GroupGesture::Group);
+        if (lone || whole) && window.panels().all(|p| self.permissions(p).movable) {
+            ctx.data_mut(|d| {
+                d.remove::<Drag<P>>(drag_key);
+                d.remove::<GroupDrag<P>>(group_key);
+            });
+            self.start_window_drag(ui, window.id, true);
+        }
+        self.escape_elsewhere(ctx, Some(window.id));
+        let origin = ui.input(|i| content_of(i.viewport())).map(|(origin, _)| origin);
+        if let Some(origin) = self.follow_window_drag(ui, window.id, origin) {
+            return origin;
+        }
+        let owns = ctx.data(|d| d.get_temp::<Drag<P>>(drag_key).map(|d| d.panel).or(d.get_temp::<GroupDrag<P>>(group_key).map(|d| d.panel)));
+        if owns.is_some_and(|panel| window.contains(&panel)) && self.record_pointer(ctx, Some(window.id), origin, None).escape {
+            // The drag's cancel, not a shortcut.
+            ui.input_mut(|i| i.consume_key(Modifiers::NONE, Key::Escape));
+        }
+        origin
+    }
+
+    /// Start moving the window with the pointer, from the position the window system reports,
+    /// or by handing the move to the window system: where it moves windows smoothly (macOS),
+    /// tracking the drag, and where it reports no positions (Wayland), leaving it alone. `docks`:
+    /// the drag began on the window's only tab or group.
+    fn start_window_drag(&mut self, ui: &Ui, window: u64, docks: bool) {
+        let ctx = ui.ctx();
+        let key = self.id.with("window-drag");
+        if ctx.data(|d| d.get_temp::<WindowDrag>(key)).is_some_and(|d| d.window == window) {
+            return;
+        }
+        let os = self.window_system.moves_windows();
+        // The window system keeps the window where it is under the pointer now.
+        let press =
+            ui.input(|i| if os { i.pointer.latest_pos().or(i.pointer.press_origin()) } else { i.pointer.press_origin().or(i.pointer.latest_pos()) });
+        match (ui.input(|i| content_of(i.viewport())), press) {
+            (Some((origin, _)), Some(press)) => {
+                let drag = WindowDrag { window, grab: press.to_vec2(), to: origin, start: origin, docks, os, moved: !os || docks };
+                ctx.data_mut(|d| d.insert_temp(key, drag));
+                if os {
+                    ctx.send_viewport_cmd(ViewportCommand::StartDrag);
+                }
+            }
+            _ => ctx.send_viewport_cmd(ViewportCommand::StartDrag),
+        }
+    }
+
+    /// Move the window by `OuterPosition` while the button is held, so the pressed point stays
+    /// under the pointer. Escape puts it back; losing focus leaves it. Where the window system
+    /// moves the window, follow it instead ([`Self::follow_os_drag`]). Returns the desktop
+    /// position of the window's content while it moves, `origin` as reported or where it is.
+    fn follow_window_drag(&mut self, ui: &Ui, window: u64, origin: Option<Pos2>) -> Option<Option<Pos2>> {
+        let key = self.id.with("window-drag");
+        let mut drag = ui.ctx().data(|d| d.get_temp::<WindowDrag>(key)).filter(|d| d.window == window)?;
+        if drag.os {
+            return Some(self.follow_os_drag(ui, drag, origin));
+        }
+        let content = ui.input(|i| content_of(i.viewport()));
+        let frame = content.map_or(Vec2::ZERO, |(_, frame)| frame);
+        // A pointer move of this frame is relative to where the window was when the window
+        // system sent it, which is where it reports the window now: a move commanded earlier
+        // may not have landed yet. Without one the window stays, since the last position egui
+        // keeps (button events included) was measured against an older place.
+        let moved = ui.input(|i| i.events.iter().rev().find_map(|e| if let Event::PointerMoved(p) = e { Some(*p) } else { None }));
+        let to = content.zip(moved.filter(|p| p.is_finite())).map(|((origin, _), local)| origin + (local.to_vec2() - drag.grab));
+        let mut step = None;
+        if let Some(to) = to.filter(|to| to.distance(drag.to) > 0.0) {
+            (drag.to, step) = (to, Some(to));
+            ui.ctx().data_mut(|d| d.insert_temp(key, drag));
+        }
+        // The pointer on the desktop is the pressed point of the window where it was last
+        // put, so the origin is that place, less the local pointer. Targets are hit there.
+        let local = ui.input(|i| i.pointer.latest_pos()).filter(|p| p.is_finite());
+        let origin = local.map(|local| drag.to + drag.grab - local.to_vec2()).or(content.map(|(origin, _)| origin));
+        let pointer = self.record_pointer(ui.ctx(), Some(window), origin, Some(&drag));
+        let move_to = |r: &mut Self, to: Pos2| {
+            ui.ctx().send_viewport_cmd(ViewportCommand::OuterPosition(to - frame));
+            r.cross.moved = Some(to);
+        };
+        if pointer.escape || self.cross.focus_lost {
+            if pointer.escape {
+                move_to(self, drag.start);
+                ui.input_mut(|i| i.consume_key(Modifiers::NONE, Key::Escape));
+            }
+            ui.ctx().data_mut(|d| d.remove::<WindowDrag>(key));
+            return Some(origin);
+        }
+        if let Some(to) = step {
+            move_to(self, to);
+        }
+        if !pointer.down {
+            ui.ctx().data_mut(|d| d.remove::<WindowDrag>(key));
+            // Left with too little of its bar on a monitor to grab it: back onto the nearest.
+            if let Some(size) = ui.input(|i| i.viewport().inner_rect.map(|r| r.size())) {
+                let [x, y, ..] = kept_reachable([drag.to.x, drag.to.y, size.x, size.y], &self.monitors);
+                if pos2(x, y).distance(drag.to) > 0.5 {
+                    move_to(self, pos2(x, y));
+                }
+            }
+            self.end_window_drag(drag, pointer);
+        }
+        Some(origin)
+    }
+
+    /// A bar drag that the window system carries out (`StartDrag`): the window stays under the
+    /// cursor at the pressed point, so it is where the cursor is less the grab. Its reported
+    /// place lags the move, and AppKit tells the cursor fresh each frame. The drag ends on the
+    /// first frame on which the window system or egui reports the release, and then once.
+    /// Escape does not end it, as with Finder's windows: AppKit sends no keys meanwhile.
+    /// Returns where the window's content is.
+    fn follow_os_drag(&mut self, ui: &Ui, mut drag: WindowDrag, origin: Option<Pos2>) -> Option<Pos2> {
+        let ctx = ui.ctx();
+        let key = self.id.with("window-drag");
+        let local = ui.input(|i| i.pointer.latest_pos()).filter(|p| p.is_finite());
+        let cursor = self.window_system.cursor(ctx).or_else(|| Some(origin? + local?.to_vec2()));
+        if let Some(cursor) = cursor {
+            drag.to = cursor - drag.grab;
+            drag.moved |= drag.to.distance(drag.start) > ctx.options(|o| o.input_options.max_click_dist);
+        }
+        let (egui_down, released) = ui.input(|i| (i.pointer.primary_down(), i.pointer.primary_released()));
+        let ended = self.window_system.primary_held() == Some(false) || released || !egui_down;
+        let command =
+            self.window_system.command_held().unwrap_or_else(|| ui.input(|i| i.modifiers.command || i.modifiers.ctrl || i.modifiers.mac_cmd));
+        if self.cross.focus_lost || ended {
+            ctx.data_mut(|d| d.remove::<WindowDrag>(key));
+        } else {
+            ctx.data_mut(|d| d.insert_temp(key, drag));
+        }
+        // A click on the bar is no drop, and the window's reports say where it is.
+        if !drag.moved {
+            return origin;
+        }
+        self.cross.moved = Some(drag.to);
+        if self.cross.focus_lost {
+            return Some(drag.to);
+        }
+        let pointer = DragPointer {
+            owner: Some(drag.window),
+            origin: Some(drag.to),
+            local: Some(drag.grab.to_pos2()),
+            down: !ended,
+            released: ended,
+            escape: false,
+            command,
+            window: Some(drag.window),
+            docks: drag.docks,
+        };
+        self.write_pointer(ctx, pointer);
+        if ended {
+            // Left with too little of its bar on a monitor to grab it: back onto the nearest.
+            if let Some(size) = ui.input(|i| i.viewport().inner_rect.map(|r| r.size())) {
+                let [x, y, ..] = kept_reachable([drag.to.x, drag.to.y, size.x, size.y], &self.monitors);
+                if pos2(x, y).distance(drag.to) > 0.5 {
+                    let frame = ui.input(|i| content_of(i.viewport())).map_or(Vec2::ZERO, |(_, frame)| frame);
+                    ctx.send_viewport_cmd(ViewportCommand::OuterPosition(pos2(x, y) - frame));
+                    self.cross.moved = Some(pos2(x, y));
+                }
+            }
+            self.end_window_drag(drag, pointer);
+        }
+        Some(drag.to)
+    }
+
+    /// Release of a bar drag. The window already sits where it was dragged; over a target in
+    /// another window it docks there once every window has drawn (`cross.rs`).
+    fn end_window_drag(&mut self, drag: WindowDrag, pointer: DragPointer) {
+        self.cross.release = Some((drag, pointer));
+    }
+
+    /// Files dragged over or dropped on the window this frame, with the panel under the pointer.
+    fn report_files(&mut self, ui: &Ui, window: &Floating<P>, viewport: ViewportId) {
+        let (hovered, dropped, pos) = ui.input(|i| (i.raw.hovered_files.clone(), i.raw.dropped_files.clone(), i.pointer.latest_pos()));
+        if hovered.is_empty() && dropped.is_empty() {
+            return;
+        }
+        // The window system may send no pointer moves while files are dragged in.
+        let Some(panel) = self.cross.pointed.clone().or_else(|| crate::docking::dock_model::first_active(&window.root).cloned()) else { return };
+        // A window whose own pass is discarded draws twice: keep one report, with the latest
+        // hovered files and every dropped one.
+        if let Some(files) = self.output.window_files.iter_mut().find(|f| f.viewport == viewport) {
+            files.panel = panel;
+            files.pos = pos;
+            files.hovered = hovered;
+            files.dropped.extend(dropped);
+        } else {
+            self.output.window_files.push(WindowFiles { window: window.id, viewport, panel, pos, hovered, dropped });
+        }
+    }
+
+    /// Keys, text and clipboard events the window's widgets left over, for the application's
+    /// shortcuts. Nothing while a widget of the window has keyboard focus: its keys are its own.
+    fn forward_events(&mut self, ui: &Ui) {
+        if ui.memory(|m| m.focused().is_some()) {
+            return;
+        }
+        let events = ui.input(|i| {
+            i.events
+                .iter()
+                .filter(|e| matches!(e, Event::Key { .. } | Event::Text(_) | Event::Copy | Event::Cut | Event::Paste(_)))
+                .cloned()
+                .collect::<Vec<_>>()
+        });
+        if !events.is_empty() {
+            self.output.forwarded_modifiers = Some(ui.input(|i| i.modifiers));
+            self.output.forwarded_events.extend(events);
+        }
+    }
+}
+
+/// Input hooks of dock areas for their native windows, run by egui before it reads each
+/// window's input. eframe runs `App::raw_input_hook` for the main window only. App drags in
+/// panel bodies cross windows here too (`body_drag.rs`).
+#[derive(Default)]
+pub(super) struct NativeInput {
+    hooks: std::collections::HashMap<Id, egui::mutex::Mutex<InputHook>>,
+    /// The dock area of each native window shown this frame.
+    windows: std::collections::HashMap<ViewportId, Id>,
+}
+
+/// Each dock area's app drag in a panel body, the events waiting for a window's next input, and
+/// the windows whose text fields have the keyboard. Kept outside [`NativeInput`]: egui calls
+/// [`egui::Plugin::input_hook`] with the plugin locked, and an app's input hook may call
+/// [`crate::docking::cancel_drag`] or [`crate::docking::send_keys`], which must reach this state
+/// without locking the plugin again. The lock here is dropped before that hook runs.
+#[derive(Default)]
+pub(super) struct NativeBodyInput {
+    /// Each dock area's app drag in a panel body.
+    pub routes: std::collections::HashMap<Id, BodyRoute>,
+    /// Pointer events routed to each window, for its next input.
+    pub queued: Queued,
+    /// Owners' held releases, for their input in a later main-window pass.
+    pub held: Held,
+    /// The main window's passes so far.
+    pub pass: u64,
+    /// The windows that had a focused text field in the last main-window pass, and those
+    /// noted so far in this one.
+    typing: std::collections::HashSet<ViewportId>,
+    typing_next: std::collections::HashSet<ViewportId>,
+    /// The main window's completed passes when `typing` was last taken from `typing_next`.
+    typing_at: u64,
+    /// Key and clipboard events for each window's next input, and the pass they were queued in.
+    keys: std::collections::HashMap<ViewportId, (u64, Vec<Event>)>,
+}
+
+/// The app drag routing and routed events shared by every native input hook of `ctx`.
+pub(super) fn body_input(ctx: &Context) -> Arc<egui::mutex::Mutex<NativeBodyInput>> {
+    ctx.data_mut(|data| data.get_temp_mut_or_default::<Arc<egui::mutex::Mutex<NativeBodyInput>>>(body_input_key()).clone())
+}
+
+/// The temp-data key for the context's native body-routing state.
+///
+/// All dock areas in a context deliberately use this one container: its `routes` map is keyed by
+/// dock-area `Id`, and queued, held and key events by target viewport. The key is unique only so
+/// this state does not collide with unrelated temporary data.
+fn body_input_key() -> Id {
+    Id::unique("craft-ui docking native body input")
+}
+
+pub(in crate::docking) type InputHook = Box<dyn FnMut(&Context, &mut RawInput) + Send>;
+
+impl egui::Plugin for NativeInput {
+    /// The egui plugin's diagnostic name, `craft-ui docking native input`.
+    fn debug_name(&self) -> &'static str {
+        "craft-ui docking native input"
+    }
+
+    /// Route this viewport's input without deadlocking.
+    ///
+    /// Only the root viewport advances the frame pass; queued, held and key entries older than the
+    /// current pass are pruned. Events waiting for this viewport are taken before routing, so events
+    /// enqueued by routing wait for its next input. A held release is only released once a later
+    /// root pass exists. Earlier routed events are spliced before the window's own events, and any
+    /// accepted route requests a root repaint. The dock area's application hook is called only
+    /// after the routing mutex is dropped because it may cancel a drag and re-enter the shared
+    /// body state.
+    fn input_hook(&mut self, ctx: &Context, input: &mut RawInput) {
+        let viewport = input.viewport_id;
+        let body = body_input(ctx);
+        let mut routed = false;
+        {
+            let mut body = body.lock();
+            let body = &mut *body;
+            if viewport == ViewportId::ROOT {
+                body.pass += 1;
+                // Every window draws in the main window's pass: events for one that has not
+                // drawn since the last pass are for a window that is gone.
+                let pass = body.pass;
+                body.queued.retain(|_, (at, _)| *at + 1 >= pass);
+                body.held.retain(|_, (at, _)| *at + 1 >= pass);
+                body.keys.retain(|_, (at, _)| *at + 1 >= pass);
+                body.typing = std::mem::take(&mut body.typing_next);
+                body.typing_at = ctx.cumulative_pass_nr_for(ViewportId::ROOT);
+                // eframe has run `App::raw_input_hook`, where an app's native menu reports its key
+                // equivalents (macOS: AppKit's menu takes them before the key window sees them).
+                // While a native window has the keyboard, the main window gets no keys of its own,
+                // so these are the menu's: those a focused text field there acts on are its own.
+                if let Some(window) = typing_window_of(&body.typing, &input.viewports) {
+                    let (moved, kept): (Vec<_>, Vec<_>) = std::mem::take(&mut input.events).into_iter().partition(text_key);
+                    input.events = kept;
+                    if !moved.is_empty() {
+                        let entry = body.keys.entry(window).or_default();
+                        entry.0 = pass;
+                        entry.1.extend(moved);
+                        ctx.request_repaint_of(window);
+                    }
+                }
+            }
+            // Taken before routing, which may queue more for this window's next input. A held
+            // release waits for a later main-window pass: a discarded pass reruns within its own.
+            let waiting = body.queued.remove(&viewport);
+            let keys = body.keys.remove(&viewport).map(|(_, mut keys)| {
+                text_clipboard_keys(ctx, viewport, &mut keys);
+                keys
+            });
+            let held = if body.held.get(&viewport).is_some_and(|(at, _)| *at < body.pass) { body.held.remove(&viewport) } else { None };
+            for route in body.routes.values_mut() {
+                routed |= route.route(input, &mut body.queued, &mut body.held, body.pass);
+            }
+            // Before the window's own events: they happened earlier, and a held release must
+            // not end a press that follows it.
+            let earlier = held
+                .into_iter()
+                .flat_map(|(_, events)| events)
+                .chain(waiting.into_iter().flat_map(|(_, events)| events.into_iter().map(|(_, e)| e)))
+                .chain(keys.into_iter().flatten());
+            input.events.splice(0..0, earlier);
+        }
+        if routed {
+            ctx.request_repaint_of(ViewportId::ROOT);
+        }
+        // After the routing lock is dropped: the app's hook may call `cancel_drag`, which locks
+        // the same body state through egui's temporary data, not this plugin.
+        if let Some(hook) = self.windows.get(&input.viewport_id).and_then(|area| self.hooks.get(area)) {
+            (hook.lock())(ctx, input);
+        }
+    }
+}
+
+/// The native window in `typing` that has the keyboard, by the main window's `viewports`.
+fn typing_window_of(typing: &std::collections::HashSet<ViewportId>, viewports: &egui::ViewportIdMap<ViewportInfo>) -> Option<ViewportId> {
+    typing.iter().copied().find(|viewport| viewports.get(viewport).and_then(|info| info.focused) == Some(true))
+}
+
+/// Whether a text field acts on `event`: the clipboard events, and the command keys that copy,
+/// paste, select all, undo, redo, move or delete in text. Other command keys are the app's
+/// (save, close, new window, its own shortcuts).
+fn text_key(event: &Event) -> bool {
+    match event {
+        Event::Copy | Event::Cut | Event::Paste(_) => true,
+        Event::Key { key, modifiers: m, .. } if m.command && !m.alt => match key {
+            Key::C | Key::X | Key::V | Key::A | Key::Backspace | Key::Delete => !m.shift,
+            Key::Z | Key::ArrowLeft | Key::ArrowRight | Key::ArrowUp | Key::ArrowDown => true,
+            _ => false,
+        },
+        _ => false,
+    }
+}
+
+/// A text field copies and pastes on `Copy`, `Cut` and `Paste` events, which egui-winit makes
+/// from the window's own key presses. A command C, X or V press here is a menu's key
+/// equivalent, which a text field ignores: give back C and X as `Copy` and `Cut`, and turn V
+/// into a request for the clipboard text, which arrives in `viewport` as `Paste`.
+fn text_clipboard_keys(ctx: &Context, viewport: ViewportId, events: &mut Vec<Event>) {
+    events.retain_mut(|e| {
+        let Event::Key { key, pressed: true, modifiers: m, .. } = *e else { return true };
+        if !m.command || m.alt || m.shift {
+            return true;
+        }
+        match key {
+            Key::C => *e = Event::Copy,
+            Key::X => *e = Event::Cut,
+            Key::V => {
+                ctx.send_viewport_cmd_to(viewport, ViewportCommand::RequestPaste);
+                return false;
+            }
+            _ => {}
+        }
+        true
+    });
+}
+
+/// See [`crate::docking::typing_window`].
+pub(in crate::docking) fn typing_window(ctx: &Context) -> Option<ViewportId> {
+    // Between frames (in `App::raw_input_hook`) a main-window pass has ended since the swap, and
+    // `typing_next` is the whole of the last pass, which the next swap hands to the routing.
+    let passes = ctx.cumulative_pass_nr_for(ViewportId::ROOT);
+    let body = body_input(ctx);
+    let typing = {
+        let input = body.lock();
+        if passes > input.typing_at { input.typing_next.clone() } else { input.typing.clone() }
+    };
+    ctx.input_for(ViewportId::ROOT, |i| typing_window_of(&typing, &i.raw.viewports))
+}
+
+/// See [`crate::docking::send_keys`].
+pub(in crate::docking) fn send_keys(ctx: &Context, viewport: ViewportId, events: Vec<Event>) {
+    if events.is_empty() {
+        return;
+    }
+    {
+        let body = body_input(ctx);
+        let mut input = body.lock();
+        let pass = input.pass;
+        let entry = input.keys.entry(viewport).or_default();
+        entry.0 = pass;
+        entry.1.extend(events);
+    }
+    ctx.request_repaint_of(viewport);
+}
+
+/// Set or clear the input hook of the dock area `area` for this frame, and forget its native
+/// windows until they show again.
+pub(in crate::docking) fn set_input_hook(ctx: &Context, area: Id, hook: Option<InputHook>) {
+    if ctx.plugin_opt::<NativeInput>().is_none() {
+        ctx.add_plugin(NativeInput::default());
+    }
+    ctx.with_plugin(|input: &mut NativeInput| {
+        input.windows.retain(|_, a| *a != area);
+        match hook {
+            Some(hook) => input.hooks.insert(area, egui::mutex::Mutex::new(hook)),
+            None => input.hooks.remove(&area),
+        }
+    });
+}
+
+/// Frames running whose native windows are all new, with the last frame's panels, before
+/// [`Renderer::warn_rebuilt`] warns.
+#[cfg(debug_assertions)]
+const REBUILT_FRAMES: usize = 3;
+
+/// What the environment says of winit's backend.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(in crate::docking) enum Session {
+    /// `WAYLAND_DISPLAY` or `WAYLAND_SOCKET` is set: winit picks Wayland unless the app forces
+    /// X11 in code (`EventLoopBuilderExtX11::with_x11`); winit reads no variable that does.
+    Wayland,
+    /// None of those nor `DISPLAY` is set on a Unix desktop: a Wayland app started with only
+    /// `WAYLAND_SOCKET`, which winit unsets as it connects, or no display at all (tests, CI).
+    Unknown,
+    /// X11 or another backend.
+    Other,
+}
+
+/// The [`Session`] of a Unix desktop (`unix`) whose environment variable `name` is set and
+/// not empty when `set(name)`.
+pub(in crate::docking) fn session(unix: bool, set: impl Fn(&str) -> bool) -> Session {
+    if !unix {
+        Session::Other
+    } else if set("WAYLAND_DISPLAY") || set("WAYLAND_SOCKET") {
+        Session::Wayland
+    } else if set("DISPLAY") {
+        Session::Other
+    } else {
+        Session::Unknown
+    }
+}
+
+/// This process's [`Session`], read once.
+fn env_session() -> Session {
+    static SESSION: std::sync::OnceLock<Session> = std::sync::OnceLock::new();
+    *SESSION.get_or_init(|| {
+        session(cfg!(any(target_os = "linux", target_os = "freebsd", target_os = "dragonfly", target_os = "netbsd", target_os = "openbsd")), |name| {
+            std::env::var_os(name).is_some_and(|value| !value.is_empty())
+        })
+    })
+}
+
+/// Whether the main window runs on Wayland, given the environment's `session`. egui does not
+/// name the backend, but on Wayland the main window never reports its outer rect, while under
+/// X11 it does from the first frame on (eframe reads it as the window opens). A minimized X11
+/// window reports none either, so once one has, the backend is not Wayland. Without a Wayland
+/// variable, only a real OS window (one that reports its native pixels per point) counts.
+pub(in crate::docking) fn wayland(ctx: &Context, session: Session) -> bool {
+    let root = |test: fn(&ViewportInfo) -> bool| ctx.input(|i| i.raw.viewports.get(&ViewportId::ROOT).is_some_and(test));
+    match session {
+        Session::Other => return false,
+        Session::Unknown if !root(|v| v.native_pixels_per_point.is_some()) => return false,
+        Session::Wayland | Session::Unknown => {}
+    }
+    let key = Id::unique("craft-ui-dock-window-positions");
+    if ctx.data(|d| d.get_temp::<bool>(key).unwrap_or(false)) {
+        return false;
+    }
+    let reported = root(|v| v.outer_rect.is_some());
+    if reported {
+        ctx.data_mut(|d| d.insert_temp(key, true));
+    }
+    !reported
+}
+
+/// Whether every window of `current` is new to `previous`, and they hold the same panels:
+/// windows, with their panels, as `(id, panels)`.
+#[cfg(debug_assertions)]
+fn rebuilt<P: Eq + Hash>(previous: &[(u64, Vec<P>)], current: &[(u64, Vec<P>)]) -> bool {
+    !current.is_empty() && current.iter().all(|(id, _)| previous.iter().all(|(p, _)| p != id)) && panels(previous) == panels(current)
+}
+
+#[cfg(debug_assertions)]
+fn panels<P: Eq + Hash>(windows: &[(u64, Vec<P>)]) -> std::collections::HashSet<&Vec<P>> {
+    windows.iter().map(|(_, panels)| panels).collect()
+}
+
+/// The start of a blocked native window's frame: its widgets are disabled, and the pointer,
+/// keys, text and scrolling are taken out of its input before anything reads them, so a panel
+/// that reads input directly sees none either. Returns the key releases it took out, for the
+/// app: a key pressed before the block would otherwise stay down in the app's shortcuts.
+fn block_input(ui: &mut Ui) -> Vec<Event> {
+    // Disabling fades what the window paints, its opaque background too; the cover dims it.
+    let opacity = ui.opacity();
+    ui.disable();
+    ui.set_opacity(opacity);
+    // Native reset acknowledgements are ordered control messages, even while widgets are blocked.
+    let kept = |e: &Event| matches!(e, Event::WindowFocused(_) | Event::ImeResetCompleted { .. });
+    let released = ui.input(|i| i.events.iter().filter(|e| matches!(e, Event::Key { pressed: false, .. })).cloned().collect());
+    ui.input_mut(|i| {
+        i.events.retain(kept);
+        i.raw.events.retain(kept);
+        // File drops are fields of their own, not events.
+        i.raw.dropped_files.clear();
+        i.raw.hovered_files.clear();
+        i.keys_down.clear();
+        i.smooth_scroll_delta = Vec2::ZERO;
+        i.pointer = Default::default();
+    });
+    ui.memory_mut(|m| m.stop_text_input());
+    released
+}
+
+/// The end of a blocked native window's frame: `dim` over its content `full`, in a layer above
+/// its popups that takes the pointer, so a popup left open takes no click either.
+fn cover(ui: &Ui, id: Id, full: Rect, dim: Color32) {
+    let cover = Ui::new(ui.ctx().clone(), id, UiBuilder::new().layer_id(LayerId::new(Order::Tooltip, id)).max_rect(full));
+    cover.painter().rect_filled(full, 0.0, dim);
+    cover.interact(full, id.with("sink"), Sense::CLICK | Sense::DRAG);
+}
+
+/// Move and size a native window so its content is the desktop rect `to`. The size goes
+/// first, so the move puts the top-left corner in place whichever corner the window system
+/// keeps on a resize (AppKit's frame origin is the bottom left).
+fn place_window(ctx: &Context, viewport: ViewportId, to: [f32; 4], frame: Vec2) {
+    ctx.send_viewport_cmd_to(viewport, ViewportCommand::InnerSize(vec2(to[2], to[3])));
+    ctx.send_viewport_cmd_to(viewport, ViewportCommand::OuterPosition(pos2(to[0], to[1]) - frame));
+}
+
+/// The resize bands of a movable native window without a frame of its own. Drawn after its
+/// content, so they take the pointer at its edges; the bar's `buttons` are left out.
+fn resize_edges(ui: &Ui, id: Id, full: Rect, buttons: &[Rect]) {
+    for (i, (direction, band)) in resize_bands(full, buttons).into_iter().enumerate() {
+        let response = ui.interact(band, id.with(i), Sense::drag()).on_hover_cursor(resize_cursor(direction));
+        if response.drag_started() {
+            ui.ctx().send_viewport_cmd(ViewportCommand::BeginResize(direction));
+        }
+    }
+}
+
+/// Over AppKit's resize areas of the window's content `full`, the default cursor whatever the
+/// content asked for: AppKit shows its resize cursor there, and any other cursor we set fights
+/// it.
+fn leave_cursor_to_os(ui: &Ui, full: Rect) {
+    if ui.input(|i| i.pointer.hover_pos()).is_some_and(|p| appkit_resize_areas(full).iter().any(|area| area.contains(p))) {
+        ui.ctx().set_cursor_icon(CursorIcon::Default);
+    }
+}
+
+/// AppKit's resize areas inside a window's content `rect`: a square at each corner and a strip
+/// along each edge.
+pub(in crate::docking) fn appkit_resize_areas(rect: Rect) -> [Rect; 8] {
+    let (c, e) = (Vec2::splat(APPKIT_CORNER), APPKIT_EDGE);
+    [
+        Rect::from_min_size(rect.left_top(), c),
+        Rect::from_min_size(rect.right_top() - vec2(c.x, 0.0), c),
+        Rect::from_min_size(rect.left_bottom() - vec2(0.0, c.y), c),
+        Rect::from_min_size(rect.right_bottom() - c, c),
+        rect.with_max_y(rect.top() + e),
+        rect.with_min_y(rect.bottom() - e),
+        rect.with_max_x(rect.left() + e),
+        rect.with_min_x(rect.right() - e),
+    ]
+}
+
+/// Over a native window's content `full`: its bar's `buttons` outlined in red and, on macOS,
+/// AppKit's resize areas in orange.
+fn debug_outlines(ui: &Ui, full: Rect, buttons: &[Rect]) {
+    let stroke = |color| egui::Stroke::new(1.0, color);
+    for button in buttons {
+        ui.painter().rect_stroke(*button, 0.0, stroke(egui::Color32::RED), egui::StrokeKind::Inside);
+    }
+    if OS_RESIZES {
+        for area in appkit_resize_areas(full) {
+            ui.painter().rect_stroke(area, 0.0, stroke(egui::Color32::ORANGE), egui::StrokeKind::Inside);
+        }
+    }
+}
+
+/// The hit area and glyph of the × in a native window's bar `bar`, laid out by `layout` from
+/// the bar's top and trailing edges.
+pub(in crate::docking) fn close_rects(bar: Rect, layout: CloseLayout, right_to_left: bool) -> (Rect, Rect) {
+    let l = layout;
+    let glyph = Rect::from_min_size(pos2(bar.right() - l.glyph_trailing - l.glyph_size, bar.top() + l.glyph_top), Vec2::splat(l.glyph_size));
+    let hit = Rect::from_min_max(glyph.min - vec2(l.hit_left, l.hit_up), glyph.max + vec2(l.hit_right, l.hit_down));
+    let mirror = |r: Rect| {
+        if right_to_left {
+            Rect::from_x_y_ranges((bar.left() + bar.right() - r.right())..=(bar.left() + bar.right() - r.left()), r.y_range())
+        } else {
+            r
+        }
+    };
+    (mirror(hit), mirror(glyph))
+}
+
+/// The bands along the edges of a native window's content `rect` that resize it: an L at each
+/// corner, [`EDGE`] deep and [`CORNER`] along both edges, and the edges between them. They
+/// leave out the bar's `buttons`, which take their own clicks.
+pub(in crate::docking) fn resize_bands(rect: Rect, buttons: &[Rect]) -> Vec<(ResizeDirection, Rect)> {
+    use ResizeDirection as D;
+    let (l, r, t, b, e, c) = (rect.left(), rect.right(), rect.top(), rect.bottom(), EDGE, CORNER);
+    let band = |x0: f32, y0: f32, x1: f32, y1: f32| Rect::from_min_max(pos2(x0, y0), pos2(x1, y1));
+    let bands = [
+        (D::NorthWest, band(l, t, l + c, t + e)),
+        (D::NorthWest, band(l, t, l + e, t + c)),
+        (D::NorthEast, band(r - c, t, r, t + e)),
+        (D::NorthEast, band(r - e, t, r, t + c)),
+        (D::SouthWest, band(l, b - e, l + c, b)),
+        (D::SouthWest, band(l, b - c, l + e, b)),
+        (D::SouthEast, band(r - c, b - e, r, b)),
+        (D::SouthEast, band(r - e, b - c, r, b)),
+        (D::North, band(l + c, t, r - c, t + e)),
+        (D::South, band(l + c, b - e, r - c, b)),
+        (D::West, band(l, t + c, l + e, b - c)),
+        (D::East, band(r - e, t + c, r, b - c)),
+    ];
+    let mut out = Vec::new();
+    for (direction, band) in bands {
+        let mut pieces = vec![band];
+        for button in buttons {
+            pieces = pieces.into_iter().flat_map(|piece| outside(piece, *button)).collect();
+        }
+        out.extend(pieces.into_iter().filter(|p| p.is_positive()).map(|p| (direction, p)));
+    }
+    out
+}
+
+/// The parts of `rect` outside `hole`: up to four rects.
+fn outside(rect: Rect, hole: Rect) -> Vec<Rect> {
+    let overlap = rect.intersect(hole);
+    if !overlap.is_positive() {
+        return vec![rect];
+    }
+    [
+        Rect::from_min_max(rect.min, pos2(rect.right(), overlap.top())),
+        Rect::from_min_max(pos2(rect.left(), overlap.bottom()), rect.max),
+        Rect::from_min_max(pos2(rect.left(), overlap.top()), overlap.left_bottom()),
+        Rect::from_min_max(overlap.right_top(), pos2(rect.right(), overlap.bottom())),
+    ]
+    .into_iter()
+    .filter(|r| r.is_positive())
+    .collect()
+}
+
+fn resize_cursor(direction: ResizeDirection) -> CursorIcon {
+    use {CursorIcon as C, ResizeDirection as D};
+    match direction {
+        D::North => C::ResizeNorth,
+        D::South => C::ResizeSouth,
+        D::East => C::ResizeEast,
+        D::West => C::ResizeWest,
+        D::NorthEast => C::ResizeNorthEast,
+        D::NorthWest => C::ResizeNorthWest,
+        D::SouthEast => C::ResizeSouthEast,
+        D::SouthWest => C::ResizeSouthWest,
+    }
+}
diff --git a/crates/ui/src/docking/render/preview.rs b/crates/ui/src/docking/render/preview.rs
new file mode 100644
index 00000000..b3cb6248
--- /dev/null
+++ b/crates/ui/src/docking/render/preview.rs
@@ -0,0 +1,925 @@
+use std::{collections::HashMap, fmt::Debug, hash::Hash};
+
+use egui::{Context, Key, Pos2, Rect, Ui, Vec2, pos2, vec2};
+
+use super::{DROP_MARGIN, Drawn, Renderer, clamp_float, dock::group_action};
+use crate::docking::chrome::drop_preview;
+use crate::docking::{
+    Action, Drag, DropProposal, DropRequest, DropTarget, GroupDrag, GroupGesture, Layout, Node, Placement, Target, Zone, cancel_drag,
+    dock_model::{Place, sized_split_depth},
+    surface::TAB_PADDING,
+    targets::{DockDrop, SIDE_EDGE_ZONE_DEPTH, resolve_drop_on},
+};
+use crate::layout::{SplitAxis, SplitSize};
+
+/// Ctrl (Windows, Linux) or Cmd (macOS) held: the drop floats and no target is offered.
+fn float_only(ctx: &Context) -> bool {
+    ctx.input(|i| i.modifiers.command || i.modifiers.ctrl || i.modifiers.mac_cmd)
+}
+
+/// Share of the accent that fills a tab drop's outline: light, so it does not read as a line.
+const TAB_FILL: f32 = 0.08;
+
+/// The preview of a drop that joins a group as a tab, or of the rect a drop beside something
+/// gives the moved panels: a 2 pt accent outline inside `rect`, with a light fill.
+fn tab_outline(painter: &egui::Painter, rect: Rect, accent: egui::Color32) {
+    painter.rect_filled(rect, 0.0, accent.gamma_multiply(TAB_FILL));
+    painter.rect_stroke(rect, 0.0, egui::Stroke::new(2.0, accent), egui::StrokeKind::Inside);
+}
+
+/// Height of a panel floated out of a dock column when the host gives no floating size.
+const DOCKED_FLOAT_HEIGHT: f32 = 320.0;
+
+/// Least height of a floating window or flyout fitted to a short panel's content.
+pub(super) const MIN_FITTED_HEIGHT: f32 = 120.0;
+
+/// Key of whether the area's group drag highlighted a drop target on the last frame, under the
+/// area's id. An in-window floating window that its bar drag moves fades from it on the next
+/// frame: the window draws before the preview.
+pub(super) const GROUP_HIGHLIGHTED: &str = "group-drag-highlighted";
+
+/// What finishing a drag reads of the pointer, in the coordinates of the window finishing it.
+#[derive(Clone, Copy, Debug)]
+pub(super) struct DragInput {
+    pub pointer: Option<Pos2>,
+    pub down: bool,
+    pub released: bool,
+    /// The window kept its focus: false on the pass it loses it (see [`crate::focus`]).
+    pub focused: bool,
+    /// The pointer left the window.
+    pub gone: bool,
+    pub escape: bool,
+    /// Ctrl or Cmd held.
+    pub command: bool,
+    /// A touch ended this frame.
+    pub touch_ended: bool,
+}
+
+impl DragInput {
+    /// This window's own input.
+    fn of(ctx: &Context) -> Self {
+        let command = float_only(ctx);
+        let focus_lost = crate::focus::lost(ctx);
+        ctx.input(|i| Self {
+            pointer: i.pointer.interact_pos().filter(|p| p.is_finite()),
+            down: i.pointer.primary_down(),
+            released: i.pointer.primary_released(),
+            focused: !focus_lost,
+            gone: !i.pointer.has_pointer(),
+            escape: i.key_pressed(Key::Escape),
+            command,
+            touch_ended: i.events.iter().any(|e| matches!(e, egui::Event::Touch { phase: egui::TouchPhase::End, .. })),
+        })
+    }
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
+    pub(in crate::docking) fn finish_group_drag(&mut self, ui: &Ui) {
+        let ctx = ui.ctx();
+        ctx.data_mut(|d| d.remove::<bool>(self.id.with(GROUP_HIGHLIGHTED)));
+        let key = self.id.with("group-drag");
+        let Some(drag) = ctx.data(|d| d.get_temp::<GroupDrag<P>>(key)) else { return };
+        if !drag.members.iter().all(|p| self.layout.contains(p) && self.permissions(p).movable) {
+            ctx.data_mut(|d| d.remove::<GroupDrag<P>>(key));
+            return;
+        }
+        let input = DragInput::of(ctx);
+        #[cfg(feature = "native-windows")]
+        let Some((drag, input)) = self.cross_group(ui, &drag, input) else { return };
+        let DragInput { escape, focused, down, released, pointer, .. } = input;
+        let ghost = pointer.map(|pointer| self.group_ghost(&drag, pointer));
+        if !escape
+            && focused
+            && (down || released)
+            && let Some(pointer) = pointer
+            && !self.blockers.iter().any(|r| r.contains(pointer))
+            && self.host_drop(ctx, &drag.panel, pointer, true, released, ghost.filter(|_| drag.gesture != GroupGesture::Window))
+        {
+            if released {
+                ctx.data_mut(|d| d.remove::<GroupDrag<P>>(key));
+            }
+            return;
+        }
+        // A button release outside the window may never reach egui.
+        let has_pointer = !input.gone;
+        // Touch-up also removes the pointer, but still completes a drop.
+        let touch_ended = input.touch_ended;
+        let float_only = input.command;
+        if escape || !focused || !down || !has_pointer {
+            cancel_drag::<P>(ctx, self.id);
+            if escape || !focused {
+                if drag.gesture == GroupGesture::Window {
+                    self.output.actions.push(Action::MoveFloating { panel: drag.panel, rect: drag.original });
+                }
+                return;
+            }
+            // Leaving the window ends a group drag where it is, with no drop, unless only a
+            // release outside the window floats.
+            let gone = !has_pointer && !touch_ended;
+            let floats_outside = !self.style.float_on_empty_drop && drag.gesture != GroupGesture::Window;
+            if !(released && !gone) && !(gone && floats_outside) {
+                return;
+            }
+            let Some(pointer) = pointer.filter(|p| !self.blockers.iter().any(|r| r.contains(*p))) else { return };
+            let outside = gone || !ctx.content_rect().contains(pointer);
+            match drag.gesture {
+                GroupGesture::Window => self.drop_window(&drag, pointer, float_only),
+                GroupGesture::Group | GroupGesture::Column => self.drop_group(&drag, pointer, float_only || outside),
+            }
+        } else if let Some(pointer) = pointer.filter(|p| !self.blockers.iter().any(|r| r.contains(*p))) {
+            self.output.group_drag = Some(drag.panel.clone());
+            if self.paint_group_drag(ui, &drag, pointer, float_only) {
+                ctx.data_mut(|d| d.insert_temp(self.id.with(GROUP_HIGHLIGHTED), true));
+            }
+        }
+    }
+
+    /// The valid target under the pointer for a whole group. A target holding the group
+    /// itself is a no-op proposal, and so is a drop that would change only sizes; a target
+    /// the model would reject is no target. A drag that takes a whole floating window along
+    /// looks through it ([`Self::looks_through`]). A window moving live does not split frames
+    /// or, moved by its bar, join a body's center.
+    pub(super) fn group_proposal(&self, drag: &GroupDrag<P>, pointer: Pos2) -> Option<DropProposal<P>> {
+        if let Some(proposal) = self.extra_proposal(&drag.members, pointer, self.looks_through(drag)) {
+            return self.valid_group(drag, self.settled(proposal, |to| group_action(drag, to)));
+        }
+        let target = self.group_target(drag, pointer)?;
+        self.group_proposal_at(drag, pointer, target)
+    }
+
+    /// Whether a group drag looks through the floating window it comes from: the window's
+    /// title bar moves it, or the drag holds the window's only group and so takes the window
+    /// along. The window then covers nothing behind it.
+    pub(super) fn looks_through(&self, drag: &GroupDrag<P>) -> bool {
+        match drag.gesture {
+            GroupGesture::Window => true,
+            GroupGesture::Group => self.whole_window(&drag.panel),
+            GroupGesture::Column => false,
+        }
+    }
+
+    /// The group under the pointer that a group drag addresses, past the drag's own groups
+    /// when it looks through its window.
+    fn group_target(&self, drag: &GroupDrag<P>, pointer: Pos2) -> Option<&DropTarget<P>> {
+        let through = self.looks_through(drag);
+        let own = |t: &DropTarget<P>| t.tabs.iter().any(|(p, _)| drag.members.contains(p));
+        self.targets.iter().rev().find(|t| crate::docking::targets::usable(t.rect) && t.rect.contains(pointer) && !(through && own(t)))
+    }
+
+    /// [`Self::group_proposal`] on `target` alone.
+    fn group_proposal_at(&self, drag: &GroupDrag<P>, pointer: Pos2, target: &DropTarget<P>) -> Option<DropProposal<P>> {
+        let window = drag.gesture == GroupGesture::Window;
+        if target.tabs.iter().any(|(p, _)| drag.members.contains(p)) {
+            return Some(DropProposal {
+                anchor: drag.panel.clone(),
+                placement: Placement::Tab { before: None },
+                preview: target.rect,
+                insertion: None,
+                noop: true,
+            });
+        }
+        let proposal = self.resolve_roomy(&drag.panel, pointer, std::slice::from_ref(target), |to| group_action(drag, to))?;
+        // A window moving live splits only groups of other floating windows. A native
+        // window's bar also takes the main window's frame edges, but not a body's center. A
+        // native window moved by its only tab or group joins a body's center too, as that tab
+        // or group drag would.
+        let into_window = matches!(self.place(&proposal.anchor), Some(Place::Floating { .. }));
+        #[cfg(feature = "native-windows")]
+        let (edges, joins) = (self.cross.bar, self.cross.docks);
+        #[cfg(not(feature = "native-windows"))]
+        let (edges, joins) = (false, false);
+        let split = match proposal.placement {
+            Placement::Split(Zone::Center) => !joins,
+            Placement::Split(_) | Placement::SplitSized { .. } => !edges,
+            _ => false,
+        };
+        if window && !into_window && split {
+            return None;
+        }
+        self.valid_group(drag, proposal)
+    }
+
+    /// `proposal` when it is a no-op or the model takes it for the whole group.
+    fn valid_group(&self, drag: &GroupDrag<P>, proposal: DropProposal<P>) -> Option<DropProposal<P>> {
+        let to = Target::At { anchor: proposal.anchor.clone(), placement: proposal.placement.clone() };
+        (proposal.noop || self.layout.clone().apply_with_permissions(group_action(drag, to), |p| self.permissions(p)).is_ok()).then_some(proposal)
+    }
+
+    /// [`crate::docking::resolve_drop_by`] with [`crate::docking::DockStyle::zone_rule`] and the
+    /// canvas sides of [`crate::docking::DockStyle::drop_edges`] (none in the docking profile),
+    /// where a split that would leave a group without room becomes a join of the target group,
+    /// or no target when the group takes no tabs. A drop that would change only sizes is a no-op ([`Self::settled`]).
+    fn resolve_roomy(&self, panel: &P, pointer: Pos2, targets: &[DropTarget<P>], action: impl Fn(Target<P>) -> Action<P>) -> Option<DropProposal<P>> {
+        let proposal = resolve_drop_on(panel, pointer, targets, self.style.zone_rule(), self.style.canvas_sides())?;
+        if !matches!(proposal.placement, Placement::Split(zone) if zone != Zone::Center) {
+            return Some(self.settled(proposal, action));
+        }
+        if self.leaves_room(action(Target::At { anchor: proposal.anchor.clone(), placement: proposal.placement.clone() })) {
+            return Some(self.settled(proposal, action));
+        }
+        if let Some(placement) = self.sized_split(panel, &proposal, &action)
+            && self.leaves_room(action(Target::At { anchor: proposal.anchor.clone(), placement: placement.clone() }))
+        {
+            return Some(self.settled(DropProposal { placement, ..proposal }, action));
+        }
+        let target = targets.iter().rev().find(|t| crate::docking::targets::usable(t.rect) && t.rect.contains(pointer))?;
+        let proposal = resolve_drop_on(
+            panel,
+            pointer,
+            std::slice::from_ref(&DropTarget { allow_splits: false, ..target.clone() }),
+            self.style.zone_rule(),
+            self.style.canvas_sides(),
+        )?;
+        Some(self.settled(proposal, action))
+    }
+
+    /// The side split of `proposal`'s frame when halving it leaves no room
+    /// ([`Placement::SplitSized`]): the frame keeps its size, and the frames beyond the divider
+    /// on that side, or on the opposite side for a frame at the edge of its area, give the new
+    /// frame its minimum (with [`DROP_MARGIN`]). A floating panel
+    /// keeps its size along the split instead, and one in a dock column its column's width or
+    /// its group's height, when that fits. `None` without such a divider, or when those frames
+    /// cannot give the new frame its minimum.
+    fn sized_split(&self, panel: &P, proposal: &DropProposal<P>, action: &impl Fn(Target<P>) -> Action<P>) -> Option<Placement<P>> {
+        let Placement::Split(zone) = proposal.placement else { return None };
+        let axis = if matches!(zone, Zone::Top | Zone::Bottom) { SplitAxis::Vertical } else { SplitAxis::Horizontal };
+        let along = |v: Vec2| if axis == SplitAxis::Horizontal { v.x } else { v.y };
+        let start = matches!(zone, Zone::Left | Zone::Top);
+        let anchor = &proposal.anchor;
+        let now = self.drawn_groups(self.layout);
+        let frame = along(now.iter().find(|(node, _)| holds(node, anchor))?.1.size());
+        let mut candidate = self.layout.clone();
+        let halves = action(Target::At { anchor: anchor.clone(), placement: proposal.placement.clone() });
+        candidate.apply_with_permissions(halves, |p| self.permissions(p)).ok()?;
+        let (root, area, path) = match candidate.place(anchor)? {
+            Place::Node(path) => (candidate.root.as_ref()?, self.workspace, path),
+            Place::Floating { window, path } => {
+                let window = candidate.floating.get(window)?;
+                (&window.root, self.window_body(window), path)
+            }
+            Place::Dock { .. } => return None,
+        };
+        // The splits from the root down to the new one, as drawn with halves.
+        let sizer = self.sizer();
+        let (_, split_path) = path.split_last()?;
+        let mut chain = vec![(root, area)];
+        for &second in split_path {
+            let &(node, rect) = chain.last()?;
+            let [a, b] = sizer.children(node, rect)?;
+            chain.push(if second { b } else { a });
+        }
+        let &(Node::Split { first, second, .. }, halved) = chain.last()? else { return None };
+        let new = if start { first } else { second };
+        let depth =
+            sized_split_depth(split_path, zone, |d| chain.get(d).is_some_and(|(n, _)| matches!(n, Node::Split { axis: own, .. } if *own == axis)))?;
+        // The frame is in the outer split's second child when the divider is on its start side.
+        let in_second = *split_path.get(depth)?;
+        let &(outer, outer_rect) = chain.get(depth)?;
+        let Node::Split { size: outer_size, first: a, second: b, .. } = outer else { return None };
+        if matches!(**a, Node::Dock { .. }) || matches!(**b, Node::Dock { .. }) {
+            return None;
+        }
+        let [a, b] = sizer.children(outer, outer_rect)?;
+        let far = if in_second { a } else { b };
+        // The far side's edge at the divider is its end edge when the frame is in the second
+        // child.
+        let room = sizer.travel(far.0, far.1, axis, in_second).0 - DROP_MARGIN;
+        let least = along(super::node_limits(new, self.style, &*self.content).min) + DROP_MARGIN;
+        let gap = self.style.gap;
+        // A split frame's width is its share of the room, not one of its own.
+        let saved = match self.place(panel) {
+            Some(Place::Floating { .. }) => now.iter().find(|(node, _)| holds(node, panel)).map(|(_, rect)| along(rect.size())),
+            Some(place @ Place::Dock { .. }) if axis == SplitAxis::Horizontal => self.layout.column(place).map(|column| column.width),
+            Some(place @ Place::Dock { .. }) => self.layout.group(place).and_then(|group| group.height),
+            _ => None,
+        };
+        let most = along(halved.size()) + room - frame - gap;
+        if least > most {
+            return None;
+        }
+        let size = saved.filter(|width| (least..=most).contains(width)).unwrap_or(least);
+        // The anchor's side of the outer split grows by what the halves did not take already.
+        let grow = frame + gap + size - along(halved.size());
+        let first = along(a.1.size()) + if in_second { -grow } else { grow };
+        let outer = super::sizes::resized(*outer_size, first, along(a.1.size()) + along(b.1.size()))?;
+        let size = super::sizes::resized(SplitSize::Ratio(0.5), if start { size } else { frame }, frame + size)?;
+        Some(Placement::SplitSized { zone, size, outer })
+    }
+
+    /// Every group of `layout`'s trees as drawn, with its rect.
+    fn drawn_groups<'l>(&self, layout: &'l Layout<P>) -> Vec<(&'l Node<P>, Rect)> {
+        let sizer = self.sizer();
+        let mut out = Vec::new();
+        for (root, area) in self.trees(layout) {
+            let mut drawn = Vec::new();
+            sizer.groups(root, area, &mut drawn);
+            out.extend(drawn.into_iter().map(|d| (d.node, d.rect)));
+        }
+        out
+    }
+
+    /// `proposal`, marked a no-op when `action` at it would leave every panel where it is,
+    /// changing only sizes ([`Layout::same_arrangement`]): a lone group dropped beside the
+    /// group it already borders, or a tab on the edge its frame already holds. Such a drop
+    /// shows no target and changes nothing.
+    fn settled(&self, mut proposal: DropProposal<P>, action: impl Fn(Target<P>) -> Action<P>) -> DropProposal<P> {
+        if !proposal.noop {
+            let mut candidate = self.layout.clone();
+            let to = Target::At { anchor: proposal.anchor.clone(), placement: proposal.placement.clone() };
+            proposal.noop = candidate.apply_with_permissions(action(to), |p| self.permissions(p)).is_ok() && candidate.same_arrangement(self.layout);
+        }
+        proposal
+    }
+
+    /// Whether `action`, a drop that splits a group or the outer edge, leaves room: every group
+    /// it makes smaller keeps its minimum, and each divider can still travel both ways. A group
+    /// within [`DROP_MARGIN`] of its minimum along an axis passes when the dividers along its
+    /// sides can travel, the groups beyond it giving way as they do for a dragged divider, so a
+    /// narrow group still splits when its neighbours have room for both halves. An action the
+    /// model rejects is left to the model's check.
+    pub(super) fn leaves_room(&self, action: Action<P>) -> bool {
+        let mut candidate = self.layout.clone();
+        if candidate.apply_with_permissions(action, |p| self.permissions(p)).is_err() {
+            return true;
+        }
+        let sizer = self.sizer();
+        let drawn = |root: &Node<P>, area: Rect| {
+            let mut out: Vec<Drawn<'_, P>> = Vec::new();
+            sizer.groups(root, area, &mut out);
+            out.into_iter().filter_map(|d| Some((lead(d.node)?.clone(), d.rect, d.limits.min))).collect::<Vec<_>>()
+        };
+        let before: HashMap<P, Vec2> =
+            self.trees(self.layout).into_iter().flat_map(|(root, area)| drawn(root, area)).map(|(panel, rect, _)| (panel, rect.size())).collect();
+        self.trees(&candidate).into_iter().all(|(root, area)| {
+            drawn(root, area).into_iter().all(|(panel, rect, min)| {
+                let (size, room) = (rect.size(), rect.size() - min);
+                let fits = |room: f32, axis| room >= DROP_MARGIN || sizer.frees((root, area), rect, axis);
+                before.get(&panel).is_some_and(|old| size.x >= old.x - 0.5 && size.y >= old.y - 0.5)
+                    || (room.min_elem() > -0.01 && fits(room.x, SplitAxis::Horizontal) && fits(room.y, SplitAxis::Vertical))
+            })
+        })
+    }
+
+    /// The trees of `layout` as drawn: the docked root in the workspace and each open floating
+    /// window's tree in its body.
+    fn trees<'l>(&self, layout: &'l Layout<P>) -> Vec<(&'l Node<P>, Rect)> {
+        let windows = layout.floating.iter().filter(|w| !w.minimized).map(|w| (&w.root, self.window_body(w)));
+        layout.root.iter().map(|root| (root, self.workspace)).chain(windows).collect()
+    }
+
+    /// Release of a group drag: join or split at the target, or float at the ghost with the
+    /// group's size. Over its own docked position, or where the drop would change only sizes,
+    /// nothing changes; a floating group released over itself or a window's title bar moves
+    /// there.
+    fn drop_group(&mut self, drag: &GroupDrag<P>, pointer: Pos2, float_only: bool) {
+        if pointer.distance(drag.origin) < 2.0 {
+            return;
+        }
+        if !float_only && let Some((action, _)) = self.dock_group_proposal(drag, pointer) {
+            self.output.actions.extend(action);
+            return;
+        }
+        let floating = matches!(self.place(&drag.panel), Some(Place::Floating { .. }));
+        let proposal = if float_only { None } else { self.group_proposal(drag, pointer) };
+        if let Some(proposal) = proposal.as_ref().filter(|p| !p.noop) {
+            let to = Target::At { anchor: proposal.anchor.clone(), placement: proposal.placement.clone() };
+            self.output.actions.push(group_action(drag, to));
+            return;
+        }
+        // A no-op anchored on another group would change only sizes.
+        if proposal.is_some_and(|p| !floating || !drag.members.contains(&p.anchor)) {
+            return;
+        }
+        if !float_only && !self.style.float_on_empty_drop {
+            return;
+        }
+        // No target: hosts that still apply their own policy for a whole-group release get it.
+        self.output.group_drop = Some((drag.panel.clone(), pointer));
+        let rect = self.group_ghost(drag, pointer);
+        let action = group_action(drag, Target::Float { rect: Some([rect.left(), rect.top(), rect.width(), rect.height()]) });
+        if self.layout.clone().apply_with_permissions(action.clone(), |p| self.permissions(p)).is_ok() {
+            self.output.actions.push(action);
+        }
+    }
+
+    /// The ghost at the pointer (a window moving live is its own ghost) under one destination
+    /// preview. The ghost has a translucent fill, a 2 pt outline and the members' labels.
+    /// Returns whether it highlighted a drop target.
+    pub(super) fn paint_group_drag(&mut self, ui: &Ui, drag: &GroupDrag<P>, pointer: Pos2, float_only: bool) -> bool {
+        let ctx = ui.ctx();
+        let painter = self.preview_painter(ctx);
+        if drag.gesture != GroupGesture::Window {
+            let ghost = self.group_ghost(drag, pointer);
+            drop_preview(&painter, ghost, self.style.accent, true);
+            let strip = Rect::from_min_size(ghost.min, vec2(ghost.width(), self.style.tab_height.min(ghost.height())));
+            let labels = painter.with_clip_rect(strip.shrink(2.0));
+            let mut x = strip.left() + TAB_PADDING * 0.5;
+            for panel in &drag.members {
+                let width = strip.right() - TAB_PADDING * 0.5 - x;
+                if width <= 0.0 {
+                    break;
+                }
+                let label = self.label_of(panel);
+                let galley = self.tab_label(ui, panel, &label, self.style.text, width);
+                let advance = galley.size().x + TAB_PADDING;
+                labels.galley(pos2(x, strip.center().y - galley.size().y * 0.5), galley, self.style.text);
+                x += advance;
+            }
+        }
+        if float_only || (drag.gesture == GroupGesture::Window && !self.title_bar_docks()) {
+            return false;
+        }
+        if let Some((action, drop)) = self.dock_group_proposal(drag, pointer) {
+            let highlighted = action.is_some();
+            if let Some(action) = action {
+                self.paint_dock_preview(ctx, &painter, action, &drag.members, &drop);
+                if drag.gesture != GroupGesture::Window {
+                    self.paint_float_hint(ctx, pointer);
+                }
+            }
+            return highlighted;
+        }
+        let proposal = self.group_proposal(drag, pointer).filter(|p| !p.noop);
+        let zones = self.paint_group_zones(&painter, drag, pointer, proposal.as_ref());
+        if let Some(proposal) = proposal {
+            if zones {
+                self.paint_marker(&painter, &proposal);
+            } else {
+                let split = matches!(proposal.placement, Placement::Split(zone) | Placement::SplitSized { zone, .. } | Placement::Edge(zone) if zone != Zone::Center);
+                self.paint_preview(ctx, &painter, &proposal, split, &drag.members, |to| group_action(drag, to));
+            }
+            if drag.gesture != GroupGesture::Window {
+                self.paint_float_hint(ctx, pointer);
+            }
+            return true;
+        }
+        false
+    }
+
+    pub(in crate::docking) fn finish_drag(&mut self, ctx: &Context) {
+        let Some(drag) = ctx.data(|d| d.get_temp::<Drag<P>>(self.id.with("drag"))) else { return };
+        let escape = ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, Key::Escape));
+        let input = DragInput { escape, ..DragInput::of(ctx) };
+        #[cfg(feature = "native-windows")]
+        let Some((drag, input)) = self.cross_tab(ctx, &drag, input) else { return };
+        let DragInput { pointer, down, released, focused, gone, escape, .. } = input;
+        // Leaving the window is the drop: on X11 and Windows the release outside never reaches
+        // egui, so the drag would otherwise stay on the pointer. `interact_pos` still holds the
+        // last position this frame, and the panel floats there rather than docking at the edge.
+        // With native viewports the release does arrive, and `gone` is false.
+        let released = released || gone;
+        if escape || !focused || !self.layout.contains(&drag.panel) || (!down && !released) {
+            cancel_drag::<P>(ctx, self.id);
+            return;
+        }
+        let Some(pointer) = pointer.filter(|p| p.is_finite()) else {
+            if released {
+                cancel_drag::<P>(ctx, self.id);
+            }
+            return;
+        };
+        if self.blockers.iter().any(|rect| rect.contains(pointer)) {
+            if released {
+                cancel_drag::<P>(ctx, self.id);
+            }
+            return;
+        }
+        let float_only = input.command || drag.undock;
+        let outside = gone || !ctx.content_rect().contains(pointer);
+        let empty_drop =
+            self.style.float_on_empty_drop && (!drag.source.contains(pointer) || self.layout.floating.iter().any(|g| g.contains(&drag.panel)));
+        let floatable = self.permissions(&drag.panel).floatable && (float_only || outside || empty_drop);
+        let floating_rect = floatable.then(|| self.tab_float_rect(&drag, pointer));
+        if self.host_drop(ctx, &drag.panel, pointer, false, released, floating_rect) {
+            if released {
+                cancel_drag::<P>(ctx, self.id);
+            }
+            return;
+        }
+        let dock = if float_only || outside { None } else { self.dock_tab_proposal(&drag.panel, pointer) };
+        if let Some((action, drop)) = dock {
+            if released {
+                cancel_drag::<P>(ctx, self.id);
+                if let Some(action) = action.filter(|_| pointer.distance(drag.origin) >= 2.0) {
+                    self.output.actions.push(action);
+                    self.output.focused = Some(drag.panel);
+                }
+            } else if let Some(action) = action {
+                let painter = self.preview_painter(ctx);
+                self.paint_dock_preview(ctx, &painter, action, std::slice::from_ref(&drag.panel), &drop);
+                self.paint_float_hint(ctx, pointer);
+            }
+            return;
+        }
+        let proposal = if float_only { None } else { self.tab_proposal(&drag.panel, pointer) };
+        if released {
+            cancel_drag::<P>(ctx, self.id);
+            if pointer.distance(drag.origin) < 2.0 || proposal.as_ref().is_some_and(|proposal| proposal.noop && !outside) {
+                return;
+            }
+            let action = if let Some(proposal) = proposal.filter(|_| !outside) {
+                Some(Action::Move { panel: drag.panel.clone(), anchor: proposal.anchor, placement: proposal.placement })
+            } else if let Some(rect) = floating_rect {
+                Some(Action::Float { panel: drag.panel.clone(), rect: [rect.left(), rect.top(), rect.width(), rect.height()] })
+            } else {
+                None
+            };
+            if let Some(action) = action {
+                // Validate the proposed gesture against the same complete snapshot. The app
+                // still applies it via its own command path after body rendering finishes.
+                let mut candidate = self.layout.clone();
+                if candidate.apply_with_permissions(action.clone(), |p| self.permissions(p)).is_ok() {
+                    self.output.actions.push(action);
+                    self.output.focused = Some(drag.panel);
+                }
+            }
+            return;
+        }
+        let painter = self.preview_painter(ctx);
+        if !float_only {
+            self.paint_tab_proposal(ctx, &painter, &drag, proposal.as_ref(), pointer);
+        }
+        if let (None, Some(rect)) = (&proposal, floating_rect) {
+            drop_preview(&painter, rect, self.style.accent, false);
+        }
+    }
+
+    /// The group target a single tab drag would take at `pointer`.
+    pub(super) fn tab_proposal(&self, panel: &P, pointer: Pos2) -> Option<DropProposal<P>> {
+        let action = |to| tab_action(panel, to);
+        match self.extra_proposal(std::slice::from_ref(panel), pointer, false) {
+            Some(proposal) => Some(self.settled(proposal, action)),
+            None => self.resolve_roomy(panel, pointer, &self.targets, action),
+        }
+    }
+
+    /// The preview of a tab drag's group target (with
+    /// [`crate::docking::DockStyle::side_edge_zones`], the zones of the group under the pointer),
+    /// and the undock hint.
+    pub(super) fn paint_tab_proposal(
+        &self,
+        ctx: &Context,
+        painter: &egui::Painter,
+        drag: &Drag<P>,
+        proposal: Option<&DropProposal<P>>,
+        pointer: Pos2,
+    ) {
+        let zones = self.paint_tab_zones(painter, &drag.panel, pointer, proposal);
+        let Some(proposal) = proposal else { return };
+        // Reordering inside the source strip shows only the insertion line.
+        let same_group = proposal.insertion.is_some()
+            && self.targets.iter().any(|target| target.rect == proposal.preview && target.tabs.iter().any(|(panel, _)| panel == &drag.panel));
+        if !same_group && !proposal.noop && !zones {
+            self.paint_preview(ctx, painter, proposal, true, std::slice::from_ref(&drag.panel), |to| tab_action(&drag.panel, to));
+        } else {
+            self.paint_marker(painter, proposal);
+        }
+        if !proposal.noop {
+            self.paint_float_hint(ctx, pointer);
+        }
+    }
+
+    /// The preview of a group target, for tab and group drags of `members`, which `action` moves
+    /// there: for a drop beside the group, the rect the members then take
+    /// ([`Self::result_rect`]); on the layout's outer edge band, the line along that edge; else
+    /// the tab outline of the whole group, and the insertion marker on a strip. With
+    /// [`crate::docking::DockStyle::side_edge_zones`], the region the drop takes, filled for a
+    /// tab drag (`filled`) or a split.
+    fn paint_preview(
+        &self,
+        ctx: &Context,
+        painter: &egui::Painter,
+        proposal: &DropProposal<P>,
+        filled: bool,
+        members: &[P],
+        action: impl Fn(Target<P>) -> Action<P>,
+    ) {
+        if crate::docking::targets::usable(proposal.preview) {
+            let beside = matches!(proposal.placement, Placement::Split(zone) | Placement::SplitSized { zone, .. } if zone != Zone::Center);
+            if self.style.side_edge_zones {
+                drop_preview(painter, proposal.preview.shrink(1.0), self.style.accent, filled);
+            } else if matches!(proposal.placement, Placement::Edge(_)) {
+                self.paint_drop_line(ctx, proposal.preview, true);
+            } else if beside {
+                let to = Target::At { anchor: proposal.anchor.clone(), placement: proposal.placement.clone() };
+                match self.result_rect(action(to), members) {
+                    Some(rect) => tab_outline(painter, rect.shrink(1.0), self.style.accent),
+                    None => self.paint_drop_line(ctx, proposal.preview, false),
+                }
+            } else {
+                tab_outline(painter, proposal.preview.shrink(1.0), self.style.accent);
+            }
+        }
+        self.paint_marker(painter, proposal);
+    }
+
+    /// The preview of a dock drop that `action` makes of `members`: the rect they then take
+    /// ([`Self::result_rect`]). A drop on the window edge ([`DockDrop::outer`]) or into an
+    /// iconic column, and any dock drop with [`crate::docking::DockStyle::side_edge_zones`],
+    /// shows the drop's line.
+    fn paint_dock_preview(&self, ctx: &Context, painter: &egui::Painter, action: Action<P>, members: &[P], drop: &DockDrop<P>) {
+        let rect = (!self.style.side_edge_zones && !drop.outer).then_some(action).and_then(|action| self.result_rect(action, members));
+        match rect {
+            Some(rect) => tab_outline(painter, rect.shrink(1.0), self.style.accent),
+            None => self.paint_drop_line(ctx, drop.line, drop.outer),
+        }
+    }
+
+    /// Where `members` are drawn once `action` is applied, laid out by the code that draws the
+    /// layout: the union of the rects of the groups that hold them, or the rect of the dock
+    /// column they make up alone. A floating window's tree is laid out in its body as drawn
+    /// this frame. In a dock column that scrolls, a group's rect sits at the column's scroll
+    /// offset this frame and is clipped to the column's body. `None` when the model rejects `action`, or when the members join an iconic column,
+    /// whose icons show no rect.
+    pub(super) fn result_rect(&self, action: Action<P>, members: &[P]) -> Option<Rect> {
+        let mut candidate = self.layout.clone();
+        candidate.apply_with_permissions(action, |p| self.permissions(p)).ok()?;
+        let moved = |panels: &[P]| panels.iter().any(|p| members.contains(p));
+        let sizer = self.sizer();
+        let mut rects = Vec::new();
+        for (root, area) in self.drawn_trees(&candidate, members) {
+            let mut drawn = Vec::new();
+            sizer.groups(root, area, &mut drawn);
+            for Drawn { node, rect, .. } in drawn {
+                let Node::Dock { side, columns } = node else {
+                    if members.iter().any(|p| holds(node, p)) {
+                        rects.push(rect);
+                    }
+                    continue;
+                };
+                for (index, _, rect) in self.dock_columns(*side, columns, rect).rects {
+                    let Some(column) = columns.get(index).filter(|c| c.groups.iter().any(|g| moved(&g.panels))) else { continue };
+                    if column.groups.iter().flat_map(|g| &g.panels).all(|p| members.contains(p)) {
+                        rects.push(rect);
+                        continue;
+                    }
+                    if column.iconic {
+                        return None;
+                    }
+                    let (_, body, heights) = self.column_layout(column, rect);
+                    // The column keeps the scroll state of its first panel, as drawn.
+                    let overflow = (heights.iter().sum::<f32>() - body.height()).max(0.0);
+                    let scroll = column.groups.first().and_then(|g| g.panels.first()).and_then(|p| self.column_scroll.get(p));
+                    let area = body.translate(vec2(0.0, -scroll.copied().unwrap_or(0.0).min(overflow)));
+                    let groups = column.groups.iter().zip(super::dock::stacked(area, &heights));
+                    rects.extend(groups.filter(|(g, _)| moved(&g.panels)).map(|(_, rect)| rect.intersect(body)));
+                }
+            }
+        }
+        rects.into_iter().filter(|r| crate::docking::targets::usable(*r)).reduce(Rect::union)
+    }
+
+    /// [`Self::trees`] of `layout`, where a floating window that holds a panel other than
+    /// `members` is laid out in the body that window is drawn in this frame.
+    fn drawn_trees<'l>(&self, layout: &'l Layout<P>, members: &[P]) -> Vec<(&'l Node<P>, Rect)> {
+        let body = |window: &crate::docking::Floating<P>| {
+            let stays = |p: &&P| !members.contains(*p);
+            let hit = self.frame.windows.iter().find(|hit| window.panels().filter(stays).any(|p| hit.members.contains(p)));
+            hit.map_or_else(|| self.window_body(window), |hit| hit.body)
+        };
+        let windows = layout.floating.iter().filter(|w| !w.minimized).map(|w| (&w.root, body(w)));
+        layout.root.iter().map(|root| (root, self.workspace)).chain(windows).collect()
+    }
+
+    /// The insertion marker of a drop on a tab strip.
+    fn paint_marker(&self, painter: &egui::Painter, proposal: &DropProposal<P>) {
+        if let Some(marker) = proposal.insertion {
+            painter.rect_filled(marker, 0.0, self.style.accent);
+        }
+    }
+
+    /// [`Self::paint_zones`] for a tab drag of `panel`. The center of the group holding the panel
+    /// is not a target: a drop there reorders or changes nothing.
+    pub(super) fn paint_tab_zones(&self, painter: &egui::Painter, panel: &P, pointer: Pos2, proposal: Option<&DropProposal<P>>) -> bool {
+        if !self.style.side_edge_zones || self.extra_proposal(std::slice::from_ref(panel), pointer, false).is_some() {
+            return false;
+        }
+        let Some(target) = self.targets.iter().rev().find(|t| crate::docking::targets::usable(t.rect) && t.rect.contains(pointer)) else {
+            return false;
+        };
+        let own = target.tabs.iter().any(|(p, _)| p == panel);
+        let at = |at: Pos2| {
+            let move_to = |to| tab_action(panel, to);
+            let proposal = self.resolve_roomy(panel, at, std::slice::from_ref(target), move_to)?;
+            let to = Target::At { anchor: proposal.anchor.clone(), placement: proposal.placement.clone() };
+            let joins = matches!(proposal.placement, Placement::Tab { .. } | Placement::Split(Zone::Center));
+            (!(own && joins) && self.layout.clone().apply_with_permissions(move_to(to), |p| self.permissions(p)).is_ok()).then_some(proposal)
+        };
+        self.paint_zones(painter, target, proposal, at)
+    }
+
+    /// [`Self::paint_zones`] for a group drag.
+    pub(super) fn paint_group_zones(&self, painter: &egui::Painter, drag: &GroupDrag<P>, pointer: Pos2, proposal: Option<&DropProposal<P>>) -> bool {
+        if !self.style.side_edge_zones || self.extra_proposal(&drag.members, pointer, self.looks_through(drag)).is_some() {
+            return false;
+        }
+        let Some(target) = self.group_target(drag, pointer) else { return false };
+        self.paint_zones(painter, target, proposal, |at| self.group_proposal_at(drag, at, target))
+    }
+
+    /// With [`crate::docking::DockStyle::side_edge_zones`], a drag over a group outlines each
+    /// of its drop zones that a drop would change something in (a side's trapezoid, the center
+    /// rectangle, the tab strip as part of the center) and fills the zone of `proposal`, the
+    /// drop under the pointer. `at` is the drop a point of `target` would get. False when it
+    /// painted nothing.
+    fn paint_zones(
+        &self,
+        painter: &egui::Painter,
+        target: &DropTarget<P>,
+        proposal: Option<&DropProposal<P>>,
+        at: impl Fn(Pos2) -> Option<DropProposal<P>>,
+    ) -> bool {
+        use crate::docking::targets::{header_height, usable, zone_shape};
+        let zone_of = |proposal: &DropProposal<P>| match proposal.placement {
+            _ if proposal.noop => None,
+            Placement::Split(zone) | Placement::SplitSized { zone, .. } => Some(zone),
+            Placement::Tab { .. } => Some(Zone::Center),
+            _ => None,
+        };
+        let header = header_height(target);
+        let centroid = |points: &[Pos2]| points.iter().fold(Vec2::ZERO, |sum, p| sum + p.to_vec2()) / points.len() as f32;
+        let takes = |zone: Zone, point: Pos2| at(point).as_ref().and_then(zone_of) == Some(zone);
+        let mut shapes: Vec<(Zone, Vec<Pos2>)> = [Zone::Left, Zone::Right, Zone::Top, Zone::Bottom, Zone::Center]
+            .into_iter()
+            .filter_map(|zone| Some((zone, zone_shape(target.rect, header, SIDE_EDGE_ZONE_DEPTH, zone)?)))
+            .filter(|(zone, points)| takes(*zone, centroid(points).to_pos2()))
+            .collect();
+        let strip = target.tab_strip.map(|strip| strip.intersect(target.rect)).filter(|strip| usable(*strip) && takes(Zone::Center, strip.center()));
+        if let Some(strip) = strip {
+            shapes.push((Zone::Center, vec![strip.left_top(), strip.right_top(), strip.right_bottom(), strip.left_bottom()]));
+        }
+        if shapes.is_empty() {
+            return false;
+        }
+        let hovered = proposal.and_then(zone_of);
+        let fill = self.style.accent.gamma_multiply(0.3);
+        for (_, points) in shapes.iter().filter(|(zone, _)| Some(*zone) == hovered) {
+            painter.add(egui::Shape::convex_polygon(points.clone(), fill, egui::Stroke::NONE));
+        }
+        let stroke = egui::Stroke::new(1.0, self.style.accent.gamma_multiply(0.6));
+        for (_, points) in shapes {
+            painter.add(egui::Shape::closed_line(points, stroke));
+        }
+        true
+    }
+
+    /// The single drop preview layer, above every floating window.
+    pub(super) fn preview_painter(&self, ctx: &Context) -> egui::Painter {
+        let layer = egui::LayerId::new(egui::Order::Tooltip, self.id.with("drop-preview"));
+        ctx.move_to_top(layer);
+        ctx.layer_painter(layer)
+    }
+
+    /// Size of a panel floated by a drag or the Float menu: the host's floating size, else the
+    /// source size within the panel limits. Out of a dock or frame, or with a floating size, the
+    /// height fits the content the panel last drew, up to that height (else 320). Content that
+    /// filled its body floats at that height.
+    pub(super) fn float_size(&self, panel: &P, source: Vec2) -> Vec2 {
+        let chrome = self.style.title_height + self.style.tab_height;
+        if let Some(size) = self.content.floating_size(panel).filter(|s| s.is_finite() && s.x > 0.0 && s.y > 0.0) {
+            return vec2(size.x, self.fitted_height(panel, chrome, size.y).unwrap_or(size.y));
+        }
+        let mut size = self.iconic.float_width(panel).map_or(source, |width| vec2(width, DOCKED_FLOAT_HEIGHT));
+        if matches!(self.place(panel), Some(Place::Dock { .. } | Place::Node(_))) {
+            size.y = match self.fitted_height(panel, chrome, DOCKED_FLOAT_HEIGHT) {
+                Some(height) => height,
+                None if self.content_height(panel) == Some(None) => DOCKED_FLOAT_HEIGHT,
+                None => size.y.min(DOCKED_FLOAT_HEIGHT),
+            };
+        }
+        let limits = self.limits(panel);
+        let header = vec2(0.0, self.style.tab_height);
+        size.max(limits.min + header).min(limits.max + header)
+    }
+
+    /// Height of a window around `panel`'s group: `chrome` (title bar and tab strip) and the
+    /// content height the panel last drew, at least [`MIN_FITTED_HEIGHT`] and at most `max`.
+    /// `None` for a panel the area has not drawn.
+    pub(super) fn fitted_height(&self, panel: &P, chrome: f32, max: f32) -> Option<f32> {
+        let content = self.content_height(panel).flatten()?;
+        Some((chrome + content).max(MIN_FITTED_HEIGHT).min(max))
+    }
+
+    /// Record what a drag floats from `panels`, one group drawn at `group` whose panels drag
+    /// from `panel` rects, for commands that float without a rect.
+    pub(super) fn record_float(&mut self, panels: &[P], panel: Vec2, group: Vec2) {
+        let group = self.group_float_size(panels, group);
+        for p in panels {
+            let size = self.float_size(p, panel);
+            self.float_space.panels.push((p.clone(), size));
+            self.float_space.groups.push((p.clone(), group));
+        }
+    }
+
+    /// Record what a drag floats from a dock column drawn at `rect`.
+    pub(super) fn record_column_float(&mut self, members: Vec<P>, rect: Rect) {
+        let size = self.group_float_size(&members, rect.size());
+        self.float_space.columns.extend(members.into_iter().map(|p| (p, size)));
+    }
+
+    /// Size of a group or column floated by a drag or Float Tab Group: the source width, and the
+    /// tallest member's floating height, else the source height capped like a panel leaving a
+    /// dock column. A group fits that height to its active panel's content. A group that already
+    /// floats keeps its size.
+    pub(super) fn group_float_size(&self, members: &[P], source: Vec2) -> Vec2 {
+        let Some(place) = members.first().and_then(|panel| self.place(panel)) else { return source };
+        if matches!(place, Place::Floating { .. }) {
+            return source;
+        }
+        let valid = |s: &Vec2| s.is_finite() && s.x > 0.0 && s.y > 0.0;
+        let host = members.iter().filter_map(|panel| self.content.floating_size(panel).filter(valid)).map(|s| s.y).reduce(f32::max);
+        let docked = matches!(place, Place::Dock { .. });
+        let chrome = self.style.title_height + self.style.tab_height;
+        let max = host.or(docked.then_some(DOCKED_FLOAT_HEIGHT));
+        let fitted = max.and_then(|max| self.group_active(members, place).and_then(|active| self.fitted_height(active, chrome, max)));
+        vec2(source.x, fitted.or(host).unwrap_or(if docked { source.y.min(DOCKED_FLOAT_HEIGHT) } else { source.y }))
+    }
+
+    /// The active panel of the group at `place` when `members` are that whole group.
+    fn group_active<'a>(&'a self, members: &[P], place: &Place) -> Option<&'a P> {
+        let (panels, active) = match place {
+            Place::Node(_) | Place::Floating { .. } => match self.layout.node_of(place) {
+                Some(Node::Tabs { panels, active }) => (panels, *active),
+                _ => return None,
+            },
+            _ => self.layout.group(place).map(|group| (&group.panels, group.active))?,
+        };
+        (panels.len() == members.len() && members.iter().all(|m| panels.contains(m))).then(|| panels.get(active)).flatten()
+    }
+
+    /// Where a group or column drag floats with the pointer at `pointer`, keeping the grab
+    /// offset, inside the window (Z2).
+    fn group_ghost(&self, drag: &GroupDrag<P>, pointer: Pos2) -> Rect {
+        let size = if drag.gesture == GroupGesture::Window { drag.source.size() } else { self.group_float_size(&drag.members, drag.source.size()) };
+        let grab = (drag.origin - drag.source.min).clamp(Vec2::ZERO, size);
+        clamp_float(Rect::from_min_size(pointer - grab, size), self.float_bounds)
+    }
+
+    fn tab_float_rect(&self, drag: &Drag<P>, pointer: Pos2) -> Rect {
+        let size = self.float_size(&drag.panel, drag.source.size());
+        let grab = drag.grab.min(vec2(size.x, self.style.tab_height));
+        clamp_float(Rect::from_min_size(pointer - grab, size), self.float_bounds)
+    }
+
+    /// Offer the gesture to [`crate::docking::DockContent::resolve_drag`]. True when the host
+    /// owns it; its feedback replaces the renderer's preview.
+    pub(super) fn host_drop(
+        &mut self,
+        ctx: &Context,
+        panel: &P,
+        pointer: Pos2,
+        whole_group: bool,
+        released: bool,
+        floating_rect: Option<Rect>,
+    ) -> bool {
+        let request = DropRequest {
+            panel,
+            pointer,
+            targets: &self.targets,
+            floating_rect,
+            whole_group,
+            released,
+            workspace: self.workspace,
+            screen: self.float_bounds,
+        };
+        let Some(feedback) = self.content.resolve_drag(ctx, self.style, &request) else { return false };
+        if !released {
+            let painter = self.preview_painter(ctx);
+            if let Some(rect) = feedback.preview.filter(|rect| crate::docking::targets::usable(*rect)) {
+                drop_preview(&painter, rect, self.style.accent, true);
+                // A window moving by its title bar fades over it, as over the renderer's own.
+                ctx.data_mut(|d| d.insert_temp(self.id.with(GROUP_HIGHLIGHTED), true));
+            }
+            if let Some(rect) = feedback.insertion.filter(|rect| crate::docking::targets::usable(*rect)) {
+                painter.rect_filled(rect, 0.0, self.style.accent);
+            }
+        }
+        true
+    }
+}
+
+/// The move a single tab's drag makes.
+fn tab_action<P: Clone>(panel: &P, to: Target<P>) -> Action<P> {
+    match to {
+        Target::At { anchor, placement } => Action::Move { panel: panel.clone(), anchor, placement },
+        to => Action::MovePanel { panel: panel.clone(), to },
+    }
+}
+
+/// Whether the drawn group `node` holds `panel`.
+fn holds<P: PartialEq>(node: &Node<P>, panel: &P) -> bool {
+    match node {
+        Node::Tabs { panels, .. } => panels.contains(panel),
+        Node::Stack { entries } => entries.iter().any(|e| &e.panel == panel),
+        Node::Split { .. } | Node::Dock { .. } => false,
+    }
+}
+
+/// The panel that names a drawn group: its first panel; none for a dock or a split.
+fn lead<P>(node: &Node<P>) -> Option<&P> {
+    match node {
+        Node::Tabs { panels, .. } => panels.first(),
+        Node::Stack { entries } => entries.first().map(|e| &e.panel),
+        Node::Split { .. } | Node::Dock { .. } => None,
+    }
+}
diff --git a/crates/ui/src/docking/render/sizes.rs b/crates/ui/src/docking/render/sizes.rs
new file mode 100644
index 00000000..415ecf8d
--- /dev/null
+++ b/crates/ui/src/docking/render/sizes.rs
@@ -0,0 +1,371 @@
+//! Split-tree geometry: where each split draws its children, how far a divider can travel,
+//! and the sizes that move a divider.
+//!
+//! A dragged divider grows the groups touching it on one side, up to their maximums, and
+//! shrinks the groups on the other side in turn: the group touching the divider gives way
+//! down to its minimum, then the next group along the axis, and so on, until every group on
+//! that side is at its minimum. Groups side by side across the axis shrink together, and the
+//! line goes on past them once one is at its minimum. The line follows splits of the drag's
+//! axis up the tree and ends at a split across it or beside a dock. Every other group keeps
+//! its size.
+
+use egui::Rect;
+
+use super::{dock::dock_rects, node_limits, split_bounds};
+use crate::docking::{DockContent, DockStyle, Node, PanelLimits};
+use crate::layout::{SplitAxis, SplitLayout, SplitSize, split_rect};
+
+/// A split's two children with the rects they are drawn in.
+type Children<'n, P> = [(&'n Node<P>, Rect); 2];
+
+/// How far each divider beside a group that a drop makes smaller can still travel both ways:
+/// the group keeps this much above its minimum, or the groups beyond it give the room.
+pub(in crate::docking) const DROP_MARGIN: f32 = 1.0;
+
+pub(in crate::docking) struct Sizer<'a, P> {
+    pub(in crate::docking) style: &'a DockStyle,
+    pub(in crate::docking) content: &'a dyn DockContent<P>,
+}
+
+/// One group as drawn: its node, rect and limits.
+pub(in crate::docking) struct Drawn<'a, P> {
+    pub(in crate::docking) node: &'a Node<P>,
+    pub(in crate::docking) rect: Rect,
+    pub(in crate::docking) limits: PanelLimits,
+}
+
+fn extent(rect: Rect, axis: SplitAxis) -> f32 {
+    match axis {
+        SplitAxis::Horizontal => rect.width(),
+        SplitAxis::Vertical => rect.height(),
+    }
+}
+
+fn along(v: egui::Vec2, axis: SplitAxis) -> f32 {
+    match axis {
+        SplitAxis::Horizontal => v.x,
+        SplitAxis::Vertical => v.y,
+    }
+}
+
+impl<P> Sizer<'_, P> {
+    fn limits(&self, node: &Node<P>) -> PanelLimits {
+        node_limits(node, self.style, self.content)
+    }
+
+    /// The split as drawn: its stored size, clamped so both children fit their limits.
+    pub(in crate::docking) fn split(&self, axis: SplitAxis, size: SplitSize, first: &Node<P>, second: &Node<P>, rect: Rect) -> Option<SplitLayout> {
+        let wanted = split_rect(rect, axis, size, self.style.gap, 0.0)?;
+        let (lo, hi) = split_bounds(wanted.available(), axis, self.limits(first), self.limits(second));
+        split_rect(rect, axis, SplitSize::FixedFirst(wanted.first_size().clamp(lo, hi)), self.style.gap, 0.0)
+    }
+
+    /// The children of a split drawn in `rect`, with their rects; a dock beside its neighbour
+    /// is drawn by the dock renderer.
+    pub(in crate::docking) fn children<'n>(&self, node: &'n Node<P>, rect: Rect) -> Option<[(&'n Node<P>, Rect); 2]> {
+        let Node::Split { axis, size, first, second } = node else { return None };
+        match (&**first, &**second) {
+            (Node::Dock { side, columns }, other) if *axis == SplitAxis::Horizontal => {
+                let (dock, rest, _) = dock_rects(*side, columns, other, rect, self.style, self.content);
+                Some([(first, dock), (second, rest)])
+            }
+            (other, Node::Dock { side, columns }) if *axis == SplitAxis::Horizontal => {
+                let (dock, rest, _) = dock_rects(*side, columns, other, rect, self.style, self.content);
+                Some([(first, rest), (second, dock)])
+            }
+            _ => {
+                let split = self.split(*axis, *size, first, second, rect)?;
+                Some([(first, split.first), (second, split.second)])
+            }
+        }
+    }
+
+    /// Every group of `node` drawn in `rect`; a dock counts as one.
+    pub(in crate::docking) fn groups<'n>(&self, node: &'n Node<P>, rect: Rect, out: &mut Vec<Drawn<'n, P>>) {
+        match self.children(node, rect) {
+            Some(children) => children.into_iter().for_each(|(child, rect)| self.groups(child, rect, out)),
+            None => out.push(Drawn { node, rect, limits: self.limits(node) }),
+        }
+    }
+
+    /// How far the end edge (`end`) or start edge of `node` drawn in `rect` can move along
+    /// `axis`: inward until every group along the axis from that edge is at its minimum, and
+    /// outward while the groups touching it stay below their maximums. Groups side by side
+    /// across the axis move together, so the first of them to reach its limit stops them.
+    pub(in crate::docking) fn travel(&self, node: &Node<P>, rect: Rect, axis: SplitAxis, end: bool) -> (f32, f32) {
+        let docked =
+            matches!(node, Node::Split { first, second, .. } if matches!(**first, Node::Dock { .. }) || matches!(**second, Node::Dock { .. }));
+        match (node, self.children(node, rect)) {
+            (Node::Split { first, .. }, Some([a, b])) if docked => {
+                let (other, rect) = if matches!(**first, Node::Dock { .. }) { b } else { a };
+                self.travel(other, rect, axis, end)
+            }
+            (Node::Split { axis: split_axis, .. }, Some([a, b])) if *split_axis == axis => {
+                let (near, far) = if end { (b, a) } else { (a, b) };
+                let (near, far) = (self.travel(near.0, near.1, axis, end), self.travel(far.0, far.1, axis, end));
+                (near.0 + far.0, near.1)
+            }
+            (_, Some([a, b])) => {
+                let (a, b) = (self.travel(a.0, a.1, axis, end), self.travel(b.0, b.1, axis, end));
+                (a.0.min(b.0), a.1.min(b.1))
+            }
+            (_, None) => {
+                let limits = self.limits(node);
+                let size = extent(rect, axis);
+                ((size - along(limits.min, axis)).max(0.0), (along(limits.max, axis) - size).max(0.0))
+            }
+        }
+    }
+
+    /// The sizes that move the end (`end`) or start edge of `node` drawn in `rect` outward by
+    /// `grow` points. Growing, only the groups touching that edge change. Shrinking, the group
+    /// at the edge gives way down to its minimum, then the next one along the axis, and so on.
+    /// Paths are relative to `path`.
+    pub(in crate::docking) fn follow(
+        &self,
+        (node, rect): (&Node<P>, Rect),
+        axis: SplitAxis,
+        end: bool,
+        grow: f32,
+        path: &mut Vec<bool>,
+        out: &mut Vec<(Vec<bool>, SplitSize)>,
+    ) {
+        let Some([a, b]) = self.children(node, rect) else { return };
+        let Node::Split { axis: split_axis, size, first, second } = node else { return };
+        let docked = matches!(**first, Node::Dock { .. }) || matches!(**second, Node::Dock { .. });
+        let visit = |child: (&Node<P>, Rect), second_child: bool, grow: f32, path: &mut Vec<bool>, out: &mut Vec<(Vec<bool>, SplitSize)>| {
+            path.push(second_child);
+            self.follow(child, axis, end, grow, path, out);
+            path.pop();
+        };
+        if docked {
+            let dock_first = matches!(**first, Node::Dock { .. });
+            visit(if dock_first { b } else { a }, dock_first, grow, path, out);
+        } else if *split_axis == axis {
+            let (near, far) = if end { (b, a) } else { (a, b) };
+            let near_grow = if grow < 0.0 { grow.max(-self.travel(near.0, near.1, axis, end).0) } else { grow };
+            let far_grow = grow - near_grow;
+            let (near_size, far_size) = (extent(near.1, axis) + near_grow, extent(far.1, axis) + far_grow);
+            let first_size = if end { far_size } else { near_size };
+            push_size(path, *size, first_size, near_size + far_size, out);
+            visit(near, end, near_grow, path, out);
+            if far_grow != 0.0 {
+                visit(far, !end, far_grow, path, out);
+            }
+        } else {
+            visit(a, false, grow, path, out);
+            visit(b, true, grow, path, out);
+        }
+    }
+
+    /// The drawn splits from `root` down to the one at `path`, each with its rect.
+    fn chain<'n>(&self, root: (&'n Node<P>, Rect), path: &[bool]) -> Option<Vec<(&'n Node<P>, Rect)>> {
+        let mut chain = vec![root];
+        for &second in path {
+            let (node, rect) = *chain.last()?;
+            let [a, b] = self.children(node, rect)?;
+            chain.push(if second { b } else { a });
+        }
+        Some(chain)
+    }
+
+    /// The ancestors that continue the line of the split at the end of `chain` along `axis`:
+    /// each with its children and whether the line runs through its second child, nearest first.
+    /// The line ends at a split across the axis or beside a dock.
+    fn line<'n>(&self, chain: &[(&'n Node<P>, Rect)], path: &[bool], axis: SplitAxis) -> Vec<(usize, Children<'n, P>, bool)> {
+        let mut line = Vec::new();
+        for depth in (0..path.len()).rev() {
+            let Some(&(node, rect)) = chain.get(depth) else { break };
+            let Node::Split { axis: split_axis, first, second, .. } = node else { break };
+            if *split_axis != axis || matches!(**first, Node::Dock { .. }) || matches!(**second, Node::Dock { .. }) {
+                break;
+            }
+            let (Some(children), Some(&second_child)) = (self.children(node, rect), path.get(depth)) else { break };
+            line.push((depth, children, second_child));
+        }
+        line
+    }
+
+    /// The divider of the split at `path` under `root` (a node and the rect it is drawn in)
+    /// moved by `delta` points, clamped to its travel. The groups touching the divider on the
+    /// side it moves toward give way, then the groups beyond them along the axis, one after
+    /// another, as far as the line of same-axis splits reaches; the groups on the other side
+    /// that touch the divider take the room. Paths are absolute, like `path`.
+    pub(in crate::docking) fn drag(&self, root: (&Node<P>, Rect), path: &[bool], delta: f32) -> Vec<(Vec<bool>, SplitSize)> {
+        let Some(chain) = self.chain(root, path) else { return Vec::new() };
+        let Some(&(node, rect)) = chain.last() else { return Vec::new() };
+        let Node::Split { axis, size, first, second } = node else { return Vec::new() };
+        let axis = *axis;
+        let Some(split) = self.split(axis, *size, first, second, rect) else { return Vec::new() };
+        let (lo, hi) = self.range(root, path);
+        let delta = delta.clamp(lo, hi);
+        if delta == 0.0 || !delta.is_finite() || split.available() <= 0.0 {
+            return Vec::new();
+        }
+        // Toward the end edge the second child gives way, toward the start the first.
+        let forward = delta > 0.0;
+        let moved = delta.abs();
+        let given = if forward {
+            moved.min(self.travel(second, split.second, axis, false).0)
+        } else {
+            moved.min(self.travel(first, split.first, axis, true).0)
+        };
+        let (first_grow, second_grow) = if forward { (moved, -given) } else { (-given, moved) };
+        let mut out = Vec::new();
+        let mut path = path.to_vec();
+        let first_size = split.first_size() + first_grow;
+        push_size(&path, *size, first_size, first_size + extent(split.second, axis) + second_grow, &mut out);
+        path.push(false);
+        self.follow((first, split.first), axis, true, first_grow, &mut path, &mut out);
+        path.pop();
+        path.push(true);
+        self.follow((second, split.second), axis, false, second_grow, &mut path, &mut out);
+        path.pop();
+        // What the split's own child could not give, the ancestors' children beyond it give:
+        // the split grows by `rest` toward them, and so does each ancestor until one absorbs it.
+        let mut rest = moved - given;
+        for (depth, [a, b], second_child) in self.line(&chain, &path, axis) {
+            if rest <= 0.0 {
+                break;
+            }
+            path.truncate(depth);
+            let (a_size, b_size) = (extent(a.1, axis), extent(b.1, axis));
+            let (first_size, second_size) = match (forward, second_child) {
+                (true, false) => {
+                    let taken = rest.min(self.travel(b.0, b.1, axis, false).0);
+                    path.push(true);
+                    self.follow(b, axis, false, -taken, &mut path, &mut out);
+                    path.pop();
+                    let sizes = (a_size + rest, b_size - taken);
+                    rest -= taken;
+                    sizes
+                }
+                (false, true) => {
+                    let taken = rest.min(self.travel(a.0, a.1, axis, true).0);
+                    path.push(false);
+                    self.follow(a, axis, true, -taken, &mut path, &mut out);
+                    path.pop();
+                    let sizes = (a_size - taken, b_size + rest);
+                    rest -= taken;
+                    sizes
+                }
+                (true, true) => (a_size, b_size + rest),
+                (false, false) => (a_size + rest, b_size),
+            };
+            if let Some((Node::Split { size, .. }, _)) = chain.get(depth) {
+                push_size(&path, *size, first_size, first_size + second_size, &mut out);
+            }
+        }
+        out
+    }
+
+    /// How far the divider of the split at `path` under `root` can move: `(lo, hi)`, with
+    /// `lo <= 0 <= hi`. Each way it is the lesser of the room the groups touching the divider
+    /// have to grow and the room every group beyond the divider, along the line of same-axis
+    /// splits, has to shrink.
+    pub(in crate::docking) fn range(&self, root: (&Node<P>, Rect), path: &[bool]) -> (f32, f32) {
+        let Some(chain) = self.chain(root, path) else { return (0.0, 0.0) };
+        let Some(&(node, rect)) = chain.last() else { return (0.0, 0.0) };
+        let Node::Split { axis, size, first, second } = node else { return (0.0, 0.0) };
+        let Some(split) = self.split(*axis, *size, first, second, rect) else { return (0.0, 0.0) };
+        let (mut first_in, first_out) = self.travel(first, split.first, *axis, true);
+        let (mut second_in, second_out) = self.travel(second, split.second, *axis, false);
+        for (_, [a, b], second_child) in self.line(&chain, path, *axis) {
+            if second_child {
+                first_in += self.travel(a.0, a.1, *axis, true).0;
+            } else {
+                second_in += self.travel(b.0, b.1, *axis, false).0;
+            }
+        }
+        (-first_in.min(second_out), first_out.min(second_in))
+    }
+
+    /// Whether every divider of `root` across `axis` that runs along a side of the group drawn
+    /// at `group` can travel [`DROP_MARGIN`] both ways, by [`Self::range`]: a group at its
+    /// minimum holds no divider still while the groups beyond it can give way.
+    pub(in crate::docking) fn frees(&self, root: (&Node<P>, Rect), group: Rect, axis: SplitAxis) -> bool {
+        let edges = |rect: Rect| match axis {
+            SplitAxis::Horizontal => (rect.left(), rect.right()),
+            SplitAxis::Vertical => (rect.top(), rect.bottom()),
+        };
+        let (start, end) = edges(group);
+        let beside = |child: Rect, edge: f32, own: f32| child.contains(group.center()) && (edge - own).abs() < 0.5;
+        let mut nodes = vec![(root.0, root.1, Vec::new())];
+        while let Some((node, rect, path)) = nodes.pop() {
+            let (Node::Split { axis: split_axis, .. }, Some([a, b])) = (node, self.children(node, rect)) else { continue };
+            if *split_axis == axis && (beside(a.1, edges(a.1).1, end) || beside(b.1, edges(b.1).0, start)) {
+                let (lo, hi) = self.range(root, &path);
+                if -lo < DROP_MARGIN || hi < DROP_MARGIN {
+                    return false;
+                }
+            }
+            for (second, (child, rect)) in [(false, a), (true, b)] {
+                let mut path = path.clone();
+                path.push(second);
+                nodes.push((child, rect, path));
+            }
+        }
+        true
+    }
+}
+
+/// The size of a split at `path` whose first child is `first` of `available` points, in the
+/// split's own mode `size`: a fixed side keeps its points, a ratio stays a ratio.
+fn push_size(path: &[bool], size: SplitSize, first: f32, available: f32, out: &mut Vec<(Vec<bool>, SplitSize)>) {
+    if let Some(size) = resized(size, first, available) {
+        out.push((path.to_vec(), size));
+    }
+}
+
+/// `size` in its own mode for a first child of `first` out of `available` points.
+pub(in crate::docking) fn resized(size: SplitSize, first: f32, available: f32) -> Option<SplitSize> {
+    if available <= 0.0 || !available.is_finite() || !first.is_finite() {
+        return None;
+    }
+    let first = first.clamp(0.0, available);
+    Some(match size {
+        SplitSize::Ratio(_) => SplitSize::Ratio((first / available).clamp(0.0, 1.0)),
+        SplitSize::FixedFirst(_) => SplitSize::FixedFirst(first),
+        SplitSize::FixedSecond(_) => SplitSize::FixedSecond(available - first),
+    })
+}
+
+/// One group of a flat row, such as the panels of a stack or the groups of a dock column:
+/// its size along the row and its limits.
+#[derive(Clone, Copy)]
+pub(in crate::docking) struct RowItem {
+    pub(in crate::docking) size: f32,
+    pub(in crate::docking) min: f32,
+    pub(in crate::docking) max: f32,
+}
+
+/// How far the divider after `row[index]` can move: `(lo, hi)`, with `lo <= 0 <= hi`, by the
+/// rule of [`row_drag`].
+pub(in crate::docking) fn row_range(row: &[RowItem], index: usize) -> (f32, f32) {
+    let room = |items: &[RowItem]| items.iter().map(|item| (item.size - item.min).max(0.0)).sum::<f32>();
+    let grow = |item: Option<&RowItem>| item.map_or(0.0, |item| (item.max - item.size).max(0.0));
+    let (before, after) = row.split_at((index + 1).min(row.len()));
+    (-room(before).min(grow(after.first())), room(after).min(grow(before.last())))
+}
+
+/// The sizes of `row` after the divider after `row[index]` moves by `delta`, clamped to its
+/// travel: the item touching the divider on the side it moves toward gives way down to its
+/// minimum, then the next one, and so on; the item on the other side takes the room.
+pub(in crate::docking) fn row_drag(row: &[RowItem], index: usize, delta: f32) -> Vec<f32> {
+    let (lo, hi) = row_range(row, index);
+    let delta = if delta.is_finite() { delta.clamp(lo, hi) } else { 0.0 };
+    let mut sizes: Vec<f32> = row.iter().map(|item| item.size).collect();
+    let (grows, givers): (usize, Vec<usize>) =
+        if delta > 0.0 { (index, (index + 1..row.len()).collect()) } else { (index + 1, (0..=index).rev().collect()) };
+    let mut rest = delta.abs();
+    for giver in givers {
+        let (Some(size), Some(item)) = (sizes.get_mut(giver), row.get(giver)) else { continue };
+        let taken = rest.min((item.size - item.min).max(0.0));
+        *size -= taken;
+        rest -= taken;
+    }
+    if let Some(size) = sizes.get_mut(grows) {
+        *size += delta.abs() - rest;
+    }
+    sizes
+}
diff --git a/crates/ui/src/docking/resize.rs b/crates/ui/src/docking/resize.rs
new file mode 100644
index 00000000..24d62c29
--- /dev/null
+++ b/crates/ui/src/docking/resize.rs
@@ -0,0 +1,143 @@
+use egui::{Pos2, Rect, Vec2};
+
+use super::PanelLimits;
+
+/// A pointer-anchored resize. The opposite edges and handle grab offset stay fixed
+/// through boundary overshoot; viewport constraints never translate the window.
+#[derive(Clone, Copy, Debug)]
+pub struct AnchoredResize {
+    start: Rect,
+    offset: Vec2,
+    direction: Vec2,
+}
+
+impl AnchoredResize {
+    pub fn new(start: Rect, pointer: Pos2, direction: Vec2) -> Option<Self> {
+        if !start.is_finite()
+            || !start.is_positive()
+            || !pointer.is_finite()
+            || ![-1.0, 0.0, 1.0].contains(&direction.x)
+            || ![-1.0, 0.0, 1.0].contains(&direction.y)
+            || direction == Vec2::ZERO
+        {
+            return None;
+        }
+        let edge =
+            egui::pos2(if direction.x < 0.0 { start.left() } else { start.right() }, if direction.y < 0.0 { start.top() } else { start.bottom() });
+        Some(Self { start, offset: pointer - edge, direction })
+    }
+
+    /// None suspends resizing when the fixed anchor cannot accommodate the minimum.
+    pub fn rect(self, pointer: Pos2, viewport: Rect, limits: PanelLimits) -> Option<Rect> {
+        if !pointer.is_finite()
+            || !viewport.is_finite()
+            || !viewport.is_positive()
+            || !limits.min.is_finite()
+            || !limits.max.is_finite()
+            || limits.min.x <= 0.0
+            || limits.min.y <= 0.0
+            || limits.max.x < limits.min.x
+            || limits.max.y < limits.min.y
+            || !viewport.contains_rect(self.start)
+            || self.start.width() < limits.min.x
+            || self.start.height() < limits.min.y
+        {
+            return None;
+        }
+        let desired = pointer - self.offset;
+        if !desired.is_finite() {
+            return None;
+        }
+        let mut rect = self.start;
+        for (axis, direction) in [(0, self.direction.x), (1, self.direction.y)] {
+            if direction == 0.0 {
+                continue;
+            }
+            let (lo, hi) = if direction < 0.0 {
+                ((self.start.max[axis] - limits.max[axis]).max(viewport.min[axis]), self.start.max[axis] - limits.min[axis])
+            } else {
+                (self.start.min[axis] + limits.min[axis], (self.start.min[axis] + limits.max[axis]).min(viewport.max[axis]))
+            };
+            if !lo.is_finite() || !hi.is_finite() || lo > hi {
+                return None;
+            }
+            if direction < 0.0 {
+                rect.min[axis] = desired[axis].clamp(lo, hi);
+            } else {
+                rect.max[axis] = desired[axis].clamp(lo, hi);
+            }
+        }
+        Some(rect)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::{pos2, vec2};
+
+    #[test]
+    fn every_handle_tracks_absolute_pointer_and_keeps_opposite_edges() {
+        let start = Rect::from_min_max(pos2(100.0, 80.0), pos2(400.0, 300.0));
+        let viewport = Rect::from_min_max(Pos2::ZERO, pos2(800.0, 600.0));
+        let limits = PanelLimits { min: vec2(160.0, 120.0), max: vec2(500.0, 400.0) };
+        for direction in
+            [vec2(-1.0, 0.0), vec2(1.0, 0.0), vec2(0.0, 1.0), vec2(-1.0, 1.0), vec2(1.0, 1.0), vec2(0.0, -1.0), vec2(-1.0, -1.0), vec2(1.0, -1.0)]
+        {
+            let edge =
+                pos2(if direction.x < 0.0 { start.left() } else { start.right() }, if direction.y < 0.0 { start.top() } else { start.bottom() });
+            let pointer = edge + vec2(2.0, -3.0);
+            let resize = AnchoredResize::new(start, pointer, direction).unwrap();
+            let rect = resize.rect(pointer + vec2(20.0, 25.0), viewport, limits).unwrap();
+            // A moving edge follows the pointer; every other edge stays.
+            let moved = |d: f32, lo: f32, hi: f32, by: f32| match d {
+                d if d < 0.0 => (lo + by, hi),
+                d if d > 0.0 => (lo, hi + by),
+                _ => (lo, hi),
+            };
+            assert_eq!((rect.left(), rect.right()), moved(direction.x, start.left(), start.right(), 20.0), "{direction:?}");
+            assert_eq!((rect.top(), rect.bottom()), moved(direction.y, start.top(), start.bottom(), 25.0), "{direction:?}");
+        }
+    }
+
+    #[test]
+    fn overshoot_requires_pointer_to_return_to_the_valid_range() {
+        let start = Rect::from_min_max(pos2(100.0, 80.0), pos2(400.0, 300.0));
+        let viewport = Rect::from_min_max(Pos2::ZERO, pos2(600.0, 500.0));
+        let limits = PanelLimits { min: vec2(160.0, 120.0), max: vec2(1000.0, 1000.0) };
+        let resize = AnchoredResize::new(start, pos2(398.0, 200.0), vec2(1.0, 0.0)).unwrap();
+        for x in [800.0, 750.0, 598.0] {
+            let rect = resize.rect(pos2(x, 200.0), viewport, limits).unwrap();
+            assert_eq!((rect.left(), rect.right()), (100.0, 600.0));
+        }
+        for x in [120.0, 200.0, 258.0] {
+            assert_eq!(resize.rect(pos2(x, 200.0), viewport, limits).unwrap().right(), 260.0);
+        }
+        assert_eq!(resize.rect(pos2(278.0, 200.0), viewport, limits).unwrap().right(), 280.0);
+        let left = AnchoredResize::new(start, pos2(102.0, 200.0), vec2(-1.0, 0.0)).unwrap();
+        assert_eq!(left.rect(pos2(-300.0, 200.0), viewport, limits).unwrap().min.x, 0.0);
+        assert_eq!(left.rect(pos2(350.0, 200.0), viewport, limits).unwrap().min.x, 240.0);
+        assert_eq!(left.rect(pos2(300.0, 200.0), viewport, limits).unwrap().min.x, 240.0);
+        assert_eq!(left.rect(pos2(222.0, 200.0), viewport, limits).unwrap().min.x, 220.0);
+    }
+
+    #[test]
+    fn panel_maximum_caps_edges_without_losing_the_absolute_anchor() {
+        let start = Rect::from_min_max(pos2(100.0, 80.0), pos2(400.0, 300.0));
+        let viewport = Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0));
+        let limits = PanelLimits { min: vec2(160.0, 120.0), max: vec2(320.0, 240.0) };
+        let resize = AnchoredResize::new(start, start.max, Vec2::splat(1.0)).unwrap();
+        for pointer in [pos2(700.0, 550.0), pos2(600.0, 450.0)] {
+            assert_eq!(resize.rect(pointer, viewport, limits).unwrap(), Rect::from_min_max(start.min, pos2(420.0, 320.0)));
+        }
+        assert_eq!(resize.rect(pos2(410.0, 310.0), viewport, limits).unwrap(), Rect::from_min_max(start.min, pos2(410.0, 310.0)));
+    }
+
+    #[test]
+    fn constrained_viewports_and_invalid_geometry_suspend_resize() {
+        let start = Rect::from_min_size(Pos2::ZERO, vec2(100.0, 90.0));
+        let resize = AnchoredResize::new(start, start.max, Vec2::splat(1.0)).unwrap();
+        assert!(resize.rect(start.max, start, PanelLimits { min: vec2(160.0, 120.0), ..Default::default() }).is_none());
+        assert!(AnchoredResize::new(start, pos2(f32::NAN, 0.0), Vec2::splat(1.0)).is_none());
+    }
+}
diff --git a/crates/ui/src/docking/split_tests.rs b/crates/ui/src/docking/split_tests.rs
new file mode 100644
index 00000000..f003ff40
--- /dev/null
+++ b/crates/ui/src/docking/split_tests.rs
@@ -0,0 +1,1019 @@
+//! A split tree of tab groups in an editing layout like FilmCraft's: Source | Program |
+//! Properties over Project | Tools | Timeline | Audio Meters, every group an ordinary
+//! resizable one. One test per docking rule, the stuck cases of the FilmCraft map, and a
+//! property test over random drops.
+
+use std::collections::HashMap;
+
+use super::floating_tests::frame_style;
+use super::render::{Drawn, Sizer};
+use super::testing::DockDriver;
+use super::*;
+use crate::layout::{SplitAxis, SplitSize};
+use egui::{Modifiers, Pos2, Rect, Vec2, pos2, vec2};
+
+const SOURCE: [u32; 4] = [1, 11, 12, 13];
+const PROGRAM: u32 = 2;
+const PROPERTIES: [u32; 3] = [3, 31, 32];
+const PROJECT: [u32; 7] = [4, 41, 42, 43, 44, 45, 46];
+const TOOLS: u32 = 5;
+const TIMELINE: u32 = 6;
+const METERS: u32 = 7;
+const INFO: u32 = 9;
+
+const SCREEN: Vec2 = Vec2::new(1440.0, 860.0);
+
+/// Panel bodies by their rects; `caps` are maximum widths a host asks for, `rules` the
+/// permissions of panels that differ from the default.
+#[derive(Default)]
+struct Film {
+    bodies: HashMap<u32, Rect>,
+    caps: HashMap<u32, f32>,
+    rules: HashMap<u32, Permissions>,
+}
+
+impl DockContent<u32> for Film {
+    fn body(&mut self, ui: &mut egui::Ui, panel: &u32) {
+        self.bodies.insert(*panel, ui.max_rect());
+    }
+    fn logical_label(&self, panel: &u32) -> String {
+        format!("Panel {panel}")
+    }
+    fn limits(&self, panel: &u32) -> PanelLimits {
+        match self.caps.get(panel) {
+            Some(width) => PanelLimits { min: Vec2::ZERO, max: vec2(*width, 1_000_000.0) },
+            None => PanelLimits::default(),
+        }
+    }
+    fn permissions(&self, panel: &u32) -> Permissions {
+        self.rules.get(panel).copied().unwrap_or_default()
+    }
+}
+
+type Driver = DockDriver<u32, Film>;
+
+fn tabs(panels: &[u32]) -> Node<u32> {
+    Node::Tabs { panels: panels.to_vec(), active: 0 }
+}
+
+fn split(axis: SplitAxis, ratio: f32, first: Node<u32>, second: Node<u32>) -> Node<u32> {
+    Node::Split { axis, size: SplitSize::Ratio(ratio), first: Box::new(first), second: Box::new(second) }
+}
+
+fn hsplit(ratio: f32, first: Node<u32>, second: Node<u32>) -> Node<u32> {
+    split(SplitAxis::Horizontal, ratio, first, second)
+}
+
+/// The Editing workspace, with Info floating over Properties.
+fn editing() -> Layout<u32> {
+    let top = hsplit(0.69, hsplit(0.5, tabs(&SOURCE), tabs(&[PROGRAM])), tabs(&PROPERTIES));
+    let row = hsplit(0.06, tabs(&[TOOLS]), hsplit(0.88, tabs(&[TIMELINE]), tabs(&[METERS])));
+    let bottom = hsplit(0.29, tabs(&PROJECT), row);
+    Layout {
+        root: Some(split(SplitAxis::Vertical, 0.57, top, bottom)),
+        floating: vec![Floating::single(vec![INFO], 0, [1120.0, 60.0, 280.0, 200.0])],
+    }
+}
+
+fn driver(layout: Layout<u32>, content: Film) -> Driver {
+    let mut d = DockDriver::new(layout, content).with_style(frame_style);
+    d.screen = Rect::from_min_size(Pos2::ZERO, SCREEN);
+    d.area = d.screen;
+    d.settle();
+    d
+}
+
+fn film() -> Driver {
+    driver(editing(), Film::default())
+}
+
+/// A group's rect: its active body and its tab strip.
+fn group(d: &Driver, panel: u32) -> Rect {
+    let body = d.content.bodies.get(&panel).copied().unwrap_or_else(|| panic!("panel {panel} not drawn"));
+    Rect::from_min_max(pos2(body.left(), body.top() - 26.0), body.max)
+}
+
+fn tab(d: &Driver, panel: u32) -> Pos2 {
+    d.hit(&Hit::Tab(panel)).unwrap_or_else(|| panic!("tab {panel}")).center()
+}
+
+/// Drag a divider by `delta`, hovering it first as a pointer does.
+fn drag_hit(d: &mut Driver, hit: Hit<u32>, delta: Vec2) {
+    let at = d.hit(&hit).unwrap_or_else(|| panic!("{hit:?} in {:?}", d.hits())).center();
+    d.move_to(at);
+    d.drag(at, at + delta);
+    d.settle();
+}
+
+fn divider(path: &[bool]) -> Hit<u32> {
+    Hit::Divider(Divider::Split(path.to_vec()))
+}
+
+fn sizes(d: &Driver, panels: &[u32]) -> Vec<Vec2> {
+    panels.iter().map(|p| group(d, *p).size()).collect()
+}
+
+fn close(a: Rect, b: Rect) -> bool {
+    (a.min - b.min).length() < 1.0 && (a.max - b.max).length() < 1.0
+}
+
+#[test]
+fn a_group_is_a_picture_frame_whose_edges_split_it_in_half_and_whose_middle_joins_it() {
+    let base = film();
+    let timeline = group(&base, TIMELINE);
+    let others = [PROJECT[0], TOOLS, METERS, SOURCE[0], PROGRAM, PROPERTIES[0]];
+    // Halfway into each 40 pt band of the body below the tab strip.
+    let inset = |zone| {
+        let (w, h) = (20.0, 20.0);
+        match zone {
+            Zone::Left => pos2(timeline.left() + w, timeline.center().y + 13.0),
+            Zone::Right => pos2(timeline.right() - w, timeline.center().y + 13.0),
+            Zone::Top => pos2(timeline.center().x, timeline.top() + 26.0 + h),
+            Zone::Bottom => pos2(timeline.center().x, timeline.bottom() - h),
+            Zone::Center => pos2(timeline.center().x, timeline.center().y + 13.0),
+        }
+    };
+    for zone in [Zone::Left, Zone::Right, Zone::Top, Zone::Bottom] {
+        let mut d = film();
+        let before = sizes(&d, &others);
+        let at = inset(zone);
+        d.hold(tab(&d, INFO), at);
+        assert!(d.filled_polygon(&zone_shape(timeline, 26.0, 40.0, zone).unwrap()), "{zone:?}: the preview fills that band");
+        let out = d.release(at);
+        assert_eq!(out.actions, vec![Action::Move { panel: INFO, anchor: TIMELINE, placement: Placement::Split(zone) }], "{zone:?}");
+        d.settle();
+        let (info, rest) = (group(&d, INFO), group(&d, TIMELINE));
+        assert!(close(info.union(rest), timeline), "{zone:?}: the two halves fill the group: {info:?} {rest:?} in {timeline:?}");
+        assert!((info.area() - rest.area()).abs() < info.area() * 0.05, "{zone:?}: about halves");
+        assert_eq!(sizes(&d, &others), before, "{zone:?}: no other group changes");
+    }
+    // The middle and the tab row join the group.
+    let mut d = film();
+    let out = d.drag(tab(&d, INFO), inset(Zone::Center));
+    assert_eq!(out.actions, vec![Action::Move { panel: INFO, anchor: TIMELINE, placement: Placement::Split(Zone::Center) }]);
+    let mut d = film();
+    let out = d.drag(tab(&d, INFO), pos2(timeline.center().x, timeline.top() + 10.0));
+    assert!(matches!(&out.actions[..], [Action::Move { panel: INFO, placement: Placement::Tab { .. }, .. }]), "{:?}", out.actions);
+    // The gap between two groups belongs to neither: the drag cancels.
+    let mut d = film();
+    let tools = group(&d, TOOLS);
+    let gap = pos2(tools.right() + 2.0, tools.center().y);
+    let out = d.drag(tab(&d, INFO), gap);
+    assert!(out.actions.is_empty(), "{:?}", out.actions);
+}
+
+#[test]
+fn window_edges_add_a_full_column_or_row_without_taking_the_groups_edges() {
+    let mut d = film();
+    let project = group(&d, PROJECT[0]);
+    let out = d.drag(tab(&d, INFO), pos2(3.0, project.center().y));
+    assert_eq!(out.actions, vec![Action::Move { panel: INFO, anchor: SOURCE[0], placement: Placement::Edge(Zone::Left) }]);
+    d.settle();
+    let info = group(&d, INFO);
+    assert_eq!((info.top(), info.bottom(), info.left()), (0.0, SCREEN.y, 0.0), "a full-height column at the left");
+    assert!((info.width() - SCREEN.x * 0.25).abs() < 4.0, "{info:?}");
+
+    for (at, zone) in [(pos2(SCREEN.x - 3.0, 300.0), Zone::Right), (pos2(700.0, 3.0), Zone::Top), (pos2(700.0, SCREEN.y - 3.0), Zone::Bottom)] {
+        let mut d = film();
+        let out = d.drag(tab(&d, INFO), at);
+        assert!(matches!(&out.actions[..], [Action::Move { placement: Placement::Edge(z), .. }] if *z == zone), "{zone:?}: {:?}", out.actions);
+    }
+    // Past the window band, the group's own edge band splits that group.
+    let mut d = film();
+    let out = d.drag(tab(&d, INFO), pos2(project.left() + 20.0, project.center().y + 13.0));
+    assert_eq!(out.actions, vec![Action::Move { panel: INFO, anchor: PROJECT[0], placement: Placement::Split(Zone::Left) }]);
+}
+
+#[test]
+fn groups_have_one_small_minimum_and_no_maximum() {
+    let mut d = film();
+    let tools = group(&d, TOOLS).width();
+    drag_hit(&mut d, divider(&[true, true]), vec2(400.0, 0.0));
+    assert!((group(&d, TOOLS).width() - (tools + 400.0)).abs() < 1.0, "Tools grows as wide as it is dragged");
+    drag_hit(&mut d, divider(&[true, true]), vec2(-2000.0, 0.0));
+    assert_eq!(group(&d, TOOLS).width(), 40.0, "and shrinks to the minimum, no further");
+
+    // At its minimum, with Project left of it at its own, it has no room for two halves and
+    // takes a drop on its left edge as a tab.
+    let tools = group(&d, TOOLS);
+    assert_eq!(group(&d, PROJECT[0]).width(), 40.0);
+    let out = d.drag(tab(&d, INFO), pos2(tools.left() + 4.0, tools.center().y + 30.0));
+    assert!(
+        matches!(&out.actions[..], [Action::Move { panel: INFO, anchor: TOOLS, placement: Placement::Split(Zone::Center) | Placement::Tab { .. } }]),
+        "{:?}",
+        out.actions
+    );
+}
+
+#[test]
+fn a_divider_resizes_only_the_groups_that_share_it() {
+    // Timeline | Meters: Project and Tools keep their widths.
+    let mut d = film();
+    let (project, tools, timeline, meters) = (group(&d, PROJECT[0]), group(&d, TOOLS), group(&d, TIMELINE), group(&d, METERS));
+    drag_hit(&mut d, divider(&[true, true, true]), vec2(-100.0, 0.0));
+    assert_eq!((group(&d, PROJECT[0]), group(&d, TOOLS)), (project, tools));
+    assert!((group(&d, TIMELINE).width() - (timeline.width() - 100.0)).abs() < 1.0);
+    assert!((group(&d, METERS).width() - (meters.width() + 100.0)).abs() < 1.0);
+
+    // Project | the rest: only Tools, on the other side, gives way; Timeline and Meters stay.
+    let mut d = film();
+    drag_hit(&mut d, divider(&[true]), vec2(15.0, 0.0));
+    assert!((group(&d, PROJECT[0]).width() - (project.width() + 15.0)).abs() < 1.0);
+    assert!((group(&d, TOOLS).width() - (tools.width() - 15.0)).abs() < 1.0);
+    assert!(close(group(&d, TIMELINE), timeline) && close(group(&d, METERS), meters), "{:?}", d.layout);
+
+    // Top row: Source | Program leaves Properties alone.
+    let mut d = film();
+    let properties = group(&d, PROPERTIES[0]);
+    drag_hit(&mut d, divider(&[false, false]), vec2(80.0, 0.0));
+    assert_eq!(group(&d, PROPERTIES[0]), properties);
+}
+
+#[test]
+fn a_divider_dragged_past_a_groups_minimum_shrinks_the_next_group_along_the_row() {
+    // A | B | C | D, 357 pt each, as (A | B) | (C | D): the cascade runs on past B's split.
+    let row = hsplit(0.5, hsplit(0.5, tabs(&[1]), tabs(&[2])), hsplit(0.5, tabs(&[3]), tabs(&[4])));
+    let mut d = driver(Layout { root: Some(row), floating: Vec::new() }, Film::default());
+    let widths = |d: &Driver| [1, 2, 3, 4].map(|panel| group(d, panel).width().round());
+    assert_eq!(widths(&d), [357.0, 357.0, 357.0, 357.0]);
+    // B gives way down to its 40 pt minimum, then C.
+    drag_hit(&mut d, divider(&[false]), vec2(400.0, 0.0));
+    assert_eq!(widths(&d), [757.0, 40.0, 274.0, 357.0]);
+    // The drag stops when B, C and D are all at their minimums.
+    drag_hit(&mut d, divider(&[false]), vec2(670.0, 0.0));
+    assert_eq!(widths(&d), [1308.0, 40.0, 40.0, 40.0]);
+    // Back the other way, A gives way and only B, which touches the divider, grows.
+    drag_hit(&mut d, divider(&[false]), vec2(-1300.0, 0.0));
+    assert_eq!(widths(&d), [40.0, 1308.0, 40.0, 40.0]);
+}
+
+#[test]
+fn a_divider_drag_keeps_the_splits_fixed_or_ratio_size() {
+    let hsized = |size, first, second| Node::Split { axis: SplitAxis::Horizontal, size, first: Box::new(first), second: Box::new(second) };
+    let start = |d: &Driver| match &d.layout.root {
+        Some(Node::Split { size, .. }) => *size,
+        other => panic!("{other:?}"),
+    };
+    let wider = |d: &mut Driver| {
+        d.screen = Rect::from_min_size(Pos2::ZERO, SCREEN + vec2(400.0, 0.0));
+        d.area = d.screen;
+        d.settle();
+    };
+    let layout = |root| Layout { root: Some(root), floating: Vec::new() };
+
+    // A fixed start panel keeps its dragged width when the window grows.
+    let mut d = driver(layout(hsized(SplitSize::FixedFirst(240.0), tabs(&[1]), tabs(&[2]))), Film::default());
+    drag_hit(&mut d, divider(&[]), vec2(60.0, 0.0));
+    let SplitSize::FixedFirst(width) = start(&d) else { panic!("{:?}", d.layout) };
+    assert!((width - 300.0).abs() < 1.0, "{width}");
+    let panel = group(&d, 1).width();
+    wider(&mut d);
+    assert!((group(&d, 1).width() - panel).abs() < 1.0, "{} {panel}", group(&d, 1).width());
+
+    // A fixed end panel too.
+    let mut d = driver(layout(hsized(SplitSize::FixedSecond(240.0), tabs(&[1]), tabs(&[2]))), Film::default());
+    drag_hit(&mut d, divider(&[]), vec2(60.0, 0.0));
+    let SplitSize::FixedSecond(width) = start(&d) else { panic!("{:?}", d.layout) };
+    assert!((width - 180.0).abs() < 1.0, "{width}");
+    let panel = group(&d, 2).width();
+    wider(&mut d);
+    assert!((group(&d, 2).width() - panel).abs() < 1.0, "{} {panel}", group(&d, 2).width());
+
+    // A ratio stays a ratio, and both sides grow with the window.
+    let mut d = driver(layout(hsplit(0.5, tabs(&[1]), tabs(&[2]))), Film::default());
+    drag_hit(&mut d, divider(&[]), vec2(60.0, 0.0));
+    let SplitSize::Ratio(ratio) = start(&d) else { panic!("{:?}", d.layout) };
+    assert!(ratio > 0.5 && ratio < 1.0, "{ratio}");
+    let (first, second) = (group(&d, 1).width(), group(&d, 2).width());
+    wider(&mut d);
+    assert!(group(&d, 1).width() > first + 100.0 && group(&d, 2).width() > second + 100.0);
+
+    // A drag that runs on past its own split into a fixed ancestor keeps the ancestor fixed.
+    let mut d = driver(layout(hsized(SplitSize::FixedSecond(300.0), hsplit(0.5, tabs(&[1]), tabs(&[2])), tabs(&[3]))), Film::default());
+    drag_hit(&mut d, divider(&[false]), vec2(600.0, 0.0));
+    let SplitSize::FixedSecond(width) = start(&d) else { panic!("{:?}", d.layout) };
+    assert!(width < 299.0, "{width}");
+    let panel = group(&d, 3).width();
+    wider(&mut d);
+    assert!((group(&d, 3).width() - panel).abs() < 1.0, "{} {panel}", group(&d, 3).width());
+}
+
+#[test]
+fn an_intersection_moves_both_dividers() {
+    let mut d = film();
+    let (project, tools, source) = (group(&d, PROJECT[0]), group(&d, TOOLS), group(&d, SOURCE[0]));
+    let hit = Hit::Divider(Divider::Intersection(vec![], vec![true]));
+    let at = d.hit(&hit).unwrap_or_else(|| panic!("{:?}", d.hits()));
+    assert!(at.contains(pos2(project.right() + 2.0, project.top() - 2.0)), "{at:?} at Project's top right corner");
+    drag_hit(&mut d, hit, vec2(15.0, -60.0));
+    assert!((group(&d, PROJECT[0]).width() - (project.width() + 15.0)).abs() < 1.0);
+    assert!((group(&d, PROJECT[0]).height() - (project.height() + 60.0)).abs() < 1.0);
+    assert!((group(&d, TOOLS).width() - (tools.width() - 15.0)).abs() < 1.0);
+    assert!((group(&d, SOURCE[0]).height() - (source.height() - 60.0)).abs() < 1.0);
+    assert_eq!(group(&d, SOURCE[0]).width(), source.width());
+}
+
+#[test]
+fn closing_a_group_gives_its_space_to_its_neighbours() {
+    let mut d = film();
+    let (tools, meters) = (group(&d, TOOLS), group(&d, METERS));
+    d.layout.apply(Action::CloseGroup { panel: TIMELINE }).unwrap();
+    d.settle();
+    let meters_now = group(&d, METERS);
+    assert_eq!(group(&d, TOOLS), tools);
+    assert_eq!((meters_now.right(), meters_now.top(), meters_now.bottom()), (meters.right(), meters.top(), meters.bottom()));
+    assert!((meters_now.left() - (tools.right() + 4.0)).abs() < 1.0, "the row has no hole: {meters_now:?}");
+}
+
+// The stuck cases of the FilmCraft map (map.md section 3).
+
+#[test]
+fn info_dropped_onto_a_capped_group_lifts_the_cap() {
+    let content = Film { caps: HashMap::from([(METERS, 116.0)]), ..Film::default() };
+    let mut d = driver(editing(), content);
+    let meters = group(&d, METERS);
+    d.drag(tab(&d, INFO), pos2(meters.center().x, meters.center().y + 13.0));
+    d.settle();
+    assert!(d.layout.location(&INFO).is_ok_and(|l| l.anchor == Some(METERS)), "{:?}", d.layout);
+    // Info is the group's shown panel.
+    let width = group(&d, INFO).width();
+    drag_hit(&mut d, divider(&[true, true, true]), vec2(-200.0, 0.0));
+    assert!((group(&d, INFO).width() - (width + 200.0)).abs() < 1.0, "the group grows past the cap of one of its panels");
+    drag_hit(&mut d, divider(&[true, true, true]), vec2(150.0, 0.0));
+    assert!((group(&d, INFO).width() - (width + 50.0)).abs() < 1.0, "and shrinks again");
+}
+
+#[test]
+fn a_drop_beside_a_narrow_group_splits_that_group_only() {
+    let mut d = film();
+    drag_hit(&mut d, divider(&[true, true]), vec2(80.0, 0.0));
+    let (tools, project, timeline, meters) = (group(&d, TOOLS), group(&d, PROJECT[0]), group(&d, TIMELINE), group(&d, METERS));
+    assert!(tools.width() > 120.0, "{tools:?}");
+    let at = pos2(tools.right() - 8.0, tools.center().y + 13.0);
+    d.hold(tab(&d, INFO), at);
+    assert!(d.filled_polygon(&zone_shape(tools, 26.0, 40.0, Zone::Right).unwrap()), "the preview fills Tools' right band");
+    let out = d.release(at);
+    assert_eq!(out.actions, vec![Action::Move { panel: INFO, anchor: TOOLS, placement: Placement::Split(Zone::Right) }]);
+    d.settle();
+    assert!(close(group(&d, TOOLS).union(group(&d, INFO)), tools));
+    assert_eq!((group(&d, PROJECT[0]), group(&d, TIMELINE), group(&d, METERS)), (project, timeline, meters));
+}
+
+/// Properties and a narrow Tools frame side by side, Tools `tools` wide in an area `width`
+/// wide, with Info floating at the left.
+fn beside_tools(width: f32, tools: f32) -> Driver {
+    let root = Node::Split {
+        axis: SplitAxis::Horizontal,
+        size: SplitSize::FixedSecond(tools),
+        first: Box::new(tabs(&PROPERTIES)),
+        second: Box::new(tabs(&[TOOLS])),
+    };
+    let layout = Layout { root: Some(root), floating: vec![Floating::single(vec![INFO], 0, [width + 100.0, 100.0, 280.0, 200.0])] };
+    let mut d = driver(layout, Film::default());
+    d.area = Rect::from_min_size(Pos2::ZERO, vec2(width, SCREEN.y));
+    d.settle();
+    d
+}
+
+#[test]
+fn a_drop_beside_a_frame_too_narrow_to_halve_takes_room_from_its_neighbour() {
+    let mut d = beside_tools(1000.0, 60.0);
+    let (tools, properties, info) = (group(&d, TOOLS), group(&d, PROPERTIES[0]), group(&d, INFO));
+    let left = zone_shape(tools, 26.0, 40.0, Zone::Left).unwrap();
+    let at = pos2(tools.left() + 4.0, tools.center().y + 13.0);
+    d.hold(tab(&d, INFO), at);
+    assert!(d.filled_polygon(&left), "Tools' left zone is a target");
+    let out = d.release(at);
+    assert!(
+        matches!(&out.actions[..], [Action::Move { panel: INFO, anchor: TOOLS, placement: Placement::SplitSized { zone: Zone::Left, .. } }]),
+        "{:?}",
+        out.actions
+    );
+    d.settle();
+    let (new_tools, new_info, new_properties) = (group(&d, TOOLS), group(&d, INFO), group(&d, PROPERTIES[0]));
+    assert!((new_tools.width() - tools.width()).abs() < 1.0, "Tools keeps its width: {new_tools:?}");
+    assert!((new_info.width() - info.width()).abs() < 1.0, "Info keeps its floating width: {new_info:?}");
+    assert!(new_info.right() < new_tools.left() && new_properties.right() < new_info.left());
+    assert!(new_properties.width() < properties.width() - 200.0, "Properties gave the room");
+}
+
+/// Tools first in its row, at the area's left edge: its left side has no divider, so the room
+/// comes from beyond its right one.
+#[test]
+fn a_drop_on_the_outer_side_of_a_frame_too_narrow_to_halve_takes_room_from_the_other_side() {
+    let root = Node::Split {
+        axis: SplitAxis::Horizontal,
+        size: SplitSize::FixedFirst(60.0),
+        first: Box::new(tabs(&[TOOLS])),
+        second: Box::new(tabs(&PROPERTIES)),
+    };
+    let layout = Layout { root: Some(root), floating: vec![Floating::single(vec![INFO], 0, [1100.0, 100.0, 280.0, 200.0])] };
+    let mut d = driver(layout, Film::default());
+    d.area = Rect::from_min_size(Pos2::ZERO, vec2(1000.0, SCREEN.y));
+    d.settle();
+    let (tools, properties, info) = (group(&d, TOOLS), group(&d, PROPERTIES[0]), group(&d, INFO));
+    // Inside Tools' left zone, past the window edge band.
+    let at = pos2(tools.left() + 12.0, tools.center().y + 13.0);
+    d.hold(tab(&d, INFO), at);
+    assert!(d.filled_polygon(&zone_shape(tools, 26.0, 40.0, Zone::Left).unwrap()), "Tools' left zone is a target");
+    let out = d.release(at);
+    assert!(
+        matches!(&out.actions[..], [Action::Move { panel: INFO, anchor: TOOLS, placement: Placement::SplitSized { zone: Zone::Left, .. } }]),
+        "{:?}",
+        out.actions
+    );
+    d.settle();
+    let (new_tools, new_info, new_properties) = (group(&d, TOOLS), group(&d, INFO), group(&d, PROPERTIES[0]));
+    assert!((new_tools.width() - tools.width()).abs() < 1.0, "Tools keeps its width: {new_tools:?}");
+    assert!((new_info.width() - info.width()).abs() < 1.0, "Info keeps its floating width: {new_info:?}");
+    assert!(new_info.right() < new_tools.left() && new_tools.right() < new_properties.left());
+    assert!(new_properties.width() < properties.width() - 200.0, "Properties gave the room");
+}
+
+#[test]
+fn a_docked_panel_dropped_beside_a_frame_too_narrow_to_halve_takes_its_minimum_width() {
+    // Info docked below Properties, as wide as it, beside a narrow Tools frame.
+    let root = Node::Split {
+        axis: SplitAxis::Horizontal,
+        size: SplitSize::FixedSecond(60.0),
+        first: Box::new(split(SplitAxis::Vertical, 0.6, tabs(&PROPERTIES), tabs(&[INFO]))),
+        second: Box::new(tabs(&[TOOLS])),
+    };
+    let mut d = driver(Layout { root: Some(root), floating: Vec::new() }, Film::default());
+    d.area = Rect::from_min_size(Pos2::ZERO, vec2(1000.0, SCREEN.y));
+    d.settle();
+    let (tools, properties) = (group(&d, TOOLS), group(&d, PROPERTIES[0]));
+    let out = d.drag(tab(&d, INFO), pos2(tools.left() + 4.0, tools.center().y + 13.0));
+    assert!(
+        matches!(&out.actions[..], [Action::Move { panel: INFO, anchor: TOOLS, placement: Placement::SplitSized { zone: Zone::Left, .. } }]),
+        "{:?}",
+        out.actions
+    );
+    d.settle();
+    let (new_tools, new_info, new_properties) = (group(&d, TOOLS), group(&d, INFO), group(&d, PROPERTIES[0]));
+    assert!((new_tools.width() - tools.width()).abs() < 1.0, "Tools keeps its width: {new_tools:?}");
+    assert!(new_info.width() < 60.0, "Info takes its minimum, not its docked width: {new_info:?}");
+    assert!(new_properties.width() > properties.width() - 60.0, "Properties gives only that: {new_properties:?}");
+}
+
+#[test]
+fn a_drop_beside_a_narrow_frame_joins_it_when_no_neighbour_has_room() {
+    let mut d = beside_tools(130.0, 60.0);
+    let tools = group(&d, TOOLS);
+    let at = pos2(tools.left() + 4.0, tools.center().y + 13.0);
+    let out = d.drag(tab(&d, INFO), at);
+    assert!(
+        matches!(&out.actions[..], [Action::Move { panel: INFO, anchor: TOOLS, placement: Placement::Tab { .. } | Placement::Split(Zone::Center) }]),
+        "{:?}",
+        out.actions
+    );
+}
+
+#[test]
+fn every_divider_travels_after_drops() {
+    let mut d = film();
+    let tools = group(&d, TOOLS);
+    d.drag(tab(&d, INFO), pos2(tools.right() - 8.0, tools.center().y + 13.0));
+    d.settle();
+    let meters = group(&d, METERS);
+    d.drag(tab(&d, PROGRAM), pos2(meters.center().x, meters.center().y + 13.0));
+    d.settle();
+    let timeline = group(&d, TIMELINE);
+    d.drag(tab(&d, PROPERTIES[0]), pos2(timeline.center().x, timeline.bottom() - 10.0));
+    d.settle();
+    assert_dividers_travel(&mut d);
+}
+
+/// Each split divider, in the docked layout and in floating windows, moves both ways when
+/// dragged, from the layout as it is.
+fn assert_dividers_travel(d: &mut Driver) {
+    let start = d.layout.clone();
+    let dividers: Vec<Hit<u32>> = d
+        .hits()
+        .into_iter()
+        .filter_map(|(hit, _)| matches!(hit, Hit::Divider(Divider::Split(_) | Divider::WindowSplit(..))).then_some(hit))
+        .collect();
+    assert!(!dividers.is_empty());
+    // A floating window may cover the dividers of the main area and of other windows.
+    let covers: Vec<(Rect, &Floating<u32>)> = start
+        .floating
+        .iter()
+        .map(|w| {
+            let drawn = w.panels().filter(|p| d.content.bodies.contains_key(p)).map(|p| group(d, *p));
+            let rect = Rect::from_min_size(pos2(w.rect[0], w.rect[1]), vec2(w.rect[2], w.rect[3]));
+            (drawn.fold(rect, |a, b| a.union(b)), w)
+        })
+        .collect();
+    for hit in dividers {
+        let own = |w: &Floating<u32>| matches!(&hit, Hit::Divider(Divider::WindowSplit(key, _)) if w.contains(key));
+        if d.hit(&hit).is_some_and(|r| covers.iter().any(|(c, w)| c.intersects(r) && !own(w))) {
+            continue;
+        }
+        for step in [12.0, -24.0] {
+            let Some(rect) = d.hit(&hit) else { continue };
+            let delta = if rect.width() < rect.height() { vec2(step, 0.0) } else { vec2(0.0, step) };
+            let before = d.layout.clone();
+            drag_hit(d, hit.clone(), delta);
+            assert_ne!(d.layout, before, "divider {hit:?} does not move by {step}");
+        }
+        d.layout = start.clone();
+        d.settle();
+    }
+}
+
+/// Every group at or above its minimum, and every divider with room both ways, in the docked
+/// layout and in each floating window. Reads the bodies drawn last.
+fn assert_sizes(d: &Driver, context: &str) {
+    let mut style = DockStyle::default();
+    frame_style(&mut style);
+    let sizer = Sizer { style: &style, content: &d.content };
+    let mut trees: Vec<(&Node<u32>, Rect)> = d.layout.root.iter().map(|root| (root, d.area)).collect();
+    for window in d.layout.floating.iter().filter(|w| !w.minimized) {
+        // The window's body is the union of its groups.
+        let drawn = window.panels().filter(|p| d.content.bodies.contains_key(p)).map(|p| group(d, *p));
+        if let Some(rect) = drawn.reduce(|a, b| a.union(b)) {
+            trees.push((&window.root, rect));
+        }
+    }
+    for (root, area) in trees {
+        let mut groups: Vec<Drawn<'_, u32>> = Vec::new();
+        sizer.groups(root, area, &mut groups);
+        for g in &groups {
+            let room = g.rect.size() - g.limits.min;
+            assert!(room.x >= -0.01 && room.y >= -0.01, "{context}: {:?} is below its minimum {:?}", g.rect, g.limits.min);
+        }
+        let mut nodes = vec![(root, area, Vec::new())];
+        while let Some((node, rect, path)) = nodes.pop() {
+            let Some([a, b]) = sizer.children(node, rect) else { continue };
+            let (lo, hi) = sizer.range((root, area), &path);
+            assert!(lo < -0.5 && hi > 0.5, "{context}: a divider is stuck ({lo}, {hi}) at {rect:?} in {:?}", d.layout);
+            for (second, (child, rect)) in [(false, a), (true, b)] {
+                let mut path = path.clone();
+                path.push(second);
+                nodes.push((child, rect, path));
+            }
+        }
+    }
+}
+
+/// A small deterministic generator, so a failing sequence repeats.
+struct Lcg(u64);
+
+impl Lcg {
+    fn next(&mut self) -> u64 {
+        self.0 = self.0.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1_442_695_040_888_963_407);
+        self.0 >> 33
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+    fn unit(&mut self) -> f32 {
+        (self.next() % 1000) as f32 / 1000.0
+    }
+}
+
+#[test]
+fn random_drops_leave_every_group_its_minimum_and_every_divider_travel() {
+    // Drops land in the docked layout and in two floating windows, one of them split; tabs and
+    // drag bars move panels and groups between all three, and Ctrl/Cmd floats some.
+    let windows = || {
+        let mut layout = editing();
+        layout.floating.push(Floating::new(hsplit(0.5, tabs(&[8]), tabs(&[50, 51])), [80.0, 420.0, 640.0, 380.0]));
+        layout
+    };
+    for seed in 1..=6u64 {
+        let mut rng = Lcg(seed);
+        let mut d = driver(windows(), Film::default());
+        let all = panel_set(&d.layout);
+        for step in 0..16 {
+            // Only the bodies drawn now.
+            d.content.bodies.clear();
+            d.settle();
+            let panels: Vec<u32> = d.layout.panels().into_iter().copied().collect();
+            let panel = panels[rng.below(panels.len())];
+            let bar = d.hit(&Hit::DragBar(panel)).filter(|_| rng.below(3) == 0);
+            let Some(from) = bar.or_else(|| d.hit(&Hit::Tab(panel))).map(|r| r.center()) else { continue };
+            let target = panels[rng.below(panels.len())];
+            let Some(rect) = d.content.bodies.get(&target).copied() else { continue };
+            let to = match rng.below(8) {
+                // A window edge.
+                0 => {
+                    let edges = [
+                        pos2(3.0, rect.center().y),
+                        pos2(SCREEN.x - 3.0, rect.center().y),
+                        pos2(rect.center().x, 3.0),
+                        pos2(rect.center().x, SCREEN.y - 3.0),
+                    ];
+                    edges[rng.below(4)]
+                }
+                // The tab row.
+                1 => pos2(rect.center().x, rect.top() - 13.0),
+                // Anywhere in the body: an edge band or the middle.
+                _ => rect.lerp_inside(vec2(0.02 + rng.unit() * 0.96, 0.02 + rng.unit() * 0.96)),
+            };
+            if rng.below(12) == 0 {
+                d.modifiers = Modifiers::COMMAND;
+            }
+            d.drag(from, to);
+            d.modifiers = Modifiers::NONE;
+            d.content.bodies.clear();
+            d.settle();
+            let context = format!("seed {seed}, step {step}");
+            assert_eq!(d.layout.validate(), Ok(()), "{context}");
+            assert_eq!(panel_set(&d.layout), all, "{context}: a panel was lost");
+            assert_sizes(&d, &context);
+        }
+        assert_dividers_travel(&mut d);
+    }
+}
+
+#[test]
+fn ctrl_or_cmd_floats_from_a_tab_or_a_drag_bar_and_the_preview_says_so() {
+    // The hint names the platform's key, as `ctx.os()` reports it in tests.
+    let key = if egui::os::OperatingSystem::from_target_os() == egui::os::OperatingSystem::Mac { "⌘" } else { "Ctrl" };
+    let hint = format!("Hold {key} to undock");
+    let floated = |actions: &[Action<u32>], panel: u32| match actions {
+        [Action::Float { panel: p, .. }] => *p == panel,
+        [Action::MoveGroup { panel: p, to: Target::Float { .. } }] => *p == panel,
+        _ => false,
+    };
+    fn texts(d: &Driver) -> Vec<String> {
+        fn walk(shape: &egui::Shape, out: &mut Vec<String>) {
+            match shape {
+                egui::Shape::Vec(shapes) => shapes.iter().for_each(|s| walk(s, out)),
+                egui::Shape::Text(text) => out.push(text.galley.text().to_owned()),
+                _ => {}
+            }
+        }
+        let mut out = Vec::new();
+        d.shapes().iter().for_each(|clipped| walk(&clipped.shape, &mut out));
+        out
+    }
+    let d = film();
+    let over = group(&d, TIMELINE).center() + vec2(0.0, 13.0);
+    let from_tab = tab(&d, PROJECT[0]);
+    let from_bar = d.hit(&Hit::DragBar(PROJECT[0])).unwrap().center();
+    for from in [from_tab, from_bar] {
+        // Without the modifier, a release over a group docks there; the preview names the modifier.
+        let mut d = film();
+        d.hold(from, over);
+        assert!(texts(&d).contains(&hint), "{from:?}: {:?}", texts(&d));
+        let out = d.release(over);
+        assert!(!out.actions.is_empty() && !floated(&out.actions, PROJECT[0]), "{from:?}: {:?}", out.actions);
+        // Held, it floats, and the hint is gone.
+        let mut d = film();
+        d.modifiers = Modifiers::COMMAND;
+        d.hold(from, over);
+        assert!(!texts(&d).contains(&hint), "{from:?}");
+        let out = d.release(over);
+        assert!(floated(&out.actions, PROJECT[0]), "{from:?}: {:?}", out.actions);
+    }
+}
+
+/// The Editing workspace under a 24 pt menu bar and above a 20 pt status bar.
+fn film_in_window() -> Driver {
+    let mut d = DockDriver::new(editing(), Film::default()).with_style(frame_style);
+    d.screen = Rect::from_min_size(Pos2::ZERO, SCREEN);
+    d.area = Rect::from_min_max(pos2(0.0, 24.0), pos2(SCREEN.x, SCREEN.y - 20.0));
+    d.settle();
+    d
+}
+
+#[test]
+fn a_release_over_no_target_inside_the_window_cancels_the_drag() {
+    let d = film_in_window();
+    let (source, program) = (group(&d, SOURCE[0]), group(&d, PROGRAM));
+    let gap = pos2((source.right() + program.left()) * 0.5, source.center().y);
+    let from_tab = tab(&d, PROJECT[0]);
+    let from_bar = d.hit(&Hit::DragBar(PROJECT[0])).unwrap().center();
+    for from in [from_tab, from_bar] {
+        for to in [pos2(600.0, 10.0), pos2(600.0, SCREEN.y - 8.0), gap] {
+            let mut d = film_in_window();
+            let before = d.layout.clone();
+            let out = d.drag(from, to);
+            d.settle();
+            assert!(out.actions.is_empty(), "{from:?} to {to:?}: {:?}", out.actions);
+            assert_eq!(d.layout, before, "{from:?} to {to:?}");
+        }
+        // Ctrl/Cmd held floats it there.
+        let mut d = film_in_window();
+        d.modifiers = Modifiers::COMMAND;
+        d.drag(from, pos2(600.0, 10.0));
+        d.settle();
+        assert!(d.layout.floating.iter().any(|w| w.contains(&PROJECT[0])), "{from:?}: {:?}", d.layout.floating);
+    }
+}
+
+#[test]
+fn a_release_outside_the_window_floats() {
+    let d = film_in_window();
+    let from_tab = tab(&d, PROJECT[0]);
+    let from_bar = d.hit(&Hit::DragBar(PROJECT[0])).unwrap().center();
+    for from in [from_tab, from_bar] {
+        let mut d = film_in_window();
+        d.hold(from, pos2(600.0, 10.0));
+        d.leave();
+        d.settle();
+        let window = d.layout.floating.iter().find(|w| w.contains(&PROJECT[0]));
+        assert!(window.is_some(), "{from:?}: {:?}", d.layout);
+        // A tab takes one panel; a drag bar takes the group.
+        assert_eq!(window.unwrap().contains(&PROJECT[1]), from == from_bar, "{from:?}");
+    }
+}
+
+#[test]
+fn the_title_bar_moves_a_floating_window_without_docking() {
+    let mut d = film();
+    let title = d.hit(&Hit::Title(INFO)).unwrap().center();
+    let timeline = group(&d, TIMELINE);
+    d.drag(title, timeline.center());
+    d.settle();
+    let window = d.layout.floating.iter().find(|w| w.contains(&INFO)).expect("still floating");
+    assert!(window.rect[0] < 1000.0 && window.rect[1] > 400.0, "moved towards the drop: {:?}", window.rect);
+    assert_eq!(d.layout.root, editing().root);
+}
+
+fn panel_set(layout: &Layout<u32>) -> Vec<u32> {
+    let mut panels: Vec<u32> = layout.panels().into_iter().copied().collect();
+    panels.sort_unstable();
+    panels
+}
+
+fn window_of(layout: &Layout<u32>, panel: u32) -> &Floating<u32> {
+    layout.floating.iter().find(|w| w.contains(&panel)).unwrap_or_else(|| panic!("{panel} does not float: {layout:?}"))
+}
+
+#[test]
+fn tabs_and_drag_bars_dock_into_a_floating_window_and_out_of_it() {
+    let mut d = film();
+    let all = panel_set(&d.layout);
+    let info = group(&d, INFO);
+    let out = d.drag(tab(&d, PROGRAM), pos2(info.left() + 10.0, info.center().y + 13.0));
+    assert_eq!(out.actions, vec![Action::Move { panel: PROGRAM, anchor: INFO, placement: Placement::Split(Zone::Left) }]);
+    d.settle();
+    assert!(matches!(window_of(&d.layout, INFO).root, Node::Split { axis: SplitAxis::Horizontal, .. }), "{:?}", d.layout.floating);
+    let (program, info) = (group(&d, PROGRAM), group(&d, INFO));
+    assert!(program.right() < info.left() && (program.width() - info.width()).abs() < 2.0, "{program:?} {info:?}");
+
+    // A drag bar inside the window moves its group to a group of the main area.
+    let timeline = group(&d, TIMELINE);
+    let bar = d.hit(&Hit::DragBar(INFO)).unwrap().center();
+    let out = d.drag(bar, timeline.center() + vec2(0.0, 13.0));
+    assert_eq!(out.actions, vec![Action::MoveGroup { panel: INFO, to: Target::At { anchor: TIMELINE, placement: Placement::Split(Zone::Center) } }]);
+    d.settle();
+    assert_eq!(window_of(&d.layout, PROGRAM).root, tabs(&[PROGRAM]));
+    assert_eq!(panel_set(&d.layout), all);
+}
+
+#[test]
+fn a_floating_window_tree_resizes_by_its_dividers_and_intersections() {
+    let mut layout = editing();
+    let tree = hsplit(0.5, tabs(&[INFO]), split(SplitAxis::Vertical, 0.5, tabs(&[50]), tabs(&[51])));
+    layout.floating = vec![Floating::new(tree, [700.0, 100.0, 600.0, 500.0])];
+    let mut d = driver(layout, Film::default());
+    let ratios = |d: &Driver| match &d.layout.floating[0].root {
+        Node::Split { size: SplitSize::Ratio(outer), second, .. } => match &**second {
+            Node::Split { size: SplitSize::Ratio(inner), .. } => (*outer, *inner),
+            other => panic!("{other:?}"),
+        },
+        other => panic!("{other:?}"),
+    };
+    let outer = Hit::Divider(Divider::WindowSplit(INFO, Vec::new()));
+    let inner = Hit::Divider(Divider::WindowSplit(INFO, vec![true]));
+    for (hit, delta) in [(&outer, vec2(30.0, 0.0)), (&outer, vec2(-60.0, 0.0)), (&inner, vec2(0.0, 30.0)), (&inner, vec2(0.0, -60.0))] {
+        let before = ratios(&d);
+        drag_hit(&mut d, hit.clone(), delta);
+        let after = ratios(&d);
+        let moved = if hit == &outer { (after.0 - before.0) * delta.x } else { (after.1 - before.1) * delta.y };
+        assert!(moved > 0.0, "{hit:?} by {delta:?}: {before:?} to {after:?}");
+        assert_eq!(d.layout.root, editing().root, "the main area keeps its sizes");
+    }
+    // The four-way handle where the inner divider meets the outer one moves both.
+    let before = ratios(&d);
+    drag_hit(&mut d, Hit::Divider(Divider::WindowIntersection(INFO, Vec::new(), vec![true])), vec2(25.0, 25.0));
+    let after = ratios(&d);
+    assert!(after.0 > before.0 && after.1 > before.1, "{before:?} to {after:?}");
+}
+
+#[test]
+fn moves_between_windows_are_one_action_and_lose_no_panel() {
+    let mut layout = editing();
+    layout.floating.push(Floating::single(vec![50, 51], 0, [200.0, 520.0, 320.0, 260.0]));
+    let mut d = driver(layout, Film::default());
+    let all = panel_set(&d.layout);
+    // Floating to floating: a whole group, by its drag bar, beside Info.
+    let info = group(&d, INFO);
+    let bar = d.hit(&Hit::DragBar(50)).unwrap().center();
+    let out = d.drag(bar, pos2(info.right() - 10.0, info.center().y + 13.0));
+    assert_eq!(out.actions, vec![Action::MoveGroup { panel: 50, to: Target::At { anchor: INFO, placement: Placement::Split(Zone::Right) } }]);
+    d.settle();
+    assert_eq!(d.layout.floating.len(), 1);
+    assert_eq!(panel_set(&d.layout), all);
+    // Main to floating: a tab joins the window's group.
+    let fifty = group(&d, 50);
+    let out = d.drag(tab(&d, SOURCE[1]), fifty.center() + vec2(0.0, 13.0));
+    assert_eq!(out.actions, vec![Action::Move { panel: SOURCE[1], anchor: 50, placement: Placement::Split(Zone::Center) }]);
+    d.settle();
+    assert!(window_of(&d.layout, 50).contains(&SOURCE[1]));
+    assert_eq!(panel_set(&d.layout), all);
+    assert_eq!(d.layout.validate(), Ok(()));
+}
+
+#[test]
+fn a_closed_floating_window_closes_its_panels_and_each_reopens_where_it_was() {
+    let mut layout = editing();
+    let tree = hsplit(0.4, tabs(&[INFO]), tabs(&[50]));
+    layout.floating = vec![Floating::new(tree.clone(), [700.0, 100.0, 600.0, 400.0])];
+    let mut d = driver(layout, Film::default());
+    let locations: Vec<_> = [INFO, 50].into_iter().map(|p| (p, d.layout.location(&p).unwrap())).collect();
+    let close = d.hit(&Hit::Close(INFO)).unwrap().center();
+    let out = d.click(close);
+    assert_eq!(out.actions, vec![Action::CloseWindow { panel: INFO }]);
+    assert!(d.layout.floating.is_empty() && !d.layout.contains(&50));
+    for (panel, location) in &locations {
+        d.layout.restore(*panel, location).unwrap();
+    }
+    let window = &d.layout.floating[0];
+    assert_eq!((&window.root, window.rect), (&tree, [700.0, 100.0, 600.0, 400.0]));
+}
+
+/// The zone outlines of the last frame: closed 1 pt paths without a fill.
+fn zone_outlines(d: &Driver) -> Vec<Vec<Pos2>> {
+    d.shapes()
+        .iter()
+        .filter_map(|clipped| match &clipped.shape {
+            egui::Shape::Path(path) if path.closed && path.fill == egui::Color32::TRANSPARENT && path.stroke.width == 1.0 => {
+                Some(path.points.clone())
+            }
+            _ => None,
+        })
+        .collect()
+}
+
+fn same_polygon(a: &[Pos2], b: &[Pos2]) -> bool {
+    a.len() == b.len() && a.iter().zip(b).all(|(a, b)| a.distance(*b) <= 0.5)
+}
+
+fn corners(rect: Rect) -> Vec<Pos2> {
+    vec![rect.left_top(), rect.right_top(), rect.right_bottom(), rect.left_bottom()]
+}
+
+#[test]
+fn the_preview_fills_the_zone_under_the_pointer_and_no_result_rect() {
+    let d = film();
+    let timeline = group(&d, TIMELINE);
+    let strip = Rect::from_min_size(timeline.min, vec2(timeline.width(), 26.0));
+    // A side band: its trapezoid, without the half the panel takes.
+    for (zone, at) in
+        [(Zone::Left, pos2(timeline.left() + 8.0, timeline.center().y + 13.0)), (Zone::Bottom, pos2(timeline.center().x, timeline.bottom() - 20.0))]
+    {
+        let mut d = film();
+        d.hold(tab(&d, INFO), at);
+        assert!(d.filled_polygon(&zone_shape(timeline, 26.0, 40.0, zone).unwrap()), "{zone:?}");
+        assert!(!d.outlined(zone_rect(timeline, zone).unwrap().shrink(1.0)), "{zone:?}");
+        d.key(egui::Key::Escape);
+    }
+    // The middle and the tab row: the center rectangle and the strip.
+    for at in [timeline.center() + vec2(0.0, 13.0), strip.center()] {
+        let mut d = film();
+        d.hold(tab(&d, INFO), at);
+        assert!(d.filled_polygon(&zone_shape(timeline, 26.0, 40.0, Zone::Center).unwrap()), "{at:?}");
+        assert!(d.filled_polygon(&corners(strip)), "{at:?}");
+        assert!(!d.outlined(timeline.shrink(1.0)), "{at:?}");
+        d.key(egui::Key::Escape);
+    }
+    // A group's drag bar shows the same.
+    let mut d = film();
+    let bar = d.hit(&Hit::DragBar(PROJECT[0])).unwrap().center();
+    d.hold(bar, pos2(timeline.left() + 8.0, timeline.center().y + 13.0));
+    assert!(d.filled_polygon(&zone_shape(timeline, 26.0, 40.0, Zone::Left).unwrap()));
+    assert_eq!(zone_outlines(&d).len(), 6);
+    d.key(egui::Key::Escape);
+
+    // The dock-and-canvas arrangement shows the rect the panel takes there instead.
+    let mut d = DockDriver::new(editing(), Film::default());
+    d.screen = Rect::from_min_size(Pos2::ZERO, SCREEN);
+    d.area = d.screen;
+    d.settle();
+    let at = pos2(timeline.left() + 8.0, timeline.center().y + 13.0);
+    d.hold(tab(&d, INFO), at);
+    assert!(!d.filled_polygon(&zone_shape(timeline, 26.0, 40.0, Zone::Left).unwrap()));
+    assert!(zone_outlines(&d).is_empty());
+    assert!(!d.filled(zone_rect(timeline, Zone::Left).unwrap().shrink(1.0)));
+    let shapes = d.shapes().to_vec();
+    d.release(at);
+    d.settle();
+    let info = group(&d, INFO);
+    assert_eq!(info.left(), timeline.left());
+    let painted = |fill: egui::Color32, stroke: f32| {
+        shapes.iter().any(|c| matches!(&c.shape, egui::Shape::Rect(r) if r.rect == info.shrink(1.0) && r.fill == fill && r.stroke.width == stroke))
+    };
+    let accent = DockStyle::default().accent;
+    assert!(painted(accent.gamma_multiply(0.08), 0.0) && painted(egui::Color32::TRANSPARENT, 2.0), "Info's rect beside the timeline");
+}
+
+#[test]
+fn a_drag_over_a_group_outlines_all_its_zones_and_fills_the_one_drop_zone_names() {
+    let d = film();
+    let timeline = group(&d, TIMELINE);
+    let strip = Rect::from_min_size(timeline.min, vec2(timeline.width(), 26.0));
+    let shape = |zone| zone_shape(timeline, 26.0, 40.0, zone).unwrap();
+    let all: Vec<Vec<Pos2>> =
+        [Zone::Left, Zone::Right, Zone::Top, Zone::Bottom, Zone::Center].map(shape).into_iter().chain([corners(strip)]).collect();
+    let body = Rect::from_min_max(pos2(timeline.left(), strip.bottom()), timeline.max);
+    // Each band, near its corners too, the middle, and the tab row.
+    let points = [
+        pos2(body.left() + 30.0, body.center().y),
+        pos2(body.left() + 30.0, body.top() + 34.0),
+        pos2(body.right() - 2.0, body.bottom() - 12.0),
+        pos2(body.center().x, body.top() + 5.0),
+        pos2(body.left() + 50.0, body.bottom() - 30.0),
+        body.center(),
+        pos2(body.left() + 45.0, body.top() + 45.0),
+        strip.center(),
+    ];
+    for at in points {
+        let mut d = film();
+        d.hold(tab(&d, INFO), at);
+        let outlines = zone_outlines(&d);
+        assert_eq!(outlines.len(), all.len(), "{at:?}: four sides, the center and the strip");
+        assert!(all.iter().all(|zone| outlines.iter().any(|o| same_polygon(o, zone))), "{at:?}: only Timeline's zones");
+        let zone = drop_zone(timeline, 26.0, 40.0, at).unwrap();
+        assert!(d.filled_polygon(&shape(zone)), "{at:?}: {zone:?} is filled");
+        let filled = all.iter().filter(|z| d.filled_polygon(z)).count();
+        assert_eq!(filled, if zone == Zone::Center { 2 } else { 1 }, "{at:?}: only {zone:?}");
+        d.key(egui::Key::Escape);
+    }
+}
+
+#[test]
+fn zones_a_group_does_not_take_are_not_drawn() {
+    let timeline = group(&film(), TIMELINE);
+    let strip = Rect::from_min_size(timeline.min, vec2(timeline.width(), 26.0));
+    let shape = |zone| zone_shape(timeline, 26.0, 40.0, zone).unwrap();
+    let at = pos2(timeline.left() + 8.0, timeline.center().y + 13.0);
+    let content = |rules: Permissions| Film { rules: HashMap::from([(TIMELINE, rules)]), ..Film::default() };
+    // No splits: the center and the strip only, and the left band under the pointer neither
+    // outlined nor filled.
+    let mut d = driver(editing(), content(Permissions { accepts_splits: false, ..Permissions::default() }));
+    d.hold(tab(&d, INFO), at);
+    let outlines = zone_outlines(&d);
+    assert_eq!(outlines.len(), 2, "{outlines:?}");
+    assert!(outlines.iter().any(|o| same_polygon(o, &shape(Zone::Center))) && outlines.iter().any(|o| same_polygon(o, &corners(strip))));
+    assert!(!d.filled_polygon(&shape(Zone::Left)));
+    d.key(egui::Key::Escape);
+    // No tabs: the four sides only.
+    let mut d = driver(editing(), content(Permissions { accepts_tabs: false, ..Permissions::default() }));
+    d.hold(tab(&d, INFO), at);
+    let outlines = zone_outlines(&d);
+    assert_eq!(outlines.len(), 4, "{outlines:?}");
+    assert!([Zone::Left, Zone::Right, Zone::Top, Zone::Bottom].into_iter().all(|z| outlines.iter().any(|o| same_polygon(o, &shape(z)))));
+    assert!(d.filled_polygon(&shape(Zone::Left)));
+    d.key(egui::Key::Escape);
+    // A tab over its own single-tab group: nothing to drop on.
+    let mut d = film();
+    d.hold(tab(&d, TIMELINE), timeline.center() + vec2(0.0, 13.0));
+    assert!(zone_outlines(&d).is_empty());
+}
+
+#[test]
+fn a_narrow_group_splits_on_every_side_and_its_neighbours_give_the_room() {
+    // Tools at 80 pt: two halves need 84, so a side split takes the rest from Timeline.
+    let narrow = || {
+        let mut d = film();
+        let width = group(&d, TOOLS).width();
+        drag_hit(&mut d, divider(&[true, true]), vec2(80.0 - width, 0.0));
+        d
+    };
+    let d = narrow();
+    let (tools, timeline) = (group(&d, TOOLS), group(&d, TIMELINE));
+    assert_eq!(tools.width().round(), 80.0);
+    let body_top = tools.top() + 26.0;
+    for (zone, at) in [
+        (Zone::Left, pos2(tools.left() + 5.0, tools.center().y)),
+        (Zone::Right, pos2(tools.right() - 5.0, tools.center().y)),
+        (Zone::Top, pos2(tools.center().x, body_top + 5.0)),
+        (Zone::Bottom, pos2(tools.center().x, tools.bottom() - 15.0)),
+    ] {
+        let mut d = narrow();
+        d.hold(tab(&d, INFO), at);
+        assert_eq!(zone_outlines(&d).len(), 6, "{zone:?}: four sides, the center and the strip");
+        assert!(d.filled_polygon(&zone_shape(tools, 26.0, 40.0, zone).unwrap()), "{zone:?} is filled");
+        let out = d.release(at);
+        assert_eq!(out.actions, vec![Action::Move { panel: INFO, anchor: TOOLS, placement: Placement::Split(zone) }]);
+        d.settle();
+        let (info, split) = (group(&d, INFO), group(&d, TOOLS));
+        let beside = match zone {
+            Zone::Left => info.right() < split.left(),
+            Zone::Right => info.left() > split.right(),
+            Zone::Top => info.bottom() < split.top(),
+            _ => info.top() > split.bottom(),
+        };
+        assert!(beside, "{zone:?}: Info {info:?}, Tools {split:?}");
+        if matches!(zone, Zone::Left | Zone::Right) {
+            assert_eq!((info.width(), split.width()), (40.0, 40.0), "{zone:?}");
+            assert!((group(&d, TIMELINE).width() - (timeline.width() - 4.0)).abs() < 1.0, "{zone:?}: Timeline gives the room");
+        }
+        assert_sizes(&d, &format!("{zone:?}"));
+    }
+}
diff --git a/crates/ui/src/docking/surface.rs b/crates/ui/src/docking/surface.rs
index 00b56b07..a4381c54 100644
--- a/crates/ui/src/docking/surface.rs
+++ b/crates/ui/src/docking/surface.rs
@@ -1,16 +1,15 @@
-use std::{fmt::Debug, hash::Hash};
+use std::{collections::HashMap, fmt::Debug, hash::Hash};
 
-use egui::{Color32, Context, FontId, Id, Key, Pos2, Rect, Sense, Stroke, StrokeKind, Ui, UiBuilder, Vec2, pos2, vec2};
+use egui::{Color32, Context, FontId, Id, Pos2, Rect, Sense, Stroke, Ui, Vec2};
 
-use crate::{
-    layout::{ResizeHandle, ResizeHandleStyle, SplitAxis, SplitSize, split_rect},
-    tabs,
-};
+use super::{Action, DockError, DropTarget, Layout, Monitor, Permissions, render::Renderer, resize::AnchoredResize};
 
-use super::{Action, DockError, DropTarget, Layout, Node, Permissions, Placement, resolve_drop};
+/// Horizontal room around a tab's label, both when measuring its natural width and when cutting it.
+pub(super) const TAB_PADDING: f32 = 24.0;
 
 /// Application-supplied chrome. Body renderers retain their own UI style and contents.
 #[derive(Clone, Debug)]
+#[non_exhaustive]
 pub struct DockStyle {
     pub tab_height: f32,
     pub gap: f32,
@@ -26,15 +25,153 @@ pub struct DockStyle {
     /// Localize these action labels in the application adapter.
     pub float_label: String,
     pub close_label: String,
-    pub move_label: String,
+    /// Tab menu item that moves one panel into another group (submenu of target panels).
+    pub move_panel_to_label: String,
     pub panels_label: String,
     pub resize_label: String,
     pub resize_window_label: String,
+    /// Accessibility label of a group's drag bar and top border.
+    pub move_group_label: String,
+    pub close_group_label: String,
+    pub minimize_label: String,
+    pub expand_label: String,
+    pub float_group_label: String,
+    /// Group menu item that moves the whole group into another group (submenu of targets).
+    pub move_group_to_label: String,
+    /// Minimum width of the drag bar left of the group header. Tabs shrink, then overflow,
+    /// before the bar narrows; a strip narrower than the header plus this width narrows it.
+    pub drag_bar_width: f32,
+    /// Narrowest a tab gets before the tabs that do not fit go to the overflow menu: about
+    /// three characters and the "…" at [`Self::font`]'s size, plus the tab's 24 pt padding
+    /// (54 pt at the default 12 pt font). Tabs whose names are shorter keep their natural
+    /// width. Set it again after changing the font.
+    pub min_tab_width: f32,
+    /// Painted under every floating window, so it stays opaque when the panel colors are not.
+    pub floating_background: Color32,
+    pub floating_stroke: Stroke,
+    /// Painted over a native floating window while [`DockArea::input_blocked`] is on.
+    pub blocked_dim: Color32,
+    /// Height of a floating window's title bar.
+    pub title_height: f32,
+    /// Width of the band along the layout's outer edge that splits at the root (28 pt). It is
+    /// at most a quarter of the layout's width and height. Not used with
+    /// [`Self::side_edge_zones`], whose band is 8 pt.
+    pub edge_band: f32,
+    /// The split-tree profile. The outer edge band also runs along the left and right edges,
+    /// where a drop adds a full-height column. A group's side zones are trapezoids
+    /// [`crate::docking::SIDE_EDGE_ZONE_DEPTH`] deep (see [`crate::docking::drop_zone`]), a drag
+    /// outlines them, and a split previews the half of the group it takes. Off: only the top and
+    /// bottom edges add a full-width row, a group's zones are [`Self::side_zone_fraction`] of its
+    /// body, and every preview is a line or a tab outline.
+    pub side_edge_zones: bool,
+    /// Which sides of the layout's outer edge, and of a group that takes no tabs (a canvas)
+    /// without [`Self::new_dock_zones`], take a drop (all four). With [`Self::new_dock_zones`]
+    /// a canvas body takes no drop, and without [`Self::side_edge_zones`] the outer left and
+    /// right edges are new docks, so only top and bottom apply there. A dock-column app whose
+    /// palettes dock only at the left and right sets [`crate::docking::Sides::NONE`] with
+    /// [`Self::new_dock_zones`] on. Not used with [`Self::side_edge_zones`]. Groups that take
+    /// tabs keep all four sides.
+    pub drop_edges: super::Sides,
+    /// The share of a group's body, below the tab strip, that means "beside" on each side: of
+    /// its width from the left and right edges, of its height from the top and bottom edges
+    /// (one third, at most one half). The middle joins the group as a tab. Not used with
+    /// [`Self::side_edge_zones`].
+    pub side_zone_fraction: f32,
+    /// Width of the line that a drop on a band along the layout's outer edge (a new dock, a new
+    /// outermost column or the outer edge band), a drop between the icon groups of an iconic
+    /// column, and every dock drop with [`Self::side_edge_zones`] preview with, and of the line
+    /// [`crate::docking::ZoneRule::Fraction`] gives hosts as a side's preview (4 pt, more than
+    /// zero). Other drops beside a group, column or dock preview the rect the moved panels
+    /// take. Border bands reach 4 pt past this line into a tab strip.
+    pub drop_line_width: f32,
+    /// [D] The docking profile. The docked area's left and right edges, where no dock is yet,
+    /// take a drop as a new dock (see [`Self::new_dock_band`]). Without
+    /// [`Self::side_edge_zones`], the body of a frame or floating group that takes no tabs (a
+    /// canvas) takes no drop: a release there floats as over no target.
+    pub new_dock_zones: bool,
+    /// [D] Height of the bar above each dock column. It drags the column and holds its »/« button.
+    pub column_bar_height: f32,
+    /// [D] Height of the band centred on the seam between two stacked groups in a dock column
+    /// (28 pt).
+    pub seam_band: f32,
+    /// [D] Width of the band centred on each edge of a dock column, where a drop makes a new
+    /// column (28 pt).
+    pub column_edge_band: f32,
+    /// [D] Width of the band along the docked area's left and right edges, and inside an empty
+    /// dock, that makes a new dock (28 pt).
+    pub new_dock_band: f32,
+    /// [D] Side of a panel icon in an iconic column; each icon row is 10 pt taller.
+    pub icon_size: f32,
+    /// [D] Width of an iconic column without a saved width, and the narrowest it gets.
+    pub iconic_width: f32,
+    /// [D] Widest an iconic column gets by dragging its inner edge.
+    pub iconic_max_width: f32,
+    /// [D] An iconic column at least this wide shows panel names beside the icons.
+    pub iconic_label_width: f32,
+    /// [D] Column menu item that toggles Auto-Collapse Iconic Panels.
+    pub auto_collapse_label: String,
+    /// [D] Lay docks out right to left: `Side::Start` is the right edge. egui has no app-wide
+    /// layout direction, so the host sets this from its locale. Splits keep their sides.
+    pub right_to_left: bool,
+    /// [D] Accessibility label of a column bar.
+    pub move_column_label: String,
+    /// [D] Column menu and group menu items.
+    pub collapse_to_icons_label: String,
+    pub expand_panels_label: String,
+    /// [D] Accessibility labels of the column bar's »/« button, distinct from the menu items.
+    pub collapse_column_label: String,
+    pub expand_column_label: String,
+    pub move_window_label: String,
+    pub close_window_label: String,
+    /// Group menu items Close Other Panels in Group, and Maximize Frame / Restore Frame Size
+    /// for groups of the split tree, each shown when its flag is on.
+    pub close_others_label: String,
+    pub close_others_item: bool,
+    pub maximize_label: String,
+    pub restore_frame_label: String,
+    pub maximize_item: bool,
+    /// Shown under the pointer while a drag offers a docking target, when [`Self::float_hint`]
+    /// is on. `{key}` stands for the modifier that floats the drop instead: ⌘ on macOS, Ctrl
+    /// elsewhere.
+    pub float_hint_label: String,
+    pub float_hint: bool,
+    /// Ctrl/Cmd held when a tab drag of a split-tree group starts makes its drop float, even
+    /// when the key is let go during the drag. Off: only the key held at the drop counts.
+    pub command_press_floats: bool,
+    /// A drag released over no drop target inside the window floats what it carries, such as
+    /// a panel dropped on a protected canvas. Off: that release cancels the drag; only
+    /// Ctrl/Cmd or a release outside the window floats.
+    pub float_on_empty_drop: bool,
+    /// Dragging a floating window's title bar onto a drop target docks the whole window there.
+    /// Off: the title bar only moves the window; tabs and drag bars dock.
+    pub title_bar_docks: bool,
+    /// Show the built-in Close items in tab and group menus (Close Panel, Close Tab Group,
+    /// Close Other Panels in Group) for closable panels. A host that draws its own Close items
+    /// turns this off and keeps [`Permissions::closable`], so its close actions still apply.
+    pub close_menu_items: bool,
+    /// Show × on the title bar of a floating window whose panels are all closable.
+    pub close_button: bool,
+    /// The mouse wheel over a tab strip selects the next or previous tab, one per notch.
+    pub wheel_selects_tabs: bool,
+    /// A middle click on a tab closes its panel when the panel is closable.
+    pub middle_click_closes_tabs: bool,
+}
+
+impl Default for DockStyle {
+    /// [`Self::from_visuals`] with egui's default visuals.
+    fn default() -> Self {
+        Self::from_visuals(&egui::Visuals::default())
+    }
 }
 
 impl DockStyle {
+    /// Colors from the `ui`'s visuals; adjust fields afterwards.
     pub fn from_ui(ui: &Ui) -> Self {
-        let visuals = ui.visuals();
+        Self::from_visuals(ui.visuals())
+    }
+
+    pub fn from_visuals(visuals: &egui::Visuals) -> Self {
+        let font = FontId::proportional(12.0);
         Self {
             tab_height: 26.0,
             gap: 4.0,
@@ -46,20 +183,127 @@ impl DockStyle {
             inactive_text: visuals.weak_text_color(),
             border: visuals.widgets.noninteractive.bg_stroke,
             accent: visuals.selection.stroke.color,
-            font: FontId::proportional(12.0),
-            float_label: "Float panel".into(),
-            close_label: "Close panel".into(),
-            move_label: "Move to group".into(),
+            min_tab_width: font.size * 2.5 + TAB_PADDING,
+            font,
+            float_label: "Float Panel".into(),
+            close_label: "Close Panel".into(),
+            move_panel_to_label: "Move Panel to Group".into(),
             panels_label: "Panels".into(),
             resize_label: "Resize panels".into(),
             resize_window_label: "Resize panel window".into(),
+            move_group_label: "Move tab group".into(),
+            close_group_label: "Close Tab Group".into(),
+            minimize_label: "Minimize".into(),
+            expand_label: "Expand".into(),
+            float_group_label: "Float Tab Group".into(),
+            move_group_to_label: "Move Group To".into(),
+            drag_bar_width: 40.0,
+            floating_background: visuals.window_fill,
+            floating_stroke: visuals.window_stroke,
+            blocked_dim: visuals.panel_fill.gamma_multiply(0.6),
+            title_height: super::chrome::TITLE_HEIGHT,
+            edge_band: 28.0,
+            side_edge_zones: false,
+            drop_edges: super::Sides::ALL,
+            side_zone_fraction: 1.0 / 3.0,
+            drop_line_width: 4.0,
+            new_dock_zones: true,
+            column_bar_height: 14.0,
+            seam_band: 28.0,
+            column_edge_band: 28.0,
+            new_dock_band: 28.0,
+            icon_size: 20.0,
+            iconic_width: 36.0,
+            iconic_max_width: 240.0,
+            iconic_label_width: 96.0,
+            auto_collapse_label: "Auto-Collapse Iconic Panels".into(),
+            right_to_left: false,
+            move_column_label: "Move panel column".into(),
+            collapse_to_icons_label: "Collapse to Icons".into(),
+            expand_panels_label: "Expand Panels".into(),
+            collapse_column_label: "Collapse column to icons".into(),
+            expand_column_label: "Expand column".into(),
+            move_window_label: "Move panel window".into(),
+            close_window_label: "Close panel window".into(),
+            close_others_label: "Close Other Panels in Group".into(),
+            close_others_item: false,
+            maximize_label: "Maximize Frame".into(),
+            restore_frame_label: "Restore Frame Size".into(),
+            maximize_item: false,
+            float_hint_label: "Hold {key} to undock".into(),
+            float_hint: false,
+            command_press_floats: false,
+            float_on_empty_drop: true,
+            title_bar_docks: true,
+            close_menu_items: true,
+            close_button: true,
+            wheel_selects_tabs: false,
+            middle_click_closes_tabs: false,
         }
     }
 
-    fn valid(&self) -> bool {
-        [self.tab_height, self.gap, self.min_pane, self.border.width, self.font.size].iter().all(|v| v.is_finite() && (0.0..=4096.0).contains(v))
+    /// The sides [`Self::drop_edges`] gives in this profile: all four with
+    /// [`Self::side_edge_zones`].
+    pub(super) fn drop_sides(&self) -> super::Sides {
+        if self.side_edge_zones { super::Sides::ALL } else { self.drop_edges }
+    }
+
+    /// The sides of a frame or floating group that takes no tabs (a canvas) whose body takes a
+    /// drop: none in the docking profile ([`Self::new_dock_zones`] without
+    /// [`Self::side_edge_zones`]), where only the bands along borders dock beside it, else
+    /// [`Self::drop_sides`].
+    pub(super) fn canvas_sides(&self) -> super::Sides {
+        if self.side_edge_zones || !self.new_dock_zones { self.drop_sides() } else { super::Sides::NONE }
+    }
+
+    /// The outer edges that take a drop: all four with [`Self::side_edge_zones`], else the top
+    /// and bottom of [`Self::drop_edges`].
+    pub(super) fn outer_edges(&self) -> super::Sides {
+        let sides = self.drop_sides();
+        if self.side_edge_zones { sides } else { super::Sides { left: false, right: false, ..sides } }
+    }
+
+    /// How a group's body divides into drop zones: [`crate::docking::SIDE_EDGE_ZONE_DEPTH`] deep
+    /// with [`Self::side_edge_zones`], else [`Self::side_zone_fraction`] of it, with
+    /// [`Self::drop_line_width`] previews. Pass it to [`crate::docking::resolve_drop_by`].
+    pub fn zone_rule(&self) -> super::ZoneRule {
+        if self.side_edge_zones {
+            super::ZoneRule::Depth(super::SIDE_EDGE_ZONE_DEPTH)
+        } else {
+            super::ZoneRule::Fraction { fraction: self.side_zone_fraction, line: self.drop_line_width }
+        }
+    }
+
+    pub(super) fn valid(&self) -> bool {
+        [
+            self.tab_height,
+            self.gap,
+            self.min_pane,
+            self.border.width,
+            self.font.size,
+            self.drag_bar_width,
+            self.min_tab_width,
+            self.floating_stroke.width,
+            self.title_height,
+            self.edge_band,
+            self.side_zone_fraction,
+            self.drop_line_width,
+            self.column_bar_height,
+            self.seam_band,
+            self.column_edge_band,
+            self.new_dock_band,
+            self.icon_size,
+            self.iconic_width,
+            self.iconic_max_width,
+            self.iconic_label_width,
+        ]
+        .iter()
+        .all(|v| v.is_finite() && (0.0..=4096.0).contains(v))
+            && self.iconic_width <= self.iconic_max_width
             && self.tab_height > 0.0
             && self.font.size > 0.0
+            && self.drop_line_width > 0.0
+            && self.side_zone_fraction <= 0.5
     }
 }
 
@@ -67,21 +311,309 @@ impl DockStyle {
 pub struct DockOutput<P> {
     pub actions: Vec<Action<P>>,
     pub error: Option<DockError>,
+    /// The panel the user focused this frame: a clicked tab or menu entry, a drop, or a press
+    /// of any pointer button in a panel body (stripless panels included) or in a group header,
+    /// which focuses the group's shown panel. Only user input sets
+    /// it; [`DockArea::raise_panel`] and host commands do not.
     pub focused: Option<P>,
     /// Whole-floating-group gesture identity; host may display its own group drop preview.
     pub group_drag: Option<P>,
     /// Whole-group release for host-owned atomic docking policy.
     pub group_drop: Option<(P, Pos2)>,
+    /// Requests that are not layout actions.
+    pub events: Vec<DockEvent<P>>,
+    /// Key, text and clipboard events (`Key`, `Text`, `Copy`, `Cut`, `Paste`) that reached a
+    /// floating window in its own OS window and that none of its widgets used (feature
+    /// `native-windows`). egui hands each OS window only its own input, so an application
+    /// passes these to the shortcut handling it runs on the main window's input. A window
+    /// where a widget has keyboard focus forwards nothing.
+    pub forwarded_events: Vec<egui::Event>,
+    /// The modifiers held in the native window that forwarded `forwarded_events`, where it
+    /// forwarded any. egui-winit turns Cmd/Ctrl+C, X and V into `Copy`, `Cut` and `Paste`
+    /// without the key, so these tell them from the keyboard's own Copy, Cut and Paste keys.
+    pub forwarded_modifiers: Option<egui::Modifiers>,
+    /// Files dragged over or dropped on floating windows in their own OS windows this frame,
+    /// one entry per window (feature `native-windows`). egui hands each OS window only its own
+    /// input, so the main window's `RawInput` never holds them.
+    pub window_files: Vec<WindowFiles<P>>,
+}
+
+/// Files dragged over or dropped on a native floating window in one frame.
+#[derive(Clone, Debug)]
+pub struct WindowFiles<P> {
+    /// [`super::Floating::id`] of the window.
+    pub window: u64,
+    /// The window's egui viewport.
+    pub viewport: egui::ViewportId,
+    /// The panel whose body is under the pointer, else the window's shown panel: the window
+    /// system may send no pointer moves while files are dragged in.
+    pub panel: P,
+    /// The pointer's last position in the window's coordinates, where egui has one.
+    pub pos: Option<Pos2>,
+    /// The window's `RawInput::hovered_files`.
+    pub hovered: Vec<egui::HoveredFile>,
+    /// The window's `RawInput::dropped_files`.
+    pub dropped: Vec<egui::DroppedFileHandle>,
 }
 
 impl<P> Default for DockOutput<P> {
     fn default() -> Self {
-        Self { actions: Vec::new(), error: None, focused: None, group_drag: None, group_drop: None }
+        Self {
+            actions: Vec::new(),
+            error: None,
+            focused: None,
+            group_drag: None,
+            group_drop: None,
+            events: Vec::new(),
+            forwarded_events: Vec::new(),
+            forwarded_modifiers: None,
+            window_files: Vec::new(),
+        }
     }
 }
 
+/// Room between the dock area's top-left corner and a unit a command floats.
+const FLOAT_INSET: f32 = 24.0;
+
+/// Size a command floats a panel at when its [`FloatSpace`] never drew it.
+#[cfg_attr(not(feature = "serde"), allow(dead_code))]
+pub(super) const DEFAULT_FLOAT: Vec2 = Vec2::new(260.0, 320.0);
+
+/// Where a docking command floats a panel, group or column when it gives no rect, and how the
+/// area draws its outer edge (see `DockCommand::to_actions`, feature `serde`). [`DockArea`]
+/// records one each frame; read it with [`float_space`].
+#[derive(Clone, Debug, PartialEq)]
+pub struct FloatSpace<P> {
+    /// The rect the area drew in. A floated unit goes inside it, 24 points from its top-left
+    /// corner, so it stays clear of the app's menu bar.
+    pub area: Rect,
+    /// What a drag floats from each drawn panel: the panel alone, its group and its dock column.
+    pub(super) panels: Vec<(P, Vec2)>,
+    pub(super) groups: Vec<(P, Vec2)>,
+    pub(super) columns: Vec<(P, Vec2)>,
+    /// The height each panel's content used when it was last drawn, which fits a floated group
+    /// to its content; `None` for content that filled its body.
+    pub(super) contents: Vec<(P, Option<f32>)>,
+    /// The area draws with [`DockStyle::side_edge_zones`]: an outer edge drop wraps the part
+    /// between the docks, never only the canvas column.
+    pub(super) side_edge_zones: bool,
+}
+
+impl<P: PartialEq> FloatSpace<P> {
+    /// An area with no recorded sizes: commands float a panel at 260x320, and a group or
+    /// column at its dock column's width (else 260) by 320.
+    pub fn new(area: Rect) -> Self {
+        Self { area, panels: Vec::new(), groups: Vec::new(), columns: Vec::new(), contents: Vec::new(), side_edge_zones: false }
+    }
+
+    /// For an area drawn with [`DockStyle::side_edge_zones`] when the area has not drawn yet
+    /// (a headless run): an outer edge command then wraps what that profile's edge band wraps.
+    pub fn with_side_edge_zones(mut self, on: bool) -> Self {
+        self.side_edge_zones = on;
+        self
+    }
+
+    /// Adds the size a command floats `panel` at alone when the area has not drawn it, such as
+    /// a hidden panel or a headless run. A size the area recorded for the panel takes precedence.
+    pub fn with_panel_size(mut self, panel: P, size: Vec2) -> Self {
+        self.panels.push((panel, size));
+        self
+    }
+}
+
+impl<P: PartialEq> FloatSpace<P> {
+    /// Record the height `panel`'s content used in a body `available` tall. Content that
+    /// reaches the body's bottom filled it and has no height of its own, unless the body was
+    /// sized to the height recorded before (a fitted window). `at` is the panel's entry in
+    /// `contents` if it has one; returns where the entry is.
+    pub(super) fn record_content(&mut self, at: Option<usize>, panel: P, used: f32, available: f32) -> usize {
+        const TOLERANCE: f32 = 1.0;
+        let used = if used.is_finite() { used.max(0.0) } else { 0.0 };
+        let recorded = at.and_then(|i| self.contents.get_mut(i)).filter(|(p, _)| *p == panel);
+        let fitted = recorded.as_ref().and_then(|(_, height)| *height).is_some_and(|height| height >= available - TOLERANCE);
+        let height = (used < available - TOLERANCE || fitted).then_some(used);
+        match (recorded, at) {
+            (Some((_, recorded)), Some(at)) => {
+                *recorded = height;
+                at
+            }
+            _ => {
+                self.contents.push((panel, height));
+                self.contents.len() - 1
+            }
+        }
+    }
+}
+
+/// Lookups for `DockCommand`, which needs feature `serde`.
+#[cfg_attr(not(feature = "serde"), allow(dead_code))]
+impl<P: PartialEq> FloatSpace<P> {
+    pub(super) fn panel(&self, panel: &P) -> Option<Vec2> {
+        Self::find(&self.panels, panel)
+    }
+
+    pub(super) fn group(&self, panel: &P) -> Option<Vec2> {
+        Self::find(&self.groups, panel)
+    }
+
+    pub(super) fn column(&self, panel: &P) -> Option<Vec2> {
+        Self::find(&self.columns, panel)
+    }
+
+    /// The first record wins: an iconic panel is recorded at its icon before its flyout.
+    fn find(sizes: &[(P, Vec2)], panel: &P) -> Option<Vec2> {
+        sizes.iter().find(|(p, _)| p == panel).map(|(_, size)| *size)
+    }
+
+    /// `[x, y, width, height]` of `size` inside the area, inset from its top-left corner and
+    /// shrunk to fit.
+    pub(super) fn place(&self, size: Vec2) -> [f32; 4] {
+        let size = size.min(self.area.size());
+        let min = (self.area.min + Vec2::splat(FLOAT_INSET)).min(self.area.max - size).max(self.area.min);
+        [min.x, min.y, size.x, size.y]
+    }
+}
+
+/// The [`FloatSpace`] the area recorded on its last frame.
+pub fn float_space<P: Clone + Send + Sync + 'static>(ctx: &Context, area_id: Id) -> Option<FloatSpace<P>> {
+    ctx.data(|d| d.get_temp(float_space_key(area_id)))
+}
+
+fn float_space_key(area: Id) -> Id {
+    area.with("float-space")
+}
+
+/// The panel whose tab held keyboard focus at the end of the last frame, where it was, and
+/// whether that frame's own actions may have moved it.
+type TabFocus<P> = (P, super::dock_model::Place, bool);
+
+fn tab_focus_key(area: Id) -> Id {
+    area.with("tab-focus")
+}
+
+/// The layout an area drew while one of its drags was in progress, and the actions it returned.
+#[derive(Clone)]
+struct DragFrame<P> {
+    layout: Layout<P>,
+    actions: Vec<Action<P>>,
+}
+
+fn drag_frame_key(area: Id) -> Id {
+    area.with("drag-frame")
+}
+
+/// The controls [`cancel_drag`] ended drags of, until the next frame's native windows, each
+/// with its own egui drag, have drawn.
+#[cfg(feature = "native-windows")]
+pub(in crate::docking) fn native_cancel_key(area: Id) -> Id {
+    area.with("cancel-native")
+}
+
+/// A drag ends when its layout changes other than by the area's own actions: a workspace
+/// switch, Reset or an app command. The app applies all of them or none; an action that
+/// fails on its own is skipped, as it is for an app that applies them one at a time. Sizes
+/// and rectangles are not compared, so an app that clamps a moved window or adjusts a resized
+/// split keeps the drag going.
+fn cancel_drag_if_replaced<P: Clone + Eq + Hash + Debug + Send + Sync + 'static>(ctx: &Context, area: Id, layout: &Layout<P>) {
+    let Some(last) = ctx.data_mut(|d| {
+        let last = d.get_temp::<DragFrame<P>>(drag_frame_key(area));
+        d.remove::<DragFrame<P>>(drag_frame_key(area));
+        last
+    }) else {
+        return;
+    };
+    let now = layout.shape();
+    if now == last.layout.shape() {
+        return;
+    }
+    let mut applied = last.layout;
+    for action in last.actions {
+        let _ = applied.apply(action);
+    }
+    if now != applied.shape() {
+        cancel_drag::<P>(ctx, area);
+    }
+}
+
+/// Keep what [`cancel_drag_if_replaced`] compares the next frame against, while a drag of this
+/// area goes on.
+fn record_drag_frame<P: Clone + Eq + Hash + Debug + Send + Sync + 'static>(
+    ctx: &Context,
+    area: Id,
+    layout: &Layout<P>,
+    owned: &[Id],
+    native_held: bool,
+    actions: &[Action<P>],
+) {
+    let held = native_held || ctx.dragged_id().is_some_and(|id| owned.contains(&id));
+    #[cfg(feature = "native-windows")]
+    let held = held || ctx.data(|d| d.get_temp::<super::render::WindowDrag>(area.with("window-drag")).is_some());
+    if held || is_dragging::<P>(ctx, area) {
+        let frame = DragFrame { layout: layout.clone(), actions: actions.to_vec() };
+        ctx.data_mut(|d| d.insert_temp(drag_frame_key(area), frame));
+    }
+}
+
+/// Keyboard focus stays on a tab only while its panel stays where the user put it: a panel
+/// hidden, closed or moved by the host (a command or a workspace reset) gives focus up.
+fn release_moved_tab_focus<P: Clone + Eq + Hash + Debug + Send + Sync + 'static>(ctx: &Context, area: Id, layout: &Layout<P>) {
+    let Some((panel, place, moved_by_area)) = ctx.data(|d| d.get_temp::<TabFocus<P>>(tab_focus_key(area))) else { return };
+    let tab = area.with(("tab", &panel));
+    let place_now = layout.place(&panel);
+    if ctx.memory(|m| m.has_focus(tab)) && (place_now.is_none() || (place_now != Some(place) && !moved_by_area)) {
+        ctx.memory_mut(|m| m.surrender_focus(tab));
+    }
+}
+
+fn record_tab_focus<P: Clone + Eq + Hash + Debug + Send + Sync + 'static>(ctx: &Context, area: Id, layout: &Layout<P>, acted: bool) {
+    let focused = ctx.memory(|m| m.focused());
+    let tab = focused.and_then(|id| layout.panels().into_iter().find(|panel| area.with(("tab", *panel)) == id));
+    let record = tab.and_then(|panel| Some((panel.clone(), layout.place(panel)?, acted)));
+    ctx.data_mut(|d| match record {
+        Some(record) => {
+            d.insert_temp(tab_focus_key(area), record);
+        }
+        None => d.remove::<TabFocus<P>>(tab_focus_key(area)),
+    });
+}
+
+/// A request for host state outside the layout.
+#[derive(Clone, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum DockEvent<P> {
+    /// Maximize Frame: maximize the frame holding `panel`, or restore it when it is the one
+    /// passed to [`DockArea::maximized`].
+    ToggleMaximize { panel: P },
+    /// [D] Auto-Collapse Iconic Panels was chosen in a column menu. The host flips its
+    /// preference and passes it to [`DockArea::auto_collapse_iconic`].
+    ToggleAutoCollapse,
+    /// [D] The area's flyout opened, switched to another panel or closed (`None`), whatever
+    /// changed it: an icon, Escape, a press outside, a raised panel, a group that is no longer
+    /// iconic, or [`super::open_flyout`] and [`super::close_flyout`]. It comes once per change,
+    /// in the frame that draws the change.
+    FlyoutChanged { panel: Option<P> },
+}
+
+/// Which panels [`DockArea::hide_panels`] hides. Protected panels always stay.
+pub enum HidePanels<'a, P> {
+    None,
+    All,
+    /// Every panel except those for which the function returns true.
+    Except(&'a dyn Fn(&P) -> bool),
+}
+
+impl<P> Clone for HidePanels<'_, P> {
+    fn clone(&self) -> Self {
+        *self
+    }
+}
+
+impl<P> Copy for HidePanels<'_, P> {}
+
 /// Preferred body bounds. Tiny viewports relax minima proportionally rather than producing
-/// inverted rectangles. Maximums constrain a pane when its sibling can occupy the remainder.
+/// inverted rectangles. Maximums constrain a pane when its sibling can occupy the remainder. A
+/// tab group takes the largest minimum and the largest maximum of its panels, so a panel without
+/// a maximum lifts the maximum of the panels it joins.
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub struct PanelLimits {
     pub min: Vec2,
@@ -95,7 +627,7 @@ impl Default for PanelLimits {
 }
 
 impl PanelLimits {
-    fn valid(self) -> bool {
+    pub(super) fn valid(self) -> bool {
         self.min.is_finite()
             && self.max.is_finite()
             && self.min.x >= 0.0
@@ -107,18 +639,91 @@ impl PanelLimits {
     }
 }
 
-#[derive(Clone)]
-struct Drag<P> {
-    panel: P,
-    origin: Pos2,
-    source: Rect,
-    grab: Vec2,
+/// Body heights a panel asks for in a dock column while the user has not resized its group
+/// (`Group::height` is `None`). Like [`PanelLimits`] they exclude the tab strip. A group takes
+/// the largest of each among its panels.
+#[derive(Clone, Copy, Debug, PartialEq)]
+#[non_exhaustive]
+pub struct DockHeights {
+    /// The height the group gets when the column has room.
+    pub default: f32,
+    /// The height it gives way down to, so the group that fills the column keeps its `fill`.
+    pub compact: f32,
+    /// The height it asks for when it fills the column: groups at their default shrink towards
+    /// `compact` before it gets less.
+    pub fill: f32,
+}
+
+impl DockHeights {
+    /// A `default` height that does not give way (`compact` is `default`) and, filling the
+    /// column, asks for no more than its minimum (`fill` is 0).
+    pub fn new(default: f32) -> Self {
+        Self { default, compact: default, fill: 0.0 }
+    }
+
+    pub fn compact(mut self, compact: f32) -> Self {
+        self.compact = compact;
+        self
+    }
+
+    pub fn fill(mut self, fill: f32) -> Self {
+        self.fill = fill;
+        self
+    }
+
+    pub(super) fn valid(self) -> bool {
+        [self.default, self.compact, self.fill].iter().all(|h| h.is_finite() && *h >= 0.0 && *h <= 1_000_000.0)
+    }
+}
+
+/// How a floating window in its own OS window behaves (feature `native-windows`), see
+/// [`DockContent::window_kind`].
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+#[non_exhaustive]
+pub enum WindowKind {
+    /// A tool palette: it stays above other windows and hides while none of the app's windows
+    /// has focus.
+    #[default]
+    Palette,
+    /// A window of its own, such as a viewer on a second display: normal window level, and it
+    /// stays shown while the app is in the background. When the app is activated, these
+    /// windows and the main window come forward, and the main window is left at the normal
+    /// level.
+    Normal,
 }
 
 #[derive(Clone)]
-struct GroupDrag<P> {
-    panel: P,
-    original: [f32; 4],
+pub(super) struct Drag<P> {
+    pub(super) panel: P,
+    pub(super) origin: Pos2,
+    pub(super) source: Rect,
+    pub(super) grab: Vec2,
+    /// Ctrl/Cmd held at the press, with [`DockStyle::command_press_floats`]: the drop floats.
+    pub(super) undock: bool,
+}
+
+/// What a group gesture moves.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum GroupGesture {
+    /// A floating window's grip: the window follows the pointer.
+    Window,
+    /// A drag bar or top border: a ghost follows the pointer, the release picks the target.
+    Group,
+    /// [D] A column bar: like `Group`, for the whole dock column.
+    Column,
+}
+
+#[derive(Clone)]
+pub(super) struct GroupDrag<P> {
+    /// The first member; identifies the gesture.
+    pub(super) panel: P,
+    /// The floating window rect at the press, restored when a window move is canceled.
+    pub(super) original: [f32; 4],
+    pub(super) gesture: GroupGesture,
+    pub(super) members: Vec<P>,
+    pub(super) origin: Pos2,
+    /// The group (or window) rect at the press. A floated group keeps this size.
+    pub(super) source: Rect,
 }
 
 /// Start a docking drag from an application's existing tab/header. Use the same area ID when
@@ -129,32 +734,167 @@ pub fn begin_drag<P: Clone + Send + Sync + 'static>(ctx: &Context, area_id: Id,
         return false;
     }
     let grab = (origin - source_rect.min).clamp(Vec2::ZERO, source_rect.size());
-    ctx.data_mut(|d| d.insert_temp(area_id.with("drag"), Drag { panel, origin, source: source_rect, grab }));
+    ctx.data_mut(|d| d.insert_temp(area_id.with("drag"), Drag { panel, origin, source: source_rect, grab, undock: false }));
     true
 }
 
-/// Discard pending tab/group gestures and an actively dragged renderer-owned control before
-/// replacing a workspace. Body/custom-header/menu gestures and other areas are untouched.
+/// Whether this area's tab or group gesture is active.
+pub fn is_dragging<P: Clone + Send + Sync + 'static>(ctx: &Context, area_id: Id) -> bool {
+    ctx.data(|data| data.get_temp::<Drag<P>>(area_id.with("drag")).is_some() || data.get_temp::<GroupDrag<P>>(area_id.with("group-drag")).is_some())
+}
+
+/// Discard pending tab/group gestures, a native window's bar drag and an actively dragged
+/// renderer-owned control, in the main window now and in a native window when it next draws.
+/// Body/custom-header/menu gestures and other areas are untouched, except that an app drag in a
+/// panel body no longer reaches other OS windows (feature `native-windows`).
 /// Ownership is recorded as controls render; before an initial render or drag threshold there
-/// may be no active egui drag to cancel. Keyboard focus is unchanged. The host owns the
-/// replacement snapshot, so this does not restore a group's previous rectangle.
+/// may be no active egui drag to cancel. Keyboard focus is unchanged. Nothing is restored from
+/// before the drag: floating and native windows go where the next layout drawn has them.
+///
+/// An area cancels its drags itself when the layout it is given is not the one it drew last
+/// frame with its own actions applied (see [`DockArea::show`]), so replacing the workspace
+/// needs no call.
 pub fn cancel_drag<P: Clone + Send + Sync + 'static>(ctx: &Context, area_id: Id) {
     let dragged = ctx.dragged_id();
     let owned = ctx.data_mut(|d| {
         d.remove::<Drag<P>>(area_id.with("drag"));
         d.remove::<GroupDrag<P>>(area_id.with("group-drag"));
+        #[cfg(feature = "native-windows")]
+        d.remove::<super::render::WindowDrag>(area_id.with("window-drag"));
         let ids = d.remove_temp::<Vec<Id>>(area_id.with("owned-interactions"));
-        dragged.is_some_and(|id| ids.is_some_and(|ids| ids.contains(&id)))
+        let resize = d.get_temp::<Id>(area_id.with("pointer-resize"));
+        d.remove::<Id>(area_id.with("pointer-resize"));
+        for id in resize.iter().chain(ids.iter().flatten()) {
+            d.remove::<AnchoredResize>(id.with("pointer-anchor"));
+        }
+        #[cfg(feature = "native-windows")]
+        d.get_temp_mut_or_default::<Vec<Id>>(native_cancel_key(area_id)).extend(ids.iter().flatten());
+        dragged.is_some_and(|id| resize == Some(id) || ids.is_some_and(|ids| ids.contains(&id)))
     });
     if owned {
         ctx.stop_dragging();
     }
+    #[cfg(feature = "native-windows")]
+    super::render::cancel_body_route(ctx, area_id);
 }
 
-/// One mutable application adapter owns bodies, menus and shaped text, avoiding competing
-/// mutable closures. Logical labels remain separate and are used for tab accessibility.
+/// Mark the app's drag in a panel body of the area `area_id` as one that carries something, so
+/// it reaches the window under the pointer (feature `native-windows`; elsewhere it does
+/// nothing). A drag with an egui drag-and-drop payload needs no call. Call it each frame while
+/// the drag lasts, from the panel body or before the area shows; a call starts the routing
+/// for this frame and the next, and a routing once started lasts until the drag ends. Drags
+/// that are never marked (sliders, scrollbars, text selection, canvas pans) stay in their window.
+pub fn route_app_drag(ctx: &Context, area_id: Id) {
+    #[cfg(feature = "native-windows")]
+    super::render::mark_app_drag(ctx, area_id);
+    #[cfg(not(feature = "native-windows"))]
+    let _ = (ctx, area_id);
+}
+
+/// The native window that has the keyboard and a focused text field in its last pass (feature
+/// `native-windows`; elsewhere `None`). Not a window drawn under [`DockArea::input_blocked`].
+///
+/// On macOS the menu bar takes key equivalents such as ⌘C and ⌘V before the key window sees
+/// them, and an app's menu glue reports them in the main window's input. While this is `Some`,
+/// the dock area moves the keys a text field acts on (⌘C, ⌘X, ⌘V, ⌘A, ⌘Z and ⇧⌘Z, ⌘ with the
+/// arrows, ⌘Backspace and ⌘Delete, and `Copy`, `Cut` and `Paste` events) from the main window's
+/// input to that window's, as [`send_keys`] does; the app's other command keys stay with the
+/// main window. A menu that runs commands itself instead of reporting keys can send the text
+/// keys to this window with [`send_keys`]. An app whose own `raw_input_hook` turns the main
+/// window's ⌘V into `ViewportCommand::RequestPaste` for its text fields skips that while this
+/// is `Some`, so the field's window pastes instead.
+pub fn typing_window(ctx: &Context) -> Option<egui::ViewportId> {
+    #[cfg(feature = "native-windows")]
+    return super::render::typing_window(ctx);
+    #[cfg(not(feature = "native-windows"))]
+    {
+        let _ = ctx;
+        None
+    }
+}
+
+/// Give `events` to the native window `viewport` at the start of its next input, and repaint
+/// it (feature `native-windows`; elsewhere it does nothing). A text field copies and pastes on
+/// egui's `Copy`, `Cut` and `Paste` events, not on key presses, so ⌘C and ⌘X presses arrive as
+/// `Copy` and `Cut`, and ⌘V asks the window for the clipboard text
+/// (`ViewportCommand::RequestPaste`), which arrives as `Paste`. Other events arrive as they are.
+/// See [`typing_window`].
+pub fn send_keys(ctx: &Context, viewport: egui::ViewportId, events: Vec<egui::Event>) {
+    #[cfg(feature = "native-windows")]
+    super::render::send_keys(ctx, viewport, events);
+    #[cfg(not(feature = "native-windows"))]
+    let _ = (ctx, viewport, events);
+}
+
+/// One mutable application adapter owns bodies, menus, shaped text and per-panel policy,
+/// avoiding competing mutable closures. Logical labels are used for tab accessibility.
+/// [`DockArea::show_content`] reads every policy from here; the closures passed to the older
+/// `show*` functions override `logical_label`, `permissions` and `limits`.
 pub trait DockContent<P> {
     fn body(&mut self, ui: &mut Ui, panel: &P);
+    /// Plain text name for accessibility, menus and the default visual label.
+    fn logical_label(&self, panel: &P) -> String
+    where
+        P: Debug,
+    {
+        format!("{panel:?}")
+    }
+    fn permissions(&self, _panel: &P) -> Permissions {
+        Permissions::default()
+    }
+    fn limits(&self, _panel: &P) -> PanelLimits {
+        PanelLimits::default()
+    }
+    /// How the panel's group sizes itself in a dock column until the user resizes it. Groups
+    /// with a [`DockHeights::fill`] above 0 share the column's free height. `None` (the
+    /// default) shares it with the other groups that have none when no group asks for a fill,
+    /// and takes the group's minimum when one does.
+    /// Groups at their [`DockHeights::default`] give way down to their `compact` height, the one
+    /// nearest the filler first, so the group that fills the column gets its `fill` height; when
+    /// the column is still too short,
+    /// every group gives way down to its minimum. A height the user set is kept.
+    fn dock_heights(&self, _panel: &P) -> Option<DockHeights> {
+        None
+    }
+    /// Preferred floating size, independent of the current dock geometry: the width of a
+    /// floated panel and the most height it takes. A floated panel or group, and a flyout, fit
+    /// their height to the content the active panel last drew (at least 120 points), up to this
+    /// height, or up to 320 out of a dock when this is `None`. Content that filled its body
+    /// takes this height, else 320. A rect a command gives and a window the user resized keep
+    /// their size.
+    fn floating_size(&self, _panel: &P) -> Option<Vec2> {
+        None
+    }
+    /// An image for the panel's icon, tinted with the icon color. [`Self::paint_icon`] goes first.
+    fn icon(&self, _panel: &P) -> Option<egui::ImageSource<'static>> {
+        None
+    }
+    /// Paint the panel's icon in code into `rect` with `color`, and return true. False draws
+    /// [`Self::icon`], or the label's initial when that is `None`. `painter` is clipped to the
+    /// icon's cell.
+    fn paint_icon(&mut self, _painter: &egui::Painter, _rect: Rect, _panel: &P, _color: Color32) -> bool {
+        false
+    }
+    /// Whether the panel's floating window may be its own OS window (feature
+    /// `native-windows`). A panel that returns false keeps its window in-window.
+    fn allow_native(&self, _panel: &P) -> bool {
+        true
+    }
+    /// How the panel's native floating window behaves (feature `native-windows`). A window
+    /// holding any [`WindowKind::Normal`] panel is a normal window; the rest are palettes.
+    fn window_kind(&self, _panel: &P) -> WindowKind {
+        WindowKind::Palette
+    }
+    /// A native floating window drew its panel bodies (feature `native-windows`): called once
+    /// per pass of the window, after its last body, with the window's `ui`. An app that
+    /// publishes its own IME descriptor, outside [`crate::ime::Composer`], publishes it here for
+    /// the window. Windows drawn in the main window's pass get no call.
+    fn window_drawn(&mut self, _ui: &mut Ui) {}
+    /// Host-owned drop resolution for targets the renderer cannot know about. Returning
+    /// feedback consumes the gesture, including no-op targets; the renderer then emits no move.
+    fn resolve_drag(&mut self, _ctx: &Context, _style: &DockStyle, _request: &DropRequest<'_, P>) -> Option<DropFeedback> {
+        None
+    }
     fn label(&mut self, _ui: &Ui, _panel: &P, logical: &str, _font: &FontId, _color: Color32) -> egui::WidgetText {
         logical.into()
     }
@@ -164,10 +904,49 @@ pub trait DockContent<P> {
         logical.into()
     }
     fn panel_menu(&mut self, _ui: &mut Ui, _panel: &P) {}
-    fn group_header_width(&self, _panels: &[P], _active: &P, _floating: bool) -> f32 {
+    /// Width of the group header at the strip's end (the host's ≡ and its own tabs).
+    /// `strip_width` is the whole tab strip; the header gets at most that, and the drag bar and
+    /// the group's tabs share what is left.
+    fn group_header_width(&self, _panels: &[P], _active: &P, _floating: bool, _strip_width: f32) -> f32 {
         0.0
     }
+    /// Draw the group header into `ui.max_rect()`, sized by [`Self::group_header_width`].
+    /// The header's widgets take their own input, so a drag on them moves nothing. For a widget
+    /// that should drag (a ≡ button, say), call [`begin_drag`] with the id given to
+    /// [`DockArea::new`], `active` and the widget's rect when its response reports
+    /// `drag_started()`; the panel then moves as its tab would.
     fn group_header(&mut self, _ui: &mut Ui, _panels: &[P], _active: &P, _floating: bool) {}
+    /// Width the group's extra tabs want: the host's own tabs, drawn right after the group's
+    /// panel tabs (and their "…" button), before the drag bar. They fit with the panel tabs:
+    /// both shrink widest first to [`DockStyle::min_tab_width`] (the extra tabs as one tab); in a
+    /// row narrower still, the panel tabs overflow and the extra tabs keep that width. Zero draws
+    /// none.
+    fn group_extra_tabs_width(&self, _panels: &[P], _active: &P, _floating: bool) -> f32 {
+        0.0
+    }
+    /// Draw the extra tabs into `ui.max_rect()`, which can be narrower than
+    /// [`Self::group_extra_tabs_width`] asked for; the host fits its tabs into it, with an
+    /// overflow of its own. Their widgets take their own input as the header's do, and a press
+    /// among them focuses the shown panel. A drop on them adds the panel after the last panel tab.
+    fn group_extra_tabs(&mut self, _ui: &mut Ui, _panels: &[P], _active: &P, _floating: bool) {}
+}
+
+/// Host-owned drop resolution request, see [`DockContent::resolve_drag`].
+pub struct DropRequest<'a, P> {
+    pub panel: &'a P,
+    pub pointer: Pos2,
+    pub targets: &'a [DropTarget<P>],
+    pub floating_rect: Option<Rect>,
+    pub whole_group: bool,
+    pub released: bool,
+    pub workspace: Rect,
+    pub screen: Rect,
+}
+
+#[derive(Clone, Debug, Default)]
+pub struct DropFeedback {
+    pub preview: Option<Rect>,
+    pub insertion: Option<Rect>,
 }
 
 struct BodyContent<F>(F);
@@ -177,17 +956,195 @@ impl<P, F: FnMut(&mut Ui, &P)> DockContent<P> for BodyContent<F> {
     }
 }
 
+/// The older `show*` closures in front of an application's content.
+struct Overrides<'a, P, C: ?Sized> {
+    label: &'a dyn Fn(&P) -> String,
+    permissions: &'a dyn Fn(&P) -> Permissions,
+    limits: &'a dyn Fn(&P) -> PanelLimits,
+    inner: &'a mut C,
+}
+
+impl<P, C: DockContent<P> + ?Sized> DockContent<P> for Overrides<'_, P, C> {
+    fn body(&mut self, ui: &mut Ui, panel: &P) {
+        self.inner.body(ui, panel);
+    }
+    fn logical_label(&self, panel: &P) -> String {
+        (self.label)(panel)
+    }
+    fn permissions(&self, panel: &P) -> Permissions {
+        (self.permissions)(panel)
+    }
+    fn limits(&self, panel: &P) -> PanelLimits {
+        (self.limits)(panel)
+    }
+    fn dock_heights(&self, panel: &P) -> Option<DockHeights> {
+        self.inner.dock_heights(panel)
+    }
+    fn floating_size(&self, panel: &P) -> Option<Vec2> {
+        self.inner.floating_size(panel)
+    }
+    fn icon(&self, panel: &P) -> Option<egui::ImageSource<'static>> {
+        self.inner.icon(panel)
+    }
+    fn paint_icon(&mut self, painter: &egui::Painter, rect: Rect, panel: &P, color: Color32) -> bool {
+        self.inner.paint_icon(painter, rect, panel, color)
+    }
+    fn allow_native(&self, panel: &P) -> bool {
+        self.inner.allow_native(panel)
+    }
+    fn window_kind(&self, panel: &P) -> WindowKind {
+        self.inner.window_kind(panel)
+    }
+    fn window_drawn(&mut self, ui: &mut Ui) {
+        self.inner.window_drawn(ui);
+    }
+    fn resolve_drag(&mut self, ctx: &Context, style: &DockStyle, request: &DropRequest<'_, P>) -> Option<DropFeedback> {
+        self.inner.resolve_drag(ctx, style, request)
+    }
+    fn label(&mut self, ui: &Ui, panel: &P, logical: &str, font: &FontId, color: Color32) -> egui::WidgetText {
+        self.inner.label(ui, panel, logical, font, color)
+    }
+    fn action_label(&mut self, ui: &Ui, logical: &str, font: &FontId, color: Color32) -> egui::WidgetText {
+        self.inner.action_label(ui, logical, font, color)
+    }
+    fn panel_menu(&mut self, ui: &mut Ui, panel: &P) {
+        self.inner.panel_menu(ui, panel);
+    }
+    fn group_header_width(&self, panels: &[P], active: &P, floating: bool, strip_width: f32) -> f32 {
+        self.inner.group_header_width(panels, active, floating, strip_width)
+    }
+    fn group_header(&mut self, ui: &mut Ui, panels: &[P], active: &P, floating: bool) {
+        self.inner.group_header(ui, panels, active, floating);
+    }
+    fn group_extra_tabs_width(&self, panels: &[P], active: &P, floating: bool) -> f32 {
+        self.inner.group_extra_tabs_width(panels, active, floating)
+    }
+    fn group_extra_tabs(&mut self, ui: &mut Ui, panels: &[P], active: &P, floating: bool) {
+        self.inner.group_extra_tabs(ui, panels, active, floating);
+    }
+}
+
 /// Optional renderer for applications without an existing docking surface. Apps with custom
 /// chrome can instead use the model, target resolver and resize/tab primitives independently.
-pub struct DockArea<P = ()> {
+pub struct DockArea<'a, P = ()> {
     id: Id,
     activation: Option<P>,
     blockers: Vec<Rect>,
+    locked: bool,
+    maximized: Option<P>,
+    hide: HidePanels<'a, P>,
+    auto_collapse: bool,
+    float_bounds: Option<Rect>,
+    monitors: Vec<Monitor>,
+    input_blocked: bool,
+    native_windows: Option<bool>,
+    #[cfg(feature = "native-windows")]
+    input_hook: Option<super::render::InputHook>,
+    #[cfg(feature = "native-windows")]
+    window_system: super::render::WindowSystem,
 }
 
-impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> DockArea<P> {
+impl<'a, P: Clone + Eq + Hash + Debug + Send + Sync + 'static> DockArea<'a, P> {
     pub fn new(id: Id) -> Self {
-        Self { id, activation: None, blockers: Vec::new() }
+        Self {
+            id,
+            activation: None,
+            blockers: Vec::new(),
+            locked: false,
+            maximized: None,
+            hide: HidePanels::None,
+            auto_collapse: true,
+            float_bounds: None,
+            monitors: Vec::new(),
+            input_blocked: false,
+            native_windows: None,
+            #[cfg(feature = "native-windows")]
+            input_hook: None,
+            #[cfg(feature = "native-windows")]
+            window_system: Default::default(),
+        }
+    }
+
+    /// The connected monitors (feature `native-windows`). A native floating window stores the
+    /// one it is on, and a restored layout puts each window back on its monitor, or on the
+    /// main window's when that monitor is gone. egui 0.36 reports no monitors; without a list
+    /// windows store the monitor size egui reports and restore onto the main window's monitor.
+    /// eframe 0.36 keeps winit's event loop, and with it `available_monitors`, to itself, so an
+    /// eframe application builds the list from the platform's own display API.
+    pub fn monitors(mut self, monitors: Vec<Monitor>) -> Self {
+        self.monitors = monitors;
+        self
+    }
+
+    /// Native floating windows ignore input while `blocked` (feature `native-windows`): pass
+    /// true while the application shows a modal dialog. egui's `Modal` blocks only the
+    /// viewport it is shown in, so the OS windows of floating panels would otherwise still take
+    /// clicks and keys. A blocked window is drawn under [`DockStyle::blocked_dim`]; its bar,
+    /// tabs, body and resize edges take no pointer, keys, text, scrolling or files, forward only
+    /// key releases, and offer no drop targets, and its OS close request is cancelled. Turning
+    /// it on cancels any drag in progress. Floating windows drawn in the main window need
+    /// nothing from this: the modal covers them.
+    pub fn input_blocked(mut self, blocked: bool) -> Self {
+        self.input_blocked = blocked;
+        self
+    }
+
+    /// Whether floating windows open in their own OS windows (feature `native-windows`), where
+    /// the backend has viewports. Off, they stay in the app window, and their native rects are
+    /// kept for a later run with it on. By default it is on, except on Wayland: the compositor
+    /// reports no window positions, so a native window could not dock again by drag or open
+    /// where it was.
+    pub fn native_windows(mut self, on: bool) -> Self {
+        self.native_windows = Some(on);
+        self
+    }
+
+    /// The egui viewport of the native window of the floating window with [`super::Floating::id`]
+    /// `window`, in the dock area `id` (feature `native-windows`).
+    #[cfg(feature = "native-windows")]
+    pub fn window_viewport(id: Id, window: u64) -> egui::ViewportId {
+        super::render::native_viewport(id, window)
+    }
+
+    /// Rewrite the input of each native window of this area before egui reads it (feature
+    /// `native-windows`), as `eframe::App::raw_input_hook` does for the main window only. Pass
+    /// it every frame; a frame without it runs none. The hook runs for every pass of each
+    /// window's frame, before any widget sees the input, so rewritten pointer events count as
+    /// sent. `RawInput::viewport_id` names the window (see [`Self::window_viewport`]). State
+    /// shared with the app's own `raw_input_hook`, which takes `&mut self`, goes in an
+    /// `Arc<Mutex<…>>`.
+    #[cfg(feature = "native-windows")]
+    pub fn native_input_hook(mut self, hook: impl FnMut(&Context, &mut egui::RawInput) + Send + 'static) -> Self {
+        self.input_hook = Some(Box::new(hook));
+        self
+    }
+
+    /// A stand-in for the window system that moves native windows and tells the cursor.
+    #[cfg(all(feature = "native-windows", any(test, feature = "testing")))]
+    pub(in crate::docking) fn window_system(mut self, window_system: super::render::WindowSystem) -> Self {
+        self.window_system = window_system;
+        self
+    }
+
+    /// [D] Auto-Collapse Iconic Panels (default on): a flyout closes on Escape or a press
+    /// outside it. Off, it stays open until its icon or another icon is clicked.
+    pub fn auto_collapse_iconic(mut self, on: bool) -> Self {
+        self.auto_collapse = on;
+        self
+    }
+
+    /// Maximize Frame: the docked frame holding `panel` fills the area; other frames and
+    /// floating windows do not render or take input. A floating or absent panel is ignored.
+    pub fn maximized(mut self, panel: Option<P>) -> Self {
+        self.maximized = panel;
+        self
+    }
+
+    /// Hide panels (Tab, Shift+Tab); their space goes to the panels that stay. Protected
+    /// panels always stay. The layout is unchanged.
+    pub fn hide_panels(mut self, hide: HidePanels<'a, P>) -> Self {
+        self.hide = hide;
+        self
     }
 
     /// Whether keyboard focus belongs to a rendered docking control in this layout.
@@ -199,53 +1156,35 @@ impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> DockArea<P> {
         if layout.validate().is_err() || ctx.read_response(focused).is_none() {
             return false;
         }
-        let matches = |id: Id| id == focused;
-        let group = |panels: &[P]| {
-            panels.iter().any(|panel| matches(self.id.with(("tab", panel))) || matches(self.id.with(("overflow", panel))))
-                || matches(self.id.with(("move-group", panels.first())))
-        };
-        for floating in &layout.floating {
-            if group(&floating.panels) || floating.panels.first().is_some_and(|first| matches(self.id.with(("floating", first)).with("resize"))) {
-                return true;
-            }
-        }
-        let mut nodes = layout.root.as_ref().map(|root| vec![(root, Vec::<bool>::new())]).unwrap_or_default();
-        while let Some((node, path)) = nodes.pop() {
-            match node {
-                Node::Tabs { panels, .. } if group(panels) => return true,
-                Node::Stack { entries }
-                    if entries.iter().any(|entry| {
-                        matches(self.id.with(("tab", &entry.panel)))
-                            || matches(self.id.with(("collapse", &entry.panel)))
-                            || matches(self.id.with(("stack-resize", &entry.panel)))
-                    }) =>
-                {
-                    return true;
-                }
-                Node::Split { first, second, .. } => {
-                    if matches(self.id.with(("split", &path))) {
-                        return true;
-                    }
-                    let mut second_path = path.clone();
-                    second_path.push(true);
-                    let mut first_path = path;
-                    first_path.push(false);
-                    nodes.push((second, second_path));
-                    nodes.push((first, first_path));
-                }
-                _ => {}
-            }
-        }
-        false
+        super::hits::named(self.id, layout).contains_key(&focused)
     }
 
-    /// Raise and focus a panel's owning floating area on this frame. Apply Activate through
-    /// the application's command path as well to select its tab.
+    /// Raise a panel's floating window (or open its flyout) on this frame. Apply Activate
+    /// through the application's command path as well to select its tab. A raise is not user
+    /// input: it moves no keyboard focus and is not reported as [`DockOutput::focused`].
     pub fn raise_panel(mut self, panel: P) -> Self {
         self.activation = Some(panel);
         self
     }
 
+    /// Where floating windows, flyouts and drag ghosts may go (default: the whole viewport).
+    /// An app whose own title bar sits under a transparent OS title bar (macOS full-size
+    /// content) passes the viewport below that strip: a window drawn there would take presses
+    /// that the OS or the app turns into moving the whole app window. Windows outside the
+    /// bounds, such as ones restored from a saved layout, are drawn moved inside.
+    pub fn float_bounds(mut self, bounds: Rect) -> Self {
+        self.float_bounds = Some(bounds);
+        self
+    }
+
+    /// Draw a locked workspace: pass [`super::Workspace::locked`]. Every panel gets
+    /// [`Permissions::locked`], so no tab, bar or native window starts a move, float or close
+    /// that the workspace would refuse.
+    pub fn locked(mut self, locked: bool) -> Self {
+        self.locked = locked;
+        self
+    }
+
     /// Host overlays that must reject docking gestures, including floating fallback.
     pub fn blocked_rects(mut self, rects: &[Rect]) -> Self {
         self.blockers = rects.to_vec();
@@ -254,7 +1193,11 @@ impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> DockArea<P> {
 
     /// Render a validated snapshot and return requested actions for the app's command handler.
     /// No action is applied here. Panel contents get a global stable egui ID across moves.
-    /// Floating groups are egui areas inside this viewport; this does not create native windows.
+    /// A drag in progress (tab, group, column, window bar, divider) ends when `layout` is not
+    /// the one drawn last frame, with or without the returned actions applied, apart from sizes
+    /// and rectangles: a workspace switch, Reset or a command changed it.
+    /// Floating windows are egui areas inside this viewport; with feature `native-windows`, each
+    /// gets its own OS window where the backend has viewports (see docs/ui-docking.md).
     pub fn show(
         self,
         ui: &mut Ui,
@@ -295,624 +1238,105 @@ impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> DockArea<P> {
         limits: impl Fn(&P) -> PanelLimits,
         content: &mut impl DockContent<P>,
     ) -> DockOutput<P> {
+        let mut content = Overrides { label: &label, permissions: &permissions, limits: &limits, inner: content };
+        self.show_content(ui, layout, style, &mut content)
+    }
+
+    /// Render with every label, policy and size from `content`.
+    pub fn show_content(self, ui: &mut Ui, layout: &Layout<P>, style: &DockStyle, content: &mut dyn DockContent<P>) -> DockOutput<P> {
+        #[cfg(feature = "native-windows")]
+        super::render::set_input_hook(ui.ctx(), self.id, self.input_hook);
         let rect = ui.available_rect_before_wrap();
         if let Err(error) = layout.validate() {
             cancel_drag::<P>(ui.ctx(), self.id);
             return DockOutput { error: Some(error), ..Default::default() };
         }
-        if !style.valid() || !super::targets::usable(rect) || layout.panels().into_iter().any(|p| !limits(p).valid()) {
+        if !style.valid() || !super::targets::usable(rect) || layout.panels().into_iter().any(|p| !content.limits(p).valid()) {
             cancel_drag::<P>(ui.ctx(), self.id);
             return DockOutput { error: Some(DockError::InvalidGeometry), ..Default::default() };
         }
+        // Blocking starts while the pointer may be down: a drag that went on would act on its
+        // release, under the modal.
+        let blocked_key = self.id.with("input-blocked");
+        let starts = self.input_blocked && !ui.ctx().data(|d| d.get_temp::<bool>(blocked_key).unwrap_or(false));
+        if starts {
+            cancel_drag::<P>(ui.ctx(), self.id);
+        }
+        #[cfg(feature = "native-windows")]
+        super::render::focus_main_from_native(ui.ctx(), self.id, layout, self.input_blocked, starts);
+        ui.ctx().data_mut(|d| d.insert_temp(blocked_key, self.input_blocked));
+        cancel_drag_if_replaced(ui.ctx(), self.id, layout);
+        release_moved_tab_focus(ui.ctx(), self.id, layout);
+        let (view, frame) = super::render::view(layout, self.maximized.as_ref(), self.hide, &*content, !style.side_edge_zones);
+        let places = layout.places();
+        // A panel keeps the content height it last drew while hidden or minimized.
+        let contents: Vec<(P, Option<f32>)> = float_space::<P>(ui.ctx(), self.id)
+            .map(|space| space.contents.into_iter().filter(|(panel, _)| places.contains_key(panel)).collect())
+            .unwrap_or_default();
+        let content_index = contents.iter().enumerate().map(|(i, (panel, _))| (panel.clone(), i)).collect();
         let mut renderer = Renderer {
             id: self.id,
             style,
-            label: &label,
-            permissions: &permissions,
-            limits: &limits,
             content,
             activation: self.activation,
             blockers: self.blockers,
+            locked: self.locked,
             layout,
+            workspace: rect,
+            float_bounds: self.float_bounds.map_or(ui.ctx().content_rect(), |bounds| bounds.intersect(ui.ctx().content_rect())),
             targets: Vec::new(),
+            dock_targets: Vec::new(),
+            dock_groups: Vec::new(),
+            column_scroll: HashMap::new(),
             owned_interactions: Vec::new(),
             output: DockOutput::default(),
+            frame,
+            iconic: super::render::Iconic::new(self.auto_collapse),
+            float_space: FloatSpace { contents, side_edge_zones: style.side_edge_zones, ..FloatSpace::new(rect) },
+            places,
+            contents: content_index,
+            dividers: Vec::new(),
+            tree: None,
+            monitors: self.monitors,
+            input_blocked: self.input_blocked,
+            native_windows: self.native_windows,
+            #[cfg(feature = "native-windows")]
+            cross: Default::default(),
+            #[cfg(feature = "native-windows")]
+            window_system: self.window_system,
         };
-        if let Some(root) = &layout.root {
-            renderer.node(ui, root, rect, &mut Vec::new());
+        if let Some(root) = &view.root {
+            renderer.node(ui, root, rect, &mut Vec::new(), (root, rect));
             ui.allocate_rect(rect, Sense::hover());
         }
-        renderer.floating(ui.ctx());
-        renderer.finish_group_drag(ui.ctx());
+        renderer.flyout(ui.ctx());
+        renderer.floating(ui.ctx(), &view.floating);
+        #[cfg(feature = "native-windows")]
+        renderer.finish_window_drag(ui);
+        renderer.finish_group_drag(ui);
         renderer.finish_drag(ui.ctx());
+        #[cfg(feature = "native-windows")]
+        renderer.end_cross(ui.ctx());
+        renderer.report_flyout(ui.ctx());
+        super::hits::record(ui.ctx(), self.id, layout, &renderer.owned_interactions);
+        record_tab_focus(ui.ctx(), self.id, layout, !renderer.output.actions.is_empty());
+        #[cfg(feature = "native-windows")]
+        let native_held = renderer.cross.held;
+        #[cfg(not(feature = "native-windows"))]
+        let native_held = false;
+        record_drag_frame(ui.ctx(), self.id, layout, &renderer.owned_interactions, native_held, &renderer.output.actions);
+        #[cfg(feature = "native-windows")]
+        ui.ctx().data_mut(|d| d.remove::<Vec<Id>>(native_cancel_key(self.id)));
+        ui.ctx().data_mut(|d| d.insert_temp(float_space_key(self.id), renderer.float_space));
         ui.ctx().data_mut(|d| d.insert_temp(self.id.with("owned-interactions"), renderer.owned_interactions));
+        // egui runs a discarded pass again with the same hovered files (dropped ones are
+        // taken), so only the next pass reports them.
+        if ui.ctx().will_discard() {
+            renderer.output.window_files.retain_mut(|files| {
+                files.hovered.clear();
+                !files.dropped.is_empty()
+            });
+        }
         renderer.output
     }
 }
-
-struct Renderer<'a, P> {
-    id: Id,
-    style: &'a DockStyle,
-    label: &'a dyn Fn(&P) -> String,
-    permissions: &'a dyn Fn(&P) -> Permissions,
-    limits: &'a dyn Fn(&P) -> PanelLimits,
-    content: &'a mut dyn DockContent<P>,
-    activation: Option<P>,
-    blockers: Vec<Rect>,
-    layout: &'a Layout<P>,
-    targets: Vec<DropTarget<P>>,
-    owned_interactions: Vec<Id>,
-    output: DockOutput<P>,
-}
-
-impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static> Renderer<'_, P> {
-    fn register_interaction(&mut self, ctx: &Context, id: Id) {
-        // A validated tree has at most 2*MAX_PANELS nodes. Tabs, stack dividers,
-        // floating grips/corners and splits fit comfortably inside this fixed bound.
-        const CAP: usize = 8 * super::MAX_PANELS;
-        if self.owned_interactions.len() < CAP && !self.owned_interactions.contains(&id) {
-            self.owned_interactions.push(id);
-        }
-        // Retain prior-frame controls until return, and publish current controls before
-        // app callbacks. No Context lock spans a callback or a stop_dragging call.
-        ctx.data_mut(|d| {
-            let ids = d.get_temp_mut_or_default::<Vec<Id>>(self.id.with("owned-interactions"));
-            if ids.len() < CAP && !ids.contains(&id) {
-                ids.push(id);
-            }
-        });
-    }
-
-    fn node(&mut self, ui: &mut Ui, node: &Node<P>, rect: Rect, path: &mut Vec<bool>) {
-        if !super::targets::usable(rect) {
-            return;
-        }
-        match node {
-            Node::Split { axis, size, first, second } => {
-                let Some(wanted) = split_rect(rect, *axis, *size, self.style.gap, 0.0) else { return };
-                let (lo, hi) = split_bounds(wanted.available(), *axis, self.node_limits(first), self.node_limits(second));
-                let first_size = wanted.first_size().clamp(lo, hi);
-                let Some(split) = split_rect(rect, *axis, SplitSize::FixedFirst(first_size), self.style.gap, 0.0) else { return };
-                path.push(false);
-                self.node(ui, first, split.first, path);
-                path.pop();
-                path.push(true);
-                self.node(ui, second, split.second, path);
-                path.pop();
-                // The divider's inner-edge hit margin must win over child scrollbars, just
-                // as accordion dividers win over the adjacent panel's content.
-                let response = ResizeHandle::new(
-                    self.id.with(("split", &*path)),
-                    *axis,
-                    split.divider,
-                    &self.style.resize_label,
-                    ResizeHandleStyle { hovered: self.style.accent, dragged: self.style.accent, focused: self.style.accent },
-                )
-                .value(split.first_size(), lo..=hi)
-                .show(ui);
-                self.register_interaction(ui.ctx(), response.response.id);
-                if response.delta != 0.0
-                    && let Some(size) = split.resized(*size, (split.first_size() + response.delta).clamp(lo, hi) - split.first_size(), 0.0)
-                {
-                    self.output.actions.push(Action::ResizeSplit { path: path.clone(), size });
-                }
-            }
-            Node::Tabs { panels, active } => self.group(ui, panels, *active, rect, false),
-            Node::Stack { entries } => {
-                let total_header = (entries.len() as f32 * self.style.tab_height).min(rect.height());
-                let remaining = (rect.height() - total_header).max(0.0);
-                let total_wanted: f64 = entries.iter().filter(|e| e.open).map(|e| f64::from(e.height.unwrap_or(self.style.min_pane).max(1.0))).sum();
-                let header = self.style.tab_height.min(rect.height() / entries.len().max(1) as f32);
-                let mut top = rect.top();
-                let mut dividers = Vec::new();
-                for (index, entry) in entries.iter().enumerate() {
-                    let share = if entry.open && total_wanted > 0.0 {
-                        (f64::from(remaining) * f64::from(entry.height.unwrap_or(self.style.min_pane).max(1.0)) / total_wanted) as f32
-                    } else {
-                        0.0
-                    };
-                    let panel_rect = Rect::from_min_max(pos2(rect.left(), top), pos2(rect.right(), (top + header + share).min(rect.bottom())));
-                    let title_rect = Rect::from_min_max(panel_rect.min, pos2(panel_rect.right(), (top + header).min(panel_rect.bottom())));
-                    self.tab(ui, &entry.panel, title_rect, entry.open, panel_rect);
-                    let collapse = Rect::from_min_max(pos2((title_rect.right() - 18.0).max(title_rect.left()), title_rect.top()), title_rect.max);
-                    let response = ui.interact(collapse, self.id.with(("collapse", &entry.panel)), Sense::click());
-                    response
-                        .widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, ui.is_enabled(), entry.open, (self.label)(&entry.panel)));
-                    ui.painter().with_clip_rect(collapse).text(
-                        collapse.center(),
-                        egui::Align2::CENTER_CENTER,
-                        if entry.open { "−" } else { "+" },
-                        self.style.font.clone(),
-                        self.style.text,
-                    );
-                    if response.clicked() {
-                        self.output.actions.push(Action::SetStackOpen { panel: entry.panel.clone(), open: !entry.open });
-                    }
-                    let body_rect = Rect::from_min_max(pos2(rect.left(), title_rect.bottom()), panel_rect.max);
-                    if entry.open {
-                        self.contents(ui, &entry.panel, body_rect);
-                    }
-                    self.targets.push(DropTarget {
-                        anchor: entry.panel.clone(),
-                        rect: panel_rect,
-                        tab_strip: Some(title_rect),
-                        tabs: vec![(entry.panel.clone(), title_rect)],
-                        allow_splits: true,
-                        accepts_tabs: (self.permissions)(&entry.panel).accepts_tabs,
-                    });
-                    top = panel_rect.bottom();
-                    if entry.open && remaining > 0.0 {
-                        dividers.push((index, Rect::from_min_max(pos2(rect.left(), top - 1.0), pos2(rect.right(), top + 1.0)).intersect(rect)));
-                    }
-                }
-                // Register dividers after the headers so their narrow hit regions win at the
-                // shared boundary. Closed entries retain their saved sizes and are skipped.
-                for (index, divider) in dividers {
-                    let Some(first) = entries.get(index) else { continue };
-                    let Some(second) = entries.iter().skip(index.saturating_add(1)).find(|entry| entry.open) else { continue };
-                    let a = f64::from(first.height.unwrap_or(self.style.min_pane).max(1.0));
-                    let b = f64::from(second.height.unwrap_or(self.style.min_pane).max(1.0));
-                    let scale = f64::from(remaining) / total_wanted;
-                    let first_size = (a * scale) as f32;
-                    let pair_size = ((a + b) * scale) as f32;
-                    let body_limits = |panel: &P| {
-                        let mut limits = (self.limits)(panel);
-                        limits.min.y = limits.min.y.max(self.style.min_pane);
-                        limits.max = limits.max.max(limits.min);
-                        limits
-                    };
-                    let (lo, hi) = split_bounds(pair_size, SplitAxis::Vertical, body_limits(&first.panel), body_limits(&second.panel));
-                    let response = ResizeHandle::new(
-                        self.id.with(("stack-resize", &first.panel)),
-                        SplitAxis::Vertical,
-                        divider,
-                        &self.style.resize_label,
-                        ResizeHandleStyle { hovered: self.style.accent, dragged: self.style.accent, focused: self.style.accent },
-                    )
-                    .value(first_size, lo..=hi)
-                    .show(ui);
-                    self.register_interaction(ui.ctx(), response.response.id);
-                    if response.delta != 0.0 && scale > 0.0 {
-                        let delta = f64::from((first_size + response.delta).clamp(lo, hi) - first_size) / scale;
-                        let next_a = (a + delta).clamp((a + b - 1_000_000.0).max(1.0), (a + b - 1.0).min(1_000_000.0));
-                        self.output.actions.push(Action::ResizeStack { panel: first.panel.clone(), height: Some(next_a as f32) });
-                        self.output.actions.push(Action::ResizeStack { panel: second.panel.clone(), height: Some((a + b - next_a) as f32) });
-                    }
-                }
-            }
-        }
-    }
-
-    fn node_limits(&self, node: &Node<P>) -> PanelLimits {
-        match node {
-            Node::Tabs { panels, .. } => {
-                let mut limits = PanelLimits::default();
-                for panel in panels {
-                    let policy = (self.limits)(panel);
-                    limits.min = limits.min.max(policy.min).max(Vec2::splat(self.style.min_pane));
-                    limits.max = limits.max.min(policy.max);
-                }
-                limits.max = limits.max.max(limits.min);
-                if panels.len() != 1 || panels.first().is_some_and(|p| (self.permissions)(p) != Permissions::PROTECTED) {
-                    limits.min.y = (limits.min.y + self.style.tab_height).min(1_000_000.0);
-                    limits.max.y = (limits.max.y + self.style.tab_height).min(1_000_000.0);
-                }
-                limits
-            }
-            Node::Stack { entries } => {
-                let mut limits = PanelLimits::default();
-                for entry in entries {
-                    let policy = (self.limits)(&entry.panel);
-                    limits.min.x = limits.min.x.max(policy.min.x).max(self.style.min_pane);
-                    limits.min.y += if entry.open { policy.min.y.max(self.style.min_pane) } else { 0.0 } + self.style.tab_height;
-                    limits.max.x = limits.max.x.min(policy.max.x);
-                }
-                limits.min = limits.min.min(Vec2::splat(1_000_000.0));
-                limits.max = limits.max.max(limits.min);
-                limits
-            }
-            Node::Split { axis, first, second, .. } => {
-                let a = self.node_limits(first);
-                let b = self.node_limits(second);
-                let limits = match axis {
-                    SplitAxis::Horizontal => PanelLimits {
-                        min: vec2(a.min.x + b.min.x + self.style.gap, a.min.y.max(b.min.y)),
-                        max: vec2(a.max.x + b.max.x + self.style.gap, a.max.y.min(b.max.y)),
-                    },
-                    SplitAxis::Vertical => PanelLimits {
-                        min: vec2(a.min.x.max(b.min.x), a.min.y + b.min.y + self.style.gap),
-                        max: vec2(a.max.x.min(b.max.x), a.max.y + b.max.y + self.style.gap),
-                    },
-                };
-                PanelLimits { min: limits.min.min(Vec2::splat(1_000_000.0)), max: limits.max.max(limits.min).min(Vec2::splat(1_000_000.0)) }
-            }
-        }
-    }
-
-    fn contents(&mut self, ui: &mut Ui, panel: &P, rect: Rect) {
-        if !super::targets::usable(rect) {
-            return;
-        }
-        ui.painter().rect_filled(rect, 0.0, self.style.background);
-        let mut child =
-            ui.new_child(UiBuilder::new().scope_id(self.id.with(("body", panel))).max_rect(rect).layout(egui::Layout::top_down(egui::Align::Min)));
-        child.set_clip_rect(rect.intersect(ui.clip_rect()));
-        self.content.body(&mut child, panel);
-        if child.rect_contains_pointer(rect) && child.input(|i| i.pointer.primary_pressed()) {
-            self.output.focused = Some(panel.clone());
-        }
-    }
-
-    fn group(&mut self, ui: &mut Ui, panels: &[P], active: usize, rect: Rect, floating: bool) {
-        let Some(selected) = panels.get(active) else { return };
-        let policy = (self.permissions)(selected);
-        let bare = panels.len() == 1 && policy == Permissions::PROTECTED;
-        if bare {
-            self.contents(ui, selected, rect);
-            self.targets.push(DropTarget {
-                anchor: selected.clone(),
-                rect,
-                tab_strip: None,
-                tabs: Vec::new(),
-                allow_splits: !floating,
-                accepts_tabs: false,
-            });
-            return;
-        }
-        let mut strip = Rect::from_min_max(rect.min, pos2(rect.right(), (rect.top() + self.style.tab_height).min(rect.bottom())));
-        ui.painter().rect_filled(strip, 0.0, self.style.tab_background);
-        if floating {
-            let grip = Rect::from_min_max(strip.min, pos2((strip.left() + 12.0).min(strip.right()), strip.bottom()));
-            let response = ui.interact(grip, self.id.with(("move-group", panels.first())), Sense::drag()).on_hover_cursor(egui::CursorIcon::Grab);
-            self.register_interaction(ui.ctx(), response.id);
-            response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.move_label));
-            if panels.iter().all(|p| (self.permissions)(p).movable)
-                && response.drag_started()
-                && let Some(first) = panels.first()
-            {
-                ui.ctx().data_mut(|d| {
-                    d.insert_temp(
-                        self.id.with("group-drag"),
-                        GroupDrag { panel: first.clone(), original: [rect.left(), rect.top(), rect.width(), rect.height()] },
-                    )
-                });
-            }
-            if panels.iter().all(|p| (self.permissions)(p).movable)
-                && response.dragged()
-                && ui.ctx().data(|d| d.get_temp::<GroupDrag<P>>(self.id.with("group-drag"))).is_some()
-                && !ui.input(|i| i.key_pressed(Key::Escape) || !i.focused)
-            {
-                let moved = clamp_float(rect.translate(ui.input(|i| i.pointer.delta())), ui.ctx().content_rect());
-                if let Some(first) = panels.first() {
-                    self.output
-                        .actions
-                        .push(Action::MoveFloating { panel: first.clone(), rect: [moved.left(), moved.top(), moved.width(), moved.height()] });
-                }
-            }
-            ui.painter().line_segment([grip.center() - vec2(0.0, 5.0), grip.center() + vec2(0.0, 5.0)], self.style.border);
-            strip.min.x = grip.right();
-        }
-        let requested = self.content.group_header_width(panels, selected, floating);
-        let header_width = if requested.is_finite() { requested.clamp(0.0, strip.width()) } else { 0.0 };
-        if header_width > 0.0 {
-            let header = Rect::from_min_max(pos2(strip.right() - header_width, strip.top()), strip.max);
-            let mut child = ui.new_child(UiBuilder::new().scope_id(self.id.with(("header", selected))).max_rect(header));
-            child.set_clip_rect(header.intersect(ui.clip_rect()));
-            self.content.group_header(&mut child, panels, selected, floating);
-        }
-        let widths: Vec<f32> = panels
-            .iter()
-            .map(|p| {
-                self.content
-                    .label(ui, p, &(self.label)(p), &self.style.font, self.style.text)
-                    .into_galley(ui, Some(egui::TextWrapMode::Extend), f32::INFINITY, self.style.font.clone())
-                    .size()
-                    .x
-                    + 24.0
-            })
-            .collect();
-        let fit = tabs::fit(&widths, active, (strip.width() - header_width).max(0.0), 40.0, 22.0);
-        let mut x = strip.left();
-        let mut targets = Vec::new();
-        for (index, width) in &fit.shown {
-            let Some(panel) = panels.get(*index) else { continue };
-            let tab = Rect::from_min_size(pos2(x, strip.top()), vec2(*width, strip.height()));
-            self.tab(ui, panel, tab, *index == active, rect);
-            targets.push((panel.clone(), tab));
-            x += width;
-        }
-        if !fit.overflow.is_empty() && fit.overflow_width > 0.0 {
-            let overflow = Rect::from_min_size(pos2(x, strip.top()), vec2(fit.overflow_width, strip.height()));
-            let response = ui.interact(overflow, self.id.with(("overflow", selected)), Sense::click());
-            response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.panels_label));
-            ui.painter().with_clip_rect(overflow).text(overflow.center(), egui::Align2::CENTER_CENTER, "…", self.style.font.clone(), self.style.text);
-            egui::Popup::menu(&response).show(|ui| {
-                egui::ScrollArea::vertical().max_height(360.0).show(ui, |ui| {
-                    for index in &fit.overflow {
-                        if let Some(panel) = panels.get(*index)
-                            && self.menu_label(ui, panel).clicked()
-                        {
-                            self.output.actions.push(Action::Activate { panel: panel.clone() });
-                            self.output.focused = Some(panel.clone());
-                            ui.close();
-                        }
-                    }
-                });
-            });
-        }
-        // Include hidden tab identities for source-group detection without creating hit areas.
-        for panel in panels {
-            if !targets.iter().any(|(p, _)| p == panel) {
-                targets.push((panel.clone(), Rect::NOTHING));
-            }
-        }
-        self.targets.push(DropTarget {
-            anchor: selected.clone(),
-            rect,
-            tab_strip: Some(strip),
-            tabs: targets,
-            allow_splits: !floating,
-            accepts_tabs: policy.accepts_tabs,
-        });
-        self.contents(ui, selected, Rect::from_min_max(pos2(rect.left(), strip.bottom()), rect.max));
-        ui.painter().rect_stroke(rect, 0.0, self.style.border, StrokeKind::Inside);
-    }
-
-    fn menu_label(&mut self, ui: &mut Ui, panel: &P) -> egui::Response {
-        let logical = (self.label)(panel);
-        let text = self.content.label(ui, panel, &logical, &self.style.font, self.style.text);
-        let response = ui.button(text);
-        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &logical));
-        response
-    }
-
-    fn tab(&mut self, ui: &mut Ui, panel: &P, rect: Rect, active: bool, group: Rect) {
-        let policy = (self.permissions)(panel);
-        let label = (self.label)(panel);
-        let color = if active { self.style.text } else { self.style.inactive_text };
-        let galley = self.content.label(ui, panel, &label, &self.style.font, color).into_galley(
-            ui,
-            Some(egui::TextWrapMode::Extend),
-            f32::INFINITY,
-            self.style.font.clone(),
-        );
-        let response = tabs::Tab::new(self.id.with(("tab", panel)), &label, active)
-            .sense(if policy.movable { Sense::click_and_drag() } else { Sense::click() })
-            .focus_stroke(Stroke::new(1.0, self.style.accent))
-            .show_at(ui, rect, |ui, response| {
-                let painter = ui.painter().with_clip_rect(rect.intersect(ui.clip_rect()));
-                painter.rect_filled(rect, 0.0, if active || response.hovered() { self.style.active_background } else { self.style.tab_background });
-                painter.galley(rect.center() - galley.size() * 0.5, galley.clone(), color);
-            });
-        self.register_interaction(ui.ctx(), response.id);
-        if response.clicked() {
-            self.output.actions.push(Action::Activate { panel: panel.clone() });
-            self.output.focused = Some(panel.clone());
-        }
-        if policy.movable && response.drag_started() {
-            begin_drag(ui.ctx(), self.id, panel.clone(), group);
-        }
-        response.context_menu(|ui| {
-            self.content.panel_menu(ui, panel);
-            if policy.movable && policy.floatable {
-                let text = self.content.action_label(ui, &self.style.float_label, &self.style.font, self.style.text);
-                let response = ui.button(text);
-                response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.float_label));
-                if response.clicked() {
-                    let rect = clamp_float(group.translate(vec2(24.0, 24.0)), ui.ctx().content_rect());
-                    self.output.actions.push(Action::Float { panel: panel.clone(), rect: [rect.left(), rect.top(), rect.width(), rect.height()] });
-                    ui.close();
-                }
-            }
-            if policy.movable {
-                let text = self.content.action_label(ui, &self.style.move_label, &self.style.font, self.style.text);
-                let response = ui.menu_button(text, |ui| {
-                    egui::ScrollArea::vertical().max_height(360.0).show(ui, |ui| {
-                        for target in self.layout.panels() {
-                            if target != panel && (self.permissions)(target).accepts_tabs && self.menu_label(ui, target).clicked() {
-                                self.output.actions.push(Action::Move {
-                                    panel: panel.clone(),
-                                    anchor: target.clone(),
-                                    placement: Placement::Tab { before: None },
-                                });
-                                ui.close();
-                            }
-                        }
-                    });
-                });
-                response.response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.move_label));
-            }
-            if policy.closable {
-                let text = self.content.action_label(ui, &self.style.close_label, &self.style.font, self.style.text);
-                let response = ui.button(text);
-                response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.close_label));
-                if response.clicked() {
-                    self.output.actions.push(Action::Close { panel: panel.clone() });
-                    ui.close();
-                }
-            }
-        });
-    }
-
-    fn floating(&mut self, ctx: &Context) {
-        let screen = ctx.content_rect();
-        if !super::targets::usable(screen) {
-            return;
-        }
-        let layers = ctx.memory(|memory| memory.layer_ids().collect::<Vec<_>>());
-        let mut groups: Vec<_> = self.layout.floating.iter().collect();
-        groups.sort_by_key(|group| {
-            let id = group.panels.first().map(|panel| self.id.with(("floating", panel)));
-            layers.iter().position(|layer| Some(layer.id) == id).unwrap_or(usize::MAX)
-        });
-        for group in groups {
-            let Some(first) = group.panels.first() else { continue };
-            let [x, y, width, height] = group.rect;
-            let limits = self.node_limits(&Node::Tabs { panels: group.panels.clone(), active: group.active });
-            let size = vec2(width, height).max(limits.min).min(limits.max);
-            let rect = clamp_float(Rect::from_min_size(pos2(x, y), size), screen);
-            let id = self.id.with(("floating", first));
-            if self.activation.as_ref().is_some_and(|panel| group.panels.contains(panel)) {
-                ctx.move_to_top(egui::LayerId::new(egui::Order::Middle, id));
-                ctx.memory_mut(|memory| memory.request_focus(self.id.with(("tab", self.activation.as_ref().unwrap_or(first)))));
-                self.output.focused = self.activation.clone();
-            }
-            egui::Area::new(id).order(egui::Order::Middle).fixed_pos(rect.min).movable(false).constrain_to(screen).show(ctx, |ui| {
-                ui.set_min_size(rect.size());
-                let rect = Rect::from_min_size(ui.min_rect().min, rect.size());
-                ui.allocate_rect(rect, Sense::hover());
-                self.group(ui, &group.panels, group.active, rect, true);
-                let corner = Rect::from_min_max((rect.max - vec2(12.0, 12.0)).max(rect.min), rect.max);
-                let response = ui.interact(corner, id.with("resize"), Sense::drag()).on_hover_cursor(egui::CursorIcon::ResizeNwSe);
-                self.register_interaction(ui.ctx(), response.id);
-                response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &self.style.resize_window_label));
-                if response.drag_started() {
-                    response.request_focus();
-                }
-                let mut delta = if response.dragged() { ui.input(|i| i.pointer.delta()) } else { Vec2::ZERO };
-                if response.has_focus() {
-                    ui.memory_mut(|memory| {
-                        memory.set_focus_lock_filter(
-                            response.id,
-                            egui::EventFilter { horizontal_arrows: true, vertical_arrows: true, ..Default::default() },
-                        )
-                    });
-                    ui.input_mut(|input| {
-                        if input.consume_key(egui::Modifiers::NONE, Key::ArrowLeft) {
-                            delta.x -= 8.0;
-                        }
-                        if input.consume_key(egui::Modifiers::NONE, Key::ArrowRight) {
-                            delta.x += 8.0;
-                        }
-                        if input.consume_key(egui::Modifiers::NONE, Key::ArrowUp) {
-                            delta.y -= 8.0;
-                        }
-                        if input.consume_key(egui::Modifiers::NONE, Key::ArrowDown) {
-                            delta.y += 8.0;
-                        }
-                    });
-                }
-                // Resizing changes the group's shared rectangle, which the model allows only when
-                // every member is movable.
-                if response.enabled() && delta != Vec2::ZERO && group.panels.iter().all(|p| (self.permissions)(p).movable) {
-                    let size = (rect.size() + delta).max(limits.min.max(vec2(40.0, self.style.tab_height + 20.0))).min(limits.max).min(screen.size());
-                    self.output.actions.push(Action::MoveFloating { panel: first.clone(), rect: [rect.left(), rect.top(), size.x, size.y] });
-                }
-                if response.hovered() || response.dragged() || response.has_focus() {
-                    ui.painter().line_segment([corner.left_bottom(), corner.right_top()], Stroke::new(2.0, self.style.accent));
-                }
-            });
-        }
-    }
-
-    fn finish_group_drag(&mut self, ctx: &Context) {
-        let Some(drag) = ctx.data(|d| d.get_temp::<GroupDrag<P>>(self.id.with("group-drag"))) else { return };
-        if !self.layout.floating.iter().any(|g| g.panels.contains(&drag.panel) && g.panels.iter().all(|p| (self.permissions)(p).movable)) {
-            ctx.data_mut(|d| d.remove::<GroupDrag<P>>(self.id.with("group-drag")));
-            return;
-        }
-        let (escape, focused, down, released, pointer) =
-            ctx.input(|i| (i.key_pressed(Key::Escape), i.focused, i.pointer.primary_down(), i.pointer.primary_released(), i.pointer.interact_pos()));
-        if escape || !focused || !down {
-            ctx.data_mut(|d| d.remove::<GroupDrag<P>>(self.id.with("group-drag")));
-            if escape || !focused {
-                self.output.actions.push(Action::MoveFloating { panel: drag.panel, rect: drag.original });
-            } else if released
-                && let Some(pointer) = pointer.filter(|p| p.is_finite())
-                && !self.blockers.iter().any(|r| r.contains(pointer))
-            {
-                self.output.group_drop = Some((drag.panel, pointer));
-            }
-        } else if pointer.is_some_and(|p| !self.blockers.iter().any(|r| r.contains(p))) {
-            self.output.group_drag = Some(drag.panel);
-        }
-    }
-
-    fn finish_drag(&mut self, ctx: &Context) {
-        let Some(drag) = ctx.data(|d| d.get_temp::<Drag<P>>(self.id.with("drag"))) else { return };
-        let (pointer, down, released, focused) =
-            ctx.input(|i| (i.pointer.interact_pos(), i.pointer.primary_down(), i.pointer.primary_released(), i.focused));
-        let escape = ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, Key::Escape));
-        if escape || !focused || !self.layout.contains(&drag.panel) || (!down && !released) {
-            cancel_drag::<P>(ctx, self.id);
-            return;
-        }
-        let Some(pointer) = pointer.filter(|p| p.is_finite()) else {
-            if released {
-                cancel_drag::<P>(ctx, self.id);
-            }
-            return;
-        };
-        if self.blockers.iter().any(|rect| rect.contains(pointer)) {
-            if released {
-                cancel_drag::<P>(ctx, self.id);
-            }
-            return;
-        }
-        let proposal = resolve_drop(&drag.panel, pointer, &self.targets);
-        if released {
-            cancel_drag::<P>(ctx, self.id);
-            if pointer.distance(drag.origin) < 2.0 {
-                return;
-            }
-            let action = if let Some(proposal) = proposal {
-                Some(Action::Move { panel: drag.panel.clone(), anchor: proposal.anchor, placement: proposal.placement })
-            } else if (self.permissions)(&drag.panel).floatable
-                && (!drag.source.contains(pointer) || self.layout.floating.iter().any(|g| g.panels.contains(&drag.panel)))
-            {
-                let rect = clamp_float(Rect::from_min_size(pointer - drag.grab, drag.source.size()), ctx.content_rect());
-                Some(Action::Float { panel: drag.panel.clone(), rect: [rect.left(), rect.top(), rect.width(), rect.height()] })
-            } else {
-                None
-            };
-            if let Some(action) = action {
-                // Validate the proposed gesture against the same complete snapshot. The app
-                // still applies it via its own command path after body rendering finishes.
-                let mut candidate = self.layout.clone();
-                if candidate.apply_with_permissions(action.clone(), self.permissions).is_ok() {
-                    self.output.actions.push(action);
-                    self.output.focused = Some(drag.panel);
-                }
-            }
-            return;
-        }
-        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, self.id.with("drop-preview")));
-        if let Some(proposal) = proposal {
-            painter.rect(
-                proposal.preview.shrink(1.0),
-                0.0,
-                self.style.accent.gamma_multiply(0.15),
-                Stroke::new(2.0, self.style.accent),
-                StrokeKind::Inside,
-            );
-            if let Some(marker) = proposal.insertion {
-                painter.rect_filled(marker, 0.0, self.style.accent);
-            }
-        } else if (self.permissions)(&drag.panel).floatable {
-            let rect = clamp_float(Rect::from_min_size(pointer - drag.grab, drag.source.size()), ctx.content_rect());
-            painter.rect_stroke(rect, 0.0, Stroke::new(2.0, self.style.accent), StrokeKind::Inside);
-        }
-    }
-}
-
-fn clamp_float(rect: Rect, screen: Rect) -> Rect {
-    if !super::targets::usable(screen) {
-        return rect;
-    }
-    let size = rect.size().max(vec2(1.0, 1.0)).min(screen.size());
-    let min = rect.min.max(screen.min).min(screen.max - size);
-    Rect::from_min_size(min, size)
-}
-
-fn split_bounds(available: f32, axis: SplitAxis, first: PanelLimits, second: PanelLimits) -> (f32, f32) {
-    let (a_min, a_max, b_min, b_max) = match axis {
-        SplitAxis::Horizontal => (first.min.x, first.max.x, second.min.x, second.max.x),
-        SplitAxis::Vertical => (first.min.y, first.max.y, second.min.y, second.max.y),
-    };
-    let scale = if a_min + b_min > available { available / (a_min + b_min).max(1.0) } else { 1.0 };
-    let lo = (a_min * scale).min(available);
-    let hi = (available - b_min * scale).max(lo).min(available);
-    let constrained_lo = lo.max(available - b_max);
-    let constrained_hi = hi.min(a_max);
-    if constrained_lo <= constrained_hi { (constrained_lo, constrained_hi) } else { (lo, hi) }
-}
diff --git a/crates/ui/src/docking/targets.rs b/crates/ui/src/docking/targets.rs
index 515b9c65..2ba84165 100644
--- a/crates/ui/src/docking/targets.rs
+++ b/crates/ui/src/docking/targets.rs
@@ -1,9 +1,11 @@
-use egui::{Pos2, Rect, pos2};
+use egui::{Pos2, Rangef, Rect, Vec2, pos2};
 
-use super::{Placement, Zone};
+use super::{Placement, Side, Target, Zone};
 
 /// One visible group, supplied in back-to-front order to [`resolve_drop`]. An empty tab strip
 /// or a group that rejects tabs may still accept side splits, e.g. a protected document canvas.
+/// The dock area's docking profile ([`crate::docking::DockStyle::new_dock_zones`]) gives the
+/// body of a frame or floating group that rejects tabs no target at all.
 #[derive(Clone, Debug)]
 pub struct DropTarget<P> {
     pub anchor: P,
@@ -12,6 +14,9 @@ pub struct DropTarget<P> {
     pub tabs: Vec<(P, Rect)>,
     pub allow_splits: bool,
     pub accepts_tabs: bool,
+    /// The strip runs right to left: the first tab is rightmost, and an insertion slot sits
+    /// at the right edge of the tab it precedes.
+    pub right_to_left: bool,
 }
 
 #[derive(Clone, Debug, PartialEq)]
@@ -20,29 +25,155 @@ pub struct DropProposal<P> {
     pub placement: Placement<P>,
     pub preview: Rect,
     pub insertion: Option<Rect>,
+    /// The pointer addresses the tab's current insertion slot. The renderer also marks a drop
+    /// that would leave every panel where it is, changing only sizes.
+    pub noop: bool,
 }
 
 pub(super) fn usable(rect: Rect) -> bool {
     rect.is_finite() && rect.width() > 0.0 && rect.height() > 0.0 && rect.width() <= 1_000_000.0 && rect.height() <= 1_000_000.0
 }
 
-/// Tab header is the center; otherwise the nearest quarter-width/height edge wins.
-/// Outside, non-finite, empty and inverted rectangles have no target.
-pub fn drop_zone(rect: Rect, tab_height: f32, pointer: Pos2) -> Option<Zone> {
+/// Depth of a group's side drop zones with [`crate::docking::DockStyle::side_edge_zones`]: the
+/// `depth` that [`drop_zone`], [`zone_shape`] and [`resolve_drop`] take there.
+pub const SIDE_EDGE_ZONE_DEPTH: f32 = 40.0;
+
+/// Width of the band along the layout's outer edge with
+/// [`crate::docking::DockStyle::side_edge_zones`], in place of
+/// [`crate::docking::DockStyle::edge_band`].
+pub(super) const SIDE_EDGE_BAND: f32 = 8.0;
+
+/// The picture-frame zones of [`crate::docking::DockStyle::side_edge_zones`]. Tab header (the
+/// top `tab_height` of `rect`) is the center; otherwise the nearest side zone of the body below
+/// it wins. Every side zone reaches the same depth into the body: `depth`, or a
+/// quarter of the body's smaller side when that is less, so a body always keeps a center and a
+/// narrow body's top and bottom zones are no deeper than its left and right ones. A `depth` of
+/// zero or less leaves only the center. Outside, non-finite, empty and inverted rectangles have
+/// no target.
+pub fn drop_zone(rect: Rect, tab_height: f32, depth: f32, pointer: Pos2) -> Option<Zone> {
     if !usable(rect) || !pointer.is_finite() || !rect.contains(pointer) || !tab_height.is_finite() || tab_height < 0.0 {
         return None;
     }
-    if pointer.y < rect.top() + tab_height.min(rect.height()) {
+    let body = body(rect, tab_height);
+    if pointer.y < body.top() || !usable(body) {
         return Some(Zone::Center);
     }
-    let x = (pointer.x - rect.left()) / rect.width();
-    let y = (pointer.y - rect.top()) / rect.height();
-    let distances = [(x, Zone::Left), (1.0 - x, Zone::Right), (y, Zone::Top), (1.0 - y, Zone::Bottom)];
-    let (distance, zone) = distances.into_iter().min_by(|a, b| a.0.total_cmp(&b.0))?;
-    Some(if distance > 0.25 { Zone::Center } else { zone })
+    let Vec2 { x, y } = side_depths(body, depth);
+    let sides = [
+        (pointer.x - body.left(), x, Zone::Left),
+        (body.right() - pointer.x, x, Zone::Right),
+        (pointer.y - body.top(), y, Zone::Top),
+        (body.bottom() - pointer.y, y, Zone::Bottom),
+    ];
+    let nearest =
+        sides.into_iter().filter(|(_, depth, _)| *depth > 0.0).map(|(gap, depth, zone)| (gap / depth, zone)).min_by(|a, b| a.0.total_cmp(&b.0));
+    Some(match nearest {
+        Some((distance, zone)) if distance <= 1.0 => zone,
+        _ => Zone::Center,
+    })
 }
 
-/// Preview of the region occupied after a split or group merge.
+/// The zones of the default profile. Tab header (the top `tab_height` of `rect`) is the center.
+/// In the body below it, the outer `fraction` of its width from the left or right edge, or of
+/// its height from the top or bottom edge, is that side's zone; where two sides' zones meet, the
+/// side the pointer is relatively nearer wins. The rest is the center. Without `center` (a group
+/// that takes no tabs) the whole body goes to the relatively nearest side, as the dock area has
+/// it without [`crate::docking::DockStyle::new_dock_zones`]; with it, such a body is no target.
+/// A `fraction` of zero or less leaves only the center; more than one half acts as one half.
+/// Outside, non-finite, empty and inverted rectangles have no target.
+pub fn body_zone(rect: Rect, tab_height: f32, fraction: f32, center: bool, pointer: Pos2) -> Option<Zone> {
+    body_zone_on(rect, tab_height, fraction, center, Sides::ALL, pointer)
+}
+
+/// [`body_zone`] where a body without `center` maps only to the nearest of `sides`, and to no
+/// target without any.
+pub(super) fn body_zone_on(rect: Rect, tab_height: f32, fraction: f32, center: bool, sides: Sides, pointer: Pos2) -> Option<Zone> {
+    if !usable(rect) || !pointer.is_finite() || !rect.contains(pointer) || !tab_height.is_finite() || tab_height < 0.0 {
+        return None;
+    }
+    let body = body(rect, tab_height);
+    if pointer.y < body.top() || !usable(body) || fraction.is_nan() || fraction <= 0.0 {
+        return Some(Zone::Center);
+    }
+    let fraction = fraction.min(0.5);
+    let (w, h) = (body.width(), body.height());
+    let allowed = |zone: &Zone| center || sides.contains(*zone);
+    let (distance, zone) = [
+        ((pointer.x - body.left()) / w, Zone::Left),
+        ((body.right() - pointer.x) / w, Zone::Right),
+        ((pointer.y - body.top()) / h, Zone::Top),
+        ((body.bottom() - pointer.y) / h, Zone::Bottom),
+    ]
+    .into_iter()
+    .filter(|(_, zone)| allowed(zone))
+    .min_by(|a, b| a.0.total_cmp(&b.0))?;
+    Some(if center && distance > fraction { Zone::Center } else { zone })
+}
+
+/// The preview line of a drop beside `rect` on `zone`'s side: `width` thick along that whole
+/// edge, inside `rect`. None for the center.
+pub(super) fn edge_line(rect: Rect, zone: Zone, width: f32) -> Option<Rect> {
+    if !usable(rect) {
+        return None;
+    }
+    let (w, h) = (width.max(1.0).min(rect.width()), width.max(1.0).min(rect.height()));
+    Some(match zone {
+        Zone::Left => Rect::from_x_y_ranges(rect.left()..=(rect.left() + w), rect.y_range()),
+        Zone::Right => Rect::from_x_y_ranges((rect.right() - w)..=rect.right(), rect.y_range()),
+        Zone::Top => Rect::from_x_y_ranges(rect.x_range(), rect.top()..=(rect.top() + h)),
+        Zone::Bottom => Rect::from_x_y_ranges(rect.x_range(), (rect.bottom() - h)..=rect.bottom()),
+        Zone::Center => return None,
+    })
+}
+
+/// The part of a group drawn at `rect` below its tab header.
+fn body(rect: Rect, tab_height: f32) -> Rect {
+    Rect::from_min_max(pos2(rect.left(), rect.top() + tab_height.min(rect.height())), rect.max)
+}
+
+/// How deep the side zones of `body` reach in from its left and right edges (`x`) and its top
+/// and bottom edges (`y`): the same on all four sides.
+fn side_depths(body: Rect, depth: f32) -> Vec2 {
+    let depth = if depth > 0.0 { depth } else { 0.0 };
+    Vec2::splat(depth.min(body.width().min(body.height()) / 4.0))
+}
+
+/// The outline of a drop zone of the group drawn at `rect`, as [`drop_zone`] finds it with the
+/// same `tab_height` and `depth`: a side's trapezoid (its outer edge the whole side of the body,
+/// its inner edge on the center rectangle), or the center rectangle. The tab header, a grouping
+/// zone too, is not part of any shape. None for a side without depth.
+pub fn zone_shape(rect: Rect, tab_height: f32, depth: f32, zone: Zone) -> Option<Vec<Pos2>> {
+    if !usable(rect) || !tab_height.is_finite() || tab_height < 0.0 {
+        return None;
+    }
+    let body = body(rect, tab_height);
+    let depths = side_depths(body, depth);
+    let flat = match zone {
+        Zone::Left | Zone::Right => depths.x <= 0.0,
+        Zone::Top | Zone::Bottom => depths.y <= 0.0,
+        Zone::Center => false,
+    };
+    if !usable(body) || flat {
+        return None;
+    }
+    let inner = body.shrink2(depths);
+    Some(match zone {
+        Zone::Left => vec![body.left_top(), inner.left_top(), inner.left_bottom(), body.left_bottom()],
+        Zone::Right => vec![inner.right_top(), body.right_top(), body.right_bottom(), inner.right_bottom()],
+        Zone::Top => vec![body.left_top(), body.right_top(), inner.right_top(), inner.left_top()],
+        Zone::Bottom => vec![inner.left_bottom(), inner.right_bottom(), body.right_bottom(), body.left_bottom()],
+        Zone::Center => vec![inner.left_top(), inner.right_top(), inner.right_bottom(), inner.left_bottom()],
+    })
+}
+
+/// Height of the tab header of `target` that [`resolve_drop`] treats as a grouping zone: from the
+/// top of its rect to the bottom of its tab strip.
+pub(super) fn header_height<P>(target: &DropTarget<P>) -> f32 {
+    target.tab_strip.map(|strip| strip.intersect(target.rect)).filter(|strip| usable(*strip)).map_or(0.0, |strip| strip.bottom() - target.rect.top())
+}
+
+/// The region a split or group merge occupies: the half of `rect` on `zone`'s side, or all of
+/// it. [`resolve_drop`] previews with it.
 pub fn zone_rect(rect: Rect, zone: Zone) -> Option<Rect> {
     if !usable(rect) {
         return None;
@@ -57,10 +188,100 @@ pub fn zone_rect(rect: Rect, zone: Zone) -> Option<Rect> {
     })
 }
 
+/// Bounded insertion marker for a logical slot in a measured tab strip. Hidden tabs
+/// retain their order; their slot uses the next visible boundary or the visible strip end.
+pub fn tab_insertion_marker<P: Eq>(target: &DropTarget<P>, before: Option<&P>) -> Option<Rect> {
+    if target.tabs.len() > super::MAX_PANELS || !target.accepts_tabs || !usable(target.rect) {
+        return None;
+    }
+    let strip = target.tab_strip?.intersect(target.rect);
+    if !usable(strip) {
+        return None;
+    }
+    let index = before.and_then(|before| target.tabs.iter().position(|(panel, _)| panel == before));
+    let rtl = target.right_to_left;
+    let leading = |rect: &Rect| if rtl { rect.right() } else { rect.left() };
+    let visible = || target.tabs.iter().filter(|(_, rect)| usable(*rect)).map(|(_, rect)| rect);
+    let x = index
+        .and_then(|index| target.tabs.get(index..))
+        .and_then(|tabs| tabs.iter().find(|(_, rect)| usable(*rect)).map(|(_, rect)| leading(rect)))
+        .unwrap_or_else(|| {
+            if rtl {
+                visible().map(|rect| rect.left()).fold(strip.right(), f32::min).max(strip.left())
+            } else {
+                visible().map(|rect| rect.right()).fold(strip.left(), f32::max).min(strip.right())
+            }
+        });
+    let width = strip.width().min(2.0);
+    let left = (x - width * 0.5).max(strip.left()).min((strip.right() - width).max(strip.left()));
+    Some(Rect::from_min_max(pos2(left, strip.top()), pos2((left + width).min(strip.right()), strip.bottom())))
+}
+
 /// Resolve a pointer against visible groups. The frontmost containing group occludes groups
 /// behind it even if it rejects the drop. A strip reorders by midpoint; the body of the source
-/// group is a no-op at center. Floating groups normally set `allow_splits` to false.
-pub fn resolve_drop<P: Clone + Eq>(panel: &P, pointer: Pos2, targets: &[DropTarget<P>]) -> Option<DropProposal<P>> {
+/// group is a no-op at center. The body's side zones are [`drop_zone`]'s with `zone_depth`
+/// ([`SIDE_EDGE_ZONE_DEPTH`] in the docking area): one depth on all four sides, at most a quarter
+/// of the body's smaller side. A split previews the half of the group it takes ([`zone_rect`]).
+/// Floating groups normally set `allow_splits` to false. These are the split-tree zones; a host
+/// that resolves drops for a [`crate::docking::DockStyle`] calls [`resolve_drop_by`] with its
+/// [`crate::docking::DockStyle::zone_rule`].
+pub fn resolve_drop<P: Clone + Eq>(panel: &P, pointer: Pos2, targets: &[DropTarget<P>], zone_depth: f32) -> Option<DropProposal<P>> {
+    resolve_drop_by(panel, pointer, targets, ZoneRule::Depth(zone_depth))
+}
+
+/// A set of sides: of the layout's outer edge, or of a group's body
+/// ([`crate::docking::DockStyle::drop_edges`]).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Sides {
+    pub left: bool,
+    pub right: bool,
+    pub top: bool,
+    pub bottom: bool,
+}
+
+impl Sides {
+    pub const ALL: Self = Self { left: true, right: true, top: true, bottom: true };
+    pub const NONE: Self = Self { left: false, right: false, top: false, bottom: false };
+    pub const LEFT_RIGHT: Self = Self { left: true, right: true, top: false, bottom: false };
+    pub const TOP_BOTTOM: Self = Self { left: false, right: false, top: true, bottom: true };
+
+    /// Whether `zone`'s side is in the set; never the center.
+    pub fn contains(self, zone: Zone) -> bool {
+        match zone {
+            Zone::Left => self.left,
+            Zone::Right => self.right,
+            Zone::Top => self.top,
+            Zone::Bottom => self.bottom,
+            Zone::Center => false,
+        }
+    }
+}
+
+/// How [`resolve_drop_by`] divides a group's body.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum ZoneRule {
+    /// [`drop_zone`] with this depth; a split previews the half it takes.
+    Depth(f32),
+    /// [`body_zone`] with this fraction; a split previews a `line` thick line along the
+    /// group's edge on that side.
+    Fraction { fraction: f32, line: f32 },
+}
+
+/// [`resolve_drop`] with the body zones of `rule`: [`crate::docking::DockStyle::zone_rule`]
+/// gives the ones the dock area uses.
+pub fn resolve_drop_by<P: Clone + Eq>(panel: &P, pointer: Pos2, targets: &[DropTarget<P>], rule: ZoneRule) -> Option<DropProposal<P>> {
+    resolve_drop_on(panel, pointer, targets, rule, Sides::ALL)
+}
+
+/// [`resolve_drop_by`] where a group that takes no tabs splits only on `sides` with
+/// [`ZoneRule::Fraction`], and with none is no target.
+pub(super) fn resolve_drop_on<P: Clone + Eq>(
+    panel: &P,
+    pointer: Pos2,
+    targets: &[DropTarget<P>],
+    rule: ZoneRule,
+    sides: Sides,
+) -> Option<DropProposal<P>> {
     if !pointer.is_finite() || targets.len() > super::MAX_PANELS {
         return None;
     }
@@ -68,26 +289,54 @@ pub fn resolve_drop<P: Clone + Eq>(panel: &P, pointer: Pos2, targets: &[DropTarg
     if target.tabs.len() > super::MAX_PANELS {
         return None;
     }
-    let anchor = if &target.anchor == panel { target.tabs.iter().find(|(p, _)| p != panel).map(|(p, _)| p)? } else { &target.anchor };
-    let strip = target.tab_strip.filter(|r| usable(*r) && r.contains(pointer));
-    if let Some(strip) = strip {
+    let anchor = if &target.anchor == panel { target.tabs.iter().find(|(p, _)| p != panel).map(|(p, _)| p).unwrap_or(panel) } else { &target.anchor };
+    let strip = target.tab_strip.map(|strip| strip.intersect(target.rect)).filter(|r| usable(*r) && r.contains(pointer));
+    if strip.is_some() {
         if !target.accepts_tabs {
             return None;
         }
-        let before = target.tabs.iter().filter(|(_, r)| usable(*r)).find(|(_, r)| pointer.x < r.center().x);
+        let ahead = |r: &Rect| if target.right_to_left { pointer.x > r.center().x } else { pointer.x < r.center().x };
+        let before = target.tabs.iter().filter(|(_, r)| usable(*r)).find(|(_, r)| ahead(r));
         let before_panel = before.map(|(p, _)| p.clone());
-        let x = before.map(|(_, r)| r.left()).unwrap_or_else(|| {
-            target.tabs.iter().filter(|(_, r)| usable(*r)).map(|(_, r)| r.right()).fold(strip.left(), f32::max).min(strip.right())
-        });
-        let insertion = Rect::from_min_max(pos2((x - 1.0).max(strip.left()), strip.top()), pos2((x + 1.0).min(strip.right()), strip.bottom()));
+        let insertion = tab_insertion_marker(target, before_panel.as_ref())?;
+        let old_order: Vec<_> = target.tabs.iter().map(|(p, _)| p).collect();
+        let mut order = old_order.clone();
+        let noop = if before_panel.as_ref() == Some(panel) {
+            old_order.contains(&panel)
+        } else if old_order.contains(&panel) {
+            order.retain(|p| *p != panel);
+            let at = before_panel.as_ref().and_then(|before| order.iter().position(|p| *p == before)).unwrap_or(order.len());
+            order.insert(at, panel);
+            order == old_order
+        } else {
+            false
+        };
         return Some(DropProposal {
             anchor: anchor.clone(),
             placement: Placement::Tab { before: before_panel },
             preview: target.rect,
             insertion: Some(insertion),
+            noop,
         });
     }
-    let zone = if target.allow_splits { drop_zone(target.rect, 0.0, pointer)? } else { Zone::Center };
+    let header = header_height(target);
+    let zone = match rule {
+        _ if !target.allow_splits => Zone::Center,
+        ZoneRule::Depth(depth) => drop_zone(target.rect, header, depth, pointer)?,
+        ZoneRule::Fraction { fraction, .. } => body_zone_on(target.rect, header, fraction, target.accepts_tabs, sides, pointer)?,
+    };
+    if zone == Zone::Center && target.accepts_tabs && target.tabs.iter().any(|(p, _)| p == panel) {
+        return Some(DropProposal {
+            anchor: anchor.clone(),
+            placement: Placement::Tab { before: Some(panel.clone()) },
+            preview: target.rect,
+            insertion: None,
+            noop: true,
+        });
+    }
+    if anchor == panel {
+        return None;
+    }
     if zone == Zone::Center {
         if !target.accepts_tabs || target.tabs.iter().any(|(p, _)| p == panel) {
             return None;
@@ -95,5 +344,87 @@ pub fn resolve_drop<P: Clone + Eq>(panel: &P, pointer: Pos2, targets: &[DropTarg
     } else if !target.allow_splits {
         return None;
     }
-    Some(DropProposal { anchor: anchor.clone(), placement: Placement::Split(zone), preview: zone_rect(target.rect, zone)?, insertion: None })
+    Some(DropProposal {
+        anchor: anchor.clone(),
+        placement: Placement::Split(zone),
+        preview: match rule {
+            ZoneRule::Fraction { line, .. } if zone != Zone::Center => edge_line(target.rect, zone, line)?,
+            _ => zone_rect(target.rect, zone)?,
+        },
+        insertion: None,
+        noop: false,
+    })
+}
+
+/// [D] A dock drop target, built once per frame next to the [`DropTarget`]s. The pointer selects
+/// it inside `band`; `line` is the edge it docks to.
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct DockDrop<P> {
+    pub(super) target: DockTarget<P>,
+    pub(super) band: Rect,
+    pub(super) line: Rect,
+    /// A band along the window edge: a new dock, or a new column outside the outermost one.
+    /// Its preview is `line`, not the rect the drop takes.
+    pub(super) outer: bool,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum DockTarget<P> {
+    /// Column edge: a new column beside the column of `anchor`, further from the window edge
+    /// when `after` (P5).
+    ColumnEdge { anchor: P, after: bool },
+    /// The seam between two stacked groups: a new group below the group of `anchor` (P4).
+    Seam { anchor: P },
+    /// The top or bottom zone of a group body, or the free room under a column's last group (P3).
+    GroupBand { anchor: P, below: bool },
+    /// A window edge without a dock, or an empty dock (P5, P6).
+    NewDock { side: Side },
+}
+
+impl<P: Clone> DockTarget<P> {
+    pub(super) fn to(&self) -> Target<P> {
+        match self {
+            Self::ColumnEdge { anchor, after } => Target::At { anchor: anchor.clone(), placement: Placement::Column { after: *after } },
+            Self::Seam { anchor } => Target::At { anchor: anchor.clone(), placement: Placement::Group { below: true, height: None } },
+            Self::GroupBand { anchor, below } => Target::At { anchor: anchor.clone(), placement: Placement::Group { below: *below, height: None } },
+            Self::NewDock { side } => Target::NewDock { side: *side },
+        }
+    }
+
+    /// Rank in resolution order: column edges reach past their columns, so they come first.
+    fn rank(&self) -> u8 {
+        match self {
+            Self::ColumnEdge { .. } => 0,
+            Self::Seam { .. } => 1,
+            Self::GroupBand { .. } => 2,
+            Self::NewDock { .. } => 3,
+        }
+    }
+}
+
+/// The dock target under the pointer: column edges, then seams, then group bands, then new docks.
+pub(super) fn resolve_dock<P: Clone>(pointer: Pos2, targets: &[DockDrop<P>]) -> Option<&DockDrop<P>> {
+    if !pointer.is_finite() {
+        return None;
+    }
+    targets.iter().filter(|t| usable(t.band) && t.band.contains(pointer)).min_by_key(|t| t.target.rank())
+}
+
+/// How far from its line a border band reaches into a tab strip that takes tabs: the rest of
+/// the strip joins the group.
+pub(super) const STRIP_REACH: f32 = 4.0;
+
+/// Band and line of a column edge at `x`: the band `band` wide, centred on the edge, and the
+/// line `line` wide.
+pub(super) fn column_edge(x: f32, ys: Rangef, band: f32, line: f32) -> (Rect, Rect) {
+    let half = band.max(0.0) * 0.5;
+    (Rect::from_x_y_ranges((x - half)..=(x + half), ys), vertical_line(x, ys, line))
+}
+
+pub(super) fn vertical_line(x: f32, ys: Rangef, width: f32) -> Rect {
+    Rect::from_x_y_ranges((x - width * 0.5)..=(x + width * 0.5), ys)
+}
+
+pub(super) fn horizontal_line(y: f32, xs: Rangef, width: f32) -> Rect {
+    Rect::from_x_y_ranges(xs, (y - width * 0.5)..=(y + width * 0.5))
 }
diff --git a/crates/ui/src/docking/testing.rs b/crates/ui/src/docking/testing.rs
new file mode 100644
index 00000000..1d230ecb
--- /dev/null
+++ b/crates/ui/src/docking/testing.rs
@@ -0,0 +1,657 @@
+//! Drive a [`DockArea`] with real egui input in application tests (feature `testing`).
+//!
+//! ```ignore
+//! let mut driver = DockDriver::new(app_layout(), Panels::default());
+//! let bar = driver.hit(&Hit::DragBar(PanelId::Layers)).unwrap();
+//! driver.drag(bar.center(), egui::pos2(2.0, 300.0));
+//! driver.settle();
+//! assert!(driver.hit(&Hit::ColumnBar(PanelId::Layers)).is_some());
+//! ```
+
+use std::{fmt::Debug, hash::Hash};
+
+use egui::{Context, Event, Id, Key, Modifiers, PointerButton, Pos2, RawInput, Rect, UiBuilder, epaint::ClippedShape, vec2};
+
+use super::{DockArea, DockContent, DockOutput, DockStyle, Hit, Layout, Monitor};
+
+/// Pointer travel that starts a drag before moving to its destination.
+const NUDGE: egui::Vec2 = egui::Vec2::new(8.0, 6.0);
+
+type StyleFn = Box<dyn Fn(&mut DockStyle)>;
+#[cfg(feature = "native-windows")]
+type InputHook = std::sync::Arc<dyn Fn(&Context, &mut RawInput) + Send + Sync>;
+
+/// A [`DockArea`] in a headless egui context, with its layout and content. Each frame advances
+/// the clock by 1/60 s, so double-clicks register. [`Self::step`] applies what a frame emits,
+/// the way an application's command path would.
+pub struct DockDriver<P, C> {
+    pub ctx: Context,
+    pub layout: Layout<P>,
+    pub content: C,
+    /// The area's id, for [`DockArea::hit_rects`] and the free docking functions.
+    pub id: Id,
+    /// The window, 800x600 by default.
+    pub screen: Rect,
+    /// Where the area draws inside the window; the whole window by default.
+    pub area: Rect,
+    /// Whether the window has focus. Losing it cancels gestures (C2).
+    pub focused: bool,
+    /// Modifiers held for the following events.
+    pub modifiers: Modifiers,
+    /// Passed to [`DockArea::auto_collapse_iconic`].
+    pub auto_collapse: bool,
+    /// Passed to [`DockArea::maximized`].
+    pub maximized: Option<P>,
+    /// Passed to [`DockArea::raise_panel`] on the next frame only.
+    pub raise: Option<P>,
+    /// Passed to [`DockArea::float_bounds`].
+    pub float_bounds: Option<Rect>,
+    /// Passed to [`DockArea::monitors`].
+    pub monitors: Vec<Monitor>,
+    /// Passed to [`DockArea::locked`].
+    pub locked: bool,
+    /// Passed to [`DockArea::input_blocked`].
+    pub input_blocked: bool,
+    /// Passed to [`DockArea::native_windows`]: on by default, whatever the test's desktop.
+    pub native_windows: bool,
+    /// The stand-in for OS windows, in use after [`Self::with_native_host`].
+    #[cfg(feature = "native-windows")]
+    host: Option<std::rc::Rc<std::cell::RefCell<NativeHost>>>,
+    #[cfg(feature = "native-windows")]
+    no_host: std::cell::RefCell<NativeHost>,
+    /// Passed to [`DockArea::native_input_hook`].
+    #[cfg(feature = "native-windows")]
+    input_hook: Option<InputHook>,
+    style: Option<StyleFn>,
+    shapes: Vec<ClippedShape>,
+    ime: Option<egui::output::IMEOutput>,
+    time: f64,
+}
+
+impl<P: Clone + Eq + Hash + Debug + Send + Sync + 'static, C: DockContent<P>> DockDriver<P, C> {
+    /// A driver whose first frames have settled, so every control has its rect.
+    pub fn new(layout: Layout<P>, content: C) -> Self {
+        let screen = Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0));
+        let mut driver = Self {
+            ctx: Context::default(),
+            layout,
+            content,
+            id: Id::unique("dock-driver"),
+            screen,
+            area: screen,
+            focused: true,
+            modifiers: Modifiers::NONE,
+            auto_collapse: true,
+            maximized: None,
+            raise: None,
+            float_bounds: None,
+            monitors: Vec::new(),
+            locked: false,
+            input_blocked: false,
+            native_windows: true,
+            #[cfg(feature = "native-windows")]
+            host: None,
+            #[cfg(feature = "native-windows")]
+            no_host: std::cell::RefCell::new(NativeHost::new(Pos2::ZERO)),
+            #[cfg(feature = "native-windows")]
+            input_hook: None,
+            style: None,
+            shapes: Vec::new(),
+            ime: None,
+            time: 0.0,
+        };
+        driver.settle();
+        driver
+    }
+
+    /// Adjust the style each frame, after [`DockStyle::from_ui`]. Settles again.
+    pub fn with_style(mut self, style: impl Fn(&mut DockStyle) + 'static) -> Self {
+        self.style = Some(Box::new(style));
+        self.settle();
+        self
+    }
+
+    /// Draw in `area` of the window. Settles again.
+    pub fn with_area(mut self, area: Rect) -> Self {
+        self.area = area;
+        self.settle();
+        self
+    }
+
+    /// Render one frame with `events` and return its output. Nothing is applied.
+    pub fn frame(&mut self, events: Vec<Event>) -> DockOutput<P> {
+        let mut output = DockOutput::default();
+        self.time += 1.0 / 60.0;
+        #[allow(unused_mut)]
+        let mut input = RawInput {
+            screen_rect: Some(self.screen),
+            events: std::iter::once(Event::ModifiersChanged(self.modifiers)).chain(events).collect(),
+            focused: self.focused,
+            time: Some(self.time),
+            ..Default::default()
+        };
+        #[cfg(feature = "native-windows")]
+        if let Some(host) = &self.host {
+            let mut host = host.borrow_mut();
+            (host.time, host.screen, host.modifiers) = (self.time, self.screen, self.modifiers);
+            host.frames += 1;
+            host.read_pointer();
+            input.viewports = host.infos();
+            input.focused = host.focus == Some(egui::ViewportId::ROOT);
+        }
+        let (layout, content, area, id) = (&self.layout, &mut self.content, self.area, self.id);
+        let monitors = self.monitors.clone();
+        #[cfg(feature = "native-windows")]
+        let input_hook = self.input_hook.clone();
+        #[cfg(feature = "native-windows")]
+        let window_system = self.host.as_ref().map_or(Default::default(), |host| host.borrow().window_system());
+        let (style_fn, maximized, raise, auto, bounds, locked, native, blocked) = (
+            &self.style,
+            self.maximized.clone(),
+            self.raise.take(),
+            self.auto_collapse,
+            self.float_bounds,
+            self.locked,
+            self.native_windows,
+            self.input_blocked,
+        );
+        let mut full = self.ctx.run_ui(input, |ui| {
+            let mut style = DockStyle::from_ui(ui);
+            if let Some(adjust) = style_fn {
+                adjust(&mut style);
+            }
+            ui.scope_builder(UiBuilder::new().max_rect(area), |ui| {
+                let mut dock = DockArea::new(id)
+                    .maximized(maximized.clone())
+                    .auto_collapse_iconic(auto)
+                    .monitors(monitors.clone())
+                    .locked(locked)
+                    .native_windows(native)
+                    .input_blocked(blocked);
+                if let Some(panel) = raise.clone() {
+                    dock = dock.raise_panel(panel);
+                }
+                if let Some(bounds) = bounds {
+                    dock = dock.float_bounds(bounds);
+                }
+                #[cfg(feature = "native-windows")]
+                {
+                    dock = dock.window_system(window_system);
+                }
+                #[cfg(feature = "native-windows")]
+                if let Some(hook) = input_hook.clone() {
+                    dock = dock.native_input_hook(move |ctx, input| hook(ctx, input));
+                }
+                output = dock.show_content(ui, layout, &style, content);
+            });
+        });
+        full.textures_delta.clear();
+        #[cfg(feature = "native-windows")]
+        if let Some(host) = &self.host {
+            let mut host = host.borrow_mut();
+            host.apply(&full);
+            host.land();
+        }
+        self.shapes = full.shapes;
+        self.ime = full.platform_output.ime;
+        output
+    }
+
+    /// Draw native floating windows in a stand-in for OS windows (feature `native-windows`):
+    /// the main window's content sits at `origin` on the desktop, and each native window runs
+    /// its own frame on this context with its own input and desktop rect. Settles again.
+    #[cfg(feature = "native-windows")]
+    pub fn with_native_host(mut self, origin: Pos2) -> Self {
+        let host = std::rc::Rc::new(std::cell::RefCell::new(NativeHost::new(origin)));
+        let shared = host.clone();
+        Context::set_immediate_viewport_renderer(move |ctx, viewport| NativeHost::render(&shared, ctx, viewport));
+        self.ctx.set_embed_viewports(false);
+        self.host = Some(host);
+        self.settle();
+        self
+    }
+
+    /// Pass `hook` to [`DockArea::native_input_hook`] every frame (feature `native-windows`).
+    #[cfg(feature = "native-windows")]
+    pub fn with_native_input_hook(mut self, hook: impl Fn(&Context, &mut RawInput) + Send + Sync + 'static) -> Self {
+        self.input_hook = Some(std::sync::Arc::new(hook));
+        self
+    }
+
+    /// The stand-in for OS windows: without [`Self::with_native_host`], one with no windows
+    /// that nothing uses.
+    #[cfg(feature = "native-windows")]
+    pub fn host(&self) -> std::cell::RefMut<'_, NativeHost> {
+        self.host.as_deref().unwrap_or(&self.no_host).borrow_mut()
+    }
+
+    /// The viewport of the floating window with this [`super::Floating::id`].
+    #[cfg(feature = "native-windows")]
+    pub fn viewport(&self, window: u64) -> egui::ViewportId {
+        DockArea::<P>::window_viewport(self.id, window)
+    }
+
+    /// Give `events`, in its own coordinates, to the native window of the floating window
+    /// `window` on the next frame, and step.
+    #[cfg(feature = "native-windows")]
+    pub fn window_step(&mut self, window: u64, events: Vec<Event>) -> DockOutput<P> {
+        let viewport = self.viewport(window);
+        if let Some(target) = self.host().windows.get_mut(&viewport) {
+            target.events.extend(events);
+        }
+        self.step(Vec::new())
+    }
+
+    /// Press and release at `pos` in a native window; the output is the release frame's.
+    #[cfg(feature = "native-windows")]
+    pub fn window_click(&mut self, window: u64, pos: Pos2) -> DockOutput<P> {
+        self.window_step(window, vec![Event::PointerMoved(pos), self.button(pos, true)]);
+        self.window_step(window, vec![Event::PointerMoved(pos), self.button(pos, false)])
+    }
+
+    /// In a native window, press at `from`, move past the drag threshold and on to `to`, in
+    /// its coordinates at each frame, without releasing. The window system keeps sending the
+    /// pointer to the window where it was pressed, inside it or not.
+    #[cfg(feature = "native-windows")]
+    pub fn window_hold(&mut self, window: u64, from: Pos2, to: Pos2) -> DockOutput<P> {
+        self.window_step(window, vec![Event::PointerMoved(from), self.button(from, true)]);
+        self.window_step(window, vec![Event::PointerMoved(from + NUDGE)]);
+        self.window_step(window, vec![Event::PointerMoved(to)])
+    }
+
+    /// Move the pointer to the desktop point `point` in the native window of `window`, and
+    /// step. The window gets the point in its coordinates. While the window system moves the
+    /// window ([`NativeHost::moves_windows`]), the window goes where the pointer keeps its grab.
+    #[cfg(feature = "native-windows")]
+    pub fn window_pointer(&mut self, window: u64, point: Pos2) -> DockOutput<P> {
+        let viewport = self.viewport(window);
+        {
+            let mut host = self.host();
+            let grab = host.os_drag.filter(|(dragged, _)| *dragged == viewport).map(|(_, grab)| grab);
+            if let Some(target) = host.windows.get_mut(&viewport) {
+                if let Some(grab) = grab {
+                    target.rect = Rect::from_min_size(point - grab, target.rect.size());
+                }
+                target.events.push(Event::PointerMoved(point - target.rect.min.to_vec2()));
+            }
+        }
+        self.step(Vec::new())
+    }
+
+    /// Release at `pos` in a native window, in its coordinates.
+    #[cfg(feature = "native-windows")]
+    pub fn window_release(&mut self, window: u64, pos: Pos2) -> DockOutput<P> {
+        self.window_step(window, vec![Event::PointerMoved(pos), self.button(pos, false)])
+    }
+
+    /// The desktop point `point` in the coordinates of the native window of `window`, as the
+    /// host placed it.
+    #[cfg(feature = "native-windows")]
+    pub fn window_local(&self, window: u64, point: Pos2) -> Option<Pos2> {
+        let viewport = self.viewport(window);
+        self.host().windows.get(&viewport).map(|w| point - w.rect.min.to_vec2())
+    }
+
+    /// Render one frame and apply its actions, all or none, with the content's permissions. A
+    /// rejected batch is reported in the output's `error`.
+    pub fn step(&mut self, events: Vec<Event>) -> DockOutput<P> {
+        let mut output = self.frame(events);
+        if output.error.is_none()
+            && let Err(error) = self.layout.apply_all(output.actions.clone(), |p| self.content.permissions(p))
+        {
+            output.error = Some(error);
+        }
+        output
+    }
+
+    /// Empty frames until moved widgets report their rects; egui reports them a frame late.
+    pub fn settle(&mut self) {
+        for _ in 0..3 {
+            self.step(Vec::new());
+        }
+    }
+
+    pub fn move_to(&mut self, pos: Pos2) -> DockOutput<P> {
+        self.step(vec![Event::PointerMoved(pos)])
+    }
+
+    pub fn press(&mut self, pos: Pos2) -> DockOutput<P> {
+        self.step(vec![Event::PointerMoved(pos), self.button(pos, true)])
+    }
+
+    pub fn release(&mut self, pos: Pos2) -> DockOutput<P> {
+        self.step(vec![Event::PointerMoved(pos), self.button(pos, false)])
+    }
+
+    /// Press and release at `pos`; the output is the release frame's.
+    pub fn click(&mut self, pos: Pos2) -> DockOutput<P> {
+        self.press(pos);
+        self.release(pos)
+    }
+
+    /// Press at `from`, move past the drag threshold and on to `to`, without releasing.
+    pub fn hold(&mut self, from: Pos2, to: Pos2) -> DockOutput<P> {
+        self.press(from);
+        self.move_to(from + NUDGE);
+        self.move_to(to)
+    }
+
+    /// A whole drag; the output is the release frame's.
+    pub fn drag(&mut self, from: Pos2, to: Pos2) -> DockOutput<P> {
+        self.hold(from, to);
+        self.release(to)
+    }
+
+    /// Press and release `key` in one frame.
+    pub fn key(&mut self, key: Key) -> DockOutput<P> {
+        let modifiers = self.modifiers;
+        self.step(vec![
+            Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers },
+            Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers },
+        ])
+    }
+
+    /// Give or take the window's focus for this and the following frames.
+    pub fn focus(&mut self, focused: bool) -> DockOutput<P> {
+        self.focused = focused;
+        self.step(vec![Event::WindowFocused(focused)])
+    }
+
+    /// The pointer leaves the window.
+    pub fn leave(&mut self) -> DockOutput<P> {
+        self.step(vec![Event::PointerGone])
+    }
+
+    /// Every gesture source of the last frame.
+    pub fn hits(&self) -> Vec<(Hit<P>, Rect)> {
+        DockArea::<P>::hit_rects(&self.ctx, self.id)
+    }
+
+    /// The rect of one gesture source in the last frame.
+    pub fn hit(&self, hit: &Hit<P>) -> Option<Rect> {
+        self.hits().into_iter().find(|(h, _)| h == hit).map(|(_, rect)| rect)
+    }
+
+    /// The shapes of the last frame.
+    pub fn shapes(&self) -> &[ClippedShape] {
+        &self.shapes
+    }
+
+    /// The IME descriptor the main window's last frame published.
+    pub fn ime(&self) -> Option<&egui::output::IMEOutput> {
+        self.ime.as_ref()
+    }
+
+    /// Whether the last frame filled `rect` (an insertion line or a split preview).
+    pub fn filled(&self, rect: Rect) -> bool {
+        self.shapes.iter().any(|clipped| match &clipped.shape {
+            egui::Shape::Rect(shape) => shape.rect == rect && shape.fill != egui::Color32::TRANSPARENT,
+            _ => false,
+        })
+    }
+
+    /// Whether the last frame filled a polygon with these corners, each within half a point.
+    pub fn filled_polygon(&self, corners: &[Pos2]) -> bool {
+        self.shapes.iter().any(|clipped| match &clipped.shape {
+            egui::Shape::Path(path) => {
+                path.fill != egui::Color32::TRANSPARENT
+                    && path.points.len() == corners.len()
+                    && path.points.iter().zip(corners).all(|(a, b)| a.distance(*b) <= 0.5)
+            }
+            _ => false,
+        })
+    }
+
+    /// Whether the last frame outlined `rect` without filling it.
+    pub fn outlined(&self, rect: Rect) -> bool {
+        self.shapes.iter().any(|clipped| match &clipped.shape {
+            egui::Shape::Rect(shape) => shape.rect == rect && shape.fill == egui::Color32::TRANSPARENT && shape.stroke.width > 0.0,
+            _ => false,
+        })
+    }
+
+    fn button(&self, pos: Pos2, pressed: bool) -> Event {
+        Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: self.modifiers }
+    }
+}
+
+/// OS windows for [`DockDriver::with_native_host`] (feature `native-windows`).
+#[cfg(feature = "native-windows")]
+pub struct NativeHost {
+    /// Desktop position of the main window's content.
+    pub origin: Pos2,
+    /// The monitor size egui reports for every window.
+    pub monitor_size: Option<egui::Vec2>,
+    /// The window with focus: the main window (`ViewportId::ROOT`, the default), a native
+    /// window, or `None` while another application is active.
+    pub focus: Option<egui::ViewportId>,
+    /// Windows report no position, as on Wayland.
+    pub no_position: bool,
+    /// From a native window's outer position to its content, as a title bar puts it. The
+    /// window opens with its outer position where it was asked to, and `OuterPosition` moves
+    /// that.
+    pub frame: egui::Vec2,
+    /// `OuterPosition` lands a frame late, at the end of the frame after the command. That
+    /// frame still reports the old place, and gets pointer events relative to it.
+    pub lag: bool,
+    /// The window system moves a window for `StartDrag` itself, as AppKit does: the window
+    /// keeps the pointer where it was in it, and reports its place as where the drag began until
+    /// the release. Meanwhile it tells the cursor and [`Self::held`].
+    pub moves_windows: bool,
+    /// The primary button is down, as the window system tells it with
+    /// [`Self::moves_windows`]: set by the presses and releases given to windows, and by a test
+    /// that has the window system report a release before egui does.
+    pub held: bool,
+    pub windows: std::collections::HashMap<egui::ViewportId, HostWindow>,
+    /// Every command sent to a native window or the main window, in order.
+    pub commands: Vec<(egui::ViewportId, egui::ViewportCommand)>,
+    /// Moves waiting to land under `lag`: window, content position, frame sent.
+    late: Vec<(egui::ViewportId, Pos2, usize)>,
+    cursor: Option<Pos2>,
+    /// The window it moves for `StartDrag`, and where the pointer is in it.
+    os_drag: Option<(egui::ViewportId, egui::Vec2)>,
+    frames: usize,
+    /// The driver's modifiers: the keyboard's, whichever window has focus.
+    modifiers: Modifiers,
+    screen: Rect,
+    time: f64,
+}
+
+/// One OS window of a [`NativeHost`].
+#[cfg(feature = "native-windows")]
+#[derive(Debug)]
+pub struct HostWindow {
+    /// Desktop rect of its content: where it opened, then moved by `OuterPosition` and
+    /// `InnerSize`.
+    pub rect: Rect,
+    pub visible: bool,
+    /// The window level its builder asked for on its last frame.
+    pub level: Option<egui::WindowLevel>,
+    /// Frames it drew.
+    pub frames: usize,
+    /// Events for its next frame, in its own coordinates.
+    pub events: Vec<Event>,
+    /// Ask to close it on its next frame, as the OS close button does.
+    pub close: bool,
+    /// Files dragged over it, in every frame's input until cleared.
+    pub hovered_files: Vec<egui::HoveredFile>,
+    /// Files dropped on it on its next frame.
+    pub dropped_files: Vec<egui::DroppedFileHandle>,
+    /// Shapes of its last frame.
+    pub shapes: Vec<ClippedShape>,
+    /// The IME descriptor its last frame published.
+    pub ime: Option<egui::output::IMEOutput>,
+    /// Where it reports its content while the window system moves it.
+    reported: Option<Pos2>,
+    /// The last pointer position it was given, in its coordinates.
+    pointer: Option<Pos2>,
+}
+
+#[cfg(feature = "native-windows")]
+impl NativeHost {
+    fn new(origin: Pos2) -> Self {
+        Self {
+            origin,
+            monitor_size: None,
+            focus: Some(egui::ViewportId::ROOT),
+            no_position: false,
+            frame: egui::Vec2::ZERO,
+            lag: false,
+            moves_windows: false,
+            held: false,
+            windows: Default::default(),
+            commands: Vec::new(),
+            late: Vec::new(),
+            cursor: None,
+            os_drag: None,
+            frames: 0,
+            modifiers: Modifiers::NONE,
+            screen: Rect::NOTHING,
+            time: 0.0,
+        }
+    }
+
+    /// What egui knows of every window.
+    fn infos(&self) -> egui::ViewportIdMap<egui::ViewportInfo> {
+        let info = |id: egui::ViewportId, rect: Rect| egui::ViewportInfo {
+            inner_rect: Some(rect),
+            outer_rect: (!self.no_position)
+                .then(|| if id == egui::ViewportId::ROOT { rect } else { Rect::from_min_max(rect.min - self.frame, rect.max) }),
+            focused: Some(self.focus == Some(id)),
+            monitor_size: self.monitor_size,
+            native_pixels_per_point: Some(1.0),
+            ..Default::default()
+        };
+        let main = Rect::from_min_size(self.origin, self.screen.size());
+        std::iter::once((egui::ViewportId::ROOT, info(egui::ViewportId::ROOT, main)))
+            .chain(
+                self.windows
+                    .iter()
+                    .map(|(id, window)| (*id, info(*id, Rect::from_min_size(window.reported.unwrap_or(window.rect.min), window.rect.size())))),
+            )
+            .collect()
+    }
+
+    /// What it tells the dock area.
+    fn window_system(&self) -> super::render::WindowSystem {
+        let moves = self.moves_windows;
+        super::render::WindowSystem::Host { cursor: self.cursor, held: moves.then_some(self.held), moves }
+    }
+
+    /// With [`Self::moves_windows`], the cursor and the button as the pointer events waiting
+    /// for each window leave them.
+    fn read_pointer(&mut self) {
+        if !self.moves_windows {
+            return;
+        }
+        for window in self.windows.values_mut() {
+            for event in &window.events {
+                match event {
+                    Event::PointerMoved(pos) => window.pointer = Some(*pos),
+                    Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, .. } => {
+                        window.pointer = Some(*pos);
+                        self.held = *pressed;
+                    }
+                    _ => continue,
+                }
+                self.cursor = window.pointer.map(|p| window.rect.min + p.to_vec2());
+            }
+        }
+    }
+
+    /// Run one native window's frame.
+    fn render(host: &std::cell::RefCell<Self>, ctx: &Context, mut viewport: egui::ImmediateViewport<'_>) {
+        let id = viewport.ids.this;
+        let input = {
+            let mut host = host.borrow_mut();
+            let builder = &viewport.builder;
+            let rect = Rect::from_min_size(builder.position.unwrap_or_default() + host.frame, builder.inner_size.unwrap_or(vec2(300.0, 200.0)));
+            let visible = builder.visible.unwrap_or(true);
+            let level = builder.window_level;
+            host.windows.entry(id).or_insert_with(|| HostWindow {
+                rect,
+                visible,
+                level,
+                frames: 0,
+                events: Vec::new(),
+                close: false,
+                hovered_files: Vec::new(),
+                dropped_files: Vec::new(),
+                shapes: Vec::new(),
+                ime: None,
+                reported: None,
+                pointer: None,
+            });
+            let mut viewports = host.infos();
+            let (time, focused, modifiers) = (host.time, host.focus == Some(id), host.modifiers);
+            let Some(window) = host.windows.get_mut(&id) else { return };
+            window.frames += 1;
+            window.level = level;
+            if std::mem::take(&mut window.close)
+                && let Some(info) = viewports.get_mut(&id)
+            {
+                info.events.push(egui::ViewportEvent::Close);
+            }
+            RawInput {
+                viewport_id: id,
+                viewports,
+                screen_rect: Some(Rect::from_min_size(Pos2::ZERO, window.rect.size())),
+                events: std::iter::once(Event::ModifiersChanged(modifiers)).chain(std::mem::take(&mut window.events)).collect(),
+                hovered_files: window.hovered_files.clone(),
+                dropped_files: std::mem::take(&mut window.dropped_files),
+                focused,
+                time: Some(time),
+                ..Default::default()
+            }
+        };
+        let mut full = ctx.run_ui(input, |ui| (viewport.viewport_ui_cb)(ui));
+        full.textures_delta.clear();
+        let mut host = host.borrow_mut();
+        host.apply(&full);
+        if let Some(window) = host.windows.get_mut(&id) {
+            window.shapes = full.shapes;
+            window.ime = full.platform_output.ime;
+        }
+    }
+
+    /// End a frame: moves sent in an earlier one land, and a move the window system carries out
+    /// ends once the button is up.
+    fn land(&mut self) {
+        let frames = self.frames;
+        let (landed, late) = std::mem::take(&mut self.late).into_iter().partition::<Vec<_>, _>(|(.., sent)| *sent < frames);
+        self.late = late;
+        for (id, pos, _) in landed {
+            if let Some(window) = self.windows.get_mut(&id) {
+                window.rect = Rect::from_min_size(pos, window.rect.size());
+            }
+        }
+        if !self.held
+            && let Some((id, _)) = self.os_drag.take()
+            && let Some(window) = self.windows.get_mut(&id)
+        {
+            window.reported = None;
+        }
+    }
+
+    /// Carry out the commands a frame sent to native windows.
+    fn apply(&mut self, full: &egui::FullOutput) {
+        for (id, output) in &full.viewport_output {
+            for command in &output.commands {
+                self.commands.push((*id, command.clone()));
+                let Some(window) = self.windows.get_mut(id) else { continue };
+                match command {
+                    egui::ViewportCommand::OuterPosition(pos) if self.lag => self.late.push((*id, *pos + self.frame, self.frames)),
+                    egui::ViewportCommand::OuterPosition(pos) => window.rect = Rect::from_min_size(*pos + self.frame, window.rect.size()),
+                    egui::ViewportCommand::InnerSize(size) => window.rect = Rect::from_min_size(window.rect.min, *size),
+                    egui::ViewportCommand::Visible(visible) => window.visible = *visible,
+                    egui::ViewportCommand::StartDrag if self.moves_windows && self.held => {
+                        let grab = window.pointer.unwrap_or_default().to_vec2();
+                        window.reported = Some(window.rect.min);
+                        self.os_drag = Some((*id, grab));
+                    }
+                    _ => {}
+                }
+            }
+        }
+    }
+}
diff --git a/crates/ui/src/docking/tests.rs b/crates/ui/src/docking/tests.rs
index e5841771..0e363276 100644
--- a/crates/ui/src/docking/tests.rs
+++ b/crates/ui/src/docking/tests.rs
@@ -1,6 +1,6 @@
 use super::*;
 use crate::layout::{SplitAxis, SplitSize};
-use egui::{Context, Event, Id, Modifiers, PointerButton, RawInput, Rect, pos2, vec2};
+use egui::{Context, Event, Id, Modifiers, PointerButton, Pos2, RawInput, Rect, pos2, vec2};
 
 fn tabs(panels: &[u32], active: usize) -> Node<u32> {
     Node::Tabs { panels: panels.to_vec(), active }
@@ -14,7 +14,7 @@ fn sample() -> Layout<u32> {
             first: Box::new(tabs(&[1], 0)),
             second: Box::new(tabs(&[2, 3, 4], 1)),
         }),
-        floating: vec![Floating { panels: vec![5, 6], active: 1, rect: [80.0, 70.0, 300.0, 220.0] }],
+        floating: vec![Floating::single(vec![5, 6], 1, [80.0, 70.0, 300.0, 220.0])],
     }
 }
 
@@ -29,8 +29,8 @@ fn floating_brush_panel_joins_main_tabs_without_losing_other_panels() {
     let Node::Split { size, second, .. } = layout.root.as_ref().unwrap() else { panic!() };
     assert_eq!(*size, SplitSize::FixedSecond(240.0));
     assert_eq!(**second, tabs(&[2, 3, 5, 4], 2));
-    assert_eq!(layout.floating[0].panels, vec![6]);
-    assert_eq!(layout.floating[0].active, 0);
+    assert_eq!(layout.floating[0].groups()[0].panels, vec![6]);
+    assert_eq!(layout.floating[0].groups()[0].active, 0);
     layout.validate().unwrap();
     assert_eq!(layout.panels().len(), 6);
 }
@@ -43,21 +43,46 @@ fn detach_redock_merge_and_collapse_empty_source_containers() {
     layout.apply(move_to(1, 2, Zone::Left)).unwrap();
     assert_eq!(layout.floating.len(), 1);
     layout.apply(move_to(5, 6, Zone::Center)).unwrap();
-    assert_eq!(layout.floating[0].panels, vec![6, 5]);
-    assert_eq!(layout.floating[0].active, 1);
+    assert_eq!(layout.floating[0].groups()[0].panels, vec![6, 5]);
+    assert_eq!(layout.floating[0].groups()[0].active, 1);
     layout.apply(move_to(6, 3, Zone::Center)).unwrap();
     layout.apply(move_to(5, 3, Zone::Center)).unwrap();
     assert!(layout.floating.is_empty());
     assert_eq!(layout.panels().len(), 6);
 }
 
+#[test]
+fn move_targets_skip_the_panel_itself_and_protected_anchors() {
+    let layout = sample();
+    let all = |_: &u32| Permissions::default();
+    let targets = layout.move_targets(&1, all);
+    assert_eq!(targets.len(), 5);
+    assert!(!targets.contains(&&1));
+    let guarded = |p: &u32| if *p == 3 { Permissions::PROTECTED } else { Permissions::default() };
+    assert!(!layout.move_targets(&1, guarded).contains(&&3));
+
+    // A lone panel has nowhere to go — its "Move Panel to Group" menu hides
+    // (storytold/lightcraft#1768).
+    let single = Layout { root: Some(tabs(&[1], 0)), floating: Vec::new() };
+    assert!(single.move_targets(&1, all).is_empty());
+}
+
+#[test]
+fn move_targets_skip_the_panels_own_group() {
+    let layout = sample();
+    let all = |_: &u32| Permissions::default();
+    assert_eq!(layout.move_targets(&3, all), vec![&1, &5, &6]);
+    let pair = Layout { root: Some(tabs(&[1, 2], 0)), floating: Vec::new() };
+    assert!(pair.move_targets(&1, all).is_empty());
+}
+
 #[test]
 fn invalid_moves_are_atomic_including_after_a_source_would_have_been_removed() {
     let layout = sample();
     for action in [
         move_to(5, 99, Zone::Center),
         move_to(99, 2, Zone::Center),
-        move_to(5, 6, Zone::Left),
+        Action::Move { panel: 5, anchor: 6, placement: Placement::Column { after: true } },
         move_to(5, 5, Zone::Center),
         Action::Move { panel: 5, anchor: 2, placement: Placement::Tab { before: Some(6) } },
         Action::Float { panel: 3, rect: [f32::NAN, 0.0, 100.0, 100.0] },
@@ -119,13 +144,15 @@ fn protected_canvas_remains_present_and_cannot_be_grouped_with_panels() {
         move_to(1, 3, Zone::Center),
         move_to(3, 1, Zone::Center),
         Action::OpenAt { panel: 1, anchor: 3, placement: Placement::Tab { before: None } },
+        Action::OpenAt { panel: 7, anchor: 1, placement: Placement::Split(Zone::Left) },
     ] {
         let mut next = layout.clone();
         assert_eq!(next.apply_with_permissions(action, permissions), Err(DockError::NotAllowed));
         assert_eq!(next, layout);
     }
+    let beside = |panel: &u32| if *panel == 1 { Permissions { accepts_splits: true, ..Permissions::PROTECTED } } else { Permissions::default() };
     let mut next = layout;
-    next.apply_with_permissions(Action::OpenAt { panel: 7, anchor: 1, placement: Placement::Split(Zone::Left) }, permissions).unwrap();
+    next.apply_with_permissions(Action::OpenAt { panel: 7, anchor: 1, placement: Placement::Split(Zone::Left) }, beside).unwrap();
     assert!(next.contains(&1) && next.contains(&7));
 }
 
@@ -142,6 +169,17 @@ fn moving_a_floating_group_needs_every_member_movable() {
     assert_eq!(next, layout);
     next.apply_with_permissions(Action::MoveFloating { panel: 5, rect: [0.0, 0.0, 300.0, 220.0] }, |_: &u32| Permissions::default()).unwrap();
     assert_eq!(next.floating[0].rect, [0.0, 0.0, 300.0, 220.0]);
+
+    // The same holds when 6 sits in another group of the window's tree.
+    let mut split = sample();
+    split.floating[0].root =
+        Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::Ratio(0.5), first: Box::new(tabs(&[5], 0)), second: Box::new(tabs(&[6], 0)) };
+    let before = split.clone();
+    assert_eq!(
+        split.apply_with_permissions(Action::MoveFloating { panel: 5, rect: [0.0, 0.0, 300.0, 220.0] }, permissions),
+        Err(DockError::NotAllowed)
+    );
+    assert_eq!(split, before);
 }
 
 #[test]
@@ -153,7 +191,7 @@ fn close_and_restore_preserve_fixed_side_and_floating_geometry() {
             first: Box::new(tabs(&[1], 0)),
             second: Box::new(tabs(&[2], 0)),
         }),
-        floating: vec![Floating { panels: vec![3], active: 0, rect: [41.0, 52.0, 233.0, 244.0] }],
+        floating: vec![Floating::single(vec![3], 0, [41.0, 52.0, 233.0, 244.0])],
     };
     let saved = layout.clone();
     let first = layout.location(&1).unwrap();
@@ -196,12 +234,18 @@ fn closing_and_reopening_an_entire_accordion_restores_its_kind_and_heights() {
 #[test]
 fn invalid_saved_layouts_reject_duplicates_selection_depth_and_nonfinite_geometry() {
     let mut duplicate = sample();
-    duplicate.floating[0].panels.push(1);
+    if let Node::Tabs { panels, .. } = &mut duplicate.floating[0].root {
+        panels.push(1);
+    }
     assert_eq!(duplicate.validate(), Err(DockError::DuplicatePanel));
     let mut invalid = sample();
-    invalid.floating[0].active = usize::MAX;
+    if let Node::Tabs { active, .. } = &mut invalid.floating[0].root {
+        *active = usize::MAX;
+    }
     assert_eq!(invalid.validate(), Err(DockError::InvalidSelection));
-    invalid.floating[0].active = 0;
+    if let Node::Tabs { active, .. } = &mut invalid.floating[0].root {
+        *active = 0;
+    }
     invalid.floating[0].rect[3] = f32::INFINITY;
     assert_eq!(invalid.validate(), Err(DockError::InvalidGeometry));
     let mut deep = tabs(&[0], 0);
@@ -213,6 +257,13 @@ fn invalid_saved_layouts_reject_duplicates_selection_depth_and_nonfinite_geometr
     assert_eq!(deep.apply(Action::Activate { panel: 0 }), Err(DockError::LimitExceeded));
     let oversized = Layout { root: Some(Node::Tabs { panels: (0..=MAX_PANELS as u32).collect(), active: 0 }), floating: Vec::new() };
     assert_eq!(oversized.validate(), Err(DockError::LimitExceeded));
+    for empty in [tabs(&[], 0), Node::Stack { entries: Vec::new() }] {
+        let root = Layout { root: Some(empty.clone()), floating: Vec::new() };
+        assert_eq!(root.validate(), Err(DockError::InvalidGeometry));
+        let beside =
+            Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::Ratio(0.5), first: Box::new(tabs(&[1], 0)), second: Box::new(empty) };
+        assert_eq!(Layout { root: Some(beside), floating: Vec::new() }.validate(), Err(DockError::InvalidGeometry));
+    }
 }
 
 fn target(anchor: u32, members: &[u32], rect: Rect) -> DropTarget<u32> {
@@ -228,6 +279,7 @@ fn target(anchor: u32, members: &[u32], rect: Rect) -> DropTarget<u32> {
             .collect(),
         allow_splits: true,
         accepts_tabs: true,
+        right_to_left: false,
     }
 }
 
@@ -235,52 +287,173 @@ fn target(anchor: u32, members: &[u32], rect: Rect) -> DropTarget<u32> {
 fn pointer_targets_distinguish_reorder_center_split_and_occlusion() {
     let rect = Rect::from_min_size(pos2(10.0, 20.0), vec2(300.0, 200.0));
     let group = target(2, &[2, 3], rect);
-    let placement = resolve_drop(&5, pos2(90.0, 30.0), std::slice::from_ref(&group)).unwrap();
+    let placement = resolve_drop(&5, pos2(90.0, 30.0), std::slice::from_ref(&group), 40.0).unwrap();
     assert_eq!(placement.placement, Placement::Tab { before: Some(3) });
     assert!(placement.insertion.unwrap().is_finite());
-    assert_eq!(resolve_drop(&5, rect.center(), std::slice::from_ref(&group)).unwrap().placement, Placement::Split(Zone::Center));
-    assert_eq!(resolve_drop(&5, pos2(11.0, 90.0), std::slice::from_ref(&group)).unwrap().placement, Placement::Split(Zone::Left));
-    assert!(resolve_drop(&3, rect.center(), std::slice::from_ref(&group)).is_none());
-    assert!(resolve_drop(&3, pos2(11.0, 90.0), std::slice::from_ref(&group)).is_some());
+    assert_eq!(resolve_drop(&5, rect.center(), std::slice::from_ref(&group), 40.0).unwrap().placement, Placement::Split(Zone::Center));
+    assert_eq!(resolve_drop(&5, pos2(11.0, 90.0), std::slice::from_ref(&group), 40.0).unwrap().placement, Placement::Split(Zone::Left));
+    assert!(resolve_drop(&3, rect.center(), std::slice::from_ref(&group), 40.0).unwrap().noop);
+    assert!(resolve_drop(&3, pos2(11.0, 90.0), std::slice::from_ref(&group), 40.0).is_some());
     let mut overlay = target(5, &[5], rect);
     overlay.accepts_tabs = false;
     overlay.allow_splits = false;
-    assert!(resolve_drop(&3, rect.center(), &[group, overlay]).is_none());
-    assert!(drop_zone(Rect::NOTHING, 24.0, pos2(0.0, 0.0)).is_none());
-    assert!(drop_zone(rect, 24.0, pos2(f32::NAN, 0.0)).is_none());
+    assert!(resolve_drop(&3, rect.center(), &[group, overlay], 40.0).is_none());
+    assert!(drop_zone(Rect::NOTHING, 24.0, 40.0, pos2(0.0, 0.0)).is_none());
+    assert!(drop_zone(rect, 24.0, 40.0, pos2(f32::NAN, 0.0)).is_none());
+}
+
+#[test]
+fn side_edge_zones_are_40_pt_deep_or_a_quarter_of_the_bodys_smaller_side() {
+    let depth = SIDE_EDGE_ZONE_DEPTH;
+    assert_eq!(depth, 40.0);
+    // The inner corner of the left trapezoid is the depth of both bands.
+    let inner = |rect: Rect| zone_shape(rect, 0.0, depth, Zone::Left).unwrap()[1] - rect.min;
+    for size in [vec2(600.0, 400.0), vec2(160.0, 160.0)] {
+        let rect = Rect::from_min_size(pos2(10.0, 20.0), size);
+        assert_eq!(inner(rect), vec2(40.0, 40.0), "{size:?}");
+        let y = rect.center().y;
+        assert_eq!(drop_zone(rect, 0.0, depth, pos2(rect.left() + 39.0, y)), Some(Zone::Left), "{size:?}");
+        assert_eq!(drop_zone(rect, 0.0, depth, pos2(rect.left() + 41.0, y)), Some(Zone::Center), "{size:?}");
+    }
+    // A 90 pt body keeps a 45 pt center.
+    let rect = Rect::from_min_size(pos2(10.0, 20.0), vec2(90.0, 90.0));
+    assert_eq!(inner(rect), vec2(22.5, 22.5));
+    assert_eq!(drop_zone(rect, 0.0, depth, rect.center()), Some(Zone::Center));
+    assert_eq!(drop_zone(rect, 0.0, depth, pos2(rect.left() + 22.0, rect.center().y)), Some(Zone::Left));
+    // A tall narrow body: its top and bottom zones are as deep as its left and right ones.
+    let rect = Rect::from_min_size(pos2(10.0, 20.0), vec2(120.0, 600.0));
+    assert_eq!(inner(rect), vec2(30.0, 30.0));
+    let top = zone_shape(rect, 0.0, depth, Zone::Top).unwrap();
+    assert_eq!(top[2].y - rect.top(), 30.0);
+    assert_eq!(drop_zone(rect, 0.0, depth, pos2(rect.center().x, rect.top() + 29.0)), Some(Zone::Top));
+    assert_eq!(drop_zone(rect, 0.0, depth, pos2(rect.center().x, rect.top() + 31.0)), Some(Zone::Center));
+    // The bands start below the tab header.
+    let rect = Rect::from_min_size(pos2(10.0, 20.0), vec2(600.0, 400.0));
+    assert_eq!(drop_zone(rect, 24.0, depth, pos2(rect.center().x, rect.top() + 60.0)), Some(Zone::Top));
+    assert_eq!(zone_shape(rect, 24.0, depth, Zone::Top).unwrap()[0], rect.left_top() + vec2(0.0, 24.0));
+    // Without depth there are no sides.
+    assert_eq!(drop_zone(rect, 0.0, 0.0, pos2(rect.left() + 1.0, rect.center().y)), Some(Zone::Center));
+    assert!(zone_shape(rect, 0.0, 0.0, Zone::Left).is_none());
+}
+
+#[test]
+fn a_bodys_outer_thirds_are_its_sides_and_the_relatively_nearer_side_wins_at_a_corner() {
+    let fraction = DockStyle::default().side_zone_fraction;
+    assert!((fraction - 1.0 / 3.0).abs() < 1e-6);
+    // A 24 pt header over a 600 x 300 body.
+    let rect = Rect::from_min_size(pos2(10.0, 20.0), vec2(600.0, 324.0));
+    let body = Rect::from_min_max(pos2(10.0, 44.0), rect.max);
+    let zone = |p| body_zone(rect, 24.0, fraction, true, p);
+    let y = body.center().y;
+    assert_eq!(zone(pos2(body.left() + 199.0, y)), Some(Zone::Left));
+    assert_eq!(zone(pos2(body.left() + 201.0, y)), Some(Zone::Center));
+    assert_eq!(zone(pos2(body.right() - 199.0, y)), Some(Zone::Right));
+    assert_eq!(zone(pos2(body.center().x, body.top() + 99.0)), Some(Zone::Top));
+    assert_eq!(zone(pos2(body.center().x, body.top() + 101.0)), Some(Zone::Center));
+    assert_eq!(zone(pos2(body.center().x, body.bottom() - 99.0)), Some(Zone::Bottom));
+    assert_eq!(zone(pos2(body.left() + 2.0, rect.top() + 10.0)), Some(Zone::Center), "the header joins");
+    // In a corner: a quarter of the width from the left is further than a fifth of the height
+    // from the top, a tenth of the width nearer than three tenths of the height.
+    assert_eq!(zone(pos2(body.left() + 150.0, body.top() + 60.0)), Some(Zone::Top));
+    assert_eq!(zone(pos2(body.left() + 60.0, body.top() + 90.0)), Some(Zone::Left));
+    // Without a middle, the relatively nearest side takes every point.
+    let edges = |p| body_zone(rect, 24.0, fraction, false, p);
+    assert_eq!(edges(body.center() - vec2(10.0, 0.0)), Some(Zone::Left));
+    assert_eq!(edges(body.center() - vec2(0.0, 10.0)), Some(Zone::Top));
+    assert_eq!(edges(body.center() + vec2(0.0, 10.0)), Some(Zone::Bottom));
+    // No fraction: only the middle. Outside or invalid: nothing.
+    assert_eq!(body_zone(rect, 24.0, 0.0, true, pos2(body.left() + 1.0, y)), Some(Zone::Center));
+    assert!(body_zone(rect, 24.0, fraction, true, pos2(0.0, 0.0)).is_none());
+    assert!(body_zone(Rect::NOTHING, 24.0, fraction, true, pos2(0.0, 0.0)).is_none());
+}
+
+#[test]
+fn a_drop_beside_a_group_previews_a_line_along_its_edge_and_a_group_without_tabs_has_no_middle() {
+    let style = DockStyle::from_visuals(&egui::Visuals::dark());
+    let rule = style.zone_rule();
+    assert_eq!(rule, ZoneRule::Fraction { fraction: 1.0 / 3.0, line: 4.0 });
+    assert_eq!(DockStyle { side_edge_zones: true, ..style }.zone_rule(), ZoneRule::Depth(SIDE_EDGE_ZONE_DEPTH));
+    let rect = Rect::from_min_size(pos2(10.0, 20.0), vec2(300.0, 224.0));
+    let group = target(2, &[2, 3], rect);
+    let resolve = |at, group: &DropTarget<u32>| resolve_drop_by(&5, at, std::slice::from_ref(group), rule);
+    let left = resolve(pos2(20.0, 140.0), &group).unwrap();
+    assert_eq!(left.placement, Placement::Split(Zone::Left));
+    assert_eq!(left.preview, Rect::from_x_y_ranges(10.0..=14.0, rect.y_range()), "the group's whole left edge");
+    let bottom = resolve(pos2(160.0, 240.0), &group).unwrap();
+    assert_eq!(bottom.placement, Placement::Split(Zone::Bottom));
+    assert_eq!(bottom.preview, Rect::from_x_y_ranges(rect.x_range(), 240.0..=244.0));
+    let middle = resolve(pos2(160.0, 144.0), &group).unwrap();
+    assert_eq!((middle.placement, middle.preview), (Placement::Split(Zone::Center), rect));
+    // A canvas: its middle goes to the nearest edge, and its strip takes nothing.
+    let canvas = DropTarget { accepts_tabs: false, ..group };
+    assert_eq!(resolve(pos2(150.0, 144.0), &canvas).unwrap().placement, Placement::Split(Zone::Left));
+    assert!(resolve(pos2(90.0, 30.0), &canvas).is_none());
+}
+
+#[test]
+fn a_style_needs_a_drop_line_and_side_zones_of_at_most_half_the_body() {
+    let style = DockStyle::from_visuals(&egui::Visuals::dark());
+    assert!(style.valid());
+    assert!(DockStyle { side_zone_fraction: 0.0, ..style.clone() }.valid());
+    assert!(DockStyle { side_zone_fraction: 0.5, ..style.clone() }.valid());
+    assert!(!DockStyle { side_zone_fraction: 0.6, ..style.clone() }.valid());
+    assert!(!DockStyle { drop_line_width: 0.0, ..style }.valid());
 }
 
 #[test]
 fn long_action_sequence_never_loses_or_duplicates_a_panel() {
-    let mut layout = sample();
-    let mut seed = 72u64;
-    for step in 0..800 {
-        seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1);
-        let panel = (seed % 6 + 1) as u32;
-        let anchor = ((seed >> 16) % 6 + 1) as u32;
-        let action = if step % 7 == 0 {
-            Action::Float { panel, rect: [10.0, 20.0, 200.0, 220.0] }
-        } else {
-            move_to(
-                panel,
-                anchor,
-                match seed % 5 {
-                    0 => Zone::Left,
-                    1 => Zone::Right,
-                    2 => Zone::Top,
-                    3 => Zone::Bottom,
-                    _ => Zone::Center,
-                },
-            )
-        };
-        let before = layout.clone();
-        if layout.apply(action).is_err() {
-            assert_eq!(layout, before);
+    for (start, ids) in [(sample(), vec![1, 2, 3, 4, 5, 6]), (super::model_tests::docked(), super::model_tests::ALL.to_vec())] {
+        let mut workspace = Workspace::new(start);
+        let mut seed = 72u64;
+        for step in 0..800 {
+            seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1);
+            let pick = |bits: u64| ids[(bits % ids.len() as u64) as usize];
+            let (panel, anchor) = (pick(seed >> 8), pick(seed >> 24));
+            let placement = match (seed >> 40) % 7 {
+                0 => Placement::Split(Zone::Left),
+                1 => Placement::Split(Zone::Right),
+                2 => Placement::Split(Zone::Top),
+                3 => Placement::Split(Zone::Bottom),
+                4 => Placement::Split(Zone::Center),
+                5 => Placement::Group { below: seed & 1 == 0, height: None },
+                _ => Placement::Column { after: seed & 2 == 0 },
+            };
+            let to = match (seed >> 32) % 4 {
+                0 => Target::Float { rect: None },
+                1 => Target::NewDock { side: if seed & 4 == 0 { Side::Start } else { Side::End } },
+                _ => Target::At { anchor, placement: placement.clone() },
+            };
+            let action = match step % 13 {
+                0 => Action::Float { panel, rect: [10.0, 20.0, 200.0, 220.0] },
+                1 => Action::MoveGroup { panel, to },
+                2 => Action::MoveColumn { panel, to },
+                3 => Action::MoveWindow { panel, to },
+                4 => Action::CloseGroup { panel },
+                5 => Action::CloseWindow { panel },
+                6 => Action::CloseOthers { panel },
+                7 => Action::Close { panel },
+                8 => Action::SetMinimized { panel, minimized: seed & 8 == 0 },
+                9 => Action::SetIconic { panel, iconic: seed & 16 == 0 },
+                _ => Action::Move { panel, anchor, placement },
+            };
+            let before = workspace.clone();
+            if workspace.apply(action, |_| Permissions::default()).is_err() {
+                assert_eq!(workspace, before);
+            }
+            if step % 3 == 0
+                && let Some((hidden, _)) = workspace.hidden.first().cloned()
+            {
+                let fallback = workspace.layout.panels().first().map(|p| **p);
+                let before = workspace.clone();
+                if workspace.set_visible(hidden, true, fallback, |_| Permissions::default()).is_err() {
+                    assert_eq!(workspace, before);
+                }
+            }
+            workspace.validate().unwrap();
+            let mut panels: Vec<u32> = workspace.layout.panels().into_iter().copied().chain(workspace.hidden.iter().map(|(p, _)| *p)).collect();
+            panels.sort_unstable();
+            assert_eq!(panels, ids, "step {step}");
         }
-        layout.validate().unwrap();
-        let mut panels: Vec<u32> = layout.panels().into_iter().copied().collect();
-        panels.sort_unstable();
-        assert_eq!(panels, vec![1, 2, 3, 4, 5, 6]);
     }
 }
 
@@ -299,6 +472,8 @@ fn saved_layout_and_hidden_location_round_trip() {
 
 #[cfg(feature = "serde")]
 #[test]
+/// Deserialize an older hidden `Location` without a `sibling` field; the
+/// missing list stays empty and the anchor panel is preserved.
 fn old_hidden_locations_accept_panel_ids_without_a_default_identity() {
     #[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
     enum Panel {
@@ -314,6 +489,8 @@ fn old_hidden_locations_accept_panel_ids_without_a_default_identity() {
     assert_eq!(location.anchor, Some(Panel::Layers));
 }
 
+/// One 800×600 `DockArea::show` frame with actual body labels. Returns `DockOutput` plus the body
+/// scope ids and records the final cursor icon in temp data; clears texture deltas.
 fn frame(ctx: &Context, layout: &Layout<u32>, events: Vec<Event>, focused: bool) -> (DockOutput<u32>, Vec<Id>) {
     let mut output = DockOutput::default();
     let mut ids = Vec::new();
@@ -331,6 +508,8 @@ fn frame(ctx: &Context, layout: &Layout<u32>, events: Vec<Event>, focused: bool)
                 ui.label("Actual panel content");
             },
         );
+        let cursor = ctx.output(|o| o.cursor_icon);
+        ctx.data_mut(|d| d.insert_temp(Id::unique("test-cursor"), cursor));
     })
     .textures_delta
     .clear();
@@ -338,6 +517,8 @@ fn frame(ctx: &Context, layout: &Layout<u32>, events: Vec<Event>, focused: bool)
 }
 
 #[test]
+/// Moving a panel from a root tab into a floating window keeps its body scope
+/// id across frames.
 fn renderer_keeps_content_identity_when_panel_moves_into_a_float() {
     let ctx = Context::default();
     let mut layout = Layout { root: Some(tabs(&[1], 0)), floating: Vec::new() };
@@ -350,6 +531,8 @@ fn renderer_keeps_content_identity_when_panel_moves_into_a_float() {
 }
 
 #[test]
+/// Escape and window focus loss each discard an in-progress drag; a subsequent release emits no
+/// actions.
 fn cancelling_or_losing_focus_during_a_drag_does_not_move_panels() {
     let ctx = Context::default();
     let layout = sample();
@@ -385,11 +568,14 @@ fn step(ctx: &Context, layout: &mut Layout<u32>, events: Vec<Event>) -> Vec<Acti
     out.actions
 }
 
+/// A primary-button pointer event at `pos` with `pressed` and no modifiers.
 fn pointer_button(pos: egui::Pos2, pressed: bool) -> Event {
     Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE }
 }
 
 #[test]
+/// Real pointer input drags a floating panel's tab into the main tab strip, emits a `Move`, removes
+/// it from the float, preserves the panel count, and activates it in the target group.
 fn actual_pointer_drag_docks_a_floating_panel_into_the_main_tab_strip() {
     let ctx = Context::default();
     let mut layout = sample();
@@ -403,14 +589,41 @@ fn actual_pointer_drag_docks_a_floating_panel_into_the_main_tab_strip() {
     step(&ctx, &mut layout, vec![Event::PointerMoved(target)]);
     let actions = step(&ctx, &mut layout, vec![pointer_button(target, false)]);
     assert!(actions.iter().any(|a| matches!(a, Action::Move { panel: 5, .. })), "{actions:?}");
-    assert!(!layout.floating.iter().any(|g| g.panels.contains(&5)));
+    assert!(!layout.floating.iter().any(|g| g.contains(&5)));
     assert_eq!(layout.panels().len(), 6);
     let Node::Split { second, .. } = layout.root.as_ref().unwrap() else { panic!() };
     let Node::Tabs { panels, active } = second.as_ref() else { panic!() };
     assert_eq!(panels.get(*active), Some(&5));
 }
 
+/// On X11 and Windows a release outside the window never reaches egui (egui-winit drops a
+/// button event once the pointer has left), so a tab dragged out of the window used to stay on
+/// the pointer for good. Leaving the window detaches the panel where it left, even over a dock
+/// target, and ends the drag.
 #[test]
+fn tab_dragged_out_of_the_window_floats_where_it_left() {
+    let ctx = Context::default();
+    let mut layout = sample();
+    for _ in 0..3 {
+        step(&ctx, &mut layout, Vec::new());
+    }
+    let tab = ctx.read_response(Id::unique("test-area").with(("tab", &3u32))).unwrap().rect.center();
+    let exit = pos2(4.0, 300.0);
+    step(&ctx, &mut layout, vec![Event::PointerMoved(tab), pointer_button(tab, true)]);
+    step(&ctx, &mut layout, vec![Event::PointerMoved(tab + vec2(-8.0, 0.0))]);
+    step(&ctx, &mut layout, vec![Event::PointerMoved(exit)]);
+    let actions = step(&ctx, &mut layout, vec![Event::PointerGone]);
+    assert!(actions.iter().any(|a| matches!(a, Action::Float { panel: 3, .. })), "{actions:?}");
+    assert!(layout.floating.iter().any(|g| g.panels().eq([3].iter())), "{layout:?}");
+    let back = pos2(400.0, 300.0);
+    assert!(step(&ctx, &mut layout, vec![Event::PointerMoved(back)]).is_empty());
+    assert!(step(&ctx, &mut layout, vec![pointer_button(back, false)]).is_empty(), "the drag ended when the pointer left");
+}
+
+#[test]
+/// At wide, narrow and wide-again sizes, every rendered body rect stays horizontally inside the
+/// viewport and, at the wide sizes, panel min/max limits bound its width, without mutating the
+/// layout's stored preferred widths.
 fn panel_size_limits_clamp_geometry_without_overwriting_preferred_widths() {
     let layout = Layout {
         root: Some(Node::Split {
@@ -469,13 +682,18 @@ fn panel_size_limits_clamp_geometry_without_overwriting_preferred_widths() {
 }
 
 #[test]
+/// A focused bottom-right floating resize grip moves width and height with Right/Down arrows and
+/// then loses focus to Tab normally.
 fn focused_floating_resize_grip_accepts_both_arrow_axes_and_releases_tab() {
     let ctx = Context::default();
     let mut layout = sample();
     for _ in 0..3 {
         step(&ctx, &mut layout, Vec::new());
     }
-    let id = Id::unique("test-area").with(("floating", &5u32)).with("resize");
+    let id = DockArea::hit_id(Id::unique("test-area"), &Hit::Resize(5u32, ResizeEdge::BottomRight));
+    let layer = DockArea::floating_layer(Id::unique("test-area"), &layout.floating[0]).unwrap();
+    let [x, y, width, height] = layout.floating[0].rect;
+    assert_eq!(ctx.memory(|m| m.area_rect(layer.id)), Some(Rect::from_min_size(pos2(x, y), vec2(width, height))));
     ctx.memory_mut(|memory| memory.request_focus(id));
     let key = |key| Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE };
     step(&ctx, &mut layout, vec![key(egui::Key::ArrowRight), key(egui::Key::ArrowDown)]);
@@ -485,6 +703,8 @@ fn focused_floating_resize_grip_accepts_both_arrow_axes_and_releases_tab() {
 }
 
 #[test]
+/// A stack divider dragged by pointer grows the open body above and shrinks the adjacent open body
+/// while closed entries and unrelated bodies keep their heights; keyboard arrows continue resizing.
 fn stack_dividers_resize_adjacent_open_bodies_by_pointer_and_keyboard() {
     let ctx = Context::default();
     let mut layout = Layout {
@@ -522,9 +742,22 @@ fn stack_dividers_resize_adjacent_open_bodies_by_pointer_and_keyboard() {
     let Node::Stack { entries } = layout.root.as_ref().unwrap() else { panic!() };
     assert!(entries[0].height.unwrap() > after_pointer);
     assert!((entries[0].height.unwrap() + entries[2].height.unwrap() - 300.0).abs() < 0.001);
+    // Dragged past the next body's minimum, the one after it gives way too, down to the same
+    // minimum; the closed entry keeps its height.
+    let start = ctx.read_response(id).unwrap().rect.center();
+    step(&ctx, &mut layout, vec![Event::PointerMoved(start), pointer_button(start, true)]);
+    step(&ctx, &mut layout, vec![Event::PointerMoved(start + vec2(0.0, 600.0))]);
+    step(&ctx, &mut layout, vec![pointer_button(start + vec2(0.0, 600.0), false)]);
+    let Node::Stack { entries } = layout.root.as_ref().unwrap() else { panic!() };
+    let heights = entries.iter().map(|entry| entry.height.unwrap()).collect::<Vec<_>>();
+    assert!((heights[2] - heights[3]).abs() < 0.01 && heights[3] < 120.0, "{heights:?}");
+    assert!((heights[0] + heights[2] + heights[3] - 420.0).abs() < 0.01, "{heights:?}");
+    assert_eq!(heights[1], 91.0);
 }
 
 #[test]
+/// A horizontal split's inner edge inside a scrollable dock remains hit-testable and draggable next
+/// to a scrollbar.
 fn split_inner_edge_remains_draggable_beside_a_scrollbar() {
     let ctx = Context::default();
     let mut layout = Layout {
@@ -580,10 +813,12 @@ fn split_inner_edge_remains_draggable_beside_a_scrollbar() {
     frame(&mut layout, vec![Event::PointerMoved(start + vec2(40.0, 0.0))]);
     frame(&mut layout, vec![pointer_button(start + vec2(40.0, 0.0), false)]);
     let Node::Split { size: SplitSize::FixedFirst(width), .. } = layout.root.unwrap() else { panic!() };
-    assert!((width - 260.0).abs() < 0.001, "sidebar width after inner-edge drag: {width}");
+    assert!((width - 260.0).abs() < 0.01, "sidebar width after inner-edge drag: {width}");
 }
 
 #[test]
+/// Closing a panel in a nested vertical/horizontal layout and restoring its
+/// saved location reproduces the complete layout.
 fn restoring_a_panel_beside_a_nested_subtree_preserves_the_complete_workspace() {
     let mut layout = Layout {
         root: Some(Node::Split {
@@ -607,9 +842,10 @@ fn restoring_a_panel_beside_a_nested_subtree_preserves_the_complete_workspace()
 }
 
 #[test]
+/// A layout with only floating windows leaves the caller's available document rect unchanged.
 fn floating_only_surface_does_not_allocate_the_callers_document_region() {
     let ctx = Context::default();
-    let layout = Layout { root: None, floating: vec![Floating { panels: vec![1u32], active: 0, rect: [30.0, 40.0, 200.0, 200.0] }] };
+    let layout = Layout { root: None, floating: vec![Floating::single(vec![1u32], 0, [30.0, 40.0, 200.0, 200.0])] };
     ctx.run_ui(RawInput { screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0))), ..Default::default() }, |ui| {
         let before = ui.available_rect_before_wrap();
         let out = DockArea::new(Id::unique("float-only")).show(
@@ -630,6 +866,8 @@ fn floating_only_surface_does_not_allocate_the_callers_document_region() {
 }
 
 #[test]
+/// Dragging the floating group grip emits `MoveFloating` and changes the window rect while the
+/// group's panels and active panel stay the same; dragging a tab detaches only that panel.
 fn floating_group_grip_moves_every_member_while_tab_drag_detaches_one() {
     let ctx = Context::default();
     let mut layout = sample();
@@ -641,8 +879,8 @@ fn floating_group_grip_moves_every_member_while_tab_drag_detaches_one() {
     step(&ctx, &mut layout, vec![Event::PointerMoved(start), pointer_button(start, true)]);
     let actions = step(&ctx, &mut layout, vec![Event::PointerMoved(start + vec2(50.0, 40.0))]);
     assert!(actions.iter().any(|a| matches!(a, Action::MoveFloating { .. })));
-    assert_eq!(layout.floating[0].panels, original.panels);
-    assert_eq!(layout.floating[0].active, original.active);
+    assert_eq!(layout.floating[0].groups()[0].panels, original.groups()[0].panels);
+    assert_eq!(layout.floating[0].groups()[0].active, original.groups()[0].active);
     assert_ne!(layout.floating[0].rect, original.rect);
     step(&ctx, &mut layout, vec![pointer_button(start + vec2(50.0, 40.0), false)]);
     for _ in 0..2 {
@@ -651,11 +889,117 @@ fn floating_group_grip_moves_every_member_while_tab_drag_detaches_one() {
     let tab = ctx.read_response(Id::unique("test-area").with(("tab", &5u32))).unwrap().rect.center();
     step(&ctx, &mut layout, vec![Event::PointerMoved(tab), pointer_button(tab, true)]);
     step(&ctx, &mut layout, vec![Event::PointerMoved(tab + vec2(8.0, 0.0))]);
-    step(&ctx, &mut layout, vec![Event::PointerMoved(tab + vec2(100.0, 100.0))]);
-    let detached = step(&ctx, &mut layout, vec![pointer_button(tab + vec2(100.0, 100.0), false)]);
+    // Inside the source window the release is a no-op; outside it floats.
+    let outside = pos2(780.0, 650.0);
+    step(&ctx, &mut layout, vec![Event::PointerMoved(outside)]);
+    let detached = step(&ctx, &mut layout, vec![pointer_button(outside, false)]);
     assert!(detached.iter().any(|a| matches!(a, Action::Float { panel: 5, .. })));
     assert_eq!(layout.floating.len(), 2);
-    assert_eq!(layout.floating[0].panels, vec![6]);
+    assert_eq!(layout.floating[0].groups()[0].panels, vec![6]);
+}
+
+#[test]
+fn floating_group_drag_ends_on_release_or_pointer_exit() {
+    for (released, leaves) in [(false, true), (true, true), (true, false)] {
+        let ctx = Context::default();
+        let mut layout = sample();
+        for _ in 0..2 {
+            step(&ctx, &mut layout, vec![]);
+        }
+        let start = pos2(86.0, 82.0);
+        step(&ctx, &mut layout, vec![Event::PointerMoved(start), pointer_button(start, true)]);
+        let moved = start + vec2(50.0, 40.0);
+        let actions = step(&ctx, &mut layout, vec![Event::PointerMoved(moved)]);
+        assert!(actions.iter().any(|action| matches!(action, Action::MoveFloating { .. })));
+        let last = layout.clone();
+        let mut events = vec![];
+        if released {
+            events.push(pointer_button(moved, false));
+        }
+        if leaves {
+            events.push(Event::PointerGone);
+        }
+        let (out, _) = frame(&ctx, &layout, events, true);
+        assert_eq!(out.group_drop, if leaves { None } else { Some((5, moved)) });
+        for action in out.actions {
+            layout.apply(action).unwrap();
+        }
+        assert_eq!(layout, last);
+        for pointer in [moved + vec2(20.0, 20.0), moved + vec2(30.0, 30.0)] {
+            let (out, _) = frame(&ctx, &layout, vec![Event::PointerMoved(pointer)], true);
+            assert!(out.actions.is_empty(), "{out:?}");
+            assert!(out.group_drag.is_none() && out.group_drop.is_none());
+        }
+        assert!(out.group_drag.is_none());
+        assert_eq!(ctx.dragged_id(), None);
+    }
+}
+
+#[test]
+fn floating_group_touch_release_reports_drop_after_pointer_gone() {
+    for web_order in [false, true] {
+        let ctx = Context::default();
+        let mut layout = sample();
+        for _ in 0..2 {
+            step(&ctx, &mut layout, vec![]);
+        }
+        let touch = |phase, pos| Event::Touch { device_id: egui::TouchDeviceId(0), id: egui::TouchId(1), phase, pos, force: None };
+        let start = pos2(86.0, 82.0);
+        let press = pointer_button(start, true);
+        let events = if web_order {
+            vec![press, touch(egui::TouchPhase::Start, start)]
+        } else {
+            vec![touch(egui::TouchPhase::Start, start), Event::PointerMoved(start), press]
+        };
+        step(&ctx, &mut layout, events);
+        let moved = start + vec2(50.0, 40.0);
+        let events = if web_order {
+            vec![Event::PointerMoved(moved), touch(egui::TouchPhase::Move, moved)]
+        } else {
+            vec![touch(egui::TouchPhase::Move, moved), Event::PointerMoved(moved)]
+        };
+        assert!(step(&ctx, &mut layout, events).iter().any(|action| matches!(action, Action::MoveFloating { .. })));
+        // egui-winit emits Touch before release/gone; eframe web emits it afterwards.
+        let events = if web_order {
+            vec![pointer_button(moved, false), Event::PointerGone, touch(egui::TouchPhase::End, moved)]
+        } else {
+            vec![touch(egui::TouchPhase::End, moved), pointer_button(moved, false), Event::PointerGone]
+        };
+        let (out, _) = frame(&ctx, &layout, events, true);
+        assert!(!ctx.input(|i| i.pointer.has_pointer()));
+        assert_eq!(out.group_drop, Some((5, moved)));
+        assert!(out.group_drag.is_none());
+        assert_eq!(ctx.dragged_id(), None);
+        assert!(step(&ctx, &mut layout, vec![Event::PointerMoved(moved + vec2(30.0, 30.0))]).is_empty());
+    }
+}
+
+#[test]
+/// A floating group drag cancelled by pointer loss, with or without Escape, restores the
+/// original floating rect and emits no group drag or drop.
+fn floating_group_exit_with_escape_or_focus_loss_restores_original_geometry() {
+    for escape in [false, true] {
+        let ctx = Context::default();
+        let mut layout = sample();
+        let original = layout.clone();
+        for _ in 0..2 {
+            step(&ctx, &mut layout, vec![]);
+        }
+        let start = pos2(86.0, 82.0);
+        step(&ctx, &mut layout, vec![Event::PointerMoved(start), pointer_button(start, true)]);
+        step(&ctx, &mut layout, vec![Event::PointerMoved(start + vec2(50.0, 40.0))]);
+        assert_ne!(layout.floating[0].rect, original.floating[0].rect);
+        let mut events = vec![Event::PointerGone];
+        if escape {
+            events.push(Event::Key { key: egui::Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+        }
+        let (out, _) = frame(&ctx, &layout, events, escape);
+        assert!(out.group_drag.is_none() && out.group_drop.is_none());
+        for action in out.actions {
+            layout.apply(action).unwrap();
+        }
+        assert_eq!(layout.floating[0].rect, original.floating[0].rect);
+    }
 }
 
 struct CustomContent {
@@ -666,6 +1010,8 @@ struct CustomContent {
 }
 
 #[test]
+/// `cancel_drag` discards a floating group's move before the caller replaces the layout, so later
+/// pointer movement and release emit nothing and the replacement stays intact.
 fn host_cancel_discards_group_drag_before_workspace_replacement() {
     let ctx = Context::default();
     let mut layout = sample();
@@ -698,16 +1044,22 @@ impl DockContent<u32> for CustomContent {
         self.labels.push(logical.to_owned());
         ui.painter().layout_no_wrap("Custom visual label".into(), font.clone(), color).into()
     }
+    /// Custom visual action label that prefixes the logical text with
+    /// `Action visual: `.
     fn action_label(&mut self, ui: &egui::Ui, logical: &str, font: &egui::FontId, color: egui::Color32) -> egui::WidgetText {
         ui.painter().layout_no_wrap(format!("Action visual: {logical}"), font.clone(), color).into()
     }
+    /// Record an app menu draw and emit a clickable `App menu` button.
     fn panel_menu(&mut self, ui: &mut egui::Ui, _: &u32) {
         self.menus += 1;
         ui.button("App menu").clicked();
     }
-    fn group_header_width(&self, _: &[u32], _: &u32, _: bool) -> f32 {
+    /// Test custom chrome declares a 40 pt group header width.
+    fn group_header_width(&self, _: &[u32], _: &u32, _: bool, _: f32) -> f32 {
         40.0
     }
+    /// Custom header: records the call, asserts it receives at most the declared 40 pt width, and
+    /// draws its own glyph.
     fn group_header(&mut self, ui: &mut egui::Ui, _: &[u32], _: &u32, _: bool) {
         self.headers += 1;
         assert!(ui.max_rect().width() <= 40.0);
@@ -715,6 +1067,8 @@ impl DockContent<u32> for CustomContent {
     }
 }
 
+/// Run one 800×600 customized dock frame with optional blockers and a
+/// programmatic raise of panel 5; returns the output with texture deltas cleared.
 fn custom_frame(
     ctx: &Context,
     layout: &Layout<u32>,
@@ -738,6 +1092,9 @@ fn custom_frame(
 }
 
 #[test]
+/// Custom chrome receives logical labels, draws custom headers and bodies and app-menu
+/// popups, while a programmatic raise sets no user focus or focus ring and emits
+/// no action.
 fn custom_chrome_shaped_labels_and_programmatic_raise_are_available() {
     let ctx = Context::default();
     let layout = sample();
@@ -746,11 +1103,12 @@ fn custom_chrome_shaped_labels_and_programmatic_raise_are_available() {
         custom_frame(&ctx, &layout, &mut content, vec![], &[], false);
     }
     let out = custom_frame(&ctx, &layout, &mut content, vec![], &[], true);
-    assert_eq!(out.focused, Some(5));
+    assert_eq!(out.focused, None, "a programmatic raise is not user focus");
+    assert_eq!(ctx.memory(|m| m.focused()), None, "a raise draws no keyboard-focus ring");
     assert!(out.actions.is_empty());
     assert!(content.headers >= 3 && content.bodies >= 3);
     assert!(content.labels.iter().any(|s| s == "Logical 5"));
-    let at = pos2(130.0, 82.0);
+    let at = pos2(130.0, 96.0);
     custom_frame(
         &ctx,
         &layout,
@@ -771,6 +1129,7 @@ fn custom_chrome_shaped_labels_and_programmatic_raise_are_available() {
 }
 
 #[test]
+/// An overlay appearing mid-drag blocks the release's float fallback; later frames emit no action.
 fn overlay_appearing_mid_drag_blocks_release_and_float_fallback() {
     let ctx = Context::default();
     let layout = sample();
@@ -787,6 +1146,7 @@ fn overlay_appearing_mid_drag_blocks_release_and_float_fallback() {
 }
 
 #[test]
+/// Escape during a floating group move restores the original floating rect.
 fn group_move_escape_restores_original_geometry() {
     let ctx = Context::default();
     let mut layout = sample();
@@ -807,6 +1167,8 @@ fn group_move_escape_restores_original_geometry() {
 }
 
 #[test]
+/// Custom headers and labels render at 0.75×, 1×, 1.5× and 2×: headers and bodies are produced and
+/// panel 6's label is rendered with its logical text.
 fn custom_headers_and_labels_render_at_small_and_large_scales() {
     for scale in [0.75, 1.0, 1.5, 2.0] {
         let ctx = Context::default();
@@ -835,6 +1197,8 @@ fn custom_headers_and_labels_render_at_small_and_large_scales() {
 }
 
 #[test]
+/// A protected member blocks whole-group gestures and host drops: drag/drop state stays empty and
+/// no `MoveFloating` action is emitted.
 fn protected_group_member_blocks_whole_group_gesture_and_host_drop() {
     let ctx = Context::default();
     let layout = sample();
@@ -903,6 +1267,8 @@ fn resize_floating_group(permissions: impl Fn(&u32) -> Permissions + Copy) -> Ve
 }
 
 #[test]
+/// A floating group's grip resizes a movable group, but a group containing
+/// protected panel 6 blocks the `MoveFloating` action.
 fn protected_group_member_blocks_floating_group_resize() {
     let moved = |actions: &[Action<u32>]| actions.iter().any(|a| matches!(a, Action::MoveFloating { .. }));
     assert!(moved(&resize_floating_group(|_| Permissions::default())), "the grip resizes a movable group");
@@ -910,6 +1276,8 @@ fn protected_group_member_blocks_floating_group_resize() {
 }
 
 #[test]
+/// Chrome focus recognizes a rendered tab but rejects a focused body text field, an invalid layout,
+/// an empty layout and an unrendered id.
 fn chrome_focus_classifies_rendered_tab_but_excludes_body_text_field_and_invalid_layout() {
     let ctx = Context::default();
     let layout = sample();
@@ -941,7 +1309,7 @@ fn chrome_focus_classifies_rendered_tab_but_excludes_body_text_field_and_invalid
     assert!(!DockArea::new(Id::unique("focus-area")).chrome_has_focus(&ctx, &layout));
     paint(tab);
     let mut invalid = layout.clone();
-    invalid.floating.push(Floating { panels: vec![3], active: 0, rect: [10.0, 10.0, 100.0, 100.0] });
+    invalid.floating.push(Floating::single(vec![3], 0, [10.0, 10.0, 100.0, 100.0]));
     assert!(!DockArea::new(Id::unique("focus-area")).chrome_has_focus(&ctx, &invalid));
     assert!(!DockArea::<u32>::new(Id::unique("focus-area")).chrome_has_focus(&ctx, &Layout::default()));
     ctx.memory_mut(|memory| memory.request_focus(Id::unique("unrendered")));
@@ -949,6 +1317,8 @@ fn chrome_focus_classifies_rendered_tab_but_excludes_body_text_field_and_invalid
 }
 
 #[test]
+/// Chrome focus recognizes rendered tabs, collapse buttons, stack resizers, split dividers and
+/// floating resizers.
 fn chrome_focus_classifies_rendered_accordion_and_split_and_floating_resizers() {
     let ctx = Context::default();
     let area = Id::unique("focus-chrome-controls");
@@ -986,6 +1356,9 @@ fn chrome_focus_classifies_rendered_accordion_and_split_and_floating_resizers()
 }
 
 #[test]
+/// `cancel_drag` ends an owned split/stack/floating resize until a new press: held movement stops
+/// producing actions and the layout stays at the cancellation snapshot, then a fresh press resizes
+/// again.
 fn workspace_cancel_stops_owned_resize_controls_until_new_press() {
     let area = Id::unique("test-area");
     let fixtures = [
@@ -1032,6 +1405,8 @@ fn workspace_cancel_stops_owned_resize_controls_until_new_press() {
 }
 
 #[test]
+/// Cancelling one area's drag leaves another area's split divider or a body-owned drag in control,
+/// and that gesture continues producing its effects.
 fn workspace_cancel_preserves_other_area_and_body_drag_ownership() {
     for body_drag in [false, true] {
         let ctx = Context::default();
@@ -1097,8 +1472,12 @@ fn workspace_cancel_preserves_other_area_and_body_drag_ownership() {
 }
 
 #[test]
+/// Custom action labels paint their visual substitution while the popup buttons keep their own
+/// logical accessibility names; the visual text is not exposed as an accessibility label.
 fn popup_action_labels_use_custom_visual_text_and_logical_accessibility() {
     use egui_kittest::{Harness, kittest::Queryable};
+    /// Recursively search a shape or shape vector for a text galley whose text is
+    /// exactly `text`.
     fn paints(shape: &egui::Shape, text: &str) -> bool {
         match shape {
             egui::Shape::Text(shape) => shape.galley.text() == text,
@@ -1122,7 +1501,7 @@ fn popup_action_labels_use_custom_visual_text_and_logical_accessibility() {
         CustomContent { labels: vec![], headers: 0, menus: 0, bodies: 0 },
     );
     h.run_steps(2);
-    let tab = Id::unique("action-label-test").with(("tab", &5_u32));
+    let tab = Id::unique("action-label-test").with(("tab", &6_u32));
     let at = h.ctx.read_response(tab).unwrap().rect.center();
     h.input_mut().events.extend([
         Event::PointerMoved(at),
@@ -1132,14 +1511,12 @@ fn popup_action_labels_use_custom_visual_text_and_logical_accessibility() {
     h.input_mut().events.push(Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: false, modifiers: Modifiers::NONE });
     h.run_steps(2);
     assert!(egui::Popup::is_any_open(&h.ctx));
-    for logical in ["Float panel", "Move to group", "Close panel"] {
+    for logical in ["Float Panel", "Move Panel to Group", "Close Panel"] {
         assert!(
             h.output().shapes.iter().any(|shape| paints(&shape.shape, &format!("Action visual: {logical}"))),
             "custom action must paint: {logical}"
         );
-        // This sample also has a floating-group grip labeled Move to group.
-        let expected = if logical == "Move to group" { 2 } else { 1 };
-        assert_eq!(h.query_all_by_label(logical).count(), expected, "popup action must retain its own logical accessibility: {logical}");
+        assert_eq!(h.query_all_by_label(logical).count(), 1, "popup action must retain its own logical accessibility: {logical}");
         assert_eq!(
             h.query_all_by_label(&format!("Action visual: {logical}")).count(),
             0,
@@ -1147,3 +1524,472 @@ fn popup_action_labels_use_custom_visual_text_and_logical_accessibility() {
         );
     }
 }
+
+#[test]
+/// At the minimum tab width, only the tabs that fit beside the drag bar and overflow control are
+/// shown, the active last tab replaces the last fitting tab, and the overflow menu lists exactly the
+/// hidden panels.
+fn a_strip_too_narrow_for_its_tabs_at_their_minimum_width_lists_the_others_in_the_overflow_menu() {
+    use egui::accesskit::Role;
+    use egui_kittest::{Harness, kittest::Queryable};
+    let area = Id::unique("whole-tabs");
+    let layout = Layout { root: Some(tabs(&[1, 2, 3, 4, 5, 6], 5)), floating: vec![] };
+    let mut h = Harness::builder().with_size(vec2(260.0, 240.0)).build_ui(move |ui| {
+        DockArea::new(area).show(
+            ui,
+            &layout,
+            &DockStyle::from_ui(ui),
+            |panel| format!("Panel {panel}"),
+            |_| Permissions::default(),
+            |_: &mut egui::Ui, _: &u32| {},
+        );
+    });
+    h.run_steps(2);
+    let shown: Vec<u32> = (1..=6).filter(|p| h.ctx.read_response(area.with(("tab", p))).is_some()).collect();
+    assert!((2..6).contains(&shown.len()), "{shown:?}");
+    // The active last tab takes the place of the last tab that fits; the others keep their order.
+    let mut expected: Vec<u32> = (1..shown.len() as u32).collect();
+    expected.push(6);
+    assert_eq!(shown, expected);
+    // As many tabs show as fit at the minimum width beside the drag bar and the "…" button.
+    let style = DockStyle::default();
+    let room = 260.0 - style.drag_bar_width - 22.0;
+    assert!(shown.len() as f32 * style.min_tab_width <= room && (shown.len() + 1) as f32 * style.min_tab_width > room, "{shown:?}");
+    h.get_by_role_and_label(Role::Button, "Panels").click();
+    h.run_steps(2);
+    let listed: Vec<u32> = (1..=6).filter(|p| h.query_by_role_and_label(Role::Button, &format!("Panel {p}")).is_some()).collect();
+    let hidden: Vec<u32> = (1..=6).filter(|p| !shown.contains(p)).collect();
+    assert_eq!(listed, hidden, "the overflow menu lists exactly the hidden panels");
+}
+
+#[test]
+/// Long tab labels are truncated with an ellipsis inside their tab and expose the full label in a
+/// tooltip on hover.
+fn tab_labels_that_do_not_fit_are_truncated_inside_their_tab_and_named_in_a_tooltip() {
+    let ctx = Context::default();
+    ctx.all_styles_mut(|style| style.interaction.tooltip_delay = 0.0);
+    let layout = Layout { root: Some(tabs(&[1, 2, 3], 0)), floating: vec![] };
+    let label = |p: &u32| format!("Eigenschaften und Anpassungen {p}");
+    let run = |events: Vec<Event>| {
+        let input = RawInput { screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(240.0, 200.0))), events, ..Default::default() };
+        let mut output = ctx.run_ui(input, |ui| {
+            DockArea::new(Id::unique("truncate")).show(
+                ui,
+                &layout,
+                &DockStyle::from_ui(ui),
+                label,
+                |_| Permissions::default(),
+                |ui, _| {
+                    ui.label("Body");
+                },
+            );
+        });
+        output.textures_delta.clear();
+        output.shapes
+    };
+    run(vec![]);
+    let shapes = run(vec![]);
+    let tab = |p: u32| ctx.read_response(Id::unique("truncate").with(("tab", &p))).expect("every tab shrinks to fit").rect;
+    for p in 1..=3 {
+        let tab = tab(p);
+        // The clip rect would hide an overflowing label; what is laid out must itself fit.
+        let painted: Vec<&egui::epaint::TextShape> = shapes
+            .iter()
+            .filter_map(|shape| match &shape.shape {
+                egui::Shape::Text(text) if tab.contains(text.visual_bounding_rect().center()) => Some(text),
+                _ => None,
+            })
+            .collect();
+        assert_eq!(painted.len(), 1, "tab {p}: {painted:?}");
+        assert!(painted[0].galley.elided, "tab {p}");
+        assert!(tab.contains_rect(painted[0].visual_bounding_rect()), "tab {p}: label {:?} overflows {tab:?}", painted[0].visual_bounding_rect());
+    }
+    run(vec![Event::PointerMoved(tab(2).center())]);
+    let shapes = run(vec![]);
+    let full = label(&2);
+    // An elided galley still reports its whole text, so the cut tab label alone would match.
+    assert!(
+        shapes.iter().any(|shape| matches!(&shape.shape, egui::Shape::Text(text) if text.galley.text() == full && !text.galley.elided)),
+        "a truncated tab names its panel in full on hover"
+    );
+}
+
+// Ported from storytold/craft-libs#110 by @Zenodeon.
+
+#[test]
+/// A floating resize keeps drag ownership when another host control rewrites the owned-interaction
+/// list; `cancel_drag` then ends it and further movement is ignored.
+fn resize_cancellation_retains_ownership_across_other_host_rendering() {
+    let ctx = Context::default();
+    let area = Id::unique("test-area");
+    let mut layout = sample();
+    for _ in 0..3 {
+        step(&ctx, &mut layout, vec![]);
+    }
+    let id = area.with(("floating", &5u32)).with("resize-right");
+    let start = ctx.read_response(id).unwrap().rect.center();
+    step(&ctx, &mut layout, vec![Event::PointerMoved(start), pointer_button(start, true)]);
+    step(&ctx, &mut layout, vec![Event::PointerMoved(start + vec2(20.0, 0.0))]);
+    assert_eq!(ctx.dragged_id(), Some(id));
+    ctx.data_mut(|data| data.insert_temp(area.with("owned-interactions"), vec![Id::unique("another-host-control")]));
+    cancel_drag::<u32>(&ctx, area);
+    assert!(ctx.dragged_id().is_none());
+    let before = layout.clone();
+    assert!(step(&ctx, &mut layout, vec![Event::PointerMoved(start + vec2(100.0, 0.0))]).is_empty());
+    assert_eq!(layout, before);
+}
+
+#[test]
+/// A collapsed 26 pt floating window still resizes its width with the Right arrow under a height
+/// cap, growing to the minimum height instead of ignoring the gesture.
+fn collapsed_floating_height_cap_does_not_disable_keyboard_width_resizing() {
+    let ctx = Context::default();
+    let mut layout = Layout { root: None, floating: vec![Floating::single(vec![1u32], 0, [80.0, 70.0, 300.0, 26.0])] };
+    let id = Id::unique("collapsed-resize").with(("floating", &1u32)).with("resize-right");
+    let mut frame = |events| {
+        let mut actions = Vec::new();
+        ctx.run_ui(
+            RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0))), focused: true, events, ..Default::default() },
+            |ui| {
+                let mut style = DockStyle::from_ui(ui);
+                style.min_pane = 0.0;
+                actions = DockArea::new(Id::unique("collapsed-resize"))
+                    .show_with_limits(
+                        ui,
+                        &layout,
+                        &style,
+                        |p| p.to_string(),
+                        |_| Permissions::default(),
+                        |_| PanelLimits { min: vec2(220.0, 0.0), max: vec2(1000.0, 0.0) },
+                        |_, _| {},
+                    )
+                    .actions;
+            },
+        )
+        .textures_delta
+        .clear();
+        for action in actions {
+            layout.apply(action).unwrap();
+        }
+    };
+    for _ in 0..3 {
+        frame(vec![]);
+    }
+    ctx.memory_mut(|memory| memory.request_focus(id));
+    frame(vec![Event::Key { key: egui::Key::ArrowRight, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE }]);
+    assert_eq!(layout.floating[0].rect, [80.0, 70.0, 308.0, 44.0]);
+}
+
+#[test]
+/// Dropping a panel back on its own singleton or multi-tab source body is an
+/// explicit no-op with no insertion marker, with or without split permission.
+fn returning_to_a_singleton_or_floating_source_body_is_an_explicit_noop() {
+    for panels in [vec![1u32], vec![1, 2, 3]] {
+        for allow_splits in [false, true] {
+            let rect = Rect::from_min_size(Pos2::ZERO, vec2(300.0, 300.0));
+            let target = DropTarget {
+                anchor: 1,
+                rect,
+                tab_strip: Some(Rect::from_min_size(Pos2::ZERO, vec2(300.0, 26.0))),
+                tabs: panels.iter().map(|id| (*id, Rect::NOTHING)).collect(),
+                allow_splits,
+                accepts_tabs: true,
+                right_to_left: false,
+            };
+            let proposal = resolve_drop(&1, rect.center(), &[target], 40.0).unwrap();
+            assert!(proposal.noop);
+            assert!(proposal.insertion.is_none());
+        }
+    }
+}
+
+#[test]
+/// Dragging each floating resize grip with the pointer past a viewport edge leaves every asserted
+/// edge unchanged when the pointer moves partway back while still outside, and returning to the
+/// start point restores the original geometry. `resize-right` and `resize` assert the clamped
+/// right edge and fixed left edge; `resize-left` and `resize-bottom-left` assert only their fixed
+/// right edge. `resize-bottom` asserts the clamped bottom edge and fixed top edge.
+fn pointer_floating_resize_stops_at_edges_and_waits_for_cursor_to_return() {
+    for name in ["resize-right", "resize-left", "resize-bottom", "resize", "resize-bottom-left"] {
+        let ctx = Context::default();
+        let mut layout = sample();
+        for _ in 0..3 {
+            step(&ctx, &mut layout, vec![]);
+        }
+        let id = Id::unique("test-area").with(("floating", &5u32)).with(name);
+        let start = ctx.read_response(id).unwrap().rect.center();
+        let original = layout.floating[0].rect;
+        let horizontal = name != "resize-bottom";
+        let left = name.contains("left");
+        step(&ctx, &mut layout, vec![Event::PointerMoved(start), pointer_button(start, true)]);
+        let outside = if horizontal { pos2(if left { -200.0 } else { 1100.0 }, start.y) } else { pos2(start.x, 1000.0) };
+        step(&ctx, &mut layout, vec![Event::PointerMoved(outside)]);
+        let stopped = layout.floating[0].rect;
+        if horizontal {
+            if left {
+                assert_eq!(stopped[0] + stopped[2], original[0] + original[2]);
+            } else {
+                assert_eq!(stopped[0], original[0]);
+                assert_eq!(stopped[0] + stopped[2], 800.0);
+            }
+        } else {
+            assert_eq!(stopped[1], original[1]);
+            assert_eq!(stopped[1] + stopped[3], 600.0);
+        }
+        let still_outside = if horizontal { outside + vec2(if left { 100.0 } else { -100.0 }, 0.0) } else { outside - vec2(0.0, 100.0) };
+        step(&ctx, &mut layout, vec![Event::PointerMoved(still_outside)]);
+        assert_eq!(layout.floating[0].rect, stopped, "{name}: reversal outside the edge must not resize");
+        step(&ctx, &mut layout, vec![Event::PointerMoved(start)]);
+        assert_eq!(layout.floating[0].rect, original, "{name}: returning to the original handle restores its geometry");
+        step(&ctx, &mut layout, vec![pointer_button(start, false)]);
+        assert!(ctx.memory(|memory| memory.focused()).is_none(), "{name}: the grip gives up focus after a pointer drag");
+    }
+}
+
+#[test]
+/// Dropping a panel within its existing tab slots is a no-op whose insertion
+/// marker stays inside the strip; positions outside its own slots move it.
+fn unchanged_tab_slots_are_explicit_noops_with_bounded_insertion_markers() {
+    let rect = Rect::from_min_size(pos2(0.0, 0.0), vec2(300.0, 200.0));
+    let target = DropTarget {
+        anchor: 1,
+        rect,
+        tab_strip: Some(Rect::from_min_size(rect.min, vec2(300.0, 30.0))),
+        tabs: vec![
+            (1, Rect::from_min_size(pos2(0.0, 0.0), vec2(60.0, 30.0))),
+            (2, Rect::from_min_size(pos2(60.0, 0.0), vec2(60.0, 30.0))),
+            (3, Rect::from_min_size(pos2(120.0, 0.0), vec2(60.0, 30.0))),
+        ],
+        allow_splits: true,
+        accepts_tabs: true,
+        right_to_left: false,
+    };
+    for (panel, positions) in [(1, [10.0, 50.0]), (2, [70.0, 110.0]), (3, [130.0, 210.0])] {
+        for x in positions {
+            let proposal = resolve_drop(&panel, pos2(x, 12.0), std::slice::from_ref(&target), 40.0).unwrap();
+            assert!(proposal.noop, "{panel}/{x}");
+            assert!(target.tab_strip.unwrap().contains_rect(proposal.insertion.unwrap()));
+        }
+    }
+    for (panel, x) in [(1, 140.0), (3, 10.0), (2, 210.0)] {
+        let proposal = resolve_drop(&panel, pos2(x, 12.0), std::slice::from_ref(&target), 40.0).unwrap();
+        assert!(!proposal.noop);
+        assert!(proposal.insertion.is_some());
+    }
+}
+
+#[test]
+/// A host drag handler that accepts the release as a no-op consumes it, so no fallback float is
+/// emitted and the host observes one release.
+fn host_owned_noop_consumes_release_without_a_fallback_float() {
+    struct Content(usize);
+    impl DockContent<u32> for Content {
+        fn body(&mut self, _ui: &mut egui::Ui, _panel: &u32) {}
+        /// Test drop handler that counts releases and accepts every request with
+        /// default feedback, consuming host-owned drops.
+        fn resolve_drag(&mut self, _ctx: &Context, _style: &DockStyle, request: &DropRequest<'_, u32>) -> Option<DropFeedback> {
+            if request.released {
+                self.0 += 1;
+            }
+            Some(DropFeedback::default())
+        }
+    }
+    let ctx = Context::default();
+    let area = Id::unique("host-owned");
+    let layout = sample();
+    let mut content = Content(0);
+    let from = pos2(30.0, 20.0);
+    let to = pos2(400.0, 300.0);
+    let render = |events: Vec<Event>, content: &mut Content| {
+        let mut output = DockOutput::default();
+        ctx.run_ui(RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(800.0, 600.0))), events, ..Default::default() }, |ui| {
+            output = DockArea::new(area).show_customized(
+                ui,
+                &layout,
+                &DockStyle::from_ui(ui),
+                |p| p.to_string(),
+                |_| Permissions::default(),
+                |_| PanelLimits::default(),
+                content,
+            );
+        })
+        .textures_delta
+        .clear();
+        output
+    };
+    render(
+        vec![
+            Event::PointerMoved(from),
+            Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE },
+        ],
+        &mut content,
+    );
+    assert!(begin_drag(&ctx, area, 1u32, Rect::from_min_size(Pos2::ZERO, vec2(200.0, 200.0))));
+    render(vec![Event::PointerMoved(to)], &mut content);
+    let output = render(
+        vec![Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE }],
+        &mut content,
+    );
+    assert_eq!(content.0, 1);
+    assert!(output.actions.iter().all(|action| !matches!(action, Action::Move { .. } | Action::Float { .. })));
+}
+
+#[test]
+fn overflow_noop_detection_uses_logical_order_including_hidden_tabs() {
+    let rect = Rect::from_min_size(Pos2::ZERO, vec2(140.0, 200.0));
+    let target = DropTarget {
+        anchor: 1,
+        rect,
+        tab_strip: Some(Rect::from_min_size(Pos2::ZERO, vec2(140.0, 30.0))),
+        tabs: vec![
+            (1, Rect::from_min_size(Pos2::ZERO, vec2(60.0, 30.0))),
+            (2, Rect::NOTHING),
+            (3, Rect::from_min_size(pos2(60.0, 0.0), vec2(60.0, 30.0))),
+        ],
+        allow_splits: true,
+        accepts_tabs: true,
+        right_to_left: false,
+    };
+    assert!(resolve_drop(&1, pos2(10.0, 12.0), std::slice::from_ref(&target), 40.0).unwrap().noop);
+    // Before the next visible tab crosses hidden tab 2 and really changes the order.
+    assert!(!resolve_drop(&1, pos2(65.0, 12.0), std::slice::from_ref(&target), 40.0).unwrap().noop);
+    assert!(resolve_drop(&3, pos2(130.0, 12.0), std::slice::from_ref(&target), 40.0).unwrap().noop);
+}
+
+#[test]
+/// For clipped and singleton strips of several widths, a no-op drop keeps its
+/// insertion marker inside the visible strip and at most 2 pt wide.
+fn insertion_markers_stay_inside_clipped_and_singleton_strips() {
+    for width in [0.5, 1.0, 20.0, 140.0] {
+        let rect = Rect::from_min_size(pos2(10.0, 20.0), vec2(width, 200.0));
+        let strip = Rect::from_min_size(rect.min, vec2(width, 30.0));
+        for tab_left in [-100.0, 10.0, 300.0] {
+            let target = DropTarget {
+                anchor: 1,
+                rect,
+                tab_strip: Some(strip.expand(5.0)),
+                tabs: vec![(1, Rect::from_min_size(pos2(tab_left, 20.0), vec2(60.0, 30.0)))],
+                allow_splits: true,
+                accepts_tabs: true,
+                right_to_left: false,
+            };
+            for x in [rect.left(), rect.center().x, rect.right()] {
+                let proposal = resolve_drop(&1, pos2(x, 25.0), std::slice::from_ref(&target), 40.0).unwrap();
+                assert!(proposal.noop);
+                let marker = proposal.insertion.unwrap();
+                assert!(rect.intersect(target.tab_strip.unwrap()).contains_rect(marker));
+                assert!(marker.width() > 0.0 && marker.width() <= 2.0);
+            }
+        }
+    }
+}
+
+#[test]
+/// A subpixel-wide tab strip crossing zero still yields a no-op insertion
+/// marker contained by the strip.
+fn insertion_marker_handles_subpixel_strip_crossing_zero_without_panicking() {
+    let rect = Rect::from_min_max(pos2(-0.001, 0.0), pos2(0.002, 30.0));
+    let target =
+        DropTarget { anchor: 1, rect, tab_strip: Some(rect), tabs: vec![(1, rect)], allow_splits: true, accepts_tabs: true, right_to_left: false };
+    let proposal = resolve_drop(&1, pos2(0.0, 12.0), &[target], 40.0).unwrap();
+    assert!(proposal.noop);
+    assert!(rect.contains_rect(proposal.insertion.unwrap()));
+}
+
+#[test]
+/// A strip narrower than its tabs paints at least one ellipsis overflow symbol.
+fn overflowing_strip_paints_a_single_ellipsis_symbol() {
+    use egui_kittest::Harness;
+    fn paints(shape: &egui::Shape, text: &str) -> bool {
+        match shape {
+            egui::Shape::Text(shape) => shape.galley.text() == text,
+            egui::Shape::Vec(shapes) => shapes.iter().any(|shape| paints(shape, text)),
+            _ => false,
+        }
+    }
+    let layout = Layout { root: Some(tabs(&[1, 2, 3, 4, 5, 6], 0)), floating: vec![] };
+    let mut h = Harness::builder().with_size(vec2(150.0, 240.0)).build_ui(move |ui| {
+        DockArea::new(Id::unique("overflow-symbol")).show(
+            ui,
+            &layout,
+            &DockStyle::from_ui(ui),
+            |panel| format!("Panel {panel}"),
+            |_| Permissions::default(),
+            |_ui: &mut egui::Ui, _panel: &u32| {},
+        );
+    });
+    h.run_steps(2);
+    assert!(h.output().shapes.iter().any(|shape| paints(&shape.shape, "\u{2026}")));
+}
+
+struct Plain;
+
+impl DockContent<u32> for Plain {
+    fn body(&mut self, _: &mut egui::Ui, _: &u32) {}
+}
+
+/// `sample` with its docked frames swapped: every panel stays, in other places.
+fn swapped() -> Layout<u32> {
+    let mut layout = sample();
+    layout.root = Some(Node::Split {
+        axis: SplitAxis::Horizontal,
+        size: SplitSize::FixedFirst(240.0),
+        first: Box::new(tabs(&[2, 3, 4], 1)),
+        second: Box::new(tabs(&[1], 0)),
+    });
+    layout
+}
+
+#[test]
+/// Replacing the layout during a tab drag ends the drag, so the new layout is not modified.
+fn replacing_the_layout_ends_a_drag_in_progress() {
+    use super::testing::DockDriver;
+    let area = Id::unique("replaced");
+    let driver = || {
+        let mut d = DockDriver::new(sample(), Plain);
+        d.id = area;
+        d.settle();
+        d
+    };
+    // Over frame [1], clear of the floating window.
+    let over = pos2(500.0, 450.0);
+    for replace in [false, true] {
+        let mut d = driver();
+        let tab = d.hit(&Hit::Tab(2)).unwrap().center();
+        d.hold(tab, over);
+        assert!(is_dragging::<u32>(&d.ctx, area));
+        if replace {
+            d.layout = swapped();
+        }
+        d.move_to(over + vec2(4.0, 0.0));
+        assert_eq!(is_dragging::<u32>(&d.ctx, area), !replace);
+        let out = d.release(over);
+        if replace {
+            assert!(out.actions.is_empty(), "{:?}", out.actions);
+            assert_eq!(d.layout, swapped());
+        } else {
+            assert!(matches!(out.actions.as_slice(), [Action::Move { panel: 2, anchor: 1, .. }]), "{:?}", out.actions);
+        }
+    }
+
+    // A window follows its bar through its own moves, and through an app that adjusts the
+    // moved rectangle or a split's size, and stops when the app switches workspaces.
+    let mut d = driver();
+    let bar = d.hit(&Hit::Title(5)).unwrap().center();
+    d.hold(bar, bar + vec2(60.0, 40.0));
+    d.move_to(bar + vec2(90.0, 60.0));
+    assert!(is_dragging::<u32>(&d.ctx, area));
+    assert_ne!(d.layout.floating[0].rect, sample().floating[0].rect);
+    d.layout.floating[0].rect[0] += 3.0;
+    if let Some(Node::Split { size, .. }) = &mut d.layout.root {
+        *size = SplitSize::FixedSecond(260.0);
+    }
+    d.move_to(bar + vec2(100.0, 70.0));
+    assert!(is_dragging::<u32>(&d.ctx, area));
+    d.layout = swapped();
+    let out = d.move_to(bar + vec2(120.0, 80.0));
+    assert!(!is_dragging::<u32>(&d.ctx, area));
+    assert!(out.actions.is_empty(), "{:?}", out.actions);
+    d.release(bar + vec2(120.0, 80.0));
+    assert_eq!(d.layout, swapped());
+}
diff --git a/crates/ui/src/docking/trial_tests.rs b/crates/ui/src/docking/trial_tests.rs
new file mode 100644
index 00000000..949d9310
--- /dev/null
+++ b/crates/ui/src/docking/trial_tests.rs
@@ -0,0 +1,497 @@
+//! Fixes from the DesignCraft trial: group float size, tab label elision, the drag ghost and
+//! grip, double-clicks on minimized groups, pointer focus, label keys and borrowed lookups; then
+//! split permissions, body focus, right-to-left strips, close controls, menu and button names,
+//! zone mapping, closed panels from `apply`, group heights and flyout events.
+
+use super::*;
+
+/// Every shape, with nested `Shape::Vec`s flattened.
+fn flat(shapes: &[egui::epaint::ClippedShape]) -> Vec<(Rect, egui::Shape)> {
+    fn walk(clip: Rect, shape: &egui::Shape, out: &mut Vec<(Rect, egui::Shape)>) {
+        match shape {
+            egui::Shape::Vec(shapes) => shapes.iter().for_each(|s| walk(clip, s, out)),
+            shape => out.push((clip, shape.clone())),
+        }
+    }
+    let mut out = Vec::new();
+    for clipped in shapes {
+        walk(clipped.clip_rect, &clipped.shape, &mut out);
+    }
+    out
+}
+
+fn texts(d: &Driver) -> Vec<(Rect, egui::epaint::TextShape)> {
+    flat(&d.shapes)
+        .into_iter()
+        .filter_map(|(clip, shape)| match shape {
+            egui::Shape::Text(text) => Some((clip, text)),
+            _ => None,
+        })
+        .collect()
+}
+
+fn rects(d: &Driver) -> Vec<egui::epaint::RectShape> {
+    flat(&d.shapes)
+        .into_iter()
+        .filter_map(|(_, shape)| match shape {
+            egui::Shape::Rect(rect) => Some(rect),
+            _ => None,
+        })
+        .collect()
+}
+
+fn last_char(galley: &egui::Galley) -> Option<char> {
+    galley.rows.last().and_then(|row| row.glyphs.last()).map(|glyph| glyph.chr)
+}
+
+#[test]
+fn a_full_height_docked_group_floats_at_the_host_or_capped_height_inside_the_window() {
+    for size in [None, Some(vec2(200.0, 150.0))] {
+        let mut layout = docked();
+        let Some(Node::Split { first, .. }) = &mut layout.root else { panic!() };
+        **first = Node::Dock { side: Side::Start, columns: vec![Column::new(vec![Group::new(vec![2, 3], 1)], 240.0)] };
+        let content = TestContent { protected: vec![0], floating_size: size, body_height: Some(600.0), ..Default::default() };
+        let mut d = Driver::with(layout, content, Rect::from_min_size(pos2(0.0, 0.0), vec2(600.0, 600.0)));
+        let bar = d.rect("drag-bar", 2);
+        let out = d.drag(bar.center(), pos2(420.0, 300.0));
+        let Some(Target::Float { rect: Some([x, y, width, height]) }) = moved_group(&out.actions) else { panic!("{:?}", out.actions) };
+        match size {
+            Some(size) => assert_eq!(*height, size.y),
+            None => assert_eq!(*height, 320.0),
+        }
+        assert!(*width > 100.0 && *width <= 240.0, "{width}");
+        let window = Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0));
+        assert!(window.contains_rect(Rect::from_min_size(pos2(*x, *y), vec2(*width, *height))), "{x} {y} {width} {height}");
+    }
+}
+
+/// Labels as a host's pre-laid-out galleys, which egui does not wrap again.
+struct GalleyLabels;
+
+impl DockContent<u32> for GalleyLabels {
+    fn body(&mut self, _: &mut egui::Ui, _: &u32) {}
+    fn logical_label(&self, panel: &u32) -> String {
+        format!("Character Styles {panel}")
+    }
+    /// Host-provided galley label that lays the logical text out without wrapping,
+    /// letting the dock handle pre-shaped widget text.
+    fn label(&mut self, ui: &egui::Ui, _: &u32, logical: &str, font: &egui::FontId, color: Color32) -> egui::WidgetText {
+        egui::WidgetText::Galley(ui.painter().layout_no_wrap(logical.to_owned(), font.clone(), color))
+    }
+}
+
+#[test]
+/// Galley-backed labels in shrunk tabs end in an ellipsis and stay wholly inside their tab, both
+/// for the active tab and for inactive tabs, at wide and narrow dock widths.
+fn galley_labels_in_shrunk_tabs_end_with_an_ellipsis_inside_the_tab_active_or_not() {
+    let panels = [1, 2, 3, 4, 5, 6];
+    let layout = Layout { root: Some(tabs(&panels, 3)), floating: Vec::new() };
+    for width in [320.0, 90.0] {
+        let ctx = Context::default();
+        let mut content = GalleyLabels;
+        let mut shapes = Vec::new();
+        for _ in 0..2 {
+            let input = RawInput { screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0))), ..Default::default() };
+            let mut full = ctx.run_ui(input, |ui| {
+                let style = DockStyle::from_ui(ui);
+                ui.scope_builder(UiBuilder::new().max_rect(Rect::from_min_size(pos2(0.0, 0.0), vec2(width, 400.0))), |ui| {
+                    DockArea::new(Id::unique(AREA)).show_content(ui, &layout, &style, &mut content);
+                });
+            });
+            full.textures_delta.clear();
+            shapes = full.shapes;
+        }
+        let texts: Vec<_> = flat(&shapes)
+            .into_iter()
+            .filter_map(|(clip, shape)| match shape {
+                egui::Shape::Text(text) => Some((clip, text)),
+                _ => None,
+            })
+            .collect();
+        let shown: Vec<u32> = panels.into_iter().filter(|p| ctx.read_response(Id::unique(AREA).with(("tab", p))).is_some()).collect();
+        assert!(shown.contains(&4) && shown.len() < panels.len(), "{width}: {shown:?}");
+        for panel in shown {
+            let tab = ctx.read_response(Id::unique(AREA).with(("tab", &panel))).unwrap().rect;
+            let Some((clip, text)) = texts.iter().find(|(_, t)| t.galley.text().ends_with(&format!(" {panel}")) && tab.contains(t.pos)) else {
+                panic!("no label in tab {panel}")
+            };
+            assert_eq!(last_char(&text.galley), Some('…'), "{width}: tab {panel}");
+            let drawn = Rect::from_min_size(text.pos, text.galley.size());
+            assert!(drawn.right() <= tab.right() + 0.5 && drawn.left() >= tab.left(), "tab {panel}: {drawn:?} in {tab:?}");
+            assert!(tab.contains_rect(clip.intersect(drawn)), "tab {panel}");
+        }
+    }
+}
+
+#[test]
+fn drag_bar_draws_no_mark_at_rest_and_a_group_drag_paints_a_filled_labeled_ghost() {
+    let mut d = Driver::new(frames());
+    let visuals = d.ctx.global_style().visuals.clone();
+    let bar = d.rect("drag-bar", 2);
+    let mark = flat(&d.shapes).into_iter().any(|(_, shape)| match shape {
+        egui::Shape::LineSegment { points, .. } => bar.contains(points[0]) && bar.contains(points[1]),
+        _ => false,
+    });
+    assert!(!mark, "a mark in the drag bar at rest");
+
+    d.hold(bar.center(), pos2(150.0, 300.0));
+    let fill = visuals.selection.stroke.color.gamma_multiply(0.15);
+    let Some(ghost) = rects(&d).into_iter().find(|r| r.fill == fill && r.stroke.width == 2.0 && r.rect.contains(pos2(150.0, 300.0))) else {
+        panic!("no filled ghost under the pointer")
+    };
+    for label in ["Panel 2", "Panel 3"] {
+        assert!(texts(&d).iter().any(|(_, t)| t.galley.text() == label && ghost.rect.contains(t.pos)), "{label} missing from the ghost");
+    }
+    d.step(vec![key(egui::Key::Escape)]);
+}
+
+#[test]
+fn double_click_on_a_tab_of_a_minimized_group_ends_expanded() {
+    let layout = Layout { root: Some(tabs(&[1], 0)), floating: vec![Floating::single(vec![5, 6], 1, [80.0, 70.0, 300.0, 220.0])] };
+    let mut d = Driver::new(layout);
+    let minimized = |d: &Driver| d.layout.floating[0].minimized;
+    let active = d.tab(6).center();
+    d.click(active);
+    d.click(active);
+    assert!(minimized(&d));
+    d.wait();
+
+    let other = d.tab(5).center();
+    d.click(other);
+    d.click(other);
+    assert!(!minimized(&d));
+    assert_eq!(d.layout.floating[0].groups()[0].active_panel(), Some(&5));
+}
+
+#[test]
+/// Double-clicking the active tab of a minimized floating window or docked
+/// group expands it; a second double-click minimizes the docked group again.
+fn double_click_on_the_active_tab_of_a_minimized_group_or_window_ends_expanded() {
+    let window = Floating { minimized: true, ..Floating::single(vec![5, 6], 1, [80.0, 70.0, 300.0, 220.0]) };
+    let mut d = Driver::new(Layout { root: Some(tabs(&[1], 0)), floating: vec![window] });
+    let active = d.tab(6).center();
+    d.click(active);
+    d.click(active);
+    assert!(!d.layout.floating[0].minimized);
+
+    let mut layout = docked();
+    let Some(Node::Split { first, .. }) = &mut layout.root else { panic!() };
+    let group = Group { minimized: true, ..Group::new(vec![2, 3], 1) };
+    **first = Node::Dock { side: Side::Start, columns: vec![Column::new(vec![group], 240.0)] };
+    let mut d = Driver::new(layout);
+    let minimized = |d: &Driver| {
+        let Some(Node::Split { first, .. }) = &d.layout.root else { panic!() };
+        let Node::Dock { columns, .. } = &**first else { panic!() };
+        columns[0].groups[0].minimized
+    };
+    let active = d.tab(3).center();
+    d.click(active);
+    d.click(active);
+    assert!(!minimized(&d));
+    d.wait();
+    d.click(active);
+    d.click(active);
+    assert!(minimized(&d));
+}
+
+#[test]
+/// A pointer click on a tab shows no focus outline even if the platform then focuses it, while
+/// keyboard (Tab) focus paints the accent outline.
+fn a_clicked_tab_shows_no_focus_outline_but_tab_key_focus_does() {
+    let mut d = Driver::new(frames());
+    let accent = d.ctx.global_style().visuals.selection.stroke.color;
+    let id = Id::unique(AREA).with(("tab", &3u32));
+    let outline = d.tab(3).shrink(2.0);
+    let outlined = |d: &Driver| rects(d).iter().any(|r| r.rect == outline && r.stroke.width > 0.0 && r.stroke.color == accent);
+
+    d.click(d.tab(3).center());
+    // A platform may focus the clicked widget, as an AccessKit focus request does.
+    d.ctx.memory_mut(|m| m.request_focus(id));
+    d.step(vec![]);
+    assert_eq!(d.ctx.memory(|m| m.focused()), Some(id));
+    assert!(!outlined(&d));
+
+    d.ctx.memory_mut(|m| m.surrender_focus(id));
+    for _ in 0..20 {
+        if d.ctx.memory(|m| m.focused()) == Some(id) {
+            break;
+        }
+        d.step(vec![key(egui::Key::Tab)]);
+    }
+    assert_eq!(d.ctx.memory(|m| m.focused()), Some(id));
+    d.step(vec![]);
+    assert!(outlined(&d));
+
+    // Space and Enter activate the tab without counting as a pointer click.
+    for activate in [egui::Key::Space, egui::Key::Enter] {
+        let out = d.step(vec![key(activate)]);
+        assert!(out.actions.contains(&Action::Activate { panel: 3 }), "{:?}", out.actions);
+        d.step(vec![]);
+        assert!(outlined(&d), "{activate:?} hid the focus outline");
+    }
+}
+
+#[test]
+fn localized_covers_every_label_and_contains_takes_a_borrowed_panel() {
+    let mut debug = String::new();
+    let mut full = Context::default().run_ui(RawInput::default(), |ui| {
+        debug = format!("{:?}", DockStyle::from_ui(ui).localized(|key| Some(key.to_owned())));
+    });
+    full.textures_delta.clear();
+    let values: Vec<&str> = debug.split("_label: \"").skip(1).filter_map(|rest| rest.split('"').next()).collect();
+    assert_eq!(values.len(), 24, "{debug}");
+    assert!(values.iter().all(|v| v.starts_with("dock.")), "a label without a key: {values:?}");
+    let unique: std::collections::HashSet<_> = values.iter().collect();
+    assert_eq!(unique.len(), values.len());
+
+    let window = Floating::single(vec!["swatches".to_owned()], 0, [0.0, 0.0, 200.0, 200.0]);
+    assert!(window.contains("swatches"));
+    assert!(!window.contains("layers"));
+}
+
+const AREA_600: Rect = Rect { min: pos2(0.0, 0.0), max: pos2(600.0, 600.0) };
+
+#[test]
+fn a_protected_canvas_takes_no_side_split_and_a_group_dropped_on_its_edge_floats() {
+    let protected = |p: &u32| if *p == 0 { Permissions::PROTECTED } else { Permissions::default() };
+    let split = Action::Move { panel: 4, anchor: 0, placement: Placement::Split(Zone::Left) };
+    let mut layout = docked();
+    assert_eq!(layout.apply_with_permissions(split.clone(), protected), Err(DockError::NotAllowed));
+    let opt_in = |p: &u32| if *p == 0 { Permissions { accepts_splits: true, ..Permissions::PROTECTED } } else { Permissions::default() };
+    assert!(layout.apply_with_permissions(split, opt_in).is_ok());
+
+    let mut d = Driver::with(docked(), TestContent { protected: vec![0], ..Default::default() }, AREA_600);
+    let bar = d.rect("drag-bar", 2);
+    let out = d.drag(bar.center(), pos2(300.0, 300.0));
+    assert!(matches!(moved_group(&out.actions), Some(Target::Float { .. })), "{:?}", out.actions);
+}
+
+#[test]
+fn a_press_in_a_stripless_panel_reports_it_focused() {
+    let mut d = Driver::with(docked(), TestContent { protected: vec![0], ..Default::default() }, AREA_600);
+    for pressed in [PointerButton::Primary, PointerButton::Secondary, PointerButton::Middle] {
+        let at = pos2(420.0, 300.0);
+        let press = Event::PointerButton { pos: at, button: pressed, pressed: true, modifiers: Modifiers::NONE };
+        let out = d.step(vec![Event::PointerMoved(at), press]);
+        assert_eq!(out.focused, Some(0), "{pressed:?}");
+        d.step(vec![Event::PointerButton { pos: at, button: pressed, pressed: false, modifiers: Modifiers::NONE }]);
+        d.step(vec![key(egui::Key::Escape)]);
+    }
+}
+
+#[test]
+/// In a right-to-left strip the first tab sits at the right edge and the bar
+/// lies to its left; drops just right of the first tab insert before panel 2,
+/// and insertion slots are mirrored at the strip edges.
+fn right_to_left_mirrors_the_tab_strip_and_its_insertion_slots() {
+    let mut d = Driver::with(frames(), TestContent { header: 30.0, ..Default::default() }, AREA_600);
+    d.tweak = |style| style.right_to_left = true;
+    d.step(vec![]);
+    d.step(vec![]);
+    let (first, second, bar) = (d.tab(2), d.tab(3), d.rect("drag-bar", 2));
+    assert!((first.right() - 600.0).abs() < 1.0, "the first tab starts at the right edge: {first:?}");
+    assert!(second.right() <= first.left() + 0.5, "{first:?} {second:?}");
+    assert!(bar.right() <= second.left() + 0.5 && bar.left() >= 304.0 + 30.0 - 0.5, "the bar sits between the tabs and the header: {bar:?}");
+
+    // Just right of the first tab's center is before it in a right-to-left strip.
+    let out = d.drag(d.tab(1).center(), pos2(first.center().x + 6.0, first.center().y));
+    assert!(out.actions.contains(&Action::Move { panel: 1, anchor: 3, placement: Placement::Tab { before: Some(2) } }), "{:?}", out.actions);
+
+    let strip = Rect::from_min_max(pos2(0.0, 0.0), pos2(100.0, 20.0));
+    let target = DropTarget {
+        anchor: 1,
+        rect: Rect::from_min_max(pos2(0.0, 0.0), pos2(100.0, 80.0)),
+        tab_strip: Some(strip),
+        tabs: vec![(1, Rect::from_min_max(pos2(60.0, 0.0), pos2(100.0, 20.0))), (2, Rect::from_min_max(pos2(20.0, 0.0), pos2(60.0, 20.0)))],
+        allow_splits: true,
+        accepts_tabs: true,
+        right_to_left: true,
+    };
+    let drop = |x: f32| resolve_drop(&9, pos2(x, 10.0), std::slice::from_ref(&target), 40.0).unwrap();
+    assert_eq!((drop(90.0).placement, drop(90.0).insertion.unwrap().center().x), (Placement::Tab { before: Some(1) }, 99.0));
+    assert_eq!((drop(70.0).placement, drop(70.0).insertion.unwrap().center().x), (Placement::Tab { before: Some(2) }, 60.0));
+    assert_eq!((drop(10.0).placement, drop(10.0).insertion.unwrap().center().x), (Placement::Tab { before: None }, 20.0));
+}
+
+#[test]
+/// In a right-to-left title bar the close and menu buttons sit on the left, the drag surface ends at
+/// the bar's right edge, and a galley title is truncated with an ellipsis inside the bar.
+fn a_right_to_left_title_bar_puts_its_buttons_left_and_cuts_a_galley_title() {
+    let ctx = Context::default();
+    let mut shapes = Vec::new();
+    let mut rects = (Rect::NOTHING, Rect::NOTHING, Rect::NOTHING);
+    let bar = Rect::from_min_size(pos2(10.0, 10.0), vec2(120.0, 18.0));
+    for _ in 0..2 {
+        let mut full = ctx.run_ui(RawInput::default(), |ui| {
+            let mut style = DockStyle::from_ui(ui);
+            style.right_to_left = true;
+            let chrome = chrome::ChromeStyle::from_dock(&style);
+            let title = egui::WidgetText::Galley(ui.painter().layout_no_wrap("Paragraph Styles and More".into(), style.font.clone(), style.text));
+            let shown = chrome::TitleBar::new(Id::unique("title"), "Move").title(title).menu("Menu").close("Close").show(ui, bar, &chrome);
+            rects = (shown.bar.rect, shown.menu.unwrap().rect, shown.close.unwrap().rect);
+        });
+        full.textures_delta.clear();
+        shapes = full.shapes;
+    }
+    let (grip, menu, close) = rects;
+    assert!(close.center().x < menu.center().x && menu.right() <= grip.left() + 0.5, "{close:?} {menu:?} {grip:?}");
+    assert!((grip.right() - bar.right()).abs() < 0.5);
+    let title = flat(&shapes)
+        .into_iter()
+        .find_map(|(_, shape)| match shape {
+            egui::Shape::Text(text) if text.galley.text().starts_with("Para") => Some(text),
+            _ => None,
+        })
+        .unwrap();
+    assert_eq!(last_char(&title.galley), Some('…'));
+    assert!(title.pos.x + title.galley.size().x <= grip.right() + 0.5 && title.pos.x >= grip.left());
+}
+
+#[test]
+/// With close buttons and close menu items disabled, no close control renders and tab menus contain
+/// neither Close Panel nor Close Tab Group; the host can still apply its own CloseWindow action.
+fn hidden_close_controls_leave_closing_to_the_host() {
+    let layout = Layout { root: Some(tabs(&[1, 2], 0)), floating: vec![Floating::single(vec![5, 6], 0, [80.0, 70.0, 300.0, 220.0])] };
+    let close = Id::unique(AREA).with(("move-group", Some(&5u32))).with("close");
+    let mut d = Driver::new(layout);
+    assert!(d.ctx.read_response(close).is_some());
+    d.tweak = |style| {
+        style.close_button = false;
+        style.close_menu_items = false;
+    };
+    d.step(vec![]);
+    d.step(vec![]);
+    assert!(d.ctx.read_response(close).is_none());
+    let at = d.tab(1).center();
+    let secondary = |pressed| Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed, modifiers: Modifiers::NONE };
+    d.step(vec![Event::PointerMoved(at), secondary(true)]);
+    d.step(vec![secondary(false)]);
+    d.step(vec![]);
+    let painted = |d: &Driver, label: &str| texts(d).iter().any(|(_, t)| t.galley.text() == label);
+    assert!(painted(&d, "Float Panel"), "the tab menu is open");
+    assert!(!painted(&d, "Close Panel") && !painted(&d, "Close Tab Group"));
+    // The panels stay closable: the host's own Close applies and reports what it closed.
+    assert_eq!(d.layout.apply_with_permissions(Action::CloseWindow { panel: 5 }, |p| d.content.permissions(p)), Ok(vec![5, 6]));
+}
+
+#[test]
+/// `apply_all` returns every panel closed by close-others and close-window in
+/// order, leaving the remaining panel open until a later `apply` closes it.
+fn apply_all_returns_every_panel_its_actions_closed() {
+    let mut layout = Layout { root: Some(tabs(&[1, 2, 3], 0)), floating: vec![Floating::single(vec![5, 6], 0, [80.0, 70.0, 300.0, 220.0])] };
+    let closed = layout
+        .apply_all([Action::Activate { panel: 2 }, Action::CloseOthers { panel: 2 }, Action::CloseWindow { panel: 6 }], |_| Permissions::default());
+    assert_eq!(closed, Ok(vec![1, 3, 5, 6]));
+    assert_eq!(layout.apply(Action::Close { panel: 2 }), Ok(vec![2]));
+}
+
+#[test]
+/// The column bar button and the column menu item expose distinct accessible names
+/// (`Collapse column to icons` versus `Collapse to Icons`).
+fn the_column_button_and_the_column_menu_item_have_distinct_names() {
+    use egui_kittest::{Harness, kittest::Queryable};
+    let mut h = Harness::builder().with_size(vec2(800.0, 600.0)).build_ui_state(
+        |ui, content: &mut TestContent| {
+            DockArea::new(Id::unique(AREA)).show_content(ui, &docked(), &DockStyle::from_ui(ui), content);
+        },
+        TestContent { protected: vec![0], ..Default::default() },
+    );
+    h.run_steps(2);
+    assert_eq!(h.query_all_by_label("Collapse column to icons").count(), 1);
+    assert_eq!(h.query_all_by_label("Collapse to Icons").count(), 0);
+    let at = h.ctx.read_response(Id::unique(AREA).with(("column-bar", Some(&2u32)))).unwrap().rect.center();
+    h.input_mut().events.extend([
+        Event::PointerMoved(at),
+        Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: true, modifiers: Modifiers::NONE },
+    ]);
+    h.run_steps(1);
+    h.input_mut().events.push(Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(2);
+    assert_eq!(h.query_all_by_label("Collapse to Icons").count(), 1);
+    assert_eq!(h.query_all_by_label("Collapse column to icons").count(), 1);
+}
+
+#[test]
+fn for_zone_maps_side_zones_onto_columns_groups_and_splits() {
+    let layout = Layout { root: docked().root, floating: vec![Floating::single(vec![5], 0, [300.0, 80.0, 200.0, 200.0])] };
+    let zone = |anchor, zone, rtl| Placement::for_zone(&layout, &anchor, zone, rtl);
+    assert_eq!(zone(2, Zone::Right, false), Ok(Placement::Column { after: true }));
+    assert_eq!(zone(2, Zone::Right, true), Ok(Placement::Column { after: false }));
+    assert_eq!(zone(4, Zone::Bottom, false), Ok(Placement::Group { below: true, height: None }));
+    assert_eq!(zone(2, Zone::Center, false), Ok(Placement::Split(Zone::Center)));
+    assert_eq!(zone(5, Zone::Top, false), Ok(Placement::Split(Zone::Top)));
+    assert_eq!(zone(5, Zone::Left, false), Ok(Placement::Split(Zone::Left)));
+    assert_eq!(zone(0, Zone::Left, true), Ok(Placement::Split(Zone::Left)));
+    assert_eq!(zone(9, Zone::Left, false), Err(DockError::MissingTarget));
+
+    // An end dock mirrors a start dock.
+    let mut end = docked();
+    let Some(Node::Split { first, second, size, .. }) = &mut end.root else { panic!() };
+    std::mem::swap(first, second);
+    *size = SplitSize::FixedSecond(240.0);
+    let Node::Dock { side, .. } = &mut **second else { panic!() };
+    *side = Side::End;
+    assert_eq!(Placement::for_zone(&end, &2, Zone::Left, false), Ok(Placement::Column { after: true }));
+    assert_eq!(Placement::for_zone(&end, &2, Zone::Left, true), Ok(Placement::Column { after: false }));
+}
+
+#[test]
+fn a_group_placement_gives_the_inserted_group_its_height() {
+    let mut layout = docked();
+    let below = |height| Placement::Group { below: true, height };
+    layout.apply(Action::OpenAt { panel: 7, anchor: 4, placement: below(Some(180.0)) }).unwrap();
+    layout.apply(Action::MoveGroup { panel: 2, to: Target::At { anchor: 7, placement: below(Some(90.0)) } }).unwrap();
+    layout.apply(Action::OpenAt { panel: 8, anchor: 4, placement: below(None) }).unwrap();
+    let Some(Node::Split { first, .. }) = &layout.root else { panic!() };
+    let Node::Dock { columns, .. } = &**first else { panic!() };
+    let heights: Vec<_> = columns[0].groups.iter().map(|g| (g.panels.clone(), g.height)).collect();
+    assert_eq!(heights, vec![(vec![4], None), (vec![8], None), (vec![7], Some(180.0)), (vec![2, 3], Some(90.0))]);
+    assert_eq!(layout.apply(Action::OpenAt { panel: 9, anchor: 4, placement: below(Some(f32::NAN)) }), Err(DockError::InvalidGeometry));
+}
+
+struct Icons;
+
+impl DockContent<u32> for Icons {
+    fn body(&mut self, _: &mut egui::Ui, _: &u32) {}
+}
+
+#[test]
+fn every_flyout_change_reports_one_event_whatever_caused_it() {
+    use crate::docking::testing::DockDriver;
+    let mut column = Column::new(vec![Group::new(vec![1, 2], 0), Group::new(vec![3], 0)], 240.0);
+    column.iconic = true;
+    let dock = Node::Dock { side: Side::Start, columns: vec![column] };
+    let canvas = Node::Tabs { panels: vec![0], active: 0 };
+    let layout = Layout {
+        root: Some(Node::Split { axis: SplitAxis::Horizontal, size: SplitSize::FixedFirst(240.0), first: Box::new(dock), second: Box::new(canvas) }),
+        floating: Vec::new(),
+    };
+    let mut d = DockDriver::new(layout, Icons);
+    let flyouts = |outputs: Vec<DockOutput<u32>>| -> Vec<Option<u32>> {
+        outputs
+            .into_iter()
+            .flat_map(|out| out.events)
+            .filter_map(|event| match event {
+                DockEvent::FlyoutChanged { panel } => Some(panel),
+                _ => None,
+            })
+            .collect()
+    };
+    let icon = |d: &DockDriver<u32, Icons>, panel| d.hit(&Hit::Icon(panel)).unwrap().center();
+    let quiet = |d: &mut DockDriver<u32, Icons>| (0..3).map(|_| d.step(Vec::new())).collect::<Vec<_>>();
+
+    let (one, two) = (icon(&d, 1), icon(&d, 2));
+    assert_eq!(flyouts(vec![d.press(one), d.release(one)]), [Some(1)], "an icon opens it");
+    assert_eq!(flyouts(quiet(&mut d)), [], "an open flyout reports nothing more");
+    assert_eq!(flyouts(vec![d.press(two), d.release(two)]), [Some(2)], "another icon switches it");
+    assert_eq!(flyouts(vec![d.key(egui::Key::Escape)]), [None], "Escape closes it");
+    open_flyout(&d.ctx, d.id, 3u32);
+    assert_eq!(flyouts(vec![d.step(Vec::new())]), [Some(3)], "open_flyout");
+    close_flyout::<u32>(&d.ctx, d.id);
+    assert_eq!(flyouts(vec![d.step(Vec::new())]), [None], "close_flyout");
+    d.raise = Some(1);
+    assert_eq!(flyouts(vec![d.step(Vec::new())]), [Some(1)], "raising an iconic panel opens it");
+    let outside = pos2(600.0, 400.0);
+    assert_eq!(flyouts(vec![d.press(outside), d.release(outside)]), [None], "a press outside closes it");
+    assert_eq!(flyouts(quiet(&mut d)), []);
+}
diff --git a/crates/ui/src/docking/workspace.rs b/crates/ui/src/docking/workspace.rs
new file mode 100644
index 00000000..c3711a50
--- /dev/null
+++ b/crates/ui/src/docking/workspace.rs
@@ -0,0 +1,325 @@
+//! A saved arrangement: the current layout, where hidden panels go back, the user's saved
+//! arrangement for Reset, and Lock Workspace.
+//!
+//! Storage, file names and size caps stay with the application. A file that does not parse or
+//! validate, or comes from a newer version, should be kept on disk and not overwritten.
+
+use std::{collections::HashSet, hash::Hash};
+
+use super::model::{Action, DockError, Layout, Location, MAX_PANELS, Permissions, Placement, Zone};
+
+#[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[cfg_attr(feature = "serde", serde(default, bound(deserialize = "P: serde::Deserialize<'de>")))]
+pub struct Workspace<P> {
+    /// Format version; files without one are v1 (`{layout, hidden}`). Always written as
+    /// [`Workspace::VERSION`].
+    #[cfg_attr(feature = "serde", serde(default = "first_version", serialize_with = "write_version"))]
+    pub version: u32,
+    /// The current arrangement, changes included.
+    pub layout: Layout<P>,
+    /// Closed panels, and panels the application does not register now, with where each one
+    /// goes back.
+    pub hidden: Vec<(P, Location<P>)>,
+    /// A user workspace's saved arrangement; Reset returns to it. Built-in workspaces use the
+    /// application's default instead.
+    pub saved: Option<Layout<P>>,
+    /// Lock Workspace, saved with this workspace: [`Self::apply`] uses
+    /// [`Permissions::locked`], so moving, floating and closing are rejected while activating,
+    /// opening, minimizing, resizing and recording native windows still work. Draw it with
+    /// [`super::DockArea::locked`]. An application with a global lock preference instead
+    /// passes locked permissions itself.
+    pub locked: bool,
+}
+
+#[cfg(feature = "serde")]
+fn first_version() -> u32 {
+    1
+}
+
+#[cfg(feature = "serde")]
+fn write_version<S: serde::Serializer>(_: &u32, serializer: S) -> Result<S::Ok, S::Error> {
+    serializer.serialize_u32(Workspace::<()>::VERSION)
+}
+
+impl<P> Default for Workspace<P> {
+    fn default() -> Self {
+        Self::new(Layout::default())
+    }
+}
+
+impl<P> Workspace<P> {
+    pub const VERSION: u32 = 2;
+
+    pub fn new(layout: Layout<P>) -> Self {
+        Self { version: Self::VERSION, layout, hidden: Vec::new(), saved: None, locked: false }
+    }
+}
+
+impl<P: Clone + Eq + Hash> Workspace<P> {
+    /// Check the version, both layouts and that every hidden panel is hidden once and absent
+    /// from the current layout.
+    pub fn validate(&self) -> Result<(), DockError> {
+        if self.version > Self::VERSION {
+            return Err(DockError::UnsupportedVersion);
+        }
+        self.layout.validate()?;
+        if let Some(saved) = &self.saved {
+            saved.validate()?;
+        }
+        if self.hidden.len() > MAX_PANELS {
+            return Err(DockError::LimitExceeded);
+        }
+        let visible: HashSet<&P> = self.layout.panels().into_iter().collect();
+        let mut seen = HashSet::new();
+        for (panel, _) in &self.hidden {
+            if visible.contains(panel) || !seen.insert(panel) {
+                return Err(DockError::DuplicatePanel);
+            }
+        }
+        Ok(())
+    }
+
+    /// Apply one action. Closed panels record where they go back, so each one can be reopened
+    /// with [`Self::set_visible`]. Honors [`Self::locked`]. Returns the panels the action
+    /// closed, in group order, so the application can release their state.
+    pub fn apply(&mut self, action: Action<P>, permissions: impl Fn(&P) -> Permissions) -> Result<Vec<P>, DockError> {
+        self.apply_all([action], permissions)
+    }
+
+    /// Apply every action in order, or none. Returns the panels the actions closed, in order.
+    pub fn apply_all(&mut self, actions: impl IntoIterator<Item = Action<P>>, permissions: impl Fn(&P) -> Permissions) -> Result<Vec<P>, DockError> {
+        self.validate()?;
+        let locked = self.locked;
+        let policy = |panel: &P| if locked { permissions(panel).locked() } else { permissions(panel) };
+        let mut proposed = self.clone();
+        let mut all_closed = Vec::new();
+        for action in actions {
+            let closed = proposed.layout.closed_by(&action)?;
+            let locations = close_locations(&proposed.layout, &closed);
+            // SetNative records where the window system has a floating window, so a lock
+            // takes it too.
+            if matches!(action, Action::SetNative { .. }) {
+                proposed.layout.apply_with_permissions(action, &permissions)?;
+            } else {
+                proposed.layout.apply_with_permissions(action, policy)?;
+            }
+            for (panel, location) in locations {
+                proposed.hidden.retain(|(p, _)| p != &panel);
+                proposed.hidden.push((panel, location));
+            }
+            all_closed.extend(closed);
+        }
+        let visible: HashSet<P> = proposed.layout.panels().into_iter().cloned().collect();
+        proposed.hidden.retain(|(p, _)| !visible.contains(p));
+        let mut seen = HashSet::new();
+        all_closed.retain(|p| !visible.contains(p) && seen.insert(p.clone()));
+        proposed.validate()?;
+        *self = proposed;
+        Ok(all_closed)
+    }
+
+    /// Show or hide one panel. Showing restores its recorded location, following the chain of
+    /// hidden anchors when its own anchor is hidden too; otherwise it opens as
+    /// [`Action::Open`] with `fallback` as the anchor, following `permissions`. The hidden
+    /// panels on that chain reopen beside it later, so a group or window closed one panel at a
+    /// time comes back as one.
+    /// A shown panel becomes the active tab of its group. Hiding follows `permissions` and
+    /// [`Self::locked`], as [`Self::apply`] does, so a protected canvas stays shown.
+    pub fn set_visible(&mut self, panel: P, visible: bool, fallback: Option<P>, permissions: impl Fn(&P) -> Permissions) -> Result<(), DockError> {
+        self.validate()?;
+        if !visible {
+            if !self.layout.contains(&panel) {
+                return Ok(());
+            }
+            return self.apply(Action::Close { panel }, permissions).map(drop);
+        }
+        if self.layout.contains(&panel) {
+            return self.apply(Action::Activate { panel }, |_| Permissions::default()).map(drop);
+        }
+        let mut layout = self.layout.clone();
+        if self.restore_from_hidden(&mut layout, &panel).is_err() {
+            layout = self.layout.clone();
+            layout.apply_with_permissions(Action::Open { panel: panel.clone(), anchor: fallback }, &permissions)?;
+        }
+        layout.apply(Action::Activate { panel: panel.clone() })?;
+        self.layout = layout;
+        self.hidden.retain(|(p, _)| p != &panel);
+        Ok(())
+    }
+
+    /// Restore `panel` where the chain of hidden anchors from its location ends, else at the
+    /// nearest location before that end that restores. The hidden panels it passed then anchor
+    /// on the panel before them in the chain, on the recorded side, so reopening them joins it
+    /// instead of rebuilding their group or window a second time.
+    fn restore_from_hidden(&mut self, layout: &mut Layout<P>, panel: &P) -> Result<(), DockError> {
+        let find = |p: &P| self.hidden.iter().find(|(q, _)| q == p).map(|(_, location)| location);
+        let mut chain = vec![(panel.clone(), find(panel).ok_or(DockError::MissingTarget)?.clone())];
+        while let Some(anchor) = chain.last().and_then(|(_, location)| location.anchor.as_ref())
+            && !chain.iter().any(|(p, _)| p == anchor)
+            && let Some(location) = find(anchor)
+        {
+            chain.push((anchor.clone(), location.clone()));
+        }
+        // A floating location whose anchor is hidden would open a window of its own, even when
+        // the chain leads to an open one. A neighbour's location brings the panel's own group
+        // and column state (height, width, icon-only), not the neighbour's.
+        let own = chain.first().and_then(|(_, location)| location.group.clone());
+        let used = (0..chain.len())
+            .rev()
+            .find_map(|i| {
+                let location = Location { group: own.clone().or_else(|| chain[i].1.group.clone()), ..chain[i].1.clone() };
+                match layout.restore(panel.clone(), &location) {
+                    Err(DockError::MissingTarget) => None,
+                    result => Some(result.map(|()| i)),
+                }
+            })
+            .unwrap_or(Err(DockError::MissingTarget))?;
+        // Past an outer-edge frame the relation can't be reversed: the rest of the chain keeps
+        // its forward anchors, so no two hidden panels anchor on each other.
+        for i in 1..=used {
+            let (before, location) = &chain[i - 1];
+            let Some((_, own)) = self.hidden.iter_mut().find(|(p, _)| p == &chain[i].0) else { continue };
+            let Some(location) = reversed(own, location, before) else { break };
+            *own = location;
+        }
+        Ok(())
+    }
+
+    /// Fit a loaded workspace to the panels the application registers now. An invalid
+    /// workspace is replaced by `default`. Panels not registered now (plug-ins, on-demand or
+    /// numbered panels) move to `hidden` with their location, so they come back once registered;
+    /// the saved arrangement drops them. Registered panels in `default` that are neither shown
+    /// nor hidden go to their default place, or to `hidden` when that place cannot be rebuilt.
+    /// A registered panel that `permissions` says cannot close, such as a protected canvas, is
+    /// always shown: at its recorded or default place, else at the outer edge of the docked
+    /// area. Pass the panels' own permissions, not [`Permissions::locked`] ones.
+    /// `hidden` keeps at most [`MAX_PANELS`] entries, dropping the oldest unregistered ones first.
+    pub fn reconcile(&mut self, registered: impl Fn(&P) -> bool, permissions: impl Fn(&P) -> Permissions, default: &Workspace<P>) {
+        if self.validate().is_err() {
+            *self = Workspace { locked: self.locked, ..default.clone() };
+        }
+        let unknown: Vec<P> = self.layout.panels().into_iter().filter(|p| !registered(p)).cloned().collect();
+        let locations = close_locations(&self.layout, &unknown);
+        for panel in &unknown {
+            self.layout.take(panel);
+        }
+        self.hidden.extend(locations);
+        if let Some(saved) = self.saved.as_mut() {
+            let unknown: Vec<P> = saved.panels().into_iter().filter(|p| !registered(p)).cloned().collect();
+            for panel in unknown {
+                saved.take(&panel);
+            }
+            if saved.validate().is_err() {
+                self.saved = None;
+            }
+        }
+        let known: HashSet<P> = self.layout.panels().into_iter().chain(self.hidden.iter().map(|(p, _)| p)).cloned().collect();
+        let mut missing: Vec<(P, Location<P>)> = Vec::new();
+        for panel in default.layout.panels() {
+            if registered(panel)
+                && !known.contains(panel)
+                && let Ok(location) = default.layout.location(panel)
+            {
+                missing.push((panel.clone(), location));
+            }
+        }
+        // Anchors may themselves be missing: place what fits, then retry the rest.
+        while !missing.is_empty() {
+            let before = missing.len();
+            missing.retain(|(panel, location)| self.layout.restore(panel.clone(), location).is_err());
+            if missing.len() == before {
+                break;
+            }
+        }
+        self.hidden.extend(missing);
+        for (panel, location) in &default.hidden {
+            if registered(panel) && !known.contains(panel) && !self.layout.contains(panel) && !self.hidden.iter().any(|(p, _)| p == panel) {
+                self.hidden.push((panel.clone(), location.clone()));
+            }
+        }
+        let stuck: Vec<P> = self.hidden.iter().map(|(p, _)| p).filter(|p| registered(p) && !permissions(p).closable).cloned().collect();
+        for panel in stuck {
+            let mut layout = self.layout.clone();
+            let shown = self.restore_from_hidden(&mut layout, &panel).is_ok()
+                || default.layout.location(&panel).is_ok_and(|location| layout.restore(panel.clone(), &location).is_ok())
+                || layout.open_at_edge(panel.clone()).is_ok();
+            if shown {
+                self.layout = layout;
+                self.hidden.retain(|(p, _)| p != &panel);
+            }
+        }
+        let mut excess = self.hidden.len().saturating_sub(MAX_PANELS);
+        self.hidden.retain(|(p, _)| {
+            let drop = excess > 0 && !registered(p);
+            excess -= usize::from(drop);
+            !drop
+        });
+        self.hidden.truncate(MAX_PANELS);
+    }
+
+    /// Reset: return to the saved arrangement, or `default` when there is none. Panels the
+    /// reset layout does not show stay hidden with their last location.
+    pub fn reset(&mut self, default: &Layout<P>) {
+        let layout = self.saved.clone().unwrap_or_else(|| default.clone());
+        let shown: HashSet<P> = layout.panels().into_iter().cloned().collect();
+        for panel in self.layout.panels() {
+            if !shown.contains(panel)
+                && !self.hidden.iter().any(|(p, _)| p == panel)
+                && let Ok(location) = self.layout.location(panel)
+            {
+                self.hidden.push((panel.clone(), location));
+            }
+        }
+        self.hidden.retain(|(p, _)| !shown.contains(p));
+        self.layout = layout;
+    }
+}
+
+/// Where each of `closed` goes back, captured as if they closed last to first. Reopening them
+/// first to last rebuilds the group: the first restores the group itself, the rest join it.
+fn close_locations<P: Clone + Eq + Hash>(layout: &Layout<P>, closed: &[P]) -> Vec<(P, Location<P>)> {
+    if let [panel] = closed {
+        return layout.location(panel).map(|location| vec![(panel.clone(), location)]).unwrap_or_default();
+    }
+    let mut scratch = layout.clone();
+    let mut locations = Vec::new();
+    for panel in closed.iter().rev() {
+        if let Ok(location) = scratch.location(panel) {
+            locations.push((panel.clone(), location));
+        }
+        scratch.take(panel);
+    }
+    locations.reverse();
+    locations
+}
+
+/// The location of a hidden panel beside `panel`, whose `location` anchors on it: the same
+/// relation from the other side. `None` for an outer-edge frame, which only sat beside it.
+fn reversed<P: Clone + Eq>(hidden: &Location<P>, location: &Location<P>, panel: &P) -> Option<Location<P>> {
+    let next = match &hidden.placement {
+        Placement::Tab { before } => before.clone(),
+        _ => None,
+    };
+    let (placement, size) = match &location.placement {
+        // `before` names the anchor only when `panel` came first and the anchor second; the
+        // anchor's own `before` then still names the tab after it.
+        Placement::Tab { before } if before == &location.anchor => (Placement::Tab { before: next }, None),
+        Placement::Tab { .. } | Placement::Split(Zone::Center) => (Placement::Tab { before: Some(panel.clone()) }, None),
+        Placement::Split(Zone::Left) => (Placement::Split(Zone::Right), location.size),
+        Placement::Split(Zone::Right) => (Placement::Split(Zone::Left), location.size),
+        Placement::Split(Zone::Top) => (Placement::Split(Zone::Bottom), location.size),
+        Placement::Split(Zone::Bottom) => (Placement::Split(Zone::Top), location.size),
+        Placement::Group { below, .. } => (Placement::Group { below: !below, height: None }, None),
+        Placement::Column { after } => (Placement::Column { after: !after }, None),
+        Placement::SplitSized { zone, .. } => match zone {
+            Zone::Left => (Placement::Split(Zone::Right), location.size),
+            Zone::Right => (Placement::Split(Zone::Left), location.size),
+            Zone::Top => (Placement::Split(Zone::Bottom), location.size),
+            Zone::Bottom => (Placement::Split(Zone::Top), location.size),
+            Zone::Center => return None,
+        },
+        Placement::Edge(_) => return None,
+    };
+    Some(Location { floating: None, anchor: Some(panel.clone()), placement, size, sibling: Vec::new(), ..hidden.clone() })
+}
diff --git a/crates/ui/src/focus.rs b/crates/ui/src/focus.rs
new file mode 100644
index 00000000..03d5b7ac
--- /dev/null
+++ b/crates/ui/src/focus.rs
@@ -0,0 +1,64 @@
+//! Window focus as pointer gestures read it.
+//!
+//! A drag or resize ends when its window loses focus, not while the window merely reports no
+//! focus. egui-winit starts `RawInput::focused` false and only a winit `Focused` event sets it
+//! (on macOS to `has_focus()` at the time the event is read), so a window can take pointer
+//! input for a long time while egui reports it unfocused, at first launch until the user
+//! switches to another application and back. Gestures in such a window still run.
+
+use egui::{Context, Id};
+
+#[derive(Clone, Copy)]
+struct Seen {
+    pass: u64,
+    before: bool,
+    now: bool,
+}
+
+/// Whether `now` is false and was true on the previous pass, as recorded under `key`. With no
+/// record from the previous pass there is no transition, so a gesture asks on every pass it
+/// runs. Asking again in the same pass gives the same answer.
+pub(crate) fn turned_false(ctx: &Context, key: Id, now: bool) -> bool {
+    let pass = ctx.cumulative_pass_nr();
+    ctx.data_mut(|d| {
+        let seen = match d.get_temp::<Seen>(key) {
+            Some(seen) if seen.pass == pass => seen,
+            Some(seen) if seen.pass + 1 == pass => Seen { pass, before: seen.now, now },
+            _ => Seen { pass, before: now, now },
+        };
+        d.insert_temp(key, seen);
+        seen.before && !seen.now
+    })
+}
+
+/// Whether the window being drawn lost focus this pass: focused on the previous pass, not now.
+pub(crate) fn lost(ctx: &Context) -> bool {
+    let focused = ctx.input(|i| i.focused);
+    turned_false(ctx, Id::unique("craft-ui-window-focus").with(ctx.viewport_id()), focused)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::RawInput;
+
+    fn pass(ctx: &Context, focused: bool) -> bool {
+        let mut lost_now = false;
+        let mut out = ctx.run_ui(RawInput { focused, ..Default::default() }, |ui| {
+            lost_now = lost(ui.ctx());
+            assert_eq!(lost(ui.ctx()), lost_now, "asking twice in a pass");
+        });
+        out.textures_delta.clear();
+        lost_now
+    }
+
+    #[test]
+    fn only_a_focused_to_unfocused_pass_is_a_loss() {
+        let ctx = Context::default();
+        assert!(!pass(&ctx, false), "a window that never had focus has not lost it");
+        assert!(!pass(&ctx, false));
+        assert!(!pass(&ctx, true));
+        assert!(pass(&ctx, false));
+        assert!(!pass(&ctx, false), "the loss is one pass");
+    }
+}
diff --git a/crates/ui/src/fonts/coverage.rs b/crates/ui/src/fonts/coverage.rs
new file mode 100644
index 00000000..c247dd0b
--- /dev/null
+++ b/crates/ui/src/fonts/coverage.rs
@@ -0,0 +1,131 @@
+//! The coverage check each app runs over its shipped translations.
+
+use std::fmt;
+
+use egui::{FontFamily, FontId};
+
+use super::Stack;
+
+/// A string the UI shows: one translation, or a sample of content text.
+#[derive(Clone, Copy, Debug)]
+pub struct Sample<'a> {
+    /// The language tag the string belongs to.
+    pub language: &'a str,
+    /// The message key, or a name for a content sample.
+    pub key: &'a str,
+    pub text: &'a str,
+}
+
+/// A character the stack can't draw.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Missing {
+    pub language: String,
+    pub key: String,
+    pub text: String,
+    pub character: char,
+}
+
+impl fmt::Display for Missing {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{} {}: U+{:04X} {:?} in {:?}", self.language, self.key, u32::from(self.character), self.character, self.text)
+    }
+}
+
+/// Every character in `samples` that no face of `family` in `stack` has. `with_system` also asks
+/// the stack's system font provider (the `system_fonts` feature, or [`super::UiFonts::system_provider`]),
+/// for an app that relies on installed fonts for some languages.
+///
+/// Whitespace, control characters and invisible format characters (joiners, direction marks,
+/// variation selectors) are skipped: they draw nothing.
+pub fn missing_glyphs<'a>(stack: &Stack, family: &FontFamily, samples: impl IntoIterator<Item = Sample<'a>>, with_system: bool) -> Vec<Missing> {
+    let mut fonts = stack.fonts(with_system);
+    let font_id = FontId::new(14.0, family.clone());
+    let mut missing = Vec::new();
+    for sample in samples {
+        let mut seen = Vec::new();
+        for c in sample.text.chars().filter(|c| draws(*c)) {
+            if !seen.contains(&c) && !fonts.has_glyph(&font_id, c) {
+                seen.push(c);
+                missing.push(Missing {
+                    language: sample.language.to_owned(),
+                    key: sample.key.to_owned(),
+                    text: sample.text.to_owned(),
+                    character: c,
+                });
+            }
+        }
+    }
+    missing
+}
+
+/// Fail, naming each language, string and character, if the stack can't draw all of `samples`
+/// in the proportional family without system fonts. For an app's coverage test.
+pub fn assert_covers<'a>(stack: &Stack, samples: impl IntoIterator<Item = Sample<'a>>) {
+    fail_on(&missing_glyphs(stack, &FontFamily::Proportional, samples, false));
+}
+
+/// [`assert_covers`] with the stack's system font provider asked too. The result depends on the
+/// machine's fonts; use it for languages the app leaves to them.
+pub fn assert_covers_with_system<'a>(stack: &Stack, samples: impl IntoIterator<Item = Sample<'a>>) {
+    fail_on(&missing_glyphs(stack, &FontFamily::Proportional, samples, true));
+}
+
+#[allow(clippy::panic, reason = "a test assertion")]
+fn fail_on(missing: &[Missing]) {
+    if !missing.is_empty() {
+        let lines: Vec<String> = missing.iter().take(50).map(|m| format!("  {m}")).collect();
+        let more = if missing.len() > lines.len() { format!("\n  … and {} more", missing.len() - lines.len()) } else { String::new() };
+        panic!("the UI fonts can't draw {} characters:\n{}{more}", missing.len(), lines.join("\n"));
+    }
+}
+
+/// A few common letters of an ISO 15924 script, for [`Stack::covers_language`]. `None` for a
+/// script without a sample, which counts as covered.
+pub(super) fn script_sample(script: &str) -> Option<&'static str> {
+    Some(match script {
+        "Arab" => "عربي",
+        "Armn" => "Հայերեն",
+        "Beng" => "বাংলা",
+        "Bopo" => "ㄅㄆㄇ",
+        "Cyrl" => "Кирилица",
+        "Deva" => "हिन्दी",
+        "Ethi" => "አማርኛ",
+        "Geor" => "ქართული",
+        "Grek" => "Ελληνικά",
+        "Gujr" => "ગુજરાતી",
+        "Guru" => "ਪੰਜਾਬੀ",
+        "Hang" => "한국어",
+        "Hani" => "日本中文",
+        "Hebr" => "עברית",
+        "Hira" => "の",
+        "Kana" => "ファイル",
+        "Khmr" => "ខ្មែរ",
+        "Knda" => "ಕನ್ನಡ",
+        "Laoo" => "ລາວ",
+        "Latn" => "Latin",
+        "Mlym" => "മലയാളം",
+        "Mong" => "ᠮᠣᠩᠭᠣᠯ",
+        "Mymr" => "မြန်မာ",
+        "Orya" => "ଓଡ଼ିଆ",
+        "Sinh" => "සිංහල",
+        "Syrc" => "ܣܘܪܝܝܐ",
+        "Taml" => "தமிழ்",
+        "Telu" => "తెలుగు",
+        "Thaa" => "ދިވެހި",
+        "Thai" => "ไทย",
+        "Tibt" => "བོད་ཡིག",
+        _ => return None,
+    })
+}
+
+/// Whether `c` shows a glyph: not whitespace, a control, a format character or another invisible
+/// mark.
+pub(super) fn draws(c: char) -> bool {
+    !(c.is_whitespace()
+        || c.is_control()
+        || matches!(
+            c,
+            '\u{00AD}' | '\u{034F}' | '\u{061C}' | '\u{200B}'..='\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2060}'..='\u{206F}' | '\u{FEFF}'
+        )
+        || matches!(c, '\u{FE00}'..='\u{FE0F}' | '\u{E0100}'..='\u{E01EF}'))
+}
diff --git a/crates/ui/src/fonts/fit.rs b/crates/ui/src/fonts/fit.rs
new file mode 100644
index 00000000..b37af32a
--- /dev/null
+++ b/crates/ui/src/fonts/fit.rs
@@ -0,0 +1,226 @@
+//! Row metrics for the UI language's script face.
+//!
+//! An app's theme sets `interact_size` for rows of its own face. When the UI language's script face
+//! leads the stack and has taller rows, widgets need that much more height; the theme's own height
+//! and padding stay as they are. CJK faces that follow the app's face are fitted into its rows
+//! instead ([`into_row`]).
+
+use std::sync::{Arc, Mutex, MutexGuard, PoisonError};
+
+use egui::epaint::text::{Fonts, TextOptions};
+use egui::{FontData, FontDefinitions, FontFamily, FontId, Style, TextStyle, Theme};
+use skrifa::instance::{LocationRef, Size};
+use skrifa::outline::{DrawSettings, OutlinePen};
+use skrifa::{FontRef, MetadataProvider as _};
+
+const BASE: &str = "craft-ui base face";
+const SCRIPT: &str = "craft-ui script face";
+
+/// The app's face and the UI language's script face, each as its own family.
+#[derive(Clone)]
+pub(super) struct RowFaces(FontDefinitions);
+
+impl RowFaces {
+    pub(super) fn new(base: Arc<FontData>, script: Arc<FontData>) -> Self {
+        let mut definitions = FontDefinitions::empty();
+        for (name, data) in [(BASE, base), (SCRIPT, script)] {
+            definitions.font_data.insert(name.to_owned(), data);
+            definitions.families.insert(FontFamily::Name(name.into()), vec![name.to_owned()]);
+        }
+        for family in [FontFamily::Proportional, FontFamily::Monospace] {
+            definitions.families.entry(family).or_default();
+        }
+        Self(definitions)
+    }
+}
+
+/// How much taller a row of the script face is than a row of the app's face, at `style`'s body and
+/// button sizes; `0` when it isn't taller.
+pub(super) fn extra_height(faces: Option<&RowFaces>, style: &Style) -> f32 {
+    let Some(RowFaces(definitions)) = faces else { return 0.0 };
+    let mut fonts = Fonts::new(TextOptions::default(), definitions.clone());
+    let mut view = fonts.with_pixels_per_point(1.0);
+    let mut row = |size: f32, face: &str| view.row_height(&FontId::new(size, FontFamily::Name(face.into())));
+    let extra = text_sizes(style).into_iter().map(|size| row(size, SCRIPT) - row(size, BASE)).fold(0.0_f32, f32::max);
+    if extra.is_finite() { extra } else { 0.0 }
+}
+
+fn text_sizes(style: &Style) -> Vec<f32> {
+    [TextStyle::Body, TextStyle::Button].iter().filter_map(|s| style.text_styles.get(s)).map(|font| font.size).collect()
+}
+
+/// Tall and deep ideographs, Hangul, kana, bopomofo and corner brackets: the characters a CJK face
+/// fitted into a Latin row keeps inside it.
+const ROW_SAMPLES: &str = "漢中國體鬱한뷁あぎアギㄅ「」";
+
+/// Fit `face`, a CJK fallback after `primary`, into `primary`'s rows: its glyphs sit on
+/// `primary`'s baseline and the row keeps `primary`'s height. The face is scaled down only as far
+/// as keeps [`ROW_SAMPLES`] inside the row.
+pub(super) fn into_row(primary: &FontData, face: &mut FontData) {
+    let (Some(p), Some(f)) = (VerticalMetrics::of(primary), VerticalMetrics::of(face)) else { return };
+    let ascent = primary.tweak.scale * p.ascent;
+    let height = primary.tweak.scale * p.height();
+    let (above, below) = ink_extent(face, ROW_SAMPLES);
+    let mut scale = 1.0_f32;
+    if above > ascent {
+        scale = scale.min(ascent / above);
+    }
+    if below > height - ascent {
+        scale = scale.min((height - ascent) / below);
+    }
+    #[allow(unused_imports, reason = "unused when egui has the inherent method")]
+    use super::SetBaselineFallback as _;
+    // egui centres a fallback's row in the primary's row without growing it; the offset moves the
+    // centred baseline onto the primary's. Both are in units of the font size times the scale.
+    face.tweak.set_baseline_fallback(false);
+    face.tweak.scale = scale;
+    let centred = 0.5 * (height - scale * f.height()) + scale * f.ascent;
+    face.tweak.y_offset_factor = (ascent - centred + primary.tweak.scale * primary.tweak.y_offset_factor) / scale;
+    face.tweak.y_offset = primary.tweak.y_offset;
+}
+
+/// A face's ascent, descent and line gap as epaint reads them, in ems.
+struct VerticalMetrics {
+    ascent: f32,
+    descent: f32,
+    line_gap: f32,
+}
+
+impl VerticalMetrics {
+    fn of(data: &FontData) -> Option<Self> {
+        let font = FontRef::from_index(data.bytes(), data.index).ok()?;
+        let metrics = font.metrics(Size::unscaled(), LocationRef::default());
+        let em = f32::from(metrics.units_per_em);
+        (em > 0.0).then(|| Self { ascent: metrics.ascent / em, descent: -metrics.descent / em, line_gap: metrics.leading / em })
+    }
+
+    fn height(&self) -> f32 {
+        self.ascent + self.descent + self.line_gap
+    }
+}
+
+/// How far the outlines of `text`'s characters in `data` reach above and below the baseline, in
+/// ems, from their control points.
+pub(super) fn ink_extent(data: &FontData, text: &str) -> (f32, f32) {
+    let Ok(font) = FontRef::from_index(data.bytes(), data.index) else { return (0.0, 0.0) };
+    let em = f32::from(font.metrics(Size::unscaled(), LocationRef::default()).units_per_em);
+    let (charmap, outlines) = (font.charmap(), font.outline_glyphs());
+    let mut pen = Extent::default();
+    for glyph in text.chars().filter_map(|c| charmap.map(c)).filter_map(|id| outlines.get(id)) {
+        let _ = glyph.draw(DrawSettings::unhinted(Size::unscaled(), LocationRef::default()), &mut pen);
+    }
+    if em > 0.0 { (pen.top / em, -pen.bottom / em) } else { (0.0, 0.0) }
+}
+
+#[derive(Default)]
+struct Extent {
+    top: f32,
+    bottom: f32,
+}
+
+impl Extent {
+    fn add(&mut self, y: f32) {
+        self.top = self.top.max(y);
+        self.bottom = self.bottom.min(y);
+    }
+}
+
+impl OutlinePen for Extent {
+    fn move_to(&mut self, _x: f32, y: f32) {
+        self.add(y);
+    }
+    fn line_to(&mut self, _x: f32, y: f32) {
+        self.add(y);
+    }
+    fn quad_to(&mut self, _cx0: f32, cy0: f32, _x: f32, y: f32) {
+        self.add(cy0);
+        self.add(y);
+    }
+    fn curve_to(&mut self, _cx0: f32, cy0: f32, _cx1: f32, cy1: f32, _x: f32, y: f32) {
+        self.add(cy0);
+        self.add(cy1);
+        self.add(y);
+    }
+    fn close(&mut self) {}
+}
+
+/// A context's fit, kept in its data.
+#[derive(Default)]
+struct Fitted {
+    faces: Option<RowFaces>,
+    /// [`extra_height`] by text sizes, for the faces installed.
+    measured: Vec<(Vec<f32>, f32)>,
+    /// Per theme: the style's own height and the height it was set to.
+    applied: [Option<(f32, f32)>; 2],
+}
+
+type Shared = Arc<Mutex<Fitted>>;
+
+fn id() -> egui::Id {
+    egui::Id::unique("craft_ui::fonts::fitted")
+}
+
+fn lock(shared: &Shared) -> MutexGuard<'_, Fitted> {
+    shared.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+/// Fit `ctx`'s styles to `faces` now, and again at the start of every pass after the app sets a
+/// style with another height or text size.
+pub(super) fn install(ctx: &egui::Context, faces: Option<RowFaces>) {
+    let shared: Shared = ctx.data_mut(|d| Arc::clone(d.get_temp_mut_or_default::<Shared>(id())));
+    {
+        let mut fitted = lock(&shared);
+        fitted.faces = faces;
+        fitted.measured.clear();
+    }
+    ctx.add_plugin(Refit);
+    refit(ctx, &shared);
+}
+
+fn refit(ctx: &egui::Context, shared: &Shared) {
+    let mut fitted = lock(shared);
+    for (i, theme) in [Theme::Dark, Theme::Light].into_iter().enumerate() {
+        let style = ctx.style_of(theme);
+        let height = style.spacing.interact_size.y;
+        // Any other height than the one set last is the app's, e.g. from a theme applied since.
+        let base = match fitted.applied[i] {
+            Some((base, set)) if set == height => base,
+            _ => height,
+        };
+        let sizes = text_sizes(&style);
+        let extra = match fitted.measured.iter().find(|(s, _)| *s == sizes) {
+            Some((_, extra)) => *extra,
+            None => {
+                let extra = extra_height(fitted.faces.as_ref(), &style);
+                // Bounded, for an app that changes text sizes often.
+                if fitted.measured.len() >= 4 {
+                    fitted.measured.remove(0);
+                }
+                fitted.measured.push((sizes, extra));
+                extra
+            }
+        };
+        let target = base + extra;
+        if target != height {
+            ctx.style_mut_of(theme, |style| style.spacing.interact_size.y = target);
+        }
+        fitted.applied[i] = Some((base, target));
+    }
+}
+
+/// Refits a context's styles at the start of each pass.
+struct Refit;
+
+impl egui::plugin::Plugin for Refit {
+    fn debug_name(&self) -> &'static str {
+        "craft_ui::fonts::Refit"
+    }
+
+    fn on_begin_pass(&mut self, ui: &mut egui::Ui) {
+        let ctx = ui.ctx().clone();
+        let shared: Option<Shared> = ctx.data(|d| d.get_temp(id()));
+        if let Some(shared) = shared {
+            refit(&ctx, &shared);
+        }
+    }
+}
diff --git a/crates/ui/src/fonts/mod.rs b/crates/ui/src/fonts/mod.rs
new file mode 100644
index 00000000..436f773e
--- /dev/null
+++ b/crates/ui/src/fonts/mod.rs
@@ -0,0 +1,1027 @@
+//! The UI font stack every Craft app installs.
+//!
+//! egui draws a character only if one of its installed faces has it. [`UiFonts`] builds the same
+//! fallback order for every app, so a label or file name in any shipped script draws in every app:
+//!
+//! 1. the app's own faces for the family (UI face, semibold, mono), or egui's default faces for a
+//!    family the app has none for;
+//! 2. craft-fonts faces for the UI language;
+//! 3. craft-fonts faces for every other script the app ships, so a Japanese interface still draws
+//!    Arabic file names;
+//! 4. installed system fonts ([`system_font_provider`]), at regular weight ([`RegularWeight`]);
+//! 5. emoji faces ([`Emoji`]) and, behind the app's own faces, egui's default faces.
+//!
+//! When the faces of step 1 don't cover the UI language's main script (Arabic, Thai, Georgian),
+//! that script's face goes first. egui takes a row's height from the first face of a family, so
+//! the UI language's own face sets the row height and its marks aren't clipped. Han, kana and
+//! Hangul sit inside the em square and fit a Latin row, so in Chinese, Japanese and Korean UIs the
+//! Latin face stays first, and rows and widgets keep the same height as in a Latin UI: CJK faces
+//! sit on the first face's baseline, scaled down only if a glyph would leave the row
+//! ([`CjkRows::Fit`]). Monospace, and every family declared [`Family::monospaced`], always keeps
+//! its Latin face first. On the suite's egui fork, the other craft faces and installed text faces
+//! used as fallbacks sit on the row's baseline and rows grow to fit them by themselves; emoji and
+//! symbol faces stay centred.
+//!
+//! Apps keep their font files: their `build.rs` embeds craft-fonts' faces with `craft-fonts-build`,
+//! as [`CraftFace`]s or as `EmbeddedFace`s that convert into them, or, for a web build, copies them
+//! beside the wasm and lists them as [`ServedFace`]s, which the stack orders the same way and
+//! fetches when they are needed (see [`UiFonts::served_faces`]). For the interface they take
+//! `Embed::subset_to(catalogs)`, which embeds or serves the CJK faces as craft-fonts' interface
+//! faces (`Noto Sans TC UI`, BIZ UDPGothic Regular), cut at build time to the characters the
+//! translation catalogs use. A character a cut face lacks, such as one in a file name, comes from
+//! the next face that has it: another region's interface face, then the installed system fonts.
+//! [`UiFonts::stack`] returns a [`Stack`] the app can still edit (add, replace and reorder faces)
+//! before [`Stack::install`].
+
+mod coverage;
+mod fit;
+mod providers;
+mod served;
+#[cfg(not(target_arch = "wasm32"))]
+#[cfg_attr(not(feature = "system_fonts"), allow(dead_code, reason = "used by the system font index, and its tests"))]
+mod system;
+#[cfg(all(feature = "system_fonts", not(target_arch = "wasm32")))]
+mod system_index;
+#[cfg(test)]
+mod tests;
+
+use std::sync::Arc;
+
+use egui::epaint::text::{Fonts, TextOptions};
+use egui::{FontData, FontDefinitions, FontFamily, FontId, FontProvider, Style};
+
+pub use coverage::{Missing, Sample, assert_covers, assert_covers_with_system, missing_glyphs};
+use providers::Installed;
+pub use providers::{FaceList, RegularWeight, set_weight};
+pub use served::{ServedFace, loading};
+
+/// A font file from craft-fonts that the app embeds, one per line of `fonts/manifest.txt`.
+#[derive(Clone, Copy, Debug)]
+pub struct CraftFace {
+    /// Family name, e.g. `"Noto Sans Arabic"`.
+    pub family: &'static str,
+    /// `"Regular"` or `"Bold"`; faces with other styles are not used for UI text.
+    pub style: &'static str,
+    /// The manifest's script tags: ISO 15924 codes such as `Arab`, `Thai`, `Jpan`, `Kore`, `Hans`
+    /// and `Hant`. Hong Kong forms, which have no ISO 15924 code, are tagged `Hant-HK`.
+    pub scripts: &'static [&'static str],
+    pub bytes: &'static [u8],
+    /// Face index in a font collection (`.ttc`); `0` for a single font.
+    pub index: u32,
+}
+
+impl From<craft_fonts_build::EmbeddedFace> for CraftFace {
+    fn from(face: craft_fonts_build::EmbeddedFace) -> Self {
+        let craft_fonts_build::EmbeddedFace { family, style, scripts, index, bytes } = face;
+        Self { family, style, scripts, bytes, index }
+    }
+}
+
+impl From<craft_fonts_build::ServedFace> for ServedFace {
+    fn from(face: craft_fonts_build::ServedFace) -> Self {
+        let craft_fonts_build::ServedFace { family, style, scripts, index, url, size, integrity, coverage } = face;
+        Self { family, style, scripts, index, url, size, integrity, coverage }
+    }
+}
+
+impl CraftFace {
+    /// The egui font name, e.g. `"Noto Sans Arabic Regular"`.
+    pub fn name(&self) -> String {
+        format!("{} {}", self.family, self.style)
+    }
+
+    fn data(&self) -> FontData {
+        baseline_fallback(FontData { index: self.index, ..FontData::from_static(self.bytes) })
+    }
+
+    fn region(&self) -> Option<Han> {
+        self.scripts.iter().find_map(|tag| match *tag {
+            "Hans" => Some(Han::Simplified),
+            "Hant" => Some(Han::Traditional),
+            "Hant-HK" => Some(Han::HongKong),
+            "Jpan" => Some(Han::Japanese),
+            "Kore" => Some(Han::Korean),
+            _ => None,
+        })
+    }
+
+    fn covers(&self, script: &str) -> bool {
+        self.scripts.iter().any(|tag| {
+            *tag == script
+                || match *tag {
+                    "Jpan" => matches!(script, "Hani" | "Hira" | "Kana"),
+                    "Kore" => matches!(script, "Hang" | "Hani"),
+                    "Hans" | "Hant" | "Hant-HK" => script == "Hani",
+                    _ => false,
+                }
+        })
+    }
+
+    /// `0` for the style a family of `weight` wants, `1` for an acceptable stand-in.
+    fn style_rank(&self, weight: u16) -> Option<u8> {
+        let regular = self.style.eq_ignore_ascii_case("regular");
+        let bold = ["bold", "semibold"].iter().any(|s| self.style.eq_ignore_ascii_case(s));
+        match (weight >= 600, regular, bold) {
+            (false, true, _) | (true, _, true) => Some(0),
+            (true, true, _) => Some(1),
+            _ => None,
+        }
+    }
+}
+
+pub use craft_i18n::Han;
+
+/// The suite's egui fork has `FontTweak::set_baseline_fallback`, which puts a fallback face's
+/// glyphs on the primary face's baseline and grows the row to fit them; crates.io egui has
+/// neither. A method call picks an inherent method over a trait method of the same name, so
+/// craft faces reach the fork's method there and this no-op everywhere else, without a feature.
+#[allow(dead_code, reason = "unused when egui has the inherent method")]
+trait SetBaselineFallback {
+    fn set_baseline_fallback(&mut self, _baseline: bool) {}
+}
+
+impl SetBaselineFallback for egui::FontTweak {}
+
+/// A craft face's data, set to sit on the primary face's baseline where egui supports it.
+fn baseline_fallback(mut data: FontData) -> FontData {
+    data.tweak.set_baseline_fallback(true);
+    data
+}
+
+/// The scripts a language is written in, by language tag. [`I18nScripts`] answers from
+/// craft-i18n; an app with its own table implements this instead.
+pub trait LanguageScripts {
+    /// ISO 15924 codes of the language's interface text, main script first: `ja` → `Hani`, `Hira`,
+    /// `Kana`; `ar` → `Arab`. The unions `Jpan`, `Kore`, `Hans` and `Hant` are accepted too.
+    fn scripts(&self, language: &str) -> Vec<&'static str>;
+
+    /// The regional Han forms the language uses, `None` for a language not written with Han.
+    fn han(&self, language: &str) -> Option<Han>;
+}
+
+/// [`LanguageScripts`] from craft-i18n's script table ([`craft_i18n::scripts`],
+/// [`craft_i18n::han`]).
+#[derive(Clone, Copy, Debug, Default)]
+pub struct I18nScripts;
+
+impl LanguageScripts for I18nScripts {
+    fn scripts(&self, language: &str) -> Vec<&'static str> {
+        craft_i18n::scripts(language).iter().map(|s| s.code()).collect()
+    }
+
+    fn han(&self, language: &str) -> Option<Han> {
+        craft_i18n::han(language)
+    }
+}
+
+/// A font family the app uses, beyond what its own faces imply.
+#[derive(Clone, Debug)]
+pub struct Family {
+    family: FontFamily,
+    weight: u16,
+    lead: Option<String>,
+    monospaced: bool,
+}
+
+impl Family {
+    /// A named family, e.g. `Family::named("semibold").weight(600)`.
+    pub fn named(name: &str) -> Self {
+        Self { family: FontFamily::Name(name.into()), weight: 400, lead: None, monospaced: false }
+    }
+
+    /// egui's proportional family.
+    pub fn proportional() -> Self {
+        Self { family: FontFamily::Proportional, weight: 400, lead: None, monospaced: false }
+    }
+
+    /// egui's monospace family, e.g. to set its weight.
+    pub fn monospace() -> Self {
+        Self { family: FontFamily::Monospace, weight: 400, lead: None, monospaced: true }
+    }
+
+    /// The weight (`wght`) this family's faces draw at: bold craft faces are used from 600 up, and
+    /// variable faces are set to this weight.
+    pub fn weight(mut self, weight: u16) -> Self {
+        self.weight = weight;
+        self
+    }
+
+    /// Put `script`'s faces first, e.g. `Family::named("arabic").script("Arab")` for the
+    /// right-to-left runs an app shapes itself.
+    pub fn script(mut self, script: &str) -> Self {
+        self.lead = Some(script.to_owned());
+        self
+    }
+
+    /// Lay the family out as egui's monospace one, e.g. `Family::named("mono").monospaced()` for
+    /// an app's own code face: its app face stays first in every UI language, and a family without
+    /// app faces starts with egui's monospace faces.
+    pub fn monospaced(mut self) -> Self {
+        self.monospaced = true;
+        self
+    }
+}
+
+/// Emoji faces the app embeds, asked in this order after the system fonts.
+///
+/// egui 0.37's default faces have only a few monochrome emoji and lack symbols such as ⊞ ☰ 🔍.
+/// On the web there are no system fonts, so emoji draw as boxes unless one of these is set.
+#[derive(Clone, Default)]
+pub struct Emoji {
+    /// A colour emoji font, e.g. Noto Color Emoji (COLRv1) on desktop.
+    pub color: Option<FontData>,
+    /// A lighter colour emoji font for web builds, e.g. Twemoji.
+    pub web: Option<FontData>,
+    /// A colour emoji font served beside the wasm, fetched the first time text needs an emoji;
+    /// asked after `web`. Ignored outside the web.
+    pub served: Option<ServedFace>,
+    /// A monochrome emoji font, e.g. Noto Emoji; the last resort.
+    pub monochrome: Option<FontData>,
+}
+
+/// How rows treat the CJK faces that follow the app's face.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum CjkRows {
+    /// Rows keep the height of the family's first face in every language, and widgets the theme's
+    /// height. CJK glyphs sit on that face's baseline, scaled down only if they would leave the row.
+    #[default]
+    Fit,
+    /// Rows and widgets take the CJK face's taller line in Chinese, Japanese and Korean UIs. Rows
+    /// grow only on the suite's egui fork; with crates.io egui only widgets do.
+    Grow,
+}
+
+/// Where installed system fonts come in the stack.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum SystemFonts {
+    /// After every craft face.
+    #[default]
+    AfterCraft,
+    /// After the UI language's craft faces, before the faces for other scripts.
+    BeforeCraft,
+    /// Not used: text draws the same on every machine.
+    Off,
+}
+
+/// Scripts the app's own UI faces cover unless [`UiFonts::app_scripts`] says otherwise.
+const APP_SCRIPTS: &[&str] = &["Latn", "Cyrl", "Grek"];
+
+/// Scripts whose characters sit inside the em square, so they fit a row of a Latin face.
+const EM_SQUARE_SCRIPTS: &[&str] = &["Hani", "Hira", "Kana", "Hang", "Bopo"];
+
+/// craft-fonts' interface face for Japanese; its manifest also lists serif Japanese faces.
+const DEFAULT_PREFER: &[(&str, &str)] = &[("Jpan", "BIZ UDPGothic")];
+
+struct AppFace {
+    name: String,
+    data: FontData,
+    families: Vec<FontFamily>,
+}
+
+/// The configuration of an app's UI fonts. Build it, then [`Self::install`] it, or take its
+/// [`Self::stack`] to edit first.
+pub struct UiFonts<'a> {
+    scripts: &'a dyn LanguageScripts,
+    app_faces: Vec<AppFace>,
+    egui_faces: Vec<(String, Vec<FontFamily>)>,
+    app_scripts: Vec<String>,
+    craft_faces: Vec<CraftFace>,
+    /// For each of `craft_faces`, the served face it stands for, whose data is fetched later.
+    served: Vec<Option<ServedFace>>,
+    languages: Vec<String>,
+    ui_language: String,
+    prefer: Vec<(String, String)>,
+    families: Vec<Family>,
+    emoji: Emoji,
+    system: SystemFonts,
+    system_provider: Option<Arc<dyn FontProvider>>,
+    cjk_rows: CjkRows,
+}
+
+impl<'a> UiFonts<'a> {
+    pub fn new(scripts: &'a dyn LanguageScripts) -> Self {
+        Self {
+            scripts,
+            app_faces: Vec::new(),
+            egui_faces: Vec::new(),
+            app_scripts: APP_SCRIPTS.iter().map(|s| (*s).to_owned()).collect(),
+            craft_faces: Vec::new(),
+            served: Vec::new(),
+            languages: Vec::new(),
+            ui_language: "en".to_owned(),
+            prefer: Vec::new(),
+            families: Vec::new(),
+            emoji: Emoji::default(),
+            system: SystemFonts::default(),
+            system_provider: None,
+            cjk_rows: CjkRows::default(),
+        }
+    }
+
+    /// One of the app's own faces, heading `families` in the order the app adds them.
+    pub fn app_face(mut self, name: &str, data: FontData, families: &[FontFamily]) -> Self {
+        self.app_faces.push(AppFace { name: name.to_owned(), data, families: families.to_vec() });
+        self
+    }
+
+    /// One of egui's default faces (`Hack`, `Ubuntu-Light`, `NotoEmoji-Regular`,
+    /// `emoji-icon-font`) at the end of `families`' configured faces, ahead of installed system
+    /// fonts, e.g. Hack in the proportional family for symbols the app's face lacks (⇧, ▸). It
+    /// needs egui's `default_fonts` feature; a name egui doesn't ship is ignored.
+    pub fn egui_face(mut self, name: &str, families: &[FontFamily]) -> Self {
+        self.egui_faces.push((name.to_owned(), families.to_vec()));
+        self
+    }
+
+    /// The scripts the app's own faces cover (default `Latn`, `Cyrl`, `Grek`). A UI language whose
+    /// main script isn't among them gets its craft face ahead of the app's faces, unless the
+    /// script fits a Latin row (Han, kana, Hangul).
+    pub fn app_scripts(mut self, scripts: &[&str]) -> Self {
+        self.app_scripts = scripts.iter().map(|s| (*s).to_owned()).collect();
+        self
+    }
+
+    /// The craft-fonts faces this build embedded; may be empty.
+    pub fn craft_faces(mut self, faces: &[CraftFace]) -> Self {
+        self.craft_faces.extend_from_slice(faces);
+        self.served.resize(self.craft_faces.len(), None);
+        self
+    }
+
+    /// The craft-fonts faces a web build serves beside its wasm (see `craft-fonts-build`'s
+    /// `Embed::serve`); may be empty. They take the places embedded faces would, and on the web
+    /// [`Stack::install`] fetches them: the UI language's faces at once ([`Stack::ui_downloads`]),
+    /// others the first time text needs a character that their files map and the faces already
+    /// installed lack ([`Stack::downloads_for`]). Until a face arrives, text falls back to the
+    /// faces after it. Outside the web they are never fetched.
+    pub fn served_faces(mut self, faces: &[ServedFace]) -> Self {
+        for face in faces {
+            self.craft_faces.push(face.craft_face());
+            self.served.push(Some(*face));
+        }
+        self
+    }
+
+    /// Every language the app offers, in its menu order.
+    pub fn languages<S: AsRef<str>>(mut self, languages: &[S]) -> Self {
+        self.languages = languages.iter().map(|l| l.as_ref().to_owned()).collect();
+        self
+    }
+
+    /// The current UI language tag.
+    pub fn ui_language(mut self, language: &str) -> Self {
+        language.clone_into(&mut self.ui_language);
+        self
+    }
+
+    /// Prefer the craft face of `family` for `script` (a face tag such as `Jpan`), ahead of other
+    /// faces for the same script and region. A family also names its interface face (`Noto Sans TC`
+    /// names `Noto Sans TC UI`). Earlier calls win over later ones.
+    pub fn prefer(mut self, script: &str, family: &str) -> Self {
+        self.prefer.push((script.to_owned(), family.to_owned()));
+        self
+    }
+
+    /// A family to build beyond those the app faces name, or a different weight or lead script for
+    /// one of them.
+    pub fn family(mut self, family: Family) -> Self {
+        self.families.push(family);
+        self
+    }
+
+    pub fn emoji(mut self, emoji: Emoji) -> Self {
+        self.emoji = emoji;
+        self
+    }
+
+    /// Whether CJK faces after the app's face keep its row height ([`CjkRows::Fit`], the default)
+    /// or make rows and widgets taller.
+    pub fn cjk_rows(mut self, rows: CjkRows) -> Self {
+        self.cjk_rows = rows;
+        self
+    }
+
+    pub fn system_fonts(mut self, system: SystemFonts) -> Self {
+        self.system = system;
+        self
+    }
+
+    /// The provider to use for installed fonts instead of [`system_font_provider`] (with the
+    /// `system_fonts` feature, on desktop). It is wrapped in [`RegularWeight`].
+    pub fn system_provider(mut self, provider: Arc<dyn FontProvider>) -> Self {
+        self.system_provider = Some(provider);
+        self
+    }
+
+    /// Build the stack and install it in `ctx`.
+    pub fn install(&self, ctx: &egui::Context) -> Stack {
+        let stack = self.stack();
+        stack.install(ctx);
+        stack
+    }
+
+    /// Build the stack without installing it.
+    pub fn stack(&self) -> Stack {
+        let mut stack = Stack {
+            definitions: FontDefinitions::empty(),
+            after_system: FaceList::default(),
+            system: self.system,
+            system_provider: self.system_provider.clone(),
+            ui_language: self.ui_language.clone(),
+            language_scripts: std::iter::once(&self.ui_language)
+                .chain(&self.languages)
+                .map(|language| (language.clone(), expand(&self.scripts.scripts(language))))
+                .collect(),
+            weights: Vec::new(),
+            base_face: None,
+            script_face: None,
+            served: Vec::new(),
+            ui_downloads: Vec::new(),
+            cjk_rows: self.cjk_rows,
+        };
+        let defaults = FontDefinitions::default();
+        let cjk_names: Vec<String> = match self.cjk_rows {
+            CjkRows::Fit => self.craft_faces.iter().filter(|face| EM_SQUARE_SCRIPTS.iter().any(|s| face.covers(s))).map(CraftFace::name).collect(),
+            CjkRows::Grow => Vec::new(),
+        };
+        let mut cjk_faces: Vec<String> = Vec::new();
+        for family in self.family_specs() {
+            let default_family = if family.monospaced { &FontFamily::Monospace } else { &family.family };
+            let default_chain = defaults.families.get(default_family).or_else(|| defaults.families.get(&FontFamily::Proportional));
+            let egui_faces: Vec<Face> =
+                default_chain.into_iter().flatten().filter_map(|name| Some(Face::new(name, (**defaults.font_data.get(name)?).clone()))).collect();
+            let mut chain = self.chain(&family, egui_faces);
+            let cjk = chain.configured.iter().chain(&chain.after).filter(|face| cjk_names.contains(&face.name));
+            cjk_faces.extend(cjk.map(|face| face.clone().weighted(family.weight).name));
+            chain.configured.extend(
+                self.egui_faces
+                    .iter()
+                    .filter(|(_, families)| families.contains(&family.family))
+                    .filter_map(|(name, _)| Some(Face::new(name, (**defaults.font_data.get(name)?).clone()))),
+            );
+            let mut configured: Vec<String> = chain.configured.into_iter().map(|face| stack.add_configured(face.weighted(family.weight))).collect();
+            let mut tail: Vec<String> = chain.after.into_iter().map(|face| stack.add_after(face.weighted(family.weight))).collect();
+            for face in chain.ui_downloads {
+                if !stack.ui_downloads.contains(&face) {
+                    stack.ui_downloads.push(face);
+                }
+            }
+            if family.family == FontFamily::Proportional {
+                stack.base_face = chain.base.map(|face| face.weighted(family.weight).name);
+                stack.script_face = chain.script.map(|face| face.weighted(family.weight).name);
+            }
+            dedup(&mut configured);
+            tail.retain(|name| !configured.contains(name));
+            dedup(&mut tail);
+            stack.definitions.families.insert(family.family.clone(), configured);
+            stack.after_system.set_chain(family.family.clone(), tail);
+            stack.weights.push((family.family, family.weight));
+        }
+        stack.fit_into_rows(&cjk_faces);
+        stack
+    }
+
+    /// Proportional and Monospace, every family an app face names, then the declared families.
+    fn family_specs(&self) -> Vec<Family> {
+        let mut specs = vec![Family::proportional(), Family::monospace()];
+        for family in self.app_faces.iter().flat_map(|f| &f.families) {
+            if !specs.iter().any(|s| s.family == *family) {
+                specs.push(Family { family: family.clone(), weight: 400, lead: None, monospaced: false });
+            }
+        }
+        for declared in &self.families {
+            match specs.iter_mut().find(|s| s.family == declared.family) {
+                Some(spec) => *spec = declared.clone(),
+                None => specs.push(declared.clone()),
+            }
+        }
+        specs
+    }
+
+    /// One family's faces. `egui_faces` are egui's defaults for it, which stand in for the app's
+    /// faces when the app has none for the family.
+    fn chain(&self, family: &Family, egui_faces: Vec<Face>) -> Chain {
+        let weight = family.weight;
+        let ui_scripts = expand(&self.scripts.scripts(&self.ui_language));
+        let ui_han = self.han(&self.ui_language);
+
+        let app = self.app_faces_for(family);
+        let own_faces = !app.is_empty();
+        let (base, egui_tail) = if own_faces { (app, egui_faces) } else { (egui_faces, Vec::new()) };
+        // egui's default faces cover the scripts app faces are assumed to.
+        let covers = |script: &str| if own_faces { self.app_covers(script) } else { APP_SCRIPTS.contains(&script) };
+
+        let lead: Vec<usize> = expand(family.lead.as_slice()).iter().flat_map(|s| self.candidates(s, ui_han, weight)).collect();
+        let language: Vec<usize> = ui_scripts.iter().filter(|s| !covers(s)).flat_map(|s| self.candidates(s, ui_han, weight)).collect();
+        // Letters of a covered script that the base faces lack, such as Vietnamese ổ and ạ in
+        // egui's Ubuntu-Light, come from that script's own faces before any other face with them.
+        // CJK faces carry Latin at CJK proportions, so they don't stand in.
+        let backup: Vec<usize> = ui_scripts
+            .iter()
+            .filter(|s| covers(s))
+            .flat_map(|s| self.candidates(s, ui_han, weight))
+            .filter(|&i| !self.craft_faces[i].covers("Hani"))
+            .collect();
+        let mut others: Vec<usize> = Vec::new();
+        for tag in self.languages.iter().filter(|l| **l != self.ui_language) {
+            let han = self.han(tag);
+            for script in expand(&self.scripts.scripts(tag)).iter().filter(|s| !covers(s)) {
+                others.extend(self.candidates(script, han, weight));
+            }
+        }
+        let mut rest: Vec<(u8, usize)> =
+            self.craft_faces.iter().enumerate().filter_map(|(i, face)| face.style_rank(weight).map(|rank| (rank, i))).collect();
+        rest.sort();
+        others.extend(rest.into_iter().map(|(_, i)| i));
+
+        let main_needs_lead = ui_scripts.first().is_some_and(|main| !covers(main) && !EM_SQUARE_SCRIPTS.contains(&main.as_str()));
+        let language_first = !family.monospaced && main_needs_lead;
+        let craft = |indices: Vec<usize>| indices.into_iter().map(|i| self.craft_face(i)).collect::<Vec<_>>();
+        // A face that only follows the app's face keeps the app's rows unless the app asks otherwise.
+        let script = (language_first || self.cjk_rows == CjkRows::Grow).then(|| language.first().map(|i| self.craft_face(*i))).flatten();
+        // The best face for each of the UI language's scripts, the ones a web build fetches first.
+        let ui_downloads = ui_scripts
+            .iter()
+            .filter(|s| !covers(s))
+            .filter_map(|s| self.candidates(s, ui_han, weight).first().map(|i| self.craft_face(*i)))
+            .filter(|face| face.served.is_some())
+            .map(|face| face.name)
+            .collect();
+        let base_face = base.first().cloned();
+
+        let mut configured = craft(lead);
+        if language_first {
+            configured.extend(craft(language));
+            configured.extend(base);
+            configured.extend(craft(backup));
+        } else {
+            configured.extend(base);
+            configured.extend(craft(backup));
+            configured.extend(craft(language));
+        }
+        let mut after = Vec::new();
+        match self.system {
+            SystemFonts::BeforeCraft => after.extend(craft(others)),
+            SystemFonts::AfterCraft | SystemFonts::Off => configured.extend(craft(others)),
+        }
+        let emoji = |name: &str, data: &Option<FontData>| Some(Face::new(name, data.clone()?));
+        after.extend(emoji("emoji-color", &self.emoji.color));
+        after.extend(emoji("emoji-web", &self.emoji.web));
+        after.extend(self.emoji.served.map(|face| {
+            let face = ServedFace { scripts: &[served::EMOJI], ..face };
+            Face { served: Some(face), ..Face::new(&face.name(), FontData::from_static(&[])) }
+        }));
+        after.extend(emoji("emoji-monochrome", &self.emoji.monochrome));
+        after.extend(egui_tail);
+        Chain { configured, after, base: base_face, script, ui_downloads }
+    }
+
+    /// The app faces heading `family`; a named family without its own takes the monospace ones
+    /// if it is [`Family::monospaced`], the proportional ones otherwise.
+    fn app_faces_for(&self, family: &Family) -> Vec<Face> {
+        let faces = |family: &FontFamily| -> Vec<Face> {
+            self.app_faces.iter().filter(|face| face.families.contains(family)).map(|face| Face::new(&face.name, face.data.clone())).collect()
+        };
+        match faces(&family.family) {
+            own if !own.is_empty() || !matches!(family.family, FontFamily::Name(_)) => own,
+            _ if family.monospaced => faces(&FontFamily::Monospace),
+            _ => faces(&FontFamily::Proportional),
+        }
+    }
+
+    /// Craft faces for `script`, best first: the right Han region, then the app's preference,
+    /// then the right style, then manifest order. craft-fonts' own preference ([`DEFAULT_PREFER`])
+    /// orders only the faces of the best region found.
+    fn candidates(&self, script: &str, han: Option<Han>, weight: u16) -> Vec<usize> {
+        let found: Vec<(u8, u8, usize)> = self
+            .craft_faces
+            .iter()
+            .enumerate()
+            .filter(|(_, face)| face.covers(script))
+            .filter_map(|(i, face)| {
+                let style = face.style_rank(weight)?;
+                let region = if script == "Hani" { region_rank(face.region(), han) } else { 0 };
+                Some((region, style, i))
+            })
+            .collect();
+        let best = found.iter().map(|(region, ..)| *region).min();
+        let mut ranked: Vec<(u8, usize, u8, usize)> = found
+            .into_iter()
+            .map(|(region, style, i)| {
+                let face = &self.craft_faces[i];
+                let app = preference_of(self.prefer.iter().map(|(s, f)| (s.as_str(), f.as_str())), face);
+                let default = || (Some(region) == best).then(|| preference_of(DEFAULT_PREFER.iter().copied(), face)).flatten();
+                let preference = app.or_else(|| default().map(|p| self.prefer.len() + p)).unwrap_or(usize::MAX);
+                (region, preference, style, i)
+            })
+            .collect();
+        ranked.sort();
+        ranked.into_iter().map(|(.., i)| i).collect()
+    }
+
+    fn craft_face(&self, index: usize) -> Face {
+        let face = self.craft_faces.get(index);
+        Face {
+            name: face.map(CraftFace::name).unwrap_or_default(),
+            data: face.map_or_else(|| FontData::from_static(&[]), CraftFace::data),
+            served: self.served.get(index).copied().flatten(),
+        }
+    }
+
+    fn app_covers(&self, script: &str) -> bool {
+        self.app_scripts.iter().any(|s| s == script)
+    }
+
+    fn han(&self, language: &str) -> Option<Han> {
+        self.scripts.han(language).or_else(|| {
+            self.scripts.scripts(language).iter().find_map(|s| match *s {
+                "Hans" => Some(Han::Simplified),
+                "Hant" => Some(Han::Traditional),
+                "Jpan" => Some(Han::Japanese),
+                "Kore" => Some(Han::Korean),
+                _ => None,
+            })
+        })
+    }
+}
+
+/// The first of `prefer`'s `(script tag, family)` entries that names `face`, or the family whose
+/// interface face `face` is (`Noto Sans TC` names `Noto Sans TC UI`).
+fn preference_of<'p>(mut prefer: impl Iterator<Item = (&'p str, &'p str)>, face: &CraftFace) -> Option<usize> {
+    let full_family = face.family.strip_suffix(" UI").unwrap_or(face.family);
+    prefer.position(|(tag, family)| face.scripts.contains(&tag) && (face.family == family || full_family == family))
+}
+
+/// How well a face's Han region suits the one wanted: lower is better.
+fn region_rank(face: Option<Han>, wanted: Option<Han>) -> u8 {
+    match (face, wanted) {
+        (_, None) => 0,
+        (Some(f), Some(w)) if f == w => 0,
+        (Some(Han::Traditional), Some(Han::HongKong)) | (Some(Han::HongKong), Some(Han::Traditional)) => 1,
+        // The other Chinese forms are closer than Japanese or Korean ones.
+        (Some(Han::Simplified), Some(Han::Traditional | Han::HongKong)) | (Some(Han::Traditional | Han::HongKong), Some(Han::Simplified)) => 2,
+        (None, Some(_)) => 2,
+        _ => 3,
+    }
+}
+
+/// Script codes with the CLDR unions spelled out.
+fn expand<S: AsRef<str>>(scripts: &[S]) -> Vec<String> {
+    let mut out: Vec<String> = Vec::new();
+    for script in scripts {
+        let parts: Vec<&str> = match script.as_ref() {
+            "Jpan" => vec!["Hani", "Hira", "Kana"],
+            "Kore" => vec!["Hang", "Hani"],
+            "Hans" | "Hant" => vec!["Hani"],
+            other => vec![other],
+        };
+        for part in parts {
+            if !out.iter().any(|s| s == part) {
+                out.push(part.to_owned());
+            }
+        }
+    }
+    out
+}
+
+fn dedup(names: &mut Vec<String>) {
+    let mut seen = std::collections::BTreeSet::new();
+    names.retain(|n| !n.is_empty() && seen.insert(n.clone()));
+}
+
+/// A face with its egui name.
+#[derive(Clone)]
+struct Face {
+    name: String,
+    data: FontData,
+    /// The served face this stands for; `data` is empty until it is fetched.
+    served: Option<ServedFace>,
+}
+
+/// One family's faces, as [`UiFonts::chain`] orders them.
+struct Chain {
+    configured: Vec<Face>,
+    /// Faces asked after the system fonts.
+    after: Vec<Face>,
+    /// The app's first face for the family, or egui's when the app has none.
+    base: Option<Face>,
+    /// The UI language's face for its main script, when the family's first faces lack it and the
+    /// face leads, or with [`CjkRows::Grow`].
+    script: Option<Face>,
+    /// Names of the served faces the UI language needs in this family.
+    ui_downloads: Vec<String>,
+}
+
+impl Face {
+    fn new(name: &str, data: FontData) -> Self {
+        Self { name: name.to_owned(), data, served: None }
+    }
+
+    /// Set a variable face to `weight`. A face that isn't at regular weight gets its own name, so
+    /// the regular and bold uses of one file don't collide in egui's face store.
+    fn weighted(mut self, weight: u16) -> Self {
+        if set_weight(&mut self.data, weight) && weight != 400 {
+            self.name = format!("{} @{weight}", self.name);
+        }
+        self
+    }
+}
+
+/// A built font stack: the configured faces and chains, and the providers asked after them.
+#[derive(Clone)]
+pub struct Stack {
+    /// The configured faces and each family's chain. Edit it to add, replace or reorder faces
+    /// before [`Self::install`]; a chain entry without font data is skipped.
+    pub definitions: FontDefinitions,
+    /// Faces asked after the system fonts: emoji, egui's defaults and, with
+    /// [`SystemFonts::BeforeCraft`], the craft faces for other scripts.
+    pub after_system: FaceList,
+    system: SystemFonts,
+    system_provider: Option<Arc<dyn FontProvider>>,
+    ui_language: String,
+    /// The scripts of the UI language and every offered language.
+    language_scripts: Vec<(String, Vec<String>)>,
+    weights: Vec<(FontFamily, u16)>,
+    /// The proportional family's first app face (or egui's), whose rows the app's theme fits.
+    base_face: Option<String>,
+    /// The UI language's main script face when it leads the stack, or with [`CjkRows::Grow`];
+    /// widgets fit its rows.
+    script_face: Option<String>,
+    /// The served faces in the chains, by name; their data is added as it arrives.
+    served: Vec<ServedFace>,
+    cjk_rows: CjkRows,
+    /// Names of the served faces to fetch at install.
+    ui_downloads: Vec<String>,
+}
+
+impl Stack {
+    /// Install the faces and providers in `ctx`, and fit the minimum widget height to a row of
+    /// text. Call it again when the UI language changes.
+    ///
+    /// The app's theme sets the widget height for rows of the app's face. When the UI language's
+    /// script face leads the stack (Arabic, Thai) and has taller rows, the context's styles get
+    /// that much more height ([`Self::fit_interact_size`]), whether the app sets its theme before
+    /// or after installing: a style the app sets later is fitted at the start of the next pass. A
+    /// language whose face follows the app's (Chinese, Japanese, Korean, unless
+    /// [`CjkRows::Grow`]) or has rows no taller than the app's face leaves the theme's height as
+    /// it is.
+    ///
+    /// The stack's system font provider (the `system_fonts` feature on desktop, or
+    /// [`UiFonts::system_provider`]) replaces the context's font providers, such as the one
+    /// eframe adds, as does [`SystemFonts::Off`]. Without one, the context keeps its providers and
+    /// the stack's faces are asked after them.
+    ///
+    /// On the web, a stack with [`UiFonts::served_faces`] also fetches them (see there); the faces
+    /// already fetched for an earlier stack are added at once.
+    pub fn install(&self, ctx: &egui::Context) {
+        #[cfg(target_arch = "wasm32")]
+        if !self.served.is_empty() {
+            return served::web::install(ctx, self.clone());
+        }
+        self.install_faces(ctx, None);
+    }
+
+    /// [`Self::install`] without fetching; `miss` is asked for characters no face has.
+    fn install_faces(&self, ctx: &egui::Context, miss: Option<Arc<dyn FontProvider>>) {
+        ctx.set_fonts(self.checked_definitions());
+        let id = egui::Id::unique("craft_ui::fonts::installed");
+        let (system, start_index) = self.context_lookup();
+        let installed: Option<Arc<Installed>> = ctx.data(|d| d.get_temp(id));
+        let installed = installed.unwrap_or_else(|| {
+            let new = Arc::new(Installed::default());
+            ctx.data_mut(|d| d.insert_temp(id, Arc::clone(&new)));
+            if system.is_none() {
+                ctx.add_font_provider(Arc::clone(&new) as Arc<dyn FontProvider>);
+            }
+            new
+        });
+        installed.set(self.after_system.clone(), miss);
+        if let Some(system) = system {
+            let mut providers = system.into_iter().collect::<Vec<_>>();
+            providers.push(installed as Arc<dyn FontProvider>);
+            providers::set_font_providers(ctx, providers);
+        }
+        if let Some(start) = start_index {
+            start(ctx);
+        }
+        fit::install(ctx, self.row_faces());
+    }
+
+    /// Each family's weight, for wrapping another provider in [`RegularWeight`].
+    pub fn weights(&self) -> &[(FontFamily, u16)] {
+        &self.weights
+    }
+
+    /// The chain of `family`, if the stack has it.
+    pub fn chain(&self, family: &FontFamily) -> &[String] {
+        self.definitions.families.get(family).map_or(&[], Vec::as_slice)
+    }
+
+    /// Insert a face into `family`'s chain at `index` (clamped), adding its data.
+    pub fn insert(&mut self, family: &FontFamily, index: usize, name: &str, data: FontData) {
+        self.definitions.font_data.insert(name.to_owned(), Arc::new(data));
+        let chain = self.definitions.families.entry(family.clone()).or_default();
+        chain.retain(|n| n != name);
+        chain.insert(index.min(chain.len()), name.to_owned());
+    }
+
+    /// Replace the data of the face called `name`, wherever it is used.
+    pub fn replace(&mut self, name: &str, data: FontData) {
+        if self.after_system.contains(name) {
+            self.after_system.insert(name, data.clone());
+        }
+        self.definitions.font_data.insert(name.to_owned(), Arc::new(data));
+    }
+
+    /// Remove the face called `name` from every chain, including those asked after the system
+    /// fonts.
+    pub fn remove(&mut self, name: &str) {
+        self.definitions.font_data.remove(name);
+        for chain in self.definitions.families.values_mut() {
+            chain.retain(|n| n != name);
+        }
+        self.after_system.remove(name);
+    }
+
+    /// Add to `style`'s minimum interactive height how much taller a row of the UI language's
+    /// script face is than a row of the app's face, at the style's body and button sizes, when
+    /// that face leads the stack or [`CjkRows::Grow`] is set.
+    /// [`Self::install`] does this for the context's styles; this is for a style used elsewhere.
+    pub fn fit_interact_size(&self, style: &mut Style) {
+        style.spacing.interact_size.y += fit::extra_height(self.row_faces().as_ref(), style);
+    }
+
+    /// Whether the proportional family can draw `language`'s scripts, e.g. to leave a language out
+    /// of the app's menu on a machine that can't show it. `with_system` also asks the system font
+    /// provider. The scripts come from the stack's [`LanguageScripts`] for the UI language and
+    /// [`UiFonts::languages`], and from craft-i18n for any other language. Each script is checked
+    /// with a few of its common letters. A served face counts for the scripts it is tagged with,
+    /// fetched or not, since it is fetched when text needs it.
+    pub fn covers_language(&self, language: &str, with_system: bool) -> bool {
+        let scripts = match self.language_scripts.iter().find(|(l, _)| l == language) {
+            Some((_, scripts)) => scripts.clone(),
+            None => expand(&I18nScripts.scripts(language)),
+        };
+        let mut fonts = self.fonts(with_system);
+        let font_id = FontId::new(14.0, FontFamily::Proportional);
+        let served = |script: &str| self.served.iter().any(|face| face.craft_face().covers(script));
+        scripts.iter().filter(|s| !served(s)).filter_map(|s| coverage::script_sample(s)).flat_map(str::chars).all(|c| fonts.has_glyph(&font_id, c))
+    }
+
+    /// The stack as one set of definitions, without providers: each family's chain followed by the
+    /// faces asked after the system fonts (emoji and egui's default faces), for a context or
+    /// [`Fonts`] that takes fonts only through `set_fonts`.
+    pub fn flat_definitions(&self) -> FontDefinitions {
+        let mut definitions = self.checked_definitions();
+        let FontDefinitions { font_data, families, .. } = &mut definitions;
+        for (family, chain) in families {
+            for name in self.after_system.chain(family) {
+                if let Some(data) = self.after_system.get(name)
+                    && !chain.contains(name)
+                {
+                    font_data.entry(name.clone()).or_insert_with(|| Arc::new(data.clone()));
+                    chain.push(name.clone());
+                }
+            }
+        }
+        definitions
+    }
+
+    /// An epaint [`Fonts`] with this stack, for tests and measurement. `with_system` adds the
+    /// system font provider.
+    pub fn fonts(&self, with_system: bool) -> Fonts {
+        Fonts::new(TextOptions::default(), self.checked_definitions()).with_font_providers(self.providers(with_system))
+    }
+
+    /// The app's face and the UI language's script face, when the stack has both.
+    fn row_faces(&self) -> Option<fit::RowFaces> {
+        let data = |name: &Option<String>| self.definitions.font_data.get(name.as_ref()?).cloned();
+        Some(fit::RowFaces::new(data(&self.base_face)?, data(&self.script_face)?))
+    }
+
+    fn checked_definitions(&self) -> FontDefinitions {
+        let mut definitions = self.definitions.clone();
+        for chain in definitions.families.values_mut() {
+            chain.retain(|name| self.definitions.font_data.contains_key(name));
+        }
+        for family in [FontFamily::Proportional, FontFamily::Monospace] {
+            definitions.families.entry(family).or_default();
+        }
+        definitions
+    }
+
+    fn providers(&self, with_system: bool) -> Vec<Arc<dyn FontProvider>> {
+        let mut providers: Vec<Arc<dyn FontProvider>> = self.system_lookup(with_system).into_iter().flatten().collect();
+        providers.push(Arc::new(self.after_system.clone()));
+        providers
+    }
+
+    /// The system font lookup that goes before the stack's own providers: `Some(None)` for none
+    /// ([`SystemFonts::Off`]), `None` when the stack has no provider of its own and leaves the
+    /// lookup to whatever the context has.
+    fn system_lookup(&self, with_system: bool) -> Option<Option<Arc<dyn FontProvider>>> {
+        if !with_system || self.system == SystemFonts::Off {
+            return Some(None);
+        }
+        let system = self.system_provider.clone().or_else(|| system_font_provider(&self.ui_language))?;
+        Some(Some(self.regular_weight(system)))
+    }
+
+    /// [`Self::system_lookup`] for [`Self::install`]. The default system provider doesn't block
+    /// the UI thread; the returned function starts its index for the context.
+    fn context_lookup(&self) -> (Option<Option<Arc<dyn FontProvider>>>, Option<StartIndex>) {
+        if self.system_provider.is_none()
+            && self.system != SystemFonts::Off
+            && let Some((provider, start)) = installed_system_font_provider(&self.ui_language)
+        {
+            return (Some(Some(self.regular_weight(provider))), Some(start));
+        }
+        (self.system_lookup(true), None)
+    }
+
+    /// `provider` at each family's weight, its text faces on the row's baseline.
+    fn regular_weight(&self, provider: Arc<dyn FontProvider>) -> Arc<dyn FontProvider> {
+        let provider: Arc<dyn FontProvider> = Arc::new(providers::OnBaseline(provider));
+        Arc::new(self.weights.iter().fold(RegularWeight::new(provider), |p, (f, w)| p.with_weight(f.clone(), *w)))
+    }
+
+    /// Fit the CJK faces `names` into the rows of the proportional family's first face, except where
+    /// one of them leads a family.
+    fn fit_into_rows(&mut self, names: &[String]) {
+        let Some(primary) = self.chain(&FontFamily::Proportional).first().and_then(|name| self.definitions.font_data.get(name)).cloned() else {
+            return;
+        };
+        let leads = |name: &String| self.definitions.families.values().any(|chain| chain.first() == Some(name));
+        let names: Vec<&String> = names.iter().filter(|name| !leads(name)).collect();
+        for name in names {
+            if let Some(data) = self.definitions.font_data.get_mut(name.as_str()) {
+                fit::into_row(&primary, Arc::make_mut(data));
+            }
+            if let Some(data) = self.after_system.get(name) {
+                let mut data = data.clone();
+                fit::into_row(&primary, &mut data);
+                self.after_system.insert(name, data);
+            }
+        }
+    }
+
+    fn add_configured(&mut self, face: Face) -> String {
+        if !self.add_served(&face) {
+            self.definitions.font_data.entry(face.name.clone()).or_insert_with(|| Arc::new(face.data));
+        }
+        face.name
+    }
+
+    fn add_after(&mut self, face: Face) -> String {
+        if self.add_served(&face) { face.name } else { self.after_system.add(face) }
+    }
+
+    /// Record a served face, whose data comes later; false for any other face.
+    fn add_served(&mut self, face: &Face) -> bool {
+        let Some(served) = face.served else { return false };
+        if !self.served.iter().any(|s| s.name() == face.name) {
+            self.served.push(served);
+        }
+        true
+    }
+}
+
+/// A system font provider that prefers `locale`'s fonts, shared by every stack and check that asks
+/// for the same locale. Every locale's provider asks one index of the installed fonts, built once
+/// on a background thread; a lookup before it is built waits for it. `None` without the
+/// `system_fonts` feature and on the web.
+///
+/// To ask whether installed fonts can draw a language, pass it to
+/// [`UiFonts::system_provider`] and check with [`assert_covers_with_system`] or
+/// [`Stack::fonts`]`(true)`.
+#[cfg(all(feature = "system_fonts", not(target_arch = "wasm32")))]
+pub fn system_font_provider(locale: &str) -> Option<Arc<dyn FontProvider>> {
+    use std::collections::BTreeMap;
+    use std::sync::{Mutex, OnceLock, PoisonError};
+    static PROVIDERS: OnceLock<Mutex<BTreeMap<String, Arc<dyn FontProvider>>>> = OnceLock::new();
+    let mut providers = PROVIDERS.get_or_init(Mutex::default).lock().unwrap_or_else(PoisonError::into_inner);
+    Some(Arc::clone(providers.entry(locale.to_owned()).or_insert_with(|| system_index::provider(locale, true))))
+}
+
+/// A system font provider that prefers `locale`'s fonts, shared by every stack and check that asks
+/// for the same locale. `None` without the `system_fonts` feature and on the web.
+#[cfg(not(all(feature = "system_fonts", not(target_arch = "wasm32"))))]
+pub fn system_font_provider(_locale: &str) -> Option<Arc<dyn FontProvider>> {
+    None
+}
+
+/// Starts building the system font index for a context.
+type StartIndex = fn(&egui::Context);
+
+/// The system font provider [`Stack::install`] gives `ctx` when the app sets none. A lookup before
+/// the index is built finds nothing, so the UI thread doesn't wait; `ctx` reloads its fonts and
+/// repaints once it is.
+#[cfg(all(feature = "system_fonts", not(target_arch = "wasm32")))]
+fn installed_system_font_provider(locale: &str) -> Option<(Arc<dyn FontProvider>, StartIndex)> {
+    Some((system_index::provider(locale, false), system_index::start))
+}
+
+#[cfg(not(all(feature = "system_fonts", not(target_arch = "wasm32"))))]
+fn installed_system_font_provider(_locale: &str) -> Option<(Arc<dyn FontProvider>, StartIndex)> {
+    None
+}
diff --git a/crates/ui/src/fonts/providers.rs b/crates/ui/src/fonts/providers.rs
new file mode 100644
index 00000000..f805b6ab
--- /dev/null
+++ b/crates/ui/src/fonts/providers.rs
@@ -0,0 +1,233 @@
+//! Font providers: embedded faces asked after the system fonts, and the regular-weight wrapper for
+//! the system font provider.
+
+use std::collections::BTreeMap;
+use std::sync::{Arc, PoisonError, RwLock};
+
+use egui::epaint::text::Tag;
+use egui::{FallbackRequest, FontData, FontFamily, FontInsert, FontPriority, FontProvider, InsertFontFamily};
+use skrifa::MetadataProvider as _;
+
+/// Set a variable face's weight axis to `weight`, within the axis's range.
+///
+/// Leaves a face with no weight axis, or one whose weight is already set, as it is. Returns
+/// whether it changed the face. Variable system fonts often default to their lightest instance,
+/// e.g. Thin (100), so a face installed without this draws as hairlines.
+pub fn set_weight(data: &mut FontData, weight: u16) -> bool {
+    let wght = Tag::new(b"wght");
+    if data.tweak.coords.as_ref().iter().any(|(tag, _)| *tag == wght) {
+        return false;
+    }
+    let Some(axis) = data.variation_axes().into_iter().find(|axis| axis.tag == wght) else { return false };
+    let value = f32::from(weight).clamp(axis.range.min, axis.range.max);
+    if value == axis.default {
+        return false;
+    }
+    data.tweak.coords.push(*b"wght", value);
+    true
+}
+
+/// Wraps a font provider, usually the system font provider, so variable faces it finds draw
+/// at each family's weight (regular, 400, unless set with [`Self::with_weight`]).
+pub struct RegularWeight {
+    inner: Arc<dyn FontProvider>,
+    weights: Vec<(FontFamily, u16)>,
+}
+
+impl RegularWeight {
+    pub fn new(inner: Arc<dyn FontProvider>) -> Self {
+        Self { inner, weights: Vec::new() }
+    }
+
+    /// Draw faces found for `family` at `weight`, e.g. 600 for a semibold family.
+    pub fn with_weight(mut self, family: FontFamily, weight: u16) -> Self {
+        self.weights.retain(|(f, _)| *f != family);
+        self.weights.push((family, weight));
+        self
+    }
+
+    fn weight(&self, family: &FontFamily) -> u16 {
+        self.weights.iter().find(|(f, _)| f == family).map_or(400, |(_, w)| *w)
+    }
+}
+
+impl FontProvider for RegularWeight {
+    fn fonts_for_family(&self, family: &FontFamily) -> Vec<FontInsert> {
+        let weight = self.weight(family);
+        self.inner.fonts_for_family(family).into_iter().map(|insert| weighted(insert, weight)).collect()
+    }
+
+    fn font_for(&self, request: &FallbackRequest<'_>) -> Option<FontInsert> {
+        let insert = self.inner.font_for(request)?;
+        Some(weighted(insert, self.weight(request.family)))
+    }
+}
+
+fn weighted(mut insert: FontInsert, weight: u16) -> FontInsert {
+    // egui's face store keys faces by name, so a face set to another weight needs its own.
+    if set_weight(&mut insert.data, weight) && weight != 400 {
+        insert.name = format!("{} @{weight}", insert.name);
+    }
+    insert
+}
+
+/// Wraps the system font provider so the text faces it finds sit on the row's baseline as
+/// fallbacks, as craft faces do. Emoji and symbol faces stay centred in the row.
+pub(super) struct OnBaseline(pub(super) Arc<dyn FontProvider>);
+
+impl FontProvider for OnBaseline {
+    fn fonts_for_family(&self, family: &FontFamily) -> Vec<FontInsert> {
+        self.0.fonts_for_family(family).into_iter().map(on_baseline).collect()
+    }
+
+    fn font_for(&self, request: &FallbackRequest<'_>) -> Option<FontInsert> {
+        self.0.font_for(request).map(on_baseline)
+    }
+}
+
+fn on_baseline(mut insert: FontInsert) -> FontInsert {
+    if is_text_face(&insert.name, &insert.data) {
+        #[allow(unused_imports, reason = "unused when egui has the inherent method")]
+        use super::SetBaselineFallback as _;
+        insert.data.tweak.set_baseline_fallback(true);
+    }
+    insert
+}
+
+/// Whether a face draws text rather than emoji or symbols: it has no colour glyphs, and neither
+/// its egui name nor its family name says emoji or symbols.
+pub(super) fn is_text_face(name: &str, data: &FontData) -> bool {
+    let pictorial = |name: &str| {
+        let name = name.to_lowercase();
+        ["emoji", "symbol"].iter().any(|word| name.contains(word))
+    };
+    if pictorial(name) {
+        return false;
+    }
+    let Ok(font) = skrifa::FontRef::from_index(data.bytes(), data.index) else { return true };
+    let colour = [b"COLR", b"CBDT", b"sbix", b"SVG "].iter().any(|tag| font.table_data(skrifa::Tag::new(tag)).is_some());
+    let family = font.localized_strings(skrifa::string::StringId::FAMILY_NAME).english_or_first().map(|s| s.to_string());
+    !colour && !family.is_some_and(|family| pictorial(&family))
+}
+
+/// Embedded faces asked in order, per family, for a character no earlier face or provider has.
+#[derive(Clone, Default)]
+pub struct FaceList {
+    faces: BTreeMap<String, FontData>,
+    chains: BTreeMap<FontFamily, Vec<String>>,
+}
+
+impl FaceList {
+    /// The faces asked for `family`, in order. A family without its own list uses the
+    /// proportional one.
+    pub fn chain(&self, family: &FontFamily) -> &[String] {
+        self.chains.get(family).or_else(|| self.chains.get(&FontFamily::Proportional)).map_or(&[], Vec::as_slice)
+    }
+
+    /// Replace `family`'s list. Names without data from [`Self::add`] are skipped when asked.
+    pub fn set_chain(&mut self, family: FontFamily, names: Vec<String>) {
+        self.chains.insert(family, names);
+    }
+
+    pub(super) fn add(&mut self, face: super::Face) -> String {
+        self.faces.entry(face.name.clone()).or_insert(face.data);
+        face.name
+    }
+
+    /// Each family's list, for renaming entries in place.
+    pub(super) fn chains_mut(&mut self) -> impl Iterator<Item = (&FontFamily, &mut Vec<String>)> {
+        self.chains.iter_mut()
+    }
+
+    /// Add or replace a face's data.
+    pub fn insert(&mut self, name: &str, data: FontData) {
+        self.faces.insert(name.to_owned(), data);
+    }
+
+    /// Whether the list has data for the face called `name`.
+    pub fn contains(&self, name: &str) -> bool {
+        self.faces.contains_key(name)
+    }
+
+    /// The data of the face called `name`, with its tweak.
+    pub fn get(&self, name: &str) -> Option<&FontData> {
+        self.faces.get(name)
+    }
+
+    /// Every face in the list with its name, in name order.
+    pub fn faces(&self) -> impl Iterator<Item = (&str, &FontData)> {
+        self.faces.iter().map(|(name, data)| (name.as_str(), data))
+    }
+
+    /// Remove the face called `name` and drop it from every chain.
+    pub fn remove(&mut self, name: &str) {
+        self.faces.remove(name);
+        for chain in self.chains.values_mut() {
+            chain.retain(|n| n != name);
+        }
+    }
+}
+
+impl FontProvider for FaceList {
+    /// The first face with the cluster's first character, preferring one that also has the
+    /// cluster's other visible characters: egui shapes the whole cluster with this face.
+    fn font_for(&self, request: &FallbackRequest<'_>) -> Option<FontInsert> {
+        let mut chars = request.cluster.chars();
+        let first = chars.next()?;
+        let rest: Vec<char> = chars.filter(|&c| super::coverage::draws(c)).collect();
+        let faces =
+            self.chain(request.family).iter().filter_map(|name| Some((name, self.faces.get(name)?))).filter(|(_, data)| has_char(data, first));
+        let (name, data) = faces.clone().find(|(_, data)| rest.iter().all(|&c| has_char(data, c))).or_else(|| faces.clone().next())?;
+        Some(FontInsert::new(name, data.clone(), vec![InsertFontFamily { family: request.family.clone(), priority: FontPriority::Lowest }]))
+    }
+}
+
+/// A context's installed [`FaceList`], swapped in place when the stack is installed again, so the
+/// providers added before it keep their place, and the provider asked when the list misses too
+/// (on the web, the one that fetches served faces).
+#[derive(Default)]
+pub(super) struct Installed(RwLock<(FaceList, Option<Arc<dyn FontProvider>>)>);
+
+impl Installed {
+    pub(super) fn set(&self, faces: FaceList, miss: Option<Arc<dyn FontProvider>>) {
+        *self.0.write().unwrap_or_else(PoisonError::into_inner) = (faces, miss);
+    }
+}
+
+impl FontProvider for Installed {
+    fn font_for(&self, request: &FallbackRequest<'_>) -> Option<FontInsert> {
+        let (faces, miss) = &*self.0.read().unwrap_or_else(PoisonError::into_inner);
+        faces.font_for(request).or_else(|| miss.as_ref()?.font_for(request))
+    }
+}
+
+/// Whether the face's character map has `c`.
+pub(super) fn has_char(data: &FontData, c: char) -> bool {
+    skrifa::FontRef::from_index(data.bytes(), data.index).is_ok_and(|font| font.charmap().map(c).is_some())
+}
+
+/// The font providers last set by [`set_font_providers`], for [`reload_font_providers`].
+#[derive(Clone)]
+struct ContextProviders(Vec<Arc<dyn FontProvider>>);
+
+fn providers_id() -> egui::Id {
+    egui::Id::unique("craft_ui::fonts::providers")
+}
+
+/// Set `ctx`'s font providers and remember them for [`reload_font_providers`].
+pub(super) fn set_font_providers(ctx: &egui::Context, providers: Vec<Arc<dyn FontProvider>>) {
+    ctx.data_mut(|d| d.insert_temp(providers_id(), ContextProviders(providers.clone())));
+    ctx.set_font_providers(providers);
+}
+
+/// Set `ctx`'s providers again, so egui forgets the characters they had no font for and repaints.
+#[cfg_attr(
+    not(all(feature = "system_fonts", not(target_arch = "wasm32"))),
+    allow(dead_code, reason = "called when the shared system font index is built, and in its tests")
+)]
+pub(super) fn reload_font_providers(ctx: &egui::Context) {
+    let providers: Option<ContextProviders> = ctx.data(|d| d.get_temp(providers_id()));
+    if let Some(ContextProviders(providers)) = providers {
+        ctx.set_font_providers(providers);
+    }
+}
diff --git a/crates/ui/src/fonts/served.rs b/crates/ui/src/fonts/served.rs
new file mode 100644
index 00000000..d1cbcd41
--- /dev/null
+++ b/crates/ui/src/fonts/served.rs
@@ -0,0 +1,345 @@
+//! Faces a web build serves beside its wasm instead of embedding them, fetched when the UI needs
+//! them.
+
+use std::sync::Arc;
+
+use egui::FontFamily;
+use egui::epaint::text::Blob;
+
+use super::{CjkRows, CraftFace, EM_SQUARE_SCRIPTS, Stack, baseline_fallback, set_weight};
+
+#[cfg(any(test, target_arch = "wasm32"))]
+pub(super) mod loader;
+#[cfg(target_arch = "wasm32")]
+pub(super) mod web;
+
+/// The script tag served emoji faces get: ISO 15924 `Zsye`, emoji.
+pub(super) const EMOJI: &str = "Zsye";
+/// ISO 15924 `Zsym`, symbols drawn as text: arrows, keyboard keys, dingbats.
+pub(super) const SYMBOLS: &str = "Zsym";
+/// ISO 15924 `Zmth`, mathematical notation.
+pub(super) const MATH: &str = "Zmth";
+
+/// A craft-fonts face served beside the app, one per line of `fonts/manifest.txt`. The tables that
+/// `craft-fonts-build`'s `Embed::serve` writes are slices of these.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct ServedFace {
+    /// Family name, e.g. `"Noto Sans Arabic"`.
+    pub family: &'static str,
+    /// `"Regular"` or `"Bold"`; faces with other styles are not used for UI text.
+    pub style: &'static str,
+    /// The manifest's script tags, as in [`CraftFace::scripts`].
+    pub scripts: &'static [&'static str],
+    /// Face index in a font collection (`.ttc`); faces of one collection share a URL.
+    pub index: u32,
+    /// Where the file is fetched from, relative to the page or absolute.
+    pub url: &'static str,
+    /// File size in bytes.
+    pub size: u64,
+    /// Subresource Integrity value (`sha256-…`) the browser checks the file against; empty for
+    /// none.
+    pub integrity: &'static str,
+    /// The characters the face maps, in `craft_fonts_build::coverage`'s encoding. A character no
+    /// served face maps fetches nothing.
+    pub coverage: &'static [u8],
+}
+
+impl ServedFace {
+    /// The egui font name, e.g. `"Noto Sans Arabic Regular"`.
+    pub fn name(&self) -> String {
+        format!("{} {}", self.family, self.style)
+    }
+
+    /// Whether the face maps `c`.
+    pub fn covers(&self, c: char) -> bool {
+        craft_fonts_build::coverage::contains(self.coverage, c)
+    }
+
+    /// The face as the stack orders it, without bytes.
+    pub(super) fn craft_face(&self) -> CraftFace {
+        CraftFace { family: self.family, style: self.style, scripts: self.scripts, bytes: &[], index: self.index }
+    }
+}
+
+impl Stack {
+    /// The served faces in the stack's chains (see [`super::UiFonts::served_faces`]).
+    pub fn served(&self) -> &[ServedFace] {
+        &self.served
+    }
+
+    /// The served faces the UI language needs, which [`Self::install`] fetches at once on the web:
+    /// for each family, the best face for each of the language's scripts that the family's own
+    /// faces lack. Empty for a language the app's faces cover.
+    pub fn ui_downloads(&self) -> Vec<&ServedFace> {
+        self.ui_downloads.iter().filter_map(|name| self.served_face(name)).collect()
+    }
+
+    /// The served faces that draw `c` in `family`, in the order the family asks them: those
+    /// whose file maps `c` ([`ServedFace::covers`]) and that are tagged with `c`'s script (see
+    /// [`script_of`]). The family's order puts the UI language's faces first, so a Han character
+    /// takes the face of the UI language's region (Simplified, Traditional, Hong Kong, Japanese or
+    /// Korean forms), then the other offered languages' and the rest in manifest order. Letters
+    /// of Latin, Greek and Cyrillic take faces such as Noto Sans, not the CJK faces, which carry
+    /// those scripts at CJK proportions. Keyboard keys, arrows and other symbols take the symbol
+    /// faces (`Zsym`), mathematical notation the math faces (`Zmth`) and then the symbol faces,
+    /// and emoji the emoji faces. Empty for characters of no particular script and for
+    /// characters no served face maps.
+    pub fn downloads_for(&self, family: &FontFamily, c: char) -> Vec<&ServedFace> {
+        self.downloads(family, c.encode_utf8(&mut [0; 4]))
+    }
+
+    /// [`Self::downloads_for`] the first character of a cluster, whose variation selector
+    /// chooses between emoji and symbol faces (see [`script_of_cluster`]).
+    pub(super) fn downloads(&self, family: &FontFamily, cluster: &str) -> Vec<&ServedFace> {
+        let (Some(c), Some(script)) = (cluster.chars().next(), script_of_cluster(cluster)) else { return Vec::new() };
+        let wanted = if script == MATH { [MATH, SYMBOLS].as_slice() } else { std::slice::from_ref(&script) };
+        let alphabet = matches!(script, "Latn" | "Grek" | "Cyrl");
+        let configured = self.definitions.families.get(family).or_else(|| self.definitions.families.get(&FontFamily::Proportional));
+        let mut faces: Vec<&ServedFace> = Vec::new();
+        for want in wanted {
+            for name in configured.into_iter().flatten().chain(self.after_system.chain(family)) {
+                if let Some(face) = self.served_face(name)
+                    && face.craft_face().covers(want)
+                    && !(alphabet && face.craft_face().covers("Hani"))
+                    && face.covers(c)
+                    && !faces.contains(&face)
+                {
+                    faces.push(face);
+                }
+            }
+        }
+        faces
+    }
+
+    /// Add the file served at `url` to every served face it holds, for [`Self::install`] to
+    /// install. A face in a family of another weight is set to that weight, and renamed as
+    /// [`super::UiFonts::stack`] would have. The web build does this for each file it fetches; an
+    /// app that gets the files some other way can call it itself.
+    pub fn provide(&mut self, url: &str, file: &Blob) {
+        let faces: Vec<ServedFace> = self.served.iter().filter(|face| face.url == url).copied().collect();
+        for face in faces {
+            let name = face.name();
+            let data = baseline_fallback(egui::FontData::from_blob(Arc::clone(file), face.index));
+            let weight = |family: &FontFamily| self.weights.iter().find(|(f, _)| f == family).map_or(400, |(_, w)| *w);
+            let weighted = |family: &FontFamily| {
+                let mut data = data.clone();
+                let weight = weight(family);
+                let name = if set_weight(&mut data, weight) && weight != 400 { format!("{name} @{weight}") } else { name.clone() };
+                (name, data)
+            };
+            let mut configured = Vec::new();
+            for (family, chain) in &mut self.definitions.families {
+                for entry in chain.iter_mut().filter(|entry| **entry == name) {
+                    let (new_name, data) = weighted(family);
+                    if *family == FontFamily::Proportional && self.script_face.as_ref() == Some(entry) {
+                        self.script_face = Some(new_name.clone());
+                    }
+                    entry.clone_from(&new_name);
+                    configured.push((new_name, data));
+                }
+            }
+            let mut after = Vec::new();
+            for (family, chain) in self.after_system.chains_mut() {
+                for entry in chain.iter_mut().filter(|entry| **entry == name) {
+                    let (new_name, data) = weighted(family);
+                    entry.clone_from(&new_name);
+                    after.push((new_name, data));
+                }
+            }
+            let mut names: Vec<String> = configured.iter().map(|(name, _)| name.clone()).collect();
+            for (name, data) in configured {
+                self.definitions.font_data.insert(name, Arc::new(data));
+            }
+            names.extend(after.iter().map(|(name, _)| name.clone()));
+            for (name, data) in after {
+                self.after_system.insert(&name, data);
+            }
+            if self.cjk_rows == CjkRows::Fit && EM_SQUARE_SCRIPTS.iter().any(|script| face.craft_face().covers(script)) {
+                self.fit_into_rows(&names);
+            }
+        }
+    }
+
+    fn served_face(&self, name: &str) -> Option<&ServedFace> {
+        self.served.iter().find(|face| face.name() == name)
+    }
+}
+
+/// Whether the UI language's served faces are still being fetched, for an app that waits for them
+/// before drawing its interface. Always false outside the web, and once every fetch has finished,
+/// failed ones included.
+#[cfg(target_arch = "wasm32")]
+pub fn loading(ctx: &egui::Context) -> bool {
+    web::loading(ctx)
+}
+
+/// Whether the UI language's served faces are still being fetched: never, outside the web.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn loading(_ctx: &egui::Context) -> bool {
+    false
+}
+
+/// The ISO 15924 script a served face must have to draw `c`, by Unicode block. Symbols with an
+/// emoji presentation by default (Unicode's `Emoji_Presentation`) map to [`EMOJI`], other
+/// symbols, such as ⌘ ⌥ ⇧ ⌃ ⎋ ⏎ ⌫, to [`SYMBOLS`]. `None` for characters of no block listed.
+pub(super) fn script_of(c: char) -> Option<&'static str> {
+    // Sorted by start; ranges don't overlap.
+    const BLOCKS: &[(u32, u32, &str)] = &[
+        (0x0020, 0x036F, "Latn"),
+        (0x0370, 0x03FF, "Grek"),
+        (0x0400, 0x052F, "Cyrl"),
+        (0x0530, 0x058F, "Armn"),
+        (0x0590, 0x05FF, "Hebr"),
+        (0x0600, 0x06FF, "Arab"),
+        (0x0700, 0x074F, "Syrc"),
+        (0x0750, 0x077F, "Arab"),
+        (0x0780, 0x07BF, "Thaa"),
+        (0x0860, 0x086F, "Syrc"),
+        (0x0870, 0x08FF, "Arab"),
+        (0x0900, 0x097F, "Deva"),
+        (0x0980, 0x09FF, "Beng"),
+        (0x0A00, 0x0A7F, "Guru"),
+        (0x0A80, 0x0AFF, "Gujr"),
+        (0x0B00, 0x0B7F, "Orya"),
+        (0x0B80, 0x0BFF, "Taml"),
+        (0x0C00, 0x0C7F, "Telu"),
+        (0x0C80, 0x0CFF, "Knda"),
+        (0x0D00, 0x0D7F, "Mlym"),
+        (0x0D80, 0x0DFF, "Sinh"),
+        (0x0E00, 0x0E7F, "Thai"),
+        (0x0E80, 0x0EFF, "Laoo"),
+        (0x0F00, 0x0FFF, "Tibt"),
+        (0x1000, 0x109F, "Mymr"),
+        (0x10A0, 0x10FF, "Geor"),
+        (0x1100, 0x11FF, "Hang"),
+        (0x1200, 0x139F, "Ethi"),
+        (0x1780, 0x17FF, "Khmr"),
+        (0x1800, 0x18AF, "Mong"),
+        (0x19E0, 0x19FF, "Khmr"),
+        (0x1C80, 0x1C8F, "Cyrl"),
+        (0x1C90, 0x1CBF, "Geor"),
+        (0x1D00, 0x1EFF, "Latn"),
+        (0x1F00, 0x1FFF, "Grek"),
+        (0x2000, 0x20CF, "Latn"),
+        (0x2100, 0x214F, SYMBOLS),
+        (0x2150, 0x218F, "Latn"),
+        (0x2190, 0x21FF, SYMBOLS),
+        (0x2200, 0x22FF, MATH),
+        (0x2300, 0x27BF, SYMBOLS),
+        (0x27C0, 0x27EF, MATH),
+        (0x27F0, 0x297F, SYMBOLS),
+        (0x2980, 0x2AFF, MATH),
+        (0x2B00, 0x2BFF, SYMBOLS),
+        (0x2C60, 0x2C7F, "Latn"),
+        (0x2D00, 0x2D2F, "Geor"),
+        (0x2D80, 0x2DDF, "Ethi"),
+        (0x2DE0, 0x2DFF, "Cyrl"),
+        (0x2E00, 0x2E7F, "Latn"),
+        (0x2E80, 0x303F, "Hani"),
+        (0x3040, 0x309F, "Hira"),
+        (0x30A0, 0x30FF, "Kana"),
+        (0x3100, 0x312F, "Bopo"),
+        (0x3130, 0x318F, "Hang"),
+        (0x31A0, 0x31BF, "Bopo"),
+        (0x31C0, 0x31EF, "Hani"),
+        (0x31F0, 0x31FF, "Kana"),
+        (0x3200, 0x9FFF, "Hani"),
+        (0xA640, 0xA69F, "Cyrl"),
+        (0xA720, 0xA7FF, "Latn"),
+        (0xA8E0, 0xA8FF, "Deva"),
+        (0xA960, 0xA97F, "Hang"),
+        (0xAB00, 0xAB2F, "Ethi"),
+        (0xAB30, 0xAB6F, "Latn"),
+        (0xAC00, 0xD7FF, "Hang"),
+        (0xF900, 0xFAFF, "Hani"),
+        (0xFB00, 0xFB06, "Latn"),
+        (0xFB13, 0xFB17, "Armn"),
+        (0xFB1D, 0xFB4F, "Hebr"),
+        (0xFB50, 0xFDFF, "Arab"),
+        (0xFE30, 0xFE4F, "Hani"),
+        (0xFE70, 0xFEFF, "Arab"),
+        (0xFF00, 0xFF65, "Hani"),
+        (0xFF66, 0xFF9F, "Kana"),
+        (0xFFA0, 0xFFDC, "Hang"),
+        (0x1D400, 0x1D7FF, MATH),
+        (0x1F000, 0x1FAFF, EMOJI),
+        (0x1FB00, 0x1FBFF, SYMBOLS),
+        (0x20000, 0x3FFFF, "Hani"),
+    ];
+    // The symbols among the BLOCKS' symbols that are emoji by default.
+    const EMOJI_PRESENTATION: &[(u32, u32)] = &[
+        (0x231A, 0x231B),
+        (0x23E9, 0x23EC),
+        (0x23F0, 0x23F0),
+        (0x23F3, 0x23F3),
+        (0x25FD, 0x25FE),
+        (0x2614, 0x2615),
+        (0x2648, 0x2653),
+        (0x267F, 0x267F),
+        (0x2693, 0x2693),
+        (0x26A1, 0x26A1),
+        (0x26AA, 0x26AB),
+        (0x26BD, 0x26BE),
+        (0x26C4, 0x26C5),
+        (0x26CE, 0x26CE),
+        (0x26D4, 0x26D4),
+        (0x26EA, 0x26EA),
+        (0x26F2, 0x26F3),
+        (0x26F5, 0x26F5),
+        (0x26FA, 0x26FA),
+        (0x26FD, 0x26FD),
+        (0x2705, 0x2705),
+        (0x270A, 0x270B),
+        (0x2728, 0x2728),
+        (0x274C, 0x274C),
+        (0x274E, 0x274E),
+        (0x2753, 0x2755),
+        (0x2757, 0x2757),
+        (0x2795, 0x2797),
+        (0x27B0, 0x27B0),
+        (0x27BF, 0x27BF),
+        (0x2B1B, 0x2B1C),
+        (0x2B50, 0x2B50),
+        (0x2B55, 0x2B55),
+    ];
+    // The emoji BLOCKS' characters that are symbols, drawn as text by default: mahjong, domino
+    // and playing card faces, enclosed letters, ornaments, geometric shapes, arrows, chess.
+    const TEXT_PRESENTATION: &[(u32, u32)] = &[
+        (0x1F000, 0x1F003),
+        (0x1F005, 0x1F0CE),
+        (0x1F0D0, 0x1F18D),
+        (0x1F18F, 0x1F190),
+        (0x1F19B, 0x1F1E5),
+        (0x1F650, 0x1F67F),
+        (0x1F780, 0x1F7DF),
+        (0x1F800, 0x1F8FF),
+        (0x1FA00, 0x1FA6F),
+    ];
+    let c = u32::from(c);
+    let script = find(BLOCKS, c, |(start, end, _)| (*start, *end)).map(|(.., script)| *script)?;
+    Some(match script {
+        SYMBOLS if find(EMOJI_PRESENTATION, c, |r| *r).is_some() => EMOJI,
+        EMOJI if find(TEXT_PRESENTATION, c, |r| *r).is_some() => SYMBOLS,
+        script => script,
+    })
+}
+
+/// [`script_of`] the cluster's first character, with an emoji or text variation selector
+/// (U+FE0F, U+FE0E) choosing between [`EMOJI`] and [`SYMBOLS`].
+pub(super) fn script_of_cluster(cluster: &str) -> Option<&'static str> {
+    let script = script_of(cluster.chars().next()?)?;
+    Some(if cluster.contains('\u{FE0F}') {
+        EMOJI
+    } else if script == EMOJI && cluster.contains('\u{FE0E}') {
+        SYMBOLS
+    } else {
+        script
+    })
+}
+
+/// The entry of `ranges` (sorted by start, not overlapping) that holds `c`.
+fn find<T>(ranges: &[T], c: u32, range: impl Fn(&T) -> (u32, u32)) -> Option<&T> {
+    let i = ranges.partition_point(|r| range(r).0 <= c);
+    let entry = ranges.get(i.checked_sub(1)?)?;
+    (c <= range(entry).1).then_some(entry)
+}
diff --git a/crates/ui/src/fonts/served/loader.rs b/crates/ui/src/fonts/served/loader.rs
new file mode 100644
index 00000000..b8de5dc3
--- /dev/null
+++ b/crates/ui/src/fonts/served/loader.rs
@@ -0,0 +1,213 @@
+//! Fetching served faces: the UI language's at install, others when egui asks the context's
+//! providers for a character no installed face has. The fetching itself is a [`Fetcher`]: the
+//! browser's on the web, a fake one in tests.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::{Arc, Mutex, MutexGuard, PoisonError, Weak};
+
+use egui::epaint::text::{Blob, MissingGlyphPolicy};
+use egui::{FallbackRequest, FontInsert, FontProvider};
+
+use crate::fonts::Stack;
+
+/// Seconds before a failed file is fetched again; each further failure doubles it, up to
+/// [`RETRY_MAX`].
+const RETRY_FIRST: f64 = 2.0;
+const RETRY_MAX: f64 = 600.0;
+
+/// Called with a fetched file's bytes, or why it failed.
+pub(in crate::fonts) type Done = Box<dyn FnOnce(Result<Vec<u8>, String>) + Send>;
+/// Called when a timer fires.
+pub(in crate::fonts) type Wake = Box<dyn FnOnce() + Send>;
+
+/// Fetches files and keeps time for a [`Loader`].
+pub(in crate::fonts) trait Fetcher: Send + Sync {
+    /// Start fetching `url`, checked against `integrity` when not empty, and call `done` with its
+    /// bytes or why it failed.
+    fn fetch(&self, url: &'static str, integrity: &'static str, done: Done);
+    /// Seconds since some fixed time.
+    fn now(&self) -> f64;
+    /// Call `wake` once, `seconds` from now.
+    fn after(&self, seconds: f64, wake: Wake);
+}
+
+/// Install `stack`, add the files fetched so far, and fetch the UI language's faces.
+pub(in crate::fonts) fn install(ctx: &egui::Context, mut stack: Stack, fetcher: Arc<dyn Fetcher>) {
+    let loader = Loader::of(ctx, fetcher);
+    let fetch = {
+        let mut state = loader.lock();
+        let now = loader.fetcher.now();
+        for (url, file) in &state.files {
+            stack.provide(url, file);
+        }
+        state.ui_pending.clear();
+        let mut fetch: Vec<(&'static str, &'static str)> = Vec::new();
+        for face in stack.ui_downloads() {
+            if state.files.contains_key(face.url) || !state.due(face.url, now) {
+                continue;
+            }
+            state.ui_pending.insert(face.url);
+            if !fetch.iter().any(|(url, _)| *url == face.url) {
+                fetch.push((face.url, face.integrity));
+            }
+        }
+        state.stack = Some(stack.clone());
+        fetch
+    };
+    stack.install_faces(ctx, Some(Arc::clone(&loader) as Arc<dyn FontProvider>));
+    for (url, integrity) in fetch {
+        loader.fetch(url, integrity);
+    }
+}
+
+#[cfg(target_arch = "wasm32")]
+pub(in crate::fonts) fn loading(ctx: &egui::Context) -> bool {
+    let loader: Option<Arc<Loader>> = ctx.data(|d| d.get_temp(id()));
+    loader.is_some_and(|loader| !loader.lock().ui_pending.is_empty())
+}
+
+fn id() -> egui::Id {
+    egui::Id::unique("craft_ui::fonts::served")
+}
+
+/// Make egui ask the providers again for the characters it found no face for. egui remembers those
+/// misses until its fonts reload and has no call that only forgets them; changing the missing
+/// glyph policy reloads the fonts, and setting it back keeps the app's policy.
+fn forget_misses(ctx: &egui::Context) {
+    let policy = ctx.missing_glyph_policy();
+    let other = match policy {
+        MissingGlyphPolicy::Tofu => MissingGlyphPolicy::Panic,
+        MissingGlyphPolicy::Panic => MissingGlyphPolicy::Tofu,
+    };
+    ctx.set_missing_glyph_policy(other);
+    ctx.set_missing_glyph_policy(policy);
+}
+
+/// The context's fetched files and the stack they go into. Also the provider asked for characters
+/// no face has, which starts fetching the face that draws them.
+struct Loader {
+    ctx: egui::Context,
+    me: Weak<Loader>,
+    fetcher: Arc<dyn Fetcher>,
+    state: Mutex<State>,
+}
+
+#[derive(Default)]
+struct State {
+    /// The installed stack, without the files' data.
+    stack: Option<Stack>,
+    /// Fetched files by URL; the browser's HTTP cache keeps them across page loads.
+    files: BTreeMap<&'static str, Blob>,
+    in_flight: BTreeSet<&'static str>,
+    failed: BTreeMap<&'static str, Failure>,
+    /// The UI language's files not fetched yet.
+    ui_pending: BTreeSet<&'static str>,
+}
+
+struct Failure {
+    attempts: u32,
+    retry_at: f64,
+}
+
+impl State {
+    /// Whether `url` may be fetched: it never failed, or its retry time has come.
+    fn due(&self, url: &str, now: f64) -> bool {
+        self.failed.get(url).is_none_or(|failure| now >= failure.retry_at)
+    }
+}
+
+impl Loader {
+    fn of(ctx: &egui::Context, fetcher: Arc<dyn Fetcher>) -> Arc<Self> {
+        let existing: Option<Arc<Self>> = ctx.data(|d| d.get_temp(id()));
+        existing.unwrap_or_else(|| {
+            let loader = Arc::new_cyclic(|me| Self { ctx: ctx.clone(), me: me.clone(), fetcher, state: Mutex::default() });
+            ctx.data_mut(|d| d.insert_temp(id(), Arc::clone(&loader)));
+            loader
+        })
+    }
+
+    fn lock(&self) -> MutexGuard<'_, State> {
+        self.state.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    fn fetch(&self, url: &'static str, integrity: &'static str) {
+        if !self.lock().in_flight.insert(url) {
+            return;
+        }
+        let Some(me) = self.me.upgrade() else { return };
+        self.fetcher.fetch(url, integrity, Box::new(move |result| me.arrived(url, result)));
+    }
+
+    fn arrived(&self, url: &'static str, result: Result<Vec<u8>, String>) {
+        let (stack, retry) = {
+            let mut state = self.lock();
+            state.in_flight.remove(url);
+            state.ui_pending.remove(url);
+            match result {
+                Ok(bytes) => {
+                    state.failed.remove(url);
+                    let file: Blob = Arc::new(bytes);
+                    state.files.insert(url, Arc::clone(&file));
+                    let stack = state.stack.as_mut().map(|stack| {
+                        stack.provide(url, &file);
+                        stack.clone()
+                    });
+                    (stack, None)
+                }
+                Err(_) => {
+                    let attempts = state.failed.get(url).map_or(1, |failure| failure.attempts + 1);
+                    let delay = (RETRY_FIRST * 2f64.powi(attempts.saturating_sub(1).min(16) as i32)).min(RETRY_MAX);
+                    state.failed.insert(url, Failure { attempts, retry_at: self.fetcher.now() + delay });
+                    (None, Some(delay))
+                }
+            }
+        };
+        if let Some(stack) = stack
+            && let Some(me) = self.me.upgrade()
+        {
+            stack.install_faces(&self.ctx, Some(me as Arc<dyn FontProvider>));
+        }
+        // The file that arrived draws characters egui found no face for; after a failure, they go
+        // to the next face that draws them now and to this one again at its retry time.
+        forget_misses(&self.ctx);
+        if let Some(delay) = retry {
+            let me = self.me.clone();
+            self.fetcher.after(
+                delay,
+                Box::new(move || {
+                    if let Some(me) = me.upgrade() {
+                        forget_misses(&me.ctx);
+                        me.ctx.request_repaint();
+                    }
+                }),
+            );
+        }
+        self.ctx.request_repaint();
+    }
+}
+
+impl FontProvider for Loader {
+    /// Start fetching the face that draws the character and find nothing for now: the face is
+    /// installed when it arrives, and egui asks again. Only faces whose files map the character
+    /// are candidates, the first one the family asks; a failed one leaves the character to the
+    /// next until its retry time. A character no served face maps fetches nothing.
+    fn font_for(&self, request: &FallbackRequest<'_>) -> Option<FontInsert> {
+        let now = self.fetcher.now();
+        let state = self.lock();
+        let mut next = None;
+        for face in state.stack.as_ref()?.downloads(request.family, request.cluster) {
+            if state.in_flight.contains(face.url) || state.files.contains_key(face.url) {
+                // It draws the character once it arrives, or already does.
+                return None;
+            }
+            if state.due(face.url, now) {
+                next = Some((face.url, face.integrity));
+                break;
+            }
+        }
+        drop(state);
+        let (url, integrity) = next?;
+        self.fetch(url, integrity);
+        None
+    }
+}
diff --git a/crates/ui/src/fonts/served/web.rs b/crates/ui/src/fonts/served/web.rs
new file mode 100644
index 00000000..d0df6332
--- /dev/null
+++ b/crates/ui/src/fonts/served/web.rs
@@ -0,0 +1,65 @@
+//! The browser's [`Fetcher`]: `fetch` with Subresource Integrity, and `setTimeout`.
+
+use std::sync::Arc;
+
+use wasm_bindgen::closure::Closure;
+use wasm_bindgen::{JsCast as _, JsValue};
+use wasm_bindgen_futures::JsFuture;
+
+use super::loader::{self, Done, Fetcher, Wake};
+use crate::fonts::Stack;
+
+/// Install `stack`, add the files fetched so far, and fetch the UI language's faces.
+pub(in crate::fonts) fn install(ctx: &egui::Context, stack: Stack) {
+    loader::install(ctx, stack, Arc::new(Browser));
+}
+
+pub(in crate::fonts) fn loading(ctx: &egui::Context) -> bool {
+    loader::loading(ctx)
+}
+
+struct Browser;
+
+impl Fetcher for Browser {
+    fn fetch(&self, url: &'static str, integrity: &'static str, done: Done) {
+        wasm_bindgen_futures::spawn_local(async move {
+            let result = fetch_file(url, integrity).await;
+            if let Err(error) = &result {
+                web_sys::console::warn_1(&format!("craft-ui: cannot fetch the font {url}: {error}").into());
+            }
+            done(result);
+        });
+    }
+
+    fn now(&self) -> f64 {
+        js_sys::Date::now() / 1000.0
+    }
+
+    fn after(&self, seconds: f64, wake: Wake) {
+        let Some(window) = web_sys::window() else { return };
+        let callback = Closure::once_into_js(wake);
+        let millis = (seconds * 1000.0) as i32;
+        // Without the timer, the face is retried when the next fetch finishes.
+        let _ = window.set_timeout_with_callback_and_timeout_and_arguments_0(callback.unchecked_ref(), millis);
+    }
+}
+
+async fn fetch_file(url: &str, integrity: &str) -> Result<Vec<u8>, String> {
+    // An Error's message only: its Debug form carries the whole JS stack. The browser logs the
+    // cause (network, integrity) itself.
+    let js = |e: JsValue| match e.dyn_ref::<js_sys::Error>() {
+        Some(error) => String::from(error.message()),
+        None => e.as_string().unwrap_or_else(|| format!("{e:?}")),
+    };
+    let window = web_sys::window().ok_or("no window")?;
+    let init = web_sys::RequestInit::new();
+    if !integrity.is_empty() {
+        init.set_integrity(integrity);
+    }
+    let response: web_sys::Response = JsFuture::from(window.fetch_with_str_and_init(url, &init)).await.map_err(js)?.dyn_into().map_err(js)?;
+    if !response.ok() {
+        return Err(format!("HTTP {}", response.status()));
+    }
+    let buffer = JsFuture::from(response.array_buffer().map_err(js)?).await.map_err(js)?;
+    Ok(js_sys::Uint8Array::new(&buffer).to_vec())
+}
diff --git a/crates/ui/src/fonts/system.rs b/crates/ui/src/fonts/system.rs
new file mode 100644
index 00000000..ef486223
--- /dev/null
+++ b/crates/ui/src/fonts/system.rs
@@ -0,0 +1,216 @@
+//! A font index built once on a background thread and shared by every locale's provider.
+//!
+//! Lookups that may not block (the UI thread's) find nothing until the index is built: egui
+//! draws with the faces it has, and every context that was turned away reloads its fonts when the
+//! index arrives, which forgets egui's cached misses and repaints. If the build panics, every
+//! lookup finds nothing from then on and egui keeps the faces it has.
+
+use std::sync::{Arc, Condvar, Mutex, MutexGuard, PoisonError};
+
+use egui::{FallbackRequest, FontInsert, FontProvider};
+
+/// A font index a [`Lookup`] asks.
+pub(super) trait FontIndex: Send + 'static {
+    /// The provider's preference between fonts for one script, e.g. a locale.
+    type Locale: Send + Sync + 'static;
+
+    fn font_for(&mut self, request: &FallbackRequest<'_>, locale: &Self::Locale) -> Option<FontInsert>;
+}
+
+enum State<T> {
+    Idle,
+    /// `turned_away`: a lookup found nothing because the index wasn't built, so `contexts` reload
+    /// their fonts when it is.
+    Building {
+        turned_away: bool,
+        contexts: Vec<egui::Context>,
+    },
+    Ready(Arc<Mutex<T>>),
+    Failed,
+}
+
+/// An index built at most once per process, on first use.
+pub(super) struct Shared<T> {
+    state: Mutex<State<T>>,
+    built: Condvar,
+    build: fn() -> T,
+}
+
+impl<T: FontIndex> Shared<T> {
+    pub(super) const fn new(build: fn() -> T) -> Self {
+        Self { state: Mutex::new(State::Idle), built: Condvar::new(), build }
+    }
+
+    /// Start building the index on a background thread unless it is built or building. `ctx`
+    /// reloads its fonts when the index arrives if a lookup was turned away meanwhile.
+    pub(super) fn start(&'static self, ctx: Option<&egui::Context>) {
+        let idle = {
+            let mut state = self.lock();
+            let idle = matches!(*state, State::Idle);
+            if idle {
+                *state = State::Building { turned_away: false, contexts: Vec::new() };
+            }
+            if let (State::Building { contexts, .. }, Some(ctx)) = (&mut *state, ctx) {
+                contexts.push(ctx.clone());
+            }
+            idle
+        };
+        if idle && std::thread::Builder::new().name("craft-ui system fonts".into()).spawn(|| self.finish()).is_err() {
+            self.finish();
+        }
+    }
+
+    /// The index, or `None` while it builds unless `wait`, which blocks until it is built, or
+    /// `None` if its build failed.
+    fn get(&'static self, wait: bool) -> Option<Arc<Mutex<T>>> {
+        self.start(None);
+        let mut state = self.lock();
+        loop {
+            match &mut *state {
+                State::Ready(index) => return Some(Arc::clone(index)),
+                State::Failed => return None,
+                State::Building { turned_away, .. } if !wait => {
+                    *turned_away = true;
+                    return None;
+                }
+                _ => state = self.built.wait(state).unwrap_or_else(PoisonError::into_inner),
+            }
+        }
+    }
+
+    fn finish(&self) {
+        let built = std::panic::catch_unwind(self.build).map_err(|payload| {
+            let message = payload
+                .downcast_ref::<String>()
+                .map(String::as_str)
+                .or_else(|| payload.downcast_ref::<&str>().copied())
+                .unwrap_or("non-string panic payload");
+            eprintln!("craft-ui: building the system font index failed, so it adds no fonts: {message}");
+        });
+        let next = built.map_or(State::Failed, |index| State::Ready(Arc::new(Mutex::new(index))));
+        let previous = std::mem::replace(&mut *self.lock(), next);
+        self.built.notify_all();
+        // Outside the lock: the UI thread holds the context's fonts while it asks for the index.
+        if let State::Building { turned_away: true, contexts } = previous {
+            for ctx in contexts {
+                super::providers::reload_font_providers(&ctx);
+            }
+        }
+    }
+
+    fn lock(&self) -> MutexGuard<'_, State<T>> {
+        self.state.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+}
+
+/// One locale's provider over a [`Shared`] index.
+pub(super) struct Lookup<T: FontIndex> {
+    index: &'static Shared<T>,
+    locale: T::Locale,
+    /// Block until the index is built, for checks; the UI thread doesn't.
+    wait: bool,
+}
+
+impl<T: FontIndex> Lookup<T> {
+    pub(super) fn new(index: &'static Shared<T>, locale: T::Locale, wait: bool) -> Self {
+        Self { index, locale, wait }
+    }
+}
+
+impl<T: FontIndex> FontProvider for Lookup<T> {
+    fn font_for(&self, request: &FallbackRequest<'_>) -> Option<FontInsert> {
+        let index = self.index.get(self.wait)?;
+        let mut index = index.lock().unwrap_or_else(PoisonError::into_inner);
+        index.font_for(request, &self.locale)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+    use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+    use std::time::{Duration, Instant};
+
+    use egui::{FontData, FontFamily, FontId, FontPriority, InsertFontFamily};
+
+    use super::*;
+
+    const ARABIC: &[u8] = include_bytes!("../../tests/fonts/NotoSansArabic-test.ttf");
+
+    struct Gated;
+
+    static OPEN: AtomicBool = AtomicBool::new(false);
+    static BUILDS: AtomicUsize = AtomicUsize::new(0);
+
+    fn build_when_open() -> Gated {
+        while !OPEN.load(Ordering::Acquire) {
+            std::thread::sleep(Duration::from_millis(1));
+        }
+        BUILDS.fetch_add(1, Ordering::Relaxed);
+        Gated
+    }
+
+    impl FontIndex for Gated {
+        type Locale = ();
+
+        fn font_for(&mut self, request: &FallbackRequest<'_>, _: &()) -> Option<FontInsert> {
+            Some(FontInsert::new(
+                "index:Arabic",
+                FontData::from_static(ARABIC),
+                vec![InsertFontFamily { family: request.family.clone(), priority: FontPriority::Lowest }],
+            ))
+        }
+    }
+
+    static GATED: Shared<Gated> = Shared::new(build_when_open);
+
+    #[test]
+    fn ui_lookups_skip_the_index_until_it_is_built_then_the_context_reloads() {
+        let ctx = egui::Context::default();
+        let font_id = FontId::new(14.0, FontFamily::Proportional);
+        let ui: Arc<dyn FontProvider> = Arc::new(Lookup::new(&GATED, (), false));
+        super::super::providers::set_font_providers(&ctx, vec![ui]);
+        GATED.start(Some(&ctx));
+        let draws_arabic = || {
+            ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
+            ctx.fonts_mut(|f| f.has_glyph(&font_id, 'ع'))
+        };
+
+        assert!(!draws_arabic(), "a lookup before the index is built finds nothing, without blocking");
+        let other_locale = Lookup::new(&GATED, (), false);
+        let request = FallbackRequest { cluster: "ع", family: &FontFamily::Proportional };
+        assert!(other_locale.font_for(&request).is_none());
+
+        OPEN.store(true, Ordering::Release);
+        let checks = Lookup::new(&GATED, (), true);
+        assert!(checks.font_for(&request).is_some(), "a waiting lookup blocks until the index is built");
+        let deadline = Instant::now() + Duration::from_secs(10);
+        while !draws_arabic() {
+            assert!(Instant::now() < deadline, "the context reloads its fonts once the index is built");
+            std::thread::sleep(Duration::from_millis(5));
+        }
+        assert!(other_locale.font_for(&request).is_some());
+        assert_eq!(BUILDS.load(Ordering::Relaxed), 1, "every locale shares one index");
+    }
+
+    fn build_panics() -> Gated {
+        panic!("stand-in index build failure");
+    }
+
+    static PANICS: Shared<Gated> = Shared::new(build_panics);
+
+    #[test]
+    fn a_panicking_build_leaves_lookups_finding_nothing() {
+        let (sent, received) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let request = FallbackRequest { cluster: "ع", family: &FontFamily::Proportional };
+            let found = Lookup::new(&PANICS, (), true).font_for(&request).is_some();
+            let _ = sent.send(found);
+        });
+        let found = received.recv_timeout(Duration::from_secs(10));
+        assert_eq!(found, Ok(false), "a waiting lookup returns once the build has failed");
+        let request = FallbackRequest { cluster: "ع", family: &FontFamily::Proportional };
+        assert!(Lookup::new(&PANICS, (), false).font_for(&request).is_none());
+        assert!(Lookup::new(&PANICS, (), true).font_for(&request).is_none());
+    }
+}
diff --git a/crates/ui/src/fonts/system_index.rs b/crates/ui/src/fonts/system_index.rs
new file mode 100644
index 00000000..1058e08f
--- /dev/null
+++ b/crates/ui/src/fonts/system_index.rs
@@ -0,0 +1,157 @@
+//! The installed fonts, indexed once with fontique for every locale. The lookup is
+//! egui_system_font_provider 0.37's, whose provider builds its own index per locale.
+
+use std::sync::{Arc, LazyLock};
+
+use egui::{FallbackRequest, FontData, FontFamily, FontInsert, FontPriority, FontProvider, InsertFontFamily};
+use fontique::{
+    Collection, CollectionOptions, FallbackKey, GenericFamily, Language, QueryFamily, QueryFont, QueryStatus, Script, SourceCache, SourceCacheOptions,
+};
+
+use super::system::{FontIndex, Lookup, Shared};
+
+pub(super) struct Index {
+    collection: Collection,
+    source_cache: SourceCache,
+}
+
+static INDEX: Shared<Index> = Shared::new(build);
+
+#[cfg(test)]
+pub(super) static BUILDS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+
+fn build() -> Index {
+    #[cfg(test)]
+    BUILDS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    Index {
+        collection: Collection::new(CollectionOptions { shared: false, system_fonts: true }),
+        source_cache: SourceCache::new(SourceCacheOptions::default()),
+    }
+}
+
+/// A provider over the shared index that prefers `locale`'s fonts. With `wait`, a lookup before the
+/// index is built blocks until it is; without, it finds nothing (see [`start`]).
+pub(super) fn provider(locale: &str, wait: bool) -> Arc<dyn FontProvider> {
+    Arc::new(Lookup::new(&INDEX, locale_language(locale), wait))
+}
+
+/// The language a locale prefers fonts for: a language tag (`zh-Hant`) or a POSIX locale
+/// (`zh_TW.UTF-8`). `C`, `POSIX` and anything else without a language prefer none.
+pub(super) fn locale_language(locale: &str) -> Option<Language> {
+    let tag = locale.split(['.', '@']).next().unwrap_or_default();
+    if matches!(tag, "C" | "POSIX") {
+        return None;
+    }
+    Language::parse(tag).ok()
+}
+
+/// Start building the index in the background. `ctx` reloads its fonts once it is built if a
+/// lookup found nothing meanwhile.
+pub(super) fn start(ctx: &egui::Context) {
+    INDEX.start(Some(ctx));
+}
+
+impl FontIndex for Index {
+    type Locale = Option<Language>;
+
+    fn font_for(&mut self, request: &FallbackRequest<'_>, locale: &Option<Language>) -> Option<FontInsert> {
+        let FallbackRequest { cluster, family } = request;
+        let base_char = cluster.chars().next()?;
+        let Self { collection, source_cache } = self;
+        let generic = match family {
+            FontFamily::Monospace => GenericFamily::Monospace,
+            FontFamily::Proportional | FontFamily::Name(_) => GenericFamily::SansSerif,
+        };
+
+        let font = if let Some(script) = script_of(base_char) {
+            // A script's fallback can be one locale's font, e.g. a Japanese font for Han that
+            // lacks many Simplified Chinese characters, so the script's other locales follow.
+            std::iter::once(locale.as_ref()).chain(other_locales(script).iter().map(Some)).find_map(|locale| {
+                let mut query = collection.query(source_cache);
+                query.set_families([QueryFamily::Generic(generic)]);
+                query.set_fallbacks(fallback_key(script, locale));
+                find_font(&mut query, base_char)
+            })
+        } else {
+            // Punctuation, symbols and emoji belong to no script and have no fallback.
+            let mut query = collection.query(source_cache);
+            query.set_families(
+                [generic, GenericFamily::SystemUi, GenericFamily::Emoji, GenericFamily::Math, GenericFamily::Serif, GenericFamily::Monospace]
+                    .map(QueryFamily::Generic),
+            );
+            find_font(&mut query, base_char)
+        }?;
+
+        let family_name = collection.family_name(font.family.0).unwrap_or("unknown");
+        let name = format!("system:{family_name}:{}:{}", font.family.1, font.index);
+        let (blob, _) = font.blob.into_raw_parts();
+        Some(FontInsert {
+            name,
+            data: FontData::from_blob(blob, font.index),
+            families: vec![InsertFontFamily { family: (*family).clone(), priority: FontPriority::Lowest }],
+        })
+    }
+}
+
+/// The first font in the query that can draw `c`.
+fn find_font(query: &mut fontique::Query<'_>, c: char) -> Option<QueryFont> {
+    let mut found = None;
+    query.matches_with(|font| {
+        if can_render(font, c) {
+            found = Some(font.clone());
+            QueryStatus::Stop
+        } else {
+            QueryStatus::Continue
+        }
+    });
+    found
+}
+
+const HAN: Script = Script::from_bytes(*b"Hani");
+
+/// The locales of the Han fonts, Simplified Chinese first. That is `zh-SG` rather than `zh-CN`:
+/// fontique's default Han locale is `zh-CN`, whose font is whatever the first locale-less Han
+/// lookup returned, often the Japanese one.
+static HAN_LOCALES: LazyLock<Vec<Language>> =
+    LazyLock::new(|| ["zh-SG", "zh-TW", "ja", "ko"].iter().filter_map(|locale| Language::parse(locale).ok()).collect());
+
+fn fallback_key(script: Script, locale: Option<&Language>) -> FallbackKey {
+    let locale = match locale {
+        Some(locale) if script == HAN && is_simplified_chinese(locale) => HAN_LOCALES.first(),
+        locale => locale,
+    };
+    FallbackKey::new(script, locale)
+}
+
+/// `zh`, `zh-CN`, `zh-Hans` and the like, as fontique tells Simplified from Traditional Chinese.
+fn is_simplified_chinese(locale: &Language) -> bool {
+    locale.language() == "zh" && locale.script() != Some("Hant") && !matches!(locale.region(), Some("HK" | "TW" | "MO"))
+}
+
+/// Only Han needs other locales: its fonts are per locale, each with different characters.
+fn other_locales(script: Script) -> &'static [Language] {
+    if script == HAN { &HAN_LOCALES } else { &[] }
+}
+
+/// The script of a character, `None` for characters shared between scripts.
+fn script_of(c: char) -> Option<Script> {
+    use unicode_script::UnicodeScript as _;
+    match c.script() {
+        unicode_script::Script::Common | unicode_script::Script::Inherited | unicode_script::Script::Unknown => None,
+        script => Script::parse(script.short_name()).ok(),
+    }
+}
+
+/// Whether the font has an outline, bitmap or colour glyph for `c`.
+fn can_render(font: &QueryFont, c: char) -> bool {
+    use skrifa::MetadataProvider as _;
+    let Some(glyph_id) = font.charmap().and_then(|charmap| charmap.map(c)) else { return false };
+    let glyph_id = skrifa::GlyphId::new(glyph_id);
+    if glyph_id == skrifa::GlyphId::NOTDEF {
+        return false;
+    }
+    let Ok(font_ref) = skrifa::FontRef::from_index(font.blob.as_ref(), font.index) else { return false };
+    font_ref.outline_glyphs().get(glyph_id).is_some()
+        || font_ref.color_glyphs().get(glyph_id).is_some()
+        || font_ref.bitmap_strikes().glyph_for_size(skrifa::instance::Size::unscaled(), glyph_id).is_some()
+}
diff --git a/crates/ui/src/fonts/tests.rs b/crates/ui/src/fonts/tests.rs
new file mode 100644
index 00000000..06439c79
--- /dev/null
+++ b/crates/ui/src/fonts/tests.rs
@@ -0,0 +1,1026 @@
+use super::*;
+use egui::{FallbackRequest, FontInsert, FontPriority, InsertFontFamily, TextStyle};
+use std::sync::Mutex;
+
+const ARABIC: &[u8] = include_bytes!("../../tests/fonts/NotoSansArabic-test.ttf");
+/// Noto Sans with Vietnamese ổ but not ẫ.
+const NOTO_SANS_LATIN: &[u8] = include_bytes!("../../tests/fonts/NotoSans-test.ttf");
+/// Noto Sans Symbols' ⌃ ⎋ and Noto Sans Symbols 2's ⌥ ⌫ ⏎: the keyboard keys are split between them.
+const SYMBOLS: &[u8] = include_bytes!("../../tests/fonts/NotoSansSymbols-test.ttf");
+const SYMBOLS_2: &[u8] = include_bytes!("../../tests/fonts/NotoSansSymbols2-test.ttf");
+const CJK: &[u8] = include_bytes!("../../tests/fonts/NotoSansCJKsc-test.otf");
+
+const OFFERED: &[&str] = &["en", "ar", "ja", "zh-CN", "zh-TW", "zh-HK", "ko", "th", "ka", "ru"];
+
+const fn face(family: &'static str, style: &'static str, scripts: &'static [&'static str]) -> CraftFace {
+    CraftFace { family, style, scripts, bytes: &[], index: 0 }
+}
+
+/// craft-fonts' manifest today, plus the regional CJK faces and Georgian it is planned to have.
+const CRAFT: &[CraftFace] = &[
+    face("Shippori Mincho", "Regular", &["Jpan", "Latn"]),
+    face("BIZ UDPGothic", "Regular", &["Jpan", "Latn"]),
+    face("BIZ UDPGothic", "Bold", &["Jpan", "Latn"]),
+    face("Noto Sans CJK SC", "Regular", &["Hans", "Latn"]),
+    face("Noto Sans CJK TC", "Regular", &["Hant", "Latn"]),
+    face("Noto Sans CJK HK", "Regular", &["Hant-HK", "Latn"]),
+    face("Noto Sans CJK KR", "Regular", &["Kore", "Latn"]),
+    face("Noto Sans Arabic", "Regular", &["Arab"]),
+    face("Noto Sans Thai", "Regular", &["Thai"]),
+    face("Noto Sans Georgian", "Regular", &["Geor"]),
+];
+
+fn fonts(ui_language: &str) -> UiFonts<'static> {
+    UiFonts::new(&I18nScripts)
+        .app_face("ui", FontData::from_static(&[]), &[FontFamily::Proportional])
+        .app_face("mono", FontData::from_static(&[]), &[FontFamily::Monospace])
+        .craft_faces(CRAFT)
+        .languages(OFFERED)
+        .ui_language(ui_language)
+        .system_fonts(SystemFonts::Off)
+}
+
+fn head(stack: &Stack, family: &FontFamily, n: usize) -> Vec<String> {
+    stack.chain(family).iter().take(n).cloned().collect()
+}
+
+#[test]
+fn ui_language_face_leads_when_the_app_face_lacks_its_script() {
+    // CJK UIs keep the Latin face first: Han, kana and Hangul fit its rows.
+    let cases: &[(&str, &[&str])] = &[
+        ("ar", &["Noto Sans Arabic Regular", "ui"]),
+        ("ja", &["ui", "BIZ UDPGothic Regular", "Shippori Mincho Regular", "Noto Sans CJK SC Regular"]),
+        ("zh-TW", &["ui", "Noto Sans CJK TC Regular", "Noto Sans CJK HK Regular", "Noto Sans CJK SC Regular"]),
+        ("zh-HK", &["ui", "Noto Sans CJK HK Regular", "Noto Sans CJK TC Regular", "Noto Sans CJK SC Regular"]),
+        ("zh-CN", &["ui", "Noto Sans CJK SC Regular", "Noto Sans CJK TC Regular"]),
+        // craft-fonts' preference for BIZ UDPGothic orders Japanese faces only where they are
+        // the best region: for Korean they keep manifest order.
+        ("ko", &["ui", "Noto Sans CJK KR Regular", "Shippori Mincho Regular", "BIZ UDPGothic Regular"]),
+        ("th", &["Noto Sans Thai Regular", "ui"]),
+        ("ka", &["Noto Sans Georgian Regular", "ui"]),
+        ("ru", &["ui", "Noto Sans Arabic Regular", "BIZ UDPGothic Regular"]),
+        ("en", &["ui", "Noto Sans Arabic Regular", "BIZ UDPGothic Regular"]),
+    ];
+    for (language, want) in cases {
+        let stack = fonts(language).stack();
+        assert_eq!(head(&stack, &FontFamily::Proportional, want.len()), *want, "{language}");
+        // Monospace keeps the app's face first, so code and numbers stay aligned.
+        assert_eq!(stack.chain(&FontFamily::Monospace).first().map(String::as_str), Some("mono"), "{language}");
+    }
+}
+
+#[test]
+fn families_without_app_faces_start_with_egui_defaults() {
+    let defaults = FontDefinitions::default();
+    let first = |family: &FontFamily| defaults.families.get(family).and_then(|c| c.first()).cloned().expect("egui default_fonts in dev-dependencies");
+    let (egui_ui, egui_mono) = (first(&FontFamily::Proportional), first(&FontFamily::Monospace));
+    let only_ui = |language| fonts_without_faces(language).app_face("ui", FontData::from_static(&[]), &[FontFamily::Proportional]).stack();
+    let no_faces = |language| fonts_without_faces(language).stack();
+
+    let stack = only_ui("en");
+    assert_eq!(head(&stack, &FontFamily::Proportional, 2), ["ui", "Noto Sans Arabic Regular"]);
+    assert_eq!(head(&stack, &FontFamily::Monospace, 1), [egui_mono.as_str()], "egui's mono face, not a craft face");
+    let stack = only_ui("ar");
+    assert_eq!(head(&stack, &FontFamily::Proportional, 2), ["Noto Sans Arabic Regular", "ui"]);
+    assert_eq!(head(&stack, &FontFamily::Monospace, 1), [egui_mono.as_str()]);
+
+    // egui's defaults come right after the UI language's faces and before other scripts.
+    for (language, lead) in [("en", None), ("ar", Some("Noto Sans Arabic Regular"))] {
+        let stack = no_faces(language);
+        let chain = stack.chain(&FontFamily::Proportional);
+        let egui_at = chain.iter().position(|n| *n == egui_ui).expect("egui's face");
+        assert_eq!(chain.first().map(String::as_str), Some(lead.unwrap_or(&egui_ui)), "{language}");
+        let other = if lead.is_some() { "BIZ UDPGothic Regular" } else { "Noto Sans Arabic Regular" };
+        assert!(chain.iter().position(|n| n == other) > Some(egui_at), "{language}: {chain:?}");
+        assert_eq!(head(&stack, &FontFamily::Monospace, 1), [egui_mono.as_str()], "{language}");
+    }
+}
+
+fn fonts_without_faces(ui_language: &str) -> UiFonts<'static> {
+    UiFonts::new(&I18nScripts).craft_faces(CRAFT).languages(OFFERED).ui_language(ui_language).system_fonts(SystemFonts::Off)
+}
+
+#[test]
+fn craft_preference_orders_the_best_region_only() {
+    // With only Japanese faces, they are the best Han region a Taiwanese UI has.
+    let stack = UiFonts::new(&I18nScripts).craft_faces(&CRAFT[..3]).ui_language("zh-TW").system_fonts(SystemFonts::Off).stack();
+    let chain = stack.chain(&FontFamily::Proportional);
+    let at = |name: &str| chain.iter().position(|n| n == name);
+    assert!(at("BIZ UDPGothic Regular") < at("Shippori Mincho Regular"), "{chain:?}");
+}
+
+#[test]
+fn every_shipped_face_is_in_every_stack() {
+    for language in OFFERED {
+        let stack = fonts(language).stack();
+        let chain = stack.chain(&FontFamily::Proportional);
+        for face in CRAFT.iter().filter(|f| f.style == "Regular") {
+            assert!(chain.contains(&face.name()), "{language}: {} missing", face.name());
+        }
+        assert!(!chain.contains(&"BIZ UDPGothic Bold".to_owned()), "{language}: bold face in the regular chain");
+    }
+}
+
+#[test]
+fn app_can_prefer_add_replace_and_reorder_faces() {
+    let stack = fonts("ja").prefer("Jpan", "Shippori Mincho").stack();
+    assert_eq!(head(&stack, &FontFamily::Proportional, 3), ["ui", "Shippori Mincho Regular", "BIZ UDPGothic Regular"]);
+
+    // An app whose UI face covers Arabic keeps it first.
+    let stack = fonts("ar").app_scripts(&["Latn", "Arab"]).stack();
+    assert!(stack.script_face.is_none(), "{:?}", stack.script_face);
+    assert_eq!(head(&stack, &FontFamily::Proportional, 1), ["ui"]);
+    assert!(stack.chain(&FontFamily::Proportional).contains(&"Noto Sans Arabic Regular".to_owned()));
+
+    let mut stack = fonts("en").stack();
+    stack.insert(&FontFamily::Proportional, 1, "brand", FontData::from_static(&[]));
+    stack.remove("Noto Sans Arabic Regular");
+    assert_eq!(head(&stack, &FontFamily::Proportional, 3), ["ui", "brand", "BIZ UDPGothic Regular"]);
+    stack.insert(&FontFamily::Proportional, 0, "BIZ UDPGothic Regular", FontData::from_static(&[]));
+    assert_eq!(head(&stack, &FontFamily::Proportional, 3), ["BIZ UDPGothic Regular", "ui", "brand"]);
+    let definitions = stack.checked_definitions();
+    assert!(!definitions.families.values().flatten().any(|n| n == "Noto Sans Arabic Regular"));
+}
+
+#[test]
+fn named_families_take_their_weight_and_lead_script() {
+    let stack = fonts("ja")
+        .app_face("ui-semibold", FontData::from_static(&[]), &[FontFamily::Name("semibold".into())])
+        .family(Family::named("semibold").weight(600))
+        .family(Family::named("arabic").script("Arab"))
+        .family(Family::monospace().weight(500))
+        .stack();
+    assert!(stack.weights().contains(&(FontFamily::Monospace, 500)));
+    let semibold = FontFamily::Name("semibold".into());
+    assert_eq!(head(&stack, &semibold, 3), ["ui-semibold", "BIZ UDPGothic Bold", "BIZ UDPGothic Regular"]);
+    // A family without an app face of its own falls back to the proportional faces.
+    let arabic = FontFamily::Name("arabic".into());
+    assert_eq!(head(&stack, &arabic, 3), ["Noto Sans Arabic Regular", "ui", "BIZ UDPGothic Regular"]);
+}
+
+#[test]
+fn monospaced_named_families_keep_their_latin_face_first() {
+    // Georgian's own face leads the text families; the monospaced ones keep their app face.
+    let (code, console, plain) = (FontFamily::Name("code".into()), FontFamily::Name("console".into()), FontFamily::Name("plain".into()));
+    let stack = fonts("ka")
+        .app_face("code-face", FontData::from_static(&[]), std::slice::from_ref(&code))
+        .family(Family::named("code").monospaced())
+        .family(Family::named("console").monospaced())
+        .family(Family::named("plain"))
+        .stack();
+    assert_eq!(head(&stack, &code, 2), ["code-face", "Noto Sans Georgian Regular"]);
+    assert_eq!(head(&stack, &console, 2), ["mono", "Noto Sans Georgian Regular"], "the monospace app faces");
+    assert_eq!(head(&stack, &plain, 2), ["Noto Sans Georgian Regular", "ui"]);
+
+    let egui_mono = FontDefinitions::default().families[&FontFamily::Monospace][0].clone();
+    let stack = fonts_without_faces("ka").family(Family::named("console").monospaced()).stack();
+    assert_eq!(head(&stack, &console, 1), [egui_mono], "egui's mono face");
+}
+
+#[test]
+fn system_fonts_before_craft_moves_other_scripts_after_them() {
+    let emoji = Emoji { color: Some(FontData::from_static(&[])), monochrome: Some(FontData::from_static(&[])), ..Emoji::default() };
+    let stack = fonts("ja").system_fonts(SystemFonts::BeforeCraft).emoji(emoji).stack();
+    let configured = stack.chain(&FontFamily::Proportional);
+    assert!(configured.contains(&"BIZ UDPGothic Regular".to_owned()));
+    assert!(!configured.contains(&"Noto Sans Arabic Regular".to_owned()));
+    let after = stack.after_system.chain(&FontFamily::Proportional);
+    let position = |name: &str| after.iter().position(|n| n == name);
+    let (arabic, color, mono) = (position("Noto Sans Arabic Regular"), position("emoji-color"), position("emoji-monochrome"));
+    assert!(arabic.is_some() && arabic < color && color < mono, "{after:?}");
+}
+
+fn test_stack(ui_language: &str) -> Stack {
+    test_fonts(ui_language).stack()
+}
+
+fn test_fonts(ui_language: &str) -> UiFonts<'static> {
+    let defaults = FontDefinitions::default();
+    let ubuntu = defaults.font_data.get("Ubuntu-Light").map(|d| (**d).clone()).expect("egui default_fonts in dev-dependencies");
+    UiFonts::new(&I18nScripts)
+        .app_face("ui", ubuntu, &[FontFamily::Proportional])
+        .craft_faces(&[
+            CraftFace { family: "Noto Sans Arabic", style: "Regular", scripts: &["Arab"], bytes: ARABIC, index: 0 },
+            CraftFace { family: "Noto Sans CJK SC", style: "Regular", scripts: &["Hans", "Latn"], bytes: CJK, index: 0 },
+        ])
+        .languages(&["en", "ar", "ja", "ka"])
+        .ui_language(ui_language)
+        .system_fonts(SystemFonts::Off)
+}
+
+#[test]
+fn craft_faces_come_from_embedded_faces() {
+    let embedded = craft_fonts_build::EmbeddedFace { family: "Noto Sans Arabic", style: "Regular", scripts: &["Arab"], index: 2, bytes: ARABIC };
+    let face = CraftFace::from(embedded);
+    assert_eq!((face.name().as_str(), face.scripts, face.index, face.bytes.len()), ("Noto Sans Arabic Regular", &["Arab"][..], 2, ARABIC.len()));
+}
+
+#[test]
+fn coverage_names_language_string_and_character() {
+    let stack = test_stack("en");
+    let samples = [
+        // With U+061C ARABIC LETTER MARK and U+034F COMBINING GRAPHEME JOINER, which draw nothing.
+        Sample { language: "ar", key: "menu.file", text: "ملف\u{061C} عر\u{034F}بي" },
+        Sample { language: "ja", key: "menu.file", text: "日本語のファイル" },
+        Sample { language: "ka", key: "menu.file", text: "ფაილი" },
+    ];
+    let missing = missing_glyphs(&stack, &FontFamily::Proportional, samples, false);
+    let chars: Vec<char> = missing.iter().map(|m| m.character).collect();
+    assert_eq!(chars, ['ფ', 'ა', 'ი', 'ლ']);
+    assert!(missing.iter().all(|m| m.language == "ka" && m.key == "menu.file"));
+    assert_eq!(missing[0].to_string(), "ka menu.file: U+10E4 'ფ' in \"ფაილი\"");
+
+    let failure = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| assert_covers(&stack, samples))).expect_err("Georgian has no face");
+    let message = failure.downcast_ref::<String>().cloned().unwrap_or_default();
+    assert!(message.contains("4 characters") && message.contains("ka menu.file: U+10E4"), "{message}");
+
+    assert_covers(&stack, samples.into_iter().take(2));
+}
+
+#[test]
+fn a_latin_ui_takes_letters_its_face_lacks_from_a_latin_craft_face() {
+    const NOTO_SANS: &[u8] = include_bytes!("../../tests/fonts/NotoSans-test.ttf");
+    let cjk = CraftFace { family: "Noto Sans CJK SC", style: "Regular", scripts: &["Hans", "Latn"], bytes: CJK, index: 0 };
+    let noto_sans = CraftFace { family: "Noto Sans", style: "Regular", scripts: &["Latn", "Cyrl", "Grek", "Deva"], bytes: NOTO_SANS, index: 0 };
+    let defaults = FontDefinitions::default();
+    let ubuntu = defaults.font_data.get("Ubuntu-Light").expect("egui default_fonts in dev-dependencies");
+    assert!(!providers::has_char(ubuntu, 'ổ') && !providers::has_char(ubuntu, 'ạ'));
+    let vietnamese = [Sample { language: "vi", key: "menu.file", text: "Tiếng Việt ổ ư ạ" }];
+    let stack = |faces: &[CraftFace]| {
+        UiFonts::new(&I18nScripts).craft_faces(faces).languages(&["en", "vi", "zh-CN"]).ui_language("vi").system_fonts(SystemFonts::Off).stack()
+    };
+
+    let without = stack(&[cjk]);
+    assert!(missing_glyphs(&without, &FontFamily::Proportional, vietnamese, false).iter().any(|m| m.character == 'ổ'));
+    let with = stack(&[cjk, noto_sans]);
+    assert_covers(&with, vietnamese);
+    // Noto Sans CJK has Vietnamese letters too, at CJK proportions: Noto Sans comes first.
+    let chain = with.chain(&FontFamily::Proportional);
+    let at = |name: &str| chain.iter().position(|n| n == name).unwrap_or(usize::MAX);
+    assert!(at("Ubuntu-Light") < at("Noto Sans Regular") && at("Noto Sans Regular") < at("Noto Sans CJK SC Regular"), "{chain:?}");
+}
+
+#[test]
+fn remove_and_replace_reach_the_faces_after_the_system_fonts() {
+    let arabic = [Sample { language: "ar", key: "menu.file", text: "ملف" }];
+    let stack = || test_fonts("en").system_fonts(SystemFonts::BeforeCraft).stack();
+    let draws_arabic = |stack: &Stack| missing_glyphs(stack, &FontFamily::Proportional, arabic, false).is_empty();
+    let mut removed = stack();
+    assert!(removed.after_system.contains("Noto Sans Arabic Regular"));
+    assert!(draws_arabic(&removed));
+    removed.remove("Noto Sans Arabic Regular");
+    assert!(!draws_arabic(&removed));
+    let mut replaced = stack();
+    replaced.replace("Noto Sans Arabic Regular", FontData::from_static(CJK));
+    assert!(!draws_arabic(&replaced));
+}
+
+#[test]
+fn flat_definitions_end_each_chain_with_the_faces_after_the_system_fonts() {
+    let stack = test_fonts("en").emoji(Emoji { monochrome: Some(FontData::from_static(CJK)), ..Emoji::default() }).stack();
+    let after: Vec<String> = stack.after_system.chain(&FontFamily::Proportional).to_vec();
+    assert!(after.iter().any(|n| n == "egui-icons") && after.iter().any(|n| n == "emoji-monochrome"), "{after:?}");
+    let names: Vec<&str> = stack.after_system.faces().map(|(name, _)| name).collect();
+    assert!(after.iter().all(|n| names.contains(&n.as_str())), "{names:?}");
+    assert_eq!(stack.after_system.get("emoji-monochrome").map(|d| d.bytes().len()), Some(CJK.len()));
+
+    let flat = stack.flat_definitions();
+    let chain = &flat.families[&FontFamily::Proportional];
+    assert_eq!(chain[..stack.chain(&FontFamily::Proportional).len()], *stack.chain(&FontFamily::Proportional));
+    assert!(chain.ends_with(&after), "{chain:?}");
+    assert!(chain.iter().all(|n| flat.font_data.contains_key(n)));
+    assert!(flat.families[&FontFamily::Monospace].ends_with(stack.after_system.chain(&FontFamily::Monospace)));
+}
+
+#[test]
+fn face_list_prefers_a_face_with_the_whole_cluster() {
+    let defaults = FontDefinitions::default();
+    let mut faces = FaceList::default();
+    for name in ["Ubuntu-Light", "Hack"] {
+        faces.insert(name, (**defaults.font_data.get(name).expect("egui default_fonts in dev-dependencies")).clone());
+    }
+    faces.set_chain(FontFamily::Proportional, vec!["Ubuntu-Light".into(), "Hack".into()]);
+    let face = |cluster| faces.font_for(&FallbackRequest { cluster, family: &FontFamily::Proportional }).map(|insert| insert.name);
+    assert_eq!(face("a").as_deref(), Some("Ubuntu-Light"));
+    // Only Hack has U+0301 COMBINING ACUTE ACCENT, and neither has U+0302.
+    assert_eq!(face("a\u{0301}").as_deref(), Some("Hack"));
+    assert_eq!(face("a\u{0302}").as_deref(), Some("Ubuntu-Light"));
+}
+
+#[test]
+fn installed_text_faces_sit_on_the_baseline_but_emoji_and_symbols_do_not() {
+    fn patched(edits: &[(&[u8], &[u8])]) -> FontData {
+        let mut bytes = ARABIC.to_vec();
+        for (from, to) in edits {
+            let at = bytes.windows(from.len()).position(|w| w == *from).expect("in the test face");
+            bytes[at..at + to.len()].copy_from_slice(to);
+        }
+        FontData::from_owned(bytes)
+    }
+    let utf16 = |s: &str| s.encode_utf16().flat_map(u16::to_be_bytes).collect::<Vec<u8>>();
+    let name = "system-fallback";
+    assert!(providers::is_text_face(name, &FontData::from_static(ARABIC)));
+    // A face with colour glyphs: the table directory names a COLR table.
+    assert!(!providers::is_text_face(name, &patched(&[(b"post", b"COLR")])));
+    // By the face's own family name, "Noto Sans Symbol", whatever the provider calls it.
+    let (arabic, symbol) = (utf16("Arabic"), utf16("Symbol"));
+    assert!(!providers::is_text_face(name, &patched(&[(&arabic, &symbol)])));
+    assert!(!providers::is_text_face("system:Segoe UI Emoji:0:0", &FontData::from_static(ARABIC)));
+}
+
+#[test]
+fn variable_faces_draw_at_regular_weight() {
+    // The Arabic test face's default instance is Thin (100), like many variable system fonts.
+    let thin = || FontData::from_static(ARABIC);
+    let wght = |data: &FontData| data.tweak.coords.as_ref().iter().find(|(t, _)| *t == egui::epaint::text::Tag::new(b"wght")).map(|(_, v)| *v);
+    assert_eq!(wght(&thin()), None);
+
+    let provider = move |request: &FallbackRequest<'_>| {
+        Some(FontInsert::new("system:Arabic", thin(), vec![InsertFontFamily { family: request.family.clone(), priority: FontPriority::Lowest }]))
+    };
+    let wrapped = RegularWeight::new(Arc::new(provider)).with_weight(FontFamily::Name("bold".into()), 700);
+    let regular = wrapped.font_for(&FallbackRequest { cluster: "ع", family: &FontFamily::Proportional }).expect("found");
+    assert_eq!((regular.name.as_str(), wght(&regular.data)), ("system:Arabic", Some(400.0)));
+    let bold = wrapped.font_for(&FallbackRequest { cluster: "ع", family: &FontFamily::Name("bold".into()) }).expect("found");
+    assert_eq!((bold.name.as_str(), wght(&bold.data)), ("system:Arabic @700", Some(700.0)));
+
+    // Craft faces get the same treatment, and a weight the app set stays.
+    let stack = test_stack("ar");
+    assert_eq!(stack.definitions.font_data.get("Noto Sans Arabic Regular").map(|d| wght(d)), Some(Some(400.0)));
+    let mut set = thin();
+    set.tweak.coords.push(*b"wght", 300.0);
+    assert!(!set_weight(&mut set, 400));
+}
+
+#[test]
+fn widgets_grow_by_how_much_taller_the_script_face_rows_are() {
+    let mut style = Style::default();
+    style.spacing.button_padding.y = 5.0;
+    let before = style.spacing.interact_size.y;
+    test_stack("en").fit_interact_size(&mut style);
+    assert_eq!(style.spacing.interact_size.y, before, "Latin rows keep the theme's height, whatever its padding");
+
+    let body = style.text_styles.get(&TextStyle::Body).cloned().expect("body style");
+    let row = |stack: &Stack| stack.fonts(false).with_pixels_per_point(1.0).row_height(&body);
+    let arabic = test_stack("ar");
+    let extra = row(&arabic) - row(&test_stack("en"));
+    assert!(extra > 0.0, "Arabic rows are taller");
+    arabic.fit_interact_size(&mut style);
+    assert!((style.spacing.interact_size.y - (before + extra)).abs() < 0.01, "{} + {extra}", before);
+}
+
+#[test]
+fn the_fit_is_the_same_whether_the_theme_comes_before_or_after_install() {
+    let theme = |ctx: &egui::Context| {
+        ctx.all_styles_mut(|s| {
+            s.spacing.interact_size.y = 20.0;
+            s.spacing.button_padding.y = 5.0;
+        });
+    };
+    let pass = |ctx: &egui::Context| ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
+    let height = |ctx: &egui::Context| ctx.style_of(egui::Theme::Dark).spacing.interact_size.y;
+    for language in ["en", "ar"] {
+        let before = egui::Context::default();
+        theme(&before);
+        test_stack(language).install(&before);
+        let after = egui::Context::default();
+        test_stack(language).install(&after);
+        theme(&after);
+        pass(&after);
+        assert_eq!(height(&after), height(&before), "{language}");
+        assert_eq!(height(&after) == 20.0, language == "en", "{language}: {}", height(&after));
+        // Passes without a new theme leave the fit as it is.
+        pass(&after);
+        assert_eq!(height(&after), height(&before), "{language}");
+    }
+}
+
+#[test]
+fn cjk_uis_keep_the_rows_and_widgets_of_a_latin_ui() {
+    let latin_only = || {
+        let ubuntu = FontDefinitions::default().font_data.get("Ubuntu-Light").map(|d| (**d).clone()).expect("egui default_fonts");
+        UiFonts::new(&I18nScripts).app_face("ui", ubuntu, &[FontFamily::Proportional]).system_fonts(SystemFonts::Off).stack()
+    };
+    let interact = |stack: &Stack| {
+        let ctx = egui::Context::default();
+        stack.install(&ctx);
+        ctx.style_of(egui::Theme::Dark).spacing.interact_size.y
+    };
+    let latin = latin_only();
+    for language in ["ja", "ko", "zh-CN", "en"] {
+        let stack = test_stack(language);
+        assert_eq!(stack.chain(&FontFamily::Proportional).first().map(String::as_str), Some("ui"), "{language}");
+        assert_eq!(interact(&stack), interact(&latin), "{language}");
+        for (size, ppp) in [(14.0, 1.0), (13.0, 1.5), (40.0, 2.0)] {
+            let font = FontId::proportional(size);
+            let layout = |stack: &Stack, text: &str| {
+                stack.fonts(false).with_pixels_per_point(ppp).layout_no_wrap(text.to_owned(), font.clone(), egui::Color32::WHITE)
+            };
+            let label = layout(&stack, "Ab漢한中");
+            let row = egui::Rect::from_x_y_ranges(label.rect.x_range(), layout(&latin, "Ab").rect.y_range());
+            assert_eq!(label.rect.height(), row.height(), "{language} at {size} pt");
+            // Rasterised glyphs reach at most a pixel past their outlines.
+            assert!(row.expand(1.0 / ppp).contains_rect(label.mesh_bounds), "{language} at {size} pt: {:?} in {row:?}", label.mesh_bounds);
+        }
+    }
+}
+
+#[test]
+fn cjk_glyphs_sit_on_the_latin_baseline() {
+    let stack = test_stack("ja");
+    let face = stack.definitions.font_data.get("Noto Sans CJK SC Regular").expect("CJK face");
+    let (above, below) = fit::ink_extent(face, "中");
+    let size = 40.0;
+    let layout =
+        |text: &str| stack.fonts(false).with_pixels_per_point(1.0).layout_no_wrap(text.to_owned(), FontId::proportional(size), egui::Color32::WHITE);
+    let baseline = layout("A").rows[0].glyphs[0].pos.y;
+    let ink = layout("中").mesh_bounds;
+    let scaled = face.tweak.scale * size;
+    assert!((ink.max.y - (baseline + below * scaled)).abs() <= 1.0, "bottom {} vs baseline {baseline} + {}", ink.max.y, below * scaled);
+    assert!((ink.min.y - (baseline - above * scaled)).abs() <= 1.0, "top {} vs baseline {baseline} - {}", ink.min.y, above * scaled);
+}
+
+#[test]
+fn cjk_rows_grow_only_when_the_app_asks() {
+    let mut style = Style::default();
+    let before = style.spacing.interact_size.y;
+    test_fonts("ja").cjk_rows(CjkRows::Grow).stack().fit_interact_size(&mut style);
+    assert!(style.spacing.interact_size.y > before, "CJK rows are taller than the Latin face's");
+}
+
+#[test]
+fn installing_another_language_refits_widgets() {
+    let ctx = egui::Context::default();
+    let before = ctx.style_of(egui::Theme::Dark).spacing.interact_size.y;
+    test_stack("ar").install(&ctx);
+    let arabic = ctx.style_of(egui::Theme::Dark).spacing.interact_size.y;
+    assert!(arabic > before);
+    test_stack("en").install(&ctx);
+    assert_eq!(ctx.style_of(egui::Theme::Dark).spacing.interact_size.y, before, "back to the style's own height");
+    assert_eq!(ctx.style_of(egui::Theme::Light).spacing.interact_size.y, before);
+    // A height the app set after installing stays.
+    ctx.all_styles_mut(|s| s.spacing.interact_size.y = 40.0);
+    test_stack("ar").install(&ctx);
+    test_stack("en").install(&ctx);
+    assert_eq!(ctx.style_of(egui::Theme::Dark).spacing.interact_size.y, 40.0);
+}
+
+#[test]
+fn install_keeps_the_context_providers_unless_it_brings_a_system_lookup() {
+    let arabic = |_: &FallbackRequest<'_>| {
+        Some(FontInsert::new(
+            "host:Arabic",
+            FontData::from_static(ARABIC),
+            vec![InsertFontFamily { family: FontFamily::Proportional, priority: FontPriority::Lowest }],
+        ))
+    };
+    let draws_arabic = |system: SystemFonts| {
+        let ctx = egui::Context::default();
+        ctx.add_font_provider(Arc::new(arabic));
+        let defaults = FontDefinitions::default();
+        let ubuntu = defaults.font_data.get("Ubuntu-Light").map(|d| (**d).clone()).expect("egui default_fonts");
+        let stack = UiFonts::new(&I18nScripts).app_face("ui", ubuntu, &[FontFamily::Proportional]).system_fonts(system).stack();
+        stack.install(&ctx);
+        stack.install(&ctx);
+        ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
+        ctx.fonts_mut(|f| f.has_glyph(&FontId::proportional(14.0), 'ع'))
+    };
+    assert!(!draws_arabic(SystemFonts::Off), "Off asks no system fonts");
+    if cfg!(not(all(feature = "system_fonts", not(target_arch = "wasm32")))) {
+        assert!(draws_arabic(SystemFonts::AfterCraft), "the host's provider stays");
+    }
+}
+
+#[cfg(all(feature = "system_fonts", not(target_arch = "wasm32")))]
+#[test]
+fn the_system_provider_is_shared_per_locale() {
+    let (a, b) = (system_font_provider("ja"), system_font_provider("ja"));
+    assert!(a.zip(b).is_some_and(|(a, b)| Arc::ptr_eq(&a, &b)));
+}
+
+#[cfg(all(feature = "system_fonts", not(target_arch = "wasm32")))]
+#[test]
+fn c_and_posix_locales_prefer_no_language() {
+    use system_index::locale_language;
+    for locale in ["C", "POSIX", "C.UTF-8", "C.utf8", "POSIX@euro", ""] {
+        assert_eq!(locale_language(locale), None, "{locale}");
+    }
+    for (locale, tag) in [("zh_TW.UTF-8", "zh-TW"), ("sr_RS@latin", "sr-RS"), ("zh-Hant", "zh-Hant")] {
+        assert_eq!(locale_language(locale).map(|l| l.to_string()).as_deref(), Some(tag), "{locale}");
+    }
+}
+
+#[cfg(all(feature = "system_fonts", not(target_arch = "wasm32")))]
+#[test]
+fn every_locale_asks_one_index_of_the_installed_fonts() {
+    let request = FallbackRequest { cluster: "ب", family: &FontFamily::Proportional };
+    for locale in ["ja", "ar", "zh-CN"] {
+        system_font_provider(locale).and_then(|provider| provider.font_for(&request));
+    }
+    assert_eq!(system_index::BUILDS.load(std::sync::atomic::Ordering::Relaxed), 1);
+}
+
+#[test]
+fn egui_faces_join_the_families_the_app_names() {
+    let semibold = FontFamily::Name("semibold".into());
+    let stack = fonts("en")
+        .family(Family::named("semibold").weight(600))
+        .egui_face("Hack", &[FontFamily::Proportional, semibold.clone()])
+        .egui_face("no such face", &[FontFamily::Proportional])
+        .stack();
+    let proportional = stack.chain(&FontFamily::Proportional);
+    assert_eq!(proportional.last().map(String::as_str), Some("Hack"), "{proportional:?}");
+    assert!(stack.chain(&semibold).iter().any(|n| n == "Hack"));
+    assert!(!stack.chain(&FontFamily::Monospace).iter().any(|n| n == "Hack"), "only the families named");
+    assert!(stack.definitions.font_data.contains_key("Hack"));
+    assert!(!proportional.iter().any(|n| n == "no such face"));
+}
+
+#[test]
+fn covers_language_checks_every_script_of_the_language() {
+    let stack = test_stack("en");
+    for language in ["en", "ar", "ja"] {
+        assert!(stack.covers_language(language, false), "{language}");
+    }
+    assert!(!stack.covers_language("ka", false), "no Georgian face");
+    // Not offered: the scripts come from craft-i18n.
+    assert!(stack.covers_language("zh-CN", false));
+    assert!(!stack.covers_language("th", false));
+}
+
+/// Coverage of every character, for faces whose tests are about scripts.
+const ALL: &[u8] = &[0, 0xFF, 0xFF, 0x43];
+
+const fn served(family: &'static str, style: &'static str, scripts: &'static [&'static str], url: &'static str, index: u32) -> ServedFace {
+    ServedFace { family, style, scripts, index, url, size: 1, integrity: "", coverage: ALL }
+}
+
+fn coverage_of(font: &[u8]) -> &'static [u8] {
+    Box::leak(craft_fonts_build::coverage::of_face(font, 0).expect("a font").into_boxed_slice())
+}
+
+fn coverage_of_chars(chars: &str) -> &'static [u8] {
+    let mut ranges: Vec<(u32, u32)> = chars.chars().map(|c| (u32::from(c), u32::from(c))).collect();
+    ranges.sort_unstable();
+    Box::leak(craft_fonts_build::coverage::encode(&ranges).into_boxed_slice())
+}
+
+/// craft-fonts' faces as a web build serves them; the CJK collection's faces share one file.
+const SERVED: &[ServedFace] = &[
+    served("BIZ UDPGothic", "Regular", &["Jpan", "Latn"], "fonts/biz-ud-pgothic/BIZUDPGothic-Regular.ttf", 0),
+    served("BIZ UDPGothic", "Bold", &["Jpan", "Latn"], "fonts/biz-ud-pgothic/BIZUDPGothic-Bold.ttf", 0),
+    served("Noto Sans CJK SC", "Regular", &["Hans", "Latn"], "fonts/noto-sans-cjk/NotoSansCJK.ttc", 2),
+    served("Noto Sans CJK TC", "Regular", &["Hant", "Latn"], "fonts/noto-sans-cjk/NotoSansCJK.ttc", 3),
+    served("Noto Sans Arabic", "Regular", &["Arab"], "fonts/noto-sans-arabic/NotoSansArabic.ttf", 0),
+    served("Noto Sans Thai", "Regular", &["Thai"], "fonts/noto-sans-thai/NotoSansThai.ttf", 0),
+];
+
+fn web_fonts(ui_language: &str, served: &[ServedFace]) -> UiFonts<'static> {
+    let defaults = FontDefinitions::default();
+    let egui_face = |name: &str| defaults.font_data.get(name).map(|d| (**d).clone()).expect("egui default_fonts in dev-dependencies");
+    UiFonts::new(&I18nScripts)
+        .app_face("ui", egui_face("Ubuntu-Light"), &[FontFamily::Proportional])
+        .app_face("mono", egui_face("Hack"), &[FontFamily::Monospace])
+        .family(Family::named("semibold").weight(600))
+        .served_faces(served)
+        .languages(OFFERED)
+        .ui_language(ui_language)
+        .system_fonts(SystemFonts::Off)
+}
+
+fn names(faces: Vec<&ServedFace>) -> Vec<String> {
+    faces.into_iter().map(ServedFace::name).collect()
+}
+
+#[test]
+fn served_faces_take_the_places_of_embedded_ones_without_data() {
+    let embedded: Vec<CraftFace> = SERVED.iter().map(ServedFace::craft_face).collect();
+    for language in ["en", "ar", "ja", "zh-TW", "th"] {
+        let web = web_fonts(language, SERVED).stack();
+        let desktop = web_fonts(language, &[]).craft_faces(&embedded).stack();
+        for family in [FontFamily::Proportional, FontFamily::Monospace, FontFamily::Name("semibold".into())] {
+            assert_eq!(web.chain(&family), desktop.chain(&family), "{language} {family:?}");
+        }
+        assert!(SERVED.iter().all(|face| !web.definitions.font_data.contains_key(&face.name())), "{language}");
+        assert_eq!(web.served().len(), SERVED.len());
+    }
+    // Served faces count before they are fetched: they are fetched when text needs them.
+    let stack = web_fonts("en", SERVED).stack();
+    assert!(stack.covers_language("ar", false) && stack.covers_language("ja", false));
+    assert!(!stack.covers_language("km", false));
+}
+
+#[test]
+fn the_ui_language_downloads_its_own_faces_first() {
+    let cases: &[(&str, &[&str])] = &[
+        ("en", &[]),
+        ("ru", &[]),
+        ("ar", &["Noto Sans Arabic Regular"]),
+        // The semibold family takes the bold face.
+        ("ja", &["BIZ UDPGothic Regular", "BIZ UDPGothic Bold"]),
+        ("zh-TW", &["Noto Sans CJK TC Regular"]),
+        ("zh-CN", &["Noto Sans CJK SC Regular"]),
+        ("th", &["Noto Sans Thai Regular"]),
+    ];
+    for (language, want) in cases {
+        assert_eq!(names(web_fonts(language, SERVED).stack().ui_downloads()), *want, "{language}");
+    }
+}
+
+#[test]
+fn a_missing_character_downloads_the_face_for_its_script() {
+    let stack = web_fonts("en", SERVED).stack();
+    let regular = FontFamily::Proportional;
+    assert_eq!(names(stack.downloads_for(&regular, 'ع')), ["Noto Sans Arabic Regular"]);
+    // Han follows the offered languages: Japanese before Chinese.
+    assert_eq!(names(stack.downloads_for(&regular, '日'))[..2], ["BIZ UDPGothic Regular", "Noto Sans CJK SC Regular"]);
+    assert_eq!(names(stack.downloads_for(&FontFamily::Name("semibold".into()), 'あ'))[0], "BIZ UDPGothic Bold");
+    // The CJK faces' Latin doesn't stand in for a Latin face.
+    for c in ['a', 'ж', 'λ', '1', 'ổ', '🔍', '⌘'] {
+        assert!(stack.downloads_for(&regular, c).is_empty(), "{c}");
+    }
+    let twemoji = served("Twemoji", "Regular", &[], "fonts/Twemoji.ttf", 0);
+    let stack = web_fonts("en", SERVED).emoji(Emoji { served: Some(twemoji), ..Emoji::default() }).stack();
+    for c in ['🔍', '⌚', '✅', '⭐'] {
+        assert_eq!(names(stack.downloads_for(&regular, c)), ["Twemoji Regular"], "{c}");
+    }
+    assert!(stack.downloads_for(&regular, '⌘').is_empty(), "a symbol, not an emoji");
+    assert!(stack.ui_downloads().is_empty());
+
+    assert_eq!(served::script_of('\u{0600}'), Some("Arab"));
+    assert_eq!(served::script_of('\u{05FF}'), Some("Hebr"));
+    assert_eq!(served::script_of('한'), Some("Hang"));
+    assert_eq!(served::script_of('\u{2F800}'), Some("Hani"));
+    assert_eq!(served::script_of('\u{10FFFF}'), None);
+}
+
+#[test]
+fn a_fetched_file_reaches_every_face_and_family_that_uses_it() {
+    let mut stack = web_fonts("en", SERVED).stack();
+    let font_id = |family: FontFamily| FontId::new(14.0, family);
+    let semibold = FontFamily::Name("semibold".into());
+    assert!(!stack.fonts(false).has_glyph(&font_id(FontFamily::Proportional), 'ع'));
+
+    // The Arabic test face is variable, so the semibold family gets its own instance at 600.
+    let file: egui::epaint::text::Blob = Arc::new(ARABIC.to_vec());
+    stack.provide("fonts/noto-sans-arabic/NotoSansArabic.ttf", &file);
+    let mut fonts = stack.fonts(false);
+    assert!(fonts.has_glyph(&font_id(FontFamily::Proportional), 'ع'));
+    assert!(fonts.has_glyph(&font_id(semibold.clone()), 'ع'));
+    assert!(stack.chain(&FontFamily::Proportional).contains(&"Noto Sans Arabic Regular".to_owned()));
+    assert!(stack.chain(&semibold).contains(&"Noto Sans Arabic Regular @600".to_owned()));
+    assert!(!stack.definitions.font_data.contains_key("Noto Sans Thai Regular"));
+
+    // Both faces of a collection come from one file.
+    let file: egui::epaint::text::Blob = Arc::new(CJK.to_vec());
+    stack.provide("fonts/noto-sans-cjk/NotoSansCJK.ttc", &file);
+    for name in ["Noto Sans CJK SC Regular", "Noto Sans CJK TC Regular"] {
+        assert!(stack.definitions.font_data.contains_key(name), "{name}");
+    }
+}
+
+#[test]
+fn fetched_cjk_faces_fit_the_latin_rows_as_embedded_ones_do() {
+    const SC: &[ServedFace] = &[served("Noto Sans CJK SC", "Regular", &["Hans", "Latn"], "fonts/sc.otf", 0)];
+    let mut web = web_fonts("zh-CN", SC).stack();
+    web.provide("fonts/sc.otf", &(Arc::new(CJK.to_vec()) as egui::epaint::text::Blob));
+    let embedded = CraftFace { bytes: CJK, ..SC[0].craft_face() };
+    let desktop = web_fonts("zh-CN", &[]).craft_faces(&[embedded]).stack();
+    let tweak = |stack: &Stack| {
+        let tweak = &stack.definitions.font_data.get("Noto Sans CJK SC Regular").expect("CJK face").tweak;
+        (tweak.scale, tweak.y_offset_factor)
+    };
+    assert_ne!(tweak(&desktop).1, 0.0, "the CJK face moves onto the Latin baseline");
+    assert_eq!(tweak(&web), tweak(&desktop));
+}
+
+/// The CJK interface faces as `Embed::subset_to` embeds them, with Noto Sans CJK SC as the
+/// Simplified one.
+fn ui_faces(others: &'static [u8]) -> [CraftFace; 5] {
+    [
+        CraftFace { family: "Noto Sans SC UI", style: "Regular", scripts: &["Hans", "Latn"], bytes: CJK, index: 0 },
+        CraftFace { family: "Noto Sans TC UI", style: "Regular", scripts: &["Hant", "Latn"], bytes: others, index: 0 },
+        CraftFace { family: "Noto Sans HK UI", style: "Regular", scripts: &["Hant-HK", "Latn"], bytes: others, index: 0 },
+        CraftFace { family: "Noto Sans KR UI", style: "Regular", scripts: &["Kore", "Latn"], bytes: others, index: 0 },
+        CraftFace { family: "BIZ UDPGothic", style: "Regular", scripts: &["Jpan", "Latn"], bytes: others, index: 0 },
+    ]
+}
+
+#[test]
+fn preferences_name_the_interface_faces_too() {
+    let order = |faces: &[CraftFace], prefer: Option<&str>| {
+        let mut fonts = UiFonts::new(&I18nScripts).craft_faces(faces).ui_language("ja").system_fonts(SystemFonts::Off);
+        if let Some(family) = prefer {
+            fonts = fonts.prefer("Jpan", family);
+        }
+        let stack = fonts.stack();
+        stack.chain(&FontFamily::Proportional).iter().filter(|n| faces.iter().any(|f| f.name() == **n)).cloned().collect::<Vec<_>>()
+    };
+    let mincho = face("Shippori Mincho", "Regular", &["Jpan", "Latn"]);
+    let gothic = ui_faces(&[])[4];
+    // craft-fonts' preference for BIZ UDPGothic.
+    assert_eq!(order(&[mincho, gothic], None), ["BIZ UDPGothic Regular", "Shippori Mincho Regular"]);
+    // The app's.
+    let mincho_ui = face("Shippori Mincho UI", "Regular", &["Jpan", "Latn"]);
+    assert_eq!(order(&[gothic, mincho_ui], Some("Shippori Mincho")), ["Shippori Mincho UI Regular", "BIZ UDPGothic Regular"]);
+}
+
+#[test]
+fn a_taiwanese_ui_takes_characters_no_interface_face_has_from_the_system_fonts() {
+    // Noto Sans stands in for faces cut without 中 and 文; the system fonts have them.
+    const NOTO_SANS: &[u8] = include_bytes!("../../tests/fonts/NotoSans-test.ttf");
+    let asked = Arc::new(std::sync::Mutex::new(Vec::<String>::new()));
+    let stack = |simplified: &'static [u8]| {
+        let mut faces = ui_faces(NOTO_SANS);
+        faces[0].bytes = simplified;
+        let recorded = Arc::clone(&asked);
+        let system = move |request: &FallbackRequest<'_>| {
+            recorded.lock().map(|mut asked| asked.push(request.cluster.to_owned())).ok()?;
+            Some(FontInsert::new(
+                "system:Noto Sans CJK SC",
+                FontData::from_static(CJK),
+                vec![InsertFontFamily { family: request.family.clone(), priority: FontPriority::Lowest }],
+            ))
+        };
+        UiFonts::new(&I18nScripts)
+            .app_face("ui", FontData::from_static(NOTO_SANS), &[FontFamily::Proportional])
+            .craft_faces(&faces)
+            .languages(&["en", "zh-TW", "zh-CN", "ja", "ko"])
+            .ui_language("zh-TW")
+            .system_provider(Arc::new(system))
+            .stack()
+    };
+    let sample = [Sample { language: "zh-TW", key: "menu.language", text: "中文" }];
+    let missing = |stack: &Stack, with_system| -> Vec<char> {
+        missing_glyphs(stack, &FontFamily::Proportional, sample, with_system).iter().map(|m| m.character).collect()
+    };
+
+    let without = stack(NOTO_SANS);
+    // Other regions' interface faces come before the system fonts, so they draw what they have.
+    assert_eq!(head(&without, &FontFamily::Proportional, 4), ["ui", "Noto Sans TC UI Regular", "Noto Sans HK UI Regular", "Noto Sans SC UI Regular"]);
+    assert_eq!(missing(&without, false), ['中', '文']);
+    assert_eq!(missing(&without, true), Vec::<char>::new());
+    // The face the system provider returns for 中 draws 文 too.
+    assert_eq!(*asked.lock().unwrap(), ["中"]);
+
+    asked.lock().unwrap().clear();
+    let with_simplified = stack(CJK);
+    assert_eq!(missing(&with_simplified, true), Vec::<char>::new());
+    assert!(asked.lock().unwrap().is_empty(), "the Simplified interface face has them");
+}
+
+#[test]
+fn a_web_build_downloads_the_interface_face_for_its_language() {
+    let faces = [
+        served("Noto Sans SC UI", "Regular", &["Hans", "Latn"], "fonts/ui/NotoSansSCUI-Regular.0123456789abcdef.ttf", 0),
+        served("Noto Sans TC UI", "Regular", &["Hant", "Latn"], "fonts/ui/NotoSansTCUI-Regular.0123456789abcdef.ttf", 0),
+        served("BIZ UDPGothic", "Regular", &["Jpan", "Latn"], "fonts/biz-ud-pgothic/BIZUDPGothic-Regular.0123456789abcdef.ttf", 0),
+        served("Noto Sans Arabic", "Regular", &["Arab"], "fonts/noto-sans-arabic/NotoSansArabic.ttf", 0),
+    ];
+    // The interface faces are Regular only: the semibold family takes that face too.
+    for (language, want) in [("zh-TW", "Noto Sans TC UI Regular"), ("zh-CN", "Noto Sans SC UI Regular"), ("ja", "BIZ UDPGothic Regular")] {
+        assert_eq!(names(web_fonts(language, &faces).stack().ui_downloads()), [want], "{language}");
+    }
+}
+
+/// craft-fonts' faces for Latin, Greek and Cyrillic, symbols and emoji, as a web build serves them.
+const SERVED_SYMBOLS: &[ServedFace] = &[
+    served("Noto Sans", "Regular", &["Latn", "Cyrl", "Grek", "Deva"], "fonts/noto-sans/NotoSans.ttf", 0),
+    served("Noto Color Emoji", "Regular", &["Zsye"], "fonts/noto-color-emoji/NotoColorEmoji.ttf", 0),
+    served("Noto Sans Symbols", "Regular", &["Zsym"], "fonts/noto-sans-symbols/NotoSansSymbols.ttf", 0),
+    served("Noto Sans Symbols 2", "Regular", &["Zsym"], "fonts/noto-sans-symbols-2/NotoSansSymbols2-Regular.ttf", 0),
+    served("Noto Sans Math", "Regular", &["Zmth", "Zsym"], "fonts/noto-sans-math/NotoSansMath-Regular.ttf", 0),
+];
+
+#[test]
+fn letters_symbols_and_emoji_download_their_own_kind_of_face() {
+    let stack = web_fonts("en", &[SERVED, SERVED_SYMBOLS].concat()).stack();
+    let regular = FontFamily::Proportional;
+    let first = |c: char| names(stack.downloads_for(&regular, c)).first().cloned().unwrap_or_default();
+    for c in ['ổ', 'ẫ', 'ạ', 'ư', 'λ', 'ῶ', 'ж', 'ӂ', 'Dž', '₫'] {
+        assert_eq!(names(stack.downloads_for(&regular, c)), ["Noto Sans Regular"], "{c}");
+    }
+    let symbols = ["Noto Sans Symbols Regular", "Noto Sans Symbols 2 Regular", "Noto Sans Math Regular"];
+    for c in ['⌘', '⌥', '⇧', '⌃', '⎋', '⏎', '⌫', '⇥', '↩', '⌦', '⇪', '⏏', '☰', '✓', '♠', '🁣', '♔'] {
+        assert_eq!(names(stack.downloads_for(&regular, c)), symbols, "{c}");
+    }
+    for c in ['⊞', '∀', '⟨', '𝔸'] {
+        assert_eq!(first(c), "Noto Sans Math Regular", "{c}");
+    }
+    for c in ['🔍', '😀', '⌚', '☕', '✅', '⭐', '🃏'] {
+        assert_eq!(names(stack.downloads_for(&regular, c)), ["Noto Color Emoji Regular"], "{c}");
+    }
+    // A variation selector chooses between the two.
+    assert_eq!(served::script_of_cluster("↩\u{FE0F}"), Some("Zsye"));
+    assert_eq!(served::script_of_cluster("⌚\u{FE0E}"), Some("Zsym"));
+    assert_eq!(served::script_of_cluster("1\u{FE0F}\u{20E3}"), Some("Zsye"));
+    assert_eq!(served::script_of_cluster("↩"), Some("Zsym"));
+}
+
+/// Fetches nothing until the test answers, on a clock the test moves.
+#[derive(Default)]
+struct FakeFetch {
+    pending: Mutex<Vec<(&'static str, served::loader::Done)>>,
+    requested: Mutex<Vec<&'static str>>,
+    now: Mutex<f64>,
+    timers: Mutex<Vec<(f64, served::loader::Wake)>>,
+}
+
+impl served::loader::Fetcher for FakeFetch {
+    fn fetch(&self, url: &'static str, _integrity: &'static str, done: served::loader::Done) {
+        self.requested.lock().unwrap().push(url);
+        self.pending.lock().unwrap().push((url, done));
+    }
+
+    fn now(&self) -> f64 {
+        *self.now.lock().unwrap()
+    }
+
+    fn after(&self, seconds: f64, wake: served::loader::Wake) {
+        let at = self.now() + seconds;
+        self.timers.lock().unwrap().push((at, wake));
+    }
+}
+
+impl FakeFetch {
+    /// The URLs requested since the last call.
+    fn requested(&self) -> Vec<&'static str> {
+        std::mem::take(&mut *self.requested.lock().unwrap())
+    }
+
+    fn answer(&self, url: &str, result: Result<&[u8], &str>) {
+        let mut pending = self.pending.lock().unwrap();
+        let i = pending.iter().position(|(u, _)| *u == url).unwrap_or_else(|| panic!("{url} is not being fetched"));
+        let (_, done) = pending.remove(i);
+        drop(pending);
+        done(result.map(<[u8]>::to_vec).map_err(str::to_owned));
+    }
+
+    fn wait(&self, seconds: f64) {
+        let now = {
+            let mut now = self.now.lock().unwrap();
+            *now += seconds;
+            *now
+        };
+        let due: Vec<_> = {
+            let mut timers = self.timers.lock().unwrap();
+            let (due, later) = std::mem::take(&mut *timers).into_iter().partition(|(at, _)| *at <= now);
+            *timers = later;
+            due
+        };
+        for (_, wake) in due {
+            wake();
+        }
+    }
+}
+
+const NOTO_SANS_URL: &str = "fonts/noto-sans/NotoSans.ttf";
+const SYMBOLS_2_URL: &str = "fonts/noto-sans-symbols-2/NotoSansSymbols2-Regular.ttf";
+const MATH_URL: &str = "fonts/noto-sans-math/NotoSansMath-Regular.ttf";
+
+/// An English UI on the web whose faces lack Vietnamese ổ and the keyboard keys, with `fetch`
+/// fetching its served faces; and whether the context draws a character, as a pass would ask.
+fn web_context(fetch: &Arc<FakeFetch>) -> (egui::Context, impl Fn(char) -> bool) {
+    let mut faces = SERVED_SYMBOLS.to_vec();
+    faces[0].coverage = coverage_of(NOTO_SANS_LATIN);
+    faces[2].coverage = coverage_of(SYMBOLS);
+    faces[3].coverage = coverage_of(SYMBOLS_2);
+    // Arrows and technical symbols, ⌥ and ⇥ among them; never served.
+    faces[4].coverage = craft_fonts_build::coverage::encode(&[(0x2190, 0x21FF), (0x2300, 0x23FF)]).leak();
+    web_context_with("en", &faces, fetch)
+}
+
+/// A web context in `ui_language` with these served faces, fetched by `fetch`; and whether the
+/// context draws a character, as a pass would ask.
+fn web_context_with(ui_language: &str, faces: &[ServedFace], fetch: &Arc<FakeFetch>) -> (egui::Context, impl Fn(char) -> bool + use<>) {
+    let ctx = egui::Context::default();
+    let stack = web_fonts(ui_language, faces).stack();
+    served::loader::install(&ctx, stack, Arc::clone(fetch) as Arc<dyn served::loader::Fetcher>);
+    let draws = {
+        let ctx = ctx.clone();
+        move |c: char| {
+            ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
+            ctx.fonts_mut(|f| f.has_glyph(&FontId::proportional(14.0), c))
+        }
+    };
+    (ctx, draws)
+}
+
+#[test]
+fn a_missing_character_fetches_only_the_face_that_draws_it() {
+    let fetch = Arc::new(FakeFetch::default());
+    let (_ctx, draws) = web_context(&fetch);
+    assert!(fetch.requested().is_empty(), "English needs no served face up front");
+
+    assert!(!draws('ổ'));
+    assert_eq!(fetch.requested(), [NOTO_SANS_URL]);
+    // While a face is on its way, characters it draws wait for it.
+    assert!(!draws('ạ'));
+    assert!(fetch.requested().is_empty());
+    fetch.answer(NOTO_SANS_URL, Ok(NOTO_SANS_LATIN));
+    assert!(draws('ổ') && draws('ạ'));
+
+    // ⌥ is in the second symbol face only: the first is never fetched for it.
+    assert!(!draws('⌥'));
+    assert_eq!(fetch.requested(), [SYMBOLS_2_URL]);
+    fetch.answer(SYMBOLS_2_URL, Ok(SYMBOLS_2));
+    assert!(draws('⌥') && draws('⌫'));
+    assert!(fetch.requested().is_empty());
+
+    // A letter no served face has fetches nothing.
+    assert!(!draws('ẫ'));
+    assert!(fetch.requested().is_empty(), "the emoji face is never a candidate for letters or keys");
+}
+
+#[test]
+fn a_han_character_fetches_the_one_interface_face_that_has_it() {
+    let cut = |family: &'static str, scripts: &'static [&'static str], url: &'static str, chars: &str| ServedFace {
+        coverage: coverage_of_chars(chars),
+        ..served(family, "Regular", scripts, url, 0)
+    };
+    let faces = [
+        cut("Noto Sans SC UI", &["Hans", "Latn"], "fonts/ui/SC.ttf", "中文日本语ổ"),
+        cut("Noto Sans TC UI", &["Hant", "Latn"], "fonts/ui/TC.ttf", "中文日本語體ổ"),
+        cut("Noto Sans HK UI", &["Hant-HK", "Latn"], "fonts/ui/HK.ttf", "中文日本語ổ"),
+        cut("Noto Sans KR UI", &["Kore", "Latn"], "fonts/ui/KR.ttf", "中文日本語한ổ"),
+        cut("BIZ UDPGothic", &["Jpan", "Latn"], "fonts/ui/JP.ttf", "中文日本語のổ"),
+        ServedFace { coverage: coverage_of(NOTO_SANS_LATIN), ..SERVED_SYMBOLS[0] },
+    ];
+    let fetch = Arc::new(FakeFetch::default());
+    let (_ctx, draws) = web_context_with("zh-Hans", &faces, &fetch);
+    assert_eq!(fetch.requested(), ["fonts/ui/SC.ttf"], "the UI language's face, at once");
+    fetch.answer("fonts/ui/SC.ttf", Ok(CJK));
+
+    // 體 is in the Traditional face only.
+    assert!(!draws('體'));
+    assert_eq!(fetch.requested(), ["fonts/ui/TC.ttf"]);
+    fetch.answer("fonts/ui/TC.ttf", Ok(CJK));
+    assert!(!draws('體'), "the test file lacks it");
+    assert!(fetch.requested().is_empty(), "a fetched face is not fetched again, and no other face has it");
+    // A rare character no face has fetches nothing: tofu or the browser draws it.
+    assert!(!draws('龘'));
+    assert!(fetch.requested().is_empty());
+    // Every cut has ổ, but Latin letters come from Noto Sans.
+    assert!(!draws('ổ'));
+    assert_eq!(fetch.requested(), [NOTO_SANS_URL]);
+
+    // Among faces that have a character, the UI language's region comes first.
+    let both =
+        [cut("Noto Sans TC UI", &["Hant", "Latn"], "fonts/ui/TC.ttf", "體"), cut("Noto Sans HK UI", &["Hant-HK", "Latn"], "fonts/ui/HK.ttf", "體")];
+    for (language, want) in [("zh-Hant", "Noto Sans TC UI Regular"), ("zh-HK", "Noto Sans HK UI Regular"), ("zh-Hans", "Noto Sans TC UI Regular")] {
+        assert_eq!(names(web_fonts(language, &both).stack().downloads_for(&FontFamily::Proportional, '體'))[0], want, "{language}");
+    }
+    let regular = FontFamily::Proportional;
+    for (language, want) in [
+        ("zh-Hans", "Noto Sans SC UI Regular"),
+        ("zh-Hant", "Noto Sans TC UI Regular"),
+        ("zh-HK", "Noto Sans HK UI Regular"),
+        ("ja", "BIZ UDPGothic Regular"),
+        ("ko", "Noto Sans KR UI Regular"),
+    ] {
+        assert_eq!(names(web_fonts(language, &faces).stack().downloads_for(&regular, '中'))[0], want, "{language}");
+    }
+}
+
+#[test]
+fn a_failed_download_moves_on_and_is_retried_later() {
+    let fetch = Arc::new(FakeFetch::default());
+    let (_ctx, draws) = web_context(&fetch);
+
+    assert!(!draws('⌥'));
+    assert_eq!(fetch.requested(), [SYMBOLS_2_URL]);
+    fetch.answer(SYMBOLS_2_URL, Err("HTTP 503"));
+    // The next face that draws it is fetched at once.
+    assert!(!draws('⌥'));
+    assert_eq!(fetch.requested(), [MATH_URL]);
+    fetch.answer(MATH_URL, Err("HTTP 503"));
+    assert!(!draws('⌥'));
+    assert!(fetch.requested().is_empty(), "failed faces wait for their retry time");
+
+    // Failures of one script don't stop another's face.
+    assert!(!draws('ổ'));
+    assert_eq!(fetch.requested(), [NOTO_SANS_URL]);
+    fetch.answer(NOTO_SANS_URL, Ok(NOTO_SANS_LATIN));
+    assert!(draws('ổ'));
+
+    // At their retry time the failed faces are fetched again, in order.
+    fetch.wait(1.0);
+    assert!(!draws('⌥'));
+    assert!(fetch.requested().is_empty());
+    fetch.wait(1.0);
+    assert!(!draws('⌥'));
+    assert_eq!(fetch.requested(), [SYMBOLS_2_URL]);
+    fetch.answer(SYMBOLS_2_URL, Ok(SYMBOLS_2));
+    assert!(draws('⌥'));
+
+    // A face that fails again waits twice as long.
+    assert!(!draws('⇥'));
+    assert_eq!(fetch.requested(), [MATH_URL]);
+    fetch.answer(MATH_URL, Err("HTTP 503"));
+    fetch.wait(3.0);
+    assert!(!draws('⇥'));
+    assert!(fetch.requested().is_empty());
+    fetch.wait(1.0);
+    assert!(!draws('⇥'));
+    assert_eq!(fetch.requested(), [MATH_URL]);
+}
diff --git a/crates/ui/src/ime/composer.rs b/crates/ui/src/ime/composer.rs
new file mode 100644
index 00000000..35d4ed03
--- /dev/null
+++ b/crates/ui/src/ime/composer.rs
@@ -0,0 +1,604 @@
+use std::ops::Range;
+
+use egui::{
+    Context, Event, IMEPurpose, Id, ImeEvent, Key, Modifiers, Rect,
+    ime_context::{ImeContextTracker, ImeObservation, ImeTarget},
+    output::IMEOutput,
+};
+
+/// Seconds after a composition ends in which the IME's own confirm, cancel and edit keys
+/// (Enter, Escape, Backspace, Delete, Space) are still taken as the IME's, and after a bare
+/// commit in which the key that typed it is. Platforms that forward the key do so in the same
+/// batch of events; a person's next Enter comes much later.
+const GUARD_SECS: f64 = 0.05;
+
+/// Seconds after the composer kept marked text itself (a click away, the canvas giving up the
+/// keyboard) in which the IME's own commit of that same text is a duplicate.
+const KEPT_SECS: f64 = 0.5;
+
+/// One step for the canvas's text, in the order the platform sent it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Edit {
+    /// The marked text changed. Empty text ends the composition; an [`Edit::Insert`] of the
+    /// committed text, if any, follows. `active` is the segment being converted, in chars.
+    Preedit {
+        text: String,
+        active: Option<Range<usize>>,
+    },
+    /// Text to insert at the caret: typed, committed by the IME, or marked text kept as typed.
+    Insert(String),
+    /// A key press for the editor (caret movement, Backspace, Enter, Escape, shortcuts). Keys the
+    /// IME is using never appear here. The key's event also stays in the input for the app's
+    /// other keyboard handling: an app handles each key from one of the two.
+    Key {
+        key: Key,
+        modifiers: Modifiers,
+        repeat: bool,
+    },
+    /// A line break sent as text or committed with nothing composing (an on-screen keyboard's
+    /// Return, an IME's bare commit of `"\n"`). No Enter key press comes with it: the editor
+    /// handles it as Enter. The line break a pressed Enter also types is dropped, so each Enter
+    /// arrives once, as [`Edit::Key`] or as this.
+    LineBreak {
+        modifiers: Modifiers,
+    },
+    /// The clipboard events, in order with the text, held back while the IME composes. The app
+    /// applies them; the event also stays in the input, so it handles each from one of the two.
+    Paste(String),
+    Copy,
+    Cut,
+    /// Delete chars around the caret (the web text agent's corrections, mobile Backspace). The app
+    /// applies it; its event is removed from the input. Never sent while composing.
+    DeleteSurrounding {
+        before_chars: usize,
+        after_chars: usize,
+    },
+    /// Delete the text an input method replaces (macOS accent menus and dictation, Wayland input
+    /// methods), counted in UTF-8 bytes before and after the caret or selection, right before the
+    /// commit that replaces it. While composing, the counts start at the caret too: the marked
+    /// text isn't in the app's text. Delete only whole chars inside the counts;
+    /// [`surrounding_chars`] counts them. The app applies it; its event is removed from the
+    /// input. Only the suite's egui fork sends it.
+    DeleteSurroundingBytes {
+        before_bytes: usize,
+        after_bytes: usize,
+    },
+}
+
+/// For [`Edit::DeleteSurroundingBytes`]: how many chars of `before` (the text before the caret or
+/// selection) end inside its last `before_bytes` bytes, and how many of `after` (the text after
+/// it) lie inside its first `after_bytes` bytes. A char cut by a count stays, as in egui's
+/// `TextEdit`.
+pub fn surrounding_chars(before: &str, after: &str, before_bytes: usize, after_bytes: usize) -> (usize, usize) {
+    let from = before.len().saturating_sub(before_bytes);
+    let before_chars = before.char_indices().rev().take_while(|(i, _)| *i >= from).count();
+    let after_chars = after.char_indices().take_while(|(i, c)| i + c.len_utf8() <= after_bytes).count();
+    (before_chars, after_chars)
+}
+
+/// The marked text, for painting at the caret with an underline.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Preedit<'a> {
+    pub text: &'a str,
+    /// The segment being converted (Japanese, Chinese phrase input), in chars. Draw it with a
+    /// thicker underline. `None` when the IME doesn't say.
+    pub active: Option<&'a Range<usize>>,
+}
+
+/// What [`Composer::process`] made of a pass's events.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Processed {
+    pub edits: Vec<Edit>,
+    /// The input events with those the IME used removed, for the app's other keyboard handling.
+    pub events: Vec<Event>,
+}
+
+/// One composer for text typed onto a canvas, outside egui's `TextEdit`.
+///
+/// It turns a pass's input events into ordered [`Edit`]s, keeps the marked (preedit) text, and
+/// tells the platform where the caret is so the candidate window opens there.
+///
+/// A clone is a new IME context: it gets its own context generation when it next writes output.
+#[derive(Debug)]
+pub struct Composer {
+    preedit: String,
+    active: Option<Range<usize>>,
+    /// The keys the platform may still forward, and since when, for [`GUARD_SECS`].
+    guard: Option<(Guard, f64)>,
+    /// Marked text the composer kept itself, and when, for [`KEPT_SECS`].
+    kept: Option<(String, f64)>,
+    /// The commit whose echo may still come in this pass, for [`Self::is_echo`].
+    last_commit: Option<String>,
+    modifiers: Modifiers,
+    caret: Option<Rect>,
+    purpose: IMEPurpose,
+    interrupt: bool,
+    /// The composer ended a composition the IME may still hold, for [`Self::interrupted`].
+    interrupted: bool,
+    /// The pass [`Self::interrupted`] is for, and the viewport and pass of the composer's last
+    /// IME output.
+    pass: Option<u64>,
+    output_pass: Option<(egui::ViewportId, u64)>,
+    on: bool,
+    /// The IME context's owner, as egui's `IMEOutput::owner`.
+    owner: Id,
+    /// The context generation egui's `IMEOutput` carries: new whenever the composer turns the
+    /// IME on again, changes purpose, or skipped a pass.
+    context: ImeContextTracker,
+}
+
+impl Default for Composer {
+    fn default() -> Self {
+        Self {
+            preedit: String::new(),
+            active: None,
+            guard: None,
+            kept: None,
+            last_commit: None,
+            modifiers: Modifiers::default(),
+            caret: None,
+            purpose: IMEPurpose::default(),
+            interrupt: false,
+            interrupted: false,
+            pass: None,
+            output_pass: None,
+            on: false,
+            owner: Id::unique("craft_ui::ime::Composer"),
+            context: ImeContextTracker::new(),
+        }
+    }
+}
+
+impl Clone for Composer {
+    fn clone(&self) -> Self {
+        Self {
+            preedit: self.preedit.clone(),
+            active: self.active.clone(),
+            guard: self.guard,
+            kept: self.kept.clone(),
+            last_commit: self.last_commit.clone(),
+            modifiers: self.modifiers,
+            caret: self.caret,
+            purpose: self.purpose,
+            interrupt: self.interrupt,
+            interrupted: self.interrupted,
+            pass: self.pass,
+            output_pass: self.output_pass,
+            on: self.on,
+            owner: self.owner,
+            context: ImeContextTracker::new(),
+        }
+    }
+}
+
+impl Composer {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// The IME owner egui and the platform integration know this canvas's text by. Give each
+    /// canvas that types text its own (the default is one id shared by every composer).
+    pub fn with_owner(mut self, owner: Id) -> Self {
+        self.owner = owner;
+        self
+    }
+
+    /// `IMEPurpose::Password` or `Terminal` for canvases that need them.
+    pub fn with_purpose(mut self, purpose: IMEPurpose) -> Self {
+        self.purpose = purpose;
+        self
+    }
+
+    pub fn is_composing(&self) -> bool {
+        !self.preedit.is_empty()
+    }
+
+    pub fn preedit(&self) -> Option<Preedit<'_>> {
+        self.is_composing().then(|| Preedit { text: &self.preedit, active: self.active.as_ref() })
+    }
+
+    /// Call once per pass, before the app's other keyboard handling, with whether the canvas
+    /// has a text caret. Returns the pass's edits and removes the events the IME used from
+    /// `ctx`'s input, so shortcuts don't see the Space that converted a word or the Enter that
+    /// confirmed it.
+    ///
+    /// When `editing` is false, or an egui text field has the keyboard, marked text is kept as
+    /// typed (an empty [`Edit::Preedit`], then an [`Edit::Insert`]) and the IME turns off.
+    /// When the editing ends later in a pass (a command closes the editor), call it again with
+    /// `editing` false: the IME turns off in that pass, not the next.
+    pub fn update(&mut self, ctx: &Context, editing: bool) -> Vec<Edit> {
+        let pass = self.start_pass(ctx);
+        if !editing || ctx.text_edit_focused() {
+            self.on = false;
+            self.context.observe(ctx.viewport_id(), None);
+            if self.output_pass == Some((ctx.viewport_id(), pass)) {
+                if super::window::recording(ctx) {
+                    super::window::withdraw(ctx, self.owner);
+                } else if !ctx.text_edit_focused() {
+                    ctx.output_mut(|o| o.ime = None);
+                }
+            }
+            let time = ctx.input(|i| i.time);
+            let kept = self.end_at(time);
+            // Turning the IME off drops its marked text; there is nothing to interrupt.
+            self.interrupt = false;
+            return kept.map(|text| vec![Edit::Preedit { text: String::new(), active: None }, Edit::Insert(text)]).unwrap_or_default();
+        }
+        self.on = true;
+        let (events, time, modifiers) = ctx.input(|i| (i.events.clone(), i.time, i.modifiers));
+        // Modifiers can change while the composer isn't updated (another view has the keyboard).
+        self.modifiers = modifiers;
+        let processed = self.process_pass(&events, time);
+        if processed.events.len() != events.len() {
+            ctx.input_mut(|i| i.events = processed.events);
+        }
+        self.write_output(ctx);
+        processed.edits
+    }
+
+    /// The caret in screen points (`ctx.layer_transform_to_global(layer) * rect` for a canvas
+    /// on a transformed layer), after this pass's edits moved it. Put it at the start of the
+    /// marked text, or of its active segment, so candidates don't cover what is being typed.
+    ///
+    /// Call it after [`Self::update`] in every pass that edits; until the first call the
+    /// candidate window has no position.
+    pub fn set_caret(&mut self, ctx: &Context, caret: Rect) {
+        self.caret = Some(caret_area(caret, ctx.content_rect()));
+        if self.on {
+            self.write_output(ctx);
+        }
+    }
+
+    /// Whether the composer ended a composition the platform IME may still hold, in this pass
+    /// (since the last [`Self::process`] for apps that call it directly): it kept the marked text as typed
+    /// (a click, the editing ending, [`Self::end`], [`Self::discard`]) or a bare line break
+    /// confirmed it. A host that talks to the platform IME itself (macOS `discardMarkedText`)
+    /// tells it to drop its marked text then; egui's `should_interrupt_composition` is already
+    /// set while the IME is on.
+    pub fn interrupted(&self) -> bool {
+        self.interrupted
+    }
+
+    /// Ends the composition from the app, keeping the marked text as typed, for an app ending
+    /// its text editing itself (a tool change, a command). Returns that text for the app to
+    /// insert before the editor closes. The IME is told to drop its copy, and its late commit
+    /// of the same text is dropped.
+    #[must_use = "insert the marked text, or call `discard` when the editor already keeps it"]
+    pub fn end(&mut self, ctx: &Context) -> Option<String> {
+        self.start_pass(ctx);
+        let time = ctx.input(|i| i.time);
+        let kept = self.end_at(time);
+        if kept.is_some() && self.on {
+            self.write_output(ctx);
+        }
+        kept
+    }
+
+    /// Ends the composition from the app without handing back the marked text: the edit was
+    /// cancelled, or the editor shows marked text inline and kept it when it stopped composing
+    /// on its own. Otherwise as [`Self::end`].
+    pub fn discard(&mut self, ctx: &Context) {
+        let _ = self.end(ctx);
+    }
+
+    /// The state machine behind [`Self::update`], for apps that read events elsewhere and for
+    /// tests. `time` is the pass's input time in seconds.
+    pub fn process(&mut self, events: &[Event], time: f64) -> Processed {
+        self.interrupted = false;
+        self.process_pass(events, time)
+    }
+
+    /// [`Self::process`] for [`Self::update`], which starts [`Self::interrupted`] per pass, so
+    /// an [`Self::end`] before it in the same pass still counts.
+    fn process_pass(&mut self, events: &[Event], time: f64) -> Processed {
+        let mut out = Processed::default();
+        self.last_commit = None;
+        if self.kept.as_ref().is_some_and(|(_, at)| time - at > KEPT_SECS) {
+            self.kept = None;
+        }
+        // The previous event was a pressed Enter: a line break right after it is that key's text.
+        let mut after_enter = false;
+        for event in events {
+            let follows_enter = std::mem::take(&mut after_enter);
+            let keep = match event {
+                Event::Ime(ime) => {
+                    self.ime(ime, time, follows_enter, &mut out.edits);
+                    false
+                }
+                Event::Key { key, pressed, repeat, modifiers, .. } => {
+                    self.modifiers = *modifiers;
+                    if !*pressed {
+                        after_enter = follows_enter;
+                        true
+                    } else {
+                        after_enter = *key == Key::Enter;
+                        if self.is_composing() || self.take_guard(*key, time) {
+                            false
+                        } else {
+                            self.kept = None;
+                            // Text after this key is the key's own.
+                            self.last_commit = None;
+                            out.edits.push(Edit::Key { key: *key, modifiers: *modifiers, repeat: *repeat });
+                            true
+                        }
+                    }
+                }
+                Event::Text(text) => {
+                    let echo = self.is_echo(text);
+                    if self.is_composing() || echo || is_shortcut_chord(self.modifiers) {
+                        false
+                    } else if is_line_break(text) {
+                        self.line_break(time, follows_enter, &mut out.edits);
+                        true
+                    } else {
+                        // Keys after typed text are the user's.
+                        self.guard = None;
+                        self.kept = None;
+                        out.edits.push(Edit::Insert(text.clone()));
+                        true
+                    }
+                }
+                Event::Paste(_) | Event::Copy | Event::Cut if self.is_composing() => false,
+                Event::Paste(text) => {
+                    out.edits.push(Edit::Paste(text.clone()));
+                    true
+                }
+                Event::Copy => {
+                    out.edits.push(Edit::Copy);
+                    true
+                }
+                Event::Cut => {
+                    out.edits.push(Edit::Cut);
+                    true
+                }
+                Event::ModifiersChanged(modifiers) => {
+                    self.modifiers = *modifiers;
+                    after_enter = follows_enter;
+                    true
+                }
+                Event::PointerButton { pressed: true, .. } => {
+                    // A click while composing keeps the marked text where it is, then the app
+                    // handles the click (moving the caret or ending the edit).
+                    if let Some(text) = self.end_at(time) {
+                        out.edits.push(Edit::Preedit { text: String::new(), active: None });
+                        out.edits.push(Edit::Insert(text));
+                    }
+                    true
+                }
+                _ => true,
+            };
+            if keep {
+                out.events.push(event.clone());
+            }
+        }
+        out
+    }
+
+    fn ime(&mut self, ime: &ImeEvent, time: f64, after_enter: bool, edits: &mut Vec<Edit>) {
+        match ime {
+            ImeEvent::Preedit { text, .. } if text.is_empty() => {
+                // Wayland input methods send empty preedits on every state change and after
+                // each commit; only one that ends a composition means anything.
+                self.take_preedit(time, edits);
+            }
+            ImeEvent::Preedit { text, active_range_chars } => {
+                self.kept = None;
+                self.last_commit = None;
+                self.preedit.clone_from(text);
+                self.active = active_range_chars.clone().filter(|r| r.end <= text.chars().count());
+                edits.push(Edit::Preedit { text: text.clone(), active: self.active.clone() });
+            }
+            // A bare line break confirms the composition (Enter with some IMEs): the marked text
+            // stays as typed, not a new line. The platform's input context can still hold the
+            // marked text (macOS), so it is kept as for a click.
+            ImeEvent::Commit(text) if is_line_break(text) => {
+                if let Some(kept) = self.take_preedit(time, edits) {
+                    self.guard = Some((Guard::Ended { committed: true }, time));
+                    edits.push(Edit::Insert(self.keep(kept, time)));
+                } else if self.awaits_commit(time) {
+                    self.guard = Some((Guard::Ended { committed: true }, time));
+                } else {
+                    self.last_commit = Some(text.clone());
+                    self.line_break(time, after_enter, edits);
+                }
+            }
+            ImeEvent::Commit(text) => {
+                let was_composing = self.take_preedit(time, edits).is_some();
+                if self.kept.take().is_some_and(|(kept, _)| kept == *text) {
+                    return;
+                }
+                if was_composing || self.awaits_commit(time) {
+                    self.guard = Some((Guard::Ended { committed: true }, time));
+                } else if !text.is_empty() {
+                    // A commit with no composition (IBus and fcitx typing plain letters, the
+                    // emoji picker, dictation, Apple Korean's Space with no syllable) is typed
+                    // text. Only Space can follow it as the key that typed it.
+                    self.guard = (text == " ").then_some((Guard::Key(Key::Space), time));
+                }
+                if text.is_empty() {
+                    return;
+                }
+                self.last_commit = Some(text.clone());
+                edits.push(Edit::Insert(text.clone()));
+            }
+            ImeEvent::DeleteSurrounding { before_chars, after_chars } => {
+                if !self.is_composing() {
+                    edits.push(Edit::DeleteSurrounding { before_chars: *before_chars, after_chars: *after_chars });
+                }
+            }
+            #[expect(deprecated)]
+            ImeEvent::Enabled | ImeEvent::Disabled => {}
+            #[allow(unreachable_patterns, reason = "crates.io egui has no other events")]
+            other => {
+                if let Some((before_bytes, after_bytes)) = delete_surrounding_bytes(other) {
+                    edits.push(Edit::DeleteSurroundingBytes { before_bytes, after_bytes });
+                }
+            }
+        }
+    }
+
+    /// Whether `text` repeats the commit just made, as the text of the key that typed it.
+    ///
+    /// macOS on winit 0.30 without the fix for rust-windowing/winit#4478 does this for Apple
+    /// Korean's Space with no syllable: `Commit(" ")`, then that Space as `KeyboardInput`, which
+    /// egui-winit turns into `Key(Space)`, `Text(" ")`, all in one pass. The key is guarded as
+    /// the IME's, so only the first text after the commit, with no key handed to the editor in
+    /// between, can be its echo. Text in a later pass is typed.
+    fn is_echo(&mut self, text: &str) -> bool {
+        self.last_commit.take().is_some_and(|c| c == text)
+    }
+
+    /// Whether `key` is the one the platform forwards after a composition ended or a bare
+    /// commit. One key per guard: a second Enter is the user's.
+    fn take_guard(&mut self, key: Key, time: f64) -> bool {
+        let guarded = self.guard.is_some_and(|(guard, at)| guard.covers(key) && time - at <= GUARD_SECS);
+        if guarded {
+            self.guard = None;
+        }
+        guarded
+    }
+
+    /// The composition just ended with an empty preedit and its commit hasn't arrived yet
+    /// (Wayland and Windows end it before committing).
+    fn awaits_commit(&self, time: f64) -> bool {
+        matches!(self.guard, Some((Guard::Ended { committed: false }, at)) if time - at <= GUARD_SECS)
+    }
+
+    /// A line break typed or committed with nothing composing is the Enter key, unless the Enter
+    /// that typed it came just before.
+    fn line_break(&mut self, time: f64, after_enter: bool, edits: &mut Vec<Edit>) {
+        if after_enter {
+            return;
+        }
+        self.kept = None;
+        self.guard = Some((Guard::Key(Key::Enter), time));
+        edits.push(Edit::LineBreak { modifiers: self.modifiers });
+    }
+
+    fn take_preedit(&mut self, time: f64, edits: &mut Vec<Edit>) -> Option<String> {
+        if !self.is_composing() {
+            return None;
+        }
+        self.active = None;
+        self.guard = Some((Guard::Ended { committed: false }, time));
+        edits.push(Edit::Preedit { text: String::new(), active: None });
+        Some(std::mem::take(&mut self.preedit))
+    }
+
+    /// Keeps marked text as typed, remembering it so the IME's late commit of it is dropped.
+    fn end_at(&mut self, time: f64) -> Option<String> {
+        if !self.is_composing() {
+            return None;
+        }
+        let text = std::mem::take(&mut self.preedit);
+        self.active = None;
+        Some(self.keep(text, time))
+    }
+
+    /// Starts [`Self::interrupted`] afresh in a new pass. Returns the pass number.
+    fn start_pass(&mut self, ctx: &Context) -> u64 {
+        let pass = ctx.cumulative_pass_nr();
+        if self.pass.replace(pass) != Some(pass) {
+            self.interrupted = false;
+        }
+        pass
+    }
+
+    /// Marked text the composer ended itself: the IME is interrupted, and a late commit of the
+    /// same text is dropped.
+    fn keep(&mut self, text: String, time: f64) -> String {
+        self.interrupt = true;
+        self.interrupted = true;
+        self.kept = Some((text.clone(), time));
+        text
+    }
+
+    fn write_output(&mut self, ctx: &Context) {
+        let interrupt = std::mem::take(&mut self.interrupt);
+        let viewport = ctx.viewport_id();
+        self.output_pass = Some((viewport, ctx.cumulative_pass_nr()));
+        let rect = self.caret.unwrap_or(Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1.0, 1.0)));
+        let observation =
+            ImeObservation::new(ctx.cumulative_frame_nr_for(viewport), ctx.cumulative_pass_nr_for(viewport), ImeTarget::new(self.owner, 0))
+                .purpose(self.purpose);
+        // `None` only once egui's process-wide generation counter has run out.
+        let Some(context) = self.context.observe(viewport, Some(observation)) else {
+            return;
+        };
+        let mut ime = IMEOutput::new(context.owner, context.context_generation, context.purpose, rect, rect);
+        ime.should_interrupt_composition = interrupt;
+        ime.change_cause = context.change_cause;
+        ime.surrounding_text = context.surrounding_text;
+        // In a native floating window docking publishes the descriptor after the window's last
+        // body (see `window.rs`).
+        if super::window::recording(ctx) {
+            super::window::record(ctx, ime);
+            return;
+        }
+        // egui-winit turns the IME on only in passes that set `ime`.
+        ctx.output_mut(|o| {
+            // A later write in the same pass (the caret after edits) keeps the interrupt.
+            ime.should_interrupt_composition |= o.ime.as_ref().is_some_and(|ime| ime.should_interrupt_composition);
+            o.ime = Some(ime);
+        });
+    }
+}
+
+/// Keys the platform may forward after the text they produced, for [`GUARD_SECS`].
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Guard {
+    /// A composition ended: the key that confirmed, cancelled or emptied it is the IME's.
+    /// `committed` once its commit, if any, has arrived.
+    Ended { committed: bool },
+    /// Text that arrived without a composition: only the key that typed it (Apple Korean's
+    /// Space after a commit of " ", the Enter behind a line break) is a duplicate.
+    Key(Key),
+}
+
+impl Guard {
+    fn covers(self, key: Key) -> bool {
+        match self {
+            Self::Ended { .. } => is_ime_key(key),
+            Self::Key(guarded) => key == guarded,
+        }
+    }
+}
+
+/// Keys an IME uses to confirm, cancel or edit a composition.
+fn is_ime_key(key: Key) -> bool {
+    matches!(key, Key::Enter | Key::Escape | Key::Backspace | Key::Delete | Key::Space)
+}
+
+/// The suite's egui fork has `ImeEvent::DeleteSurroundingBytes { before_bytes, after_bytes }`;
+/// crates.io egui doesn't. Reading it from the event's `Debug` output lets the same source build
+/// against both without a feature.
+fn delete_surrounding_bytes(ime: &ImeEvent) -> Option<(usize, usize)> {
+    let debug = format!("{ime:?}");
+    let fields = debug.strip_prefix("DeleteSurroundingBytes { before_bytes: ")?.strip_suffix(" }")?;
+    let (before, after) = fields.split_once(", after_bytes: ")?;
+    Some((before.parse().ok()?, after.parse().ok()?))
+}
+
+fn is_line_break(text: &str) -> bool {
+    text == "\n" || text == "\r" || text == "\r\n"
+}
+
+/// Cmd/Ctrl chords are shortcuts: a host that still sends their letter as text doesn't type it.
+/// Alt is left alone: Option on macOS and AltGr (Ctrl+Alt) on Windows type characters.
+fn is_shortcut_chord(m: Modifiers) -> bool {
+    (m.command || m.ctrl || m.mac_cmd) && !m.alt
+}
+
+/// A caret IMEs can place a window at: at least a point wide and tall (some ignore an empty
+/// rectangle), and inside the window, so a caret scrolled off the canvas doesn't put the
+/// candidates off screen.
+pub(super) fn caret_area(caret: Rect, screen: Rect) -> Rect {
+    if !caret.is_finite() || !screen.is_positive() {
+        return caret;
+    }
+    let size = caret.size().max(egui::vec2(1.0, 1.0)).min(screen.size());
+    // `screen.max - size` can round below `screen.min` (a screen from 0.1 to 0.5), and `clamp`
+    // panics on bounds out of order.
+    let min = caret.min.clamp(screen.min, (screen.max - size).max(screen.min));
+    Rect::from_min_size(min, size)
+}
diff --git a/crates/ui/src/ime/mod.rs b/crates/ui/src/ime/mod.rs
new file mode 100644
index 00000000..7e364c80
--- /dev/null
+++ b/crates/ui/src/ime/mod.rs
@@ -0,0 +1,79 @@
+//! Input methods for text typed onto canvases.
+//!
+//! egui's `TextEdit` handles its own composition. A canvas that takes text (a type tool, a cell
+//! being typed into, a caption on a timeline) uses one [`Composer`] instead:
+//!
+//! ```no_run
+//! # fn insert(_: &str) {} fn press(_: egui::Key, _: egui::Modifiers) {}
+//! # fn paste(_: &str) {} fn copy() {} fn cut() {} fn delete_around(_: usize, _: usize) {}
+//! # fn delete_whole_chars_around(_: usize, _: usize) {}
+//! # fn caret_rect() -> egui::Rect { egui::Rect::ZERO }
+//! # let ctx = egui::Context::default(); let mut composer = craft_ui::ime::Composer::new();
+//! # let editing = true;
+//! use craft_ui::ime::Edit;
+//! // Every pass, before shortcuts and other keyboard handling:
+//! for edit in composer.update(&ctx, editing) {
+//!     match edit {
+//!         // The editor paints marked text from `composer.preedit()`.
+//!         Edit::Preedit { .. } => {}
+//!         Edit::Insert(text) => insert(&text),
+//!         Edit::Key { key, modifiers, .. } => press(key, modifiers),
+//!         Edit::LineBreak { modifiers } => press(egui::Key::Enter, modifiers),
+//!         Edit::Paste(text) => paste(&text),
+//!         Edit::Copy => copy(),
+//!         Edit::Cut => cut(),
+//!         Edit::DeleteSurrounding { before_chars, after_chars } => delete_around(before_chars, after_chars),
+//!         // Whole chars inside the byte counts; `craft_ui::ime::surrounding_chars` counts them.
+//!         Edit::DeleteSurroundingBytes { before_bytes, after_bytes } => delete_whole_chars_around(before_bytes, after_bytes),
+//!     }
+//! }
+//! // After laying out the text, in screen points:
+//! composer.set_caret(&ctx, caret_rect());
+//! // Paint `composer.preedit()` at the caret, underlined.
+//! ```
+//!
+//! The app applies every edit; the composer changes no text. Keys and clipboard events it hands
+//! over as edits also stay in the input, so the app takes each from one of the two.
+//!
+//! When the app ends a composition itself, [`Composer::end`] returns the marked text to insert
+//! and [`Composer::discard`] drops it (the edit was cancelled, or the editor already keeps it).
+//! [`Composer::interrupted`] says when the platform IME should drop its marked text, for hosts
+//! that talk to it directly.
+//!
+//! An editor in a panel body of a native floating window ([`crate::docking`], feature
+//! `native-windows`) uses its composer the same way. The window is an egui pass of its own:
+//! there the composer records its descriptor, and docking publishes it once, after the
+//! window's last body, so another body drawn after the editor's cannot clear it.
+//!
+//! The composer covers what the apps each handled on their own:
+//!
+//! - Events stay in the order the platform sent them, so a Telex Backspace that replaces a
+//!   letter lands between the right two inserts.
+//! - Keys, text and clipboard events belong to the IME while it composes. Enter, Escape,
+//!   Backspace, Delete and Space that end a composition are its too, once: Enter that confirms a
+//!   word doesn't also start a line or submit, Backspace that empties the marked text doesn't
+//!   delete the character before it, and Escape that cancels doesn't leave the editor.
+//! - Text committed with no composition (IBus and fcitx send plain letters this way) leaves the
+//!   keys after it to the editor; only the Space that typed a committed space is dropped.
+//! - A bare line break committed by the IME confirms the marked text instead of breaking the line,
+//!   and interrupts the IME as a click does. With nothing composing, a line break sent as text or
+//!   committed arrives as [`Edit::LineBreak`], and the line break typed by a pressed Enter is
+//!   dropped, so each Enter arrives once.
+//! - Empty preedits outside a composition (Wayland sends them on every state change) are ignored.
+//! - A click while composing keeps the marked text as typed and tells the IME to drop its copy;
+//!   a late commit of the same text is dropped. Giving up the keyboard does the same.
+//! - Text that repeats the commit just made, as the text of the key the IME took (Apple Korean's
+//!   Space), is typed once. A key the editor gets in between, or a new pass, ends that.
+//! - Cmd/Ctrl chords don't type their letter if the host sends it; Alt and AltGr still type.
+//! - The candidate window is placed at the caret, clamped into the window.
+//!
+//! Platform bugs below egui (lost commits on macOS, the Korean first key, X11 focus) belong in
+//! winit and are fixed there; the composer doesn't work around them.
+
+mod composer;
+pub(crate) mod window;
+
+pub use composer::{Composer, Edit, Preedit, Processed, surrounding_chars};
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui/src/ime/tests.rs b/crates/ui/src/ime/tests.rs
new file mode 100644
index 00000000..17ecde3f
--- /dev/null
+++ b/crates/ui/src/ime/tests.rs
@@ -0,0 +1,550 @@
+use super::*;
+use egui::{Context, Event, IMEPurpose, ImeEvent, Key, Modifiers, PointerButton, RawInput, Rect, output::IMEOutput, pos2, vec2};
+
+fn preedit(text: &str, active: Option<std::ops::Range<usize>>) -> Event {
+    Event::Ime(ImeEvent::Preedit { text: text.into(), active_range_chars: active })
+}
+
+fn commit(text: &str) -> Event {
+    Event::Ime(ImeEvent::Commit(text.into()))
+}
+
+fn key_with(key: Key, modifiers: Modifiers) -> Event {
+    Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers }
+}
+
+fn key(key: Key) -> Event {
+    key_with(key, Modifiers::NONE)
+}
+
+fn text(t: &str) -> Event {
+    Event::Text(t.into())
+}
+
+fn click() -> Event {
+    Event::PointerButton { pos: pos2(5.0, 5.0), button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE }
+}
+
+/// Feeds passes of `(time, events)` and returns the text the editor ends with and every key it
+/// was given. Backspace deletes the last char; other keys are only recorded.
+fn type_passes(composer: &mut Composer, passes: &[(f64, Vec<Event>)]) -> (String, Vec<Key>) {
+    let mut doc = String::new();
+    let mut keys = Vec::new();
+    for (time, events) in passes {
+        for edit in composer.process(events, *time).edits {
+            match edit {
+                Edit::Insert(t) => doc.push_str(&t),
+                Edit::Key { key: Key::Backspace, .. } => {
+                    doc.pop();
+                    keys.push(Key::Backspace);
+                }
+                Edit::Key { key, .. } => keys.push(key),
+                Edit::LineBreak { .. } => keys.push(Key::Enter),
+                _ => {}
+            }
+        }
+    }
+    (doc, keys)
+}
+
+fn inserts(edits: &[Edit]) -> Vec<&str> {
+    edits.iter().filter_map(|e| if let Edit::Insert(t) = e { Some(t.as_str()) } else { None }).collect()
+}
+
+#[test]
+fn pinyin_on_wayland_commits_once_and_ignores_trailing_empty_preedits() {
+    let mut c = Composer::new();
+    let (doc, keys) = type_passes(
+        &mut c,
+        &[
+            (0.0, vec![preedit("c", Some(1..1))]),
+            (0.1, vec![preedit("ce", Some(2..2))]),
+            (0.2, vec![preedit("ce shi", Some(6..6))]),
+            // Space picks the first candidate (fcitx5 on GNOME Wayland).
+            (0.3, vec![preedit("", None), commit("测试"), preedit("", Some(0..0)), preedit("", None)]),
+            (0.4, vec![preedit("", None)]),
+            (1.0, vec![preedit("", None), key(Key::Enter)]),
+        ],
+    );
+    assert_eq!(doc, "测试");
+    assert_eq!(keys, [Key::Enter], "an Enter long after the commit is the user's");
+    assert!(!c.is_composing());
+}
+
+#[test]
+fn pinyin_on_windows_keeps_candidate_keys_for_the_ime() {
+    let mut c = Composer::new();
+    let (doc, keys) = type_passes(
+        &mut c,
+        &[
+            (0.0, vec![preedit("ni", Some(2..2))]),
+            // Picking candidate 2: the key and its text are the IME's.
+            (0.1, vec![key(Key::Num2), text("2"), preedit("你", Some(1..1))]),
+            #[expect(deprecated)]
+            (0.2, vec![preedit("你", Some(1..1)), preedit("", None), commit("你"), Event::Ime(ImeEvent::Disabled)]),
+        ],
+    );
+    assert_eq!(doc, "你");
+    assert!(keys.is_empty());
+}
+
+#[test]
+fn korean_two_set_splits_syllables_and_types_one_space() {
+    let mut c = Composer::new();
+    let (doc, keys) = type_passes(
+        &mut c,
+        &[
+            // g k s: ㅎ 하 한, the first key composing like the rest.
+            (0.0, vec![preedit("ㅎ", None)]),
+            (0.1, vec![preedit("하", None)]),
+            (0.2, vec![preedit("한", None)]),
+            // k moves ㄴ to the next syllable: 하 is committed, 나 composes.
+            (0.3, vec![commit("하"), preedit("나", None)]),
+            // Space after a syllable: commit, then the space itself.
+            (0.4, vec![commit("나"), key(Key::Space), text(" ")]),
+            // Apple Korean's Space with no syllable: committed and also sent as the key's text.
+            (0.8, vec![preedit(" ", None), commit(" "), preedit("", None), key(Key::Space), text(" ")]),
+            // 한 then 5: the digit after the syllable is kept.
+            (1.2, vec![preedit("한", None)]),
+            (1.3, vec![commit("한"), key(Key::Num5), text("5")]),
+        ],
+    );
+    assert_eq!(doc, "하나  한5");
+    assert_eq!(keys, [Key::Num5]);
+}
+
+#[test]
+fn korean_backspace_that_empties_the_syllable_deletes_nothing_else() {
+    let mut c = Composer::new();
+    let (doc, keys) = type_passes(
+        &mut c,
+        &[
+            (0.0, vec![text("a")]),
+            (0.1, vec![preedit("ㅎ", None)]),
+            (0.2, vec![preedit("", None), key(Key::Backspace)]),
+            (0.6, vec![key(Key::Backspace)]),
+        ],
+    );
+    assert_eq!(doc, "", "only the second Backspace reaches the text");
+    assert_eq!(keys, [Key::Backspace]);
+}
+
+#[test]
+fn a_raw_first_jamo_is_typed_not_lost() {
+    // Unpatched macOS sends the first key in a fresh app as a raw jamo (fixed in the shared
+    // winit); it is still typed.
+    let mut c = Composer::new();
+    let (doc, _) = type_passes(&mut c, &[(0.0, vec![key(Key::G), text("ㅎ")]), (0.1, vec![preedit("ㅏ", None)])]);
+    assert_eq!(doc, "ㅎ");
+    assert_eq!(c.preedit().map(|p| p.text), Some("ㅏ"));
+}
+
+#[test]
+fn japanese_conversion_tracks_the_segment_and_guards_the_confirming_enter() {
+    let mut c = Composer::new();
+    c.process(&[preedit("にほんご", Some(4..4))], 0.0);
+    // Space converts: the key is the IME's.
+    let p = c.process(&[key(Key::Space), preedit("日本語", Some(0..3))], 0.1);
+    assert!(p.events.is_empty(), "the converting Space is removed from the app's input");
+    assert_eq!(c.preedit().and_then(|p| p.active.cloned()), Some(0..3));
+    // Moving to the next segment.
+    c.process(&[key(Key::ArrowRight), preedit("日本語", Some(2..3))], 0.2);
+    assert_eq!(c.preedit().and_then(|p| p.active.cloned()), Some(2..3));
+    // An out-of-range segment is dropped rather than trusted.
+    c.process(&[preedit("日本語", Some(2..9))], 0.25);
+    assert_eq!(c.preedit().map(|p| p.active), Some(None));
+    let p = c.process(&[commit("日本語"), key(Key::Enter)], 0.3);
+    assert_eq!(inserts(&p.edits), ["日本語"]);
+    assert!(!p.edits.iter().any(|e| matches!(e, Edit::Key { .. })), "the confirming Enter doesn't submit");
+    // The next Enter is the user's.
+    let p = c.process(&[key(Key::Enter)], 0.9);
+    assert_eq!(p.edits, [Edit::Key { key: Key::Enter, modifiers: Modifiers::NONE, repeat: false }]);
+    // An Enter forwarded in the pass after the commit is still the IME's.
+    c.process(&[preedit("か", None)], 1.0);
+    c.process(&[commit("課")], 1.1);
+    let p = c.process(&[key(Key::Enter)], 1.11);
+    assert!(p.edits.is_empty());
+}
+
+#[test]
+fn a_bare_line_break_commit_keeps_the_marked_text() {
+    let mut c = Composer::new();
+    let (doc, keys) = type_passes(&mut c, &[(0.0, vec![preedit("かな", None)]), (0.1, vec![commit("\n"), key(Key::Enter)])]);
+    assert_eq!(doc, "かな");
+    assert!(keys.is_empty());
+    assert!(c.interrupted(), "the platform's input context may still hold the marked text");
+    // Interrupting the IME can commit the same text again.
+    let p = c.process(&[commit("かな")], 0.15);
+    assert!(inserts(&p.edits).is_empty());
+    assert!(!c.interrupted());
+}
+
+#[test]
+fn vietnamese_telex_keeps_backspace_between_its_inserts() {
+    // Unikey without preedit: "toaf" replaces the a with à by Backspace and text.
+    let mut c = Composer::new();
+    let p = c.process(&[text("t"), text("o"), text("a"), key(Key::Backspace), text("à")], 0.0);
+    assert_eq!(
+        p.edits,
+        [
+            Edit::Insert("t".into()),
+            Edit::Insert("o".into()),
+            Edit::Insert("a".into()),
+            Edit::Key { key: Key::Backspace, modifiers: Modifiers::NONE, repeat: false },
+            Edit::Insert("à".into()),
+        ]
+    );
+    // IBus-Unikey with preedit: the word composes and Space commits it, then types the space.
+    let (doc, _) = type_passes(
+        &mut c,
+        &[
+            (1.0, vec![preedit("t", None)]),
+            (1.1, vec![preedit("to", None)]),
+            (1.2, vec![preedit("toa", None)]),
+            (1.3, vec![preedit("toà", None)]),
+            (1.4, vec![preedit("", None), commit("toà"), key(Key::Space), text(" ")]),
+        ],
+    );
+    assert_eq!(doc, "toà ");
+}
+
+#[test]
+fn commits_without_a_composition_leave_the_next_keys_to_the_user() {
+    // IBus and fcitx send plain letters as commits.
+    let mut c = Composer::new();
+    let (doc, keys) = type_passes(&mut c, &[(0.0, vec![commit("a"), commit("b"), key(Key::Backspace)])]);
+    assert_eq!(doc, "a");
+    assert_eq!(keys, [Key::Backspace]);
+    for k in [Key::Enter, Key::Escape, Key::Delete, Key::Space] {
+        let (_, keys) = type_passes(&mut c, &[(1.0, vec![commit("x"), key(k)])]);
+        assert_eq!(keys, [k], "{k:?} after a bare commit is the user's");
+    }
+    // Telex through IBus without preedit: Backspace replaces the a.
+    let (doc, _) = type_passes(&mut c, &[(2.0, vec![commit("t"), commit("o"), commit("a"), key(Key::Backspace), commit("à")])]);
+    assert_eq!(doc, "toà");
+    // A bare commit of a space guards only the Space key that typed it.
+    let (doc, keys) = type_passes(&mut c, &[(3.0, vec![commit(" "), key(Key::Space), text(" ")]), (3.01, vec![commit(" "), key(Key::Backspace)])]);
+    assert_eq!(doc, " ");
+    assert_eq!(keys, [Key::Backspace]);
+}
+
+#[test]
+fn only_text_right_after_a_commit_is_its_echo() {
+    let typed = |passes: &[(f64, Vec<Event>)]| type_passes(&mut Composer::new(), passes).0;
+    // A key the editor gets after a commit types its own text.
+    assert_eq!(typed(&[(0.0, vec![commit("a"), key(Key::A), text("a")])]), "aa");
+    assert_eq!(typed(&[(0.0, vec![commit("a"), text("a")])]), "a");
+    assert_eq!(typed(&[(0.0, vec![commit("あ"), text("あ")])]), "あ");
+    // The echo comes in the commit's pass; text in a later pass is typed.
+    assert_eq!(typed(&[(0.0, vec![commit("a")]), (0.01, vec![text("a")])]), "aa");
+    assert_eq!(typed(&[(0.0, vec![key(Key::A), text("a")])]), "a");
+}
+
+#[test]
+fn a_line_break_with_nothing_composing_is_enter_once() {
+    let line_break = |modifiers| Edit::LineBreak { modifiers };
+    let enter = Edit::Key { key: Key::Enter, modifiers: Modifiers::NONE, repeat: false };
+    let mut c = Composer::new();
+    assert_eq!(c.process(&[commit("\n")], 0.0).edits, [line_break(Modifiers::NONE)]);
+    assert_eq!(c.process(&[text("\n")], 1.0).edits, [line_break(Modifiers::NONE)]);
+    // The key and its text, in either order, are one Enter: the key when it came first.
+    let p = c.process(&[key(Key::Enter), text("\r")], 2.0);
+    assert_eq!(p.edits, [enter]);
+    assert_eq!(p.events, [key(Key::Enter), text("\r")], "the pressed Enter stays in the input");
+    assert_eq!(c.process(&[commit("\n"), key(Key::Enter), text("\n")], 3.0).edits, [line_break(Modifiers::NONE)]);
+    // Shift+Enter stays Shift+Enter.
+    let p = c.process(&[Event::ModifiersChanged(Modifiers::SHIFT), commit("\r")], 4.0);
+    assert_eq!(p.edits, [line_break(Modifiers::SHIFT)]);
+}
+
+#[test]
+fn dead_keys_compose_or_arrive_as_text() {
+    let mut c = Composer::new();
+    // macOS: ⌥E marks the accent, the next key commits the letter.
+    let (doc, _) = type_passes(&mut c, &[(0.0, vec![preedit("´", None)]), (0.1, vec![preedit("", None), commit("í")])]);
+    assert_eq!(doc, "í");
+    // Windows, X11 and Wayland compose in the keyboard layout: only the result arrives.
+    let (doc, _) = type_passes(&mut c, &[(1.0, vec![text("é")])]);
+    assert_eq!(doc, "é");
+    // Escape cancels a marked accent without reaching the editor.
+    let (doc, keys) = type_passes(&mut c, &[(2.0, vec![preedit("¨", None)]), (2.1, vec![preedit("", None), key(Key::Escape)])]);
+    assert_eq!(doc, "");
+    assert!(keys.is_empty());
+}
+
+#[test]
+fn a_click_while_composing_keeps_the_text_and_drops_the_late_commit() {
+    let mut c = Composer::new();
+    c.process(&[preedit("ce", None)], 0.0);
+    let p = c.process(&[click()], 0.1);
+    assert_eq!(p.edits, [Edit::Preedit { text: String::new(), active: None }, Edit::Insert("ce".into())]);
+    assert_eq!(p.events, [click()], "the app still handles the click");
+    // Windows commits the dropped composition when the IME is interrupted.
+    let p = c.process(&[preedit("", Some(0..0)), commit("ce")], 0.15);
+    assert!(inserts(&p.edits).is_empty());
+    // The same text typed later is typed.
+    let p = c.process(&[commit("ce")], 2.0);
+    assert_eq!(inserts(&p.edits), ["ce"]);
+}
+
+#[test]
+fn shortcut_chords_dont_type_but_altgr_does() {
+    let mut c = Composer::new();
+    let p = c.process(&[key_with(Key::S, Modifiers::COMMAND), text("s")], 0.0);
+    assert!(inserts(&p.edits).is_empty());
+    assert!(matches!(p.edits[..], [Edit::Key { key: Key::S, .. }]));
+    let altgr = Modifiers { alt: true, ctrl: true, ..Modifiers::NONE };
+    let p = c.process(&[key_with(Key::Q, altgr), text("@")], 0.1);
+    assert_eq!(inserts(&p.edits), ["@"]);
+}
+
+#[test]
+fn clipboard_and_surrounding_deletes_are_the_apps_to_apply() {
+    let delete = |before_chars, after_chars| Event::Ime(ImeEvent::DeleteSurrounding { before_chars, after_chars });
+    let mut c = Composer::new();
+    // While composing, they are the IME's: no edits, and gone from the input.
+    let p = c.process(&[preedit("ni", None), Event::Paste("x".into()), Event::Copy, Event::Cut, delete(1, 0)], 0.0);
+    assert_eq!(p.edits, [Edit::Preedit { text: "ni".into(), active: None }]);
+    assert!(p.events.is_empty());
+    // After it, in order with the text. The clipboard events stay in the input too.
+    let events = [preedit("", None), Event::Copy, text("a"), Event::Cut, Event::Paste("x".into()), delete(2, 1)];
+    let p = c.process(&events, 0.1);
+    assert_eq!(
+        p.edits,
+        [
+            Edit::Preedit { text: String::new(), active: None },
+            Edit::Copy,
+            Edit::Insert("a".into()),
+            Edit::Cut,
+            Edit::Paste("x".into()),
+            Edit::DeleteSurrounding { before_chars: 2, after_chars: 1 },
+        ]
+    );
+    assert_eq!(p.events, [Event::Copy, text("a"), Event::Cut, Event::Paste("x".into())]);
+}
+
+/// The suite's egui fork's `ImeEvent::DeleteSurroundingBytes`, read from JSON; `None` on
+/// crates.io egui, which has no such event, so the test builds against both.
+fn delete_bytes(before_bytes: usize, after_bytes: usize) -> Option<Event> {
+    let known: Result<ImeEvent, _> = serde_json::from_str(r#"{"DeleteSurrounding":{"before_chars":1,"after_chars":0}}"#);
+    assert!(known.is_ok(), "egui's events read from JSON: {known:?}");
+    let json = format!(r#"{{"DeleteSurroundingBytes":{{"before_bytes":{before_bytes},"after_bytes":{after_bytes}}}}}"#);
+    serde_json::from_str(&json).ok().map(Event::Ime)
+}
+
+#[test]
+fn byte_deletes_come_before_the_commit_that_replaces_them() {
+    let (Some(delete_e), Some(delete_jamo)) = (delete_bytes(1, 0), delete_bytes(3, 2)) else {
+        return;
+    };
+    let mut c = Composer::new();
+    // macOS press-and-hold: "e" typed, then "é" from the accent menu replaces it.
+    c.process(&[text("e")], 0.0);
+    let p = c.process(&[delete_e, commit("é")], 1.0);
+    assert_eq!(p.edits, [Edit::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }, Edit::Insert("é".into())]);
+    assert!(p.events.is_empty());
+    // While composing too: the counts start at the caret, where the marked text is.
+    c.process(&[preedit("ㅎ", None)], 2.0);
+    let p = c.process(&[delete_jamo, commit("하")], 2.1);
+    assert_eq!(
+        p.edits,
+        [
+            Edit::DeleteSurroundingBytes { before_bytes: 3, after_bytes: 2 },
+            Edit::Preedit { text: String::new(), active: None },
+            Edit::Insert("하".into()),
+        ]
+    );
+}
+
+#[test]
+fn byte_counts_delete_only_whole_chars() {
+    // A combining acute is two bytes; "é" is two bytes, "🇧🇪" two four-byte chars.
+    assert_eq!(surrounding_chars("cafe\u{301}", "", 2, 0), (1, 0));
+    assert_eq!(surrounding_chars("aé", "", 1, 0), (0, 0));
+    assert_eq!(surrounding_chars("aé", "", 3, 0), (2, 0));
+    assert_eq!(surrounding_chars("x🇧🇪", "", 4, 0), (1, 0));
+    assert_eq!(surrounding_chars("", "éb", 0, 3), (0, 2));
+    assert_eq!(surrounding_chars("", "éb", 0, 1), (0, 0));
+    assert_eq!(surrounding_chars("ab", "cd", 9, 9), (2, 2));
+}
+
+#[test]
+fn the_app_ends_a_composition_keeping_or_discarding_the_marked_text() {
+    let ctx = Context::default();
+    let mut c = Composer::new();
+    run(&ctx, 0.0, vec![preedit("かな", None)], |ctx| {
+        c.update(ctx, true);
+    });
+    let mut kept = None;
+    let out = run(&ctx, 0.1, vec![], |ctx| {
+        // A command run before the composer's update ends the editing.
+        kept = c.end(ctx);
+        c.update(ctx, true);
+    });
+    assert_eq!(kept.as_deref(), Some("かな"));
+    assert!(c.interrupted());
+    assert!(out.platform_output.ime.is_some_and(|i| i.should_interrupt_composition));
+
+    // An editor that already keeps the marked text discards the composer's.
+    run(&ctx, 0.2, vec![preedit("ね", None)], |ctx| {
+        c.update(ctx, true);
+    });
+    assert!(!c.interrupted());
+    let out = run(&ctx, 0.3, vec![], |ctx| {
+        c.update(ctx, true);
+        c.discard(ctx);
+    });
+    assert!(!c.is_composing() && c.interrupted());
+    assert!(out.platform_output.ime.is_some_and(|i| i.should_interrupt_composition));
+    let mut edits = Vec::new();
+    run(&ctx, 0.35, vec![commit("ね")], |ctx| edits = c.update(ctx, true));
+    assert!(inserts(&edits).is_empty(), "the IME's late commit is dropped");
+}
+
+#[test]
+fn the_ime_context_generation_is_new_only_when_the_context_starts_again() {
+    let ctx = Context::default();
+    let mut c = Composer::new();
+    let caret = Rect::from_min_size(pos2(10.0, 10.0), vec2(1.0, 16.0));
+    let mut time = 0.0;
+    let mut pass = |c: &mut Composer, editing: &[bool]| {
+        time += 0.1;
+        let out = run(&ctx, time, vec![], |ctx| {
+            for e in editing {
+                c.update(ctx, *e);
+            }
+            if !editing.is_empty() {
+                c.set_caret(ctx, caret);
+            }
+        });
+        out.platform_output.ime.as_ref().map(|i| i.context_generation)
+    };
+    let first = pass(&mut c, &[true]);
+    assert!(first.is_some());
+    assert_eq!(pass(&mut c, &[true]), first, "consecutive editing passes keep the context");
+    // The editing ends and starts again in one pass.
+    let again = pass(&mut c, &[false, true]);
+    assert!(again.is_some() && again != first, "{again:?} after {first:?}");
+    assert_eq!(pass(&mut c, &[true]), again);
+    // A pass without the composer.
+    assert_eq!(pass(&mut c, &[]), None);
+    let after_skip = pass(&mut c, &[true]);
+    assert!(after_skip.is_some() && after_skip != again, "{after_skip:?} after {again:?}");
+}
+
+fn run(ctx: &Context, time: f64, events: Vec<Event>, f: impl FnMut(&Context)) -> egui::FullOutput {
+    let raw = RawInput { time: Some(time), events, screen_rect: Some(Rect::from_min_size(pos2(0.0, 0.0), vec2(800.0, 600.0))), ..Default::default() };
+    let mut f = f;
+    let mut out = ctx.run_ui(raw, |ui| f(ui.ctx()));
+    out.textures_delta.clear();
+    out
+}
+
+#[test]
+fn the_ime_is_on_at_the_caret_only_while_editing() {
+    let ctx = Context::default();
+    let mut c = Composer::new();
+    let caret = Rect::from_min_size(pos2(100.0, 50.0), vec2(0.0, 16.0));
+    let out = run(&ctx, 0.0, vec![preedit("に", None), key(Key::Space)], |ctx| {
+        c.update(ctx, true);
+        assert!(ctx.input(|i| i.events.is_empty()), "the IME's events are removed for later handlers");
+        c.set_caret(ctx, caret);
+    });
+    let ime = out.platform_output.ime.expect("IME on while a caret is on the canvas");
+    assert_eq!(ime.cursor_rect, Rect::from_min_size(pos2(100.0, 50.0), vec2(1.0, 16.0)));
+    assert!(!ime.should_interrupt_composition);
+
+    // A click away keeps the text and interrupts the IME.
+    let mut edits = Vec::new();
+    let out = run(&ctx, 0.1, vec![click()], |ctx| {
+        edits = c.update(ctx, true);
+        c.set_caret(ctx, caret);
+    });
+    assert!(edits.contains(&Edit::Insert("に".into())));
+    assert!(out.platform_output.ime.is_some_and(|i| i.should_interrupt_composition));
+
+    // Leaving the canvas keeps marked text and turns the IME off.
+    run(&ctx, 0.2, vec![preedit("か", None)], |ctx| {
+        c.update(ctx, true);
+    });
+    let out = run(&ctx, 0.3, vec![], |ctx| edits = c.update(ctx, false));
+    assert_eq!(edits, [Edit::Preedit { text: String::new(), active: None }, Edit::Insert("か".into())]);
+    assert!(out.platform_output.ime.is_none());
+    assert!(c.interrupted(), "the IME may still hold the marked text it dropped");
+}
+
+#[test]
+fn editing_that_ends_mid_pass_turns_the_ime_off_in_that_pass() {
+    let ctx = Context::default();
+    let mut c = Composer::new();
+    let caret = Rect::from_min_size(pos2(100.0, 50.0), vec2(0.0, 16.0));
+    run(&ctx, 0.0, vec![preedit("に", None)], |ctx| {
+        c.update(ctx, true);
+        c.set_caret(ctx, caret);
+    });
+    let mut edits = Vec::new();
+    let mut interrupted = false;
+    let out = run(&ctx, 0.1, vec![click()], |ctx| {
+        edits = c.update(ctx, true);
+        // The click closed the editor.
+        edits.extend(c.update(ctx, false));
+        interrupted = c.interrupted();
+        c.set_caret(ctx, caret);
+    });
+    assert_eq!(inserts(&edits), ["に"]);
+    assert!(interrupted, "the second update keeps the first one's interrupt");
+    assert!(out.platform_output.ime.is_none());
+    // A pass in which the composer wrote nothing leaves another widget's IME output alone.
+    let other = IMEOutput::new(egui::Id::unique("other"), 1, IMEPurpose::Normal, caret, caret);
+    let out = run(&ctx, 0.2, vec![], |ctx| {
+        ctx.output_mut(|o| o.ime = Some(other.clone()));
+        c.update(ctx, false);
+    });
+    assert_eq!(out.platform_output.ime, Some(other));
+}
+
+#[test]
+fn a_bare_line_break_commit_interrupts_the_ime() {
+    let ctx = Context::default();
+    let mut c = Composer::new();
+    run(&ctx, 0.0, vec![preedit("かな", None)], |ctx| {
+        c.update(ctx, true);
+    });
+    let mut edits = Vec::new();
+    let out = run(&ctx, 0.1, vec![commit("\n")], |ctx| edits = c.update(ctx, true));
+    assert_eq!(inserts(&edits), ["かな"]);
+    assert!(out.platform_output.ime.is_some_and(|i| i.should_interrupt_composition));
+}
+
+#[test]
+fn update_starts_from_the_modifiers_held() {
+    // Cmd went down while another view had the keyboard; its ModifiersChanged went there.
+    let ctx = Context::default();
+    let mut c = Composer::new();
+    run(&ctx, 0.0, vec![Event::ModifiersChanged(Modifiers::COMMAND)], |_| {});
+    let mut edits = Vec::new();
+    run(&ctx, 0.1, vec![text("s")], |ctx| edits = c.update(ctx, true));
+    assert!(edits.is_empty(), "Cmd+S doesn't type an s");
+}
+
+#[test]
+fn a_caret_off_the_canvas_keeps_the_candidates_on_screen() {
+    let ctx = Context::default();
+    let mut c = Composer::new();
+    let out = run(&ctx, 0.0, vec![], |ctx| {
+        c.update(ctx, true);
+        c.set_caret(ctx, Rect::from_min_size(pos2(-50.0, 900.0), vec2(2.0, 20.0)));
+    });
+    let r = out.platform_output.ime.map(|i| i.cursor_rect);
+    assert_eq!(r, Some(Rect::from_min_size(pos2(0.0, 580.0), vec2(2.0, 20.0))));
+}
+
+#[test]
+fn a_caret_past_a_tiny_or_unbounded_screen_stays_inside_it() {
+    let caret = Rect::from_min_size(pos2(10.0, 10.0), vec2(2.0, 20.0));
+    let tiny = Rect::from_min_max(pos2(0.1, 0.1), pos2(0.5, 0.5));
+    assert_eq!(composer::caret_area(caret, tiny), Rect::from_min_size(tiny.min, tiny.size()));
+    assert_eq!(composer::caret_area(caret, Rect::EVERYTHING), caret);
+    let nan = Rect::from_min_max(pos2(0.0, 0.0), pos2(f32::NAN, 600.0));
+    assert_eq!(composer::caret_area(caret, nan), caret);
+}
diff --git a/crates/ui/src/ime/window.rs b/crates/ui/src/ime/window.rs
new file mode 100644
index 00000000..a0ab51f4
--- /dev/null
+++ b/crates/ui/src/ime/window.rs
@@ -0,0 +1,73 @@
+//! The IME descriptor of a native floating window, published by docking once per pass.
+//!
+//! Docking draws each native window's panel bodies in that window's own egui pass. A composer
+//! drawn there records its descriptor for the pass instead of writing it into the output, and
+//! docking writes what was recorded after the window's last body. So a body drawn after the
+//! editor's cannot clear the descriptor: egui-winit turns the IME off in a pass without one,
+//! which ends the composition.
+
+use egui::{Context, Id, ViewportId, output::IMEOutput};
+
+/// The descriptor the composers of one native-window pass recorded.
+#[derive(Clone)]
+struct Recorded {
+    pass: u64,
+    ime: Option<IMEOutput>,
+}
+
+fn key(viewport: ViewportId) -> Id {
+    Id::unique(("craft_ui::ime::window", viewport))
+}
+
+/// The recording for the current pass of the current viewport, if docking began one.
+fn current(ctx: &Context) -> Option<Recorded> {
+    let (pass, key) = (ctx.cumulative_pass_nr(), key(ctx.viewport_id()));
+    ctx.data(|d| d.get_temp::<Recorded>(key)).filter(|r| r.pass == pass)
+}
+
+fn store(ctx: &Context, recorded: Recorded) {
+    let key = key(ctx.viewport_id());
+    ctx.data_mut(|d| d.insert_temp(key, recorded));
+}
+
+/// Docking starts drawing a native window's bodies in this pass of the current viewport.
+#[cfg_attr(not(feature = "native-windows"), allow(dead_code))]
+pub(crate) fn begin_window(ctx: &Context) {
+    let (recorded, key) = (Recorded { pass: ctx.cumulative_pass_nr(), ime: None }, key(ctx.viewport_id()));
+    ctx.data_mut(|d| d.insert_temp(key, recorded));
+}
+
+/// Docking has drawn the window's last body: the recorded descriptor goes out, unless something
+/// wrote one directly in this pass (a focused egui `TextEdit`, an app's own editor).
+#[cfg_attr(not(feature = "native-windows"), allow(dead_code))]
+pub(crate) fn finish_window(ctx: &Context) {
+    let (recorded, key) = (current(ctx), key(ctx.viewport_id()));
+    ctx.data_mut(|d| d.remove::<Recorded>(key));
+    if let Some(ime) = recorded.and_then(|r| r.ime) {
+        ctx.output_mut(|o| {
+            o.ime.get_or_insert(ime);
+        });
+    }
+}
+
+/// Whether composers record their descriptor in this pass rather than write it.
+pub(super) fn recording(ctx: &Context) -> bool {
+    current(ctx).is_some()
+}
+
+/// Record `ime` for the pass. A later record in the same pass keeps an earlier interrupt.
+pub(super) fn record(ctx: &Context, mut ime: IMEOutput) {
+    let Some(mut recorded) = current(ctx) else { return };
+    ime.should_interrupt_composition |= recorded.ime.as_ref().is_some_and(|ime| ime.should_interrupt_composition);
+    recorded.ime = Some(ime);
+    store(ctx, recorded);
+}
+
+/// Drop the pass's descriptor if `owner` recorded it.
+pub(super) fn withdraw(ctx: &Context, owner: Id) {
+    let Some(mut recorded) = current(ctx) else { return };
+    if recorded.ime.as_ref().is_some_and(|ime| ime.owner == owner) {
+        recorded.ime = None;
+        store(ctx, recorded);
+    }
+}
diff --git a/crates/ui/src/layout/mod.rs b/crates/ui/src/layout/mod.rs
index 335dd072..a6ffed84 100644
--- a/crates/ui/src/layout/mod.rs
+++ b/crates/ui/src/layout/mod.rs
@@ -9,6 +9,7 @@ mod resize;
 mod toolbar;
 
 pub use geometry::{SplitAxis, SplitLayout, SplitSize, split_rect};
+pub(crate) use resize::drag_focus;
 pub use resize::{ResizeHandle, ResizeHandleStyle, ResizeResponse};
 pub use toolbar::{ToolbarFit, fit_toolbar};
 
diff --git a/crates/ui/src/layout/resize.rs b/crates/ui/src/layout/resize.rs
index fc51aa1f..4206190a 100644
--- a/crates/ui/src/layout/resize.rs
+++ b/crates/ui/src/layout/resize.rs
@@ -24,7 +24,8 @@ pub struct ResizeResponse {
 /// A focusable divider with pointer, arrow-key and accessibility resizing.
 ///
 /// This widget never stores or changes a pane size. IDs and labels are separate, so translated
-/// labels do not change identity. Pointer drags retain egui's immediate `Sense::drag` behavior.
+/// labels do not change identity. Pointer drags retain egui's immediate `Sense::drag` behavior
+/// and hold focus only for the gesture (see [`drag_focus`]).
 /// Only arrows along the split axis are consumed, while this handle has focus. Tab remains
 /// available for normal focus traversal.
 pub struct ResizeHandle<'a> {
@@ -36,11 +37,12 @@ pub struct ResizeHandle<'a> {
     hit_margin: f32,
     step: f32,
     value: Option<(f32, RangeInclusive<f32>)>,
+    reversed: bool,
 }
 
 impl<'a> ResizeHandle<'a> {
     pub fn new(id: Id, axis: SplitAxis, rect: Rect, label: &'a str, style: ResizeHandleStyle) -> Self {
-        Self { id, axis, rect, label, style, hit_margin: 3.0, step: 8.0, value: None }
+        Self { id, axis, rect, label, style, hit_margin: 3.0, step: 8.0, value: None, reversed: false }
     }
 
     /// Expand the hit rectangle along the movement axis, in logical points. Default: 3.
@@ -62,6 +64,22 @@ impl<'a> ResizeHandle<'a> {
         self
     }
 
+    /// The value grows against the axis, as for a column docked on the right edge that widens
+    /// as its divider moves left. Accessibility actions then work on the value; the pointer
+    /// and arrow keys stay physical, and `delta` stays along the axis.
+    pub fn reversed(mut self, reversed: bool) -> Self {
+        self.reversed = reversed;
+        self
+    }
+
+    /// Show the handle and return a resize proposal for the caller to apply.
+    ///
+    /// Invalid geometry or values make the handle inert. Pointer drags and arrow keys produce a
+    /// physical `delta` along the split axis; `reversed` flips only accessibility
+    /// increment/decrement/SetValue changes, not the pointer or arrow movement. A finite nonzero
+    /// delta marks the response changed. The accessibility role is `Splitter`, oriented
+    /// perpendicular to the movement axis, with Increment/Decrement and optional SetValue actions
+    /// and numeric value when configured.
     pub fn show(self, ui: &mut Ui) -> ResizeResponse {
         let hit = self.rect.expand2(match self.axis {
             SplitAxis::Horizontal => Vec2::new(self.hit_margin, 0.0),
@@ -83,9 +101,7 @@ impl<'a> ResizeHandle<'a> {
         let enabled = valid && response.enabled();
         let mut delta = 0.0;
         if enabled {
-            if response.drag_started() {
-                response.request_focus();
-            }
+            drag_focus(ui, &response);
             if response.dragged() {
                 let drag = response.drag_delta();
                 delta = match self.axis {
@@ -117,27 +133,30 @@ impl<'a> ResizeHandle<'a> {
                     }
                 });
             }
+            let mut change = 0.0;
             ui.input_mut(|input| {
                 input.consume_accesskit_action_requests(response.id, |request| match request.action {
                     accesskit::Action::Increment => {
-                        delta += self.step;
+                        change += self.step;
                         true
                     }
                     accesskit::Action::Decrement => {
-                        delta -= self.step;
+                        change -= self.step;
                         true
                     }
                     accesskit::Action::SetValue => {
                         if let (Some((value, range)), Some(accesskit::ActionData::NumericValue(new_value))) = (&self.value, &request.data)
                             && new_value.is_finite()
                         {
-                            delta = (new_value.clamp(f64::from(*range.start()), f64::from(*range.end())) - f64::from(*value)) as f32;
+                            change = (new_value.clamp(f64::from(*range.start()), f64::from(*range.end())) - f64::from(*value)) as f32;
+                            delta = 0.0;
                         }
                         true
                     }
                     _ => false,
                 });
             });
+            delta += if self.reversed { -change } else { change };
         }
         if !delta.is_finite() {
             delta = 0.0;
@@ -196,3 +215,19 @@ impl<'a> ResizeHandle<'a> {
         ResizeResponse { response, delta }
     }
 }
+
+/// A pointer drag focuses its handle for the gesture only and gives the focus up on release,
+/// so the app's shortcuts and its canvas arrow keys work again (they defer to a focused
+/// widget). A handle focused from the keyboard (Tab, F6) before the drag keeps its focus.
+pub(crate) fn drag_focus(ui: &Ui, response: &Response) {
+    let key = response.id.with("pointer-focus");
+    if response.drag_started() {
+        if !response.has_focus() {
+            ui.ctx().data_mut(|d| d.insert_temp(key, ()));
+        }
+        response.request_focus();
+    }
+    if response.drag_stopped() && ui.ctx().data_mut(|d| d.remove_temp::<()>(key)).is_some() {
+        response.surrender_focus();
+    }
+}
diff --git a/crates/ui/src/layout/tests.rs b/crates/ui/src/layout/tests.rs
index cdd44cb5..f306f7a6 100644
--- a/crates/ui/src/layout/tests.rs
+++ b/crates/ui/src/layout/tests.rs
@@ -107,6 +107,8 @@ struct HandleTest {
 }
 
 impl HandleTest {
+    /// Create a handle test with horizontal axis, a 4×140 pt rect, the label
+    /// `Resize panels`, enabled state and value 100.
     fn new() -> Self {
         let ctx = Context::default();
         ctx.enable_accesskit();
@@ -120,6 +122,8 @@ impl HandleTest {
         }
     }
 
+    /// Run one enabled `ResizeHandle` in a 400×200 frame and return its response plus the frame
+    /// output; texture deltas are cleared.
     fn frame(&mut self, events: Vec<Event>) -> (ResizeResponse, FullOutput) {
         let ctx = self.ctx.clone();
         let mut result = None;
@@ -171,9 +175,32 @@ fn resize_handle_preserves_pointer_drag_lifecycle_and_reports_per_frame_delta()
     let (response, _) = h.frame(vec![pointer(center + vec2(16.0, 0.0), false)]);
     assert!(response.response.drag_stopped());
     assert_eq!(response.delta, 0.0);
+    assert!(!response.response.has_focus());
+    let (response, _) = h.frame(vec![key(Key::ArrowRight)]);
+    assert!(h.ctx.memory(|m| m.focused()).is_none(), "after a pointer drag no widget has focus, so app shortcuts work");
+    assert_eq!(response.delta, 0.0, "arrow keys are left to the app");
     assert_eq!(h.value, 100.0, "the component never owns pane state");
 }
 
+#[test]
+fn tab_focused_handle_keeps_focus_through_a_pointer_drag_and_arrow_resizing() {
+    let mut h = HandleTest::new();
+    let center = h.rect.center();
+    h.settle();
+    h.frame(vec![key(Key::Tab)]);
+    let (response, _) = h.frame(vec![]);
+    assert!(response.response.has_focus(), "Tab reaches the handle");
+    h.frame(vec![Event::PointerMoved(center), pointer(center, true)]);
+    h.frame(vec![Event::PointerMoved(center + vec2(12.0, 0.0))]);
+    h.frame(vec![pointer(center + vec2(12.0, 0.0), false)]);
+    let (response, _) = h.frame(vec![key(Key::ArrowRight)]);
+    assert!(response.response.has_focus());
+    assert_eq!(response.delta, 8.0);
+    let (response, _) = h.frame(vec![key(Key::ArrowLeft)]);
+    assert!(response.response.has_focus());
+    assert_eq!(response.delta, -8.0);
+}
+
 #[test]
 fn focused_handle_resizes_with_axis_arrows_and_draws_visible_focus() {
     for (axis, forward, back) in [(SplitAxis::Horizontal, Key::ArrowRight, Key::ArrowLeft), (SplitAxis::Vertical, Key::ArrowDown, Key::ArrowUp)] {
diff --git a/crates/ui/src/lib.rs b/crates/ui/src/lib.rs
index fcb60829..b37b23dd 100644
--- a/crates/ui/src/lib.rs
+++ b/crates/ui/src/lib.rs
@@ -6,9 +6,19 @@
 //! accept focused style values and return egui responses; no application engine is required.
 
 pub mod buttons;
+pub mod capture;
+pub mod direction;
 pub mod docking;
+mod focus;
+pub mod fonts;
 pub mod icons;
+pub mod ime;
 pub mod layout;
+pub mod localized;
+pub mod panes;
 pub mod printing;
 pub mod tabs;
+#[cfg(all(feature = "screen-testing", not(target_arch = "wasm32")))]
+pub mod testing;
+pub mod text;
 pub mod theme;
diff --git a/crates/ui/src/localized/mod.rs b/crates/ui/src/localized/mod.rs
new file mode 100644
index 00000000..0bfeb73f
--- /dev/null
+++ b/crates/ui/src/localized/mod.rs
@@ -0,0 +1,797 @@
+//! Number widgets that write numbers the way the user's region does (its digits, decimal mark and
+//! grouping) and read back any digits with the region's separators.
+//!
+//! [`LocaleNumbers`] wraps a [`craft_i18n::Format`], which writes and reads the numbers.
+//! [`LocalizedDragValue`] puts them on an [`egui::DragValue`]; [`NumberField`] is a text field for
+//! apps that edit numbers in a [`egui::TextEdit`], with the apps' panel-field behaviour: a
+//! [`Recessed`] box, scrubbing by the label, stepping to multiples of the step, a blank field for
+//! [mixed](NumberField::mixed) values and [`focus_first_field`]. Text that isn't a number never
+//! changes the value: it is outlined in the error color with a tooltip saying why, from the
+//! catalog with [`LocaleNumbers::with_catalog`].
+
+use std::cell::{Cell, RefCell};
+use std::ops::RangeInclusive;
+use std::rc::Rc;
+use std::sync::Arc;
+
+use craft_i18n::{Format, I18n, Lang, NumberError};
+use egui::emath::{Numeric, round_to_decimals};
+use egui::response::Flags;
+use egui::text::{CCursor, CCursorRange};
+use egui::{
+    Align2, AsIdSalt, Color32, Context, CornerRadius, CursorIcon, DragValue, Event, Frame, Id, IdSalt, Key, Margin, Modifiers, MouseWheelUnit, Rect,
+    Response, Sense, Stroke, StrokeKind, Style, TextEdit, Ui, Vec2, Widget, vec2,
+};
+
+#[cfg(test)]
+mod tests;
+
+/// How long a [`LocalizedDragValue`] keeps marking text it could not read after reverting, in
+/// seconds.
+const REJECTED_FOR: f64 = 2.5;
+
+/// Points of horizontal drag on a [`NumberField`]'s label per step.
+const SCRUB_POINTS_PER_STEP: f32 = 2.0;
+
+type Messages = Arc<dyn Fn(&'static str) -> String + Send + Sync>;
+type Fallback<'a> = Box<dyn 'a + Fn(&str) -> Option<f64>>;
+type Formatter<'a> = Box<dyn 'a + Fn(f64, RangeInclusive<usize>) -> Option<String>>;
+/// The last text egui asked the parser to read: whether it is still being typed, and the result.
+type LastRead = Rc<Cell<Option<(bool, Result<f64, NumberError>)>>>;
+
+/// How the user's region writes and reads numbers. Cheap to clone; build it from
+/// [`I18n::format`] so widgets match the app's counts and sizes.
+#[derive(Clone)]
+pub struct LocaleNumbers {
+    format: Arc<Format>,
+    messages: Option<Messages>,
+    grouping: bool,
+}
+
+impl std::fmt::Debug for LocaleNumbers {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LocaleNumbers").field("format", &self.format).finish_non_exhaustive()
+    }
+}
+
+impl LocaleNumbers {
+    pub fn new(format: Arc<Format>) -> LocaleNumbers {
+        LocaleNumbers { format, messages: None, grouping: true }
+    }
+
+    /// The numbers of a locale tag (`de-CH`, `ar-EG`) with its own digits.
+    pub fn from_tag(tag: &str) -> LocaleNumbers {
+        LocaleNumbers::new(Arc::new(Format::from_tag(tag)))
+    }
+
+    /// The error tooltips from `i18n`'s catalog in `lang`: the plain rows keyed by the English
+    /// text ([`message`]), English where a row is missing.
+    pub fn with_catalog(self, i18n: &I18n, lang: Lang) -> LocaleNumbers {
+        let rows: Vec<(&'static str, String)> = MESSAGES.iter().map(|&english| (english, i18n.t(lang, english).to_owned())).collect();
+        self.with_messages(move |english| rows.iter().find(|(key, _)| *key == english).map_or_else(|| english.to_owned(), |(_, row)| row.clone()))
+    }
+
+    /// Translate the error tooltips with an app's own lookup: `translate` gets the English text
+    /// ([`message`]) and returns it in the interface language.
+    pub fn with_messages(mut self, translate: impl Fn(&'static str) -> String + Send + Sync + 'static) -> LocaleNumbers {
+        self.messages = Some(Arc::new(translate));
+        self
+    }
+
+    /// Write numbers without grouping separators, for pixel sizes and years: `1920`, not `1,920`.
+    /// Grouped text still reads back.
+    pub fn ungrouped(mut self) -> LocaleNumbers {
+        self.grouping = false;
+        self
+    }
+
+    /// `value` with between `decimals.start()` and `decimals.end()` digits after the decimal mark,
+    /// trailing zeros dropped down to the minimum: `1,5`, `١٬٢٣٤٫٥`.
+    pub fn format(&self, value: f64, decimals: RangeInclusive<usize>) -> String {
+        let (min, max) = (*decimals.start(), (*decimals.end()).max(*decimals.start()));
+        let full = round_to_decimals(value, max);
+        let decimals = (min..max).find(|&d| round_to_decimals(value, d) == full).unwrap_or(max);
+        // `-0.001` shown with two decimals is `0,00`, not `-0,00`.
+        let value = if round_to_decimals(value, decimals) == 0.0 { 0.0 } else { value };
+        if self.grouping { self.format.number(value, decimals) } else { self.format.number_ungrouped(value, decimals) }
+    }
+
+    /// The number in `text`, as [`Format::parse`] reads it: what [`LocaleNumbers::format`] writes,
+    /// in any digits.
+    pub fn parse(&self, text: &str) -> Result<f64, NumberError> {
+        self.format.parse(text)
+    }
+
+    fn describe(&self, error: NumberError) -> String {
+        let english = message(error);
+        self.messages.as_ref().map_or_else(|| english.to_owned(), |translate| translate(english))
+    }
+}
+
+/// Every text [`message`] returns: the catalog rows an app adds for [`LocaleNumbers::with_catalog`].
+pub const MESSAGES: [&str; 5] =
+    ["Enter a number", "Not a number", "Use one kind of digits", "Check the decimal and grouping marks", "Number too large"];
+
+/// The English text the widgets show for `error`; a catalog key.
+pub fn message(error: NumberError) -> &'static str {
+    match error {
+        NumberError::Empty => MESSAGES[0],
+        NumberError::Unexpected(_) => MESSAGES[1],
+        NumberError::MixedDigits => MESSAGES[2],
+        NumberError::Separator => MESSAGES[3],
+        NumberError::TooLarge => MESSAGES[4],
+    }
+}
+
+/// A unit around a number, from a craft-i18n unit template with the number as `{n}`: `{n} px`,
+/// `{n}%`, Turkish `%{n}`. Typed text may include it; it is removed before parsing.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Unit {
+    prefix: String,
+    suffix: String,
+}
+
+impl Unit {
+    /// The unit `template` spells; a template without `{n}` is a suffix.
+    pub fn new(template: &str) -> Unit {
+        match template.split_once("{n}") {
+            Some((prefix, suffix)) => Unit { prefix: prefix.to_owned(), suffix: suffix.to_owned() },
+            None => Unit { prefix: String::new(), suffix: template.to_owned() },
+        }
+    }
+
+    /// The unit row `template` (context `unit`) in `lang`, the English template if untranslated.
+    pub fn translated(i18n: &I18n, lang: Lang, template: &str) -> Unit {
+        Unit::new(i18n.get(lang, "unit", template).unwrap_or(template))
+    }
+
+    pub fn prefix(&self) -> &str {
+        &self.prefix
+    }
+
+    pub fn suffix(&self) -> &str {
+        &self.suffix
+    }
+
+    fn strip<'t>(&self, text: &'t str) -> &'t str {
+        let text = text.trim();
+        let text = text.strip_prefix(self.prefix.trim()).unwrap_or(text);
+        text.strip_suffix(self.suffix.trim()).unwrap_or(text).trim()
+    }
+}
+
+/// Parses `text` with `numbers`, then with `fallback` (an app's expression or timecode reader).
+fn read(numbers: &LocaleNumbers, unit: &Unit, fallback: Option<&Fallback<'_>>, text: &str) -> Result<f64, NumberError> {
+    numbers.parse(unit.strip(text)).or_else(|error| fallback.and_then(|f| f(text)).ok_or(error))
+}
+
+/// Text that may still become a number as the user types (`-`, `1,`): not marked while editing.
+fn incomplete(text: &str, error: NumberError) -> bool {
+    match error {
+        NumberError::Empty => true,
+        NumberError::Separator => text.trim_end().ends_with(['.', ',', '٫', '٬', '\'', '’', '．', '，']),
+        _ => false,
+    }
+}
+
+/// Text the widget could not read. `until` is `None` while the user is still editing it.
+#[derive(Clone)]
+struct Rejected {
+    error: NumberError,
+    until: Option<f64>,
+}
+
+fn rejected_id(id: Id) -> Id {
+    id.with("craft_ui::localized::rejected")
+}
+
+/// Outlines `response` in the error color and, with `tell`, shows `text` beside it.
+fn mark_invalid(ui: &Ui, response: &Response, radius: CornerRadius, text: String, tell: bool) {
+    ui.painter().rect_stroke(response.rect, radius, Stroke::new(1.5, ui.visuals().error_fg_color), StrokeKind::Inside);
+    if tell {
+        response.show_tooltip_text(text);
+    }
+}
+
+/// An [`egui::DragValue`] that writes and reads numbers with [`LocaleNumbers`]. Set range, speed,
+/// decimals and any prefix or suffix on the drag value; a [`Unit`] set here goes outside that
+/// prefix and suffix (egui adds to them and can't take them off), so set one or the other. The
+/// drag value's own `custom_formatter` and `custom_parser` are replaced: pass an app's formatter
+/// and parser to [`LocalizedDragValue::or_format`] and [`LocalizedDragValue::or_parse`] instead.
+///
+/// Typed text that isn't a number is outlined while it is being edited. Committing it (Enter,
+/// clicking away) keeps the old value, as egui does, and the field stays outlined with the reason
+/// for a moment. Escape reverts without a mark. Committing the text as the drag value shows it
+/// leaves the value as it is, with any decimals the drag value doesn't show.
+///
+/// ```
+/// # egui::__run_test_ui(|ui| {
+/// use craft_ui::localized::{LocaleNumbers, LocalizedDragValue, Unit};
+/// let numbers = LocaleNumbers::from_tag("de");
+/// let mut width = 1.5;
+/// ui.add(LocalizedDragValue::new(egui::DragValue::new(&mut width).speed(0.1), &numbers).unit(Unit::new("{n} px")));
+/// # });
+/// ```
+#[must_use = "You should put this widget in a ui with `ui.add(widget);`"]
+pub struct LocalizedDragValue<'a> {
+    drag: DragValue<'a>,
+    numbers: LocaleNumbers,
+    unit: Unit,
+    formatter: Option<Formatter<'a>>,
+    fallback: Option<Fallback<'a>>,
+}
+
+impl<'a> LocalizedDragValue<'a> {
+    pub fn new(drag: DragValue<'a>, numbers: &LocaleNumbers) -> Self {
+        LocalizedDragValue { drag, numbers: numbers.clone(), unit: Unit::default(), formatter: None, fallback: None }
+    }
+
+    /// The unit around the number, outside a prefix and suffix set on the drag value.
+    pub fn unit(mut self, unit: Unit) -> Self {
+        self.unit = unit;
+        self
+    }
+
+    /// [`DragValue::range`] of the wrapped drag value.
+    pub fn range<Num: Numeric>(mut self, range: RangeInclusive<Num>) -> Self {
+        self.drag = self.drag.range(range);
+        self
+    }
+
+    /// [`DragValue::speed`] of the wrapped drag value.
+    pub fn speed(mut self, speed: impl Into<f64>) -> Self {
+        self.drag = self.drag.speed(speed);
+        self
+    }
+
+    /// Show the number without grouping separators ([`LocaleNumbers::ungrouped`]).
+    pub fn ungrouped(mut self) -> Self {
+        self.numbers.grouping = false;
+        self
+    }
+
+    /// An app's own text for some values (a timecode, `Auto` for 0), tried before the locale's;
+    /// `None` writes the number as the locale does. Pair it with [`LocalizedDragValue::or_parse`]
+    /// so the text reads back.
+    pub fn or_format(mut self, formatter: impl 'a + Fn(f64, RangeInclusive<usize>) -> Option<String>) -> Self {
+        self.formatter = Some(Box::new(formatter));
+        self
+    }
+
+    /// A parser for text that isn't a plain number (an expression, a timecode), tried after the
+    /// locale's.
+    pub fn or_parse(mut self, parser: impl 'a + Fn(&str) -> Option<f64>) -> Self {
+        self.fallback = Some(Box::new(parser));
+        self
+    }
+}
+
+impl Widget for LocalizedDragValue<'_> {
+    fn ui(self, ui: &mut Ui) -> Response {
+        let LocalizedDragValue { drag, numbers, unit, formatter, fallback } = self;
+        let parsed: LastRead = Rc::new(Cell::new(None));
+        // The value egui last had written and its text. egui reads the text back when the field
+        // loses focus, edited or not; the unedited text gives the value itself, not the value
+        // rounded to the decimals shown.
+        let shown: Rc<RefCell<Option<(f64, String)>>> = Rc::new(RefCell::new(None));
+        let mut drag = drag.custom_formatter({
+            let (numbers, shown) = (numbers.clone(), Rc::clone(&shown));
+            move |value, decimals| {
+                let text = formatter.as_ref().and_then(|f| f(value, decimals.clone())).unwrap_or_else(|| numbers.format(value, decimals));
+                *shown.borrow_mut() = Some((value, text.clone()));
+                text
+            }
+        });
+        if !unit.prefix.is_empty() {
+            drag = drag.prefix(unit.prefix.clone());
+        }
+        if !unit.suffix.is_empty() {
+            drag = drag.suffix(unit.suffix.clone());
+        }
+        drag = drag.custom_parser({
+            let (numbers, unit, parsed) = (numbers.clone(), unit.clone(), Rc::clone(&parsed));
+            let shown = Rc::clone(&shown);
+            move |text| {
+                let result = match &*shown.borrow() {
+                    Some((value, written)) if written == text => Ok(*value),
+                    _ => read(&numbers, &unit, fallback.as_ref(), text),
+                };
+                let still_typing = result.err().is_some_and(|error| incomplete(text, error));
+                parsed.set(Some((still_typing, result)));
+                result.ok()
+            }
+        });
+        let response = ui.add(drag);
+
+        let key = rejected_id(response.id);
+        let now = ui.input(|i| i.time);
+        let editing = response.has_focus();
+        let mut rejected = ui.data(|d| d.get_temp::<Rejected>(key));
+        match parsed.take() {
+            Some((_, Ok(_))) => rejected = None,
+            Some((still_typing, Err(error))) if editing => rejected = (!still_typing).then_some(Rejected { error, until: None }),
+            // egui reads the text once more the frame after the edit loses focus.
+            Some((_, Err(error))) => rejected = Some(Rejected { error, until: Some(now + REJECTED_FOR) }),
+            // Escape, or focus left without a final read.
+            None if !editing && rejected.as_ref().is_some_and(|r| r.until.is_none()) => rejected = None,
+            None => {}
+        }
+        // A drag or arrow key after a rejection sets a new value: the mark is moot.
+        if response.changed() || rejected.as_ref().is_some_and(|r| r.until.is_some_and(|t| t <= now)) {
+            rejected = None;
+        }
+        match rejected {
+            Some(r) => {
+                if let Some(until) = r.until {
+                    ui.ctx().request_repaint_after_secs((until - now) as f32);
+                }
+                mark_invalid(ui, &response, ui.visuals().widgets.inactive.corner_radius, numbers.describe(r.error), true);
+                ui.data_mut(|d| d.insert_temp(key, r));
+            }
+            None => ui.data_mut(|d| d.remove::<Rejected>(key)),
+        }
+        response
+    }
+}
+
+/// What a [`NumberField`] keeps between frames while its text differs from the value.
+#[derive(Clone)]
+struct FieldState {
+    text: String,
+    /// The value and mixed state when `text` was stored; a change means the app changed them, and
+    /// the text is dropped.
+    value: f64,
+    mixed: bool,
+    error: Option<NumberError>,
+}
+
+/// The sunken box of [`NumberField::recessed`], as the apps draw their own fields. Fill it from the
+/// app's tokens, or start from [`Recessed::from_style`].
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Recessed {
+    pub fill: Color32,
+    pub stroke: Stroke,
+    /// The border while the field has the keyboard focus.
+    pub focus_stroke: Stroke,
+    pub corner_radius: CornerRadius,
+    /// The box's height; the text is centred in it.
+    pub height: f32,
+    /// Space between the box's edge and the text.
+    pub margin: Margin,
+}
+
+impl Recessed {
+    /// egui's text-edit fill, the noninteractive border, the selection stroke while focused, and
+    /// the interact height.
+    pub fn from_style(style: &Style) -> Recessed {
+        let visuals = &style.visuals;
+        Recessed {
+            fill: visuals.text_edit_bg_color(),
+            stroke: visuals.widgets.noninteractive.bg_stroke,
+            focus_stroke: visuals.selection.stroke,
+            corner_radius: visuals.widgets.inactive.corner_radius,
+            height: style.spacing.interact_size.y,
+            margin: Margin::symmetric(6, 0),
+        }
+    }
+}
+
+fn first_field_id() -> Id {
+    Id::unique("craft_ui::localized::focus_first_field")
+}
+
+/// While `on`, the next enabled [`NumberField`] drawn takes the keyboard focus with its text
+/// selected, so typing replaces the value and Enter applies it: a dialog opening on its first
+/// field. Raise it when the group opens; the field that takes it lowers it. A sizing pass (a new
+/// window's first frame) leaves it for the next pass.
+pub fn focus_first_field(ctx: &Context, on: bool) {
+    ctx.data_mut(|d| {
+        if on {
+            d.insert_temp(first_field_id(), true);
+        } else {
+            d.remove::<bool>(first_field_id());
+        }
+    });
+}
+
+/// A drag on a [`NumberField`]'s label in progress.
+#[derive(Clone, Copy)]
+struct Scrub {
+    /// The value before the first step, which Escape puts back.
+    start: Option<f64>,
+    /// Points dragged and not yet stepped.
+    pending: f32,
+}
+
+/// A single-line text field for a number, read on commit (Enter or focus leaving) with
+/// [`LocaleNumbers`]. Arrow up and down, and the mouse wheel over the focused field, step the
+/// value; a drag on its [`NumberField::scrub_label`] scrubs it.
+///
+/// Text that isn't a number leaves the value unchanged and stays in the field, outlined, with the
+/// reason in a tooltip, until it is fixed or Escape restores the value. A number is rounded to the
+/// most decimals shown, half away from zero (`2,5` is 3 and `-0,5` is -1 in an integer field),
+/// then clamped to the range. Committing the text as the field shows it leaves the value as it is,
+/// with any decimals the field doesn't show. The response is `changed()` when the value changed.
+///
+/// ```
+/// # egui::__run_test_ui(|ui| {
+/// use craft_ui::localized::{LocaleNumbers, NumberField, Recessed, Unit};
+/// let numbers = LocaleNumbers::from_tag("fr");
+/// let mut gap = 12.0;
+/// let label = ui.label("Gap");
+/// let frame = Recessed::from_style(ui.style());
+/// ui.add(NumberField::new(&mut gap, &numbers).range(0.0..=100.0).step(0.5).unit(Unit::new("{n} mm")).recessed(frame).scrub_label(&label));
+/// # });
+/// ```
+#[must_use = "You should put this widget in a ui with `ui.add(widget);`"]
+pub struct NumberField<'a> {
+    get_set: Box<dyn 'a + FnMut(Option<f64>) -> f64>,
+    numbers: LocaleNumbers,
+    range: RangeInclusive<f64>,
+    step: f64,
+    decimals: RangeInclusive<usize>,
+    unit: Unit,
+    fallback: Option<Fallback<'a>>,
+    width: Option<f32>,
+    id_salt: Option<IdSalt>,
+    mixed: bool,
+    placeholder: Option<String>,
+    recessed: Option<Recessed>,
+    label: Option<(Id, Rect)>,
+}
+
+impl<'a> NumberField<'a> {
+    /// A field for `value`. Integer types get no decimals and their full range.
+    pub fn new<Num: Numeric>(value: &'a mut Num, numbers: &LocaleNumbers) -> Self {
+        let field = NumberField {
+            get_set: Box::new(move |v: Option<f64>| {
+                if let Some(v) = v {
+                    *value = Num::from_f64(v);
+                }
+                value.to_f64()
+            }),
+            numbers: numbers.clone(),
+            range: f64::NEG_INFINITY..=f64::INFINITY,
+            step: 1.0,
+            decimals: 0..=6,
+            unit: Unit::default(),
+            fallback: None,
+            width: None,
+            id_salt: None,
+            mixed: false,
+            placeholder: None,
+            recessed: None,
+            label: None,
+        };
+        if Num::INTEGRAL { field.decimals(0..=0).range(Num::MIN.to_f64()..=Num::MAX.to_f64()) } else { field }
+    }
+
+    pub fn range(mut self, range: RangeInclusive<f64>) -> Self {
+        self.range = range;
+        self
+    }
+
+    /// The change per arrow key press, wheel notch or scrub step; 0 turns stepping off. Default 1.
+    /// Shift steps ten, and Ctrl/Cmd a tenth where the decimals show it. A plain or Ctrl/Cmd step
+    /// goes to the next multiple of its size (by 1, `5,1` goes up to 6 and down to 5); a Shift step
+    /// rounds to a multiple of `step` first.
+    pub fn step(mut self, step: f64) -> Self {
+        self.step = step;
+        self
+    }
+
+    /// The fewest and most digits shown after the decimal mark. Default `0..=6`.
+    pub fn decimals(mut self, decimals: RangeInclusive<usize>) -> Self {
+        self.decimals = decimals;
+        self
+    }
+
+    pub fn unit(mut self, unit: Unit) -> Self {
+        self.unit = unit;
+        self
+    }
+
+    /// A parser for text that isn't a plain number (an expression, a timecode), tried after the
+    /// locale's.
+    pub fn or_parse(mut self, parser: impl 'a + Fn(&str) -> Option<f64>) -> Self {
+        self.fallback = Some(Box::new(parser));
+        self
+    }
+
+    pub fn desired_width(mut self, width: f32) -> Self {
+        self.width = Some(width);
+        self
+    }
+
+    pub fn id_salt(mut self, id_salt: impl AsIdSalt) -> Self {
+        self.id_salt = Some(IdSalt::new(id_salt));
+        self
+    }
+
+    /// The value differs between the selected objects: the field is blank (showing the
+    /// [`NumberField::placeholder`]) and the value stays as it is until the user enters a number.
+    /// That number is `changed()` even when it equals the value, so the app sets it on every
+    /// object. Committing the field blank changes nothing, and the label doesn't scrub.
+    pub fn mixed(mut self, mixed: bool) -> Self {
+        self.mixed = mixed;
+        self
+    }
+
+    /// Text shown in the field while it is empty, as a [`NumberField::mixed`] field is.
+    pub fn placeholder(mut self, text: impl Into<String>) -> Self {
+        self.placeholder = Some(text.into());
+        self
+    }
+
+    /// Draw the field in a sunken box of `frame`'s fill, border and height.
+    pub fn recessed(mut self, frame: Recessed) -> Self {
+        self.recessed = Some(frame);
+        self
+    }
+
+    /// The field's label, drawn before it. It names the field for accessibility, and dragging it
+    /// sideways scrubs the value: a step every two points, with the arrow keys' Shift and Ctrl/Cmd
+    /// steps. A click on it focuses the field; Escape during the drag puts the value back. The
+    /// response reports the label's drag as its own (`drag_started`, `dragged`, `drag_stopped`),
+    /// so the app can make the whole drag one undo step.
+    pub fn scrub_label(mut self, label: &Response) -> Self {
+        self.label = Some((label.id, label.rect));
+        self
+    }
+}
+
+impl Widget for NumberField<'_> {
+    fn ui(self, ui: &mut Ui) -> Response {
+        let NumberField { mut get_set, numbers, range, step, decimals, unit, fallback, width, id_salt, mixed, placeholder, recessed, label } = self;
+        let id = id_salt.map_or_else(|| ui.next_auto_id(), |salt| ui.make_persistent_id(salt));
+        let old = get_set(None);
+        let places = *decimals.end();
+        let clamp = |v: f64| if range.start() <= range.end() { v.clamp(*range.start(), *range.end()) } else { v };
+        let settle = |v: f64| clamp(round_half_away(v, places));
+        let shown = if mixed { String::new() } else { numbers.format(old, decimals.clone()) };
+
+        let mut state = ui.data(|d| d.get_temp::<FieldState>(id)).filter(|s| s.value == old && s.mixed == mixed);
+        let mut select = false;
+        if ui.is_enabled() && !ui.is_sizing_pass() && ui.data_mut(|d| d.remove_temp::<bool>(first_field_id())).is_some() {
+            ui.memory_mut(|m| m.request_focus(id));
+            select = true;
+        }
+        // The shown text stands for `old` itself: reading it back would round the value to the
+        // shown decimals, so leaving an untouched field would change it.
+        let read_text = |text: &str| if !mixed && text == shown { Ok(old) } else { read(&numbers, &unit, fallback.as_ref(), text) };
+        let mut value = old;
+        // A number the user entered; in a mixed field it counts as a change even if it equals `old`.
+        let mut entered = false;
+        if step != 0.0 && ui.memory(|m| m.has_focus(id)) {
+            let typed = state.as_ref().map_or(shown.as_str(), |s| s.text.as_str());
+            // Text that isn't a number takes no steps: the wheel scrolls the panel instead.
+            if let Ok(base) = read_text(typed) {
+                let over = ui.ctx().read_response(id).is_some_and(|r| r.contains_pointer());
+                let steps = take_steps(ui, id, over);
+                if !steps.is_empty() {
+                    value = settle(steps.iter().fold(base, |v, &(modifiers, n)| stepped(v, step, places, modifiers, n)));
+                    (entered, select, state) = (true, true, None);
+                }
+            }
+        }
+        let mut scrubbed = None;
+        if let Some((_, rect)) = label.filter(|_| !mixed && step != 0.0) {
+            let (drag, to) = scrub(ui, id, rect, value, |v, modifiers, n| settle(stepped(v, step, places, modifiers, n)));
+            if let Some(to) = to {
+                (value, state) = (to, None);
+            }
+            scrubbed = Some(drag);
+        }
+        let mut text = match &state {
+            Some(s) => s.text.clone(),
+            None if value == old && !entered => shown.clone(),
+            None => numbers.format(value, decimals.clone()),
+        };
+        if select {
+            select_all(ui.ctx(), id, &text);
+        }
+
+        let mut edit = TextEdit::singleline(&mut text).id(id);
+        if let Some(placeholder) = placeholder {
+            edit = edit.hint_text(placeholder);
+        }
+        if !unit.prefix.is_empty() {
+            edit = edit.prefix(unit.prefix.clone());
+        }
+        if !unit.suffix.is_empty() {
+            edit = edit.suffix(unit.suffix.clone());
+        }
+        if let Some(width) = width {
+            edit = edit.desired_width(width);
+        }
+        let radius = match recessed {
+            Some(frame) => {
+                let stroke = if ui.memory(|m| m.has_focus(id)) { frame.focus_stroke } else { frame.stroke };
+                let sunk = Frame::NONE.fill(frame.fill).stroke(stroke).corner_radius(frame.corner_radius).inner_margin(frame.margin);
+                edit = edit.frame(sunk).min_size(vec2(0.0, frame.height)).align(Align2::LEFT_CENTER);
+                frame.corner_radius
+            }
+            None => ui.visuals().widgets.inactive.corner_radius,
+        };
+        let mut response = ui.add(edit);
+        // After the text edit, which gives up the focus on a click elsewhere.
+        if scrubbed.as_ref().is_some_and(Response::clicked) {
+            ui.memory_mut(|m| m.request_focus(id));
+            select_all(ui.ctx(), id, &text);
+        }
+        let editing = response.has_focus();
+
+        let escape = ui.input(|i| i.key_pressed(Key::Escape));
+        let mut error = state.as_ref().and_then(|s| s.error);
+        if response.lost_focus() && (escape || mixed && unit.strip(&text).is_empty()) {
+            state = None;
+            error = None;
+        } else if response.lost_focus() {
+            match read_text(&text) {
+                Ok(parsed) => {
+                    value = if !mixed && text == shown { parsed } else { settle(parsed) };
+                    entered = true;
+                    state = None;
+                    error = None;
+                }
+                Err(e) => {
+                    error = Some(e);
+                    state = Some(FieldState { text: text.clone(), value, mixed, error });
+                }
+            }
+        } else if response.changed() {
+            error = read(&numbers, &unit, fallback.as_ref(), &text).err().filter(|e| !incomplete(&text, *e));
+            state = Some(FieldState { text: text.clone(), value, mixed, error });
+        } else if response.has_focus() && state.is_none() {
+            state = Some(FieldState { text: text.clone(), value, mixed, error: None });
+        }
+
+        if value != old || mixed && entered {
+            get_set(Some(value));
+            response.mark_changed();
+        } else {
+            response.flags.remove(Flags::CHANGED);
+        }
+        if let Some(drag) = scrubbed {
+            response.flags.insert(drag.flags & (Flags::DRAG_STARTED | Flags::DRAGGED | Flags::DRAG_STOPPED));
+        }
+        if let Some((label, _)) = label {
+            response = response.labelled_by(label);
+        }
+        let value = get_set(None);
+        match state {
+            Some(mut s) => {
+                s.value = value;
+                ui.data_mut(|d| d.insert_temp(id, s));
+            }
+            None => ui.data_mut(|d| d.remove::<FieldState>(id)),
+        }
+        if let Some(error) = error {
+            mark_invalid(ui, &response, radius, numbers.describe(error), editing);
+            if !editing {
+                response = response.on_hover_text(numbers.describe(error));
+            }
+        }
+        response
+    }
+}
+
+/// `value` moved `n` steps of `step` (down when `n` is negative) with `modifiers` held: ten steps
+/// with Shift, a tenth of one with Ctrl/Cmd when `decimals` show it. A plain or Ctrl/Cmd step
+/// goes to the next multiple of its size in its direction, then on by whole steps; a Shift step
+/// rounds to a multiple of `step` first.
+fn stepped(value: f64, step: f64, decimals: usize, modifiers: Modifiers, n: f64) -> f64 {
+    let fine = step / 10.0;
+    if modifiers.command && (round_half_away(fine, decimals) - fine).abs() <= fine.abs() * 1e-9 {
+        to_multiple(value, fine, n)
+    } else if modifiers.shift {
+        (value / step).round() * step + 10.0 * step * n
+    } else {
+        to_multiple(value, step, n)
+    }
+}
+
+/// `value` moved to the `n`th multiple of `size` past it: by 1, 5.1 goes up to 6 and down to 5,
+/// and 5 to 6 and 4. A value within a millionth of a step of a multiple counts as on it.
+fn to_multiple(value: f64, size: f64, n: f64) -> f64 {
+    let q = value / size;
+    let from = if n > 0.0 { (q + 1e-6).floor() } else { (q - 1e-6).ceil() };
+    (from + n) * size
+}
+
+/// The steps asked for this frame by the arrow keys in a focused field and, with `wheel`, by the
+/// mouse wheel over it, in order: their modifiers and how many steps up (down when negative).
+/// They are taken from the input, so the text edit doesn't move its cursor and the panel under the
+/// field doesn't scroll.
+fn take_steps(ui: &Ui, id: Id, wheel: bool) -> Vec<(Modifiers, f64)> {
+    // The wheel turns in notches: a line each, or `line` points of a trackpad. What is left of a
+    // notch carries over to the next turn.
+    let line = ui.ctx().options(|o| o.input_options.line_scroll_speed).max(1.0);
+    let notch_id = id.with("craft_ui::localized::notches");
+    let mut notches: f32 = if wheel { ui.data(|d| d.get_temp(notch_id)).unwrap_or(0.0) } else { 0.0 };
+    let mut steps = Vec::new();
+    ui.input_mut(|i| {
+        i.events.retain(|event| {
+            let (modifiers, n) = match event {
+                Event::Key { key: Key::ArrowUp, pressed: true, modifiers, .. } => (*modifiers, 1.0),
+                Event::Key { key: Key::ArrowDown, pressed: true, modifiers, .. } => (*modifiers, -1.0),
+                Event::MouseWheel { unit, delta, modifiers, .. } if wheel => {
+                    // Shift may turn the wheel sideways (macOS does).
+                    let turn = if modifiers.shift { delta.x + delta.y } else { delta.y };
+                    notches += match unit {
+                        MouseWheelUnit::Point => turn / line,
+                        MouseWheelUnit::Line | MouseWheelUnit::Page => turn,
+                    };
+                    let whole = notches.trunc();
+                    notches -= whole;
+                    (*modifiers, f64::from(whole))
+                }
+                _ => return true,
+            };
+            if n != 0.0 {
+                steps.push((modifiers, n));
+            }
+            false
+        });
+        if wheel {
+            i.smooth_scroll_delta = Vec2::ZERO;
+        }
+    });
+    if wheel {
+        ui.data_mut(|d| d.insert_temp(notch_id, notches));
+    }
+    steps
+}
+
+/// A drag this frame on `label`, the label of field `id`: its response, and the value it scrubs
+/// `value` to with `step` (value, modifiers, steps).
+fn scrub(ui: &Ui, id: Id, label: Rect, value: f64, step: impl Fn(f64, Modifiers, f64) -> f64) -> (Response, Option<f64>) {
+    // On top of the label, which may sense clicks itself (selectable text).
+    let drag = ui.interact(label, id.with("craft_ui::localized::scrub"), Sense::click_and_drag());
+    if drag.hovered() || drag.dragged() {
+        ui.ctx().set_cursor_icon(CursorIcon::ResizeHorizontal);
+    }
+    let key = drag.id;
+    if drag.drag_started() {
+        // Typing in the field ends, and its text is committed, before the first step.
+        ui.memory_mut(|m| m.surrender_focus(id));
+        // The drag starts once the pointer has moved a few points: those count too.
+        let moved = match (ui.input(|i| i.pointer.press_origin()), drag.interact_pointer_pos()) {
+            (Some(from), Some(to)) => to.x - from.x,
+            _ => drag.drag_delta().x,
+        };
+        ui.data_mut(|d| d.insert_temp(key, Scrub { start: None, pending: moved }));
+        return (drag, None);
+    }
+    let Some(mut s) = ui.data(|d| d.get_temp::<Scrub>(key)) else { return (drag, None) };
+    if !drag.dragged() {
+        ui.data_mut(|d| d.remove::<Scrub>(key));
+        // egui ends a drag on Escape: the value goes back.
+        let cancelled = drag.drag_stopped() && ui.input_mut(|i| i.consume_key(Modifiers::NONE, Key::Escape));
+        return (drag, s.start.filter(|_| cancelled));
+    }
+    s.pending += drag.drag_delta().x;
+    let n = (s.pending / SCRUB_POINTS_PER_STEP).trunc();
+    let mut to = None;
+    if n != 0.0 {
+        s.pending -= n * SCRUB_POINTS_PER_STEP;
+        s.start.get_or_insert(value);
+        to = Some(step(value, ui.input(|i| i.modifiers), f64::from(n)));
+    }
+    ui.data_mut(|d| d.insert_temp(key, s));
+    (drag, to)
+}
+
+/// Selects all of `text` in text edit `id`, so typing replaces it.
+fn select_all(ctx: &Context, id: Id, text: &str) {
+    let mut state = TextEdit::load_state(ctx, id).unwrap_or_default();
+    state.cursor.set_char_range(Some(CCursorRange::two(CCursor::new(0), CCursor::new(text.chars().count()))));
+    state.store(ctx, id);
+}
+
+/// `value` rounded to `decimals` digits after the point, ties away from zero; never `-0`.
+fn round_half_away(value: f64, decimals: usize) -> f64 {
+    let scale = 10_f64.powi(i32::try_from(decimals).unwrap_or(i32::MAX));
+    let rounded = if scale.is_finite() { (value * scale).round() / scale } else { value };
+    if rounded.is_finite() { rounded + 0.0 } else { value }
+}
diff --git a/crates/ui/src/localized/tests.rs b/crates/ui/src/localized/tests.rs
new file mode 100644
index 00000000..b216e0ef
--- /dev/null
+++ b/crates/ui/src/localized/tests.rs
@@ -0,0 +1,594 @@
+use egui::accesskit::Role;
+use egui::{DragValue, Key, Modifiers};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+
+use super::*;
+
+#[test]
+fn formats_and_reads_the_regions_numbers() {
+    let de = LocaleNumbers::from_tag("de");
+    assert_eq!(de.format(1.5, 0..=6), "1,5");
+    assert_eq!(de.format(1234567.0, 0..=2), "1.234.567");
+    assert_eq!(de.format(2.0, 2..=4), "2,00");
+    assert_eq!(de.format(-0.001, 0..=2), "0");
+    assert_eq!(de.parse("1,5"), Ok(1.5));
+    assert_eq!(de.parse("1.234.567"), Ok(1234567.0));
+    assert!(de.parse("1.234.").is_err_and(|e| incomplete("1.234.", e)), "a grouping mark still to be followed by digits");
+    assert_eq!(de.parse("1.5"), Ok(1.5), "a lone point that can't be grouping");
+
+    let en = LocaleNumbers::from_tag("en-US");
+    assert_eq!(en.format(1234567.25, 0..=2), "1,234,567.25");
+    assert_eq!(en.parse("1,234,567.25"), Ok(1234567.25));
+    assert_eq!(en.parse("１２，３４５．５"), Ok(12345.5), "full-width digits and marks");
+    assert_eq!(en.parse("1,5,5"), Err(NumberError::Separator));
+
+    let ar = LocaleNumbers::from_tag("ar-EG");
+    assert_eq!(ar.format(1234.5, 1..=1), "١٬٢٣٤٫٥");
+    assert_eq!(ar.parse("١٬٢٣٤٫٥"), Ok(1234.5));
+    assert_eq!(ar.parse(&ar.format(-12.5, 0..=2)), Ok(-12.5), "the sign and bidi marks read back");
+    assert_eq!(ar.parse("12.5"), Ok(12.5));
+
+    let fa = LocaleNumbers::from_tag("fa-IR");
+    assert_eq!(fa.format(1.5, 0..=2), "۱٫۵");
+    assert_eq!(fa.parse("۱٫۵"), Ok(1.5));
+    assert_eq!(fa.parse("1۵"), Err(NumberError::MixedDigits));
+}
+
+#[test]
+fn a_region_reads_back_its_own_decimal_mark() {
+    // English in the US with a decimal comma and no grouping from the Windows settings.
+    let mut region = craft_i18n::Region::from_tag("en-US");
+    region.decimal = Some(',');
+    let numbers = LocaleNumbers::new(Arc::new(Format::new(&region, craft_i18n::Digits::Locale)));
+    let written = numbers.format(1234.5, 1..=1);
+    assert_eq!((written.as_str(), numbers.parse(&written)), ("1.234,5", Ok(1234.5)));
+    assert_eq!(numbers.parse("1.234"), Ok(1234.0), "the grouping moved to the point");
+    region.grouping = Some(None);
+    let numbers = LocaleNumbers::new(Arc::new(Format::new(&region, craft_i18n::Digits::Locale)));
+    assert_eq!(numbers.format(1234.5, 1..=1), "1234,5");
+}
+
+#[test]
+fn units_wrap_and_strip() {
+    let unit = Unit::new("%{n}");
+    assert_eq!((unit.prefix(), unit.suffix()), ("%", ""));
+    let px = Unit::new("{n} px");
+    assert_eq!(px.strip(" 12,5 px "), "12,5");
+    assert_eq!(px.strip("12,5"), "12,5");
+    let (i18n, _) = I18n::new(&[("fr", "unit\t{n} px\t{n} pt-écran\n", "")], &["fr"]);
+    let fr = i18n.from_code("fr").unwrap_or(Lang::EN);
+    assert_eq!(Unit::translated(&i18n, fr, "{n} px").suffix(), " pt-écran");
+    assert_eq!(Unit::translated(&i18n, Lang::EN, "{n} px").suffix(), " px");
+}
+
+fn drag_harness(tag: &str, value: f64) -> Harness<'static, f64> {
+    let numbers = LocaleNumbers::from_tag(tag);
+    drag_harness_with(value, move |ui, value| LocalizedDragValue::new(DragValue::new(value).speed(0.1), &numbers).ui(ui))
+}
+
+fn drag_harness_with(value: f64, add: impl FnMut(&mut Ui, &mut f64) -> Response + 'static) -> Harness<'static, f64> {
+    let mut add = add;
+    // The default fonts have no Arabic or Persian digits; the fonts module adds them in apps.
+    let mut h = Harness::builder().allow_missing_glyphs().build_ui_state(
+        move |ui, value: &mut f64| {
+            let label = ui.label("Width");
+            add(ui, value).labelled_by(label.id);
+        },
+        value,
+    );
+    h.run();
+    h
+}
+
+/// Clicks the drag value into text editing, types `text` over its selected text and presses Enter.
+fn type_into_drag(h: &mut Harness<'_, f64>, text: &str) {
+    h.get_by_role(Role::SpinButton).click();
+    h.run();
+    h.get_by_role(Role::SpinButton).type_text(text);
+    h.run();
+    h.key_press(Key::Enter);
+    h.run();
+}
+
+#[test]
+fn drag_value_shows_and_takes_german_decimals() {
+    let mut h = drag_harness("de", 1.5);
+    assert_eq!(h.get_by_role(Role::SpinButton).value().as_deref(), Some("1,5"));
+    type_into_drag(&mut h, "2,25");
+    assert_eq!(*h.state(), 2.25);
+    assert_eq!(h.get_by_role(Role::SpinButton).value().as_deref(), Some("2,25"));
+}
+
+#[test]
+fn drag_value_in_arabic_digits() {
+    let mut h = drag_harness("ar-EG", 1.5);
+    assert_eq!(h.get_by_role(Role::SpinButton).value().as_deref(), Some("١٫٥"));
+    type_into_drag(&mut h, "٢٬٥٠٠٫٥");
+    assert_eq!(*h.state(), 2500.5);
+}
+
+#[test]
+fn drag_value_keeps_the_apps_text_around_the_number() {
+    let numbers = LocaleNumbers::from_tag("de");
+    let mut h = drag_harness_with(0.0, move |ui, value| {
+        LocalizedDragValue::new(DragValue::new(value).prefix("x: ").suffix(" °"), &numbers)
+            .or_format(|v, _| (v == 0.0).then(|| "Auto".to_owned()))
+            .or_parse(|t| (t.trim() == "Auto").then_some(0.0))
+            .ui(ui)
+    });
+    assert_eq!(h.get_by_role(Role::SpinButton).value().as_deref(), Some("x: Auto °"));
+    type_into_drag(&mut h, "2,5");
+    assert_eq!(*h.state(), 2.5);
+    assert_eq!(h.get_by_role(Role::SpinButton).value().as_deref(), Some("x: 2,5 °"));
+
+    let numbers = LocaleNumbers::from_tag("de");
+    let h = drag_harness_with(1.5, move |ui, value| {
+        LocalizedDragValue::new(DragValue::new(value).prefix("x: ").suffix(" °"), &numbers).unit(Unit::new("{n} px")).ui(ui)
+    });
+    let shown = h.get_by_role(Role::SpinButton).value().unwrap_or_default();
+    assert!(shown.contains("x: 1,5 °") && shown.trim_end().ends_with("px"), "a unit goes outside them: {shown:?}");
+}
+
+#[test]
+fn drag_value_takes_range_speed_and_no_grouping_after_wrapping() {
+    let numbers = LocaleNumbers::from_tag("en-US");
+    let mut h = drag_harness_with(1920.0, move |ui, value| {
+        LocalizedDragValue::new(DragValue::new(value), &numbers).range(1..=4096).speed(1.0).ungrouped().unit(Unit::new("{n} px")).ui(ui)
+    });
+    let shown = h.get_by_role(Role::SpinButton).value().unwrap_or_default();
+    assert!(shown.starts_with("1920"), "{shown:?}");
+    type_into_drag(&mut h, "10,000");
+    assert_eq!(*h.state(), 4096.0, "grouped text reads back and is clamped to the range");
+    assert_eq!(LocaleNumbers::from_tag("de").ungrouped().format(1234567.5, 0..=1), "1234567,5");
+}
+
+#[test]
+fn drag_value_marks_text_it_cannot_read() {
+    let mut h = drag_harness("de", 1.5);
+    h.get_by_role(Role::SpinButton).click();
+    h.run();
+    h.get_by_role(Role::SpinButton).type_text("1x");
+    h.run();
+    assert!(h.query_by_label("Not a number").is_some(), "marked while editing");
+    h.key_press(Key::Enter);
+    h.run();
+    assert_eq!(*h.state(), 1.5, "the value stays");
+    assert!(h.query_by_label("Not a number").is_some(), "still marked after reverting");
+    assert_eq!(h.get_by_role(Role::SpinButton).value().as_deref(), Some("1,5"));
+}
+
+#[test]
+fn drag_value_does_not_mark_a_number_being_typed() {
+    let mut h = drag_harness("de", 1.5);
+    h.get_by_role(Role::SpinButton).click();
+    h.run();
+    h.get_by_role(Role::SpinButton).type_text("1.");
+    h.run();
+    assert!(h.query_by_label("Check the decimal and grouping marks").is_none());
+}
+
+fn field_harness(tag: &str, value: f64) -> Harness<'static, f64> {
+    let numbers = LocaleNumbers::from_tag(tag);
+    let mut h = Harness::builder().allow_missing_glyphs().build_ui_state(
+        move |ui, value: &mut f64| {
+            let label = ui.label("Gap");
+            ui.add(NumberField::new(value, &numbers).range(0.0..=10000.0).step(0.5).unit(Unit::new("{n} mm"))).labelled_by(label.id);
+        },
+        value,
+    );
+    h.run();
+    h
+}
+
+fn type_into_field(h: &mut Harness<'_, f64>, text: &str) {
+    h.get_by_role(Role::TextInput).click();
+    h.run();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.run();
+    h.get_by_role(Role::TextInput).type_text(text);
+    h.run();
+    h.key_press(Key::Enter);
+    h.run();
+}
+
+#[test]
+fn number_field_reads_on_commit() {
+    let mut h = field_harness("de", 1.5);
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("1,5"));
+    type_into_field(&mut h, "1.234,5 mm");
+    assert_eq!(*h.state(), 1234.5);
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("1.234,5"));
+    type_into_field(&mut h, "20000");
+    assert_eq!(*h.state(), 10000.0, "clamped to the range");
+}
+
+#[test]
+fn number_field_takes_full_width_and_persian_digits() {
+    let mut h = field_harness("en", 1.0);
+    type_into_field(&mut h, "１２．５");
+    assert_eq!(*h.state(), 12.5);
+    let mut h = field_harness("fa", 1.0);
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("۱"));
+    type_into_field(&mut h, "۱۲٫۵");
+    assert_eq!(*h.state(), 12.5);
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("۱۲٫۵"));
+}
+
+#[test]
+fn number_field_keeps_text_it_cannot_read() {
+    let mut h = field_harness("de", 1.5);
+    type_into_field(&mut h, "1,5,5");
+    assert_eq!(*h.state(), 1.5, "the value stays");
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("1,5,5"), "the text stays to be fixed");
+    type_into_field(&mut h, "2,5");
+    assert_eq!(*h.state(), 2.5);
+}
+
+#[test]
+fn number_field_rounds_before_clamping() {
+    let mut h = field_harness("de", 1.5);
+    type_into_field(&mut h, "9999,99999999");
+    assert_eq!(*h.state(), 10000.0, "rounded to six decimals, then clamped");
+    let numbers = LocaleNumbers::from_tag("de");
+    let mut h = Harness::builder().build_ui_state(
+        move |ui, value: &mut i32| {
+            let label = ui.label("Count");
+            ui.add(NumberField::new(value, &numbers).range(-10.0..=10.0)).labelled_by(label.id);
+        },
+        0,
+    );
+    h.run();
+    for (text, want) in [("2,7", 3), ("2,5", 3), ("-0,5", -1), ("-0,4", 0), ("9,6", 10), ("10,5", 10)] {
+        h.get_by_role(Role::TextInput).click();
+        h.run();
+        h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+        h.run();
+        h.get_by_role(Role::TextInput).type_text(text);
+        h.run();
+        h.key_press(Key::Enter);
+        h.run();
+        assert_eq!(*h.state(), want, "{text}");
+    }
+}
+
+#[test]
+fn number_field_keeps_a_value_it_shows_rounded_until_it_is_edited() {
+    let mut h = field_harness("en", 1.23456789);
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("1.234568"));
+    type_into_field(&mut h, "1.234568");
+    assert_eq!(*h.state(), 1.23456789, "the text it shows, typed back");
+    h.get_by_role(Role::TextInput).click();
+    h.run();
+    h.get_by_role(Role::TextInput).type_text("9");
+    h.run();
+    h.key_press(Key::Escape);
+    h.run();
+    assert_eq!(*h.state(), 1.23456789, "Escape");
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("1.234568"));
+    type_into_field(&mut h, "1.2345678");
+    assert_eq!(*h.state(), 1.234568, "an edit is rounded to the decimals shown");
+}
+
+#[test]
+fn steps_go_to_multiples_of_the_step() {
+    let (none, shift, cmd) = (Modifiers::NONE, Modifiers::SHIFT, Modifiers::COMMAND);
+    assert_eq!(stepped(5.1, 1.0, 6, none, 1.0), 6.0);
+    assert_eq!(stepped(5.1, 1.0, 6, none, -1.0), 5.0);
+    assert_eq!(stepped(5.0, 1.0, 6, none, -2.0), 3.0);
+    assert_eq!(stepped(5.4, 1.0, 6, shift, 1.0), 15.0, "Shift rounds to the step, then adds ten");
+    assert_eq!(round_half_away(stepped(1.23, 1.0, 2, cmd, 1.0), 2), 1.3, "a tenth with Ctrl/Cmd");
+    assert_eq!(stepped(5.1, 1.0, 0, cmd, 1.0), 6.0, "a count has no tenths");
+    assert_eq!(stepped(4.9999999, 1.0, 6, none, 1.0), 6.0, "within a millionth of a multiple is on it");
+}
+
+fn field_with(value: f64, add: impl FnMut(&mut Ui, &mut f64) -> Response + 'static) -> Harness<'static, f64> {
+    let mut add = add;
+    let mut h = Harness::builder().allow_missing_glyphs().build_ui_state(
+        move |ui, value: &mut f64| {
+            let label = ui.label("Gap");
+            add(ui, value).labelled_by(label.id);
+        },
+        value,
+    );
+    h.run();
+    h
+}
+
+#[test]
+fn number_field_steps_with_arrow_keys_and_the_wheel() {
+    let mut h = field_harness("de", 1.3);
+    h.get_by_role(Role::TextInput).click();
+    h.run();
+    h.key_press(Key::ArrowUp);
+    h.run();
+    assert_eq!(*h.state(), 1.5, "to the next multiple of 0,5");
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("1,5"));
+    h.key_press(Key::ArrowUp);
+    h.run();
+    assert_eq!(*h.state(), 2.0);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::ArrowDown);
+    h.run();
+    assert_eq!(*h.state(), 0.0, "ten steps down, clamped");
+    h.get_by_role(Role::TextInput).type_text("4");
+    h.run();
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("4"), "the stepped text is selected, so typing replaces it");
+    let at = h.get_by_role(Role::TextInput).rect().center();
+    h.hover_at(at);
+    h.run();
+    let wheel = |y| egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Line,
+        delta: egui::vec2(0.0, y),
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Unknown,
+        modifiers: Modifiers::NONE,
+    };
+    h.event(wheel(2.0));
+    h.run();
+    assert_eq!(*h.state(), 5.0, "two notches of 0,5 up from the typed 4");
+}
+
+#[test]
+fn number_field_draws_a_recessed_box() {
+    let numbers = LocaleNumbers::from_tag("en");
+    let mut h = field_with(1.0, move |ui, value| {
+        let frame = Recessed { height: 30.0, ..Recessed::from_style(ui.style()) };
+        ui.add(NumberField::new(value, &numbers).recessed(frame).desired_width(80.0))
+    });
+    let rect = h.get_by_role(Role::TextInput).rect();
+    assert!((rect.height() - 30.0).abs() < 0.5, "{rect:?}");
+    type_into_field(&mut h, "2.5");
+    assert_eq!(*h.state(), 2.5);
+}
+
+fn scrub_harness(value: f64) -> Harness<'static, f64> {
+    let numbers = LocaleNumbers::from_tag("en");
+    let mut h = Harness::builder().build_ui_state(
+        move |ui, value: &mut f64| {
+            ui.horizontal(|ui| {
+                let label = ui.label("Gap");
+                ui.add(NumberField::new(value, &numbers).range(0.0..=100.0).scrub_label(&label));
+            });
+        },
+        value,
+    );
+    h.run();
+    h
+}
+
+#[test]
+fn dragging_the_label_scrubs_the_field() {
+    let mut h = scrub_harness(5.4);
+    let at = h.get_by_role(Role::Label).rect().center();
+    let drag = |h: &mut Harness<'_, f64>, by: &[f32]| {
+        h.hover_at(at);
+        h.run();
+        h.drag_at(at);
+        h.run();
+        for dx in by {
+            h.hover_at(at + egui::vec2(*dx, 0.0));
+            h.run();
+        }
+    };
+    drag(&mut h, &[20.0, 40.0]);
+    h.drop_at(at + egui::vec2(40.0, 0.0));
+    h.run();
+    assert_eq!(*h.state(), 25.0, "20 steps of 2 points from 5,4: the first to 6");
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("25"));
+
+    drag(&mut h, &[20.0, -20.0]);
+    assert_eq!(*h.state(), 15.0);
+    h.key_press(Key::Escape);
+    h.run();
+    assert_eq!(*h.state(), 25.0, "Escape puts the value back");
+    h.drop_at(at);
+    h.run();
+
+    h.drag_at(at);
+    h.run();
+    h.drop_at(at);
+    h.run();
+    h.get_by_role(Role::TextInput).type_text("7");
+    h.run();
+    h.key_press(Key::Enter);
+    h.run();
+    assert_eq!(*h.state(), 7.0, "a click on the label focuses the field with its text selected");
+}
+
+#[test]
+fn a_click_on_the_label_keeps_a_value_it_shows_rounded() {
+    let mut h = scrub_harness(1.23456789);
+    let at = h.get_by_role(Role::Label).rect().center();
+    h.drag_at(at);
+    h.run();
+    h.drop_at(at);
+    h.run();
+    h.key_press(Key::Enter);
+    h.run();
+    assert_eq!(*h.state(), 1.23456789);
+}
+
+#[derive(Default)]
+struct Mixed {
+    value: f64,
+    mixed: bool,
+    changes: usize,
+}
+
+#[test]
+fn a_mixed_field_is_blank_until_a_number_is_entered() {
+    let numbers = LocaleNumbers::from_tag("en");
+    let mut h = Harness::builder().build_ui_state(
+        move |ui, m: &mut Mixed| {
+            let label = ui.label("Gap");
+            let r = ui.add(NumberField::new(&mut m.value, &numbers).mixed(m.mixed).placeholder("Mixed")).labelled_by(label.id);
+            if r.changed() {
+                (m.changes, m.mixed) = (m.changes + 1, false);
+            }
+        },
+        Mixed { value: 3.0, mixed: true, changes: 0 },
+    );
+    h.run();
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some(""));
+    h.get_by_role(Role::TextInput).click();
+    h.run();
+    h.key_press(Key::ArrowUp);
+    h.run();
+    h.key_press(Key::Enter);
+    h.run();
+    assert_eq!((h.state().value, h.state().changes), (3.0, 0), "blank commits and arrow keys change nothing");
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some(""));
+    type_into_mixed(&mut h, "3");
+    assert_eq!((h.state().value, h.state().changes), (3.0, 1), "the value it had is still a change: it goes to every object");
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("3"));
+}
+
+fn type_into_mixed(h: &mut Harness<'_, Mixed>, text: &str) {
+    h.get_by_role(Role::TextInput).click();
+    h.run();
+    h.get_by_role(Role::TextInput).type_text(text);
+    h.run();
+    h.key_press(Key::Enter);
+    h.run();
+}
+
+#[test]
+fn the_first_field_of_a_group_takes_the_focus() {
+    let numbers = LocaleNumbers::from_tag("en");
+    let mut opened = false;
+    let mut h = Harness::builder().build_ui_state(
+        move |ui, values: &mut [f64; 2]| {
+            if !opened {
+                focus_first_field(ui.ctx(), true);
+                opened = true;
+            }
+            for (value, name) in values.iter_mut().zip(["Width", "Height"]) {
+                let label = ui.label(name);
+                ui.add(NumberField::new(value, &numbers)).labelled_by(label.id);
+            }
+        },
+        [12.5, 40.0],
+    );
+    h.run();
+    h.event(egui::Event::Text("7".to_owned()));
+    h.run();
+    h.key_press(Key::Enter);
+    h.run();
+    assert_eq!(*h.state(), [7.0, 40.0], "the first field was focused with its text selected");
+}
+
+#[test]
+fn error_tooltips_come_from_the_catalog() {
+    let (i18n, _) = I18n::new(&[("fr", "\tNot a number\tPas un nombre\n", "")], &["fr"]);
+    let fr = i18n.from_code("fr").unwrap_or(Lang::EN);
+    let numbers = LocaleNumbers::from_tag("fr").with_catalog(&i18n, fr);
+    assert_eq!(numbers.describe(NumberError::Unexpected('x')), "Pas un nombre");
+    assert_eq!(numbers.describe(NumberError::TooLarge), "Number too large", "English where the row is missing");
+}
+
+const PRECISE: f64 = 1.234_567_89;
+
+/// A harness with the widget `add` makes and a button after it to take the focus.
+fn with_other(add: impl Fn(&mut Ui, &mut f64) -> Response + 'static) -> Harness<'static, f64> {
+    let mut h = Harness::builder().allow_missing_glyphs().build_ui_state(
+        move |ui, value: &mut f64| {
+            let label = ui.label("Width");
+            add(ui, value).labelled_by(label.id);
+            let _ = ui.button("Other");
+        },
+        PRECISE,
+    );
+    h.run();
+    h
+}
+
+/// Focuses the widget of `role` and leaves it without an edit in each way the user can: a click
+/// elsewhere, Enter and Tab. The value must stay exactly as it was.
+fn leaving_untouched_keeps_the_value(role: Role, add: impl Fn(&mut Ui, &mut f64) -> Response + Clone + 'static) {
+    let mut changed = Vec::new();
+    for leave in ["click elsewhere", "Enter", "Tab"] {
+        let mut h = with_other(add.clone());
+        h.get_by_role(role).click();
+        h.run();
+        assert!(h.get_by_role(role).value().is_some_and(|v| v.contains("1,234568")), "shown rounded");
+        match leave {
+            "Enter" => h.key_press(Key::Enter),
+            "Tab" => h.key_press(Key::Tab),
+            _ => h.get_by_label("Other").click(),
+        }
+        h.run();
+        h.run();
+        assert!(!h.get_by_role(role).is_focused(), "{leave} leaves the field");
+        if h.state().to_bits() != PRECISE.to_bits() {
+            changed.push((leave, *h.state()));
+        }
+    }
+    assert!(changed.is_empty(), "{changed:?}");
+}
+
+#[test]
+fn leaving_an_unedited_number_field_keeps_its_value() {
+    let numbers = LocaleNumbers::from_tag("de");
+    let add = move |ui: &mut Ui, value: &mut f64| ui.add(NumberField::new(value, &numbers));
+    leaving_untouched_keeps_the_value(Role::TextInput, add.clone());
+
+    let mut h = with_other(add.clone());
+    h.get_by_role(Role::TextInput).click();
+    h.run();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.run();
+    h.get_by_role(Role::TextInput).type_text("2,5");
+    h.run();
+    h.key_press(Key::Tab);
+    h.run();
+    assert_eq!(*h.state(), 2.5, "an edit commits");
+
+    let mut h = with_other(add);
+    h.get_by_role(Role::TextInput).click();
+    h.run();
+    h.key_press(Key::ArrowUp);
+    h.run();
+    assert_eq!(*h.state(), 2.0, "a step commits");
+}
+
+#[test]
+fn leaving_an_unedited_drag_value_keeps_its_value() {
+    let numbers = LocaleNumbers::from_tag("de");
+    let add = move |ui: &mut Ui, value: &mut f64| ui.add(LocalizedDragValue::new(DragValue::new(value).speed(0.1).max_decimals(6), &numbers));
+    leaving_untouched_keeps_the_value(Role::SpinButton, add.clone());
+
+    let mut h = with_other(add.clone());
+    type_into_drag(&mut h, "2,5");
+    assert_eq!(*h.state(), 2.5, "an edit commits");
+
+    let mut h = with_other(add);
+    h.get_by_role(Role::SpinButton).click();
+    h.run();
+    h.key_press(Key::ArrowUp);
+    h.run();
+    assert_ne!(*h.state(), PRECISE, "a step commits");
+}
+
+#[test]
+fn the_wheel_scrolls_past_a_field_it_cannot_step() {
+    let numbers = LocaleNumbers::from_tag("de");
+    let mut h = with_other(move |ui, value| ui.add(NumberField::new(value, &numbers)));
+    h.get_by_role(Role::TextInput).click();
+    h.run();
+    h.get_by_role(Role::TextInput).type_text("1x");
+    h.run();
+    let at = h.get_by_role(Role::TextInput).rect().center();
+    h.hover_at(at);
+    h.run();
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Line,
+        delta: egui::vec2(0.0, 1.0),
+        phase: egui::TouchPhase::Move,
+        source: egui::MouseWheelSource::Unknown,
+        modifiers: Modifiers::NONE,
+    });
+    let mut wheel_left = false;
+    h.step();
+    h.ctx.input(|i| wheel_left = i.events.iter().any(|e| matches!(e, egui::Event::MouseWheel { .. })));
+    assert!(wheel_left, "the wheel event stays for the panel under the field");
+}
diff --git a/crates/ui/src/panes/mod.rs b/crates/ui/src/panes/mod.rs
new file mode 100644
index 00000000..61db4e80
--- /dev/null
+++ b/crates/ui/src/panes/mod.rs
@@ -0,0 +1,954 @@
+//! Task panes for document apps: side and bottom panes around the app's own central document.
+//!
+//! [`PaneHost`] draws each open pane as an egui side or bottom panel, or as a floating frame, with
+//! a title bar (title, ▾ menu, ×) and a resizable inner edge. Call it before the app's
+//! `CentralPanel`; the document never becomes a panel. The app owns which panes are open and
+//! where they are: the host takes the open list and each pane's [`PaneState`] every frame and
+//! returns [`PaneRequest`]s for the app to run through its own commands. The order of `open`
+//! is the order of the panes on each edge, the first outermost; a drop that picks a position on
+//! an edge asks for a new order with [`PaneRequest::Before`]. Docking chrome
+//! ([`crate::docking::chrome`]) draws the floating frames and title bars. [`Rail`] draws an icon
+//! strip at one edge that opens one pane at a time.
+
+use std::fmt::Debug;
+use std::hash::Hash;
+use std::ops::RangeInclusive;
+
+use egui::{
+    Context, Frame, Id, Key, LayerId, Margin, Modifiers, Order, Pos2, Rect, Response, Role, Sense, Ui, UiBuilder, Vec2, WidgetInfo, pos2, vec2,
+};
+
+use crate::docking::PanelLimits;
+use crate::docking::chrome::{self, ChromeStyle, FloatingFrame, MoveStep, TitleBar};
+use crate::layout::{ResizeHandle, ResizeHandleStyle, SplitAxis};
+
+#[cfg(feature = "serde")]
+use serde::{Deserialize, Serialize};
+
+mod rail;
+
+pub use rail::{RAIL_BUTTON, RAIL_WIDTH, Rail, RailItem, RailOutput, RailRequest};
+
+/// A title dragged this far out of a docked pane floats it; a pane dropped this close to the
+/// host's left or right edge docks there, outermost.
+pub const DOCK_SNAP: f32 = 32.0;
+/// Height of a pane's title bar.
+pub const TITLE_BAR_HEIGHT: f32 = 24.0;
+/// Size of a pane floated for the first time.
+pub const FLOAT_DEFAULT: Vec2 = vec2(270.0, 480.0);
+const FLOAT_MIN_HEIGHT: f32 = 160.0;
+/// Where the title bar is held when a dragged-out pane floats at the pointer.
+const FLOAT_GRAB: Vec2 = vec2(40.0, 12.0);
+
+/// A logical edge of the host area. `Start` is left in left-to-right interfaces and right in
+/// right-to-left ones.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum Edge {
+    Start,
+    End,
+    Bottom,
+}
+
+/// Where a pane is shown.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub enum Place {
+    Docked(Edge),
+    Floating,
+}
+
+/// The persisted layout of one pane. The app stores it where it keeps its preferences.
+#[derive(Clone, Copy, Debug, PartialEq)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub struct PaneState {
+    pub place: Place,
+    /// Width of a side pane or height of a bottom pane, in points. `None`: the pane's default.
+    pub size: Option<f32>,
+    /// `[x, y, width, height]` of the floating pane, also kept while it is docked.
+    pub float_rect: Option<[f32; 4]>,
+}
+
+impl PaneState {
+    pub fn docked(edge: Edge, size: f32) -> Self {
+        Self { place: Place::Docked(edge), size: Some(size), float_rect: None }
+    }
+
+    fn apply<P>(&mut self, request: &PaneRequest<P>) {
+        match request {
+            PaneRequest::Place(_, place) => self.place = *place,
+            PaneRequest::Resize(_, size) => self.size = Some(*size),
+            PaneRequest::FloatRect(_, rect) => self.float_rect = Some(*rect),
+            PaneRequest::Close(_) | PaneRequest::Focus(_) | PaneRequest::Before(..) => {}
+        }
+    }
+}
+
+/// How docked panes share an edge.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum SidePolicy {
+    /// Every pane on an edge is shown, side by side in `open` order, the first outermost. A drop
+    /// over the outer third of a docked side pane docks directly outside it, over its inner third
+    /// directly inside it, and at the host's left or right edge outermost; the host asks for that
+    /// position with [`PaneRequest::Before`].
+    #[default]
+    Columns,
+    /// One pane per edge: the last of the edge's closable panes in `open`. Panes that are not
+    /// closable (context panes the app shows from its own state) are shown beside the slot. A
+    /// closable pane dropped on an edge takes its slot: [`PaneRequest::Before`] moves it after the
+    /// slot's pane in `open`.
+    OneSlot,
+}
+
+/// A change the user asked for. The host applies none of them to the app's state.
+#[derive(Clone, Debug, PartialEq)]
+pub enum PaneRequest<P> {
+    Close(P),
+    Place(P, Place),
+    Resize(P, f32),
+    FloatRect(P, [f32; 4]),
+    /// The pane took focus from a click, keyboard focus or F6.
+    Focus(P),
+    /// Move the first pane in `open` to directly before the second (`None`: after every pane),
+    /// which puts it directly outside the second on their edge. Sent after the `Place` of a drop
+    /// that picks a position on an edge, and only when `open` changes.
+    Before(P, Option<P>),
+}
+
+impl<P> PaneRequest<P> {
+    pub fn pane(&self) -> &P {
+        match self {
+            Self::Close(p) | Self::Place(p, _) | Self::Resize(p, _) | Self::FloatRect(p, _) | Self::Focus(p) | Self::Before(p, _) => p,
+        }
+    }
+}
+
+/// What [`PaneHost::show`] returns.
+#[derive(Clone, Debug, PartialEq)]
+pub struct PaneOutput<P> {
+    /// In the order they happened; apply them in order. Resize and FloatRect arrive every
+    /// frame a gesture changes the size or rect.
+    pub requests: Vec<PaneRequest<P>>,
+    /// The pane holding keyboard focus or last clicked, if it is still shown.
+    pub focused: Option<P>,
+    /// F6 moved focus past the last pane (or Shift+F6 past the first): focus the document.
+    pub to_document: bool,
+}
+
+/// The app's side of a pane: its contents and defaults.
+pub trait PaneContent<P> {
+    /// May follow the selection (Format Shape, Format Picture).
+    fn title(&self, pane: &P) -> String;
+    fn body(&mut self, ui: &mut Ui, pane: &P);
+    /// Used when the state callback returns `None` and the host has none in memory.
+    fn default_state(&self, pane: &P) -> PaneState;
+    /// Width (or bottom height) limits of the docked pane.
+    fn size_range(&self, _pane: &P) -> RangeInclusive<f32> {
+        200.0..=520.0
+    }
+    /// `false`: no Move or Float items and no title drag.
+    fn movable(&self, _pane: &P) -> bool {
+        true
+    }
+    /// `false`: no × and no Close item (context panes such as PivotTable Fields).
+    fn closable(&self, _pane: &P) -> bool {
+        true
+    }
+    /// `false`: a docked pane draws no title bar (no title, ▾ menu, × or title drag), for bodies
+    /// that draw their own header. The body fills the pane, the resize edge stays and F6 still
+    /// reaches the pane. Close then comes only from the app. A floating pane always draws its
+    /// title bar, which moves it.
+    fn title_bar(&self, _pane: &P) -> bool {
+        true
+    }
+    /// App items, shown above the Move, Float and Close items of the ▾ menu.
+    fn menu(&mut self, _ui: &mut Ui, _pane: &P) {}
+}
+
+/// Labels of the chrome; translate them in the app.
+#[derive(Clone, Debug)]
+pub struct PaneLabels {
+    pub menu: String,
+    pub move_start: String,
+    pub move_end: String,
+    pub move_bottom: String,
+    pub float: String,
+    pub close: String,
+    /// Accessibility label of the title bar. `{title}` is replaced with the pane's title, so
+    /// each title bar has its own name.
+    pub move_pane: String,
+    /// Accessibility label of the resize edges.
+    pub resize: String,
+}
+
+impl Default for PaneLabels {
+    fn default() -> Self {
+        Self {
+            menu: "Pane options".into(),
+            move_start: "Move to Start".into(),
+            move_end: "Move to End".into(),
+            move_bottom: "Move to Bottom".into(),
+            float: "Float".into(),
+            close: "Close".into(),
+            move_pane: "Move {title} pane".into(),
+            resize: "Resize pane".into(),
+        }
+    }
+}
+
+/// Draws the open panes. Build it every frame.
+pub struct PaneHost {
+    id: Id,
+    rtl: bool,
+    policy: SidePolicy,
+    max_fraction: f32,
+    f6: bool,
+    labels: PaneLabels,
+    frame: Option<Frame>,
+    margin: Margin,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Side {
+    Left,
+    Right,
+    Bottom,
+}
+
+#[derive(Clone, Copy, Debug, Default)]
+struct Memory {
+    active: Option<Id>,
+    last_focus: Option<Id>,
+    /// F6 pressed or [`focus_next`] called: `true` cycles backwards.
+    cycle: Option<bool>,
+    drag_out: Option<DragOut>,
+}
+
+#[derive(Clone, Copy, Debug)]
+struct DragOut {
+    pane: Id,
+    canceled: bool,
+}
+
+#[derive(Clone)]
+struct Shown<P> {
+    pane: P,
+    id: Id,
+    state: PaneState,
+}
+
+/// Where a dragged pane docks when dropped: at `edge`, directly before the pane `before` in
+/// `open` (`None`: after every pane).
+#[derive(Clone, Copy, Debug, PartialEq)]
+struct Target {
+    edge: Edge,
+    before: Option<Id>,
+}
+
+/// `panes` with `pane` docked at the target's edge and at its place in the order.
+fn arrange<P: Clone>(panes: &[Shown<P>], pane: Id, target: Target) -> Vec<Shown<P>> {
+    let mut after = panes.to_vec();
+    let Some(index) = after.iter().position(|s| s.id == pane) else { return after };
+    let mut moved = after.remove(index);
+    moved.state.place = Place::Docked(target.edge);
+    let at = match target.before {
+        Some(before) => after.iter().position(|s| s.id == before).unwrap_or(index),
+        None => after.len(),
+    };
+    after.insert(at.min(after.len()), moved);
+    after
+}
+
+/// The requests that dock `pane` at `target`: its `Place` when the edge changes, then `Before`
+/// when `open` changes. None when it lands where it is.
+fn dock_requests<P: Clone>(panes: &[Shown<P>], pane: Id, target: Target) -> Vec<PaneRequest<P>> {
+    let mut requests = Vec::new();
+    let Some(s) = panes.iter().find(|s| s.id == pane) else { return requests };
+    let after = arrange(panes, pane, target);
+    let docked = Place::Docked(target.edge);
+    let on_edge = |list: &[Shown<P>]| list.iter().filter(|s| s.state.place == docked).map(|s| s.id).collect::<Vec<_>>();
+    if s.state.place == docked && on_edge(panes) == on_edge(&after) {
+        return requests;
+    }
+    if s.state.place != docked {
+        requests.push(PaneRequest::Place(s.pane.clone(), docked));
+    }
+    if !panes.iter().map(|s| s.id).eq(after.iter().map(|s| s.id)) {
+        let before = target.before.and_then(|id| panes.iter().find(|s| s.id == id)).map(|s| s.pane.clone());
+        requests.push(PaneRequest::Before(s.pane.clone(), before));
+    }
+    requests
+}
+
+/// Where a pane was drawn, for focus tracking.
+struct Region {
+    pane: Id,
+    rect: Rect,
+    floating: Option<LayerId>,
+}
+
+fn memory_id(id: Id) -> Id {
+    id.with("panes-memory")
+}
+
+/// Move focus to the next pane (the previous one with `reverse`) at the host's next frame. For
+/// apps that route F6 through their own commands; see [`PaneHost::f6`].
+/// Pass the same explicit [`Id`] used for the host; strings require [`Id::unique`].
+pub fn focus_next(ctx: &Context, id: impl Into<Id>, reverse: bool) {
+    let key = memory_id(id.into());
+    ctx.data_mut(|data| data.get_temp_mut_or_default::<Memory>(key).cycle = Some(reverse));
+    ctx.request_repaint();
+}
+
+impl PaneHost {
+    /// Creates a host with a stable global ID. Use [`Id::unique`] to turn a string or tuple
+    /// into an ID, and reuse that ID for [`focus_next`].
+    pub fn new(id: impl Into<Id>) -> Self {
+        Self {
+            id: id.into(),
+            rtl: false,
+            policy: SidePolicy::Columns,
+            max_fraction: 1.0,
+            f6: true,
+            labels: PaneLabels::default(),
+            frame: None,
+            margin: Margin::same(8),
+        }
+    }
+
+    /// Right-to-left interface: `Start` is the right edge.
+    pub fn rtl(mut self, rtl: bool) -> Self {
+        self.rtl = rtl;
+        self
+    }
+
+    pub fn policy(mut self, policy: SidePolicy) -> Self {
+        self.policy = policy;
+        self
+    }
+
+    /// Largest share of the host's width (height for bottom panes) one docked pane may take.
+    pub fn max_fraction(mut self, fraction: f32) -> Self {
+        self.max_fraction = if fraction.is_finite() { fraction.clamp(0.0, 1.0) } else { 1.0 };
+        self
+    }
+
+    /// Whether the host takes F6 and Shift+F6 to cycle focus through the panes and back to the
+    /// document. Default on. Apps that bind F6 themselves call [`focus_next`].
+    pub fn f6(mut self, f6: bool) -> Self {
+        self.f6 = f6;
+        self
+    }
+
+    pub fn labels(mut self, labels: PaneLabels) -> Self {
+        self.labels = labels;
+        self
+    }
+
+    /// Frame of the docked panels. Default: the panel fill and a hairline border, no margin.
+    pub fn frame(mut self, frame: Frame) -> Self {
+        self.frame = Some(frame);
+        self
+    }
+
+    /// Margin around each pane's body. Default 8.
+    pub fn body_margin(mut self, margin: Margin) -> Self {
+        self.margin = margin;
+        self
+    }
+
+    fn pane_id<P: Hash + Debug>(&self, pane: &P) -> Id {
+        self.id.with(("pane", pane))
+    }
+
+    fn side(&self, edge: Edge) -> Side {
+        match (edge, self.rtl) {
+            (Edge::Bottom, _) => Side::Bottom,
+            (Edge::Start, false) | (Edge::End, true) => Side::Left,
+            (Edge::Start, true) | (Edge::End, false) => Side::Right,
+        }
+    }
+
+    /// The edge a pane dropped at `pointer` docks against, if it is within [`DOCK_SNAP`] of the
+    /// host's left or right edge.
+    fn snap(&self, pointer: Pos2, bounds: Rect) -> Option<Edge> {
+        let left = if self.rtl { Edge::End } else { Edge::Start };
+        let right = if self.rtl { Edge::Start } else { Edge::End };
+        if pointer.x <= bounds.left() + DOCK_SNAP {
+            Some(left)
+        } else if pointer.x >= bounds.right() - DOCK_SNAP {
+            Some(right)
+        } else {
+            None
+        }
+    }
+
+    /// Draw the panes in `open` with the state `states` returns for each (`None`: the state the
+    /// host kept from earlier requests, else the pane's default). Call between the app's top
+    /// and bottom bars and its `CentralPanel`.
+    pub fn show<P: Clone + Hash + Debug, C: PaneContent<P>>(
+        self,
+        ui: &mut Ui,
+        open: &[P],
+        states: impl Fn(&P) -> Option<PaneState>,
+        content: &mut C,
+    ) -> PaneOutput<P> {
+        let ctx = ui.ctx().clone();
+        let bounds = ui.available_rect_before_wrap();
+        let style = ChromeStyle { right_to_left: self.rtl, ..ChromeStyle::from_ui(ui) };
+        let key = memory_id(self.id);
+        let mut memory = ctx.data(|data| data.get_temp::<Memory>(key)).unwrap_or_default();
+        let mut requests = Vec::new();
+        let mut to_document = false;
+
+        if self.f6 {
+            ui.input_mut(|input| {
+                if input.consume_key(Modifiers::SHIFT, Key::F6) {
+                    memory.cycle = Some(true);
+                } else if input.consume_key(Modifiers::NONE, Key::F6) {
+                    memory.cycle = Some(false);
+                }
+            });
+        }
+
+        let mut shown: Vec<Shown<P>> = Vec::new();
+        for pane in open {
+            let id = self.pane_id(pane);
+            if shown.iter().any(|s| s.id == id) {
+                continue;
+            }
+            let state =
+                states(pane).or_else(|| ctx.data(|data| data.get_temp::<PaneState>(id.with("state")))).unwrap_or_else(|| content.default_state(pane));
+            shown.push(Shown { pane: pane.clone(), id, state });
+        }
+        // Before the one-slot filter: a drop can reveal a pane this frame hides.
+        let open_panes = shown.clone();
+        self.one_slot(&mut shown, content);
+
+        let previous = memory.active.filter(|active| shown.iter().any(|s| s.id == *active));
+        memory.active = previous;
+        let mut focus_target = None;
+        if let Some(reverse) = memory.cycle.take() {
+            let current = memory.active.and_then(|active| shown.iter().position(|s| s.id == active));
+            let next = match (current, reverse) {
+                (None, false) => shown.first(),
+                (None, true) => shown.last(),
+                (Some(i), false) => shown.get(i + 1),
+                (Some(i), true) => i.checked_sub(1).and_then(|i| shown.get(i)),
+            };
+            focus_target = next.map(|s| s.id);
+            memory.active = focus_target;
+            if focus_target.is_none() {
+                to_document = true;
+                ctx.memory_mut(|m| {
+                    if let Some(focused) = m.focused() {
+                        m.surrender_focus(focused);
+                    }
+                });
+            }
+        }
+
+        let preview = ctx.layer_painter(LayerId::new(Order::Tooltip, self.id.with("drop-preview")));
+        let mut regions = Vec::new();
+        for edge in [Edge::Start, Edge::End, Edge::Bottom] {
+            for s in shown.iter().filter(|s| s.state.place == Place::Docked(edge)) {
+                let rect =
+                    self.docked(ui, &open_panes, s, edge, content, &style, focus_target == Some(s.id), bounds, &mut memory, &preview, &mut requests);
+                regions.push(Region { pane: s.id, rect, floating: None });
+            }
+        }
+        for s in shown.iter().filter(|s| s.state.place == Place::Floating) {
+            let (rect, layer) = self.floating(&ctx, &open_panes, s, content, &style, focus_target == Some(s.id), bounds, &preview, &mut requests);
+            regions.push(Region { pane: s.id, rect, floating: Some(layer) });
+        }
+
+        if focus_target.is_none() && !to_document {
+            self.track_focus(&ctx, ui.layer_id(), &regions, &mut memory);
+        }
+        memory.last_focus = ctx.memory(|m| m.focused());
+        if memory.active != previous
+            && let Some(s) = memory.active.and_then(|active| shown.iter().find(|s| s.id == active))
+        {
+            requests.push(PaneRequest::Focus(s.pane.clone()));
+        }
+
+        for s in &shown {
+            let mut state = s.state;
+            let mut changed = false;
+            for request in requests.iter().filter(|r| self.pane_id(r.pane()) == s.id) {
+                state.apply(request);
+                changed = true;
+            }
+            if changed {
+                ctx.data_mut(|data| data.insert_temp(s.id.with("state"), state));
+            }
+        }
+        let focused = memory.active.and_then(|active| shown.iter().find(|s| s.id == active)).map(|s| s.pane.clone());
+        ctx.data_mut(|data| data.insert_temp(key, memory));
+        PaneOutput { requests, focused, to_document }
+    }
+
+    /// The pane under a primary press, or the pane holding a newly focused widget, becomes active.
+    /// Presses and focus outside every pane (the document) clear it; presses on other layers
+    /// (menus, the app's own windows) leave it.
+    fn track_focus(&self, ctx: &Context, layer: LayerId, regions: &[Region], memory: &mut Memory) {
+        let find = |at_layer: Option<LayerId>, pos: Pos2| -> Option<Option<Id>> {
+            if let Some(region) = regions.iter().find(|r| r.floating.is_some() && r.floating == at_layer) {
+                return Some(Some(region.pane));
+            }
+            if at_layer.is_none() || at_layer == Some(layer) {
+                return Some(regions.iter().find(|r| r.floating.is_none() && r.rect.contains(pos)).map(|r| r.pane));
+            }
+            None
+        };
+        if ctx.input(|input| input.pointer.primary_pressed())
+            && let Some(pos) = ctx.input(|input| input.pointer.press_origin())
+            && let Some(active) = find(ctx.layer_id_at(pos), pos)
+        {
+            memory.active = active;
+        }
+        let focused = ctx.memory(|m| m.focused());
+        if focused != memory.last_focus
+            && let Some(response) = focused.and_then(|id| ctx.read_response(id))
+            && let Some(active) = find(Some(response.layer_id), response.rect.center())
+        {
+            memory.active = active;
+        }
+    }
+
+    fn limits<P, C: PaneContent<P>>(&self, content: &C, pane: &P, extent: f32) -> (f32, f32) {
+        let range = content.size_range(pane);
+        let min = if range.start().is_finite() { range.start().max(0.0) } else { 0.0 };
+        let max = if range.end().is_finite() { range.end().max(min) } else { min.max(extent) };
+        (min, max.min(self.max_fraction * extent).max(min))
+    }
+
+    /// With [`SidePolicy::OneSlot`], drop every closable docked pane but the last on its edge.
+    fn one_slot<P, C: PaneContent<P>>(&self, shown: &mut Vec<Shown<P>>, content: &C) {
+        if self.policy != SidePolicy::OneSlot {
+            return;
+        }
+        let mut taken = Vec::new();
+        for index in (0..shown.len()).rev() {
+            if let Place::Docked(edge) = shown[index].state.place
+                && content.closable(&shown[index].pane)
+            {
+                if taken.contains(&edge) {
+                    shown.remove(index);
+                } else {
+                    taken.push(edge);
+                }
+            }
+        }
+    }
+
+    /// The width (height at the bottom) of a pane docked at `edge`: its size, else its default,
+    /// within its limits.
+    fn docked_size<P, C: PaneContent<P>>(&self, content: &C, s: &Shown<P>, edge: Edge, bounds: Rect) -> f32 {
+        let extent = if self.side(edge) == Side::Bottom { bounds.height() } else { bounds.width() };
+        let (min, max) = self.limits(content, &s.pane, extent);
+        let default = content.default_state(&s.pane).size;
+        s.state.size.filter(|v| v.is_finite()).or(default.filter(|v| v.is_finite())).unwrap_or(min).clamp(min, max)
+    }
+
+    /// The rects of the side panes in `panes` as [`Self::show`] draws them: `Start` panes, then
+    /// `End` panes, each in order from the outside in and no wider than the space left.
+    fn side_rects<P, C: PaneContent<P>>(&self, panes: &[Shown<P>], content: &C, bounds: Rect) -> Vec<(Id, Edge, Rect)> {
+        let mut rects = Vec::new();
+        let mut free = bounds;
+        for edge in [Edge::Start, Edge::End] {
+            for s in panes.iter().filter(|s| s.state.place == Place::Docked(edge)) {
+                let size = self.docked_size(content, s, edge, bounds).min(free.width()).max(0.0);
+                let rect = if self.side(edge) == Side::Left {
+                    let rect = Rect::from_x_y_ranges(free.left()..=free.left() + size, free.y_range());
+                    free.min.x = rect.right();
+                    rect
+                } else {
+                    let rect = Rect::from_x_y_ranges(free.right() - size..=free.right(), free.y_range());
+                    free.max.x = rect.left();
+                    rect
+                };
+                rects.push((s.id, edge, rect));
+            }
+        }
+        rects
+    }
+
+    /// Where `pane`, dragged with the pointer at `pointer`, docks if dropped: at the host's left or
+    /// right edge, outermost there, or over the outer or inner third of another docked side pane,
+    /// directly outside or inside it. `panes` is the open list before the one-slot filter.
+    fn target<P: Clone, C: PaneContent<P>>(&self, pointer: Pos2, panes: &[Shown<P>], pane: Id, content: &C, bounds: Rect) -> Option<Target> {
+        if !pointer.is_finite() {
+            return None;
+        }
+        let others = || panes.iter().filter(|s| s.id != pane);
+        // The pane after `id` in `open`, skipping the dragged pane: directly after `id` is
+        // directly before that one.
+        let after = |id: Id| others().skip_while(|s| s.id != id).nth(1).map(|s| s.id);
+        // Directly before the pane that follows it, the dragged pane keeps its place in `open`.
+        let keep = panes.iter().skip_while(|s| s.id != pane).nth(1).map(|s| s.id);
+        let mut visible = panes.to_vec();
+        self.one_slot(&mut visible, content);
+        // One slot per edge leaves no position to pick: a closable pane takes the edge's slot by
+        // going after the slot's pane.
+        let slot = |edge: Edge, columns: Option<Id>| match self.policy {
+            SidePolicy::Columns => columns,
+            SidePolicy::OneSlot => {
+                let closable = panes.iter().any(|s| s.id == pane && content.closable(&s.pane));
+                match visible.iter().find(|s| closable && s.id != pane && s.state.place == Place::Docked(edge) && content.closable(&s.pane)) {
+                    Some(taken) => after(taken.id),
+                    None => keep,
+                }
+            }
+        };
+        if let Some(edge) = self.snap(pointer, bounds) {
+            let first = others().find(|s| s.state.place == Place::Docked(edge)).map(|s| s.id);
+            return Some(Target { edge, before: slot(edge, first.or(keep)) });
+        }
+        let (id, edge, rect) = self.side_rects(&visible, content, bounds).into_iter().find(|(id, _, rect)| *id != pane && rect.contains(pointer))?;
+        let third = rect.width() / 3.0;
+        let from_outside = if self.side(edge) == Side::Left { pointer.x - rect.left() } else { rect.right() - pointer.x };
+        if from_outside < third {
+            Some(Target { edge, before: slot(edge, Some(id)) })
+        } else if from_outside > rect.width() - third {
+            Some(Target { edge, before: slot(edge, after(id)) })
+        } else {
+            None
+        }
+    }
+
+    /// The rect `pane` takes on the next frame once it is docked at `target`. `None` when
+    /// [`SidePolicy::OneSlot`] would hide it there.
+    fn landing<P: Clone, C: PaneContent<P>>(&self, panes: &[Shown<P>], pane: Id, target: Target, content: &C, bounds: Rect) -> Option<Rect> {
+        let mut after = arrange(panes, pane, target);
+        self.one_slot(&mut after, content);
+        self.side_rects(&after, content, bounds).into_iter().find(|(id, _, _)| *id == pane).map(|(_, _, rect)| rect)
+    }
+
+    /// Paints where `pane` lands when it is dropped at `target`.
+    #[allow(clippy::too_many_arguments)]
+    fn preview_dock<P: Clone, C: PaneContent<P>>(
+        &self,
+        preview: &egui::Painter,
+        style: &ChromeStyle,
+        panes: &[Shown<P>],
+        pane: Id,
+        target: Target,
+        content: &C,
+        bounds: Rect,
+    ) {
+        if let Some(rect) = self.landing(panes, pane, target, content, bounds) {
+            chrome::drop_preview(preview, rect.shrink(1.0), style.accent, true);
+        }
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn docked<P: Clone + Hash + Debug, C: PaneContent<P>>(
+        &self,
+        ui: &mut Ui,
+        shown: &[Shown<P>],
+        s: &Shown<P>,
+        edge: Edge,
+        content: &mut C,
+        style: &ChromeStyle,
+        focus: bool,
+        bounds: Rect,
+        memory: &mut Memory,
+        preview: &egui::Painter,
+        requests: &mut Vec<PaneRequest<P>>,
+    ) -> Rect {
+        let side = self.side(edge);
+        let extent = if side == Side::Bottom { bounds.height() } else { bounds.width() };
+        let (min, max) = self.limits(content, &s.pane, extent);
+        // A side pane takes no more than the width the panes outside it leave: egui would place
+        // a wider one partly beyond the host's edge.
+        let room = if side == Side::Bottom { f32::INFINITY } else { ui.available_rect_before_wrap().width().max(0.0) };
+        let size = self.docked_size(content, s, edge, bounds).min(room);
+        let panel_id = s.id.with("panel");
+        let panel = match side {
+            Side::Left => egui::Panel::left(panel_id),
+            Side::Right => egui::Panel::right(panel_id),
+            Side::Bottom => egui::Panel::bottom(panel_id),
+        };
+        let frame = self.frame.unwrap_or_else(|| Frame::NONE.fill(ui.visuals().panel_fill).stroke(ui.visuals().widgets.noninteractive.bg_stroke));
+        let title_bar = content.title_bar(&s.pane);
+        let drawn = panel.exact_size(size).resizable(false).frame(frame).show(ui, |ui| {
+            let top = ui.max_rect();
+            let (bar, body_top) = if title_bar {
+                let title = Rect::from_min_size(top.min, vec2(top.width(), TITLE_BAR_HEIGHT));
+                ui.allocate_rect(title, Sense::hover());
+                (Some(self.chrome(ui, title, s, content, style, focus, bounds, requests)), title.bottom())
+            } else {
+                (None, top.top())
+            };
+            // The pane reserves exactly its size and clips its body. egui cuts a panel wider
+            // than its exact size at its outer edge, so a wide body would shift a right or
+            // bottom pane's reserved rect inwards and the document would draw over the pane.
+            let body = Rect::from_min_max(pos2(top.left(), body_top), top.max);
+            // Without a title bar, F6 focuses the body itself; Tab goes on into its widgets,
+            // which register after it.
+            let stop = (!title_bar).then(|| {
+                let stop = ui.interact(body, s.id.with("body"), Sense::focusable_noninteractive());
+                let title = content.title(&s.pane);
+                stop.widget_info(|| WidgetInfo::labeled(Role::Pane, true, &title));
+                if focus {
+                    stop.request_focus();
+                }
+                stop
+            });
+            let mut child = ui.new_child(UiBuilder::new().max_rect(body).layout(*ui.layout()));
+            child.set_clip_rect(body.intersect(ui.clip_rect()));
+            Frame::NONE.inner_margin(self.margin).show(&mut child, |ui| {
+                ui.set_min_width(ui.available_width());
+                content.body(ui, &s.pane);
+            });
+            if stop.as_ref().is_some_and(Response::has_focus) {
+                ui.painter().rect_stroke(body.shrink(1.0), 0.0, egui::Stroke::new(1.0, style.accent), egui::StrokeKind::Inside);
+            }
+            ui.allocate_rect(body, Sense::hover());
+            bar
+        });
+        let rect = drawn.response.rect;
+        let bar = drawn.inner;
+
+        let (axis, strip) = match side {
+            Side::Left => (SplitAxis::Horizontal, Rect::from_x_y_ranges(rect.right() - 2.0..=rect.right() + 2.0, rect.y_range())),
+            Side::Right => (SplitAxis::Horizontal, Rect::from_x_y_ranges(rect.left() - 2.0..=rect.left() + 2.0, rect.y_range())),
+            Side::Bottom => (SplitAxis::Vertical, Rect::from_x_y_ranges(rect.x_range(), rect.top() - 2.0..=rect.top() + 2.0)),
+        };
+        let handle_style = ResizeHandleStyle { hovered: style.accent.gamma_multiply(0.5), dragged: style.accent, focused: style.accent };
+        // The edge's hit strip reaches over the document, whose widgets register after the host
+        // and would take presses there on the host's layer. A sublayer sits directly above it:
+        // over the document, under floating windows.
+        let edge_layer = LayerId::new(ui.layer_id().order, s.id.with("resize-layer"));
+        ui.ctx().set_sublayer(ui.layer_id(), edge_layer);
+        let mut edge_ui = ui.new_child(UiBuilder::new().layer_id(edge_layer));
+        let resize = ResizeHandle::new(s.id.with("resize"), axis, strip, &self.labels.resize, handle_style).show(&mut edge_ui);
+        let next = if resize.response.dragged() {
+            resize.response.interact_pointer_pos().map(|p| match side {
+                Side::Left => p.x - rect.left(),
+                Side::Right => rect.right() - p.x,
+                Side::Bottom => rect.bottom() - p.y,
+            })
+        } else if resize.delta != 0.0 {
+            // Arrow keys move the edge: right grows a left pane, left grows a right pane.
+            Some(if side == Side::Left { size + resize.delta } else { size - resize.delta })
+        } else {
+            None
+        };
+        if let Some(next) = next.filter(|v| v.is_finite()).map(|v| v.clamp(min, max).round())
+            && next != size
+        {
+            requests.push(PaneRequest::Resize(s.pane.clone(), next));
+        }
+
+        if content.movable(&s.pane)
+            && let Some(bar) = &bar
+        {
+            self.drag_out(ui.ctx(), bar, shown, s, edge, rect, content, bounds, memory, preview, style, requests);
+        }
+        rect
+    }
+
+    /// A docked pane's title dragged beyond [`DOCK_SNAP`] of the pane: dropped on a dock target
+    /// ([`Self::target`]) it docks there, elsewhere it floats under the pointer.
+    #[allow(clippy::too_many_arguments)]
+    fn drag_out<P: Clone, C: PaneContent<P>>(
+        &self,
+        ctx: &Context,
+        bar: &Response,
+        shown: &[Shown<P>],
+        s: &Shown<P>,
+        edge: Edge,
+        rect: Rect,
+        content: &C,
+        bounds: Rect,
+        memory: &mut Memory,
+        preview: &egui::Painter,
+        style: &ChromeStyle,
+        requests: &mut Vec<PaneRequest<P>>,
+    ) {
+        if bar.drag_started() {
+            memory.drag_out = Some(DragOut { pane: s.id, canceled: false });
+        }
+        let Some(mut drag) = memory.drag_out.filter(|d| d.pane == s.id) else { return };
+        if ctx.input(|input| input.key_pressed(Key::Escape)) || crate::focus::lost(ctx) {
+            drag.canceled = true;
+        }
+        let near = rect.expand(DOCK_SNAP);
+        let Some(pointer) = ctx.pointer_latest_pos() else { return };
+        let outside = if edge == Edge::Bottom { !near.y_range().contains(pointer.y) } else { !near.x_range().contains(pointer.x) };
+        let size = s.state.float_rect.map_or(FLOAT_DEFAULT, |r| vec2(r[2], r[3]));
+        let float = float_rect(Some(rect_array(Rect::from_min_size(pointer - FLOAT_GRAB, size))), bounds, vec2(0.0, FLOAT_MIN_HEIGHT));
+        let target = self.target(pointer, shown, s.id, content, bounds);
+        if bar.drag_stopped() {
+            memory.drag_out = None;
+            if drag.canceled || !outside {
+                return;
+            }
+            match target {
+                Some(target) => requests.extend(dock_requests(shown, s.id, target)),
+                None => {
+                    requests.push(PaneRequest::Place(s.pane.clone(), Place::Floating));
+                    requests.push(PaneRequest::FloatRect(s.pane.clone(), rect_array(float)));
+                }
+            }
+            return;
+        }
+        if !bar.dragged() {
+            memory.drag_out = None;
+            return;
+        }
+        memory.drag_out = Some(drag);
+        if drag.canceled || !outside {
+            return;
+        }
+        match target {
+            Some(target) => self.preview_dock(preview, style, shown, s.id, target, content, bounds),
+            None => chrome::drop_preview(preview, float.shrink(1.0), style.accent, true),
+        }
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn floating<P: Clone + Hash + Debug, C: PaneContent<P>>(
+        &self,
+        ctx: &Context,
+        panes: &[Shown<P>],
+        s: &Shown<P>,
+        content: &mut C,
+        style: &ChromeStyle,
+        focus: bool,
+        bounds: Rect,
+        preview: &egui::Painter,
+        requests: &mut Vec<PaneRequest<P>>,
+    ) -> (Rect, LayerId) {
+        let (min_width, _) = self.limits(content, &s.pane, bounds.width());
+        let min = vec2(min_width, FLOAT_MIN_HEIGHT);
+        let rect = float_rect(s.state.float_rect, bounds, min);
+        let limits = PanelLimits { min, max: bounds.size().max(min) };
+        let shown = FloatingFrame::new(s.id.with("float"), rect).bounds(bounds).limits(limits).resize_label(&self.labels.resize).show(
+            ctx,
+            style,
+            |ui, rect| {
+                let title = Rect::from_min_size(rect.min, vec2(rect.width(), TITLE_BAR_HEIGHT));
+                let bar = self.chrome(ui, title, s, content, style, focus, bounds, requests);
+                let body = Rect::from_min_max(pos2(rect.left(), title.bottom()), rect.max) - self.margin;
+                if body.is_positive() {
+                    ui.scope_builder(UiBuilder::new().max_rect(body), |ui| {
+                        ui.set_clip_rect(body.intersect(ui.clip_rect()));
+                        content.body(ui, &s.pane);
+                    });
+                }
+                bar
+            },
+        );
+        if let Some(resized) = shown.resized {
+            requests.push(PaneRequest::FloatRect(s.pane.clone(), rect_array(resized)));
+        }
+        if content.movable(&s.pane) {
+            let step = chrome::live_move(ctx, &shown.inner, shown.rect, bounds);
+            if let Some(MoveStep::Moving(_)) = step
+                && let Some(target) = ctx.pointer_latest_pos().and_then(|pointer| self.target(pointer, panes, s.id, content, bounds))
+            {
+                self.preview_dock(preview, style, panes, s.id, target, content, bounds);
+            }
+            match step {
+                Some(MoveStep::Moving(next) | MoveStep::Canceled(next)) if next != shown.rect => {
+                    requests.push(PaneRequest::FloatRect(s.pane.clone(), rect_array(next)));
+                }
+                Some(MoveStep::Dropped { rect, pointer }) => {
+                    if let Some(target) = self.target(pointer, panes, s.id, content, bounds) {
+                        requests.extend(dock_requests(panes, s.id, target));
+                    } else if rect != shown.rect {
+                        requests.push(PaneRequest::FloatRect(s.pane.clone(), rect_array(rect)));
+                    }
+                }
+                _ => {}
+            }
+        }
+        (shown.rect, shown.layer)
+    }
+
+    /// Title, ▾ menu and ×. Returns the bar, which senses the title drag.
+    #[allow(clippy::too_many_arguments)]
+    fn chrome<P: Clone, C: PaneContent<P>>(
+        &self,
+        ui: &mut Ui,
+        rect: Rect,
+        s: &Shown<P>,
+        content: &mut C,
+        style: &ChromeStyle,
+        focus: bool,
+        bounds: Rect,
+        requests: &mut Vec<PaneRequest<P>>,
+    ) -> Response {
+        let movable = content.movable(&s.pane);
+        let closable = content.closable(&s.pane);
+        let title = content.title(&s.pane);
+        let move_label = self.labels.move_pane.replace("{title}", &title);
+        let mut bar = TitleBar::new(s.id.with("title"), &move_label).title(title).menu(&self.labels.menu).movable(movable);
+        if closable {
+            bar = bar.close(&self.labels.close);
+        }
+        let title = bar.show(ui, rect, style);
+        if focus {
+            title.bar.request_focus();
+        }
+        if title.close.as_ref().is_some_and(Response::clicked) {
+            requests.push(PaneRequest::Close(s.pane.clone()));
+        }
+        if let Some(menu) = &title.menu {
+            egui::Popup::menu(menu).show(|ui| {
+                let top = ui.cursor().top();
+                content.menu(ui, &s.pane);
+                if ui.cursor().top() > top && (movable || closable) {
+                    ui.separator();
+                }
+                if movable {
+                    let mut places = vec![(Place::Docked(Edge::Start), &self.labels.move_start), (Place::Docked(Edge::End), &self.labels.move_end)];
+                    if content.default_state(&s.pane).place == Place::Docked(Edge::Bottom) {
+                        places.push((Place::Docked(Edge::Bottom), &self.labels.move_bottom));
+                    }
+                    places.push((Place::Floating, &self.labels.float));
+                    for (place, label) in places {
+                        if ui.selectable_label(s.state.place == place, label.as_str()).clicked() && s.state.place != place {
+                            requests.push(PaneRequest::Place(s.pane.clone(), place));
+                            if place == Place::Floating {
+                                let rect = float_rect(s.state.float_rect, bounds, vec2(0.0, FLOAT_MIN_HEIGHT));
+                                requests.push(PaneRequest::FloatRect(s.pane.clone(), rect_array(rect)));
+                            }
+                        }
+                    }
+                }
+                if closable && ui.button(self.labels.close.as_str()).clicked() {
+                    requests.push(PaneRequest::Close(s.pane.clone()));
+                }
+            });
+        }
+        title.bar
+    }
+}
+
+fn rect_array(rect: Rect) -> [f32; 4] {
+    [rect.min.x, rect.min.y, rect.width(), rect.height()]
+}
+
+/// The floating rect for `saved` (`[x, y, width, height]`), at least `min` and at most the
+/// bounds in size, inside `bounds`. Without a saved rect: [`FLOAT_DEFAULT`] right of the middle.
+/// Non-finite or negative values fall back to the defaults, so the result is always finite.
+pub fn float_rect(saved: Option<[f32; 4]>, bounds: Rect, min: Vec2) -> Rect {
+    let bounds = if bounds.is_finite() && bounds.is_positive() { bounds } else { Rect::from_min_size(Pos2::ZERO, FLOAT_DEFAULT) };
+    let finite = |v: f32, fallback: f32| if v.is_finite() { v } else { fallback };
+    let size = saved.map_or(FLOAT_DEFAULT, |r| vec2(finite(r[2], FLOAT_DEFAULT.x), finite(r[3], FLOAT_DEFAULT.y)));
+    let size = size.max(min.max(Vec2::splat(1.0))).min(bounds.size());
+    let free = (bounds.size() - size).max(Vec2::ZERO);
+    let default = (bounds.min + vec2(free.x * 0.75, free.y * 0.3)).round();
+    let pos = saved.map_or(default, |r| pos2(finite(r[0], default.x), finite(r[1], default.y)));
+    let pos = pos.max(bounds.min).min((bounds.max - size).max(bounds.min));
+    Rect::from_min_size(pos, size)
+}
+
+#[cfg(test)]
+mod rail_tests;
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui/src/panes/rail.rs b/crates/ui/src/panes/rail.rs
new file mode 100644
index 00000000..c6756e7b
--- /dev/null
+++ b/crates/ui/src/panes/rail.rs
@@ -0,0 +1,299 @@
+//! An icon rail: a vertical strip of icons, always shown at one edge, that opens one task pane at
+//! a time beside it.
+//!
+//! The rail stores nothing. The app passes its items and the pane it has open every frame, shows
+//! that pane with [`super::PaneHost`] ([`super::SidePolicy::OneSlot`], not movable), and runs the
+//! [`RailRequest`] a click returns.
+
+use std::fmt::Debug;
+use std::hash::Hash;
+
+use egui::{
+    Align, EventFilter, Frame, Id, ImageSource, Key, Layout, Margin, Modifiers, Rect, Response, Role, Sense, Stroke, StrokeKind, Ui, WidgetInfo, vec2,
+};
+
+use super::Edge;
+use crate::docking::chrome::ChromeStyle;
+
+/// Default width of the rail.
+pub const RAIL_WIDTH: f32 = 48.0;
+/// Default width and height of one item.
+pub const RAIL_BUTTON: f32 = 34.0;
+/// Room between two items.
+const SPACING: f32 = 4.0;
+/// Room between an item's edge and its icon.
+const ICON_INSET: f32 = 8.0;
+/// Radius of the marker dot.
+const MARKER_RADIUS: f32 = 3.0;
+/// Largest width or item size the rail accepts; larger or non-finite values fall back.
+const MAX_SIZE: f32 = 4096.0;
+
+/// One icon of the rail, standing for the pane it opens.
+#[derive(Clone, Debug)]
+pub struct RailItem<P> {
+    pub pane: P,
+    /// Painted tinted with the chrome's text colors, like docking's panel icons.
+    pub icon: ImageSource<'static>,
+    /// Tooltip and accessible name. Translate it in the app.
+    pub label: String,
+    /// `false`: drawn disabled, not focusable, and a click asks for nothing.
+    pub enabled: bool,
+    /// A small dot telling that the pane has content (comments exist, the document has
+    /// bookmarks). Drawn only while the pane is not open.
+    pub marker: bool,
+    /// The item's accessible description while the marker shows ("Has comments"). Translate it
+    /// in the app.
+    pub marker_label: Option<String>,
+}
+
+impl<P> RailItem<P> {
+    /// An enabled item without a marker.
+    pub fn new(pane: P, icon: ImageSource<'static>, label: impl Into<String>) -> Self {
+        Self { pane, icon, label: label.into(), enabled: true, marker: false, marker_label: None }
+    }
+
+    pub fn enabled(mut self, enabled: bool) -> Self {
+        self.enabled = enabled;
+        self
+    }
+
+    pub fn marker(mut self, marker: bool) -> Self {
+        self.marker = marker;
+        self
+    }
+
+    pub fn marker_label(mut self, label: impl Into<String>) -> Self {
+        self.marker_label = Some(label.into());
+        self
+    }
+}
+
+/// What a click on an item asks the app to do.
+#[derive(Clone, Debug, PartialEq)]
+#[non_exhaustive]
+pub enum RailRequest<P> {
+    /// Open this pane in place of the open one.
+    Open(P),
+    /// Close this pane, which is the open one.
+    Close(P),
+}
+
+/// What [`Rail::show`] returns.
+#[derive(Clone, Debug, PartialEq)]
+#[non_exhaustive]
+pub struct RailOutput<P> {
+    /// The click of this frame, if any.
+    pub request: Option<RailRequest<P>>,
+    /// The item holding keyboard focus.
+    pub focused: Option<P>,
+    /// Where the rail was drawn.
+    pub rect: Rect,
+}
+
+/// Draws the icon rail. Build it every frame.
+pub struct Rail {
+    id: Id,
+    edge: Edge,
+    rtl: bool,
+    width: f32,
+    button: f32,
+    frame: Option<Frame>,
+}
+
+impl Rail {
+    /// Creates a rail with a stable global ID; use [`Id::unique`] for string or tuple keys.
+    pub fn new(id: impl Into<Id>) -> Self {
+        Self { id: id.into(), edge: Edge::End, rtl: false, width: RAIL_WIDTH, button: RAIL_BUTTON, frame: None }
+    }
+
+    /// The edge the rail sits at. Default [`Edge::End`]. The rail is vertical, so
+    /// [`Edge::Bottom`] draws it at the end edge.
+    pub fn edge(mut self, edge: Edge) -> Self {
+        self.edge = edge;
+        self
+    }
+
+    /// Right-to-left interface: `Start` is the right edge, and the marker dot sits at the
+    /// item's top-left corner.
+    pub fn rtl(mut self, rtl: bool) -> Self {
+        self.rtl = rtl;
+        self
+    }
+
+    /// Width of the rail. Default [`RAIL_WIDTH`].
+    pub fn width(mut self, width: f32) -> Self {
+        self.width = if width.is_finite() { width.clamp(0.0, MAX_SIZE) } else { RAIL_WIDTH };
+        self
+    }
+
+    /// Width and height of one item. Default [`RAIL_BUTTON`]. The icon is 16 points smaller.
+    pub fn button_size(mut self, size: f32) -> Self {
+        self.button = if size.is_finite() { size.clamp(0.0, MAX_SIZE) } else { RAIL_BUTTON };
+        self
+    }
+
+    /// Frame of the rail. Default: the panel fill and an 8 pt margin above and below. The panel's
+    /// separator line draws the inner edge.
+    pub fn frame(mut self, frame: Frame) -> Self {
+        self.frame = Some(frame);
+        self
+    }
+
+    /// The widget id of `pane`'s item, to give it keyboard focus (`Memory::request_focus`), for
+    /// example when the app's F6 cycle reaches the rail.
+    pub fn item_id<P: Hash + Debug>(&self, pane: &P) -> Id {
+        self.id.with(("rail-item", pane))
+    }
+
+    fn left(&self) -> bool {
+        matches!((self.edge, self.rtl), (Edge::Start, false) | (Edge::End | Edge::Bottom, true))
+    }
+
+    /// Draw the rail as the outermost panel on its edge: call it before [`super::PaneHost::show`]
+    /// (and after the app's top and bottom bars), so the open pane sits between the document and
+    /// the rail. `items` are drawn top-down and scroll in a short window; `foot` draws below
+    /// them, always visible (page navigation, zoom), and may draw nothing. `open` is the pane
+    /// the app has open.
+    pub fn show<P: Clone + Hash + Debug>(self, ui: &mut Ui, items: &[RailItem<P>], open: Option<&P>, foot: impl FnOnce(&mut Ui)) -> RailOutput<P> {
+        let style = ChromeStyle::from_ui(ui);
+        let panel_id = self.id.with("rail-panel");
+        let panel = if self.left() { egui::Panel::left(panel_id) } else { egui::Panel::right(panel_id) };
+        let frame = self.frame.unwrap_or_else(|| Frame::NONE.fill(ui.visuals().panel_fill).inner_margin(Margin::symmetric(0, 8)));
+        let shown = panel.exact_size(self.width).resizable(false).frame(frame).show(ui, |ui| {
+            // The foot is a panel of its own, so that in a short window the items scroll instead
+            // of running into it.
+            egui::Panel::bottom(self.id.with("rail-foot")).frame(Frame::NONE).show_separator_line(false).resizable(false).show(ui, |ui| {
+                ui.with_layout(Layout::top_down(Align::Center), foot);
+            });
+            egui::ScrollArea::vertical()
+                .id_salt(self.id.with("rail-items"))
+                .auto_shrink([false, false])
+                .show(ui, |ui| {
+                    ui.with_layout(Layout::top_down(Align::Center), |ui| {
+                        ui.spacing_mut().item_spacing.y = SPACING;
+                        self.items(ui, items, open, &style)
+                    })
+                    .inner
+                })
+                .inner
+        });
+        let (request, focused) = shown.inner;
+        RailOutput { request, focused, rect: shown.response.rect }
+    }
+
+    fn items<P: Clone + Hash + Debug>(
+        &self,
+        ui: &mut Ui,
+        items: &[RailItem<P>],
+        open: Option<&P>,
+        style: &ChromeStyle,
+    ) -> (Option<RailRequest<P>>, Option<P>) {
+        let mut request = None;
+        let mut focused = None;
+        let open = open.map(|pane| self.item_id(pane));
+        let mut drawn: Vec<Id> = Vec::new();
+        // Focus order for Up and Down: the enabled items with their place in `drawn`.
+        let mut enabled: Vec<(usize, Id, &P)> = Vec::new();
+        let mut focus_index = None;
+        // An item disabled while focused, by its place. egui drops a disabled widget's focus as
+        // it draws it, so this is read before.
+        let mut lost_focus = None;
+        for item in items {
+            let id = self.item_id(&item.pane);
+            // A pane listed twice would give two widgets one id.
+            if drawn.contains(&id) {
+                continue;
+            }
+            let place = drawn.len();
+            drawn.push(id);
+            let selected = open == Some(id);
+            let had_focus = ui.memory(|m| m.has_focus(id));
+            let response = ui
+                .add_enabled_ui(item.enabled, |ui| {
+                    let (rect, _) = ui.allocate_exact_size(vec2(self.button, self.button), Sense::hover());
+                    let response = ui.interact(rect, id, Sense::click());
+                    response.widget_info(|| WidgetInfo::selected(Role::Button, ui.is_enabled(), selected, &item.label));
+                    if item.marker
+                        && !selected
+                        && let Some(label) = &item.marker_label
+                    {
+                        ui.ctx().accesskit_node_builder(id, |node| node.set_description(label.as_str()));
+                    }
+                    self.paint(ui, &response, item, selected, style);
+                    response
+                })
+                .inner;
+            let response = if item.enabled { response.on_hover_text(&item.label) } else { response.on_disabled_hover_text(&item.label) };
+            if !item.enabled {
+                if had_focus {
+                    lost_focus = Some(place);
+                }
+                continue;
+            }
+            if response.gained_focus() {
+                response.scroll_to_me(None);
+            }
+            if response.has_focus() {
+                focus_index = Some(enabled.len());
+                focused = Some(item.pane.clone());
+            }
+            enabled.push((place, id, &item.pane));
+            if response.clicked() {
+                request = Some(if selected { RailRequest::Close(item.pane.clone()) } else { RailRequest::Open(item.pane.clone()) });
+            }
+        }
+        if let Some(place) = lost_focus
+            && focus_index.is_none()
+        {
+            // Focus moves to the nearest enabled item below, else above, else leaves the rail.
+            let next = enabled.iter().find(|(p, ..)| *p > place).or_else(|| enabled.iter().rev().find(|(p, ..)| *p < place));
+            if let Some(&(_, next, pane)) = next {
+                ui.memory_mut(|m| m.request_focus(next));
+                focused = Some(pane.clone());
+            }
+        }
+        if let Some(index) = focus_index
+            && let Some(&(_, id, _)) = enabled.get(index)
+        {
+            // Up and Down move between the items, never out of the rail by egui's geometric focus.
+            ui.memory_mut(|m| m.set_focus_lock_filter(id, EventFilter { vertical_arrows: true, ..Default::default() }));
+            let next = ui.input_mut(|input| {
+                if input.consume_key(Modifiers::NONE, Key::ArrowDown) {
+                    Some(index.checked_add(1))
+                } else if input.consume_key(Modifiers::NONE, Key::ArrowUp) {
+                    Some(index.checked_sub(1))
+                } else {
+                    None
+                }
+            });
+            if let Some(&(_, next, _)) = next.flatten().and_then(|i| enabled.get(i)) {
+                ui.memory_mut(|m| m.request_focus(next));
+            }
+        }
+        (request, focused)
+    }
+
+    fn paint<P>(&self, ui: &Ui, response: &Response, item: &RailItem<P>, selected: bool, style: &ChromeStyle) {
+        let rect = response.rect;
+        if !rect.is_positive() {
+            return;
+        }
+        let painter = ui.painter();
+        let hovered = response.hovered() && ui.is_enabled();
+        if selected || hovered {
+            painter.rect_filled(rect.shrink(1.0), 4.0, style.active_background);
+        }
+        if response.has_focus() {
+            painter.rect_stroke(rect.shrink(1.0), 4.0, Stroke::new(1.0, style.accent), StrokeKind::Inside);
+        }
+        let tint = if selected || hovered { style.text } else { style.weak_text };
+        let icon = rect.shrink(ICON_INSET);
+        if icon.is_positive() {
+            egui::Image::new(item.icon.clone()).tint(tint).paint_at(ui, icon);
+        }
+        if item.marker && !selected {
+            let corner = if self.rtl { rect.left_top() + vec2(6.0, 6.0) } else { rect.right_top() + vec2(-6.0, 6.0) };
+            painter.circle_filled(corner, MARKER_RADIUS, style.accent);
+        }
+    }
+}
diff --git a/crates/ui/src/panes/rail_tests.rs b/crates/ui/src/panes/rail_tests.rs
new file mode 100644
index 00000000..2fa6ce77
--- /dev/null
+++ b/crates/ui/src/panes/rail_tests.rs
@@ -0,0 +1,412 @@
+//! Behavior tests for the icon rail, driven by egui pointer and key events. The harness's root ui
+//! has an 8 pt margin, so in an 800 pt wide window the rail and panes span x 8..792.
+
+use egui::accesskit::{Role, Toggled};
+use egui::load::Bytes;
+use egui::{Event, ImageSource, Key, Modifiers, PointerButton, Pos2, Rect, Ui, vec2};
+use egui_kittest::{Harness, kittest::NodeT, kittest::Queryable};
+
+use super::*;
+
+const L: f32 = 8.0;
+const R: f32 = 792.0;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+enum Tool {
+    Comments,
+    Bookmarks,
+    Pages,
+    Layers,
+    Files,
+    Tags,
+}
+
+const TOOLS: [Tool; 6] = [Tool::Comments, Tool::Bookmarks, Tool::Pages, Tool::Layers, Tool::Files, Tool::Tags];
+
+/// A tiny valid icon for the rail's images. The tests install the SVG loader below; without a
+/// loadable image, egui paints its failed-image placeholder ("⚠️"), which the harness's missing
+/// glyph policy rejects.
+const ICON_SVG: &[u8] = br##"<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24"
+    viewBox="0 0 24 24"><rect width="24" height="24" fill="#000"/></svg>"##;
+
+fn items() -> Vec<RailItem<Tool>> {
+    TOOLS
+        .iter()
+        .map(|t| {
+            let icon = ImageSource::Bytes { uri: format!("bytes://rail-test/{t:?}.svg").into(), bytes: Bytes::Static(ICON_SVG) };
+            RailItem::new(*t, icon, format!("{t:?}"))
+        })
+        .collect()
+}
+
+/// The one-slot task pane the rail opens, at the rail's edge.
+struct Content {
+    edge: Edge,
+}
+
+impl PaneContent<Tool> for Content {
+    fn title(&self, pane: &Tool) -> String {
+        format!("{pane:?} pane")
+    }
+    fn body(&mut self, ui: &mut Ui, pane: &Tool) {
+        ui.label(format!("{pane:?} body"));
+    }
+    fn default_state(&self, _: &Tool) -> PaneState {
+        PaneState::docked(self.edge, 250.0)
+    }
+    fn movable(&self, _: &Tool) -> bool {
+        false
+    }
+}
+
+/// The app side: which pane is open, and every request the rail sent.
+struct App {
+    items: Vec<RailItem<Tool>>,
+    open: Option<Tool>,
+    log: Vec<RailRequest<Tool>>,
+    edge: Edge,
+    rtl: bool,
+    /// Show the open pane with a `PaneHost` after the rail.
+    pane: bool,
+    foot: bool,
+    out: Option<RailOutput<Tool>>,
+    /// `PaneOutput::focused` of the pane host.
+    pane_focused: Option<Tool>,
+    document: Rect,
+}
+
+impl App {
+    fn new() -> Self {
+        Self {
+            items: items(),
+            open: None,
+            log: Vec::new(),
+            edge: Edge::End,
+            rtl: false,
+            pane: false,
+            foot: false,
+            out: None,
+            pane_focused: None,
+            document: Rect::NOTHING,
+        }
+    }
+
+    fn frame(&mut self, ui: &mut Ui) {
+        let foot = self.foot;
+        let out = Rail::new(Id::unique("rail")).edge(self.edge).rtl(self.rtl).show(ui, &self.items, self.open.as_ref(), |ui| {
+            if foot {
+                let _ = ui.button("Foot");
+            }
+        });
+        if self.pane {
+            let open: Vec<Tool> = self.open.into_iter().collect();
+            let panes = PaneHost::new(Id::unique("panes")).rtl(self.rtl).policy(SidePolicy::OneSlot).show(
+                ui,
+                &open,
+                |_| None,
+                &mut Content { edge: self.edge },
+            );
+            self.pane_focused = panes.focused;
+        }
+        self.document = egui::CentralPanel::default().show(ui, |ui| ui.label("Document")).response.rect;
+        match &out.request {
+            Some(RailRequest::Open(p)) => self.open = Some(*p),
+            Some(RailRequest::Close(_)) => self.open = None,
+            None => {}
+        }
+        self.log.extend(out.request.clone());
+        self.out = Some(out);
+    }
+
+    fn out(&self) -> &RailOutput<Tool> {
+        self.out.as_ref().unwrap()
+    }
+}
+
+fn harness(app: App, height: f32) -> Harness<'static, App> {
+    let mut h = Harness::builder()
+        .with_context_setup(egui_extras::install_image_loaders)
+        .with_size(vec2(800.0, height))
+        .build_ui_state(|ui, app: &mut App| app.frame(ui), app);
+    h.input_mut().focused = true;
+    h.run_steps(2);
+    h
+}
+
+fn item(h: &Harness<'_, App>, tool: Tool) -> Rect {
+    h.ctx.read_response(Rail::new(Id::unique("rail")).item_id(&tool)).unwrap().rect
+}
+
+fn click(h: &mut Harness<'_, App>, at: Pos2) {
+    let button = |pressed| Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE };
+    h.input_mut().events.extend([Event::PointerMoved(at), button(true)]);
+    h.run_steps(1);
+    h.input_mut().events.push(button(false));
+    h.run_steps(2);
+}
+
+fn click_item(h: &mut Harness<'_, App>, tool: Tool) {
+    let at = item(h, tool).center();
+    click(h, at);
+}
+
+fn key(h: &mut Harness<'_, App>, key: Key) {
+    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    h.input_mut().events.push(Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE });
+    h.run_steps(2);
+}
+
+fn focused(h: &Harness<'_, App>) -> Option<Tool> {
+    h.state().out().focused
+}
+
+#[test]
+fn a_click_opens_the_open_item_closes_and_another_swaps() {
+    let mut h = harness(App::new(), 600.0);
+    click_item(&mut h, Tool::Comments);
+    assert_eq!(h.state().log, [RailRequest::Open(Tool::Comments)]);
+    assert_eq!(h.state().open, Some(Tool::Comments));
+    click_item(&mut h, Tool::Comments);
+    assert_eq!(h.state().log[1..], [RailRequest::Close(Tool::Comments)]);
+    assert_eq!(h.state().open, None);
+    click_item(&mut h, Tool::Comments);
+    click_item(&mut h, Tool::Pages);
+    assert_eq!(h.state().log[2..], [RailRequest::Open(Tool::Comments), RailRequest::Open(Tool::Pages)]);
+    assert_eq!(h.state().open, Some(Tool::Pages));
+}
+
+#[test]
+fn a_disabled_item_sends_nothing_and_the_marker_shows_only_while_closed() {
+    let mut app = App::new();
+    app.items[1].enabled = false;
+    app.items[0].marker = true;
+    app.items[0].marker_label = Some("Has comments".into());
+    app.items[3] = app.items[3].clone().marker(true).marker_label("Has layers");
+    app.open = Some(Tool::Comments);
+    let mut h = harness(app, 600.0);
+    click_item(&mut h, Tool::Bookmarks);
+    assert!(h.state().log.is_empty());
+    assert_eq!(h.state().open, Some(Tool::Comments));
+
+    let markers = |h: &Harness<'_, App>| -> Vec<Pos2> {
+        h.output()
+            .shapes
+            .iter()
+            .filter_map(|s| match &s.shape {
+                egui::Shape::Circle(circle) if circle.radius == 3.0 => Some(circle.center),
+                _ => None,
+            })
+            .collect()
+    };
+    let shown = markers(&h);
+    assert_eq!(shown.len(), 1, "{shown:?}");
+    assert!(item(&h, Tool::Layers).contains(shown[0]));
+    assert!(shown[0].x > item(&h, Tool::Layers).center().x, "the marker sits at the top-right corner");
+    let description = |h: &Harness<'_, App>, label: &str| h.get_by_label(label).accesskit_node().description();
+    assert_eq!(description(&h, "Layers").as_deref(), Some("Has layers"));
+    // egui 0.37 uses tooltip text as the default accessible description.
+    assert_eq!(description(&h, "Comments").as_deref(), Some("Comments"), "no marker description while the pane is open");
+
+    // Closed, Comments shows its marker too.
+    click_item(&mut h, Tool::Comments);
+    assert_eq!(h.state().open, None);
+    let shown = markers(&h);
+    assert_eq!(shown.len(), 2, "{shown:?}");
+    assert!(shown.iter().any(|p| item(&h, Tool::Comments).contains(*p)));
+    h.run_steps(1);
+    // Hovering Comments shows a tooltip with its label; move away before reading by label.
+    h.input_mut().events.push(Event::PointerMoved(Pos2::new(400.0, 300.0)));
+    h.run_steps(2);
+    assert_eq!(description(&h, "Comments").as_deref(), Some("Has comments"));
+
+    let mut app = App::new();
+    app.rtl = true;
+    app.items[3].marker = true;
+    let h = harness(app, 600.0);
+    let shown = markers(&h);
+    assert_eq!(shown.len(), 1, "{shown:?}");
+    assert!(shown[0].x < item(&h, Tool::Layers).center().x, "right-to-left: the marker sits at the top-left corner");
+}
+
+#[test]
+fn the_rail_is_outermost_and_the_open_pane_sits_between_it_and_the_document() {
+    for (edge, rtl, left) in [(Edge::End, false, false), (Edge::End, true, true), (Edge::Start, false, true), (Edge::Start, true, false)] {
+        let mut app = App::new();
+        app.edge = edge;
+        app.rtl = rtl;
+        app.pane = true;
+        app.open = Some(Tool::Comments);
+        let h = harness(app, 600.0);
+        let rail = h.state().out().rect;
+        let pane_id = Id::unique("panes").with(("pane", &Tool::Comments));
+        // The resize handle lies on the pane's inner edge; the pane is 250 wide.
+        let inner = h.ctx.read_response(pane_id.with("resize")).unwrap().rect.center().x;
+        let pane = if left {
+            Rect::from_x_y_ranges(inner - 250.0..=inner, rail.y_range())
+        } else {
+            Rect::from_x_y_ranges(inner..=inner + 250.0, rail.y_range())
+        };
+        let title = h.ctx.read_response(pane_id.with("title")).unwrap().rect;
+        let document = h.state().document;
+        let case = format!("{edge:?} rtl {rtl}: rail {rail:?}, pane {pane:?}, title {title:?}, document {document:?}");
+        assert_eq!(rail.width(), RAIL_WIDTH, "{case}");
+        assert!(pane.x_range().contains(title.left()) && pane.x_range().contains(title.right()), "{case}");
+        if left {
+            assert_eq!(rail.left(), L, "{case}");
+            assert_eq!(pane.left(), rail.right(), "{case}");
+            assert!(document.left() >= pane.right(), "{case}");
+        } else {
+            assert_eq!(rail.right(), R, "{case}");
+            assert_eq!(pane.right(), rail.left(), "{case}");
+            assert!(document.right() <= pane.left(), "{case}");
+        }
+        assert!(rail.x_range().contains(item(&h, Tool::Comments).center().x), "{case}");
+    }
+}
+
+#[test]
+fn in_a_short_window_the_items_scroll_and_the_foot_stays_visible() {
+    let mut app = App::new();
+    app.foot = true;
+    let mut h = harness(app, 200.0);
+    let foot = h.get_by_label("Foot").rect();
+    assert!(foot.bottom() <= 192.0, "{foot:?}");
+    assert!(item(&h, Tool::Comments).top() < 30.0);
+    assert!(item(&h, Tool::Tags).bottom() > foot.top(), "the last item starts out of view");
+
+    let over = item(&h, Tool::Comments).center();
+    h.input_mut().events.extend([
+        Event::PointerMoved(over),
+        Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Point,
+            delta: vec2(0.0, -500.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: Modifiers::NONE,
+        },
+    ]);
+    h.run_steps(3);
+    let tags = item(&h, Tool::Tags);
+    assert!(tags.bottom() <= h.get_by_label("Foot").rect().top(), "{tags:?} above the foot after scrolling");
+    assert_eq!(h.get_by_label("Foot").rect(), foot);
+}
+
+#[test]
+fn items_are_named_toggle_buttons_and_the_keyboard_moves_between_and_activates_them() {
+    let mut app = App::new();
+    app.items[1].enabled = false;
+    app.open = Some(Tool::Comments);
+    let mut h = harness(app, 600.0);
+    let comments = h.get_by_label("Comments").accesskit_node();
+    assert_eq!(comments.role(), Role::Button);
+    assert_eq!(comments.toggled(), Some(Toggled::True));
+    assert!(!comments.is_disabled());
+    let pages = h.get_by_label("Pages").accesskit_node();
+    assert_eq!(pages.role(), Role::Button);
+    assert_eq!(pages.toggled(), Some(Toggled::False));
+    assert!(h.get_by_label("Bookmarks").accesskit_node().is_disabled());
+
+    h.ctx.memory_mut(|m| m.request_focus(Rail::new(Id::unique("rail")).item_id(&Tool::Comments)));
+    h.run_steps(2);
+    assert_eq!(focused(&h), Some(Tool::Comments));
+    key(&mut h, Key::ArrowUp);
+    assert_eq!(focused(&h), Some(Tool::Comments), "Up on the first item stays");
+    key(&mut h, Key::ArrowDown);
+    assert_eq!(focused(&h), Some(Tool::Pages), "Down skips the disabled item");
+    key(&mut h, Key::Enter);
+    assert_eq!(h.state().log, [RailRequest::Open(Tool::Pages)]);
+    key(&mut h, Key::Space);
+    assert_eq!(h.state().log[1..], [RailRequest::Close(Tool::Pages)]);
+    key(&mut h, Key::ArrowUp);
+    assert_eq!(focused(&h), Some(Tool::Comments));
+    for _ in 0..TOOLS.len() {
+        key(&mut h, Key::ArrowDown);
+    }
+    assert_eq!(focused(&h), Some(Tool::Tags), "Down on the last item stays");
+}
+
+#[test]
+fn an_empty_rail_draws_and_bad_sizes_fall_back() {
+    let mut app = App::new();
+    app.items.clear();
+    let h = harness(app, 600.0);
+    let rail = h.state().out().rect;
+    assert_eq!((rail.right(), rail.width()), (R, RAIL_WIDTH));
+    assert_eq!(h.state().out().request, None);
+
+    let mut h = Harness::builder().with_context_setup(egui_extras::install_image_loaders).with_size(vec2(400.0, 300.0)).build_ui(|ui| {
+        let out = Rail::new(Id::unique("bad")).width(f32::NAN).button_size(f32::INFINITY).show(ui, &items(), None, |_| {});
+        assert_eq!(out.rect.width(), RAIL_WIDTH);
+    });
+    h.run_steps(2);
+}
+
+#[test]
+fn a_disabled_item_takes_no_tab_focus_and_a_focused_item_disabled_hands_focus_on() {
+    let mut app = App::new();
+    app.items[1].enabled = false;
+    let mut h = harness(app, 600.0);
+    let focused_id = |h: &Harness<'_, App>| h.ctx.memory(|m| m.focused());
+    let id = |tool: Tool| Rail::new(Id::unique("rail")).item_id(&tool);
+    h.ctx.memory_mut(|m| m.request_focus(id(Tool::Comments)));
+    h.run_steps(2);
+    key(&mut h, Key::Tab);
+    assert_eq!(focused_id(&h), Some(id(Tool::Pages)), "Tab skips the disabled item");
+
+    // Pages is disabled while focused: focus goes to the next enabled item.
+    h.state_mut().items[2].enabled = false;
+    h.run_steps(2);
+    assert_eq!(focused_id(&h), Some(id(Tool::Layers)));
+    assert_eq!(focused(&h), Some(Tool::Layers));
+
+    // The last item disabled while focused: focus goes to the enabled one above.
+    h.ctx.memory_mut(|m| m.request_focus(id(Tool::Tags)));
+    h.run_steps(2);
+    h.state_mut().items[5].enabled = false;
+    h.run_steps(2);
+    assert_eq!(focused_id(&h), Some(id(Tool::Files)));
+
+    // Nothing left enabled: focus leaves the rail.
+    for item in &mut h.state_mut().items {
+        item.enabled = false;
+    }
+    h.run_steps(2);
+    assert_eq!((focused_id(&h), focused(&h)), (None, None));
+}
+
+#[test]
+fn a_press_on_the_rail_clears_the_pane_hosts_focused_pane() {
+    let mut app = App::new();
+    app.pane = true;
+    app.open = Some(Tool::Comments);
+    let mut h = harness(app, 600.0);
+    let body = h.get_by_label("Comments body").rect().center();
+    click(&mut h, body);
+    assert_eq!(h.state().pane_focused, Some(Tool::Comments));
+    // Below the items: the rail, not a pane.
+    let rail = h.state().out().rect;
+    click(&mut h, Pos2::new(rail.center().x, rail.bottom() - 40.0));
+    assert_eq!(h.state().pane_focused, None);
+    assert!(h.state().log.is_empty());
+    assert_eq!(h.state().open, Some(Tool::Comments));
+}
+
+#[test]
+fn a_bottom_edge_draws_the_rail_at_the_end() {
+    let mut app = App::new();
+    app.edge = Edge::Bottom;
+    let h = harness(app, 600.0);
+    let rail = h.state().out().rect;
+    assert_eq!((rail.right(), rail.height()), (R, 584.0), "{rail:?}");
+}
+
+#[test]
+fn chrome_style_from_visuals_matches_the_dock_style_it_skips() {
+    use crate::docking::{DockStyle, chrome::ChromeStyle};
+    for visuals in [egui::Visuals::light(), egui::Visuals::dark()] {
+        let direct = ChromeStyle::from_visuals(&visuals);
+        let through_dock = ChromeStyle::from_dock(&DockStyle::from_visuals(&visuals));
+        assert_eq!(format!("{direct:?}"), format!("{through_dock:?}"));
+    }
+}
diff --git a/crates/ui/src/panes/tests.rs b/crates/ui/src/panes/tests.rs
new file mode 100644
index 00000000..de50d853
--- /dev/null
+++ b/crates/ui/src/panes/tests.rs
@@ -0,0 +1,690 @@
+//! Behavior tests for the pane host, driven by egui pointer and key events in an 800 × 600
+//! window. The harness's root ui has an 8 pt margin, so the host spans x 8..792, y 8..592.
+
+use std::collections::HashMap;
+
+use egui::{Event, Id, Key, Modifiers, PointerButton, Pos2, Rect, Ui, pos2, vec2};
+use egui_kittest::{Harness, kittest::NodeT, kittest::Queryable};
+
+use super::*;
+
+const L: f32 = 8.0;
+const R: f32 = 792.0;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+enum Pane {
+    Nav,
+    Styles,
+    Comments,
+    /// A context pane, like PivotTable Fields: not closable, not movable.
+    Pivot,
+}
+
+struct Content;
+
+impl PaneContent<Pane> for Content {
+    fn title(&self, pane: &Pane) -> String {
+        format!("{pane:?}")
+    }
+    fn body(&mut self, ui: &mut Ui, pane: &Pane) {
+        ui.label(format!("{pane:?} body"));
+    }
+    /// Default docked pane state: end for Comments and Pivot, start otherwise,
+    /// with a 250 pt size.
+    fn default_state(&self, pane: &Pane) -> PaneState {
+        let edge = if matches!(pane, Pane::Comments | Pane::Pivot) { Edge::End } else { Edge::Start };
+        PaneState::docked(edge, 250.0)
+    }
+    fn movable(&self, pane: &Pane) -> bool {
+        *pane != Pane::Pivot
+    }
+    fn closable(&self, pane: &Pane) -> bool {
+        *pane != Pane::Pivot
+    }
+}
+
+/// [`Content`] with the title bar on or off.
+struct Titled(bool);
+
+impl PaneContent<Pane> for Titled {
+    fn title(&self, pane: &Pane) -> String {
+        Content.title(pane)
+    }
+    fn body(&mut self, ui: &mut Ui, pane: &Pane) {
+        Content.body(ui, pane);
+    }
+    fn default_state(&self, pane: &Pane) -> PaneState {
+        Content.default_state(pane)
+    }
+    fn movable(&self, pane: &Pane) -> bool {
+        Content.movable(pane)
+    }
+    fn closable(&self, pane: &Pane) -> bool {
+        Content.closable(pane)
+    }
+    fn title_bar(&self, _: &Pane) -> bool {
+        self.0
+    }
+}
+
+/// The app side: open list, persisted states and every request it received.
+struct App {
+    open: Vec<Pane>,
+    states: HashMap<Pane, PaneState>,
+    log: Vec<PaneRequest<Pane>>,
+    focused: Option<Pane>,
+    to_document: usize,
+    rtl: bool,
+    policy: SidePolicy,
+    title_bar: bool,
+    /// The document is one drag-sensing widget, like a canvas.
+    drag_document: bool,
+    document_drags: usize,
+}
+
+impl App {
+    /// Create an app with `open` panes, empty state and log, no focused pane, no
+    /// document-focus requests, left-to-right layout and column side policy.
+    fn new(open: &[Pane]) -> Self {
+        Self {
+            open: open.to_vec(),
+            states: HashMap::new(),
+            log: Vec::new(),
+            focused: None,
+            to_document: 0,
+            rtl: false,
+            policy: SidePolicy::Columns,
+            title_bar: true,
+            drag_document: false,
+            document_drags: 0,
+        }
+    }
+
+    /// Render `PaneHost` with the app's open panes, policy and RTL flag, then a central document
+    /// panel. Applies pane requests to stored state and records requests, focused pane and
+    /// document-focus transitions.
+    fn frame(&mut self, ui: &mut Ui) {
+        let states = self.states.clone();
+        let out = PaneHost::new(Id::unique("panes")).rtl(self.rtl).policy(self.policy).show(
+            ui,
+            &self.open,
+            |p| states.get(p).copied(),
+            &mut Titled(self.title_bar),
+        );
+        let drag_document = self.drag_document;
+        // A canvas fills the panel, without the default frame's margin.
+        let panel = if drag_document { egui::CentralPanel::default().frame(Frame::NONE) } else { egui::CentralPanel::default() };
+        let dragged = panel
+            .show(ui, |ui| {
+                if drag_document {
+                    ui.interact(ui.max_rect(), Id::unique("document-drag"), Sense::click_and_drag()).dragged()
+                } else {
+                    ui.label("Document").dragged()
+                }
+            })
+            .inner;
+        self.document_drags += usize::from(dragged);
+        for request in &out.requests {
+            match request {
+                PaneRequest::Close(p) => self.open.retain(|o| o != p),
+                PaneRequest::Focus(_) => {}
+                PaneRequest::Before(p, before) => {
+                    self.open.retain(|o| o != p);
+                    let at = before.and_then(|b| self.open.iter().position(|o| *o == b)).unwrap_or(self.open.len());
+                    self.open.insert(at, *p);
+                }
+                other => {
+                    let pane = *other.pane();
+                    let state = self.states.entry(pane).or_insert_with(|| Content.default_state(&pane));
+                    state.apply(other);
+                }
+            }
+        }
+        self.log.extend(out.requests);
+        self.focused = out.focused;
+        self.to_document += usize::from(out.to_document);
+    }
+
+    fn place(&self, pane: Pane) -> Place {
+        self.states.get(&pane).map_or_else(|| Content.default_state(&pane).place, |s| s.place)
+    }
+}
+
+/// Build an 800×600 harness around `App::frame`, mark input focused, and run
+/// two frames before returning it.
+fn harness(app: App) -> Harness<'static, App> {
+    let mut h = Harness::builder().with_size(vec2(800.0, 600.0)).build_ui_state(|ui, app: &mut App| app.frame(ui), app);
+    h.input_mut().focused = true;
+    h.run_steps(2);
+    h
+}
+
+/// The stable response id for `pane` under the `panes` host scope.
+fn pane_id(pane: Pane) -> Id {
+    Id::unique("panes").with(("pane", &pane))
+}
+
+fn rect(h: &Harness<'_, App>, id: Id) -> Option<Rect> {
+    h.ctx.read_response(id).map(|r| r.rect)
+}
+
+fn title(h: &Harness<'_, App>, pane: Pane) -> Rect {
+    rect(h, pane_id(pane).with("title")).unwrap()
+}
+
+/// The x of a side pane's inner edge.
+fn edge(h: &Harness<'_, App>, pane: Pane) -> f32 {
+    rect(h, pane_id(pane).with("resize")).unwrap().center().x
+}
+
+fn button(pos: Pos2, pressed: bool) -> Event {
+    Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE }
+}
+
+fn send(h: &mut Harness<'_, App>, events: Vec<Event>) {
+    h.input_mut().events.extend(events);
+    h.run_steps(1);
+}
+
+fn click(h: &mut Harness<'_, App>, at: Pos2) {
+    send(h, vec![Event::PointerMoved(at), button(at, true)]);
+    send(h, vec![button(at, false)]);
+    h.run_steps(1);
+}
+
+fn hold(h: &mut Harness<'_, App>, from: Pos2, to: Pos2) {
+    send(h, vec![Event::PointerMoved(from), button(from, true)]);
+    send(h, vec![Event::PointerMoved(from + vec2(8.0, 6.0))]);
+    send(h, vec![Event::PointerMoved(to)]);
+}
+
+fn drag(h: &mut Harness<'_, App>, from: Pos2, to: Pos2) {
+    hold(h, from, to);
+    send(h, vec![button(to, false)]);
+    h.run_steps(2);
+}
+
+/// The rect a docked pane's panel takes. egui 0.37 keys a panel's persisted `PanelState` by the
+/// scope of the `Ui` it is shown in and the panel's id salt, not by the id alone.
+fn panel(h: &Harness<'_, App>, pane: Pane) -> Rect {
+    egui::containers::panel::PanelState::load(&h.ctx, h.ui_id().with(pane_id(pane).with("panel"))).unwrap().outer_rect
+}
+
+/// The drop previews painted in the last frame: 2 pt accent outlines with a 15% accent fill.
+fn previews(h: &Harness<'_, App>) -> Vec<Rect> {
+    h.output()
+        .shapes
+        .iter()
+        .filter_map(|clipped| match &clipped.shape {
+            egui::Shape::Rect(shape) if shape.stroke.width == 2.0 && shape.fill == shape.stroke.color.gamma_multiply(0.15) => {
+                Some(shape.rect.expand(1.0))
+            }
+            _ => None,
+        })
+        .collect()
+}
+
+fn key(h: &mut Harness<'_, App>, key: Key, modifiers: Modifiers) {
+    send(h, vec![Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers }]);
+    h.run_steps(1);
+}
+
+/// The requests that change a pane's state or open list.
+fn changes(app: &App) -> Vec<PaneRequest<Pane>> {
+    app.log.iter().filter(|r| !matches!(r, PaneRequest::Focus(_))).cloned().collect()
+}
+
+fn last_resize(app: &App, pane: Pane) -> Option<f32> {
+    app.log.iter().rev().find_map(|r| match r {
+        PaneRequest::Resize(p, size) if *p == pane => Some(*size),
+        _ => None,
+    })
+}
+
+#[test]
+fn a_docked_pane_without_a_title_bar_fills_the_pane_and_still_resizes() {
+    for title_bar in [true, false] {
+        let mut app = App::new(&[Pane::Nav]);
+        app.title_bar = title_bar;
+        let mut h = harness(app);
+        let chrome = [
+            rect(&h, pane_id(Pane::Nav).with("title")).is_some(),
+            h.query_by_label("Move Nav pane").is_some(),
+            h.query_by_label("Pane options").is_some(),
+            h.query_by_label("Close").is_some(),
+        ];
+        assert_eq!(chrome, [title_bar; 4], "title bar {title_bar}: title, its node, ▾ and ×");
+        // The body's first line sits under the body margin, below the title bar when there is one.
+        let body = h.get_by_label("Nav body").rect();
+        let top = if title_bar { L + TITLE_BAR_HEIGHT + 8.0 } else { L + 8.0 };
+        assert!((body.top() - top).abs() < 2.0, "title bar {title_bar}: body {body:?}");
+
+        // Without the bar, the body is the pane's accessible region, named by its title.
+        let regions = h.query_all_by_label("Nav").filter(|n| n.accesskit_node().role() == egui::accesskit::Role::Pane).count();
+        assert_eq!(regions, usize::from(!title_bar), "title bar {title_bar}");
+        assert_eq!(h.get_by_label("Resize pane").accesskit_node().role(), egui::accesskit::Role::Splitter);
+
+        drag(&mut h, pos2(L + 250.0, 300.0), pos2(L + 300.0, 300.0));
+        assert_eq!(last_resize(h.state(), Pane::Nav), Some(300.0), "title bar {title_bar}");
+        assert_eq!(edge(&h, Pane::Nav), L + 300.0);
+    }
+}
+
+#[test]
+fn f6_reaches_a_pane_without_a_title_bar() {
+    let mut app = App::new(&[Pane::Nav, Pane::Comments]);
+    app.title_bar = false;
+    let mut h = harness(app);
+    key(&mut h, Key::F6, Modifiers::NONE);
+    assert_eq!(h.state().focused, Some(Pane::Nav));
+    assert_eq!(h.ctx.memory(|m| m.focused()), Some(pane_id(Pane::Nav).with("body")), "F6 focuses the body");
+    key(&mut h, Key::F6, Modifiers::NONE);
+    assert_eq!(h.state().focused, Some(Pane::Comments));
+    key(&mut h, Key::F6, Modifiers::NONE);
+    assert_eq!((h.state().focused, h.state().to_document), (None, 1));
+}
+
+#[test]
+fn the_resize_edge_works_on_both_sides_of_the_line_over_a_dragging_document() {
+    for offset in [-3.5, 3.5] {
+        let mut app = App::new(&[Pane::Nav]);
+        app.drag_document = true;
+        let mut h = harness(app);
+        // The line is at L + 250; positive offsets lie over the document.
+        drag(&mut h, pos2(L + 250.0 + offset, 300.0), pos2(L + 300.0 + offset, 300.0));
+        // The edge follows the pointer.
+        let size = last_resize(h.state(), Pane::Nav);
+        assert!(size.is_some_and(|size| (size - (300.0 + offset)).abs() <= 1.0), "offset {offset}: {size:?}");
+        assert_eq!(h.state().document_drags, 0, "offset {offset}: the document took the drag");
+    }
+    // A floating pane over the edge keeps its presses: the edge stays under floating windows.
+    let mut app = App::new(&[Pane::Nav, Pane::Styles]);
+    app.states.insert(Pane::Styles, PaneState { place: Place::Floating, size: None, float_rect: Some([L + 150.0, 100.0, 220.0, 300.0]) });
+    let mut h = harness(app);
+    h.run_steps(2);
+    drag(&mut h, pos2(L + 250.0, 300.0), pos2(L + 300.0, 300.0));
+    assert_eq!(last_resize(h.state(), Pane::Nav), None, "the edge under a floating pane took the drag");
+
+    // Away from the edge, the document still drags.
+    let mut app = App::new(&[Pane::Nav]);
+    app.drag_document = true;
+    let mut h = harness(app);
+    drag(&mut h, pos2(L + 400.0, 300.0), pos2(L + 450.0, 300.0));
+    assert!(h.state().document_drags > 0);
+    assert_eq!(last_resize(h.state(), Pane::Nav), None);
+}
+
+#[test]
+fn columns_sit_side_by_side_resize_and_move_to_end() {
+    let mut h = harness(App::new(&[Pane::Nav, Pane::Styles]));
+    assert_eq!(edge(&h, Pane::Nav), L + 250.0);
+    assert_eq!(edge(&h, Pane::Styles), L + 500.0);
+    assert!(title(&h, Pane::Nav).left() < L + 2.0);
+
+    drag(&mut h, pos2(L + 250.0, 300.0), pos2(L + 300.0, 300.0));
+    assert_eq!(last_resize(h.state(), Pane::Nav), Some(300.0));
+    assert_eq!(edge(&h, Pane::Nav), L + 300.0);
+    assert_eq!(edge(&h, Pane::Styles), L + 550.0, "the second column follows");
+
+    let at = rect(&h, pane_id(Pane::Nav).with("title").with("menu")).unwrap().center();
+    click(&mut h, at);
+    for label in ["Move to Start", "Move to End", "Float", "Close"] {
+        assert!(h.query_all_by_label(label).count() >= 1, "{label}");
+    }
+    h.get_by_label("Move to End").click();
+    h.run_steps(3);
+    assert!(h.state().log.contains(&PaneRequest::Place(Pane::Nav, Place::Docked(Edge::End))));
+    assert_eq!(edge(&h, Pane::Nav), R - 300.0, "a 300 pt pane at the right edge");
+    assert_eq!(edge(&h, Pane::Styles), L + 250.0);
+}
+
+#[test]
+fn a_bottom_pane_dragged_to_a_side_previews_the_width_it_docks_at() {
+    let mut app = App::new(&[Pane::Comments]);
+    app.states.insert(Pane::Comments, PaneState::docked(Edge::Bottom, 300.0));
+    let mut h = harness(app);
+    let from = title(&h, Pane::Comments).center();
+    let to = pos2(L + 10.0, 200.0);
+    hold(&mut h, from, to);
+    let previewed = h.output().shapes.iter().any(|clipped| match &clipped.shape {
+        egui::Shape::Rect(shape) => shape.rect.left() == L + 1.0 && shape.rect.width() == 298.0,
+        _ => false,
+    });
+    assert!(previewed, "a 300 pt side pane");
+    send(&mut h, vec![button(to, false)]);
+    h.run_steps(2);
+    assert_eq!(h.state().place(Pane::Comments), Place::Docked(Edge::Start));
+    assert_eq!(edge(&h, Pane::Comments), L + 300.0);
+}
+
+#[test]
+fn title_dragged_out_floats_and_a_drop_near_an_edge_docks() {
+    // Drag-out-to-float and the 32 pt edge snap follow wordcraft#2584.
+    let mut h = harness(App::new(&[Pane::Styles]));
+    let from = title(&h, Pane::Styles).center();
+    // Within DOCK_SNAP of the pane: nothing happens.
+    drag(&mut h, from, pos2(L + 270.0, 300.0));
+    assert!(changes(h.state()).is_empty(), "{:?}", h.state().log);
+
+    drag(&mut h, from, pos2(400.0, 300.0));
+    assert_eq!(
+        changes(h.state()),
+        vec![PaneRequest::Place(Pane::Styles, Place::Floating), PaneRequest::FloatRect(Pane::Styles, [360.0, 112.0, 270.0, 480.0])],
+        "floats under the pointer, clamped to the window"
+    );
+    assert_eq!(title(&h, Pane::Styles).min, pos2(360.0, 116.0));
+
+    // Dropped within 32 pt of the right edge: docked at End.
+    h.state_mut().log.clear();
+    let from = title(&h, Pane::Styles).center();
+    drag(&mut h, from, pos2(780.0, 300.0));
+    assert_eq!(h.state().log.last(), Some(&PaneRequest::Place(Pane::Styles, Place::Docked(Edge::End))));
+    assert_eq!(edge(&h, Pane::Styles), R - 250.0);
+    // The floating rect's size is kept for the next float.
+    assert_eq!(h.state().states[&Pane::Styles].float_rect.map(|r| [r[2], r[3]]), Some([270.0, 480.0]));
+}
+
+#[test]
+fn a_floating_pane_near_a_side_edge_previews_the_column_it_docks_in() {
+    let mut app = App::new(&[Pane::Nav, Pane::Styles]);
+    app.states.insert(Pane::Styles, PaneState { place: Place::Floating, size: Some(300.0), float_rect: Some([300.0, 100.0, 270.0, 400.0]) });
+    let mut h = harness(app);
+    let from = title(&h, Pane::Styles).center();
+    hold(&mut h, from, pos2(400.0, 300.0));
+    assert!(previews(&h).is_empty(), "away from the edges");
+    let to = pos2(L + 10.0, 300.0);
+    send(&mut h, vec![Event::PointerMoved(to)]);
+    let landing = Rect::from_x_y_ranges(L..=L + 300.0, 8.0..=592.0);
+    assert_eq!(previews(&h), vec![landing], "outside Nav, 300 pt wide");
+    send(&mut h, vec![button(to, false)]);
+    h.run_steps(2);
+    assert_eq!(h.state().place(Pane::Styles), Place::Docked(Edge::Start));
+    assert_eq!(panel(&h, Pane::Styles), landing);
+    assert_eq!(edge(&h, Pane::Nav), L + 550.0);
+}
+
+#[test]
+fn a_docked_pane_dragged_across_previews_the_column_it_lands_in() {
+    let mut h = harness(App::new(&[Pane::Nav, Pane::Comments]));
+    let from = title(&h, Pane::Comments).center();
+    let to = pos2(L + 10.0, 300.0);
+    hold(&mut h, from, to);
+    let landing = Rect::from_x_y_ranges(L..=L + 250.0, 8.0..=592.0);
+    assert_eq!(previews(&h), vec![landing], "the window edge docks outermost");
+    send(&mut h, vec![button(to, false)]);
+    h.run_steps(2);
+    assert_eq!(
+        changes(h.state()),
+        vec![PaneRequest::Place(Pane::Comments, Place::Docked(Edge::Start)), PaneRequest::Before(Pane::Comments, Some(Pane::Nav))]
+    );
+    assert_eq!(panel(&h, Pane::Comments), landing);
+    assert_eq!(panel(&h, Pane::Nav), Rect::from_x_y_ranges(L + 250.0..=L + 500.0, 8.0..=592.0));
+
+    // Right to left: Start is the right edge.
+    let mut app = App::new(&[Pane::Nav, Pane::Comments]);
+    app.rtl = true;
+    let mut h = harness(app);
+    let from = title(&h, Pane::Comments).center();
+    let to = pos2(R - 10.0, 300.0);
+    hold(&mut h, from, to);
+    let landing = Rect::from_x_y_ranges(R - 250.0..=R, 8.0..=592.0);
+    assert_eq!(previews(&h), vec![landing]);
+    send(&mut h, vec![button(to, false)]);
+    h.run_steps(2);
+    assert_eq!(panel(&h, Pane::Comments), landing);
+    assert_eq!(panel(&h, Pane::Nav), Rect::from_x_y_ranges(R - 500.0..=R - 250.0, 8.0..=592.0));
+}
+
+#[test]
+fn a_pane_dropped_over_a_docked_panes_outer_or_inner_third_docks_beside_it_there() {
+    let full = |x: std::ops::RangeInclusive<f32>| Rect::from_x_y_ranges(x, 8.0..=592.0);
+    // Drags Comments' title to `to`, checks the preview, drops it and returns the harness.
+    let drop = |app: App, to: Pos2, preview: Option<Rect>| {
+        let mut h = harness(app);
+        let from = title(&h, Pane::Comments).center();
+        hold(&mut h, from, to);
+        let previewed = previews(&h);
+        match preview {
+            Some(rect) => assert_eq!(previewed, vec![rect], "at {to:?}"),
+            None => assert!(previewed.len() == 1 && previewed[0].height() == FLOAT_DEFAULT.y, "a float preview at {to:?}: {previewed:?}"),
+        }
+        send(&mut h, vec![button(to, false)]);
+        h.run_steps(2);
+        h
+    };
+
+    // Over Nav's outer third, beyond the window-edge strip: outside Nav.
+    let h = drop(App::new(&[Pane::Nav, Pane::Comments]), pos2(L + 40.0, 300.0), Some(full(L..=L + 250.0)));
+    assert_eq!(
+        changes(h.state()),
+        vec![PaneRequest::Place(Pane::Comments, Place::Docked(Edge::Start)), PaneRequest::Before(Pane::Comments, Some(Pane::Nav))]
+    );
+    assert_eq!((panel(&h, Pane::Comments), panel(&h, Pane::Nav)), (full(L..=L + 250.0), full(L + 250.0..=L + 500.0)));
+
+    // Over its inner third: inside Nav, innermost.
+    let h = drop(App::new(&[Pane::Comments, Pane::Nav]), pos2(L + 220.0, 300.0), Some(full(L + 250.0..=L + 500.0)));
+    assert_eq!(changes(h.state()), vec![PaneRequest::Place(Pane::Comments, Place::Docked(Edge::Start)), PaneRequest::Before(Pane::Comments, None)]);
+    assert_eq!(panel(&h, Pane::Comments), full(L + 250.0..=L + 500.0));
+
+    // Over its middle third: no dock target, so it floats.
+    let h = drop(App::new(&[Pane::Nav, Pane::Comments]), pos2(L + 125.0, 300.0), None);
+    assert_eq!(h.state().place(Pane::Comments), Place::Floating);
+
+    // Right to left: Nav is at the right edge, and its outer third is on its right.
+    let mut app = App::new(&[Pane::Nav, Pane::Comments]);
+    app.rtl = true;
+    let h = drop(app, pos2(R - 40.0, 300.0), Some(full(R - 250.0..=R)));
+    assert_eq!((panel(&h, Pane::Comments), panel(&h, Pane::Nav)), (full(R - 250.0..=R), full(R - 500.0..=R - 250.0)));
+
+    // One slot per edge: a pane dropped over the slot's pane takes the slot.
+    let mut app = App::new(&[Pane::Comments, Pane::Nav]);
+    app.policy = SidePolicy::OneSlot;
+    let h = drop(app, pos2(L + 40.0, 300.0), Some(full(L..=L + 250.0)));
+    assert_eq!(h.state().open, vec![Pane::Nav, Pane::Comments]);
+    assert_eq!(panel(&h, Pane::Comments), full(L..=L + 250.0));
+
+    // On the same edge: over the outer third of the pane outside it moves it outermost; over the
+    // inner third of that pane, where it already is, nothing changes.
+    let mut h = harness(App::new(&[Pane::Nav, Pane::Styles]));
+    let from = title(&h, Pane::Styles).center();
+    drag(&mut h, from, pos2(L + 200.0, 300.0));
+    assert!(changes(h.state()).is_empty(), "{:?}", h.state().log);
+    drag(&mut h, from, pos2(L + 40.0, 300.0));
+    assert_eq!(changes(h.state()), vec![PaneRequest::Before(Pane::Styles, Some(Pane::Nav))]);
+    assert_eq!((edge(&h, Pane::Styles), edge(&h, Pane::Nav)), (L + 250.0, L + 500.0));
+
+    // A floating pane: no target over Nav's middle third, beside it over its inner third.
+    let mut app = App::new(&[Pane::Nav, Pane::Styles]);
+    app.states.insert(Pane::Styles, PaneState { place: Place::Floating, size: Some(300.0), float_rect: Some([300.0, 100.0, 270.0, 400.0]) });
+    let mut h = harness(app);
+    let from = title(&h, Pane::Styles).center();
+    hold(&mut h, from, pos2(L + 125.0, 300.0));
+    assert!(previews(&h).is_empty());
+    let to = pos2(L + 220.0, 300.0);
+    send(&mut h, vec![Event::PointerMoved(to)]);
+    assert_eq!(previews(&h), vec![full(L + 250.0..=L + 550.0)]);
+    send(&mut h, vec![button(to, false)]);
+    h.run_steps(2);
+    assert_eq!(h.state().place(Pane::Styles), Place::Docked(Edge::Start));
+    assert_eq!(panel(&h, Pane::Styles), full(L + 250.0..=L + 550.0));
+}
+
+#[test]
+fn one_slot_previews_a_pane_beside_the_context_pane() {
+    let mut app = App::new(&[Pane::Pivot, Pane::Styles]);
+    app.policy = SidePolicy::OneSlot;
+    let mut h = harness(app);
+    let from = title(&h, Pane::Styles).center();
+    let to = pos2(R - 10.0, 300.0);
+    hold(&mut h, from, to);
+    let landing = Rect::from_x_y_ranges(R - 500.0..=R - 250.0, 8.0..=592.0);
+    assert_eq!(previews(&h), vec![landing], "inside the Pivot pane, which comes first in open");
+    send(&mut h, vec![button(to, false)]);
+    h.run_steps(2);
+    assert_eq!(panel(&h, Pane::Styles), landing);
+}
+
+#[test]
+fn one_slot_previews_the_room_a_pane_it_reveals_leaves() {
+    // Nav and Styles share the start slot, so only Styles shows. Moved to the end, it reveals
+    // Nav, which takes 500 of the host's 784 pt.
+    let mut app = App::new(&[Pane::Nav, Pane::Styles]);
+    app.policy = SidePolicy::OneSlot;
+    for pane in [Pane::Nav, Pane::Styles] {
+        app.states.insert(pane, PaneState::docked(Edge::Start, 500.0));
+    }
+    let mut h = harness(app);
+    let from = title(&h, Pane::Styles).center();
+    let to = pos2(R - 10.0, 300.0);
+    hold(&mut h, from, to);
+    let landing = Rect::from_x_y_ranges(L + 500.0..=R, 8.0..=592.0);
+    assert_eq!(previews(&h), vec![landing]);
+    send(&mut h, vec![button(to, false)]);
+    h.run_steps(2);
+    assert_eq!(panel(&h, Pane::Styles), landing);
+}
+
+#[test]
+fn escape_and_focus_loss_restore_a_floating_pane_during_a_move() {
+    let mut app = App::new(&[Pane::Styles]);
+    let start = [300.0, 100.0, 270.0, 400.0];
+    app.states.insert(Pane::Styles, PaneState { place: Place::Floating, size: None, float_rect: Some(start) });
+    let mut h = harness(app);
+    let from = title(&h, Pane::Styles).center();
+    let float_rect = |h: &Harness<'_, App>| h.state().states[&Pane::Styles].float_rect;
+
+    hold(&mut h, from, from + vec2(40.0, 30.0));
+    assert_eq!(float_rect(&h), Some([340.0, 130.0, 270.0, 400.0]), "follows the pointer");
+    key(&mut h, Key::Escape, Modifiers::NONE);
+    assert_eq!(float_rect(&h), Some(start));
+    send(&mut h, vec![Event::PointerMoved(pos2(790.0, 300.0))]);
+    send(&mut h, vec![button(pos2(790.0, 300.0), false)]);
+    h.run_steps(1);
+    assert_eq!(h.state().place(Pane::Styles), Place::Floating, "the rest of the drag is ignored");
+    assert_eq!(float_rect(&h), Some(start));
+
+    hold(&mut h, from, from + vec2(-60.0, 20.0));
+    assert_eq!(float_rect(&h), Some([240.0, 120.0, 270.0, 400.0]));
+    h.input_mut().focused = false;
+    h.run_steps(1);
+    h.input_mut().focused = true;
+    send(&mut h, vec![button(from + vec2(-60.0, 20.0), false)]);
+    assert_eq!(float_rect(&h), Some(start));
+}
+
+#[test]
+fn f6_cycles_through_the_panes_and_back_to_the_document() {
+    let mut h = harness(App::new(&[Pane::Nav, Pane::Comments]));
+    let focused_widget = |h: &Harness<'_, App>| h.ctx.memory(|m| m.focused());
+    key(&mut h, Key::F6, Modifiers::NONE);
+    assert_eq!(h.state().focused, Some(Pane::Nav));
+    assert_eq!(focused_widget(&h), Some(pane_id(Pane::Nav).with("title")));
+    key(&mut h, Key::F6, Modifiers::NONE);
+    assert_eq!(h.state().focused, Some(Pane::Comments));
+    key(&mut h, Key::F6, Modifiers::NONE);
+    assert_eq!((h.state().focused, h.state().to_document), (None, 1));
+    assert_eq!(focused_widget(&h), None);
+    key(&mut h, Key::F6, Modifiers::SHIFT);
+    assert_eq!(h.state().focused, Some(Pane::Comments), "Shift+F6 from the document goes to the last pane");
+    let focus: Vec<_> = h.state().log.iter().filter(|r| matches!(r, PaneRequest::Focus(_))).cloned().collect();
+    assert_eq!(focus, vec![PaneRequest::Focus(Pane::Nav), PaneRequest::Focus(Pane::Comments), PaneRequest::Focus(Pane::Comments)]);
+
+    // A click in the document clears it; a click in a pane sets it.
+    click(&mut h, pos2(400.0, 300.0));
+    assert_eq!(h.state().focused, None);
+    click(&mut h, pos2(100.0, 300.0));
+    assert_eq!(h.state().focused, Some(Pane::Nav));
+}
+
+#[test]
+fn one_slot_shows_the_last_pane_per_edge_beside_context_panes() {
+    let mut app = App::new(&[Pane::Pivot, Pane::Comments, Pane::Styles]);
+    app.policy = SidePolicy::OneSlot;
+    app.states.insert(Pane::Styles, PaneState::docked(Edge::End, 300.0));
+    let mut h = harness(app);
+    assert!(rect(&h, pane_id(Pane::Comments).with("title")).is_none());
+    assert_eq!(edge(&h, Pane::Pivot), R - 250.0, "the context pane stays, outermost");
+    assert_eq!(edge(&h, Pane::Styles), R - 550.0);
+    assert!(rect(&h, pane_id(Pane::Pivot).with("title").with("close")).is_none());
+
+    let at = rect(&h, pane_id(Pane::Styles).with("title").with("close")).unwrap().center();
+    click(&mut h, at);
+    h.run_steps(1);
+    assert_eq!(h.state().open, vec![Pane::Pivot, Pane::Comments]);
+    assert_eq!(edge(&h, Pane::Comments), R - 500.0, "the slot shows the remaining pane");
+}
+
+#[test]
+fn rtl_mirrors_sides_and_edge_snaps() {
+    let mut app = App::new(&[Pane::Nav, Pane::Comments]);
+    app.rtl = true;
+    let mut h = harness(app);
+    assert_eq!(edge(&h, Pane::Nav), R - 250.0, "Start is the right edge");
+    assert_eq!(edge(&h, Pane::Comments), L + 250.0);
+
+    let from = title(&h, Pane::Nav).center();
+    drag(&mut h, from, pos2(10.0, 300.0));
+    assert_eq!(changes(h.state()), vec![PaneRequest::Place(Pane::Nav, Place::Docked(Edge::End))], "the left edge is End");
+    // Both on End, outermost first in open order.
+    assert_eq!(edge(&h, Pane::Nav), L + 250.0);
+    assert_eq!(edge(&h, Pane::Comments), L + 500.0);
+}
+
+#[test]
+fn float_rect_is_finite_and_inside_the_bounds() {
+    let bounds = Rect::from_min_size(pos2(0.0, 100.0), vec2(800.0, 500.0));
+    let min = vec2(200.0, 160.0);
+    assert_eq!(float_rect(Some([300.0, 150.0, 280.0, 300.0]), bounds, min), Rect::from_min_size(pos2(300.0, 150.0), vec2(280.0, 300.0)));
+    for junk in [[f32::NAN, 0.0, 1.0, -3.0], [5000.0, -5000.0, 1.0e9, 1.0e9], [f32::NEG_INFINITY, f32::INFINITY, f32::NAN, 0.0]] {
+        let r = float_rect(Some(junk), bounds, min);
+        assert!(r.is_finite() && bounds.contains_rect(r) && r.width() >= 200.0, "{junk:?} -> {r:?}");
+    }
+    assert_eq!(float_rect(None, bounds, min).size(), FLOAT_DEFAULT.min(bounds.size()));
+}
+
+#[cfg(feature = "serde")]
+#[test]
+/// A `PaneState` with a docked edge, size and float rect serializes to JSON and
+/// deserializes back unchanged.
+fn pane_state_round_trips_through_json() {
+    let state = PaneState { place: Place::Docked(Edge::End), size: Some(280.0), float_rect: Some([1.0, 2.0, 270.0, 480.0]) };
+    let json = serde_json::to_string(&state).unwrap();
+    assert_eq!(serde_json::from_str::<PaneState>(&json).unwrap(), state);
+}
+
+#[test]
+/// A pane body may request 400 pt inside its 250 pt side pane; the document region still begins at
+/// the pane's inner edge on both sides.
+fn a_body_wider_than_its_pane_is_clipped_and_the_document_starts_at_the_pane_edge() {
+    struct Wide;
+    impl PaneContent<Pane> for Wide {
+        fn title(&self, pane: &Pane) -> String {
+            format!("{pane:?}")
+        }
+        /// A pane body that requests 400×40 pt inside its pane to exercise clipping.
+        fn body(&mut self, ui: &mut Ui, _: &Pane) {
+            ui.allocate_exact_size(vec2(400.0, 40.0), Sense::hover());
+        }
+        fn default_state(&self, pane: &Pane) -> PaneState {
+            PaneState::docked(if *pane == Pane::Comments { Edge::End } else { Edge::Start }, 250.0)
+        }
+    }
+    let mut h = Harness::builder().with_size(vec2(800.0, 600.0)).build_ui_state(
+        |ui, document: &mut Rect| {
+            PaneHost::new(Id::unique("panes")).show(ui, &[Pane::Nav, Pane::Comments], |_| None, &mut Wide);
+            *document = ui.available_rect_before_wrap();
+        },
+        Rect::NOTHING,
+    );
+    h.run_steps(2);
+    let document = *h.state();
+    assert_eq!(document.left(), L + 250.0, "{document:?}");
+    assert_eq!(document.right(), R - 250.0, "{document:?}");
+}
+
+#[test]
+fn each_title_bar_is_named_after_its_pane() {
+    let h = harness(App::new(&[Pane::Nav, Pane::Comments]));
+    assert_eq!(h.query_all_by_label("Move Nav pane").count(), 1);
+    assert_eq!(h.query_all_by_label("Move Comments pane").count(), 1);
+}
diff --git a/crates/ui/src/printing/tests.rs b/crates/ui/src/printing/tests.rs
index a3eede0c..28ac98b9 100644
--- a/crates/ui/src/printing/tests.rs
+++ b/crates/ui/src/printing/tests.rs
@@ -144,6 +144,9 @@ fn failed_discovery_cannot_reuse_a_previously_available_queue() {
 }
 
 #[test]
+/// Only one print job can be active: a second `begin` fails, the receiver stays
+/// with the job, and submission, queue refusal and a dropped worker report
+/// `Submitted`, `Failed` and `WorkerStopped` while returning to ready.
 fn active_jobs_keep_their_receiver_and_report_receipt_refusal_or_worker_failure() {
     let ctx = egui::Context::default();
     let mut state = State::default();
@@ -175,6 +178,8 @@ fn active_jobs_keep_their_receiver_and_report_receipt_refusal_or_worker_failure(
 }
 
 #[test]
+/// Discovery and rendering localized controls populate the settings (printer, copies, duplex,
+/// grayscale) and become ready, without starting or submitting a print job.
 fn discovery_and_controls_do_not_submit_a_job() {
     let mut state = State::default();
     let discover: Discover = Box::new(|| {
@@ -206,6 +211,8 @@ fn discovery_and_controls_do_not_submit_a_job() {
 }
 
 #[test]
+/// At 220×360 with long localized labels, the grayscale checkbox stays inside the pane and works;
+/// starting a job disables it, and clicking it while pending changes nothing.
 fn localized_controls_fit_narrow_ui_and_disable_while_submitting() {
     let ctx = egui::Context::default();
     ctx.enable_accesskit();
diff --git a/crates/ui/src/tabs/mod.rs b/crates/ui/src/tabs/mod.rs
index 9dc33963..ab6d16ae 100644
--- a/crates/ui/src/tabs/mod.rs
+++ b/crates/ui/src/tabs/mod.rs
@@ -1,8 +1,9 @@
 //! Tab fitting and accessible tab interactions without owning a dock or document model.
 //!
 //! The caller owns identity, localization, selection, painting, overflow menus and drag actions.
-//! [`fit`] only assigns widths; [`Tab`] returns the complete egui response, including double-click
-//! and drag phases, so a panel strip can collapse, reorder or tear off according to its app.
+//! [`fit`] (tabs shrink before they overflow) and [`fit_whole`] (tabs keep their full width) only
+//! assign widths; [`Tab`] returns the complete egui response, including double-click and drag
+//! phases, so a panel strip can collapse, reorder or tear off according to its app.
 
 use egui::{Id, Rect, Response, Sense, Stroke, StrokeKind, Ui, Vec2};
 
@@ -70,6 +71,48 @@ pub fn fit(natural: &[f32], selected: usize, available: f32, minimum_width: f32,
     TabFit { shown, overflow, overflow_width }
 }
 
+/// Fit tabs at their natural widths; the tabs that do not fit go to an overflow menu.
+///
+/// Tabs are shown in input order up to the first one that does not fit beside the selected tab
+/// and an overflow button of `overflow_width`. The selected tab (or the final tab if `selected`
+/// is out of bounds) is always shown, in its logical place: when it lies past that run, it takes
+/// the place of the last tabs that fit. Only a selected tab wider than the strip minus the button
+/// gets less than its natural width; its painter elides the label. A lone tab never reserves a
+/// button.
+///
+/// Dimensions are sanitized as in [`fit`], and the shown widths plus `overflow_width` never
+/// exceed the sanitized available width. Work and storage are linear in the input count.
+pub fn fit_whole(natural: &[f32], selected: usize, available: f32, overflow_width: f32) -> TabFit {
+    let available = extent(available);
+    let natural: Vec<f32> = natural.iter().map(|&w| extent(w)).collect();
+    if natural.iter().map(|&w| f64::from(w)).sum::<f64>() <= f64::from(available) {
+        return TabFit { shown: natural.into_iter().enumerate().collect(), ..Default::default() };
+    }
+    if let [width] = natural[..] {
+        return TabFit { shown: vec![(0, width.min(available))], ..Default::default() };
+    }
+    let overflow_width = extent(overflow_width).min(available);
+    let budget = available - overflow_width;
+    let selected = selected.min(natural.len().saturating_sub(1));
+    let active = natural.get(selected).copied().unwrap_or(0.0).min(budget);
+    let mut room = f64::from(budget - active);
+    let mut shown = Vec::new();
+    let mut overflow = Vec::new();
+    let mut full = false;
+    for (i, &width) in natural.iter().enumerate() {
+        if i == selected {
+            shown.push((i, active));
+        } else if !full && f64::from(width) <= room {
+            room -= f64::from(width);
+            shown.push((i, width));
+        } else {
+            full = true;
+            overflow.push(i);
+        }
+    }
+    TabFit { shown, overflow, overflow_width }
+}
+
 fn squeeze(natural: &[f32], indices: &[usize], total: f32, minimum: f32) -> Vec<(usize, f32)> {
     let width = |i: usize| natural.get(i).copied().unwrap_or(0.0);
     let sum_at = |cap: f32| indices.iter().map(|&i| f64::from(width(i).min(cap.max(width(i).min(minimum))))).sum::<f64>();
diff --git a/crates/ui/src/tabs/tests.rs b/crates/ui/src/tabs/tests.rs
index 854cb392..5a5b4e3d 100644
--- a/crates/ui/src/tabs/tests.rs
+++ b/crates/ui/src/tabs/tests.rs
@@ -72,6 +72,48 @@ fn many_tabs_keep_the_last_selected_without_quadratic_membership_scans() {
     assert!(total(&f) <= 240.001);
 }
 
+#[test]
+fn whole_tabs_keep_their_width_and_the_selected_tab_replaces_the_last_that_fits() {
+    let natural = [60.0, 70.0, 80.0, 50.0, 90.0, 40.0];
+    // 200 points: 22 for the button leaves 178.
+    let f = fit_whole(&natural, 0, 200.0, 22.0);
+    assert_eq!(f.shown, [(0, 60.0), (1, 70.0)]);
+    assert_eq!(f.overflow, [2, 3, 4, 5]);
+    assert_eq!(f.overflow_width, 22.0);
+    // The last tab, selected, takes the place of tab 1 and keeps its order.
+    let f = fit_whole(&natural, 5, 200.0, 22.0);
+    assert_eq!(f.shown, [(0, 60.0), (1, 70.0), (5, 40.0)]);
+    assert_eq!(f.overflow, [2, 3, 4]);
+    let f = fit_whole(&natural, 4, 200.0, 22.0);
+    assert_eq!(f.shown, [(0, 60.0), (4, 90.0)]);
+    assert_eq!(f.overflow, [1, 2, 3, 5]);
+    // Everything fits: no button.
+    let f = fit_whole(&natural, 4, 390.0, 22.0);
+    assert_eq!(f.shown.len(), 6);
+    assert!(f.overflow.is_empty() && f.overflow_width == 0.0);
+}
+
+#[test]
+fn only_a_selected_tab_wider_than_the_strip_is_narrowed() {
+    let f = fit_whole(&[60.0, 300.0, 70.0], 1, 200.0, 22.0);
+    assert_eq!(f.shown, [(1, 178.0)]);
+    assert_eq!(f.overflow, [0, 2]);
+    for selected in [0, 1, 2, usize::MAX] {
+        for available in [0.0, 1.0, 21.0, 22.0, 100.0, 200.0, 500.0] {
+            let natural = [60.0, 300.0, 70.0];
+            let f = fit_whole(&natural, selected, available, 22.0);
+            let selected = selected.min(2);
+            assert!(f.shown.iter().all(|&(i, w)| i == selected || w == natural[i]), "{selected} at {available}: {f:?}");
+            assert!(f.shown.iter().any(|&(i, _)| i == selected));
+            assert_eq!(f.shown.len() + f.overflow.len(), 3);
+            assert!(total(&f) <= available + 0.001, "{available}: {f:?}");
+        }
+    }
+    assert_eq!(fit_whole(&[80.0], 0, 10.0, 22.0).shown, [(0, 10.0)]);
+    let f = fit_whole(&[f32::NAN, f32::INFINITY, -5.0, 30.0], usize::MAX, f32::NAN, f32::MAX);
+    assert!(f.shown.iter().all(|&(_, w)| w.is_finite() && w >= 0.0) && total(&f) == 0.0);
+}
+
 struct TabTest {
     ctx: Context,
     labels: [String; 2],
@@ -85,6 +127,8 @@ struct TabTest {
 }
 
 impl TabTest {
+    /// Create a two-tab test with duplicate `Layers` labels, the first selected and
+    /// enabled, click sense, a 90×26 pt rect and zero counters.
     fn new() -> Self {
         let ctx = Context::default();
         ctx.enable_accesskit();
@@ -102,6 +146,8 @@ impl TabTest {
         }
     }
 
+    /// Render the two tabs at fixed 90×26 rects with injected events. Clears texture deltas, counts
+    /// body paints, and updates the clicked/selected fixtures before returning the responses.
     fn frame(&mut self, events: Vec<Event>) -> (Vec<Response>, FullOutput) {
         self.time += 0.05;
         let ctx = self.ctx.clone();
diff --git a/crates/ui/src/testing/mod.rs b/crates/ui/src/testing/mod.rs
new file mode 100644
index 00000000..9cab5bbd
--- /dev/null
+++ b/crates/ui/src/testing/mod.rs
@@ -0,0 +1,232 @@
+//! Screenshot and input smoke tests of an app's screens in the suite's test languages
+//! (`screen-testing` feature).
+//!
+//! [`Screens`] renders a UI closure with egui_kittest once per language in [`LANGUAGES`]: Arabic,
+//! Japanese, Traditional Chinese (Taiwan), Korean, Thai and Vietnamese. Each run installs the
+//! app's font stack for that UI language with no system fonts, so a snapshot looks the same on
+//! every machine and a character no face draws fails the test (kittest panics on a missing glyph).
+//! A right-to-left language lays the screen out from the right. [`compose`] types through an IME
+//! composition, as a Korean, Japanese or Chinese input method sends it.
+//!
+//! The app's closure gets the [`Locale`] and picks its strings and settings from it; the
+//! harness's language is not visible to the app otherwise.
+//!
+//! ```no_run
+//! use craft_ui::testing::{KOREAN, Screens, compose};
+//! use egui_kittest::kittest::Queryable as _;
+//!
+//! # const FACES: &[craft_ui::fonts::CraftFace] = &[];
+//! let screens = Screens::new("rename").size([320.0, 160.0]).fonts(|fonts| fonts.craft_faces(FACES));
+//! // Compares tests/snapshots/rename-ar.png, rename-ja.png, … (UPDATE_SNAPSHOTS=1 writes them).
+//! screens.snapshots(|ui, locale| {
+//!     ui.label(locale.language);
+//! });
+//!
+//! let mut harness = screens.harness_state("ko", |ui, _, name: &mut String| {
+//!     ui.text_edit_singleline(name);
+//! }, String::new());
+//! harness.get_by_role(egui::accesskit::Role::TextInput).focus();
+//! compose(&mut harness, &KOREAN);
+//! assert_eq!(harness.state(), "한");
+//! ```
+//!
+//! # Shortcut smoke test
+//!
+//! craft-ui doesn't depend on craft-keymap, so this one is a recipe. Send the key event egui
+//! reports for a press on a non-Latin layout and check the app ran the command the press means
+//! by craft-keymap's layout rule. On Hebrew, the key at the Q position types `/`; with Ctrl held
+//! egui reports `Slash` at physical `Q`, and the rule reads it as Ctrl+Q once the layout is known
+//! not to be Latin (`Layout::with_latin(false)`, or after the app has seen Hebrew typed):
+//!
+//! ```ignore
+//! let press = egui::Event::Key {
+//!     key: egui::Key::Slash,
+//!     physical_key: Some(egui::Key::Q),
+//!     pressed: true,
+//!     repeat: false,
+//!     modifiers: egui::Modifiers::COMMAND,
+//! };
+//! let mut harness = screens.harness_state("ar", app_ui, app);
+//! harness.event(press);
+//! harness.run();
+//! assert_eq!(harness.state().last_command(), Some(Command::Quit));
+//! ```
+//!
+//! On Russian, the `с` key reports `C` at physical `C` and must run Ctrl+C. The app's dispatcher
+//! (`craft_keymap::egui::Dispatcher`) turns the event into a `KeyInput` with
+//! `KeyInput::from_egui`.
+
+#[cfg(test)]
+mod tests;
+
+use std::rc::Rc;
+
+use craft_i18n::Direction;
+use egui::{Align, Context, Event, ImeEvent, Layout, Ui, Vec2};
+use egui_kittest::{Harness, SnapshotResults};
+
+use crate::fonts::{I18nScripts, SystemFonts, UiFonts};
+
+/// The UI languages every app's key screens are tested in: one per kind of script layout
+/// (right to left with joining, Han with kana, Traditional Han, Hangul, Thai marks without word
+/// spaces, Latin with stacked diacritics).
+pub const LANGUAGES: [&str; 6] = ["ar", "ja", "zh-TW", "ko", "th", "vi"];
+
+/// The language a screen is drawn in.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Locale {
+    /// Language tag, as in [`LANGUAGES`].
+    pub language: &'static str,
+    pub direction: Direction,
+}
+
+impl Locale {
+    pub fn new(language: &'static str) -> Self {
+        Self { language, direction: craft_i18n::direction(language) }
+    }
+}
+
+type Fonts = Rc<dyn Fn(UiFonts<'static>) -> UiFonts<'static>>;
+type Setup = Rc<dyn Fn(&Context, &Locale)>;
+
+/// One screen's tests across [`LANGUAGES`]. Build it, then take a [`Self::harness`] per language
+/// or compare [`Self::snapshots`].
+#[derive(Clone)]
+pub struct Screens {
+    name: String,
+    size: Vec2,
+    languages: Vec<&'static str>,
+    fonts: Fonts,
+    setup: Option<Setup>,
+}
+
+impl Screens {
+    /// `name` prefixes the snapshot files: `{name}-{language}.png`.
+    pub fn new(name: &str) -> Self {
+        Self { name: name.to_owned(), size: Vec2::new(400.0, 300.0), languages: LANGUAGES.to_vec(), fonts: Rc::new(|fonts| fonts), setup: None }
+    }
+
+    /// The harness size in points (default 400 × 300).
+    pub fn size(mut self, size: impl Into<Vec2>) -> Self {
+        self.size = size.into();
+        self
+    }
+
+    /// Languages to test instead of [`LANGUAGES`].
+    pub fn languages(mut self, languages: &[&'static str]) -> Self {
+        self.languages = languages.to_vec();
+        self
+    }
+
+    /// The app's font configuration: its own faces and the craft faces it embeds. The testing
+    /// module offers [`LANGUAGES`] (call [`UiFonts::languages`] to offer the app's list instead),
+    /// then sets the UI language and turns system fonts off after this runs.
+    pub fn fonts(mut self, fonts: impl Fn(UiFonts<'static>) -> UiFonts<'static> + 'static) -> Self {
+        self.fonts = Rc::new(fonts);
+        self
+    }
+
+    /// Called on the context before the first frame, after the fonts are installed: the app's
+    /// theme, and anything else it stores on the context. The harness applies the locale's
+    /// direction ([`direction::apply`](crate::direction::apply)) before this runs and again after
+    /// it, so egui's own chrome follows the locale even when the callback installs a whole new
+    /// style. The callback can't override the direction.
+    pub fn setup(mut self, setup: impl Fn(&Context, &Locale) + 'static) -> Self {
+        self.setup = Some(Rc::new(setup));
+        self
+    }
+
+    /// A harness drawing `app` in `language`.
+    pub fn harness<'a>(&self, language: &'static str, mut app: impl FnMut(&mut Ui, &Locale) + 'a) -> Harness<'a> {
+        self.harness_state(language, move |ui, locale, ()| app(ui, locale), ())
+    }
+
+    /// A harness drawing `app` in `language`, with state the test can read and change
+    /// ([`Harness::state`]).
+    pub fn harness_state<'a, State>(
+        &self,
+        language: &'static str,
+        mut app: impl FnMut(&mut Ui, &Locale, &mut State) + 'a,
+        state: State,
+    ) -> Harness<'a, State> {
+        let locale = Locale::new(language);
+        let fonts = (self.fonts)(UiFonts::new(&I18nScripts).languages(&LANGUAGES[..])).ui_language(language).system_fonts(SystemFonts::Off).stack();
+        let setup = self.setup.clone();
+        Harness::builder()
+            .with_size(self.size)
+            .with_context_setup(move |ctx| {
+                fonts.install(ctx);
+                crate::direction::apply(ctx, locale.direction);
+                if let Some(setup) = setup {
+                    setup(ctx, &locale);
+                    crate::direction::apply(ctx, locale.direction);
+                }
+            })
+            .build_ui_state(
+                move |ui, state| {
+                    // A right-to-left screen starts at the right: egui then starts each
+                    // `ui.horizontal` row from the right too.
+                    let layout = match locale.direction {
+                        Direction::Rtl => Layout::top_down(Align::Max),
+                        Direction::Ltr => Layout::top_down(Align::Min),
+                    };
+                    ui.with_layout(layout, |ui| app(ui, &locale, state));
+                },
+                state,
+            )
+    }
+
+    /// Draw `app` in each language and compare it with `tests/snapshots/{name}-{language}.png`
+    /// (kittest's snapshot options and `kittest.toml` apply). Run with `UPDATE_SNAPSHOTS=1` to
+    /// write new snapshots; review them before committing. The returned results panic on drop if
+    /// any language differs, after every language has been compared.
+    pub fn snapshots(&self, mut app: impl FnMut(&mut Ui, &Locale)) -> SnapshotResults {
+        let mut results = SnapshotResults::new();
+        for language in self.languages.clone() {
+            let mut harness = self.harness(language, &mut app);
+            harness.run();
+            results.add(harness.try_snapshot(format!("{}-{language}", self.name)));
+        }
+        results
+    }
+}
+
+/// One IME composition: the marked text after each keystroke, then the text committed.
+#[derive(Clone, Copy, Debug)]
+pub struct Composition<'a> {
+    pub preedit: &'a [&'a str],
+    pub commit: &'a str,
+}
+
+/// 2-Set Korean: ㅎ, ㅏ, ㄴ build one syllable.
+pub const KOREAN: Composition<'static> = Composition { preedit: &["ㅎ", "하", "한"], commit: "한" };
+
+/// Japanese romaji input, converted to kanji before commit.
+pub const JAPANESE: Composition<'static> = Composition { preedit: &["に", "にほ", "にほん", "にほんご", "日本語"], commit: "日本語" };
+
+/// Pinyin: Latin letters marked until a candidate is chosen.
+pub const PINYIN: Composition<'static> = Composition { preedit: &["z", "zh", "zho", "zhon", "zhong"], commit: "中" };
+
+/// Vietnamese Telex (IBus, Fcitx5): `Vieejt` builds the word in place.
+pub const TELEX: Composition<'static> = Composition { preedit: &["V", "Vi", "Vie", "Viê", "Việ", "Việt"], commit: "Việt" };
+
+/// The events an input method sends for `composition`: a preedit per keystroke, then the commit.
+/// Each preedit marks its whole text as the segment being converted. egui's `TextEdit` and
+/// canvases reading `Event::Ime`, such as craft-ui's IME composer, both take these.
+pub fn ime_events(composition: &Composition<'_>) -> Vec<Event> {
+    let preedit = composition
+        .preedit
+        .iter()
+        .map(|text| Event::Ime(ImeEvent::Preedit { text: (*text).to_owned(), active_range_chars: Some(0..text.chars().count()) }));
+    preedit.chain([Event::Ime(ImeEvent::Commit(composition.commit.to_owned()))]).collect()
+}
+
+/// Type `composition` into the focused widget, one frame per event as a platform delivers them,
+/// then run the harness until it settles. Focus the text field or canvas first.
+pub fn compose<State>(harness: &mut Harness<'_, State>, composition: &Composition<'_>) {
+    for event in ime_events(composition) {
+        harness.event(event);
+        harness.step();
+    }
+    harness.run();
+}
diff --git a/crates/ui/src/testing/tests.rs b/crates/ui/src/testing/tests.rs
new file mode 100644
index 00000000..36834661
--- /dev/null
+++ b/crates/ui/src/testing/tests.rs
@@ -0,0 +1,60 @@
+use egui::accesskit::Role;
+use egui_kittest::kittest::Queryable as _;
+
+use super::{JAPANESE, KOREAN, Screens, compose, ime_events};
+use crate::fonts::CraftFace;
+
+const ARABIC: CraftFace = CraftFace {
+    family: "Noto Sans Arabic",
+    style: "Regular",
+    scripts: &["Arab"],
+    bytes: include_bytes!("../../tests/fonts/NotoSansArabic-screens.ttf"),
+    index: 0,
+};
+// The subset has the test strings' kana, Han and Hangul, so it stands in for every CJK face.
+const CJK: CraftFace = CraftFace {
+    family: "Noto Sans CJK SC",
+    style: "Regular",
+    scripts: &["Jpan", "Kore", "Hans", "Hant"],
+    bytes: include_bytes!("../../tests/fonts/NotoSansCJKsc-screens.otf"),
+    index: 0,
+};
+
+fn screens() -> Screens {
+    Screens::new("unit").size([300.0, 80.0]).fonts(|fonts| fonts.craft_faces(&[ARABIC, CJK]))
+}
+
+#[test]
+fn ime_events_end_with_the_commit() {
+    let events = ime_events(&KOREAN);
+    assert_eq!(events.len(), 4);
+    assert_eq!(events.last(), Some(&egui::Event::Ime(egui::ImeEvent::Commit("한".to_owned()))));
+}
+
+#[test]
+fn compose_types_into_the_focused_text_field() {
+    for (language, composition) in [("ko", KOREAN), ("ja", JAPANESE)] {
+        let mut harness = screens().harness_state(
+            language,
+            |ui, _, text: &mut String| {
+                let label = ui.label("Name");
+                ui.text_edit_singleline(text).labelled_by(label.id);
+            },
+            String::new(),
+        );
+        harness.get_by_role(Role::TextInput).focus();
+        harness.run();
+        compose(&mut harness, &composition);
+        assert_eq!(harness.state(), composition.commit, "{language}");
+    }
+}
+
+#[test]
+fn right_to_left_screens_start_at_the_right() {
+    for (language, at_right) in [("ar", true), ("ja", false)] {
+        let harness = screens().harness(language, |ui, _| _ = ui.label("ملف"));
+        let label = harness.get_by_label("ملف").rect();
+        assert_eq!(label.max.x > 250.0, at_right, "{language}: {label:?}");
+        assert_eq!(label.min.x < 50.0, !at_right, "{language}: {label:?}");
+    }
+}
diff --git a/crates/ui/src/text.rs b/crates/ui/src/text.rs
new file mode 100644
index 00000000..ec4d7826
--- /dev/null
+++ b/crates/ui/src/text.rs
@@ -0,0 +1,653 @@
+//! Position already shaped text within a fixed-width reading area.
+
+use std::sync::Arc;
+
+use egui::emath::GuiRounding as _;
+use egui::{Align, Color32, Galley, Painter, Pos2, Rect, Vec2, epaint::TextShape, epaint::text::PlacedRow, pos2, vec2};
+
+/// Already-shaped rows and their explicit placement relative to a reading area.
+///
+/// The normalized galley alone does not include its reading-area offset. Use [`Self::paint`]
+/// or [`Self::text_shape`] to retain it; there is deliberately no implicit galley conversion.
+#[derive(Clone, Debug)]
+#[must_use]
+pub enum AlignedGalley {
+    /// A complete left-anchored logical bound, with the reading area kept separately.
+    Aligned { galley: Arc<Galley>, paint_offset: Vec2, reading_rect: Rect },
+    /// An invalid width leaves the original galley untouched, including its alignment.
+    InvalidWidth { original: Arc<Galley> },
+}
+
+impl AlignedGalley {
+    /// The requested reading area, in coordinates relative to the supplied reading origin.
+    /// An invalid width has no reading rectangle.
+    pub fn reading_rect(&self) -> Option<Rect> {
+        match self {
+            Self::Aligned { reading_rect, .. } => Some(*reading_rect),
+            Self::InvalidWidth { .. } => None,
+        }
+    }
+
+    /// The original text height, independent of horizontal overflow.
+    pub fn height(&self) -> f32 {
+        match self {
+            Self::Aligned { reading_rect, .. } => reading_rect.height(),
+            Self::InvalidWidth { original } => original.size().y,
+        }
+    }
+
+    /// A shape placed at the reading area's origin, retaining the explicit galley offset.
+    /// Like [`TextShape::new`], this leaves final pixel rounding to the renderer.
+    pub fn text_shape(&self, reading_origin: Pos2, color: Color32) -> TextShape {
+        match self {
+            Self::Aligned { galley, paint_offset, .. } => TextShape::new(reading_origin + *paint_offset, galley.clone(), color),
+            Self::InvalidWidth { original } => TextShape::new(reading_origin, original.clone(), color),
+        }
+    }
+
+    /// Paint at the reading area's origin using the painter's existing clipping rectangle.
+    ///
+    /// When text rounding is enabled, snap the reading origin before adding the pixel-aligned
+    /// offset. Otherwise translating an origin near half a pixel could change which pixel the
+    /// renderer selects. An invalid width uses the original painting path unchanged.
+    pub fn paint(self, painter: &Painter, reading_origin: Pos2, color: Color32) {
+        match self {
+            Self::Aligned { galley, paint_offset, .. } => {
+                let origin = if painter.ctx().tessellation_options(|options| options.round_text_to_pixels) {
+                    reading_origin.round_to_pixels(galley.pixels_per_point)
+                } else {
+                    reading_origin
+                };
+                painter.galley(origin + paint_offset, galley, color);
+            }
+            Self::InvalidWidth { original } => painter.galley(reading_origin, original, color),
+        }
+    }
+}
+
+/// Align each row inside `width`, without changing its glyphs, wrapping, or logical text.
+///
+/// This is useful for read-only comments, captions and messages whose text must reach the
+/// container's edges. `LayoutJob` alignment ordinarily uses the widest text row instead.
+/// The caller supplies the row alignment, for example from paragraph direction in its shaper.
+/// This helper uses only stock egui APIs and does not implement bidirectional shaping.
+///
+/// The result keeps the requested reading rectangle separately from the complete logical bound.
+/// Oversized right-aligned rows overflow to the left, and centered rows overflow on both sides.
+/// The galley is normalized to a left-edge anchor (`job.halign = Align::Min`, `rect.left() = 0`);
+/// its explicit paint offset preserves every row's position relative to the reading area.
+/// `mesh_bounds` describes the complete normalized ink. Apply clipping separately when required.
+/// Positions snap down to physical pixels so right-aligned rows do not cross the right edge
+/// through nearest-pixel rounding.
+///
+/// Use the result's paint method, supplying the reading area's origin. Per-row alignment is not
+/// represented by its single `LayoutJob` alignment, so editable text should retain its original
+/// galley for hit testing.
+/// Zero width is valid and may place ink entirely outside the reading rectangle.
+/// Invalid widths explicitly return the untouched original, without calling `align`.
+/// Row positions are copy-on-write; the original shared glyph meshes remain shared, and a cached
+/// galley is never modified.
+pub fn align_galley_rows(mut galley: Arc<Galley>, width: f32, mut align: impl FnMut(&PlacedRow) -> Align) -> AlignedGalley {
+    if !width.is_finite() || width < 0.0 {
+        return AlignedGalley::InvalidWidth { original: galley };
+    }
+    let positioned = Arc::make_mut(&mut galley);
+    if positioned.job.halign != Align::Min {
+        Arc::make_mut(&mut positioned.job).halign = Align::Min;
+    }
+    let reading_rect = Rect::from_min_size(pos2(0.0, 0.0), vec2(width, positioned.rect.height()));
+    let mut bounds = reading_rect;
+    for row in &mut positioned.rows {
+        let spare = f64::from(width) - f64::from(row.size.x);
+        let ppp = f64::from(positioned.pixels_per_point);
+        row.pos.x = ((f64::from(align(row).to_factor()) * spare * ppp).floor() / ppp) as f32;
+        bounds |= row.rect();
+    }
+    let paint_offset = vec2(bounds.left(), 0.0);
+    let mut rect = reading_rect.translate(-paint_offset);
+    let mut mesh_bounds = Rect::NOTHING;
+    for row in &mut positioned.rows {
+        row.pos.x -= paint_offset.x;
+        rect |= row.rect();
+        if !row.visuals.mesh.vertices.is_empty() {
+            let ink = row.visuals.mesh_bounds;
+            let offset = row.pos.to_vec2();
+            // Keep the public translated rectangle as well as exact translated endpoints:
+            // min + offset + (max - min) can round differently from max + offset.
+            mesh_bounds |= ink.translate(offset);
+            mesh_bounds |= Rect::from_min_max(ink.min + offset, ink.max + offset);
+        }
+    }
+    positioned.rect = rect;
+    positioned.mesh_bounds = mesh_bounds;
+    AlignedGalley::Aligned { galley, paint_offset, reading_rect }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The three-row fixture (`Short` / `A longer line` / `End`) laid out at 1.0 ppp and left aligned.
+    fn layout() -> Arc<Galley> {
+        layout_text("Short\nA longer line\nEnd", 1.0, Align::Min)
+    }
+
+    /// A fresh context at `ppp` with one settling pass, then a simple job of `text` with the requested
+    /// halign and infinite width.
+    fn layout_with_context(text: &str, ppp: f32, halign: Align) -> (egui::Context, Arc<Galley>) {
+        let ctx = egui::Context::default();
+        ctx.set_pixels_per_point(ppp);
+        ctx.run_ui(egui::RawInput::default(), |_| {}).drop_without_applying_deltas();
+        let mut job = egui::text::LayoutJob::simple(text.into(), egui::FontId::proportional(14.0), Color32::BLACK, f32::INFINITY);
+        job.halign = halign;
+        let galley = ctx.fonts_mut(|fonts| fonts.layout_job(job));
+        (ctx, galley)
+    }
+
+    /// Convenience wrapper returning only the galley from [`layout_with_context`].
+    fn layout_text(text: &str, ppp: f32, halign: Align) -> Arc<Galley> {
+        layout_with_context(text, ppp, halign).1
+    }
+
+    /// Destructure an aligned result into galley, paint offset and reading rect; a valid fixture must
+    /// not become `InvalidWidth`.
+    fn parts(aligned: &AlignedGalley) -> (&Arc<Galley>, Vec2, Rect) {
+        match aligned {
+            AlignedGalley::Aligned { galley, paint_offset, reading_rect } => (galley, *paint_offset, *reading_rect),
+            AlignedGalley::InvalidWidth { .. } => panic!("a valid fixture width must produce aligned rows"),
+        }
+    }
+
+    /// Compare two rects componentwise within `epsilon`.
+    fn close_rect(actual: Rect, expected: Rect, epsilon: f32) {
+        assert!((actual.min - expected.min).length() <= epsilon, "{actual:?} != {expected:?}");
+        assert!((actual.max - expected.max).length() <= epsilon, "{actual:?} != {expected:?}");
+    }
+
+    // The pre-normalization row placement, independent of the new wrapper/offset code. This is
+    // the old physical-pixel floor formula, applied to the original shared glyph rows.
+    /// Reconstruct the previous physical-pixel floor placement as an independent oracle. The
+    /// reference starts from a rect of the requested width, recomputes each row's x from the alignment
+    /// factor, and unions each row rect and translated ink bound into its `rect` and `mesh_bounds`;
+    /// overwide rows therefore extend the rect past the requested width.
+    fn reading_space_reference(original: &Galley, width: f32, alignments: &[Align]) -> Arc<Galley> {
+        let mut reference = original.clone();
+        reference.rect = Rect::from_min_size(Pos2::ZERO, vec2(width, original.rect.height()));
+        reference.mesh_bounds = Rect::NOTHING;
+        assert_eq!(reference.rows.len(), alignments.len());
+        for (row, alignment) in reference.rows.iter_mut().zip(alignments) {
+            let pixels = (f64::from(width) - f64::from(row.size.x)) * f64::from(alignment.to_factor()) * f64::from(original.pixels_per_point);
+            row.pos.x = (pixels.floor() / f64::from(original.pixels_per_point)) as f32;
+            reference.rect |= row.rect();
+            reference.mesh_bounds |= row.visuals.mesh_bounds.translate(row.pos.to_vec2());
+        }
+        Arc::new(reference)
+    }
+
+    #[test]
+    /// Per-row alignment at width 400 keeps row Y positions, the shared job and row arcs, and vertex
+    /// and index counts; the returned logical width is 400 and every translated ink bound is contained.
+    fn independent_row_alignment_preserves_shaping_and_cached_geometry() {
+        let original = layout();
+        let positions: Vec<_> = original.rows.iter().map(|row| row.pos).collect();
+        let mut i = 0;
+        let result = align_galley_rows(original.clone(), 400.0, |_| {
+            let align = match i {
+                0 => Align::Max,
+                1 => Align::Min,
+                _ => Align::Center,
+            };
+            i += 1;
+            align
+        });
+        let (aligned, offset, reading) = parts(&result);
+        assert_eq!(i, 3);
+        assert_eq!(offset, Vec2::ZERO);
+        assert_eq!(result.reading_rect(), Some(reading));
+        assert_eq!(original.rows.iter().map(|row| row.pos).collect::<Vec<_>>(), positions);
+        assert!(Arc::ptr_eq(&original.job, &aligned.job));
+        assert_eq!(aligned.num_vertices, original.num_vertices);
+        assert_eq!(aligned.num_indices, original.num_indices);
+        for (index, (old, new)) in original.rows.iter().zip(&aligned.rows).enumerate() {
+            assert!(Arc::ptr_eq(&old.row, &new.row), "glyphs and meshes must remain shared");
+            assert_eq!(old.pos.y, new.pos.y);
+            let factor = match index {
+                0 => 1.0,
+                1 => 0.0,
+                _ => 0.5,
+            };
+            assert!((new.pos.x - (400.0 - new.size.x) * factor).abs() < 1.0);
+            let bounds = new.visuals.mesh_bounds.translate(new.pos.to_vec2());
+            assert!(aligned.mesh_bounds.contains_rect(bounds));
+        }
+        assert_eq!(aligned.size().x, 400.0);
+        assert_eq!(aligned.size().y, original.size().y);
+        assert_eq!(result.height(), original.size().y);
+    }
+
+    #[test]
+    /// NaN, infinite and negative widths return `InvalidWidth` without calling the alignment callback
+    /// or changing the galley and halign; there is no reading rect, and painting still uses the original
+    /// galley at the given origin.
+    fn invalid_widths_preserve_the_input() {
+        for halign in [Align::Min, Align::Center, Align::Max] {
+            let original = layout_text("Short", 1.0, halign);
+            for width in [f32::NAN, f32::INFINITY, -1.0] {
+                let result = align_galley_rows(original.clone(), width, |_| panic!("an invalid width must not call the alignment callback"));
+                let AlignedGalley::InvalidWidth { original: unchanged } = &result else { panic!("invalid width must be explicit") };
+                assert!(Arc::ptr_eq(&original, unchanged));
+                assert_eq!(unchanged.job.halign, halign);
+                assert_eq!(result.reading_rect(), None);
+                assert_eq!(result.height(), original.size().y);
+                let shape = result.text_shape(pos2(17.25, 31.5), Color32::BLACK);
+                assert_eq!(shape.pos, pos2(17.25, 31.5));
+                assert!(Arc::ptr_eq(&shape.galley, &original));
+            }
+        }
+    }
+
+    #[test]
+    /// At 2.0 ppp, an unbreakably wide row at width 23.3 keeps the requested reading edge through the
+    /// paint offset for Min/Center/Max: physical x is pixel-aligned and within half a pixel of the
+    /// expected alignment, and all logical and ink bounds contain the row.
+    fn overwide_rows_keep_the_requested_reading_edge() {
+        let original = layout_text("unbreakable-long-token", 2.0, Align::Min);
+        let width = 23.3;
+        assert!(original.rows[0].size.x > width);
+        for alignment in [Align::Min, Align::Center, Align::Max] {
+            let result = align_galley_rows(original.clone(), width, |_| alignment);
+            let (aligned, offset, reading) = parts(&result);
+            let row = &aligned.rows[0];
+            let x = offset.x + row.pos.x;
+            let expected = (width - row.size.x) * alignment.to_factor();
+            assert!(x <= expected + 0.0001);
+            assert!(expected - x < 0.5);
+            assert_eq!(x * 2.0, (x * 2.0).floor());
+            if alignment == Align::Max {
+                assert!(x < 0.0);
+                assert!(x + row.size.x <= width + 0.0001);
+            }
+            assert_eq!(aligned.rect.left(), 0.0);
+            assert_eq!(aligned.job.halign, Align::Min);
+            assert_eq!(reading.width(), width);
+            assert!(aligned.rect.contains_rect(row.rect()));
+            assert!(aligned.rect.contains_rect(reading.translate(-offset)));
+            assert!(aligned.mesh_bounds.contains_rect(row.visuals.mesh_bounds.translate(row.pos.to_vec2())));
+        }
+    }
+
+    #[test]
+    /// A right-aligned overwide row extends left of zero while its right edge stays at the requested
+    /// reading edge, and the public logical rect contains the actual row.
+    fn overwide_right_aligned_rows_have_complete_logical_bounds() {
+        let original = layout_text("unbreakable-long-token", 2.0, Align::Min);
+        let width = 23.3;
+        assert!(original.rows[0].size.x > width, "the fixture must overflow the reading area");
+        let result = align_galley_rows(original, width, |_| Align::Max);
+        let (aligned, offset, _) = parts(&result);
+        let row = &aligned.rows[0];
+        let reading_row = row.rect().translate(offset);
+        assert!(reading_row.left() < 0.0, "the right-aligned overwide row must extend to the left");
+        assert!(reading_row.right() <= width, "the requested right reading edge stays fixed");
+        assert!(aligned.rect.contains_rect(row.rect()), "the public logical bound {:?} must contain the actual row {:?}", aligned.rect, row.rect());
+    }
+
+    #[test]
+    /// Fractional width 163.3 with any original halign normalizes the result to a left anchor: halign
+    /// becomes Min, offset is zero, the logical rect is 0..163.3, and rows keep pixel-snapped absolute
+    /// positions.
+    fn fractional_width_and_nonleft_input_normalize_the_anchor() {
+        for original_align in [Align::Min, Align::Center, Align::Max] {
+            let original = layout_text("Short", 2.0, original_align);
+            let result = align_galley_rows(original.clone(), 163.3, |_| Align::Max);
+            let (aligned, offset, _) = parts(&result);
+            assert_eq!(original.job.halign, original_align);
+            assert_eq!(aligned.job.halign, Align::Min);
+            assert_eq!(offset, Vec2::ZERO);
+            assert_eq!(aligned.rect.left(), 0.0);
+            assert_eq!(aligned.rect.right(), 163.3);
+            for row in &aligned.rows {
+                assert_eq!(row.pos.x * 2.0, (row.pos.x * 2.0).floor());
+                assert!(row.rect().right() <= 163.3);
+                assert!(163.3 - row.rect().right() < 0.5);
+            }
+        }
+    }
+
+    #[test]
+    /// Empty, whitespace-only and trailing-newline text produce a valid container rect of the requested
+    /// width and original height; a cleared row list gives zero height and `Rect::NOTHING` ink.
+    fn empty_and_whitespace_rows_have_valid_logical_bounds() {
+        for text in ["", "   ", "Short\n"] {
+            let original = layout_text(text, 1.0, Align::Min);
+            let height = original.rect.height();
+            let result = align_galley_rows(original, 80.25, |_| Align::Max);
+            let (aligned, offset, reading) = parts(&result);
+            assert_eq!(offset, Vec2::ZERO);
+            assert_eq!(aligned.rect, Rect::from_min_size(pos2(0.0, 0.0), vec2(80.25, height)));
+            assert_eq!(reading, aligned.rect);
+            assert_eq!(result.height(), height);
+        }
+        let original = layout();
+        let mut empty = (*original).clone();
+        empty.rows.clear();
+        empty.rect = Rect::ZERO;
+        empty.mesh_bounds = Rect::NOTHING;
+        let result = align_galley_rows(Arc::new(empty), 80.25, |_| Align::Max);
+        let (aligned, offset, _) = parts(&result);
+        assert_eq!(offset, Vec2::ZERO);
+        assert_eq!(aligned.rect, Rect::from_min_size(pos2(0.0, 0.0), vec2(80.25, 0.0)));
+        assert_eq!(aligned.mesh_bounds, Rect::NOTHING);
+    }
+
+    #[test]
+    /// At fractional scales, zero and fractional widths, aligning directly and re-aligning after a
+    /// different first width produce identical reading rects, offsets, logical/ink bounds and row
+    /// positions; row x positions are pixel-snapped in physical space.
+    fn fractional_scale_zero_width_and_repeated_alignment_keep_absolute_positions() {
+        for ppp in [1.25, 1.5] {
+            let original = layout_text("Short", ppp, Align::Center);
+            for width in [0.0, 163.3] {
+                for alignment in [Align::Min, Align::Center, Align::Max] {
+                    let direct = align_galley_rows(original.clone(), width, |_| alignment);
+                    for first_width in [3.5, 230.5] {
+                        let first = align_galley_rows(original.clone(), first_width, |_| Align::Max);
+                        let repeated = align_galley_rows(parts(&first).0.clone(), width, |_| alignment);
+                        let (a, a_offset, a_reading) = parts(&direct);
+                        let (b, b_offset, b_reading) = parts(&repeated);
+                        assert_eq!(a_reading.width(), width);
+                        assert_eq!(a_reading, b_reading);
+                        assert_eq!(a_offset, b_offset);
+                        assert_eq!(a.rect, b.rect);
+                        assert_eq!(a.mesh_bounds, b.mesh_bounds);
+                        for (a, b) in a.rows.iter().zip(&b.rows) {
+                            assert_eq!(a.pos, b.pos);
+                            let pixel = (a.pos.x + a_offset.x) * ppp;
+                            assert!((pixel - pixel.round()).abs() < 1e-4);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    /// A synthetic cached quad with binary32 rounding differences keeps its glyph arcs shared. The
+    /// normalized offset is exactly the whitespace shift; `mesh_bounds` contains every translated vertex
+    /// and the complete legacy rect, equals the union of both rounding directions, survives repetition,
+    /// and remains `Rect::NOTHING` when all ink is empty.
+    fn fractional_ink_bounds_contain_translated_rectangles_and_vertices() {
+        // A synthetic cached quad isolates the two directions of binary32 rounding. The
+        // whitespace row supplies the normalization offset without contributing any ink.
+        let shift = f32::from_bits(0x3f2a_aaab);
+        let mut original = layout_text(" \nI", 1.5, Align::Min);
+        let fixture = Arc::make_mut(&mut original);
+        assert_eq!(fixture.rows.len(), 2);
+        fixture.rect = Rect::from_min_size(Pos2::ZERO, vec2(1.0, 64.0));
+        fixture.rows[0].pos = Pos2::ZERO;
+        let empty = Arc::make_mut(&mut fixture.rows[0].row);
+        empty.size.x = 0.5; // Max at width 0 snaps to -one pixel, not -two pixels.
+        empty.visuals = Default::default();
+        fixture.rows[1].pos = pos2(0.0, shift);
+        let ink = Arc::make_mut(&mut fixture.rows[1].row);
+        ink.size.x = 1.0;
+        let mut mesh = egui::epaint::Mesh::default();
+        mesh.add_rect_with_uv(
+            Rect::from_min_max(pos2(-2.0, -2.0), pos2(f32::from_bits(0x4055_5555), shift)),
+            Rect::from_min_max(Pos2::ZERO, pos2(1.0, 1.0)),
+            Color32::BLACK,
+        );
+        ink.visuals = egui::epaint::text::RowVisuals {
+            mesh_bounds: mesh.calc_bounds(),
+            glyph_index_start: 0,
+            glyph_vertex_range: 0..mesh.vertices.len(),
+            mesh,
+        };
+        let local = ink.visuals.mesh_bounds;
+        assert!(ink.visuals.mesh.is_valid());
+        assert_eq!(ink.visuals.mesh.vertices.len(), 4);
+        assert_eq!(ink.visuals.mesh.indices.len(), 6);
+        for vertex in &ink.visuals.mesh.vertices {
+            assert!(local.contains(vertex.pos));
+        }
+        fixture.mesh_bounds = Rect::from_min_max(local.min + vec2(0.0, shift), local.max + vec2(0.0, shift));
+        fixture.num_vertices = 4;
+        fixture.num_indices = 6;
+        let snapshot = (*original).clone();
+        assert!(snapshot.rows[0].visuals.mesh.vertices.is_empty());
+        assert!(snapshot.rows[0].visuals.mesh.indices.is_empty());
+        assert_eq!(snapshot.rows[0].visuals.mesh_bounds, Rect::NOTHING);
+        assert_eq!(snapshot.rows.iter().filter(|row| !row.visuals.mesh.vertices.is_empty()).count(), 1);
+
+        let align_fixture = |galley| {
+            let mut index = 0;
+            let aligned = align_galley_rows(galley, 0.0, |_| {
+                index += 1;
+                if index == 1 { Align::Max } else { Align::Min }
+            });
+            assert_eq!(index, 2);
+            aligned
+        };
+        let result = align_fixture(original.clone());
+        let (aligned, offset, reading) = parts(&result);
+        assert_eq!(offset, vec2(-shift, 0.0));
+        assert_eq!(aligned.rows[1].pos, pos2(shift, shift));
+        assert_eq!(aligned.rect.left_top(), Pos2::ZERO);
+        assert_eq!(aligned.job.halign, Align::Min);
+        assert_eq!(result.height(), 64.0);
+        assert_eq!(reading, Rect::from_min_size(Pos2::ZERO, vec2(0.0, 64.0)));
+        assert!(aligned.rect.contains_rect(reading.translate(-offset)));
+        assert_eq!(*original, snapshot, "alignment must leave the complete source unchanged");
+        assert_eq!(aligned.num_vertices, snapshot.num_vertices);
+        assert_eq!(aligned.num_indices, snapshot.num_indices);
+        for (index, (row, old)) in aligned.rows.iter().zip(&snapshot.rows).enumerate() {
+            assert!(Arc::ptr_eq(&row.row, &old.row), "cached glyphs and meshes stay shared");
+            assert_eq!(row.pos.y, old.pos.y);
+            let reading_position = if index == 0 { pos2(-shift, 0.0) } else { old.pos };
+            assert_eq!(row.pos + offset, reading_position);
+            assert!(aligned.rect.contains_rect(row.rect()));
+        }
+        assert_eq!(aligned.rows[0].visuals.mesh_bounds, Rect::NOTHING);
+        let repeated = align_fixture(aligned.clone());
+        let (again, again_offset, again_reading) = parts(&repeated);
+        assert_eq!(again_offset, offset);
+        assert_eq!(again_reading, reading);
+        assert_eq!(**again, **aligned, "repeated alignment is exact, including cached ink bounds");
+
+        let mut all_empty = (*original).clone();
+        for row in &mut all_empty.rows {
+            Arc::make_mut(&mut row.row).visuals = Default::default();
+        }
+        all_empty.mesh_bounds = Rect::NOTHING;
+        all_empty.num_vertices = 0;
+        all_empty.num_indices = 0;
+        let all_empty = align_fixture(Arc::new(all_empty));
+        assert_eq!(parts(&all_empty).0.mesh_bounds, Rect::NOTHING);
+
+        let row = &aligned.rows[1];
+        let legacy = local.translate(row.pos.to_vec2());
+        let endpoints = Rect::from_min_max(local.min + row.pos.to_vec2(), local.max + row.pos.to_vec2());
+        assert_eq!(legacy.max.x.to_bits(), 0x407f_ffff, "the legacy X maximum rounds inward");
+        assert_eq!(endpoints.max.x.to_bits(), 0x4080_0000);
+        assert_eq!(legacy.max.y.to_bits(), 0x3faa_aaac, "the legacy Y maximum rounds outward");
+        assert_eq!(endpoints.max.y.to_bits(), 0x3faa_aaab);
+        assert!(endpoints.max.x > legacy.max.x && endpoints.max.y < legacy.max.y);
+        assert!(aligned.mesh_bounds.is_finite());
+        assert!(aligned.mesh_bounds.contains_rect(legacy), "retain the complete public translated row rectangle");
+        for (index, vertex) in row.visuals.mesh.vertices.iter().enumerate() {
+            let position = row.pos + vertex.pos.to_vec2();
+            assert!(
+                aligned.mesh_bounds.contains(position),
+                "actual translated vertex {index} must be contained: position={:?} bits={:x?}, bounds_max={:?} bits={:x?}",
+                [position.x, position.y],
+                [position.x.to_bits(), position.y.to_bits()],
+                [aligned.mesh_bounds.max.x, aligned.mesh_bounds.max.y],
+                [aligned.mesh_bounds.max.x.to_bits(), aligned.mesh_bounds.max.y.to_bits()]
+            );
+        }
+        assert_eq!(aligned.mesh_bounds, legacy.union(endpoints));
+    }
+
+    #[test]
+    /// The logical container width follows the reading width while ink bounds stay the glyph extent;
+    /// whitespace has a container but no ink bounds.
+    fn logical_container_and_ink_bounds_remain_distinct() {
+        let result = align_galley_rows(layout_text("Short", 1.0, Align::Min), 400.0, |_| Align::Min);
+        let (aligned, _, _) = parts(&result);
+        assert_eq!(aligned.rect.width(), 400.0);
+        assert!(aligned.mesh_bounds.right() < aligned.rect.right());
+        let result = align_galley_rows(layout_text("   ", 1.0, Align::Min), 400.0, |_| Align::Max);
+        let (whitespace, _, _) = parts(&result);
+        assert_eq!(whitespace.rect.width(), 400.0);
+        assert_eq!(whitespace.mesh_bounds, Rect::NOTHING);
+    }
+
+    #[test]
+    /// A uniquely owned galley is reused at the same allocation instead of being cloned.
+    fn uniquely_owned_galley_reuses_its_allocation() {
+        let original = Arc::new((*layout()).clone());
+        assert_eq!(Arc::strong_count(&original), 1);
+        let before = Arc::as_ptr(&original);
+        let result = align_galley_rows(original, 400.0, |_| Align::Max);
+        assert_eq!(before, Arc::as_ptr(parts(&result).0));
+    }
+
+    const MIXED: &str = "First extraordinarily long reading row\nSecond independently aligned reading row\nThird right-aligned overwide reading row";
+    const ALIGNMENTS: [Align; 3] = [Align::Min, Align::Center, Align::Max];
+
+    /// Assert the mixed fixture's three rows each overflow `width`, then apply Min/Center/Max in that
+    /// order through `align_galley_rows`.
+    fn mixed(original: Arc<Galley>, width: f32) -> AlignedGalley {
+        assert_eq!(original.rows.len(), ALIGNMENTS.len());
+        assert!(original.rows.iter().all(|row| row.size.x > width), "each fixture row must overflow");
+        let mut index = 0;
+        let result = align_galley_rows(original, width, |_| {
+            let alignment = ALIGNMENTS[index];
+            index += 1;
+            alignment
+        });
+        assert_eq!(index, ALIGNMENTS.len());
+        result
+    }
+
+    #[test]
+    /// Across fractional scales and widths 0/23.3, mixed overflow matches the independent oracle after
+    /// translating by the offset, shares row arcs, preserves absolute Y positions, and keeps the
+    /// reading rect at the requested width.
+    fn mixed_overflow_normalizes_bounds_without_changing_absolute_rows_or_ink() {
+        for ppp in [1.25, 1.5, 2.0] {
+            let original = layout_text(MIXED, ppp, Align::Center);
+            for width in [0.0, 23.3] {
+                let expected = reading_space_reference(&original, width, &ALIGNMENTS);
+                assert!(expected.rect.left() < 0.0 && expected.rect.right() > width, "fixture must overflow both reading edges");
+                let result = mixed(original.clone(), width);
+                let (aligned, offset, reading) = parts(&result);
+                assert_eq!(aligned.job.halign, Align::Min);
+                assert_eq!(aligned.rect.left_top(), Pos2::ZERO);
+                assert_eq!(reading, Rect::from_min_size(Pos2::ZERO, vec2(width, original.rect.height())));
+                assert_eq!(offset, vec2(expected.rect.left(), 0.0));
+                close_rect(aligned.rect.translate(offset), expected.rect, 1e-4 / ppp);
+                close_rect(aligned.mesh_bounds.translate(offset), expected.mesh_bounds, 1e-4 / ppp);
+                assert_eq!(aligned.num_vertices, original.num_vertices);
+                assert_eq!(aligned.num_indices, original.num_indices);
+                for ((row, expected), original) in aligned.rows.iter().zip(&expected.rows).zip(&original.rows) {
+                    assert!(Arc::ptr_eq(&row.row, &original.row));
+                    assert_eq!(row.pos.y, original.pos.y);
+                    assert!(aligned.rect.contains_rect(row.rect()));
+                    assert!(aligned.mesh_bounds.contains_rect(row.visuals.mesh_bounds.translate(row.pos.to_vec2())));
+                    assert!(((row.pos + offset) - expected.pos).length() * ppp < 1e-4);
+                    let pixel = (row.pos.x + offset.x) * ppp;
+                    assert!((pixel - pixel.round()).abs() < 1e-4);
+                }
+            }
+        }
+    }
+
+    #[test]
+    /// `text_shape` anchors rotation at the complete logical bound rather than the reading rect; row
+    /// corners and the visual ink bounds match an independently rotated oracle for several anchors.
+    fn public_text_shape_uses_the_complete_logical_bound_for_rotation_anchors() {
+        let original = layout_text(MIXED, 1.5, Align::Min);
+        let expected = reading_space_reference(&original, 23.3, &ALIGNMENTS);
+        let result = mixed(original, 23.3);
+        let (galley, _, _) = parts(&result);
+        let origin = pos2(51.25, 37.5);
+        let angle = 0.73;
+        let rotation = egui::emath::Rot2::from_angle(angle);
+        for anchor in [egui::Align2::LEFT_TOP, egui::Align2::CENTER_CENTER, egui::Align2::RIGHT_BOTTOM] {
+            let pivot = origin + anchor.pos_in_rect(&expected.rect).to_vec2();
+            let shape = result.text_shape(origin, Color32::BLACK).with_angle_and_anchor(angle, anchor);
+            for (row, expected) in galley.rows.iter().zip(&expected.rows) {
+                for (corner, expected) in
+                    [(row.rect().left_top(), expected.rect().left_top()), (row.rect().right_bottom(), expected.rect().right_bottom())]
+                {
+                    let actual = shape.pos + rotation * corner.to_vec2();
+                    let expected = pivot + rotation * (origin + expected.to_vec2() - pivot);
+                    assert!((actual - expected).length() < 1e-4, "rotation must retain the independently computed logical anchor");
+                }
+            }
+            let corners = [
+                expected.mesh_bounds.left_top(),
+                expected.mesh_bounds.right_top(),
+                expected.mesh_bounds.right_bottom(),
+                expected.mesh_bounds.left_bottom(),
+            ];
+            let expected_ink = Rect::from_points(&corners.map(|p| pivot + rotation * (origin + p.to_vec2() - pivot)));
+            close_rect(shape.visual_bounding_rect(), expected_ink, 1e-4);
+        }
+    }
+
+    #[test]
+    /// At fractional DPI and origins, including points straddling a physical pixel, `paint` emits one
+    /// text shape whose tessellated vertices, indices, UVs and colors match the reading-space reference
+    /// at the same physical pixels, with text rounding both on and off.
+    fn painter_preserves_visible_vertices_at_fractional_origins_and_dpi() {
+        for ppp in [1.25, 1.5, 2.0] {
+            let (ctx, original) = layout_with_context(MIXED, ppp, Align::Min);
+            for width in [0.0, 23.3] {
+                let reference = reading_space_reference(&original, width, &ALIGNMENTS);
+                let aligned = mixed(original.clone(), width);
+                for rounding in [false, true] {
+                    ctx.tessellation_options_mut(|options| options.round_text_to_pixels = rounding);
+                    let options = ctx.tessellation_options(|options| *options);
+                    for origin in [pos2(37.25, 19.375), pos2(-11.5, 9.5), pos2(0.5 / ppp - 1e-5, 0.5 / ppp), pos2(0.5 / ppp + 1e-5, 0.5 / ppp)] {
+                        let output = ctx.run_ui(egui::RawInput::default(), |ui| aligned.clone().paint(ui.painter(), origin, Color32::BLACK));
+                        let shapes: Vec<_> = output
+                            .shapes
+                            .iter()
+                            .filter_map(|clipped| match &clipped.shape {
+                                egui::Shape::Text(shape) => Some(shape),
+                                _ => None,
+                            })
+                            .collect();
+                        assert_eq!(shapes.len(), 1, "the actual paint method must emit one text shape");
+                        let atlas_size = ctx.fonts(|fonts| fonts.image().size);
+                        let tessellate = |shape: &TextShape| {
+                            let mut tessellator = egui::epaint::Tessellator::new(ppp, options, atlas_size, Vec::new());
+                            let mut mesh = egui::epaint::Mesh::default();
+                            tessellator.tessellate_text(shape, &mut mesh);
+                            mesh
+                        };
+                        let actual = tessellate(shapes[0]);
+                        let expected = tessellate(&TextShape::new(origin, reference.clone(), Color32::BLACK));
+                        assert!(!expected.vertices.is_empty(), "real glyph ink must be tessellated");
+                        assert_eq!(actual.indices, expected.indices);
+                        assert_eq!(actual.vertices.len(), expected.vertices.len());
+                        for (actual, expected) in actual.vertices.iter().zip(&expected.vertices) {
+                            assert_eq!(actual.uv, expected.uv);
+                            assert_eq!(actual.color, expected.color);
+                            assert!(
+                                (actual.pos - expected.pos).length() * ppp < 1e-4,
+                                "the wrapper must not move ink to another physical pixel: {:?} != {:?}",
+                                actual.pos,
+                                expected.pos
+                            );
+                        }
+                        drop(shapes);
+                        output.drop_without_applying_deltas();
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/crates/ui/src/theme/mod.rs b/crates/ui/src/theme/mod.rs
index 26f9e9d3..9c905713 100644
--- a/crates/ui/src/theme/mod.rs
+++ b/crates/ui/src/theme/mod.rs
@@ -1,7 +1,7 @@
 //! Theme mechanisms for egui widgets, with palettes and theme selection owned by applications.
 //!
-//! This module does not install fonts, store a theme, or change global visuals. Applications
-//! decide their colors, borders, typography, spacing and saved preferences independently.
+//! This module does not store a theme or change global visuals; [`crate::fonts`] installs fonts.
+//! Applications decide their colors, borders, typography, spacing and saved preferences independently.
 
 use egui::{Color32, CornerRadius, Stroke, style::Widgets};
 
diff --git a/crates/ui/tests/docking_workflows.rs b/crates/ui/tests/docking_workflows.rs
index 24feb6f1..8303a7ed 100644
--- a/crates/ui/tests/docking_workflows.rs
+++ b/crates/ui/tests/docking_workflows.rs
@@ -40,6 +40,9 @@ struct Harness {
 }
 
 impl Harness {
+    /// Create a workflow harness with the requested theme, width and pixel scale,
+    /// zero animation and no cursor blink, and a canvas plus side tabs and floating
+    /// brushes layout, then settle it.
     fn new(dark: bool, width: f32, scale: f32) -> Self {
         let ctx = Context::default();
         ctx.set_theme(if dark { egui::Theme::Dark } else { egui::Theme::Light });
@@ -55,7 +58,7 @@ impl Harness {
                 first: Box::new(Node::Tabs { panels: vec![CANVAS], active: 0 }),
                 second: Box::new(Node::Tabs { panels: vec![LAYERS, PROPERTIES], active: 0 }),
             }),
-            floating: vec![Floating { panels: vec![BRUSHES], active: 0, rect: [38.0, 76.0, 210.0, 250.0] }],
+            floating: vec![Floating::single(vec![BRUSHES], 0, [38.0, 76.0, 210.0, 250.0])],
         };
         let mut harness = Self {
             ctx,
@@ -77,6 +80,9 @@ impl Harness {
         harness
     }
 
+    /// One 520 pt-high frame through the real wgpu test renderer. Applies returned actions with
+    /// canvas protection (round-tripping them through JSON when `serde` is enabled), validates the
+    /// layout, and records body ids and applied actions.
     fn step(&mut self, events: Vec<Event>) {
         self.frame += 1;
         let input = RawInput {
@@ -174,12 +180,14 @@ impl Harness {
         self.layout.validate().unwrap();
     }
 
+    /// Run four empty workflow frames to settle sizing.
     fn settle(&mut self) {
         for _ in 0..4 {
             self.step(Vec::new());
         }
     }
 
+    /// The response rect of `panel`'s tab in the workflow dock.
     fn tab(&self, panel: u32) -> Rect {
         self.ctx.read_response(Id::unique("workflow").with(("tab", &panel))).unwrap().rect
     }
@@ -235,7 +243,7 @@ fn floating_brushes_merge_detach_and_redock_through_real_pointer_input() {
                 assert_eq!(h.body_ids[&BRUSHES], brush_id);
                 h.capture(&directory, "02-merged-main-tabs");
                 h.drag(h.tab(BRUSHES).center(), pos2((width - 240.0) * 0.5, 270.0));
-                assert!(h.layout.floating.iter().any(|g| g.panels.contains(&BRUSHES)), "{name}: {:?}", h.applied);
+                assert!(h.layout.floating.iter().any(|g| g.contains(&BRUSHES)), "{name}: {:?}", h.applied);
                 h.capture(&directory, "03-detached-again");
                 h.drag(h.tab(BRUSHES).center(), h.tab(LAYERS).left_center() + vec2(4.0, 0.0));
                 assert!(h.layout.floating.is_empty(), "{name}");
@@ -250,3 +258,189 @@ fn floating_brushes_merge_detach_and_redock_through_real_pointer_input() {
         }
     }
 }
+
+/// Each app's saved v1 layout goes through a docking session driven by real pointer input and a
+/// command, then writes and reads back unchanged.
+#[cfg(all(feature = "serde", feature = "testing"))]
+mod v1_fixtures {
+    use craft_ui::docking::{DockCommand, DockContent, Hit, Layout, Node, Permissions, ResizeEdge, Side, testing::DockDriver};
+    use egui::{Pos2, Rect, pos2};
+    use serde_json::{Value, json};
+
+    struct Content;
+
+    impl DockContent<String> for Content {
+        fn body(&mut self, ui: &mut egui::Ui, panel: &String) {
+            ui.label(panel.as_str());
+        }
+        fn logical_label(&self, panel: &String) -> String {
+            panel.clone()
+        }
+        fn permissions(&self, panel: &String) -> Permissions {
+            if panel == "canvas" { Permissions::PROTECTED } else { Permissions::default() }
+        }
+    }
+
+    type Driver = DockDriver<String, Content>;
+    type Columns = Vec<Vec<Vec<String>>>;
+
+    /// App, file contents and the JSON pointer to a saved layout.
+    const FIXTURES: [(&str, &str, &str); 10] = [
+        ("designcraft", include_str!("fixtures/v1/designcraft.json"), "/docking"),
+        ("designcraft", include_str!("fixtures/v1/designcraft.json"), "/customWorkspaces/0/docking"),
+        ("vectorcraft", include_str!("fixtures/v1/vectorcraft.json"), "/docking"),
+        ("lightcraft", include_str!("fixtures/v1/lightcraft.json"), "/docking/layout"),
+        ("pdfcraft", include_str!("fixtures/v1/pdfcraft.json"), "/docking/layout"),
+        ("cadcraft", include_str!("fixtures/v1/cadcraft.json"), "/workspace/docking/layout"),
+        ("soundcraft", include_str!("fixtures/v1/soundcraft.json"), "/docking/layout"),
+        ("soundcraft", include_str!("fixtures/v1/soundcraft.json"), "/mix_docking/layout"),
+        ("photocraft", include_str!("fixtures/v1/photocraft.json"), "/docking"),
+        ("photocraft", include_str!("fixtures/v1/photocraft.json"), "/panel_layout/docking"),
+    ];
+
+    /// The start dock's columns, each a list of groups.
+    fn start_columns(layout: &Layout<String>) -> Columns {
+        fn find(node: &Node<String>) -> Option<Columns> {
+            match node {
+                Node::Dock { side: Side::Start, columns } => {
+                    Some(columns.iter().map(|column| column.groups.iter().map(|group| group.panels.clone()).collect()).collect())
+                }
+                Node::Split { first, second, .. } => find(first).or_else(|| find(second)),
+                _ => None,
+            }
+        }
+        layout.root.as_ref().and_then(find).unwrap_or_default()
+    }
+
+    fn iconic(layout: &Layout<String>) -> bool {
+        fn find(node: &Node<String>) -> Option<bool> {
+            match node {
+                Node::Dock { side: Side::Start, columns } => columns.first().map(|column| column.iconic),
+                Node::Split { first, second, .. } => find(first).or_else(|| find(second)),
+                _ => None,
+            }
+        }
+        layout.root.as_ref().and_then(find).unwrap_or(false)
+    }
+
+    fn hit(d: &Driver, hit: Hit<String>) -> Rect {
+        d.hit(&hit).unwrap_or_else(|| panic!("{hit:?} in {:?}", d.hits()))
+    }
+
+    /// A point of `from` that no floating window above it covers, as drawn last frame.
+    fn grab(d: &Driver, from: &Hit<String>, panel: &String) -> Option<Pos2> {
+        let rect = d.hit(from)?;
+        let own = d.layout.floating.iter().position(|w| w.contains(panel));
+        let windows: Vec<Rect> = d
+            .layout
+            .floating
+            .iter()
+            .filter_map(|w| {
+                let first = w.panels().next()?.clone();
+                Some(Rect::from_min_max(d.hit(&Hit::Title(first.clone()))?.min, d.hit(&Hit::Resize(first, ResizeEdge::BottomRight))?.max))
+            })
+            .collect();
+        let covered = |p: Pos2| windows.iter().enumerate().any(|(i, w)| own.is_none_or(|own| i > own) && w.contains(p));
+        let mut x = rect.left() + 4.0;
+        while x < rect.right() {
+            let p = pos2(x, rect.center().y);
+            if !covered(p) {
+                return Some(p);
+            }
+            x += 4.0;
+        }
+        None
+    }
+
+    /// Drag from an uncovered point of `from` to `to`; something must change.
+    fn drag(d: &mut Driver, from: Hit<String>, to: Pos2, what: &str) {
+        let panel = match &from {
+            Hit::DragBar(p) | Hit::Title(p) => p.clone(),
+            other => panic!("{other:?}"),
+        };
+        let at = grab(d, &from, &panel).unwrap_or_else(|| panic!("{what}: {from:?} is covered"));
+        let out = d.drag(at, to);
+        assert!(out.error.is_none() && !out.actions.is_empty(), "{what}: {out:?}\n{:?}\n{:?}", d.layout, d.hits());
+        d.settle();
+    }
+
+    fn sorted(layout: &Layout<String>) -> Vec<String> {
+        let mut panels: Vec<String> = layout.panels().into_iter().cloned().collect();
+        panels.sort();
+        panels
+    }
+
+    #[test]
+    fn v1_layouts_dock_collapse_float_redock_and_reload() {
+        let mut seams = Vec::new();
+        for (app, text, pointer) in FIXTURES {
+            let at = format!("{app}{pointer}");
+            let file: Value = serde_json::from_str(text).unwrap();
+            let layout: Layout<String> = serde_json::from_value(file.pointer(pointer).unwrap().clone()).unwrap_or_else(|e| panic!("{at}: {e}"));
+            let panels = sorted(&layout);
+            let mut d = Driver::new(layout, Content);
+            let mut bars: Vec<String> = Vec::new();
+            for (h, _) in d.hits() {
+                if let Hit::DragBar(panel) = h
+                    && !bars.contains(&panel)
+                {
+                    bars.push(panel);
+                }
+            }
+            assert!(bars.len() >= 2, "{at}: two movable groups in {bars:?}");
+
+            // The first group's bar dropped on the window's start edge makes a dock.
+            drag(&mut d, Hit::DragBar(bars[0].clone()), pos2(2.0, 300.0), &format!("{at}: new dock"));
+            let columns = start_columns(&d.layout);
+            assert!(columns.len() == 1 && columns[0].len() == 1 && columns[0][0][0] == bars[0], "{at}: {columns:?}");
+
+            // The second group stacks below it, and a third goes into the seam between them.
+            let first = hit(&d, Hit::Tab(bars[0].clone()));
+            let bottom = d.area.bottom();
+            drag(&mut d, Hit::DragBar(bars[1].clone()), pos2(first.center().x, bottom - 10.0), &format!("{at}: stack below"));
+            let third = bars[2..].iter().find(|p| grab(&d, &Hit::DragBar((*p).clone()), p).is_some()).cloned();
+            if let Some(third) = &third {
+                seams.push(at.clone());
+                let second = hit(&d, Hit::Tab(bars[1].clone()));
+                drag(&mut d, Hit::DragBar(third.clone()), pos2(second.center().x, second.top() + 2.0), &format!("{at}: seam"));
+            }
+            let columns = start_columns(&d.layout);
+            let heads: Vec<&String> = columns[0].iter().map(|group| &group[0]).collect();
+            let expected: Vec<&String> = match &third {
+                Some(third) => vec![&bars[0], third, &bars[1]],
+                None => vec![&bars[0], &bars[1]],
+            };
+            assert_eq!((columns.len(), heads), (1, expected), "{at}");
+
+            // Collapse the column to icons and expand it again.
+            d.click(hit(&d, Hit::Collapse(bars[0].clone())).center());
+            d.settle();
+            assert!(iconic(&d.layout), "{at}: collapsed");
+            assert!(d.hit(&Hit::Icon(bars[0].clone())).is_some(), "{at}: icons");
+            d.click(hit(&d, Hit::Collapse(bars[0].clone())).center());
+            d.settle();
+            assert!(!iconic(&d.layout), "{at}: expanded");
+
+            // Float the column by command, then drag its window back to the start edge.
+            let float: DockCommand<String> =
+                serde_json::from_value(json!({"command": "window.panel.float", "panel": bars[0], "column": true})).unwrap();
+            let space = craft_ui::docking::float_space(&d.ctx, d.id).unwrap();
+            let actions =
+                float.to_actions_with(&craft_ui::docking::Workspace::new(d.layout.clone()), false, &space, |p| d.content.permissions(p)).unwrap();
+            d.layout.apply_all(actions, |p| d.content.permissions(p)).unwrap_or_else(|e| panic!("{at}: {e}"));
+            d.settle();
+            assert!(start_columns(&d.layout).is_empty(), "{at}: floated");
+            drag(&mut d, Hit::Title(bars[0].clone()), pos2(2.0, 300.0), &format!("{at}: dock back"));
+            assert_eq!(start_columns(&d.layout), columns, "{at}: docked back");
+
+            // Nothing was lost, and the layout reads back as written.
+            assert_eq!(sorted(&d.layout), panels, "{at}");
+            let written = serde_json::to_string(&d.layout).unwrap();
+            let read: Layout<String> = serde_json::from_str(&written).unwrap();
+            read.validate().unwrap_or_else(|e| panic!("{at}: {e}"));
+            assert_eq!(read, d.layout, "{at}");
+        }
+        // The fixtures with a third movable group, uncovered, try the seam.
+        assert_eq!(seams.len(), 6, "{seams:?}");
+    }
+}
diff --git a/crates/ui/tests/fixtures/v1/cadcraft.json b/crates/ui/tests/fixtures/v1/cadcraft.json
new file mode 100644
index 00000000..996bb02e
--- /dev/null
+++ b/crates/ui/tests/fixtures/v1/cadcraft.json
@@ -0,0 +1,91 @@
+{
+  "version": 1,
+  "workspace": {
+    "docking": {
+      "layout": {
+        "root": {
+          "Split": {
+            "axis": "Horizontal",
+            "size": {
+              "FixedFirst": 220.0
+            },
+            "first": {
+              "Tabs": {
+                "panels": [
+                  "toolSets"
+                ],
+                "active": 0
+              }
+            },
+            "second": {
+              "Split": {
+                "axis": "Horizontal",
+                "size": {
+                  "FixedSecond": 300.0
+                },
+                "first": {
+                  "Tabs": {
+                    "panels": [
+                      "canvas"
+                    ],
+                    "active": 0
+                  }
+                },
+                "second": {
+                  "Stack": {
+                    "entries": [
+                      {
+                        "panel": "layers",
+                        "open": true,
+                        "height": 280.0
+                      },
+                      {
+                        "panel": "properties",
+                        "open": false,
+                        "height": null
+                      }
+                    ]
+                  }
+                }
+              }
+            }
+          }
+        },
+        "floating": [
+          {
+            "panels": [
+              "quickCalc"
+            ],
+            "active": 0,
+            "rect": [
+              320.0,
+              200.0,
+              240.0,
+              300.0
+            ]
+          }
+        ]
+      },
+      "hidden": [
+        [
+          "externalReferences",
+          {
+            "floating": null,
+            "anchor": "layers",
+            "placement": {
+              "Tab": {
+                "before": "properties"
+              }
+            },
+            "size": null,
+            "stack": [
+              true,
+              null
+            ],
+            "sibling": []
+          }
+        ]
+      ]
+    }
+  }
+}
diff --git a/crates/ui/tests/fixtures/v1/designcraft.json b/crates/ui/tests/fixtures/v1/designcraft.json
new file mode 100644
index 00000000..ea99c2c1
--- /dev/null
+++ b/crates/ui/tests/fixtures/v1/designcraft.json
@@ -0,0 +1,123 @@
+{
+  "uiScale": 1.0,
+  "theme": "dark",
+  "docking": {
+    "root": {
+      "Tabs": {
+        "panels": [
+          "properties",
+          "pages",
+          "layers",
+          "stroke"
+        ],
+        "active": 2
+      }
+    },
+    "floating": [
+      {
+        "panels": [
+          "swatches",
+          "color"
+        ],
+        "active": 1,
+        "rect": [
+          640.0,
+          120.0,
+          280.0,
+          360.0
+        ]
+      }
+    ]
+  },
+  "dockingHidden": {
+    "gradient": {
+      "floating": [
+        640.0,
+        120.0,
+        280.0,
+        360.0
+      ],
+      "anchor": "swatches",
+      "placement": {
+        "Tab": {
+          "before": null
+        }
+      },
+      "size": null,
+      "stack": null,
+      "sibling": []
+    },
+    "effects": {
+      "floating": null,
+      "anchor": "layers",
+      "placement": {
+        "Tab": {
+          "before": "stroke"
+        }
+      },
+      "size": null,
+      "stack": null,
+      "sibling": []
+    }
+  },
+  "customWorkspaces": [
+    {
+      "name": "Print",
+      "docking": {
+        "root": {
+          "Split": {
+            "axis": "Horizontal",
+            "size": {
+              "FixedFirst": 268.0
+            },
+            "first": {
+              "Tabs": {
+                "panels": [
+                  "layers"
+                ],
+                "active": 0
+              }
+            },
+            "second": {
+              "Tabs": {
+                "panels": [
+                  "properties",
+                  "pages"
+                ],
+                "active": 0
+              }
+            }
+          }
+        },
+        "floating": [
+          {
+            "panels": [
+              "swatches"
+            ],
+            "active": 0,
+            "rect": [
+              120.0,
+              160.0,
+              280.0,
+              360.0
+            ]
+          }
+        ]
+      },
+      "dockingHidden": {
+        "stroke": {
+          "floating": null,
+          "anchor": "layers",
+          "placement": {
+            "Tab": {
+              "before": null
+            }
+          },
+          "size": null,
+          "stack": null,
+          "sibling": []
+        }
+      }
+    }
+  ]
+}
diff --git a/crates/ui/tests/fixtures/v1/lightcraft.json b/crates/ui/tests/fixtures/v1/lightcraft.json
new file mode 100644
index 00000000..5b558be6
--- /dev/null
+++ b/crates/ui/tests/fixtures/v1/lightcraft.json
@@ -0,0 +1,67 @@
+{
+  "uiScale": 1.0,
+  "docking": {
+    "layout": {
+      "root": {
+        "Split": {
+          "axis": "Horizontal",
+          "size": {
+            "FixedSecond": 270.0
+          },
+          "first": {
+            "Split": {
+              "axis": "Horizontal",
+              "size": {
+                "FixedFirst": 268.0
+              },
+              "first": {
+                "Tabs": {
+                  "panels": [
+                    "library"
+                  ],
+                  "active": 0
+                }
+              },
+              "second": {
+                "Tabs": {
+                  "panels": [
+                    "canvas"
+                  ],
+                  "active": 0
+                }
+              }
+            }
+          },
+          "second": {
+            "Tabs": {
+              "panels": [
+                "tools"
+              ],
+              "active": 0
+            }
+          }
+        }
+      },
+      "floating": []
+    },
+    "hidden": [
+      [
+        "presets",
+        {
+          "floating": null,
+          "anchor": "canvas",
+          "placement": {
+            "Split": "Right"
+          },
+          "size": {
+            "FixedSecond": 300.0
+          },
+          "stack": null,
+          "sibling": [
+            "canvas"
+          ]
+        }
+      ]
+    ]
+  }
+}
diff --git a/crates/ui/tests/fixtures/v1/pdfcraft.json b/crates/ui/tests/fixtures/v1/pdfcraft.json
new file mode 100644
index 00000000..2951f997
--- /dev/null
+++ b/crates/ui/tests/fixtures/v1/pdfcraft.json
@@ -0,0 +1,51 @@
+{
+  "docking": {
+    "layout": {
+      "root": {
+        "Split": {
+          "axis": "Horizontal",
+          "size": {
+            "FixedFirst": 272.0
+          },
+          "first": {
+            "Tabs": {
+              "panels": [
+                "tools"
+              ],
+              "active": 0
+            }
+          },
+          "second": {
+            "Split": {
+              "axis": "Horizontal",
+              "size": {
+                "FixedSecond": 330.0
+              },
+              "first": {
+                "Tabs": {
+                  "panels": [
+                    "canvas"
+                  ],
+                  "active": 0
+                }
+              },
+              "second": {
+                "Tabs": {
+                  "panels": [
+                    "inspector"
+                  ],
+                  "active": 0
+                }
+              }
+            }
+          }
+        }
+      },
+      "floating": []
+    },
+    "hidden": []
+  },
+  "docking_left_open": true,
+  "docking_right": null,
+  "recent": []
+}
diff --git a/crates/ui/tests/fixtures/v1/photocraft.json b/crates/ui/tests/fixtures/v1/photocraft.json
new file mode 100644
index 00000000..34aed08b
--- /dev/null
+++ b/crates/ui/tests/fixtures/v1/photocraft.json
@@ -0,0 +1,151 @@
+{
+  "docking": {
+    "root": {
+      "Split": {
+        "axis": "Horizontal",
+        "size": {
+          "FixedSecond": 300.0
+        },
+        "first": {
+          "Tabs": {
+            "panels": [
+              "canvas"
+            ],
+            "active": 0
+          }
+        },
+        "second": {
+          "Split": {
+            "axis": "Vertical",
+            "size": {
+              "Ratio": 0.5
+            },
+            "first": {
+              "Tabs": {
+                "panels": [
+                  "layers",
+                  "channels",
+                  "paths"
+                ],
+                "active": 0
+              }
+            },
+            "second": {
+              "Tabs": {
+                "panels": [
+                  "adjustments",
+                  "history"
+                ],
+                "active": 1
+              }
+            }
+          }
+        }
+      }
+    },
+    "floating": [
+      {
+        "panels": [
+          "properties"
+        ],
+        "active": 0,
+        "rect": [
+          120.0,
+          160.0,
+          320.0,
+          440.0
+        ]
+      }
+    ]
+  },
+  "docking_hidden": {
+    "navigator": {
+      "floating": null,
+      "anchor": "layers",
+      "placement": {
+        "Tab": {
+          "before": "channels"
+        }
+      },
+      "size": null,
+      "stack": null,
+      "sibling": []
+    }
+  },
+  "panel_layout": {
+    "docking": {
+      "root": {
+        "Split": {
+          "axis": "Horizontal",
+          "size": {
+            "FixedSecond": 300.0
+          },
+          "first": {
+            "Tabs": {
+              "panels": [
+                "canvas"
+              ],
+              "active": 0
+            }
+          },
+          "second": {
+            "Split": {
+              "axis": "Vertical",
+              "size": {
+                "Ratio": 0.5
+              },
+              "first": {
+                "Tabs": {
+                  "panels": [
+                    "layers",
+                    "channels",
+                    "paths"
+                  ],
+                  "active": 0
+                }
+              },
+              "second": {
+                "Tabs": {
+                  "panels": [
+                    "adjustments",
+                    "history"
+                  ],
+                  "active": 1
+                }
+              }
+            }
+          }
+        }
+      },
+      "floating": [
+        {
+          "panels": [
+            "properties"
+          ],
+          "active": 0,
+          "rect": [
+            120.0,
+            160.0,
+            320.0,
+            440.0
+          ]
+        }
+      ]
+    },
+    "dockingHidden": {
+      "navigator": {
+        "floating": null,
+        "anchor": "layers",
+        "placement": {
+          "Tab": {
+            "before": "channels"
+          }
+        },
+        "size": null,
+        "stack": null,
+        "sibling": []
+      }
+    },
+    "dockingCollapsed": []
+  }
+}
diff --git a/crates/ui/tests/fixtures/v1/soundcraft.json b/crates/ui/tests/fixtures/v1/soundcraft.json
new file mode 100644
index 00000000..51bd013d
--- /dev/null
+++ b/crates/ui/tests/fixtures/v1/soundcraft.json
@@ -0,0 +1,180 @@
+{
+  "docking": {
+    "layout": {
+      "root": {
+        "Split": {
+          "axis": "Vertical",
+          "size": {
+            "FixedSecond": 348.0
+          },
+          "first": {
+            "Split": {
+              "axis": "Horizontal",
+              "size": {
+                "FixedFirst": 168.0
+              },
+              "first": {
+                "Tabs": {
+                  "panels": [
+                    "tracks"
+                  ],
+                  "active": 0
+                }
+              },
+              "second": {
+                "Split": {
+                  "axis": "Horizontal",
+                  "size": {
+                    "FixedSecond": 230.0
+                  },
+                  "first": {
+                    "Tabs": {
+                      "panels": [
+                        "canvas"
+                      ],
+                      "active": 0
+                    }
+                  },
+                  "second": {
+                    "Tabs": {
+                      "panels": [
+                        "clips"
+                      ],
+                      "active": 0
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "second": {
+            "Tabs": {
+              "panels": [
+                "midi"
+              ],
+              "active": 0
+            }
+          }
+        }
+      },
+      "floating": [
+        {
+          "panels": [
+            "memory"
+          ],
+          "active": 0,
+          "rect": [
+            160.0,
+            120.0,
+            480.0,
+            280.0
+          ]
+        },
+        {
+          "panels": [
+            "history"
+          ],
+          "active": 0,
+          "rect": [
+            680.0,
+            120.0,
+            260.0,
+            300.0
+          ]
+        }
+      ]
+    },
+    "hidden": []
+  },
+  "mix_docking": {
+    "layout": {
+      "root": {
+        "Split": {
+          "axis": "Horizontal",
+          "size": {
+            "FixedFirst": 168.0
+          },
+          "first": {
+            "Tabs": {
+              "panels": [
+                "tracks"
+              ],
+              "active": 0
+            }
+          },
+          "second": {
+            "Tabs": {
+              "panels": [
+                "canvas"
+              ],
+              "active": 0
+            }
+          }
+        }
+      },
+      "floating": [
+        {
+          "panels": [
+            "memory"
+          ],
+          "active": 0,
+          "rect": [
+            160.0,
+            120.0,
+            480.0,
+            280.0
+          ]
+        },
+        {
+          "panels": [
+            "history"
+          ],
+          "active": 0,
+          "rect": [
+            680.0,
+            120.0,
+            260.0,
+            300.0
+          ]
+        }
+      ]
+    },
+    "hidden": [
+      [
+        "clips",
+        {
+          "floating": null,
+          "anchor": "canvas",
+          "placement": {
+            "Split": "Right"
+          },
+          "size": {
+            "FixedSecond": 230.0
+          },
+          "stack": null,
+          "sibling": [
+            "canvas"
+          ]
+        }
+      ],
+      [
+        "midi",
+        {
+          "floating": null,
+          "anchor": "tracks",
+          "placement": {
+            "Split": "Bottom"
+          },
+          "size": {
+            "FixedSecond": 348.0
+          },
+          "stack": null,
+          "sibling": [
+            "tracks",
+            "canvas"
+          ]
+        }
+      ]
+    ]
+  }
+}
diff --git a/crates/ui/tests/fixtures/v1/vectorcraft.json b/crates/ui/tests/fixtures/v1/vectorcraft.json
new file mode 100644
index 00000000..d9c25542
--- /dev/null
+++ b/crates/ui/tests/fixtures/v1/vectorcraft.json
@@ -0,0 +1,91 @@
+{
+  "dock_tab": "layers",
+  "docking": {
+    "root": {
+      "Split": {
+        "axis": "Vertical",
+        "size": {
+          "Ratio": 0.625
+        },
+        "first": {
+          "Tabs": {
+            "panels": [
+              "properties",
+              "layers",
+              "libraries"
+            ],
+            "active": 1
+          }
+        },
+        "second": {
+          "Stack": {
+            "entries": [
+              {
+                "panel": "color",
+                "open": true,
+                "height": 180.0
+              },
+              {
+                "panel": "swatches",
+                "open": false,
+                "height": null
+              },
+              {
+                "panel": "stroke",
+                "open": true,
+                "height": null
+              }
+            ]
+          }
+        }
+      }
+    },
+    "floating": [
+      {
+        "panels": [
+          "brushes",
+          "symbols"
+        ],
+        "active": 0,
+        "rect": [
+          200.0,
+          140.0,
+          300.0,
+          400.0
+        ]
+      },
+      {
+        "panels": [
+          "gradient"
+        ],
+        "active": 0,
+        "rect": [
+          540.0,
+          180.0,
+          260.0,
+          320.0
+        ]
+      }
+    ]
+  },
+  "docking_hidden": {
+    "patternOptions": {
+      "floating": null,
+      "anchor": "color",
+      "placement": {
+        "Tab": {
+          "before": "swatches"
+        }
+      },
+      "size": null,
+      "stack": [
+        true,
+        240.0
+      ],
+      "sibling": []
+    }
+  },
+  "docking_icons": [
+    "stroke"
+  ]
+}
diff --git a/crates/ui/tests/fonts/NotoSans-test.ttf b/crates/ui/tests/fonts/NotoSans-test.ttf
new file mode 100644
index 00000000..0b088427
Binary files /dev/null and b/crates/ui/tests/fonts/NotoSans-test.ttf differ
diff --git a/crates/ui/tests/fonts/NotoSansArabic-screens.ttf b/crates/ui/tests/fonts/NotoSansArabic-screens.ttf
new file mode 100644
index 00000000..a0c53c96
Binary files /dev/null and b/crates/ui/tests/fonts/NotoSansArabic-screens.ttf differ
diff --git a/crates/ui/tests/fonts/NotoSansArabic-test.ttf b/crates/ui/tests/fonts/NotoSansArabic-test.ttf
new file mode 100644
index 00000000..0823e4a4
Binary files /dev/null and b/crates/ui/tests/fonts/NotoSansArabic-test.ttf differ
diff --git a/crates/ui/tests/fonts/NotoSansCJKsc-screens.otf b/crates/ui/tests/fonts/NotoSansCJKsc-screens.otf
new file mode 100644
index 00000000..092a6a02
Binary files /dev/null and b/crates/ui/tests/fonts/NotoSansCJKsc-screens.otf differ
diff --git a/crates/ui/tests/fonts/NotoSansCJKsc-test.otf b/crates/ui/tests/fonts/NotoSansCJKsc-test.otf
new file mode 100644
index 00000000..d6e8d407
Binary files /dev/null and b/crates/ui/tests/fonts/NotoSansCJKsc-test.otf differ
diff --git a/crates/ui/tests/fonts/NotoSansSymbols-test.ttf b/crates/ui/tests/fonts/NotoSansSymbols-test.ttf
new file mode 100644
index 00000000..9b26322b
Binary files /dev/null and b/crates/ui/tests/fonts/NotoSansSymbols-test.ttf differ
diff --git a/crates/ui/tests/fonts/NotoSansSymbols2-test.ttf b/crates/ui/tests/fonts/NotoSansSymbols2-test.ttf
new file mode 100644
index 00000000..0458a26f
Binary files /dev/null and b/crates/ui/tests/fonts/NotoSansSymbols2-test.ttf differ
diff --git a/crates/ui/tests/fonts/NotoSansThai-screens.ttf b/crates/ui/tests/fonts/NotoSansThai-screens.ttf
new file mode 100644
index 00000000..a9957d88
Binary files /dev/null and b/crates/ui/tests/fonts/NotoSansThai-screens.ttf differ
diff --git a/crates/ui/tests/fonts_render.rs b/crates/ui/tests/fonts_render.rs
new file mode 100644
index 00000000..85a24e01
--- /dev/null
+++ b/crates/ui/tests/fonts_render.rs
@@ -0,0 +1,62 @@
+//! A CJK and an Arabic label draw with the shared UI font stack and no system fonts.
+//!
+//! The kittest harness panics on any character no installed face can draw, so these tests fail
+//! on a replacement box ("tofu") rather than passing a snapshot nobody looks at.
+
+use craft_ui::fonts::{CraftFace, I18nScripts, SystemFonts, UiFonts};
+use egui::{FontDefinitions, FontFamily};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable as _;
+
+const ARABIC: CraftFace =
+    CraftFace { family: "Noto Sans Arabic", style: "Regular", scripts: &["Arab"], bytes: include_bytes!("fonts/NotoSansArabic-test.ttf"), index: 0 };
+const CJK: CraftFace = CraftFace {
+    family: "Noto Sans CJK SC",
+    style: "Regular",
+    scripts: &["Hans", "Latn"],
+    bytes: include_bytes!("fonts/NotoSansCJKsc-test.otf"),
+    index: 0,
+};
+
+const LABELS: [&str; 3] = ["Files", "日本語のファイル", "ملف عربي"];
+
+fn harness(ui_language: &'static str, faces: &'static [CraftFace]) -> Harness<'static> {
+    Harness::builder()
+        .with_size([240.0, 120.0])
+        .with_context_setup(move |ctx| {
+            let defaults = FontDefinitions::default();
+            let mut fonts =
+                UiFonts::new(&I18nScripts).craft_faces(faces).languages(&["en", "ar", "ja"]).ui_language(ui_language).system_fonts(SystemFonts::Off);
+            if let Some(ubuntu) = defaults.font_data.get("Ubuntu-Light") {
+                fonts = fonts.app_face("ui", (**ubuntu).clone(), &[FontFamily::Proportional]);
+            }
+            fonts.install(ctx);
+        })
+        .build_ui(|ui| {
+            for label in LABELS {
+                ui.label(label);
+            }
+        })
+}
+
+#[test]
+fn fonts_draw_cjk_and_arabic_labels_without_replacement_boxes() {
+    for ui_language in ["en", "ar", "ja"] {
+        let mut harness = harness(ui_language, &[ARABIC, CJK]);
+        harness.run();
+        for label in LABELS {
+            assert!(harness.query_by_label(label).is_some(), "{ui_language}: {label} not shown");
+        }
+        let image = harness.render().expect("render");
+        let background = *image.get_pixel(image.width() - 1, image.height() - 1);
+        let drawn = image.pixels().filter(|p| **p != background).count();
+        assert!(drawn > 500, "{ui_language}: only {drawn} pixels drawn");
+    }
+}
+
+/// Without the Arabic face, an Arabic character (U+06xx) has no glyph.
+#[test]
+#[should_panic(expected = "(U+06")]
+fn fonts_without_an_arabic_face_fail() {
+    harness("en", &[CJK]).run();
+}
diff --git a/crates/ui/tests/screens.rs b/crates/ui/tests/screens.rs
new file mode 100644
index 00000000..20016b14
--- /dev/null
+++ b/crates/ui/tests/screens.rs
@@ -0,0 +1,98 @@
+//! A rename dialog in the six test languages: the example of `craft_ui::testing` for app tests.
+//!
+//! The snapshots are in `tests/snapshots/rename-*.png`; `UPDATE_SNAPSHOTS=1` rewrites them.
+
+use craft_ui::fonts::CraftFace;
+use craft_ui::testing::{JAPANESE, KOREAN, Locale, Screens, compose};
+use egui::accesskit::Role;
+use egui::{FontData, FontFamily, Ui};
+use egui_kittest::kittest::Queryable as _;
+
+const ARABIC: CraftFace = CraftFace {
+    family: "Noto Sans Arabic",
+    style: "Regular",
+    scripts: &["Arab"],
+    bytes: include_bytes!("fonts/NotoSansArabic-screens.ttf"),
+    index: 0,
+};
+// The subset has the dialog's kana, Han and Hangul, so it stands in for every CJK face. Its Latin
+// glyphs, Vietnamese included, are the app's UI face: egui's default face has no Vietnamese.
+const CJK: CraftFace = CraftFace {
+    family: "Noto Sans CJK SC",
+    style: "Regular",
+    scripts: &["Jpan", "Kore", "Hans", "Hant"],
+    bytes: include_bytes!("fonts/NotoSansCJKsc-screens.otf"),
+    index: 0,
+};
+const THAI: CraftFace =
+    CraftFace { family: "Noto Sans Thai", style: "Regular", scripts: &["Thai"], bytes: include_bytes!("fonts/NotoSansThai-screens.ttf"), index: 0 };
+
+struct Strings {
+    title: &'static str,
+    name: &'static str,
+    file: &'static str,
+    keep: &'static str,
+    cancel: &'static str,
+    rename: &'static str,
+}
+
+fn strings(language: &str) -> Strings {
+    let [title, name, file, keep, cancel, rename] = match language {
+        "ar" => ["إعادة تسمية الملف", "الاسم", "تقرير ٢٠٢٦.pdf", "الإبقاء على الامتداد", "إلغاء", "إعادة التسمية"],
+        "ja" => ["ファイル名を変更", "名前", "報告書 2026.pdf", "拡張子を保持", "キャンセル", "変更"],
+        "zh-TW" => ["重新命名檔案", "名稱", "報告 2026.pdf", "保留副檔名", "取消", "重新命名"],
+        "ko" => ["파일 이름 바꾸기", "이름", "보고서 2026.pdf", "확장자 유지", "취소", "이름 바꾸기"],
+        "th" => ["เปลี่ยนชื่อไฟล์", "ชื่อ", "รายงาน 2026.pdf", "เก็บนามสกุลไฟล์", "ยกเลิก", "เปลี่ยนชื่อ"],
+        "vi" => ["Đổi tên tệp", "Tên", "Báo cáo 2026.pdf", "Giữ phần mở rộng", "Hủy", "Đổi tên"],
+        _ => ["Rename file", "Name", "Report 2026.pdf", "Keep extension", "Cancel", "Rename"],
+    };
+    Strings { title, name, file, keep, cancel, rename }
+}
+
+struct Dialog {
+    file: String,
+    keep: bool,
+}
+
+impl Dialog {
+    fn new(locale: &Locale) -> Self {
+        Self { file: strings(locale.language).file.to_owned(), keep: true }
+    }
+
+    fn ui(&mut self, ui: &mut Ui, locale: &Locale) {
+        let text = strings(locale.language);
+        ui.heading(text.title);
+        ui.horizontal(|ui| {
+            let label = ui.label(text.name);
+            ui.text_edit_singleline(&mut self.file).labelled_by(label.id);
+        });
+        ui.checkbox(&mut self.keep, text.keep);
+        ui.horizontal(|ui| {
+            _ = ui.button(text.rename);
+            _ = ui.button(text.cancel);
+        });
+    }
+}
+
+fn screens() -> Screens {
+    Screens::new("rename")
+        .size([320.0, 150.0])
+        .fonts(|fonts| fonts.app_face("ui", FontData::from_static(CJK.bytes), &[FontFamily::Proportional]).craft_faces(&[ARABIC, CJK, THAI]))
+}
+
+#[test]
+fn testing_rename_dialog_snapshots() {
+    screens().snapshots(|ui, locale| Dialog::new(locale).ui(ui, locale));
+}
+
+#[test]
+fn testing_rename_dialog_takes_ime_input() {
+    for (language, composition) in [("ko", KOREAN), ("ja", JAPANESE)] {
+        let dialog = Dialog { file: String::new(), keep: true };
+        let mut harness = screens().harness_state(language, |ui, locale, dialog: &mut Dialog| dialog.ui(ui, locale), dialog);
+        harness.get_by_role(Role::TextInput).focus();
+        harness.run();
+        compose(&mut harness, &composition);
+        assert_eq!(harness.state().file, composition.commit, "{language}");
+    }
+}
diff --git a/crates/ui/tests/snapshots/.gitignore b/crates/ui/tests/snapshots/.gitignore
new file mode 100644
index 00000000..a7b82c9a
--- /dev/null
+++ b/crates/ui/tests/snapshots/.gitignore
@@ -0,0 +1,3 @@
+*.new.png
+*.diff.png
+*.old.png
diff --git a/crates/ui/tests/snapshots/rename-ar.png b/crates/ui/tests/snapshots/rename-ar.png
new file mode 100644
index 00000000..32529767
Binary files /dev/null and b/crates/ui/tests/snapshots/rename-ar.png differ
diff --git a/crates/ui/tests/snapshots/rename-ja.png b/crates/ui/tests/snapshots/rename-ja.png
new file mode 100644
index 00000000..88f911a6
Binary files /dev/null and b/crates/ui/tests/snapshots/rename-ja.png differ
diff --git a/crates/ui/tests/snapshots/rename-ko.png b/crates/ui/tests/snapshots/rename-ko.png
new file mode 100644
index 00000000..f9c0f376
Binary files /dev/null and b/crates/ui/tests/snapshots/rename-ko.png differ
diff --git a/crates/ui/tests/snapshots/rename-th.png b/crates/ui/tests/snapshots/rename-th.png
new file mode 100644
index 00000000..a28d9980
Binary files /dev/null and b/crates/ui/tests/snapshots/rename-th.png differ
diff --git a/crates/ui/tests/snapshots/rename-vi.png b/crates/ui/tests/snapshots/rename-vi.png
new file mode 100644
index 00000000..c375838e
Binary files /dev/null and b/crates/ui/tests/snapshots/rename-vi.png differ
diff --git a/crates/ui/tests/snapshots/rename-zh-TW.png b/crates/ui/tests/snapshots/rename-zh-TW.png
new file mode 100644
index 00000000..6ccc1bd0
Binary files /dev/null and b/crates/ui/tests/snapshots/rename-zh-TW.png differ
diff --git a/crates/ui/tests/web/serve_fonts.py b/crates/ui/tests/web/serve_fonts.py
new file mode 100644
index 00000000..bdab5a57
--- /dev/null
+++ b/crates/ui/tests/web/serve_fonts.py
@@ -0,0 +1,47 @@
+"""Serve crates/ui/tests/fonts on 127.0.0.1 for the web_fonts browser test.
+
+    python3 crates/ui/tests/web/serve_fonts.py [port]   # default 8137
+
+/fonts/<file> serves the file. /flaky/<file> answers 503 the first time and serves the file after.
+Other paths answer 404. /log lists the paths requested so far, as JSON.
+"""
+
+import http.server
+import json
+import pathlib
+import sys
+
+FONTS = pathlib.Path(__file__).resolve().parent.parent / "fonts"
+requested = []
+failed_once = set()
+
+
+class Handler(http.server.BaseHTTPRequestHandler):
+    def do_GET(self):
+        if self.path == "/log":
+            return self.reply(200, json.dumps(requested).encode(), "application/json")
+        requested.append(self.path)
+        kind, _, name = self.path.lstrip("/").partition("/")
+        file = FONTS / name
+        if kind == "flaky" and self.path not in failed_once:
+            failed_once.add(self.path)
+            return self.reply(503, b"", "text/plain")
+        if kind in ("fonts", "flaky") and "/" not in name and file.is_file():
+            return self.reply(200, file.read_bytes(), "font/ttf")
+        self.reply(404, b"", "text/plain")
+
+    def reply(self, status, body, content_type):
+        self.send_response(status)
+        self.send_header("Content-Type", content_type)
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Access-Control-Allow-Origin", "*")
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, *args):
+        pass
+
+
+port = int(sys.argv[1]) if len(sys.argv) > 1 else 8137
+http.server.ThreadingHTTPServer(("127.0.0.1", port), Handler).serve_forever()
diff --git a/crates/ui/tests/web_fonts.rs b/crates/ui/tests/web_fonts.rs
new file mode 100644
index 00000000..9caeef72
--- /dev/null
+++ b/crates/ui/tests/web_fonts.rs
@@ -0,0 +1,103 @@
+//! Served faces in a browser: a character no installed face has fetches the one served face that
+//! has it, a character no served face has fetches nothing, and a failed face is fetched again
+//! later.
+//!
+//! Start `tests/web/serve_fonts.py` (127.0.0.1:8137; another address through
+//! `CRAFT_UI_FONT_SERVER` when building), then run
+//!
+//! ```text
+//! cargo test -p craft-ui --target wasm32-unknown-unknown --test web_fonts
+//! ```
+//!
+//! with `wasm-bindgen-test-runner` as the target's runner: headless through a WebDriver, or with
+//! `NO_HEADLESS=1`, which serves the test page for any browser to open.
+#![cfg(target_arch = "wasm32")]
+
+use craft_ui::fonts::{I18nScripts, ServedFace, SystemFonts, UiFonts};
+use egui::{FontDefinitions, FontFamily, FontId};
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen_futures::JsFuture;
+use wasm_bindgen_test::{wasm_bindgen_test, wasm_bindgen_test_configure};
+
+wasm_bindgen_test_configure!(run_in_browser);
+
+fn url(path: &str) -> &'static str {
+    let server = option_env!("CRAFT_UI_FONT_SERVER").unwrap_or("http://127.0.0.1:8137");
+    Box::leak(format!("{server}{path}").into_boxed_str())
+}
+
+fn face(family: &'static str, scripts: &'static [&'static str], path: &str, coverage: Vec<u8>) -> ServedFace {
+    ServedFace { family, style: "Regular", scripts, index: 0, url: url(path), size: 0, integrity: "", coverage: coverage.leak() }
+}
+
+fn coverage_of(font: &[u8]) -> Vec<u8> {
+    craft_fonts_build::coverage::of_face(font, 0).expect("a font")
+}
+
+async fn sleep(millis: i32) {
+    let promise = js_sys::Promise::new(&mut |resolve, _| {
+        let window = web_sys::window().expect("a browser window");
+        window.set_timeout_with_callback_and_timeout_and_arguments_0(&resolve, millis).expect("setTimeout");
+    });
+    JsFuture::from(promise).await.expect("a timer");
+}
+
+/// Run passes until the context draws `c`, for up to `seconds`.
+async fn draws_within(ctx: &egui::Context, c: char, seconds: f64) -> bool {
+    let start = js_sys::Date::now();
+    loop {
+        ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
+        if ctx.fonts_mut(|f| f.has_glyph(&FontId::proportional(14.0), c)) {
+            return true;
+        }
+        if js_sys::Date::now() - start > seconds * 1000.0 {
+            return false;
+        }
+        sleep(50).await;
+    }
+}
+
+/// The paths the font server was asked for, in order.
+async fn requested() -> Vec<String> {
+    let window = web_sys::window().expect("a browser window");
+    let response: web_sys::Response = JsFuture::from(window.fetch_with_str(url("/log"))).await.expect("the font server").unchecked_into();
+    let paths = JsFuture::from(response.json().expect("JSON")).await.expect("JSON");
+    js_sys::Array::from(&paths).iter().filter_map(|path| path.as_string()).collect()
+}
+
+#[wasm_bindgen_test]
+async fn a_missing_character_fetches_the_face_that_has_it_and_a_failed_one_is_retried() {
+    let encode = craft_fonts_build::coverage::encode;
+    let served = [
+        face("Noto Sans", &["Latn", "Cyrl", "Grek", "Deva"], "/fonts/NotoSans-test.ttf", coverage_of(include_bytes!("fonts/NotoSans-test.ttf"))),
+        face("Noto Color Emoji", &["Zsye"], "/missing/NotoColorEmoji.ttf", encode(&[(0x1F300, 0x1FAFF)])),
+        // ⌃ ⎋, and ⌥ ⌫ ⏎: the keyboard keys are split between the two symbol faces.
+        face("Noto Sans Symbols", &["Zsym"], "/fonts/NotoSansSymbols-test.ttf", coverage_of(include_bytes!("fonts/NotoSansSymbols-test.ttf"))),
+        // Fails the first time.
+        face("Noto Sans Symbols 2", &["Zsym"], "/flaky/NotoSansSymbols2-test.ttf", coverage_of(include_bytes!("fonts/NotoSansSymbols2-test.ttf"))),
+        face("Noto Sans Math", &["Zmth", "Zsym"], "/missing/NotoSansMath-Regular.ttf", encode(&[(0x2200, 0x22FF)])),
+    ];
+    let defaults = FontDefinitions::default();
+    let ubuntu = (**defaults.font_data.get("Ubuntu-Light").expect("egui default_fonts")).clone();
+    let ctx = egui::Context::default();
+    UiFonts::new(&I18nScripts)
+        .app_face("ui", ubuntu, &[FontFamily::Proportional])
+        .served_faces(&served)
+        .ui_language("en")
+        .system_fonts(SystemFonts::Off)
+        .stack()
+        .install(&ctx);
+
+    assert!(draws_within(&ctx, 'ổ', 5.0).await, "Vietnamese from Noto Sans");
+    assert!(draws_within(&ctx, '⌃', 5.0).await, "a key from Noto Sans Symbols");
+    // Only Symbols 2 has ⌥: it fails, and is fetched again after two seconds.
+    assert!(draws_within(&ctx, '⌥', 10.0).await, "a key from Noto Sans Symbols 2 after a failure");
+    assert!(draws_within(&ctx, '⌫', 1.0).await);
+    // No face has ẫ.
+    assert!(!draws_within(&ctx, 'ẫ', 1.0).await);
+    assert_eq!(
+        requested().await,
+        ["/fonts/NotoSans-test.ttf", "/fonts/NotoSansSymbols-test.ttf", "/flaky/NotoSansSymbols2-test.ttf", "/flaky/NotoSansSymbols2-test.ttf"],
+        "each character fetches only the face that has it",
+    );
+}
diff --git a/crates/update/Cargo.toml b/crates/update/Cargo.toml
new file mode 100644
index 00000000..39934748
--- /dev/null
+++ b/crates/update/Cargo.toml
@@ -0,0 +1,45 @@
+[package]
+name = "craft-update"
+description = "Release checking, downloading, installing and self-updating for the Craft App Suite and ArtCraft Launcher"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+
+[lints]
+workspace = true
+
+[features]
+default = []
+egui = ["dep:egui"]
+local-mirror = []
+
+[dependencies]
+egui = { workspace = true, optional = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+log = "0.4"
+getrandom = "0.3"
+tempfile = "3"
+sha2 = "0.10"
+ureq = { version = "3.4", default-features = false, features = ["rustls-no-provider", "_ring", "gzip", "platform-verifier"] }
+chrono = { workspace = true }
+semver = { version = "1", features = ["serde"] }
+
+[dev-dependencies]
+flate2 = "1"
+
+[target.'cfg(unix)'.dependencies]
+flate2 = "1"
+tar = { version = "0.4", default-features = false }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+plist = "1"
+
+[target.'cfg(target_os = "windows")'.dependencies]
+winreg = "0.55"
+dunce = "1"
+zip = { version = "9", default-features = false, features = ["deflate"] }
+winsafe = { version = "0.0.29", features = ["advapi", "kernel", "shell", "version"] }
+verifysign = "1"
diff --git a/crates/update/src/app.rs b/crates/update/src/app.rs
new file mode 100644
index 00000000..c5e0ce25
--- /dev/null
+++ b/crates/update/src/app.rs
@@ -0,0 +1,75 @@
+//! Which app an installer or an update works on.
+
+/// A Craft App, as its releases and installers know it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct App {
+    /// Machine name: repo, binary, package and asset stem (`photocraft`).
+    pub id: &'static str,
+    /// Display name (`PhotoCraft`).
+    pub name: &'static str,
+    /// What it's for, in a few words (English). Written into the menu entries installers add.
+    pub tagline: &'static str,
+    /// GitHub `owner/repo`. Releases are only ever downloaded from this repository.
+    pub repo: &'static str,
+    /// Older names its release assets may carry (PdfCraft shipped as PrintCraft until 0.2.1).
+    pub former_ids: &'static [&'static str],
+    /// Older display names its installers registered (PdfCraft's MSI said PrintCraft until 0.2.1).
+    pub former_names: &'static [&'static str],
+    /// Its 128 px PNG icon, for the menu entry written beside an AppImage. `None`: no icon.
+    pub icon_png: Option<&'static [u8]>,
+}
+
+impl App {
+    /// An app with no former names and no icon.
+    pub const fn new(id: &'static str, name: &'static str, tagline: &'static str, repo: &'static str) -> Self {
+        Self { id, name, tagline, repo, former_ids: &[], former_names: &[], icon_png: None }
+    }
+
+    /// `ai.storyteller.<id>`: macOS bundle id, Flatpak id and Linux desktop-file id.
+    pub fn bundle_id(&self) -> String {
+        format!("ai.storyteller.{}", self.id)
+    }
+
+    pub fn releases_url(&self) -> String {
+        format!("https://github.com/{}/releases", self.repo)
+    }
+
+    pub fn repo_url(&self) -> String {
+        format!("https://github.com/{}", self.repo)
+    }
+
+    /// The app's page on getartcraft.com.
+    pub fn website(&self) -> String {
+        format!("https://getartcraft.com/apps/{}", self.id)
+    }
+
+    /// Asset stems this app's releases may use, current first.
+    pub fn stems(&self) -> impl Iterator<Item = &'static str> + '_ {
+        std::iter::once(self.id).chain(self.former_ids.iter().copied())
+    }
+
+    /// Display names this app's installers may have registered, current first.
+    pub fn names(&self) -> impl Iterator<Item = &'static str> + '_ {
+        std::iter::once(self.name).chain(self.former_names.iter().copied())
+    }
+
+    /// Looks up an app in the Craft App Suite catalog by its id.
+    pub fn by_id(id: &str) -> Option<&'static App> {
+        crate::suite::by_id(id)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn former_names_follow_the_current_one() {
+        let pdf =
+            App { former_ids: &["printcraft"], former_names: &["PrintCraft"], ..App::new("pdfcraft", "PdfCraft", "PDFs", "storytold/pdfcraft") };
+        assert_eq!(pdf.stems().collect::<Vec<_>>(), ["pdfcraft", "printcraft"]);
+        assert_eq!(pdf.names().collect::<Vec<_>>(), ["PdfCraft", "PrintCraft"]);
+        assert_eq!(pdf.bundle_id(), "ai.storyteller.pdfcraft");
+        assert_eq!(pdf.releases_url(), "https://github.com/storytold/pdfcraft/releases");
+    }
+}
diff --git a/crates/update/src/desktop_entry.rs b/crates/update/src/desktop_entry.rs
new file mode 100644
index 00000000..d6639bef
--- /dev/null
+++ b/crates/update/src/desktop_entry.rs
@@ -0,0 +1,186 @@
+//! Menu entries (freedesktop `.desktop` files) for AppImages the launcher installs.
+//!
+//! An AppImage installs nothing by itself, so without an entry the app is missing from the
+//! desktop's menu and, on Wayland, the dock can't match the window's app id to an icon. The
+//! launcher writes `<data>/applications/ai.storyteller.<app>.desktop` (the id each app's window
+//! reports) and marks it as its own, so it only ever replaces or removes entries it wrote.
+//!
+//! The text is built by pure functions, tested on every platform; only Linux writes the files.
+
+#![cfg_attr(not(target_os = "linux"), allow(dead_code))]
+
+use std::path::Path;
+
+use crate::App;
+
+/// The key that marks an entry as written by the launcher.
+pub const MARKER: &str = "X-ArtCraft-Launcher=true";
+
+/// The menu categories and the window class each app's own `.desktop` file declares.
+pub fn meta(app: &App) -> (&'static str, Option<&'static str>) {
+    match app.id {
+        "photocraft" => ("Graphics;2DGraphics;RasterGraphics;Photography;", Some("photocraft")),
+        "pdfcraft" => ("Office;Viewer;", Some("pdfcraft")),
+        "lightcraft" => ("Graphics;2DGraphics;RasterGraphics;Photography;", None),
+        "filmcraft" => ("AudioVideo;Video;AudioVideoEditing;", None),
+        "designcraft" => ("Graphics;Publishing;", None),
+        "vectorcraft" => ("Graphics;2DGraphics;VectorGraphics;", None),
+        "effectcraft" => ("AudioVideo;Video;Graphics;2DGraphics;", None),
+        "wordcraft" => ("Office;WordProcessor;", None),
+        "deckcraft" => ("Office;Presentation;", None),
+        "gridcraft" => ("Office;Spreadsheet;", None),
+        "cadcraft" => ("Graphics;Engineering;VectorGraphics;", None),
+        "soundcraft" => ("AudioVideo;Audio;Midi;Mixer;Sequencer;Recorder;", None),
+        "figcraft" => ("Graphics;2DGraphics;VectorGraphics;X-Design;", Some("figcraft")),
+        _ => ("Graphics;", None),
+    }
+}
+
+/// `path` as one quoted argument of an `Exec=` key, per the Desktop Entry spec: inside double
+/// quotes `"`, `` ` ``, `$` and `\` take a backslash, then the string-value rule doubles every
+/// backslash, and `%` (field codes) is written `%%`. `None` for paths that can't be written
+/// safely (not UTF-8, holding a control character such as a line break, or holding `=`, which the
+/// spec forbids in the executable name or path even when quoted).
+pub fn exec_quote(path: &Path) -> Option<String> {
+    let s = path.to_str()?;
+    if s.chars().any(|c| c.is_control() || c == '=') {
+        return None;
+    }
+    let mut out = String::with_capacity(s.len() + 2);
+    out.push('"');
+    for c in s.chars() {
+        match c {
+            '"' | '`' | '$' => {
+                out.push_str("\\\\");
+                out.push(c);
+            }
+            '\\' => out.push_str("\\\\\\\\"),
+            '%' => out.push_str("%%"),
+            c => out.push(c),
+        }
+    }
+    out.push('"');
+    Some(out)
+}
+
+/// A localestring/string value: backslashes and line breaks escaped.
+fn value(s: &str) -> String {
+    s.replace('\\', "\\\\").replace('\n', "\\n").replace('\r', "\\r").replace('\t', "\\t")
+}
+
+/// The entry for `app` installed as the AppImage `appimage`; `icon` when its icon is installed
+/// under the app's id. `None` when the path can't be put in an `Exec=` line.
+pub fn render(app: &App, appimage: &Path, icon: bool) -> Option<String> {
+    let exec = exec_quote(appimage)?;
+    let (categories, wm_class) = meta(app);
+    let mut text = String::from("[Desktop Entry]\nType=Application\n");
+    text.push_str(&format!("Name={}\n", value(app.name)));
+    text.push_str(&format!("Comment={}\n", value(app.tagline)));
+    text.push_str(&format!("Exec={exec} %F\n"));
+    if icon {
+        text.push_str(&format!("Icon={}\n", app.bundle_id()));
+    }
+    text.push_str("Terminal=false\n");
+    text.push_str(&format!("Categories={categories}\n"));
+    text.push_str(&format!("StartupWMClass={}\n", wm_class.map_or_else(|| app.bundle_id(), str::to_string)));
+    text.push_str(MARKER);
+    text.push('\n');
+    Some(text)
+}
+
+/// Whether the launcher wrote this entry.
+pub fn is_ours(text: &str) -> bool {
+    text.lines().any(|l| l.trim() == MARKER)
+}
+
+/// The program an entry's `Exec=` runs: its first argument, unquoted. Reads the launcher's own
+/// quoting and the plain `Exec="<path>" %F` the apps' AppImages write for themselves.
+pub fn exec_program(text: &str) -> Option<String> {
+    let line = text.lines().find_map(|l| l.strip_prefix("Exec="))?;
+    // String-value escapes first, then the quoting rule.
+    let mut unescaped = String::with_capacity(line.len());
+    let mut chars = line.chars();
+    while let Some(c) = chars.next() {
+        if c == '\\' {
+            match chars.next() {
+                Some('s') => unescaped.push(' '),
+                Some('n') => unescaped.push('\n'),
+                Some('t') => unescaped.push('\t'),
+                Some('r') => unescaped.push('\r'),
+                Some(other) => unescaped.push(other),
+                None => unescaped.push('\\'),
+            }
+        } else {
+            unescaped.push(c);
+        }
+    }
+    let mut out = String::new();
+    let mut chars = unescaped.trim_start().chars();
+    if unescaped.trim_start().starts_with('"') {
+        chars.next();
+        loop {
+            match chars.next()? {
+                '"' => break,
+                '\\' => out.push(chars.next()?),
+                c => out.push(c),
+            }
+        }
+    } else {
+        out.extend(chars.take_while(|c| !c.is_whitespace()));
+    }
+    Some(out.replace("%%", "%"))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::PathBuf;
+
+    use super::*;
+
+    fn app(id: &str) -> &'static App {
+        App::by_id(id).unwrap()
+    }
+
+    #[test]
+    fn writes_a_complete_entry() {
+        let text = render(app("photocraft"), Path::new("/home/ana/Applications/photocraft-0.6.0-linux-x86_64.AppImage"), true).unwrap();
+        let expected = format!(
+            "[Desktop Entry]\nType=Application\nName=PhotoCraft\nComment={}\n\
+             Exec=\"/home/ana/Applications/photocraft-0.6.0-linux-x86_64.AppImage\" %F\n\
+             Icon=ai.storyteller.photocraft\nTerminal=false\nCategories=Graphics;2DGraphics;RasterGraphics;Photography;\n\
+             StartupWMClass=photocraft\nX-ArtCraft-Launcher=true\n",
+            app("photocraft").tagline
+        );
+        assert_eq!(text, expected);
+        assert!(is_ours(&text));
+        let no_icon = render(app("wordcraft"), Path::new("/x/w.AppImage"), false).unwrap();
+        assert!(!no_icon.contains("Icon="));
+        assert!(no_icon.contains("StartupWMClass=ai.storyteller.wordcraft\n"));
+        assert!(no_icon.contains("Categories=Office;WordProcessor;\n"));
+    }
+
+    #[test]
+    fn quotes_exec_paths_per_the_spec() {
+        assert_eq!(exec_quote(Path::new("/home/ana/My Apps/p.AppImage")).unwrap(), "\"/home/ana/My Apps/p.AppImage\"");
+        assert_eq!(exec_quote(Path::new("/a/\"q\" $HOME `x`.AppImage")).unwrap(), r#""/a/\\"q\\" \\$HOME \\`x\\`.AppImage""#);
+        assert_eq!(exec_quote(Path::new(r"/a\b/100%.AppImage")).unwrap(), r#""/a\\\\b/100%%.AppImage""#);
+        assert_eq!(exec_quote(Path::new("/a/line\nbreak.AppImage")), None);
+        // The spec forbids `=` in the executable name or path, even quoted.
+        assert_eq!(exec_quote(Path::new("/opt/artcraft=beta/app")), None);
+        assert!(render(app("photocraft"), Path::new("/a/line\nbreak.AppImage"), true).is_none());
+    }
+
+    #[test]
+    fn reads_back_the_program_it_wrote_and_the_apps_own_entries() {
+        for p in ["/home/ana/My Apps/p.AppImage", "/a/\"q\" $HOME `x`.AppImage", r"/a\b/100%.AppImage", "/plain.AppImage"] {
+            let text = render(app("gridcraft"), Path::new(p), false).unwrap();
+            assert_eq!(exec_program(&text).map(PathBuf::from), Some(PathBuf::from(p)), "{p}");
+        }
+        // PhotoCraft's AppRun writes its own entry, unmarked.
+        let theirs = "[Desktop Entry]\nName=PhotoCraft\nExec=\"/home/ana/Applications/photocraft-0.5.0-linux-x86_64.AppImage\" %F\n";
+        assert_eq!(exec_program(theirs).as_deref(), Some("/home/ana/Applications/photocraft-0.5.0-linux-x86_64.AppImage"));
+        assert!(!is_ours(theirs));
+        assert_eq!(exec_program("[Desktop Entry]\nExec=photocraft %F\n").as_deref(), Some("photocraft"));
+        assert_eq!(exec_program("[Desktop Entry]\nName=x\n"), None);
+    }
+}
diff --git a/crates/update/src/detect.rs b/crates/update/src/detect.rs
new file mode 100644
index 00000000..437e315d
--- /dev/null
+++ b/crates/update/src/detect.rs
@@ -0,0 +1,777 @@
+//! Finding Craft Apps that are already installed, however they got there.
+//!
+//! - macOS: `<App>.app` in `/Applications` or `~/Applications`, read from its `Info.plist`.
+//! - Windows: the Windows Installer's uninstall entries (`Learning Machines LLC`), and portable
+//!   copies the launcher unpacked.
+//! - Linux: AppImages in `~/Applications` (where the launcher and AppImageLauncher put them),
+//!   `~/AppImages` (Gear Lever) and `~/.local/bin`, Debian/RPM packages, Flatpaks, and tarball
+//!   installs.
+//! - FreeBSD: tarball installs and `/usr/local/bin/<app>`.
+
+use std::path::{Path, PathBuf};
+
+use crate::{App, InstallSource, Installed, version};
+
+use crate::manifest::Manifest;
+
+/// One look at the system, shared by every app's detection (package lists are read once).
+#[derive(Default)]
+pub struct Snapshot {
+    #[allow(dead_code)]
+    packages: Vec<crate::packages::Package>,
+}
+
+impl Snapshot {
+    pub fn take() -> Self {
+        #[cfg(target_os = "linux")]
+        {
+            Self { packages: linux::packages() }
+        }
+        #[cfg(not(target_os = "linux"))]
+        {
+            Self::default()
+        }
+    }
+}
+
+/// What's installed of `app`, best source first.
+pub fn detect(app: &App, manifest: &Manifest, snapshot: &Snapshot) -> Option<Installed> {
+    let _ = snapshot;
+    if let Some(found) = from_manifest(app, manifest) {
+        return Some(found);
+    }
+    #[cfg(target_os = "macos")]
+    return macos::detect(app);
+    #[cfg(windows)]
+    return windows::detect(app);
+    #[cfg(target_os = "linux")]
+    return linux::detect(app, snapshot);
+    #[cfg(target_os = "freebsd")]
+    return freebsd::detect(app);
+    #[allow(unreachable_code)]
+    None
+}
+
+fn from_manifest(app: &App, manifest: &Manifest) -> Option<Installed> {
+    let rec = manifest.apps.get(app.id)?;
+    if !rec.path.exists() {
+        return None;
+    }
+    // On macOS the bundle itself is the truth (the app may have updated itself).
+    #[cfg(target_os = "macos")]
+    if rec.kind == crate::PackageKind::Dmg {
+        return macos::read_bundle(app, &rec.path);
+    }
+    Some(Installed {
+        version: version::parse(&rec.version),
+        source: InstallSource::Launcher,
+        location: rec.path.display().to_string(),
+        package: None,
+    })
+}
+
+/// Whether a file name is an AppImage of the app with asset stems `stems`, and the version its
+/// name gives. Matches only the names a release AppImage ends up with: the release's own
+/// (`photocraft-0.6.0-linux-x86_64.AppImage`) and the bare app name Gear Lever renames it to
+/// (`photocraft.appimage`, version unknown). The extension's case doesn't matter.
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+pub(crate) fn appimage_version(name: &str, stems: &[&str]) -> Option<Option<String>> {
+    let split = name.len().checked_sub(".appimage".len())?;
+    let (base, ext) = (name.get(..split)?, name.get(split..)?);
+    if !ext.eq_ignore_ascii_case(".appimage") {
+        return None;
+    }
+    if stems.iter().any(|s| base.eq_ignore_ascii_case(s)) {
+        return Some(None);
+    }
+    let parsed = crate::platform::parse_asset_name(&format!("{base}.AppImage"), stems)?;
+    (parsed.kind == crate::PackageKind::AppImage && parsed.token.starts_with("linux-")).then_some(Some(parsed.version))
+}
+
+/// Who our Windows Installer packages name as their publisher.
+#[cfg_attr(not(windows), allow(dead_code))]
+const PUBLISHER: &str = "Learning Machines LLC";
+
+/// Whether an uninstall entry's `DisplayName` and `Publisher` are `app`'s, under any name its
+/// installers have registered.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn is_installer_entry(app: &App, display_name: &str, publisher: &str) -> bool {
+    publisher == PUBLISHER && app.names().any(|n| n == display_name)
+}
+
+/// Where a Windows install of `app` may keep its exe, in the order to try: the entry's
+/// `InstallLocation`, then `<App>` under each Program Files root for each name the app has had,
+/// and in each folder `<stem>.exe` for each stem, current first. Doesn't touch the disk.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn exe_candidates(app: &App, location: Option<&Path>, program_files: &[PathBuf]) -> Vec<PathBuf> {
+    let in_program_files = program_files.iter().flat_map(|root| app.names().map(move |n| root.join(n)));
+    let dirs = location.map(Path::to_path_buf).into_iter().chain(in_program_files);
+    dirs.flat_map(|d| app.stems().map(move |s| d.join(format!("{s}.exe")))).collect()
+}
+
+/// Version from `<app> --version` output. Binaries print the machine id (`photocraft 0.7.0`),
+/// the display name (`SoundCraft 0.5.0`), or a former id (`printcraft 0.2.1` for PdfCraft).
+#[cfg_attr(not(any(target_os = "linux", target_os = "freebsd")), allow(dead_code))]
+fn parse_cli_version(line: &str, app: &App) -> Option<version::Version> {
+    let line = line.trim();
+    for prefix in app.stems().chain(std::iter::once(app.name)) {
+        if let Some(rest) = strip_cli_prefix(line, prefix)
+            && let Some(tok) = rest.split_whitespace().next()
+            && let Some(v) = version::parse(tok)
+        {
+            return Some(v);
+        }
+    }
+    version::parse_package(line)
+}
+
+fn strip_cli_prefix<'a>(line: &'a str, prefix: &str) -> Option<&'a str> {
+    let (head, rest) = line.split_at_checked(prefix.len())?;
+    if !head.eq_ignore_ascii_case(prefix) {
+        return None;
+    }
+    match rest.chars().next() {
+        None => Some(rest),
+        Some(c) if c.is_ascii_whitespace() => Some(rest),
+        _ => None,
+    }
+}
+
+#[cfg(target_os = "macos")]
+pub mod macos {
+    use std::path::{Path, PathBuf};
+
+    use super::{App, InstallSource, Installed, version};
+
+    /// Where a `.app` might be: the system and the user's Applications folders.
+    pub fn candidates(app: &App) -> Vec<PathBuf> {
+        let bundle = format!("{}.app", app.name);
+        let mut out = vec![Path::new("/Applications").join(&bundle)];
+        if let Some(home) = crate::folders::home_dir() {
+            out.push(home.join("Applications").join(&bundle));
+        }
+        out
+    }
+
+    pub fn detect(app: &App) -> Option<Installed> {
+        candidates(app).iter().find_map(|p| read_bundle(app, p))
+    }
+
+    /// Reads a bundle's `Info.plist`; `None` unless it's really this app.
+    pub fn read_bundle(app: &App, path: &Path) -> Option<Installed> {
+        let plist = plist::Value::from_file(path.join("Contents/Info.plist")).ok()?;
+        let dict = plist.as_dictionary()?;
+        if dict.get("CFBundleIdentifier")?.as_string()? != app.bundle_id() {
+            return None;
+        }
+        // `<App>Version` carries the full version including a pre-release suffix;
+        // CFBundleShortVersionString only has the numbers.
+        let full_key = format!("{}Version", app.name);
+        let text =
+            [full_key.as_str(), "CFBundleShortVersionString", "CFBundleVersion"].iter().find_map(|k| dict.get(k).and_then(plist::Value::as_string));
+        Some(Installed { version: text.and_then(version::parse), source: InstallSource::MacApp, location: path.display().to_string(), package: None })
+    }
+}
+
+#[cfg(windows)]
+pub mod windows {
+    use std::path::PathBuf;
+
+    use winreg::RegKey;
+    use winreg::enums::{HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, KEY_READ, KEY_WOW64_32KEY, KEY_WOW64_64KEY};
+
+    use super::{App, InstallSource, Installed, exe_candidates, is_installer_entry, version};
+
+    const UNINSTALL: &str = r"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall";
+
+    /// Reads the ProductVersion string from a program's VERSIONINFO, in the first language that
+    /// has one, without running the program or any other process.
+    pub fn executable_version(path: &std::path::Path) -> Option<crate::version::Version> {
+        let path = dunce::canonicalize(path).ok()?;
+        let info = winsafe::HVERSIONINFO::GetFileVersionInfo(path.to_str()?).ok()?;
+        let listed = info.langs_and_cps().map(<[_]>::to_vec).unwrap_or_default();
+        let product = string_tables(&listed).into_iter().find_map(|table| info.str_val(table, "ProductVersion").ok())?;
+        version::parse(product.trim())
+    }
+
+    /// The string tables to look in: the languages the file lists, then U.S. English in UTF-16,
+    /// Windows-1252 and no code page, as .NET's `FileVersionInfo` also tries when a file lists none
+    /// or its listed one has no strings.
+    pub(crate) fn string_tables(listed: &[(winsafe::LANGID, winsafe::co::CP)]) -> Vec<(winsafe::LANGID, winsafe::co::CP)> {
+        use winsafe::{LANGID, co};
+        let us = LANGID::new(co::LANG::ENGLISH, co::SUBLANG::ENGLISH_US);
+        listed.iter().copied().chain([(us, co::CP::UTF16), (us, co::CP::WINDOWS_1252), (us, co::CP::ACP)]).collect()
+    }
+
+    /// An MSI install found in the registry.
+    pub struct MsiInstall {
+        pub product_code: String,
+        pub version: Option<crate::version::Version>,
+        pub exe: Option<PathBuf>,
+    }
+
+    /// Every Windows Installer entry for `app`, newest first.
+    pub fn msi_installs(app: &App) -> Vec<MsiInstall> {
+        let mut out = Vec::new();
+        for (hive, flags) in [(HKEY_LOCAL_MACHINE, KEY_WOW64_64KEY), (HKEY_LOCAL_MACHINE, KEY_WOW64_32KEY), (HKEY_CURRENT_USER, 0)] {
+            let Ok(root) = RegKey::predef(hive).open_subkey_with_flags(UNINSTALL, KEY_READ | flags) else { continue };
+            for code in root.enum_keys().flatten() {
+                let Ok(key) = root.open_subkey_with_flags(&code, KEY_READ | flags) else { continue };
+                let name: String = key.get_value("DisplayName").unwrap_or_default();
+                let publisher: String = key.get_value("Publisher").unwrap_or_default();
+                if !is_installer_entry(app, &name, &publisher) || out.iter().any(|m: &MsiInstall| m.product_code == code) {
+                    continue;
+                }
+                let version = key.get_value::<String, _>("DisplayVersion").ok().and_then(|v| version::parse(&v));
+                let location: String = key.get_value("InstallLocation").unwrap_or_default();
+                let exe = exe_path(app, (!location.is_empty()).then(|| PathBuf::from(location)).or_else(|| install_dir(app)));
+                out.push(MsiInstall { product_code: code, version, exe });
+            }
+        }
+        out.sort_by(|a, b| match (&b.version, &a.version) {
+            (Some(x), Some(y)) => version::compare(x, y),
+            (Some(_), None) => std::cmp::Ordering::Greater,
+            (None, Some(_)) => std::cmp::Ordering::Less,
+            (None, None) => std::cmp::Ordering::Equal,
+        });
+        out
+    }
+
+    /// The folder the app's MSI remembers for its next upgrade, which is where it went when the
+    /// launcher chose the folder.
+    fn install_dir(app: &App) -> Option<PathBuf> {
+        [KEY_WOW64_64KEY, KEY_WOW64_32KEY].into_iter().find_map(|flags| {
+            let key = RegKey::predef(HKEY_LOCAL_MACHINE).open_subkey_with_flags(format!(r"SOFTWARE\{}", app.name), KEY_READ | flags).ok()?;
+            key.get_value::<String, _>("InstallDir").ok().filter(|d| !d.is_empty()).map(PathBuf::from)
+        })
+    }
+
+    /// The app's exe: from `App Paths`, the install folder, or Program Files.
+    fn exe_path(app: &App, location: Option<PathBuf>) -> Option<PathBuf> {
+        for stem in app.stems() {
+            let app_paths = format!(r"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\{stem}.exe");
+            for flags in [KEY_WOW64_64KEY, KEY_WOW64_32KEY] {
+                if let Ok(key) = RegKey::predef(HKEY_LOCAL_MACHINE).open_subkey_with_flags(&app_paths, KEY_READ | flags)
+                    && let Ok(path) = key.get_value::<String, _>("")
+                {
+                    let p = PathBuf::from(path.trim_matches('"'));
+                    if p.exists() {
+                        return Some(p);
+                    }
+                }
+            }
+        }
+        let mut roots = Vec::new();
+        for var in ["ProgramW6432", "ProgramFiles", "ProgramFiles(x86)"] {
+            if let Some(pf) = std::env::var_os(var) {
+                roots.push(PathBuf::from(pf));
+            }
+        }
+        exe_candidates(app, location.as_deref(), &roots).into_iter().find(|p| p.exists())
+    }
+
+    pub fn detect(app: &App) -> Option<Installed> {
+        let m = msi_installs(app).into_iter().next()?;
+        Some(Installed {
+            version: m.version,
+            source: InstallSource::Msi,
+            location: m.exe.map_or_else(|| app.name.to_string(), |p| p.display().to_string()),
+            package: Some(m.product_code),
+        })
+    }
+}
+
+#[cfg(target_os = "linux")]
+pub mod linux {
+    use std::path::{Path, PathBuf};
+    use std::time::Duration;
+
+    use super::{App, InstallSource, Installed, Snapshot, appimage_version, parse_cli_version, version};
+    use crate::packages::{self, Package};
+    use crate::process::capture;
+
+    /// Installed Craft App packages from every package manager on this system (dpkg, rpm,
+    /// pacman, Flatpak). Read once per detection pass.
+    pub fn packages() -> Vec<Package> {
+        let ours = |name: &str| {
+            crate::suite::SUITE.iter().any(|a| {
+                [InstallSource::Deb, InstallSource::Rpm, InstallSource::Pacman, InstallSource::Flatpak]
+                    .iter()
+                    .any(|m| crate::packages::candidate_names(a, *m).iter().any(|n| n == name))
+            })
+        };
+        let t = Duration::from_secs(10);
+        let mut out = Vec::new();
+        let mut add = |manager, list: Vec<(String, String)>| {
+            out.extend(list.into_iter().filter(|(n, _)| ours(n)).map(|(name, version)| Package { manager, name, version }));
+        };
+        if let Some(list) = capture("dpkg-query", &["-W", "-f", "${Package}|${db:Status-Status}|${Version}\n"], t) {
+            add(InstallSource::Deb, packages::parse_dpkg(&list));
+        }
+        if let Some(list) = capture("rpm", &["-qa", "--qf", "%{NAME}|%{VERSION}\n"], t) {
+            add(InstallSource::Rpm, packages::parse_rpm(&list));
+        }
+        // Only run `pacman` where its database exists: elsewhere `pacman` on PATH may be an unrelated program
+        // (the Pac-Man game in /usr/games on Debian-family systems).
+        if has_pacman_db()
+            && let Some(list) = capture("pacman", &["-Q"], t)
+        {
+            add(InstallSource::Pacman, packages::parse_pacman(&list));
+        }
+        let arch = format!("--arch={}", std::env::consts::ARCH);
+        if let Some(list) = crate::process::capture_flatpak(&["list", "--app", &arch, "--columns=application,version"], t) {
+            let mut flatpaks = packages::parse_flatpak_list(&list);
+            // Bundles built from a release tarball often list no version: ask Flatpak directly.
+            for (id, version) in flatpaks.iter_mut().filter(|(id, v)| v.is_empty() && id.starts_with("ai.storyteller.")) {
+                if let Some(v) = crate::process::capture_flatpak(&["info", &arch, id], t).as_deref().and_then(packages::parse_flatpak_info) {
+                    *version = v;
+                }
+            }
+            add(InstallSource::Flatpak, flatpaks);
+        }
+        out
+    }
+
+    /// The local package database of Arch's pacman.
+    pub(crate) const PACMAN_DB: &str = "/var/lib/pacman/local";
+
+    /// True when `db` is a directory, i.e. this system really uses pacman.
+    pub(crate) fn pacman_db_present(db: &Path) -> bool {
+        db.is_dir()
+    }
+
+    /// True when the system's default pacman database directory exists.
+    pub(crate) fn has_pacman_db() -> bool {
+        pacman_db_present(Path::new(PACMAN_DB))
+    }
+
+    /// Where a package put the app's binary: on `PATH`, else `/usr/bin/<id>`.
+    fn binary_on_path(id: &str) -> String {
+        std::env::var_os("PATH")
+            .and_then(|path| std::env::split_paths(&path).map(|d| d.join(id)).find(|p| p.is_file()))
+            .unwrap_or_else(|| PathBuf::from("/usr/bin").join(id))
+            .display()
+            .to_string()
+    }
+
+    /// `~/Applications`, where the launcher puts AppImages (the AppImageLauncher convention).
+    pub fn appimage_dir() -> Option<PathBuf> {
+        crate::folders::home_dir().map(|h| h.join("Applications"))
+    }
+
+    /// Every folder searched for AppImages, the launcher's own first: `~/Applications`,
+    /// `~/AppImages` (Gear Lever's default) and `~/.local/bin`.
+    pub fn appimage_dirs() -> Vec<PathBuf> {
+        let Some(home) = crate::folders::home_dir() else { return Vec::new() };
+        vec![home.join("Applications"), home.join("AppImages"), home.join(".local").join("bin")]
+    }
+
+    /// AppImages of `app` in `dirs`, newest first (unknown versions last; earlier folders win
+    /// ties).
+    pub fn appimages_in(app: &App, dirs: &[PathBuf]) -> Vec<(PathBuf, Option<version::Version>)> {
+        let stems: Vec<&str> = app.stems().collect();
+        let mut out: Vec<(PathBuf, Option<version::Version>)> = Vec::new();
+        for dir in dirs {
+            let Ok(entries) = std::fs::read_dir(dir) else { continue };
+            let mut found: Vec<(PathBuf, Option<version::Version>)> = entries
+                .flatten()
+                .filter_map(|e| {
+                    let name = e.file_name().into_string().ok()?;
+                    let version = appimage_version(&name, &stems)?;
+                    let path = e.path();
+                    path.is_file().then(|| (path, version.as_deref().and_then(version::parse)))
+                })
+                .collect();
+            found.sort_by(|a, b| a.0.cmp(&b.0));
+            out.extend(found);
+        }
+        // Stable sort: equal versions keep the folder order above.
+        out.sort_by(|a, b| match (&b.1, &a.1) {
+            (Some(x), Some(y)) => version::compare(x, y),
+            (Some(_), None) => std::cmp::Ordering::Greater,
+            (None, Some(_)) => std::cmp::Ordering::Less,
+            (None, None) => std::cmp::Ordering::Equal,
+        });
+        out
+    }
+
+    /// AppImages of `app` in any of the usual folders, newest first.
+    pub fn appimages(app: &App) -> Vec<(PathBuf, Option<version::Version>)> {
+        appimages_in(app, &appimage_dirs())
+    }
+
+    pub fn detect(app: &App, snapshot: &Snapshot) -> Option<Installed> {
+        if let Some((path, version)) = appimages(app).into_iter().next() {
+            return Some(Installed { version, source: InstallSource::AppImage, location: path.display().to_string(), package: None });
+        }
+        let order = [InstallSource::Deb, InstallSource::Rpm, InstallSource::Pacman, InstallSource::Flatpak];
+        if let Some(p) = packages::find(app, &snapshot.packages, &order) {
+            let location = if p.manager == InstallSource::Flatpak { app.bundle_id() } else { binary_on_path(app.id) };
+            return Some(Installed { version: packages::version_of(p), source: p.manager, location, package: Some(p.name.clone()) });
+        }
+        detect_system_install(app)
+    }
+
+    /// When the package managers don't report the app (a query timed out or was locked, an
+    /// unlisted package name, or a sandbox that can't see them) but its binary is there. It is
+    /// reported as a system binary: the launcher can open it but leaves updating and removing it
+    /// to whatever installed it, since it can't tell which package manager that was.
+    fn detect_system_install(app: &App) -> Option<Installed> {
+        let bin = find_binary(app.id)?;
+        Some(Installed { version: binary_version(&bin, app), source: InstallSource::Binary, location: bin.display().to_string(), package: None })
+    }
+
+    fn find_binary(id: &str) -> Option<PathBuf> {
+        let on_path = std::env::var_os("PATH").and_then(|path| std::env::split_paths(&path).map(|d| d.join(id)).find(|p| p.is_file()));
+        let usual = ["/usr/bin", "/usr/local/bin"].into_iter().map(PathBuf::from).chain(crate::folders::home_dir().map(|h| h.join(".local/bin")));
+        on_path.or_else(|| usual.map(|d| d.join(id)).find(|p| p.is_file()))
+    }
+
+    pub(crate) fn binary_version(bin: &Path, app: &App) -> Option<version::Version> {
+        let out = crate::process::capture(bin.to_str()?, &["--version"], Duration::from_secs(5))?;
+        parse_cli_version(out.trim(), app)
+    }
+}
+
+#[cfg(target_os = "freebsd")]
+pub mod freebsd {
+    use std::path::Path;
+    use std::time::Duration;
+
+    use super::{App, InstallSource, Installed, parse_cli_version, version};
+
+    pub fn detect(app: &App) -> Option<Installed> {
+        let bin = Path::new("/usr/local/bin").join(app.id);
+        if !bin.exists() {
+            return None;
+        }
+        Some(Installed { version: binary_version(&bin, app), source: InstallSource::Binary, location: bin.display().to_string(), package: None })
+    }
+
+    /// `<app> --version` prints `<app> 0.5.0 (sha, date)`.
+    fn binary_version(bin: &Path, app: &App) -> Option<version::Version> {
+        let out = crate::process::capture(bin.to_str()?, &["--version"], Duration::from_secs(5))?;
+        parse_cli_version(out.trim(), app)
+    }
+}
+
+#[cfg(all(test, target_os = "linux"))]
+mod linux_tests {
+    use super::*;
+
+    #[test]
+    fn ours_filter_matches_rpm_packages() {
+        let ours = |name: &str| {
+            crate::suite::SUITE.iter().any(|a| {
+                [InstallSource::Deb, InstallSource::Rpm, InstallSource::Pacman, InstallSource::Flatpak]
+                    .iter()
+                    .any(|m| crate::packages::candidate_names(a, *m).iter().any(|n| n == name))
+            })
+        };
+        assert!(ours("photocraft"));
+        assert!(ours("ai.storyteller.photocraft"));
+        assert!(!ours("unrelated-package"));
+    }
+
+    #[test]
+    fn pacman_is_only_queried_where_its_database_exists() {
+        let root = tempfile::tempdir().unwrap();
+        assert!(!linux::pacman_db_present(&root.path().join("local")));
+        std::fs::create_dir(root.path().join("local")).unwrap();
+        assert!(linux::pacman_db_present(&root.path().join("local")));
+    }
+
+    /// `linux::binary_version` on a script the test just wrote. Another test thread that forks
+    /// while the script is still open for writing holds that descriptor until it execs, and running
+    /// the script in that window fails with ETXTBSY ("Text file busy"), so a miss is retried.
+    fn binary_version_of_new_script(bin: &Path, app: &App) -> Option<version::Version> {
+        for _ in 0..20 {
+            if let Some(v) = linux::binary_version(bin, app) {
+                return Some(v);
+            }
+            std::thread::sleep(std::time::Duration::from_millis(50));
+        }
+        None
+    }
+
+    #[test]
+    fn reads_binary_version_from_cli() {
+        let photo = App::by_id("photocraft").unwrap();
+        let temp_dir = tempfile::tempdir().unwrap();
+        let bin = temp_dir.path().join("photocraft");
+        std::fs::write(&bin, "#!/bin/sh\necho 'photocraft 0.6.0 (0c72d9542, 2026-10-10)'\n").unwrap();
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).unwrap();
+        let ver = binary_version_of_new_script(&bin, photo);
+        assert_eq!(ver.unwrap().to_string(), "0.6.0");
+    }
+
+    #[test]
+    fn reads_binary_version_when_the_cli_uses_the_display_name_or_a_former_id() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        use std::os::unix::fs::PermissionsExt;
+        let write = |name: &str, script: &str| {
+            let bin = temp_dir.path().join(name);
+            std::fs::write(&bin, script).unwrap();
+            std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).unwrap();
+            bin
+        };
+        let sound = write("soundcraft", "#!/bin/sh\necho 'SoundCraft 0.5.0'\n");
+        assert_eq!(binary_version_of_new_script(&sound, App::by_id("soundcraft").unwrap()).unwrap().to_string(), "0.5.0");
+        let pdf = write("pdfcraft", "#!/bin/sh\necho 'printcraft 0.2.1'\n");
+        assert_eq!(binary_version_of_new_script(&pdf, App::by_id("pdfcraft").unwrap()).unwrap().to_string(), "0.2.1");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::SUITE;
+
+    use super::*;
+
+    /// A file without VERSIONINFO, or one that isn't there, has no version.
+    #[cfg(windows)]
+    #[test]
+    fn a_file_without_version_info_has_no_version() {
+        let dir = tempfile::tempdir().unwrap();
+        let text = dir.path().join("photocraft.exe");
+        std::fs::write(&text, "not a program").unwrap();
+        assert_eq!(windows::executable_version(&text), None);
+        assert_eq!(windows::executable_version(&dir.path().join("missing.exe")), None);
+    }
+
+    /// Without a listed language, the version is still looked for in the string tables .NET's
+    /// `FileVersionInfo` falls back to (040904B0, 040904E4, 04090000), after any listed one.
+    #[cfg(windows)]
+    #[test]
+    fn the_version_is_looked_for_in_the_usual_string_tables_too() {
+        use winsafe::{LANGID, co};
+        let key = |(lang, cp): (LANGID, co::CP)| format!("{:04x}{:04x}", u16::from(lang), u16::from(cp));
+        let keys = |listed: &[(LANGID, co::CP)]| windows::string_tables(listed).into_iter().map(key).collect::<Vec<_>>();
+        assert_eq!(keys(&[]), ["040904b0", "040904e4", "04090000"]);
+        let german = (LANGID::new(co::LANG::GERMAN, co::SUBLANG::GERMAN), co::CP::UTF16);
+        assert_eq!(keys(&[german]), ["040704b0", "040904b0", "040904e4", "04090000"]);
+    }
+
+    /// A program whose VERSIONINFO has a ProductVersion in the U.S. English UTF-16 table but no
+    /// `\VarFileInfo\Translation` entry still has a version.
+    #[cfg(windows)]
+    #[test]
+    fn a_version_without_a_translation_entry_is_found() {
+        let dir = tempfile::tempdir().unwrap();
+        let exe = dir.path().join("photocraft.exe");
+        std::fs::write(&exe, resource_only_program("1.2.3")).unwrap();
+        assert_eq!(windows::executable_version(&exe), version::parse("1.2.3"));
+    }
+
+    /// A VERSIONINFO block node: length, value length, type, the key, then the value and the
+    /// children, each aligned to 4 bytes.
+    #[cfg(windows)]
+    fn version_node(key: &str, value: &[u8], value_length: u16, text: bool, children: &[Vec<u8>]) -> Vec<u8> {
+        let align = |bytes: &mut Vec<u8>| bytes.resize(bytes.len().next_multiple_of(4), 0);
+        let mut node = vec![0, 0];
+        node.extend(value_length.to_le_bytes());
+        node.extend(u16::from(text).to_le_bytes());
+        node.extend(key.encode_utf16().chain([0]).flat_map(u16::to_le_bytes));
+        align(&mut node);
+        node.extend(value);
+        for child in children {
+            align(&mut node);
+            node.extend(child);
+        }
+        let length = u16::try_from(node.len()).unwrap();
+        node[..2].copy_from_slice(&length.to_le_bytes());
+        node
+    }
+
+    /// A 64-bit program file holding only a version resource (`ProductVersion` = `product`, in
+    /// the 040904B0 string table) and no `\VarFileInfo\Translation` entry.
+    #[cfg(windows)]
+    fn resource_only_program(product: &str) -> Vec<u8> {
+        let put = |bytes: &mut Vec<u8>, at: usize, value: &[u8]| bytes[at..at + value.len()].copy_from_slice(value);
+        let text: Vec<u8> = product.encode_utf16().chain([0]).flat_map(u16::to_le_bytes).collect();
+        let string = version_node("ProductVersion", &text, u16::try_from(product.len() + 1).unwrap(), true, &[]);
+        let table = version_node("040904b0", &[], 0, true, &[string]);
+        let strings = version_node("StringFileInfo", &[], 0, true, &[table]);
+        let mut fixed = vec![0u8; 52];
+        put(&mut fixed, 0, &0xFEEF_04BDu32.to_le_bytes());
+        put(&mut fixed, 4, &0x0001_0000u32.to_le_bytes());
+        let info = version_node("VS_VERSION_INFO", &fixed, 52, false, &[strings]);
+
+        // The resource section: type 16 (RT_VERSION) > id 1 > language 0x0409 > the data.
+        const RVA: u32 = 0x1000;
+        let mut rsrc = vec![0u8; 0x58];
+        for (dir, id, next) in [(0x00, 16u32, 0x8000_0018u32), (0x18, 1, 0x8000_0030), (0x30, 0x0409, 0x48)] {
+            put(&mut rsrc, dir + 14, &1u16.to_le_bytes());
+            put(&mut rsrc, dir + 16, &id.to_le_bytes());
+            put(&mut rsrc, dir + 20, &next.to_le_bytes());
+        }
+        put(&mut rsrc, 0x48, &(RVA + 0x58).to_le_bytes());
+        put(&mut rsrc, 0x4C, &u32::try_from(info.len()).unwrap().to_le_bytes());
+        rsrc.extend(&info);
+        let raw = u32::try_from(rsrc.len().next_multiple_of(0x200)).unwrap();
+        let rsrc_len = u32::try_from(rsrc.len()).unwrap();
+
+        let mut file = vec![0u8; 0x200];
+        put(&mut file, 0, b"MZ");
+        put(&mut file, 0x3C, &0x40u32.to_le_bytes());
+        put(&mut file, 0x40, b"PE\0\0");
+        // COFF header: x64, one section, a 240-byte optional header, an executable DLL image.
+        put(&mut file, 0x44, &0x8664u16.to_le_bytes());
+        put(&mut file, 0x46, &1u16.to_le_bytes());
+        put(&mut file, 0x54, &240u16.to_le_bytes());
+        put(&mut file, 0x56, &0x2022u16.to_le_bytes());
+        // PE32+ optional header.
+        let opt = 0x58;
+        put(&mut file, opt, &0x20Bu16.to_le_bytes());
+        put(&mut file, opt + 8, &raw.to_le_bytes());
+        put(&mut file, opt + 24, &0x1_4000_0000u64.to_le_bytes());
+        put(&mut file, opt + 32, &0x1000u32.to_le_bytes());
+        put(&mut file, opt + 36, &0x200u32.to_le_bytes());
+        put(&mut file, opt + 40, &6u16.to_le_bytes());
+        put(&mut file, opt + 48, &6u16.to_le_bytes());
+        put(&mut file, opt + 56, &(RVA + rsrc_len.next_multiple_of(0x1000)).to_le_bytes());
+        put(&mut file, opt + 60, &0x200u32.to_le_bytes());
+        put(&mut file, opt + 68, &2u16.to_le_bytes());
+        put(&mut file, opt + 72, &0x10_0000u64.to_le_bytes());
+        put(&mut file, opt + 80, &0x1000u64.to_le_bytes());
+        put(&mut file, opt + 88, &0x10_0000u64.to_le_bytes());
+        put(&mut file, opt + 96, &0x1000u64.to_le_bytes());
+        put(&mut file, opt + 108, &16u32.to_le_bytes());
+        put(&mut file, opt + 112 + 2 * 8, &RVA.to_le_bytes());
+        put(&mut file, opt + 112 + 2 * 8 + 4, &rsrc_len.to_le_bytes());
+        // The .rsrc section header.
+        let section = opt + 240;
+        put(&mut file, section, b".rsrc\0\0\0");
+        put(&mut file, section + 8, &rsrc_len.to_le_bytes());
+        put(&mut file, section + 12, &RVA.to_le_bytes());
+        put(&mut file, section + 16, &raw.to_le_bytes());
+        put(&mut file, section + 20, &0x200u32.to_le_bytes());
+        put(&mut file, section + 36, &0x4000_0040u32.to_le_bytes());
+        rsrc.resize(usize::try_from(raw).unwrap(), 0);
+        file.extend(rsrc);
+        file
+    }
+
+    #[test]
+    fn recognises_appimage_names_conservatively() {
+        let pdf = ["pdfcraft", "printcraft"];
+        let v = |n: &str| appimage_version(n, &pdf);
+        assert_eq!(v("pdfcraft-0.3.0-linux-x86_64.AppImage"), Some(Some("0.3.0".into())));
+        assert_eq!(v("printcraft-0.2.1-linux-aarch64.appimage"), Some(Some("0.2.1".into())));
+        assert_eq!(v("pdfcraft-0.3.0-rc.1-linux-x86_64.AppImage"), Some(Some("0.3.0-rc.1".into())));
+        // Gear Lever's rename, and a plain rename by hand.
+        assert_eq!(v("pdfcraft.appimage"), Some(None));
+        assert_eq!(v("PdfCraft.AppImage"), Some(None));
+        for other in [
+            "pdfcraft-0.3.0-linux-x86_64.AppImage.zsync",
+            "pdfcraft-0.3.0-linux-x86_64.deb",
+            "pdfcraft-0.3.0-windows-x64.AppImage",
+            "pdfcraft-cli-0.3.0-linux-x86_64.AppImage",
+            "photocraft-0.6.0-linux-x86_64.AppImage",
+            "mypdfcraft.AppImage",
+            "pdfcraft-latest.AppImage",
+            ".appimage",
+            "x",
+        ] {
+            assert_eq!(v(other), None, "{other}");
+        }
+    }
+
+    #[test]
+    fn parse_cli_version_accepts_id_display_name_and_former_id() {
+        let photo = App::by_id("photocraft").unwrap();
+        let sound = App::by_id("soundcraft").unwrap();
+        let pdf = App::by_id("pdfcraft").unwrap();
+        assert_eq!(parse_cli_version("photocraft 0.7.0 (dev build)", photo).unwrap().to_string(), "0.7.0");
+        assert_eq!(parse_cli_version("SoundCraft 0.5.0", sound).unwrap().to_string(), "0.5.0");
+        assert_eq!(parse_cli_version("printcraft 0.2.1", pdf).unwrap().to_string(), "0.2.1");
+        assert_eq!(parse_cli_version("PdfCraft 0.6.0", pdf).unwrap().to_string(), "0.6.0");
+        assert!(strip_cli_prefix("photocraft-cli 1.0.0", "photocraft").is_none());
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn finds_appimages_in_every_folder_newest_first() {
+        let app = App::by_id("photocraft").unwrap();
+        let root = tempfile::tempdir().unwrap();
+        let (apps, gear, bin) = (root.path().join("Applications"), root.path().join("AppImages"), root.path().join("bin"));
+        for d in [&apps, &gear, &bin] {
+            std::fs::create_dir_all(d).unwrap();
+        }
+        std::fs::write(apps.join("photocraft-0.5.0-linux-x86_64.AppImage"), b"").unwrap();
+        std::fs::write(apps.join("wordcraft-0.3.0-linux-x86_64.AppImage"), b"").unwrap();
+        std::fs::write(gear.join("photocraft.appimage"), b"").unwrap();
+        std::fs::write(bin.join("photocraft-0.6.0-linux-x86_64.AppImage"), b"").unwrap();
+        std::fs::create_dir(bin.join("photocraft.AppImage")).unwrap();
+        let found = linux::appimages_in(app, &[apps.clone(), gear.clone(), bin.clone(), root.path().join("missing")]);
+        let names: Vec<_> = found.iter().map(|(p, v)| (p.clone(), v.as_ref().map(ToString::to_string))).collect();
+        assert_eq!(
+            names,
+            [
+                (bin.join("photocraft-0.6.0-linux-x86_64.AppImage"), Some("0.6.0".to_string())),
+                (apps.join("photocraft-0.5.0-linux-x86_64.AppImage"), Some("0.5.0".to_string())),
+                (gear.join("photocraft.appimage"), None),
+            ]
+        );
+    }
+
+    const LEARNING_MACHINES: &str = "Learning Machines LLC";
+
+    fn roots() -> Vec<PathBuf> {
+        vec![PathBuf::from(r"C:\Program Files"), PathBuf::from(r"C:\Program Files (x86)")]
+    }
+
+    #[test]
+    fn pdfcraft_matches_its_former_printcraft_installer_name() {
+        let pdf = App::by_id("pdfcraft").unwrap();
+        assert!(is_installer_entry(pdf, "PrintCraft", LEARNING_MACHINES), "a PrintCraft entry from {LEARNING_MACHINES} should be PdfCraft's");
+    }
+
+    #[test]
+    fn pdfcraft_still_matches_its_own_installer_name() {
+        let pdf = App::by_id("pdfcraft").unwrap();
+        assert!(is_installer_entry(pdf, "PdfCraft", LEARNING_MACHINES));
+    }
+
+    #[test]
+    fn printcraft_entries_match_nothing_else() {
+        let pdf = App::by_id("pdfcraft").unwrap();
+        assert!(!is_installer_entry(pdf, "PrintCraft", "Some Other Publisher"));
+        assert!(!is_installer_entry(pdf, "PhotoCraft", LEARNING_MACHINES));
+        for a in SUITE.iter().filter(|a| a.id != "pdfcraft") {
+            assert!(!is_installer_entry(a, "PrintCraft", LEARNING_MACHINES), "PrintCraft matched {}", a.name);
+        }
+    }
+
+    #[test]
+    fn pdfcraft_exe_is_sought_under_every_name_it_has_shipped_as() {
+        let pdf = App::by_id("pdfcraft").unwrap();
+        let location = PathBuf::from(r"D:\Apps\PrintCraft");
+        let roots = roots();
+        let mut want = vec![location.join("pdfcraft.exe"), location.join("printcraft.exe")];
+        for root in &roots {
+            for dir in ["PdfCraft", "PrintCraft"] {
+                want.push(root.join(dir).join("pdfcraft.exe"));
+                want.push(root.join(dir).join("printcraft.exe"));
+            }
+        }
+        assert_eq!(exe_candidates(pdf, Some(&location), &roots), want);
+    }
+
+    #[test]
+    fn apps_without_former_names_match_and_find_their_exe_as_before() {
+        let roots = roots();
+        let location = PathBuf::from(r"D:\Apps\Somewhere");
+        for a in SUITE.iter().filter(|a| a.former_ids.is_empty() && a.former_names.is_empty()) {
+            assert!(is_installer_entry(a, a.name, LEARNING_MACHINES), "{}", a.name);
+            assert!(!is_installer_entry(a, a.name, "Some Other Publisher"), "{}", a.name);
+            assert!(!is_installer_entry(a, &a.name.to_lowercase(), LEARNING_MACHINES), "{}", a.name);
+            let exe = format!("{}.exe", a.id);
+            let in_program_files: Vec<PathBuf> = roots.iter().map(|r| r.join(a.name).join(&exe)).collect();
+            assert_eq!(exe_candidates(a, None, &roots), in_program_files);
+            let with_location: Vec<PathBuf> = std::iter::once(location.join(&exe)).chain(in_program_files).collect();
+            assert_eq!(exe_candidates(a, Some(&location), &roots), with_location);
+        }
+    }
+}
diff --git a/crates/update/src/dialog.rs b/crates/update/src/dialog.rs
new file mode 100644
index 00000000..d6bf1dd4
--- /dev/null
+++ b/crates/update/src/dialog.rs
@@ -0,0 +1,405 @@
+//! Startup update prompt dialog for egui frontends.
+
+use egui::{Align, Align2, Color32, Layout, RichText, Vec2};
+
+use crate::app::App;
+use crate::release::Release;
+
+/// What the user chose in the startup update prompt.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum StartupPromptResponse {
+    /// Dialog is still open and waiting for user input.
+    Pending,
+    /// User chose to update and restart now.
+    UpdateAndRestart,
+    /// User chose to download manually via browser.
+    Download,
+    /// User dismissed the dialog for now.
+    Later,
+}
+
+/// State for the startup update prompt dialog.
+#[derive(Clone, Debug)]
+pub struct StartupPrompt {
+    pub app: &'static App,
+    pub release: Release,
+    pub running_version: String,
+    pub is_self_updating: bool,
+    pub open: bool,
+    pub status_message: Option<String>,
+    pub is_installing: bool,
+}
+
+impl StartupPrompt {
+    /// Creates a new prompt dialog state for the given app and newly discovered release.
+    pub fn new(app: &'static App, release: Release, running_version: impl Into<String>) -> Self {
+        let is_self_updating = crate::self_update::is_self_updating(app);
+        Self { app, release, running_version: running_version.into(), is_self_updating, open: true, status_message: None, is_installing: false }
+    }
+
+    /// Renders the modal window on the given egui context.
+    pub fn show(&mut self, ctx: &egui::Context) -> StartupPromptResponse {
+        if !self.open {
+            return StartupPromptResponse::Later;
+        }
+
+        let mut response = StartupPromptResponse::Pending;
+
+        // Modal dimmed background overlay; it senses clicks so they don't reach widgets underneath.
+        let screen_rect = ctx.content_rect();
+        egui::Area::new(egui::Id::unique("craft_update_backdrop")).order(egui::Order::Middle).fixed_pos(screen_rect.min).show(ctx, |ui| {
+            let (rect, _) = ui.allocate_exact_size(screen_rect.size(), egui::Sense::click_and_drag());
+            ui.painter().rect_filled(rect, 0.0, Color32::from_black_alpha(150));
+        });
+
+        if ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
+            response = StartupPromptResponse::Later;
+        }
+
+        let is_dark = ctx.theme() == egui::Theme::Dark;
+        let card_bg = if is_dark { Color32::from_rgb(26, 26, 28) } else { Color32::from_rgb(255, 255, 255) };
+        let border_color = if is_dark { Color32::from_rgb(52, 52, 56) } else { Color32::from_rgb(215, 215, 220) };
+        let text_primary = if is_dark { Color32::from_rgb(245, 245, 248) } else { Color32::from_rgb(20, 20, 25) };
+        let text_muted = if is_dark { Color32::from_rgb(150, 150, 160) } else { Color32::from_rgb(105, 105, 115) };
+        let accent_color = Color32::from_rgb(52, 120, 246);
+
+        egui::Area::new(egui::Id::unique("craft_update.startup_prompt"))
+            .anchor(Align2::CENTER_CENTER, Vec2::ZERO)
+            .order(egui::Order::Foreground)
+            .show(ctx, |ui| {
+                egui::Frame::new()
+                    .fill(card_bg)
+                    .stroke(egui::Stroke::new(1.0, border_color))
+                    .corner_radius(egui::CornerRadius::ZERO)
+                    .inner_margin(egui::Margin::symmetric(20, 18))
+                    .show(ui, |ui| {
+                        ui.set_width(400.0);
+                        ui.spacing_mut().item_spacing = Vec2::new(8.0, 6.0);
+
+                        // Header row: App badge + title + close
+                        ui.horizontal(|ui| {
+                            let (badge_rect, _) = ui.allocate_exact_size(Vec2::new(34.0, 34.0), egui::Sense::hover());
+                            ui.painter().rect_filled(badge_rect, egui::CornerRadius::ZERO, accent_color);
+                            let initial = self.app.name.chars().next().map(|c| c.to_string()).unwrap_or_else(|| "A".to_string());
+                            ui.painter().text(badge_rect.center(), Align2::CENTER_CENTER, initial, egui::FontId::monospace(18.0), Color32::WHITE);
+
+                            ui.add_space(4.0);
+
+                            ui.vertical(|ui| {
+                                ui.spacing_mut().item_spacing.y = 2.0;
+                                ui.horizontal(|ui| {
+                                    ui.label(RichText::new(self.app.name).size(15.0).strong().color(text_primary));
+                                    ui.label(RichText::new("UPDATE").size(10.0).monospace().color(accent_color));
+                                });
+                                // ASCII only, like the rest of the card: an app whose fonts lack a glyph may panic
+                                // instead of drawing a box, and this prompt shows up unasked.
+                                let version_pill = format!("v{} to {}", self.running_version, self.release.version_label());
+                                ui.label(RichText::new(version_pill).size(11.0).monospace().color(text_muted));
+                            });
+
+                            ui.with_layout(Layout::right_to_left(Align::Min), |ui| {
+                                // Two strokes, not a "✕" glyph: none of the bundled faces has U+2715.
+                                let (rect, close) = ui.allocate_exact_size(Vec2::splat(18.0), egui::Sense::click());
+                                close.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, "Close"));
+                                let color = if close.hovered() { text_primary } else { text_muted };
+                                let (center, reach) = (rect.center(), 4.5);
+                                let stroke = egui::Stroke::new(1.5, color);
+                                ui.painter().line_segment([center + Vec2::new(-reach, -reach), center + Vec2::new(reach, reach)], stroke);
+                                ui.painter().line_segment([center + Vec2::new(-reach, reach), center + Vec2::new(reach, -reach)], stroke);
+                                if close.on_hover_cursor(egui::CursorIcon::PointingHand).clicked() {
+                                    response = StartupPromptResponse::Later;
+                                }
+                            });
+                        });
+
+                        ui.add_space(8.0);
+
+                        if let Some(msg) = &self.status_message {
+                            let alert_bg = if is_dark { Color32::from_rgb(50, 30, 20) } else { Color32::from_rgb(255, 242, 235) };
+                            let alert_color = Color32::from_rgb(225, 95, 30);
+                            egui::Frame::new()
+                                .fill(alert_bg)
+                                .stroke(egui::Stroke::new(1.0, alert_color))
+                                .corner_radius(egui::CornerRadius::ZERO)
+                                .inner_margin(egui::Margin::symmetric(10, 6))
+                                .show(ui, |ui| {
+                                    ui.set_width(ui.available_width());
+                                    ui.label(RichText::new(msg).size(12.0).color(alert_color));
+                                });
+                            ui.add_space(4.0);
+                        }
+
+                        if self.is_installing {
+                            ui.horizontal(|ui| {
+                                ui.spinner();
+                                ui.label(RichText::new("Downloading and installing update…").size(12.0).color(text_primary));
+                            });
+                        } else {
+                            let desc =
+                                format!("{} {} is available with the latest features and bug fixes.", self.app.name, self.release.version_label());
+                            ui.label(RichText::new(desc).size(12.5).color(text_muted));
+                        }
+
+                        ui.add_space(10.0);
+                        let (hairline_rect, _) = ui.allocate_exact_size(Vec2::new(ui.available_width(), 1.0), egui::Sense::hover());
+                        ui.painter().hline(hairline_rect.x_range(), hairline_rect.top(), egui::Stroke::new(1.0, border_color));
+                        ui.add_space(8.0);
+
+                        // Footer actions
+                        ui.horizontal(|ui| {
+                            let what_new = egui::Hyperlink::from_label_and_url(
+                                RichText::new("What's new").size(11.5).color(accent_color),
+                                &self.release.html_url,
+                            );
+                            ui.add(what_new);
+
+                            ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                                if self.is_installing {
+                                    let dismiss_btn = egui::Button::new(RichText::new("DISMISS").size(10.5).monospace().color(text_muted))
+                                        .stroke(egui::Stroke::new(1.0, border_color))
+                                        .corner_radius(egui::CornerRadius::ZERO)
+                                        .min_size(Vec2::new(72.0, 26.0));
+                                    if ui.add(dismiss_btn).clicked() {
+                                        response = StartupPromptResponse::Later;
+                                    }
+                                } else {
+                                    if self.is_self_updating {
+                                        let update_btn = egui::Button::new(
+                                            RichText::new("UPDATE AND RESTART").size(10.5).strong().monospace().color(Color32::WHITE),
+                                        )
+                                        .fill(accent_color)
+                                        .corner_radius(egui::CornerRadius::ZERO)
+                                        .min_size(Vec2::new(140.0, 26.0));
+                                        if ui.add(update_btn).clicked() {
+                                            response = StartupPromptResponse::UpdateAndRestart;
+                                        }
+                                    } else {
+                                        let dl_btn =
+                                            egui::Button::new(RichText::new("DOWNLOAD").size(10.5).strong().monospace().color(Color32::WHITE))
+                                                .fill(accent_color)
+                                                .corner_radius(egui::CornerRadius::ZERO)
+                                                .min_size(Vec2::new(90.0, 26.0));
+                                        if ui.add(dl_btn).clicked() {
+                                            response = StartupPromptResponse::Download;
+                                        }
+                                    }
+
+                                    let later_btn = egui::Button::new(RichText::new("LATER").size(10.5).monospace().color(text_primary))
+                                        .stroke(egui::Stroke::new(1.0, border_color))
+                                        .corner_radius(egui::CornerRadius::ZERO)
+                                        .min_size(Vec2::new(65.0, 26.0));
+                                    if ui.add(later_btn).clicked() {
+                                        response = StartupPromptResponse::Later;
+                                    }
+                                }
+                            });
+                        });
+                    });
+            });
+
+        if response == StartupPromptResponse::Later {
+            self.open = false;
+        }
+
+        response
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::suite::PHOTOCRAFT;
+    use egui::{Context, Event, FullOutput, Key, Modifiers, RawInput, Rect};
+
+    const DARK_CARD: Color32 = Color32::from_rgb(26, 26, 28);
+    const DARK_STATUS: Color32 = Color32::from_rgb(50, 30, 20);
+
+    fn screen() -> Rect {
+        Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(640.0, 480.0))
+    }
+
+    /// A dark, animation-free context so a single frame paints final (unfaded) colors.
+    fn dark_context() -> Context {
+        let ctx = Context::default();
+        ctx.set_theme(egui::ThemePreference::Dark);
+        ctx.global_style_mut(|style| style.animation_time = 0.0);
+        ctx
+    }
+
+    /// A prompt in a known installation mode, without probing the host for a real install.
+    fn prompt_for(is_self_updating: bool) -> StartupPrompt {
+        let release = Release { version: crate::version::parse("0.2.0"), tag: "v0.2.0".to_string(), ..Release::default() };
+        StartupPrompt {
+            app: &PHOTOCRAFT,
+            release,
+            running_version: "0.1.0".to_string(),
+            is_self_updating,
+            open: true,
+            status_message: None,
+            is_installing: false,
+        }
+    }
+
+    fn frame(ctx: &Context, prompt: &mut StartupPrompt, events: Vec<Event>) -> (StartupPromptResponse, FullOutput) {
+        let mut response = StartupPromptResponse::Pending;
+        let mut output = ctx.run_ui(RawInput { screen_rect: Some(screen()), events, ..RawInput::default() }, |ui| {
+            response = prompt.show(ui.ctx());
+        });
+        output.textures_delta.clear(); // Headless test: no renderer consumes the font atlas.
+        (response, output)
+    }
+
+    fn collect_text(shape: &egui::Shape, out: &mut Vec<String>) {
+        match shape {
+            egui::Shape::Vec(shapes) => {
+                for shape in shapes {
+                    collect_text(shape, out);
+                }
+            }
+            egui::Shape::Text(text) => out.push(text.galley.text().to_owned()),
+            _ => {}
+        }
+    }
+
+    /// Every string the frame actually painted, one per line.
+    fn painted_text(output: &FullOutput) -> String {
+        let mut texts = Vec::new();
+        for clipped in &output.shapes {
+            collect_text(&clipped.shape, &mut texts);
+        }
+        texts.join("\n")
+    }
+
+    /// The rectangle fills painted this frame, so the card and alert surfaces can be told apart.
+    fn rect_fills(output: &FullOutput) -> Vec<(Rect, Color32)> {
+        fn collect(shape: &egui::Shape, out: &mut Vec<(Rect, Color32)>) {
+            match shape {
+                egui::Shape::Vec(shapes) => {
+                    for shape in shapes {
+                        collect(shape, out);
+                    }
+                }
+                egui::Shape::Rect(rect) => out.push((rect.rect, rect.fill)),
+                _ => {}
+            }
+        }
+        let mut fills = Vec::new();
+        for clipped in &output.shapes {
+            collect(&clipped.shape, &mut fills);
+        }
+        fills
+    }
+
+    #[test]
+    fn creates_startup_prompt_dialog() {
+        let release = Release { version: crate::version::parse("0.2.0"), tag: "v0.2.0".to_string(), ..Release::default() };
+        let prompt = StartupPrompt::new(&PHOTOCRAFT, release, "0.1.0");
+        assert_eq!(prompt.app.name, "PhotoCraft");
+        assert_eq!(prompt.running_version, "0.1.0");
+        assert!(prompt.open);
+    }
+
+    #[test]
+    fn download_prompt_paints_card_actions_and_stays_pending() {
+        let ctx = dark_context();
+        let mut prompt = prompt_for(false);
+        // A new Area first measures itself invisibly; inspect the following visible frame.
+        let (sizing, _) = frame(&ctx, &mut prompt, Vec::new());
+        assert_eq!(sizing, StartupPromptResponse::Pending);
+        let (response, output) = frame(&ctx, &mut prompt, Vec::new());
+        assert_eq!(response, StartupPromptResponse::Pending);
+        assert!(prompt.open);
+        let painted = painted_text(&output);
+        for expected in [
+            "PhotoCraft",
+            "UPDATE",
+            "v0.1.0 to 0.2.0",
+            "PhotoCraft 0.2.0 is available with the latest features and bug fixes.",
+            "What's new",
+            "DOWNLOAD",
+            "LATER",
+        ] {
+            assert!(painted.contains(expected), "missing {expected:?} in painted text {painted:?}");
+        }
+        assert!(!painted.contains("UPDATE AND RESTART"), "download branch must not offer the self-update button: {painted:?}");
+        // No glyph that a font might lack: apps that panic on a missing glyph would take the prompt down (#343).
+        assert!(painted.is_ascii(), "the prompt paints a non-ASCII character: {painted:?}");
+        let fills = rect_fills(&output);
+        let backdrop = fills.iter().any(|(rect, fill)| *fill == Color32::from_black_alpha(150) && rect.size() == screen().size());
+        assert!(backdrop, "modal backdrop missing: {fills:?}");
+        let card = fills.iter().any(|(_, fill)| *fill == DARK_CARD);
+        assert!(card, "dialog card missing: {fills:?}");
+    }
+
+    #[test]
+    fn self_updating_prompt_offers_update_and_restart() {
+        let ctx = dark_context();
+        let mut prompt = prompt_for(true);
+        // A new Area first measures itself invisibly; inspect the following visible frame.
+        let (sizing, _) = frame(&ctx, &mut prompt, Vec::new());
+        assert_eq!(sizing, StartupPromptResponse::Pending);
+        let (response, output) = frame(&ctx, &mut prompt, Vec::new());
+        assert_eq!(response, StartupPromptResponse::Pending);
+        assert!(prompt.open);
+        let painted = painted_text(&output);
+        assert!(painted.contains("UPDATE AND RESTART"), "self-update button missing: {painted:?}");
+        assert!(painted.contains("LATER"), "dismiss button missing: {painted:?}");
+        assert!(!painted.contains("DOWNLOAD"), "self-updating copy must not offer the manual download button: {painted:?}");
+        let card = rect_fills(&output).iter().any(|(_, fill)| *fill == DARK_CARD);
+        assert!(card, "dialog card missing");
+    }
+
+    #[test]
+    fn installing_prompt_paints_status_and_dismiss() {
+        let ctx = dark_context();
+        let mut prompt = prompt_for(true);
+        prompt.is_installing = true;
+        prompt.status_message = Some("Couldn't reach GitHub".to_string());
+        // A new Area first measures itself invisibly; inspect the following visible frame.
+        let (sizing, _) = frame(&ctx, &mut prompt, Vec::new());
+        assert_eq!(sizing, StartupPromptResponse::Pending);
+        let (response, output) = frame(&ctx, &mut prompt, Vec::new());
+        assert_eq!(response, StartupPromptResponse::Pending);
+        assert!(prompt.open);
+        let painted = painted_text(&output);
+        for expected in ["PhotoCraft", "Downloading and installing update…", "Couldn't reach GitHub", "DISMISS", "What's new"] {
+            assert!(painted.contains(expected), "missing {expected:?} in painted text {painted:?}");
+        }
+        for absent in ["LATER", "DOWNLOAD", "UPDATE AND RESTART"] {
+            assert!(!painted.contains(absent), "unexpected {absent:?} while installing: {painted:?}");
+        }
+        let fills = rect_fills(&output);
+        let alert = fills.iter().any(|(_, fill)| *fill == DARK_STATUS);
+        assert!(alert, "status alert frame missing: {fills:?}");
+    }
+
+    #[test]
+    fn escape_dismisses_open_prompt() {
+        let ctx = dark_context();
+        let mut prompt = prompt_for(false);
+        let (first, _) = frame(&ctx, &mut prompt, Vec::new());
+        assert_eq!(first, StartupPromptResponse::Pending);
+        assert!(prompt.open);
+        let escape = Event::Key { key: Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE };
+        let (dismissed, dismissed_output) = frame(&ctx, &mut prompt, vec![escape]);
+        assert_eq!(dismissed, StartupPromptResponse::Later);
+        assert!(!prompt.open);
+        // The dismissing frame still paints the dialog; the closed state applies from the next frame on.
+        assert!(!painted_text(&dismissed_output).is_empty(), "dismissing frame should have painted the dialog");
+        let (later, closed_output) = frame(&ctx, &mut prompt, Vec::new());
+        assert_eq!(later, StartupPromptResponse::Later);
+        assert!(closed_output.shapes.is_empty(), "closed prompt painted {} shapes", closed_output.shapes.len());
+    }
+
+    #[test]
+    fn closed_prompt_returns_later_without_painting() {
+        let ctx = dark_context();
+        let mut prompt = prompt_for(false);
+        prompt.open = false;
+        let (response, output) = frame(&ctx, &mut prompt, Vec::new());
+        assert_eq!(response, StartupPromptResponse::Later);
+        assert!(!prompt.open);
+        assert!(output.shapes.is_empty(), "closed prompt painted {} shapes", output.shapes.len());
+        assert!(painted_text(&output).is_empty());
+    }
+}
diff --git a/crates/update/src/distro.rs b/crates/update/src/distro.rs
new file mode 100644
index 00000000..89080522
--- /dev/null
+++ b/crates/update/src/distro.rs
@@ -0,0 +1,108 @@
+//! Linux distributions: reading `os-release` and choosing the package formats that suit them.
+//!
+//! The distro decides the system package format, not which tools happen to be on `PATH`: Fedora
+//! can have `apt-get` and `dpkg` installed (for building Debian images), and an `.rpm` system
+//! must never be handed to apt.
+
+use crate::platform::PackageKind;
+
+/// The parts of `/etc/os-release` that say which distro family this is.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct OsRelease {
+    /// `ID`, lower-cased (`fedora`, `ubuntu`, `opensuse-tumbleweed`, …). Empty when missing.
+    pub id: String,
+    /// `ID_LIKE`, lower-cased and split on spaces (`["rhel", "centos", "fedora"]`).
+    pub id_like: Vec<String>,
+}
+
+/// Reads `os-release` text (`KEY=value` lines, values optionally quoted).
+pub fn parse_os_release(text: &str) -> OsRelease {
+    let mut out = OsRelease::default();
+    for line in text.lines() {
+        let line = line.trim();
+        if line.starts_with('#') {
+            continue;
+        }
+        let Some((key, value)) = line.split_once('=') else { continue };
+        let value = unquote(value.trim()).to_ascii_lowercase();
+        match key.trim() {
+            "ID" => out.id = value,
+            "ID_LIKE" => out.id_like = value.split_whitespace().map(str::to_string).collect(),
+            _ => {}
+        }
+    }
+    out
+}
+
+fn unquote(v: &str) -> &str {
+    for q in ['"', '\''] {
+        if let Some(inner) = v.strip_prefix(q).and_then(|v| v.strip_suffix(q)) {
+            return inner;
+        }
+    }
+    v
+}
+
+/// The distro's own package format: `.deb` for the Debian family, `.rpm` for the Fedora, Red Hat
+/// and SUSE families, `.pkg.tar.zst` for the Arch Linux family, `None` for anything else
+/// (unknown distros), which gets AppImages.
+pub fn native_package(os: &OsRelease) -> Option<PackageKind> {
+    std::iter::once(&os.id).chain(&os.id_like).find_map(|id| family(id))
+}
+
+fn family(id: &str) -> Option<PackageKind> {
+    match id {
+        "debian" | "ubuntu" => Some(PackageKind::Deb),
+        "fedora" | "rhel" | "centos" | "suse" | "sles" => Some(PackageKind::Rpm),
+        _ if id.starts_with("opensuse") => Some(PackageKind::Rpm),
+        "arch" | "manjaro" | "endeavouros" | "garuda" | "cachyos" | "artix" => Some(PackageKind::ArchPkg),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const FEDORA: &str = r#"NAME="Fedora Linux"
+VERSION="40 (Workstation Edition)"
+ID=fedora
+VERSION_ID=40
+PRETTY_NAME="Fedora Linux 40 (Workstation Edition)"
+"#;
+    const UBUNTU: &str = r#"PRETTY_NAME="Ubuntu 24.04.1 LTS"
+NAME="Ubuntu"
+VERSION_ID="24.04"
+ID=ubuntu
+ID_LIKE=debian
+"#;
+    const MINT: &str = "NAME=\"Linux Mint\"\nID=linuxmint\nID_LIKE=\"ubuntu debian\"\n";
+    const ARCH: &str = "NAME=\"Arch Linux\"\nPRETTY_NAME=\"Arch Linux\"\nID=arch\nBUILD_ID=rolling\n";
+    const TUMBLEWEED: &str = "NAME=\"openSUSE Tumbleweed\"\n# a comment\nID=\"opensuse-tumbleweed\"\nID_LIKE=\"opensuse suse\"\n";
+    const ROCKY: &str = "NAME=\"Rocky Linux\"\nID=\"rocky\"\nID_LIKE=\"rhel centos fedora\"\n";
+    const UNKNOWN: &str = "NAME=\"Some OS\"\nID=someos\n";
+
+    fn native(text: &str) -> Option<PackageKind> {
+        native_package(&parse_os_release(text))
+    }
+
+    #[test]
+    fn os_release_is_parsed() {
+        assert_eq!(parse_os_release(FEDORA), OsRelease { id: "fedora".into(), id_like: vec![] });
+        assert_eq!(parse_os_release(MINT), OsRelease { id: "linuxmint".into(), id_like: vec!["ubuntu".into(), "debian".into()] });
+        assert_eq!(parse_os_release("ID='opensuse-leap'\n").id, "opensuse-leap");
+        assert_eq!(parse_os_release(""), OsRelease::default());
+    }
+
+    #[test]
+    fn the_distro_family_picks_the_package_format() {
+        assert_eq!(native(FEDORA), Some(PackageKind::Rpm));
+        assert_eq!(native(ROCKY), Some(PackageKind::Rpm));
+        assert_eq!(native(TUMBLEWEED), Some(PackageKind::Rpm));
+        assert_eq!(native(UBUNTU), Some(PackageKind::Deb));
+        assert_eq!(native(MINT), Some(PackageKind::Deb));
+        assert_eq!(native(ARCH), Some(PackageKind::ArchPkg));
+        assert_eq!(native(UNKNOWN), None);
+        assert_eq!(native(""), None);
+    }
+}
diff --git a/crates/update/src/folders.rs b/crates/update/src/folders.rs
new file mode 100644
index 00000000..a144a3ad
--- /dev/null
+++ b/crates/update/src/folders.rs
@@ -0,0 +1,65 @@
+//! The per-user folders, from the environment, so no extra crate (and its licence) is needed.
+
+use std::path::PathBuf;
+
+/// The user's home folder.
+pub fn home_dir() -> Option<PathBuf> {
+    std::env::home_dir().filter(|h| !h.as_os_str().is_empty())
+}
+
+/// An absolute folder from the environment variable `name` (an XDG one must be absolute).
+fn absolute_env(name: &str) -> Option<PathBuf> {
+    std::env::var_os(name).map(PathBuf::from).filter(|p| p.is_absolute())
+}
+
+/// The known folder Local AppData, which follows a redirected profile (the environment variable
+/// is only the fallback).
+#[cfg(windows)]
+fn local_app_data() -> Option<PathBuf> {
+    use winsafe::{SHGetKnownFolderPath, co};
+    SHGetKnownFolderPath(&co::KNOWNFOLDERID::LocalAppData, co::KF::DEFAULT, None)
+        .ok()
+        .map(PathBuf::from)
+        .filter(|p| p.is_absolute())
+        .or_else(|| absolute_env("LOCALAPPDATA"))
+}
+
+#[cfg(not(windows))]
+fn local_app_data() -> Option<PathBuf> {
+    absolute_env("LOCALAPPDATA")
+}
+
+/// Where per-user data lives on this machine.
+pub fn data_local_dir() -> Option<PathBuf> {
+    if cfg!(target_os = "windows") {
+        local_app_data()
+    } else if cfg!(target_os = "macos") {
+        home_dir().map(|h| h.join("Library").join("Application Support"))
+    } else {
+        absolute_env("XDG_DATA_HOME").or_else(|| home_dir().map(|h| h.join(".local").join("share")))
+    }
+}
+
+/// Where per-user caches live on this machine.
+pub fn cache_dir() -> Option<PathBuf> {
+    if cfg!(target_os = "windows") {
+        local_app_data()
+    } else if cfg!(target_os = "macos") {
+        home_dir().map(|h| h.join("Library").join("Caches"))
+    } else {
+        absolute_env("XDG_CACHE_HOME").or_else(|| home_dir().map(|h| h.join(".cache")))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_folders_are_absolute_when_there_is_a_home() {
+        if home_dir().is_some() {
+            assert!(data_local_dir().is_some_and(|p| p.is_absolute()));
+            assert!(cache_dir().is_some_and(|p| p.is_absolute()));
+        }
+    }
+}
diff --git a/crates/update/src/http.rs b/crates/update/src/http.rs
new file mode 100644
index 00000000..963eed1e
--- /dev/null
+++ b/crates/update/src/http.rs
@@ -0,0 +1,1124 @@
+//! HTTPS requests: small JSON/text answers, redirect probes, and verified downloads.
+
+use std::io::{Read, Write};
+use std::path::Path;
+use std::sync::atomic::{AtomicU8, Ordering};
+
+use crate::protocol::{CANCELLED, PAUSED};
+use std::time::Duration;
+
+use sha2::{Digest, Sha256};
+
+/// Largest JSON or text answer we read.
+const MAX_SMALL: u64 = 4 << 20;
+
+/// What a GET of a small resource produced.
+#[derive(Debug, PartialEq, Eq)]
+pub enum Fetched {
+    Body {
+        text: String,
+        etag: Option<String>,
+    },
+    /// `If-None-Match` matched: the saved copy is current.
+    NotModified,
+    NotFound,
+    /// GitHub's API refused: out of quota until `reset` (Unix seconds), if it said.
+    RateLimited {
+        reset: Option<i64>,
+    },
+}
+
+#[derive(Clone)]
+pub struct Http {
+    small: ureq::Agent,
+    /// ArtCraft's release feed: a short timeout, so a slow server never holds up a check.
+    feed: ureq::Agent,
+    no_redirect: ureq::Agent,
+    download: ureq::Agent,
+    direct: ureq::Agent,
+    direct_download: ureq::Agent,
+    token: Option<String>,
+}
+
+/// Why ArtCraft's release feed couldn't be read.
+#[derive(Debug)]
+pub struct FeedError {
+    pub why: String,
+    /// The server answered HTTP 429 Too Many Requests.
+    pub throttled: bool,
+    /// The server's `Retry-After`, in seconds.
+    pub retry_after: Option<i64>,
+}
+
+/// `http://<loopback host>:<port>` and an optional path: the host must be exactly 127.0.0.1,
+/// localhost or [::1] (no `user@` in front of another host), with a numeric port.
+pub fn is_loopback(url: &str) -> bool {
+    let Some(rest) = url.strip_prefix("http://") else { return false };
+    let authority = rest.split(['/', '?', '#']).next().unwrap_or_default();
+    let Some((host, port)) = authority.rsplit_once(':') else { return false };
+    matches!(host, "127.0.0.1" | "localhost" | "[::1]") && !port.is_empty() && port.parse::<u16>().is_ok()
+}
+
+impl Http {
+    /// `user_agent` names the product and its version (`PhotoCraft/0.9.0`) and nothing about the
+    /// person using it.
+    pub fn new(user_agent: &str) -> Result<Self, String> {
+        // The OS checks each certificate chain itself: Windows fetches roots it hasn't stored yet
+        // and trusts what antivirus HTTPS scanning installs. Reading the store ourselves missed
+        // both ("invalid peer certificate: UnknownIssuer").
+        let tls = || ureq::tls::TlsConfig::builder().root_certs(ureq::tls::RootCerts::PlatformVerifier).build();
+        // Chosen once: the proxy environment variables, else the OS proxy setting.
+        let proxy = crate::proxy::pick();
+        let small = ureq::Agent::config_builder()
+            .tls_config(tls())
+            .proxy(proxy.clone())
+            .timeout_global(Some(Duration::from_secs(20)))
+            .http_status_as_error(false)
+            .user_agent(user_agent)
+            .build()
+            .new_agent();
+        let feed = ureq::Agent::config_builder()
+            .tls_config(tls())
+            .proxy(proxy.clone())
+            .timeout_connect(Some(Duration::from_secs(5)))
+            .timeout_global(Some(Duration::from_secs(10)))
+            .http_status_as_error(false)
+            .user_agent(user_agent)
+            .build()
+            .new_agent();
+        let no_redirect = ureq::Agent::config_builder()
+            .tls_config(tls())
+            .proxy(proxy.clone())
+            .timeout_global(Some(Duration::from_secs(20)))
+            .http_status_as_error(false)
+            .max_redirects(0)
+            .max_redirects_will_error(false)
+            .user_agent(user_agent)
+            .build()
+            .new_agent();
+        let download = ureq::Agent::config_builder()
+            .tls_config(tls())
+            .proxy(proxy.clone())
+            .timeout_connect(Some(Duration::from_secs(20)))
+            .timeout_recv_response(Some(Duration::from_secs(60)))
+            // ureq has no idle timeout: cap each attempt instead, and resume where it stopped.
+            .timeout_recv_body(Some(ATTEMPT_BODY_TIME))
+            .http_status_as_error(false)
+            .user_agent(user_agent)
+            .build()
+            .new_agent();
+        let direct = ureq::Agent::config_builder()
+            .proxy(None)
+            .tls_config(tls())
+            .timeout_connect(Some(Duration::from_secs(5)))
+            .timeout_global(Some(Duration::from_secs(20)))
+            .http_status_as_error(false)
+            .user_agent(user_agent)
+            .build()
+            .new_agent();
+        let direct_download = ureq::Agent::config_builder()
+            .proxy(None)
+            .tls_config(tls())
+            .timeout_connect(Some(Duration::from_secs(20)))
+            .timeout_recv_response(Some(Duration::from_secs(60)))
+            .timeout_recv_body(Some(ATTEMPT_BODY_TIME))
+            .http_status_as_error(false)
+            .user_agent(user_agent)
+            .build()
+            .new_agent();
+        Ok(Self { small, feed, no_redirect, download, direct, direct_download, token: None })
+    }
+
+    /// An optional token raises GitHub's limit from 60 to 5000 requests an hour. Only ever sent
+    /// to api.github.com. Blank means none.
+    #[must_use]
+    pub fn with_github_token(mut self, token: Option<String>) -> Self {
+        self.token = token.map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
+        self
+    }
+
+    /// GET a GitHub API resource, revalidating with `etag` when given.
+    pub fn get_api(&self, url: &str, etag: Option<&str>) -> Result<Fetched, String> {
+        let mut req = self.small.get(url).header("Accept", "application/vnd.github+json").header("X-GitHub-Api-Version", "2022-11-28");
+        if let Some(tag) = etag {
+            req = req.header("If-None-Match", tag);
+        }
+        if let Some(token) = &self.token
+            && url.starts_with("https://api.github.com/")
+        {
+            req = req.header("Authorization", &format!("Bearer {token}"));
+        }
+        let mut resp = req.call().map_err(|e| format!("couldn't reach GitHub ({e})"))?;
+        let header = |name: &str| resp.headers().get(name).and_then(|v| v.to_str().ok()).map(str::to_string);
+        let status = resp.status().as_u16();
+        match status {
+            200 => {
+                let etag = header("etag");
+                let text = read_text_capped(&mut resp, MAX_SMALL).map_err(|e| format!("unreadable answer from GitHub ({e})"))?;
+                Ok(Fetched::Body { text, etag })
+            }
+            304 => Ok(Fetched::NotModified),
+            404 => Ok(Fetched::NotFound),
+            403 | 429 => {
+                let remaining = header("x-ratelimit-remaining");
+                let reset = header("x-ratelimit-reset").and_then(|r| r.trim().parse::<i64>().ok());
+                let retry_after = header("retry-after").and_then(|r| r.trim().parse::<i64>().ok());
+                match refused_until(status, remaining.as_deref(), reset, retry_after, crate::now()) {
+                    Some(reset) => Ok(Fetched::RateLimited { reset }),
+                    None => Err(format!("GitHub refused the request (HTTP {status})")),
+                }
+            }
+            s => Err(format!("GitHub answered HTTP {s}")),
+        }
+    }
+
+    /// ArtCraft's release feed, or why it couldn't be read. Never takes more than ~10 seconds.
+    pub fn get_feed(&self, url: &str) -> Result<String, FeedError> {
+        let failed = |why: String| FeedError { why, throttled: false, retry_after: None };
+        let agent = if is_loopback(url) { &self.direct } else { &self.feed };
+        let mut resp =
+            agent.get(url).header("Accept", "application/json").call().map_err(|e| failed(format!("couldn't reach {} ({e})", host(url))))?;
+        // Seconds only; an HTTP date falls back to our own backoff.
+        let retry_after = resp.headers().get("retry-after").and_then(|v| v.to_str().ok()).and_then(|r| r.trim().parse::<i64>().ok());
+        match resp.status().as_u16() {
+            200 => read_text_capped(&mut resp, MAX_SMALL).map_err(|e| failed(format!("unreadable answer ({e})"))),
+            s => Err(FeedError { why: format!("{} answered HTTP {s}", host(url)), throttled: s == 429, retry_after }),
+        }
+    }
+
+    /// GET a small text file (following redirects).
+    pub fn get_text(&self, url: &str) -> Result<Option<String>, String> {
+        let agent = if is_loopback(url) { &self.direct } else { &self.small };
+        let mut resp = agent.get(url).call().map_err(|e| format!("couldn't reach {} ({e})", host(url)))?;
+        match resp.status().as_u16() {
+            200 => read_text_capped(&mut resp, MAX_SMALL).map(Some).map_err(|e| format!("unreadable answer ({e})")),
+            404 => Ok(None),
+            s => Err(format!("{} answered HTTP {s}", host(url))),
+        }
+    }
+
+    /// GET a small binary file (following redirects). `Ok(None)` for a 404. A file of more than
+    /// `max` bytes is refused: by its announced length before a byte is read, and by a hard limit
+    /// on the body when the length wasn't announced or was wrong.
+    pub fn get_bytes(&self, url: &str, max: usize) -> Result<Option<Vec<u8>>, String> {
+        let agent = if is_loopback(url) { &self.direct } else { &self.small };
+        let mut resp = agent.get(url).call().map_err(|e| format!("couldn't reach {} ({e})", host(url)))?;
+        match resp.status().as_u16() {
+            200 => {
+                let announced = resp.headers().get("content-length").and_then(|v| v.to_str().ok()).and_then(|v| v.parse::<u64>().ok());
+                let too_big = || format!("{} sent more than {max} bytes", host(url));
+                if announced.is_some_and(|n| n > max as u64) {
+                    return Err(too_big());
+                }
+                let body = read_bytes_capped(&mut resp, max)
+                    .map_err(|e| if e.contains("larger than") { too_big() } else { format!("unreadable answer ({e})") })?;
+                Ok(Some(body))
+            }
+            404 => Ok(None),
+            s => Err(format!("{} answered HTTP {s}", host(url))),
+        }
+    }
+
+    /// Where `url` redirects to, without following it.
+    pub fn redirect_target(&self, url: &str) -> Result<Option<String>, String> {
+        let resp = self.no_redirect.head(url).call().map_err(|e| format!("couldn't reach {} ({e})", host(url)))?;
+        match resp.status().as_u16() {
+            300..=399 => Ok(resp.headers().get("location").and_then(|v| v.to_str().ok()).map(str::to_string)),
+            404 => Ok(None),
+            s => Err(format!("{} answered HTTP {s}", host(url))),
+        }
+    }
+
+    /// Downloads `url` to `dest`, checking it against the supplied SHA-256 checksum (and always
+    /// against `size`, when known). The caller must provide a published checksum.
+    ///
+    /// Tolerant by design: an interrupted or stalled transfer resumes where it stopped (HTTP range
+    /// requests) with backoff; a paused download, or one left by an earlier run, continues from
+    /// its partial file; a file that fails its checksum is fetched once more from scratch before
+    /// giving up. When the connection stays down, the download ends paused (`PAUSED`), never
+    /// losing what it has. `stop` pauses or cancels it between reads.
+    pub fn download(&self, url: &str, dest: &Path, size: u64, sha256: &str, stop: &Stop, progress: &mut dyn FnMut(Transfer)) -> Result<(), String> {
+        if sha256.len() != 64 || !sha256.bytes().all(|b| b.is_ascii_hexdigit()) {
+            return Err("the release publishes no valid checksum for this file, so it wasn't downloaded".into());
+        }
+        if let Some(dir) = dest.parent() {
+            std::fs::create_dir_all(dir).map_err(|e| format!("couldn't create {} ({e})", dir.display()))?;
+        }
+        // A finished copy from an earlier attempt that never got installed. Marking it as just
+        // used, before checking it, keeps `clean_downloads` away from it while it's installed.
+        if dest.is_file() && touch(dest) && matches_published(dest, sha256) {
+            progress(Transfer::Bytes { done: size, total: size });
+            return Ok(());
+        }
+        // The partial file is named after the release file and its size; if it still turns out
+        // to belong to something else, the checksum catches it and the download starts over.
+        let part = part_path(dest, size);
+        let mut fresh_start_used = false;
+        loop {
+            if let Err(e) = self.fetch_resuming(url, &part, size, stop, progress) {
+                if e == CANCELLED {
+                    let _ = std::fs::remove_file(&part);
+                } else if e != PAUSED {
+                    log::warn!("download of {url} failed: {e}");
+                }
+                return Err(e);
+            }
+            if matches_published(&part, sha256) {
+                if let Err(e) = rename_retrying(&part, dest, stop) {
+                    if e == CANCELLED {
+                        let _ = std::fs::remove_file(&part);
+                    }
+                    return Err(e);
+                }
+                return Ok(());
+            }
+            let _ = std::fs::remove_file(&part);
+            if fresh_start_used {
+                return Err("the download doesn't match its published checksum, so it wasn't installed".into());
+            }
+            // A resumed file can be spliced wrongly by a misbehaving proxy: try once from zero.
+            log::warn!("checksum mismatch for {url}; downloading again from the start");
+            fresh_start_used = true;
+        }
+    }
+
+    /// Fetches `url` into `part`, resuming from whatever `part` already holds. Retries while the
+    /// transfer keeps making progress; after several attempts in a row get nowhere, it stops and
+    /// reports `PAUSED` so the user can resume later.
+    fn fetch_resuming(&self, url: &str, part: &Path, size: u64, stop: &Stop, progress: &mut dyn FnMut(Transfer)) -> Result<(), String> {
+        let mut fruitless = 0u32;
+        loop {
+            stop.check()?;
+            let have = std::fs::metadata(part).map(|m| m.len()).unwrap_or(0);
+            if fruitless >= MAX_FRUITLESS_ATTEMPTS {
+                log::warn!("{url}: no progress after {fruitless} attempts; pausing");
+                return Err(PAUSED.into());
+            }
+            if fruitless > 0 {
+                progress(Transfer::Reconnecting { done: have, total: size });
+                // 1 s, 2 s, 4 s … 30 s, staying responsive to Pause and Cancel.
+                let wait = Duration::from_secs((1u64 << (fruitless - 1).min(5)).min(30));
+                let until = std::time::Instant::now() + wait;
+                while std::time::Instant::now() < until {
+                    stop.check()?;
+                    std::thread::sleep(Duration::from_millis(100));
+                }
+            }
+            if size > 0 && have == size {
+                return Ok(());
+            }
+            if size > 0 && have > size {
+                std::fs::remove_file(part).map_err(|e| format!("couldn't save the download ({e})"))?;
+                continue;
+            }
+            match self.attempt(url, part, have, size, stop, progress) {
+                Ok(()) => return Ok(()),
+                Err(AttemptError::Stopped(e)) => return Err(e),
+                Err(AttemptError::Fatal(e)) => return Err(e),
+                Err(AttemptError::Retry { error, progressed }) => {
+                    log::info!("{url}: {error}; retrying");
+                    fruitless = if progressed { 1 } else { fruitless + 1 };
+                }
+            }
+        }
+    }
+
+    /// One request: appends to `part` from byte `have`.
+    fn attempt(&self, url: &str, part: &Path, have: u64, size: u64, stop: &Stop, progress: &mut dyn FnMut(Transfer)) -> Result<(), AttemptError> {
+        let retry = |error: String, progressed: bool| AttemptError::Retry { error, progressed };
+        // Binaries are already compressed; ask for the bytes exactly as published.
+        let agent = if is_loopback(url) { &self.direct_download } else { &self.download };
+        let mut req = agent.get(url).header("Accept-Encoding", "identity");
+        if have > 0 {
+            req = req.header("Range", &format!("bytes={have}-"));
+        }
+        let mut resp = match req.call() {
+            Ok(r) => r,
+            Err(e) => return Err(retry(format!("couldn't connect: {e}"), false)),
+        };
+        let status = resp.status().as_u16();
+        let header = |name: &str| resp.headers().get(name).and_then(|v| v.to_str().ok()).map(str::to_string);
+        let (start, total) = match status {
+            200 => (0, header("content-length").and_then(|v| v.parse::<u64>().ok()).filter(|n| *n > 0).unwrap_or(size)),
+            206 => match header("content-range").as_deref().and_then(parse_content_range) {
+                Some((start, Some(total))) => (start, total),
+                Some((start, None)) => (start, size),
+                None => return Err(retry("the server sent an unreadable partial response".into(), false)),
+            },
+            // The range is past the end: the part file is already complete (or wrong; the
+            // checksum decides).
+            416 if have > 0 => return Ok(()),
+            404 | 410 => return Err(AttemptError::Fatal("the file is no longer on the release page".into())),
+            401 | 403 => return Err(retry(format!("the server refused the download (HTTP {status})"), false)),
+            s => return Err(retry(format!("HTTP {s}"), false)),
+        };
+        if size > 0 && total != size {
+            return Err(AttemptError::Fatal(format!("the server offered {total} bytes, but the release lists {size}")));
+        }
+        if let Some(enc) = header("content-encoding")
+            && !enc.eq_ignore_ascii_case("identity")
+        {
+            return Err(AttemptError::Fatal(format!("unexpected Content-Encoding '{enc}' on binary artifact download")));
+        }
+        let limit = if total > 0 { total } else { MAX_DOWNLOAD };
+        let appends = status == 206 && start == have;
+        if appends && have > limit {
+            return Err(AttemptError::Fatal(format!("the download exceeds the permitted size of {limit} bytes")));
+        }
+        // Open the part file at the right place: a 200 restarts it, a 206 continues it.
+        let mut file = match (status, start) {
+            (206, s) if s == have => std::fs::OpenOptions::new().append(true).open(part),
+            _ => std::fs::File::create(part),
+        }
+        .map_err(|e| AttemptError::Fatal(format!("couldn't save the download ({e})")))?;
+        let mut done = if status == 206 && start == have { have } else { 0 };
+        // We check the length and checksum ourselves; the reader's limit is only a backstop
+        // against an endless body. (ureq errors once the limit is *reached*, so leave headroom.)
+        let remaining = limit.saturating_sub(done);
+        let mut reader = resp.body_mut().with_config().limit(remaining.saturating_add(1 << 20)).reader();
+        let mut buf = vec![0u8; 256 * 1024];
+        let at_start = done;
+        progress(Transfer::Bytes { done, total });
+        loop {
+            stop.check().map_err(AttemptError::Stopped)?;
+            let n = match reader.read(&mut buf) {
+                Ok(n) => n,
+                Err(e) => {
+                    let _ = file.sync_all();
+                    return Err(retry(format!("the connection dropped: {e}"), done > at_start));
+                }
+            };
+            if n == 0 {
+                break;
+            }
+            let next_done = done.saturating_add(n as u64);
+            if next_done > limit {
+                return Err(AttemptError::Fatal(format!("the server sent more than the permitted size of {limit} bytes")));
+            }
+            let chunk = buf.get(..n).ok_or_else(|| AttemptError::Fatal("read past the buffer".into()))?;
+            file.write_all(chunk).map_err(|e| AttemptError::Fatal(format!("couldn't save the download ({e}). Is the disk full?")))?;
+            done = next_done;
+            progress(Transfer::Bytes { done, total });
+        }
+        file.sync_all().map_err(|e| AttemptError::Fatal(format!("couldn't save the download ({e})")))?;
+        if total > 0 && done < total {
+            return Err(retry(format!("the connection closed early ({done} of {total} bytes)"), done > at_start));
+        }
+        Ok(())
+    }
+}
+
+/// Attempts in a row without any new bytes before pausing (about two minutes of backoff).
+const MAX_FRUITLESS_ATTEMPTS: u32 = 8;
+/// The longest one request may spend receiving; the next request resumes.
+const ATTEMPT_BODY_TIME: Duration = Duration::from_secs(5 * 60);
+/// Backstop when the server doesn't say how big the file is.
+const MAX_DOWNLOAD: u64 = 16 << 30;
+
+/// What a download reports as it goes.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Transfer {
+    Bytes {
+        done: u64,
+        total: u64,
+    },
+    /// The connection dropped; waiting before trying again.
+    Reconnecting {
+        done: u64,
+        total: u64,
+    },
+}
+
+/// Asks a running download to pause (keeping its partial file) or cancel (deleting it).
+#[derive(Debug, Default)]
+pub struct Stop(AtomicU8);
+
+impl Stop {
+    const RUN: u8 = 0;
+    const PAUSE: u8 = 1;
+    const CANCEL: u8 = 2;
+
+    pub fn pause(&self) {
+        let _ = self.0.compare_exchange(Self::RUN, Self::PAUSE, Ordering::SeqCst, Ordering::SeqCst);
+    }
+
+    pub fn cancel(&self) {
+        self.0.store(Self::CANCEL, Ordering::SeqCst);
+    }
+
+    /// `Err(PAUSED | CANCELLED)` once asked to stop.
+    pub fn check(&self) -> Result<(), String> {
+        match self.0.load(Ordering::SeqCst) {
+            Self::PAUSE => Err(PAUSED.into()),
+            Self::CANCEL => Err(CANCELLED.into()),
+            _ => Ok(()),
+        }
+    }
+}
+
+/// Whether a file on disk is the published one: its SHA-256 matches.
+fn matches_published(path: &Path, sha256: &str) -> bool {
+    sha256_file(path).is_ok_and(|h| h.eq_ignore_ascii_case(sha256))
+}
+
+/// How much of a download is already on disk (a paused or interrupted one).
+pub fn partial_bytes(dest: &Path, size: u64) -> Option<u64> {
+    std::fs::metadata(part_path(dest, size)).ok().map(|m| m.len()).filter(|n| *n > 0)
+}
+
+/// Renames `from` to `to`, retrying for a few seconds while Windows reports the file busy: an
+/// antivirus scanner often holds a just-written installer open, and the rename then fails with
+/// "Access denied" (os error 5) or a sharing violation (os error 32). `stop` pauses or cancels
+/// it between tries.
+fn rename_retrying(from: &Path, to: &Path, stop: &Stop) -> Result<(), String> {
+    let mut wait = Duration::from_millis(100);
+    loop {
+        stop.check()?;
+        match std::fs::rename(from, to) {
+            Err(e) if cfg!(windows) && matches!(e.raw_os_error(), Some(5 | 32)) && wait <= Duration::from_secs(4) => {
+                log::info!("{} is busy ({e}); retrying the rename", to.display());
+                std::thread::sleep(wait);
+                wait = wait.saturating_mul(2);
+            }
+            result => return result.map_err(|e| format!("couldn't save the download ({e})")),
+        }
+    }
+}
+
+/// Sets a file's modification time to now.
+fn touch(path: &Path) -> bool {
+    std::fs::File::options().write(true).open(path).and_then(|f| f.set_modified(std::time::SystemTime::now())).is_ok()
+}
+
+/// Whether a finished download is waiting at `dest`. Judged by size alone: `download` checks it
+/// against the published checksum before anything uses it.
+pub fn finished(dest: &Path, size: u64) -> bool {
+    std::fs::metadata(dest).is_ok_and(|m| m.is_file() && m.len() == size)
+}
+
+/// Removes leftovers from the download folder: partial files in an old naming scheme, paused
+/// downloads untouched for `partial_max_age`, and finished ones (kept after a failed install)
+/// untouched for `finished_max_age` (they're for releases long since replaced, or given up on).
+/// Files written within the last minute are always kept, so a running download is never touched.
+pub fn clean_downloads(dir: &Path, partial_max_age: Duration, finished_max_age: Duration) {
+    let Ok(entries) = std::fs::read_dir(dir) else { return };
+    let now = std::time::SystemTime::now();
+    for entry in entries.flatten() {
+        let path = entry.path();
+        let Ok(meta) = entry.metadata() else { continue };
+        if !meta.is_file() {
+            continue;
+        }
+        let age = meta.modified().ok().and_then(|m| now.duration_since(m).ok()).unwrap_or_default();
+        if age < Duration::from_secs(60) {
+            continue;
+        }
+        let name = entry.file_name().to_string_lossy().into_owned();
+        // Current partial files are `<file>.<size>.part`.
+        let current_part = name
+            .strip_suffix(".part")
+            .and_then(|stem| stem.rsplit_once('.'))
+            .is_some_and(|(_, size)| !size.is_empty() && size.bytes().all(|b| b.is_ascii_digit()));
+        let legacy_part = name.ends_with(".part") && !current_part;
+        let max_age = if name.ends_with(".part") { partial_max_age } else { finished_max_age };
+        if legacy_part || age > max_age {
+            log::info!("removing stale download {}", path.display());
+            let _ = std::fs::remove_file(&path);
+        }
+    }
+}
+
+/// Throws away a paused download, and a finished one kept for another try at installing.
+pub fn discard(dest: &Path, size: u64) {
+    let _ = std::fs::remove_file(part_path(dest, size));
+    let _ = std::fs::remove_file(dest);
+}
+
+enum AttemptError {
+    /// Paused or cancelled.
+    Stopped(String),
+    /// Won't get better by trying again.
+    Fatal(String),
+    Retry {
+        error: String,
+        progressed: bool,
+    },
+}
+
+/// `<dest>.<size>.part`: where an unfinished download of `dest` is kept.
+fn part_path(dest: &Path, size: u64) -> std::path::PathBuf {
+    let tag = size.to_string();
+    let mut name = dest.file_name().map(std::ffi::OsStr::to_os_string).unwrap_or_default();
+    name.push(format!(".{tag}.part"));
+    dest.with_file_name(name)
+}
+
+/// `bytes 100-199/1000` → (100, Some(1000)); `bytes 100-199/*` → (100, None).
+fn parse_content_range(v: &str) -> Option<(u64, Option<u64>)> {
+    let rest = v.trim().strip_prefix("bytes ")?;
+    let (range, total) = rest.split_once('/')?;
+    let start = range.split_once('-')?.0.trim().parse().ok()?;
+    let total = if total.trim() == "*" { None } else { Some(total.trim().parse().ok()?) };
+    Some((start, total))
+}
+
+pub fn hex(bytes: &[u8]) -> String {
+    use std::fmt::Write as _;
+    bytes.iter().fold(String::with_capacity(bytes.len() * 2), |mut s, b| {
+        let _ = write!(s, "{b:02x}");
+        s
+    })
+}
+
+/// SHA-256 of a file on disk.
+pub fn sha256_file(path: &Path) -> Result<String, String> {
+    let mut file = std::fs::File::open(path).map_err(|e| format!("couldn't read {} ({e})", path.display()))?;
+    let mut hasher = Sha256::new();
+    std::io::copy(&mut file, &mut hasher).map_err(|e| format!("couldn't read {} ({e})", path.display()))?;
+    Ok(hex(&hasher.finalize()))
+}
+
+/// Whether a 403 or 429 from GitHub's API means "slow down", and until when (Unix seconds, when
+/// it says). `None`: refused for some other reason.
+///
+/// GitHub sends `x-ratelimit-reset` with every answer: it's when the hourly quota refills, which
+/// only matters once `x-ratelimit-remaining` is 0. A secondary limit says how long to wait in
+/// `Retry-After` (seconds) and leaves the hourly quota alone; without either, GitHub's advice is
+/// to wait a minute.
+fn refused_until(status: u16, remaining: Option<&str>, reset: Option<i64>, retry_after: Option<i64>, now: i64) -> Option<Option<i64>> {
+    let retry = retry_after.map(|secs| now.saturating_add(secs.max(0)));
+    if remaining.map(str::trim) == Some("0") {
+        // `None` sorts first: whichever of the two is known, and the later if both are.
+        return Some(reset.max(retry));
+    }
+    if retry.is_some() {
+        return Some(retry);
+    }
+    (status == 429).then_some(Some(now.saturating_add(60)))
+}
+
+/// The host of `url` for error messages, or all of it when it has no scheme.
+fn host(url: &str) -> &str {
+    url.split_once("://").and_then(|(_, rest)| rest.split('/').next()).unwrap_or(url)
+}
+
+/// Reads a text body, rejecting one whose *decoded* size exceeds `max`.
+///
+/// ureq's own `limit` guards the *compressed* stream: it sits below the transparent gzip decoder,
+/// so a few hundred wire bytes can still expand far past the cap. So we cap the fully decoded
+/// reader with `take` instead, one byte past the cap, and refuse an oversized answer outright —
+/// before it is parsed — instead of truncating it into something that merely fails to parse
+/// (CWE-409). Invalid UTF-8 stays an error, as before.
+fn read_text_capped(resp: &mut ureq::http::Response<ureq::Body>, max: u64) -> Result<String, String> {
+    let mut reader = resp.body_mut().with_config().reader().take(max.saturating_add(1));
+    let mut text = String::new();
+    reader.read_to_string(&mut text).map_err(|e| e.to_string())?;
+    if text.len() as u64 > max {
+        return Err(format!("the answer is larger than {max} bytes"));
+    }
+    Ok(text)
+}
+
+/// Reads a binary body, rejecting one whose decoded size exceeds `max` (CWE-409).
+fn read_bytes_capped(resp: &mut ureq::http::Response<ureq::Body>, max: usize) -> Result<Vec<u8>, String> {
+    let mut reader = resp.body_mut().with_config().reader().take((max as u64).saturating_add(1));
+    let mut bytes = Vec::new();
+    reader.read_to_end(&mut bytes).map_err(|e| e.to_string())?;
+    if bytes.len() > max {
+        return Err(format!("the answer is larger than {max} bytes"));
+    }
+    Ok(bytes)
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+
+    const DAYS_30: Duration = Duration::from_secs(30 * 86_400);
+    const DAYS_7: Duration = Duration::from_secs(7 * 86_400);
+
+    #[test]
+    fn host_is_what_follows_the_scheme() {
+        assert_eq!(host("https://api.github.com/repos/storytold/wordcraft"), "api.github.com");
+        assert_eq!(host("http://127.0.0.1:8080"), "127.0.0.1:8080");
+        assert_eq!(host("not a url"), "not a url");
+    }
+
+    #[test]
+    fn cleaning_keeps_current_partial_files_and_removes_leftovers() {
+        let dir = tempfile::tempdir().unwrap();
+        let old = std::time::SystemTime::now() - Duration::from_secs(3600);
+        let make = |name: &str| {
+            let p = dir.path().join(name);
+            std::fs::write(&p, b"x").unwrap();
+            std::fs::File::options().write(true).open(&p).unwrap().set_modified(old).unwrap();
+            p
+        };
+        let keep = make("photocraft-0.5.0-macos-universal.dmg.150000.part");
+        let legacy = make("photocraft-0.5.0-macos-universal.part");
+        let finished = make("photocraft-0.5.0-macos-universal.dmg");
+        let fresh = dir.path().join("x.part");
+        std::fs::write(&fresh, b"x").unwrap();
+        clean_downloads(dir.path(), DAYS_30, DAYS_7);
+        assert!(keep.exists() && fresh.exists() && finished.exists());
+        assert!(!legacy.exists());
+        // A finished file goes sooner than a paused one.
+        clean_downloads(dir.path(), DAYS_30, Duration::from_secs(60));
+        assert!(keep.exists() && !finished.exists());
+        clean_downloads(dir.path(), Duration::from_secs(60), DAYS_7);
+        assert!(!keep.exists());
+    }
+
+    #[test]
+    fn a_kept_file_that_still_matches_is_not_fetched_again() {
+        let (body, sha) = body();
+        let len = body.len() as u64;
+        let (url, requests) = serve(body.clone(), vec![Reply::Full, Reply::Full]);
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("file.bin");
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        http.download(&url, &dest, len, &sha, &Stop::default(), &mut |_| {}).unwrap();
+        assert!(finished(&dest, len) && !finished(&dest, 0));
+        // Old enough to be cleaned up, were it not about to be used.
+        let old = std::time::SystemTime::now() - Duration::from_secs(40 * 86_400);
+        std::fs::File::options().write(true).open(&dest).unwrap().set_modified(old).unwrap();
+        let mut last = (0, 0);
+        let again = http.download(&url, &dest, len, &sha, &Stop::default(), &mut |t| {
+            if let Transfer::Bytes { done, total } = t {
+                last = (done, total);
+            }
+        });
+        assert_eq!(again, Ok(()));
+        assert_eq!(last, (len, len));
+        assert_eq!(requests.lock().unwrap().len(), 1);
+        // A cleanup while the installer runs leaves the reused file alone.
+        clean_downloads(dir.path(), DAYS_30, DAYS_7);
+        assert_eq!(std::fs::read(&dest).unwrap(), body);
+        discard(&dest, len);
+        assert!(!finished(&dest, len));
+    }
+
+    #[test]
+    fn a_kept_file_that_no_longer_matches_is_fetched_again() {
+        let (body, sha) = body();
+        let len = body.len() as u64;
+        let (url, requests) = serve(body.clone(), vec![Reply::Full, Reply::Full]);
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("file.bin");
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        http.download(&url, &dest, len, &sha, &Stop::default(), &mut |_| {}).unwrap();
+        // The same size, so only the checksum can tell.
+        std::fs::write(&dest, vec![b'x'; body.len()]).unwrap();
+        http.download(&url, &dest, len, &sha, &Stop::default(), &mut |_| {}).unwrap();
+        assert_eq!(std::fs::read(&dest).unwrap(), body);
+        assert_eq!(requests.lock().unwrap().len(), 2);
+    }
+
+    #[test]
+    fn reads_content_ranges() {
+        assert_eq!(parse_content_range("bytes 100-199/1000"), Some((100, Some(1000))));
+        assert_eq!(parse_content_range("bytes 5-9/*"), Some((5, None)));
+        assert_eq!(parse_content_range("items 1-2/3"), None);
+        assert_eq!(parse_content_range("bytes x-9/10"), None);
+    }
+
+    use std::io::{BufRead, BufReader};
+    use std::net::TcpListener;
+    use std::sync::{Arc, Mutex};
+
+    /// How the fake server answers one request.
+    #[derive(Clone, Copy, Debug)]
+    pub(crate) enum Reply {
+        /// The whole file.
+        Full,
+        /// Promise the whole file, send `n` bytes, hang up.
+        DropAfter(usize),
+        /// Honour `Range` with a 206.
+        Ranged,
+        /// The right length, wrong bytes.
+        Corrupt,
+        /// 404.
+        Missing,
+        /// The whole body, already a gzip stream, announced as `Content-Encoding: gzip`.
+        Gzipped,
+    }
+
+    /// Serves `body` over plain HTTP following `script`, one reply per connection; records the
+    /// `Range` header each request carried.
+    pub(crate) fn serve(body: Vec<u8>, script: Vec<Reply>) -> (String, Arc<Mutex<Vec<Option<String>>>>) {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let url = format!("http://{}/file.bin", listener.local_addr().unwrap());
+        let ranges = Arc::new(Mutex::new(Vec::new()));
+        let seen = ranges.clone();
+        std::thread::spawn(move || {
+            for reply in script {
+                let Ok((mut stream, _)) = listener.accept() else { return };
+                let mut range = None;
+                let mut reader = BufReader::new(stream.try_clone().unwrap());
+                loop {
+                    let mut line = String::new();
+                    if reader.read_line(&mut line).unwrap_or(0) == 0 || line == "\r\n" {
+                        break;
+                    }
+                    if let Some(v) = line.to_ascii_lowercase().strip_prefix("range: bytes=") {
+                        range = v.trim().trim_end_matches('-').parse::<usize>().ok();
+                    }
+                }
+                seen.lock().unwrap().push(range.map(|r| r.to_string()));
+                let len = body.len();
+                let _ = match reply {
+                    Reply::Full => {
+                        write!(stream, "HTTP/1.1 200 OK\r\nContent-Length: {len}\r\nConnection: close\r\n\r\n").and_then(|()| stream.write_all(&body))
+                    }
+                    Reply::DropAfter(n) => write!(stream, "HTTP/1.1 200 OK\r\nContent-Length: {len}\r\nConnection: close\r\n\r\n")
+                        .and_then(|()| stream.write_all(&body[..n])),
+                    Reply::Corrupt => write!(stream, "HTTP/1.1 200 OK\r\nContent-Length: {len}\r\nConnection: close\r\n\r\n")
+                        .and_then(|()| stream.write_all(&vec![b'x'; len])),
+                    Reply::Missing => write!(stream, "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"),
+                    Reply::Gzipped => {
+                        write!(stream, "HTTP/1.1 200 OK\r\nContent-Length: {len}\r\nContent-Encoding: gzip\r\nConnection: close\r\n\r\n")
+                            .and_then(|()| stream.write_all(&body))
+                    }
+                    Reply::Ranged => {
+                        let from = range.unwrap_or(0);
+                        write!(
+                            stream,
+                            "HTTP/1.1 206 Partial Content\r\nContent-Length: {}\r\nContent-Range: bytes {from}-{}/{len}\r\nConnection: close\r\n\r\n",
+                            len - from,
+                            len - 1
+                        )
+                        .and_then(|()| stream.write_all(&body[from..]))
+                    }
+                };
+            }
+        });
+        (url, ranges)
+    }
+
+    pub(crate) fn body() -> (Vec<u8>, String) {
+        let body: Vec<u8> = (0..700_000u32).map(|i| (i % 251) as u8).collect();
+        let sha = hex(&Sha256::digest(&body));
+        (body, sha)
+    }
+
+    fn run(script: Vec<Reply>) -> (Result<Vec<u8>, String>, Vec<Option<String>>) {
+        let (body, sha) = body();
+        let (url, ranges) = serve(body.clone(), script);
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("file.bin");
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let mut last = (0, 0);
+        let result = http.download(&url, &dest, body.len() as u64, &sha, &Stop::default(), &mut |t| {
+            if let Transfer::Bytes { done, total } = t {
+                last = (done, total);
+            }
+        });
+        let result = result.map(|()| std::fs::read(&dest).unwrap());
+        if result.is_ok() {
+            assert_eq!(last, (body.len() as u64, body.len() as u64));
+        }
+        let seen = ranges.lock().unwrap().clone();
+        (result, seen)
+    }
+
+    #[test]
+    fn small_binary_files_are_read_whole_and_a_404_is_none() {
+        let (body, _) = body();
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let (url, _) = serve(body.clone(), vec![Reply::Full]);
+        assert_eq!(http.get_bytes(&url, body.len()).unwrap(), Some(body.clone()), "a body of exactly the cap is fine");
+        let (url, _) = serve(body, vec![Reply::Missing]);
+        assert_eq!(http.get_bytes(&url, 1 << 20).unwrap(), None);
+    }
+
+    #[test]
+    fn a_file_over_the_cap_is_refused() {
+        let (body, _) = body();
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let (url, _) = serve(body.clone(), vec![Reply::Full]);
+        let err = http.get_bytes(&url, body.len() - 1).unwrap_err();
+        assert!(err.contains("more than"), "{err}");
+    }
+
+    #[test]
+    fn a_complete_body_of_exactly_the_published_size_succeeds() {
+        // The bug this guards: a reader limit equal to the size failed on the final read.
+        let (result, _) = run(vec![Reply::Full]);
+        assert_eq!(result.unwrap(), body().0);
+    }
+
+    #[test]
+    fn a_dropped_connection_resumes_where_it_stopped() {
+        let (result, ranges) = run(vec![Reply::DropAfter(300_000), Reply::Ranged]);
+        assert_eq!(result.unwrap(), body().0);
+        assert_eq!(ranges, [None, Some("300000".to_string())]);
+    }
+
+    #[test]
+    fn a_server_that_ignores_ranges_starts_over() {
+        let (result, _) = run(vec![Reply::DropAfter(123_456), Reply::Full]);
+        assert_eq!(result.unwrap(), body().0);
+    }
+
+    #[test]
+    fn corrupt_data_is_fetched_again_and_never_kept() {
+        let (result, _) = run(vec![Reply::Corrupt, Reply::Full]);
+        assert_eq!(result.unwrap(), body().0);
+        let (result, _) = run(vec![Reply::Corrupt, Reply::Corrupt]);
+        assert!(result.unwrap_err().contains("checksum"));
+    }
+
+    #[test]
+    fn pausing_keeps_the_partial_file_and_resuming_continues_it() {
+        let (body, sha) = body();
+        let len = body.len() as u64;
+        let (url, ranges) = serve(body.clone(), vec![Reply::Full, Reply::Ranged]);
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("file.bin");
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let stop = Stop::default();
+        // Pause as soon as the first bytes arrive.
+        let err = http
+            .download(&url, &dest, len, &sha, &stop, &mut |t| {
+                if matches!(t, Transfer::Bytes { done, .. } if done > 0) {
+                    stop.pause();
+                }
+            })
+            .unwrap_err();
+        assert_eq!(err, PAUSED);
+        let kept = partial_bytes(&dest, len).unwrap();
+        assert!(kept > 0 && kept < len, "{kept}");
+        http.download(&url, &dest, len, &sha, &Stop::default(), &mut |_| {}).unwrap();
+        assert_eq!(std::fs::read(&dest).unwrap(), body);
+        assert_eq!(ranges.lock().unwrap()[1], Some(kept.to_string()));
+    }
+
+    #[test]
+    fn cancelling_throws_the_partial_file_away() {
+        let (body, sha) = body();
+        let len = body.len() as u64;
+        let (url, _) = serve(body, vec![Reply::Full]);
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("file.bin");
+        let stop = Stop::default();
+        let err = Http::new(crate::TEST_AGENT)
+            .unwrap()
+            .download(&url, &dest, len, &sha, &stop, &mut |t| {
+                if matches!(t, Transfer::Bytes { done, .. } if done > 0) {
+                    stop.cancel();
+                }
+            })
+            .unwrap_err();
+        assert_eq!(err, CANCELLED);
+        assert_eq!(partial_bytes(&dest, len), None);
+    }
+
+    #[test]
+    fn a_missing_file_fails_at_once() {
+        let (result, ranges) = run(vec![Reply::Missing, Reply::Full]);
+        assert!(result.unwrap_err().contains("no longer"));
+        assert_eq!(ranges.len(), 1);
+    }
+
+    #[test]
+    fn a_partial_file_from_an_earlier_run_is_continued() {
+        let (body, sha) = body();
+        let (url, ranges) = serve(body.clone(), vec![Reply::Ranged]);
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("file.bin");
+        std::fs::write(part_path(&dest, body.len() as u64), &body[..500_000]).unwrap();
+        assert_eq!(partial_bytes(&dest, body.len() as u64), Some(500_000));
+        Http::new(crate::TEST_AGENT).unwrap().download(&url, &dest, body.len() as u64, &sha, &Stop::default(), &mut |_| {}).unwrap();
+        assert_eq!(std::fs::read(&dest).unwrap(), body);
+        assert_eq!(*ranges.lock().unwrap(), [Some("500000".to_string())]);
+        assert!(!part_path(&dest, body.len() as u64).exists());
+    }
+
+    #[test]
+    fn an_oversized_partial_file_is_restarted_from_zero() {
+        let (body, sha) = body();
+        let (url, ranges) = serve(body.clone(), vec![Reply::Full]);
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("file.bin");
+        let size = body.len() as u64;
+        std::fs::write(part_path(&dest, size), vec![b'x'; body.len() + 1]).unwrap();
+        Http::new(crate::TEST_AGENT).unwrap().download(&url, &dest, size, &sha, &Stop::default(), &mut |_| {}).unwrap();
+        assert_eq!(std::fs::read(dest).unwrap(), body);
+        assert_eq!(*ranges.lock().unwrap(), [None]);
+    }
+
+    #[test]
+    fn an_oversized_partial_file_that_cannot_be_removed_reports_an_error() {
+        let dir = tempfile::tempdir().unwrap();
+        let part = part_path(&dir.path().join("file.bin"), 1);
+        // A directory cannot be removed as a file on Unix. On Windows, hold a file open
+        // without delete sharing: metadata remains readable, but removing it is refused.
+        #[cfg(unix)]
+        std::fs::create_dir(&part).unwrap();
+        #[cfg(windows)]
+        let _locked_partial = {
+            use std::os::windows::fs::OpenOptionsExt;
+            std::fs::write(&part, b"too large").unwrap();
+            // FILE_SHARE_READ | FILE_SHARE_WRITE, without FILE_SHARE_DELETE.
+            std::fs::File::options().read(true).share_mode(0x00000003).open(&part).unwrap()
+        };
+        assert!(std::fs::metadata(&part).unwrap().len() > 1);
+        assert!(std::fs::remove_file(&part).is_err());
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let stop = Stop::default();
+        // Bound the regression: the old retry loop spins until Cancel, without a request.
+        let (finished, done) = std::sync::mpsc::channel();
+        let error = std::thread::scope(|scope| {
+            let watchdog_stop = &stop;
+            scope.spawn(move || {
+                if done.recv_timeout(Duration::from_secs(10)).is_err() {
+                    watchdog_stop.cancel();
+                }
+            });
+            let result = http.fetch_resuming("http://127.0.0.1:9/file.bin", &part, 1, &stop, &mut |_| {});
+            let _ = finished.send(());
+            result.unwrap_err()
+        });
+        assert!(error.contains("couldn't save the download"), "{error}");
+        assert!(part.exists(), "a blocked partial file must be left alone");
+    }
+
+    #[test]
+    fn an_oversized_feed_answer_is_refused_before_parsing() {
+        // More than MAX_SMALL (4 MiB) of decoded text: rejected outright, not truncated and parsed.
+        let big = vec![b' '; (MAX_SMALL as usize) + 1024];
+        let (url, _) = serve(big, vec![Reply::Full]);
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let err = http.get_feed(&url).unwrap_err();
+        assert!(err.why.contains("larger than"), "{}", err.why);
+        // A small answer still comes back intact.
+        let (url, _) = serve(b"{\"ok\":true}".to_vec(), vec![Reply::Full]);
+        assert_eq!(http.get_feed(&url).unwrap(), "{\"ok\":true}");
+    }
+
+    #[test]
+    fn a_gzip_bomb_answer_is_refused_before_parsing() {
+        // A few hundred bytes on the wire that decode to more than MAX_SMALL. ureq's own limit
+        // sits below the transparent gzip decoder, so only a cap on the decoded stream (CWE-409)
+        // refuses this; a wire-byte limit would hand the parser truncated JSON.
+        let big = vec![b'x'; (MAX_SMALL as usize) + 1024];
+        let gz = gzip(&big);
+        assert!(gz.len() * 4 < MAX_SMALL as usize, "no longer a bomb: {} compressed bytes", gz.len());
+        let (url, _) = serve(gz, vec![Reply::Gzipped]);
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let err = http.get_text(&url).unwrap_err();
+        assert!(err.contains("larger than"), "{err}");
+        // A small gzip answer still decodes intact.
+        let (url, _) = serve(gzip(b"{\"ok\":true}"), vec![Reply::Gzipped]);
+        assert_eq!(http.get_text(&url).unwrap().unwrap(), "{\"ok\":true}");
+    }
+
+    /// `data` as a real gzip stream (what `Reply::Gzipped` serves).
+    fn gzip(data: &[u8]) -> Vec<u8> {
+        let mut enc = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+        enc.write_all(data).unwrap();
+        enc.finish().unwrap()
+    }
+
+    /// Live: a real Craft App release asset (`cargo test -p artcraft-launcher-native -- --ignored`).
+    #[test]
+    #[ignore = "needs network access"]
+    fn downloads_a_real_release_asset() {
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let Fetched::Body { text, .. } = http.get_api("https://api.github.com/repos/storytold/wordcraft/releases/latest", None).unwrap() else {
+            panic!("no release")
+        };
+        let release = crate::release::parse_github_release(&text, "storytold/wordcraft").unwrap();
+        let sums_url = &release.sums_asset().unwrap().url;
+        let sums = crate::release::parse_sha256sums(&http.get_text(sums_url).unwrap().unwrap());
+        let asset = release.assets.iter().find(|a| a.name.ends_with("freebsd-x86_64.tar.gz")).unwrap();
+        let sha = asset.sha256.clone().or_else(|| sums.iter().find(|(_, n)| *n == asset.name).map(|(h, _)| h.clone())).unwrap();
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join(&asset.name);
+        http.download(&asset.url, &dest, asset.size, &sha, &Stop::default(), &mut |_| {}).unwrap();
+        assert_eq!(std::fs::metadata(&dest).unwrap().len(), asset.size);
+    }
+
+    /// Answers one request with `head` (status line and headers) and an empty body.
+    fn answer_once(head: String) -> String {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let url = format!("http://{}/repos/storytold/photocraft/releases/latest", listener.local_addr().unwrap());
+        std::thread::spawn(move || {
+            let Ok((mut stream, _)) = listener.accept() else { return };
+            let mut reader = BufReader::new(stream.try_clone().unwrap());
+            loop {
+                let mut line = String::new();
+                if reader.read_line(&mut line).unwrap_or(0) == 0 || line == "\r\n" {
+                    break;
+                }
+            }
+            let _ = write!(stream, "{head}Content-Length: 0\r\nConnection: close\r\n\r\n");
+        });
+        url
+    }
+
+    #[test]
+    fn a_secondary_limit_waits_for_retry_after_not_the_hourly_reset() {
+        // GitHub's secondary limit: quota left, an hourly reset 50 minutes away, and "try again
+        // in a minute". That's a minute, not 50 minutes of "the hourly limit was reached".
+        let now = crate::now();
+        let url = answer_once(format!(
+            "HTTP/1.1 403 Forbidden\r\nx-ratelimit-remaining: 41\r\nx-ratelimit-reset: {}\r\nretry-after: 60\r\n",
+            now + 50 * 60
+        ));
+        let Fetched::RateLimited { reset: Some(until) } = Http::new(crate::TEST_AGENT).unwrap().get_api(&url, None).unwrap() else {
+            panic!("not rate limited")
+        };
+        assert!((now + 60..now + 120).contains(&until), "limited for {} s", until - now);
+    }
+
+    #[test]
+    fn an_empty_hourly_quota_waits_for_the_reset() {
+        let now = crate::now();
+        let reset = now + 31 * 60;
+        let url = answer_once(format!("HTTP/1.1 403 Forbidden\r\nx-ratelimit-remaining: 0\r\nx-ratelimit-reset: {reset}\r\n"));
+        assert_eq!(Http::new(crate::TEST_AGENT).unwrap().get_api(&url, None).unwrap(), Fetched::RateLimited { reset: Some(reset) });
+    }
+
+    #[test]
+    fn github_refusals_are_read_the_way_github_documents_them() {
+        const NOW: i64 = 1_791_500_000;
+        // Out of quota: until the reset, or Retry-After if that's later.
+        assert_eq!(refused_until(403, Some("0"), Some(NOW + 1800), None, NOW), Some(Some(NOW + 1800)));
+        assert_eq!(refused_until(403, Some("0"), Some(NOW + 30), Some(90), NOW), Some(Some(NOW + 90)));
+        assert_eq!(refused_until(403, Some("0"), None, None, NOW), Some(None));
+        // A secondary limit: Retry-After, never the hourly reset.
+        assert_eq!(refused_until(429, Some("12"), Some(NOW + 1800), Some(30), NOW), Some(Some(NOW + 30)));
+        // A 429 that doesn't say: a minute.
+        assert_eq!(refused_until(429, Some("12"), Some(NOW + 1800), None, NOW), Some(Some(NOW + 60)));
+        // A plain 403 (blocked, private, …) isn't a rate limit.
+        assert_eq!(refused_until(403, Some("12"), Some(NOW + 1800), None, NOW), None);
+        assert_eq!(refused_until(403, None, None, None, NOW), None);
+    }
+
+    #[test]
+    fn partial_files_are_named_after_the_file_and_size() {
+        assert_eq!(part_path(Path::new("/d/photocraft.dmg"), 9), Path::new("/d/photocraft.dmg.9.part"));
+    }
+
+    #[test]
+    fn get_bytes_rejects_oversized_payload() {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let port = listener.local_addr().unwrap().port();
+        std::thread::spawn(move || {
+            let Ok((mut stream, _)) = listener.accept() else { return };
+            let mut line = String::new();
+            let mut reader = BufReader::new(stream.try_clone().unwrap());
+            while reader.read_line(&mut line).unwrap_or(0) > 0 && line != "\r\n" {
+                line.clear();
+            }
+            let body = vec![b'A'; 200];
+            let _ = write!(stream, "HTTP/1.1 200 OK\r\nContent-Length: 200\r\nConnection: close\r\n\r\n");
+            let _ = stream.write_all(&body);
+        });
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let result = http.get_bytes(&format!("http://127.0.0.1:{port}/test.bin"), 100);
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("more than 100 bytes"));
+    }
+}
diff --git a/crates/update/src/install.rs b/crates/update/src/install.rs
new file mode 100644
index 00000000..09de4e0c
--- /dev/null
+++ b/crates/update/src/install.rs
@@ -0,0 +1,2871 @@
+//! Installing, updating, removing and starting Craft Apps.
+//!
+//! Apps go where their platform keeps applications, installed the platform's own way:
+//!
+//! - macOS: the signed `.app` from the release DMG into `/Applications`.
+//! - Windows: the release MSI (Windows Installer) into `C:\Program Files\<App>`.
+//! - Linux: the distro's own package (`.deb` through apt on the Debian family, `.rpm` through
+//!   dnf/zypper/rpm on the Fedora, Red Hat and SUSE families, read from `os-release`) with the
+//!   system's polkit password prompt; otherwise a Flatpak, otherwise an AppImage in
+//!   `~/Applications` (the AppImage convention), with a menu entry and icon in
+//!   `~/.local/share` so it shows up like any other app. A Flatpak or AppImage launcher prefers
+//!   its own format.
+//! - FreeBSD: the release's `/usr/local` tree, with a polkit prompt (or `~/.local` without one).
+//! - Linux, inside the Flatpak launcher with no usable host Flatpak (none installed, or
+//!   `flatpak-spawn` not allowed): the release tarball, unpacked into the launcher's own folder
+//!   (`<data>/apps/<app>`) and run inside the same sandbox with `HOME` pointed at a `home/`
+//!   folder beside it, so the app's settings stay in the sandbox too.
+//!
+//! Every download is checked against its published SHA-256 before anything is unpacked, a
+//! running app is never replaced, and a new copy is fully in place before the old one goes.
+
+use std::path::{Path, PathBuf};
+
+use crate::protocol::{CANCELLED, INSTALL_CANCELLED, InstallLocations, JobPhase};
+use crate::release::{self, Asset, Release};
+use crate::{App, InstallSource, Installed, PackageKind, version};
+
+use crate::http::{Http, Stop, Transfer};
+use crate::manifest::Record;
+use crate::paths::Paths;
+use crate::process;
+
+/// What an install needs from the backend.
+pub struct Job<'a> {
+    pub http: &'a Http,
+    pub paths: &'a Paths,
+    pub stop: &'a Stop,
+    pub phase: &'a mut dyn FnMut(JobPhase),
+    pub install_locations: &'a InstallLocations,
+    /// Write over whatever [`occupied`] found.
+    pub replace: bool,
+}
+
+/// Downloads and installs `asset` of `release`. Returns a record when the launcher owns the
+/// result (portable ZIP, AppImage, macOS bundle, tarball); MSI installs are found in the registry.
+/// `previous` is the launcher's record of the copy being replaced, if it installed it.
+pub fn install(
+    app: &App,
+    release: &Release,
+    asset: &Asset,
+    kind: PackageKind,
+    existing: Option<&Installed>,
+    previous: Option<&Record>,
+    job: &mut Job<'_>,
+) -> Result<Option<Record>, String> {
+    install_at(app, release, asset, kind, existing, previous, job, None)
+}
+
+type RecordCommit<'a> = Option<&'a mut dyn FnMut(&Record) -> Result<(), String>>;
+
+#[allow(clippy::too_many_arguments)]
+pub fn install_at(
+    app: &App,
+    release: &Release,
+    asset: &Asset,
+    kind: PackageKind,
+    existing: Option<&Installed>,
+    previous: Option<&Record>,
+    job: &mut Job<'_>,
+    commit: RecordCommit<'_>,
+) -> Result<Option<Record>, String> {
+    #[cfg(windows)]
+    let mut commit = commit;
+    #[cfg(not(windows))]
+    let _ = commit;
+    #[allow(unused_variables)]
+    let destination = destination(app, kind, existing, previous, job.install_locations)?;
+    if let Some(inst) = existing
+        && inst.source.launcher_can_update()
+        && process::is_running(Path::new(&inst.location))
+    {
+        return Err(format!("{} is running. Quit it, then try again.", app.name));
+    }
+    bind_artifact_version(app, release, asset)?;
+    if !job.replace
+        && let Some(inst) = existing
+        && let (Some(rel_v), Some(inst_v)) = (release.version.as_ref(), inst.version.as_ref())
+        && version::is_newer(inst_v, rel_v)
+    {
+        return Err(format!("Cannot update {} to {}: installed version {} is newer", app.name, release.version_label(), inst_v));
+    }
+    log::info!("{}: starting {} to {} ({})", app.name, if existing.is_some() { "update" } else { "install" }, release.version_label(), kind.label());
+    let file = download(release, asset, job)?;
+    log::info!("{}: download ready ({}), running installer...", app.name, file.display());
+    // Past this point the install can't be interrupted halfway.
+    (job.phase)(JobPhase::Installing);
+    #[allow(unused_variables)]
+    let version = release.version_label();
+    let result = match kind {
+        #[cfg(target_os = "macos")]
+        PackageKind::Dmg => {
+            macos::install_dmg(app, &file, existing, destination.as_deref(), job.replace, job.paths, &macos::Expect::release(release))
+                .map(|path| Some(record(&version, kind, path, Vec::new(), false)))
+        }
+        #[cfg(windows)]
+        PackageKind::Msi => windows::run_msi(&file, destination.as_deref(), job.stop, &mut *job.phase).map(|_| None),
+        #[cfg(windows)]
+        PackageKind::PortableZip => {
+            crate::portable::install(app, &file, &version, previous, job.paths, destination.as_deref(), job.replace, &mut |record| {
+                if release.version.is_some() && crate::detect::windows::executable_version(&record.path).as_ref() != release.version.as_ref() {
+                    return Err("The portable executable does not match the selected version. The installation was rolled back.".into());
+                }
+                match commit.as_deref_mut() {
+                    Some(commit) => commit(record),
+                    None => Ok(()),
+                }
+            })
+            .map(Some)
+        }
+        #[cfg(target_os = "linux")]
+        PackageKind::Deb | PackageKind::Rpm | PackageKind::ArchPkg | PackageKind::Flatpak => {
+            linux::install_package(kind, &file, job.stop, &mut *job.phase).map(|_| None)
+        }
+        #[cfg(target_os = "linux")]
+        PackageKind::AppImage => {
+            linux::install_appimage(&file, &asset.name, destination.as_deref(), previous, job.replace).map(|(path, replaced)| {
+                let files = linux::integrate(app, &path, &replaced, previous);
+                Some(record(&version, kind, path, files, false))
+            })
+        }
+        #[cfg(target_os = "freebsd")]
+        PackageKind::TarGz => freebsd::install_tree(app, &file, job.paths).map(|(bin, files, root)| Some(record(&version, kind, bin, files, root))),
+        #[cfg(target_os = "linux")]
+        PackageKind::TarGz => linux::install_tree(app, &file, job.paths).map(|path| Some(record(&version, kind, path, Vec::new(), false))),
+        other => Err(format!("{} isn't supported on this system", other.label())),
+    };
+    match &result {
+        Ok(_) => log::info!("{}: successfully installed/updated to {}", app.name, release.version_label()),
+        Err(e) if e == CANCELLED => log::info!("{}: installation cancelled", app.name),
+        Err(e) => log::error!("{}: installation failed: {e}", app.name),
+    }
+    // A failed install keeps the download: the next try checks it against its published checksum
+    // again and skips the transfer.
+    if result.is_ok() {
+        let _ = std::fs::remove_file(&file);
+    }
+    // The system's own prompt was dismissed: the download itself wasn't cancelled.
+    result.map_err(|e| if e == CANCELLED { INSTALL_CANCELLED.to_string() } else { e })
+}
+
+/// Rejects an artifact whose own identity disagrees with the release that authorized it.
+///
+/// A feed or GitHub converter supplies the release version, the asset filename, and the download
+/// URL independently. The downgrade guard and the persisted record both trust `release.version`,
+/// so a controller could advertise a new version while pointing at an older official artifact —
+/// bypassing the guard and recording a false installed version (finding: version not bound to the
+/// release). We require the version encoded in the asset filename and the release tag embedded in
+/// the download URL to agree with the release version before any bytes are fetched.
+pub(crate) fn bind_artifact_version(app: &App, release: &Release, asset: &Asset) -> Result<(), String> {
+    let mismatch = || format!("{}'s download does not match the advertised version {}.", app.name, release.version_label());
+    let release_version = release.version.as_ref();
+
+    // The version in the asset filename (`<stem>-<version>-<os>-<arch>.<ext>`), when it carries one.
+    let stems: Vec<&str> = app.stems().collect();
+    if let Some(release_version) = release_version
+        && let Some(parsed) = crate::platform::parse_asset_name(&asset.name, &stems)
+        && version::parse(&parsed.version).as_ref() != Some(release_version)
+    {
+        return Err(mismatch());
+    }
+
+    // The release tag and filename embedded in a release download URL (`.../releases/download/<tag>/<name>`).
+    if let Some(rest) = asset.url.split("/releases/download/").nth(1) {
+        let mut parts = rest.split('/');
+        let tag = parts.next().unwrap_or("");
+        let url_filename = parts.next().unwrap_or("");
+        if tag.is_empty()
+            || release_version
+                .map_or(tag != release.tag, |release_version| tag != release.tag && version::parse(tag).as_ref() != Some(release_version))
+        {
+            return Err(mismatch());
+        }
+        if !url_filename.is_empty() && url_filename != asset.name {
+            return Err(format!("{}'s download URL filename does not match selected asset {}.", app.name, asset.name));
+        }
+    }
+    Ok(())
+}
+
+/// What a new install would write over: something already at its destination that the launcher
+/// didn't put there.
+pub fn occupied(
+    app: &App,
+    #[cfg_attr(not(target_os = "linux"), allow(unused_variables))] asset: &Asset,
+    kind: PackageKind,
+    existing: Option<&Installed>,
+    previous: Option<&Record>,
+    locations: &InstallLocations,
+    paths: &Paths,
+) -> Result<Option<PathBuf>, String> {
+    if existing.is_some() || previous.is_some() {
+        return Ok(None);
+    }
+    let folder = destination(app, kind, None, None, locations)?;
+    let target = match kind {
+        PackageKind::Msi => folder,
+        PackageKind::PortableZip => Some(folder.unwrap_or_else(|| paths.apps()).join(app.id)),
+        PackageKind::Dmg => folder.map(|f| f.join(format!("{}.app", app.name))),
+        #[cfg(target_os = "linux")]
+        PackageKind::AppImage => folder.or_else(crate::detect::linux::appimage_dir).map(|f| f.join(&asset.name)),
+        _ => None,
+    };
+    Ok(target.filter(|t| std::fs::symlink_metadata(t).is_ok()))
+}
+
+/// The folder a new copy goes in: beside the launcher's copy it replaces, else the user's choice,
+/// else the platform default (`None`). macOS updates find their bundle's folder themselves.
+fn destination(
+    app: &App,
+    kind: PackageKind,
+    existing: Option<&Installed>,
+    previous: Option<&Record>,
+    locations: &InstallLocations,
+) -> Result<Option<PathBuf>, String> {
+    if kind == PackageKind::PortableZip && previous.is_some_and(|record| record.kind == PackageKind::PortableZip) {
+        return Ok(None);
+    }
+    if let Some(inst) = existing {
+        let exe = Path::new(&inst.location);
+        return Ok(match kind {
+            PackageKind::AppImage => previous.filter(|r| r.kind == kind).and_then(|r| r.path.parent()).map(Path::to_path_buf),
+            PackageKind::Msi => exe.parent().filter(|_| exe.is_absolute()).map(Path::to_path_buf),
+            _ => None,
+        });
+    }
+    let Some(folder) = locations.folder(app.id) else { return Ok(None) };
+    if !matches!(kind, PackageKind::Dmg | PackageKind::AppImage | PackageKind::Msi | PackageKind::PortableZip) || process::in_sandbox() {
+        return Err("custom install folders aren't supported on this system".into());
+    }
+    let parent = selected_folder(folder, kind != PackageKind::Msi)?;
+    Ok(Some(if kind == PackageKind::Msi { parent.join(app.name) } else { parent }))
+}
+
+fn selected_folder(folder: &str, writable: bool) -> Result<PathBuf, String> {
+    let path = if folder == "~" {
+        crate::folders::home_dir().ok_or("no home folder")?
+    } else if let Some(relative) = folder.strip_prefix("~/") {
+        crate::folders::home_dir().ok_or("no home folder")?.join(relative)
+    } else {
+        PathBuf::from(folder)
+    };
+    let invalid = |reason: &str| format!("couldn't use install folder {}: {reason}", path.display());
+    if folder.chars().any(|c| c.is_control() || (cfg!(windows) && c == '"')) {
+        return Err(invalid("the path contains invalid characters"));
+    }
+    if !path.is_absolute() {
+        return Err(invalid("choose an absolute path"));
+    }
+    if !path.is_dir() {
+        return Err(invalid("the folder is unavailable. Create it or reconnect its drive first"));
+    }
+    if writable {
+        let probe = path.join(format!(
+            ".artcraft-launcher-write-test-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_nanos())
+        ));
+        let output = std::fs::OpenOptions::new().write(true).create_new(true).open(&probe).map_err(|e| invalid(&e.to_string()))?;
+        drop(output);
+        std::fs::remove_file(&probe).map_err(|e| invalid(&e.to_string()))?;
+    }
+    Ok(path)
+}
+
+#[cfg(any(windows, test))]
+fn msi_folder_argument(path: &Path) -> Result<String, String> {
+    let value = path.to_str().ok_or("unusual characters in a path")?;
+    if value.chars().any(|c| c == '"' || c.is_control()) {
+        return Err(format!("couldn't use install folder {value}: the path contains invalid characters"));
+    }
+    Ok(format!("INSTALLFOLDER=\"{value}\""))
+}
+
+/// Where `asset` is downloaded to (and its partial file kept while unfinished).
+pub fn download_path(paths: &Paths, asset: &Asset) -> PathBuf {
+    paths.downloads().join(&asset.name)
+}
+
+#[allow(dead_code)]
+fn record(version: &str, kind: PackageKind, path: PathBuf, files: Vec<PathBuf>, needs_root: bool) -> Record {
+    Record { version: version.to_string(), kind, path, installed_at: crate::now(), files, needs_root }
+}
+
+/// The package format to install `app` with: the format of the copy that's there (an update
+/// stays a `.deb` update), else the user's choice, else the best this system supports.
+///
+/// Returns an empty `Vec` when `app` is already installed outside the launcher (such as an AUR
+/// or repository Arch package) and must not be updated or replaced by the launcher.
+pub fn choose_kinds(app: &App, existing: Option<&Installed>, record: Option<&Record>, preferred: &[PackageKind]) -> Vec<PackageKind> {
+    let available = available_kinds();
+    let can_pacman = available.contains(&PackageKind::ArchPkg) || can_pacman();
+    choose_kinds_with(app, existing, record, preferred, &available, can_pacman)
+}
+
+pub(crate) fn choose_kinds_with(
+    app: &App,
+    existing: Option<&Installed>,
+    record: Option<&Record>,
+    preferred: &[PackageKind],
+    available: &[PackageKind],
+    can_pacman: bool,
+) -> Vec<PackageKind> {
+    if let Some(inst) = existing {
+        let kind = match inst.source {
+            InstallSource::Launcher => record.map(|r| r.kind),
+            InstallSource::MacApp => Some(PackageKind::Dmg),
+            InstallSource::Msi => Some(PackageKind::Msi),
+            InstallSource::Deb => Some(PackageKind::Deb),
+            InstallSource::Rpm => Some(PackageKind::Rpm),
+            // The release's own Arch package is updated like a .deb. AUR builds and repository
+            // packages are updated outside the launcher (see `managed_elsewhere`); the launcher
+            // opens and removes them but never replaces them.
+            InstallSource::Pacman if is_release_arch_package(app, inst) => Some(PackageKind::ArchPkg),
+            InstallSource::Pacman => return Vec::new(),
+            InstallSource::Flatpak => Some(PackageKind::Flatpak),
+            InstallSource::AppImage => Some(PackageKind::AppImage),
+            InstallSource::Binary => Some(PackageKind::TarGz),
+        };
+        if let Some(k) = kind.filter(|k| available.contains(k) || (*k == PackageKind::ArchPkg && can_pacman)) {
+            return vec![k];
+        }
+    }
+    let mut kinds: Vec<PackageKind> = preferred.iter().copied().filter(|k| available.contains(k)).collect();
+    for k in available {
+        if !kinds.contains(k) {
+            kinds.push(*k);
+        }
+    }
+    kinds
+}
+
+/// Whether this system has a working pacman installation and pacman database.
+fn can_pacman() -> bool {
+    #[cfg(target_os = "linux")]
+    return find_in(&SYSTEM_BIN_DIRS, std::ffi::OsStr::new("pacman")).is_some() && crate::detect::linux::has_pacman_db();
+    #[cfg(not(target_os = "linux"))]
+    return false;
+}
+
+/// Whether a pacman install is the release's own Arch package rather than an AUR build. The
+/// release names it by the bundle id (`ai.storyteller.<app>`), which no AUR package uses
+/// (they are `<app>`, `<app>-bin` and `<app>-git`), so an AUR helper never mistakes it
+/// for one of its own and rebuilds it from source.
+pub fn is_release_arch_package(app: &App, installed: &Installed) -> bool {
+    installed.source == InstallSource::Pacman && installed.package.as_deref() == Some(&app.bundle_id())
+}
+
+/// Package formats this machine can install, best first.
+pub fn available_kinds() -> Vec<PackageKind> {
+    #[cfg(target_os = "macos")]
+    return vec![PackageKind::Dmg];
+    #[cfg(windows)]
+    return vec![PackageKind::Msi, PackageKind::PortableZip];
+    #[cfg(target_os = "linux")]
+    return linux::available_kinds();
+    #[cfg(target_os = "freebsd")]
+    return vec![PackageKind::TarGz];
+    #[allow(unreachable_code)]
+    Vec::new()
+}
+
+/// Fetches `asset` into the download folder, checked against its published SHA-256: the feed's
+/// or GitHub's per-file digest, else the release's `SHA256SUMS.txt`. A release with neither is
+/// refused before anything is fetched: a file nothing vouches for is never installed (#90).
+pub(crate) fn download(release: &Release, asset: &Asset, job: &mut Job<'_>) -> Result<PathBuf, String> {
+    if !release::valid_file_name(&asset.name) {
+        return Err("the release has an unexpected file name".into());
+    }
+    let sha = match &asset.sha256 {
+        Some(s) => Some(s.clone()),
+        None => published_checksum(release, asset, job.http)?,
+    };
+    let Some(sha) = sha else {
+        return Err(format!(
+            "the release publishes no checksum for {}, so it can't be verified and wasn't installed. Try again later, or report it on GitHub.",
+            asset.name
+        ));
+    };
+    let dest = download_path(job.paths, asset);
+    let phase = &mut *job.phase;
+    job.http.download(&asset.url, &dest, asset.size, &sha, job.stop, &mut |t| match t {
+        Transfer::Bytes { done, total } => phase(JobPhase::Downloading { done, total }),
+        Transfer::Reconnecting { done, total } => phase(JobPhase::Reconnecting { done, total }),
+    })?;
+    (job.phase)(JobPhase::Verifying);
+    Ok(dest)
+}
+
+/// The file's line in the release's `SHA256SUMS.txt`. `Ok(None)` only when the release really
+/// publishes no checksum for it; a list that exists but can't be fetched is an error, so a
+/// network hiccup never downgrades the check.
+fn published_checksum(release: &Release, asset: &Asset, http: &Http) -> Result<Option<String>, String> {
+    let Some(sums) = release.sums_asset() else { return Ok(None) };
+    let Some(text) = http.get_text(&sums.url).map_err(|e| format!("couldn't fetch the release's checksums ({e}). Try again"))? else {
+        return Ok(None);
+    };
+    Ok(release::parse_sha256sums(&text).into_iter().find(|(_, n)| *n == asset.name).map(|(h, _)| h))
+}
+
+/// When `installed` is owned by something the launcher doesn't drive, what to tell the user
+/// instead of installing a second copy. Arch packages other than the release's own are removed
+/// through pacman like any system package, but updated by whatever they came from: a system
+/// update for a repository package (Omarchy's, Chaotic-AUR, ...), the user's AUR helper (which
+/// builds as the user and can't run behind the password prompt) for anything else.
+pub fn managed_elsewhere(app: &App, installed: &Installed, uninstall: bool) -> Option<String> {
+    managed_elsewhere_with(app, installed, uninstall, pacman_repo)
+}
+
+fn managed_elsewhere_with(app: &App, installed: &Installed, uninstall: bool, repo_fn: impl Fn(&str) -> Option<String>) -> Option<String> {
+    match installed.source {
+        InstallSource::Pacman if !uninstall && !is_release_arch_package(app, installed) => {
+            let pkg = installed.package.clone().unwrap_or_else(|| app.id.to_string());
+            Some(pacman_update_hint(app, &pkg, repo_fn(&pkg).as_deref()))
+        }
+        InstallSource::Binary => Some(format!("{} was installed outside the launcher. Update or remove it the way it was installed.", app.name)),
+        _ => None,
+    }
+}
+
+/// How to update an Arch package the launcher doesn't own: `repo` is the sync repository it
+/// comes from, or `None` for a foreign (AUR) package.
+fn pacman_update_hint(app: &App, pkg: &str, repo: Option<&str>) -> String {
+    let helper = ["paru", "yay"].into_iter().find(|h| which(h).is_some());
+    let cmd = match helper {
+        Some(h) => format!("{h} -S {pkg}"),
+        None => format!("your AUR helper (for example: yay -S {pkg})"),
+    };
+    if let Some(repo) = repo {
+        return format!("{} was installed from the {repo} repository or the AUR ({pkg}). Update it with {cmd} or sudo pacman -Syu", app.name);
+    }
+    format!("{} was installed from the AUR ({pkg}). Update it with {cmd}", app.name)
+}
+
+/// The sync repository (`extra`, `omarchy`, ...) that carries the installed package `pkg`, or
+/// `None` when no configured repository does (an AUR or locally built package) or pacman can't
+/// be asked.
+fn pacman_repo(pkg: &str) -> Option<String> {
+    #[cfg(target_os = "linux")]
+    if !crate::detect::linux::has_pacman_db() {
+        return None;
+    }
+    let pacman = which("pacman")?;
+    let t = std::time::Duration::from_secs(5);
+    // For packages carried by a configured sync repository, ask pacman -Si which repo carries it.
+    // pacman translates its field names; the C locale keeps "Repository" parseable.
+    let mut si = process::command(&pacman);
+    si.args(["-Si", "--", pkg]).env("LC_ALL", "C");
+    let out = process::run_command(si, "pacman", t).ok()?;
+    parse_pacman_repo(&out)
+}
+
+/// The `Repository` field of `pacman -Si` output (the first one, when several repos carry it:
+/// that is the one pacman installs from).
+fn parse_pacman_repo(si: &str) -> Option<String> {
+    si.lines().find_map(|l| {
+        let (key, value) = l.split_once(':')?;
+        (key.trim() == "Repository").then(|| value.trim().to_string()).filter(|r| !r.is_empty())
+    })
+}
+
+/// Removes an installed copy. `phase` hears when the removal has to wait for another install;
+/// `stop` cancels it while it waits.
+pub fn uninstall(
+    app: &App,
+    installed: &Installed,
+    record: Option<&Record>,
+    paths: &Paths,
+    stop: &Stop,
+    phase: &mut dyn FnMut(JobPhase),
+) -> Result<(), String> {
+    let _ = (record, stop, &phase, paths);
+    let path = PathBuf::from(&installed.location);
+    if let Some(msg) = managed_elsewhere(app, installed, true) {
+        return Err(msg);
+    }
+    if matches!(installed.source, InstallSource::MacApp | InstallSource::Msi | InstallSource::AppImage | InstallSource::Launcher)
+        && process::is_running(&path)
+    {
+        return Err(format!("{} is running. Quit it, then try again.", app.name));
+    }
+    match installed.source {
+        #[cfg(windows)]
+        InstallSource::Launcher if record.is_some_and(|r| r.kind == PackageKind::PortableZip) => {
+            crate::portable::remove(app, record.ok_or("the launcher has no record of these files")?)
+        }
+        #[cfg(windows)]
+        InstallSource::Msi => windows::uninstall_msi(app, stop, phase),
+        #[cfg(target_os = "macos")]
+        InstallSource::MacApp | InstallSource::Launcher => macos::move_to_trash(&path),
+        #[cfg(target_os = "linux")]
+        InstallSource::Deb | InstallSource::Rpm | InstallSource::Pacman | InstallSource::Flatpak => {
+            linux::remove_package(app, installed, stop, phase)
+        }
+        #[cfg(target_os = "freebsd")]
+        InstallSource::Launcher => match record {
+            Some(r) => freebsd::remove_files(&r.files, r.needs_root),
+            None => Err("the launcher has no record of these files".into()),
+        },
+        #[cfg(target_os = "linux")]
+        InstallSource::AppImage => remove_appimage(app, &path, record),
+        // A tarball the launcher unpacked into its own folder: take the tree out and leave the
+        // app's settings (`home/`) alone, so a reinstall finds its projects where they were.
+        #[cfg(target_os = "linux")]
+        InstallSource::Launcher if record.is_some_and(|r| r.kind == PackageKind::TarGz) => linux::remove_tree(app, paths),
+        #[cfg(target_os = "linux")]
+        InstallSource::Launcher => remove_appimage(app, &path, record),
+        other => Err(format!("{} can't be removed from here", other.label())),
+    }
+}
+
+/// Deletes an AppImage, the menu entry and icon the launcher wrote for it, and the menu entry
+/// the app may have written for itself on first run.
+#[cfg(target_os = "linux")]
+fn remove_appimage(app: &App, path: &Path, record: Option<&Record>) -> Result<(), String> {
+    if path.extension().is_none_or(|e| !e.eq_ignore_ascii_case("AppImage")) || !path.is_file() {
+        return Err(format!("{} isn't an AppImage, so it was left alone", path.display()));
+    }
+    // AppImages found elsewhere (Gear Lever's ~/AppImages, ~/.local/bin) are the user's own:
+    // remove only the launcher's folder or a copy the launcher recorded installing.
+    let ours =
+        path.parent().is_some_and(|dir| crate::detect::linux::appimage_dir().is_some_and(|own| own == dir)) || record.is_some_and(|r| r.path == path);
+    if !ours {
+        return Err(format!("{} wasn't installed by the launcher. Remove it the way it was added.", path.display()));
+    }
+    std::fs::remove_file(path).map_err(|e| format!("couldn't remove {} ({e})", path.display()))?;
+    linux::unintegrate(app, path, record);
+    Ok(())
+}
+
+/// Starts an installed app.
+pub fn launch(app: &App, installed: &Installed, paths: &Paths) -> Result<(), String> {
+    let _ = paths;
+    let path = Path::new(&installed.location);
+    match installed.source {
+        InstallSource::Flatpak => {
+            let mut cmd = process::flatpak_command();
+            cmd.args(["run", &app.bundle_id()]);
+            process::spawn_detached(cmd)
+        }
+        InstallSource::MacApp => process::open(path.as_os_str()),
+        // A tarball the launcher unpacked into its own folder: run it here, against its own
+        // home, rather than on the host through `flatpak-spawn` (which is what `launch_binary`
+        // would do inside the sandbox). Its settings then land beside it instead of in the
+        // launcher's or the host's home folder.
+        #[cfg(target_os = "linux")]
+        InstallSource::Launcher if path.starts_with(paths.apps()) => {
+            let home = paths.app_home(app.id);
+            prepare_home(&home);
+            let mut cmd = process::command(path);
+            for (name, value) in home_env(&home) {
+                cmd.env(name, value);
+            }
+            if let Some(dir) = path.parent() {
+                cmd.current_dir(dir);
+            }
+            process::spawn_detached(cmd)
+        }
+        _ if cfg!(target_os = "macos") && path.extension().is_some_and(|e| e == "app") => process::open(path.as_os_str()),
+        _ => {
+            if !path.exists() {
+                return Err(format!("{} isn't where it was installed ({})", app.name, path.display()));
+            }
+            process::launch_binary(path, &[])
+        }
+    }
+    .map_err(|e| format!("Couldn't open {}: {e}", app.name))
+}
+
+/// The environment a Craft App unpacked by the launcher runs with: its own `HOME` and the XDG
+/// base directories inside it. Apps read their settings from these, so everything they keep
+/// (settings, projects, caches) stays in that one folder.
+#[cfg(target_os = "linux")]
+fn home_env(home: &Path) -> [(&'static str, PathBuf); 5] {
+    [
+        ("HOME", home.to_path_buf()),
+        ("XDG_CONFIG_HOME", home.join(".config")),
+        ("XDG_DATA_HOME", home.join(".local/share")),
+        ("XDG_CACHE_HOME", home.join(".cache")),
+        ("XDG_STATE_HOME", home.join(".local/state")),
+    ]
+}
+
+/// Creates the folders an app unpacked by the launcher expects to find, and links the host's
+/// `~/.vst3` and `~/.clap` (SoundCraft's plugin folders) in when they exist, so an app running
+/// inside the sandbox still sees the plugins installed on the host. Every failure here is
+/// ignored: the app is worth starting even if its home is not quite ready.
+#[cfg(target_os = "linux")]
+fn prepare_home(home: &Path) {
+    for (_, dir) in home_env(home).iter().skip(1) {
+        let _ = std::fs::create_dir_all(dir);
+    }
+    let Some(real) = crate::folders::home_dir() else { return };
+    if real == home {
+        return;
+    }
+    for name in [".vst3", ".clap"] {
+        let link = home.join(name);
+        if link.symlink_metadata().is_ok() {
+            continue;
+        }
+        if real.join(name).is_dir() {
+            let _ = std::os::unix::fs::symlink(real.join(name), link);
+        }
+    }
+}
+
+/// A new folder of our own inside `dir`, removed when dropped: a predictable name there may be
+/// the user's.
+#[cfg(any(target_os = "linux", target_os = "macos"))]
+fn staging_dir(dir: &Path) -> Result<tempfile::TempDir, String> {
+    tempfile::Builder::new()
+        .prefix(".artcraft-launcher-")
+        .tempdir_in(dir)
+        .map_err(|e| format!("couldn't create a staging folder in {} ({e})", dir.display()))
+}
+
+/// Moves `staged` into place at `dest`, keeping the old copy until the new one is there.
+#[allow(dead_code)]
+fn swap_into_place(staged: &Path, dest: &Path) -> Result<(), String> {
+    swap_into_place_via(staged, dest, |from, to| std::fs::rename(from, to))
+}
+
+fn swap_into_place_via(staged: &Path, dest: &Path, rename: impl Fn(&Path, &Path) -> std::io::Result<()>) -> Result<(), String> {
+    // Reserve a directory of our own beside the destination. A predictable sibling such as
+    // `app.old` may be a user's backup, and must never be removed or overwritten.
+    let backup = if dest.exists() {
+        let parent = dest.parent().ok_or("the installed app has no parent folder")?;
+        let backup = tempfile::Builder::new()
+            .prefix(".artcraft-launcher-backup-")
+            .tempdir_in(parent)
+            .map_err(|e| format!("couldn't create a backup folder in {} ({e})", parent.display()))?;
+        rename(dest, &backup.path().join("old")).map_err(|e| format!("couldn't move the old copy aside ({e})"))?;
+        Some(backup)
+    } else {
+        None
+    };
+    if let Err(e) = rename(staged, dest) {
+        if let Some(backup) = backup
+            && let Err(restore) = rename(&backup.path().join("old"), dest)
+        {
+            // A failed rollback must not let TempDir's cleanup delete the only old copy.
+            let saved = backup.keep().join("old");
+            return Err(format!(
+                "couldn't put the new copy in place ({e}); couldn't restore the old copy ({restore}); it was kept at {}",
+                saved.display()
+            ));
+        }
+        return Err(format!("couldn't put the new copy in place ({e})"));
+    }
+    Ok(())
+}
+
+/// After unpacking an archive into `dir`: its single top-level folder, if it has one.
+#[allow(dead_code)]
+fn single_top_folder(dir: &Path) -> Result<PathBuf, String> {
+    let entries: Vec<_> = std::fs::read_dir(dir).map_err(|e| e.to_string())?.flatten().collect();
+    match entries.as_slice() {
+        [only] if only.file_type().is_ok_and(|ft| ft.is_dir() && !ft.is_symlink()) => Ok(only.path()),
+        _ => Ok(dir.to_path_buf()),
+    }
+}
+
+/// The app binary inside an unpacked archive: `bin/<id>`, `<id>` or `<id>.exe`.
+#[allow(dead_code)]
+fn find_binary(root: &Path, app: &App) -> Option<PathBuf> {
+    let exe = if cfg!(windows) { format!("{}.exe", app.id) } else { app.id.to_string() };
+    [root.join("bin").join(&exe), root.join(&exe)].into_iter().find(|p| p.is_file())
+}
+
+/// Finds a program on `PATH`.
+#[allow(dead_code)]
+fn which(name: &str) -> Option<PathBuf> {
+    let path = std::env::var_os("PATH")?;
+    std::env::split_paths(&path).map(|d| d.join(name)).find(|p| p.is_file())
+}
+
+/// The root-owned directories that programs run as root come from. `pkexec` looks a bare program
+/// name up on the caller's `PATH`, so it is always handed an absolute path from one of these.
+#[cfg(target_os = "linux")]
+const SYSTEM_BIN_DIRS: [&str; 4] = ["/usr/bin", "/bin", "/usr/sbin", "/sbin"];
+/// FreeBSD's packages, polkit's `pkexec` among them, install under `/usr/local`.
+#[cfg(target_os = "freebsd")]
+const SYSTEM_BIN_DIRS: [&str; 6] = ["/usr/bin", "/bin", "/usr/sbin", "/sbin", "/usr/local/bin", "/usr/local/sbin"];
+
+/// `name` in the first of `dirs` that has it.
+#[cfg(any(target_os = "linux", target_os = "freebsd"))]
+fn find_in(dirs: &[impl AsRef<Path>], name: &std::ffi::OsStr) -> Option<PathBuf> {
+    dirs.iter().map(|d| d.as_ref().join(name)).find(|p| p.is_file())
+}
+
+/// `args` with its program as an absolute path: a bare name is looked up in `dirs`.
+#[cfg(any(target_os = "linux", target_os = "freebsd"))]
+fn with_absolute_program(dirs: &[impl AsRef<Path>], args: &[&std::ffi::OsStr]) -> Result<Vec<std::ffi::OsString>, String> {
+    let (program, rest) = args.split_first().ok_or("there is no command to run")?;
+    let path = Path::new(program);
+    let program = if path.is_absolute() {
+        path.to_path_buf()
+    } else if path.file_name() == Some(*program) {
+        find_in(dirs, program).ok_or_else(|| format!("{} isn't installed", path.display()))?
+    } else {
+        return Err(format!("{} isn't a program name", path.display()));
+    };
+    Ok(std::iter::once(program.into_os_string()).chain(rest.iter().map(|a| a.to_os_string())).collect())
+}
+
+/// polkit's `pkexec`, from the same directories as the programs it runs.
+#[cfg(any(target_os = "linux", target_os = "freebsd"))]
+fn pkexec() -> Option<PathBuf> {
+    find_in(&SYSTEM_BIN_DIRS, std::ffi::OsStr::new("pkexec"))
+}
+
+/// Runs a command as root through polkit (`pkexec`), which shows the desktop's password prompt.
+#[cfg(any(target_os = "linux", target_os = "freebsd"))]
+fn run_as_root(args: &[&std::ffi::OsStr]) -> Result<(), String> {
+    let args = with_absolute_program(&SYSTEM_BIN_DIRS, args)?;
+    let pkexec = pkexec().ok_or("installing system-wide needs polkit (pkexec), which isn't installed")?;
+    let status = process::command(pkexec).args(&args).status().map_err(|e| format!("couldn't ask for permission ({e})"))?;
+    root_outcome(status.code())
+}
+
+/// What `pkexec`'s exit code says about the command it ran.
+#[cfg(any(target_os = "linux", target_os = "freebsd"))]
+fn root_outcome(code: Option<i32>) -> Result<(), String> {
+    match code {
+        Some(0) => Ok(()),
+        // pkexec: 126 = the password prompt was dismissed, 127 = not authorized.
+        Some(126 | 127) => Err("cancelled".into()),
+        Some(c) => Err(format!("the system installer stopped with error {c}")),
+        None => Err("the system installer was interrupted".into()),
+    }
+}
+
+/// How the error of an installer call shared by several apps ends (see `linux::shared_outcome`).
+const SHARED_CALL: &str = "apps together. Try them one at a time.";
+
+/// Whether an install failed in one installer call shared with other apps (Linux packages
+/// installed together). Such a call can fail after it has installed some of its apps; any other
+/// failure is the app's own.
+pub fn failed_in_shared_call(error: &str) -> bool {
+    cfg!(target_os = "linux") && error.ends_with(SHARED_CALL)
+}
+
+/// The system's installer runs one job at a time; the others wait their turn here.
+#[cfg(any(target_os = "linux", windows))]
+static INSTALLER: crate::queue::Queue = crate::queue::Queue::new();
+
+/// For [`INSTALLER`]: reports [`JobPhase::Waiting`] while a job waits, then `working` again.
+#[cfg(any(target_os = "linux", windows))]
+fn turn<'a>(phase: &'a mut dyn FnMut(JobPhase), working: JobPhase) -> impl FnMut(bool) + 'a {
+    move |waiting| phase(if waiting { JobPhase::Waiting } else { working })
+}
+
+/// For [`INSTALLER`]: whether the user cancelled the job while it waits.
+#[cfg(any(target_os = "linux", windows))]
+fn cancelled(stop: &Stop) -> impl Fn() -> bool + '_ {
+    || stop.check().is_err_and(|e| e == crate::protocol::CANCELLED)
+}
+
+#[cfg(target_os = "linux")]
+pub(crate) mod linux {
+    use std::ffi::{OsStr, OsString};
+    use std::os::unix::fs::PermissionsExt;
+
+    use crate::distro;
+    use crate::protocol::CANCELLED;
+
+    use super::{
+        App, INSTALLER, InstallSource, Installed, JobPhase, PackageKind, Path, PathBuf, Paths, Record, SHARED_CALL, SYSTEM_BIN_DIRS, Stop, cancelled,
+        find_in, pkexec, process, run_as_root, swap_into_place, tree, turn,
+    };
+
+    /// apt waits this long for another package tool (a software centre, automatic updates) to
+    /// let go of its lock, instead of failing at once.
+    const APT_WAITS: &str = "DPkg::Lock::Timeout=60";
+
+    /// A package tool that root commands can run, from the same directories `run_as_root` uses.
+    fn system_tool(name: &str) -> Option<PathBuf> {
+        find_in(&SYSTEM_BIN_DIRS, OsStr::new(name))
+    }
+
+    /// Where commands that need root go: the installer's queue, then `pkexec`.
+    pub struct Root<'a> {
+        pub queue: &'a crate::queue::Queue,
+        pub run: &'a (dyn Fn(&[&OsStr]) -> Result<(), String> + Sync),
+    }
+
+    const SYSTEM: Root<'static> = Root { queue: &INSTALLER, run: &run_as_root };
+
+    /// Runs `command target` as root. Jobs waiting for the same command go into one call
+    /// (`apt-get install a.deb b.deb`), so the password is asked for once.
+    fn as_root(
+        root: &Root<'_>,
+        command: &[&str],
+        target: &OsStr,
+        stop: &Stop,
+        phase: &mut dyn FnMut(JobPhase),
+        working: JobPhase,
+    ) -> Result<(), String> {
+        let command = command.iter().map(OsString::from).collect();
+        root.queue.batched(command, target.to_os_string(), &cancelled(stop), &mut turn(phase, working), &|command, targets| {
+            let args: Vec<&OsStr> = command.iter().chain(targets).map(OsString::as_os_str).collect();
+            shared_outcome((root.run)(&args), targets.len())
+        })
+    }
+
+    /// What one call's result means for each of the `count` apps it handled: a failure can't be
+    /// pinned on one of them, and trying each again by itself would ask for the password each time.
+    pub fn shared_outcome(result: Result<(), String>, count: usize) -> Result<(), String> {
+        match result {
+            Err(e) if count > 1 && e != CANCELLED => Err(format!("{e} while handling {count} {SHARED_CALL}")),
+            other => other,
+        }
+    }
+
+    /// The command that installs (or upgrades) a downloaded system package.
+    pub fn install_command(kind: PackageKind) -> Option<&'static [&'static str]> {
+        match kind {
+            // apt resolves dependencies and records the package like any other.
+            PackageKind::Deb => Some(&["apt-get", "-o", APT_WAITS, "install", "-y", "--allow-downgrades"]),
+            PackageKind::Rpm if system_tool("dnf").is_some() => Some(&["dnf", "install", "-y"]),
+            PackageKind::Rpm if system_tool("zypper").is_some() => Some(&["zypper", "--non-interactive", "install", "--allow-unsigned-rpm"]),
+            PackageKind::Rpm => Some(&["rpm", "-U", "--replacepkgs"]),
+            PackageKind::ArchPkg => Some(&["pacman", "-U", "--noconfirm"]),
+            _ => None,
+        }
+    }
+
+    /// Fedora Atomic (Silverblue, Kinoite, Bazzite…): rpm-ostree manages the root filesystem and
+    /// `dnf install` of a local package is refused (Bazzite wraps `/usr/bin/dnf` to say so).
+    fn immutable_ostree() -> bool {
+        Path::new("/run/ostree-booted").exists()
+    }
+
+    /// What this system can install, ordered with the best default first.
+    ///
+    /// The default package format aligns with how the user installed the launcher itself:
+    /// - Running as a Flatpak: prefers Flatpak (per-user, desktop integration). When the host
+    ///   has no usable Flatpak (none installed, or `flatpak-spawn` refused) it prefers the
+    ///   release tarball instead, which the launcher unpacks and runs inside the sandbox; an
+    ///   AppImage cannot mount there and a distro package needs root, so both are dead ends.
+    /// - Running as an AppImage: prefers AppImage.
+    /// - Otherwise (system install): prefers the distro's own package format (`.deb` on the
+    ///   Debian family, `.rpm` on the Fedora, Red Hat and SUSE families, `.pkg.tar.zst` on Arch,
+    ///   read from `os-release` rather than from whichever tools are on `PATH`), then Flatpak if
+    ///   available, then AppImage.
+    pub fn available_kinds() -> Vec<PackageKind> {
+        let flatpak = process::is_flatpak_available();
+        let is_flatpak = process::in_sandbox();
+        let is_appimage = std::env::var_os("APPIMAGE").is_some();
+        let root = pkexec().is_some();
+        let os = ["/etc/os-release", "/usr/lib/os-release"].iter().find_map(|p| std::fs::read_to_string(p).ok()).unwrap_or_default();
+        let native = distro::native_package(&distro::parse_os_release(&os));
+        // An ostree system can't take .deb or .rpm installs, whatever os-release says.
+        let root = root && !immutable_ostree();
+        let can_deb = root && native == Some(PackageKind::Deb) && system_tool("apt-get").is_some() && system_tool("dpkg").is_some();
+        let can_rpm = root && native == Some(PackageKind::Rpm) && system_tool("rpm").is_some();
+        let can_arch = root && native == Some(PackageKind::ArchPkg) && system_tool("pacman").is_some() && crate::detect::linux::has_pacman_db();
+        order_available_kinds(is_flatpak, is_appimage, flatpak, can_deb, can_rpm, can_arch)
+    }
+
+    pub(crate) fn order_available_kinds(
+        is_flatpak: bool,
+        is_appimage: bool,
+        flatpak_available: bool,
+        can_deb: bool,
+        can_rpm: bool,
+        can_arch: bool,
+    ) -> Vec<PackageKind> {
+        let mut kinds = Vec::new();
+        if is_flatpak && flatpak_available {
+            kinds.push(PackageKind::Flatpak);
+        } else if is_flatpak {
+            kinds.push(PackageKind::TarGz);
+        } else if is_appimage {
+            kinds.push(PackageKind::AppImage);
+        }
+
+        if can_deb {
+            kinds.push(PackageKind::Deb);
+        }
+        if can_rpm {
+            kinds.push(PackageKind::Rpm);
+        }
+        if can_arch {
+            kinds.push(PackageKind::ArchPkg);
+        }
+
+        if flatpak_available && !kinds.contains(&PackageKind::Flatpak) {
+            kinds.push(PackageKind::Flatpak);
+        }
+        // The tarball runs inside the sandbox, so it is only ever offered there.
+        if is_flatpak && !kinds.contains(&PackageKind::TarGz) {
+            kinds.push(PackageKind::TarGz);
+        }
+        if !kinds.contains(&PackageKind::AppImage) {
+            kinds.push(PackageKind::AppImage);
+        }
+        kinds
+    }
+
+    /// Installs (or upgrades) a downloaded package with the system's own tools.
+    pub fn install_package(kind: PackageKind, file: &Path, stop: &Stop, phase: &mut dyn FnMut(JobPhase)) -> Result<(), String> {
+        if kind == PackageKind::Deb && system_tool("apt-get").is_none() {
+            return Err("this system has no apt-get to install a Debian package with".into());
+        }
+        if kind == PackageKind::ArchPkg && system_tool("pacman").is_none() {
+            return Err("this system has no pacman to install an Arch package with".into());
+        }
+        install_package_via(&SYSTEM, kind, file, stop, phase)
+    }
+
+    pub fn install_package_via(root: &Root<'_>, kind: PackageKind, file: &Path, stop: &Stop, phase: &mut dyn FnMut(JobPhase)) -> Result<(), String> {
+        let f = file.as_os_str();
+        if let Some(command) = install_command(kind) {
+            return as_root(root, command, f, stop, phase, JobPhase::Installing);
+        }
+        match kind {
+            PackageKind::Flatpak => {
+                let install_one = || {
+                    log::info!("executing flatpak install --reinstall --bundle for {}", file.display());
+                    let output = process::flatpak_command()
+                        .args(["install", "--user", "-y", "--noninteractive", "--reinstall", "--bundle"])
+                        .arg(f)
+                        .output()
+                        .map_err(|e| format!("couldn't start Flatpak ({e})"))?;
+                    if output.status.success() {
+                        log::info!("flatpak install succeeded for {}", file.display());
+                        Ok(())
+                    } else {
+                        let stderr = String::from_utf8_lossy(&output.stderr);
+                        let err = stderr.trim();
+                        let err = if err.is_empty() { String::from_utf8_lossy(&output.stdout).trim().to_string() } else { err.to_string() };
+                        if err.is_empty() {
+                            Err("Flatpak couldn't install the bundle (it needs the Flathub remote for its runtime)".into())
+                        } else {
+                            let clean_err = err.strip_prefix("error: ").or_else(|| err.strip_prefix("Error: ")).unwrap_or(&err);
+                            Err(format!("Flatpak couldn't install the bundle: {clean_err}"))
+                        }
+                    }
+                };
+                root.queue.alone(&cancelled(stop), &mut turn(phase, JobPhase::Installing), install_one).unwrap_or(Err(CANCELLED.into()))
+            }
+            other => Err(format!("{} isn't a system package", other.label())),
+        }
+    }
+
+    pub fn remove_package(app: &App, installed: &Installed, stop: &Stop, phase: &mut dyn FnMut(JobPhase)) -> Result<(), String> {
+        let mut remove = |command: &[&str], package: &str| as_root(&SYSTEM, command, OsStr::new(package), stop, phase, JobPhase::Removing);
+        match installed.source {
+            InstallSource::Deb if system_tool("apt-get").is_some() => remove(&["apt-get", "-o", APT_WAITS, "remove", "-y"], app.id),
+            InstallSource::Deb => remove(&["dpkg", "-r"], app.id),
+            InstallSource::Rpm => {
+                if system_tool("dnf").is_some() {
+                    remove(&["dnf", "remove", "-y"], app.id)
+                } else {
+                    remove(&["rpm", "-e"], app.id)
+                }
+            }
+            // The package detected (photocraft, photocraft-bin or photocraft-git).
+            InstallSource::Pacman => remove(&["pacman", "-R", "--noconfirm"], installed.package.as_deref().unwrap_or(app.id)),
+            InstallSource::Flatpak => {
+                let id = app.bundle_id();
+                let user = process::flatpak_command().args(["uninstall", "--user", "-y", "--noninteractive", &id]).status();
+                if user.is_ok_and(|s| s.success()) {
+                    return Ok(());
+                }
+                if process::in_sandbox() {
+                    let system = process::flatpak_command().args(["uninstall", "--system", "-y", "--noninteractive", &id]).status();
+                    if system.is_ok_and(|s| s.success()) {
+                        return Ok(());
+                    }
+                    return Err(format!("couldn't uninstall {id}"));
+                }
+                remove(&["flatpak", "uninstall", "--system", "-y", "--noninteractive"], &id)
+            }
+            other => Err(format!("{} isn't a system package", other.label())),
+        }
+    }
+
+    pub fn install_appimage(
+        file: &Path,
+        name: &str,
+        destination: Option<&Path>,
+        previous: Option<&Record>,
+        replace: bool,
+    ) -> Result<(PathBuf, Vec<PathBuf>), String> {
+        let dir = match destination {
+            Some(dir) => dir.to_path_buf(),
+            None => {
+                let dir = crate::detect::linux::appimage_dir().ok_or("no home folder")?;
+                std::fs::create_dir_all(&dir).map_err(|e| format!("couldn't create {} ({e})", dir.display()))?;
+                dir
+            }
+        };
+        let dest = dir.join(name);
+        let ours = previous.is_some_and(|r| r.kind == PackageKind::AppImage && r.path == dest);
+        if std::fs::symlink_metadata(&dest).is_ok_and(|m| m.is_dir() || !(replace || ours && m.is_file())) {
+            return Err(format!("{} already exists and wasn't installed by ArtCraft Launcher", dest.display()));
+        }
+        let staging = super::staging_dir(&dir)?;
+        let partial = staging.path().join(name);
+        std::fs::copy(file, &partial).map_err(|e| format!("couldn't copy the AppImage ({e})"))?;
+        // The AppImage is the program the user just installed and must be executable; 0o755 is
+        // not group/world-writable.
+        std::fs::set_permissions(&partial, std::fs::Permissions::from_mode(0o755)).map_err(|e| e.to_string())?; // NOSONAR
+        std::fs::rename(&partial, &dest).map_err(|e| format!("couldn't put the AppImage in place ({e})"))?;
+        let mut removed = Vec::new();
+        if let Some(old) = previous.filter(|r| r.kind == PackageKind::AppImage && r.path != dest)
+            && std::fs::remove_file(&old.path).is_ok()
+        {
+            removed.push(old.path.clone());
+        }
+        Ok((dest, removed))
+    }
+
+    /// Unpacks a release tarball (`bin/<app>`, `share/…`) into `<data>/apps/<app>`, a folder
+    /// only the launcher owns, and returns the app's binary. This is the fallback for the
+    /// Flatpak launcher when the host has no usable Flatpak: the app then runs inside the
+    /// sandbox instead of on the host. `bin` and `share` are swapped in one at a time, so an
+    /// update leaves the app's own `home/` beside them untouched.
+    pub fn install_tree(app: &App, file: &Path, paths: &Paths) -> Result<PathBuf, String> {
+        let staged = paths.cache.join(format!("{}.new", app.id));
+        let result = unpack_tree(app, file, &staged, paths);
+        let _ = std::fs::remove_dir_all(&staged);
+        result
+    }
+
+    fn unpack_tree(app: &App, file: &Path, staged: &Path, paths: &Paths) -> Result<PathBuf, String> {
+        let tree = tree::unpack(app, file, staged)?;
+        // Verify tree root is strictly within staged and is not a symlink (CWE-59).
+        let rel_tree = tree.strip_prefix(staged).map_err(|_| "staging layout escapes staging".to_string())?;
+        let mut check_root = staged.to_path_buf();
+        for part in rel_tree.components() {
+            check_root.push(part);
+            let meta = std::fs::symlink_metadata(&check_root).map_err(|e| format!("couldn't check {} ({e})", check_root.display()))?;
+            if meta.file_type().is_symlink() {
+                return Err("unpacked tree root is a symlink".into());
+            }
+        }
+        // Validate the staged binary and set its mode *before* either swap: a rejected update
+        // (e.g. a symlinked app binary) must never disturb the installed tree it replaces.
+        let staged_bin = tree.join("bin").join(app.id);
+        make_runnable_within(&tree, &staged_bin)?;
+        let root = paths.apps().join(app.id);
+        std::fs::create_dir_all(&root).map_err(|e| format!("couldn't create {} ({e})", root.display()))?;
+        for dir in ["bin", "share"] {
+            if tree.join(dir).is_dir() {
+                swap_into_place(&tree.join(dir), &root.join(dir))?;
+            }
+        }
+        Ok(root.join("bin").join(app.id))
+    }
+
+    /// Makes `bin` executable (0755) without ever following an archive-controlled symlink out of
+    /// the installation tree.
+    ///
+    /// `bin` comes from an untrusted tarball. If it, or one of its ancestors inside `root`, is a
+    /// symlink, a plain `std::fs::set_permissions(bin, …)` would follow the link and change the
+    /// mode of an existing file *outside* the tree (CWE-59). We reject any symlinked component
+    /// before changing permissions, so the chmod can only ever reach a regular file that lives at
+    /// the verified path inside the launcher's own apps folder.
+    fn make_runnable_within(root: &Path, bin: &Path) -> Result<(), String> {
+        let root_meta = std::fs::symlink_metadata(root).map_err(|e| format!("couldn't check {} ({e})", root.display()))?;
+        if root_meta.file_type().is_symlink() {
+            return Err("the install tree root is a symlink".into());
+        }
+        // No component between `root` and `bin` may be a symlink.
+        let rel = bin.strip_prefix(root).map_err(|_| "the app binary isn't inside the install tree".to_string())?;
+        let mut here = root.to_path_buf();
+        for part in rel.components() {
+            here.push(part);
+            let meta = std::fs::symlink_metadata(&here).map_err(|e| format!("couldn't check {} ({e})", here.display()))?;
+            if meta.file_type().is_symlink() {
+                return Err("the download's app binary escapes the install tree through a symlink".into());
+            }
+        }
+        // The final component is a verified non-symlink regular file inside the launcher's own
+        // apps folder, so changing its mode cannot reach anything outside the tree.
+        if !here.metadata().map_err(|e| e.to_string())?.file_type().is_file() {
+            return Err("the download's app binary isn't a regular file".into());
+        }
+        // Verified non-symlink regular file inside the launcher's apps folder; the app binary must
+        // be executable and 0o755 is not group/world-writable.
+        std::fs::set_permissions(bin, std::fs::Permissions::from_mode(0o755)).map_err(|e| format!("couldn't make {} runnable ({e})", bin.display())) // NOSONAR
+    }
+
+    /// Removes a tree the launcher unpacked in [`install_tree`], keeping the app's `home/`: the
+    /// settings and projects in it are the user's, not the installer's. Only the two folders the
+    /// launcher put there are removed, and only inside the launcher's own apps folder.
+    pub fn remove_tree(app: &App, paths: &Paths) -> Result<(), String> {
+        let root = paths.apps().join(app.id);
+        let mut removed = false;
+        for dir in ["bin", "share"] {
+            let path = root.join(dir);
+            if path.starts_with(paths.apps()) && path.is_dir() {
+                std::fs::remove_dir_all(&path).map_err(|e| format!("couldn't remove {} ({e})", path.display()))?;
+                removed = true;
+            }
+        }
+        if removed { Ok(()) } else { Err(format!("{} isn't installed in this folder", app.name)) }
+    }
+
+    /// Where menu entries and icons go: `$XDG_DATA_HOME`, else `~/.local/share`. Inside the
+    /// launcher's own Flatpak that variable points into the sandbox, so the host's is used.
+    pub fn host_data_dir() -> Option<PathBuf> {
+        if Path::new("/.flatpak-info").exists() {
+            if let Some(dir) = std::env::var_os("HOST_XDG_DATA_HOME").map(PathBuf::from).filter(|p| p.is_absolute()) {
+                return Some(dir);
+            }
+            return crate::folders::home_dir().map(|h| h.join(".local").join("share"));
+        }
+        crate::folders::data_local_dir()
+    }
+
+    /// The app's 128 px icon, as bundled in `assets/app-icons`.
+    fn icon_png(app: &App) -> Option<&'static [u8]> {
+        app.icon_png
+    }
+
+    fn desktop_path(data: &Path, app: &App) -> PathBuf {
+        data.join("applications").join(format!("{}.desktop", app.bundle_id()))
+    }
+
+    fn icon_path(data: &Path, app: &App) -> PathBuf {
+        data.join("icons/hicolor/128x128/apps").join(format!("{}.png", app.bundle_id()))
+    }
+
+    /// Adds `appimage` to the desktop's menu. Best effort: a failure here never fails the
+    /// install. Returns the files written, for the record.
+    pub fn integrate(app: &App, appimage: &Path, replaced: &[PathBuf], previous: Option<&Record>) -> Vec<PathBuf> {
+        match host_data_dir() {
+            Some(data) => integrate_into(&data, app, appimage, replaced, previous),
+            None => Vec::new(),
+        }
+    }
+
+    /// [`integrate`] into the data folder `data`. Only writes over files the launcher wrote
+    /// before: its own marked menu entry, an entry pointing at a copy this install replaced, and
+    /// an icon listed in `previous`.
+    pub(crate) fn integrate_into(data: &Path, app: &App, appimage: &Path, replaced: &[PathBuf], previous: Option<&Record>) -> Vec<PathBuf> {
+        let ours_before = |p: &Path| previous.is_some_and(|r| r.files.iter().any(|f| f == p));
+        let mut written = Vec::new();
+        let icon = icon_path(data, app);
+        let has_icon = match icon_png(app) {
+            Some(png) if !icon.exists() || ours_before(&icon) => match crate::paths::write_atomic(&icon, png) {
+                Ok(()) => {
+                    written.push(icon.clone());
+                    true
+                }
+                Err(e) => {
+                    log::warn!("{}: couldn't install the menu icon: {e}", app.name);
+                    false
+                }
+            },
+            // Someone else's icon under the app's id (the app's own AppImage puts one there).
+            _ => icon.is_file(),
+        };
+        let Some(text) = crate::desktop_entry::render(app, appimage, has_icon) else {
+            log::warn!("{}: {} can't be written into a menu entry; skipping it", app.name, appimage.display());
+            return written;
+        };
+        let desktop = desktop_path(data, app);
+        let replace = match std::fs::read_to_string(&desktop) {
+            Ok(old) => {
+                crate::desktop_entry::is_ours(&old)
+                    || crate::desktop_entry::exec_program(&old)
+                        .is_some_and(|p| Path::new(&p) == appimage || replaced.iter().any(|r| r == Path::new(&p)))
+            }
+            Err(_) => !desktop.exists(),
+        };
+        if !replace {
+            log::info!("{}: leaving the existing menu entry {} alone", app.name, desktop.display());
+            return written;
+        }
+        match crate::paths::write_atomic(&desktop, text.as_bytes()) {
+            Ok(()) => written.push(desktop),
+            Err(e) => log::warn!("{}: couldn't add the menu entry: {e}", app.name),
+        }
+        written
+    }
+
+    /// Takes away what [`integrate`] added for the removed AppImage `appimage`.
+    pub fn unintegrate(app: &App, appimage: &Path, record: Option<&Record>) {
+        if let Some(data) = host_data_dir() {
+            unintegrate_from(&data, app, appimage, record);
+        }
+    }
+
+    /// [`unintegrate`] from the data folder `data`: the menu entry when it runs the removed copy,
+    /// or when the launcher wrote it and what it runs is gone; the icon only when the
+    /// launcher's record lists it.
+    pub(crate) fn unintegrate_from(data: &Path, app: &App, appimage: &Path, record: Option<&Record>) {
+        let desktop = desktop_path(data, app);
+        if let Ok(text) = std::fs::read_to_string(&desktop) {
+            let program = crate::desktop_entry::exec_program(&text).map(PathBuf::from);
+            let runs_removed = program.as_deref() == Some(appimage);
+            let ours_and_dangling = crate::desktop_entry::is_ours(&text) && program.is_none_or(|p| !p.exists());
+            if runs_removed || ours_and_dangling {
+                let _ = std::fs::remove_file(&desktop);
+            }
+        }
+        let icon = icon_path(data, app);
+        if record.is_some_and(|r| r.files.contains(&icon)) {
+            let _ = std::fs::remove_file(&icon);
+        }
+    }
+}
+
+#[cfg(target_os = "macos")]
+pub mod macos {
+    use std::time::Duration;
+
+    use crate::version::Version;
+
+    use super::{App, InstallSource, Installed, Path, PathBuf, Paths, Release, process, swap_into_place};
+
+    /// `/Applications` when we can write there, else `~/Applications`.
+    fn applications_dir(existing: Option<&Installed>, destination: Option<&Path>) -> Result<PathBuf, String> {
+        if let Some(parent) =
+            existing.filter(|i| i.source == InstallSource::MacApp).and_then(|i| Path::new(&i.location).parent().map(Path::to_path_buf))
+        {
+            return Ok(parent);
+        }
+        if let Some(dir) = destination {
+            return Ok(dir.to_path_buf());
+        }
+        let system = PathBuf::from("/Applications");
+        let probe = system.join(".artcraft-launcher-write-test");
+        if std::fs::write(&probe, b"").is_ok() {
+            let _ = std::fs::remove_file(&probe);
+            return Ok(system);
+        }
+        let user = crate::folders::home_dir().ok_or("no home folder")?.join("Applications");
+        std::fs::create_dir_all(&user).map_err(|e| format!("couldn't create {} ({e})", user.display()))?;
+        Ok(user)
+    }
+
+    /// The Apple Developer team that signs every Craft App and ArtCraft Launcher (Learning
+    /// Machines LLC): the macOS side of the Windows publisher check.
+    pub const TEAM_ID: &str = "DJ6XS33FX8";
+
+    /// What a new copy must prove before it replaces anything. The checksum shows the download is
+    /// the file the release lists; these show the app inside is the one the release promises.
+    pub struct Expect<'a> {
+        /// The team whose Developer ID signature the bundle must carry. `None` only in tests,
+        /// which build unsigned bundles.
+        pub team: Option<&'a str>,
+        /// The release's version, which the bundle must report. `None` when the tag isn't one.
+        pub version: Option<&'a Version>,
+    }
+
+    impl<'a> Expect<'a> {
+        pub fn release(release: &'a Release) -> Self {
+            Self { team: Some(TEAM_ID), version: release.version.as_ref() }
+        }
+    }
+
+    /// Held while this process asks diskimages-helper for something (an attach here; the tests'
+    /// `hdiutil create` too), since it turns concurrent requests away.
+    pub(crate) static DISK_IMAGES: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+    /// Apple's tools, by full path: a launcher started from Finder or at login gets a minimal
+    /// `PATH`, and nothing earlier on it should stand in for these.
+    const HDIUTIL: &str = "/usr/bin/hdiutil";
+    const DITTO: &str = "/usr/bin/ditto";
+    const CODESIGN: &str = "/usr/bin/codesign";
+
+    pub fn install_dmg(
+        app: &App,
+        dmg: &Path,
+        existing: Option<&Installed>,
+        destination: Option<&Path>,
+        replace: bool,
+        paths: &Paths,
+        expect: &Expect<'_>,
+    ) -> Result<PathBuf, String> {
+        // A new, empty mount point for every install. A fixed one can still hold an image from an
+        // attach that was interrupted or timed out, and hdiutil won't mount another over it.
+        let attempt = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos()).unwrap_or_default();
+        let mount = paths.cache.join(format!("mount-{}-{}-{attempt}", app.id, std::process::id()));
+        std::fs::create_dir_all(&mount).map_err(|e| format!("couldn't create a folder to open the disk image in ({e})"))?;
+        let (Some(dmg_s), Some(mount_s)) = (dmg.to_str(), mount.to_str()) else {
+            let _ = std::fs::remove_dir(&mount);
+            return Err("unusual characters in the cache folder's path".into());
+        };
+        // diskimages-helper refuses an attach while it is busy with another image ("Resource
+        // temporarily unavailable"): attach one image at a time (several apps may be updating at
+        // once), and wait a little and try again when something outside the launcher holds it.
+        // The download's SHA-256 is already checked, so hdiutil's own checksum pass (-noverify)
+        // would only add minutes on a large image.
+        let attached = {
+            let _one_at_a_time = DISK_IMAGES.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            let attach = || {
+                process::run(
+                    HDIUTIL,
+                    &["attach", "-nobrowse", "-readonly", "-noautoopen", "-noverify", "-mountpoint", mount_s, dmg_s],
+                    Duration::from_secs(300),
+                )
+            };
+            // diskimages-helper can stay busy for a while on a shared runner; a minute of retries is still quick.
+            let mut attached = attach();
+            for wait in [1, 2, 4, 8, 16, 32] {
+                if attached.is_ok() {
+                    break;
+                }
+                let _ = detach(&mount);
+                std::thread::sleep(Duration::from_secs(wait));
+                attached = attach();
+            }
+            attached
+        };
+        if let Err(reason) = attached {
+            let _ = std::fs::remove_dir(&mount);
+            return Err(format!("couldn't open the disk image: {reason}"));
+        }
+        let result = copy_app(app, &mount, existing, destination, replace, expect);
+        let _ = detach(&mount);
+        let _ = std::fs::remove_dir(&mount);
+        result
+    }
+
+    fn copy_app(
+        app: &App,
+        mount: &Path,
+        existing: Option<&Installed>,
+        destination: Option<&Path>,
+        replace: bool,
+        expect: &Expect<'_>,
+    ) -> Result<PathBuf, String> {
+        let bundle = format!("{}.app", app.name);
+        let src = mount.join(&bundle);
+        crate::detect::macos::read_bundle(app, &src).ok_or("the disk image doesn't contain the app")?;
+        let dir = applications_dir(existing, destination)?;
+        let dest = existing.filter(|i| i.source == InstallSource::MacApp).map_or_else(|| dir.join(&bundle), |i| PathBuf::from(&i.location));
+        if !replace
+            && std::fs::symlink_metadata(&dest).is_ok()
+            && (std::fs::symlink_metadata(&dest).is_ok_and(|m| m.file_type().is_symlink()) || crate::detect::macos::read_bundle(app, &dest).is_none())
+        {
+            return Err(format!("{} already exists and wasn't installed by ArtCraft Launcher", dest.display()));
+        }
+        let staging = super::staging_dir(&dir)?;
+        let staged = staging.path().join(&bundle);
+        let (Some(src_s), Some(staged_s)) = (src.to_str(), staged.to_str()) else { return Err("unusual characters in a path".into()) };
+        // ditto keeps the code signature and symlinks intact. The disk image's volume adds Finder
+        // metadata (com.apple.FinderInfo) to the files; leave it and the extended attributes
+        // behind, or `codesign --verify --strict` rejects the bundle as carrying "detritus". A
+        // bundle's signature lives in its files, not in extended attributes.
+        process::run(DITTO, &["--norsrc", "--noextattr", "--noacl", src_s, staged_s], Duration::from_secs(600))
+            .map_err(|reason| format!("couldn't copy the app: {reason}"))?;
+        let checked = crate::detect::macos::read_bundle(app, &staged)
+            .ok_or_else(|| "the copied app is incomplete".to_string())
+            .and_then(|found| check(&staged, &found, expect));
+        checked?;
+        swap_into_place(&staged, &dest)?;
+        Ok(dest)
+    }
+
+    /// Checks a copied bundle against what its release promises, before it replaces anything.
+    fn check(bundle: &Path, found: &Installed, expect: &Expect<'_>) -> Result<(), String> {
+        if let Some(team) = expect.team
+            && !signed_by(bundle, team)
+        {
+            return Err("the app isn't signed by its developer, so it wasn't installed".into());
+        }
+        if let Some(want) = expect.version
+            && !found.version.as_ref().is_some_and(|v| same_release(v, want))
+        {
+            return Err(format!("the app inside isn't version {want}, so it wasn't installed"));
+        }
+        Ok(())
+    }
+
+    /// Whether `bundle` has a valid Developer ID signature from `team`, nested code included. The
+    /// requirement pins the signer, so a valid ad-hoc or other developer's signature fails it.
+    /// Unlike a Gatekeeper assessment it needs no network.
+    pub fn signed_by(bundle: &Path, team: &str) -> bool {
+        let Some(path) = bundle.to_str() else { return false };
+        if team.is_empty() || !team.bytes().all(|b| b.is_ascii_alphanumeric()) {
+            return false;
+        }
+        let requirement = format!("=anchor apple generic and certificate leaf[subject.OU] = \"{team}\"");
+        process::capture(CODESIGN, &["--verify", "--deep", "-R", &requirement, path], Duration::from_secs(120)).is_some()
+    }
+
+    /// Whether a bundle's version is the release's. A bundle that reports only the numbers
+    /// (`CFBundleShortVersionString`) matches a pre-release with the same numbers.
+    fn same_release(found: &Version, release: &Version) -> bool {
+        (found.major, found.minor, found.patch) == (release.major, release.minor, release.patch) && (found.pre.is_empty() || found.pre == release.pre)
+    }
+
+    fn detach(mount: &Path) -> Option<String> {
+        let m = mount.to_str()?;
+        if !mount.join(".").exists() {
+            return None;
+        }
+        process::capture(HDIUTIL, &["detach", m, "-quiet"], Duration::from_secs(60))
+            .or_else(|| process::capture(HDIUTIL, &["detach", m, "-force", "-quiet"], Duration::from_secs(60)))
+    }
+
+    /// Moves an app to the user's Trash (so it can be put back).
+    pub fn move_to_trash(path: &Path) -> Result<(), String> {
+        let trash = crate::folders::home_dir().ok_or("no home folder")?.join(".Trash");
+        let name = path.file_name().ok_or("not an app")?;
+        let mut dest = trash.join(name);
+        if dest.exists() {
+            dest = trash.join(format!("{} {}", name.to_string_lossy(), crate::now()));
+        }
+        std::fs::rename(path, &dest).map_err(|e| format!("couldn't move {} to Trash ({e}). Remove it in Finder instead.", path.display()))
+    }
+}
+
+/// FreeBSD: the release tarball holds a `/usr/local`-style tree (`bin/<app>`,
+/// `share/applications`, icons). Older releases had the files flat in one folder; those are laid
+/// out the same way first.
+#[cfg(unix)]
+#[allow(dead_code)]
+mod tree {
+    use super::{App, Path, PathBuf, single_top_folder};
+
+    /// Unpacks `file` and returns a staging folder laid out like `/usr/local`.
+    pub fn unpack(app: &App, file: &Path, staging: &Path) -> Result<PathBuf, String> {
+        let _ = std::fs::remove_dir_all(staging);
+        std::fs::create_dir_all(staging).map_err(|e| format!("couldn't create {} ({e})", staging.display()))?;
+        let gz = std::fs::File::open(file).map_err(|e| e.to_string())?;
+        let mut archive = tar::Archive::new(flate2::read::GzDecoder::new(gz));
+        archive.set_preserve_permissions(true);
+        // Bound entry count and cumulative unpacked bytes to prevent decompression bombs (CWE-409).
+        const MAX_ENTRIES: usize = 50_000;
+        const MAX_UNPACKED_BYTES: u64 = 2 * 1024 * 1024 * 1024;
+        let mut entry_count = 0;
+        let mut total_unpacked = 0u64;
+        let mut directories = Vec::new();
+        let entries = archive.entries().map_err(|e| format!("couldn't read archive entries ({e})"))?;
+        for entry in entries {
+            let mut entry = entry.map_err(|e| format!("invalid tar entry ({e})"))?;
+            entry_count += 1;
+            if entry_count > MAX_ENTRIES {
+                return Err("archive has too many entries".into());
+            }
+            let size = entry.size();
+            total_unpacked = total_unpacked.saturating_add(size);
+            if total_unpacked > MAX_UNPACKED_BYTES {
+                return Err("archive exceeds maximum unpacked size".into());
+            }
+            if entry.header().entry_type().is_dir() {
+                directories.push(entry);
+            } else {
+                entry.unpack_in(staging).map_err(|e| format!("couldn't unpack archive entry ({e})"))?;
+            }
+        }
+        // Delay directory entries until child entries are written so restrictive modes do not break child extraction.
+        directories.sort_by(|a, b| b.path_bytes().cmp(&a.path_bytes()));
+        for mut dir in directories {
+            dir.unpack_in(staging).map_err(|e| format!("couldn't unpack archive directory ({e})"))?;
+        }
+        let top = single_top_folder(staging)?;
+        if top.join("bin").join(app.id).is_file() {
+            return Ok(top);
+        }
+        // Flat layout: put each file where /usr/local keeps it.
+        // Ensure tree is a fresh directory and not an archive-created symlink or directory (CWE-59).
+        let tree = staging.join("tree");
+        if let Ok(m) = std::fs::symlink_metadata(&tree) {
+            if m.file_type().is_symlink() || !m.is_dir() {
+                let _ = std::fs::remove_file(&tree);
+            } else {
+                let _ = std::fs::remove_dir_all(&tree);
+            }
+        }
+        std::fs::create_dir_all(&tree).map_err(|e| e.to_string())?;
+        let id = app.bundle_id();
+        for (from, to) in [
+            (top.join(app.id), tree.join("bin").join(app.id)),
+            (top.join(format!("{}-cli", app.id)), tree.join("bin").join(format!("{}-cli", app.id))),
+            (top.join(format!("{id}.desktop")), tree.join("share/applications").join(format!("{id}.desktop"))),
+            (top.join(format!("{id}.png")), tree.join("share/pixmaps").join(format!("{id}.png"))),
+        ] {
+            if std::fs::symlink_metadata(&from).is_ok_and(|m| m.file_type().is_file()) {
+                if let Some(dir) = to.parent() {
+                    let rel = dir.strip_prefix(&tree).map_err(|_| "destination escapes staging tree".to_string())?;
+                    let mut check = tree.clone();
+                    for part in rel.components() {
+                        check.push(part);
+                        if let Ok(m) = std::fs::symlink_metadata(&check)
+                            && m.file_type().is_symlink()
+                        {
+                            return Err("destination parent directory is a symlink".into());
+                        }
+                    }
+                    std::fs::create_dir_all(dir).map_err(|e| e.to_string())?;
+                }
+                std::fs::rename(&from, &to).map_err(|e| e.to_string())?;
+            }
+        }
+        if !tree.join("bin").join(app.id).is_file() {
+            return Err("the download doesn't contain the app".into());
+        }
+        Ok(tree)
+    }
+
+    /// Every file under `root`, relative to it. Does not descend through symlinks (CWE-59, CWE-400).
+    pub fn files(root: &Path) -> Result<Vec<PathBuf>, String> {
+        let mut out = Vec::new();
+        let mut stack = vec![root.to_path_buf()];
+        let mut visited = 0;
+        const MAX_FILES: usize = 50_000;
+        while let Some(dir) = stack.pop() {
+            let entries = std::fs::read_dir(&dir).map_err(|e| format!("couldn't read directory {}: {e}", dir.display()))?;
+            for entry in entries {
+                let entry = entry.map_err(|e| format!("couldn't read directory entry: {e}"))?;
+                visited += 1;
+                if visited > MAX_FILES {
+                    return Err("directory tree exceeds maximum file limit of 50,000".into());
+                }
+                let ft = entry.file_type().map_err(|e| format!("couldn't read file type: {e}"))?;
+                let p = entry.path();
+                if ft.is_dir() && !ft.is_symlink() {
+                    stack.push(p);
+                } else {
+                    let rel = p.strip_prefix(root).map_err(|e| e.to_string())?;
+                    out.push(rel.to_path_buf());
+                }
+            }
+        }
+        out.sort();
+        Ok(out)
+    }
+}
+
+#[cfg(target_os = "freebsd")]
+mod freebsd {
+    use std::ffi::OsStr;
+
+    use super::{App, Path, PathBuf, Paths, pkexec, process, run_as_root, tree};
+
+    /// Copies the release's tree into `/usr/local` (asking for permission through polkit), or
+    /// into `~/.local` when polkit isn't installed. Returns the binary, every file installed,
+    /// and whether removing them needs root.
+    pub fn install_tree(app: &App, file: &Path, paths: &Paths) -> Result<(PathBuf, Vec<PathBuf>, bool), String> {
+        let staging = paths.cache.join(format!("{}.new", app.id));
+        let result = install_from(app, file, &staging);
+        let _ = std::fs::remove_dir_all(&staging);
+        result
+    }
+
+    fn install_from(app: &App, file: &Path, staging: &Path) -> Result<(PathBuf, Vec<PathBuf>, bool), String> {
+        let tree = tree::unpack(app, file, staging)?;
+        let rel = tree::files(&tree)?;
+        let mut source = tree.into_os_string();
+        source.push("/.");
+        if pkexec().is_some() {
+            let prefix = PathBuf::from("/usr/local");
+            run_as_root(&[OsStr::new("/bin/cp"), OsStr::new("-R"), &source, prefix.as_os_str()])?;
+            return Ok((prefix.join("bin").join(app.id), rel.iter().map(|r| prefix.join(r)).collect(), true));
+        }
+        let prefix = crate::folders::home_dir().ok_or("no home folder")?.join(".local");
+        std::fs::create_dir_all(&prefix).map_err(|e| e.to_string())?;
+        let status = process::command("/bin/cp").arg("-R").arg(&source).arg(&prefix).status().map_err(|e| e.to_string())?;
+        if !status.success() {
+            return Err("couldn't copy the app into ~/.local".into());
+        }
+        // ~/.local/bin is often not on PATH for the desktop: point the menu entry at the binary.
+        let bin = prefix.join("bin").join(app.id);
+        let desktop = prefix.join("share/applications").join(format!("{}.desktop", app.bundle_id()));
+        if let Ok(text) = std::fs::read_to_string(&desktop) {
+            let exec = format!("Exec=\"{}\"", bin.display());
+            let fixed: String = text
+                .lines()
+                .map(|l| {
+                    if let Some(rest) = l.strip_prefix("Exec=").and_then(|r| r.strip_prefix(app.id)) {
+                        format!("{exec}{rest}\n")
+                    } else {
+                        format!("{l}\n")
+                    }
+                })
+                .collect();
+            let _ = std::fs::write(&desktop, fixed);
+        }
+        Ok((bin, rel.iter().map(|r| prefix.join(r)).collect(), false))
+    }
+
+    /// Removes the files a tree install put down.
+    pub fn remove_files(files: &[PathBuf], needs_root: bool) -> Result<(), String> {
+        if files.is_empty() {
+            return Err("the launcher has no record of these files".into());
+        }
+        let prefix = if needs_root { PathBuf::from("/usr/local") } else { crate::folders::home_dir().ok_or("no home folder")?.join(".local") };
+        let mut safe_files = Vec::new();
+        for f in files {
+            // Refuse paths that climb or escape install prefix (CWE-59).
+            if !f.starts_with(&prefix) || f.components().any(|c| matches!(c, std::path::Component::ParentDir)) {
+                return Err(format!("refusing to remove file outside install prefix: {}", f.display()));
+            }
+            let mut has_symlink_ancestor = false;
+            if let Ok(rel) = f.strip_prefix(&prefix) {
+                let mut check = prefix.clone();
+                for part in rel.components() {
+                    if let Ok(meta) = std::fs::symlink_metadata(&check)
+                        && meta.file_type().is_symlink()
+                    {
+                        has_symlink_ancestor = true;
+                        break;
+                    }
+                    check.push(part);
+                }
+            }
+            if !has_symlink_ancestor {
+                safe_files.push(f);
+            }
+        }
+        if safe_files.is_empty() {
+            return Ok(());
+        }
+        if needs_root {
+            let mut args: Vec<&OsStr> = vec![OsStr::new("/bin/rm"), OsStr::new("-f"), OsStr::new("--")];
+            args.extend(safe_files.iter().map(|f| f.as_os_str()));
+            return run_as_root(&args);
+        }
+        for f in safe_files {
+            let _ = std::fs::remove_file(f);
+        }
+        Ok(())
+    }
+}
+
+/// Builds the Windows Installer command separately so its package argument can be checked
+/// without starting an installer.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn msi_command(program: &Path, msi: &Path) -> Result<std::process::Command, String> {
+    let msi = msi_path(msi)?;
+    let mut command = process::command(program);
+    // A verbose log beside the package: Windows Installer's own errors (1603 above all) say
+    // nothing without it.
+    command.arg("/i").arg(&msi).args(["/passive", "/norestart", "/l*v"]).arg(msi_log(&msi));
+    Ok(command)
+}
+
+/// Where `msi_command` asks Windows Installer to write its log.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn msi_log(msi: &Path) -> PathBuf {
+    msi.with_extension("log")
+}
+
+/// Windows Installer's storage APIs can fail on paths through junctions or symlinks (#338).
+/// Keep ordinary drive/UNC syntax when possible: Windows canonicalization alone introduces
+/// a `\\?\` prefix that older APIs also cannot handle.
+#[cfg_attr(not(windows), allow(dead_code))]
+pub(crate) fn msi_path(msi: &Path) -> Result<PathBuf, String> {
+    #[cfg(windows)]
+    let resolved = dunce::canonicalize(msi);
+    #[cfg(not(windows))]
+    let resolved = std::fs::canonicalize(msi);
+    resolved.map_err(|e| format!("couldn't resolve the Windows Installer package {} ({e})", msi.display()))
+}
+
+#[cfg(windows)]
+pub mod windows {
+    use crate::protocol::CANCELLED;
+
+    use super::{App, INSTALLER, JobPhase, Path, PathBuf, Stop, cancelled, msi_command, msi_folder_argument, msi_log, process, turn};
+
+    fn msiexec() -> PathBuf {
+        std::env::var_os("SystemRoot").map_or_else(|| PathBuf::from(r"C:\Windows"), PathBuf::from).join(r"System32\msiexec.exe")
+    }
+
+    fn explain(code: Option<i32>) -> Result<(), String> {
+        match code {
+            Some(0 | 3010 | 1641) => Ok(()),
+            Some(1602) => Err("cancelled".into()),
+            Some(1618) => Err("another installation is in progress. Wait for it to finish, then try again.".into()),
+            Some(1925 | 1303) => Err("Windows didn't allow the install (administrator permission is needed)".into()),
+            Some(c) => Err(format!("the Windows Installer stopped with error {c}")),
+            None => Err("the Windows Installer was interrupted".into()),
+        }
+    }
+
+    /// Runs an MSI with a progress window and no restart. Windows asks for permission itself.
+    pub fn run_msi(msi: &Path, destination: Option<&Path>, stop: &Stop, phase: &mut dyn FnMut(JobPhase)) -> Result<(), String> {
+        in_turn(stop, phase, JobPhase::Installing, || {
+            use std::os::windows::process::CommandExt;
+            let mut command = msi_command(&msiexec(), msi)?;
+            if let Some(dir) = destination {
+                command.raw_arg(msi_folder_argument(dir)?);
+            }
+            let status = command.status().map_err(|e| format!("couldn't start the Windows Installer ({e})"))?;
+            explain(status.code()).map_err(|e| match status.code() {
+                Some(1602) | None => e,
+                _ => format!("{e}. Its log is at {}", msi_log(msi).display()),
+            })
+        })
+    }
+
+    /// Runs the launcher's own new MSI for a self-update, with the same progress window and no
+    /// restart as [`run_msi`], and waits for it.
+    pub fn reinstall(msi: &Path) -> Result<(), String> {
+        let status = msi_command(&msiexec(), msi)?.status().map_err(|e| format!("couldn't start the Windows Installer ({e})"))?;
+        explain(status.code())
+    }
+
+    /// Runs `work` once no other Windows Installer job of ours is running (a second one would
+    /// stop with error 1618). Cancelled while it waits, it never runs.
+    fn in_turn(stop: &Stop, phase: &mut dyn FnMut(JobPhase), working: JobPhase, work: impl FnOnce() -> Result<(), String>) -> Result<(), String> {
+        INSTALLER.alone(&cancelled(stop), &mut turn(phase, working), work).unwrap_or_else(|| Err(CANCELLED.into()))
+    }
+
+    pub fn uninstall_msi(app: &App, stop: &Stop, phase: &mut dyn FnMut(JobPhase)) -> Result<(), String> {
+        let installs = crate::detect::windows::msi_installs(app);
+        if installs.is_empty() {
+            return Err(format!("{} isn't registered with the Windows Installer", app.name));
+        }
+        in_turn(stop, phase, JobPhase::Removing, || {
+            for m in installs {
+                let status = process::command(msiexec())
+                    .args(["/x", &m.product_code, "/passive", "/norestart"])
+                    .status()
+                    .map_err(|e| format!("couldn't start the Windows Installer ({e})"))?;
+                explain(status.code())?;
+            }
+            Ok(())
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[cfg(unix)]
+    #[test]
+    fn msi_install_uses_the_package_target_instead_of_a_symlinked_cache() {
+        let dir = tempfile::tempdir().unwrap();
+        let cache = dir.path().join("persistent cache");
+        std::fs::create_dir(&cache).unwrap();
+        let file = cache.join("PhotoCraft.msi");
+        std::fs::write(&file, b"test package").unwrap();
+        let link = dir.path().join("current cache");
+        std::os::unix::fs::symlink(&cache, &link).unwrap();
+        let command = msi_command(Path::new("msiexec.exe"), &link.join("PhotoCraft.msi")).unwrap();
+        let args: Vec<_> = command.get_args().collect();
+        assert_eq!(
+            args,
+            [
+                std::ffi::OsStr::new("/i"),
+                file.canonicalize().unwrap().as_os_str(),
+                std::ffi::OsStr::new("/passive"),
+                std::ffi::OsStr::new("/norestart"),
+                std::ffi::OsStr::new("/l*v"),
+                file.canonicalize().unwrap().with_extension("log").as_os_str()
+            ]
+        );
+    }
+
+    #[test]
+    fn an_unavailable_msi_is_refused_before_starting_the_installer() {
+        let dir = tempfile::tempdir().unwrap();
+        let missing = dir.path().join("missing.msi");
+        let error = msi_command(Path::new("msiexec.exe"), &missing).unwrap_err();
+        assert!(error.contains("couldn't resolve the Windows Installer package"), "{error}");
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn a_short_local_msi_path_keeps_ordinary_windows_syntax() {
+        let dir = tempfile::tempdir().unwrap();
+        let file = dir.path().join("package.msi");
+        std::fs::write(&file, b"test package").unwrap();
+        let resolved = msi_path(&file).unwrap();
+        assert!(!resolved.as_os_str().to_string_lossy().starts_with(r"\\?\"), "{resolved:?}");
+        assert_eq!(std::fs::read(resolved).unwrap(), b"test package");
+    }
+
+    #[test]
+    fn selected_folders_must_exist_and_leave_no_probe_files() {
+        let dir = tempfile::tempdir().unwrap();
+        assert_eq!(selected_folder(dir.path().to_str().unwrap(), true).unwrap(), dir.path());
+        assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 0);
+        #[cfg(unix)]
+        {
+            let quoted = dir.path().join("Craft \"Apps\"");
+            std::fs::create_dir(&quoted).unwrap();
+            assert_eq!(selected_folder(quoted.to_str().unwrap(), true).unwrap(), quoted);
+        }
+        let missing = dir.path().join("unavailable/Apps");
+        assert!(selected_folder(missing.to_str().unwrap(), true).is_err());
+        assert!(!missing.exists());
+        assert!(selected_folder("relative/folder", true).is_err());
+        assert!(selected_folder("bad\nfolder", true).is_err());
+        let app = App::by_id("photocraft").unwrap();
+        let locations = InstallLocations { root: Some(dir.path().display().to_string()), ..Default::default() };
+        assert_eq!(destination(app, PackageKind::Msi, None, None, &locations).unwrap(), Some(dir.path().join("PhotoCraft")));
+        assert_eq!(destination(app, PackageKind::PortableZip, None, None, &locations).unwrap(), Some(dir.path().to_path_buf()));
+        let old = record("0.5.0", PackageKind::PortableZip, dir.path().join("PhotoCraft/photocraft.exe"), vec![], false);
+        let unavailable = InstallLocations { root: Some(dir.path().join("missing").display().to_string()), ..Default::default() };
+        assert_eq!(destination(app, PackageKind::PortableZip, None, Some(&old), &unavailable).unwrap(), None);
+        let msi = Installed {
+            version: None,
+            source: InstallSource::Msi,
+            location: dir.path().join("MSI/PhotoCraft/photocraft.exe").display().to_string(),
+            package: None,
+        };
+        assert_eq!(destination(app, PackageKind::Msi, Some(&msi), Some(&old), &unavailable).unwrap(), Some(dir.path().join("MSI/PhotoCraft")));
+        assert!(destination(app, PackageKind::TarGz, None, None, &locations).unwrap_err().contains("aren't supported"));
+    }
+
+    #[test]
+    fn updates_stay_beside_the_launchers_copy_and_new_installs_use_the_chosen_folder() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let path = dir.path().join("old.AppImage");
+        let rec = record("0.5.0", PackageKind::AppImage, path.clone(), vec![], false);
+        let launcher = Installed { version: None, source: InstallSource::Launcher, location: path.display().to_string(), package: None };
+        let users = Installed { version: None, source: InstallSource::AppImage, location: "/home/me/AppImages/p.AppImage".into(), package: None };
+        let chosen = dir.path().join("New apps");
+        std::fs::create_dir(&chosen).unwrap();
+        let mut locations = InstallLocations { root: Some(chosen.display().to_string()), ..Default::default() };
+        assert_eq!(destination(app, PackageKind::AppImage, Some(&launcher), Some(&rec), &locations).unwrap(), Some(dir.path().into()));
+        assert_eq!(destination(app, PackageKind::AppImage, Some(&users), None, &locations).unwrap(), None);
+        if !process::in_sandbox() {
+            assert_eq!(destination(app, PackageKind::AppImage, None, None, &locations).unwrap(), Some(chosen.clone()));
+            locations.per_app.insert(app.id.into(), dir.path().display().to_string());
+            assert_eq!(destination(app, PackageKind::Dmg, None, None, &locations).unwrap(), Some(dir.path().into()));
+        }
+    }
+
+    #[test]
+    fn msi_folder_assignment_preserves_spaces_unicode_and_root_separators() {
+        for (value, argument) in [
+            (r"D:\", r#"INSTALLFOLDER="D:\""#),
+            (r"D:\Craft Apps\PhotoCraft", r#"INSTALLFOLDER="D:\Craft Apps\PhotoCraft""#),
+            (r"\\server\apps\绘画", r#"INSTALLFOLDER="\\server\apps\绘画""#),
+            (r"D:\Craft Apps\", r#"INSTALLFOLDER="D:\Craft Apps\""#),
+        ] {
+            assert_eq!(msi_folder_argument(Path::new(value)).unwrap(), argument);
+        }
+        assert!(msi_folder_argument(Path::new("D:\\bad\" TRANSFORMS=evil")).is_err());
+        assert!(msi_folder_argument(Path::new("D:\\bad\nfolder")).is_err());
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn appimage_updates_replace_only_the_recorded_file_in_the_same_folder() {
+        let dir = tempfile::tempdir().unwrap();
+        let folder = dir.path().join("Craft Apps");
+        std::fs::create_dir(&folder).unwrap();
+        let download = dir.path().join("download");
+        std::fs::write(&download, "first").unwrap();
+        let unrelated = folder.join("photocraft-unrelated.AppImage");
+        std::fs::write(&unrelated, "user copy").unwrap();
+        let (old, removed) = linux::install_appimage(&download, "photocraft-0.5.0.AppImage", Some(&folder), None, false).unwrap();
+        assert!(removed.is_empty());
+        assert_eq!(std::fs::read(&old).unwrap(), b"first");
+        let rec = record("0.5.0", PackageKind::AppImage, old.clone(), vec![], false);
+        std::fs::write(&download, "updated").unwrap();
+        let (new, removed) = linux::install_appimage(&download, "photocraft-0.6.0.AppImage", Some(&folder), Some(&rec), false).unwrap();
+        assert_eq!(new, folder.join("photocraft-0.6.0.AppImage"));
+        assert_eq!(std::fs::read(&new).unwrap(), b"updated");
+        assert_eq!(removed.as_slice(), std::slice::from_ref(&old));
+        assert!(!old.exists());
+        assert_eq!(std::fs::read(&unrelated).unwrap(), b"user copy");
+        assert!(linux::install_appimage(&download, "photocraft-unrelated.AppImage", Some(&folder), Some(&rec), false).is_err());
+        assert_eq!(std::fs::read(&unrelated).unwrap(), b"user copy");
+        let new_rec = record("0.6.0", PackageKind::AppImage, new.clone(), vec![], false);
+        assert!(linux::install_appimage(&download, "photocraft-0.6.0.AppImage", Some(&folder), Some(&new_rec), false).is_ok());
+        assert_eq!(std::fs::read_dir(&folder).unwrap().count(), 2);
+        let link = folder.join("linked.AppImage");
+        std::os::unix::fs::symlink(&unrelated, &link).unwrap();
+        let link_rec = record("0.6.0", PackageKind::AppImage, link, vec![], false);
+        assert!(linux::install_appimage(&download, "linked.AppImage", Some(&folder), Some(&link_rec), false).is_err());
+        assert_eq!(std::fs::read(&unrelated).unwrap(), b"user copy");
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn an_appimage_writes_over_a_users_file_only_when_asked_to() {
+        let dir = tempfile::tempdir().unwrap();
+        let download = dir.path().join("download");
+        std::fs::write(&download, "new").unwrap();
+        let folder = dir.path().join("Apps");
+        std::fs::create_dir(&folder).unwrap();
+        let theirs = folder.join("photocraft.AppImage");
+        let personal = dir.path().join("personal.txt");
+        std::fs::write(&theirs, "user copy").unwrap();
+        std::fs::write(&personal, "user file").unwrap();
+        std::os::unix::fs::symlink(&personal, folder.join(".photocraft.AppImage.partial")).unwrap();
+        assert!(linux::install_appimage(&download, "photocraft.AppImage", Some(&folder), None, false).is_err());
+        assert_eq!(std::fs::read(&theirs).unwrap(), b"user copy");
+        linux::install_appimage(&download, "photocraft.AppImage", Some(&folder), None, true).unwrap();
+        assert_eq!(std::fs::read(&theirs).unwrap(), b"new");
+        assert_eq!(std::fs::read(&personal).unwrap(), b"user file");
+        assert_eq!(std::fs::read_dir(&folder).unwrap().count(), 2, "staging was left behind");
+    }
+
+    #[test]
+    fn a_new_install_reports_what_it_would_write_over() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        let locations = InstallLocations { root: Some(dir.path().display().to_string()), ..Default::default() };
+        let asset = Asset { name: "photocraft.zip".into(), ..Default::default() };
+        let occupied = |previous| occupied(app, &asset, PackageKind::PortableZip, None, previous, &locations, &paths).unwrap();
+        assert_eq!(occupied(None), None);
+        std::fs::create_dir(dir.path().join("photocraft")).unwrap();
+        assert_eq!(occupied(None), Some(dir.path().join("photocraft")));
+        let old = record("0.5.0", PackageKind::PortableZip, dir.path().join("photocraft/photocraft.exe"), vec![], false);
+        assert_eq!(occupied(Some(&old)), None);
+    }
+
+    #[test]
+    fn swap_keeps_the_old_copy_until_the_new_one_is_in_place() {
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("app");
+        let staged = dir.path().join("app.new");
+        std::fs::create_dir(&dest).unwrap();
+        std::fs::write(dest.join("v"), "old").unwrap();
+        std::fs::create_dir(&staged).unwrap();
+        std::fs::write(staged.join("v"), "new").unwrap();
+        swap_into_place(&staged, &dest).unwrap();
+        assert_eq!(std::fs::read_to_string(dest.join("v")).unwrap(), "new");
+        assert!(!staged.exists() && !dir.path().join("app.old").exists());
+        assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 1);
+        // A missing staged copy leaves the installed one alone.
+        assert!(swap_into_place(&staged, &dest).is_err());
+        assert_eq!(std::fs::read_to_string(dest.join("v")).unwrap(), "new");
+        assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 1);
+    }
+
+    #[test]
+    fn swap_preserves_an_unrelated_backup_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("app");
+        let staged = dir.path().join("app.new");
+        let unrelated = dest.with_extension("old");
+        std::fs::write(&dest, b"installed app").unwrap();
+        std::fs::write(&staged, b"updated app").unwrap();
+        std::fs::write(&unrelated, b"user backup").unwrap();
+        swap_into_place(&staged, &dest).unwrap();
+        assert_eq!(std::fs::read(&unrelated).unwrap(), b"user backup");
+        assert_eq!(std::fs::read(&dest).unwrap(), b"updated app");
+        assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 2);
+    }
+
+    #[test]
+    fn swap_preserves_an_unrelated_backup_directory() {
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("app");
+        let staged = dir.path().join("app.new");
+        let unrelated = dest.with_extension("old");
+        std::fs::create_dir(&dest).unwrap();
+        std::fs::write(dest.join("v"), b"installed app").unwrap();
+        std::fs::create_dir(&staged).unwrap();
+        std::fs::write(staged.join("v"), b"updated app").unwrap();
+        std::fs::create_dir(&unrelated).unwrap();
+        std::fs::write(unrelated.join("keep.txt"), b"user backup").unwrap();
+        swap_into_place(&staged, &dest).unwrap();
+        assert_eq!(std::fs::read(unrelated.join("keep.txt")).unwrap(), b"user backup");
+        assert_eq!(std::fs::read(dest.join("v")).unwrap(), b"updated app");
+        assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 2);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn swap_preserves_a_dangling_backup_symlink() {
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("app");
+        let staged = dir.path().join("app.new");
+        let unrelated = dest.with_extension("old");
+        let target = dir.path().join("missing");
+        std::fs::write(&dest, b"installed app").unwrap();
+        std::fs::write(&staged, b"updated app").unwrap();
+        std::os::unix::fs::symlink(&target, &unrelated).unwrap();
+        swap_into_place(&staged, &dest).unwrap();
+        assert_eq!(std::fs::read_link(&unrelated).unwrap(), target);
+        assert_eq!(std::fs::read(&dest).unwrap(), b"updated app");
+    }
+
+    #[test]
+    fn a_failed_rollback_keeps_the_old_app_and_reports_its_backup_path() {
+        let dir = tempfile::tempdir().unwrap();
+        let dest = dir.path().join("app");
+        let staged = dir.path().join("app.new");
+        std::fs::write(&dest, b"installed app").unwrap();
+        std::fs::write(&staged, b"updated app").unwrap();
+        let calls = std::cell::Cell::new(0);
+        let err = swap_into_place_via(&staged, &dest, |from, to| {
+            calls.set(calls.get() + 1);
+            match calls.get() {
+                1 => std::fs::rename(from, to),
+                2 => Err(std::io::Error::other("staged move failed")),
+                _ => Err(std::io::Error::other("restore failed")),
+            }
+        })
+        .unwrap_err();
+        assert_eq!(calls.get(), 3);
+        assert!(err.contains("staged move failed") && err.contains("restore failed"));
+        let backup = std::fs::read_dir(dir.path()).unwrap().map(|e| e.unwrap().path()).find(|p| p.is_dir()).unwrap();
+        let saved = backup.join("old");
+        assert_eq!(std::fs::read(&saved).unwrap(), b"installed app");
+        assert!(err.contains(&saved.display().to_string()));
+        assert_eq!(std::fs::read(&staged).unwrap(), b"updated app");
+    }
+
+    #[test]
+    fn a_failed_install_keeps_the_download_for_the_next_try() {
+        use crate::http::tests::{Reply, body, serve};
+        let base = App::by_id("wordcraft").unwrap();
+        let wordcraft = App { icon_png: Some(b"\x89PNG\r\n\x1a\nfake-png-bytes"), ..*base };
+        let app = &wordcraft;
+        let (body, sha) = body();
+        let (url, requests) = serve(body.clone(), vec![Reply::Full, Reply::Full]);
+        let asset = Asset { name: "wordcraft-0.3.0-test.pkg".into(), size: body.len() as u64, url, sha256: Some(sha) };
+        let release = Release { assets: vec![asset.clone()], ..Release::default() };
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        // A format no build of the launcher installs here stands in for any failing install step.
+        let kind = if cfg!(windows) { PackageKind::Dmg } else { PackageKind::Msi };
+        let mut phases = Vec::new();
+        for _ in 0..2 {
+            let mut phase = |p: JobPhase| phases.push(p);
+            let mut job = Job {
+                http: &http,
+                paths: &paths,
+                stop: &Stop::default(),
+                phase: &mut phase,
+                install_locations: &InstallLocations::default(),
+                replace: false,
+            };
+            let err = install(app, &release, &asset, kind, None, None, &mut job).unwrap_err();
+            assert!(err.contains("isn't supported"), "{err}");
+            assert_eq!(std::fs::read(download_path(&paths, &asset)).unwrap(), body);
+        }
+        assert_eq!(requests.lock().unwrap().len(), 1, "the second try reuses the kept file");
+        assert_eq!(phases.iter().filter(|p| **p == JobPhase::Installing).count(), 2);
+    }
+
+    #[test]
+    fn an_unavailable_custom_folder_is_rejected_before_downloading() {
+        use crate::http::tests::{Reply, body, serve};
+        let base = App::by_id("wordcraft").unwrap();
+        let wordcraft = App { icon_png: Some(b"\x89PNG\r\n\x1a\nfake-png-bytes"), ..*base };
+        let app = &wordcraft;
+        let (body, sha) = body();
+        let (url, requests) = serve(body.clone(), vec![Reply::Full]);
+        let asset = Asset { name: "wordcraft-0.3.0-linux-x86_64.AppImage".into(), size: body.len() as u64, url, sha256: Some(sha) };
+        let release = Release { assets: vec![asset.clone()], ..Release::default() };
+        let dir = tempfile::tempdir().unwrap();
+        let missing = dir.path().join("unavailable/Apps");
+        let locations = InstallLocations { root: Some(missing.display().to_string()), ..Default::default() };
+        let paths = Paths::under(dir.path());
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let mut phases = vec![];
+        let mut phase = |p| phases.push(p);
+        let mut job = Job { http: &http, paths: &paths, stop: &Stop::default(), phase: &mut phase, install_locations: &locations, replace: false };
+        let error = install(app, &release, &asset, PackageKind::AppImage, None, None, &mut job).unwrap_err();
+        assert!(error.contains("folder is unavailable") || (process::in_sandbox() && error.contains("aren't supported")), "{error}");
+        assert!(requests.lock().unwrap().is_empty());
+        assert!(phases.is_empty());
+        assert!(!missing.exists());
+    }
+
+    #[test]
+    fn a_release_without_a_checksum_is_refused_before_anything_is_fetched() {
+        use crate::http::tests::{Reply, body, serve};
+        let base = App::by_id("wordcraft").unwrap();
+        let wordcraft = App { icon_png: Some(b"\x89PNG\r\n\x1a\nfake-png-bytes"), ..*base };
+        let app = &wordcraft;
+        let (body, _) = body();
+        let (url, requests) = serve(body.clone(), vec![Reply::Full]);
+        // Neither a per-file digest nor a SHA256SUMS.txt in the release.
+        let asset = Asset { name: "wordcraft-0.3.1-test.pkg".into(), size: body.len() as u64, url, sha256: None };
+        let release = Release { assets: vec![asset.clone()], ..Release::default() };
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let kind = if cfg!(windows) { PackageKind::Dmg } else { PackageKind::Msi };
+        let mut phases = Vec::new();
+        let mut phase = |p: JobPhase| phases.push(p);
+        let mut job = Job {
+            http: &http,
+            paths: &paths,
+            stop: &Stop::default(),
+            phase: &mut phase,
+            install_locations: &InstallLocations::default(),
+            replace: false,
+        };
+        let err = install(app, &release, &asset, kind, None, None, &mut job).unwrap_err();
+        assert!(err.contains("publishes no checksum"), "{err}");
+        assert!(!download_path(&paths, &asset).exists());
+        assert!(requests.lock().unwrap().is_empty(), "nothing was fetched");
+        assert!(!phases.contains(&JobPhase::Installing));
+    }
+
+    #[cfg(unix)]
+    fn tarball(path: &Path, entries: &[&str]) {
+        let f = std::fs::File::create(path).unwrap();
+        let mut b = tar::Builder::new(flate2::write::GzEncoder::new(f, flate2::Compression::fast()));
+        for name in entries {
+            let mut h = tar::Header::new_gnu();
+            h.set_size(2);
+            h.set_mode(0o755);
+            h.set_cksum();
+            b.append_data(&mut h, name, &b"hi"[..]).unwrap();
+        }
+        b.into_inner().unwrap().finish().unwrap();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn lays_out_both_freebsd_tarball_styles_like_usr_local() {
+        let base = App::by_id("wordcraft").unwrap();
+        let wordcraft = App { icon_png: Some(b"\x89PNG\r\n\x1a\nfake-png-bytes"), ..*base };
+        let app = &wordcraft;
+        let dir = tempfile::tempdir().unwrap();
+        let tree_style = dir.path().join("tree.tar.gz");
+        tarball(
+            &tree_style,
+            &["wordcraft-0.3.0-freebsd-x86_64/bin/wordcraft", "wordcraft-0.3.0-freebsd-x86_64/share/applications/ai.storyteller.wordcraft.desktop"],
+        );
+        let flat_style = dir.path().join("flat.tar.gz");
+        tarball(
+            &flat_style,
+            &[
+                "wordcraft-0.3.0-freebsd-x86_64/wordcraft",
+                "wordcraft-0.3.0-freebsd-x86_64/wordcraft-cli",
+                "wordcraft-0.3.0-freebsd-x86_64/README.md",
+                "wordcraft-0.3.0-freebsd-x86_64/ai.storyteller.wordcraft.desktop",
+                "wordcraft-0.3.0-freebsd-x86_64/ai.storyteller.wordcraft.png",
+            ],
+        );
+        for file in [tree_style, flat_style] {
+            let root = tree::unpack(app, &file, &dir.path().join("staging")).unwrap();
+            let files = tree::files(&root).unwrap();
+            assert!(files.contains(&PathBuf::from("bin/wordcraft")), "{files:?}");
+            assert!(files.contains(&PathBuf::from("share/applications/ai.storyteller.wordcraft.desktop")), "{files:?}");
+            assert!(!files.iter().any(|f| f.ends_with("README.md")), "{files:?}");
+        }
+        let bad = dir.path().join("bad.tar.gz");
+        tarball(&bad, &["x/README.md"]);
+        assert!(tree::unpack(app, &bad, &dir.path().join("staging")).is_err());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn tree_files_does_not_traverse_directory_symlinks() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path().join("root");
+        let external = dir.path().join("external");
+        std::fs::create_dir_all(&root).unwrap();
+        std::fs::create_dir_all(&external).unwrap();
+        std::fs::write(root.join("regular.txt"), b"hi").unwrap();
+        std::fs::write(external.join("secret.txt"), b"secret").unwrap();
+        std::os::unix::fs::symlink(&external, root.join("link_to_external")).unwrap();
+
+        let list = tree::files(&root).unwrap();
+        assert_eq!(list, vec![PathBuf::from("link_to_external"), PathBuf::from("regular.txt")]);
+    }
+
+    #[cfg(target_os = "freebsd")]
+    #[test]
+    fn remove_files_refuses_escaping_paths() {
+        assert!(freebsd::remove_files(&[PathBuf::from("/etc/shadow")], false).is_err());
+        if let Some(home) = crate::folders::home_dir() {
+            let prefix = home.join(".local");
+            assert!(freebsd::remove_files(&[prefix.join("../escaped")], false).is_err());
+        }
+    }
+
+    #[test]
+    fn single_top_folder_rejects_symlink() {
+        let dir = tempfile::tempdir().unwrap();
+        let real_dir = dir.path().join("real");
+        std::fs::create_dir_all(&real_dir).unwrap();
+        let staging = dir.path().join("staging");
+        std::fs::create_dir_all(&staging).unwrap();
+        #[cfg(unix)]
+        {
+            std::os::unix::fs::symlink(&real_dir, staging.join("symlink_dir")).unwrap();
+            let res = single_top_folder(&staging).unwrap();
+            assert_eq!(res, staging, "a directory symlink must not be chosen as top folder");
+        }
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn a_tarball_install_lives_in_the_launchers_folder_and_keeps_the_apps_home() {
+        let base = App::by_id("wordcraft").unwrap();
+        let wordcraft = App { icon_png: Some(b"\x89PNG\r\n\x1a\nfake-png-bytes"), ..*base };
+        let app = &wordcraft;
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        let file = dir.path().join("wordcraft-0.3.0-linux-x86_64.tar.gz");
+        tarball(
+            &file,
+            &[
+                "wordcraft-0.3.0-linux-x86_64/bin/wordcraft",
+                "wordcraft-0.3.0-linux-x86_64/bin/wordcraft-cli",
+                "wordcraft-0.3.0-linux-x86_64/share/applications/ai.storyteller.wordcraft.desktop",
+            ],
+        );
+
+        let bin = linux::install_tree(app, &file, &paths).unwrap();
+        let root = paths.apps().join("wordcraft");
+        assert_eq!(bin, root.join("bin").join("wordcraft"));
+        assert!(bin.is_file(), "the app's binary wasn't unpacked");
+        assert!(root.join("share/applications/ai.storyteller.wordcraft.desktop").is_file(), "share/ wasn't unpacked");
+        assert!(!paths.cache.join("wordcraft.new").exists(), "the staging folder was left behind");
+
+        // The app's own home sits beside the tree, and an update keeps it.
+        let home = paths.app_home(app.id);
+        std::fs::create_dir_all(home.join(".config/wordcraft")).unwrap();
+        std::fs::write(home.join(".config/wordcraft/settings.toml"), "keep me").unwrap();
+        linux::install_tree(app, &file, &paths).unwrap();
+        assert_eq!(std::fs::read_to_string(home.join(".config/wordcraft/settings.toml")).unwrap(), "keep me");
+
+        // Removing the install takes the tree and nothing else.
+        linux::remove_tree(app, &paths).unwrap();
+        assert!(!bin.exists() && !root.join("share").exists());
+        assert!(home.join(".config/wordcraft/settings.toml").is_file(), "the app's settings were removed with it");
+        assert!(linux::remove_tree(app, &paths).is_err(), "a second removal says there is nothing there");
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn a_tarball_binary_that_is_a_symlink_out_of_the_tree_is_refused() {
+        use std::io::Write;
+        use std::os::unix::fs::PermissionsExt;
+        let base = App::by_id("wordcraft").unwrap();
+        let wordcraft = App { icon_png: Some(b"\x89PNG\r\n\x1a\nfake-png-bytes"), ..*base };
+        let app = &wordcraft;
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+
+        // A working install the rejected update must leave untouched.
+        let good = dir.path().join("wordcraft-0.3.0-linux-x86_64.tar.gz");
+        tarball(&good, &["wordcraft-0.3.0-linux-x86_64/bin/wordcraft"]);
+        let bin = linux::install_tree(app, &good, &paths).unwrap();
+        assert_eq!(std::fs::read_to_string(&bin).unwrap(), "hi");
+
+        // A file outside the install tree that the archive tries to chmod through a symlink.
+        let outside = dir.path().join("victim");
+        std::fs::write(&outside, b"secret").unwrap();
+        std::fs::set_permissions(&outside, std::fs::Permissions::from_mode(0o600)).unwrap();
+
+        // A tarball whose bin/wordcraft is a symlink to that external file.
+        let file = dir.path().join("evil.tar.gz");
+        let f = std::fs::File::create(&file).unwrap();
+        let mut b = tar::Builder::new(flate2::write::GzEncoder::new(f, flate2::Compression::fast()));
+        let mut link = tar::Header::new_gnu();
+        link.set_entry_type(tar::EntryType::Symlink);
+        link.set_size(0);
+        link.set_mode(0o777);
+        link.set_cksum();
+        b.append_link(&mut link, "wordcraft-0.3.0-linux-x86_64/bin/wordcraft", &outside).unwrap();
+        // A second real file so the top folder is detected.
+        let mut reg = tar::Header::new_gnu();
+        reg.set_size(2);
+        reg.set_mode(0o644);
+        reg.set_cksum();
+        b.append_data(&mut reg, "wordcraft-0.3.0-linux-x86_64/share/applications/ai.storyteller.wordcraft.desktop", &b"hi"[..]).unwrap();
+        b.into_inner().unwrap().finish().unwrap();
+        drop(std::io::stdout().flush());
+
+        let result = linux::install_tree(app, &file, &paths);
+        assert!(result.is_err(), "a symlink binary must be rejected: {result:?}");
+        assert!(result.unwrap_err().contains("symlink"));
+        // The external file keeps its original mode: the chmod never reached it.
+        let mode = std::fs::metadata(&outside).unwrap().permissions().mode() & 0o777;
+        assert_eq!(mode, 0o600, "the external file's permissions must be untouched");
+        // The rejected update left the previously installed, working binary fully intact.
+        assert!(bin.is_file(), "the rejected update must not remove the working binary");
+        assert_eq!(std::fs::read_to_string(&bin).unwrap(), "hi");
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn an_app_sees_its_own_home_and_the_xdg_folders_inside_it() {
+        let home = PathBuf::from("/data/apps/photocraft/home");
+        let env = home_env(&home);
+        assert_eq!(env[0], ("HOME", home.clone()));
+        for (name, dir) in &env[1..] {
+            assert!(dir.starts_with(&home), "{name}: {}", dir.display());
+        }
+        for wanted in ["XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "XDG_STATE_HOME"] {
+            assert!(env.iter().any(|(name, _)| *name == wanted), "{wanted} isn't set");
+        }
+    }
+
+    #[cfg(any(target_os = "linux", target_os = "freebsd"))]
+    #[test]
+    fn root_commands_run_programs_by_absolute_path_from_the_given_dirs() {
+        use std::ffi::OsStr;
+        let root = tempfile::tempdir().unwrap();
+        let (usr_bin, sbin) = (root.path().join("usr/bin"), root.path().join("sbin"));
+        std::fs::create_dir_all(&usr_bin).unwrap();
+        std::fs::create_dir_all(&sbin).unwrap();
+        std::fs::write(usr_bin.join("rpm"), b"").unwrap();
+        std::fs::write(sbin.join("rpm"), b"").unwrap();
+        std::fs::write(sbin.join("zypper"), b"").unwrap();
+        let dirs = [&usr_bin, &sbin];
+        let run = |args: &[&str]| {
+            let args: Vec<&OsStr> = args.iter().map(OsStr::new).collect();
+            with_absolute_program(&dirs, &args).map(|a| a.into_iter().map(PathBuf::from).collect::<Vec<_>>())
+        };
+
+        // The first directory that has the program wins, and the arguments follow unchanged.
+        assert_eq!(run(&["rpm", "-e", "wordcraft"]), Ok(vec![usr_bin.join("rpm"), "-e".into(), "wordcraft".into()]));
+        assert_eq!(run(&["zypper"]), Ok(vec![sbin.join("zypper")]));
+        // A program that isn't in those directories isn't looked for anywhere else.
+        assert_eq!(run(&["dnf", "remove"]), Err("dnf isn't installed".into()));
+        // An absolute path is kept; a relative path with folders in it is refused.
+        assert_eq!(run(&["/bin/cp", "-R"]), Ok(vec!["/bin/cp".into(), "-R".into()]));
+        assert!(run(&["../usr/bin/rpm"]).is_err());
+        assert!(run(&["bin/rpm"]).is_err());
+        assert!(run(&[]).is_err());
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn several_debs_fit_one_apt_call_and_share_its_result() {
+        // The files are appended to this, so it must end where apt expects packages.
+        assert_eq!(
+            linux::install_command(PackageKind::Deb),
+            Some(&["apt-get", "-o", "DPkg::Lock::Timeout=60", "install", "-y", "--allow-downgrades"][..])
+        );
+        assert_eq!(linux::install_command(PackageKind::Flatpak), None);
+        let failed = || Err("the system installer stopped with error 100".to_string());
+        assert_eq!(linux::shared_outcome(Ok(()), 3), Ok(()));
+        assert_eq!(linux::shared_outcome(failed(), 1), failed());
+        assert_eq!(
+            linux::shared_outcome(failed(), 3),
+            Err("the system installer stopped with error 100 while handling 3 apps together. Try them one at a time.".into())
+        );
+        // A dismissed password prompt stays a cancellation for every app, not an error.
+        assert_eq!(linux::shared_outcome(Err("cancelled".into()), 3), Err("cancelled".into()));
+    }
+
+    /// Installs two `.deb` files that reach the installer together (both wait behind a running
+    /// install), with a stand-in for `pkexec` that exits with `code`. Returns every argument
+    /// list that reached it, and each job's result.
+    #[cfg(target_os = "linux")]
+    fn two_debs_through_pkexec(code: i32) -> (Vec<Vec<String>>, Vec<Result<(), String>>) {
+        use std::sync::{Mutex, mpsc};
+        let queue = crate::queue::Queue::new();
+        let ran = Mutex::new(Vec::new());
+        let run = |args: &[&std::ffi::OsStr]| {
+            ran.lock().unwrap().push(args.iter().map(|a| a.to_string_lossy().into_owned()).collect::<Vec<_>>());
+            root_outcome(Some(code))
+        };
+        let root = linux::Root { queue: &queue, run: &run };
+        let (started, has_started) = mpsc::channel();
+        let (release, released) = mpsc::channel::<()>();
+        let (waiting, waits) = mpsc::channel();
+        let results = std::thread::scope(|scope| {
+            let (queue, root) = (&queue, &root);
+            scope.spawn(move || {
+                queue.alone(&|| false, &mut |_| {}, || {
+                    started.send(()).unwrap();
+                    released.recv().unwrap();
+                });
+            });
+            has_started.recv().unwrap();
+            let jobs = ["/downloads/a.deb", "/downloads/b.deb"].map(|file| {
+                let waiting = waiting.clone();
+                scope.spawn(move || {
+                    let mut phase = |p: JobPhase| {
+                        if p == JobPhase::Waiting {
+                            waiting.send(()).unwrap();
+                        }
+                    };
+                    linux::install_package_via(root, PackageKind::Deb, Path::new(file), &Stop::default(), &mut phase)
+                })
+            });
+            waits.recv().unwrap();
+            waits.recv().unwrap();
+            release.send(()).unwrap();
+            jobs.map(|j| j.join().unwrap()).to_vec()
+        });
+        (ran.into_inner().unwrap(), results)
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn two_debs_reach_root_as_one_apt_call() {
+        let (ran, results) = two_debs_through_pkexec(0);
+        assert_eq!(ran.len(), 1, "{ran:?}");
+        let (command, files) = ran[0].split_at(6);
+        assert_eq!(command, ["apt-get", "-o", "DPkg::Lock::Timeout=60", "install", "-y", "--allow-downgrades"]);
+        let mut files = files.to_vec();
+        files.sort();
+        assert_eq!(files, ["/downloads/a.deb", "/downloads/b.deb"]);
+        assert_eq!(results, [Ok(()), Ok(())]);
+
+        // The password prompt was dismissed: one call, and both apps are cancelled, not failed.
+        let (ran, results) = two_debs_through_pkexec(126);
+        assert_eq!(ran.len(), 1, "{ran:?}");
+        assert_eq!(results, vec![Err("cancelled".to_string()); 2]);
+
+        // apt failed: both apps say so, and how to find the one at fault.
+        let (ran, results) = two_debs_through_pkexec(100);
+        assert_eq!(ran.len(), 1, "{ran:?}");
+        let error = "the system installer stopped with error 100 while handling 2 apps together. Try them one at a time.";
+        assert_eq!(results, vec![Err(error.to_string()); 2]);
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn flatpak_bundle_install_failure_reports_clean_error() {
+        if !crate::process::is_flatpak_available() {
+            return;
+        }
+        let queue = crate::queue::Queue::new();
+        let root = linux::Root { queue: &queue, run: &|_| Ok(()) };
+        let result = linux::install_package_via(&root, PackageKind::Flatpak, Path::new("/nonexistent/file.flatpak"), &Stop::default(), &mut |_| ());
+        assert!(result.is_err());
+        let err = result.unwrap_err();
+        assert!(err.starts_with("Flatpak couldn't install the bundle: "), "unexpected error: {err}");
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn adds_and_removes_only_its_own_menu_entry_and_icon() {
+        let base = App::by_id("wordcraft").unwrap();
+        let wordcraft = App { icon_png: Some(b"\x89PNG\r\n\x1a\nfake-png-bytes"), ..*base };
+        let app = &wordcraft;
+        let root = tempfile::tempdir().unwrap();
+        let data = root.path().join("share");
+        let desktop = data.join("applications/ai.storyteller.wordcraft.desktop");
+        let icon = data.join("icons/hicolor/128x128/apps/ai.storyteller.wordcraft.png");
+        let old = root.path().join("My Apps/wordcraft-0.2.0-linux-x86_64.AppImage");
+        let new = root.path().join("My Apps/wordcraft-0.3.0-linux-x86_64.AppImage");
+        std::fs::create_dir_all(new.parent().unwrap()).unwrap();
+        std::fs::write(&new, b"").unwrap();
+
+        // Fresh install: entry and icon written and recorded.
+        let files = linux::integrate_into(&data, app, &new, &[], None);
+        assert_eq!(files, [icon.clone(), desktop.clone()]);
+        let text = std::fs::read_to_string(&desktop).unwrap();
+        assert!(text.contains("Exec=\"") && text.contains("My Apps/wordcraft-0.3.0-linux-x86_64.AppImage\" %F\n"), "{text}");
+        assert!(text.contains("Icon=ai.storyteller.wordcraft\n"));
+        assert!(std::fs::read(&icon).unwrap().starts_with(b"\x89PNG"));
+        let rec = record("0.3.0", PackageKind::AppImage, new.clone(), files, false);
+
+        // An update rewrites both.
+        assert_eq!(linux::integrate_into(&data, app, &new, &[], Some(&rec)).len(), 2);
+
+        // Someone else's entry and icon are left alone (and not recorded).
+        std::fs::write(&desktop, "[Desktop Entry]\nExec=/usr/bin/wordcraft\n").unwrap();
+        std::fs::write(&icon, b"theirs").unwrap();
+        assert!(linux::integrate_into(&data, app, &new, &[], None).is_empty());
+        assert_eq!(std::fs::read(&icon).unwrap(), b"theirs");
+        // ...unless the entry runs a copy this install just replaced (the app wrote it itself).
+        std::fs::write(&desktop, format!("[Desktop Entry]\nExec=\"{}\" %F\n", old.display())).unwrap();
+        assert_eq!(linux::integrate_into(&data, app, &new, std::slice::from_ref(&old), None), std::slice::from_ref(&desktop));
+        assert!(desktop_entry_is_ours(&desktop));
+
+        // Uninstall: an icon the record doesn't list stays; the entry for the removed copy goes.
+        std::fs::remove_file(&new).unwrap();
+        linux::unintegrate_from(&data, app, &new, None);
+        assert!(!desktop.exists());
+        assert_eq!(std::fs::read(&icon).unwrap(), b"theirs");
+        // With the record, the launcher's icon goes too.
+        std::fs::remove_file(&icon).unwrap();
+        std::fs::write(&new, b"").unwrap();
+        let files = linux::integrate_into(&data, app, &new, &[], None);
+        let rec = record("0.3.0", PackageKind::AppImage, new.clone(), files, false);
+        std::fs::remove_file(&new).unwrap();
+        linux::unintegrate_from(&data, app, &new, Some(&rec));
+        assert!(!desktop.exists() && !icon.exists());
+        // Someone else's entry survives an uninstall.
+        std::fs::write(&desktop, "[Desktop Entry]\nExec=/usr/bin/wordcraft\n").unwrap();
+        linux::unintegrate_from(&data, app, &new, Some(&rec));
+        assert!(desktop.exists());
+    }
+
+    #[cfg(target_os = "linux")]
+    fn desktop_entry_is_ours(path: &Path) -> bool {
+        crate::desktop_entry::is_ours(&std::fs::read_to_string(path).unwrap())
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn immutable_ostree_offers_no_deb_or_rpm() {
+        if !Path::new("/run/ostree-booted").exists() {
+            return;
+        }
+        let kinds = available_kinds();
+        assert!(!kinds.contains(&PackageKind::Rpm), "{kinds:?}");
+        assert!(!kinds.contains(&PackageKind::Deb), "{kinds:?}");
+        assert!(kinds.contains(&PackageKind::AppImage), "{kinds:?}");
+    }
+
+    #[test]
+    fn updates_keep_the_installed_format() {
+        let inst = |source| Installed { version: None, source, location: String::new(), package: None };
+        let app = crate::App::by_id("photocraft").unwrap();
+        let available = available_kinds();
+        if let Some(first) = available.first() {
+            assert_eq!(choose_kinds(app, None, None, &[]).first(), Some(first));
+        }
+        #[cfg(target_os = "macos")]
+        assert_eq!(choose_kinds(app, Some(&inst(InstallSource::MacApp)), None, &[]), [PackageKind::Dmg]);
+        #[cfg(windows)]
+        assert_eq!(choose_kinds(app, Some(&inst(InstallSource::Msi)), None, &[]), [PackageKind::Msi]);
+        #[cfg(target_os = "linux")]
+        assert_eq!(choose_kinds(app, Some(&inst(InstallSource::AppImage)), None, &[]), [PackageKind::AppImage]);
+        let _ = inst;
+    }
+
+    #[test]
+    fn only_the_release_arch_package_is_updated_by_the_launcher() {
+        let pacman = |name: &str| Installed { version: None, source: InstallSource::Pacman, location: String::new(), package: Some(name.into()) };
+        let app = crate::App::by_id("wordcraft").unwrap();
+        assert!(is_release_arch_package(app, &pacman("ai.storyteller.wordcraft")));
+        for aur in ["wordcraft", "wordcraft-bin", "wordcraft-git"] {
+            assert!(!is_release_arch_package(app, &pacman(aur)), "{aur}");
+        }
+        assert_eq!(managed_elsewhere_with(app, &pacman("ai.storyteller.wordcraft"), false, |_| None), None);
+        assert_eq!(managed_elsewhere_with(app, &pacman("wordcraft-bin"), true, |_| None), None);
+    }
+
+    #[test]
+    fn arch_packages_from_a_repository_are_updated_with_the_system() {
+        let app = crate::App::by_id("wordcraft").unwrap();
+        let hint = pacman_update_hint(app, "wordcraft-bin", Some("omarchy"));
+        assert!(hint.starts_with("WordCraft was installed from the omarchy repository or the AUR (wordcraft-bin)."));
+        assert!(hint.ends_with("or sudo pacman -Syu"));
+
+        let aur_hint = pacman_update_hint(app, "wordcraft-bin", None);
+        assert!(aur_hint.starts_with("WordCraft was installed from the AUR (wordcraft-bin)."));
+
+        let si = "Repository      : omarchy\nName            : wordcraft-bin\nVersion         : 0.6.1-1\n";
+        assert_eq!(parse_pacman_repo(si).as_deref(), Some("omarchy"));
+        assert_eq!(parse_pacman_repo("Name : wordcraft-bin\n"), None);
+        assert_eq!(parse_pacman_repo("Repository :\n"), None);
+    }
+
+    #[test]
+    fn aur_packages_are_not_updated_as_arch_pkg() {
+        let pacman = |name: &str| Installed { version: None, source: InstallSource::Pacman, location: String::new(), package: Some(name.into()) };
+        let app = crate::App::by_id("filmcraft").unwrap();
+        let installed = pacman("filmcraft-bin");
+        assert!(managed_elsewhere_with(app, &installed, false, |_| None).is_some());
+        assert_eq!(choose_kinds_with(app, Some(&installed), None, &[], &[], false), Vec::<PackageKind>::new());
+        assert_eq!(choose_kinds_with(app, Some(&installed), None, &[PackageKind::ArchPkg], &[PackageKind::ArchPkg], true), Vec::<PackageKind>::new());
+    }
+
+    #[test]
+    fn release_arch_packages_are_updated_as_arch_pkg() {
+        let pacman = |name: &str| Installed { version: None, source: InstallSource::Pacman, location: String::new(), package: Some(name.into()) };
+        let app = crate::App::by_id("filmcraft").unwrap();
+        let installed = pacman("ai.storyteller.filmcraft");
+        assert_eq!(managed_elsewhere_with(app, &installed, false, |_| None), None);
+        assert_eq!(choose_kinds_with(app, Some(&installed), None, &[], &[], true), vec![PackageKind::ArchPkg]);
+        assert_eq!(choose_kinds_with(app, Some(&installed), None, &[], &[PackageKind::ArchPkg], false), vec![PackageKind::ArchPkg]);
+    }
+
+    #[test]
+    fn unavailable_arch_package_not_selected_for_new_install() {
+        let app = crate::App::by_id("filmcraft").unwrap();
+        assert_eq!(choose_kinds_with(app, None, None, &[PackageKind::ArchPkg], &[], true), Vec::<PackageKind>::new());
+        assert_eq!(choose_kinds_with(app, None, None, &[PackageKind::ArchPkg], &[], false), Vec::<PackageKind>::new());
+        assert_eq!(choose_kinds_with(app, None, None, &[PackageKind::ArchPkg], &[PackageKind::ArchPkg], false), vec![PackageKind::ArchPkg]);
+    }
+
+    #[test]
+    fn install_refuses_to_downgrade_when_target_release_is_older() {
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let phase = &mut |_| ();
+        let locations = InstallLocations::default();
+        let app = App::by_id("photocraft").unwrap();
+        let release = Release { version: version::parse("0.4.0"), tag: "v0.4.0".into(), ..Release::default() };
+        let asset = Asset { name: "photocraft-0.4.0-linux-x86_64.AppImage".into(), ..Asset::default() };
+        let installed = Installed {
+            version: version::parse("0.5.0"),
+            source: InstallSource::Launcher,
+            location: dir.path().join("PhotoCraft.AppImage").display().to_string(),
+            package: None,
+        };
+        let stop = Stop::default();
+        let mut job = Job { http: &http, paths: &paths, stop: &stop, phase, install_locations: &locations, replace: false };
+        let result = install_at(app, &release, &asset, PackageKind::AppImage, Some(&installed), None, &mut job, None);
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("installed version 0.5.0 is newer"));
+    }
+
+    #[test]
+    fn install_rejects_an_artifact_whose_version_is_not_the_advertised_one() {
+        // The release advertises 99.0.0, but the selected artifact is an older official build
+        // (filename and URL tag say 0.4.0). The guard must refuse before any download.
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let phase = &mut |_| ();
+        let locations = InstallLocations::default();
+        let app = App::by_id("photocraft").unwrap();
+        let release = Release { version: version::parse("99.0.0"), tag: "v99.0.0".into(), ..Release::default() };
+        let asset = Asset {
+            name: "photocraft-0.4.0-linux-x86_64.AppImage".into(),
+            url: "https://github.com/storytold/photocraft/releases/download/v0.4.0/photocraft-0.4.0-linux-x86_64.AppImage".into(),
+            ..Asset::default()
+        };
+        let stop = Stop::default();
+        let mut job = Job { http: &http, paths: &paths, stop: &stop, phase, install_locations: &locations, replace: false };
+        let result = install_at(app, &release, &asset, PackageKind::AppImage, None, None, &mut job, None);
+        assert!(result.is_err(), "mismatched artifact version must be rejected");
+        assert!(result.unwrap_err().contains("does not match the advertised version"));
+
+        // A matching artifact passes the guard (it fails later for unrelated reasons, not the bind).
+        let good = Asset {
+            name: "photocraft-99.0.0-linux-x86_64.AppImage".into(),
+            url: "https://github.com/storytold/photocraft/releases/download/v99.0.0/photocraft-99.0.0-linux-x86_64.AppImage".into(),
+            ..Asset::default()
+        };
+        assert!(bind_artifact_version(app, &release, &good).is_ok());
+
+        // URL filename mismatch is rejected (CWE-494).
+        let bad_url_name = Asset {
+            name: "photocraft-99.0.0-linux-x86_64.AppImage".into(),
+            url: "https://github.com/storytold/photocraft/releases/download/v99.0.0/other.AppImage".into(),
+            ..Asset::default()
+        };
+        assert!(bind_artifact_version(app, &release, &bad_url_name).is_err());
+
+        // URL tag mismatch is rejected.
+        let bad_tag = Asset {
+            name: "photocraft-99.0.0-linux-x86_64.AppImage".into(),
+            url: "https://github.com/storytold/photocraft/releases/download/unparsed_tag/photocraft-99.0.0-linux-x86_64.AppImage".into(),
+            ..Asset::default()
+        };
+        assert!(bind_artifact_version(app, &release, &bad_tag).is_err());
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn package_kinds_order_matches_launcher_format() {
+        use super::linux::order_available_kinds;
+
+        // Flatpak launcher defaults to Flatpak if available
+        let kinds = order_available_kinds(true, false, true, true, false, false);
+        assert_eq!(kinds.first(), Some(&PackageKind::Flatpak));
+        assert!(kinds.contains(&PackageKind::Deb));
+        assert!(kinds.contains(&PackageKind::AppImage));
+
+        // AppImage launcher defaults to AppImage
+        let kinds = order_available_kinds(false, true, true, true, false, false);
+        assert_eq!(kinds.first(), Some(&PackageKind::AppImage));
+        assert!(kinds.contains(&PackageKind::Deb));
+        assert!(kinds.contains(&PackageKind::Flatpak));
+
+        // Base Linux launcher defaults to native package format (deb, rpm, or arch) if available
+        let kinds = order_available_kinds(false, false, true, true, false, false);
+        assert_eq!(kinds.first(), Some(&PackageKind::Deb));
+
+        let kinds = order_available_kinds(false, false, true, false, true, false);
+        assert_eq!(kinds.first(), Some(&PackageKind::Rpm));
+
+        let kinds = order_available_kinds(false, false, true, false, false, true);
+        assert_eq!(kinds.first(), Some(&PackageKind::ArchPkg));
+
+        // Base Linux launcher without root/distro packaging falls back to Flatpak then AppImage
+        let kinds = order_available_kinds(false, false, true, false, false, false);
+        assert_eq!(kinds.first(), Some(&PackageKind::Flatpak));
+        assert_eq!(kinds.get(1), Some(&PackageKind::AppImage));
+
+        // The tarball runs inside the sandbox, so it is only offered there: with a usable host
+        // Flatpak it stays an alternative, without one it is the default (an AppImage cannot
+        // mount in a sandbox, and a distro package needs root).
+        let kinds = order_available_kinds(true, false, true, false, false, false);
+        assert_eq!(kinds.first(), Some(&PackageKind::Flatpak));
+        assert_eq!(kinds.get(1), Some(&PackageKind::TarGz));
+        let kinds = order_available_kinds(true, false, false, false, false, false);
+        assert_eq!(kinds, [PackageKind::TarGz, PackageKind::AppImage]);
+        for (appimage, flatpak) in [(true, true), (false, false), (false, true)] {
+            assert!(!order_available_kinds(false, appimage, flatpak, true, true, false).contains(&PackageKind::TarGz));
+        }
+    }
+
+    #[cfg(target_os = "macos")]
+    mod macos_checks {
+        use crate::{SUITE, version};
+
+        use super::macos::{Expect, TEAM_ID, install_dmg, signed_by};
+        use super::*;
+
+        fn photocraft() -> &'static App {
+            SUITE.iter().find(|a| a.id == "photocraft").unwrap()
+        }
+
+        /// A minimal `PhotoCraft.app` at `dir`, reporting `version`.
+        fn bundle(dir: &Path, version: &str) -> PathBuf {
+            let app = dir.join("PhotoCraft.app");
+            let contents = app.join("Contents");
+            std::fs::create_dir_all(contents.join("MacOS")).unwrap();
+            std::fs::write(
+                contents.join("Info.plist"),
+                format!(
+                    "<?xml version=\"1.0\" encoding=\"UTF-8\"?><plist version=\"1.0\"><dict>\
+                     <key>CFBundleIdentifier</key><string>ai.storyteller.photocraft</string>\
+                     <key>CFBundleExecutable</key><string>PhotoCraft</string>\
+                     <key>CFBundleShortVersionString</key><string>{version}</string></dict></plist>"
+                ),
+            )
+            .unwrap();
+            std::fs::write(contents.join("MacOS/PhotoCraft"), version).unwrap();
+            app
+        }
+
+        /// A release-style disk image holding a `PhotoCraft.app` that reports `version`. The
+        /// disk-image helper turns requests away while it is busy (`attach` retries for the same
+        /// reason), so `hdiutil create` is tried a few times, and what it said is kept for the
+        /// failure message.
+        fn dmg(dir: &Path, version: &str) -> PathBuf {
+            let src = dir.join(format!("src-{version}"));
+            bundle(&src, version);
+            let dmg = dir.join(format!("photocraft-{version}-macos-universal.dmg"));
+            let _one_at_a_time = super::macos::DISK_IMAGES.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            let mut said = String::new();
+            for attempt in 0..5u64 {
+                if attempt > 0 {
+                    std::thread::sleep(std::time::Duration::from_millis(400 * attempt));
+                    let _ = std::fs::remove_file(&dmg);
+                }
+                let output = std::process::Command::new("hdiutil")
+                    .args(["create", "-quiet", "-format", "UDZO", "-volname", "PhotoCraft", "-srcfolder"])
+                    .arg(&src)
+                    .arg(&dmg)
+                    .output()
+                    .unwrap();
+                if output.status.success() {
+                    return dmg;
+                }
+                said = String::from_utf8_lossy(&output.stderr).trim().to_string();
+            }
+            panic!("hdiutil create failed after 5 tries: {said}");
+        }
+
+        #[test]
+        fn custom_bundles_are_detected_and_updates_stay_in_their_actual_location() {
+            let dir = tempfile::tempdir().unwrap();
+            let apps = dir.path().join("Craft Apps");
+            std::fs::create_dir(&apps).unwrap();
+            let paths = Paths::under(dir.path());
+            let image = dmg(dir.path(), "0.6.0");
+            let expect = Expect { team: None, version: None };
+            let placed = install_dmg(photocraft(), &image, None, Some(&apps), false, &paths, &expect).unwrap();
+            assert_eq!(placed, apps.join("PhotoCraft.app"));
+            let mut manifest = crate::manifest::Manifest::default();
+            manifest.apps.insert("photocraft".into(), record("0.6.0", PackageKind::Dmg, placed.clone(), vec![], false));
+            let existing = crate::detect::detect(photocraft(), &manifest, &crate::detect::Snapshot::default()).unwrap();
+            assert_eq!(existing.source, InstallSource::MacApp);
+            assert_eq!(existing.location, placed.display().to_string());
+            assert_eq!(existing.version.unwrap().to_string(), "0.6.0");
+            let existing = crate::detect::detect(photocraft(), &manifest, &crate::detect::Snapshot::default()).unwrap();
+            let new_default = dir.path().join("Other Apps");
+            std::fs::create_dir(&new_default).unwrap();
+            let update = dmg(dir.path(), "0.7.0");
+            assert_eq!(install_dmg(photocraft(), &update, Some(&existing), Some(&new_default), false, &paths, &expect).unwrap(), placed);
+            assert!(!new_default.join("PhotoCraft.app").exists());
+            let detected = crate::detect::detect(photocraft(), &manifest, &crate::detect::Snapshot::default()).unwrap();
+            assert_eq!(detected.version.unwrap().to_string(), "0.7.0");
+            std::fs::write(placed.join("Contents/Info.plist"), "invalid").unwrap();
+            assert_ne!(
+                crate::detect::detect(photocraft(), &manifest, &crate::detect::Snapshot::default()).map(|i| i.source),
+                Some(InstallSource::Launcher)
+            );
+        }
+
+        #[test]
+        fn an_unrelated_bundle_at_the_selected_destination_is_preserved() {
+            let dir = tempfile::tempdir().unwrap();
+            let placed = bundle(dir.path(), "0.5.0");
+            let plist = placed.join("Contents/Info.plist");
+            let unrelated = std::fs::read_to_string(&plist).unwrap().replace("ai.storyteller.photocraft", "com.example.other");
+            std::fs::write(&plist, &unrelated).unwrap();
+            let image = dmg(dir.path(), "0.6.0");
+            let result =
+                install_dmg(photocraft(), &image, None, Some(dir.path()), false, &Paths::under(dir.path()), &Expect { team: None, version: None });
+            assert!(result.unwrap_err().contains("already exists"));
+            assert_eq!(std::fs::read_to_string(plist).unwrap(), unrelated);
+            assert_eq!(std::fs::read(placed.join("Contents/MacOS/PhotoCraft")).unwrap(), b"0.5.0");
+        }
+
+        #[test]
+        fn only_the_teams_signature_passes() {
+            let dir = tempfile::tempdir().unwrap();
+            let app = bundle(dir.path(), "0.6.0");
+            assert!(!signed_by(&app, TEAM_ID), "an unsigned bundle passed");
+
+            // A valid signature, but not from the team.
+            let ok = std::process::Command::new("codesign").args(["--force", "--sign", "-"]).arg(&app).status().unwrap().success();
+            assert!(ok, "codesign failed");
+            assert!(!signed_by(&app, TEAM_ID), "an ad-hoc signature passed");
+
+            // A team id can't smuggle anything into the requirement.
+            assert!(!signed_by(&app, "X\" or anchor apple generic or \"Y"));
+            assert!(!signed_by(&app, ""));
+        }
+
+        #[test]
+        fn the_bundle_must_be_the_releases_version() {
+            let dir = tempfile::tempdir().unwrap();
+            let apps = dir.path().join("Applications");
+            let current = bundle(&apps, "0.5.0");
+            let existing = Installed { version: None, source: InstallSource::MacApp, location: current.display().to_string(), package: None };
+            let paths = Paths::under(dir.path());
+            let image = dmg(dir.path(), "0.6.0");
+
+            for (release, ok) in [("0.6.0", true), ("0.7.0", false), ("0.6.0-rc.1", true), ("0.5.0", false)] {
+                std::fs::write(current.join("Contents/MacOS/PhotoCraft"), "0.5.0").unwrap();
+                let want = version::parse(release).unwrap();
+                let expect = Expect { team: None, version: Some(&want) };
+                let result = install_dmg(photocraft(), &image, Some(&existing), None, false, &paths, &expect);
+                assert_eq!(result.is_ok(), ok, "release {release}: {result:?}");
+                let now = std::fs::read_to_string(current.join("Contents/MacOS/PhotoCraft")).unwrap();
+                assert_eq!(now, if ok { "0.6.0" } else { "0.5.0" }, "release {release}");
+                if !ok {
+                    assert_eq!(result, Err(format!("the app inside isn't version {release}, so it wasn't installed")));
+                }
+                assert_eq!(
+                    std::fs::read_dir(&apps).unwrap().map(|e| e.unwrap().file_name()).collect::<Vec<_>>(),
+                    [std::ffi::OsString::from("PhotoCraft.app")]
+                );
+            }
+
+            // A bundle that names a pre-release must name the release's.
+            let rc = dmg(dir.path(), "0.8.0-rc.2");
+            let want = version::parse("0.8.0-rc.1").unwrap();
+            let expect = Expect { team: None, version: Some(&want) };
+            assert!(install_dmg(photocraft(), &rc, Some(&existing), None, false, &paths, &expect).is_err());
+        }
+
+        #[test]
+        fn an_unsigned_update_leaves_the_installed_copy_alone() {
+            let dir = tempfile::tempdir().unwrap();
+            let apps = dir.path().join("Applications");
+            let current = bundle(&apps, "0.5.0");
+            let existing = Installed { version: None, source: InstallSource::MacApp, location: current.display().to_string(), package: None };
+            let image = dmg(dir.path(), "0.6.0");
+            let release = Release { tag: "v0.6.0".into(), version: version::parse("0.6.0"), ..Release::default() };
+
+            let result = install_dmg(photocraft(), &image, Some(&existing), None, false, &Paths::under(dir.path()), &Expect::release(&release));
+            assert_eq!(result, Err("the app isn't signed by its developer, so it wasn't installed".into()));
+            assert_eq!(std::fs::read_to_string(current.join("Contents/MacOS/PhotoCraft")).unwrap(), "0.5.0");
+            assert_eq!(
+                std::fs::read_dir(&apps).unwrap().map(|e| e.unwrap().file_name()).collect::<Vec<_>>(),
+                [std::ffi::OsString::from("PhotoCraft.app")]
+            );
+        }
+
+        /// A real release passes. Run with `CRAFT_APP=/path/to/PhotoCraft.app cargo test -p
+        /// artcraft-launcher-native -- --ignored a_real_craft_app`.
+        #[test]
+        #[ignore = "needs a Craft App from a real release"]
+        fn a_real_craft_app_carries_the_teams_signature() {
+            let app = std::env::var("CRAFT_APP").expect("set CRAFT_APP to a Craft App bundle");
+            assert!(signed_by(Path::new(&app), TEAM_ID), "{app} isn't signed by {TEAM_ID}");
+        }
+    }
+}
diff --git a/crates/update/src/lib.rs b/crates/update/src/lib.rs
new file mode 100644
index 00000000..d0fec496
--- /dev/null
+++ b/crates/update/src/lib.rs
@@ -0,0 +1,75 @@
+//! Release checking, downloading, installing and self-updating for the Craft App Suite and ArtCraft Launcher.
+
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+pub mod app;
+pub mod desktop_entry;
+pub mod detect;
+pub mod distro;
+mod folders;
+pub mod http;
+pub mod install;
+pub mod manifest;
+pub mod packages;
+pub mod paths;
+pub mod platform;
+#[cfg(windows)]
+pub mod portable;
+pub mod process;
+pub mod protocol;
+pub mod proxy;
+pub mod queue;
+pub mod release;
+pub mod self_update;
+pub mod source;
+pub mod status;
+pub mod suite;
+pub mod time;
+pub mod version;
+
+#[cfg(feature = "egui")]
+pub mod dialog;
+#[cfg(feature = "egui")]
+pub mod updater;
+
+pub use app::App;
+pub use http::{Http, Stop};
+pub use paths::Paths;
+pub use platform::{Arch, Os, PackageKind, Platform, pick_asset};
+pub use protocol::{InstallLocations, JobPhase, LatestRelease, Source};
+pub use release::{Asset, Release, parse_github_release, parse_github_release_list};
+pub use status::{InstallSource, Installed};
+pub use suite::SUITE;
+pub use time::parse_rfc3339;
+pub use version::{Version, is_newer, parse as parse_version};
+
+#[cfg(feature = "egui")]
+pub use dialog::{StartupPrompt, StartupPromptResponse};
+
+/// Checks for an update against GitHub releases for the given app.
+pub fn check_for_update(app: &App, http: &Http, current_version: &str) -> Result<Option<Release>, String> {
+    let url = format!("https://api.github.com/repos/{}/releases?per_page=30", app.repo);
+    match http.get_api(&url, None)? {
+        crate::http::Fetched::Body { text, .. } => {
+            let latest = crate::release::parse_github_release_list(&text, app.repo, false)?;
+            if let Some(release) = latest
+                && let Some(rel_v) = &release.version
+                && let Some(cur_v) = crate::version::parse(current_version)
+                && crate::version::is_newer(rel_v, &cur_v)
+            {
+                return Ok(Some(release));
+            }
+            Ok(None)
+        }
+        crate::http::Fetched::RateLimited { .. } => Err("GitHub's request limit was reached".into()),
+        crate::http::Fetched::NotModified | crate::http::Fetched::NotFound => Ok(None),
+    }
+}
+
+/// Unix seconds now.
+pub fn now() -> i64 {
+    std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| i64::try_from(d.as_secs()).unwrap_or(i64::MAX))
+}
+
+#[cfg(test)]
+pub(crate) const TEST_AGENT: &str = "ArtCraft-Launcher-Test/0.0";
diff --git a/crates/update/src/manifest.rs b/crates/update/src/manifest.rs
new file mode 100644
index 00000000..bcf9b06c
--- /dev/null
+++ b/crates/update/src/manifest.rs
@@ -0,0 +1,61 @@
+//! The launcher's record of what it installed itself.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use crate::PackageKind;
+use serde::{Deserialize, Serialize};
+
+/// One app the launcher installed.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Record {
+    pub version: String,
+    pub kind: PackageKind,
+    /// The `.app`, the exe, the AppImage, or the folder of an unpacked tarball.
+    pub path: PathBuf,
+    /// Unix seconds.
+    pub installed_at: i64,
+    /// Every file installed, for tree installs (FreeBSD), so removal takes exactly those.
+    #[serde(default)]
+    pub files: Vec<PathBuf>,
+    /// The files are in a system prefix and removing them needs root.
+    #[serde(default)]
+    pub needs_root: bool,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Manifest {
+    pub apps: BTreeMap<String, Record>,
+}
+
+impl Manifest {
+    pub fn load(path: &Path) -> Self {
+        std::fs::read(path).ok().and_then(|b| serde_json::from_slice(&b).ok()).unwrap_or_default()
+    }
+
+    pub fn save(&self, path: &Path) -> Result<(), String> {
+        let bytes = serde_json::to_vec_pretty(self).map_err(|e| e.to_string())?;
+        crate::paths::write_atomic(path, &bytes)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn round_trips_and_survives_garbage() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("installed.json");
+        assert_eq!(Manifest::load(&path), Manifest::default());
+        let mut m = Manifest::default();
+        m.apps.insert(
+            "photocraft".into(),
+            Record { version: "0.5.0".into(), kind: PackageKind::AppImage, path: "/x/y".into(), installed_at: 1, files: vec![], needs_root: false },
+        );
+        m.save(&path).unwrap();
+        assert_eq!(Manifest::load(&path), m);
+        std::fs::write(&path, b"{not json").unwrap();
+        assert_eq!(Manifest::load(&path), Manifest::default());
+    }
+}
diff --git a/crates/update/src/packages.rs b/crates/update/src/packages.rs
new file mode 100644
index 00000000..1820c2f1
--- /dev/null
+++ b/crates/update/src/packages.rs
@@ -0,0 +1,161 @@
+//! Reading system package lists (dpkg, rpm, pacman, Flatpak) and matching them to Craft Apps.
+//!
+//! Pure functions over the tools' text output, so they're tested on every platform; only Linux
+//! runs the tools (`detect::linux`).
+
+use crate::{App, InstallSource, version};
+
+/// One installed package that belongs to a Craft App.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Package {
+    pub manager: InstallSource,
+    /// The package's name (`photocraft-bin`) or Flatpak app id.
+    pub name: String,
+    /// As the package manager reports it (`0.5.0-1`); empty when it doesn't say.
+    pub version: String,
+}
+
+/// `dpkg-query -W -f '${Package}|${db:Status-Status}|${Version}\n'`: installed packages only.
+pub fn parse_dpkg(text: &str) -> Vec<(String, String)> {
+    text.lines()
+        .filter_map(|line| {
+            let mut f = line.split('|');
+            match (f.next(), f.next(), f.next()) {
+                (Some(name), Some("installed"), Some(ver)) => {
+                    let name = name.split_once(':').map(|(n, _)| n).unwrap_or(name);
+                    Some((name.to_string(), ver.to_string()))
+                }
+                _ => None,
+            }
+        })
+        .collect()
+}
+
+/// `rpm -qa --qf '%{NAME}|%{VERSION}\n'`.
+pub fn parse_rpm(text: &str) -> Vec<(String, String)> {
+    text.lines().filter_map(|line| line.split_once('|').map(|(n, v)| (n.to_string(), v.to_string()))).collect()
+}
+
+/// `pacman -Q`: `name version` per line.
+pub fn parse_pacman(text: &str) -> Vec<(String, String)> {
+    text.lines()
+        .filter_map(|line| {
+            let mut f = line.split_whitespace();
+            Some((f.next()?.to_string(), f.next()?.to_string()))
+        })
+        .collect()
+}
+
+/// `flatpak list --app --columns=application,version`: the version column is often empty for
+/// bundles built from a release tarball.
+pub fn parse_flatpak_list(text: &str) -> Vec<(String, String)> {
+    text.lines()
+        .filter_map(|line| {
+            let mut f = line.split('\t');
+            let id = f.next()?.trim();
+            (!id.is_empty()).then(|| (id.to_string(), f.next().unwrap_or("").trim().to_string()))
+        })
+        .collect()
+}
+
+/// The `Version:` line of `flatpak info <id>`.
+pub fn parse_flatpak_info(text: &str) -> Option<String> {
+    text.lines().find_map(|l| l.trim().strip_prefix("Version:").map(|v| v.trim().to_string())).filter(|v| !v.is_empty())
+}
+
+/// The package names a Craft App may be installed under with `manager`. On Arch the AUR carries
+/// each app three ways: built from source (`photocraft`), the release binary (`photocraft-bin`)
+/// and the latest commit (`photocraft-git`). Debian and RPM packages may use either the short stem
+/// (`photocraft`) or the reverse-DNS bundle id (`ai.storyteller.photocraft`).
+pub fn candidate_names(app: &App, manager: InstallSource) -> Vec<String> {
+    match manager {
+        InstallSource::Flatpak => vec![app.bundle_id()],
+        InstallSource::Pacman => {
+            app.stems().flat_map(|s| [s.to_string(), format!("{s}-bin"), format!("{s}-git")]).chain(std::iter::once(app.bundle_id())).collect()
+        }
+        InstallSource::Deb | InstallSource::Rpm => app.stems().map(str::to_string).chain(std::iter::once(app.bundle_id())).collect(),
+        _ => app.stems().map(str::to_string).collect(),
+    }
+}
+
+/// The package of `app` among `installed`, preferring the manager listed first in `order`.
+pub fn find<'a>(app: &App, installed: &'a [Package], order: &[InstallSource]) -> Option<&'a Package> {
+    order.iter().find_map(|manager| {
+        let names = candidate_names(app, *manager);
+        names.iter().find_map(|n| installed.iter().find(|p| p.manager == *manager && p.name == *n))
+    })
+}
+
+/// A package's version, read the package-manager way (`0.5.0-1` is 0.5.0).
+pub fn version_of(p: &Package) -> Option<version::Version> {
+    version::parse_package(&p.version)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn pkgs(manager: InstallSource, list: Vec<(String, String)>) -> Vec<Package> {
+        list.into_iter().map(|(name, version)| Package { manager, name, version }).collect()
+    }
+
+    #[test]
+    fn reads_each_package_managers_listing() {
+        assert_eq!(
+            parse_dpkg("photocraft|installed|0.5.0-1\nphotocraft:amd64|installed|0.6.0-1\nwordcraft|config-files|0.3.0-1\n"),
+            [("photocraft".into(), "0.5.0-1".into()), ("photocraft".into(), "0.6.0-1".into())]
+        );
+        assert_eq!(parse_rpm("gridcraft|0.3.0\n"), [("gridcraft".into(), "0.3.0".into())]);
+        assert_eq!(parse_pacman("photocraft-bin 0.5.0-1\nlinux 6.11.1.arch1-1\n").len(), 2);
+        assert_eq!(
+            parse_flatpak_list("ai.storyteller.wordcraft\t\nai.storyteller.cadcraft\t0.3.0\n"),
+            [("ai.storyteller.wordcraft".into(), String::new()), ("ai.storyteller.cadcraft".into(), "0.3.0".into())]
+        );
+        let info = "\nWordCraft - Word processor\n\n          ID: ai.storyteller.wordcraft\n     Version: 0.3.0\n      Branch: master\n";
+        assert_eq!(parse_flatpak_info(info).as_deref(), Some("0.3.0"));
+        assert_eq!(parse_flatpak_info("Version: \n"), None);
+    }
+
+    #[test]
+    fn candidate_names_cover_bundle_ids_for_deb_rpm_and_pacman() {
+        let photo = App::by_id("photocraft").unwrap();
+        let deb_names = candidate_names(photo, InstallSource::Deb);
+        assert!(deb_names.contains(&"photocraft".to_string()));
+        assert!(deb_names.contains(&"ai.storyteller.photocraft".to_string()));
+
+        let rpm_names = candidate_names(photo, InstallSource::Rpm);
+        assert!(rpm_names.contains(&"photocraft".to_string()));
+        assert!(rpm_names.contains(&"ai.storyteller.photocraft".to_string()));
+
+        let pacman_names = candidate_names(photo, InstallSource::Pacman);
+        assert!(pacman_names.contains(&"photocraft".to_string()));
+        assert!(pacman_names.contains(&"photocraft-bin".to_string()));
+        assert!(pacman_names.contains(&"ai.storyteller.photocraft".to_string()));
+    }
+
+    #[test]
+    fn finds_aur_packages_in_every_flavour() {
+        let photo = App::by_id("photocraft").unwrap();
+        let pdf = App::by_id("pdfcraft").unwrap();
+        let installed =
+            pkgs(InstallSource::Pacman, parse_pacman("linux 6.11.1.arch1-1\nphotocraft-git 0.3.0.r47.g47f9306-1\nprintcraft-bin 0.2.1-1\n"));
+        let hit = find(photo, &installed, &[InstallSource::Pacman]).unwrap();
+        assert_eq!(hit.name, "photocraft-git");
+        assert_eq!(version_of(hit).unwrap().to_string(), "0.3.0");
+        // PdfCraft under its old name.
+        assert_eq!(find(pdf, &installed, &[InstallSource::Pacman]).unwrap().name, "printcraft-bin");
+        assert!(find(App::by_id("wordcraft").unwrap(), &installed, &[InstallSource::Pacman]).is_none());
+    }
+
+    #[test]
+    fn prefers_managers_in_order_and_reads_revisions() {
+        let photo = App::by_id("photocraft").unwrap();
+        let mut installed = pkgs(InstallSource::Deb, parse_dpkg("photocraft|installed|0.5.0-1\n"));
+        installed.extend(pkgs(InstallSource::Flatpak, parse_flatpak_list("ai.storyteller.photocraft\t0.4.0\n")));
+        let hit = find(photo, &installed, &[InstallSource::Deb, InstallSource::Flatpak]).unwrap();
+        assert_eq!(hit.manager, InstallSource::Deb);
+        // 0.5.0-1 is the 0.5.0 release, not a pre-release of it.
+        assert_eq!(version_of(hit).unwrap().to_string(), "0.5.0");
+        assert_eq!(find(photo, &installed, &[InstallSource::Flatpak]).unwrap().version, "0.4.0");
+    }
+}
diff --git a/crates/update/src/paths.rs b/crates/update/src/paths.rs
new file mode 100644
index 00000000..7dab89e1
--- /dev/null
+++ b/crates/update/src/paths.rs
@@ -0,0 +1,131 @@
+//! Where an installer keeps its own files: downloads, records, logs.
+
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+use crate::app::App;
+
+/// An installer's folders.
+#[derive(Clone, Debug)]
+pub struct Paths {
+    /// Records of what was installed, and tarball installs.
+    pub data: PathBuf,
+    /// Saved release answers and in-progress downloads.
+    pub cache: PathBuf,
+}
+
+impl Paths {
+    /// Discovers paths for an app, respecting portable mode if `portable.txt` is next to current exe.
+    pub fn for_app(app: &App) -> Result<Self, String> {
+        if let Ok(exe) = std::env::current_exe() {
+            return Self::for_exe(app, &exe);
+        }
+        let dir = if cfg!(any(target_os = "macos", target_os = "windows")) { app.name } else { app.id };
+        Self::per_user(dir)
+    }
+
+    /// Discovers paths for an app from a specific executable path.
+    pub fn for_exe(app: &App, exe: &Path) -> Result<Self, String> {
+        if let Some(parent) = exe.parent()
+            && parent.join("portable.txt").is_file()
+        {
+            let data_dir_name = format!("{}Data", app.name.replace(' ', ""));
+            return Ok(Self::under(&parent.join(data_dir_name)));
+        }
+        let dir = if cfg!(any(target_os = "macos", target_os = "windows")) { app.name } else { app.id };
+        Self::per_user(dir)
+    }
+
+    /// The per-user folders named `dir` (`ArtCraft Launcher` on macOS and Windows,
+    /// `artcraft-launcher` elsewhere, by convention).
+    pub fn per_user(dir: &str) -> Result<Self, String> {
+        let data = crate::folders::data_local_dir().ok_or("no per-user data folder on this system")?.join(dir);
+        let cache = crate::folders::cache_dir().ok_or("no per-user cache folder on this system")?.join(dir);
+        Ok(Self { data, cache })
+    }
+
+    /// Everything under one folder (portable mode, tests).
+    pub fn under(root: &std::path::Path) -> Self {
+        Self { data: root.join("data"), cache: root.join("cache") }
+    }
+
+    pub fn downloads(&self) -> PathBuf {
+        self.cache.join("downloads")
+    }
+
+    /// Log files, and the error of a failed self-update waiting for the next start.
+    pub fn logs(&self) -> PathBuf {
+        self.data.join("logs")
+    }
+
+    /// Where tarball installs (FreeBSD, Linux without AppImage) are unpacked: `<data>/apps/<app>`.
+    pub fn apps(&self) -> PathBuf {
+        self.data.join("apps")
+    }
+
+    /// The folder an app unpacked in [`Self::apps`] sees as its home: `<data>/apps/<app>/home`.
+    /// A Craft App keeps its settings in the XDG folders (`~/.config`, `~/.local/share`,
+    /// `~/.cache`), so pointing `HOME` and those variables here keeps every app's configuration
+    /// beside it, inside the folder the installer owns.
+    #[cfg(target_os = "linux")]
+    pub fn app_home(&self, id: &str) -> PathBuf {
+        self.apps().join(id).join("home")
+    }
+}
+
+/// Writes `bytes` to `path` via a temporary file and a rename, so a crash never leaves half a file.
+pub fn write_atomic(path: &std::path::Path, bytes: &[u8]) -> Result<(), String> {
+    let dir = path.parent().ok_or("no parent folder")?;
+    std::fs::create_dir_all(dir).map_err(|e| format!("couldn't create {} ({e})", dir.display()))?;
+    let mut tmp = tempfile::NamedTempFile::new_in(dir).map_err(|e| format!("couldn't create a temporary file in {} ({e})", dir.display()))?;
+    tmp.write_all(bytes).map_err(|e| format!("couldn't write {} ({e})", tmp.path().display()))?;
+    tmp.as_file().sync_all().map_err(|e| format!("couldn't sync {} ({e})", tmp.path().display()))?;
+    tmp.persist(path).map_err(|e| format!("couldn't replace {} ({e})", path.display()))?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn atomic_write_does_not_overwrite_an_unrelated_temporary_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("installed.json");
+        let unrelated = path.with_extension("tmp");
+        std::fs::write(&unrelated, b"another writer's data").unwrap();
+        write_atomic(&path, b"new manifest").unwrap();
+        assert_eq!(std::fs::read(&unrelated).unwrap(), b"another writer's data");
+        assert_eq!(std::fs::read(&path).unwrap(), b"new manifest");
+    }
+
+    #[test]
+    fn atomic_write_replaces_a_complete_file_and_cleans_up_on_failure() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("installed.json");
+        std::fs::write(&path, b"old manifest").unwrap();
+        write_atomic(&path, b"new manifest").unwrap();
+        assert_eq!(std::fs::read(&path).unwrap(), b"new manifest");
+        assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 1);
+
+        let blocked = dir.path().join("directory.json");
+        std::fs::create_dir(&blocked).unwrap();
+        std::fs::write(blocked.join("keep.txt"), b"keep").unwrap();
+        assert!(write_atomic(&blocked, b"replacement").is_err());
+        assert_eq!(std::fs::read(blocked.join("keep.txt")).unwrap(), b"keep");
+        assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 2);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn atomic_write_does_not_follow_a_temporary_file_symlink() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("installed.json");
+        let victim = dir.path().join("unrelated.txt");
+        std::fs::write(&victim, b"keep this file").unwrap();
+        std::os::unix::fs::symlink(&victim, path.with_extension("tmp")).unwrap();
+        write_atomic(&path, b"new manifest").unwrap();
+        assert_eq!(std::fs::read(&victim).unwrap(), b"keep this file");
+        assert_eq!(std::fs::read(&path).unwrap(), b"new manifest");
+    }
+}
diff --git a/crates/update/src/platform.rs b/crates/update/src/platform.rs
new file mode 100644
index 00000000..a16a852d
--- /dev/null
+++ b/crates/update/src/platform.rs
@@ -0,0 +1,423 @@
+//! Platforms, package formats, and choosing the right release asset.
+//!
+//! Every Craft App release names its files `<app>-<version>-<os>-<arch>[-portable].<ext>`, for
+//! example `photocraft-0.5.0-windows-x64.msi` or `photocraft-0.5.0-linux-aarch64.AppImage`.
+//!
+//! Labels are English. The UI translates [`PackageKind::label`]; OS and architecture names are
+//! shown as they are.
+
+use serde::{Deserialize, Serialize};
+
+use crate::release::{Asset, Release};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum Os {
+    Windows,
+    MacOs,
+    Linux,
+    FreeBsd,
+}
+
+impl Os {
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Windows => "Windows",
+            Self::MacOs => "macOS",
+            Self::Linux => "Linux",
+            Self::FreeBsd => "FreeBSD",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum Arch {
+    X64,
+    X86,
+    Arm64,
+    Riscv64,
+}
+
+impl Arch {
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::X64 => "x64",
+            Self::X86 => "x86",
+            Self::Arm64 => "ARM64",
+            Self::Riscv64 => "RISC-V",
+        }
+    }
+}
+
+/// A package format a release ships.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum PackageKind {
+    /// Windows Installer package (installs for all users into Program Files).
+    Msi,
+    /// Windows zip with the exe at the top level.
+    PortableZip,
+    /// macOS disk image with the `.app` bundle.
+    Dmg,
+    AppImage,
+    Deb,
+    Rpm,
+    /// Arch Linux package (`.pkg.tar.zst`).
+    ArchPkg,
+    Flatpak,
+    /// Linux or FreeBSD tarball (`bin/<app>`, `share/…`).
+    TarGz,
+}
+
+impl PackageKind {
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Msi => "Installer (.msi)",
+            Self::PortableZip => "Portable (.zip)",
+            Self::Dmg => "Disk image (.dmg)",
+            Self::AppImage => "AppImage",
+            Self::Deb => "Debian package (.deb)",
+            Self::Rpm => "RPM package (.rpm)",
+            Self::ArchPkg => "Arch package (.pkg.tar.zst)",
+            Self::Flatpak => "Flatpak bundle",
+            Self::TarGz => "Tarball (.tar.gz)",
+        }
+    }
+
+    fn suffix(self) -> &'static str {
+        match self {
+            Self::Msi => ".msi",
+            Self::PortableZip => "-portable.zip",
+            Self::Dmg => ".dmg",
+            Self::AppImage => ".AppImage",
+            Self::Deb => ".deb",
+            Self::Rpm => ".rpm",
+            Self::ArchPkg => ".pkg.tar.zst",
+            Self::Flatpak => ".flatpak",
+            Self::TarGz => ".tar.gz",
+        }
+    }
+}
+
+/// Where the launcher is running (or, on the web, the visitor's machine).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct Platform {
+    pub os: Os,
+    pub arch: Arch,
+}
+
+impl Platform {
+    /// The platform this binary was built for, or `None` for wasm and unsupported targets.
+    pub fn current() -> Option<Self> {
+        let os = if cfg!(target_os = "windows") {
+            Os::Windows
+        } else if cfg!(target_os = "macos") {
+            Os::MacOs
+        } else if cfg!(target_os = "linux") {
+            Os::Linux
+        } else if cfg!(target_os = "freebsd") {
+            Os::FreeBsd
+        } else {
+            return None;
+        };
+        let arch = if cfg!(target_arch = "x86_64") {
+            Arch::X64
+        } else if cfg!(target_arch = "x86") {
+            Arch::X86
+        } else if cfg!(target_arch = "aarch64") {
+            Arch::Arm64
+        } else if cfg!(target_arch = "riscv64") {
+            Arch::Riscv64
+        } else {
+            return None;
+        };
+        Some(Self { os, arch })
+    }
+
+    pub fn label(self) -> String {
+        match self.os {
+            Os::MacOs => "macOS".into(),
+            os => format!("{} {}", os.label(), self.arch.label()),
+        }
+    }
+
+    /// Asset platform tokens to try, best first. Windows on ARM and 64-bit Windows can fall back
+    /// to emulated builds; macOS prefers universal, then native builds. Apple silicon can fall
+    /// back to Intel builds, but Intel Macs cannot run ARM builds.
+    fn tokens(self) -> &'static [&'static str] {
+        match (self.os, self.arch) {
+            (Os::Windows, Arch::X64) => &["windows-x64", "windows-x86"],
+            (Os::Windows, Arch::X86) => &["windows-x86"],
+            (Os::Windows, Arch::Arm64) => &["windows-arm64", "windows-x64", "windows-x86"],
+            (Os::Windows, _) => &[],
+            (Os::MacOs, Arch::X64) => &["macos-universal", "macos-x86_64"],
+            (Os::MacOs, Arch::Arm64) => &["macos-universal", "macos-aarch64", "macos-arm64", "macos-x86_64"],
+            (Os::MacOs, _) => &[],
+            (Os::Linux, Arch::X64) => &["linux-x86_64"],
+            (Os::Linux, Arch::Arm64) => &["linux-aarch64"],
+            (Os::Linux, Arch::Riscv64) => &["linux-riscv64"],
+            (Os::Linux, Arch::X86) => &[],
+            (Os::FreeBsd, Arch::X64) => &["freebsd-x86_64"],
+            (Os::FreeBsd, Arch::Arm64) => &["freebsd-aarch64"],
+            (Os::FreeBsd, _) => &[],
+        }
+    }
+
+    /// Package formats the launcher installs on this OS, in order of preference.
+    pub fn default_kinds(self) -> &'static [PackageKind] {
+        match self.os {
+            Os::Windows => &[PackageKind::Msi, PackageKind::PortableZip],
+            Os::MacOs => &[PackageKind::Dmg],
+            Os::Linux => &[PackageKind::AppImage, PackageKind::TarGz],
+            Os::FreeBsd => &[PackageKind::TarGz],
+        }
+    }
+
+    /// Every format offered as a manual download on this OS (the web build's download menu).
+    pub fn download_kinds(self) -> &'static [PackageKind] {
+        match self.os {
+            Os::Windows => &[PackageKind::Msi, PackageKind::PortableZip],
+            Os::MacOs => &[PackageKind::Dmg],
+            Os::Linux => &[PackageKind::AppImage, PackageKind::Deb, PackageKind::Rpm, PackageKind::ArchPkg, PackageKind::Flatpak, PackageKind::TarGz],
+            Os::FreeBsd => &[PackageKind::TarGz],
+        }
+    }
+}
+
+/// What an asset name says about itself.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AssetName {
+    pub stem: String,
+    pub version: String,
+    pub token: String,
+    pub kind: PackageKind,
+}
+
+/// Reads `<stem>-<version>-<os>-<arch>[-portable].<ext>`; `None` for checksums, zsync files, CLI
+/// and web bundles, or anything else.
+pub fn parse_asset_name(name: &str, stems: &[&str]) -> Option<AssetName> {
+    const KINDS: [PackageKind; 9] = [
+        PackageKind::PortableZip,
+        PackageKind::TarGz,
+        PackageKind::Msi,
+        PackageKind::Dmg,
+        PackageKind::AppImage,
+        PackageKind::Deb,
+        PackageKind::Rpm,
+        PackageKind::ArchPkg,
+        PackageKind::Flatpak,
+    ];
+    let (kind, base) = KINDS.iter().find_map(|k| name.strip_suffix(k.suffix()).map(|b| (*k, b)))?;
+    for stem in stems {
+        let Some(rest) = base.strip_prefix(stem).and_then(|r| r.strip_prefix('-')) else { continue };
+        // rest = <version>-<os>-<arch>; os and arch never contain '-', versions may.
+        let mut parts = rest.rsplitn(3, '-');
+        let (arch, os, version) = (parts.next()?, parts.next()?, parts.next()?);
+        if crate::version::parse(version).is_none() || !version.starts_with(|c: char| c.is_ascii_digit()) {
+            continue;
+        }
+        return Some(AssetName { stem: (*stem).to_string(), version: version.to_string(), token: format!("{os}-{arch}"), kind });
+    }
+    None
+}
+
+/// The best asset of `release` for `platform`, trying `kinds` in order and, within a kind, the
+/// platform's tokens in order (native before emulated).
+pub fn pick_asset<'a>(release: &'a Release, stems: &[&str], platform: Platform, kinds: &[PackageKind]) -> Option<(&'a Asset, PackageKind)> {
+    let parsed: Vec<(&Asset, AssetName)> = release.assets.iter().filter_map(|a| parse_asset_name(&a.name, stems).map(|n| (a, n))).collect();
+    for kind in kinds {
+        for token in platform.tokens() {
+            if let Some((asset, _)) = parsed.iter().find(|(_, n)| n.kind == *kind && n.token == *token) {
+                return Some((asset, *kind));
+            }
+        }
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn release(names: &[&str]) -> Release {
+        Release {
+            assets: names.iter().map(|n| Asset { name: (*n).into(), size: 1, url: format!("https://x/{n}"), sha256: None }).collect(),
+            ..Release::default()
+        }
+    }
+
+    const PHOTO: &[&str] = &[
+        "photocraft-0.5.0-freebsd-x86_64.tar.gz",
+        "photocraft-0.5.0-linux-aarch64.AppImage",
+        "photocraft-0.5.0-linux-aarch64.AppImage.zsync",
+        "photocraft-0.5.0-linux-aarch64.deb",
+        "photocraft-0.5.0-linux-riscv64.tar.gz",
+        "photocraft-0.5.0-linux-x86_64.AppImage",
+        "photocraft-0.5.0-linux-x86_64.tar.gz",
+        "photocraft-0.5.0-macos-universal.dmg",
+        "photocraft-0.5.0-windows-x64-portable.zip",
+        "photocraft-0.5.0-windows-x64.msi",
+        "photocraft-0.5.0-windows-x86.msi",
+        "photocraft-cli-0.5.0-macos-universal.zip",
+        "photocraft-web-0.5.0.zip",
+        "SHA256SUMS.txt",
+    ];
+
+    #[test]
+    fn macos_prefers_the_published_universal_build() {
+        // PhotoCraft v0.9.0's GitHub metadata, trimmed to its desktop DMG.
+        let mut r = crate::release::parse_github_release(include_str!("../tests/fixtures/photocraft-release.json"), "storytold/photocraft").unwrap();
+        // Split builds must not outrank the published universal DMG, even when listed first.
+        r.assets.splice(0..0, release(&["photocraft-0.9.0-macos-arm64.dmg", "photocraft-0.9.0-macos-x86_64.dmg"]).assets);
+        for arch in [Arch::X64, Arch::Arm64] {
+            let (asset, kind) = pick_asset(&r, &["photocraft"], Platform { os: Os::MacOs, arch }, &[PackageKind::Dmg]).unwrap();
+            assert_eq!(asset.name, "photocraft-0.9.0-macos-universal.dmg");
+            assert_eq!(kind, PackageKind::Dmg);
+        }
+    }
+
+    #[test]
+    fn freebsd_picks_the_tarball_for_the_processor() {
+        // SoundCraft v0.10.0's GitHub metadata, trimmed to its FreeBSD tarballs.
+        let r = crate::release::parse_github_release(include_str!("../tests/fixtures/soundcraft-release.json"), "storytold/soundcraft").unwrap();
+        let pick = |arch| {
+            let platform = Platform { os: Os::FreeBsd, arch };
+            pick_asset(&r, &["soundcraft"], platform, platform.default_kinds()).map(|(a, k)| (a.name.as_str(), k))
+        };
+        assert_eq!(pick(Arch::X64), Some(("soundcraft-0.10.0-freebsd-x86_64.tar.gz", PackageKind::TarGz)));
+        assert_eq!(pick(Arch::Arm64), Some(("soundcraft-0.10.0-freebsd-aarch64.tar.gz", PackageKind::TarGz)));
+        for arch in [Arch::X86, Arch::Riscv64] {
+            assert_eq!(pick(arch), None);
+        }
+        // An x86_64 machine never takes the ARM tarball, nor an ARM machine the x86_64 one.
+        let only_arm = release(&["soundcraft-0.10.0-freebsd-aarch64.tar.gz"]);
+        assert_eq!(pick_asset(&only_arm, &["soundcraft"], Platform { os: Os::FreeBsd, arch: Arch::X64 }, &[PackageKind::TarGz]), None);
+        let only_x64 = release(&["soundcraft-0.10.0-freebsd-x86_64.tar.gz"]);
+        assert_eq!(pick_asset(&only_x64, &["soundcraft"], Platform { os: Os::FreeBsd, arch: Arch::Arm64 }, &[PackageKind::TarGz]), None);
+    }
+
+    #[test]
+    fn macos_split_builds_match_the_processor() {
+        let r = release(&["photocraft-0.5.0-macos-arm64.dmg", "photocraft-0.5.0-macos-x86_64.dmg"]);
+        let pick = |arch| pick_asset(&r, &["photocraft"], Platform { os: Os::MacOs, arch }, &[PackageKind::Dmg]).map(|(a, _)| a.name.as_str());
+        assert_eq!(pick(Arch::X64), Some("photocraft-0.5.0-macos-x86_64.dmg"));
+        assert_eq!(pick(Arch::Arm64), Some("photocraft-0.5.0-macos-arm64.dmg"));
+    }
+
+    #[test]
+    fn intel_macos_never_selects_an_arm_only_build() {
+        for token in ["macos-aarch64", "macos-arm64"] {
+            let name = format!("photocraft-0.5.0-{token}.dmg");
+            let r = release(&[&name]);
+            assert_eq!(pick_asset(&r, &["photocraft"], Platform { os: Os::MacOs, arch: Arch::X64 }, &[PackageKind::Dmg]), None);
+            assert_eq!(
+                pick_asset(&r, &["photocraft"], Platform { os: Os::MacOs, arch: Arch::Arm64 }, &[PackageKind::Dmg]).map(|(a, _)| a.name.as_str()),
+                Some(name.as_str())
+            );
+        }
+    }
+
+    #[test]
+    fn apple_silicon_keeps_the_intel_fallback() {
+        let r = release(&["photocraft-0.5.0-macos-x86_64.dmg"]);
+        assert_eq!(
+            pick_asset(&r, &["photocraft"], Platform { os: Os::MacOs, arch: Arch::Arm64 }, &[PackageKind::Dmg]).map(|(a, _)| a.name.as_str()),
+            Some("photocraft-0.5.0-macos-x86_64.dmg")
+        );
+        for arch in [Arch::X86, Arch::Riscv64] {
+            assert_eq!(pick_asset(&r, &["photocraft"], Platform { os: Os::MacOs, arch }, &[PackageKind::Dmg]), None);
+        }
+    }
+
+    #[test]
+    fn reads_asset_names() {
+        let n = parse_asset_name("photocraft-0.2.0-rc.1-windows-arm64-portable.zip", &["photocraft"]).unwrap();
+        assert_eq!((n.version.as_str(), n.token.as_str(), n.kind), ("0.2.0-rc.1", "windows-arm64", PackageKind::PortableZip));
+        let n = parse_asset_name("printcraft-0.2.1-linux-x86_64.tar.gz", &["pdfcraft", "printcraft"]).unwrap();
+        assert_eq!((n.stem.as_str(), n.kind), ("printcraft", PackageKind::TarGz));
+        for other in
+            ["photocraft-cli-0.5.0-macos-universal.zip", "photocraft-web-0.5.0.zip", "SHA256SUMS.txt", "photocraft-0.5.0-linux-x86_64.AppImage.zsync"]
+        {
+            assert_eq!(parse_asset_name(other, &["photocraft"]), None, "{other}");
+        }
+        // FigCraft also ships its collaboration server; that tarball is not the app.
+        assert_eq!(parse_asset_name("figcraft-server-0.5.1-linux-x86_64.tar.gz", &["figcraft"]), None);
+        assert!(parse_asset_name("figcraft-0.5.1-linux-x86_64.tar.gz", &["figcraft"]).is_some());
+    }
+
+    #[test]
+    fn picks_the_native_build_first_and_falls_back_to_emulation() {
+        let r = release(PHOTO);
+        let pick = |os, arch, kinds: &[PackageKind]| pick_asset(&r, &["photocraft"], Platform { os, arch }, kinds).map(|(a, _)| a.name.clone());
+        assert_eq!(pick(Os::MacOs, Arch::Arm64, &[PackageKind::Dmg]).as_deref(), Some("photocraft-0.5.0-macos-universal.dmg"));
+        assert_eq!(pick(Os::Windows, Arch::X64, &[PackageKind::Msi]).as_deref(), Some("photocraft-0.5.0-windows-x64.msi"));
+        // No arm64 MSI in this release: Windows on ARM runs the x64 build.
+        assert_eq!(pick(Os::Windows, Arch::Arm64, &[PackageKind::Msi]).as_deref(), Some("photocraft-0.5.0-windows-x64.msi"));
+        assert_eq!(pick(Os::Linux, Arch::Arm64, &[PackageKind::AppImage]).as_deref(), Some("photocraft-0.5.0-linux-aarch64.AppImage"));
+        assert_eq!(pick(Os::Linux, Arch::Arm64, &[PackageKind::TarGz]), None);
+        assert_eq!(pick(Os::Linux, Arch::Riscv64, &[PackageKind::TarGz]).as_deref(), Some("photocraft-0.5.0-linux-riscv64.tar.gz"));
+        assert_eq!(pick(Os::FreeBsd, Arch::X64, &[PackageKind::TarGz]).as_deref(), Some("photocraft-0.5.0-freebsd-x86_64.tar.gz"));
+        // Preference order across kinds.
+        assert_eq!(
+            pick(Os::Windows, Arch::X64, &[PackageKind::PortableZip, PackageKind::Msi]).as_deref(),
+            Some("photocraft-0.5.0-windows-x64-portable.zip")
+        );
+        assert_eq!(pick(Os::Windows, Arch::X86, &[PackageKind::PortableZip, PackageKind::Msi]).as_deref(), Some("photocraft-0.5.0-windows-x86.msi"));
+
+        let p_riscv = Platform { os: Os::Linux, arch: Arch::Riscv64 };
+        assert_eq!(
+            pick_asset(&r, &["photocraft"], p_riscv, p_riscv.default_kinds()).map(|(a, _)| a.name.clone()).as_deref(),
+            Some("photocraft-0.5.0-linux-riscv64.tar.gz")
+        );
+        assert_eq!(
+            pick_asset(&r, &["photocraft"], p_riscv, p_riscv.download_kinds()).map(|(a, _)| a.name.clone()).as_deref(),
+            Some("photocraft-0.5.0-linux-riscv64.tar.gz")
+        );
+        let r_riscv_deb =
+            release(&["photocraft-0.5.0-linux-riscv64.tar.gz", "photocraft-0.5.0-linux-riscv64.deb", "photocraft-0.5.0-linux-riscv64.rpm"]);
+        assert_eq!(
+            pick_asset(&r_riscv_deb, &["photocraft"], p_riscv, p_riscv.download_kinds()).map(|(a, _)| a.name.clone()).as_deref(),
+            Some("photocraft-0.5.0-linux-riscv64.deb")
+        );
+    }
+
+    #[test]
+    fn strictly_matches_architecture_for_all_linux_package_formats() {
+        let multi_arch_release = release(&[
+            "photocraft-0.5.0-linux-aarch64.AppImage",
+            "photocraft-0.5.0-linux-x86_64.AppImage",
+            "photocraft-0.5.0-linux-aarch64.deb",
+            "photocraft-0.5.0-linux-x86_64.deb",
+            "photocraft-0.5.0-linux-aarch64.rpm",
+            "photocraft-0.5.0-linux-x86_64.rpm",
+            "photocraft-0.5.0-linux-aarch64.pkg.tar.zst",
+            "photocraft-0.5.0-linux-x86_64.pkg.tar.zst",
+            "photocraft-0.5.0-linux-aarch64.flatpak",
+            "photocraft-0.5.0-linux-x86_64.flatpak",
+            "photocraft-0.5.0-linux-aarch64.tar.gz",
+            "photocraft-0.5.0-linux-x86_64.tar.gz",
+        ]);
+
+        let p_x64 = Platform { os: Os::Linux, arch: Arch::X64 };
+        let p_arm64 = Platform { os: Os::Linux, arch: Arch::Arm64 };
+
+        for kind in [PackageKind::AppImage, PackageKind::Deb, PackageKind::Rpm, PackageKind::ArchPkg, PackageKind::Flatpak, PackageKind::TarGz] {
+            let pick_x64 = pick_asset(&multi_arch_release, &["photocraft"], p_x64, &[kind]).map(|(a, _)| a.name.clone());
+            assert!(pick_x64.as_deref().unwrap().contains("linux-x86_64"), "Expected x86_64 asset for {kind:?}, got {pick_x64:?}");
+
+            let pick_arm64 = pick_asset(&multi_arch_release, &["photocraft"], p_arm64, &[kind]).map(|(a, _)| a.name.clone());
+            assert!(pick_arm64.as_deref().unwrap().contains("linux-aarch64"), "Expected aarch64 asset for {kind:?}, got {pick_arm64:?}");
+        }
+
+        // On x86_64 Linux, an aarch64-only asset must NEVER match or fall back
+        let arm_only_release = release(&[
+            "photocraft-0.5.0-linux-aarch64.AppImage",
+            "photocraft-0.5.0-linux-aarch64.deb",
+            "photocraft-0.5.0-linux-aarch64.rpm",
+            "photocraft-0.5.0-linux-aarch64.pkg.tar.zst",
+            "photocraft-0.5.0-linux-aarch64.flatpak",
+            "photocraft-0.5.0-linux-aarch64.tar.gz",
+        ]);
+        for kind in [PackageKind::AppImage, PackageKind::Deb, PackageKind::Rpm, PackageKind::ArchPkg, PackageKind::Flatpak, PackageKind::TarGz] {
+            assert_eq!(pick_asset(&arm_only_release, &["photocraft"], p_x64, &[kind]), None, "x86_64 must never match an aarch64 asset for {kind:?}");
+        }
+    }
+}
diff --git a/crates/update/src/portable.rs b/crates/update/src/portable.rs
new file mode 100644
index 00000000..027411df
--- /dev/null
+++ b/crates/update/src/portable.rs
@@ -0,0 +1,868 @@
+//! Portable Windows packages: bounded extraction and replacement of recorded files only.
+
+use std::ffi::OsStr;
+use std::path::{Component, Path, PathBuf};
+
+use crate::manifest::Record;
+use crate::paths::Paths;
+use crate::{App, PackageKind};
+
+const MAX_FILES: usize = 10_000;
+const MAX_BYTES: u64 = 4 * 1024 * 1024 * 1024;
+
+/// Custom destinations may have OS-managed links in their host ancestors.
+pub fn validate_directory(path: &Path) -> Result<(), String> {
+    if !path.is_absolute() || path.components().any(|c| matches!(c, Component::ParentDir | Component::CurDir)) {
+        return Err("Choose an absolute installation folder without parent-directory components.".into());
+    }
+    // Resolve the closest existing ancestor: /home and /var can be OS-managed
+    // symlinks, and a custom destination need not exist yet.
+    for ancestor in path.ancestors() {
+        match std::fs::canonicalize(ancestor) {
+            Ok(resolved) => {
+                if !resolved.is_dir() {
+                    return Err("The installation folder contains a non-directory component.".into());
+                }
+                return Ok(());
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                // A dangling link is not a missing directory we can safely create.
+                if std::fs::symlink_metadata(ancestor).is_ok() {
+                    return Err("The installation folder contains a dangling link.".into());
+                }
+            }
+            Err(error) => return Err(error.to_string()),
+        }
+    }
+    Err("The installation folder has no existing ancestor.".into())
+}
+
+/// Links are allowed above the ownership boundary, never inside it (including root).
+fn validate_owned_directory(root: &Path, path: &Path) -> Result<(), String> {
+    validate_directory(path)?;
+    if !path.starts_with(root) {
+        return Err("An installation path points outside its folder.".into());
+    }
+    for ancestor in path.ancestors().take_while(|ancestor| ancestor.starts_with(root)) {
+        match std::fs::symlink_metadata(ancestor) {
+            Ok(meta) if linked(&meta) || !meta.is_dir() => {
+                return Err("The installation folder contains a link or a non-directory component.".into());
+            }
+            Err(error) if error.kind() != std::io::ErrorKind::NotFound => return Err(error.to_string()),
+            _ => {}
+        }
+    }
+    Ok(())
+}
+
+fn resolve_missing(path: &Path) -> Result<PathBuf, String> {
+    for ancestor in path.ancestors() {
+        match std::fs::canonicalize(ancestor) {
+            Ok(resolved) => {
+                let suffix = path.strip_prefix(ancestor).map_err(|e| e.to_string())?;
+                return Ok(resolved.join(suffix));
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                if std::fs::symlink_metadata(ancestor).is_ok() {
+                    return Err("The installation folder contains a dangling link.".into());
+                }
+            }
+            Err(error) => return Err(error.to_string()),
+        }
+    }
+    Err("The installation folder has no existing ancestor.".into())
+}
+
+/// Whether two paths name the same Windows folder or file: case, trailing separators and the
+/// verbatim `\\?\` form that `canonicalize` returns don't count.
+fn same_windows_path(left: &Path, right: &Path) -> bool {
+    /// `canonicalize` writes `\\?\C:\…` and, for a network share, `\\?\UNC\server\share\…`;
+    /// Windows reads either prefix in any case.
+    fn normalized(path: &Path) -> String {
+        let text = path.to_string_lossy().to_lowercase();
+        let text = match text.strip_prefix(r"\\?\unc\") {
+            Some(share) => format!(r"\\{share}"),
+            None => text.strip_prefix(r"\\?\").unwrap_or(&text).to_string(),
+        };
+        text.trim_end_matches(['\\', '/']).to_string()
+    }
+    normalized(left) == normalized(right)
+}
+
+fn linked(meta: &std::fs::Metadata) -> bool {
+    #[cfg(windows)]
+    {
+        use std::os::windows::fs::MetadataExt;
+        meta.file_attributes() & 0x400 != 0
+    }
+    #[cfg(not(windows))]
+    {
+        meta.file_type().is_symlink()
+    }
+}
+
+struct Staging(PathBuf);
+impl Staging {
+    /// Stop cleaning up and hand the directory back: used when a rollback failed and the backup
+    /// is the only copy left for manual recovery.
+    fn keep(self) -> PathBuf {
+        let path = self.0.clone();
+        // Deliberately skipping Drop here is the whole point — it would delete the recovery
+        // files. The directory is handed to the operator, not leaked into nothing.
+        std::mem::forget(self); // NOSONAR
+        path
+    }
+}
+impl Drop for Staging {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn extract(file: &Path, destination: &Path) -> Result<(Vec<PathBuf>, Vec<PathBuf>), String> {
+    let file = std::fs::File::open(file).map_err(|e| e.to_string())?;
+    let mut archive = zip::ZipArchive::new(file).map_err(|e| format!("couldn't read the portable ZIP ({e})"))?;
+    if archive.len() > MAX_FILES {
+        return Err("The portable ZIP contains too many files.".into());
+    }
+    let mut files = Vec::new();
+    let mut entries = Vec::new();
+    let mut total = 0u64;
+    let mut seen = std::collections::BTreeSet::new();
+    for index in 0..archive.len() {
+        let mut entry = archive.by_index(index).map_err(|e| e.to_string())?;
+        let relative = entry.enclosed_name().ok_or("The portable ZIP contains an unsafe path.")?;
+        if relative.components().any(|c| !matches!(c, Component::Normal(_)))
+            || entry.name().map_or(true, |name| name.contains(['\\', ':']))
+            || entry.unix_mode().is_some_and(|mode| mode & 0o170000 == 0o120000)
+        {
+            return Err("The portable ZIP contains an unsafe path or link.".into());
+        }
+        // Windows treats case variants as the same file; reject duplicate and colliding names.
+        if !seen.insert(relative.to_string_lossy().to_lowercase()) {
+            return Err("The portable ZIP contains duplicate paths.".into());
+        }
+        let target = destination.join(&relative);
+        entries.push(relative.clone());
+        if entry.is_dir() {
+            std::fs::create_dir_all(&target).map_err(|e| e.to_string())?;
+            continue;
+        }
+        total = total.checked_add(entry.size()).filter(|size| *size <= MAX_BYTES).ok_or("The portable ZIP is too large.")?;
+        if let Some(parent) = target.parent() {
+            std::fs::create_dir_all(parent).map_err(|e| e.to_string())?;
+        }
+        let mut output = std::fs::OpenOptions::new().write(true).create_new(true).open(&target).map_err(|e| e.to_string())?;
+        use std::io::Read;
+        let declared = entry.size();
+        let copied = std::io::copy(&mut (&mut entry).take(declared.saturating_add(1)), &mut output).map_err(|e| e.to_string())?;
+        if copied != declared {
+            return Err("The portable ZIP has an unexpected unpacked size.".into());
+        }
+        files.push(relative);
+    }
+    Ok((files, entries))
+}
+
+fn recorded_files<'a>(app: &App, record: &'a Record) -> Result<(&'a Path, Vec<PathBuf>), String> {
+    let root = record.path.parent().ok_or("The portable installation has no parent folder.")?;
+    if record.kind != PackageKind::PortableZip || root.file_name().is_none_or(|n| n != app.id) {
+        return Err("The launcher has no valid ownership record for this portable folder.".into());
+    }
+    let resolved = resolve_missing(root)?;
+    if !same_windows_path(root, &resolved) {
+        return Err("The recorded portable folder resolves through a changed alias. Reinstall it to choose a safe location.".into());
+    }
+    validate_owned_directory(root, root)?;
+    let mut files = Vec::new();
+    for file in &record.files {
+        let relative = file.strip_prefix(root).map_err(|_| "An installation record points outside its folder.")?;
+        if relative.as_os_str().is_empty() || relative.components().any(|c| !matches!(c, Component::Normal(_))) {
+            return Err("The installation record contains an unsafe path.".into());
+        }
+        validate_owned_directory(root, file.parent().ok_or("A recorded file has no parent folder.")?)?;
+        if let Ok(meta) = std::fs::symlink_metadata(file)
+            && (linked(&meta) || !meta.is_file())
+        {
+            return Err("A recorded file was replaced by a link or directory.".into());
+        }
+        files.push(relative.to_path_buf());
+    }
+    Ok((root, files))
+}
+
+/// Keeps existing portable installations at their location and preserves unrecorded user files,
+/// unless `replace` allows writing over them.
+#[allow(clippy::too_many_arguments)]
+pub fn install(
+    app: &App,
+    file: &Path,
+    version: &str,
+    previous: Option<&Record>,
+    paths: &Paths,
+    directory: Option<&Path>,
+    replace: bool,
+    commit: &mut dyn FnMut(&Record) -> Result<(), String>,
+) -> Result<Record, String> {
+    let (destination, mut old_files) = match previous {
+        Some(record) => {
+            let (root, files) = recorded_files(app, record)?;
+            (root.to_path_buf(), files)
+        }
+        None => {
+            let parent = directory.map(Path::to_path_buf).unwrap_or_else(|| paths.apps());
+            validate_directory(&parent)?;
+            let parent = resolve_missing(&parent)?;
+            (parent.join(app.id), Vec::new())
+        }
+    };
+    validate_owned_directory(&destination, &destination)?;
+    let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_err(|e| e.to_string())?.as_nanos();
+    let staging = paths.cache.join("staging").join(format!("{}-{}-{stamp}", app.id, std::process::id()));
+    validate_owned_directory(&paths.cache, &staging)?;
+    std::fs::create_dir_all(staging.parent().ok_or("no staging folder")?).map_err(|e| e.to_string())?;
+    std::fs::create_dir(&staging).map_err(|e| e.to_string())?;
+    let staging = Staging(staging);
+    let unpacked = staging.0.join("unpacked");
+    std::fs::create_dir(&unpacked).map_err(|e| e.to_string())?;
+    let (files, entries) = extract(file, &unpacked)?;
+    // Accept both a flat layout (files at the ZIP root) and a single wrapper-folder layout,
+    // but never arbitrary nesting.
+    let (unpacked, files) = flatten_zip_layout(app, &unpacked, files, &entries)?;
+    let executable = files
+        .iter()
+        .find(|relative| is_root_executable(relative, app))
+        .ok_or("The portable ZIP does not contain the expected executable at its root.")?
+        .clone();
+    // Validate the entire transaction before moving any existing program file.
+    for relative in &files {
+        let target = destination.join(relative);
+        validate_owned_directory(&destination, target.parent().ok_or("no destination folder")?)?;
+        if let Ok(meta) = std::fs::symlink_metadata(&target) {
+            let recorded = old_files.iter().any(|old| same_windows_path(old, relative));
+            if linked(&meta) || !meta.is_file() || !(recorded || replace) {
+                return Err("The installation would overwrite an unrecorded file.".into());
+            }
+            if !recorded {
+                old_files.push(relative.clone());
+            }
+        }
+    }
+    std::fs::create_dir_all(&destination).map_err(|e| e.to_string())?;
+    let backup = staging.0.join("backup");
+    let record = Record {
+        version: version.to_string(),
+        kind: PackageKind::PortableZip,
+        path: destination.join(executable),
+        installed_at: crate::now(),
+        files: files.iter().map(|relative| destination.join(relative)).collect(),
+        needs_root: false,
+    };
+    let mut moved = Vec::new();
+    let mut copied = Vec::new();
+    let transaction = (|| {
+        for relative in &old_files {
+            let old = destination.join(relative);
+            if !old.exists() {
+                continue;
+            }
+            let saved = backup.join(relative);
+            std::fs::create_dir_all(saved.parent().ok_or("no backup folder")?).map_err(|e| e.to_string())?;
+            // Copy the rollback copy: cache and custom installation can be on different drives.
+            std::fs::copy(&old, &saved).map_err(|e| e.to_string())?;
+            std::fs::remove_file(&old).map_err(|e| e.to_string())?;
+            moved.push(relative.clone());
+        }
+        for relative in &files {
+            let target = destination.join(relative);
+            std::fs::create_dir_all(target.parent().ok_or("no destination folder")?).map_err(|e| e.to_string())?;
+            let mut input = std::fs::File::open(unpacked.join(relative)).map_err(|e| e.to_string())?;
+            let mut output = std::fs::OpenOptions::new().write(true).create_new(true).open(&target).map_err(|e| e.to_string())?;
+            copied.push(relative.clone());
+            std::io::copy(&mut input, &mut output).map_err(|e| e.to_string())?;
+        }
+        commit(&record)?;
+        Ok::<(), String>(())
+    })();
+    if let Err(error) = transaction {
+        for relative in copied {
+            let _ = std::fs::remove_file(destination.join(relative));
+        }
+        for relative in moved {
+            if let Err(restore) = std::fs::copy(backup.join(&relative), destination.join(&relative)) {
+                // Preserve backups for manual recovery if the disk won't accept a rollback.
+                let backup_path = staging.keep();
+                return Err(format!("{error}; could not restore the previous version ({restore}). Recovery files: {}", backup_path.display()));
+            }
+        }
+        return Err(error);
+    }
+    Ok(record)
+}
+
+/// Whether a ZIP-relative path sits at the archive root and is one of the app's executables.
+fn is_root_executable(relative: &Path, app: &App) -> bool {
+    relative.parent().is_some_and(|parent| parent.as_os_str().is_empty())
+        && relative.file_name().and_then(OsStr::to_str).is_some_and(|name| app.stems().any(|stem| name.eq_ignore_ascii_case(&format!("{stem}.exe"))))
+}
+
+/// Flattens a portable ZIP whose files all sit in one top-level folder (the official Windows
+/// packaging script's `Compress-Archive -Path $Portable` puts everything under a versioned
+/// directory) into the flat layout a root launcher exe requires, passing already-flat layouts
+/// through. ZIPs mixing unrelated top-level folders are rejected.
+fn flatten_zip_layout(app: &App, unpacked: &Path, files: Vec<PathBuf>, entries: &[PathBuf]) -> Result<(PathBuf, Vec<PathBuf>), String> {
+    if files.iter().any(|relative| is_root_executable(relative, app)) {
+        return Ok((unpacked.to_path_buf(), files));
+    }
+    let prefix = files.first().and_then(|path| path.components().next()).ok_or("The portable ZIP contains no files.")?.as_os_str().to_os_string();
+    let prefix = PathBuf::from(prefix);
+    // Include explicit ZIP directory entries as well as extracted files.
+    // The wrapper directory itself is allowed; unrelated roots are not.
+    if !entries.iter().all(|path| path.starts_with(&prefix))
+        || !files.iter().all(|path| path.strip_prefix(&prefix).is_ok_and(|relative| relative.components().next().is_some()))
+    {
+        return Err("The portable ZIP has an unsupported directory layout.".into());
+    }
+    let unpacked = unpacked.join(&prefix);
+    let files: Vec<PathBuf> =
+        files.into_iter().map(|path| path.strip_prefix(&prefix).map(Path::to_path_buf).map_err(|e| e.to_string())).collect::<Result<Vec<_>, _>>()?;
+    Ok((unpacked, files))
+}
+
+/// Removes only recorded program files. Personal settings and documents remain.
+pub fn remove(app: &App, record: &Record) -> Result<(), String> {
+    let (root, files) = recorded_files(app, record)?;
+    for relative in &files {
+        let file = root.join(relative);
+        if file.exists() {
+            std::fs::remove_file(&file).map_err(|e| e.to_string())?;
+        }
+    }
+    for relative in &files {
+        let mut directory = root.join(relative).parent().map(Path::to_path_buf);
+        while let Some(path) = directory.filter(|p| p.starts_with(root)) {
+            if std::fs::remove_dir(&path).is_err() || path == root {
+                break;
+            }
+            directory = path.parent().map(Path::to_path_buf);
+        }
+    }
+    Ok(())
+}
+
+/// Unpacks the launcher's own portable zip into `staging`, with the same checks as an app's, and
+/// copies it over `folder` for a self-update. `check` must accept every unpacked file before
+/// any is copied, and again before the backup is removed. The archive must include `executable`.
+/// When every file sits in one top-level folder, that folder's contents are the program. A copy
+/// that fails puts the previous files back. When one of them can't be put back,
+/// the previous files move to a `<staging>-recovery-<time>` folder beside `staging`, which no
+/// later update removes, and the error names it. `staging` is removed afterwards.
+pub fn unpack_over(
+    zip: &Path,
+    staging: &Path,
+    folder: &Path,
+    executable: &std::ffi::OsStr,
+    check: &dyn Fn(&Path) -> Result<(), String>,
+) -> Result<(), String> {
+    let backup = staging.join("backup");
+    // A failed update whose files couldn't be moved to a recovery folder: never clear them.
+    if backup.exists() {
+        return Err(format!("the previous files of a failed update are in {}; move them out of the way first", backup.display()));
+    }
+    let _ = std::fs::remove_dir_all(staging);
+    let mut keep = false;
+    let result = replace_with(zip, staging, folder, executable, check, &mut keep);
+    if !keep {
+        let _ = std::fs::remove_dir_all(staging);
+    }
+    result
+}
+
+fn replace_with(
+    zip: &Path,
+    staging: &Path,
+    folder: &Path,
+    executable: &std::ffi::OsStr,
+    check: &dyn Fn(&Path) -> Result<(), String>,
+    keep: &mut bool,
+) -> Result<(), String> {
+    let unpacked = staging.join("unpacked");
+    let backup = staging.join("backup");
+    std::fs::create_dir_all(&unpacked).map_err(|e| e.to_string())?;
+    let (files, _) = extract(zip, &unpacked)?;
+    let top = single_top_folder(&files);
+    let files = files
+        .into_iter()
+        .map(|relative| {
+            let inside = match &top {
+                Some(top) => relative.strip_prefix(top).map_err(|e| e.to_string())?.to_path_buf(),
+                None => relative.clone(),
+            };
+            Ok((relative, inside))
+        })
+        .collect::<Result<Vec<_>, String>>()?;
+    if !files.iter().any(|(_, inside)| inside == Path::new(executable)) {
+        return Err(format!("the update doesn't contain {}", executable.to_string_lossy()));
+    }
+    for (relative, _) in &files {
+        check(&unpacked.join(relative))?;
+    }
+    let mut saved = Vec::new();
+    let mut created = Vec::new();
+    let copied = (|| {
+        for (relative, inside) in &files {
+            let target = folder.join(inside);
+            if let Some(parent) = target.parent() {
+                std::fs::create_dir_all(parent).map_err(|e| e.to_string())?;
+            }
+            if target.is_file() {
+                let previous = backup.join(inside);
+                std::fs::create_dir_all(previous.parent().ok_or("no backup folder")?).map_err(|e| e.to_string())?;
+                std::fs::copy(&target, &previous).map_err(|e| e.to_string())?;
+                saved.push(inside.to_path_buf());
+            } else {
+                created.push(target.clone());
+            }
+            std::fs::copy(unpacked.join(relative), &target).map_err(|e| format!("couldn't replace {} ({e})", target.display()))?;
+        }
+        // Keep the previous files until the installed copies have passed the same checks.
+        for (_, inside) in &files {
+            check(&folder.join(inside))?;
+        }
+        Ok::<(), String>(())
+    })();
+    if let Err(error) = copied {
+        for target in &created {
+            let _ = std::fs::remove_file(target);
+        }
+        for inside in &saved {
+            if let Err(restore) = std::fs::copy(backup.join(inside), folder.join(inside)) {
+                let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_nanos());
+                let mut recovery = staging.as_os_str().to_owned();
+                recovery.push(format!("-recovery-{stamp}"));
+                let recovery = PathBuf::from(recovery);
+                let kept = if std::fs::rename(&backup, &recovery).is_ok() {
+                    recovery
+                } else {
+                    *keep = true;
+                    backup.clone()
+                };
+                return Err(format!(
+                    "{error}; couldn't put back {} ({restore}). The previous files are in {}",
+                    folder.join(inside).display(),
+                    kept.display()
+                ));
+            }
+        }
+        return Err(error);
+    }
+    Ok(())
+}
+
+/// The one folder that holds every file, when there is one.
+fn single_top_folder(files: &[PathBuf]) -> Option<PathBuf> {
+    let first = files.first()?.components().next()?;
+    files
+        .iter()
+        .all(|file| {
+            let mut parts = file.components();
+            parts.next() == Some(first) && parts.next().is_some()
+        })
+        .then(|| PathBuf::from(first.as_os_str()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+
+    /// A folder on a network share is the same folder after `canonicalize`.
+    #[cfg(windows)]
+    #[test]
+    fn verbatim_paths_match_their_plain_form() {
+        assert!(same_windows_path(Path::new(r"C:\Apps\ArtCraft"), Path::new(r"\\?\C:\apps\artcraft\")));
+        assert!(same_windows_path(Path::new(r"\\server\share\Apps\ArtCraft"), Path::new(r"\\?\UNC\server\share\Apps\ArtCraft")));
+        assert!(same_windows_path(Path::new(r"\\?\unc\server\share\Apps\ArtCraft"), Path::new(r"\\Server\Share\Apps\ArtCraft")));
+        assert!(!same_windows_path(Path::new(r"C:\Apps\ArtCraft"), Path::new(r"\\?\D:\Apps\ArtCraft")));
+    }
+
+    /// Previous files left in the staging folder by a failed update are never cleared by the next one.
+    #[test]
+    fn a_self_update_keeps_the_previous_files_of_a_failed_one() {
+        let dir = tempfile::tempdir().unwrap();
+        let staging = dir.path().join("launcher-update");
+        std::fs::create_dir_all(staging.join("backup")).unwrap();
+        std::fs::write(staging.join("backup").join("artcraft-launcher.exe"), "0.1.0").unwrap();
+        let zip = archive(dir.path(), "update.zip", &[("artcraft-launcher.exe", b"0.2.0")]);
+        let folder = dir.path().join("ArtCraft Launcher");
+        std::fs::create_dir_all(&folder).unwrap();
+        let error = unpack_over(&zip, &staging, &folder, std::ffi::OsStr::new("artcraft-launcher.exe"), &|_| Ok(())).unwrap_err();
+        assert!(error.contains("previous files"), "{error}");
+        assert_eq!(std::fs::read_to_string(staging.join("backup").join("artcraft-launcher.exe")).unwrap(), "0.1.0");
+        assert!(!folder.join("artcraft-launcher.exe").exists());
+    }
+
+    /// Validation of the installed copy is part of the transaction, while a backup still exists.
+    #[test]
+    fn a_self_update_that_fails_validation_puts_the_previous_files_back() {
+        let dir = tempfile::tempdir().unwrap();
+        let staging = dir.path().join("launcher-update");
+        let folder = dir.path().join("ArtCraft Launcher");
+        std::fs::create_dir_all(&folder).unwrap();
+        let exe = folder.join("artcraft-launcher.exe");
+        std::fs::write(&exe, "old launcher").unwrap();
+        let zip = archive(dir.path(), "update.zip", &[("launcher/artcraft-launcher.exe", b"new launcher"), ("launcher/README.md", b"new readme")]);
+        let checked = std::cell::Cell::new(false);
+        let error = unpack_over(&zip, &staging, &folder, std::ffi::OsStr::new("artcraft-launcher.exe"), &|file| {
+            if file == exe {
+                assert_eq!(std::fs::read(file).unwrap(), b"new launcher");
+                assert!(folder.join("README.md").is_file());
+                checked.set(true);
+                Err("installed launcher failed validation".into())
+            } else {
+                Ok(())
+            }
+        })
+        .unwrap_err();
+        assert_eq!(error, "installed launcher failed validation");
+        assert!(checked.get());
+        assert_eq!(std::fs::read(&exe).unwrap(), b"old launcher");
+        assert!(!folder.join("README.md").exists());
+        assert!(!staging.exists());
+    }
+
+    fn archive(root: &Path, name: &str, files: &[(&str, &[u8])]) -> PathBuf {
+        let path = root.join(name);
+        let mut zip = zip::ZipWriter::new(std::fs::File::create(&path).unwrap());
+        for (name, content) in files {
+            if name.ends_with('/') {
+                zip.add_directory(*name, zip::write::SimpleFileOptions::default()).unwrap();
+            } else {
+                zip.start_file(*name, zip::write::SimpleFileOptions::default()).unwrap();
+                zip.write_all(content).unwrap();
+            }
+        }
+        zip.finish().unwrap();
+        path
+    }
+
+    #[test]
+    fn wrapped_layout_validates_explicit_directory_entries() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        let invalid = archive(dir.path(), "invalid-dirs.zip", &[("wrapper/", b""), ("wrapper/photocraft.exe", b"program"), ("outside/", b"")]);
+        let error = install(app, &invalid, "0.12.0", None, &paths, None, false, &mut |_| Ok(())).unwrap_err();
+        assert!(error.contains("unsupported directory layout"), "{error}");
+        assert!(!paths.apps().join(app.id).exists());
+
+        let valid = archive(dir.path(), "valid-dirs.zip", &[("wrapper/", b""), ("wrapper/photocraft.exe", b"program")]);
+        let record = install(app, &valid, "0.12.0", None, &paths, None, false, &mut |_| Ok(())).unwrap();
+        assert!(record.path.exists());
+    }
+
+    #[test]
+    fn wrapped_packages_install_update_and_remove_at_a_stable_location() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        let parent = dir.path().join("My Tools");
+        let mut previous = None;
+        // The published ZIPs wrap the app, CLI and resources in a versioned directory.
+        // Also exercise transitions to and from the older, flat layout.
+        for (version, prefix) in [
+            ("0.12.0", "photocraft-0.12.0-windows-x64-portable/"),
+            ("0.13.0", "photocraft-0.13.0-windows-x64-portable/"),
+            ("0.11.0", ""),
+            ("0.12.0", "photocraft-0.12.0-windows-x64-portable/"),
+        ] {
+            let zip = archive(
+                dir.path(),
+                "app.zip",
+                &[
+                    (&format!("{prefix}photocraft-cli.exe"), b"cli"),
+                    (&format!("{prefix}PhotoCraft.exe"), version.as_bytes()),
+                    (&format!("{prefix}lib/runtime.dll"), b"library"),
+                    (&format!("{prefix}LICENSE-MIT"), b"license"),
+                ],
+            );
+            let record = install(app, &zip, version, previous.as_ref(), &paths, Some(&parent), false, &mut |_| Ok(())).unwrap();
+            let root = std::fs::canonicalize(parent.join(app.id)).unwrap();
+            assert_eq!(record.path, root.join("PhotoCraft.exe"));
+            assert_eq!(std::fs::read(&record.path).unwrap(), version.as_bytes());
+            assert_eq!(std::fs::read(root.join("lib/runtime.dll")).unwrap(), b"library");
+            assert_eq!(record.files, ["photocraft-cli.exe", "PhotoCraft.exe", "lib/runtime.dll", "LICENSE-MIT"].map(|p| root.join(p)));
+            let personal = root.join("settings.json");
+            if previous.is_some() {
+                assert_eq!(std::fs::read(&personal).unwrap(), b"personal");
+            } else {
+                std::fs::write(&personal, b"personal").unwrap();
+            }
+            previous = Some(record);
+        }
+        let record = previous.unwrap();
+        remove(app, &record).unwrap();
+        assert!(record.files.iter().all(|p| !p.exists()));
+        assert_eq!(std::fs::read(parent.join("photocraft/settings.json")).unwrap(), b"personal");
+    }
+
+    #[test]
+    fn rejects_missing_executables_and_ambiguous_or_deep_wrappers() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        for names in [
+            vec![],
+            vec!["package/photocraft-cli.exe"],
+            vec!["package/bin/photocraft.exe"],
+            vec!["one/photocraft.exe", "two/photocraft.exe"],
+            vec!["package/photocraft.exe", "outside.txt"],
+            vec!["package/photocraft.exe", "other/runtime.dll"],
+        ] {
+            let files: Vec<_> = names.iter().map(|name| (*name, b"content".as_slice())).collect();
+            let zip = archive(dir.path(), "invalid.zip", &files);
+            assert!(install(app, &zip, "0.12.0", None, &paths, None, false, &mut |_| Ok(())).is_err(), "{names:?}");
+            assert!(!paths.apps().join(app.id).exists());
+        }
+    }
+
+    #[test]
+    fn wrapped_update_keeps_collision_checks_and_rolls_back_failed_commits() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        let old = archive(dir.path(), "old.zip", &[("photocraft.exe", b"old"), ("lib.dll", b"library")]);
+        let record = install(app, &old, "0.11.0", None, &paths, None, false, &mut |_| Ok(())).unwrap();
+        let personal = paths.apps().join("photocraft/settings.json");
+        std::fs::write(&personal, b"keep").unwrap();
+        let collision = archive(dir.path(), "collision.zip", &[("package/photocraft.exe", b"new"), ("package/settings.json", b"overwrite")]);
+        let error = install(app, &collision, "0.12.0", Some(&record), &paths, None, false, &mut |_| Ok(())).unwrap_err();
+        assert_eq!(error, "The installation would overwrite an unrecorded file.");
+        let next = archive(dir.path(), "next.zip", &[("package/photocraft.exe", b"new"), ("package/new.dll", b"new")]);
+        let error = install(app, &next, "0.12.0", Some(&record), &paths, None, false, &mut |_| Err("manifest disk full".into())).unwrap_err();
+        assert_eq!(error, "manifest disk full");
+        assert_eq!(std::fs::read(record.path).unwrap(), b"old");
+        assert_eq!(std::fs::read(paths.apps().join("photocraft/lib.dll")).unwrap(), b"library");
+        assert!(!paths.apps().join("photocraft/new.dll").exists());
+        assert_eq!(std::fs::read(personal).unwrap(), b"keep");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn host_symlinks_are_allowed_but_owned_links_are_rejected() {
+        use std::os::unix::fs::symlink;
+
+        let dir = tempfile::tempdir().unwrap();
+        let host = dir.path().join("var-home");
+        std::fs::create_dir(&host).unwrap();
+        let home = dir.path().join("home");
+        symlink(&host, &home).unwrap();
+        let root = home.join("photocraft");
+        assert!(validate_directory(&root).is_ok());
+        assert!(validate_owned_directory(&root, &root).is_ok());
+
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(&home);
+        let zip = archive(dir.path(), "app.zip", &[("photocraft.exe", b"program"), ("lib/runtime.dll", b"library")]);
+        let record = install(app, &zip, "0.5.0", None, &paths, Some(&home), false, &mut |_| Ok(())).unwrap();
+        assert_eq!(std::fs::read(&record.path).unwrap(), b"program");
+
+        std::fs::remove_file(root.join("lib/runtime.dll")).unwrap();
+        std::fs::remove_dir(root.join("lib")).unwrap();
+        symlink(&host, root.join("lib")).unwrap();
+        assert!(validate_owned_directory(&root, &root.join("lib/nested")).is_err());
+        assert!(remove(app, &record).is_err());
+        assert!(install(app, &zip, "0.6.0", Some(&record), &paths, None, false, &mut |_| Ok(())).is_err());
+        assert_eq!(std::fs::read(&record.path).unwrap(), b"program");
+
+        let linked_root = home.join("linked-app");
+        symlink(&root, &linked_root).unwrap();
+        assert!(validate_owned_directory(&linked_root, &linked_root).is_err());
+        assert!(validate_owned_directory(&root, &home).is_err());
+        let dangling = home.join("dangling");
+        symlink(home.join("missing"), &dangling).unwrap();
+        assert!(validate_directory(&dangling.join("nested")).is_err());
+    }
+
+    #[test]
+    fn stale_junction_record_cannot_remove_files_after_retargeting() {
+        use std::process::Command;
+
+        fn junction(link: &Path, target: &Path) {
+            let status = Command::new("cmd.exe").args(["/C", "mklink", "/J"]).arg(link).arg(target).status().unwrap();
+            assert!(status.success());
+        }
+
+        let dir = tempfile::tempdir().unwrap();
+        let first = dir.path().join("first");
+        let second = dir.path().join("second");
+        let link = dir.path().join("Apps junction");
+        std::fs::create_dir(&first).unwrap();
+        std::fs::create_dir(&second).unwrap();
+        junction(&link, &first);
+        let alias_root = link.join("photocraft");
+        std::fs::create_dir(&alias_root).unwrap();
+        std::fs::write(alias_root.join("photocraft.exe"), b"old program").unwrap();
+        let record = Record {
+            version: "0.5.0".into(),
+            kind: PackageKind::PortableZip,
+            path: alias_root.join("photocraft.exe"),
+            installed_at: 0,
+            files: vec![alias_root.join("photocraft.exe")],
+            needs_root: false,
+        };
+        std::process::Command::new("cmd.exe").args(["/C", "rmdir"]).arg(&link).status().unwrap();
+        junction(&link, &second);
+        let foreign_root = link.join("photocraft");
+        std::fs::create_dir(&foreign_root).unwrap();
+        std::fs::write(foreign_root.join("photocraft.exe"), b"foreign program").unwrap();
+        assert!(remove(App::by_id("photocraft").unwrap(), &record).is_err());
+        assert_eq!(std::fs::read(foreign_root.join("photocraft.exe")).unwrap(), b"foreign program");
+    }
+
+    #[test]
+    fn upgrade_downgrade_and_uninstall_preserve_personal_files_and_location() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        let parent = dir.path().join("My Tools");
+        let first = archive(dir.path(), "first.zip", &[("photocraft.exe", b"first"), ("obsolete.dll", b"old")]);
+        let mut record = install(app, &first, "0.5.0", None, &paths, Some(&parent), false, &mut |_| Ok(())).unwrap();
+        let personal = parent.join("photocraft").join("settings.json");
+        std::fs::write(&personal, b"personal").unwrap();
+        for (version, exe) in [("0.6.0", b"new".as_slice()), ("0.4.0", b"older".as_slice())] {
+            let executable = if version == "0.4.0" { "PhotoCraft.exe" } else { "photocraft.exe" };
+            let package = archive(dir.path(), "next.zip", &[(executable, exe), ("lib/runtime.dll", b"dll")]);
+            record = install(app, &package, version, Some(&record), &paths, Some(&dir.path().join("Ignored")), false, &mut |_| Ok(())).unwrap();
+            assert_eq!(std::fs::read(&record.path).unwrap(), exe);
+            assert_eq!(record.path.parent().unwrap(), std::fs::canonicalize(personal.parent().unwrap()).unwrap());
+            assert!(!parent.join("photocraft/obsolete.dll").exists());
+            assert_eq!(std::fs::read(&personal).unwrap(), b"personal");
+            let mut manifest = crate::manifest::Manifest::default();
+            manifest.apps.insert(app.id.into(), record.clone());
+            manifest.save(&paths.data.join("installed.json")).unwrap();
+            let restored = crate::manifest::Manifest::load(&paths.data.join("installed.json"));
+            let detected = crate::detect::detect(app, &restored, &crate::detect::Snapshot::take()).unwrap();
+            assert_eq!(detected.version, crate::version::parse(version));
+            assert_eq!(detected.location, record.path.to_string_lossy());
+        }
+        remove(app, &record).unwrap();
+        assert!(!record.path.exists());
+        assert_eq!(std::fs::read(personal).unwrap(), b"personal");
+    }
+
+    #[test]
+    fn a_failed_manifest_commit_restores_the_previous_program() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        let old = archive(dir.path(), "old.zip", &[("photocraft.exe", b"old"), ("lib.dll", b"library")]);
+        let record = install(app, &old, "0.5.0", None, &paths, None, false, &mut |_| Ok(())).unwrap();
+        let next = archive(dir.path(), "next.zip", &[("photocraft.exe", b"new"), ("new.dll", b"new")]);
+        let result = install(app, &next, "0.6.0", Some(&record), &paths, None, false, &mut |_| Err("manifest disk full".into()));
+        assert_eq!(result.unwrap_err(), "manifest disk full");
+        assert_eq!(std::fs::read(record.path).unwrap(), b"old");
+        assert_eq!(std::fs::read(paths.apps().join("photocraft/lib.dll")).unwrap(), b"library");
+        assert!(!paths.apps().join("photocraft/new.dll").exists());
+    }
+
+    #[test]
+    fn collision_is_rejected_before_replacing_any_old_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        let old = archive(dir.path(), "old.zip", &[("photocraft.exe", b"old")]);
+        let record = install(app, &old, "0.5.0", None, &paths, None, false, &mut |_| Ok(())).unwrap();
+        let personal = paths.apps().join("photocraft/settings.json");
+        std::fs::write(&personal, b"keep").unwrap();
+        let next = archive(dir.path(), "next.zip", &[("photocraft.exe", b"new"), ("settings.json", b"overwrite")]);
+        assert!(install(app, &next, "0.6.0", Some(&record), &paths, None, false, &mut |_| Ok(())).is_err());
+        assert_eq!(std::fs::read(record.path).unwrap(), b"old");
+        assert_eq!(std::fs::read(personal).unwrap(), b"keep");
+    }
+
+    #[test]
+    fn a_new_install_writes_over_unrecorded_files_only_when_asked_to() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        let folder = paths.apps().join("photocraft");
+        std::fs::create_dir_all(&folder).unwrap();
+        std::fs::write(folder.join("photocraft.exe"), b"theirs").unwrap();
+        std::fs::write(folder.join("notes.txt"), b"keep").unwrap();
+        let zip = archive(dir.path(), "new.zip", &[("photocraft.exe", b"new")]);
+        assert!(install(app, &zip, "0.5.0", None, &paths, None, false, &mut |_| Ok(())).is_err());
+        assert_eq!(std::fs::read(folder.join("photocraft.exe")).unwrap(), b"theirs");
+        install(app, &zip, "0.5.0", None, &paths, None, true, &mut |_| Ok(())).unwrap();
+        assert_eq!(std::fs::read(folder.join("photocraft.exe")).unwrap(), b"new");
+        assert_eq!(std::fs::read(folder.join("notes.txt")).unwrap(), b"keep");
+    }
+
+    #[test]
+    fn installs_official_single_directory_portable_zip() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        let zip = archive(
+            dir.path(),
+            "release.zip",
+            &[
+                ("photocraft-0.6.1-windows-x64-portable/photocraft.exe", b"program"),
+                ("photocraft-0.6.1-windows-x64-portable/portable.txt", b""),
+                ("photocraft-0.6.1-windows-x64-portable/lib/runtime.dll", b"library"),
+            ],
+        );
+        let record = install(app, &zip, "0.6.1", None, &paths, None, false, &mut |_| Ok(())).unwrap();
+        assert_eq!(record.path.file_name().unwrap(), "photocraft.exe");
+        assert_eq!(record.path.parent().unwrap().file_name().unwrap(), "photocraft");
+        assert_eq!(std::fs::read(&record.path).unwrap(), b"program");
+        assert_eq!(std::fs::read(paths.apps().join("photocraft/lib/runtime.dll")).unwrap(), b"library");
+        assert_eq!(record.files.len(), 3);
+        remove(app, &record).unwrap();
+        assert!(!record.path.exists());
+    }
+
+    #[test]
+    fn rejects_mixed_root_and_multiple_directory_archives() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = App::by_id("photocraft").unwrap();
+        let paths = Paths::under(dir.path());
+        for (name, entries) in [
+            ("mixed.zip", vec![("package/photocraft.exe", b"program".as_slice()), ("another/readme.txt", b"other".as_slice())]),
+            ("nested.zip", vec![("wrapper/inner/photocraft.exe", b"program".as_slice())]),
+        ] {
+            let zip = archive(dir.path(), name, &entries);
+            assert!(install(app, &zip, "0.6.1", None, &paths, None, false, &mut |_| Ok(())).is_err(), "{name}");
+            assert!(!paths.apps().join("photocraft/photocraft.exe").exists());
+        }
+    }
+
+    /// ZIP 9 strips a drive prefix from enclosed paths; the original name must still be rejected.
+    #[test]
+    fn rejects_drive_prefixed_names_before_writing_files() {
+        let dir = tempfile::tempdir().unwrap();
+        let zip = archive(dir.path(), "drive.zip", &[("c:escape.exe", b"bad".as_slice())]);
+        let output = dir.path().join("output");
+        std::fs::create_dir(&output).unwrap();
+        assert!(extract(&zip, &output).is_err());
+        assert_eq!(std::fs::read_dir(&output).unwrap().count(), 0);
+    }
+
+    #[test]
+    fn rejects_traversal_and_case_collisions() {
+        let dir = tempfile::tempdir().unwrap();
+        for (name, files) in [
+            ("traversal.zip", vec![("../escape.exe", b"bad".as_slice())]),
+            ("colon.zip", vec![("data:stream", b"bad".as_slice())]),
+            ("duplicate.zip", vec![("PhotoCraft.exe", b"one".as_slice()), ("photocraft.exe", b"two".as_slice())]),
+        ] {
+            let zip = archive(dir.path(), name, &files);
+            let output = dir.path().join(name.replace('.', "-"));
+            std::fs::create_dir(&output).unwrap();
+            assert!(extract(&zip, &output).is_err(), "{name}");
+        }
+        assert!(!dir.path().join("escape.exe").exists());
+        assert!(validate_directory(Path::new("relative/folder")).is_err());
+        assert!(validate_directory(&dir.path().join("../escape")).is_err());
+    }
+}
diff --git a/crates/update/src/process.rs b/crates/update/src/process.rs
new file mode 100644
index 00000000..4f5c935e
--- /dev/null
+++ b/crates/update/src/process.rs
@@ -0,0 +1,597 @@
+//! Starting programs: the Craft Apps themselves, the file manager, and helper tools.
+
+use std::ffi::OsStr;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+/// A `Command` that won't flash a console window on Windows, and clears AppImage-injected
+/// environment variables that corrupt system helper binaries and external applications.
+pub fn command(program: impl AsRef<std::ffi::OsStr>) -> Command {
+    #[allow(unused_mut)]
+    let mut cmd = Command::new(program);
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt;
+        const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+        cmd.creation_flags(CREATE_NO_WINDOW);
+    }
+    #[cfg(unix)]
+    clean_appimage_env(&mut cmd);
+    cmd
+}
+
+/// Cleans AppImage runtime environment variables so child processes don't load incompatible
+/// libraries from the launcher's bundled AppImage.
+#[cfg(unix)]
+pub fn clean_appimage_env(cmd: &mut Command) {
+    if std::env::var_os("APPIMAGE").is_some() {
+        for var in [
+            "LD_LIBRARY_PATH",
+            "LD_PRELOAD",
+            "APPDIR",
+            "APPIMAGE",
+            "ARGV0",
+            "OWD",
+            "GDK_PIXBUF_MODULE_FILE",
+            "GIO_MODULE_DIR",
+            "GTK_PATH",
+            "PYTHONHOME",
+            "QT_PLUGIN_PATH",
+        ] {
+            cmd.env_remove(var);
+        }
+    }
+}
+
+/// Runs a helper and returns its standard output when it succeeds within `timeout`.
+pub fn capture(program: &str, args: &[&str], timeout: Duration) -> Option<String> {
+    run(program, args, timeout).ok()
+}
+
+/// Runs a helper and returns its standard output when it succeeds within `timeout`; otherwise
+/// the reason, in the helper's own words (its standard error) where it gave one.
+pub fn run(program: &str, args: &[&str], timeout: Duration) -> Result<String, String> {
+    let mut cmd = command(program);
+    cmd.args(args);
+    run_command(cmd, program, timeout)
+}
+
+/// Runs a configured helper with bounded output and a timeout.
+pub fn run_command(mut cmd: Command, program: &str, timeout: Duration) -> Result<String, String> {
+    let mut child =
+        cmd.stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().map_err(|e| format!("couldn't start {program} ({e})"))?;
+    // Read both pipes while it runs, so a chatty helper can't block on a full one.
+    let (stdout, stderr) = (read_all(child.stdout.take()), read_all(child.stderr.take()));
+    let start = Instant::now();
+    let status = loop {
+        match child.try_wait() {
+            Ok(Some(status)) => break status,
+            Ok(None) if start.elapsed() < timeout => std::thread::sleep(Duration::from_millis(15)),
+            _ => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return Err(format!("{program} didn't finish within {} seconds", timeout.as_secs()));
+            }
+        }
+    };
+    // A descendant may retain a pipe after the direct child exits. Keep reader completion
+    // under the same deadline; on timeout the readers detach, as in the child timeout path.
+    while !stdout.is_finished() || !stderr.is_finished() {
+        if start.elapsed() >= timeout {
+            return Err(format!("{program} didn't finish within {} seconds", timeout.as_secs()));
+        }
+        std::thread::sleep(Duration::from_millis(15));
+    }
+    let text = |pipe: std::thread::JoinHandle<Vec<u8>>| String::from_utf8_lossy(&pipe.join().unwrap_or_default()).into_owned();
+    let (out, err) = (text(stdout), text(stderr));
+    if status.success() {
+        return Ok(out);
+    }
+    let reason = err.trim();
+    Err(if reason.is_empty() { format!("{program} failed ({status})") } else { reason.to_string() })
+}
+
+/// Captures at most 8 MB of a child's pipe and drains the rest on its own thread.
+fn read_all<R: std::io::Read + Send + 'static>(pipe: Option<R>) -> std::thread::JoinHandle<Vec<u8>> {
+    std::thread::spawn(move || {
+        let mut out = Vec::new();
+        if let Some(mut pipe) = pipe {
+            let _ = std::io::Read::read_to_end(&mut std::io::Read::take(&mut pipe, 8 << 20), &mut out);
+            // Keep reading without retaining more output: closing a full pipe early can make a
+            // successful helper fail with a broken pipe (SIGPIPE on Unix).
+            let _ = std::io::copy(&mut pipe, &mut std::io::sink());
+        }
+        out
+    })
+}
+
+/// Starts `cmd` without waiting for it, and reaps it when it exits.
+pub fn spawn_detached(mut cmd: Command) -> Result<(), String> {
+    let mut child = cmd.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null()).spawn().map_err(|e| format!("couldn't start it ({e})"))?;
+    std::thread::spawn(move || {
+        let _ = child.wait();
+    });
+    Ok(())
+}
+
+/// Waits up to `timeout` for the process `pid` to exit, and says whether it has. A process that
+/// can't be opened, because it's gone or never was, counts as exited.
+#[cfg(windows)]
+pub fn wait_for_exit(pid: u32, timeout: Duration) -> bool {
+    use winsafe::{HPROCESS, co};
+    let Ok(process) = HPROCESS::OpenProcess(co::PROCESS::SYNCHRONIZE, false, pid) else { return true };
+    // u32::MAX would mean INFINITE.
+    let ms = u32::try_from(timeout.as_millis()).unwrap_or(u32::MAX - 1);
+    process.WaitForSingleObject(Some(ms)).is_ok_and(|w| w == co::WAIT::OBJECT_0)
+}
+
+/// Whether this process is running inside a Flatpak container sandbox.
+pub fn in_sandbox() -> bool {
+    std::env::var_os("FLATPAK_ID").is_some() || Path::new("/.flatpak-info").exists()
+}
+
+/// A command to run `flatpak`, delegating to the host via `flatpak-spawn --host` if inside a sandbox.
+pub fn flatpak_command() -> Command {
+    if in_sandbox() {
+        let mut cmd = command("flatpak-spawn");
+        cmd.args(["--host", "flatpak"]);
+        cmd
+    } else {
+        command("flatpak")
+    }
+}
+
+/// Runs a flatpak command and captures its standard output.
+pub fn capture_flatpak(args: &[&str], timeout: Duration) -> Option<String> {
+    if in_sandbox() {
+        let mut spawn_args = vec!["--host", "flatpak"];
+        spawn_args.extend_from_slice(args);
+        capture("flatpak-spawn", &spawn_args, timeout)
+    } else {
+        capture("flatpak", args, timeout)
+    }
+}
+
+/// Whether Flatpak is available on the machine (or on the host when sandboxed).
+pub fn is_flatpak_available() -> bool {
+    if in_sandbox() {
+        capture("flatpak-spawn", &["--host", "flatpak", "--version"], Duration::from_secs(3)).is_some()
+    } else {
+        which_on_path("flatpak").is_some()
+    }
+}
+
+fn which_on_path(name: &str) -> Option<std::path::PathBuf> {
+    let path = std::env::var_os("PATH")?;
+    std::env::split_paths(&path).map(|d| d.join(name)).find(|p| p.is_file())
+}
+
+/// Starts an app binary from its own folder.
+pub fn launch_binary(exe: &Path, args: &[&str]) -> Result<(), String> {
+    let mut cmd = if in_sandbox() {
+        let mut c = command("flatpak-spawn");
+        c.arg("--host").arg(exe);
+        c
+    } else {
+        command(exe)
+    };
+    cmd.args(args);
+    if let Some(dir) = exe.parent() {
+        cmd.current_dir(dir);
+    }
+    spawn_detached(cmd)
+}
+
+/// Opens a file, folder or URL with the system's default handler.
+pub fn open(target: &std::ffi::OsStr) -> Result<(), String> {
+    spawn_detached(opener(target)?)
+}
+
+/// The system's default opener for `target`: `explorer` on Windows, `open` on macOS, and
+/// `xdg-open` elsewhere (on the host, through `flatpak-spawn --host`, inside the sandbox).
+fn opener(target: &std::ffi::OsStr) -> Result<Command, String> {
+    let mut cmd = if cfg!(target_os = "macos") {
+        command("open")
+    } else if cfg!(windows) {
+        command(windows_system_program("explorer.exe")?)
+    } else if in_sandbox() {
+        let mut c = command("flatpak-spawn");
+        c.arg("--host").arg("xdg-open");
+        c
+    } else {
+        command("xdg-open")
+    };
+    cmd.arg(target);
+    Ok(cmd)
+}
+
+/// Opens `primary_url` with the system's default handler. If opening fails (for example,
+/// if a custom scheme handler is not found or fails to execute), falls back to `fallback_url`.
+pub fn open_url_with_fallback(primary_url: &str, fallback_url: &str) {
+    let primary = primary_url.to_string();
+    let fallback = fallback_url.to_string();
+    std::thread::spawn(move || {
+        if !open_and_wait_success(&primary, Duration::from_millis(1500)) {
+            log::warn!("couldn't open {primary}; falling back to {fallback}");
+            let _ = open(std::ffi::OsStr::new(&fallback));
+        }
+    });
+}
+
+/// Starts the default system opener for `target` and returns `true` unless it fails to start
+/// or exits in error within `timeout`. An opener still running after `timeout` counts as
+/// success and is reaped in the background.
+///
+/// `explorer` exits with an error status even when it opens the target, so on Windows only a
+/// failure to start counts; the scheme check covers the rest.
+fn open_and_wait_success(target: &str, timeout: Duration) -> bool {
+    let mut cmd = match opener(std::ffi::OsStr::new(target)) {
+        Ok(cmd) => cmd,
+        Err(error) => {
+            log::warn!("couldn't resolve the system opener for {target}: {error}");
+            return false;
+        }
+    };
+    if cfg!(windows) {
+        return spawn_detached(cmd).is_ok();
+    }
+    let mut child = match cmd.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null()).spawn() {
+        Ok(c) => c,
+        Err(e) => {
+            log::warn!("couldn't start the opener for {target}: {e}");
+            return false;
+        }
+    };
+    let start = Instant::now();
+    loop {
+        match child.try_wait() {
+            Ok(Some(status)) => return status.success(),
+            Ok(None) if start.elapsed() < timeout => std::thread::sleep(Duration::from_millis(25)),
+            Ok(None) => {
+                std::thread::spawn(move || {
+                    let _ = child.wait();
+                });
+                return true;
+            }
+            Err(_) => return false,
+        }
+    }
+}
+
+/// Shows `path` selected in the file manager.
+pub fn reveal(path: &Path) -> Result<(), String> {
+    if cfg!(target_os = "macos") {
+        let mut cmd = command("open");
+        cmd.arg("-R").arg(path);
+        spawn_detached(cmd)
+    } else if cfg!(windows) {
+        reveal_in_explorer(path)
+    } else {
+        open(path.parent().unwrap_or(path).as_os_str())
+    }
+}
+
+#[cfg(windows)]
+fn reveal_in_explorer(path: &Path) -> Result<(), String> {
+    use std::os::windows::process::CommandExt;
+    let mut cmd = command(windows_system_program("explorer.exe")?);
+    // Passed raw: `arg` would wrap all of `/select,...` in quotes when the path has a space
+    // (`C:\Program Files\...`), and Explorer then ignores the switch and opens Documents.
+    // A quote in the path would end the quoted part early and let the rest reach Explorer as
+    // switches; no Windows path has one, so refuse it.
+    let arg = explorer_select_arg(path).ok_or_else(|| format!("{} isn't a usable path", path.display()))?;
+    cmd.raw_arg(arg);
+    spawn_detached(cmd)
+}
+
+#[cfg(not(windows))]
+fn reveal_in_explorer(_path: &Path) -> Result<(), String> {
+    Err("Explorer is only on Windows".into())
+}
+
+/// Explorer's `/select,"<path>"` argument as it goes on the command line: only the path is quoted,
+/// and forward slashes become backslashes, which Explorer needs to find the item. `None` for a path
+/// with a `"` in it.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn explorer_select_arg(path: &Path) -> Option<std::ffi::OsString> {
+    let s = path.to_str()?;
+    if s.contains('"') {
+        return None;
+    }
+    let mut arg = std::ffi::OsString::from("/select,\"");
+    arg.push(s.replace('/', "\\"));
+    arg.push("\"");
+    Some(arg)
+}
+
+/// Whether a process started from inside `path` (an exe, an AppImage, or a `.app`) is running.
+pub fn is_running(path: &Path) -> bool {
+    if cfg!(windows) {
+        let Some(name) = path.file_name().and_then(OsStr::to_str) else { return false };
+        let filter = format!("IMAGENAME eq {name}");
+        let Ok(tasklist) = windows_system_program(r"System32\tasklist.exe") else { return false };
+        let mut cmd = command(tasklist);
+        cmd.args(["/FI", &filter, "/NH", "/FO", "CSV"]);
+        run_command(cmd, "tasklist", Duration::from_secs(5)).ok().is_some_and(|out| out.to_ascii_lowercase().contains(&name.to_ascii_lowercase()))
+    } else {
+        let Some(p) = path.to_str() else { return false };
+        let pattern = pgrep_pattern(p);
+        // pgrep exits 0 when something matches; it never matches itself.
+        if in_sandbox() {
+            capture("flatpak-spawn", &["--host", "pgrep", "-f", "--", &pattern], Duration::from_secs(5)).is_some()
+        } else {
+            capture("pgrep", &["-f", "--", &pattern], Duration::from_secs(5)).is_some()
+        }
+    }
+}
+
+fn windows_system_program(relative: &str) -> Result<PathBuf, String> {
+    let root = std::env::var_os("SystemRoot")
+        .filter(|root| !root.is_empty())
+        .map(PathBuf::from)
+        .ok_or_else(|| "Windows didn't provide its system folder".to_string())?;
+    if !root.is_absolute() {
+        return Err("Windows provided a non-absolute system folder".into());
+    }
+    Ok(root.join(relative))
+}
+
+/// Quote the path's metacharacters for pgrep's extended regular expression.
+fn pgrep_pattern(path: &str) -> String {
+    let mut pattern = String::with_capacity(path.len());
+    for c in path.chars() {
+        if matches!(c, '.' | '^' | '$' | '*' | '+' | '?' | '(' | ')' | '[' | ']' | '{' | '}' | '|' | '\\') {
+            pattern.push('\\');
+        }
+        pattern.push(c);
+    }
+    pattern
+}
+
+#[cfg(test)]
+#[cfg(unix)]
+mod tests {
+    use std::io::{BufRead, BufReader};
+    use std::process::Child;
+
+    use super::*;
+
+    struct RunningProbe(Child);
+
+    impl RunningProbe {
+        fn start(path: &str) -> Self {
+            let child = command("/bin/sh")
+                .args(["-c", "printf 'ready\\n'; read line", path])
+                .stdin(Stdio::piped())
+                .stdout(Stdio::piped())
+                .stderr(Stdio::null())
+                .spawn()
+                .unwrap();
+            let mut probe = Self(child);
+            let mut ready = String::new();
+            BufReader::new(probe.0.stdout.take().unwrap()).read_line(&mut ready).unwrap();
+            assert_eq!(ready, "ready\n");
+            probe
+        }
+    }
+
+    impl Drop for RunningProbe {
+        fn drop(&mut self) {
+            let _ = self.0.kill();
+            let _ = self.0.wait();
+        }
+    }
+
+    #[test]
+    fn running_paths_are_matched_literally() {
+        let root = format!("/tmp/artcraft-launcher-process-{}", std::process::id());
+        for (actual, requested, expected) in [
+            ("plain/PhotoCraft.app", "plain/PhotoCraft.app", true),
+            ("Apps (work)/PhotoCraft.app", "Apps (work)/PhotoCraft.app", true),
+            ("Apps [work]/PhotoCraft.app", "Apps [work]/PhotoCraft.app", true),
+            ("other/PhotoCraftXapp", "other/PhotoCraft.app", false),
+            ("symbols/应用.^$*+?()[]{}|\\.app", "symbols/应用.^$*+?()[]{}|\\.app", true),
+        ] {
+            let actual = format!("{root}/{actual}");
+            let requested = format!("{root}/{requested}");
+            let _probe = RunningProbe::start(&actual);
+            assert_eq!(is_running(Path::new(&requested)), expected, "{requested}");
+        }
+    }
+}
+
+#[cfg(test)]
+mod run_tests {
+    use super::*;
+
+    /// A shell command line, for the platform's shell.
+    fn shell(script: &str) -> (&'static str, [&str; 2]) {
+        if cfg!(windows) { ("cmd", ["/C", script]) } else { ("/bin/sh", ["-c", script]) }
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn waiting_for_a_process_ends_when_it_exits() {
+        let mut child = Command::new("ping").args(["-n", "3", "127.0.0.1"]).stdout(Stdio::null()).spawn().unwrap();
+        assert!(!wait_for_exit(child.id(), Duration::from_millis(200)), "it's still running");
+        assert!(wait_for_exit(child.id(), Duration::from_secs(30)), "it has exited");
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn a_failing_helper_reports_its_own_error() {
+        let (program, args) = shell(if cfg!(windows) { "echo no such image 1>&2 & exit /b 3" } else { "echo no such image >&2; exit 3" });
+        assert_eq!(run(program, &args, Duration::from_secs(30)), Err("no such image".into()));
+        assert_eq!(capture(program, &args, Duration::from_secs(30)), None);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn successful_helpers_can_write_past_the_stdout_capture_limit() {
+        let out = run("/bin/sh", &["-c", "head -c 9437184 /dev/zero"], Duration::from_secs(10)).unwrap();
+        assert_eq!(out.len(), 8 << 20);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn successful_helpers_can_write_past_the_stderr_capture_limit() {
+        let out = run("/bin/sh", &["-c", "head -c 9437184 /dev/zero >&2"], Duration::from_secs(10));
+        assert!(out.is_ok(), "the helper should finish without a broken pipe");
+        assert!(out.unwrap().is_empty());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_helper_that_keeps_writing_still_times_out() {
+        let start = Instant::now();
+        let err = run("yes", &[], Duration::from_millis(100)).unwrap_err();
+        assert!(err.contains("didn't finish within"), "{err}");
+        assert!(start.elapsed() < Duration::from_secs(5));
+    }
+
+    #[test]
+    fn a_silent_failure_and_a_success() {
+        let (program, args) = shell("exit 4");
+        let err = run(program, &args, Duration::from_secs(30)).unwrap_err();
+        assert!(err.starts_with(&format!("{program} failed")), "{err}");
+        let (program, args) = shell("echo hello");
+        assert_eq!(run(program, &args, Duration::from_secs(30)).map(|out| out.trim().to_string()), Ok("hello".into()));
+    }
+}
+
+#[cfg(test)]
+mod explorer_tests {
+    use super::*;
+
+    #[cfg(windows)]
+    #[test]
+    fn system_helpers_use_absolute_system_paths() {
+        let root = PathBuf::from(std::env::var_os("SystemRoot").unwrap());
+        assert_eq!(windows_system_program("explorer.exe").unwrap(), root.join("explorer.exe"));
+        assert_eq!(windows_system_program(r"System32\tasklist.exe").unwrap(), root.join(r"System32\tasklist.exe"));
+    }
+
+    #[test]
+    fn explorer_select_quotes_only_the_path() {
+        let arg = explorer_select_arg(Path::new(r"C:\Program Files\PhotoCraft\photocraft.exe"));
+        assert_eq!(arg.unwrap(), r#"/select,"C:\Program Files\PhotoCraft\photocraft.exe""#);
+    }
+
+    #[test]
+    fn explorer_select_without_spaces() {
+        let arg = explorer_select_arg(Path::new(r"C:\Apps\photocraft.exe"));
+        assert_eq!(arg.unwrap(), r#"/select,"C:\Apps\photocraft.exe""#);
+        assert_eq!(explorer_select_arg(Path::new(r#"C:\Apps" /root,C:\x.exe"#)), None);
+    }
+
+    #[test]
+    fn explorer_select_uses_backslashes() {
+        let arg = explorer_select_arg(Path::new("C:/Users/A B/AppData/Local/ArtCraft Launcher/apps/photocraft.exe"));
+        assert_eq!(arg.unwrap(), r#"/select,"C:\Users\A B\AppData\Local\ArtCraft Launcher\apps\photocraft.exe""#);
+    }
+}
+
+#[cfg(test)]
+mod inherited_pipe_tests {
+    use super::*;
+    use std::io::Write;
+
+    fn fixture_args(name: &str, marker: &str) -> Vec<String> {
+        let (_, module) = module_path!().split_once("::").unwrap();
+        // libtest accepts arbitrary skip filters; this one carries our private fixture path.
+        vec!["--ignored".into(), "--exact".into(), format!("{module}::{name}"), "--nocapture".into(), "--skip".into(), marker.into()]
+    }
+
+    fn fixture_dir() -> std::path::PathBuf {
+        let args: Vec<String> = std::env::args().collect();
+        std::path::PathBuf::from(&args[args.iter().position(|arg| arg == "--skip").unwrap() + 1])
+    }
+
+    #[test]
+    #[ignore = "self-spawned subprocess fixture"]
+    fn pipe_holder() {
+        let dir = fixture_dir();
+        let buffer = [b'x'; 64 << 10];
+        // Both streams exceed the capture cap before the direct child exits.
+        for _ in 0..144 {
+            std::io::stdout().write_all(&buffer).unwrap();
+            std::io::stderr().write_all(&buffer).unwrap();
+        }
+        std::fs::write(dir.join("ready"), []).unwrap();
+        // Hold the pipes far longer than any deadline the test tries, so a capture that waited
+        // for them would show; the test's guard stops this early.
+        let start = Instant::now();
+        while !dir.join("stop").exists() && start.elapsed() < HOLD {
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        std::fs::write(dir.join("done"), []).unwrap();
+    }
+
+    #[test]
+    #[ignore = "self-spawned subprocess fixture"]
+    fn pipe_parent() {
+        let dir = fixture_dir();
+        let descendant = command(std::env::current_exe().unwrap()).args(fixture_args("pipe_holder", dir.to_str().unwrap())).spawn().unwrap();
+        std::fs::write(dir.join("spawned"), []).unwrap();
+        // No deadline of its own: run() kills this process at its deadline if it is too slow.
+        let start = Instant::now();
+        while !dir.join("ready").exists() && start.elapsed() < HOLD {
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        assert!(dir.join("ready").exists(), "descendant did not fill both captured pipes");
+        std::fs::write(dir.join("parent-returning"), []).unwrap();
+        // Dropping Child leaves the finite fixture running with inherited stdout/stderr.
+        drop(descendant);
+    }
+
+    /// How long the descendant holds the pipes when nothing stops it.
+    const HOLD: Duration = Duration::from_secs(120);
+
+    struct StopHolder(tempfile::TempDir);
+
+    impl Drop for StopHolder {
+        fn drop(&mut self) {
+            let _ = std::fs::write(self.0.path().join("stop"), []);
+            if !self.0.path().join("spawned").exists() {
+                return;
+            }
+            let start = Instant::now();
+            while !self.0.path().join("done").exists() && start.elapsed() < Duration::from_secs(30) {
+                std::thread::sleep(Duration::from_millis(10));
+            }
+        }
+    }
+
+    #[test]
+    fn exited_helper_does_not_wait_past_deadline_for_inherited_pipes() {
+        let exe = std::env::current_exe().unwrap();
+        // The direct child has to start a second test process and fill both pipes before the
+        // deadline, which can take seconds on a slow or emulated machine. An attempt where it
+        // didn't get that far says nothing about inherited pipes: retry with a longer deadline.
+        let mut deadline = Duration::from_secs(1);
+        loop {
+            let holder = StopHolder(tempfile::tempdir().unwrap());
+            let args = fixture_args("pipe_parent", holder.0.path().to_str().unwrap());
+            let args: Vec<&str> = args.iter().map(String::as_str).collect();
+            let start = Instant::now();
+            let result = run(exe.to_str().unwrap(), &args, deadline);
+            let elapsed = start.elapsed();
+            if !holder.0.path().join("parent-returning").exists() && deadline < Duration::from_secs(16) {
+                deadline *= 4;
+                continue;
+            }
+            assert!(holder.0.path().join("parent-returning").exists(), "direct child did not exit its fixture within {deadline:?}");
+            assert!(
+                matches!(&result, Err(error) if error.contains("didn't finish within")),
+                "expected a pipe deadline error; helper returned success: {}, elapsed: {elapsed:?}",
+                result.is_ok()
+            );
+            // The descendant would hold the pipes for HOLD, far past this bound.
+            assert!(deadline * 2 < HOLD);
+            assert!(elapsed < deadline * 2, "capture exceeded its caller deadline {deadline:?}: {elapsed:?}");
+            // The guard stops the finite descendant and waits for its completion marker on failures too.
+            break;
+        }
+    }
+}
diff --git a/crates/update/src/protocol.rs b/crates/update/src/protocol.rs
new file mode 100644
index 00000000..e52dbb94
--- /dev/null
+++ b/crates/update/src/protocol.rs
@@ -0,0 +1,84 @@
+//! The vocabulary installers and release lookups report in: what a job is doing, how it ended,
+//! where new installs go and what a release lookup found.
+
+use std::collections::BTreeMap;
+
+use serde::{Deserialize, Serialize};
+
+use crate::release::Release;
+
+/// Parent folders for new installs. Existing installations keep their recorded location.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct InstallLocations {
+    pub root: Option<String>,
+    pub per_app: BTreeMap<String, String>,
+}
+
+impl InstallLocations {
+    pub fn folder(&self, app: &str) -> Option<&str> {
+        self.per_app.get(app).map(String::as_str).or(self.root.as_deref())
+    }
+}
+
+/// The answer to "what's the latest release of this app?".
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub enum LatestRelease {
+    Found(Release),
+    /// The repo exists but has no published release.
+    None,
+    /// Couldn't find out (offline, rate-limited, unreadable answer).
+    Failed(String),
+}
+
+/// What a running job is doing.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum JobPhase {
+    Downloading {
+        done: u64,
+        total: u64,
+    },
+    /// The connection dropped; trying again shortly, from where it stopped.
+    Reconnecting {
+        done: u64,
+        total: u64,
+    },
+    Verifying,
+    /// The system's installer is busy with another app; this one goes next.
+    Waiting,
+    /// Waiting on the OS installer (MSI) or copying files.
+    Installing,
+    Removing,
+}
+
+/// The `JobFinished` error a paused job ends with (not a failure).
+pub const PAUSED: &str = "paused";
+/// The `JobFinished` error a cancelled job ends with (not a failure).
+pub const CANCELLED: &str = "cancelled";
+/// The `JobFinished` error of an install whose system prompt (password, Windows Installer) the
+/// user dismissed after the download finished (not a failure).
+pub const INSTALL_CANCELLED: &str = "install cancelled";
+
+/// Where release information came from.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Source {
+    /// ArtCraft's release feed (storyteller-web), which polls GitHub for everyone.
+    Feed,
+    /// The GitHub REST API.
+    GitHubApi,
+    /// github.com release pages (no API quota; used when the API is rate-limited).
+    GitHubPages,
+    /// Saved answers from an earlier check.
+    Cache,
+}
+
+impl Source {
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Feed => "ArtCraft",
+            Self::GitHubApi => "GitHub",
+            Self::GitHubPages => "GitHub (release pages)",
+            Self::Cache => "saved results",
+        }
+    }
+}
diff --git a/crates/update/src/proxy.rs b/crates/update/src/proxy.rs
new file mode 100644
index 00000000..87aa3524
--- /dev/null
+++ b/crates/update/src/proxy.rs
@@ -0,0 +1,281 @@
+//! Which HTTP proxy the launcher uses: the proxy environment variables first, else the proxy set
+//! in the OS (Windows Internet Settings, macOS network settings). Automatic configuration (PAC
+//! scripts, WPAD) is not supported.
+
+use ureq::{Proxy, ProxyProtocol};
+
+/// A manually configured proxy read from the OS settings.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SystemProxy {
+    pub host: String,
+    pub port: Option<u16>,
+    /// Hosts that skip the proxy, in `NO_PROXY` form (`example.com`, `*.example.com`, `10.*`).
+    pub bypass: Vec<String>,
+    /// Where it came from, for the log.
+    pub source: &'static str,
+}
+
+/// The proxy every agent uses, or `None` to connect directly. Logs the choice at info level,
+/// without any user name or password.
+pub fn pick() -> Option<Proxy> {
+    if let Some(proxy) = Proxy::try_from_env() {
+        let mut builder = Proxy::builder(proxy.protocol()).host(proxy.host()).port(proxy.port());
+        if let Some(user) = proxy.username() {
+            builder = builder.username(user);
+        }
+        if let Some(pass) = proxy.password() {
+            builder = builder.password(pass);
+        }
+        if let Ok(no_proxy_env) = std::env::var("NO_PROXY").or_else(|_| std::env::var("no_proxy")) {
+            for entry in no_proxy_env.split(',') {
+                let entry = entry.trim();
+                if !entry.is_empty() {
+                    builder = builder.no_proxy(entry);
+                }
+            }
+        }
+        for entry in ["localhost", "127.0.0.1", "[::1]"] {
+            builder = builder.no_proxy(entry);
+        }
+        if let Ok(p) = builder.build() {
+            log::info!("HTTP proxy: {} {}:{} (from environment variables)", p.protocol(), p.host(), p.port());
+            return Some(p);
+        }
+        log::info!("HTTP proxy: {} {}:{} (from environment variables)", proxy.protocol(), proxy.host(), proxy.port());
+        return Some(proxy);
+    }
+    let system = system()?;
+    match to_proxy(&system) {
+        Ok(proxy) => {
+            log::info!("HTTP proxy: {} {}:{} (from {})", proxy.protocol(), proxy.host(), proxy.port(), system.source);
+            Some(proxy)
+        }
+        Err(e) => {
+            log::warn!("ignoring the proxy in {} ({e}); connecting directly", system.source);
+            None
+        }
+    }
+}
+
+/// A ureq proxy for `system`. Loopback addresses always go direct, as they do on Windows and
+/// macOS.
+pub fn to_proxy(system: &SystemProxy) -> Result<Proxy, ureq::Error> {
+    let mut builder = Proxy::builder(ProxyProtocol::Http).host(&system.host);
+    if let Some(port) = system.port {
+        builder = builder.port(port);
+    }
+    for entry in ["localhost", "127.0.0.1", "[::1]"].iter().copied().chain(system.bypass.iter().map(String::as_str)) {
+        builder = builder.no_proxy(entry);
+    }
+    builder.build()
+}
+
+#[cfg(windows)]
+fn system() -> Option<SystemProxy> {
+    use winreg::RegKey;
+    use winreg::enums::HKEY_CURRENT_USER;
+
+    let key = RegKey::predef(HKEY_CURRENT_USER).open_subkey(r"Software\Microsoft\Windows\CurrentVersion\Internet Settings").ok()?;
+    let enabled: u32 = key.get_value("ProxyEnable").unwrap_or(0);
+    if enabled == 0 {
+        return None;
+    }
+    let server: String = key.get_value("ProxyServer").ok()?;
+    let overrides: String = key.get_value("ProxyOverride").unwrap_or_default();
+    let (host, port) = windows_proxy_server(&server)?;
+    Some(SystemProxy { host, port, bypass: windows_bypass(&overrides), source: "Windows proxy settings" })
+}
+
+#[cfg(target_os = "macos")]
+fn system() -> Option<SystemProxy> {
+    let out = crate::process::capture("/usr/sbin/scutil", &["--proxy"], std::time::Duration::from_secs(3))?;
+    parse_scutil(&out)
+}
+
+#[cfg(not(any(windows, target_os = "macos")))]
+fn system() -> Option<SystemProxy> {
+    // Linux and the BSDs: desktop proxy settings reach programs through the environment.
+    None
+}
+
+/// Parses Windows' `ProxyServer` value: either `host:port` for every protocol, or a list such as
+/// `http=h:p;https=h:p;socks=h:p`. Prefers the HTTPS entry (every request is HTTPS), then HTTP.
+/// SOCKS-only settings are ignored.
+pub fn windows_proxy_server(value: &str) -> Option<(String, Option<u16>)> {
+    let entries: Vec<&str> = value.split([';', ' ']).map(str::trim).filter(|e| !e.is_empty()).collect();
+    let chosen = if entries.iter().any(|e| e.contains('=')) {
+        let find = |scheme: &str| {
+            entries.iter().find_map(|e| e.split_once('=').filter(|(k, _)| k.trim().eq_ignore_ascii_case(scheme)).map(|(_, v)| v.trim()))
+        };
+        find("https").or_else(|| find("http"))?
+    } else {
+        entries.first().copied()?
+    };
+    host_port(chosen)
+}
+
+/// Splits `host:port`, `http://host:port/`, `[::1]:8080` and similar into host and port.
+fn host_port(value: &str) -> Option<(String, Option<u16>)> {
+    let rest = match value.split_once("://") {
+        Some((scheme, rest)) if scheme.eq_ignore_ascii_case("http") => rest,
+        Some(_) => return None,
+        None => value,
+    };
+    let rest = rest.trim_end_matches('/');
+    // Credentials never come from these settings; refuse rather than mis-parse.
+    if rest.is_empty() || rest.contains(['@', '/', '?', '#']) {
+        return None;
+    }
+    if rest.starts_with('[') {
+        let (host, after) = rest.split_once(']')?;
+        let host = format!("{host}]");
+        return match after.strip_prefix(':') {
+            Some(port) => Some((host, Some(port.parse().ok()?))),
+            None if after.is_empty() => Some((host, None)),
+            None => None,
+        };
+    }
+    match rest.split_once(':') {
+        Some((host, port)) if !host.is_empty() && !port.contains(':') => Some((host.to_string(), Some(port.parse().ok()?))),
+        Some(_) => None,
+        None => Some((rest.to_string(), None)),
+    }
+}
+
+/// Parses Windows' `ProxyOverride` bypass list (`*.local;10.*;<local>`). `<local>` (plain host
+/// names without a dot) has no `NO_PROXY` equivalent and is dropped.
+pub fn windows_bypass(value: &str) -> Vec<String> {
+    value.split([';', ' ']).map(str::trim).filter(|e| !e.is_empty() && !e.eq_ignore_ascii_case("<local>")).map(str::to_string).collect()
+}
+
+/// Parses `scutil --proxy` output: the HTTPS proxy when enabled, else the HTTP proxy, plus the
+/// exceptions list.
+pub fn parse_scutil(out: &str) -> Option<SystemProxy> {
+    let mut fields: Vec<(&str, &str)> = Vec::new();
+    let mut bypass = Vec::new();
+    let mut in_exceptions = false;
+    for line in out.lines().map(str::trim) {
+        if in_exceptions {
+            if line.starts_with('}') {
+                in_exceptions = false;
+            } else if let Some((_, v)) = line.split_once(" : ") {
+                let v = v.trim();
+                if !v.is_empty() {
+                    bypass.push(v.to_string());
+                }
+            }
+            continue;
+        }
+        let Some((k, v)) = line.split_once(" : ") else { continue };
+        let (k, v) = (k.trim(), v.trim());
+        if k == "ExceptionsList" && v.starts_with("<array>") {
+            in_exceptions = !v.ends_with('}');
+        } else {
+            fields.push((k, v));
+        }
+    }
+    let get = |key: &str| fields.iter().find(|(k, _)| *k == key).map(|(_, v)| *v);
+    ["HTTPS", "HTTP"].into_iter().find_map(|kind| {
+        if get(&format!("{kind}Enable")) != Some("1") {
+            return None;
+        }
+        let host = get(&format!("{kind}Proxy")).filter(|h| !h.is_empty() && !h.contains(['@', '/', ' ']))?;
+        let port = match get(&format!("{kind}Port")) {
+            Some(p) => Some(p.parse().ok()?),
+            None => None,
+        };
+        Some(SystemProxy { host: host.to_string(), port, bypass: bypass.clone(), source: "macOS proxy settings" })
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn hp(host: &str, port: Option<u16>) -> Option<(String, Option<u16>)> {
+        Some((host.to_string(), port))
+    }
+
+    #[test]
+    fn windows_single_proxy_for_everything() {
+        assert_eq!(windows_proxy_server("proxy.corp:8080"), hp("proxy.corp", Some(8080)));
+        assert_eq!(windows_proxy_server("127.0.0.1:7890"), hp("127.0.0.1", Some(7890)));
+        assert_eq!(windows_proxy_server("proxy.corp"), hp("proxy.corp", None));
+        assert_eq!(windows_proxy_server("http://proxy.corp:3128/"), hp("proxy.corp", Some(3128)));
+        assert_eq!(windows_proxy_server("[::1]:8080"), hp("[::1]", Some(8080)));
+    }
+
+    #[test]
+    fn windows_per_protocol_list_prefers_https() {
+        assert_eq!(windows_proxy_server("http=h1:80;https=h2:443;ftp=h3:21;socks=h4:1080"), hp("h2", Some(443)));
+        assert_eq!(windows_proxy_server("ftp=h3:21;http=h1:8080"), hp("h1", Some(8080)));
+        assert_eq!(windows_proxy_server("HTTPS=h2:8443 ; "), hp("h2", Some(8443)));
+    }
+
+    #[test]
+    fn windows_settings_that_cannot_be_used() {
+        assert_eq!(windows_proxy_server(""), None);
+        assert_eq!(windows_proxy_server("socks=h4:1080"), None);
+        assert_eq!(windows_proxy_server("socks5://h4:1080"), None);
+        assert_eq!(windows_proxy_server("proxy.corp:notaport"), None);
+        assert_eq!(windows_proxy_server("proxy.corp:99999"), None);
+        assert_eq!(windows_proxy_server("user:pw@proxy.corp:8080"), None);
+    }
+
+    #[test]
+    fn windows_bypass_list() {
+        assert_eq!(windows_bypass("*.local;10.*; localhost;<local>"), ["*.local", "10.*", "localhost"]);
+        assert!(windows_bypass("").is_empty());
+    }
+
+    const SCUTIL: &str = "<dictionary> {
+  ExceptionsList : <array> {
+    0 : *.local
+    1 : 169.254/16
+  }
+  FTPPassive : 1
+  HTTPEnable : 1
+  HTTPPort : 8080
+  HTTPProxy : http.corp
+  HTTPSEnable : 1
+  HTTPSPort : 3128
+  HTTPSProxy : https.corp
+  SOCKSEnable : 0
+}
+";
+
+    #[test]
+    fn scutil_https_proxy_with_exceptions() {
+        let p = parse_scutil(SCUTIL).unwrap();
+        assert_eq!((p.host.as_str(), p.port), ("https.corp", Some(3128)));
+        assert_eq!(p.bypass, ["*.local", "169.254/16"]);
+    }
+
+    #[test]
+    fn scutil_falls_back_to_http_proxy() {
+        let out = SCUTIL.replace("HTTPSEnable : 1", "HTTPSEnable : 0");
+        let p = parse_scutil(&out).unwrap();
+        assert_eq!((p.host.as_str(), p.port), ("http.corp", Some(8080)));
+    }
+
+    #[test]
+    fn scutil_without_a_proxy() {
+        let out = "<dictionary> {\n  ExceptionsList : <array> {\n    0 : *.local\n  }\n  FTPPassive : 1\n  HTTPEnable : 0\n  HTTPSEnable : 0\n}\n";
+        assert_eq!(parse_scutil(out), None);
+        assert_eq!(parse_scutil(""), None);
+        assert_eq!(parse_scutil("HTTPSEnable : 1\nHTTPSProxy : \nHTTPSPort : 1\n"), None);
+    }
+
+    #[test]
+    fn system_proxy_becomes_a_ureq_proxy_that_skips_loopback() {
+        let p = to_proxy(&SystemProxy { host: "proxy.corp".into(), port: Some(8080), bypass: vec!["*.local".into()], source: "test" }).unwrap();
+        assert_eq!((p.protocol(), p.host(), p.port()), (ProxyProtocol::Http, "proxy.corp", 8080));
+        for (url, direct) in
+            [("http://127.0.0.1:1/", true), ("http://localhost/", true), ("https://nas.local/", true), ("https://github.com/", false)]
+        {
+            assert_eq!(p.is_no_proxy(&url.parse().unwrap()), direct, "{url}");
+        }
+        let p = to_proxy(&SystemProxy { host: "proxy.corp".into(), port: None, bypass: vec![], source: "test" }).unwrap();
+        assert_eq!(p.port(), 80);
+    }
+}
diff --git a/crates/update/src/queue.rs b/crates/update/src/queue.rs
new file mode 100644
index 00000000..b30713a0
--- /dev/null
+++ b/crates/update/src/queue.rs
@@ -0,0 +1,512 @@
+//! One system installer at a time.
+//!
+//! apt, dnf, rpm and the Windows Installer each hold a system-wide lock: an install started
+//! while another runs fails. Jobs wait their turn here instead. Where the installer takes
+//! several packages, the jobs waiting for the same command share one call, so the password is
+//! asked for once.
+
+use std::ffi::OsString;
+use std::sync::{Condvar, Mutex, MutexGuard, PoisonError};
+use std::time::Duration;
+
+use crate::protocol::CANCELLED;
+
+type Outcome = Result<(), String>;
+
+struct Waiting {
+    id: u64,
+    command: Vec<OsString>,
+    target: OsString,
+}
+
+struct State {
+    busy: bool,
+    next_id: u64,
+    waiting: Vec<Waiting>,
+    /// The jobs of the call in progress.
+    running: Vec<u64>,
+    finished: Vec<(u64, Outcome)>,
+}
+
+pub struct Queue {
+    state: Mutex<State>,
+    changed: Condvar,
+}
+
+/// Frees the installer when a call ends (even by unwinding) and hands its outcome to the other
+/// jobs of the call.
+struct Turn<'a> {
+    queue: &'a Queue,
+    others: Vec<u64>,
+    outcome: Outcome,
+}
+
+impl Drop for Turn<'_> {
+    fn drop(&mut self) {
+        let mut state = self.queue.lock();
+        state.busy = false;
+        state.running.clear();
+        for id in self.others.drain(..) {
+            state.finished.push((id, self.outcome.clone()));
+        }
+        self.queue.changed.notify_all();
+    }
+}
+
+impl Default for Queue {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Queue {
+    pub const fn new() -> Self {
+        let state = State { busy: false, next_id: 0, waiting: Vec::new(), running: Vec::new(), finished: Vec::new() };
+        Self { state: Mutex::new(state), changed: Condvar::new() }
+    }
+
+    fn lock(&self) -> MutexGuard<'_, State> {
+        self.state.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    /// Until something changes, or long enough to ask again whether the job was cancelled.
+    fn wait<'a>(&self, state: MutexGuard<'a, State>) -> MutexGuard<'a, State> {
+        self.changed.wait_timeout(state, Duration::from_millis(100)).unwrap_or_else(PoisonError::into_inner).0
+    }
+
+    /// Runs `work` once no other installer is running. `turn(true)` says it has to wait,
+    /// `turn(false)` that the wait is over. `None` when `cancelled` (asked a few times a second,
+    /// so it must not block) said so during the wait; `work` then never ran.
+    pub fn alone<R>(&self, cancelled: &dyn Fn() -> bool, turn: &mut dyn FnMut(bool), work: impl FnOnce() -> R) -> Option<R> {
+        let mut state = self.lock();
+        let mut waited = false;
+        loop {
+            if waited && cancelled() {
+                return None;
+            }
+            if !state.busy {
+                break;
+            }
+            if waited {
+                state = self.wait(state);
+            } else {
+                waited = true;
+                drop(state);
+                turn(true);
+                state = self.lock();
+            }
+        }
+        state.busy = true;
+        drop(state);
+        if waited {
+            turn(false);
+        }
+        let _turn = Turn { queue: self, others: Vec::new(), outcome: Ok(()) };
+        Some(work())
+    }
+
+    /// Runs `exec(command, targets)` once no other installer is running, with the targets of
+    /// every job waiting for the same `command`, and gives each of those jobs its outcome.
+    /// `turn(true)` says the job has to wait, `turn(false)` that its call has started.
+    ///
+    /// A job that is waiting leaves with [`CANCELLED`] once `cancelled` (asked a few times a
+    /// second, so it must not block) says so; once its call has started it sees it through.
+    pub fn batched(
+        &self,
+        command: Vec<OsString>,
+        target: OsString,
+        cancelled: &dyn Fn() -> bool,
+        turn: &mut dyn FnMut(bool),
+        exec: &dyn Fn(&[OsString], &[OsString]) -> Outcome,
+    ) -> Outcome {
+        let mut state = self.lock();
+        let id = state.next_id;
+        state.next_id = state.next_id.wrapping_add(1);
+        state.waiting.push(Waiting { id, command: command.clone(), target });
+        let (mut waited, mut started) = (false, false);
+        loop {
+            if let Some(at) = state.finished.iter().position(|(done, _)| *done == id) {
+                return state.finished.swap_remove(at).1;
+            }
+            // Another job took this one into its call.
+            let running = state.running.contains(&id);
+            if !running && waited && cancelled() {
+                state.waiting.retain(|w| w.id != id);
+                return Err(CANCELLED.into());
+            }
+            if !running && !state.busy {
+                break;
+            }
+            let tell = if running { waited && !started } else { !waited };
+            if tell {
+                (waited, started) = (true, running);
+                drop(state);
+                turn(!running);
+                state = self.lock();
+            } else {
+                state = self.wait(state);
+            }
+        }
+        let (batch, rest): (Vec<Waiting>, Vec<Waiting>) = std::mem::take(&mut state.waiting).into_iter().partition(|w| w.command == command);
+        state.waiting = rest;
+        state.busy = true;
+        state.running = batch.iter().map(|w| w.id).collect();
+        self.changed.notify_all();
+        drop(state);
+        if waited {
+            turn(false);
+        }
+        let others = batch.iter().map(|w| w.id).filter(|other| *other != id).collect();
+        let targets: Vec<OsString> = batch.into_iter().map(|w| w.target).collect();
+        let mut call = Turn { queue: self, others, outcome: Err("the system installer was interrupted".into()) };
+        let outcome = exec(&command, &targets);
+        call.outcome.clone_from(&outcome);
+        outcome
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::atomic::AtomicBool;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::mpsc;
+
+    use super::*;
+
+    fn os(s: &str) -> OsString {
+        OsString::from(s)
+    }
+
+    fn line(parts: &[&str]) -> Vec<OsString> {
+        parts.iter().map(|p| os(p)).collect()
+    }
+
+    fn install() -> Vec<OsString> {
+        line(&["apt-get", "install", "-y"])
+    }
+
+    fn remove() -> Vec<OsString> {
+        line(&["apt-get", "remove", "-y"])
+    }
+
+    /// Every call made, as `command + targets` with the targets sorted.
+    #[derive(Default)]
+    struct Calls(Mutex<Vec<Vec<OsString>>>);
+
+    impl Calls {
+        fn record(&self, command: &[OsString], targets: &[OsString]) {
+            let mut targets = targets.to_vec();
+            targets.sort();
+            self.0.lock().unwrap().push(command.iter().cloned().chain(targets).collect());
+        }
+
+        fn taken(&self) -> Vec<Vec<OsString>> {
+            let mut calls = std::mem::take(&mut *self.0.lock().unwrap());
+            calls.sort();
+            calls
+        }
+    }
+
+    /// Starts `jobs` (command, target) while an install is running, so they all wait; lets that
+    /// install finish once every one of them has said it is waiting. Returns their outcomes.
+    fn behind_a_running_install(
+        queue: &Queue,
+        jobs: &[(Vec<OsString>, &str)],
+        exec: &(dyn Fn(&[OsString], &[OsString]) -> Outcome + Sync),
+    ) -> Vec<Option<Outcome>> {
+        let (started, has_started) = mpsc::channel();
+        let (release, released) = mpsc::channel::<()>();
+        let (turned, turns) = mpsc::channel();
+        std::thread::scope(|scope| {
+            scope.spawn(move || {
+                queue.alone(&|| false, &mut |_| {}, || {
+                    started.send(()).unwrap();
+                    released.recv().unwrap();
+                });
+            });
+            has_started.recv().unwrap();
+            let handles: Vec<_> = jobs
+                .iter()
+                .map(|(command, target)| {
+                    let turned = turned.clone();
+                    scope.spawn(move || {
+                        let mut turn = |waiting: bool| {
+                            if waiting {
+                                turned.send(()).unwrap();
+                            }
+                        };
+                        queue.batched(command.clone(), os(target), &|| false, &mut turn, exec)
+                    })
+                })
+                .collect();
+            for _ in jobs {
+                turns.recv().unwrap();
+            }
+            release.send(()).unwrap();
+            handles.into_iter().map(|h| h.join().ok()).collect()
+        })
+    }
+
+    #[test]
+    fn jobs_that_wait_together_share_one_call_per_command() {
+        let queue = Queue::new();
+        let calls = Calls::default();
+        let jobs = [(install(), "a.deb"), (install(), "b.deb"), (remove(), "photocraft"), (install(), "c.deb")];
+        let results = behind_a_running_install(&queue, &jobs, &|command, targets| {
+            calls.record(command, targets);
+            Ok(())
+        });
+        assert_eq!(results, vec![Some(Ok(())); 4]);
+        assert_eq!(calls.taken(), [line(&["apt-get", "install", "-y", "a.deb", "b.deb", "c.deb"]), line(&["apt-get", "remove", "-y", "photocraft"])]);
+    }
+
+    #[test]
+    fn installers_never_run_at_the_same_time() {
+        let queue = Queue::new();
+        let (inside, most, handled) = (AtomicUsize::new(0), AtomicUsize::new(0), AtomicUsize::new(0));
+        let enter = || {
+            most.fetch_max(inside.fetch_add(1, Ordering::SeqCst) + 1, Ordering::SeqCst);
+            std::thread::sleep(Duration::from_millis(3));
+            inside.fetch_sub(1, Ordering::SeqCst);
+        };
+        std::thread::scope(|scope| {
+            for i in 0..24 {
+                let (queue, enter, handled) = (&queue, &enter, &handled);
+                scope.spawn(move || {
+                    std::thread::sleep(Duration::from_millis(i % 5));
+                    let exec = |_: &[OsString], targets: &[OsString]| {
+                        enter();
+                        handled.fetch_add(targets.len(), Ordering::SeqCst);
+                        Ok(())
+                    };
+                    match i % 3 {
+                        0 => queue.batched(install(), os(&format!("{i}.deb")), &|| false, &mut |_| {}, &exec).unwrap(),
+                        1 => queue.batched(remove(), os(&format!("app{i}")), &|| false, &mut |_| {}, &exec).unwrap(),
+                        _ => queue
+                            .alone(&|| false, &mut |_| {}, || {
+                                enter();
+                                handled.fetch_add(1, Ordering::SeqCst);
+                            })
+                            .unwrap(),
+                    }
+                });
+            }
+        });
+        assert_eq!(most.load(Ordering::SeqCst), 1);
+        assert_eq!(handled.load(Ordering::SeqCst), 24);
+    }
+
+    #[test]
+    fn a_job_arriving_mid_install_waits_then_runs() {
+        let queue = Queue::new();
+        let calls = Calls::default();
+        let (started, has_started) = mpsc::channel();
+        let (release, released) = mpsc::channel::<()>();
+        let (turned, turns) = mpsc::channel();
+        std::thread::scope(|scope| {
+            let (queue, calls) = (&queue, &calls);
+            let first = scope.spawn(move || {
+                queue.batched(install(), os("a.deb"), &|| false, &mut |_| panic!("the first job never waits"), &|command, targets| {
+                    calls.record(command, targets);
+                    started.send(()).unwrap();
+                    released.recv().unwrap();
+                    Ok(())
+                })
+            });
+            has_started.recv().unwrap();
+            let second = scope.spawn(move || {
+                queue.batched(install(), os("b.deb"), &|| false, &mut |waiting| turned.send(waiting).unwrap(), &|command, targets| {
+                    calls.record(command, targets);
+                    Ok(())
+                })
+            });
+            assert!(turns.recv().unwrap(), "the second job says it is waiting");
+            assert_eq!(calls.0.lock().unwrap().len(), 1, "and does not start while the first runs");
+            release.send(()).unwrap();
+            assert_eq!(first.join().unwrap(), Ok(()));
+            assert_eq!(second.join().unwrap(), Ok(()));
+            assert!(!turns.recv().unwrap(), "then that its turn came");
+        });
+        assert_eq!(calls.taken(), [line(&["apt-get", "install", "-y", "a.deb"]), line(&["apt-get", "install", "-y", "b.deb"])]);
+    }
+
+    #[test]
+    fn a_job_taken_into_another_jobs_call_hears_it_started() {
+        let queue = Queue::new();
+        let (started, has_started) = mpsc::channel();
+        let (release, released) = mpsc::channel::<()>();
+        let (turned, turns) = mpsc::channel();
+        let installing = AtomicUsize::new(0);
+        std::thread::scope(|scope| {
+            let (queue, installing) = (&queue, &installing);
+            scope.spawn(move || {
+                queue.alone(&|| false, &mut |_| {}, || {
+                    started.send(()).unwrap();
+                    released.recv().unwrap();
+                });
+            });
+            has_started.recv().unwrap();
+            for file in ["a.deb", "b.deb"] {
+                let turned = turned.clone();
+                scope.spawn(move || {
+                    let mut turn = |waiting: bool| {
+                        if !waiting {
+                            installing.fetch_add(1, Ordering::SeqCst);
+                        }
+                        turned.send(waiting).unwrap();
+                    };
+                    // The call lasts until both jobs know it is under way.
+                    let exec = |_: &[OsString], targets: &[OsString]| {
+                        assert_eq!(targets.len(), 2);
+                        while installing.load(Ordering::SeqCst) < 2 {
+                            std::thread::sleep(Duration::from_millis(1));
+                        }
+                        Ok(())
+                    };
+                    assert_eq!(queue.batched(install(), os(file), &|| false, &mut turn, &exec), Ok(()));
+                });
+            }
+            assert!(turns.recv().unwrap() && turns.recv().unwrap());
+            release.send(()).unwrap();
+        });
+        assert_eq!(turns.try_iter().collect::<Vec<_>>(), [false, false]);
+    }
+
+    #[test]
+    fn a_dismissed_prompt_cancels_every_job_of_the_call() {
+        let queue = Queue::new();
+        let calls = Calls::default();
+        let jobs = [(install(), "a.deb"), (install(), "b.deb"), (install(), "c.deb")];
+        let results = behind_a_running_install(&queue, &jobs, &|command, targets| {
+            calls.record(command, targets);
+            Err("cancelled".into())
+        });
+        assert_eq!(calls.taken().len(), 1);
+        assert_eq!(results, vec![Some(Err("cancelled".to_string())); 3]);
+    }
+
+    #[test]
+    fn a_waiting_job_can_be_cancelled_and_is_left_out_of_the_call() {
+        let queue = Queue::new();
+        let calls = Calls::default();
+        let cancel = AtomicBool::new(false);
+        let (started, has_started) = mpsc::channel();
+        let (release, released) = mpsc::channel::<()>();
+        let (turned, turns) = mpsc::channel();
+        std::thread::scope(|scope| {
+            let (queue, calls, cancel) = (&queue, &calls, &cancel);
+            scope.spawn(move || {
+                queue.alone(&|| false, &mut |_| {}, || {
+                    started.send(()).unwrap();
+                    released.recv().unwrap();
+                });
+            });
+            has_started.recv().unwrap();
+            let exec = |command: &[OsString], targets: &[OsString]| {
+                calls.record(command, targets);
+                Ok(())
+            };
+            let turned_too = turned.clone();
+            let leaving = scope.spawn(move || {
+                queue.batched(install(), os("a.deb"), &|| cancel.load(Ordering::SeqCst), &mut |waiting| turned.send(waiting).unwrap(), &exec)
+            });
+            let staying =
+                scope.spawn(move || queue.batched(install(), os("b.deb"), &|| false, &mut |waiting| turned_too.send(waiting).unwrap(), &exec));
+            assert!(turns.recv().unwrap() && turns.recv().unwrap());
+            cancel.store(true, Ordering::SeqCst);
+            // It leaves while the other install is still running, without waiting for its turn.
+            assert_eq!(leaving.join().unwrap(), Err("cancelled".to_string()));
+            assert!(calls.0.lock().unwrap().is_empty());
+            release.send(()).unwrap();
+            assert_eq!(staying.join().unwrap(), Ok(()));
+        });
+        assert_eq!(calls.taken(), [line(&["apt-get", "install", "-y", "b.deb"])]);
+    }
+
+    #[test]
+    fn waiting_alone_for_the_installer_can_be_cancelled() {
+        let queue = Queue::new();
+        let (started, has_started) = mpsc::channel();
+        let (release, released) = mpsc::channel::<()>();
+        std::thread::scope(|scope| {
+            let queue = &queue;
+            scope.spawn(move || {
+                queue.alone(&|| false, &mut |_| {}, || {
+                    started.send(()).unwrap();
+                    released.recv().unwrap();
+                });
+            });
+            has_started.recv().unwrap();
+            let ran = queue.alone(&|| true, &mut |_| {}, || panic!("a cancelled job never runs"));
+            assert_eq!(ran, None);
+            release.send(()).unwrap();
+        });
+    }
+
+    #[test]
+    fn a_job_whose_call_has_started_sees_it_through() {
+        let queue = Queue::new();
+        let cancel = AtomicBool::new(false);
+        let (in_call, is_in_call) = mpsc::channel();
+        let (finish, finished) = mpsc::channel::<()>();
+        let finished = Mutex::new(finished);
+        let jobs = [(install(), "a.deb"), (install(), "b.deb")];
+        std::thread::scope(|scope| {
+            let (queue, cancel, finished) = (&queue, &cancel, &finished);
+            let (started, has_started) = mpsc::channel();
+            let (release, released) = mpsc::channel::<()>();
+            let (turned, turns) = mpsc::channel();
+            scope.spawn(move || {
+                queue.alone(&|| false, &mut |_| {}, || {
+                    started.send(()).unwrap();
+                    released.recv().unwrap();
+                });
+            });
+            has_started.recv().unwrap();
+            let handles: Vec<_> = jobs
+                .iter()
+                .map(|(command, target)| {
+                    let (turned, in_call) = (turned.clone(), in_call.clone());
+                    scope.spawn(move || {
+                        let mut turn = |waiting: bool| {
+                            if waiting {
+                                turned.send(()).unwrap();
+                            }
+                        };
+                        queue.batched(command.clone(), os(target), &|| cancel.load(Ordering::SeqCst), &mut turn, &|_, targets| {
+                            assert_eq!(targets.len(), 2);
+                            in_call.send(()).unwrap();
+                            finished.lock().unwrap().recv().unwrap();
+                            Ok(())
+                        })
+                    })
+                })
+                .collect();
+            turns.recv().unwrap();
+            turns.recv().unwrap();
+            release.send(()).unwrap();
+            is_in_call.recv().unwrap();
+            // Cancelled mid-call: the job taken into the other's call has time to notice, and must not leave.
+            cancel.store(true, Ordering::SeqCst);
+            std::thread::sleep(Duration::from_millis(300));
+            finish.send(()).unwrap();
+            for h in handles {
+                assert_eq!(h.join().unwrap(), Ok(()));
+            }
+        });
+    }
+
+    #[test]
+    fn an_installer_that_dies_frees_the_queue_and_fails_its_jobs() {
+        let queue = Queue::new();
+        let jobs = [(install(), "a.deb"), (install(), "b.deb")];
+        let results = behind_a_running_install(&queue, &jobs, &|_, targets| {
+            assert_eq!(targets.len(), 2);
+            panic!("the installer died")
+        });
+        // The job that made the call unwound; the other was told.
+        assert!(results.contains(&None), "{results:?}");
+        assert!(results.contains(&Some(Err("the system installer was interrupted".to_string()))), "{results:?}");
+        assert_eq!(queue.batched(install(), os("c.deb"), &|| false, &mut |_| {}, &|_, _| Ok(())), Ok(()));
+    }
+}
diff --git a/crates/update/src/release.rs b/crates/update/src/release.rs
new file mode 100644
index 00000000..ca5419e4
--- /dev/null
+++ b/crates/update/src/release.rs
@@ -0,0 +1,438 @@
+//! GitHub releases: reading the API's answer and `SHA256SUMS.txt`.
+//!
+//! Everything here is untrusted input. Sizes are bounded by the caller, download links must point
+//! at the app's own release downloads, and checksums must look like checksums.
+
+use serde::{Deserialize, Serialize};
+
+use crate::version::{self, Version};
+
+/// One downloadable file of a release.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Asset {
+    pub name: String,
+    /// Bytes; 0 when unknown.
+    pub size: u64,
+    /// `https://github.com/<repo>/releases/download/<tag>/<name>`.
+    pub url: String,
+    /// Lowercase hex SHA-256, when GitHub or `SHA256SUMS.txt` told us.
+    pub sha256: Option<String>,
+}
+
+/// A published release of one app.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Release {
+    pub tag: String,
+    pub version: Option<Version>,
+    /// `PhotoCraft v0.5.0`
+    pub name: String,
+    /// Unix seconds; `None` when only the tag is known.
+    pub published_at: Option<i64>,
+    pub html_url: String,
+    /// Release notes (Markdown), capped.
+    pub notes: String,
+    pub prerelease: bool,
+    pub assets: Vec<Asset>,
+}
+
+impl Release {
+    pub fn version_label(&self) -> String {
+        self.version.as_ref().map_or_else(|| self.tag.clone(), ToString::to_string)
+    }
+
+    /// Fills in checksums from a `SHA256SUMS.txt` for assets that don't have one.
+    pub fn apply_sums(&mut self, sums: &[(String, String)]) {
+        for asset in &mut self.assets {
+            if asset.sha256.is_none() {
+                asset.sha256 = sums.iter().find(|(_, n)| *n == asset.name).map(|(h, _)| h.clone());
+            }
+        }
+    }
+
+    pub fn sums_asset(&self) -> Option<&Asset> {
+        self.assets.iter().find(|a| a.name == "SHA256SUMS.txt")
+    }
+}
+
+const MAX_NOTES: usize = 64 * 1024;
+
+fn is_hex64(s: &str) -> bool {
+    s.len() == 64 && s.bytes().all(|b| b.is_ascii_hexdigit())
+}
+
+/// Whether `url` is safe to hand to the system browser from untrusted text (release notes):
+/// `https` only, a host, no user-info, no spaces or control characters, and no shell metacharacters.
+///
+/// The system opener is not always a direct `open`: the pinned `webbrowser` crate's WSL fallback
+/// passes the URL to `cmd.exe /c start` while escaping only `^` and `&`, so a character like `|`
+/// in an otherwise valid URL becomes a command separator (CWE-78). Because a legitimate
+/// `https://` web link never needs these characters unescaped, we refuse any URL that contains a
+/// shell/cmd metacharacter rather than rely on the opener to neutralise it.
+pub fn safe_web_link(url: &str) -> bool {
+    let Some(rest) = url.strip_prefix("https://") else { return false };
+    let authority = rest.split(['/', '?', '#']).next().unwrap_or_default();
+    url.len() <= 2000
+        && !authority.is_empty()
+        && !authority.contains(['@', '\\'])
+        && !url.chars().any(|c| c.is_control() || c.is_whitespace())
+        && !url.chars().any(is_shell_meta)
+}
+
+/// Characters a command interpreter (POSIX shells or `cmd.exe`) may treat specially. A real
+/// `https` URL never needs any of them unescaped in a browser-opened link. `%` matters because
+/// `cmd.exe` expands `%NAME%` references, and an expanded value could itself carry metacharacters.
+pub fn is_shell_meta(c: char) -> bool {
+    matches!(c, '|' | '&' | ';' | '<' | '>' | '(' | ')' | '$' | '`' | '"' | '\'' | '^' | '!' | '*' | '%' | '{' | '}' | '[' | ']')
+}
+
+/// Whether `url` is a valid release page URL strictly for `repo` on GitHub:
+/// starts with `https://github.com/<repo>/releases`, contains no dot-segments (`.` or `..`),
+/// no percent-encoded path separators (`%2f`, `%5c`), no query/fragment/backslash, and
+/// satisfies [`safe_web_link`] (no shell metacharacters or control bytes, CWE-78).
+pub fn safe_release_html_url(repo: &str, url: &str) -> Option<String> {
+    if !safe_web_link(url) {
+        return None;
+    }
+    let releases = format!("https://github.com/{repo}/releases");
+    if url == releases {
+        return Some(url.to_string());
+    }
+    let rest = url.strip_prefix(&releases)?;
+    let path = rest.strip_prefix('/')?;
+    if path.is_empty() || path.contains(['?', '#', '\\']) {
+        return None;
+    }
+    for seg in path.split('/') {
+        if seg.is_empty() || seg == "." || seg == ".." || seg.contains("%2f") || seg.contains("%2F") || seg.contains("%5c") || seg.contains("%5C") {
+            return None;
+        }
+    }
+    Some(url.to_string())
+}
+
+/// The prefix every download of `repo` must start with.
+pub fn download_prefix(repo: &str) -> String {
+    format!("https://github.com/{repo}/releases/download/")
+}
+
+/// Whether `url` is a download that truly belongs to `repo`.
+///
+/// A raw `starts_with(prefix)` check is not enough: a value such as
+/// `https://github.com/storytold/craft-launcher/releases/download/../../../ATTACKER/REPO/releases/download/v1/x`
+/// shares the prefix textually, yet its interpreted path escapes the repository. The link is
+/// accepted only when the text after the prefix is exactly `<tag>/<name>` — two non-empty path
+/// segments with no traversal (`.`/`..`), no additional slashes, no query or fragment, and no
+/// backslash or percent-encoded separators that a client could later re-interpret.
+pub fn download_url_under(url: &str, prefix: &str) -> bool {
+    let Some(rest) = url.strip_prefix(prefix) else { return false };
+    download_suffix_ok(rest)
+}
+
+/// Whether `url` sits under a developer mirror `base` (ending in `/`) without escaping it.
+pub fn download_url_under_mirror(url: &str, base: &str) -> bool {
+    let Some(rest) = url.strip_prefix(base) else { return false };
+    // A mirror serves `<tag>/<name>` just like GitHub, but we only require that it can't climb out
+    // of its own folder; its layout is otherwise the developer's business.
+    !rest.is_empty() && !url.contains(['?', '#', '\\']) && !contains_traversal(rest) && !contains_encoded_separator(rest)
+}
+
+/// `<tag>/<name>`: exactly two non-empty segments, no traversal, no re-interpretable separators.
+fn download_suffix_ok(rest: &str) -> bool {
+    if rest.contains(['?', '#', '\\']) || contains_encoded_separator(rest) {
+        return false;
+    }
+    let mut parts = rest.split('/');
+    let (Some(tag), Some(name), None) = (parts.next(), parts.next(), parts.next()) else { return false };
+    !tag.is_empty() && tag != "." && tag != ".." && tag.len() <= 64 && !tag.contains('\\') && valid_file_name(name)
+}
+
+/// Any `.` or `..` path segment that could climb out of the repository.
+fn contains_traversal(rest: &str) -> bool {
+    rest.split('/').any(|seg| seg == "." || seg == "..")
+}
+
+/// Percent-encoded slash or backslash (`%2f`, `%5c`): a client could decode these back into
+/// separators after the check, so a confined URL must not contain them.
+fn contains_encoded_separator(rest: &str) -> bool {
+    let bytes = rest.as_bytes();
+    bytes.windows(3).any(|w| w[0] == b'%' && matches!(&w[1..].to_ascii_lowercase()[..], b"2f" | b"5c"))
+}
+
+/// Reads `GET /repos/<repo>/releases/latest` (or one element of `/releases`).
+pub fn parse_github_release(json: &str, repo: &str) -> Result<Release, String> {
+    let v: serde_json::Value = serde_json::from_str(json).map_err(|e| format!("unreadable answer from GitHub ({e})"))?;
+    release_from_value(&v, repo)
+}
+
+/// Reads `GET /repos/<repo>/releases` and returns the newest stable (or any, with
+/// `allow_prerelease`) published release.
+pub fn parse_github_release_list(json: &str, repo: &str, allow_prerelease: bool) -> Result<Option<Release>, String> {
+    let v: serde_json::Value = serde_json::from_str(json).map_err(|e| format!("unreadable answer from GitHub ({e})"))?;
+    let list = v.as_array().ok_or("unexpected answer from GitHub")?;
+    let mut best: Option<Release> = None;
+    for item in list {
+        if item["draft"].as_bool().unwrap_or(false) {
+            continue;
+        }
+        let Ok(r) = release_from_value(item, repo) else { continue };
+        let Some(ver) = r.version.as_ref() else { continue };
+        if !allow_prerelease && (r.prerelease || !version::is_stable(ver)) {
+            continue;
+        }
+        let newer = best.as_ref().and_then(|b| b.version.as_ref()).is_none_or(|b| version::is_newer(ver, b));
+        if newer {
+            best = Some(r);
+        }
+    }
+    Ok(best)
+}
+
+fn release_from_value(v: &serde_json::Value, repo: &str) -> Result<Release, String> {
+    if let Some(msg) = v["message"].as_str() {
+        return Err(if msg == "Not Found" { "no releases yet".into() } else { format!("GitHub says: {}", truncate(msg, 200)) });
+    }
+    let tag = v["tag_name"].as_str().filter(|t| !t.is_empty() && t.len() <= 64).ok_or("no release found")?.to_string();
+    let releases = format!("https://github.com/{repo}/releases");
+    let html_url = v["html_url"].as_str().and_then(|u| safe_release_html_url(repo, u)).unwrap_or_else(|| releases.clone());
+    let prefix = download_prefix(repo);
+    let assets = v["assets"]
+        .as_array()
+        .map(|list| {
+            list.iter()
+                .filter_map(|a| {
+                    let name = a["name"].as_str().filter(|n| valid_file_name(n))?.to_string();
+                    let url = a["browser_download_url"].as_str().filter(|u| download_url_under(u, &prefix))?.to_string();
+                    let sha256 = a["digest"].as_str().and_then(|d| d.strip_prefix("sha256:")).filter(|h| is_hex64(h)).map(str::to_ascii_lowercase);
+                    Some(Asset { name, size: a["size"].as_u64().unwrap_or(0), url, sha256 })
+                })
+                .collect()
+        })
+        .unwrap_or_default();
+    Ok(Release {
+        version: version::parse(&tag),
+        name: v["name"].as_str().map(|n| truncate(n, 120)).filter(|n| !n.is_empty()).unwrap_or_else(|| tag.clone()),
+        tag,
+        published_at: v["published_at"].as_str().and_then(crate::time::parse_rfc3339),
+        html_url,
+        notes: v["body"].as_str().map(|b| truncate(b, MAX_NOTES)).unwrap_or_default(),
+        prerelease: v["prerelease"].as_bool().unwrap_or(false),
+        assets,
+    })
+}
+
+/// A release known only from its tag and `SHA256SUMS.txt` (the quota-free route: the
+/// `releases/latest` redirect names the tag, and the sums list every file).
+pub fn release_from_sums(repo: &str, tag: &str, sums: &[(String, String)]) -> Release {
+    let prefix = download_prefix(repo);
+    let mut assets: Vec<Asset> = sums
+        .iter()
+        .map(|(hash, name)| Asset { name: name.clone(), size: 0, url: format!("{prefix}{tag}/{name}"), sha256: Some(hash.clone()) })
+        .collect();
+    assets.push(Asset { name: "SHA256SUMS.txt".into(), size: 0, url: format!("{prefix}{tag}/SHA256SUMS.txt"), sha256: None });
+    Release {
+        tag: tag.to_string(),
+        version: version::parse(tag),
+        name: tag.to_string(),
+        published_at: None,
+        html_url: format!("https://github.com/{repo}/releases/tag/{tag}"),
+        notes: String::new(),
+        prerelease: false,
+        assets,
+    }
+}
+
+/// The tag in a `https://github.com/<repo>/releases/tag/<tag>` redirect target.
+pub fn tag_from_redirect(location: &str, repo: &str) -> Option<String> {
+    let rest = location.strip_prefix(&format!("https://github.com/{repo}/releases/tag/"))?;
+    (!rest.is_empty() && rest.len() <= 64 && rest.bytes().all(|b| b.is_ascii_alphanumeric() || b"._-+".contains(&b))).then(|| rest.to_string())
+}
+
+/// Reads `sha256sum` output: `<hex>  <name>` (or `<hex> *<name>`) per line.
+pub fn parse_sha256sums(text: &str) -> Vec<(String, String)> {
+    text.lines()
+        .filter_map(|line| {
+            let (hash, rest) = line.trim().split_once(char::is_whitespace)?;
+            let name = rest.trim_start().trim_start_matches('*');
+            (is_hex64(hash) && valid_file_name(name)).then(|| (hash.to_ascii_lowercase(), name.to_string()))
+        })
+        .collect()
+}
+
+/// A bare file name we'd be willing to save: no paths, no control characters.
+pub fn valid_file_name(name: &str) -> bool {
+    !name.is_empty()
+        && name.len() <= 200
+        && name != "."
+        && name != ".."
+        && !name.starts_with('.')
+        && !name.chars().any(|c| c.is_control() || matches!(c, '/' | '\\' | ':' | '<' | '>' | '"' | '|' | '?' | '*'))
+}
+
+/// `s` cut to at most `max` bytes (on a char boundary) with an ellipsis, for text from a
+/// release or the feed shown in the UI.
+pub(crate) fn truncate(s: &str, max: usize) -> String {
+    if s.len() <= max {
+        return s.to_string();
+    }
+    let mut end = max;
+    while !s.is_char_boundary(end) {
+        end -= 1;
+    }
+    format!("{}…", &s[..end])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const REPO: &str = "storytold/photocraft";
+
+    #[test]
+    fn truncate_keeps_whole_characters() {
+        assert_eq!(truncate("short", 10), "short");
+        assert_eq!(truncate("abcdef", 3), "abc…");
+        // `é` is two bytes: cutting at 2 would split it, so the cut backs off to 1.
+        assert_eq!(truncate("aé", 2), "a…");
+    }
+
+    #[test]
+    fn only_plain_https_links_pass() {
+        assert!(safe_web_link("https://github.com/storytold/photocraft/releases/tag/v1"));
+        for bad in [
+            "http://example.com/",
+            "javascript:alert(1)",
+            "file:///C:/Windows/System32/calc.exe",
+            "ms-msdt:/id",
+            "https://",
+            "https://user@evil.example/",
+            "https://example.com/a b",
+            "https://example.com/\nx",
+            "https:///path",
+            // Shell/cmd metacharacters: the WSL opener fallback shells out, so these must be
+            // refused even inside an otherwise valid https URL (CWE-78).
+            "https://example.com/a|calc",
+            "https://example.com/p?x=1&y=2",
+            "https://example.com/`id`",
+            "https://example.com/$(whoami)",
+            "https://example.com/a;b",
+            "https://example.com/a>b",
+            "https://example.com/%COMSPEC%",
+            "https://example.com/%PATH%",
+        ] {
+            assert!(!safe_web_link(bad), "{bad:?}");
+        }
+    }
+    const HASH: &str = "8a5edab282632443219e051e4ade2d1d5bbc671c781051bf1437897cbdfea0f1";
+
+    fn api_json(url: &str) -> String {
+        format!(
+            r#"{{"tag_name":"v0.5.0","name":"PhotoCraft v0.5.0","html_url":"https://github.com/storytold/photocraft/releases/tag/v0.5.0",
+            "published_at":"2026-10-08T14:52:50Z","prerelease":false,"body":"Notes",
+            "assets":[{{"name":"photocraft-0.5.0-macos-universal.dmg","size":123,"browser_download_url":"{url}","digest":"sha256:{HASH}"}}]}}"#
+        )
+    }
+
+    #[test]
+    fn reads_the_latest_release() {
+        let r = parse_github_release(
+            &api_json("https://github.com/storytold/photocraft/releases/download/v0.5.0/photocraft-0.5.0-macos-universal.dmg"),
+            REPO,
+        )
+        .unwrap();
+        assert_eq!(r.version, Some(Version::new(0, 5, 0)));
+        assert_eq!(r.name, "PhotoCraft v0.5.0");
+        assert_eq!(r.published_at, Some(1_791_471_170));
+        assert_eq!(r.assets.len(), 1);
+        assert_eq!(r.assets[0].sha256.as_deref(), Some(HASH));
+        assert_eq!(r.assets[0].size, 123);
+    }
+
+    #[test]
+    fn drops_downloads_that_point_elsewhere() {
+        for url in ["https://evil.example/photocraft.dmg", "https://github.com/storytold/other/releases/download/v1/x.dmg", "javascript:alert(1)"] {
+            let r = parse_github_release(&api_json(url), REPO).unwrap();
+            assert!(r.assets.is_empty(), "{url}");
+        }
+        assert_eq!(parse_github_release(r#"{"message":"Not Found"}"#, REPO).unwrap_err(), "no releases yet");
+        assert!(parse_github_release("<html>", REPO).is_err());
+    }
+
+    #[test]
+    fn release_html_url_rejects_traversal_and_metacharacters() {
+        let repo = "storytold/photocraft";
+        assert_eq!(
+            safe_release_html_url(repo, "https://github.com/storytold/photocraft/releases/tag/v1.0.0"),
+            Some("https://github.com/storytold/photocraft/releases/tag/v1.0.0".to_string())
+        );
+        assert_eq!(
+            safe_release_html_url(repo, "https://github.com/storytold/photocraft/releases"),
+            Some("https://github.com/storytold/photocraft/releases".to_string())
+        );
+        for bad in [
+            "https://github.com/storytold/photocraft/releases/../../attacker/repo/releases/tag/v1",
+            "https://github.com/storytold/photocraft/releases/tag/v1/../../../attacker/repo",
+            "https://github.com/storytold/photocraft/releases/tag/v1|calc.exe",
+            "https://github.com/storytold/photocraft/releases/tag/v1%2f..%2f..",
+            "https://github.com/storytold/photocraft/releases/tag/v1?x=1",
+            "https://github.com/storytold/photocraft/releases/tag/v1#hash",
+            "https://github.com/storytold/other/releases/tag/v1.0.0",
+            "http://github.com/storytold/photocraft/releases/tag/v1",
+        ] {
+            assert!(safe_release_html_url(repo, bad).is_none(), "should reject: {bad}");
+        }
+    }
+
+    #[test]
+    fn traversal_cannot_escape_the_repository() {
+        // Raw-prefix matches but the interpreted path climbs into another repository (CWE-180).
+        for url in [
+            "https://github.com/storytold/photocraft/releases/download/../../../../attacker/repo/releases/download/v99/photocraft-99.0.0-linux-x86_64.AppImage",
+            "https://github.com/storytold/photocraft/releases/download/v1/../../../attacker/repo/x.dmg",
+            "https://github.com/storytold/photocraft/releases/download/./v1/x.dmg",
+            "https://github.com/storytold/photocraft/releases/download/v1/sub/x.dmg",
+            "https://github.com/storytold/photocraft/releases/download/v1%2f..%2f..%2fx.dmg",
+            "https://github.com/storytold/photocraft/releases/download/v1/x%2fy.dmg",
+        ] {
+            let prefix = download_prefix(REPO);
+            assert!(!download_url_under(url, &prefix), "{url}");
+            let r = parse_github_release(&api_json(url), REPO).unwrap();
+            assert!(r.assets.is_empty(), "{url}");
+        }
+        // A plain, confined download still passes.
+        let prefix = download_prefix(REPO);
+        assert!(download_url_under("https://github.com/storytold/photocraft/releases/download/v0.5.0/photocraft-0.5.0-macos-universal.dmg", &prefix));
+    }
+
+    #[test]
+    fn list_picks_the_newest_stable_release() {
+        let json = r#"[
+            {"tag_name":"v0.6.0-rc.1","prerelease":false,"draft":false,"assets":[]},
+            {"tag_name":"v0.5.1","prerelease":true,"draft":false,"assets":[]},
+            {"tag_name":"v0.7.0","draft":true,"assets":[]},
+            {"tag_name":"v0.5.0","prerelease":false,"draft":false,"assets":[]},
+            {"tag_name":"v0.4.0","prerelease":false,"draft":false,"assets":[]}]"#;
+        assert_eq!(parse_github_release_list(json, REPO, false).unwrap().unwrap().tag, "v0.5.0");
+        assert_eq!(parse_github_release_list(json, REPO, true).unwrap().unwrap().tag, "v0.6.0-rc.1");
+        assert_eq!(parse_github_release_list("[]", REPO, false).unwrap(), None);
+    }
+
+    #[test]
+    fn reads_checksums_and_redirects() {
+        let sums = parse_sha256sums(&format!("{HASH}  photocraft-0.5.0-macos-universal.dmg\n{HASH} *b.zip\nnot a line\n{HASH}  ../escape\n"));
+        assert_eq!(sums, [(HASH.to_string(), "photocraft-0.5.0-macos-universal.dmg".to_string()), (HASH.to_string(), "b.zip".to_string())]);
+        assert_eq!(tag_from_redirect("https://github.com/storytold/photocraft/releases/tag/v0.5.0", REPO).as_deref(), Some("v0.5.0"));
+        assert_eq!(tag_from_redirect("https://github.com/storytold/photocraft/releases", REPO), None);
+        assert_eq!(tag_from_redirect("https://evil/storytold/photocraft/releases/tag/v1", REPO), None);
+        let r = release_from_sums(REPO, "v0.5.0", &sums);
+        assert_eq!(r.assets[0].url, "https://github.com/storytold/photocraft/releases/download/v0.5.0/photocraft-0.5.0-macos-universal.dmg");
+        assert_eq!(r.version, Some(Version::new(0, 5, 0)));
+    }
+
+    #[test]
+    fn file_names_cannot_escape() {
+        for bad in ["", "..", "a/b", "a\\b", ".hidden", "c:x", "x\u{0}"] {
+            assert!(!valid_file_name(bad), "{bad:?}");
+        }
+        assert!(valid_file_name("photocraft-0.5.0-linux-x86_64.AppImage"));
+    }
+}
diff --git a/crates/update/src/self_update.rs b/crates/update/src/self_update.rs
new file mode 100644
index 00000000..f22dfb35
--- /dev/null
+++ b/crates/update/src/self_update.rs
@@ -0,0 +1,1781 @@
+//! ArtCraft Launcher updating itself.
+//!
+//! The new version is downloaded and verified like any Craft App, then swapped in the way this
+//! copy was installed. A small helper process waits for this launcher to exit, finishes anything
+//! that can't happen while it runs (Windows locks a running exe), and starts the new one. The
+//! launcher has to exit first anyway: it holds the single-instance lock, and a new copy started
+//! while it runs would only ask it to show its window.
+//!
+//! | Installed as | Swap |
+//! |---|---|
+//! | macOS `.app` | copy the new bundle from the DMG over this one (fine while running), reopen it |
+//! | Windows MSI (per-user, any folder) | after exit, run the new MSI (it reinstalls into the same folder), then start the exe |
+//! | Windows portable zip | after exit, unzip over this folder (settings in `ArtCraftLauncherData` stay) |
+//! | Linux AppImage | rename the new AppImage over this one (fine while running), start it |
+//! | Linux `.deb` / `.rpm` | the system package manager, with the password prompt; then restart |
+//! | Linux Flatpak | reinstall the bundle with `--reinstall` via the host portal; then restart |
+//!
+//! Anything else (FreeBSD, a development build) gets the download link instead.
+
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+
+use crate::PackageKind;
+use crate::app::App;
+use crate::platform::{Platform, pick_asset};
+use crate::protocol::JobPhase;
+use crate::release::Release;
+use crate::version::{self, Version};
+#[cfg(target_os = "macos")]
+use crate::{InstallSource, Installed};
+
+use crate::http::{Http, Stop};
+use crate::install::{self, Job};
+use crate::paths::Paths;
+use crate::process;
+
+/// How this running launcher was installed.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Install {
+    /// The `ArtCraft Launcher.app` bundle.
+    MacApp(PathBuf),
+    /// The per-user Windows Installer package; the exe.
+    Msi(PathBuf),
+    /// The Windows portable zip; the exe (with `portable.txt` beside it).
+    Portable(PathBuf),
+    /// The AppImage file.
+    AppImage(PathBuf),
+    /// A Debian or RPM package; the binary.
+    Package(PackageKind, PathBuf),
+    /// A Flatpak application.
+    Flatpak,
+    /// A standalone executable or unpacked tree.
+    Standalone(PathBuf),
+}
+
+impl Install {
+    fn kind(&self) -> PackageKind {
+        match self {
+            Self::MacApp(_) => PackageKind::Dmg,
+            Self::Msi(_) => PackageKind::Msi,
+            Self::Portable(_) => PackageKind::PortableZip,
+            Self::AppImage(_) => PackageKind::AppImage,
+            Self::Package(kind, _) => *kind,
+            Self::Flatpak => PackageKind::Flatpak,
+            Self::Standalone(_) => {
+                #[cfg(windows)]
+                {
+                    PackageKind::PortableZip
+                }
+                #[cfg(not(windows))]
+                {
+                    PackageKind::TarGz
+                }
+            }
+        }
+    }
+}
+
+/// Makes an installed copy believe it's this version, to try the self-update against the current
+/// release. The restart helper drops it, so it lasts one run.
+pub const PRETEND_VAR: &str = "ARTCRAFT_LAUNCHER_PRETEND_VERSION";
+
+/// Makes a development build believe it's an installed copy, to try the self-update.
+pub const DEV_VAR: &str = "CRAFT_UPDATE_DEV";
+
+/// The version this app counts as (see [`PRETEND_VAR`]).
+pub fn current_version(app: &App, fallback_pkg_version: &str) -> Option<Version> {
+    let app_pretend = format!("{}_PRETEND_VERSION", app.id.replace('-', "_").to_uppercase());
+    std::env::var(&app_pretend)
+        .or_else(|_| std::env::var(PRETEND_VAR))
+        .ok()
+        .and_then(|v| version::parse(&v))
+        .or_else(|| version::parse(fallback_pkg_version))
+}
+
+/// How long a just-installed version stays exempt from being offered again.
+const JUST_UPDATED_FOR: i64 = 24 * 3600;
+
+/// Whether `release` is the version this app just updated itself to. Offering it again would
+/// loop: update, restart, "update available", … That happens if a release's binary reports a
+/// different version from its tag, or while a pretend version is set.
+pub fn just_updated_to(paths: &Paths, release: &Release) -> bool {
+    let Ok(text) = std::fs::read_to_string(marker(paths)) else { return false };
+    let mut lines = text.lines();
+    let (Some(tag), Some(at)) = (lines.next(), lines.next().and_then(|a| a.parse::<i64>().ok())) else { return false };
+    tag == release.tag && crate::now().checked_sub(at).is_some_and(|age| (0..JUST_UPDATED_FOR).contains(&age))
+}
+
+fn marker(paths: &Paths) -> PathBuf {
+    paths.data.join("self-update.txt")
+}
+
+/// How this copy is installed, if it's one the app knows how to replace.
+pub fn current(app: &App) -> Option<Install> {
+    let exe = std::env::current_exe().ok()?;
+    current_at(app, &exe, std::env::var_os(DEV_VAR).is_some())
+}
+
+/// [`current`] for a known executable and opt-in setting, without reading the ambient
+/// environment.
+fn current_at(app: &App, exe: &Path, opted_in: bool) -> Option<Install> {
+    let exe = exe.canonicalize().unwrap_or_else(|_| exe.to_path_buf());
+    if is_development_build(&exe, opted_in) {
+        return None;
+    }
+    detect(app, &exe)
+}
+
+/// Cargo's cache-directory marker at the root of a target directory.
+const CARGO_CACHE_MARKER: &str = "CACHEDIR.TAG";
+
+/// Whether `exe` runs from a Cargo build tree, wherever `CARGO_TARGET_DIR` or
+/// `build.target-dir` put it. Normally Cargo caches rustc information in `.rustc_info.json` at
+/// the target root, and that marker alone identifies the tree; a folder that installers put the
+/// app in doesn't carry it, so this doesn't depend on the directory being called `target`. But
+/// the cache can be disabled (`CARGO_CACHE_RUSTC_INFO=0`) or a tree copied without the hidden
+/// file, so a profile output directory is also accepted when it has Cargo's `.fingerprint`,
+/// `deps` and `build` subdirectories and its target root carries `CACHEDIR.TAG`.
+/// `CACHEDIR.TAG` alone isn't Cargo-specific (the same signature marks any cache directory), so
+/// it only corroborates that profile layout.
+fn is_development_build(exe: &Path, opted_in: bool) -> bool {
+    !opted_in && exe.ancestors().skip(1).any(is_cargo_build_dir)
+}
+
+/// Whether `dir` is a Cargo target root (by its rustc-info cache marker) or a profile output
+/// directory inside one (by the cache-disabled fallback).
+fn is_cargo_build_dir(dir: &Path) -> bool {
+    if dir.join(".rustc_info.json").is_file() {
+        return true;
+    }
+    let Some(profile_parent) = dir.parent() else { return false };
+    let is_profile = [".fingerprint", "deps", "build"].into_iter().all(|name| dir.join(name).is_dir());
+    if !is_profile {
+        return false;
+    }
+    // The target root is the profile's parent, or its grandparent for cross-compiled output
+    // (`<target>/<triple>/<profile>`). It must carry Cargo's marker, as a file rather than a
+    // directory of that name.
+    if profile_parent.join(CARGO_CACHE_MARKER).is_file() {
+        return true;
+    }
+    profile_parent.parent().is_some_and(|root| root.join(CARGO_CACHE_MARKER).is_file())
+}
+
+/// Whether this installed copy can update itself.
+pub fn is_self_updating(app: &App) -> bool {
+    current(app).is_some()
+}
+
+#[cfg(target_os = "macos")]
+fn detect(app: &App, exe: &Path) -> Option<Install> {
+    if let Some(bundle) = exe.ancestors().find(|p| p.extension().is_some_and(|e| e == "app"))
+        && let Ok(plist) = plist::Value::from_file(bundle.join("Contents/Info.plist"))
+        && let Some(id) = plist.as_dictionary().and_then(|d| d.get("CFBundleIdentifier")).and_then(|v| v.as_string())
+        && id == app.bundle_id()
+    {
+        return Some(Install::MacApp(bundle.to_path_buf()));
+    }
+    if exe.is_file() {
+        return Some(Install::Standalone(exe.to_path_buf()));
+    }
+    None
+}
+
+#[cfg(windows)]
+fn detect(app: &App, exe: &Path) -> Option<Install> {
+    let dir = exe.parent()?;
+    if dir.join("portable.txt").is_file() {
+        return Some(Install::Portable(exe.to_path_buf()));
+    }
+    // The MSI installs per user, into the folder chosen in its wizard (which it records in the
+    // registry) or by default %LOCALAPPDATA%\Programs\<App Name>.
+    let canonical = |p: PathBuf| p.canonicalize().unwrap_or(p);
+    let recorded = msi_install_dir(app).map(canonical);
+    let default = crate::folders::data_local_dir().map(|d| canonical(d.join("Programs").join(app.name)));
+    if [recorded, default].into_iter().flatten().any(|d| d == dir) {
+        return Some(Install::Msi(exe.to_path_buf()));
+    }
+    if exe.is_file() {
+        return Some(Install::Standalone(exe.to_path_buf()));
+    }
+    None
+}
+
+/// The folder the MSI installed into, as it records it.
+#[cfg(windows)]
+fn msi_install_dir(app: &App) -> Option<PathBuf> {
+    use winreg::RegKey;
+    use winreg::enums::HKEY_CURRENT_USER;
+    let subkey = format!(r"Software\Learning Machines LLC\{}", app.name);
+    let key = RegKey::predef(HKEY_CURRENT_USER).open_subkey(&subkey).ok()?;
+    let dir: String = key.get_value("InstallDir").ok()?;
+    let dir = dir.trim();
+    (!dir.is_empty()).then(|| PathBuf::from(dir))
+}
+
+#[cfg(target_os = "linux")]
+fn detect(app: &App, exe: &Path) -> Option<Install> {
+    if process::in_sandbox() {
+        // Only the release bundle installed per user updates itself, with `flatpak install --user
+        // --reinstall --bundle`. A system-wide copy would gain a second, per-user one beside it;
+        // a copy from a repository is that repository's to update (and an unsigned bundle can't
+        // go into a signed one).
+        return (is_user_install() && from_bundle(app)).then_some(Install::Flatpak);
+    }
+    if let Some(appimage) = std::env::var_os("APPIMAGE") {
+        return Some(Install::AppImage(PathBuf::from(appimage)));
+    }
+    let t = std::time::Duration::from_secs(10);
+    if process::capture("dpkg-query", &["-W", "-f", "${db:Status-Status}", app.id], t).is_some_and(|s| s.trim() == "installed") {
+        return Some(Install::Package(PackageKind::Deb, exe.to_path_buf()));
+    }
+    if process::capture("rpm", &["-q", app.id], t).is_some() {
+        return Some(Install::Package(PackageKind::Rpm, exe.to_path_buf()));
+    }
+    // A pacman install of the app. We detect the release's own Arch package (by bundle id).
+    // AUR builds (`<id>`, `<id>-bin`, `<id>-git`) are left to pacman and the AUR helper.
+    if crate::detect::linux::has_pacman_db() && process::capture("pacman", &["-Q", &app.bundle_id()], t).is_some() {
+        return Some(Install::Package(PackageKind::ArchPkg, exe.to_path_buf()));
+    }
+    if exe.is_file() {
+        return Some(Install::Standalone(exe.to_path_buf()));
+    }
+    None
+}
+
+/// Whether this sandbox runs the per-user installation's copy, from `app-path` in `/.flatpak-info`.
+#[cfg(target_os = "linux")]
+fn is_user_install() -> bool {
+    std::fs::read_to_string("/.flatpak-info").is_ok_and(|info| parse_is_user_install(&info))
+}
+
+#[cfg(target_os = "linux")]
+fn parse_is_user_install(info: &str) -> bool {
+    let mut in_instance = false;
+    for line in info.lines() {
+        let line = line.trim();
+        if line.starts_with('[') {
+            in_instance = line == "[Instance]";
+        } else if in_instance && let Some(path) = line.strip_prefix("app-path=") {
+            // The host's path. The per-user installation is ~/.local/share/flatpak there; it can't
+            // be looked up from in here, where XDG_DATA_HOME points into ~/.var/app instead.
+            return path.trim().contains("/.local/share/flatpak/");
+        }
+    }
+    false
+}
+
+/// Whether the per-user copy was installed from a `.flatpak` bundle. `/.flatpak-info` doesn't say
+/// where it came from, so the host's Flatpak is asked.
+#[cfg(target_os = "linux")]
+fn from_bundle(app: &App) -> bool {
+    let id = app.bundle_id();
+    process::capture_flatpak(&["info", "--user", "--show-origin", &id], std::time::Duration::from_secs(3))
+        .is_some_and(|origin| is_bundle_origin(app, origin.trim()))
+}
+
+/// Flatpak names a bundle's origin after the last part of the app id, numbered when that name is
+/// taken: `<id>-origin`, `<id>1-origin`, …
+#[cfg(target_os = "linux")]
+fn is_bundle_origin(app: &App, origin: &str) -> bool {
+    origin.strip_prefix(app.id).and_then(|rest| rest.strip_suffix("-origin")).is_some_and(|n| n.bytes().all(|b| b.is_ascii_digit()))
+}
+
+#[cfg(not(any(target_os = "macos", windows, target_os = "linux")))]
+fn detect(_app: &App, _exe: &Path) -> Option<Install> {
+    None
+}
+
+/// Downloads `release` for `platform`, puts it in place and starts the helper that relaunches
+/// it once this process has exited. On success the caller must quit promptly. `last` is called
+/// once the download is ready and returns when the app may replace itself and restart.
+#[allow(clippy::too_many_arguments)]
+pub fn update(
+    app: &App,
+    install: &Install,
+    release: &Release,
+    platform: Platform,
+    http: &Http,
+    paths: &Paths,
+    stop: &Stop,
+    phase: &mut dyn FnMut(JobPhase),
+    last: &dyn Fn() -> Result<(), String>,
+    running_version: Option<&str>,
+) -> Result<(), String> {
+    let cur_v = running_version.and_then(|v| current_version(app, v));
+    if let (Some(rel_v), Some(cur_v)) = (release.version.as_ref(), cur_v.as_ref())
+        && !version::is_newer(rel_v, cur_v)
+    {
+        return Err(format!("{} {} is not newer than currently running version {}", app.name, release.version_label(), cur_v));
+    }
+    let (asset, _) = pick_asset(release, &[app.id], platform, &[install.kind()])
+        .ok_or_else(|| format!("{} {} has no {} for {}", app.name, release.version_label(), install.kind().label(), platform.label()))?;
+    let asset = asset.clone();
+    crate::install::bind_artifact_version(app, release, &asset)?;
+    let mut job = Job { http, paths, stop, phase, install_locations: &Default::default(), replace: false };
+    let file = install::download(release, &asset, &mut job)?;
+    #[cfg(windows)]
+    windows_precheck(app, install, paths, &file)?;
+    // The restart ends this process: nothing else may be under way.
+    last()?;
+    phase(JobPhase::Installing);
+    // Written before the swap starts: the Windows helper runs alongside this process and clears
+    // it when it fails, which a write after scheduling could undo.
+    mark_installed(paths, release);
+    let pid = std::process::id();
+    let scheduled = (|| -> Result<(), String> {
+        match install {
+            #[cfg(target_os = "macos")]
+            Install::MacApp(bundle) => {
+                let existing = Installed { version: None, source: InstallSource::MacApp, location: bundle.display().to_string(), package: None };
+                let placed = install::macos::install_dmg(app, &file, Some(&existing), None, false, paths, &install::macos::Expect::release(release));
+                let _ = std::fs::remove_file(&file);
+                let placed = placed?;
+                relaunch_after_exit(pid, &[Path::new("/usr/bin/open").as_os_str(), placed.as_os_str()])
+            }
+            #[cfg(target_os = "linux")]
+            Install::AppImage(path) => {
+                replace_appimage(&file, path)?;
+                let _ = std::fs::remove_file(&file);
+                relaunch_after_exit(pid, &[path.as_os_str()])
+            }
+            #[cfg(target_os = "linux")]
+            Install::Package(kind, exe) => {
+                let result = install::linux::install_package(*kind, &file, stop, phase);
+                let _ = std::fs::remove_file(&file);
+                result?;
+                relaunch_after_exit(pid, &[exe.as_os_str()])
+            }
+            #[cfg(target_os = "linux")]
+            Install::Flatpak => {
+                let result = install::linux::install_package(PackageKind::Flatpak, &file, stop, phase);
+                let _ = std::fs::remove_file(&file);
+                result?;
+                relaunch_flatpak_after_exit(app)
+            }
+            #[cfg(windows)]
+            Install::Msi(exe) => windows_helper(app, paths, pid, exe, &msi_finish(&file)?),
+            #[cfg(windows)]
+            Install::Portable(exe) => {
+                exe.parent().ok_or_else(|| format!("{} isn't in a folder", app.name))?;
+                windows_helper(app, paths, pid, exe, &Finish::Portable { zip: file, tmp: paths.cache.join(PORTABLE_STAGING) })
+            }
+            #[cfg(windows)]
+            Install::Standalone(exe) => {
+                exe.parent().ok_or_else(|| format!("{} isn't in a folder", app.name))?;
+                windows_helper(app, paths, pid, exe, &Finish::Portable { zip: file, tmp: paths.cache.join(PORTABLE_STAGING) })
+            }
+            #[cfg(unix)]
+            Install::Standalone(exe) => {
+                let result = replace_standalone(app, &file, exe);
+                let _ = std::fs::remove_file(&file);
+                result?;
+                relaunch_after_exit(pid, &[exe.as_os_str()])
+            }
+            #[allow(unreachable_patterns)]
+            _ => {
+                let _ = (pid, &file);
+                Err(format!("this copy of {} can't update itself; download the new version instead", app.name))
+            }
+        }
+    })();
+    unmark_unless_scheduled(paths, scheduled)
+}
+
+/// Records `release` as just installed, so it isn't offered again for [`JUST_UPDATED_FOR`].
+fn mark_installed(paths: &Paths, release: &Release) {
+    if let Err(e) = crate::paths::write_atomic(&marker(paths), format!("{}\n{}\n", release.tag, crate::now()).as_bytes()) {
+        log::warn!("couldn't record the self-update: {e}");
+    }
+}
+
+/// Removes the record of [`mark_installed`] when the swap couldn't be scheduled, so the update
+/// stays on offer.
+fn unmark_unless_scheduled(paths: &Paths, scheduled: Result<(), String>) -> Result<(), String> {
+    if scheduled.is_err() {
+        let _ = std::fs::remove_file(marker(paths));
+    }
+    scheduled
+}
+
+/// Copies the new AppImage beside the running one and renames it over it. The running copy is
+/// mounted from its own (now unlinked) file, so it keeps working until it exits.
+#[cfg(target_os = "linux")]
+fn replace_appimage(new: &Path, path: &Path) -> Result<(), String> {
+    use std::os::unix::fs::PermissionsExt;
+    let dir = path.parent().ok_or("the AppImage isn't in a folder")?;
+    let staged = dir.join(format!(".{}.update", path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default()));
+    std::fs::copy(new, &staged).map_err(|e| format!("couldn't write next to {} ({e})", path.display()))?;
+    // The replacement AppImage must be executable; 0o755 is not group/world-writable.
+    std::fs::set_permissions(&staged, std::fs::Permissions::from_mode(0o755)).map_err(|e| e.to_string())?; // NOSONAR
+    std::fs::rename(&staged, path).map_err(|e| {
+        let _ = std::fs::remove_file(&staged);
+        format!("couldn't replace {} ({e})", path.display())
+    })
+}
+
+/// Extracts the app's binary from a release tarball and atomically renames it over the running
+/// standalone executable.
+#[cfg(unix)]
+fn replace_standalone(app: &App, tarball: &Path, exe: &Path) -> Result<(), String> {
+    use std::os::unix::fs::PermissionsExt;
+    let dir = exe.parent().ok_or_else(|| "executable isn't in a folder".to_string())?;
+    let f = std::fs::File::open(tarball).map_err(|e| format!("could not open {}: {e}", tarball.display()))?;
+    let gz = flate2::read::GzDecoder::new(f);
+    let mut archive = tar::Archive::new(gz);
+    let staged = dir.join(format!(".{}.update", exe.file_name().and_then(|n| n.to_str()).unwrap_or("app")));
+    let bin_suffix = format!("/{}", app.id);
+    let bin_rel = format!("bin/{}", app.id);
+    let mut found = false;
+    for entry in archive.entries().map_err(|e| format!("could not read archive entries: {e}"))? {
+        let mut entry = entry.map_err(|e| format!("archive entry error: {e}"))?;
+        if !entry.header().entry_type().is_file() {
+            continue;
+        }
+        let path = entry.path().map_err(|e| format!("archive path error: {e}"))?;
+        let path_str = path.to_string_lossy();
+        if path_str == bin_rel || path_str.ends_with(&bin_suffix) || path.file_name().is_some_and(|n| n == app.id) {
+            let mut out = std::fs::File::create(&staged).map_err(|e| format!("could not create {}: {e}", staged.display()))?;
+            std::io::copy(&mut entry, &mut out).map_err(|e| format!("could not extract binary: {e}"))?;
+            found = true;
+            break;
+        }
+    }
+    if !found {
+        let _ = std::fs::remove_file(&staged);
+        return Err(format!("release archive did not contain binary for {}", app.id));
+    }
+    std::fs::set_permissions(&staged, std::fs::Permissions::from_mode(0o755)).map_err(|e| e.to_string())?;
+    std::fs::rename(&staged, exe).map_err(|e| {
+        let _ = std::fs::remove_file(&staged);
+        format!("could not replace {}: {e}", exe.display())
+    })
+}
+
+/// Starts `sh`, which waits for `pid` to exit and then runs `command`. Detached, so it outlives us.
+#[cfg(unix)]
+fn relaunch_after_exit(pid: u32, command: &[&std::ffi::OsStr]) -> Result<(), String> {
+    process::spawn_detached(helper_command(pid, command)).map_err(|e| format!("couldn't schedule the restart ({e})"))
+}
+
+#[cfg(unix)]
+fn helper_command(pid: u32, command: &[&std::ffi::OsStr]) -> std::process::Command {
+    let mut cmd = process::command("/bin/sh");
+    cmd.arg("-c")
+        .arg(r#"pid=$1; shift; i=0; while kill -0 "$pid" 2>/dev/null && [ $i -lt 600 ]; do sleep 0.1; i=$((i+1)); done; exec "$@""#)
+        .arg("sh")
+        .arg(pid.to_string())
+        .args(command)
+        // The new launcher reports its real version; a pretend one was for this run only.
+        .env_remove(PRETEND_VAR);
+    cmd
+}
+
+#[cfg(target_os = "linux")]
+fn parse_flatpak_instance_id(info: &str) -> Option<String> {
+    for line in info.lines() {
+        if let Some(id) = line.trim().strip_prefix("instance-id=") {
+            let trimmed = id.trim();
+            if !trimmed.is_empty() {
+                return Some(trimmed.to_string());
+            }
+        }
+    }
+    None
+}
+
+#[cfg(target_os = "linux")]
+fn flatpak_instance_id() -> Option<String> {
+    let info = std::fs::read_to_string("/.flatpak-info").ok()?;
+    parse_flatpak_instance_id(&info)
+}
+
+#[cfg(target_os = "linux")]
+fn parse_flatpak_host_pid(ps_output: &str, target_instance: &str) -> Option<u32> {
+    for line in ps_output.lines() {
+        let mut parts = line.split_whitespace();
+        if let (Some(inst), Some(pid)) = (parts.next(), parts.next())
+            && inst == target_instance
+        {
+            return pid.parse().ok();
+        }
+    }
+    None
+}
+
+#[cfg(target_os = "linux")]
+fn flatpak_host_pid() -> Option<u32> {
+    let instance_id = flatpak_instance_id()?;
+    let out = process::capture_flatpak(&["ps", "--columns=instance,pid"], std::time::Duration::from_secs(3))?;
+    parse_flatpak_host_pid(&out, &instance_id)
+}
+
+/// Starts a host helper that waits for this Flatpak instance to exit, then relaunches it via Flatpak on the host.
+#[cfg(target_os = "linux")]
+fn relaunch_flatpak_after_exit(app: &App) -> Result<(), String> {
+    let host_pid = flatpak_host_pid();
+    let instance_id = flatpak_instance_id();
+    // Each wait clause polls until the old process is gone, then execs the relaunch command.
+    // If the old process is still alive after 60 s the helper gives up WITHOUT launching a second
+    // copy, which is the safe choice: the user can relaunch manually once the old one exits.
+    let (wait_clause, target_arg) = match (host_pid, instance_id) {
+        (Some(pid), _) => (
+            r#"pid=$1; shift; i=0; while kill -0 "$pid" 2>/dev/null; do [ $i -ge 600 ] && exit 1; sleep 0.1; i=$((i+1)); done; exec "$@""#,
+            pid.to_string(),
+        ),
+        (None, Some(id)) => (
+            r#"id=$1; shift; i=0; while flatpak ps --columns=instance 2>/dev/null | grep -q "^$id$"; do [ $i -ge 600 ] && exit 1; sleep 0.1; i=$((i+1)); done; exec "$@""#,
+            id,
+        ),
+        // Without either, starting it again could only meet the old copy still running.
+        (None, None) => return Err(format!("{} is updated; quit and reopen it to start the new version", app.name)),
+    };
+    let script = format!("({wait_clause}) &");
+    let app_id = app.bundle_id();
+    let mut cmd = process::command("flatpak-spawn");
+    cmd.args(["--host", "sh", "-c", &script, "sh", &target_arg, "flatpak", "run", &app_id]).env_remove(PRETEND_VAR);
+    process::spawn_detached(cmd).map_err(|e| format!("couldn't schedule the Flatpak restart ({e})"))
+}
+
+/// The first argument of the Windows update helper: a copy of this program that finishes an
+/// update once the launcher has exited (see [`finish`]).
+pub const FINISH_FLAG: &str = "--finish-update";
+
+/// What the update helper does once the old launcher has exited.
+#[derive(Clone, Debug, PartialEq, Eq)]
+#[cfg_attr(not(windows), allow(dead_code))]
+enum Finish {
+    /// Run the new MSI, which reinstalls into the same folder.
+    Msi(PathBuf),
+    /// Unpack the new portable zip into `tmp` and copy it over the launcher's folder.
+    Portable { zip: PathBuf, tmp: PathBuf },
+}
+
+/// The helper's arguments: [`FINISH_FLAG`], the process id to wait for, the exe to start
+/// afterwards, then the step.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn helper_args(pid: u32, exe: &Path, finish: &Finish) -> Vec<OsString> {
+    let mut args: Vec<OsString> = vec![FINISH_FLAG.into(), pid.to_string().into(), exe.into()];
+    match finish {
+        Finish::Msi(msi) => args.extend(["msi".into(), msi.into()]),
+        Finish::Portable { zip, tmp } => args.extend(["portable".into(), zip.into(), tmp.into()]),
+    }
+    args
+}
+
+/// Reads [`helper_args`] back.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn parse_helper_args(args: &[OsString]) -> Option<(u32, PathBuf, Finish)> {
+    let [flag, pid, exe, step @ ..] = args else { return None };
+    if flag != FINISH_FLAG {
+        return None;
+    }
+    let pid = pid.to_str()?.parse().ok()?;
+    let finish = match step {
+        [kind, msi] if kind == "msi" => Finish::Msi(msi.into()),
+        [kind, zip, tmp] if kind == "portable" => Finish::Portable { zip: zip.into(), tmp: tmp.into() },
+        _ => return None,
+    };
+    Some((pid, exe.into(), finish))
+}
+
+#[cfg_attr(not(windows), allow(dead_code))]
+fn msi_finish(file: &Path) -> Result<Finish, String> {
+    install::msi_path(file).map(Finish::Msi)
+}
+
+/// The cache folder the update helper is copied into.
+#[cfg_attr(not(windows), allow(dead_code))]
+const HELPER_DIR: &str = "launcher-update-helper";
+/// The cache folder a portable update is unpacked into.
+#[cfg_attr(not(windows), allow(dead_code))]
+const PORTABLE_STAGING: &str = "launcher-update";
+
+/// Copies this program into the cache and starts the copy as the update helper, which waits for
+/// `pid` to exit, does `finish` and starts `exe`. Run from the cache, the helper doesn't hold the
+/// installed exe that the step replaces.
+#[cfg(windows)]
+fn windows_helper(_app: &App, paths: &Paths, pid: u32, exe: &Path, finish: &Finish) -> Result<(), String> {
+    let program = std::env::current_exe().map_err(|e| format!("couldn't find this program ({e})"))?;
+    let dir = paths.cache.join(HELPER_DIR);
+    // The previous update's copy, when it's still there.
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).map_err(|e| format!("couldn't schedule the update ({e})"))?;
+    let helper = dir.join(program.file_name().ok_or("this program has no file name")?);
+    std::fs::copy(&program, &helper).map_err(|e| format!("couldn't schedule the update ({e})"))?;
+    let mut cmd = process::command(&helper);
+    cmd.args(helper_args(pid, exe, finish)).env_remove(PRETEND_VAR);
+    process::spawn_detached(cmd).map_err(|e| format!("couldn't schedule the update ({e})"))
+}
+
+/// Finishes an update when this program was started as the update helper; `args` are its
+/// arguments without the program name. `None` when they don't start with [`FINISH_FLAG`]. The
+/// app is started again even when the step fails: the old copy is then still in place.
+#[cfg(windows)]
+pub fn finish(app: &App, args: &[OsString]) -> Option<Result<(), String>> {
+    if args.first().is_none_or(|a| a != FINISH_FLAG) {
+        return None;
+    }
+    let Some((pid, exe, step)) = parse_helper_args(args) else { return Some(Err("the update helper's arguments are incomplete".into())) };
+    let Ok(me) = std::env::current_exe() else { return Some(Err("the update helper couldn't find itself".into())) };
+    let paths = match Paths::for_exe(app, &exe) {
+        Ok(paths) => paths,
+        Err(e) => return Some(Err(e)),
+    };
+    // Nothing runs unless this is the app's own update, signed like this helper.
+    if let Err(e) = check_helper(app, &me, &paths, &exe, &step).and_then(|()| signed_like(app, &me, &exe)) {
+        record_failure(&paths, &e);
+        return Some(Err(e));
+    }
+    let done = run_step(app, &me, pid, &exe, &step, std::time::Duration::from_secs(60));
+    if let Err(e) = &done {
+        record_failure(&paths, e);
+    }
+    // The new app, or the old one when the step failed.
+    let started = signed_like(app, &me, &exe)
+        .and_then(|()| process::spawn_detached(std::process::Command::new(&exe)).map_err(|e| format!("couldn't start {} ({e})", exe.display())));
+    if let Err(e) = &started {
+        record_failure(&paths, e);
+    }
+    Some(done.and(started))
+}
+
+/// Finishes an update on non-Windows platforms (no-op helper).
+#[cfg(not(windows))]
+pub fn finish(_app: &App, _args: &[OsString]) -> Option<Result<(), String>> {
+    None
+}
+
+/// Where a failed update's error waits for the next start.
+fn failure_file(paths: &Paths) -> PathBuf {
+    paths.logs().join("self-update-error.txt")
+}
+
+/// Records a failed update: the next check offers the update again, and the next start logs `error`.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn record_failure(paths: &Paths, error: &str) {
+    let _ = std::fs::remove_file(marker(paths));
+    let _ = std::fs::create_dir_all(paths.logs());
+    let _ = crate::paths::write_atomic(&failure_file(paths), error.as_bytes());
+}
+
+/// The error of the last update, if it failed, once.
+pub fn take_failure(paths: &Paths) -> Option<String> {
+    let file = failure_file(paths);
+    let error = std::fs::read_to_string(&file).ok()?;
+    let _ = std::fs::remove_file(&file);
+    Some(error)
+}
+
+/// Whether `exe` is named like this app's own executable (case-insensitive, any of its ids).
+#[cfg(windows)]
+fn is_own_executable(app: &App, exe: &Path) -> bool {
+    exe.file_stem().and_then(|stem| stem.to_str()).is_some_and(|stem| app.stems().any(|id| id.eq_ignore_ascii_case(stem)))
+}
+
+/// Refuses an executable that isn't this app's own, as the helper would.
+#[cfg(windows)]
+fn own_executable(app: &App, exe: &Path) -> Result<(), String> {
+    if is_own_executable(app, exe) { Ok(()) } else { Err(format!("the update helper only finishes {}'s own update", app.name)) }
+}
+
+/// Checks, while the app still runs and can show the error, what the helper checks before
+/// it installs: this program, the installed exe and the new MSI are signed by one publisher, and
+/// the helper finds the cache in `paths` that holds its copy, the download and the staging folder.
+#[cfg(windows)]
+fn windows_precheck(app: &App, install: &Install, paths: &Paths, download: &Path) -> Result<(), String> {
+    let me = std::env::current_exe().map_err(|e| format!("couldn't find this program ({e})"))?;
+    match install {
+        Install::Msi(exe) => signed_like(app, &me, exe)
+            .and_then(|()| signed_like(app, &me, download))
+            .and_then(|()| own_executable(app, exe))
+            .and_then(|()| same_cache_as_helper(app, paths, exe)),
+        Install::Portable(exe) | Install::Standalone(exe) => {
+            signed_like(app, &me, exe).and_then(|()| own_executable(app, exe)).and_then(|()| same_cache_as_helper(app, paths, exe))
+        }
+        _ => Ok(()),
+    }
+}
+
+/// Accepts `paths` when the update helper, which finds the app's folders again from `exe`
+/// ([`Paths::for_exe`]), finds the same cache. Refuses an app that keeps its files in the
+/// temporary folder because its own folders couldn't be found.
+#[cfg(windows)]
+fn same_cache_as_helper(app: &App, paths: &Paths, exe: &Path) -> Result<(), String> {
+    let canonical = |p: &Path| p.canonicalize().ok();
+    let theirs = Paths::for_exe(app, exe).ok().and_then(|helper| canonical(&helper.cache));
+    if theirs.is_some() && theirs == canonical(&paths.cache) {
+        Ok(())
+    } else {
+        Err(format!("{} can't update itself while it keeps its files in {}; download the new version instead", app.name, paths.cache.display()))
+    }
+}
+
+/// Accepts `file` when it carries a valid Authenticode signature from the same publisher as
+/// `reference`, this program. Refuses an unsigned file, another publisher's, and every file when
+/// `reference` itself isn't signed.
+#[cfg(windows)]
+fn signed_like(app: &App, reference: &Path, file: &Path) -> Result<(), String> {
+    let publisher = |path: &Path| verifysign::verify_file(path).map(|signature| signature.subject_name());
+    let ours = publisher(reference).map_err(|e| format!("this copy of {} isn't signed ({e}), so it doesn't install updates", app.name))?;
+    let theirs = publisher(file).map_err(|e| format!("{} isn't signed ({e})", file.display()))?;
+    if ours == theirs { Ok(()) } else { Err(format!("{} isn't signed by {}'s publisher", file.display(), app.name)) }
+}
+
+/// Whether `file` is a Windows program or library (it starts with the `MZ` header), whatever its
+/// name.
+#[cfg(windows)]
+fn is_program(file: &Path) -> bool {
+    use std::io::Read;
+    let mut magic = [0u8; 2];
+    std::fs::File::open(file).and_then(|mut f| f.read_exact(&mut magic)).is_ok() && magic == *b"MZ"
+}
+
+/// Allows only the app's own update: `exe` is this app's MSI or portable installation,
+/// of the kind `step` updates, and the helper (`me`), the download and the staging folder are in
+/// that installation's cache. Anything else is refused before the helper runs or starts a file.
+#[cfg(windows)]
+fn check_helper(app: &App, me: &Path, paths: &Paths, exe: &Path, step: &Finish) -> Result<(), String> {
+    let refused = || format!("the update helper only finishes {}'s own update", app.name);
+    let canonical = |p: &Path| p.canonicalize().map_err(|_| refused());
+    let cache = canonical(&paths.cache)?;
+    if canonical(me.parent().ok_or_else(refused)?)? != cache.join(HELPER_DIR) {
+        return Err(refused());
+    }
+    let exe = canonical(exe)?;
+    // Whatever the folder, the program to restart is this app's own, never another executable.
+    if !is_own_executable(app, &exe) {
+        return Err(refused());
+    }
+    let downloads = canonical(&paths.downloads())?;
+    let in_downloads = |file: &Path| canonical(file).map(|f| f.parent() == Some(downloads.as_path()));
+    let allowed = match (detect(app, &exe), step) {
+        (Some(Install::Msi(installed)), Finish::Msi(msi)) => installed == exe && in_downloads(msi)?,
+        (Some(Install::Portable(installed) | Install::Standalone(installed)), Finish::Portable { zip, tmp }) => {
+            installed == exe
+                && in_downloads(zip)?
+                && tmp.file_name().is_some_and(|n| n == PORTABLE_STAGING)
+                && canonical(tmp.parent().ok_or_else(refused)?)? == cache
+        }
+        _ => false,
+    };
+    if allowed { Ok(()) } else { Err(refused()) }
+}
+
+/// Lets a Windows test observe both sides of `run_step`'s wait for the old launcher. Compiled only
+/// for tests, so production behavior is unchanged.
+#[cfg(all(test, windows))]
+mod wait_watch {
+    use std::sync::mpsc::{self, Receiver, Sender};
+    use std::sync::{Mutex, PoisonError};
+
+    /// A test's two observations of one wait, keyed by the launcher's pid.
+    pub(super) struct Channels {
+        /// Sent just before `run_step` calls the wait.
+        pub(super) entered: Receiver<()>,
+        /// Sent right after the wait returns, before any extraction, and carries the wait's result.
+        pub(super) returned: Receiver<bool>,
+    }
+
+    struct Watch {
+        pid: u32,
+        entered: Option<Sender<()>>,
+        returned: Option<Sender<bool>>,
+    }
+
+    static WATCH: Mutex<Option<Watch>> = Mutex::new(None);
+
+    pub(super) fn watch(pid: u32) -> Channels {
+        let (entered, entered_rx) = mpsc::channel();
+        let (returned, returned_rx) = mpsc::channel();
+        *WATCH.lock().unwrap_or_else(PoisonError::into_inner) = Some(Watch { pid, entered: Some(entered), returned: Some(returned) });
+        Channels { entered: entered_rx, returned: returned_rx }
+    }
+
+    /// Notes that `run_step` is about to wait. Only the first call for a watched pid is kept.
+    pub(super) fn entered(pid: u32) {
+        let mut watch = WATCH.lock().unwrap_or_else(PoisonError::into_inner);
+        let sender = watch.as_mut().filter(|watch| watch.pid == pid).and_then(|watch| watch.entered.take());
+        if let Some(sender) = sender {
+            let _ = sender.send(());
+        }
+    }
+
+    /// Notes the wait's result as soon as it returns; the step hasn't run yet.
+    pub(super) fn returned(pid: u32, waited: bool) {
+        let mut watch = WATCH.lock().unwrap_or_else(PoisonError::into_inner);
+        let sender = watch.as_mut().filter(|watch| watch.pid == pid).and_then(|watch| watch.returned.take());
+        if let Some(sender) = sender {
+            let _ = sender.send(waited);
+        }
+    }
+}
+
+/// Waits up to `wait` for `pid` to exit, does `step` once it has, and removes the download either
+/// way. The MSI, and every program in the portable zip, must be signed like `reference`.
+#[cfg(windows)]
+fn run_step(app: &App, reference: &Path, pid: u32, exe: &Path, step: &Finish, wait: std::time::Duration) -> Result<(), String> {
+    #[cfg(test)]
+    wait_watch::entered(pid);
+    // The test hook needs the result, so it is stored rather than consumed by the branch.
+    let waited = process::wait_for_exit(pid, wait);
+    #[cfg(test)]
+    wait_watch::returned(pid, waited);
+    let result = if waited {
+        match step {
+            Finish::Msi(msi) => signed_like(app, reference, msi).and_then(|()| install::windows::reinstall(msi)),
+            Finish::Portable { zip, tmp } => match (exe.parent(), exe.file_name()) {
+                (Some(dir), Some(executable)) => crate::portable::unpack_over(zip, tmp, dir, executable, &|file| {
+                    // The expected executable must be signed even when its contents aren't a PE file.
+                    if file.file_name() == Some(executable) || is_program(file) { signed_like(app, reference, file) } else { Ok(()) }
+                }),
+                _ => Err(format!("{} isn't in a folder", app.name)),
+            },
+        }
+    } else {
+        Err(format!("{} was still running after a minute, so the update wasn't installed", app.name))
+    };
+    match step {
+        Finish::Msi(msi) => {
+            let _ = std::fs::remove_file(msi);
+        }
+        // `unpack_over` removes the staging folder, unless it holds files it couldn't put back.
+        Finish::Portable { zip, .. } => {
+            let _ = std::fs::remove_file(zip);
+        }
+    }
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[cfg(unix)]
+    #[test]
+    fn msi_self_update_uses_the_target_of_a_symlinked_download() {
+        let dir = tempfile::tempdir().unwrap();
+        let file = dir.path().join("Launcher O'Brien.msi");
+        std::fs::write(&file, b"test package").unwrap();
+        let link = dir.path().join("cached.msi");
+        std::os::unix::fs::symlink(&file, &link).unwrap();
+        assert_eq!(msi_finish(&link).unwrap(), Finish::Msi(file.canonicalize().unwrap()));
+    }
+
+    #[test]
+    fn a_missing_msi_cannot_schedule_a_self_update() {
+        let dir = tempfile::tempdir().unwrap();
+        assert!(msi_finish(&dir.path().join("missing.msi")).is_err());
+    }
+
+    /// The helper reads back exactly what the launcher passed it, paths with spaces and
+    /// apostrophes included, and nothing that is incomplete or unknown.
+    #[test]
+    fn the_update_helper_reads_back_its_arguments() {
+        let exe = Path::new(r"C:\Users\O'Brien\AppData\Local\Programs\ArtCraft Launcher\artcraft-launcher.exe");
+        let msi = Finish::Msi(PathBuf::from(r"C:\Users\O'Brien\AppData\Local\ArtCraft Launcher\cache\artcraft-launcher-0.7.0-windows-x64.msi"));
+        let portable =
+            Finish::Portable { zip: PathBuf::from(r"D:\Tools\x 1.zip"), tmp: PathBuf::from(r"D:\Tools\ArtCraftLauncherData\cache\launcher-update") };
+        for finish in [msi, portable] {
+            let args = helper_args(4242, exe, &finish);
+            assert_eq!(args.first().map(OsString::as_os_str), Some(std::ffi::OsStr::new(FINISH_FLAG)));
+            assert_eq!(parse_helper_args(&args), Some((4242, exe.to_path_buf(), finish)));
+        }
+        let os = |args: &[&str]| args.iter().map(OsString::from).collect::<Vec<_>>();
+        for bad in [
+            os(&[]),
+            os(&["--hidden"]),
+            os(&[FINISH_FLAG, "4242", "launcher.exe"]),
+            os(&[FINISH_FLAG, "4242", "launcher.exe", "msi"]),
+            os(&[FINISH_FLAG, "4242", "launcher.exe", "msi", "a.msi", "extra"]),
+            os(&[FINISH_FLAG, "4242", "launcher.exe", "portable", "a.zip"]),
+            os(&[FINISH_FLAG, "not a pid", "launcher.exe", "msi", "a.msi"]),
+            os(&[FINISH_FLAG, "4242", "launcher.exe", "script", "Remove-Item C:\\"]),
+            os(&["--finish", "4242", "launcher.exe", "msi", "a.msi"]),
+        ] {
+            assert_eq!(parse_helper_args(&bad), None, "{bad:?}");
+        }
+    }
+
+    /// Arguments that aren't the helper's leave the launcher to start as usual.
+    #[cfg(windows)]
+    #[test]
+    fn only_the_helper_flag_starts_the_update_helper() {
+        assert_eq!(finish(&crate::suite::LAUNCHER, &[]), None);
+        assert_eq!(finish(&crate::suite::LAUNCHER, &[OsString::from("--hidden")]), None);
+        assert!(finish(&crate::suite::LAUNCHER, &[OsString::from(FINISH_FLAG)]).is_some_and(|done| done.is_err()));
+    }
+
+    /// The portable update waits for the old launcher to exit, then replaces its files with the
+    /// zip's folder, keeps the settings beside it, and removes the download and the staging folder.
+    #[cfg(windows)]
+    #[test]
+    fn a_portable_update_replaces_the_launcher_after_it_exits() {
+        use std::io::Write;
+        let dir = tempfile::tempdir().unwrap();
+        let folder = dir.path().join("ArtCraft Launcher");
+        std::fs::create_dir_all(folder.join("ArtCraftLauncherData")).unwrap();
+        std::fs::write(folder.join("artcraft-launcher.exe"), "0.1.0").unwrap();
+        std::fs::write(folder.join("portable.txt"), "").unwrap();
+        std::fs::write(folder.join("ArtCraftLauncherData").join("settings.json"), "{}").unwrap();
+        let zip = dir.path().join("artcraft-launcher-0.2.0-windows-x64-portable.zip");
+        let mut writer = zip::ZipWriter::new(std::fs::File::create(&zip).unwrap());
+        let signed_exe = std::fs::read(system_program("cmd.exe")).unwrap();
+        for (name, body) in [
+            ("artcraft-launcher-0.2.0-windows-x64-portable/artcraft-launcher.exe", signed_exe.as_slice()),
+            ("artcraft-launcher-0.2.0-windows-x64-portable/portable.txt", b"".as_slice()),
+        ] {
+            writer.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+            writer.write_all(body).unwrap();
+        }
+        writer.finish().unwrap();
+        let tmp = dir.path().join("cache").join("launcher-update");
+        let step = Finish::Portable { zip: zip.clone(), tmp: tmp.clone() };
+
+        let mut old = std::process::Command::new("ping").args(["-n", "3", "127.0.0.1"]).stdout(std::process::Stdio::null()).spawn().unwrap();
+        let exe = folder.join("artcraft-launcher.exe");
+        let helper = {
+            let (exe, step, pid) = (exe.clone(), step.clone(), old.id());
+            std::thread::spawn(move || {
+                run_step(&crate::suite::LAUNCHER, &system_program("cmd.exe"), pid, &exe, &step, std::time::Duration::from_secs(30))
+            })
+        };
+        std::thread::sleep(std::time::Duration::from_millis(500));
+        assert_eq!(std::fs::read_to_string(&exe).unwrap(), "0.1.0", "replaced while the old launcher was still running");
+        old.wait().unwrap();
+        helper.join().unwrap().unwrap();
+        assert_eq!(std::fs::read(&exe).unwrap(), signed_exe);
+        assert_eq!(std::fs::read_to_string(folder.join("ArtCraftLauncherData").join("settings.json")).unwrap(), "{}");
+        assert!(!folder.join("artcraft-launcher-0.2.0-windows-x64-portable").exists(), "the zip's folder must not be nested in the launcher's");
+        assert!(!zip.exists() && !tmp.exists(), "the download and the staging folder are removed");
+    }
+
+    /// Stands in for the old launcher: `sort.exe` keeps running until the test closes its stdin
+    /// pipe, so the helper's wait cannot succeed early.
+    #[cfg(windows)]
+    struct BlockedLauncher {
+        child: Option<std::process::Child>,
+    }
+
+    #[cfg(windows)]
+    impl BlockedLauncher {
+        fn start() -> Self {
+            let child = std::process::Command::new(system_program("sort.exe"))
+                .stdin(std::process::Stdio::piped())
+                .stdout(std::process::Stdio::null())
+                .stderr(std::process::Stdio::null())
+                .spawn()
+                .unwrap();
+            Self { child: Some(child) }
+        }
+
+        fn id(&self) -> u32 {
+            self.child.as_ref().unwrap().id()
+        }
+
+        /// Fails unless the stand-in is still running. `try_wait` keeps the handle owned, so
+        /// `finish` and `Drop` can still reap it.
+        fn assert_running(&mut self, when: &str) {
+            let child = self.child.as_mut().unwrap();
+            assert!(child.try_wait().unwrap().is_none(), "the stand-in launcher had already exited {when}");
+        }
+
+        /// Closes the pipe so `sort.exe` exits, and reaps it. If reaping fails the child stays
+        /// owned by `self`, so `Drop` can still kill and reap it.
+        fn finish(&mut self) -> std::io::Result<std::process::ExitStatus> {
+            let child = self.child.as_mut().unwrap();
+            drop(child.stdin.take());
+            child.wait()
+        }
+    }
+
+    #[cfg(windows)]
+    impl Drop for BlockedLauncher {
+        fn drop(&mut self) {
+            if let Some(mut child) = self.child.take() {
+                // Closing the pipe normally lets sort exit; killing is the fallback after a failed
+                // assertion, and the wait reaps it either way.
+                drop(child.stdin.take());
+                let _ = child.kill();
+                let _ = child.wait();
+            }
+        }
+    }
+
+    /// A launcher without `portable.txt` is a standalone installation, and the helper still
+    /// replaces its own executable after it exits. The test holds a stand-in launcher alive
+    /// through a pipe and observes both sides of the helper's wait: the first assertion runs only
+    /// after the helper announces it is about to wait. A wait that returns while the stand-in is alive
+    /// fails the test before any extraction can replace the executable.
+    ///
+    /// The "still blocked" check is a bounded observation, not proof: a helper descheduled for the
+    /// whole window could hide a missing wait until the release below. A premature timeout longer
+    /// than this observation window is also outside this test's coverage.
+    #[cfg(windows)]
+    #[test]
+    fn a_standalone_update_replaces_the_launcher_after_it_exits() {
+        use std::io::Write;
+        use std::sync::mpsc::RecvTimeoutError;
+        let dir = tempfile::tempdir().unwrap();
+        let folder = dir.path().join("ArtCraft Launcher");
+        std::fs::create_dir_all(folder.join("ArtCraftLauncherData")).unwrap();
+        let exe = folder.join("artcraft-launcher.exe");
+        std::fs::write(&exe, "0.1.0").unwrap();
+        std::fs::write(folder.join("ArtCraftLauncherData").join("settings.json"), "{}").unwrap();
+        let zip = dir.path().join("artcraft-launcher-0.2.0-windows-x64-portable.zip");
+        let mut writer = zip::ZipWriter::new(std::fs::File::create(&zip).unwrap());
+        let signed_exe = std::fs::read(system_program("cmd.exe")).unwrap();
+        for (name, body) in [
+            ("artcraft-launcher-0.2.0-windows-x64-portable/artcraft-launcher.exe", signed_exe.as_slice()),
+            ("artcraft-launcher-0.2.0-windows-x64-portable/portable.txt", b"".as_slice()),
+        ] {
+            writer.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+            writer.write_all(body).unwrap();
+        }
+        writer.finish().unwrap();
+        let tmp = dir.path().join("cache").join(PORTABLE_STAGING);
+        let step = Finish::Portable { zip: zip.clone(), tmp: tmp.clone() };
+
+        // Timeouts only bound the test; each failure names the observation that never arrived.
+        let entered_timeout = std::time::Duration::from_secs(10);
+        let blocked_window = std::time::Duration::from_secs(2);
+        let returned_timeout = std::time::Duration::from_secs(30);
+
+        std::thread::scope(|scope| {
+            let mut old = BlockedLauncher::start();
+            let pid = old.id();
+            let watch = wait_watch::watch(pid);
+            let helper_exe = exe.clone();
+            let step = step.clone();
+            let helper = scope.spawn(move || {
+                run_step(&crate::suite::LAUNCHER, &system_program("cmd.exe"), pid, &helper_exe, &step, std::time::Duration::from_secs(30))
+            });
+            match watch.entered.recv_timeout(entered_timeout) {
+                Ok(()) => {}
+                Err(RecvTimeoutError::Timeout) => {
+                    panic!("the helper didn't reach its wait within {entered_timeout:?} (helper already finished: {})", helper.is_finished())
+                }
+                Err(RecvTimeoutError::Disconnected) => panic!("the entered channel disconnected before the helper reached its wait"),
+            }
+            old.assert_running("before the first replacement check");
+            assert_eq!(std::fs::read_to_string(&exe).unwrap(), "0.1.0", "replaced while the old launcher was still running");
+
+            // A correct wait can't return while the stand-in holds the pipe.
+            match watch.returned.recv_timeout(blocked_window) {
+                Err(RecvTimeoutError::Timeout) => {}
+                Ok(waited) => panic!("run_step left its wait while the old launcher was still running (waited: {waited})"),
+                Err(RecvTimeoutError::Disconnected) => panic!("the returned channel disconnected while the old launcher was still running"),
+            }
+            old.assert_running("after the wait was expected to stay blocked");
+            assert_eq!(std::fs::read_to_string(&exe).unwrap(), "0.1.0", "replaced while the old launcher was still running");
+
+            old.finish().expect("the stand-in launcher couldn't be reaped");
+            match watch.returned.recv_timeout(returned_timeout) {
+                Ok(waited) => assert!(waited, "the wait reported that the launcher was still running although it had exited"),
+                Err(RecvTimeoutError::Timeout) => panic!(
+                    "the helper didn't leave its wait within {returned_timeout:?} after the launcher exited (helper already finished: {})",
+                    helper.is_finished()
+                ),
+                Err(RecvTimeoutError::Disconnected) => panic!("the returned channel disconnected before reporting the wait's result"),
+            }
+            helper.join().unwrap().unwrap();
+        });
+        assert_eq!(std::fs::read(&exe).unwrap(), signed_exe);
+        assert_eq!(std::fs::read_to_string(folder.join("ArtCraftLauncherData").join("settings.json")).unwrap(), "{}");
+        // The update's zip carries `portable.txt`, so the replaced copy is detected as portable
+        // and keeps its data in the folder beside the executable.
+        assert_eq!(detect(&crate::suite::LAUNCHER, &exe), Some(Install::Portable(exe.clone())));
+        assert_eq!(Paths::for_exe(&crate::suite::LAUNCHER, &exe).unwrap().data, folder.join("ArtCraftLauncherData").join("data"));
+        assert!(!folder.join("artcraft-launcher-0.2.0-windows-x64-portable").exists(), "the zip's folder must not be nested in the launcher's");
+        assert!(!zip.exists() && !tmp.exists(), "the download and the staging folder are removed");
+    }
+
+    /// The helper finishes only the launcher's own update: its own installation, with the
+    /// download from its own cache. A signed launcher must not run or start anything else.
+    #[cfg(windows)]
+    #[test]
+    fn the_update_helper_refuses_anything_but_the_launchers_own_update() {
+        let dir = tempfile::tempdir().unwrap();
+        let folder = dir.path().join("ArtCraft Launcher");
+        std::fs::create_dir_all(&folder).unwrap();
+        let exe = folder.join("artcraft-launcher.exe");
+        std::fs::write(&exe, "0.1.0").unwrap();
+        std::fs::write(folder.join("portable.txt"), "").unwrap();
+        let paths = Paths::under(dir.path());
+        let cache = paths.cache.clone();
+        std::fs::create_dir_all(paths.downloads()).unwrap();
+        std::fs::create_dir_all(cache.join(HELPER_DIR)).unwrap();
+        let me = cache.join(HELPER_DIR).join("artcraft-launcher.exe");
+        std::fs::write(&me, "helper").unwrap();
+        let zip = paths.downloads().join("artcraft-launcher-0.2.0-windows-x64-portable.zip");
+        std::fs::write(&zip, "zip").unwrap();
+        let elsewhere = dir.path().join("elsewhere.zip");
+        std::fs::write(&elsewhere, "zip").unwrap();
+        let other = dir.path().join("other.exe");
+        std::fs::write(&other, "other").unwrap();
+        let other_in_folder = folder.join("other.exe");
+        std::fs::write(&other_in_folder, "other").unwrap();
+        let other_app = folder.join(format!("{}.exe", crate::suite::PHOTOCRAFT.id));
+        std::fs::write(&other_app, "another Craft app").unwrap();
+        let staging = cache.join(PORTABLE_STAGING);
+        let portable = |zip: &Path, tmp: &Path| Finish::Portable { zip: zip.to_path_buf(), tmp: tmp.to_path_buf() };
+
+        assert_eq!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &exe, &portable(&zip, &staging)), Ok(()));
+        // A helper that isn't in the installation's cache.
+        assert!(check_helper(&crate::suite::LAUNCHER, &other, &paths, &exe, &portable(&zip, &staging)).is_err());
+        // Not the launcher's installation.
+        assert!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &other, &portable(&zip, &staging)).is_err());
+        // A portable marker doesn't make a foreign executable the launcher.
+        assert!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &other_in_folder, &portable(&zip, &staging)).is_err());
+        // Another Craft App's executable is not the launcher, even in the same folder.
+        assert!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &other_app, &portable(&zip, &staging)).is_err());
+        // A download from outside the cache.
+        assert!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &exe, &portable(&elsewhere, &staging)).is_err());
+        // Unpacking anywhere but the cache's staging folder.
+        assert!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &exe, &portable(&zip, &dir.path().join(PORTABLE_STAGING))).is_err());
+        assert!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &exe, &portable(&zip, &paths.downloads())).is_err());
+        // An MSI for a portable installation.
+        assert!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &exe, &Finish::Msi(zip.clone())).is_err());
+        // Without portable.txt it is a standalone executable, which updates from the same zip.
+        std::fs::remove_file(folder.join("portable.txt")).unwrap();
+        assert_eq!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &exe, &portable(&zip, &staging)), Ok(()));
+        // A foreign executable is not a standalone launcher either.
+        assert!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &other_in_folder, &portable(&zip, &staging)).is_err());
+        // An MSI is for an MSI installation only.
+        assert!(check_helper(&crate::suite::LAUNCHER, &me, &paths, &exe, &Finish::Msi(zip.clone())).is_err());
+    }
+
+    /// The helper finds a portable launcher's folders beside it, as that launcher does.
+    #[test]
+    fn the_helper_uses_the_portable_launchers_own_folders() {
+        let dir = tempfile::tempdir().unwrap();
+        let exe = dir.path().join("artcraft-launcher.exe");
+        std::fs::write(dir.path().join("portable.txt"), "").unwrap();
+        let paths = Paths::for_exe(&crate::suite::LAUNCHER, &exe).unwrap();
+        assert_eq!(paths.cache, dir.path().join("ArtCraftLauncherData").join("cache"));
+        assert_eq!(paths.data, dir.path().join("ArtCraftLauncherData").join("data"));
+    }
+
+    /// The launcher quits for an update only when the helper finds the cache the update was
+    /// downloaded into. One that keeps its files in the temporary folder, because its own folders
+    /// couldn't be found, refuses before it quits: the helper would look in the per-user folders.
+    #[cfg(windows)]
+    #[test]
+    fn a_launcher_whose_helper_looks_in_other_folders_does_not_quit_for_an_update() {
+        let dir = tempfile::tempdir().unwrap();
+        let folder = dir.path().join("ArtCraft Launcher");
+        std::fs::create_dir_all(&folder).unwrap();
+        let exe = folder.join("artcraft-launcher.exe");
+        std::fs::write(&exe, "0.1.0").unwrap();
+        let own = Paths::under(&folder.join("ArtCraftLauncherData"));
+        let temporary = Paths::under(&dir.path().join("Temp").join("artcraft-launcher"));
+        for paths in [&own, &temporary] {
+            std::fs::create_dir_all(paths.downloads()).unwrap();
+        }
+        // Installed with the MSI: the helper calls `Paths::new` again.
+        assert!(same_cache_as_helper(&crate::suite::LAUNCHER, &temporary, &exe).is_err_and(|e| e.contains("can't update itself")));
+        std::fs::write(folder.join("portable.txt"), "").unwrap();
+        assert_eq!(same_cache_as_helper(&crate::suite::LAUNCHER, &own, &exe), Ok(()));
+        assert!(same_cache_as_helper(&crate::suite::LAUNCHER, &temporary, &exe).is_err());
+    }
+
+    /// An update whose swap couldn't be scheduled stays on offer, and a scheduled one is not
+    /// offered again unless the helper, running alongside, records that it failed.
+    #[test]
+    fn only_a_scheduled_update_is_recorded_as_installed() {
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        std::fs::create_dir_all(&paths.data).unwrap();
+        let release = Release { tag: "v0.2.0".into(), ..Release::default() };
+        mark_installed(&paths, &release);
+        assert!(unmark_unless_scheduled(&paths, Err("couldn't schedule the update".into())).is_err());
+        assert!(!just_updated_to(&paths, &release));
+        mark_installed(&paths, &release);
+        assert!(unmark_unless_scheduled(&paths, Ok(())).is_ok());
+        assert!(just_updated_to(&paths, &release));
+        // The helper refuses before this process has finished scheduling it.
+        mark_installed(&paths, &release);
+        record_failure(&paths, "the update helper only finishes ArtCraft Launcher's own update");
+        assert!(unmark_unless_scheduled(&paths, Ok(())).is_ok());
+        assert!(!just_updated_to(&paths, &release), "a failure the helper recorded must stay recorded");
+    }
+
+    /// A failed update is offered again and its error is logged at the next start, once.
+    #[test]
+    fn a_failed_update_is_offered_again_and_reported_once() {
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        let release = Release { tag: "v0.2.0".into(), ..Release::default() };
+        std::fs::create_dir_all(&paths.data).unwrap();
+        crate::paths::write_atomic(&marker(&paths), format!("v0.2.0\n{}\n", crate::now()).as_bytes()).unwrap();
+        assert!(just_updated_to(&paths, &release));
+        record_failure(&paths, "the Windows Installer stopped with error 1603");
+        assert!(!just_updated_to(&paths, &release));
+        assert_eq!(take_failure(&paths).as_deref(), Some("the Windows Installer stopped with error 1603"));
+        assert_eq!(take_failure(&paths), None);
+    }
+
+    /// A launcher that doesn't quit keeps its files, and the download is still removed.
+    #[cfg(windows)]
+    #[test]
+    fn a_launcher_that_keeps_running_is_not_replaced() {
+        let dir = tempfile::tempdir().unwrap();
+        let exe = dir.path().join("artcraft-launcher.exe");
+        std::fs::write(&exe, "0.1.0").unwrap();
+        let msi = dir.path().join("artcraft-launcher-0.2.0-windows-x64.msi");
+        std::fs::write(&msi, "not a package").unwrap();
+        let running = std::process::id();
+        let started = std::time::Instant::now();
+        // The test process itself never exits within the wait, so the package is never run.
+        let error = run_step(
+            &crate::suite::LAUNCHER,
+            &system_program("cmd.exe"),
+            running,
+            &exe,
+            &Finish::Msi(msi.clone()),
+            std::time::Duration::from_millis(300),
+        )
+        .unwrap_err();
+        assert!(error.contains("still running"), "{error}");
+        assert!(started.elapsed() < std::time::Duration::from_secs(30));
+        assert_eq!(std::fs::read_to_string(&exe).unwrap(), "0.1.0");
+        assert!(!msi.exists());
+    }
+
+    #[cfg(windows)]
+    fn system_program(name: &str) -> PathBuf {
+        PathBuf::from(std::env::var_os("SystemRoot").unwrap()).join("System32").join(name)
+    }
+
+    /// The process id of a process that has already exited.
+    #[cfg(windows)]
+    fn exited_pid() -> u32 {
+        let mut gone = std::process::Command::new("cmd").args(["/C", "exit"]).spawn().unwrap();
+        gone.wait().unwrap();
+        gone.id()
+    }
+
+    /// A catalog-signed program matches itself; an unsigned one never does, on either side.
+    #[cfg(windows)]
+    #[test]
+    fn a_file_must_be_signed_by_the_launchers_own_publisher() {
+        let cmd = system_program("cmd.exe");
+        // `cargo test` binaries are unsigned.
+        let unsigned = std::env::current_exe().unwrap();
+        assert_eq!(signed_like(&crate::suite::LAUNCHER, &cmd, &cmd), Ok(()));
+        assert!(signed_like(&crate::suite::LAUNCHER, &cmd, &unsigned).is_err_and(|e| e.contains("isn't signed")));
+        assert!(signed_like(&crate::suite::LAUNCHER, &unsigned, &cmd).is_err_and(|e| e.contains("doesn't install updates")));
+    }
+
+    /// An unsigned launcher says so before it quits for an update. `cargo test` binaries are
+    /// unsigned, like a package built without the signing secrets.
+    #[cfg(windows)]
+    #[test]
+    fn an_unsigned_launcher_refuses_to_update_before_it_quits() {
+        let dir = tempfile::tempdir().unwrap();
+        let msi = dir.path().join("artcraft-launcher-0.2.0-windows-x64.msi");
+        std::fs::write(&msi, "not a package").unwrap();
+        for install in [Install::Msi(system_program("msiexec.exe")), Install::Portable(system_program("msiexec.exe"))] {
+            let error = windows_precheck(&crate::suite::LAUNCHER, &install, &Paths::under(dir.path()), &msi).unwrap_err();
+            assert!(error.contains("isn't signed"), "{error}");
+        }
+    }
+
+    /// An MSI that isn't signed by the launcher's publisher is never handed to the Windows Installer.
+    #[cfg(windows)]
+    #[test]
+    fn an_unsigned_msi_is_never_run() {
+        let dir = tempfile::tempdir().unwrap();
+        let exe = dir.path().join("artcraft-launcher.exe");
+        std::fs::write(&exe, "0.1.0").unwrap();
+        let msi = dir.path().join("artcraft-launcher-0.2.0-windows-x64.msi");
+        std::fs::write(&msi, "not a package").unwrap();
+        let error = run_step(
+            &crate::suite::LAUNCHER,
+            &system_program("cmd.exe"),
+            exited_pid(),
+            &exe,
+            &Finish::Msi(msi.clone()),
+            std::time::Duration::from_secs(5),
+        )
+        .unwrap_err();
+        assert!(error.contains("isn't signed"), "{error}");
+        assert!(!msi.exists());
+    }
+
+    /// A program in the portable zip that isn't signed by the launcher's publisher stops the
+    /// update before any file is replaced.
+    #[cfg(windows)]
+    #[test]
+    fn an_unsigned_program_in_the_portable_zip_is_not_installed() {
+        use std::io::Write;
+        let dir = tempfile::tempdir().unwrap();
+        let folder = dir.path().join("ArtCraft Launcher");
+        std::fs::create_dir_all(&folder).unwrap();
+        let exe = folder.join("artcraft-launcher.exe");
+        std::fs::write(&exe, "0.1.0").unwrap();
+        let zip = dir.path().join("artcraft-launcher-0.2.0-windows-x64-portable.zip");
+        let mut writer = zip::ZipWriter::new(std::fs::File::create(&zip).unwrap());
+        writer.start_file("artcraft-launcher-0.2.0-windows-x64-portable/README.md", zip::write::SimpleFileOptions::default()).unwrap();
+        writer.write_all(b"# ArtCraft Launcher").unwrap();
+        writer.start_file("artcraft-launcher-0.2.0-windows-x64-portable/artcraft-launcher.exe", zip::write::SimpleFileOptions::default()).unwrap();
+        writer.write_all(&std::fs::read(system_program("cmd.exe")).unwrap()).unwrap();
+        // An unsigned program under a harmless name.
+        writer.start_file("artcraft-launcher-0.2.0-windows-x64-portable/notes.txt", zip::write::SimpleFileOptions::default()).unwrap();
+        writer.write_all(&std::fs::read(std::env::current_exe().unwrap()).unwrap()).unwrap();
+        writer.finish().unwrap();
+        let tmp = dir.path().join("cache").join(PORTABLE_STAGING);
+        let step = Finish::Portable { zip: zip.clone(), tmp: tmp.clone() };
+        let error =
+            run_step(&crate::suite::LAUNCHER, &system_program("cmd.exe"), exited_pid(), &exe, &step, std::time::Duration::from_secs(5)).unwrap_err();
+        assert!(error.contains("isn't signed"), "{error}");
+        assert_eq!(std::fs::read_to_string(&exe).unwrap(), "0.1.0");
+        assert!(!folder.join("README.md").exists() && !folder.join("notes.txt").exists(), "nothing is copied");
+        assert!(!zip.exists() && !tmp.exists());
+    }
+
+    /// A missing or malformed executable must be rejected before any installed file is changed.
+    #[cfg(windows)]
+    #[test]
+    fn a_portable_update_requires_a_signed_launcher_even_without_an_mz_header() {
+        use std::io::Write;
+        for launcher in [None, Some(b"not a Windows program".as_slice()), Some(b"".as_slice())] {
+            let dir = tempfile::tempdir().unwrap();
+            let folder = dir.path().join("ArtCraft Launcher");
+            std::fs::create_dir_all(folder.join("ArtCraftLauncherData")).unwrap();
+            let exe = folder.join("artcraft-launcher.exe");
+            std::fs::write(&exe, "old launcher").unwrap();
+            let settings = folder.join("ArtCraftLauncherData/settings.json");
+            std::fs::write(&settings, "settings").unwrap();
+            let zip = dir.path().join("update.zip");
+            let mut writer = zip::ZipWriter::new(std::fs::File::create(&zip).unwrap());
+            writer.start_file("launcher/README.md", zip::write::SimpleFileOptions::default()).unwrap();
+            writer.write_all(b"new readme").unwrap();
+            if let Some(body) = launcher {
+                writer.start_file("launcher/artcraft-launcher.exe", zip::write::SimpleFileOptions::default()).unwrap();
+                writer.write_all(body).unwrap();
+            }
+            writer.finish().unwrap();
+            let tmp = dir.path().join(PORTABLE_STAGING);
+            let step = Finish::Portable { zip: zip.clone(), tmp: tmp.clone() };
+            let error = run_step(&crate::suite::LAUNCHER, &system_program("cmd.exe"), exited_pid(), &exe, &step, std::time::Duration::from_secs(5))
+                .unwrap_err();
+            assert!(error.contains(if launcher.is_some() { "isn't signed" } else { "doesn't contain" }), "{error}");
+            assert_eq!(std::fs::read(&exe).unwrap(), b"old launcher");
+            assert_eq!(std::fs::read(&settings).unwrap(), b"settings");
+            assert!(!folder.join("README.md").exists());
+            assert!(!zip.exists() && !tmp.exists());
+        }
+    }
+
+    /// A copy that fails part way through puts the previous files back and removes the new ones,
+    /// so the launcher that starts again is the old one, whole.
+    #[cfg(windows)]
+    #[test]
+    fn a_portable_update_that_fails_part_way_puts_the_old_files_back() {
+        use std::io::Write;
+        let dir = tempfile::tempdir().unwrap();
+        let folder = dir.path().join("ArtCraft Launcher");
+        // A folder where the zip has a file: copying it there fails after the exe was replaced.
+        std::fs::create_dir_all(folder.join("NOTICE")).unwrap();
+        let exe = folder.join("artcraft-launcher.exe");
+        std::fs::write(&exe, "0.1.0").unwrap();
+        let zip = dir.path().join("artcraft-launcher-0.2.0-windows-x64-portable.zip");
+        let mut writer = zip::ZipWriter::new(std::fs::File::create(&zip).unwrap());
+        let signed_exe = std::fs::read(system_program("cmd.exe")).unwrap();
+        for (name, body) in [
+            ("artcraft-launcher-0.2.0-windows-x64-portable/artcraft-launcher.exe", signed_exe.as_slice()),
+            ("artcraft-launcher-0.2.0-windows-x64-portable/README.md", b"# ArtCraft Launcher".as_slice()),
+            ("artcraft-launcher-0.2.0-windows-x64-portable/NOTICE", b"notice".as_slice()),
+        ] {
+            writer.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+            writer.write_all(body).unwrap();
+        }
+        writer.finish().unwrap();
+        let tmp = dir.path().join("cache").join(PORTABLE_STAGING);
+        let step = Finish::Portable { zip: zip.clone(), tmp: tmp.clone() };
+        let error =
+            run_step(&crate::suite::LAUNCHER, &system_program("cmd.exe"), exited_pid(), &exe, &step, std::time::Duration::from_secs(5)).unwrap_err();
+        assert!(error.contains("NOTICE"), "{error}");
+        assert_eq!(std::fs::read_to_string(&exe).unwrap(), "0.1.0", "the previous exe is put back");
+        assert!(!folder.join("README.md").exists(), "a file the update added is removed");
+        assert!(!zip.exists() && !tmp.exists());
+    }
+
+    #[test]
+    fn a_corrupt_self_update_timestamp_does_not_overflow() {
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        let release = Release { tag: "v0.2.0".into(), ..Release::default() };
+        crate::paths::write_atomic(&marker(&paths), format!("v0.2.0\n{}\n", i64::MIN).as_bytes()).unwrap();
+        assert!(!just_updated_to(&paths, &release));
+    }
+
+    #[test]
+    fn a_future_self_update_timestamp_does_not_suppress_updates() {
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        let release = Release { tag: "v0.2.0".into(), ..Release::default() };
+        for at in [crate::now() + JUST_UPDATED_FOR, i64::MAX] {
+            crate::paths::write_atomic(&marker(&paths), format!("v0.2.0\n{at}\n").as_bytes()).unwrap();
+            assert!(!just_updated_to(&paths, &release), "future timestamp {at}");
+        }
+    }
+
+    #[test]
+    fn a_version_just_installed_is_not_offered_again() {
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        let r = Release { tag: "v0.2.0".into(), ..Release::default() };
+        assert!(!just_updated_to(&paths, &r));
+        crate::paths::write_atomic(&marker(&paths), format!("v0.2.0\n{}\n", crate::now()).as_bytes()).unwrap();
+        assert!(just_updated_to(&paths, &r));
+        assert!(!just_updated_to(&paths, &Release { tag: "v0.3.0".into(), ..Release::default() }));
+        // A day later the guard lapses.
+        crate::paths::write_atomic(&marker(&paths), format!("v0.2.0\n{}\n", crate::now() - JUST_UPDATED_FOR - 1).as_bytes()).unwrap();
+        assert!(!just_updated_to(&paths, &r));
+    }
+
+    /// The restart helper doesn't pass a pretend version on to the new launcher.
+    #[cfg(unix)]
+    #[test]
+    fn the_restarted_launcher_does_not_inherit_a_pretend_version() {
+        let cmd = helper_command(1, &[std::ffi::OsStr::new("/usr/bin/true")]);
+        assert!(cmd.get_envs().any(|(k, v)| k == PRETEND_VAR && v.is_none()), "the helper must remove {PRETEND_VAR}");
+    }
+
+    /// The helper waits for the old launcher to exit before it starts the new one.
+    #[cfg(unix)]
+    #[test]
+    fn the_restart_waits_for_the_old_process_to_exit() {
+        let dir = tempfile::tempdir().unwrap();
+        let marker = dir.path().join("started");
+        let mut old = std::process::Command::new("sleep").arg("1").spawn().unwrap();
+        relaunch_after_exit(old.id(), &[std::ffi::OsStr::new("touch"), marker.as_os_str()]).unwrap();
+        std::thread::sleep(std::time::Duration::from_millis(400));
+        assert!(!marker.exists(), "started while the old launcher was still running");
+        old.wait().unwrap();
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+        while !marker.exists() && std::time::Instant::now() < deadline {
+            std::thread::sleep(std::time::Duration::from_millis(50));
+        }
+        assert!(marker.exists(), "never started after the old launcher exited");
+    }
+
+    /// A real disk image: the new `ArtCraft Launcher.app` replaces the old one in place.
+    #[cfg(target_os = "macos")]
+    #[test]
+    fn the_new_bundle_replaces_the_running_one() {
+        fn bundle(at: &Path, version: &str) {
+            let contents = at.join("ArtCraft Launcher.app/Contents");
+            std::fs::create_dir_all(contents.join("MacOS")).unwrap();
+            std::fs::write(
+                contents.join("Info.plist"),
+                format!(
+                    "<?xml version=\"1.0\" encoding=\"UTF-8\"?><plist version=\"1.0\"><dict>\
+                     <key>CFBundleIdentifier</key><string>ai.storyteller.artcraft-launcher</string>\
+                     <key>CFBundleShortVersionString</key><string>{version}</string></dict></plist>"
+                ),
+            )
+            .unwrap();
+            std::fs::write(contents.join("MacOS/ArtCraft Launcher"), version).unwrap();
+        }
+        let dir = tempfile::tempdir().unwrap();
+        let apps = dir.path().join("Applications");
+        bundle(&apps, "0.1.0");
+        let src = dir.path().join("src");
+        bundle(&src, "0.2.0");
+        let dmg = dir.path().join("artcraft-launcher-0.2.0-macos-universal.dmg");
+        let one_at_a_time = install::macos::DISK_IMAGES.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let ok = std::process::Command::new("hdiutil")
+            .args(["create", "-quiet", "-format", "UDZO", "-volname", "ArtCraft Launcher 0.2.0", "-srcfolder"])
+            .arg(&src)
+            .arg(&dmg)
+            .status()
+            .unwrap()
+            .success();
+        assert!(ok, "hdiutil create failed");
+        drop(one_at_a_time);
+        let current = apps.join("ArtCraft Launcher.app");
+        let existing = Installed { version: None, source: InstallSource::MacApp, location: current.display().to_string(), package: None };
+        // An unsigned test bundle: the signature check has its own tests in `install`.
+        let expect = install::macos::Expect { team: None, version: None };
+        let placed =
+            install::macos::install_dmg(&crate::suite::LAUNCHER, &dmg, Some(&existing), None, false, &Paths::under(dir.path()), &expect).unwrap();
+        assert_eq!(placed, current);
+        assert_eq!(std::fs::read_to_string(current.join("Contents/MacOS/ArtCraft Launcher")).unwrap(), "0.2.0");
+        assert_eq!(
+            std::fs::read_dir(&apps).unwrap().map(|e| e.unwrap().file_name()).collect::<Vec<_>>(),
+            [std::ffi::OsString::from("ArtCraft Launcher.app")]
+        );
+    }
+
+    /// A directory laid out like Cargo's target tree: `.rustc_info.json` at the root and the
+    /// executable below `profile` (with or without a target triple in between).
+    fn cargo_build_tree(dir: &Path, root: &str, relative_exe: &str) -> PathBuf {
+        let root = dir.join(root);
+        let exe = root.join(relative_exe);
+        std::fs::create_dir_all(exe.parent().unwrap()).unwrap();
+        std::fs::write(root.join(".rustc_info.json"), "{}").unwrap();
+        std::fs::write(&exe, "ELF").unwrap();
+        exe
+    }
+
+    /// A directory laid out like a Cargo target tree whose rustc-info cache was disabled: the
+    /// target root has `CACHEDIR.TAG`, but no `.rustc_info.json`. `profile` is relative to the
+    /// target root, so it may include a target triple.
+    fn cargo_build_tree_without_rustc_info(dir: &Path, profile: &str, exe: &str) -> PathBuf {
+        let root = dir.join("target");
+        let profile = root.join(profile);
+        for sub in [".fingerprint", "deps", "build"] {
+            std::fs::create_dir_all(profile.join(sub)).unwrap();
+        }
+        let exe = root.join(exe);
+        std::fs::create_dir_all(exe.parent().unwrap()).unwrap();
+        std::fs::write(root.join(CARGO_CACHE_MARKER), "Signature: 8a477f597d28d172789f06886806bc55\n").unwrap();
+        std::fs::write(&exe, "ELF").unwrap();
+        exe
+    }
+
+    /// `CARGO_TARGET_DIR` moves the build tree; the executable in it is still a development build,
+    /// whatever the profile or target triple is called.
+    #[test]
+    fn a_development_build_under_a_custom_target_dir_is_detected() {
+        let dir = tempfile::tempdir().unwrap();
+        for exe in [
+            "debug/deps/craft_update-e8899812898c870d",
+            "release/artcraft-launcher",
+            "x86_64-pc-windows-gnu/debug/deps/craft_update-0123456789abcdef",
+            "x86_64-pc-windows-gnu/my-profile/deps/artcraft-launcher-0123456789abcdef",
+        ] {
+            let exe = cargo_build_tree(dir.path(), "builds/egui037-craft-libs", exe);
+            assert!(is_development_build(&exe, false), "{}", exe.display());
+        }
+    }
+
+    /// A Cargo build tree is not recognised by names: an installed copy in a folder literally
+    /// called `target` stays an installed copy.
+    #[test]
+    fn an_installed_copy_in_a_folder_called_target_is_not_a_development_build() {
+        let dir = tempfile::tempdir().unwrap();
+        let folder = dir.path().join("target").join("ArtCraft Launcher");
+        std::fs::create_dir_all(&folder).unwrap();
+        let exe = folder.join("artcraft-launcher.exe");
+        std::fs::write(&exe, "MZ").unwrap();
+        assert!(!is_development_build(&exe, false), "a folder named target is not a build tree");
+    }
+
+    /// `CACHEDIR.TAG` has a generic signature, used by every cache directory; without Cargo's
+    /// profile layout it does not identify a development build.
+    #[test]
+    fn a_generic_cache_marker_is_not_a_cargo_target_dir() {
+        let dir = tempfile::tempdir().unwrap();
+        let cache = dir.path().join("cache");
+        let exe = cache.join("ArtCraft Launcher").join("artcraft-launcher");
+        std::fs::create_dir_all(exe.parent().unwrap()).unwrap();
+        std::fs::write(cache.join("CACHEDIR.TAG"), "Signature: 8a477f597d28d172789f06886806bc55\n").unwrap();
+        std::fs::write(&exe, "ELF").unwrap();
+        assert!(!is_development_build(&exe, false), "a generic cache is not a Cargo build tree");
+    }
+
+    /// `CARGO_CACHE_RUSTC_INFO=0` leaves no `.rustc_info.json`; the profile layout plus the
+    /// target root's `CACHEDIR.TAG` still identify a development build, whatever the profile or
+    /// target triple is called.
+    #[test]
+    fn a_cargo_build_tree_without_rustc_info_is_detected() {
+        let dir = tempfile::tempdir().unwrap();
+        for (profile, exe) in [
+            ("debug", "debug/deps/craft_update-e8899812898c870d"),
+            ("release", "release/artcraft-launcher"),
+            ("my-profile", "my-profile/artcraft-launcher"),
+            ("x86_64-pc-windows-gnu/my-profile", "x86_64-pc-windows-gnu/my-profile/deps/artcraft-launcher-0123456789abcdef"),
+        ] {
+            let exe = cargo_build_tree_without_rustc_info(dir.path(), profile, exe);
+            assert!(is_development_build(&exe, false), "{}", exe.display());
+        }
+    }
+
+    /// The fallback needs the complete profile layout and the target root's cache marker; a
+    /// partial layout or a missing marker isn't enough.
+    #[test]
+    fn an_incomplete_cargo_layout_is_not_a_development_build() {
+        let dir = tempfile::tempdir().unwrap();
+        for missing in [".fingerprint", "deps", "build"] {
+            let exe = cargo_build_tree_without_rustc_info(dir.path(), "debug", "debug/deps/artcraft-launcher");
+            std::fs::remove_dir_all(dir.path().join("target/debug").join(missing)).unwrap();
+            assert!(!is_development_build(&exe, false), "missing {missing}");
+        }
+
+        let dir = tempfile::tempdir().unwrap();
+        let exe = cargo_build_tree_without_rustc_info(dir.path(), "debug", "debug/deps/artcraft-launcher");
+        std::fs::remove_file(dir.path().join("target").join(CARGO_CACHE_MARKER)).unwrap();
+        assert!(!is_development_build(&exe, false), "a profile layout without the target-root marker");
+    }
+
+    /// An installed copy that merely lives below a Cargo project isn't in that project's target
+    /// tree, even when the project has a build tree of its own.
+    #[test]
+    fn an_installed_copy_beneath_a_cargo_project_is_not_a_development_build() {
+        let dir = tempfile::tempdir().unwrap();
+        let project = dir.path().join("project");
+        std::fs::create_dir_all(project.join("src")).unwrap();
+        std::fs::write(project.join("Cargo.toml"), "[package]\nname = \"installer\"\n").unwrap();
+        cargo_build_tree_without_rustc_info(&project, "debug", "debug/deps/installer-0123456789abcdef");
+        let exe = project.join("dist").join("artcraft-launcher");
+        std::fs::create_dir_all(exe.parent().unwrap()).unwrap();
+        std::fs::write(&exe, "ELF").unwrap();
+        assert!(!is_development_build(&exe, false), "{}", exe.display());
+    }
+
+    /// Both markers must be files: a directory of the same name doesn't identify or corroborate
+    /// a build tree.
+    #[test]
+    fn marker_directories_are_not_development_builds() {
+        let dir = tempfile::tempdir().unwrap();
+        let exe = dir.path().join("builds").join("debug").join("deps").join("artcraft-launcher");
+        std::fs::create_dir_all(exe.parent().unwrap()).unwrap();
+        std::fs::create_dir_all(dir.path().join("builds").join(".rustc_info.json")).unwrap();
+        std::fs::write(&exe, "ELF").unwrap();
+        assert!(!is_development_build(&exe, false), "a directory named .rustc_info.json");
+
+        let dir = tempfile::tempdir().unwrap();
+        let exe = cargo_build_tree_without_rustc_info(dir.path(), "debug", "debug/deps/artcraft-launcher");
+        let root = dir.path().join("target");
+        std::fs::remove_file(root.join(CARGO_CACHE_MARKER)).unwrap();
+        std::fs::create_dir(root.join(CARGO_CACHE_MARKER)).unwrap();
+        assert!(!is_development_build(&exe, false), "a directory named CACHEDIR.TAG");
+    }
+
+    /// `CRAFT_UPDATE_DEV` still lets a development build try the self-update.
+    #[test]
+    fn a_development_build_can_opt_in_to_updating_itself() {
+        let dir = tempfile::tempdir().unwrap();
+        let exe = cargo_build_tree(dir.path(), "builds/egui037-craft-libs", "release/artcraft-launcher");
+        assert!(!is_development_build(&exe, true));
+    }
+
+    /// The opt-in also covers a build only recognised through the cache-disabled fallback.
+    #[test]
+    fn a_development_build_without_rustc_info_can_opt_in_to_updating_itself() {
+        let dir = tempfile::tempdir().unwrap();
+        let exe = cargo_build_tree_without_rustc_info(dir.path(), "release", "release/artcraft-launcher");
+        assert!(!is_development_build(&exe, true));
+    }
+
+    #[test]
+    fn a_development_build_does_not_update_itself() {
+        // An archived test runner may relocate its executable without Cargo's metadata.
+        // Supply a complete cache-disabled build tree so this checks the updater guard,
+        // independent of the runner's location and the ambient `CRAFT_UPDATE_DEV` value.
+        let dir = tempfile::tempdir().unwrap();
+        let exe = cargo_build_tree_without_rustc_info(dir.path(), "debug", "debug/deps/artcraft-launcher");
+        assert!(is_development_build(&exe, false), "{} should be inside a Cargo target directory", exe.display());
+        assert_eq!(current_at(&crate::suite::LAUNCHER, &exe, false), None);
+    }
+
+    /// The guard in `current_at` runs before platform detection, so a development executable is
+    /// rejected without probing the ambient host.
+    #[test]
+    fn current_at_rejects_a_development_build_before_detection() {
+        let dir = tempfile::tempdir().unwrap();
+        let exe = cargo_build_tree(dir.path(), "builds/egui037-craft-libs", "debug/artcraft-launcher");
+        assert_eq!(current_at(&crate::suite::LAUNCHER, &exe, false), None);
+    }
+
+    #[test]
+    fn the_launcher_picks_its_own_release_files() {
+        let names = [
+            "artcraft-launcher-0.2.0-macos-universal.dmg",
+            "artcraft-launcher-0.2.0-windows-x64.msi",
+            "artcraft-launcher-0.2.0-windows-x64-portable.zip",
+            "artcraft-launcher-0.2.0-linux-x86_64.AppImage",
+            "artcraft-launcher-0.2.0-linux-x86_64.deb",
+            "artcraft-launcher-0.2.0-linux-x86_64.flatpak",
+            "artcraft-launcher-0.2.0-linux-x86_64.pkg.tar.zst",
+            "artcraft-launcher-web-0.2.0.zip",
+        ];
+        let release = Release {
+            assets: names.iter().map(|n| crate::release::Asset { name: (*n).into(), size: 1, url: String::new(), sha256: None }).collect(),
+            ..Release::default()
+        };
+        use crate::{Arch, Os};
+        let pick =
+            |os, kind| pick_asset(&release, &[crate::suite::LAUNCHER.id], Platform { os, arch: Arch::X64 }, &[kind]).map(|(a, _)| a.name.clone());
+        assert_eq!(pick(Os::MacOs, Install::MacApp(PathBuf::new()).kind()).as_deref(), Some(names[0]));
+        assert_eq!(pick(Os::Windows, Install::Msi(PathBuf::new()).kind()).as_deref(), Some(names[1]));
+        assert_eq!(pick(Os::Windows, Install::Portable(PathBuf::new()).kind()).as_deref(), Some(names[2]));
+        assert_eq!(pick(Os::Linux, Install::AppImage(PathBuf::new()).kind()).as_deref(), Some(names[3]));
+        assert_eq!(pick(Os::Linux, Install::Package(PackageKind::Deb, PathBuf::new()).kind()).as_deref(), Some(names[4]));
+        assert_eq!(pick(Os::Linux, Install::Flatpak.kind()).as_deref(), Some(names[5]));
+        assert_eq!(pick(Os::Linux, Install::Package(PackageKind::ArchPkg, PathBuf::new()).kind()).as_deref(), Some(names[6]));
+    }
+
+    #[test]
+    fn update_refuses_to_downgrade_when_release_is_older() {
+        let dir = tempfile::tempdir().unwrap();
+        let paths = Paths::under(dir.path());
+        let http = Http::new(crate::TEST_AGENT).unwrap();
+        let mut phase = |_| ();
+        let last = || Ok(());
+        let stop = Stop::default();
+        let release = Release {
+            version: version::parse("0.1.0"),
+            tag: "v0.1.0".into(),
+            assets: vec![crate::release::Asset {
+                name: "artcraft-launcher-0.1.0-linux-x86_64.AppImage".into(),
+                size: 1,
+                url: String::new(),
+                sha256: None,
+            }],
+            ..Release::default()
+        };
+        let install = Install::AppImage(dir.path().join("launcher.AppImage"));
+        use crate::{Arch, Os};
+        let platform = Platform { os: Os::Linux, arch: Arch::X64 };
+        let result = update(&crate::suite::LAUNCHER, &install, &release, platform, &http, &paths, &stop, &mut phase, &last, Some("0.2.0"));
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("is not newer than currently running version"));
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn parses_flatpak_metadata_for_restart() {
+        let info = "[Application]\nname=ai.storyteller.artcraft-launcher\n\n[Instance]\ninstance-id=155661136\n";
+        assert_eq!(parse_flatpak_instance_id(info), Some("155661136".to_string()));
+        assert_eq!(parse_flatpak_instance_id("no instance id here"), None);
+
+        let ps = "Instance   PID    Application\n155661136  842791 ai.storyteller.artcraft-launcher\n";
+        assert_eq!(parse_flatpak_host_pid(ps, "155661136"), Some(842791));
+        assert_eq!(parse_flatpak_host_pid(ps, "999999999"), None);
+    }
+
+    /// Only the per-user installation's copy updates itself; a system-wide one is left alone.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn only_a_per_user_install_updates_itself() {
+        let info = |path: &str| format!("[Application]\nname=ai.storyteller.artcraft-launcher\n\n[Instance]\ninstance-id=1\napp-path={path}\n");
+        assert!(parse_is_user_install(&info("/home/alice/.local/share/flatpak/app/ai.storyteller.artcraft-launcher/x86_64/stable/0a3de1c/files")));
+        assert!(!parse_is_user_install(&info("/var/lib/flatpak/app/ai.storyteller.artcraft-launcher/x86_64/stable/0a3de1c/files")));
+        // `flatpak run --app-path=` mounts an empty /app.
+        assert!(!parse_is_user_install(&info("")));
+        // The key belongs to [Instance] only.
+        assert!(!parse_is_user_install("[Application]\napp-path=/home/alice/.local/share/flatpak/app/x/files\n"));
+        assert!(!parse_is_user_install("[Instance]\ninstance-id=123\n"));
+        assert!(!parse_is_user_install(""));
+    }
+
+    /// A copy from a repository (Flathub or any other) isn't the bundle's to replace.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn only_a_bundle_origin_counts_as_the_release_bundle() {
+        assert!(is_bundle_origin(&crate::suite::LAUNCHER, "artcraft-launcher-origin"));
+        assert!(is_bundle_origin(&crate::suite::LAUNCHER, "artcraft-launcher2-origin"));
+        assert!(!is_bundle_origin(&crate::suite::LAUNCHER, "flathub"));
+        assert!(!is_bundle_origin(&crate::suite::LAUNCHER, "flathub-beta"));
+        assert!(!is_bundle_origin(&crate::suite::LAUNCHER, "artcraft-launcher-beta-origin"));
+        assert!(!is_bundle_origin(&crate::suite::LAUNCHER, "photocraft-origin"));
+        assert!(is_bundle_origin(&crate::suite::PHOTOCRAFT, "photocraft-origin"));
+        assert!(!is_bundle_origin(&crate::suite::LAUNCHER, ""));
+    }
+}
diff --git a/crates/update/src/source.rs b/crates/update/src/source.rs
new file mode 100644
index 00000000..e71e8dcb
--- /dev/null
+++ b/crates/update/src/source.rs
@@ -0,0 +1,198 @@
+//! Where release information comes from.
+//!
+//! [`GitHubSource`] asks the GitHub REST API (one request per app, revalidated with ETags) and,
+//! when the API is out of quota, falls back to github.com's release pages: the
+//! `releases/latest` redirect names the tag and `SHA256SUMS.txt` lists every file with its
+//! checksum, which costs no API quota at all. A later [`ReleaseSource`] will ask the ArtCraft
+//! catalog API for every app in one request.
+
+use std::collections::BTreeMap;
+use std::sync::{Mutex, PoisonError};
+
+use crate::protocol::{LatestRelease, Source};
+use crate::release::{self, Release};
+use serde::{Deserialize, Serialize};
+
+use crate::http::{Fetched, Http};
+
+/// One answer from a source.
+#[derive(Clone, Debug)]
+pub struct Answer {
+    pub latest: LatestRelease,
+    pub source: Source,
+}
+
+/// Looks up latest releases. Called from worker threads.
+pub trait ReleaseSource: Send + Sync {
+    fn latest(&self, repo: &str, prereleases: bool) -> Answer;
+    /// The last answer saved for `repo`, for an instant first paint.
+    fn cached(&self, repo: &str, prereleases: bool) -> Option<LatestRelease>;
+    /// The tag of `repo`'s newest stable release, by a route that costs no API quota (GitHub's
+    /// `releases/latest` redirect), or `None` when it can't be told. Quick: a check pressed by the
+    /// user asks this for every app to see whether the feed has fallen behind.
+    fn newest_tag(&self, repo: &str) -> Option<String> {
+        let _ = repo;
+        None
+    }
+    /// API refused until this time (Unix seconds).
+    fn rate_limited_until(&self) -> Option<i64>;
+    /// Persist anything worth keeping.
+    fn save(&self);
+}
+
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+struct Entry {
+    etag: Option<String>,
+    /// `None`: the repo has no releases.
+    release: Option<Release>,
+    prereleases: bool,
+    fetched_at: i64,
+}
+
+#[derive(Default, Serialize, Deserialize)]
+struct CacheFile {
+    entries: BTreeMap<String, Entry>,
+}
+
+pub struct GitHubSource {
+    http: Http,
+    cache: Mutex<CacheFile>,
+    cache_path: std::path::PathBuf,
+    limited_until: Mutex<Option<i64>>,
+}
+
+impl GitHubSource {
+    pub fn new(http: Http, cache_path: std::path::PathBuf) -> Self {
+        let cache = std::fs::read(&cache_path).ok().and_then(|b| serde_json::from_slice::<CacheFile>(&b).ok()).unwrap_or_default();
+        Self { http, cache: Mutex::new(cache), cache_path, limited_until: Mutex::new(None) }
+    }
+
+    fn entry(&self, repo: &str, prereleases: bool) -> Option<Entry> {
+        let cache = self.cache.lock().unwrap_or_else(PoisonError::into_inner);
+        cache.entries.get(repo).filter(|e| e.prereleases == prereleases).cloned()
+    }
+
+    fn store(&self, repo: &str, entry: Entry) {
+        self.cache.lock().unwrap_or_else(PoisonError::into_inner).entries.insert(repo.to_string(), entry);
+    }
+
+    fn limited(&self) -> bool {
+        let until = *self.limited_until.lock().unwrap_or_else(PoisonError::into_inner);
+        until.is_some_and(|u| u > crate::now())
+    }
+
+    fn ask_api(&self, repo: &str, prereleases: bool) -> Result<Option<Answer>, String> {
+        let url = if prereleases {
+            format!("https://api.github.com/repos/{repo}/releases?per_page=30")
+        } else {
+            format!("https://api.github.com/repos/{repo}/releases/latest")
+        };
+        let saved = self.entry(repo, prereleases);
+        let found =
+            |release: Option<Release>| Answer { latest: release.map_or(LatestRelease::None, LatestRelease::Found), source: Source::GitHubApi };
+        match self.http.get_api(&url, saved.as_ref().and_then(|e| e.etag.as_deref()))? {
+            Fetched::Body { text, etag } => {
+                let release = if prereleases {
+                    release::parse_github_release_list(&text, repo, true)?
+                } else {
+                    Some(release::parse_github_release(&text, repo)?)
+                };
+                self.store(repo, Entry { etag, release: release.clone(), prereleases, fetched_at: crate::now() });
+                Ok(Some(found(release)))
+            }
+            Fetched::NotModified => match saved {
+                Some(e) => {
+                    self.store(repo, Entry { fetched_at: crate::now(), ..e.clone() });
+                    Ok(Some(found(e.release)))
+                }
+                None => Err("GitHub said nothing changed, but there's no saved answer".into()),
+            },
+            Fetched::NotFound => {
+                self.store(repo, Entry { etag: None, release: None, prereleases, fetched_at: crate::now() });
+                Ok(Some(found(None)))
+            }
+            Fetched::RateLimited { reset } => {
+                *self.limited_until.lock().unwrap_or_else(PoisonError::into_inner) = Some(reset.unwrap_or_else(|| crate::now() + 15 * 60));
+                Ok(None)
+            }
+        }
+    }
+
+    /// The quota-free route through github.com (stable releases only).
+    fn ask_pages(&self, repo: &str) -> Result<Answer, String> {
+        let location = self.http.redirect_target(&format!("https://github.com/{repo}/releases/latest"))?;
+        let Some(tag) = location.as_deref().and_then(|l| release::tag_from_redirect(l, repo)) else {
+            // No published release: github.com sends us to the release list instead.
+            return Ok(Answer { latest: LatestRelease::None, source: Source::GitHubPages });
+        };
+        if let Some(e) = self.entry(repo, false)
+            && let Some(r) = e.release.as_ref().filter(|r| r.tag == tag)
+        {
+            return Ok(Answer { latest: LatestRelease::Found(r.clone()), source: Source::GitHubPages });
+        }
+        let sums_url = format!("{}{tag}/SHA256SUMS.txt", release::download_prefix(repo));
+        let sums = self.http.get_text(&sums_url)?.map(|t| release::parse_sha256sums(&t)).unwrap_or_default();
+        let r = release::release_from_sums(repo, &tag, &sums);
+        self.store(repo, Entry { etag: None, release: Some(r.clone()), prereleases: false, fetched_at: crate::now() });
+        Ok(Answer { latest: LatestRelease::Found(r), source: Source::GitHubPages })
+    }
+}
+
+impl ReleaseSource for GitHubSource {
+    fn latest(&self, repo: &str, prereleases: bool) -> Answer {
+        let api_error = if self.limited() {
+            None
+        } else {
+            match self.ask_api(repo, prereleases) {
+                Ok(Some(answer)) => return answer,
+                Ok(None) => None,
+                Err(e) => Some(e),
+            }
+        };
+        if !prereleases && api_error.is_none() {
+            match self.ask_pages(repo) {
+                Ok(answer) => return answer,
+                Err(e) => log::warn!("{repo}: release pages: {e}"),
+            }
+        }
+        let why = api_error.unwrap_or_else(|| "GitHub's request limit was reached".into());
+        match self.cached(repo, prereleases) {
+            Some(latest) => Answer { latest, source: Source::Cache },
+            None => Answer { latest: LatestRelease::Failed(why), source: Source::Cache },
+        }
+    }
+
+    fn cached(&self, repo: &str, prereleases: bool) -> Option<LatestRelease> {
+        self.entry(repo, prereleases).map(|e| e.release.map_or(LatestRelease::None, LatestRelease::Found))
+    }
+
+    fn newest_tag(&self, repo: &str) -> Option<String> {
+        match self.http.redirect_target(&format!("https://github.com/{repo}/releases/latest")) {
+            Ok(location) => location.as_deref().and_then(|l| release::tag_from_redirect(l, repo)),
+            Err(e) => {
+                log::debug!("{repo}: couldn't read the latest-release redirect: {e}");
+                None
+            }
+        }
+    }
+
+    fn rate_limited_until(&self) -> Option<i64> {
+        let until = *self.limited_until.lock().unwrap_or_else(PoisonError::into_inner);
+        until.filter(|u| *u > crate::now())
+    }
+
+    fn save(&self) {
+        let json = {
+            let cache = self.cache.lock().unwrap_or_else(PoisonError::into_inner);
+            serde_json::to_vec(&*cache)
+        };
+        match json {
+            Ok(bytes) => {
+                if let Err(e) = crate::paths::write_atomic(&self.cache_path, &bytes) {
+                    log::warn!("release cache: {e}");
+                }
+            }
+            Err(e) => log::warn!("release cache: {e}"),
+        }
+    }
+}
diff --git a/crates/update/src/status.rs b/crates/update/src/status.rs
new file mode 100644
index 00000000..1cd0cf76
--- /dev/null
+++ b/crates/update/src/status.rs
@@ -0,0 +1,64 @@
+//! How a copy of an app got onto the machine, and where it is.
+
+use serde::{Deserialize, Serialize};
+
+use crate::version::Version;
+
+/// How an installed copy got onto the machine, which decides how to update and remove it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum InstallSource {
+    /// Installed by this launcher (it keeps a record and can update or remove it).
+    Launcher,
+    /// A macOS `.app` the user put in Applications.
+    MacApp,
+    /// A Windows Installer (MSI) install.
+    Msi,
+    /// A Debian package.
+    Deb,
+    /// An RPM package.
+    Rpm,
+    /// An Arch Linux package: the release's own (`ai.storyteller.<app>`), or `<app>`, `<app>-bin`
+    /// or `<app>-git` from the AUR or a repository.
+    Pacman,
+    /// A Flatpak.
+    Flatpak,
+    /// An AppImage file found on disk.
+    AppImage,
+    /// A binary found on `PATH` or in a system prefix.
+    Binary,
+}
+
+impl InstallSource {
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Launcher => "ArtCraft Launcher",
+            Self::MacApp => "Applications folder",
+            Self::Msi => "Windows Installer",
+            Self::Deb => "Debian package",
+            Self::Rpm => "RPM package",
+            Self::Pacman => "Arch package",
+            Self::Flatpak => "Flatpak",
+            Self::AppImage => "AppImage",
+            Self::Binary => "System binary",
+        }
+    }
+
+    /// Whether the launcher may replace or remove this copy itself. Packages owned by a system
+    /// package manager (deb, rpm, Flatpak) are updated through that manager instead.
+    pub fn launcher_can_update(self) -> bool {
+        matches!(self, Self::Launcher | Self::MacApp | Self::Msi | Self::AppImage)
+    }
+}
+
+/// An installed copy of an app.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Installed {
+    /// `None` when the copy is there but its version couldn't be read.
+    pub version: Option<Version>,
+    pub source: InstallSource,
+    /// Where it lives: the `.app`, the exe, the AppImage, or the binary of a package.
+    pub location: String,
+    /// The package that installed it, for package-manager installs (`photocraft-bin`).
+    #[serde(default)]
+    pub package: Option<String>,
+}
diff --git a/crates/update/src/suite.rs b/crates/update/src/suite.rs
new file mode 100644
index 00000000..57e2e2a3
--- /dev/null
+++ b/crates/update/src/suite.rs
@@ -0,0 +1,70 @@
+//! The Craft App Suite as releases know it: each app's id, name and repository.
+//!
+//! An app that updates itself takes its own entry (`suite::PHOTOCRAFT`); the launcher takes all
+//! of them. Installers use the list to tell a Craft App's package from anyone else's.
+
+use crate::app::App;
+
+pub const PHOTOCRAFT: App = App::new("photocraft", "PhotoCraft", "Image editing", "storytold/photocraft");
+pub const VECTORCRAFT: App = App::new("vectorcraft", "VectorCraft", "Vector illustration", "storytold/vectorcraft");
+pub const FILMCRAFT: App = App::new("filmcraft", "FilmCraft", "Video editing, color and sound", "storytold/filmcraft");
+pub const LIGHTCRAFT: App = App::new("lightcraft", "LightCraft", "Photo library and raw development", "storytold/lightcraft");
+pub const PDFCRAFT: App = App {
+    former_ids: &["printcraft"],
+    former_names: &["PrintCraft"],
+    ..App::new("pdfcraft", "PdfCraft", "Reading, organizing and protecting PDFs", "storytold/pdfcraft")
+};
+pub const EFFECTCRAFT: App = App::new("effectcraft", "EffectCraft", "Motion graphics and visual effects", "storytold/effectcraft");
+pub const DESIGNCRAFT: App = App::new("designcraft", "DesignCraft", "Page layout and publishing", "storytold/designcraft");
+pub const FIGCRAFT: App = App::new("figcraft", "FigCraft", "Interface design and prototyping", "storytold/figcraft");
+pub const WORDCRAFT: App = App::new("wordcraft", "WordCraft", "Writing and document design", "storytold/wordcraft");
+pub const SOUNDCRAFT: App = App::new("soundcraft", "SoundCraft", "Recording, editing and mixing audio", "storytold/soundcraft");
+pub const DECKCRAFT: App = App::new("deckcraft", "DeckCraft", "Presentations and slide shows", "storytold/deckcraft");
+pub const CADCRAFT: App = App::new("cadcraft", "CADCraft", "Computer-aided design and drafting", "storytold/cadcraft");
+pub const GRIDCRAFT: App = App::new("gridcraft", "GridCraft", "Spreadsheets and data", "storytold/gridcraft");
+
+/// ArtCraft Launcher, described like a Craft App so it updates itself with the same machinery
+/// (asset names `artcraft-launcher-<ver>-…`, bundle id `ai.storyteller.artcraft-launcher`,
+/// `ArtCraft Launcher.app`). Not part of [`SUITE`].
+pub const LAUNCHER: App = App::new("artcraft-launcher", "ArtCraft Launcher", "Installs and updates the Craft App Suite", "storytold/craft-launcher");
+
+/// The Craft App Suite, in getartcraft.com's display order.
+pub const SUITE: [App; 13] = [
+    PHOTOCRAFT,
+    VECTORCRAFT,
+    FILMCRAFT,
+    LIGHTCRAFT,
+    PDFCRAFT,
+    EFFECTCRAFT,
+    DESIGNCRAFT,
+    FIGCRAFT,
+    WORDCRAFT,
+    SOUNDCRAFT,
+    DECKCRAFT,
+    CADCRAFT,
+    GRIDCRAFT,
+];
+
+/// The suite's app with this id.
+pub fn by_id(id: &str) -> Option<&'static App> {
+    SUITE.iter().find(|a| a.id == id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn thirteen_apps_with_unique_ids_in_their_own_repos() {
+        let mut ids: Vec<_> = SUITE.iter().map(|a| a.id).collect();
+        ids.sort_unstable();
+        ids.dedup();
+        assert_eq!(ids.len(), SUITE.len());
+        for a in &SUITE {
+            assert_eq!(a.repo, format!("storytold/{}", a.id));
+            assert_eq!(a.name.to_lowercase(), a.id);
+        }
+        assert!(by_id(LAUNCHER.id).is_none());
+        assert_eq!(by_id("pdfcraft").map(|a| a.former_ids), Some(&["printcraft"][..]));
+    }
+}
diff --git a/crates/update/src/time.rs b/crates/update/src/time.rs
new file mode 100644
index 00000000..3d91a930
--- /dev/null
+++ b/crates/update/src/time.rs
@@ -0,0 +1,26 @@
+//! Time and calendar conversions for release timestamps.
+//!
+//! Calendar conversion goes through chrono, in accordance with the AGENTS.md shared standard.
+
+use chrono::DateTime;
+
+/// Seconds since the Unix epoch for an RFC 3339 UTC timestamp such as `2026-10-08T14:52:50Z`.
+pub fn parse_rfc3339(text: &str) -> Option<i64> {
+    DateTime::parse_from_rfc3339(text.trim()).ok().map(|dt| dt.timestamp())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reads_github_timestamps() {
+        assert_eq!(parse_rfc3339("1970-01-01T00:00:00Z"), Some(0));
+        assert_eq!(parse_rfc3339("2026-10-08T14:52:50Z"), Some(1_791_471_170));
+        assert_eq!(parse_rfc3339("2026-10-08T16:52:50+02:00"), Some(1_791_471_170));
+        assert_eq!(parse_rfc3339("2026-10-08T14:52:50.123Z"), Some(1_791_471_170));
+        for bad in ["", "2026-10-08", "2026-13-08T00:00:00Z", "2026-10-08T14:52:50Q", "20x6-10-08T14:52:50Z"] {
+            assert_eq!(parse_rfc3339(bad), None, "{bad}");
+        }
+    }
+}
diff --git a/crates/update/src/updater.rs b/crates/update/src/updater.rs
new file mode 100644
index 00000000..836bf441
--- /dev/null
+++ b/crates/update/src/updater.rs
@@ -0,0 +1,486 @@
+//! The update flow of an egui app in one place: a check at start or on request, the startup prompt,
+//! and the self-update worker. An app creates one [`Updater`], calls [`Updater::tick`] and
+//! [`Updater::show`] each frame, and acts on the [`Action`] it returns, so every app gets the same
+//! handling of failures, dropped workers, repaints and quitting.
+
+use std::sync::Arc;
+use std::sync::mpsc::{Receiver, TryRecvError, channel};
+use std::time::Duration;
+
+use crate::dialog::{StartupPrompt, StartupPromptResponse};
+use crate::release::Release;
+use crate::{App, Http, Paths, Platform, Stop, check_for_update, self_update};
+
+/// Asks for the newest release (blocking; it runs on its own thread). Tests stand in for the network
+/// with one; without it the check asks GitHub.
+pub type CheckSource = Arc<dyn Fn() -> Result<Option<Release>, String> + Send + Sync>;
+
+/// What a requested check came to, for a window that answers Help ▸ Check for Updates.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Status {
+    /// Nothing to report.
+    Idle,
+    /// A requested check is running.
+    Checking,
+    /// A requested check found nothing newer.
+    UpToDate,
+    /// A requested check failed.
+    Failed(String),
+}
+
+/// What the app should do after [`Updater::show`].
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Action {
+    None,
+    /// Open this page in the browser.
+    OpenUrl(String),
+    /// Close the app through its normal close path (which asks about unsaved work): the update is
+    /// installed and a helper restarts the app once it has exited.
+    Close,
+}
+
+type Checked = Result<Option<Release>, String>;
+
+pub struct Updater {
+    app: &'static App,
+    version: String,
+    source: Option<CheckSource>,
+    status: Status,
+    /// The check running (or queued behind it) was asked for by the user.
+    requested: bool,
+    started: bool,
+    check: Option<Receiver<Checked>>,
+    install: Option<(Receiver<Result<(), String>>, Release)>,
+    prompt: Option<StartupPrompt>,
+    restart: bool,
+    /// An update is installed and waits for the app to exit; nothing starts a second one.
+    installed: bool,
+}
+
+impl Updater {
+    pub fn new(app: &'static App, version: impl Into<String>) -> Self {
+        Self {
+            app,
+            version: version.into(),
+            source: None,
+            status: Status::Idle,
+            requested: false,
+            started: false,
+            check: None,
+            install: None,
+            prompt: None,
+            restart: false,
+            installed: false,
+        }
+    }
+
+    /// Replaces the network with `source` (tests).
+    pub fn with_source(mut self, source: CheckSource) -> Self {
+        self.source = Some(source);
+        self
+    }
+
+    /// The check at start, once. Later calls do nothing.
+    pub fn check_at_start(&mut self, ctx: &egui::Context) {
+        if !std::mem::replace(&mut self.started, true) {
+            self.begin(ctx, false);
+        }
+    }
+
+    /// Help ▸ Check for Updates: a check whose outcome [`Self::status`] reports. A check already
+    /// running becomes a requested one; nothing starts while an update installs.
+    pub fn check_now(&mut self, ctx: &egui::Context) {
+        self.started = true;
+        self.begin(ctx, true);
+    }
+
+    /// Opens the startup prompt for a release the app found itself.
+    pub fn offer(&mut self, release: Release) {
+        if self.install.is_none() && !self.installed {
+            self.prompt = Some(StartupPrompt::new(self.app, release, self.version.clone()));
+        }
+    }
+
+    pub fn status(&self) -> &Status {
+        &self.status
+    }
+
+    /// Dismisses the outcome of a requested check. One still running carries on, and reports
+    /// like the check at start (a prompt if there is a release, otherwise nothing).
+    pub fn dismiss_status(&mut self) {
+        self.requested = false;
+        self.status = Status::Idle;
+    }
+
+    /// Whether the startup prompt is showing.
+    pub fn prompt_open(&self) -> bool {
+        self.prompt.is_some()
+    }
+
+    fn begin(&mut self, ctx: &egui::Context, requested: bool) {
+        if self.install.is_some() || self.installed {
+            return;
+        }
+        if requested {
+            self.requested = true;
+            self.status = Status::Checking;
+        }
+        if self.check.is_some() {
+            return;
+        }
+        let (tx, rx) = channel();
+        let (source, app, version, ctx) = (self.source.clone(), self.app, self.version.clone(), ctx.clone());
+        let spawned = std::thread::Builder::new().name("update-check".into()).spawn(move || {
+            let ask = || match source {
+                Some(ask) => ask(),
+                None => Http::new(&format!("{}/Update", app.name)).and_then(|http| check_for_update(app, &http, &version)),
+            };
+            let answer =
+                std::panic::catch_unwind(std::panic::AssertUnwindSafe(ask)).unwrap_or_else(|_| Err("the update check failed unexpectedly".into()));
+            let _ = tx.send(answer);
+            ctx.request_repaint();
+        });
+        match spawned {
+            Ok(_) => self.check = Some(rx),
+            Err(e) => self.finish_check(Err(format!("couldn't start the update check ({e})"))),
+        }
+    }
+
+    fn finish_check(&mut self, answer: Checked) {
+        let requested = std::mem::take(&mut self.requested);
+        match answer {
+            Ok(Some(release)) => {
+                self.status = Status::Idle;
+                if self.prompt.is_none() && self.install.is_none() && !self.installed {
+                    self.prompt = Some(StartupPrompt::new(self.app, release, self.version.clone()));
+                }
+            }
+            Ok(None) => self.status = if requested { Status::UpToDate } else { Status::Idle },
+            Err(e) => {
+                log::warn!("{} update check failed: {e}", self.app.name);
+                self.status = if requested { Status::Failed(e) } else { Status::Idle };
+            }
+        }
+    }
+
+    /// Picks up a finished check or installation. Call once per frame, before [`Self::show`]. It
+    /// keeps the UI awake while either is running.
+    pub fn tick(&mut self, ctx: &egui::Context) {
+        if let Some(rx) = &self.check {
+            match rx.try_recv() {
+                Ok(answer) => {
+                    self.check = None;
+                    self.finish_check(answer);
+                }
+                Err(TryRecvError::Empty) => ctx.request_repaint_after(Duration::from_millis(100)),
+                Err(TryRecvError::Disconnected) => {
+                    self.check = None;
+                    self.finish_check(Err("the update check stopped unexpectedly".into()));
+                }
+            }
+        }
+        if let Some((rx, _)) = &self.install {
+            let outcome = match rx.try_recv() {
+                Ok(outcome) => Some(outcome),
+                Err(TryRecvError::Empty) => {
+                    ctx.request_repaint_after(Duration::from_millis(100));
+                    None
+                }
+                Err(TryRecvError::Disconnected) => Some(Err("the update stopped unexpectedly".into())),
+            };
+            if let Some(outcome) = outcome {
+                let release = self.install.take().map(|(_, release)| release);
+                match outcome {
+                    Ok(()) => {
+                        self.installed = true;
+                        self.restart = true;
+                        if let Some(prompt) = &mut self.prompt {
+                            prompt.is_installing = false;
+                            prompt.status_message =
+                                Some(format!("The update is installed. Close {} to finish; it restarts by itself.", self.app.name));
+                        }
+                    }
+                    Err(e) => {
+                        log::warn!("{} self-update failed: {e}", self.app.name);
+                        // The prompt may have been dismissed meanwhile: bring it back with the reason.
+                        if self.prompt.is_none()
+                            && let Some(release) = release
+                        {
+                            self.prompt = Some(StartupPrompt::new(self.app, release, self.version.clone()));
+                        }
+                        if let Some(prompt) = &mut self.prompt {
+                            prompt.is_installing = false;
+                            prompt.status_message = Some(e);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    /// Draws the startup prompt and starts what it asks for.
+    pub fn show(&mut self, ctx: &egui::Context) -> Action {
+        self.show_if(ctx, true)
+    }
+
+    /// Like [`Self::show`], but an installation only starts when `can_start` is true. An app passes
+    /// `false` while it holds unsaved work: the restart helper is scheduled before the app closes,
+    /// and a close that the user then cancels would leave it waiting for an exit that never comes.
+    pub fn show_if(&mut self, ctx: &egui::Context, can_start: bool) -> Action {
+        // The close waits for the app to hold no unsaved work: the user may have edited while the
+        // update installed, and a close they cancel is asked again once the work is saved.
+        if self.restart && can_start {
+            self.restart = false;
+            return Action::Close;
+        }
+        let Some(prompt) = &mut self.prompt else { return Action::None };
+        match prompt.show(ctx) {
+            StartupPromptResponse::Pending => Action::None,
+            StartupPromptResponse::UpdateAndRestart => {
+                self.request_install(ctx, can_start);
+                Action::None
+            }
+            StartupPromptResponse::Download => {
+                let url = prompt.release.html_url.clone();
+                self.prompt = None;
+                Action::OpenUrl(url)
+            }
+            StartupPromptResponse::Later => {
+                // An installation carries on and reports through `tick`.
+                self.prompt = None;
+                Action::None
+            }
+        }
+    }
+
+    fn request_install(&mut self, ctx: &egui::Context, can_start: bool) {
+        if can_start {
+            self.start_install(ctx);
+        } else if let Some(prompt) = &mut self.prompt {
+            prompt.status_message = Some("Save or close your open work first; the update restarts the app.".into());
+        }
+    }
+
+    fn start_install(&mut self, ctx: &egui::Context) {
+        let Some(prompt) = &mut self.prompt else { return };
+        if self.installed {
+            prompt.status_message = Some(format!("The update is installed. Close {} to finish; it restarts by itself.", self.app.name));
+            return;
+        }
+        let Some(installed) = self_update::current(self.app) else {
+            prompt.status_message = Some("Cannot auto-update this installation type. Please download manually.".into());
+            prompt.is_installing = false;
+            return;
+        };
+        prompt.is_installing = true;
+        prompt.status_message = None;
+        let (tx, rx) = channel();
+        let (app, version, ctx, release) = (self.app, self.version.clone(), ctx.clone(), prompt.release.clone());
+        let worker_release = release.clone();
+        let spawned = std::thread::Builder::new().name("self-update".into()).spawn(move || {
+            let run = || install(app, &installed, worker_release, &version);
+            let outcome =
+                std::panic::catch_unwind(std::panic::AssertUnwindSafe(run)).unwrap_or_else(|_| Err("the update failed unexpectedly".into()));
+            let _ = tx.send(outcome);
+            ctx.request_repaint();
+        });
+        match spawned {
+            Ok(_) => self.install = Some((rx, release)),
+            Err(e) => {
+                prompt.is_installing = false;
+                prompt.status_message = Some(format!("couldn't start the update ({e})"));
+            }
+        }
+    }
+}
+
+fn install(app: &'static App, installed: &self_update::Install, mut release: Release, version: &str) -> Result<(), String> {
+    let http = Http::new(&format!("{}/Update", app.name)).map_err(|e| format!("could not initialize HTTP: {e}"))?;
+    if release.assets.is_empty()
+        && let Some(full) = check_for_update(app, &http, version).map_err(|e| format!("could not fetch release assets: {e}"))?
+    {
+        release = full;
+    }
+    let paths = Paths::for_app(app).map_err(|e| format!("could not find paths: {e}"))?;
+    let platform = Platform::current().ok_or("unsupported platform for self update")?;
+    self_update::update(app, installed, &release, platform, &http, &paths, &Stop::default(), &mut |_| {}, &|| Ok(()), Some(version))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::suite::PHOTOCRAFT;
+
+    fn updater(answer: Checked) -> Updater {
+        Updater::new(&PHOTOCRAFT, "0.1.0").with_source(Arc::new(move || answer.clone()))
+    }
+
+    /// Ticks until the running check has reported.
+    fn settle(updater: &mut Updater, ctx: &egui::Context) {
+        let deadline = std::time::Instant::now() + Duration::from_secs(10);
+        while updater.check.is_some() && std::time::Instant::now() < deadline {
+            updater.tick(ctx);
+            std::thread::sleep(Duration::from_millis(5));
+        }
+    }
+
+    fn newer() -> Release {
+        Release { tag: "v9.0.0".into(), version: crate::version::parse("9.0.0"), ..Release::default() }
+    }
+
+    #[test]
+    fn a_requested_check_reports_an_up_to_date_app() {
+        let (ctx, mut u) = (egui::Context::default(), updater(Ok(None)));
+        u.check_now(&ctx);
+        assert_eq!(u.status(), &Status::Checking);
+        settle(&mut u, &ctx);
+        assert_eq!(u.status(), &Status::UpToDate);
+        u.dismiss_status();
+        assert_eq!(u.status(), &Status::Idle);
+    }
+
+    #[test]
+    fn dismissing_a_running_check_keeps_it_quiet() {
+        let (ctx, mut u) = (egui::Context::default(), updater(Ok(None)));
+        u.check_now(&ctx);
+        u.dismiss_status();
+        settle(&mut u, &ctx);
+        assert_eq!(u.status(), &Status::Idle);
+    }
+
+    #[test]
+    fn a_requested_check_reports_a_failure_but_the_startup_check_stays_quiet() {
+        let ctx = egui::Context::default();
+        let mut u = updater(Err("offline".into()));
+        u.check_now(&ctx);
+        settle(&mut u, &ctx);
+        assert_eq!(u.status(), &Status::Failed("offline".into()));
+
+        let mut u = updater(Err("offline".into()));
+        u.check_at_start(&ctx);
+        settle(&mut u, &ctx);
+        assert_eq!(u.status(), &Status::Idle);
+    }
+
+    #[test]
+    fn a_newer_release_opens_the_prompt_and_later_closes_it() {
+        let (ctx, mut u) = (egui::Context::default(), updater(Ok(Some(newer()))));
+        u.check_at_start(&ctx);
+        settle(&mut u, &ctx);
+        assert!(u.prompt_open());
+        assert_eq!(u.status(), &Status::Idle);
+        u.prompt = None;
+        assert!(!u.prompt_open());
+    }
+
+    #[test]
+    fn the_startup_check_runs_once() {
+        let (ctx, mut u) = (egui::Context::default(), updater(Ok(None)));
+        u.check_at_start(&ctx);
+        settle(&mut u, &ctx);
+        u.check_at_start(&ctx);
+        assert!(u.check.is_none());
+    }
+
+    #[test]
+    fn a_request_during_the_startup_check_is_not_lost() {
+        let (ctx, mut u) = (egui::Context::default(), updater(Ok(None)));
+        u.check_at_start(&ctx);
+        u.check_now(&ctx);
+        settle(&mut u, &ctx);
+        assert_eq!(u.status(), &Status::UpToDate);
+    }
+
+    #[test]
+    fn a_panicking_check_is_an_error_not_a_hang() {
+        let ctx = egui::Context::default();
+        let mut u = Updater::new(&PHOTOCRAFT, "0.1.0").with_source(Arc::new(|| std::panic::panic_any("boom")));
+        u.check_now(&ctx);
+        settle(&mut u, &ctx);
+        assert!(matches!(u.status(), Status::Failed(_)));
+        assert!(u.check.is_none());
+    }
+
+    #[test]
+    fn a_failed_install_returns_to_the_prompt_even_after_it_was_dismissed() {
+        let ctx = egui::Context::default();
+        let mut u = updater(Ok(None));
+        let (tx, rx) = channel();
+        u.install = Some((rx, newer()));
+        assert!(tx.send(Err("disk full".into())).is_ok());
+        u.tick(&ctx);
+        let prompt = u.prompt.as_ref().map(|p| (p.is_installing, p.status_message.clone()));
+        assert_eq!(prompt, Some((false, Some("disk full".into()))));
+        assert!(u.install.is_none());
+    }
+
+    #[test]
+    fn a_dropped_install_worker_is_an_error() {
+        let ctx = egui::Context::default();
+        let mut u = updater(Ok(None));
+        let (tx, rx) = channel::<Result<(), String>>();
+        u.install = Some((rx, newer()));
+        drop(tx);
+        u.tick(&ctx);
+        assert!(u.prompt.as_ref().is_some_and(|p| p.status_message.is_some()));
+    }
+
+    #[test]
+    fn nothing_starts_once_an_update_is_installed() {
+        let ctx = egui::Context::default();
+        let mut u = updater(Ok(Some(newer())));
+        let (tx, rx) = channel();
+        u.install = Some((rx, newer()));
+        assert!(tx.send(Ok(())).is_ok());
+        u.tick(&ctx);
+        assert_eq!(u.show(&ctx), Action::Close);
+        u.prompt = None;
+        u.check_now(&ctx);
+        assert!(u.check.is_none(), "no check after an install");
+        u.offer(newer());
+        assert!(!u.prompt_open(), "no second offer after an install");
+    }
+
+    #[test]
+    fn an_install_waits_while_the_app_holds_unsaved_work() {
+        let ctx = egui::Context::default();
+        let mut u = updater(Ok(None));
+        u.offer(newer());
+        u.request_install(&ctx, false);
+        assert!(u.install.is_none(), "nothing is scheduled while there is unsaved work");
+        assert!(u.prompt.as_ref().is_some_and(|p| !p.is_installing && p.status_message.is_some()));
+    }
+
+    /// One frame with the updater's prompt drawn.
+    fn frame(u: &mut Updater, ctx: &egui::Context, can_start: bool) -> Action {
+        let mut action = Action::None;
+        ctx.run_ui(egui::RawInput::default(), |ui| action = u.show_if(ui.ctx(), can_start)).textures_delta.clear();
+        action
+    }
+
+    #[test]
+    fn a_finished_install_keeps_asking_to_close_until_the_app_can() {
+        let ctx = egui::Context::default();
+        let mut u = updater(Ok(None));
+        u.offer(newer());
+        let (tx, rx) = channel();
+        u.install = Some((rx, newer()));
+        assert!(tx.send(Ok(())).is_ok());
+        u.tick(&ctx);
+        assert_eq!(frame(&mut u, &ctx, false), Action::None, "unsaved work holds the close back");
+        assert_eq!(frame(&mut u, &ctx, true), Action::Close);
+        assert_eq!(frame(&mut u, &ctx, true), Action::None);
+    }
+
+    #[test]
+    fn a_finished_install_asks_the_app_to_close_once() {
+        let ctx = egui::Context::default();
+        let mut u = updater(Ok(None));
+        let (tx, rx) = channel();
+        u.install = Some((rx, newer()));
+        assert!(tx.send(Ok(())).is_ok());
+        u.tick(&ctx);
+        assert_eq!(u.show(&ctx), Action::Close);
+        assert_eq!(u.show(&ctx), Action::None);
+    }
+}
diff --git a/crates/update/src/version.rs b/crates/update/src/version.rs
new file mode 100644
index 00000000..0beceef1
--- /dev/null
+++ b/crates/update/src/version.rs
@@ -0,0 +1,183 @@
+//! Versions: release tags (`v0.5.0`), installed versions from many sources, and ordering.
+
+use std::cmp::Ordering;
+
+pub use semver::Version;
+
+/// Reads a version from a tag or an installed-version string.
+///
+/// Accepts `v0.5.0`, `0.5.0`, `0.2.0-rc.1`, Debian's `0.2.0~rc.1-1`, and the two-part `0.5`
+/// some platforms report. Build metadata is kept but never affects ordering.
+pub fn parse(text: &str) -> Option<Version> {
+    let t = text.trim();
+    let t = t.strip_prefix(['v', 'V']).unwrap_or(t);
+    if t.is_empty() || t.len() > 64 {
+        return None;
+    }
+    // Debian/RPM spell pre-releases with `~` and append a package revision after `-`.
+    let debianish = t.contains('~');
+    let t = if debianish { t.split_once('-').map_or(t, |(v, _)| v).replace('~', "-") } else { t.to_string() };
+    if let Ok(v) = Version::parse(&t) {
+        return Some(v);
+    }
+    // `0.5` → `0.5.0`
+    let (core, rest) = match t.find(['-', '+']) {
+        Some(i) => t.split_at(i),
+        None => (t.as_str(), ""),
+    };
+    let parts: Vec<&str> = core.split('.').collect();
+    if parts.len() == 2 && parts.iter().all(|p| !p.is_empty() && p.bytes().all(|b| b.is_ascii_digit())) {
+        return Version::parse(&format!("{core}.0{rest}")).ok();
+    }
+    None
+}
+
+/// Reads a version as a system package manager reports it, dropping what the packaging adds:
+/// an epoch (`1:`), the package revision (`-1`, `-2.fc40`), Debian's `~` pre-release spelling, and
+/// a VCS snapshot suffix (`0.3.0.r47.g47f9306` from an AUR `-git` package, read as `0.3.0`).
+pub fn parse_package(text: &str) -> Option<Version> {
+    let t = text.trim();
+    // Epoch.
+    let t = match t.split_once(':') {
+        Some((epoch, rest)) if !epoch.is_empty() && epoch.bytes().all(|b| b.is_ascii_digit()) => rest,
+        _ => t,
+    };
+    // Package revision: whatever follows the last '-' when the part before it is a version.
+    let t = match t.rsplit_once('-') {
+        Some((upstream, rev)) if !rev.is_empty() && rev.starts_with(|c: char| c.is_ascii_digit()) && upstream.contains('.') => upstream,
+        _ => t,
+    };
+    let t = t.replace('~', "-");
+    if let Some(v) = parse(&t) {
+        return Some(v);
+    }
+    // VCS snapshots and other suffixes: the leading X.Y.Z.
+    let core: String = t.chars().take_while(|c| c.is_ascii_digit() || *c == '.').collect();
+    let parts: Vec<&str> = core.split('.').filter(|p| !p.is_empty()).take(3).collect();
+    match parts.as_slice() {
+        [a, b, c] => Version::parse(&format!("{a}.{b}.{c}")).ok(),
+        [a, b] => Version::parse(&format!("{a}.{b}.0")).ok(),
+        // Text around the version, as in `--version` output (`PhotoCraft 0.5.0 (abc, 2026)`):
+        // the first `X.Y.Z` run anywhere.
+        _ => first_xyz(&t),
+    }
+}
+
+/// The first `major.minor.patch` run anywhere in `text`.
+fn first_xyz(text: &str) -> Option<Version> {
+    let bytes = text.as_bytes();
+    for start in 0..bytes.len() {
+        if !bytes.get(start).is_some_and(u8::is_ascii_digit) || (start > 0 && bytes.get(start - 1).is_some_and(u8::is_ascii_digit)) {
+            continue;
+        }
+        let Some((major, i)) = digits(text, start) else { continue };
+        if bytes.get(i) != Some(&b'.') {
+            continue;
+        }
+        let Some((minor, j)) = digits(text, i + 1) else { continue };
+        if bytes.get(j) != Some(&b'.') {
+            continue;
+        }
+        let Some((patch, _)) = digits(text, j + 1) else { continue };
+        return Some(Version::new(major, minor, patch));
+    }
+    None
+}
+
+/// A run of ASCII digits from `from`, as a number and the index just past it.
+fn digits(text: &str, from: usize) -> Option<(u64, usize)> {
+    let bytes = text.as_bytes();
+    let mut end = from;
+    while bytes.get(end).is_some_and(u8::is_ascii_digit) {
+        end += 1;
+    }
+    if end == from {
+        return None;
+    }
+    text.get(from..end)?.parse().ok().map(|n| (n, end))
+}
+
+/// A version that's a plain `X.Y.Z` with no pre-release suffix.
+pub fn is_stable(v: &Version) -> bool {
+    v.pre.is_empty()
+}
+
+/// Orders by precedence, ignoring build metadata.
+pub fn compare(a: &Version, b: &Version) -> Ordering {
+    a.cmp_precedence(b)
+}
+
+/// True when `latest` is newer than `installed`.
+pub fn is_newer(latest: &Version, installed: &Version) -> bool {
+    compare(latest, installed) == Ordering::Greater
+}
+
+/// Platforms that only record `X.Y.Z` (the MSI ProductVersion, `CFBundleShortVersionString`)
+/// drop a pre-release suffix. A numeric-only installed version therefore counts as current when it
+/// matches a pre-release's numbers, rather than nagging forever.
+pub fn is_update(latest: &Version, installed: &Version) -> bool {
+    if installed.pre.is_empty()
+        && !latest.pre.is_empty()
+        && (latest.major, latest.minor, latest.patch) == (installed.major, installed.minor, installed.patch)
+    {
+        return false;
+    }
+    is_newer(latest, installed)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn v(s: &str) -> Version {
+        parse(s).unwrap()
+    }
+
+    #[test]
+    fn reads_tags_and_platform_spellings() {
+        assert_eq!(v("v0.5.0"), Version::new(0, 5, 0));
+        assert_eq!(v(" 1.2.3\n"), Version::new(1, 2, 3));
+        assert_eq!(v("0.5"), Version::new(0, 5, 0));
+        assert_eq!(v("0.2.0~rc.1-1").to_string(), "0.2.0-rc.1");
+        assert_eq!(v("0.2.0-rc.1").to_string(), "0.2.0-rc.1");
+        for bad in ["", "v", "latest", "1", "1.x.0", "0.5.", &"9".repeat(80)] {
+            assert_eq!(parse(bad), None, "{bad}");
+        }
+    }
+
+    #[test]
+    fn reads_package_manager_versions() {
+        let p = |s: &str| parse_package(s).map(|v| v.to_string());
+        // dpkg and pacman add a package revision; it is not a pre-release.
+        assert_eq!(p("0.5.0-1").as_deref(), Some("0.5.0"));
+        assert_eq!(p("0.5.0-12").as_deref(), Some("0.5.0"));
+        assert_eq!(p("1:0.5.0-1").as_deref(), Some("0.5.0"));
+        assert_eq!(p("0.2.0~rc.1-1").as_deref(), Some("0.2.0-rc.1"));
+        assert_eq!(p("0.5.0-2.fc40").as_deref(), Some("0.5.0"));
+        // AUR -git packages: the release the snapshot follows.
+        assert_eq!(p("0.3.0.r47.g47f9306-1").as_deref(), Some("0.3.0"));
+        // Plain versions (rpm %{VERSION}, Flatpak) pass through.
+        assert_eq!(p("0.4.0").as_deref(), Some("0.4.0"));
+        assert_eq!(p("0.5").as_deref(), Some("0.5.0"));
+        // A version inside text, as `--version` prints it.
+        assert_eq!(p("PhotoCraft 0.5.0 (abc, 2026)").as_deref(), Some("0.5.0"));
+        assert_eq!(p("junk"), None);
+        assert_eq!(p("garbage"), None);
+        // The bug this guards: 0.5.0-1 used to read as a pre-release, so an installed .deb of the
+        // latest release always looked out of date.
+        assert!(!is_update(&v("0.5.0"), &parse_package("0.5.0-1").unwrap()));
+    }
+
+    #[test]
+    fn orders_versions_and_spots_updates() {
+        assert!(is_newer(&v("0.10.0"), &v("0.9.9")));
+        assert!(is_newer(&v("0.2.0"), &v("0.2.0-rc.5")));
+        assert!(!is_newer(&v("0.2.0+abc"), &v("0.2.0")));
+        assert!(is_update(&v("0.5.0"), &v("0.4.1")));
+        assert!(!is_update(&v("0.5.0"), &v("0.5.0")));
+        assert!(!is_update(&v("0.5.0"), &v("0.6.0")));
+        // An MSI that recorded 0.3.0 for 0.3.0-rc.2 is not out of date against 0.3.0-rc.2.
+        assert!(!is_update(&v("0.3.0-rc.2"), &v("0.3.0")));
+        assert!(is_stable(&v("1.0.0")) && !is_stable(&v("1.0.0-beta.1")));
+    }
+}
diff --git a/crates/update/tests/fixtures/photocraft-release.json b/crates/update/tests/fixtures/photocraft-release.json
new file mode 100644
index 00000000..d9969318
--- /dev/null
+++ b/crates/update/tests/fixtures/photocraft-release.json
@@ -0,0 +1,16 @@
+{
+  "tag_name": "v0.9.0",
+  "name": "PhotoCraft v0.9.0",
+  "html_url": "https://github.com/storytold/photocraft/releases/tag/v0.9.0",
+  "published_at": "2026-10-14T16:36:26Z",
+  "prerelease": false,
+  "draft": false,
+  "assets": [
+    {
+      "name": "photocraft-0.9.0-macos-universal.dmg",
+      "size": 90386785,
+      "browser_download_url": "https://github.com/storytold/photocraft/releases/download/v0.9.0/photocraft-0.9.0-macos-universal.dmg",
+      "digest": "sha256:06503eb1c845990e99f8824831cc73b274e2b1dbe4461eb6460dfc9a6008239d"
+    }
+  ]
+}
diff --git a/crates/update/tests/fixtures/soundcraft-release.json b/crates/update/tests/fixtures/soundcraft-release.json
new file mode 100644
index 00000000..ca81aa4e
--- /dev/null
+++ b/crates/update/tests/fixtures/soundcraft-release.json
@@ -0,0 +1,22 @@
+{
+  "tag_name": "v0.10.0",
+  "name": "SoundCraft v0.10.0",
+  "html_url": "https://github.com/storytold/soundcraft/releases/tag/v0.10.0",
+  "published_at": "2026-10-20T14:34:31Z",
+  "prerelease": false,
+  "draft": false,
+  "assets": [
+    {
+      "name": "soundcraft-0.10.0-freebsd-aarch64.tar.gz",
+      "size": 14786997,
+      "browser_download_url": "https://github.com/storytold/soundcraft/releases/download/v0.10.0/soundcraft-0.10.0-freebsd-aarch64.tar.gz",
+      "digest": "sha256:6a791aa9afd693d701bdc80bc19839eabe0ccbc8d8424b5684ef1ac46d6d68e6"
+    },
+    {
+      "name": "soundcraft-0.10.0-freebsd-x86_64.tar.gz",
+      "size": 16384262,
+      "browser_download_url": "https://github.com/storytold/soundcraft/releases/download/v0.10.0/soundcraft-0.10.0-freebsd-x86_64.tar.gz",
+      "digest": "sha256:189d9e997cbab32d1672d824ee337a9447e54dd2be4934ff1537e2f53c52ea28"
+    }
+  ]
+}
diff --git a/crates/window/Cargo.toml b/crates/window/Cargo.toml
index 54db833d..2ccc0765 100644
--- a/crates/window/Cargo.toml
+++ b/crates/window/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "craft-window"
-description = "Decide who draws the window frame on Linux (the compositor or the app) and apply it, so every Craft app gets the same native titlebar and borders per desktop."
+description = "Decide who draws the window frame (the desktop or the app) so every Craft app gets the same titlebar and borders per desktop, make an app-drawn strip act as the title bar, and keep the window list, cascade placement and Window menu for apps with one window per document."
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -8,8 +8,9 @@ rust-version.workspace = true
 repository.workspace = true
 
 [features]
-# `apply`/`decorations`: decide decorations and set them on an `egui::ViewportBuilder`.
-egui = ["dep:egui"]
+# `decorate`: set the decision on an `egui::ViewportBuilder`. `title_bar`: an app-drawn strip as
+# the title bar (on macOS with AppKit's `movable` flag). `Viewports`: one immediate viewport per window.
+egui = ["dep:egui", "dep:objc2", "dep:objc2-app-kit"]
 
 [dependencies]
 egui = { workspace = true, optional = true }
@@ -18,5 +19,10 @@ egui = { workspace = true, optional = true }
 [target.'cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd"))'.dependencies]
 wayland-client = "0.31"
 
+# `title_bar::sync_movable` (`NSWindow.movable`); eframe's winit already uses these.
+[target.'cfg(target_os = "macos")'.dependencies]
+objc2 = { version = "0.6.4", default-features = false, features = ["std"], optional = true }
+objc2-app-kit = { version = "0.3.2", default-features = false, features = ["std", "NSApplication", "NSButton", "NSControl", "NSResponder", "NSView", "NSWindow"], optional = true }
+
 [lints]
 workspace = true
diff --git a/crates/window/README.md b/crates/window/README.md
index 75b4c681..686d8c13 100644
--- a/crates/window/README.md
+++ b/crates/window/README.md
@@ -2,7 +2,9 @@ craft-window
 ============
 
 Decide who draws the window frame — the desktop or the app — so every Craft app shows the same
-titlebar and borders on a given desktop.
+titlebar and borders on a given desktop, make the app's own top strip act as the title bar
+when it draws one, and keep the window list, cascade placement and Window menu for apps with one
+window per document.
 
 ## Why
 
@@ -54,8 +56,86 @@ if let Some(layout) = choice.frame().layout() {
 An app that offers a "System title bar" preference checks `choice.overridden()` and its own setting,
 and can override the probe by setting the frame to `Frame::Desktop`.
 
-The `egui` feature adds [`decorate`]. Without it, the crate is pure decision logic (`Choice`,
-`Frame`, `Layout`) with no egui dependency.
+The `egui` feature adds [`decorate`], the [`title_bar`](#the-apps-own-title-bar) module and
+`Viewports`. Without it, the crate is pure decision and bookkeeping logic with no egui dependency.
+
+## The app's own title bar
+
+An app that draws over the title bar — a hidden macOS title bar with a full-size content view, or
+`Frame::App` — makes its top strip act as one with `craft_window::title_bar` (`egui` feature):
+
+| Where the drag or double-click starts | What happens |
+| --- | --- |
+| The strip's empty part | A drag moves the window (`ViewportCommand::StartDrag`); a double-click follows the system setting (macOS `AppleActionOnDoubleClick`: zoom, minimize or nothing; zoom elsewhere) |
+| A control on the strip | The control gets it; the window stays put |
+| An in-window panel over the strip (an `Order::Middle` layer: a floating dock, an `egui::Window`) | The panel gets it; the window stays put |
+| A modal's backdrop or a tooltip (`Foreground`/`Tooltip`) | The window moves, as under AppKit's own title bar |
+| Anything, in full screen | Nothing happens to the window |
+
+```rust,ignore
+egui::Panel::top("app_bar").show(ui, |ui| {
+    // Before the bar's controls, so they sit on top and take their own clicks.
+    craft_window::title_bar::empty_area(ui, ui.max_rect());
+    // ... the bar's controls ...
+});
+// macOS, once per frame after the UI: `applied` is app state, starting at `None`.
+#[cfg(target_os = "macos")]
+craft_window::title_bar::sync_movable(ui.ctx(), &mut self.applied);
+```
+
+On macOS, AppKit moves a full-size-content window from a drag anywhere in the title-bar band, the
+app's controls and panels included, unless `NSWindow.movable` is false. `sync_movable` sets that
+flag from `title_bar::window_movable`, which is false while the pointer is on a control or a panel
+over the strip. It leaves windows with hidden window buttons alone, such as floating panels in
+their own windows.
+
+## One window per document
+
+For apps that open each document in its own top-level window, the crate also keeps the shared
+window bookkeeping. The core has no egui dependency.
+
+| Type | What it does |
+| --- | --- |
+| `WindowList<T>` | Open windows with the app's per-window data `T`. Opening order (stable, for menus) and most-recent order; the first in most-recent order is the active window, which menu commands go to. `close` returns the data and, when the active window closed, the window to focus next. `find` returns the most recent window whose data matches, e.g. the window already showing a file. |
+| `WindowId` | A window's id: `Copy`, `Hash`, `Ord`, from one process-wide counter, so never reused while the app runs. Use it as the key for per-window state (UI state, pending dialogs). |
+| `cascade` | Places a new window one step (about a title bar, `CASCADE_STEP`) right of and below the most recent window. Each axis that would run off the bounds (monitor or work area) starts over at the bounds' edge. |
+| `WindowMenu` | The Window menu (macOS) or View › Switch Windows list: (id, title, dirty, active) per window, in opening order. Windows on the same document are titled `Name:1`, `Name:2`, numbered by opening order; a document with one window keeps its plain name. The app supplies each window's document key, name and dirty flag. |
+
+With the `egui` feature, `Viewports` shows the windows as egui immediate viewports:
+
+- Call `show` once per frame from the root viewport's UI. It runs the app's callback for each
+  window inside that window's viewport, so `ui.ctx()` input (close requests, IME) and commands
+  belong to that window. A window's viewport id is `child_viewport_id(id)`.
+- New windows get `decorate` (the frame decision above) and a cascade position from the most
+  recently focused window. On Wayland, where windows have no known position, the compositor places
+  them.
+- The root viewport stays the app's. `set_root(Some(id))` draws window `id` in it. When the root's
+  window closes while others stay open, `adopt` moves another window into the root viewport (its
+  position, size and focus); that window's id and data stay the same.
+- `show` returns `WindowEvent::Focused` and `WindowEvent::CloseRequested`. Focus also updates the
+  list's active window. Close and quit policy stay with the app: a child window closes when the app
+  removes it from the list, and for the root's window the app sends `ViewportCommand::CancelClose`
+  to the root in the same frame unless the app should quit.
+
+```rust,ignore
+use craft_window::{Document, Viewports, WindowEvent, WindowList, WindowMenu};
+
+let menu = WindowMenu::new(&windows, |_, w| Document { key: w.doc, name: name_of(w.doc), dirty: is_dirty(w.doc) });
+let base = egui::ViewportBuilder::default().with_inner_size([1000.0, 700.0]);
+for event in viewports.show(
+    ui,
+    &mut windows,
+    |id, _| base.clone().with_title(menu.title(id).unwrap_or_default()),
+    |ui, id, window| draw_window(ui, id, window),
+) {
+    if let WindowEvent::CloseRequested(id) = event {
+        // The app's policy: prompt for the document's last dirty window, then `windows.close(id)`,
+        // and `adopt` or `focus` the window `Closed::focus` names.
+    }
+}
+```
+
+Immediate viewports repaint every window when one repaints, so cache expensive per-window drawing.
 
 ## Notes
 
diff --git a/crates/window/src/lib.rs b/crates/window/src/lib.rs
index 42f936c5..c6de89b5 100644
--- a/crates/window/src/lib.rs
+++ b/crates/window/src/lib.rs
@@ -2,7 +2,7 @@
 #![forbid(unsafe_code)]
 
 //! Decide who draws the window frame, so every Craft app shows the same titlebar and borders on a
-//! given desktop.
+//! given desktop, and make an app-drawn strip act as the title bar.
 //!
 //! egui apps either let the desktop draw the window frame (the title bar, borders and window
 //! buttons) or turn it off and draw their own. Across the suite this decision had drifted: some
@@ -45,6 +45,102 @@
 //!
 //! The probe opens a short-lived Wayland connection and reads the global registry once; it never
 //! touches the connection winit inherits. Call it once at startup.
+//!
+//! # The app's own title bar
+//!
+//! An app that draws over the title bar (a hidden macOS title bar with a full-size content view,
+//! or [`Frame::App`]) makes its top strip act as one with [`title_bar`]: the strip's empty part
+//! moves the window and follows the system's double-click setting, while the strip's controls and
+//! in-window panels lying over it keep their own clicks and drags. On macOS,
+//! `title_bar::sync_movable` sets AppKit's `movable` flag each frame so a drag that starts on
+//! one of those does not move the window.
+//!
+//! ```ignore
+//! egui::Panel::top("app_bar").show(ui, |ui| {
+//!     craft_window::title_bar::empty_area(ui, ui.max_rect());
+//!     // ... the bar's controls ...
+//! });
+//! // After the UI, once per frame (macOS); `applied` lives in the app state, starting at `None`.
+//! #[cfg(target_os = "macos")]
+//! craft_window::title_bar::sync_movable(ui.ctx(), &mut self.applied);
+//! ```
+//!
+//! # One window per document
+//!
+//! The rest of the crate keeps the bookkeeping for apps that open each document in its own
+//! top-level window. The core has no egui dependency:
+//!
+//! - [`WindowList`]: open windows with the app's per-window data, a [`WindowId`] for each (never
+//!   reused while the process runs), the active window and most-recent order. Menu commands go to
+//!   [`WindowList::active`]; when the active window closes, [`Closed::focus`] names the next one.
+//! - [`cascade`]: where a new window goes, one title bar down and right of the last one, wrapped
+//!   back inside the screen.
+//! - [`WindowMenu`]: the Window menu (macOS) or View › Switch Windows list. Windows on the same
+//!   document are titled "Name:1", "Name:2".
+//!
+//! The `egui` feature adds `Viewports`, which shows each window as an immediate viewport, applies
+//! `decorate` and the cascade to new windows, and reports `WindowEvent`s. Close and quit policy
+//! stay with the app: the driver reports a close request, and a window closes when the app removes
+//! it from the list.
+//!
+//! ```ignore
+//! use craft_window::{Choice, Document, Prefix, Viewports, WindowEvent, WindowList, WindowMenu};
+//!
+//! // At startup: the first document's window is drawn in the root viewport.
+//! let mut windows = WindowList::new();
+//! let mut viewports = Viewports::new(Choice::probe(Prefix::new("GRIDCRAFT")).into_frame());
+//! let first = windows.open(WindowUi::new(doc_id));
+//! viewports.set_root(Some(first));
+//!
+//! // Each frame, in eframe's `App::ui`:
+//! let menu = WindowMenu::new(&windows, |_, w| Document {
+//!     key: w.doc_id,
+//!     name: engine.name(w.doc_id),
+//!     dirty: engine.is_dirty(w.doc_id),
+//! });
+//! let base = egui::ViewportBuilder::default().with_inner_size([1000.0, 700.0]);
+//! let events = viewports.show(
+//!     ui,
+//!     &mut windows,
+//!     |id, _| base.clone().with_title(menu.title(id).unwrap_or_default()),
+//!     |ui, id, window| draw_window(ui, id, window, &mut engine),
+//! );
+//! for event in events {
+//!     match event {
+//!         WindowEvent::Focused(_) => {} // `windows.active()` already follows focus
+//!         WindowEvent::CloseRequested(id) => {
+//!             let in_root = viewports.root() == Some(id);
+//!             if in_root {
+//!                 // Otherwise eframe closes the app with the root window.
+//!                 ui.ctx().send_viewport_cmd_to(egui::ViewportId::ROOT, egui::ViewportCommand::CancelClose);
+//!             }
+//!             // Prompt if this is the document's last window and it is dirty; then:
+//!             if let Some(closed) = windows.close(id) {
+//!                 let next = closed.focus.or_else(|| windows.active());
+//!                 match next {
+//!                     Some(next) if in_root => viewports.adopt(ui.ctx(), &windows, next),
+//!                     Some(next) => viewports.focus(ui.ctx(), next),
+//!                     None => { /* last window: the platform default (quit, or stay on macOS) */ }
+//!                 }
+//!             }
+//!         }
+//!     }
+//! }
+//! ```
+
+mod list;
+mod menu;
+mod place;
+#[cfg(feature = "egui")]
+pub mod title_bar;
+#[cfg(feature = "egui")]
+mod viewports;
+
+pub use list::{Closed, WindowId, WindowList};
+pub use menu::{Document, MenuEntry, WindowMenu};
+pub use place::{CASCADE_STEP, Rect, cascade};
+#[cfg(feature = "egui")]
+pub use viewports::{Viewports, WindowEvent, child_viewport_id};
 
 /// The environment-variable prefix an app overrides the frame with: `<PREFIX>_TITLEBAR`.
 ///
diff --git a/crates/window/src/list.rs b/crates/window/src/list.rs
new file mode 100644
index 00000000..91f6481d
--- /dev/null
+++ b/crates/window/src/list.rs
@@ -0,0 +1,239 @@
+//! Open windows, their ids, the active window and most-recent order.
+
+use std::num::NonZeroU64;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use crate::place::Rect;
+
+/// One top-level window, for as long as the process runs.
+///
+/// Ids come from one process-wide counter, so an id is never reused, even after its window closes
+/// or across several [`WindowList`]s. Use it as a key for anything kept per window (UI state,
+/// pending dialogs, an egui viewport).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct WindowId(NonZeroU64);
+
+static NEXT_ID: AtomicU64 = AtomicU64::new(1);
+
+impl WindowId {
+    fn mint() -> Self {
+        // The counter starts at 1 and would wrap to 0 only after 2^64 opens.
+        let raw = NEXT_ID.fetch_add(1, Ordering::Relaxed);
+        Self(NonZeroU64::new(raw).unwrap_or(NonZeroU64::MAX))
+    }
+
+    /// The raw number, for logs and for keys outside Rust (control and MCP protocols).
+    pub fn get(self) -> u64 {
+        self.0.get()
+    }
+}
+
+/// What [`WindowList::close`] hands back.
+#[derive(Debug, PartialEq, Eq)]
+pub struct Closed<T> {
+    /// The closed window's data.
+    pub data: T,
+    /// The window to focus next: the most recently focused remaining window, when the closed one
+    /// was the active window. `None` when another window was already active or none remain.
+    pub focus: Option<WindowId>,
+}
+
+struct Entry<T> {
+    id: WindowId,
+    data: T,
+    outer: Option<Rect>,
+}
+
+/// The app's open windows, each with the app's data `T` (per-window state, or a document key).
+///
+/// Windows are kept in opening order, which is the stable order for menus. Separately, the list
+/// keeps most-recent order: the window focused last comes first. The first of that order is the
+/// *active* window, the one menu commands go to (on macOS, the most recently focused document
+/// window, even while another app has focus).
+pub struct WindowList<T> {
+    entries: Vec<Entry<T>>,
+    /// Most recently focused first; always a permutation of the entries' ids.
+    recent: Vec<WindowId>,
+}
+
+impl<T> Default for WindowList<T> {
+    fn default() -> Self {
+        Self { entries: Vec::new(), recent: Vec::new() }
+    }
+}
+
+impl<T> WindowList<T> {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Open a window with `data`. It becomes the active window, as the desktop focuses a new
+    /// window.
+    pub fn open(&mut self, data: T) -> WindowId {
+        let id = WindowId::mint();
+        self.entries.push(Entry { id, data, outer: None });
+        self.recent.insert(0, id);
+        id
+    }
+
+    /// Close a window. Returns its data and, if it was active, the window to focus next; `None`
+    /// if `id` is not open.
+    pub fn close(&mut self, id: WindowId) -> Option<Closed<T>> {
+        let index = self.entries.iter().position(|e| e.id == id)?;
+        let entry = self.entries.remove(index);
+        let was_active = self.active() == Some(id);
+        self.recent.retain(|&r| r != id);
+        let focus = if was_active { self.active() } else { None };
+        Some(Closed { data: entry.data, focus })
+    }
+
+    /// Record that `id` got focus: it becomes active and moves to the front of most-recent order.
+    /// Returns `false` if `id` is not open.
+    pub fn focus(&mut self, id: WindowId) -> bool {
+        if !self.contains(id) {
+            return false;
+        }
+        self.recent.retain(|&r| r != id);
+        self.recent.insert(0, id);
+        true
+    }
+
+    /// The most recently focused open window.
+    pub fn active(&self) -> Option<WindowId> {
+        self.recent.first().copied()
+    }
+
+    /// Open windows, most recently focused first.
+    pub fn recent(&self) -> impl Iterator<Item = WindowId> + '_ {
+        self.recent.iter().copied()
+    }
+
+    /// Open windows in opening order.
+    pub fn ids(&self) -> impl Iterator<Item = WindowId> + '_ {
+        self.entries.iter().map(|e| e.id)
+    }
+
+    /// Open windows and their data, in opening order.
+    pub fn iter(&self) -> impl Iterator<Item = (WindowId, &T)> {
+        self.entries.iter().map(|e| (e.id, &e.data))
+    }
+
+    /// Open windows and their data, in opening order.
+    pub fn iter_mut(&mut self) -> impl Iterator<Item = (WindowId, &mut T)> {
+        self.entries.iter_mut().map(|e| (e.id, &mut e.data))
+    }
+
+    pub fn get(&self, id: WindowId) -> Option<&T> {
+        self.entries.iter().find(|e| e.id == id).map(|e| &e.data)
+    }
+
+    pub fn get_mut(&mut self, id: WindowId) -> Option<&mut T> {
+        self.entries.iter_mut().find(|e| e.id == id).map(|e| &mut e.data)
+    }
+
+    pub fn contains(&self, id: WindowId) -> bool {
+        self.entries.iter().any(|e| e.id == id)
+    }
+
+    /// The most recently focused window whose data matches, e.g. a window already showing the
+    /// file being opened.
+    pub fn find(&self, mut matches: impl FnMut(&T) -> bool) -> Option<WindowId> {
+        self.recent.iter().copied().find(|&id| self.get(id).is_some_and(&mut matches))
+    }
+
+    pub fn len(&self) -> usize {
+        self.entries.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+
+    /// The window's last known outer rectangle (frame included), in points.
+    pub fn outer_rect(&self, id: WindowId) -> Option<Rect> {
+        self.entries.iter().find(|e| e.id == id).and_then(|e| e.outer)
+    }
+
+    /// Record a window's outer rectangle; the egui driver does this every frame. Platforms that
+    /// don't report window positions (Wayland) leave it unknown.
+    pub fn set_outer_rect(&mut self, id: WindowId, rect: Option<Rect>) {
+        if let Some(entry) = self.entries.iter_mut().find(|e| e.id == id) {
+            entry.outer = rect;
+        }
+    }
+
+    /// The outer rectangle of the most recently focused window whose position is known, other
+    /// than `except`: what a new window cascades from.
+    pub fn cascade_origin(&self, except: Option<WindowId>) -> Option<Rect> {
+        self.recent.iter().filter(|&&id| Some(id) != except).find_map(|&id| self.outer_rect(id))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ids_are_never_reused() {
+        let mut list = WindowList::new();
+        let a = list.open("a");
+        assert!(list.close(a).is_some());
+        let b = list.open("b");
+        let mut other = WindowList::new();
+        let c = other.open("c");
+        assert!(a != b && b != c && a != c);
+        assert!(b > a, "ids increase");
+        assert_eq!(list.get(a), None);
+        assert_eq!(list.get(b), Some(&"b"));
+    }
+
+    #[test]
+    fn focus_and_close_keep_most_recent_order() {
+        let mut list = WindowList::new();
+        let a = list.open("a");
+        let b = list.open("b");
+        let c = list.open("c");
+        assert_eq!(list.active(), Some(c), "a new window is active");
+        assert!(list.focus(a));
+        assert_eq!(list.recent().collect::<Vec<_>>(), [a, c, b]);
+        assert_eq!(list.ids().collect::<Vec<_>>(), [a, b, c], "opening order is stable");
+
+        // Closing a background window leaves the active one alone.
+        let closed = list.close(b);
+        assert_eq!(closed, Some(Closed { data: "b", focus: None }));
+        assert_eq!(list.active(), Some(a));
+
+        // Closing the active window hands focus to the one focused before it.
+        assert_eq!(list.close(a).and_then(|c| c.focus), Some(c));
+        assert_eq!(list.active(), Some(c));
+        assert_eq!(list.close(c).map(|c| c.focus), Some(None), "nothing left to focus");
+        assert!(list.is_empty());
+        assert_eq!(list.close(c), None);
+        assert!(!list.focus(c));
+    }
+
+    #[test]
+    fn find_prefers_the_most_recent_match() {
+        let mut list = WindowList::new();
+        let first = list.open("book.xlsx");
+        let _other = list.open("notes.xlsx");
+        let second = list.open("book.xlsx");
+        assert_eq!(list.find(|d| *d == "book.xlsx"), Some(second));
+        list.focus(first);
+        assert_eq!(list.find(|d| *d == "book.xlsx"), Some(first));
+        assert_eq!(list.find(|d| *d == "missing"), None);
+    }
+
+    #[test]
+    fn cascade_origin_is_the_most_recent_known_rect() {
+        let mut list = WindowList::new();
+        let a = list.open(());
+        let b = list.open(());
+        let rect = Rect::new(10.0, 20.0, 300.0, 200.0);
+        list.set_outer_rect(a, Some(rect));
+        assert_eq!(list.cascade_origin(None), Some(rect), "b's position is unknown");
+        assert_eq!(list.cascade_origin(Some(a)), None);
+        list.set_outer_rect(b, Some(Rect::new(0.0, 0.0, 1.0, 1.0)));
+        assert_eq!(list.cascade_origin(Some(b)), Some(rect));
+    }
+}
diff --git a/crates/window/src/menu.rs b/crates/window/src/menu.rs
new file mode 100644
index 00000000..2fd134e6
--- /dev/null
+++ b/crates/window/src/menu.rs
@@ -0,0 +1,131 @@
+//! The Window menu: one entry per open window, titled by its document.
+
+use std::collections::HashMap;
+use std::hash::Hash;
+
+use crate::list::{WindowId, WindowList};
+
+/// What the app says about the document a window shows.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Document<K> {
+    /// Identifies the document; windows with equal keys show the same document.
+    pub key: K,
+    /// The document's display name ("Book1", "report.docx").
+    pub name: String,
+    /// Unsaved changes.
+    pub dirty: bool,
+}
+
+/// One window in the Window menu (macOS) or the View › Switch Windows list.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct MenuEntry {
+    pub id: WindowId,
+    /// The document's name, or "Name:1", "Name:2", … when several windows show the document.
+    /// Also the window's title.
+    pub title: String,
+    pub dirty: bool,
+    /// The active (most recently focused) window: the one to check-mark.
+    pub active: bool,
+}
+
+/// The Window menu's entries, in the windows' opening order.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct WindowMenu {
+    entries: Vec<MenuEntry>,
+}
+
+impl WindowMenu {
+    /// Build the menu from the open windows. `document` names each window's document.
+    ///
+    /// When several windows show one document, each title gets ":n", numbered by opening order;
+    /// numbers close up when one of them closes, and a document left with one window drops the
+    /// suffix.
+    pub fn new<T, K: Eq + Hash>(windows: &WindowList<T>, mut document: impl FnMut(WindowId, &T) -> Document<K>) -> Self {
+        let docs: Vec<(WindowId, Document<K>)> = windows.iter().map(|(id, data)| (id, document(id, data))).collect();
+        let mut counts: HashMap<&K, usize> = HashMap::new();
+        for (_, doc) in &docs {
+            *counts.entry(&doc.key).or_default() += 1;
+        }
+        let active = windows.active();
+        let mut seen: HashMap<&K, usize> = HashMap::new();
+        let entries = docs
+            .iter()
+            .map(|(id, doc)| {
+                let title = if counts.get(&doc.key).copied().unwrap_or(0) > 1 {
+                    let n = seen.entry(&doc.key).or_default();
+                    *n += 1;
+                    format!("{}:{n}", doc.name)
+                } else {
+                    doc.name.clone()
+                };
+                MenuEntry { id: *id, title, dirty: doc.dirty, active: active == Some(*id) }
+            })
+            .collect();
+        Self { entries }
+    }
+
+    pub fn entries(&self) -> &[MenuEntry] {
+        &self.entries
+    }
+
+    pub fn get(&self, id: WindowId) -> Option<&MenuEntry> {
+        self.entries.iter().find(|e| e.id == id)
+    }
+
+    /// The window's title, as the menu shows it.
+    pub fn title(&self, id: WindowId) -> Option<&str> {
+        self.get(id).map(|e| e.title.as_str())
+    }
+}
+
+impl<'a> IntoIterator for &'a WindowMenu {
+    type Item = &'a MenuEntry;
+    type IntoIter = std::slice::Iter<'a, MenuEntry>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.entries.iter()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Windows on documents (key, name, dirty).
+    fn menu(list: &WindowList<(u32, &str, bool)>) -> Vec<(String, bool, bool)> {
+        WindowMenu::new(list, |_, &(key, name, dirty)| Document { key, name: name.to_owned(), dirty })
+            .entries()
+            .iter()
+            .map(|e| (e.title.clone(), e.dirty, e.active))
+            .collect()
+    }
+
+    fn entry(title: &str, dirty: bool, active: bool) -> (String, bool, bool) {
+        (title.to_owned(), dirty, active)
+    }
+
+    #[test]
+    fn numbers_only_windows_that_share_a_document() {
+        let mut list = WindowList::new();
+        let book = list.open((1, "Book1", true));
+        let _notes = list.open((2, "Notes", false));
+        let second = list.open((1, "Book1", true));
+        list.focus(book);
+        assert_eq!(menu(&list), [entry("Book1:1", true, true), entry("Notes", false, false), entry("Book1:2", true, false)]);
+
+        list.close(book);
+        assert_eq!(menu(&list), [entry("Notes", false, false), entry("Book1", true, true)], "one window left: no suffix");
+        let third = list.open((1, "Book1", true));
+        let titles = WindowMenu::new(&list, |_, &(key, name, dirty)| Document { key, name: name.to_owned(), dirty });
+        assert_eq!(titles.title(second), Some("Book1:1"), "numbers close up in opening order");
+        assert_eq!(titles.title(third), Some("Book1:2"));
+    }
+
+    #[test]
+    fn same_name_different_documents_stay_unnumbered() {
+        let mut list = WindowList::new();
+        list.open((1, "report.docx", false));
+        list.open((2, "report.docx", false));
+        assert_eq!(menu(&list), [entry("report.docx", false, false), entry("report.docx", false, true)]);
+    }
+}
diff --git a/crates/window/src/place.rs b/crates/window/src/place.rs
new file mode 100644
index 00000000..aa4830e0
--- /dev/null
+++ b/crates/window/src/place.rs
@@ -0,0 +1,87 @@
+//! Where a new window goes: cascaded from the most recent window, kept on the screen.
+
+/// A rectangle in points: top-left corner and size.
+#[derive(Clone, Copy, Debug, PartialEq, Default)]
+pub struct Rect {
+    pub x: f32,
+    pub y: f32,
+    pub width: f32,
+    pub height: f32,
+}
+
+impl Rect {
+    pub const fn new(x: f32, y: f32, width: f32, height: f32) -> Self {
+        Self { x, y, width, height }
+    }
+
+    pub fn right(&self) -> f32 {
+        self.x + self.width
+    }
+
+    pub fn bottom(&self) -> f32 {
+        self.y + self.height
+    }
+}
+
+#[cfg(feature = "egui")]
+impl From<egui::Rect> for Rect {
+    fn from(r: egui::Rect) -> Self {
+        Self::new(r.min.x, r.min.y, r.width(), r.height())
+    }
+}
+
+#[cfg(feature = "egui")]
+impl From<Rect> for egui::Rect {
+    fn from(r: Rect) -> Self {
+        egui::Rect::from_min_size(egui::pos2(r.x, r.y), egui::vec2(r.width, r.height))
+    }
+}
+
+/// The default cascade step: about one title bar.
+pub const CASCADE_STEP: f32 = 28.0;
+
+/// Place a window of `size` (outer, in points) one `step` right of and below `previous`, the most
+/// recent window's outer rectangle.
+///
+/// Each axis that would run past `bounds` (the monitor or its work area) starts over at the
+/// bounds' edge, so a long run of new windows walks down the screen and wraps back to the top
+/// left. A window larger than `bounds` goes to the bounds' corner; its size is never changed.
+pub fn cascade(previous: Rect, size: [f32; 2], bounds: Rect, step: f32) -> Rect {
+    let axis = |prev: f32, len: f32, lo: f32, hi: f32| {
+        let pos = prev + step;
+        if pos < lo || pos + len > hi { lo } else { pos }
+    };
+    Rect::new(axis(previous.x, size[0], bounds.x, bounds.right()), axis(previous.y, size[1], bounds.y, bounds.bottom()), size[0], size[1])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const SCREEN: Rect = Rect::new(0.0, 0.0, 1000.0, 800.0);
+
+    #[test]
+    fn steps_down_and_right() {
+        let prev = Rect::new(100.0, 50.0, 400.0, 300.0);
+        assert_eq!(cascade(prev, [400.0, 300.0], SCREEN, 28.0), Rect::new(128.0, 78.0, 400.0, 300.0));
+    }
+
+    #[test]
+    fn wraps_each_axis_at_the_bounds() {
+        // Bottom edge: y starts over, x keeps stepping.
+        let prev = Rect::new(100.0, 480.0, 400.0, 300.0);
+        assert_eq!(cascade(prev, [400.0, 300.0], SCREEN, 28.0), Rect::new(128.0, 0.0, 400.0, 300.0));
+        // Right edge on a second monitor whose work area starts at (1000, 30).
+        let second = Rect::new(1000.0, 30.0, 1200.0, 770.0);
+        let prev = Rect::new(1780.0, 100.0, 400.0, 300.0);
+        assert_eq!(cascade(prev, [400.0, 300.0], second, 28.0), Rect::new(1000.0, 128.0, 400.0, 300.0));
+    }
+
+    #[test]
+    fn a_window_off_the_bounds_or_too_big_goes_to_the_corner() {
+        let prev = Rect::new(-500.0, -200.0, 400.0, 300.0);
+        assert_eq!(cascade(prev, [400.0, 300.0], SCREEN, 28.0), Rect::new(0.0, 0.0, 400.0, 300.0));
+        let prev = Rect::new(10.0, 10.0, 400.0, 300.0);
+        assert_eq!(cascade(prev, [1200.0, 900.0], SCREEN, 28.0), Rect::new(0.0, 0.0, 1200.0, 900.0));
+    }
+}
diff --git a/crates/window/src/title_bar.rs b/crates/window/src/title_bar.rs
new file mode 100644
index 00000000..aedc7deb
--- /dev/null
+++ b/crates/window/src/title_bar.rs
@@ -0,0 +1,291 @@
+//! A strip of the app's own UI as the window's title bar: its empty part moves the window when
+//! dragged and follows the system's title-bar double-click setting.
+//!
+//! This is for windows whose title bar the app draws over: on macOS a hidden title bar with a
+//! full-size content view, elsewhere an undecorated window ([`Frame::App`](crate::Frame::App)).
+//! Call [`empty_area`] with the strip's rect before drawing the strip's controls.
+//!
+//! On macOS the full-size content view makes AppKit hand every click in the title-bar band to the
+//! app (that is how the strip's own controls work), and AppKit does not zoom the window. It does
+//! move the window when a drag starts anywhere in the band, on the strip's controls and on any
+//! in-window panel that lies over the band, unless the window is not movable. [`window_movable`]
+//! says when the pointer is on one of those, and [`sync_movable`] sets the window's `movable` flag
+//! from it before the press.
+//!
+//! In full screen the strip is not a title bar: neither a drag nor a double-click acts on the
+//! window.
+
+use std::sync::{Once, OnceLock};
+
+/// System Settings › Desktop & Dock › "Double-click a window's title bar to".
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum DoubleClick {
+    Zoom,
+    Minimize,
+    Nothing,
+}
+
+/// The value of the global default `AppleActionOnDoubleClick`, as `defaults read` prints it.
+/// Anything other than "Minimize" or "None" zooms, the macOS default ("Maximize"; macOS 15 adds
+/// "Fill", which zooming comes closest to).
+pub fn parse(defaults_output: &str) -> DoubleClick {
+    match defaults_output.trim() {
+        "Minimize" => DoubleClick::Minimize,
+        "None" => DoubleClick::Nothing,
+        _ => DoubleClick::Zoom,
+    }
+}
+
+static ACTION: OnceLock<DoubleClick> = OnceLock::new();
+static READ: Once = Once::new();
+
+/// Starts reading the system setting on a background thread, once per run (macOS only).
+fn prefetch() {
+    READ.call_once(|| {
+        #[cfg(all(target_os = "macos", not(test)))]
+        {
+            // No thread, no setting: the strip zooms.
+            let _ = std::thread::Builder::new().name("title-bar-setting".into()).spawn(|| {
+                let action = match std::process::Command::new("/usr/bin/defaults").args(["read", "-g", "AppleActionOnDoubleClick"]).output() {
+                    Ok(out) if out.status.success() => parse(&String::from_utf8_lossy(&out.stdout)),
+                    // Absent (never changed) or unreadable: the default.
+                    _ => DoubleClick::Zoom,
+                };
+                let _ = ACTION.set(action);
+            });
+        }
+    });
+}
+
+/// The system setting; zoom until it has been read, and always zoom outside macOS.
+pub fn action() -> DoubleClick {
+    ACTION.get().copied().unwrap_or(DoubleClick::Zoom)
+}
+
+/// What a double-click on the empty title bar asks of the window.
+pub fn double_click_command(action: DoubleClick, maximized: bool) -> Option<egui::ViewportCommand> {
+    match action {
+        DoubleClick::Zoom => Some(egui::ViewportCommand::Maximized(!maximized)),
+        DoubleClick::Minimize => Some(egui::ViewportCommand::Minimized(true)),
+        DoubleClick::Nothing => None,
+    }
+}
+
+/// Makes the empty part of `rect` act as a title bar. Call it before drawing the strip's controls:
+/// they sit on top and take their own clicks.
+///
+/// The area senses clicks only. A drag-sensing background would also receive drags that start
+/// on a click-only control (egui gives clicks and drags to different widgets), so a drag is
+/// detected here as a press on the empty area that has stopped being a click.
+/// It takes no keyboard focus: Tab goes to the strip's controls.
+///
+/// Returns the empty area's response, for an accessible label or a tooltip.
+pub fn empty_area(ui: &mut egui::Ui, rect: egui::Rect) -> egui::Response {
+    prefetch();
+    let resp = ui.interact(rect, ui.scope_id().with("title_bar_empty"), egui::Sense::CLICK);
+    let covered = ui.ctx().pointer_hover_pos().filter(|p| rect.contains(*p)).and_then(|p| ui.ctx().layer_id_at(p));
+    let covered = covered.is_some_and(|top| covers(top, ui.layer_id(), resp.hovered()));
+    let pass = ui.ctx().cumulative_pass_nr();
+    ui.data_mut(|d| d.insert_temp(movable_id(), (pass, !covered)));
+    // egui forgets which widget a press landed on once it can no longer be a click, so the press
+    // is remembered (by its start time) while it still can.
+    let armed = resp.id.with("drag_press");
+    if ui.input(|i| i.viewport().fullscreen).unwrap_or(false) {
+        ui.data_mut(|d| d.remove::<Option<f64>>(armed));
+        return resp;
+    }
+    if resp.double_clicked() {
+        let maximized = ui.input(|i| i.viewport().maximized).unwrap_or(false);
+        if let Some(cmd) = double_click_command(action(), maximized) {
+            ui.ctx().send_viewport_cmd(cmd);
+        }
+    }
+    let press = ui.input(|i| i.pointer.press_start_time());
+    if resp.is_pointer_button_down_on() {
+        ui.data_mut(|d| d.insert_temp(armed, press));
+    }
+    if press.is_some() && ui.input(|i| i.pointer.is_decidedly_dragging()) && ui.data(|d| d.get_temp::<Option<f64>>(armed)) == Some(press) {
+        // Once per press: AppKit's drag loop takes the mouse-up, so egui may still see the button
+        // down afterwards.
+        ui.data_mut(|d| d.remove::<Option<f64>>(armed));
+        ui.ctx().send_viewport_cmd(egui::ViewportCommand::StartDrag);
+    }
+    resp
+}
+
+/// Whether `top`, the topmost layer under the pointer, keeps a drag there from moving the window.
+///
+/// In the strip's own layer a control covers the empty area when the empty area is not hovered.
+/// A `Middle` layer is an in-window panel lying over the strip (a floating dock, an
+/// `egui::Window`). A layer above those (a modal's backdrop, a tooltip) leaves the window movable,
+/// as AppKit's own title bar would be.
+fn covers(top: egui::LayerId, strip: egui::LayerId, empty_hovered: bool) -> bool {
+    if top == strip { !empty_hovered } else { top.order == egui::Order::Middle }
+}
+
+fn movable_id() -> egui::Id {
+    egui::Id::unique("title_bar_window_movable")
+}
+
+/// Whether AppKit may move the window when a drag starts in the title-bar band: false while the
+/// pointer is on one of the strip's controls or on an in-window panel over the strip, so pressing
+/// and dragging there does not move the window. True when neither this pass nor the one before
+/// drew a title bar.
+pub fn window_movable(ctx: &egui::Context) -> bool {
+    match ctx.data(|d| d.get_temp::<(u64, bool)>(movable_id())) {
+        Some((pass, movable)) if ctx.cumulative_pass_nr().saturating_sub(pass) <= 1 => movable,
+        _ => true,
+    }
+}
+
+/// Sets the window's `movable` flag from this pass's [`window_movable`]. Call it once per frame,
+/// after the UI has run. `applied` holds the value last set, so AppKit is only called when it
+/// changes.
+///
+/// Only windows with a full-size content view and visible window buttons are touched: the app
+/// draws over their title bar. Floating panels in their own windows hide the buttons, and keep
+/// their own `movable`, which AppKit also needs to resize them from their edges.
+#[cfg(target_os = "macos")]
+pub fn sync_movable(ctx: &egui::Context, applied: &mut Option<bool>) {
+    use objc2::MainThreadMarker;
+    use objc2_app_kit::{NSApplication, NSWindowButton, NSWindowStyleMask};
+
+    let movable = window_movable(ctx);
+    if *applied == Some(movable) {
+        return;
+    }
+    // eframe runs the app on the main thread; anywhere else AppKit is out of reach.
+    let Some(mtm) = MainThreadMarker::new() else {
+        return;
+    };
+    let mut found = false;
+    for window in NSApplication::sharedApplication(mtm).windows().to_vec() {
+        let buttons = window.standardWindowButton(NSWindowButton::CloseButton).is_some_and(|close| !close.isHidden());
+        if window.styleMask().contains(NSWindowStyleMask::FullSizeContentView) && buttons {
+            window.setMovable(movable);
+            found = true;
+        }
+    }
+    // Before the window is on screen there is nothing to set yet; try again next frame.
+    if found {
+        *applied = Some(movable);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::{Context, Event, Order, PointerButton, Pos2, RawInput, Rect, ViewportCommand, ViewportId, pos2, vec2};
+
+    #[test]
+    fn parses_the_defaults_output() {
+        assert_eq!(parse("Maximize\n"), DoubleClick::Zoom);
+        assert_eq!(parse("Minimize\n"), DoubleClick::Minimize);
+        assert_eq!(parse("None\n"), DoubleClick::Nothing);
+        for junk in ["", "Fill", "minimize", "1", "The domain/default pair of (kCFPreferencesAnyApplication, X) does not exist"] {
+            assert_eq!(parse(junk), DoubleClick::Zoom, "{junk:?}");
+        }
+    }
+
+    #[test]
+    fn tab_skips_the_empty_area() {
+        let mut bar = Bar::new();
+        bar.frame(vec![]);
+        let tab = Event::Key { key: egui::Key::Tab, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE };
+        bar.frame(vec![tab]);
+        bar.frame(vec![]);
+        let focused = bar.ctx.memory(|m| m.focused()).and_then(|id| bar.ctx.read_response(id)).map(|r| r.rect);
+        assert!(focused.is_some_and(|r| r.contains(BUTTON) && r.width() < 100.0), "the first Tab goes to the strip's button: {focused:?}");
+    }
+
+    #[test]
+    fn zoom_toggles_and_minimize_minimizes() {
+        use egui::ViewportCommand::{Maximized, Minimized};
+        assert_eq!(double_click_command(DoubleClick::Zoom, false), Some(Maximized(true)));
+        assert_eq!(double_click_command(DoubleClick::Zoom, true), Some(Maximized(false)));
+        assert_eq!(double_click_command(DoubleClick::Minimize, false), Some(Minimized(true)));
+        assert_eq!(double_click_command(DoubleClick::Nothing, true), None);
+    }
+
+    /// A 400×28 strip with a button at x 10..60, a `Middle` area at x 100..180 and a `Foreground`
+    /// area at x 200..280, all over the strip.
+    struct Bar {
+        ctx: Context,
+        time: f64,
+        fullscreen: bool,
+    }
+
+    const BUTTON: Pos2 = pos2(30.0, 14.0);
+    const EMPTY: Pos2 = pos2(350.0, 14.0);
+    const FLOAT: Pos2 = pos2(140.0, 14.0);
+    const OVERLAY: Pos2 = pos2(240.0, 14.0);
+
+    impl Bar {
+        fn new() -> Self {
+            Self { ctx: Context::default(), time: 0.0, fullscreen: false }
+        }
+
+        /// Runs one frame with `events`; returns the viewport commands it sent.
+        fn frame(&mut self, events: Vec<Event>) -> Vec<ViewportCommand> {
+            self.time += 1.0 / 60.0;
+            let mut input = RawInput {
+                screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(400.0, 300.0))),
+                time: Some(self.time),
+                events,
+                ..RawInput::default()
+            };
+            input.viewports.entry(ViewportId::ROOT).or_default().fullscreen = Some(self.fullscreen);
+            let mut out = self.ctx.run_ui(input, |ui| {
+                empty_area(ui, Rect::from_min_size(Pos2::ZERO, vec2(400.0, 28.0)));
+                let _ = ui.put(Rect::from_min_max(pos2(10.0, 4.0), pos2(60.0, 24.0)), egui::Button::new("Menu"));
+                for (id, order, x) in [("float", Order::Middle, 100.0), ("overlay", Order::Foreground, 200.0)] {
+                    egui::Area::new(egui::Id::unique(id)).order(order).fixed_pos(pos2(x, 0.0)).show(ui.ctx(), |ui| {
+                        ui.allocate_exact_size(vec2(80.0, 28.0), egui::Sense::hover());
+                    });
+                }
+            });
+            // No renderer here to take the font atlas.
+            out.textures_delta.clear();
+            out.viewport_output.get(&ViewportId::ROOT).map(|v| v.commands.clone()).unwrap_or_default()
+        }
+
+        /// Moves the pointer to `p` and lets layers and hover settle.
+        fn hover(&mut self, p: Pos2) {
+            for _ in 0..3 {
+                self.frame(vec![Event::PointerMoved(p)]);
+            }
+        }
+
+        /// Presses at `p`, drags 30 points right and releases; returns how many `StartDrag`s it sent.
+        fn drag(&mut self, p: Pos2) -> usize {
+            self.hover(p);
+            let button = |pos, pressed| Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
+            let mut commands = self.frame(vec![button(p, true)]);
+            for dx in [5.0, 10.0, 20.0, 30.0] {
+                commands.extend(self.frame(vec![Event::PointerMoved(p + vec2(dx, 0.0))]));
+            }
+            commands.extend(self.frame(vec![button(p + vec2(30.0, 0.0), false)]));
+            commands.iter().filter(|c| matches!(c, ViewportCommand::StartDrag)).count()
+        }
+    }
+
+    #[test]
+    fn only_the_empty_strip_moves_the_window() {
+        let mut bar = Bar::new();
+        bar.hover(EMPTY);
+        assert!(window_movable(&bar.ctx), "empty strip");
+        bar.hover(BUTTON);
+        assert!(!window_movable(&bar.ctx), "control on the strip");
+        bar.hover(FLOAT);
+        assert!(!window_movable(&bar.ctx), "Middle area over the strip");
+        bar.hover(OVERLAY);
+        assert!(window_movable(&bar.ctx), "Foreground area over the strip");
+
+        assert_eq!(bar.drag(EMPTY), 1, "drag on the empty strip");
+        assert_eq!(bar.drag(BUTTON), 0, "drag on a control");
+        assert_eq!(bar.drag(FLOAT), 0, "drag on a Middle area");
+
+        bar.fullscreen = true;
+        assert_eq!(bar.drag(EMPTY), 0, "drag in full screen");
+    }
+}
diff --git a/crates/window/src/viewports.rs b/crates/window/src/viewports.rs
new file mode 100644
index 00000000..fde0b3de
--- /dev/null
+++ b/crates/window/src/viewports.rs
@@ -0,0 +1,401 @@
+//! Show each open window as an egui immediate viewport.
+
+use std::collections::HashMap;
+
+use egui::{Context, Ui, ViewportBuilder, ViewportCommand, ViewportId};
+
+use crate::list::{WindowId, WindowList};
+use crate::place::{CASCADE_STEP, Rect, cascade};
+use crate::{Frame, decorate};
+
+/// Something that happened to a window this frame. The app decides what follows.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum WindowEvent {
+    /// The window got focus. The driver has already made it the list's active window.
+    Focused(WindowId),
+    /// The user asked to close the window (its close button, Alt+F4, ⌘W through the desktop).
+    ///
+    /// A child window stays open until the app closes it in the [`WindowList`], so the app can ask
+    /// to save first. For the window in the root viewport, eframe closes the whole app unless the
+    /// app sends [`ViewportCommand::CancelClose`] to the root in the same frame: do that before
+    /// adopting another window ([`Viewports::adopt`]) or prompting.
+    CloseRequested(WindowId),
+}
+
+/// What the driver remembers about a window between frames.
+#[derive(Default)]
+struct Seen {
+    focused: bool,
+    inner_size: Option<egui::Vec2>,
+    monitor_size: Option<egui::Vec2>,
+    /// The cascade position chosen when the window was created; repeated every frame so egui sees
+    /// an unchanged builder.
+    position: Option<egui::Pos2>,
+    /// The root viewport's title, sent as a command when it changes.
+    title: Option<String>,
+}
+
+/// Shows the windows of a [`WindowList`] as egui immediate viewports, one native window each.
+///
+/// Call [`Viewports::show`] once per frame from the root viewport's UI. The root viewport stays
+/// the app's: when the app maps it to a window with [`Viewports::set_root`], that window's content
+/// is drawn into the root UI, and every other window gets its own viewport. Close and quit policy
+/// stays with the app; the driver reports [`WindowEvent`]s.
+pub struct Viewports {
+    frame: Frame,
+    root: Option<WindowId>,
+    step: f32,
+    bounds: Option<Rect>,
+    seen: HashMap<WindowId, Seen>,
+}
+
+impl Viewports {
+    /// `frame` is the app's frame decision ([`crate::Choice::probe`]), applied to every new
+    /// window's builder.
+    pub fn new(frame: Frame) -> Self {
+        Self { frame, root: None, step: CASCADE_STEP, bounds: None, seen: HashMap::new() }
+    }
+
+    /// The cascade offset for new windows, in points. Defaults to [`CASCADE_STEP`].
+    pub fn with_step(mut self, step: f32) -> Self {
+        self.step = step;
+        self
+    }
+
+    /// The area new windows cascade within, when the app knows the work area. Without it the
+    /// driver uses the size of the monitor the previous window is on, as egui reports it.
+    pub fn set_bounds(&mut self, bounds: Option<Rect>) {
+        self.bounds = bounds;
+    }
+
+    /// The window drawn in the root viewport.
+    pub fn root(&self) -> Option<WindowId> {
+        self.root
+    }
+
+    /// Draw `id` in the root viewport (or nothing, with `None`). The window's own viewport, if it
+    /// had one, closes on the next frame.
+    pub fn set_root(&mut self, id: Option<WindowId>) {
+        if let Some(id) = id {
+            // The root is a different native window: forget the child's focus and title.
+            self.seen.insert(id, Seen::default());
+        }
+        self.root = id;
+    }
+
+    /// Move window `id` into the root viewport, for when the root's own window closes while
+    /// others stay open. The root window takes `id`'s position and size and gets focus; `id`'s
+    /// data and [`WindowId`] are unchanged, so its UI state carries over.
+    pub fn adopt<T>(&mut self, ctx: &Context, windows: &WindowList<T>, id: WindowId) {
+        let inner_size = self.seen.get(&id).and_then(|s| s.inner_size);
+        self.set_root(Some(id));
+        if let Some(rect) = windows.outer_rect(id) {
+            ctx.send_viewport_cmd_to(ViewportId::ROOT, ViewportCommand::OuterPosition(egui::pos2(rect.x, rect.y)));
+        }
+        if let Some(size) = inner_size {
+            ctx.send_viewport_cmd_to(ViewportId::ROOT, ViewportCommand::InnerSize(size));
+        }
+        ctx.send_viewport_cmd_to(ViewportId::ROOT, ViewportCommand::Focus);
+    }
+
+    /// The egui viewport that shows `id`: [`ViewportId::ROOT`] for the root's window.
+    pub fn viewport_id(&self, id: WindowId) -> ViewportId {
+        if self.root == Some(id) { ViewportId::ROOT } else { child_viewport_id(id) }
+    }
+
+    /// The window a viewport shows, e.g. `ctx.viewport_id()` inside a window's UI.
+    pub fn window_of(&self, viewport: ViewportId) -> Option<WindowId> {
+        if viewport == ViewportId::ROOT {
+            return self.root;
+        }
+        self.seen.keys().copied().find(|&id| self.root != Some(id) && child_viewport_id(id) == viewport)
+    }
+
+    /// Bring window `id` to the front.
+    pub fn focus(&self, ctx: &Context, id: WindowId) {
+        ctx.send_viewport_cmd_to(self.viewport_id(id), ViewportCommand::Focus);
+    }
+
+    /// Show every open window for this frame. Call from the root viewport's UI.
+    ///
+    /// - `builder` gives a window's viewport builder: its title (e.g. from [`crate::WindowMenu`]),
+    ///   size and icon. The driver applies the frame decision ([`decorate`]) after it, and places
+    ///   a new window by [`cascade`] from the most recently focused window. For the root's window
+    ///   only the title is used.
+    /// - `content` draws a window into its viewport's top-level [`Ui`]; `ui.ctx()` is that
+    ///   viewport's context, so per-viewport input (`close_requested`, IME) and commands apply to
+    ///   that window.
+    ///
+    /// Returns this frame's focus changes and close requests, in drawing order.
+    pub fn show<T>(
+        &mut self,
+        ui: &mut Ui,
+        windows: &mut WindowList<T>,
+        mut builder: impl FnMut(WindowId, &T) -> ViewportBuilder,
+        mut content: impl FnMut(&mut Ui, WindowId, &mut T),
+    ) -> Vec<WindowEvent> {
+        self.seen.retain(|id, _| windows.contains(*id));
+        let ctx = ui.ctx().clone();
+        let mut events = Vec::new();
+
+        if let Some(root) = self.root.filter(|&id| windows.contains(id)) {
+            if let Some(title) = windows.get(root).and_then(|data| builder(root, data).title) {
+                let seen = self.seen.entry(root).or_default();
+                if seen.title.as_ref() != Some(&title) {
+                    ctx.send_viewport_cmd_to(ViewportId::ROOT, ViewportCommand::Title(title.clone()));
+                    seen.title = Some(title);
+                }
+            }
+            if let Some(data) = windows.get_mut(root) {
+                content(ui, root, data);
+            }
+            self.record(Snapshot::read(&ctx), windows, root, &mut events);
+        }
+
+        let children: Vec<WindowId> = windows.ids().filter(|&id| self.root != Some(id)).collect();
+        for id in children {
+            let Some(data) = windows.get(id) else { continue };
+            let mut viewport = decorate(builder(id, data), &self.frame);
+            let position = match self.seen.get(&id) {
+                Some(seen) => seen.position,
+                None => self.place(windows, id, &viewport),
+            };
+            if let Some(position) = position {
+                viewport = viewport.with_position(position);
+            }
+            self.seen.entry(id).or_default().position = position;
+
+            let Some(data) = windows.get_mut(id) else { continue };
+            let snapshot = ctx.show_viewport_immediate(child_viewport_id(id), viewport, |child_ui, _class| {
+                content(child_ui, id, data);
+                Snapshot::read(child_ui.ctx())
+            });
+            self.record(snapshot, windows, id, &mut events);
+        }
+        events
+    }
+
+    /// Take in window `id`'s viewport state for this frame.
+    fn record<T>(&mut self, snapshot: Snapshot, windows: &mut WindowList<T>, id: WindowId, events: &mut Vec<WindowEvent>) {
+        let Snapshot { close, focused, outer, inner, monitor } = snapshot;
+        windows.set_outer_rect(id, outer.map(Rect::from));
+        let seen = self.seen.entry(id).or_default();
+        seen.inner_size = inner.map(|r| r.size()).or(seen.inner_size);
+        seen.monitor_size = monitor.or(seen.monitor_size);
+        if focused && !seen.focused {
+            windows.focus(id);
+            events.push(WindowEvent::Focused(id));
+        }
+        seen.focused = focused;
+        if close {
+            events.push(WindowEvent::CloseRequested(id));
+        }
+    }
+
+    /// Where a new window goes, if the previous window's position is known.
+    fn place<T>(&self, windows: &WindowList<T>, id: WindowId, viewport: &ViewportBuilder) -> Option<egui::Pos2> {
+        let previous = windows.cascade_origin(Some(id))?;
+        let previous_id = windows.recent().find(|&w| w != id && windows.outer_rect(w).is_some());
+        // The new window's outer size: its requested inner size plus the previous window's frame.
+        let frame = previous_id
+            .and_then(|w| self.seen.get(&w))
+            .and_then(|s| s.inner_size)
+            .map(|inner| egui::vec2(previous.width - inner.x, previous.height - inner.y))
+            .unwrap_or_default();
+        let size = viewport.inner_size.map(|s| s + frame).unwrap_or(egui::vec2(previous.width, previous.height));
+        let bounds = self.bounds.or_else(|| {
+            let monitor = previous_id.and_then(|w| self.seen.get(&w)).and_then(|s| s.monitor_size)?;
+            Some(monitor_bounds(previous, monitor))
+        })?;
+        let placed = cascade(previous, [size.x, size.y], bounds, self.step);
+        Some(egui::pos2(placed.x, placed.y))
+    }
+}
+
+/// A viewport's state for this frame, read inside its own pass (egui's input is per viewport).
+struct Snapshot {
+    close: bool,
+    focused: bool,
+    outer: Option<egui::Rect>,
+    inner: Option<egui::Rect>,
+    monitor: Option<egui::Vec2>,
+}
+
+impl Snapshot {
+    fn read(ctx: &Context) -> Self {
+        ctx.input(|i| {
+            let v = i.viewport();
+            Self {
+                close: v.close_requested(),
+                focused: v.focused.unwrap_or(false),
+                outer: v.outer_rect,
+                inner: v.inner_rect,
+                monitor: v.monitor_size,
+            }
+        })
+    }
+}
+
+/// The viewport id of a window that isn't in the root viewport.
+pub fn child_viewport_id(id: WindowId) -> ViewportId {
+    ViewportId::from_hash_of(("craft_window", id.get()))
+}
+
+/// egui reports a monitor's size but not its origin. Assume monitors of that size tile the
+/// desktop and take the tile holding the window's top-left corner, which is right for a single
+/// monitor and for side-by-side monitors of equal size.
+fn monitor_bounds(window: Rect, monitor: egui::Vec2) -> Rect {
+    let tile = |pos: f32, len: f32| if len > 0.0 { (pos / len).floor() * len } else { 0.0 };
+    Rect::new(tile(window.x, monitor.x), tile(window.y, monitor.y), monitor.x, monitor.y)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::RefCell;
+
+    use egui::{RawInput, ViewportEvent, ViewportInfo};
+
+    use super::*;
+    use crate::Layout;
+
+    thread_local! {
+        /// The builders the test backend received, by viewport.
+        static BUILDERS: RefCell<HashMap<ViewportId, ViewportBuilder>> = RefCell::new(HashMap::new());
+        /// The viewport infos the test backend hands each viewport's pass.
+        static INFOS: RefCell<egui::ViewportIdMap<ViewportInfo>> = RefCell::new(egui::ViewportIdMap::default());
+    }
+
+    /// A multi-viewport backend like eframe's: each immediate viewport runs a nested pass with its
+    /// own input.
+    fn backend() -> Context {
+        BUILDERS.with(|b| b.borrow_mut().clear());
+        INFOS.with(|i| i.borrow_mut().clear());
+        let ctx = Context::default();
+        ctx.set_embed_viewports(false);
+        Context::set_immediate_viewport_renderer(|ctx, viewport| {
+            let id = viewport.ids.this;
+            BUILDERS.with(|b| b.borrow_mut().insert(id, viewport.builder.clone()));
+            let mut input = RawInput { viewport_id: id, ..RawInput::default() };
+            input.viewports = INFOS.with(|i| i.borrow().clone());
+            input.viewports.entry(id).or_default().parent = Some(viewport.ids.parent);
+            let mut cb = viewport.viewport_ui_cb;
+            let mut out = ctx.run_ui(input, |ui| cb(ui));
+            out.textures_delta.clear(); // not painted
+        });
+        ctx
+    }
+
+    fn info(viewport: ViewportId, edit: impl FnOnce(&mut ViewportInfo)) {
+        INFOS.with(|i| edit(i.borrow_mut().entry(viewport).or_default()));
+    }
+
+    /// One root frame showing `windows`; returns the events and which windows drew where.
+    fn frame(ctx: &Context, driver: &mut Viewports, windows: &mut WindowList<&'static str>) -> (Vec<WindowEvent>, Vec<(WindowId, ViewportId)>) {
+        let mut input = RawInput { viewports: INFOS.with(|i| i.borrow().clone()), ..RawInput::default() };
+        input.viewports.entry(ViewportId::ROOT).or_default();
+        let mut drawn = Vec::new();
+        let mut events = Vec::new();
+        let mut out = ctx.run_ui(input, |ui| {
+            events = driver.show(
+                ui,
+                windows,
+                |_, name| ViewportBuilder::default().with_title(*name).with_inner_size([400.0, 300.0]),
+                |ui, id, _| drawn.push((id, ui.ctx().viewport_id())),
+            );
+        });
+        out.textures_delta.clear(); // not painted
+        INFOS.with(|i| i.borrow_mut().values_mut().for_each(|v| v.events.clear()));
+        (events, drawn)
+    }
+
+    #[test]
+    fn each_window_gets_its_own_viewport_and_close_is_reported_per_window() {
+        let ctx = backend();
+        let mut driver = Viewports::new(Frame::App(Layout::default()));
+        let mut windows = WindowList::new();
+        let a = windows.open("a");
+        let b = windows.open("b");
+
+        let (events, drawn) = frame(&ctx, &mut driver, &mut windows);
+        assert!(events.is_empty());
+        let (va, vb) = (child_viewport_id(a), child_viewport_id(b));
+        assert_eq!(drawn, [(a, va), (b, vb)]);
+        assert_ne!(va, vb);
+        assert_eq!(driver.window_of(vb), Some(b));
+
+        let builders = BUILDERS.with(|b| b.borrow().clone());
+        for v in [va, vb] {
+            assert_eq!(builders.get(&v).and_then(|b| b.decorations), Some(false), "the app draws the frame");
+        }
+        assert_eq!(builders.get(&va).and_then(|b| b.title.clone()).as_deref(), Some("a"));
+
+        info(vb, |v| v.events.push(ViewportEvent::Close));
+        let (events, drawn) = frame(&ctx, &mut driver, &mut windows);
+        assert_eq!(events, [WindowEvent::CloseRequested(b)]);
+        assert_eq!(drawn.len(), 2, "the window stays until the app closes it");
+    }
+
+    #[test]
+    fn focus_is_reported_once_and_makes_the_window_active() {
+        let ctx = backend();
+        let mut driver = Viewports::new(Frame::Desktop);
+        let mut windows = WindowList::new();
+        let a = windows.open("a");
+        let _b = windows.open("b");
+        info(child_viewport_id(a), |v| v.focused = Some(true));
+        let (events, _) = frame(&ctx, &mut driver, &mut windows);
+        assert_eq!(events, [WindowEvent::Focused(a)]);
+        assert_eq!(windows.active(), Some(a));
+        let (events, _) = frame(&ctx, &mut driver, &mut windows);
+        assert!(events.is_empty(), "still focused: no new event");
+    }
+
+    #[test]
+    fn the_root_window_draws_in_the_root_viewport() {
+        let ctx = backend();
+        let mut driver = Viewports::new(Frame::Desktop);
+        let mut windows = WindowList::new();
+        let a = windows.open("a");
+        let b = windows.open("b");
+        driver.set_root(Some(a));
+        info(ViewportId::ROOT, |v| v.events.push(ViewportEvent::Close));
+        let (events, drawn) = frame(&ctx, &mut driver, &mut windows);
+        assert_eq!(drawn, [(a, ViewportId::ROOT), (b, child_viewport_id(b))]);
+        assert_eq!(events, [WindowEvent::CloseRequested(a)]);
+
+        // The root's window closes; the root adopts b, which loses its own viewport.
+        windows.close(a);
+        driver.adopt(&ctx, &windows, b);
+        let (_, drawn) = frame(&ctx, &mut driver, &mut windows);
+        assert_eq!(drawn, [(b, ViewportId::ROOT)]);
+        assert_eq!(driver.window_of(ViewportId::ROOT), Some(b));
+    }
+
+    #[test]
+    fn a_new_window_cascades_from_the_last_one() {
+        let ctx = backend();
+        let mut driver = Viewports::new(Frame::Desktop);
+        let mut windows = WindowList::new();
+        let a = windows.open("a");
+        let va = child_viewport_id(a);
+        info(va, |v| {
+            v.outer_rect = Some(egui::Rect::from_min_size(egui::pos2(100.0, 50.0), egui::vec2(400.0, 330.0)));
+            v.inner_rect = Some(egui::Rect::from_min_size(egui::pos2(100.0, 80.0), egui::vec2(400.0, 300.0)));
+            v.monitor_size = Some(egui::vec2(1000.0, 800.0));
+        });
+        frame(&ctx, &mut driver, &mut windows);
+        let b = windows.open("b");
+        frame(&ctx, &mut driver, &mut windows);
+        let position = BUILDERS.with(|m| m.borrow().get(&child_viewport_id(b)).and_then(|b| b.position));
+        assert_eq!(position, Some(egui::pos2(128.0, 78.0)));
+        let position = BUILDERS.with(|m| m.borrow().get(&va).and_then(|b| b.position));
+        assert_eq!(position, None, "the first window is placed by the desktop");
+    }
+
+    #[test]
+    fn monitor_bounds_follow_the_window() {
+        let monitor = egui::vec2(1920.0, 1080.0);
+        assert_eq!(monitor_bounds(Rect::new(2000.0, 10.0, 1.0, 1.0), monitor), Rect::new(1920.0, 0.0, 1920.0, 1080.0));
+        assert_eq!(monitor_bounds(Rect::new(10.0, 10.0, 1.0, 1.0), monitor), Rect::new(0.0, 0.0, 1920.0, 1080.0));
+    }
+}
diff --git a/docs/egui-037-migration-plan.md b/docs/egui-037-migration-plan.md
new file mode 100644
index 00000000..c793b26d
--- /dev/null
+++ b/docs/egui-037-migration-plan.md
@@ -0,0 +1,1211 @@
+# egui 0.37 migration plan for craft-libs
+
+Status update (2026-10-25): local candidate includes main `865c9af7fdf455cd3892402d18e526a9f019c6bc`, preserving current native docking, blocked-window focus and print-copy handling. Native input-callback cancellation no longer re-enters the plugin mutex. Both cancellation regressions reproduced the deadlock before the fix. Current gates passed: 1,774 test executions, zero failures, 21 ignored, plus strict workspace/UI/print lint, UI all-feature tests, native example build and UI WASM check. Independent merge/implementation and compiler-correction reviews passed. App-pinned ancestors 25da1314 and 650b1c0 remain reachable. Current-source native platforms/GUI/printer hardware and paired performance remain open; the attempted paired run stopped before measurement due to a collector metadata-projection bug. Publication needs separate explicit approval; human review and human merge are required.
+
+The original planning record below is historical.
+
+Status: final landing integration, 2026-10-25. The reviewed shared UI includes screenshot completion, shaped-text alignment, keymap support and regression coverage. The manifest and lock select egui `6d518fc799681571963842f95b55a6b68431b15a` and winit `a517b3846ee8457d84ee4975110bfda6797c44dc` through canonical GitHub URLs.
+
+The integration of migration ancestor `25da1314d443171b4adeaad2cd9454b273f35c6f` with main `2ab6049d9031bc8fae7f7df669b5fccaf5b9966f` passed formatting, strict workspace all-target clippy, workspace tests and the PDF all-feature suite in managed job `egui037-craft-libs-current-main-gates-20261024-2021`. Source and lock hashes were checked against that job before the local integration checkpoint.
+
+New main `6e7f28518dd1cb57e1624bdc269c3c14316b13ae` adds docking, native floating windows and other shared-library changes. Its integration passed fresh review. That review identified an IME reset acknowledgement lost when a native floating window was blocked; the fix preserves ordered control messages in both raw and processed panel input, with a native-driver regression. A second review accepted the fix.
+
+Managed job `egui037-craft-libs-native-fix-gates-20261025-0328` passed formatting, strict workspace lint, workspace tests, UI all-feature lint/tests, the native docking example build, UI WASM check, and prepress/plate-test all-feature lint/tests with hash-verified licensed PDF test fonts. Its 121 test summaries total 1,723 passed, 0 failed and 25 ignored; overlapping feature suites are included in those totals. PDF all-feature tests also passed in job `egui037-craft-libs-new-main-ci-20261025-0242`. Further shared-crate feature/platform matrices, visible native-window workflows and final performance acceptance remain open. App-pinned migration ancestors remain reachable. The prepared benchmark protocol has no accepted timing result; the completed egui text benchmark remains separately inconclusive. Earlier test counts below are historical snapshots.
+
+Every push or new PR requires approval of its exact commit range and validation. Human review and merge are required. The baseline tables below preserve the original planning record.
+
+This plan covers only `storytold/craft-libs`. It records the shared-library work needed before the
+Craft applications move to the egui 0.37 family. Application-specific UI migrations, their document
+models, command routing, persistence policy and native window ownership remain in those applications.
+
+The [suite rollout plan](egui-037-suite-rollout.md) supplies the shared publication order,
+measurement protocol and cross-application acceptance contract. Stricter repository gates apply.
+
+## 1. Baseline and provenance
+
+### 1.1 Exact source baseline
+
+| Item | Revision / value |
+| --- | --- |
+| craft-libs checkout | `49190884278f16c9a9f5823d7698a8ffb5deb062` (`Merge pull request #238 ...`, 2026-10-22) |
+| older local comparison point | `b1401e3` (stale local `origin/main`; not the current remote baseline) |
+| lockfile | `Cargo.lock`, format version 4 |
+| current egui family | `egui`, `epaint`, `ecolor`, `emath`, `eframe`, `egui-wgpu`, `egui-winit`, `egui_extras`, `egui_kittest` all `0.36.2` |
+| current winit | `0.30.13`, crates.io checksum `a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d` |
+| current accesskit | `0.24.1`; `accesskit_consumer` `0.35.0`; `kittest` `0.4.0` |
+| target upstream release | egui annotated tag `0.37.0`, peeled commit `841a328ba2dd8f6996beb7189ebb7fc00e668a2a`, released 2026-10-15; **not** `main` |
+| egui source candidate | `aiongg/egui` `craft/0.37` at `a4f9a17f64a6bae61350fb85804c9df0d9865916`; integrate/review into storytold before production pinning |
+| winit source candidate | `aiongg/winit` `craft/0.30.13-lang` at `8b35388bd719e8cc86a95971ba0bc026c9a8f058`; integrate/review into storytold before production pinning |
+| storytold winit base | `craft/0.30.13` at `ffae5198770d7730e718043f035a772b7dbc3b1b`, itself based on winit tag `v0.30.13` (`e9809ef5`) |
+| craft-libs PR under review | `storytold/craft-libs` PR 199, OPEN / CONFLICTING at head `b68de8c5f4f1c060904d211a7b1320aa0f7bce78`; its merge into local audit branch is `ec8840af8c5fda695cf195cdd05e5ae078415c07` |
+
+The audit merge `ec8840a` is **not** a usable target: its conflicted `Cargo.lock` still resolves egui
+0.36.2 even though the manifest and source use the 0.37 API. The PR branch itself has a 0.37.0
+registry lock. The historical audit log at
+`/home/codex/work/ssd2/task-evidence/egui037-audit-20261022/fork/craft-libs.log` shows a successful
+`cargo check` after the audit harness patched 11 crates to the fork path; it is a useful lead, not
+fresh evidence and not a test run. Fresh validation uses `maintenance/task.py run/status/finish`: retain the owning resource, source
+and evidence paths across sequential commands and use a fresh job ID for each intentional command.
+
+### 1.2 Dependents and feature targets in this workspace
+
+The root workspace has no application binaries or examples. Excluded vendored PDF
+crates retain their own examples/workspaces; keep them unchanged. Relevant root targets are
+libraries and their tests:
+
+| Crate | egui use | Features / targets |
+| --- | --- | --- |
+| `craft-ui` (`crates/ui`) | public components and tests | production `egui` with `default-features = false`; optional `serde`; dev `egui` with `default_fonts`, `egui_extras/svg`, `egui_kittest/wgpu`, `image/png` |
+| `craft-window` (`crates/window`) | optional `decorate(egui::ViewportBuilder)` | `egui` feature; Wayland probe only on Linux/BSD; pure logic without egui |
+| `craft-quit` (`crates/quit`) | optional close handling and app menu | `egui`; `menu` implies `egui`; menu/terminate code only on macOS |
+| `craft-platform` (`crates/platform`) | optional deferred close and native theme hook | `egui` with `dialogs` and/or `appearance`; `appearance` only on unix non-macOS non-wasm; `browser` only on wasm |
+| other crates | none, except references in documentation | no egui dependency |
+
+`Cargo.toml:34` is the workspace pin; `crates/ui/Cargo.toml:20-24` is the only egui test toolchain.
+`docs/ui-components-audit.md:5` and `crates/ui/README.md:237` still say 0.36; both need updating after
+validation, but historical source citations in the audit must not be silently rewritten.
+
+### 1.3 Current tests and CI
+
+Source-declared `#[test]` occurrences at the baseline: 728 workspace-wide, 91 in `crates/ui`
+(85 in `src`, 6 integration). These counts are not proof of execution. The UI CI matrix is Ubuntu,
+Windows and macOS for `cargo fmt`, clippy, `cargo test -p craft-ui` (default and all features), plus a
+wasm32 `cargo check` (`.github/workflows/ui.yml:20-58`). The visual suite declares 372 control pairs,
+36 deliberate negative pairs, 18 toolbar pairs, 12 palette pairs and 12 SVG pairs; every positive
+pair requires exact RGBA and mesh equality (`crates/ui/tests/visual_regression.rs:185-394`).
+
+The repository AGENTS.md additionally requires before merge:
+`cargo fmt --check`, `cargo clippy --workspace --all-targets -- -D warnings`, and
+`cargo test --workspace`. Those are the minimum gates; the package-specific CI matrix and the fork
+contract below add coverage rather than replacing them.
+
+## 2. What actually changes in egui 0.37
+
+The following are released 0.37 behavior, not fork behavior. They are the only reasons `craft-ui`
+needs production edits for the upstream release.
+
+| Change | Effect in craft-libs | Source anchor |
+| --- | --- | --- |
+| `WidgetType` is replaced by `accesskit::Role` (`egui::Role`); compatibility alias is deprecated | Every `WidgetInfo` constructor must use `Role`; `SelectableLabel` becomes `Button`, `Other` becomes `Unknown`, `Checkbox` becomes `CheckBox` | `egui/src/lib.rs` 0.37.0 lines ~640-655; PR #8555 |
+| `Id::new` and `AsId` are deprecated; `Id::unique`, `IdSalt`, `IdSaltSet/Map` are the explicit APIs | Test IDs and any caller-provided IDs should use `Id::unique`; use `IdSalt` for scope-local salts | `egui/src/id.rs`; PRs #8534, #8586, #8590 |
+| `Ui::id` is renamed `Ui::scope_id`; `UiBuilder::id` is renamed `scope_id` | Child body/header UIs must pass a globally unique scope id; tests and README examples must use `scope_id` | `egui/src/ui.rs` 0.37.0 lines ~359-383; `ui_builder.rs` lines ~63-82; PR #8542 |
+| `Panel` constructors accept `impl AsIdSalt`; `CentralPanel` stays last; root `Ui` is the normal app surface | Application panel code must keep panel order and use a stable salt; craft-ui's `DockArea` is a child of that root/panel UI, not a `Context` replacement | `egui/src/containers/panel.rs` 0.37.0; PR #8592; `Context::run_ui` / `root_ui` / `run_pass` |
+| `default_fonts` is no longer a default feature; eframe still enables it by default, but integrations must choose | `craft-ui` production already disables defaults; test dev-dependency must keep `default_fonts`; applications with custom fonts must verify coverage | `egui/Cargo.toml` 0.37.0; PR #8583 |
+| egui 0.37 adds missing-glyph policy and system font providers; kittest panics on missing glyph by default | Tests that deliberately draw arbitrary script text must opt into `MissingGlyphPolicy::Tofu`; production should keep tofu rather than panic; custom app fonts need explicit coverage checks | `epaint/src/text/fonts.rs`; `egui_kittest/src/builder.rs` (`missing_glyph_policy`); PRs #8601, #8512 |
+| `ViewportCommand::Screenshot` takes a one-shot `ScreenshotCallback`; `Context::request_screenshot` is the convenience API | Any app screenshot path, not craft-ui itself, must move from `UserData`/`Event::Screenshot` correlation to callbacks | `egui/src/data/screenshot_callback.rs`; `viewport.rs:1202-1205`; PR #8489 |
+| `Response::accessible_name`, `Ui::label_inputs_by` / `name_inputs`, `Area::role`, better popup/menu trees | Accessibility labels/roles must be explicit for input widgets and icon-only controls; kittest now fails unnamed inputs | PRs #8604, #8608, #8612, #8581, #8589 |
+| Style defaults changed (roomier buttons, larger corner radius); `Style` theme plugin is experimental | `DockStyle::from_ui` inherits changed defaults; visual fixtures must keep explicit geometry/colors instead of accepting a new golden | PRs #8617, #8445, #8153 |
+| `Context::run_ui`, `run_pass`, `root_ui` and `Context::run_logic` define root-UI and hidden-window semantics | Tests must use the correct entry point; logic-only work must not require a painted `Ui`; `request_discard` may call a UI closure more than once | `egui/src/context.rs` 0.37.0; PR #8535; eframe `App::logic`/`App::ui` |
+| PRIMARY selection support was added upstream | App clipboard behavior changes; E4 changes the backend on Wayland; PRIMARY must be tested separately from the regular clipboard | PR #8428; `egui-winit/src/clipboard.rs` |
+| `egui_extras` and `egui_kittest` have their own 0.37 releases and features; `egui_plot` is not part of this repo | Do not assume every egui-family crate shares one version number; pin what is used and verify its manifest | crate manifests at tag `0.37.0` |
+
+The upstream 0.37.0 tag itself has no `PATCHES.md`; fork-only material is in the suite branch. The
+0.37.0 tag and the fork revision must never be confused: a registry-only build gets upstream
+behavior, while a suite build gets E1-E21 and the winit patches.
+
+## 3. Fork and winit provenance
+
+craft-libs #198 is a broader language-support issue/proposal, not a PR or merged
+dependency. It does not authorize a wholesale locale/font roadmap in this port.
+PR 199 is open/conflicting at the recorded head; its stale merge tree must not
+replace current main. Current upstream report status is dated research, not proof
+of fixed behavior or fresh task validation.
+
+
+### 3.1 The suite fork
+
+`aiongg/egui` `craft/0.37` is based on tag `0.37.0` and merges the `craft/*` topic branches in the
+order listed in its `PATCHES.md`. The final inspected revision is
+`a4f9a17f64a6bae61350fb85804c9df0d9865916`. The branch and its `origin/ai-0.37` alias are movable;
+all manifests and CI must use the full SHA. The older `origin/craft/0.37.0-trial`
+(`59163e291c56ebe0199e191c23bf58ed157c9862`) is not the target because it lacks later language
+work and is not the published suite reference.
+
+The fork's workspace manifest pins winit by **branch**:
+
+```toml
+[patch.crates-io]
+winit = { git = "https://github.com/aiongg/winit", branch = "craft/0.30.13-lang" }
+```
+
+That patch belongs to the egui workspace. Cargo does **not** propagate a dependency's patch section
+into a consumer root. A consumer that only depends on `aiongg/egui` will resolve registry winit, and
+E4/E19/E21 will fail to compile or silently use the wrong API. `craft-libs` and every app must add its
+own `winit` patch with the immutable commit.
+
+### 3.2 Winit patch ledger
+
+Base: winit `v0.30.13` (`e9809ef5`), then storytold/winit `craft/0.30.13` (`ffae5198`) with W1-W15,
+then `aiongg/winit` `craft/0.30.13-lang` (`8b35388b`) with W17-W27. W16 (Wayland pinch/rotation) is
+not in this cut.
+
+| Patch | Commit(s) | Behavior relevant to this plan | Removal / test condition |
+| --- | --- | --- | --- |
+| W1 | `b357a332` | Windows mixed-DPI `WM_DPICHANGED` rect | Remove when a winit release in use has #4341; verify DPI geometry |
+| W2 | `13ca693b` | Wayland text input dies only with its seat | Remove with upstream #4747; test seat removal |
+| W3 | `fd104a4c` | Windows IME caret from `GCS_CURSORPOS` only when reported | Test Korean caret; remove on release |
+| W4 | `3fffb7ce` | Hidden maximized windows stay hidden | Test restore; remove on release |
+| W5 | `283370ce` | X11 focus replacement IME context | Superseded by W20; remove together |
+| W6 | `a82b90fb` | macOS NSTextInputClient commit flow | Test composition; remove on release |
+| W7 | `9b90d5bd` | macOS discard marked text when IME disabled | Test disable; remove on release |
+| W8 | `6a87addd` | macOS emoji picker text as commit | Test picker; remove on release |
+| W9 | `9500f25d` | macOS no duplicate Korean space | Test Korean space; remove on upstream fix |
+| W10 | `4a7dd791` | macOS first Apple Korean key retry | Test first key; remove on release |
+| W11 | `4df8554b` | X11 scale factor from server DPI before physical DPI | Test mixed-DPI X11; remove when upstream equivalent lands |
+| W12 | `7facf001` | macOS title-bar drag reaches app | Test drag; remove when upstream equivalent lands |
+| W13 | `5506b1a9` | Wayland pixel wheel/tilt/continuous reports `Moved` | Test Ctrl zoom not latched; remove on upstream fix |
+| W14 | `c488d2e9` | macOS opt-in cancelable termination -> close request | Test close/quit; keep until upstream release |
+| W15 | `cf73a29c`, `b05ce129` | Wayland file drops and clipboard on one per-seat data device | Required by E4; remove only with a winit release carrying #4729/#4571 and equivalent regular-clipboard/data-device tests |
+| W15P | New; no commit yet | Per-seat SCTK PRIMARY on the existing Wayland connection/event queue; `platform/wayland.rs`, `wayland/clipboard.rs`, `wayland/state.rs` and seat handlers | Require bounded asynchronous read/write transfers, total deadlines, byte/request/worker caps, cancellation and focused-owner completion; pointer/keyboard triggering serials, seats/offers, empty/absent/self-paste tests on wlroots/KWin/Mutter. Remove only with an equivalent released native path |
+| W17 | `2be27382` | Regression guards for W2/W3/W5-W10/W12/W13 | Keep as tests while their patches remain |
+| W18 | `894bf2d7` | Windows hidden system caret at IME area | Test Sogou/Japanese IME; remove on upstream fix |
+| W19 | `fa2e1b3d` | Windows `VK_PROCESSKEY` not sent as a key press | Test IME key ownership; remove on upstream fix |
+| W20 | `019c95f1` | X11 one input context per window; disable resets | Test Vietnamese Telex; replaces W5, remove together |
+| W21 | `23bb19a7` | X11 IME spot after 100 ms quiet | Test forwarded keys not refiltered; remove on upstream fix |
+| W22 | `0816871e` | macOS caret, replacement ranges, un-composed commits | Test press-and-hold/dictation; remove on release |
+| W23 | `c8cd8aa1` | macOS layout's Command table for shortcut keys | Test Dvorak-Command/V; remove on upstream fix |
+| W24 | `4b5bc5a0` | `Window::reset_ime()` for all four desktop backends | Required by IME reset tests; remove on release with equivalent |
+| W25 | `eb4007da` | X11/Wayland `KeyEventExtLatinLayout` | Required by E19; remove on release with equivalent |
+| W26 | `2b9cd1cf` | macOS IME delete-surrounding by UTF-8 bytes | Required by E21; remove after the egui -> winit 0.31 move |
+| W27 | `f40c76a2` | Wayland text-input-v3 surrounding text and delete-surrounding | Required by E21; remove after the egui -> winit 0.31 move |
+
+Provenance concerns:
+
+- Integrate and review W17-W27 plus W15P and the W27 lifecycle revision in `storytold/winit` before pinning production consumers. Retain
+  aiongg provenance; use the resulting full storytold commit, never a moving branch.
+- W15's Wayland clipboard API and E4 are a pair. Do not take one without the other.
+- W26/W27 use a fork-only delete-surrounding API shape. When winit gains core
+  `Ime::DeleteSurrounding`, E21 and the winit patches must be removed together; otherwise the
+  compiler sees two incompatible IME APIs.
+- W11 changes `pixels_per_point`/DPR input. It affects tab fit, visual fixtures, screenshot pixel
+  sizes and any performance comparison. Record the exact winit commit in those runs.
+
+## 4. Audit of craft-libs PR 199
+
+PR 199 is the useful starting point, not a branch to merge blindly.
+
+### 4.1 What it gets right
+
+- `Cargo.toml:34` changes the workspace egui pin to `0.37` and `crates/ui/Cargo.toml:23-24` changes
+  `egui_extras` and `egui_kittest` to `0.37`.
+- `crates/ui/src/buttons/mod.rs`, `crates/ui/src/docking/surface.rs`,
+  `crates/ui/src/layout/resize.rs`, and `crates/ui/src/tabs/mod.rs` map the deprecated
+  `WidgetType` values to the 0.37 roles: `SelectableLabel` -> `Button`, `Checkbox` -> `CheckBox`,
+  `Other` -> `Unknown`. This matches egui's own mapping table.
+- Test IDs move from `Id::new` to `Id::unique`; child-body IDs move from `Ui::id`/`UiBuilder::id` to
+  `scope_id`. These are semantic renames, not a new ID scheme.
+- `crates/ui/src/docking/tests.rs` replaces the `⋮` fixture label with `…`. A read-only cmap check of the
+  bundled 0.36.2 and 0.37.0 Hack, Ubuntu, NotoEmoji and emoji-icon fonts finds no U+22EE in either
+  release; the 0.36 test drew tofu and the 0.37 kittest harness instead panics on a missing glyph.
+- The branch's own lock resolves `egui`/`eframe`/`egui-*` 0.37.0 from crates.io and raises accesskit
+  to 0.25.1 and kittest to 0.5.0. The lock churn is large but coherent for a registry-only build.
+
+### 4.2 Findings and required corrections before reuse
+
+1. **Both the PR merge tree and audit merge are unsafe bases.** `b68de8c`
+   has a coherent registry lock but a stale tree relative to `4919088`: it lacks
+   the entire `crates/platform` crate, drops PDF/media bounds and secure font-fetch
+   changes, reverts settings merge behavior, docking permission guards and the
+   linear printer-name collision algorithm. `ec8840a` additionally has a stale
+   0.36 lock. Never merge/cherry-pick either tree as the migration result.
+2. **Reuse only the intended port hunks.** Apply the API changes from `8614e4a`
+   and README change from `1764bca` onto recorded current main. Preserve provenance,
+   resolve against present source, and regenerate the lock with the final reviewed
+   storytold fork/winit set. Include those pins atomically with source adaptation;
+   no stock-only intermediate consumer release is planned.
+3. **README code still uses `ui.id()`.** `crates/ui/README.md:115` is documentation, not compiled, but
+   it is a public example and will fail under `-D warnings` if copied. Change it to
+   `ui.scope_id()` in the same documentation pass. The version statement at line 237 must also be
+   updated.
+4. **The ellipsis change is not a production fix.** The production source still paints `…` and `−`;
+   both are present in the bundled Hack/Ubuntu fonts. The old `⋮` was only a test fixture and was never
+   covered by the bundled fonts; 0.36 silently painted tofu. Add an explicit glyph-coverage test so
+   the next font/default change is caught deliberately, instead of relying on one changed string.
+5. **AccessKit role mapping needs contract tests, not just compilation.** The PR changes enum names;
+   it does not prove that `Role::Tab` (manually set after `WidgetInfo::selected(Role::Button)`),
+   `Role::CheckBox` for stack collapse, `Role::Splitter`, labels, enabled state and selection still
+   reach the tree. The 0.37 tree changes from #8581/#8589 make this a real regression surface.
+6. **The PR does not test a hidden/minimized `App::logic`.** `craft-ui` has one UI-driven poll path
+   (`printing::State::show` calls `poll`) and no logic-only test. Eframe 0.37 calls `App::logic` but no
+   `App::ui` while hidden. The API is already public, but the contract is untested.
+7. **The PR does not add a publication-compatible check.** Root `[patch.crates-io]` entries will not
+   travel to crates.io consumers. The packaged crate must be tested against registry egui 0.37, not
+   only against the suite fork.
+
+Decision: reuse only reviewed port hunks from `8614e4a` and `1764bca`. CL-1 uses
+an explicit changed-file allow-list: `Cargo.toml`, `Cargo.lock`, `crates/ui/Cargo.toml`,
+`crates/ui/README.md`, `crates/ui/src/buttons/mod.rs`, `crates/ui/src/docking/surface.rs`,
+`crates/ui/src/docking/tests.rs`, `crates/ui/src/layout/resize.rs`,
+`crates/ui/src/layout/tests.rs`, `crates/ui/src/printing/tests.rs`,
+`crates/ui/src/tabs/mod.rs`, `crates/ui/src/tabs/tests.rs`,
+`crates/ui/tests/docking_workflows.rs` and `crates/ui/tests/visual/fixtures.rs`.
+Compare `git diff --name-only` against this list and review the actual allowed-file
+hunks: being on the list never permits unrelated reversions. Extra files required
+by a proven compatibility fix need a named reason and review before extending it.
+In particular, `.github/workflows/**`, `NOTICE`, root `README.md`,
+`crates/ui/src/docking/model.rs`, `crates/platform/**`, vendors and non-UI libraries
+stay unchanged. Preserve linear `shown_names`, floating-group permission guards,
+secure font fetches and all intervening hardening. Run
+`moving_a_floating_group_needs_every_member_movable`,
+`protected_group_member_blocks_floating_group_resize`,
+`collisions_resolve_like_the_pass_by_pass_rule` and `a_long_collision_cascade_stays_fast`.
+Root workspace/lock membership must still contain craft-platform.
+
+## 5. Dependency and publication topology
+
+### 5.1 Intended suite graph
+
+For suite validation, `craft-libs` should resolve one and only one copy of each egui-family crate and
+one winit:
+
+```text
+craft-ui / craft-quit / craft-platform / craft-window
+        -> egui 0.37.0 (reviewed published storytold SHA, derived from a4f9a17f input)
+        -> egui-winit 0.37.0, eframe 0.37.0, egui-wgpu 0.37.0,
+           egui_extras 0.37.0, egui_kittest 0.37.0 (test/consumer)
+        -> epaint, epaint_default_fonts, ecolor, emath (same git revision)
+        -> winit 0.30.13 (reviewed published storytold SHA including W15P)
+```
+
+The root `[patch.crates-io]` must name every used package at the same full SHA. At minimum:
+`egui`, `eframe`, `egui-winit`, `egui-wgpu`, `egui_extras`, `egui_kittest`, `epaint`,
+`epaint_default_fonts`, `ecolor`, `emath`, and `winit`. Include `egui_glow`
+when selected by tests/optional features; metadata determines the complete set. If `egui_system_font_provider` is enabled,
+patch it too. Do not patch `egui_plot` or `egui_dock` unless a consumer actually uses them; do not
+assume their 0.37 version numbers.
+
+Required checks:
+
+```sh
+cargo tree -d
+cargo tree -i egui@0.37.0
+cargo tree -i winit@0.30.13
+```
+
+Acceptance is exactly one egui-family source and exactly one winit source, with no registry
+`egui`/`epaint`/`egui-winit` copy beside the git copy. A duplicate is a failure, not a warning.
+
+### 5.2 Publication reachability
+
+`craft-ui`'s production manifest must remain compatible with **stock** egui 0.37.0. The fork-only
+behaviors are in dependencies, not in craft-libs source. This is deliberate:
+
+- it keeps `cargo package` usable;
+- it lets a consumer choose stock egui 0.37 or the suite fork;
+- it prevents a fork-only API (for example `Style::right_to_left` or
+  `RawInput::latin_layout_chars`) from leaking into a published shared crate.
+
+Add an isolated `ci/registry-egui` workspace (its own `[workspace]`, not a member of the root
+workspace) that depends on `crates/ui` by path without any patch. Run its clippy/tests against
+registry egui 0.37.0. Then run `cargo package -p craft-ui` and inspect the generated manifest and
+`.crate` contents. A machine-local path patch, an aiongg branch name, or a hidden winit dependency in
+the packaged manifest blocks release.
+
+Do not put path overrides into the published manifest. A consumer's `[patch.crates-io]` is the
+supported place for the suite fork and winit; document that in the README compatibility section.
+The suite's `Cargo.lock` is a lock, not a publication promise.
+
+### 5.3 Versioning
+
+`craft-libs` currently versions every crate `0.1.0` from the workspace. This migration ships as a
+new immutable git revision with explicit compatibility notes: egui-facing public types change
+identity, so every consumer must move coherently. Do not bump every unrelated workspace crate.
+Publishing a crates.io release is a separate release operation requiring a semver/version plan;
+it is not authorized or required by the git-based suite migration.
+
+### 5.4 Vendors and nested workspaces
+
+The only vendored packages are PDF readers/writer, not egui:
+
+- `vendor/krilla` (0.8.2), `vendor/hayro` (0.7.1), `vendor/hayro-interpret` (0.7.0),
+  `vendor/hayro-syntax` (0.7.2), `vendor/hayro-jbig2` (0.3.0), `vendor/hayro-cmap` (0.1.0)
+  and `vendor/hayro-postscript` (0.1.0).
+- Reader provenance and patch ledger: `vendor/README.craft-reader.md`. The first reader transfer
+  was from PdfCraft `7437bde378f43856eada40af25b983812e615e8a`; the ledger records subsequent
+  transfers and fixes. Writer provenance and patches are recorded separately in
+  `vendor/krilla/README.craft.md`. Each source manifest records the relevant source hashes.
+- Equivalence decision: keep the 0.7 backend and its documented compatibility patches. They are not
+  replaced by the egui migration. When reconciling current main, preserve its reader/writer fixes
+  and provenance byte-for-byte; do not independently re-vendor or remove them.
+- Removal/test condition: only a separate PDF backend migration may change them; their existing
+  `cargo test -p craft-pdf --all-features` and `scripts/test-pdf-backends.sh` evidence remain the
+  gate. Run these checks again after a main reconciliation changes the vendors; default-feature
+  workspace tests alone do not qualify the PDF backend. The root `[patch.crates-io]` must keep
+  these entries while `craft-pdf` uses them.
+
+`crates/pdf/read-only-contract` is a nested workspace with its own `Cargo.lock` and a single
+`hayro-syntax` patch. It does not depend on egui and is unaffected by the workspace egui lock; do not
+edit its lock as part of this migration. There are no vendored egui, eframe, egui-winit or winit
+sources in this repository.
+
+## 6. Root-`Ui` and lifecycle design
+
+### 6.1 Boundaries
+
+craft-libs must not grow a blanket `Context` compatibility layer. The correct boundaries are:
+
+- **Application lifecycle:** eframe owns `App::logic` and `App::ui`. `logic` runs before each
+  UI pass, possibly repeatedly in one frame, and in hidden mode when a repaint
+  is requested; `ui` may not run at all while hidden. Code that must
+  drain queues, service print jobs, autosave, or decide a close must live in `logic`.
+- **Root UI:** `App::ui` receives the root `Ui`. `craft_ui::docking::DockArea` and every other component
+  take `&mut Ui`. They must never call `Context::root_ui` from inside their own rendering; that would
+  panic when the root UI is already borrowed (`Context::root_ui` docs at 0.37.0).
+- **Painted output:** `DockArea::show` returns `DockOutput` actions and does not mutate the layout.
+  The app applies them after rendering. This remains the command/undo/persistence boundary.
+- **Hidden/minimized:** no component may rely on a paint to make progress. `printing::State::poll`
+  already takes `&Context` and can run in `logic`; `show` is a fallback. Background receivers,
+  autosave timers and playback must be app-owned and continue in `logic`. Pending
+  work must arrange a wakeup with `request_repaint`/`request_repaint_after`; hidden
+  polling is not a continuous scheduler. Test repaint-driven delivery explicitly.
+- **Multiple passes:** `Context::run_ui` can call its closure more than once after `request_discard`.
+  Both hosts call logic/UI inside that closure. Queues/actions must be consumed
+  once and deadlines use monotonic time. Count observable effects across all passes;
+  do not hide duplicates by counting only the final pass or altering the test host.
+  After a completed run_ui the pass index is zero, but events/time remain stale in
+  run_logic. Fresh input belongs to the known UI phase, including forced hidden paint.
+
+### 6.2 Preserve lazy printing and hidden result delivery
+
+Current behavior:
+
+- `printing::State::show` calls `refresh` on first display and `poll` every displayed frame
+  (`crates/ui/src/printing.rs:205-209`).
+- `poll` drains discovery/submission receivers and calls `request_repaint_after(100 ms)` while work is
+  pending (`printing.rs:162-201`).
+- WordCraft and GridCraft already call `poll`/`poll_printing` from `logic`, and GridCraft also calls it
+  from `ui`; repeated polling is currently harmless because `try_recv` consumes once. A window
+  that has never opened print should not start printer discovery merely because `logic` runs.
+
+Keep `refresh` as the explicit discovery trigger and `poll` as the idempotent receiver drain.
+Retain `show`'s lazy first-display behavior. Apps may trigger discovery from the print-open action
+before the page is drawn, then poll pending work in `logic` while hidden. Do not add an eager
+`tick` API or new startup process/IPC work as part of this migration. Change production code only
+if a regression demonstrates a missing transition. `Settings`, `Feedback`, `begin`, `ready`,
+selection and job ownership stay unchanged.
+
+Contract tests:
+
+1. `print_poll_is_lazy_without_open`: run repeated `poll` calls through `Context::run_logic` before
+   any print action; assert no discovery worker starts and no periodic wakeup is requested.
+2. `print_result_arrives_without_ui`: trigger `refresh` once, send a fake printer list and run
+   `poll` through `run_logic`; assert printers/feedback update without a `Ui`. Subsequent `show`
+   and discarded UI passes must not start another worker or consume a result twice.
+3. `completed_work_requests_no_more_repaints`: after a submission result is delivered, run 60
+   `run_logic` passes and assert no `request_repaint_after`/immediate repaint is requested by
+   `State`.
+4. `queue_default_and_selection_survive_logic_only_poll`: assert a still-present queue remains
+   selected and a removed queue cannot be submitted.
+
+### 6.3 Autosave, undo and side effects
+
+No autosave, playback or undo engine lives in craft-libs. The migration contract for consumers is
+therefore explicit:
+
+- queue drains, autosave, audio/playback polling and save-file completion callbacks go in
+  `App::logic`, not `App::ui`;
+- painting only presents state; it must not be the sole trigger for a save/undo transaction;
+- `DockArea` action output is applied once, after rendering, through the app command path;
+- any `Context::request_discard` path must be idempotent; tests use a call counter to prove exactly
+  one committed action or one undo step.
+
+These are app acceptance criteria, not claims that this repository's tests can prove application
+behavior.
+
+## 7. Component-by-component migration
+
+### 7.0 Shared-helper policy
+
+The 0.37 API renames are direct calls, not a reason to build a compatibility layer. Apply this rule:
+
+- **No wrappers** for `Id::unique`, `Role`, `Ui::scope_id`, `ScreenshotCallback`,
+  `Context::set_language`, `Response::accessible_name` or `Context::run_logic`. Applications call the
+  egui API; craft-ui exposes only component-specific semantics.
+- **Justified mechanism:** a bounded-lifetime capture completion slot, reviewed with two concrete
+  existing craft-ui consumers; section 7.8 keeps request IDs and application policy outside it.
+- **Existing print API:** retain lazy `refresh` and idempotent `poll`. No eager discovery helper.
+- **Docking direction:** retain the persisted first/second split and tab model. Use an explicit
+  opt-in DockArea direction policy from section 7.7, with matching hit coordinates;
+  no hidden global mirroring mode.
+- **Not shared:** fonts, themes, localization catalogs, autosave, undo history and native pickers.
+  They remain application-owned, as the existing component audit requires.
+
+### 7.1 IDs and scopes
+
+Anchors: `crates/ui/src/tabs/mod.rs:117` (`Tab::new`), `:141` (`ui.interact`),
+`crates/ui/src/docking/surface.rs:539` (body child), `:600` (header child), `:761` (floating `Area`),
+`crates/ui/src/layout/resize.rs:82` (handle), `crates/ui/src/printing.rs:210` (`push_id`).
+
+Rules:
+
+- Caller-supplied widget IDs stay caller-owned and global. Use `Id::unique(("app", panel))` or an
+  app-owned `IdSalt`; never derive an ID from translated text.
+- `Tab::new` and `ResizeHandle::new` keep taking `Id`. The public signatures do not need a new wrapper.
+- `Ui::new_child(UiBuilder::new().scope_id(...))` must use a scope id that is globally unique. The
+  body scope is `self.id.with(("body", panel))`; the header scope is
+  `self.id.with(("header", selected))`; they are distinct. Do not replace them with `id_salt` unless
+  the child is intended to move with its parent.
+- `printing::State::show` continues to use `ui.push_id(id, ...)`; the caller's `id` remains the
+  stable identity of the print block.
+- `Id::unique` is the same hash as the old `Id::new`, so test behavior is intended to be identical.
+  Add a test that the same source yields the same `Id` across frames and that two calls with
+  different panel payloads differ.
+
+### 7.2 Accessibility roles and names
+
+Anchors: `buttons/mod.rs:84`, `tabs/mod.rs:143-148`, `docking/surface.rs:419-421,569,628,769`,
+`layout/resize.rs:157-173`, `printing.rs:213-254`.
+
+Required mappings and assertions:
+
+| Control | Role / metadata | Assertion |
+| --- | --- | --- |
+| Icon button | `Role::Button`, `selected`, label, enabled | AccessKit role Button; `Toggled::True/False`; exact label; disabled flag |
+| Tab | widget info starts Button, then node role `Tab`; `clear_toggled`; selected | Role Tab, selected, no toggled flag, label exact; duplicate labels have distinct IDs |
+| Stack collapse | `Role::CheckBox`, selected = open | Role CheckBox, toggled/selected matches open, label exact |
+| Resize handle | `Role::Splitter`, orientation, numeric value/range/step, Increment/Decrement/SetValue | orientation perpendicular to movement; actions; SetValue delta; NaN ignored |
+| Floating group grip | `Role::Button`, move label | Role Button, label; not focusable as a splitter |
+| Overflow | `Role::Button`, panels label | Role Button, label, menu opens and entries keep logical labels |
+| Tab menu actions | `Role::Button`, logical labels | custom visual text does not replace AccessKit label |
+| Print printer ComboBox | labelled by visible printer label | `labelled_by` present; `get_by_label("Printer")` finds it |
+| Print copies DragValue | labelled by visible copies label | label present; `check_accessibility` passes |
+| Print grayscale checkbox | own label | Role CheckBox, label present |
+
+Do not disable `Harness::check_accessibility` globally. If a fixture deliberately uses an unnamed
+input, scope the exception to that fixture and document why. `egui_kittest` 0.37 fails unnamed input
+widgets by default (PR #8589); that is a feature, not a migration nuisance.
+
+### 7.3 Panels, docking, order, clip and floating layers
+
+`DockArea` does not use `egui::Panel`; it renders a snapshot into the caller's `Ui` and uses
+`Area::new(id).order(Order::Middle)` for floating groups
+(`crates/ui/src/docking/surface.rs:761`). The app's panel structure remains outside.
+
+Required integration tests:
+
+1. **Panel order and clip:** in a root `Ui`, add `Panel::left("left").exact_size(200).show(...)`, then
+   `CentralPanel::default().show(ui, |ui| DockArea::show(...))`; assert the dock gets the remaining
+   width, the left panel is not overdrawn, and body `Ui` clip is a subset of the parent clip.
+2. **Nested panels:** a top panel containing a horizontal `Panel` and a central panel; assert order
+   and no double allocation. This checks 0.37's `Panel`/`CentralPanel` last rule.
+3. **Floating layer order:** two floating groups, `raise_panel` on the second, assert the top layer
+   and tab focus; assert the serialized `Layout` is unchanged by `raise_panel`.
+4. **IDs after move:** move a panel into a floating group and back; assert the body `scope_id` is the
+   same before/after and that a focused text field retains its edit buffer.
+5. **No document allocation in floating-only mode:** existing test
+   `floating_only_surface_does_not_allocate_the_callers_document_region` remains mandatory.
+6. **Clip and popup:** open the overflow `Popup` and tab context menu near the viewport edge; assert
+   popup rect stays inside the screen, menu labels are logical, and the parent clip does not clip the
+   popup away. 0.37's popup tree changes (#8581) make this a real check.
+
+Do not turn `DockArea` into a native multi-window manager. Native viewport creation, reparenting and
+cross-monitor coordinates remain host-owned. `Action::Float` means an in-viewport floating group.
+
+### 7.4 Tabs, split geometry, resize handles, toolbar and theme
+
+- `tabs::fit` is direction-agnostic and pure. Keep its exact width/overflow assertions. Add a
+  64-tab and a 4096-tab bounded-work test; the latter must still be linear and must not allocate
+  unbounded storage.
+- `layout::split_rect` and `SplitLayout::resized` stay pure and f32/f64 bounded. Add property tests
+  with extreme finite values and non-finite rejection; do not accept a `None` as a silent panel
+  disappearance in app adapters.
+- `ResizeHandle` focus lock, arrow keys, AccessKit actions and pointer drag deltas stay. Add a test
+  that a focused handle consumes only its axis arrows and leaves Tab traversal intact.
+- `fit_toolbar` stays ordered-prefix only; add a test that every input index is either shown or in
+  overflow, and that the overflow control is reachable when the width is exactly the overflow width.
+- `WidgetPalette` keeps preserving borders/expansion. Add a test that a 0.37 default-style change
+  does not overwrite an explicit app border or expansion.
+- `DockStyle::from_ui` should document that 0.37's default radius/spacing values are inherited; apps
+  with exact designs must pass explicit values.
+
+### 7.5 Fonts, glyphs and custom catalogs
+
+Anchors: `docking/surface.rs:425` (`−`/`+`), `:629` (`…`), `printing.rs` labels,
+`crates/ui/tests/visual_regression.rs` (font-free fixtures and SVG raster checks).
+
+- `craft-ui` production still disables egui default features. This is correct: the app chooses fonts.
+- The `crates/ui` dev-dependency keeps `default_fonts` so component tests can shape labels; keep it.
+- 0.37's `default_fonts` no longer includes monochrome emoji fonts, and the 0.37 kittest harness
+  panics when nothing can draw a glyph. That is why the `⋮` fixture had to change even though 0.36
+  had silently drawn tofu. `…` and `−` are present in Hack/Ubuntu; verify with:
+  `ctx.fonts_mut(|f| f.has_glyphs(&FontId::proportional(12.0), "…−+"))` after one `run_ui` pass.
+- Add a test using `MissingGlyphPolicy::Panic` (or `Harness` default) with `⋮` as a deliberate
+  negative fixture: it must fail. Then use `…` in the actual component and assert `has_glyphs`.
+- Do not call `allow_missing_glyphs()` on a whole suite just to make a test green. If arbitrary
+  script fixtures are intentional, scope the policy to that fixture.
+- SVG catalogs remain trusted compiled-in bytes and are not a font fallback. `SvgIconSet` still
+  requires a unique URI prefix per catalog/style; egui caches by URI. Test SVG at 12/24/48 logical
+  pixels and exact RGBA.
+
+### 7.6 Quit, platform and window helpers
+
+- `craft-quit::on_close_request` already expects `egui::Context`, `ViewportCommand::CancelClose` and
+  the root viewport. It compiles against 0.37. Add a test with `App::logic`-style ordering: app
+  cancels close first, then `on_close_request` sees the cancellation and does not quit.
+- `craft-platform::DeferredClose::update` scans `ViewportCommand::Close`/`CancelClose`; keep its test
+  that a pending picker holds close and releases exactly once. The 0.37 `ViewportCommand::Screenshot`
+  callback does not change this, but apps must not treat a pending screenshot as a pending close.
+- `craft-platform::sync_native_window_theme` is an `egui::Plugin::output_hook`. In 0.37 the plugin
+  API still calls `output_hook` after the pass; keep the test that a manual `SetTheme` is not
+  overwritten and that child viewport outputs receive the hint.
+- `craft-window::decorate` only touches `ViewportBuilder`; no 0.37 API change. Keep the Linux/BSD
+  Wayland probe and the `WAYLAND_SOCKET` protection. Do not call it more than once at startup.
+- `craft-quit` menu code uses `muda`; 0.37 does not change muda. Do not add a second native menu
+  abstraction.
+
+### 7.7 Input, IME, RTL, clipboard and PRIMARY
+
+craft-libs itself does not implement text input, IME, clipboards or RTL shaping; it consumes egui
+widgets and labels. The fork changes that matter:
+
+- **E5/E12/E13/E15/E16/E20:** bidi shaping, visual order, grapheme editing and language-aware layout
+  affect every `Label`/`TextEdit` inside a `DockArea` body. Test Arabic/Hebrew mixed labels through
+  the fork fixture, not stock 0.37. Keep ASCII geometry tests unchanged as the no-regression baseline.
+- **E9 and docking direction:** built-in egui chrome follows the fork's direction,
+  but custom docking uses explicit geometry. Add an opt-in `DockArea::direction`
+  builder with a stock-compatible `DockDirection::{LeftToRight, RightToLeft}`;
+  default remains LTR. Applications pass their UI direction; craft-ui does not
+  read fork-only style fields or infer language from labels.
+  - Preserve serialized split first/second, axes, ratios, floating rectangles and
+    logical tab order. Changing UI direction must not rearrange a saved workspace.
+  - Mirror horizontal tab-strip visual order and leading/trailing controls. Painting,
+    clipping, hit tests, accessibility order and drag insertion use the same computed
+    rectangles. Convert visual insertion index back to logical model index once.
+  - Split-pane geometry and physical splitter drag directions stay unchanged.
+    Floating resize grips use bottom-trailing placement (right in LTR, left in RTL);
+    RTL resize keeps the right/top edges fixed: for pointer delta `(dx, dy)`,
+    clamp `(width - dx, height + dy)` to the same limits, then emit
+    `Action::MoveFloating` with `[old_right - new_width, old_top, new_width, new_height]`.
+    LTR keeps left/top fixed and clamps `(width + dx, height + dy)`. Apply the existing
+    screen clamp afterwards. Horizontal splitter motion to the right increases the
+    physical left pane and decreases the right pane in both directions; vertical
+    motion downward increases the top pane. Assert these rectangles/ratios and
+    keyboard-generated deltas under both policies and at min/max/screen limits. For a focused
+    floating resize grip, ArrowLeft supplies negative physical dx and ArrowRight positive dx:
+    RTL ArrowLeft increases width and moves the left edge left while keeping right fixed;
+    RTL ArrowRight decreases width and moves left right. LTR uses the opposite width
+    effect with left fixed. ArrowDown grows height; ArrowUp shrinks it in both directions.
+  - Physical left/right keyboard traversal follows visual tab order; panel IDs and
+    focus stay stable across direction changes. Vertical behavior is unchanged.
+  - CL-3 tests LTR/RTL click/drag/reorder/resize, keyboard focus, protected floating
+    groups and unchanged serialized workspace. Deliberately mirror paint without
+    hit coordinates to prove failure detection. This is a visual policy, not a
+    schema migration or wholesale locale redesign.
+- **E17/E18:** `Context::set_language(Some("ar".to_owned()))` sets the AccessKit root language; `UiBuilder::language`
+  marks content language; eframe's `Frame::set_ui_language` is the convenient host hook. Craft-ui
+  should not cache a language; pass localized text and let the app set language once per change.
+- **E19:** Latin layout characters affect app shortcuts, not craft-ui geometry. App tests must cover
+  Ctrl+Q on Russian/Arabic/Hebrew and Dvorak Command layouts; do not infer shortcut behavior from
+  `Key` alone.
+- **E21:** TextEdit deletes the exact UTF-8 bytes an IME replaces and groups the deletion with the
+  commit. App undo tests must assert one undo step for a press-and-hold/dictation replacement.
+- **E21b/P7b (new prerequisite):** the candidate does not send outgoing surrounding text to W27.
+  The reviewed fork must add the bounded transient IME payload, built-in TextEdit producer and
+  Wayland adapter before CL-1's fork contract can pass. Check deletion-only and delete/commit
+  batches, selection/focus changes, password clearing, two windows, UTF-8 boundaries, preedit
+  exclusion and the 4,000-byte window. Stock-compatible craft-ui production code uses ordinary
+  TextEdit and needs no fork-only payload API; the fork contract fixture exercises it explicitly.
+  The eight custom-editor consumers need their own adapters as specified in the suite rollout.
+  CL-1 requires the final reviewed E21b/W27 revisions with an explicit input-owner/context
+  generation present for both `Available` (including an empty document) and `Unavailable`, and clear/invalidate
+  operations. Clear both caches and protocol state through a committed disable/enable boundary
+  when the owner changes or text becomes unavailable; ordinary updates preserve composition.
+  Cancel old pending preedit/commit/delete state on leave/reset/disable. Within the current focus
+  epoch, text-input-v3 `done` with a mismatched serial still applies incoming edits once but defers
+  outgoing state until a matching serial; old-epoch events cannot edit the new owner. The latest
+  completed UI pass is authoritative, including `IMEOutput = None`; do not retain the earlier
+  payload through `ime.or(self.ime)`. Test password/unavailable/over-limit transitions, queued
+  deletion then refocus, reset, two windows and text-to-non-text discarded-pass output.
+  Final SHAs are execution prerequisites. `8b35388b` remains a comparison input, not an interim
+  production pin: CL-1 waits for the completed reviewed/published dependency series.
+- **E4 + upstream #8428:** the existing candidate's arboard PRIMARY fallback is
+  replaced by the selected new winit W15P path on the same connection/event queue,
+  using SCTK's per-seat PRIMARY objects. This must land before egui P2b and CL-1.
+  Test pointer- and keyboard-triggered ownership, including keyboard-only focus, with
+  fresh triggering serials scoped to their seat/origin (no arbitrary first-seat fallback),
+  owner/seat changes, empty/absent offers,
+  self-paste and canceled/slow transfers on wlroots/KWin/Mutter. Keep password and
+  unchanged-selection protections; no second regular data device. An isolated
+  PRIMARY-only fallback needs measured necessity and review; ordinary paste is
+  not PRIMARY acceptance. W15 and W15P must use bounded asynchronous transfer handles,
+  a total monotonic deadline, byte/count limits and bounded workers. The existing two-second
+  per-`WouldBlock` timeout is not a total bound. Egui consumes completion only for the still-live
+  paste request/owner/input generation; cancellation and late completion cannot paste elsewhere.
+  Verify responsiveness during slow trickles and oversized/concurrent offers.
+
+### 7.8 Screenshot callback correlation (downstream contract)
+
+craft-libs has no screenshot code; multiple suite applications do. The migration must replace
+`ViewportCommand::Screenshot(UserData)` plus `Event::Screenshot` matching with one-shot callbacks:
+
+```rust
+// Proposed ownership, not an existing API:
+// app request record -> one result slot -> optional image + owning-viewport wakeup
+// screenshot callback -> weak reference to that slot
+// app logic -> take the image once, validate request, encode/write/reply
+```
+
+Requirements:
+
+- `ScreenshotCallback::new` / `Context::request_screenshot` is one-shot. Clones share one callback;
+  complete it at most once.
+- The request record owns one completion slot and the callback holds a weak reference
+  to that exact slot. Correlation comes from ownership, not callback order or a second
+  global token map. Drop/cancel releases the slot and rejects late results.
+- If the window is hidden, send `ViewportCommand::RequestPaintWhileHidden` or the screenshot command
+  itself (a pending screenshot already requests a paint). A hidden `App::ui` is not run otherwise.
+- In a custom/headless renderer (for example LightCraft's headless path), retain the
+  `ScreenshotCallback` and call `complete(image)` with the next rendered image; do not reconstruct a
+  fake `Event`.
+- Test two outstanding requests with distinct tags, callback-once behavior, no callback without a
+  request, and a hidden-window request. Test E2 surface fitting: the returned image may be smaller
+  than the window when surface fitting reduced it. The integration render_scale is
+  private: derive x/y image scale from returned image dimensions and the recorded
+  logical viewport rectangle for that capture, including pixels-per-point metadata.
+  Verify expected aspect/rounding. A resize/DPI generation mismatch retries within
+  the deadline or returns an error; never combine old image pixels with current geometry.
+
+Add a narrow completion-slot helper for existing craft-ui consumers after reviewing two concrete
+adapters together (DesignCraft and GridCraft are the selected first consumers). Their tokens, paths, settle
+delays, deadlines and replies remain app-owned. The callback holds only a weak slot reference;
+avoid a strong Context/callback cycle, release locks before wakeup, and drop late results after
+cancellation. The app enforces aggregate request/image limits. A bounded nonblocking channel is
+the measured fallback if slot stress tests expose a problem. Apps without craft-ui need not add
+it solely for capture. See the suite rollout plan for the selected ownership contract.
+
+Admission accounts for in-flight captures as well as completed slots: reserve a checked byte
+budget before issuing a capture, using the allowed surface dimensions, and cap request count
+independently. Defaults: 4 outstanding requests, 128 MiB/image, 256 MiB aggregate reserved
+in-flight/completed image bytes; stricter app budgets are allowed. Record known issuance UI
+logical bounds and a geometry epoch. Reject/retry any resize/DPI/zoom/surface epoch change
+before save, even a change back; the callback contains pixels only, not frame metadata.
+Revalidate dimensions before issuance after resize/DPI changes. On completion,
+reject an oversized or stale image and release both its memory and reservation; account for the
+renderer/readback's transient allocation separately in peak RSS. A post-callback size check alone
+does not prove that peak capture memory was bounded. Stress concurrent 4K captures, resize races,
+timeouts and canceled records; retained image bytes must return to zero after drain/shutdown.
+
+## 8. Fork-specific patch plan: E1-E21
+
+The fork's `PATCHES.md` is the source for the table below. The upstream column reflects the inspected
+tag `0.37.0` and open PRs, not a claim about `main` after 2026-10-15. Removal is always conditional on
+a released egui version in use containing equivalent behavior and on the full suite tests passing
+without the patch.
+
+| Patch | Commit(s) | Behavior | Upstream status at 0.37.0 | craft-libs relevance and required test |
+| --- | --- | --- | --- | --- |
+| E1 | `8f3abf06` | eframe `NativeOptions::viewport_hooks`: every viewport's native window on create/destroy and every viewport's `RawInput` before egui, including immediate viewports | not proposed | No direct craft-ui use. Compile-only fork contract; native window identity is app/craft-tablet. Test hook installed/replaced and one call per viewport in egui repo. |
+| E2+E3 | `9dd799ab` | egui-wgpu fits a surface to `max_texture_dimension_2d` and returns `ConfigureSurface`/`CreateRenderer` errors instead of panicking | not proposed; addresses open #8361 | Required for large/multi-monitor windows. Test `surface_fit` edge cases and an oversized surface; report errors rather than abort. Screenshot pixel geometry must account for reduced surface. |
+| E4 | `66bacf23` | egui-winit uses winit's Wayland data device for regular clipboard, falling back to arboard; smithay not started | emilk/egui#8657 draft; winit#4729 open | Required on Hyprland/KWin; needs W15 plus new W15P for PRIMARY. Test regular/image/drop and PRIMARY separately, serial/seat/ownership/cancel cases, and no second regular data device. |
+| E5 | `0e27d87e`, `777977b7`, `f7e89e23`, `5b2b8e19` | Bidi shaping, visual row order, marks/end caret/selection, no-default-fonts tests | emilk/egui#8577 open, plus #8698 review fixes | Affects all app text and DockArea labels. Test Arabic/Hebrew mixed rows, selection across boundaries, marks, end caret, ASCII unchanged; run with default_fonts off and on. |
+| E6 | `0abfabcf` | `request_focus` on the already-focused widget does not interrupt IME composition | not proposed | App TextEdit behavior. Test focus to same widget preserves composition; focus to another widget commits/cancels as intended. |
+| E7 | `0670c58a` | Windows letter keys from virtual-key code on layouts without A-Z | not proposed | App shortcuts. Test Russian/Arabic/Hebrew layout key names and no duplicate text. |
+| E8 | `1b03c10f` | TextEdit does not clip glyphs that overshoot the row | not proposed | App text clipping. Test Thai/Vietnamese/Arabic marks in single-line and wrapped fields. |
+| E9 | `b2f5cafc`, `e1341a3d`, `5105330d`, `75a5b3d3` | `Style::right_to_left` mirrors menus, scroll bars, headers, title bars, combo boxes, checkboxes, popups, resize grips | not proposed | Required for RTL UI. Test built-in chrome in both directions; `DockArea` manual tabs/splits remain explicit. Do not let this alter persisted layout semantics. |
+| E10 | `dc90c13e`, `c8e573f7`, `34b2c0d4` | eframe web: named keys not typed as text; letter keys from `KeyboardEvent.code`; `lang` on hidden input and speech | not proposed | Web apps. Test browser key layout, IME, screen-reader language; wasm check is compile-only. |
+| E11 | `92e61afd` | epaint rasterizes each glyph on a single-threaded vello context, avoiding vello multithreading panic | emilk/egui#8641 open draft | Required when any app enables `vello_cpu/multithreading` (VectorCraft). Test rasterization with the feature on and no thread-per-glyph panic. |
+| E12 | `e955bb18`, `485c0b89`, `0185887c`, `7015ac23`, `4067b2c4`, `620e070e` | `LayoutJob::direction`, RTL paragraph alignment, visual-end ellipsis, UAX #9 L1, linear reorder, bidi controls keep levels | not proposed; follows #8577 | Test forced LTR/RTL, neutral paragraphs, wrapped RTL, elision, long mixed paragraph linearity. Affects tab label widths. |
+| E13 | `5e4da7f4` | Cursor movement/hit-test/Delete/Backspace by grapheme cluster | not proposed | App text editing. Test combining marks, emoji ZWJ/flags/keycaps, Devanagari, Thai, Hangul, CRLF; hit test every x in LTR/RTL. |
+| E14 | `cbd77549`, `b3722ac0` | Fallback fonts share baseline and grow the row; `FontTweak::fallback_align` default unchanged | not proposed | CJK/Indic fallback. Test row height, DockArea `tab_height` clipping, and default center behavior unchanged. |
+| E15 | `f1cae609` | Pluggable `LineBreaker`, grapheme-safe emergency breaks, `LayoutJob::language` | not proposed | App line breaking. Test `SimpleLineBreaker` old rules, custom breaker receives language, hard breaks and emergency cluster breaks. |
+| E16 | `b3ef9771`, `bed6dfe3` | Visual cursor movement with affinity, Home/End reading order, per-cluster password mask, neutral paragraph inherits direction | not proposed | App text editing. Test bidi arrow behavior, Home/End, selection, password masking; no craft-ui API change. |
+| E17 | `520435df` | `Context::set_language`, `UiBuilder::language`, `Response::accessible_language`; AccessKit root language; one text run per bidi level | not proposed | Craft-ui labels/accessibility. Test root language, per-widget language, mixed bidi runs, screen-reader names. |
+| E18 | `89de8f3c` | eframe `Frame::set_ui_language`; web speech/input language fallback | fork-only | App host hook. Test native and web language propagation; no craft-ui cache. |
+| E19 | `d64047bf`, `642b74f7`, `baeb4515` | One Latin-letter shortcut rule on Windows/macOS/Linux; `RawInput::keyboard_layout_is_latin`; per-key Latin layout chars | fork-only; needs W25 | App shortcuts. Test non-Latin layouts and Dvorak-Command; `Key` alone is insufficient. |
+| E20 | `23955535` | Widget text laid out in the language of its `Ui` | fork-only (with E15/E17) | Tab/menu/label shaping language. Test Arabic/Hebrew labels inside DockArea and menu; ASCII unchanged. |
+| E21 | `a70470b0` | `ImeEvent::DeleteSurroundingBytes`; TextEdit deletes exact bytes in the commit's undo step | not proposed; needs W26/W27 | App IME. Test exact-byte deletion, one undo step, combining accent/flag/ZWJ replacement, and no over-deletion. |
+| E21b/P7b | New, no commit yet | Bounded outgoing surrounding-text payload, TextEdit producer and egui-winit W27 adapter | Confirmed missing from candidate | Fork-only contract tests cover logical text, UTF-8/preedit mapping, 4,000-byte limits and focus/password clearing; custom app editors supply their own adapters. |
+
+Decision: keep E1-E21 and implement E21b before the target is frozen; remove none during this migration. The removal
+condition for every row is a released egui version in use with equivalent behavior, the fork test
+suite passing without the patch, and the app workflows passing. E5 is the dependency root for E12,
+E13, E16, E17 (language runs), E18 and E20; E19 and E21 are independent but require specific winit
+patches. A removal decision for one patch must consider its
+dependents, its tests and the winit side. The fork's own tests are numerous: epaint text layout tests
+include bidi order, mixed Hebrew/Latin, cursor hit-testing, selection boundaries, grapheme clusters,
+fallback baseline, line breaking and RTL wrap; egui integration tests include `ime_focus`,
+`text_edit_overshoot`, `layout_language` and `ime_delete_surrounding`. Those tests are the first
+acceptance layer, not the only one.
+
+## 9. Test plan and regression assertions
+
+### 9.1 Commands and evidence
+
+All commands run through `maintenance/task.py run/status/finish`, never directly, with a fresh task,
+exact source, durable evidence and a unique job ID. Use the allocated `CARGO_TARGET_DIR`; do not use a
+shared target.
+
+Minimum gates, in order:
+
+```sh
+cargo fmt --check
+cargo clippy --workspace --all-targets --locked -- -D warnings
+cargo test --workspace --locked
+cargo clippy -p craft-ui --all-targets --all-features --locked -- -D warnings
+cargo test -p craft-ui --all-features --locked
+cargo check -p craft-ui --all-features --locked --target wasm32-unknown-unknown
+```
+
+Then the fork/registry contract and package checks described in section 5. Record actual executed
+test counts, exit codes, `rustc -Vv`, `cargo -V`, lock hashes, feature list and the full command line
+for each run. Do not call a historical audit log a fresh run.
+
+### 9.2 Stable fixtures and exact assertions
+
+Use fixed `RawInput.screen_rect`, fixed `time`, `pixels_per_point` 1.0/1.5/2.0, both themes, and
+`animation_time = 0.0`. No test may update a golden automatically.
+
+Required assertions:
+
+- **Pixel/mesh:** 372 positive visual pairs exact RGBA and exact vertices/indices/texture IDs/clips;
+  36 deliberate color/spacing/stroke changes must differ in both. If a 0.37 default changes a fixture,
+  diagnose the component or deliberately change the independent reference; never accept a new golden
+  to hide a visual regression.
+- **Geometry:** exact `TabFit` widths/overflow for the existing fixtures; split first/divider/second
+  rectangles exact; 64-tab and 4096-tab work bounded; `fit_toolbar` every index reachable.
+- **IDs/focus:** tab/body IDs equal across frames and moves; duplicate labels distinct; focus survives
+  a panel move; `scope_id` children do not collide.
+- **Actions:** `DockArea` returns the expected single `Move`/`Float`/`Close`/`Resize` sequence; the
+  layout snapshot is unchanged until the caller applies it; 800 deterministic moves never lose or
+  duplicate a panel.
+- **Persistence:** `Layout` and `Action` serialize to a fixed JSON fixture and back without changing
+  panel identity, active index, fixed sizes, accordion state or floating rect. Unknown fields are a
+  deliberate schema decision, not an accident.
+- **Accessibility:** exact roles/names/selected/enabled as in section 7.2; `Harness::check_accessibility`
+  passes; unnamed input fixture (deliberate) fails when the name is removed.
+- **Lifecycle:** no print worker starts before print is opened; once requested, results are
+  delivered via `run_logic` without `run_ui`; completed work requests no further repaint and
+  repeated logic/UI calls do not start a second worker.
+- **Glyphs:** component-painted glyph set (`…`, `−`, `+`) passes `has_glyphs` with bundled test fonts;
+  missing `⋮` under panic policy demonstrates the test detects a font regression.
+- **RTL/fork:** in the fork contract workspace only, Arabic/Hebrew mixed labels keep logical order,
+  tab widths and hit rects remain finite, built-in menus mirror, and an ASCII fixture is byte-identical
+  to the stock 0.37 result (where the API is shared).
+- **Screenshot:** two tokens, callback once, hidden-window request, surface-fit scaling; app fixtures
+  live in app repositories, not craft-libs.
+- **Panic policy:** no new `unwrap`, `expect`, `panic`, `todo`, `unimplemented` or `unreachable` in
+  production code; crate `lib.rs` deny headers stay.
+
+### 9.3 Deliberate failure probes
+
+The existing 36 visual mutation comparisons are the primary pixel/mesh probes. Add these targeted
+negative checks:
+
+1. Render an icon button with the label omitted or role changed to `Label`; the accessibility test
+   must fail.
+2. Remove `labelled_by` from the print `DragValue`; `Harness::check_accessibility` or the label query
+   must fail.
+3. Render `⋮` under `MissingGlyphPolicy::Panic`; the fixture must fail.
+4. Feed the same body `scope_id` to two simultaneously rendered panels; a duplicate-ID test must fail.
+5. Change a tab-strip width by one point or reverse the overflow order; exact geometry must fail.
+6. Call the print discover closure twice; the one-worker counter test must fail.
+7. Deliberately misroute a capture slot to another request; correlation must fail. Completing
+   clones twice is a positive one-shot test and must still yield exactly one result.
+
+Document the expected failure for each probe and keep it out of release acceptance.
+
+## 10. Performance protocol and thresholds
+
+### 10.1 Baseline capture and the implemented CPU harness
+
+The harness is test-only work. Prepare separate baseline/control and candidate qualification
+worktrees with the same measured work, cases and instrumentation; record their exact commits,
+complete patches, harness/lock hashes and any reviewed API compatibility adapter. The original
+plan proposed `49190884278f16c9a9f5823d7698a8ffb5deb062` as a baseline; that ref alone does not
+qualify a comparison. Preserve the published source and existing control worktrees. Run correctness
+gates before measuring, then alternate paired baseline/candidate runs under the same conditions.
+
+Environment to record exactly:
+
+- host CPU: Intel Xeon E-2176G, 12 threads (6 cores), 3.70 GHz base, 125 GiB RAM (the observed host);
+- current host inspection finds i915 PCI `8086:3E96` and an accessible render node; no display
+  session is inherited. Qualify the actual selected adapter/driver/backend with a managed job.
+  Historical llvmpipe results are software-renderer evidence only, not current hardware discovery;
+- Windows row (if used): the Windows VM's Microsoft Basic Render Driver (CPU), not a physical GPU;
+- no real-GPU measurement has been performed for this task. Hardware availability alone does not
+  establish renderer, compositor or presentation acceptance.
+
+The implemented target is `crates/ui/examples/ui_hotpaths.rs`, a headless JSON-emitting example,
+not a Criterion bench target. It measures:
+
+- pure `tabs_fit`, `split_rect`/`resized` and `fit_toolbar` cases across the encoded sizes/scales;
+- dock layouts with four split/floating panels or a 32-panel tree at 800×600 and 1440×900,
+  at 1× and 2×;
+- left-panel plus central-dock integration, with actual rendered bodies, geometry and interaction
+  checks. Frame timing includes `Context::run_ui` and `Context::tessellate` together.
+
+Printing receiver/poll lifecycle, separately timed text tessellation, fresh-process font discovery,
+GPU pipeline construction and native child/input behavior need their own evidence. They are not
+implemented measurements of this example. Texture deltas are counted, never uploaded; no window,
+GPU renderer, compositor, physical input or allocation-counting allocator runs here.
+
+Named cross-repository acceptance owners: egui fork section 10 owns fresh-process
+DX12 renderer/pipeline construction (#8736), and SoundCraft/PdfCraft Windows rows
+exercise their real options. Its selection-then-toolbar test owns #8763/#8764;
+craft-ui adds select-text-then-dock/button-action integration coverage. Its hidden
+parent/deferred-child fixture owns #8748; DesignCraft's native child-window scenario
+provides the consumer evidence. Link actual results to CL-4, rather than claiming
+craft-libs' library harness independently validates native DX12 or child windows.
+
+Build and run the implemented example through the owning `task.py` resource, keeping its allocated
+target/source/evidence paths. Build separately from measurement so Cargo startup/compilation is not
+mistaken for executable RSS or wall time. For example, inside the parent's managed jobs:
+
+```sh
+cargo build --release -p craft-ui --example ui_hotpaths --locked
+
+# Use a distinct durable output for each paired attempt; repeat in the candidate's own resource.
+# CARGO_TARGET_DIR is supplied by task.py, never overridden or shared across sources.
+CRAFT_UI_PERF_LABEL=baseline-attempt01 \
+CRAFT_UI_PERF_OUT=/absolute/task-evidence/baseline-attempt01-ui-hotpaths.json \
+"$CARGO_TARGET_DIR/release/examples/ui_hotpaths"
+```
+
+`CRAFT_UI_PERF_OUT` writes the pretty JSON report; unset it to emit JSON to stdout.
+`CRAFT_UI_PERF_LABEL` is copied into the report. Default fonts are egui's bundled definitions;
+optional `CRAFT_UI_PERF_FONT` supplies a pinned fixture file instead. Record its exact path and
+SHA256 externally. The report's `fonts.font_file` is a readable string (null when unset); non-UTF-8
+OS paths are displayed with replacement characters, so that display is not a lossless file identity.
+Actual file loading retains the OS path. Keep raw reports, stderr, source/lock/executable hashes,
+full argv/environment, Rust versions, feature set, CPU affinity and profile settings for both sides.
+The report's `build_profile` uses `debug_assertions` as a label: it does not independently prove
+optimization/LTO/codegen settings or account for environment profile overrides.
+
+Schema 3 records the case matrix and raw arrays. Each case warms for at least 50 operations/frames
+and at least 3 seconds. Pure functions collect 50 mean-of-batch samples (16 iterations per sample,
+2,000 for split cases), plus 50 separate individual latencies; those individual micro latencies are
+diagnostic because timer overhead dominates sub-microsecond work. Mean-of-batch samples are not a
+frame-tail distribution. Dock/integration cases collect 1,000 individual frame durations with
+median/p95/p99 statistics. Bodies, geometry, interaction checks, shapes/vertices/indices and the
+64-bit mesh fingerprint come from the final measured frame; the fingerprint is not exact mesh or
+pixel identity. Texture/repaint counters aggregate measured frames, and the hover probe runs in a
+separate unmeasured frame. Galley counts are recorded after warmup and after measurement.
+
+Before comparing paired reports, require nonempty consistent case keys/counts, matching viewport,
+DPI, theme, font fixtures, features and instrumentation, and the intended reviewed dependency delta.
+Alternate repeated runs and retain every raw pair; this example neither produces Criterion confidence
+intervals nor automatically accepts regressions. Apply section 10.2's thresholds only to metrics the
+actual output supports, with noise and correctness checks. Other criteria (exact visual/mesh equality,
+allocation counts, a 10k-frame cache-growth run, printing/native behavior and GPU/upload timing) need
+separate fixtures or profiling. Measure peak RSS/wall time around the built executable with the
+parent's managed runner; they are not fields measured by this harness. A successful example run alone
+does not establish performance, native rendering or all-platform acceptance.
+
+### 10.2 Thresholds
+
+These are acceptance thresholds for the migration, not automatically generated pass/fail golden
+values. Correctness gates are hard. Performance thresholds apply after excluding correctness
+failures.
+
+| Metric | Threshold | Action on failure |
+| --- | --- | --- |
+| Exact visual pairs | 0 changed pixels, 0 changed mesh elements | Fix component or make a reviewed, justified reference change |
+| Exact geometry fixtures | exact values | Fix component |
+| Accessibility names/roles | exact | Fix component or scoped fixture policy |
+| Idle repaint | 0 paints in 2 s after settle, no `request_repaint` from completed print state | Fix lifecycle |
+| Dock frame median | <= +5% candidate vs paired baseline | Profile; rerun; no acceptance on one noisy run |
+| Dock frame p95 | <= +10% | Profile; rerun; report |
+| Pooled dock frame p99 (>=1,000 individual frames) | <= +15% | Profile; rerun; part of acceptance; max is diagnostic only |
+| Layout pure functions median | <= +3% | Profile; rerun |
+| Layout pure functions p95 | <= +5%, from individual latency samples | Profile; rerun |
+| 800-action dock sequence median | <= +5%; inspect growth across larger trees | Inspect algorithmic regression |
+| Texture upload bytes / 100 frames | <= +5%, no repeated upload of the same image | Inspect cache keys/URI |
+| Peak RSS | investigate > +8 MiB or +5%, whichever is reached first | Report both absolute and percentage |
+| Galley cache size | bounded, no monotonic growth over 10k frames | Inspect cache key/language/viewport |
+
+Noise policy:
+
+- Run baseline and candidate on the same host, same OS image, same Rust toolchain, same feature set,
+  recorded lock identities and same viewport/DPI. Review the intended dependency delta rather
+  than requiring identical old/new lock contents. Alternate baseline/candidate sessions; do not compare a
+  laptop to the server or llvmpipe to a GPU.
+- Warm up for at least 3 s or 50 iterations, whichever is longer. Discard warmup.
+- Use 5 independent sessions of at least 200 individual frame samples for frame percentiles,
+  plus the Criterion runs for microbenchmarks. If the coefficient of variation of medians is > 3%, or
+  any session has a build/test/profiling process competing for CPU, discard and rerun the pair.
+- Accept only when the median-of-medians, pooled p95 and pooled p99 meet the table.
+  Report p99 only from the pooled >=1,000 individual samples, not each 200-frame
+  session; if tail variability prevents a repeatable verdict, expand to 10,000 frames. Report the raw session
+  values even when they pass.
+- A changed visual golden is never auto-accepted because of a performance change. A compile-time
+  measurement is not UI performance and must not be reported as such.
+
+The Windows row is a separate performance table (Basic Render Driver, guest CPU, guest memory).
+The macOS row requires real CI or hardware evidence; without it the row is unresolved. The real-GPU
+row requires fresh adapter-qualified measurements. The suite protocol's startup counts, small
+operation floor and stricter applicable thresholds also apply.
+
+## 11. Implementation PR stages
+
+Dependency DAG:
+
+```text
+all reviewed plans land
+  -> CL-0 baseline harness and measurements (before production change)
+winit completed integration including W15P + W27 lifecycle revision -> approved publication
+  -> egui final P8 incl. P2b, P7, P7b/E21b and P7c -> approved publication
+  -> CL-1 atomic API/fork graph
+       -> CL-2 capture prototype + lazy-print tests
+            -> approved prototype revision for integration consumers
+            -> DesignCraft + GridCraft adapter PRs/reviews
+            -> CL-2F final helper API freeze and docs
+       -> CL-3 accessibility/glyph/persistence/direction tests
+       -> CL-4 stock/fork fixtures and linked native acceptance
+  -> CL-5 final compatibility documentation
+```
+
+CL-0 is a separate baseline harness stage. CL-1 cannot start until CL-0 baseline records are complete. CL-2 and CL-3 may proceed after CL-1
+on disjoint code; their publication still requires approval. CL-2's initial API is
+explicitly provisional until the two named adapters are reviewed, preventing a
+dependency cycle between helper availability and API freeze.
+
+### CL-1: egui 0.37 API and coherent suite lock
+
+Files:
+
+- `Cargo.toml` (workspace egui pin).
+- `crates/ui/Cargo.toml` (dev dependency versions).
+- `crates/ui/src/buttons/mod.rs`, `crates/ui/src/docking/surface.rs`,
+  `crates/ui/src/layout/resize.rs`, `crates/ui/src/tabs/mod.rs` (role mapping).
+- The exact closed test-file allow-list in §4.2 (`Id::unique`, `scope_id`, ellipsis fixture);
+  additional files need a named reviewed exception, not a broad glob.
+- `crates/ui/README.md` (version + `scope_id` example).
+- Root patches and `Cargo.lock` regenerated against the reviewed immutable storytold egui/winit
+  commits; retained PDF backend patches remain intact.
+
+Use a local stock-0.37 experiment to isolate API fallout, then land the coherent suite graph in
+one compatibility PR after the fork dependencies are published with approval. Stock compatibility
+is verified independently; no intermediate registry-only consumer graph is a suite handoff.
+Rollback: revert the coherent commit. The old coherent set is preserved at
+`49190884278f16c9a9f5823d7698a8ffb5deb062`: egui family 0.36.2, accesskit 0.24.1, kittest 0.4.0,
+winit 0.30.13 and the baseline `Cargo.lock`. Do not partially revert only one crate and do not leave a
+0.37 manifest with a 0.36 lock.
+
+Prerequisite: the completed reviewed/published P8 fork includes P2b, P7, P7b/E21b and
+P7c, with W15P and the W27 lifecycle revision. Intermediate pins are not accepted.
+Acceptance: all section 9.1 gates against the suite fork and focused stock-0.37 compatibility
+checks; `cargo tree` has one egui family; visual
+suite still exact; no deprecation warnings under clippy `-D warnings`.
+
+### CL-2: Capture completion and existing lifecycle contracts
+
+Files:
+
+- `crates/ui/src/lib.rs` declares public `capture`; the lightweight slot has no new feature
+  gate or renderer dependency. Public types are available under `craft_ui::capture`.
+- `crates/ui/src/capture.rs` completion-slot prototype and tests. Publish only after
+  approval as a provisional git API; DesignCraft and GridCraft then implement their
+  adapters against that exact revision. CL-2F freezes the public API after joint review.
+- `crates/ui/src/printing.rs` only if a demonstrated regression needs a fix; preserve lazy discovery.
+- `crates/ui/src/printing/tests.rs` (logic-only and one-worker tests).
+- `crates/ui/README.md` lifecycle paragraph.
+
+No change to `Settings`, `Feedback`, `Discover`, `Submit`, `begin`, `ready`, or job ownership.
+Rollback: revert the helper together with its adapters, preserving pending-request cleanup and
+the previously coherent app dependency set. Print behavior changes require their own regression.
+
+Acceptance: tests from sections 6.2 and 7.8; cancellation, out-of-order result and shutdown stress;
+no worker before print-open, no duplicate workers or repaint after completion.
+
+### CL-3: Accessibility, glyph, persistence and docking direction contracts
+
+Files:
+
+- `crates/ui/src/docking/tests.rs`, `tabs/tests.rs`, `layout/tests.rs`, `buttons/tests.rs`,
+  `printing/tests.rs`.
+- `crates/ui/src/docking/surface.rs` implements `DockArea::direction`/`DockDirection`;
+  `crates/ui/src/docking/mod.rs` re-exports the public direction type.
+- New `crates/ui/tests/panel_integration.rs` and `serde_contract` test module;
+  opt-in docking direction implementation and the exact geometry/hit/drag tests in §7.7.
+- Beyond the explicit direction policy, no production change unless an assertion exposes a real component bug; then fix the component in
+  the same PR and document the exact role/name change.
+
+Acceptance: exact roles/names as section 7.2; `Harness::check_accessibility`; glyph coverage; fixed
+JSON round-trip; panel order/clip/float layer; targeted failure probes. Rollback: revert the
+production direction API and its app adapters as a coherent set; other fixtures are test-only.
+Any additional component fix is identified and reverted separately.
+
+### CL-4: Suite fork, winit pin and dual-compatibility checks
+
+Files:
+
+- Verify the root patches and lock introduced atomically in CL-1, with one git source per family.
+- `ci/registry-egui` isolated workspace plus `cargo package -p craft-ui` smoke check.
+  This preserves library portability; it does not authorize a crates.io release.
+- `ci/egui-fork-contract` isolated workspace that depends on the four UI-facing craft crates and
+  compiles against the fork with `eframe` wgpu/accesskit/x11/wayland and winit.
+- Documentation of the consumer patch requirement (README or docs).
+
+This PR does not publish anything and does not change the published manifest's registry requirement.
+Rollback: retain CL-1's coherent dependency set and revert only this stage's fixture changes.
+
+Acceptance:
+
+- `cargo tree -d` empty (or only pre-existing unrelated duplicates documented);
+- exactly one `egui`/`epaint`/`egui-winit` and one `winit` source;
+- fork contract compiles on Linux (x11+wayland), Windows GNU check, and wasm check for `craft-ui`;
+- packaged `craft-ui` still compiles/tests against registry 0.37.0;
+- E1/E4/E19/E21 symbol smoke checks compile only where the API exists;
+- no branch names in locks or manifests.
+
+### CL-5: Documentation and release checklist
+
+Files:
+
+- `crates/ui/README.md` compatibility paragraph: registry 0.37 vs suite fork, consumer patch
+  requirement, `scope_id` example.
+- `docs/ui-components-audit.md` version statement and a dated migration note; do not rewrite its
+  historical pinned hashes.
+- `docs/egui-037-migration-plan.md` status update only after the plan is approved.
+- Release notes in the user's voice, no agent/model/tool attribution.
+
+Acceptance: documentation links to immutable commits/tags; no machine-local path; no claim of a
+performance or platform result that was not measured. Rollback: documentation-only.
+
+## 12. Risks and migration traps
+
+1. **Lock conflict regression.** The audit merge proves how easily a 0.37 manifest gets a 0.36 lock.
+   Always inspect the lock, not only the manifest, and run `cargo tree`.
+2. **Fork patch not propagating.** A consumer that only patches `egui` will get registry `egui-winit`
+   or registry winit. The root patch must name every family member and winit.
+3. **Movable branch pins.** `craft/0.37`, `craft/0.30.13-lang` and `origin/ai-0.37` can move. Use full
+   SHAs in all locks, fixtures and docs.
+4. **Fork vs upstream API leak.** The shared library deliberately preserves stock 0.37 compatibility,
+   independently of its git-only suite delivery. Keep fork-only APIs in app/fork
+   fixtures: `Context::set_language`, `UiBuilder::language`, `Response::accessible_language`,
+   `Frame::set_ui_language`, `LayoutJob::{language,direction}`, `LineBreaker`,
+   `FontTweak::fallback_align`, `Style::right_to_left`, `RawInput::latin_layout_chars`,
+   `RawInput::keyboard_layout_is_latin`, E21b surrounding-text/owner payload and clear APIs,
+   `ImeEvent::DeleteSurroundingBytes` and `ViewportHooks`. The independent stock
+   compile/test fixture is authoritative, not just a symbol-name grep.
+5. **Default fonts changed twice.** `default_fonts` became opt-in and monochrome emoji fonts became
+   separate. The old `⋮` tofu case became a hard test failure under the new panic policy. Custom app
+   fonts, not craft-ui production defaults, must prove glyph coverage.
+6. **Kittest panic policy.** `MissingGlyphPolicy::Panic` and `check_accessibility` are deliberate bug
+   detectors. Scoped opt-outs, never global.
+7. **Screenshot callback ownership.** Callbacks are one-shot, `Send + 'static`, and execute outside
+   the UI pass. A callback that captures `&mut App` will not compile; a callback that never wakes the
+   app will strand a hidden-window result.
+8. **Surface fitting changes screenshot pixels.** E2 may render a window at a smaller surface and
+   scale it. Use returned image dimensions and capture-time logical viewport/DPI
+   metadata; the private integration render_scale is not a public app API.
+9. **Manual DockArea layout is not mirrored by `Style::right_to_left`.** Tabs, split first/second and
+   floating grip placement follow the explicit opt-in visual policy in section 7.7;
+   E9 does not implement it automatically.
+10. **Bidi changes text widths.** A tab label with Arabic/Hebrew can change `tabs::fit` results. Keep
+    ASCII fixtures exact and add fork-specific mixed-script geometry tests; do not update ASCII
+    references for an unrelated reason.
+11. **IME and undo.** E21's exact-byte deletion is only correct if the app keeps the commit and
+    deletion in one undo transaction. Do not reimplement deletion in app code.
+12. **Clipboard PRIMARY.** Regular copy/paste and middle-click PRIMARY are separate paths and separate
+    compositor behaviors. Test both.
+13. **GPU/resource tests.** `WgpuTestRenderer` is offscreen and prefers CPU adapters but may fall back to
+    a physical GPU. Record adapter identity; enforce a CPU adapter for deterministic
+    goldens and keep physical-GPU performance rows separate. It is not native
+    focus/IME/picker evidence and not a real-GPU claim.
+14. **Panel/root UI borrow.** Calling `Context::root_ui` from inside `DockArea` or a component panics.
+    Components take `&mut Ui`.
+15. **Multiple passes.** `request_discard` can repeat a `run_ui` closure. One-shot side effects in
+    tests or app callbacks must be guarded.
+
+## 13. Resolved design and blocking acceptance
+
+1. **Dependency policy.** Integrate the reviewed patches into storytold egui/winit first; pin
+   their final immutable commits at the suite root. The aiongg SHAs are reviewed inputs, not
+   promised production tips. A separate registry fixture verifies stock API compatibility.
+2. **Versioning.** Ship a new git revision and compatibility note; no blanket workspace version
+   bump or crates.io publication is part of this task.
+3. **Printing.** Keep user-triggered/lazy `refresh` and idempotent `poll`; hidden polling must
+   deliver requested results without starting unrelated printer discovery.
+4. **Docking direction.** Preserve serialized panel IDs, split axes, tab order and positions.
+   Adopt the explicit opt-in DockArea direction policy in §7.7; test RTL painting,
+   hit coordinates, visual-to-logical drag insertion and unchanged serialization. Do not silently mirror the persisted model or add a locale redesign.
+5. **Capture.** Use the narrow weak completion-slot design from section 7.8; review two concrete
+   callers and stress cancellation/memory before freezing the API. Keep app policy outside it.
+6. **Platform evidence.** Qualify the accessible Linux i915 render node and software backends
+   separately. Windows Basic Render Driver is software evidence. macOS needs native evidence,
+   and wasm compilation does not replace a real browser interaction workflow.
+
+Blocking acceptance criteria for craft-libs:
+
+- CL-1 through CL-4 gates pass with fresh task/evidence records; no direct cargo run.
+- One egui family and one winit source in the fork lock; packaged crate still resolves stock 0.37.
+- Fresh reports reproduce or rule out the applicable upstream #8731 text-tessellation and #8512
+  font-startup regressions; renderer fixtures include #8736 DX12 setup, #8763 selection/action and
+  hidden/deferred viewport behavior. #8763 is the open selection issue; #8764 its open, unmerged
+  proposed fix. #8748 is a closed, unmerged PR. #8512 is a closed feature PR whose comments supply
+  the startup-cost discussion. None is evidence of a released regression fix.
+- Exact visual/geometry/accessibility/persistence tests and the deliberate failure probes pass.
+- `cargo tree -d` has no new duplicates; no branch refs; no machine-local paths.
+- The performance table meets the thresholds, or a regression is profiled and explicitly reviewed
+  with a documented exception. A compile-time number, a changed golden or a single noisy sample is
+  not acceptance.
+- Every push/new PR has explicit human approval after the exact diff and validation are shown.
+  Commits and PR text use the user's voice and username-only contributor credit (`@skylartaylor`);
+  no agent/model/tool attribution.
+
+## 14. Source index used for this plan
+
+Primary upstream:
+
+- egui 0.37.0 changelog and release commit `841a328b`: `CHANGELOG.md` at tag `0.37.0`.
+- `crates/egui/src/context.rs` (`run_ui`, `run_pass`, `root_ui`, `run_logic`, `request_screenshot`).
+- `crates/egui/src/id.rs` (`Id::unique`, `IdSalt`), `ui.rs` (`scope_id`), `ui_builder.rs`.
+- `crates/egui/src/containers/panel.rs` (`Panel`, `CentralPanel`).
+- `crates/egui/src/data/screenshot_callback.rs`, `viewport.rs` (`Screenshot`).
+- `crates/egui_kittest/src/builder.rs`, `accessibility.rs`; `crates/epaint/src/text/fonts.rs`
+  (`MissingGlyphPolicy`, `has_glyphs`).
+- Upstream PRs: #8361, #8428, #8489, #8534, #8535, #8542, #8555, #8577, #8581, #8583, #8589, #8592,
+  #8601, #8617, #8657, #8641, #4729 (winit).
+
+Suite fork:
+
+- `/home/codex/work/CraftApps/egui037-migration-20261022/egui`:
+  `aiongg/craft/0.37` = `a4f9a17f64a6bae61350fb85804c9df0d9865916`;
+  `PATCHES.md` E1-E21; `0.37.0` = `841a328b`.
+- `/home/codex/work/CraftApps/craft-fork-20261020/winit-ai-lang`:
+  `craft/0.30.13-lang` = `8b35388bd719e8cc86a95971ba0bc026c9a8f058`;
+  `craft/0.30.13` = `ffae5198`; PATCHES.md W1-W27.
+- craft-libs PR 199 ref `refs/review/pr199` = `b68de8c`; audit merge `ec8840a` is not a target.
+- Historical evidence, not fresh validation:
+  `/home/codex/work/ssd2/task-evidence/craft-fork-plan-20261020/PLAN.md`,
+  `/home/codex/work/ssd2/task-evidence/craft-fork-ai-lines-20261022/SURVEY.md`,
+  `/home/codex/work/ssd2/task-evidence/craft-fork-egui037-20261021/RESULTS.md`,
+  `/home/codex/work/ssd2/task-evidence/egui037-audit-20261022/fork/craft-libs.log`.
+
+craft-libs source anchors:
+
+- `Cargo.toml:34`; `crates/ui/Cargo.toml:13-24`; `.github/workflows/ui.yml:20-58`.
+- `crates/ui/src/lib.rs`; `crates/ui/src/buttons/mod.rs:70-102`.
+- `crates/ui/src/tabs/mod.rs:40-163`.
+- `crates/ui/src/layout/geometry.rs:1-135`; `layout/resize.rs:1-198`; `layout/toolbar.rs:1-152`.
+- `crates/ui/src/docking/model.rs:1-798`; `docking/surface.rs:1-919`; `docking/targets.rs:1-99`.
+- `crates/ui/src/printing.rs:1-261`; `printing/tests.rs:1-257`.
+- `crates/ui/src/theme/mod.rs:1-97`; `icons/mod.rs:1-78`.
+- `crates/ui/tests/visual_regression.rs:1-394`; `tests/visual/fixtures.rs:1-327`;
+  `tests/docking_workflows.rs:1-252`.
+- `crates/platform/src/appearance.rs:439-525`; `platform/src/dialogs.rs:220-251`;
+  `crates/quit/src/close.rs:1-190`; `crates/window/src/lib.rs:255`.
+- `crates/ui/README.md:115,237`; `docs/ui-components-audit.md:5`;
+  `docs/ui-visual-regressions.md`; `docs/ui-docking.md`.
+
+
+## Local implementation update — 2026-10-23
+
+The user clarified that reviewed plans remain local and implementation proceeds before publication. The earlier requirement to publish/land this plan first is superseded; pushes and PR publication still require explicit approval.
+
+Canonical `storytold/craft-libs` `main` now resolves to `f180fc0d35d521c5d18e118c881d3efde1ec1eee`. The owned checkout was fast-forwarded to this revision. Earlier baseline SHAs and line anchors above are retained as historical review evidence; use this new revision and its exact lockfile for current-main integration and paired measurements. The original refs remain reachable.
+
+Preserve new hayro/krilla hostile-input bounds, updated SOURCE manifests/nested lock, and chrono std-only workspace policy. PR199 advanced to1dcde7ed and now incorporates49190884 security fixes; its14-file delta can be reviewed against currentmain rather than treating newhead as the old stale tree. Regenerate lock against final dependencies.
+
+The complete static delta review and exact old/new object identities are retained in the task evidence: `canonical-diffs-refresh-20261023.json` and `overnight-consumer-review-20261023.md`. This amendment claims no new build, native GUI or performance acceptance.
+
+### Local row-alignment component, 2026-10-23
+
+`craft_ui::text::align_galley_rows` positions already-shaped rows within an explicitly allocated width. It accepts a row alignment callback and uses stock egui 0.37 types, so it does not make the shared UI crate depend on the fork's bidi extensions. It is useful for comment cards, captions and message panels. It retains shared row glyphs/meshes and logical text, updates row positions and logical/mesh bounds, and never mutates the cached source galley. Oversized left-aligned rows overflow right, right-aligned rows overflow left, and centered rows overflow on both sides; nonfinite or negative widths are refused without changing the input.
+
+WordCraft supplies alignment from the fork's `rtl_paragraph` field. This preserves native shaping, mixed-direction runs, mirrored bracket glyphs and neutral-paragraph inheritance. The fork's `LayoutJob::halign_min_is_start` aligns RTL rows to the widest text row, which is insufficient for a short comment in a wider card. No new Unicode reordering implementation is introduced. Unicode's logical-order and mirroring rules are described in [UAX #9](https://www.unicode.org/reports/tr9/); the fork source documents its row placement in `epaint/src/text/text_layout_types.rs`.
+
+Prepared helper tests check independent row alignment, unchanged cached row data, mesh bounds, invalid widths and oversized rows. WordCraft's real Arabic/mixed/neutral-paragraph test passes in `egui037-wordcraft-candidate-20261023-targeted-07`, including atlas-bitmap bracket orientation. Stock shared-library tests, performance and independent component review are pending; the prior 110-test result predates this helper.
+
+The second independent component review found no blocking helper defect. Word now clips balloon ink to the card and disables the fork-only start-edge override before custom row alignment. Additional source tests cover fractional scale, zero width, idempotence and separate ink bounds. Execution remains pending.
diff --git a/docs/egui-037-suite-rollout.md b/docs/egui-037-suite-rollout.md
new file mode 100644
index 00000000..d3e529be
--- /dev/null
+++ b/docs/egui-037-suite-rollout.md
@@ -0,0 +1,461 @@
+# Craft suite: egui 0.37 rollout and acceptance plan
+
+Status: local implementation underway, updated 2026-10-24. The reviewed local egui fork is
+`173cc7375d35dc5fbc5b5d0994fdf787f547c5d1`; the reviewed local winit fork is
+`ae48c756a3b81125eb796c0cc6dccf60990d1181`. craft-libs is reconciled on merged PR 199 and now
+records those immutable canonical sources in its manifest and lock. Its 118 craft-ui tests, strict
+package clippy, canonical source audit and formatting checks pass. Full workspace, platform/native,
+accepted comparative performance and clean post-publication remote-fetch gates are not implied.
+No push or new pull request is authorized.
+
+The inventory below retains the 2026-10-22 planning snapshot and source references for provenance;
+the current repository status supersedes its old implementation/PR-conflict statements. Every
+repository has a separate `docs/egui-037-migration-plan.md`. This document defines the shared
+dependency order and acceptance contract; each repository plan supplies its actual source anchors,
+commands, fixtures and behavior-specific assertions.
+
+## Scope and current dependency state
+
+The inventory covers 15 applications: CADCraft, DeckCraft, DesignCraft, EffectCraft, FigCraft,
+FilmCraft, GridCraft, LightCraft, PdfCraft, PhotoCraft, SoundCraft, VectorCraft, WordCraft,
+ArtCraft Launcher (`craft-launcher`) and ArtCraft Native (`artcraft/artcraft-native`).
+It also covers `craft-libs`, `craft-ai-integrations`, `storytold/egui` and the required
+`storytold/winit` companion fork. CLI, web, headless, examples, benchmarks and nested workspaces
+that consume these libraries belong to their repository's migration.
+
+The first 14 applications were present in the earlier suite audit; ArtCraft Native and
+`craft-ai-integrations/crates/ai-egui` must not be lost from the rollout. `craft-fonts` and
+`craft-i18n` are relevant data/API inputs, not egui rendering consumers in the inspected sources.
+The older `storyteller-bevy` studio and `bevy-mocap` examples use Bevy-specific integrations
+(`bevy-inspector-egui` 0.23 and 0.22); they are outside this Craft suite/fork migration. A
+future expansion to those projects needs their own Bevy compatibility plan, not a root egui override.
+
+The [launcher's pinned catalog](https://github.com/storytold/craft-launcher/blob/9419d8977bc70f80373da8558356e4ba7387c7b2/crates/core/src/catalog.rs)
+enumerates the 13 creative apps above. Repository discovery also covered all 68 repositories
+returned for `storytold` (the next page was empty), with a separate code search excluding the
+19 migration repositories so one large app could not crowd out smaller consumers. Search is a
+discovery aid, not proof about unindexed code. Manifest/source inspection confirmed the additional
+ArtCraft Native and AI UI consumers. ArtCraft-X is a Tauri/Vite frontend, the repository-status
+app uses a TypeScript UI, and ArtCraft Services' inspected workspace contains service/CLI code;
+the latter's old Docker comments mentioning egui are not a dependency declaration. Asset/data
+repositories and the empty AniCraft/CraftHub repositories do not require an egui port. Re-run
+this inventory before final integration to catch newly added consumers or branches.
+
+Most inspected suite roots still resolve egui 0.36.2. CADCraft at
+`1977a493c7d8340249185126744c5143f096dc86` and SoundCraft at
+`52471b37e957feaea56dfd48932ef16d314cc74a` have already bumped direct dependencies to 0.37,
+while their pinned `craft-ui` still requires 0.36. Both lockfiles therefore contain two egui versions.
+Their first deliverable is a coherent graph and preserved behavior, not another version bump.
+
+The existing application code already uses the root-Ui lifecycle on 0.36.2; some web shells
+implement only `App::ui` and inherit default `logic`. Do not attribute that split to 0.37
+or rewrite it mechanically. Inspect the remaining incompatibilities and
+revalidate the lifecycle, especially hidden windows, child viewports and repeated UI passes.
+
+## Pinned starting points and existing work
+
+| Source | Exact reference | Use |
+|---|---|---|
+| Upstream egui 0.37.0 | `841a328ba2dd8f6996beb7189ebb7fc00e668a2a` | Release commit, not moving main or the annotated tag object |
+| Upstream egui 0.36.2 | `49682f8baa058bf49e011035cfbd6e825f88a5ef` | Stock comparison, where useful |
+| Published storytold egui | `767b1cad294120689a514bb4bd68c077e46679b9` | Existing `craft/0.36.2` patch inventory |
+| aiongg egui candidate | `a4f9a17f64a6bae61350fb85804c9df0d9865916` | `craft/0.37`; review E1–E21 before integration |
+| Published storytold winit | `ffae5198770d7730e718043f035a772b7dbc3b1b` | Existing `craft/0.30.13` behavior |
+| aiongg winit candidate | `8b35388bd719e8cc86a95971ba0bc026c9a8f058` | `craft/0.30.13-lang`; review companion patches and downstream vendors |
+| craft-libs plan baseline | `49190884278f16c9a9f5823d7698a8ffb5deb062` | Current shared-library tree used by this plan |
+| craft-libs PR 199 | `b68de8c5f4f1c060904d211a7b1320aa0f7bce78` | Existing aiongg API port; open and conflicting at inspection |
+
+[PR 199](https://github.com/storytold/craft-libs/pull/199) supplies reusable API-port hunks,
+not a mergeable replacement tree. Its head `b68de8c` and historical audit tree `ec8840a`
+omit current `craft-platform` and revert security, settings, docking and printing fixes.
+Apply the port from `8614e4a04fae516fba16c22b31ff1008cb6be10b` and relevant README
+changes from `1764bca` onto current `4919088`, preserving intervening fixes and provenance.
+Re-run actual gates; neither the PR nor historical checks qualify the resulting tree.
+[Issue 198](https://github.com/storytold/craft-libs/issues/198) is a broader language-support
+proposal, not a merged dependency. Its locale/formatting roadmap is not silently included in
+this upgrade. Changes required to consume the selected fork correctly are included: remove
+double bidi processing, maintain logical text at OS/accessibility boundaries, preserve IME and
+shortcut behavior, and ensure installed/bundled font coverage under each app's asset policy.
+Do not import prohibited font assets from the proposal; existing licensing rules still apply.
+
+The candidate also has a confirmed IME integration gap: winit W27 exposes outgoing
+surrounding-text support but egui-winit never sends it. Egui E21b/P7b adds the bounded
+transient payload, TextEdit producer and Wayland adapter. Word/Vector/Fig/Effect/Film/
+Design/Deck/Photo custom editors require model/preedit/byte-index adapters; this is
+part of their atomic compatibility work. Outgoing state, focus/password clearing,
+long selections and native IME evidence are explicit acceptance gates. The input-owner generation
+exists even for `Unavailable`; an empty available document is distinct. W27 must clear cached and
+protocol surrounding state at an owner/unavailable transition using a committed disable/enable
+boundary and cancel old pending preedit/commit/delete batches. Ordinary updates retain composition.
+Within a current focus epoch, mismatched text-input-v3 `done` serials still apply incoming edits
+once while deferring outgoing state until a match; old epochs cannot edit a new owner. Egui's
+latest completed pass, including `IMEOutput = None`, replaces earlier IME output. Fork P7b/W27
+own these fixes and tests before downstream compatibility PRs; see their detailed contracts.
+P7b also separates the web TextAgent DOM-position equality key from transient IME payload
+equality, testing browser composition and no extra style writes for unchanged caret geometry.
+
+The winit plan must pin the candidate's full SHA and compare its tree against the published
+`craft/0.30.13`. The selected egui language APIs and winit language APIs form one compatibility
+unit. winit remains 0.30.13 and wgpu remains 30 unless a separately justified change is needed.
+
+## Implementation and publication dependency order
+
+1. Finish each plan, then obtain a fresh independent adversarial review of that exact document.
+   Resolve concrete findings, retain the review and final document hash, and prepare documentation
+   PRs. Obtain publication approval after showing the proposed branches, files and checks.
+   Implementation begins after the plans land; local drafts are not described as landed.
+2. Add regression and benchmark harnesses on the recorded baseline revisions before changing
+   production behavior. Record pre-existing failures separately. For CADCraft and SoundCraft,
+   locate the last coherent pre-bump revision; keep both the current broken graph and the
+   coherent performance baseline identified. No fabricated baseline from a failing binary.
+3. Integrate the reviewed winit patch series, new W15P PRIMARY support and tests. Integrate egui
+   E1–E21 plus E21b outgoing IME state and E4/P2b PRIMARY integration in dependency order,
+   including P7 held-key pairing and P7c selection-action/hidden-child fixes, then final P8;
+   include only justified performance fixes. Preserve patch authorship, source links, test mappings
+   and removal conditions. Publish approved dependency commits before consumers reference them.
+4. Port craft-libs using the selected PR 199 hunks, including `craft-ui`, egui-enabled
+   `craft-quit`/`craft-window` and all relevant optional features. The current shared workspace
+   has no binary/example targets; excluded vendor examples retain their separate disposition.
+   Add narrowly justified shared helpers and their
+   regressions. Port `craft-ai-egui` in parallel once its dependency contracts are fixed.
+5. Port each application in its own reviewable PR series. Atomic compatibility changes include
+   manifests, lockfiles, source adaptations and harness changes; never land an intermediate
+   dependency bump that leaves main unbuildable. Eleven craft-ui consumers adopt the capture
+   helper from CL-1 + CL-2F in that atomic stage; DesignCraft/GridCraft explicitly pilot the
+   reviewed CL-2 prototype before CL-2F. Only Deck/Fig/Art Native use local capture adapters.
+   Non-capture helpers may follow separately when compatible. Required IME/bidi adapters
+   belong in the first fork pin; later language-policy and expanded coverage PRs stay focused.
+6. Run per-app functional, visual, platform and performance acceptance, then a fresh independent
+   adversarial implementation review at the exact candidate revision. Fix findings and re-run
+   affected checks. Perform a final suite-wide dependency and capability audit before rollout.
+
+Consumers can be implemented in parallel after the shared contracts stabilize, using separate
+source checkouts, build resources and test VMs. Start integration with ArtCraft Launcher plus
+CADCraft/SoundCraft to expose graph/API problems, then the office apps and complex canvas/media
+apps. This order is risk management, not permission to skip a later app or its platform checks.
+FilmCraft/EffectCraft cross-repository pins require an explicit reverse-dependency check.
+
+Each push and each new PR still requires the user's explicit approval for that publication.
+Implementation authorization does not authorize pushing, merging, releasing or closing other
+contributors' issues. Public descriptions contain the problem, change and validation, without
+agent/model/tool signatures. Contributor metadata remains username-only.
+
+## Dependency and vendoring acceptance
+
+- Record manifests and lockfile package IDs, sources, versions, revisions and features for every
+  root and nested workspace. Inspect target-specific, dev and build dependencies, not just the
+  default executable. Parse `cargo metadata` and `cargo tree` under native and wasm feature sets.
+- Every selected egui family crate, including tests, renderers, `epaint_default_fonts` and
+  `egui_system_font_provider` when used, must resolve from the intended immutable fork revision.
+  A package version match alone is insufficient: registry and git packages have different identities.
+- Root `[patch]` sections must exist where resolution occurs; a dependency's patch section is
+  ignored by its consumer. Verify fork-specific APIs under real consumer roots. Align craft-libs
+  revisions wherever shared public types cross crate boundaries; do not churn unrelated pins blindly.
+- Resolve features for every accepted native/wasm/package-test root with `cargo tree -e features`.
+  Egui 0.37 has no default `default_fonts`; eframe's default feature set is different. Each root
+  declares its bundled/provider policy and passes a no-tofu fixture without relying on another
+  workspace member's feature unification. Check clipboard, accessibility, color-font and renderer
+  features explicitly. All-family source audits include optional lock-only crates such as `egui_glow`.
+- Record the full coherent version/source set in a canonical manifest and check all consumer
+  roots against it in CI. Tooling must catch a missing patch, duplicate egui/winit, an old transitive
+  `craft-ui`, a moving branch dependency, and a machine-local path. Test these failure cases.
+- Compare PdfCraft's vendored winit and egui-wgpu fixes against the selected fork semantically,
+  including fixes added since the old audit. Transfer regression coverage before deleting only
+  superseded vendors. Preserve krilla, hayro (including hayro-cmap), lopdf, vello and VectorCraft's windows-link patches unless a
+  separate comparison proves a migration-related replacement. Review open Android/IME/Wayland
+  vendor work as evidence; do not merge unrelated changes or close its PRs as a side effect.
+- A clean checkout must fetch every approved revision and pass `--locked` without local overrides.
+  Before merge, recheck remote heads for drift and rebase/revalidate affected source and evidence.
+
+The initial root-patch disposition is exhaustive for the 19 recorded roots. Nested workspaces,
+vendored manifests and command-line overrides remain separately enumerated in the static
+inventory and must be checked under their actual resolution roots:
+
+| Root | Existing override | Migration disposition |
+|---|---|---|
+| DesignCraft | winit `storytold/winit@3d51077fd1a966f84df9ef287839dc84fd5b4ca7` | Replace with final reviewed W14/W15P/W27-compatible storytold revision; preserve cancelable-quit regression |
+| PdfCraft | `vendor/winit`, `vendor/egui-wgpu` 0.36.2 | Transfer all window/GPU fixes and guards centrally, prove equivalence, then remove these overrides/vendors atomically |
+| craft-libs | local krilla, hayro, hayro-interpret, hayro-syntax, hayro-jbig2 | Retain PDF/printing fixes, provenance and tests |
+| DesignCraft | krilla and four hayro packages at craft-libs `89dcbb3060377a26c99a6d80caa16084366704c4` | Retain independently of the UI pin |
+| DeckCraft, WordCraft | krilla at craft-libs `c348732…` | Retain exact existing revision from each manifest |
+| EffectCraft | hayro-syntax at craft-libs `ca50d63b773c99f96e75c77ce5a1d21e7c9cda0d` | Retain |
+| VectorCraft | hayro-syntax, hayro-interpret, hayro-jbig2, krilla at the same `ca50d63…` | Retain; also preserve Windows 7 packaging's command-line windows-link path override and its dedicated test |
+| PdfCraft | local hayro, hayro-interpret, hayro-syntax, hayro-cmap, hayro-jbig2, lopdf, vello_common | Retain unrelated PDF fixes |
+| Other 12 roots | No root patch at the recorded source | Add required immutable family/winit overrides at the actual consuming roots |
+
+Candidate fork branch dependencies are research inputs; final manifests use approved reachable
+storytold revisions containing the completed series. CI checks actual package IDs, not textual
+version matches. Negative fixtures inject DesignCraft's old winit override, PdfCraft's old path
+override, a missing family patch and an unapproved moving branch; each must fail the graph gate.
+Inspect inverse trees for winit and egui-wgpu under every selected root/target/feature set.
+The canonical inventory contains all 19 sources, including ArtCraft Native, AI UI and winit;
+gate inventory/ledger source-set equality and reject missing or unreadable tracked manifests.
+The synchronized `dependency-inventory.json` at this planning workspace root and in the task's
+`ssd2/task-evidence/egui037-migration-20261022` directory contain the same 19-source inventory;
+record its hash in each gate, compare against Git's tracked manifests, and reject stale copies.
+
+## Shared components: justified boundaries
+
+Screenshot completion has 14 consumers: CADCraft, DeckCraft, DesignCraft, EffectCraft, FigCraft,
+FilmCraft, GridCraft, LightCraft, PdfCraft, PhotoCraft, SoundCraft, VectorCraft, WordCraft and
+ArtCraft Native. Eleven creative apps already depend on craft-ui and will adopt its new helper after CL-2F
+(the DesignCraft/GridCraft pilots first use the reviewed CL-2 prototype).
+DeckCraft, FigCraft and ArtCraft Native do not depend on it and keep small local adapters
+with the same tested contract. Exact manifest-key inspection distinguishes `craft-ui`
+from each app's own `*-ui-egui` crate name. The launcher has no screenshot consumer.
+egui 0.37 replaces screenshot input events with a one-shot callback.
+The screenshot command itself requests a hidden paint; callback arrival does not. A request
+queued in app logic but issued only in UI, including every remaining settling frame, must
+send `RequestPaintWhileHidden` to reach issuance. A wake alone may run hidden logic only.
+The callback receives only `Arc<ColorImage>` and does not schedule another repaint itself.
+See the [release callback implementation](https://github.com/emilk/egui/blob/841a328ba2dd8f6996beb7189ebb7fc00e668a2a/crates/egui/src/data/screenshot_callback.rs).
+
+Keep app request IDs, output paths, serialization, timeouts, settling policy and reply schemas
+in each app. A shared mechanism may provide a bounded, cancelable per-request completion slot,
+capture correlation and viewport-aware wakeup. The callback must not encode PNGs, write files,
+run commands, hold a long lock or borrow mutable app state. After timeout/close, a late callback
+must release its image without sending another reply. Limits must bound pending images and
+requests; counter wrap and a reused viewport must not bind an old capture to a new document.
+
+The selected starting design is one completion slot per admitted request, with the callback holding
+only a weak reference to that slot. Several app plans need the same one-result lifecycle, while
+their request records already own IDs, deadlines and reply routing. Keeping the slot inside that
+record gives correlation without a second global token map. Dropping/canceling the record releases
+its image; a late callback cannot retain the app or produce a file/reply. Keep any context/wakeup
+handle in the live slot, not strongly captured by a callback that may itself be queued in that
+context. Release the slot lock before waking the owning viewport. The app retains admission limits
+and must bound aggregate pending image memory, not merely the number of results in each slot.
+
+The default capture admission policy is 4 pending requests, 128 MiB image bytes per request
+and 256 MiB aggregate reserved in-flight/completed bytes; apps may select stricter explicit
+limits (CADCraft uses its documented smaller budget). Use checked dimensions × 4 arithmetic,
+reject excess admission without evicting earlier requests, and measure transient readback/encoder
+RSS separately. Callback arguments contain pixels only. The default adapter records target-UI
+logical content/screen bounds and a geometry epoch at issuance, then rejects/retries any intervening
+resize/DPI/zoom/surface epoch change before save, even a change back. With an unchanged epoch,
+derive pixel scale from returned image dimensions and verify aspect/rounding. Do not assume
+Wayland `inner_rect` exists or that callback arrival supplies capture metadata. A renderer-specific
+frame annotation is an alternative only after an actual tested API is established. Distinct-image
+correlation tests manually complete callbacks in reverse order; kittest's ordinary renderer shares
+one image across callbacks, so real two-window pixels require native evidence. Before
+baselines, reconcile every app admission table to these defaults or stricter limits; no
+app silently retains 8/16 requests or larger per-image/aggregate budgets.
+
+Stress concurrent captures, cancellation, shutdown, delayed GPU readback, out-of-order completion,
+memory and hidden-window wakeup. Compare a bounded nonblocking channel prototype with explicit
+overflow/error handling if these tests or measurements expose a weakness in the slot design.
+Do not encode/save images on the callback thread or add a generic UI compatibility framework.
+Applications without craft-ui need not adopt the entire crate solely for this helper. Prototype
+the shared API in CL-2, then integrate DesignCraft's multiple viewports and GridCraft's single
+window against an approved provisional revision. Review those adapters before CL-2F freezes the
+API. This is an initial topology check, not a reduction of scope: all eleven shared
+consumers and the three local adapters must pass their capture/cancel/close/DPI tests.
+
+The DockArea direction policy is explicit and opt-in: custom RTL tab/control chrome,
+hit tests, drag insertion and keyboard traversal share one geometry calculation;
+serialized physical splits, rectangles and logical tab order are preserved. The
+shared-library plan defines the builder and tests. No app may reverse saved panel
+order to simulate RTL.
+
+Other candidates are a tested wheel-event adapter that preserves `MouseWheelSource`, and focused
+font/direction/IME helpers with multiple named callers. Retain native widget roles/names rather
+than hiding all role changes behind `Unknown`. Existing app themes, units, document models,
+canvas engines and undo stacks remain owned by the applications.
+
+## Shared regression matrix
+
+| Risk | Required observable assertion |
+|---|---|
+| Callback screenshot routing | Distinct requests for two viewports receive the right pixels and exactly one reply; timeout/close/cancel prevents a late file write or reply; pending queue drains |
+| UI passes and hidden logic | A forced second UI pass does not duplicate a command/undo step; background results, autosave and media continue under logic-only iterations without replaying stale input |
+| Hidden parent and child viewports | With the parent occluded or overdue, open, update and close a child; the visible child receives content and close acknowledgement without restoring the parent |
+| Root UI and panels | Existing Ui is passed through; no recursive `root_ui` borrow; panels reserve space in order; canvas geometry, clip and hit positions agree after resizing |
+| Stable widget identity | Changing language, hiding a panel or inserting/reordering a row does not transfer focus/edit/drag state to another item; persisted workspace restores |
+| Accessibility | Named inputs expose correct roles, values, selected/disabled/focus states; hidden controls disappear; tab/arrow/Enter/Space actions trigger the same commands |
+| Fonts and text | Controlled licensed fonts cover fixture glyphs; no tofu, clipped combining marks or doubled bidi; logical clipboard/save/accessibility strings remain unchanged |
+| Selection regression | Select text, click a toolbar/context action and verify the intended selected range is used; pointer and keyboard paths agree |
+| IME/graphemes | Preedit, replacement, commit and cancel produce one intended edit/undo step; surrounding byte ranges cannot split UTF-8; emoji clusters and RTL caret/selection remain consistent |
+| Scroll and zoom | Wheel, trackpad and momentum preserve source, phase and modifiers; overscroll uses the correct clamped/unclamped coordinate for painting and hit tests; zoom stays anchored |
+| Input/native platform | Child focus/close/reopen, mixed DPI, native pickers, clipboard/PRIMARY, file drop and pen/tablet behavior are observed in real native workflows |
+| Wayland PRIMARY | Password selection is never offered; unchanged selection does not reclaim ownership; pointer- and keyboard-triggered ownership (including keyboard-only focus), fresh triggering serials per seat/origin, owner/seat changes, empty/absent offers, self-paste and slow/canceled transfers work under wlroots, KWin and Mutter with supported capabilities recorded |
+| GPU/resources | Surface limits/configuration errors do not panic; textures are updated/freed correctly after DPI/resize/device errors; color emoji and nearest/linear/wrap sampling stay correct |
+| Persistence | Edit, save, close and reopen a synthetic document plus layout; compare document meaning, selection/workspace expectations and undo semantics |
+
+Use deterministic synthetic fixtures and explicitly pinned fonts/DPI/theme/viewport. Test small
+windows and 1x/1.5x/2x scaling in both themes; add RTL/CJK/combining/emoji cases where the app's
+UI or document text uses them. Keep geometry and semantic assertions alongside rendered images.
+Review each intended image change; never bulk-refresh goldens to make CI pass. Demonstrate detection
+with bounded negative controls (wrong callback/viewport association, missing accessible name, wrong clip/offset,
+dropped callback or forced duplicate command), then remove the deliberate defect.
+
+Rerun's [testing guide](https://github.com/rerun-io/rerun/blob/42677ef9b096abbce742f0929dea58bb75f740ad/TESTING.md)
+provides relevant prior art: drive viewer interactions through the harness and examine image diffs.
+Apply that principle to Craft workflows; direct state setup is for fixtures, not a substitute for
+clicking the changed control. Use egui_kittest's strict missing-name and missing-glyph behavior.
+Native IME, focus, system dialogs and compositor behavior still need native evidence.
+W15/W15P use bounded asynchronous read/write transfer handles, a total monotonic deadline,
+byte/request/worker limits and cancellation. The candidate's two-second inactivity poll timeout
+is not a total deadline. Egui E4/P2b routes completions only to a live paste request with unchanged
+input owner/generation; focus changes cancel it. Test slow trickles, oversized offers, cancellation
+and concurrent peers while measuring event-loop responsiveness. Serial selection uses the actual
+triggering pointer/keyboard event and seat; no arbitrary first-seat fallback.
+
+Text conformance fixtures must match the data in the selected dependencies: the candidate locks
+`unicode-bidi` 0.3.18 (Unicode 16) and `unicode-segmentation` 1.13.3 (Unicode 17). Test the fork's
+layout/editing adapters against versioned [bidi](https://www.unicode.org/reports/tr9/) and
+[grapheme](https://www.unicode.org/reports/tr29/) cases; do not silently use the latest data as the
+locked contract. For [Wayland text-input-v3](https://cgit.freedesktop.org/wayland/wayland-protocols/tree/unstable/text-input/text-input-unstable-v3.xml),
+assert the full preedit/deletion/commit sequence, valid UTF-8 byte boundaries and freshly updated
+outgoing surrounding text. Cover deletion-only batches, focus/reset/serial changes and two windows.
+A [similar Mozilla report](https://bugzilla.mozilla.org/show_bug.cgi?id=2080478) motivates the
+stale-surrounding-text case; it is not evidence that this fork has that bug.
+
+## Performance protocol and stop conditions
+
+Capture baseline before production edits. Rebuild baseline and candidate with the same compiler,
+profile, features, fonts, fixture, renderer/backend, driver, viewport and DPI. Record full Git and
+lockfile identities, CPU/GPU/OS, raw samples and any shared-host load. Use separate allocations,
+then alternate execution order to reduce thermal/cache bias. Never benchmark concurrently with
+builds or another noisy workload and claim a small improvement.
+
+Use at least 10 warmups and 30 timed iterations for steady operations, and at least 20 fresh
+processes for startup. For frame distributions capture at least 1,000 frames and report p50/p95/p99;
+do not claim a reliable p99 from 30 samples. Report median/p95 for discrete operations with the
+sample count, a paired confidence interval where suitable, peak RSS, allocations/texture uploads,
+idle CPU/repaint count, and cold versus warm caches separately. Preserve startup/font-provider
+timings and raw/compressed WASM sizes. Software renderers and real GPUs are separate results.
+
+Preliminary gates, to be frozen in baseline reports before candidates are measured: investigate
+a repeatable >5% median or >10% p95 latency regression, >5% peak-RSS increase, any new idle
+busy-loop or audio underrun, and any loss of the app's existing absolute performance budget.
+For sub-millisecond measurements require the relative increase also exceed 0.05 ms or corroborate
+it with stable instruction/allocation counts. Reject noisy comparisons as inconclusive and rerun;
+do not expand tolerances after seeing a failure. Any exception needs a documented tradeoff and
+review before acceptance. Existing stricter repository budgets win.
+
+These sample counts are minimums and the investigation thresholds are maximum tolerances across
+the suite: an app may tighten them, never silently loosen them. Any proposed exception must be
+documented and approved before candidate measurements; an exploratory small sample is not tail
+acceptance. Reconcile every app's table against this contract before baseline capture. In
+particular, the earlier FilmCraft five-warmup, EffectCraft three-warmup/relaxed startup and winit
+three-warmup proposals are superseded: use the shared floor and investigate at the shared latency
+thresholds unless an explicit pre-measurement exception has been approved. FilmCraft’s old
+absolute +20 ms startup allowance is also superseded by the shared relative thresholds.
+
+The first baseline report and every investigated regression include an equivalent stock-0.37
+control alongside 0.36 and the selected fork. Fork-only app code need not compile unchanged on
+stock: use the same operation in a pinned minimal adapter/harness and explain any remaining
+semantic differences. Record all three source/lock identities; unavailable equivalence remains
+an attribution limitation, not evidence that an upstream regression is unavoidable.
+
+App plans select meaningful workloads: canvas pan/zoom/selection and text editing; spreadsheet
+scroll/recalculation; timeline scrub/playback and waveform updates; slide transition/presenter
+windows; thumbnail grids and RAW previews; PDF page navigation/annotations/search; launcher catalog
+and download progress; AI job history/progress. Include idle and first-use paths, not just engine
+CLI throughput. Rendering hashes and document state must remain correct during measurement.
+
+Three upstream reports require targeted reproduction on our own fixtures and environments:
+
+- [#8731](https://github.com/emilk/egui/issues/8731): plain-text tessellation regression associated
+  with color-glyph handling. Compare unchanged 0.36, stock 0.37 and selected fork. If confirmed,
+  evaluate a row-level fast path and cached color-glyph metadata while testing mixed/color rows.
+- [#8736](https://github.com/emilk/egui/issues/8736): DX12 FXC shader compilation cost even when
+  predictable filtering is disabled. Measure renderer construction separately from first frame.
+  Compare an override-constant design with semantically equivalent wrap arithmetic only if needed;
+  clamp-only output is not a valid fix for Repeat/MirroredRepeat.
+- [#8512](https://github.com/emilk/egui/pull/8512): a system-font startup-cost report in the
+  discussion. Measure discovery separately, preserve glyph coverage, and compare current app
+  loaders with explicitly configured system providers before enabling a new default everywhere.
+
+These are external reports, not reproduced measurements or promises of a speedup.
+
+Known functional reports also require explicit decisions before the fork is frozen:
+
+- [#8763](https://github.com/emilk/egui/issues/8763) and unmerged
+  [#8764](https://github.com/emilk/egui/pull/8764): reproduce selection loss when clicking an
+  outside toolbar/context action. The fork owns the selected fix, with pointer and keyboard
+  regressions proving that the intended range reaches the action in that pass. A necessary app
+  workaround must preserve the range and undo semantics and have its own removal condition.
+- [#8748](https://github.com/emilk/egui/pull/8748) is closed and unmerged, not behavior in the
+  selected release. The fork owns a tested hidden-parent/deferred-child solution; exercise
+  overdue redraw with unknown visibility as well as actual occlusion/minimization. Do not infer
+  phase from `visible()`, or describe ordinary logic-only calls as full UI passes.
+- [#8657](https://github.com/emilk/egui/issues/8657) and
+  [#8428](https://github.com/emilk/egui/pull/8428) inform the clipboard/PRIMARY matrix;
+  [#8577](https://github.com/emilk/egui/pull/8577) informs logical-text/bidi regressions.
+  Their status is evidence to inspect, not permission to assume a reported behavior is fixed.
+
+For a reproduced required workflow failure, a reviewed fork fix or tested app workaround is
+required. An explicit deferral records an unresolved rollout gate; it is not a passing result.
+
+## Platform evidence, review and rollback
+
+Each app's required gates include its existing fmt/lints/tests/assets/layers/wasm commands plus
+selected feature checks that default CI misses. Record actual selected test counts and failures.
+Linux covers native X11 and Wayland with compositor identity; Windows uses a uniquely owned
+baseline clone and visible edited/saved/reopened workflows. Browser workflows must run, not merely
+compile to wasm. macOS IME, Metal/GL, keyboard layouts and native termination need real macOS
+evidence; cross-compilation is not acceptance. FreeBSD/Android rows follow the app's support claims.
+Unavailable environments remain explicit rollout blockers, not implicit passes.
+
+Current readiness and allocation plan (recheck immediately before each wave):
+
+| Wave/environment | Current evidence | Required preparation and capacity gate |
+|---|---|---|
+| Static planning | 19 owned checkouts; no tests/builds run | No build reservation needed; preserve review artifacts |
+| Shared/fork CPU and headless regressions | No qualified runtime yet | Estimate one baseline/candidate build's growth from dependencies, reserve through task.py, execute sequentially and preserve paired binaries; defaults do not fit current capacity |
+| Linux X11 | No inherited DISPLAY; Xvfb/window manager absent at inspection | Provision an isolated display/window manager, record versions and qualify native focus/clipboard; label virtual-display/software results accurately |
+| Linux Wayland | No inherited WAYLAND_DISPLAY; Weston/Sway/KWin absent | Provision the compositor/input-method environments required by the matrix; qualify keyboard/IME/PRIMARY protocol behavior and identify unsupported capabilities |
+| Linux GPU | Parent can access i915 8086:3E96 renderD128; worker sandbox may hide it | Managed renderer/device probe must identify actual driver/backend; access alone is not GPU acceptance |
+| Windows | Sealed baseline uses Basic Render Driver; 128 GiB default clone cannot currently fit | Estimate guest source/build/evidence growth; allocate a unique full clone if capacity permits or a baseline-backed overlay with an adequate reservation (at least 10 GiB); otherwise block this wave |
+| Browser | Wasm compile is not runtime evidence | Provision/pin browser and WebGPU/WebGL backend; run interactive fixtures and record browser/adapter identity |
+| macOS and physical Windows/audio | No qualified environment in this task | Obtain real platform access and owned execution/evidence before those gates pass; software VM results do not qualify these rows |
+
+The allocator snapshot had about 23.6 GiB and 37.7 GiB allocatable on the two separate drives;
+they cannot be combined for one target. Overlay creation is already authorized by the standing
+workflow; its budget must cover expected growth, not merely the minimum. Per-wave reservations
+are set from that estimate and current capacity before submission. Do not invent a fixed small
+budget now to claim all platform gates are ready.
+
+All new host tests/builds and owned-VM commands use the managed run/status/finish workflow.
+Keep exact source, evidence and resource identities; export logs, screenshots, fixtures, hashes,
+source patches and deliverables before cleanup. No existing job/VM is adopted or stopped.
+
+Schedule builds and VMs from current allocator capacity, not from the number of available review
+workers. At planning inspection, both drives together had less than one default 64 GiB host-build
+reservation available after existing reservations. Before each validation wave, inspect capacity
+and budget each owned task from its expected growth; do not lower an estimate simply to pass the
+guard. Start only the workloads that fit, retain paired baseline/candidate executables outside
+disposable targets, and finish a resource only after its required reviews and evidence are complete.
+Use a smaller reservation only for a demonstrably smaller workload. Resize before substantial
+growth. If a required build or clone cannot fit, preserve its records and report the capacity gate;
+do not reclaim another task, move an active allocation or bypass the allocator. Keep performance
+measurement sequential even when correctness builds can safely run concurrently.
+
+Every plan and every implementation gets a new independent reviewer with a bounded assignment.
+Reviewers inspect source, tests, dependency identities and negative cases; a passing build or an
+author's own checklist is insufficient. Track finding, severity, evidence, resolution, recheck and
+reviewed hash. No unresolved correctness finding is silently downgraded to a future task.
+
+The authoritative ledger records all 19 repository plans plus this suite document separately:
+current hash, review-request ID, reviewed hash, verdict, finding resolutions and fresh closure
+review. Preserve earlier drafts and reports. A changed document invalidates its earlier approval;
+implementation remains blocked until all 20 current documents have accepted reviews and their
+documentation PRs have landed. The evidence copy of the ledger is a synchronized snapshot.
+
+Rollback restores the entire previous coherent manifests/lockfiles/source set, not just an egui
+version string. Keep prior dependency revisions reachable. Avoid persistence format changes for
+this upgrade; if one is necessary, specify backward compatibility and preserve unreadable data.
+Do not release a mixed suite dependency graph or delete old source/evidence during cache cleanup.
+At each dependency/app integration stage, rehearse restoration of the previous coherent source,
+lockfiles and settings using preserved source refs and the baseline executable. Reopen the saved
+fixture and verify the old behavior before accepting the stage. If rebuilding is necessary, use
+a separate managed allocation. Keep the old executable/source identities reachable through the
+rollback window; restoring only an old lockfile does not constitute the rehearsal.
+
+
+## Local implementation clarification — 2026-10-23
+
+The user explicitly corrected the publication-first workflow: all reviewed plans stay local while implementation proceeds. Published dependency reachability remains a release requirement, not a condition for local prototypes, source ports, tests or reviews. Local development may use isolated candidate worktrees and explicit local Cargo patches; no machine-local path enters a publication draft.
+
+Canonical integration sources were refreshed for all19 repositories; sixteen advanced by220 commits in total. See the task evidence `REMOTE-REFRESH-SUMMARY.json`, canonical ref/diff snapshots and the per-repository local-update appendices. Keep the original review source refs for historical comparison. Current-main paired measurements must use refreshed integration sources so unrelated security/performance work is not attributed to the toolkit migration.
diff --git a/docs/language-testing.md b/docs/language-testing.md
new file mode 100644
index 00000000..84fe9b9b
--- /dev/null
+++ b/docs/language-testing.md
@@ -0,0 +1,135 @@
+# Language testing per release
+
+A manual checklist for each app release: input methods, keyboard layouts and screen readers on
+real systems. Copy it into the release issue and tick each item; for a failure, note the system,
+its version and what happened instead, and open an issue.
+
+Run every input item in two places: a single-line text field (a rename or search field) and the
+app's canvas text tool, if it has one. "Commits" means the text appears in the field as ordinary
+text, once, at the caret, with the composition underline gone.
+
+## What is automated
+
+Leave these to the automated tests; repeat them by hand only to investigate a failure.
+
+| Automated | Where |
+|---|---|
+| Linux input methods on this box: fcitx5 on Xvfb (XIM), fcitx5 on headless sway (text-input-v3) and IBus on Xvfb; Pinyin, Hangul, Telex and Anthy compositions, a click into a composing field, a pointer unplugged while composing | [IME harness](https://github.com/storytold/craft-libs/pull/212), `tools/ime-harness/` |
+| Each app's key screens in Arabic, Japanese, Traditional Chinese, Korean, Thai and Vietnamese with no system fonts; one scripted IME composition and one non-Latin shortcut per app | `craft_ui::testing` ([craft-ui README](../crates/ui/README.md#testing-screens-in-each-language)) |
+| The shortcut rule for Russian, Arabic 101, Hebrew, Greek, Thai, AZERTY, Dvorak and QWERTZ presses as egui reports them | craft-keymap's tests |
+
+The manual list covers what those can't reach: the input methods and layouts of Windows and
+macOS, desktop Linux sessions, the browser on phones, and screen readers.
+
+## Release
+
+- App and version:
+- Tester and date:
+- Builds tested (Windows, macOS, Linux, Flatpak, FreeBSD, web):
+
+## Windows
+
+- [ ] **Microsoft Pinyin.** Type `nihao`, then Space. The candidate window opens at the caret;
+      你好 commits. Type `nihao` and press Enter: `nihao` commits as Latin text.
+- [ ] **Microsoft Japanese IME.** Type `nihongo`, then Space. にほんご converts to 日本語 with
+      the converted segment underlined; Enter commits 日本語. Type `nihongo` again and press
+      Escape twice: the composition is removed, nothing is inserted, and the dialog or panel stays
+      open.
+- [ ] **Microsoft Korean IME** (2-Set). Switch with the Han/Eng key or Right Alt. Type `gksrmf`:
+      the syllables build in place and 한글 commits. While composing 한, Backspace leaves 하.
+      Press Enter after a syllable: the syllable commits and the field does not also submit; a
+      second Enter does.
+- [ ] **Sogou Pinyin.** Type `zhongguo`, then Space: 中国 commits, with Sogou's candidate bar at
+      the caret. In Chinese mode, `,` types the full-width `，`.
+- [ ] **UniKey** (Telex). Type `Vieejt Nam`: Việt Nam commits with no doubled or missing letters.
+      Type `tieesng` in the canvas text tool: tiếng.
+- [ ] **Emoji panel.** Press Win+. and pick 😀: it is inserted once, at the caret. Pick a second
+      emoji with the panel still open: it follows the first.
+- [ ] **AltGr layouts.** On German, AltGr+Q types `@` and AltGr+E types `€`; on Polish
+      (programmer's), AltGr+A types `ą`. None of these runs a Ctrl+Alt shortcut.
+- [ ] **US-International dead keys.** Type `'` then `e`: é. Type `'` then Space: `'`.
+
+## macOS
+
+- [ ] **Pinyin – Simplified.** Type `nihao`, then Space: the candidate window opens at the caret
+      and 你好 commits.
+- [ ] **Japanese – Romaji (Kotoeri).** Type `nihongo`, then Space: 日本語 is shown with the
+      active segment underlined more thickly; Return commits. Escape during a composition cancels
+      it without closing the dialog.
+- [ ] **2-Set Korean.** Type `gksrmf`: 한글 builds in place and commits. Return after a syllable
+      commits it without submitting the field; a second Return submits.
+- [ ] **Press and hold.** Hold `e`: the accent menu opens at the caret; press `2`: é replaces the
+      e. The plain `e` is not left behind.
+- [ ] **Dead keys** (U.S. layout). Option+E then `e`: é. Option+U then `u`: ü. Option+N then `n`:
+      ñ. The pending accent shows as marked text until the second key.
+- [ ] **Character Viewer.** Press Ctrl+Cmd+Space and pick 😀: it is inserted once, at the caret.
+- [ ] **Dictation.** Start dictation (press Fn twice, or the microphone key) and say a short
+      sentence: interim text appears at the caret; stopping dictation leaves the sentence once.
+
+## Linux
+
+- [ ] **GNOME with IBus** (Wayland session). With ibus-libpinyin, `nihao` Space: 你好. With
+      ibus-hangul, `gksrmf`: 한글. With ibus-mozc or ibus-anthy, `nihongo` Space Enter: 日本語.
+      The candidate popup opens at the caret.
+- [ ] **KDE Plasma with Fcitx5** (Wayland session). The same three compositions through
+      fcitx5-chinese-addons, fcitx5-hangul and fcitx5-mozc. The preedit shows in the field while
+      composing (designcraft#1234).
+- [ ] **Hyprland with Fcitx5.** The same three compositions; the candidate popup follows the
+      caret when the caret moves to a second line.
+- [ ] **X11 with Vietnamese Telex.** In an X11 session with fcitx5-unikey or ibus-unikey, type
+      `tieesng Vieejt`: tiếng Việt, with no doubled letters.
+- [ ] **One Flatpak build.** Install the app's Flatpak and repeat one composition (Pinyin or
+      Hangul) through the host's input method. Switch the UI to Japanese and to Arabic: every label
+      draws without boxes, with only the runtime's fonts.
+
+## FreeBSD (once per release cycle)
+
+- [ ] Build and start the app. Under X11 with fcitx5 or IBus, compose `nihao` → 你好 and
+      `gksrmf` → 한글. Switch the UI to Arabic: labels join and run right to left.
+
+## Web
+
+- [ ] **Android, Chrome, Gboard.** Type `hello wrold` with suggestions on: the composing word is
+      underlined, and the autocorrected `world` replaces it without duplicating text. Backspace
+      deletes one character at a time. Switch Gboard to Korean and type 한글: syllables build in
+      place.
+- [ ] **iOS, Safari, Korean keyboard.** Type 한글: syllables build in place with no doubled jamo;
+      tapping elsewhere in the text commits the syllable and moves the caret there.
+
+## Keyboard shortcuts on other layouts
+
+For each layout, run Copy, Paste, Undo, Select All and Save from the keyboard, and the shortcuts
+named below. Each should run the same command it runs on US QWERTY, and the menus should show the
+shortcut as listed. On macOS read Ctrl as Cmd.
+
+- [ ] **Russian.** Ctrl on the C, V, Z, A and S keys (с, м, я, ф, ы) copies, pastes, undoes,
+      selects all and saves. The menu shows Ctrl+[ as Ctrl+Х.
+- [ ] **Arabic 101.** Ctrl on the C, V, Z, A and S keys (ؤ, ر, ئ, ش, س) runs the same commands.
+- [ ] **Hebrew.** Ctrl on the C, V, Z, A and S keys (ב, ה, ז, ש, ד) runs the same commands. Ctrl on
+      the Q key, which types `/`, runs the Ctrl+Q command, not Ctrl+/.
+- [ ] **Greek.** Ctrl on the C, V, Z, A and S keys (ψ, ω, ζ, α, σ) runs the same commands. In a
+      text field, `;` then `α` types ά.
+- [ ] **Thai** (Kedmanee). Ctrl on the C, V, Z, A and S keys (แ, อ, ผ, ฟ, ห) runs the same
+      commands. Ctrl on the 1 key, which types ๅ, runs Ctrl+1.
+- [ ] **AZERTY** (French). Ctrl+A and Ctrl+Z are the keys labelled A and Z. Ctrl on the 1 key
+      (`&`) runs Ctrl+1. Ctrl on the 6 key (`-`) zooms out.
+- [ ] **Dvorak.** Ctrl+C, Ctrl+V and Ctrl+Z are the keys labelled C, V and Z. Ctrl on the QWERTY
+      Q position, which types `'`, does not run Ctrl+Q.
+- [ ] **QWERTZ** (German). Ctrl+Z undoes and Ctrl+Y redoes, on the keys labelled Z and Y. Ctrl+⇧7
+      runs Ctrl+/. The menu shows Ctrl+[ as Ctrl+Ü.
+- [ ] **Dvorak – QWERTY ⌘** (macOS). Typing gives Dvorak letters. With Cmd held, the keys follow
+      QWERTY: Cmd on the QWERTY C position copies, and the menus show ⌘C.
+
+## Screen readers
+
+Run each with the UI in English, then in Arabic. In Arabic, use a voice that reads Arabic.
+
+- [ ] **NVDA** (Windows). Tab through the main window and one dialog: each control is announced
+      with its name and role, in the UI language, in the order it appears (right to left in
+      Arabic). In a text field, typed characters are echoed and arrow keys read the character
+      passed over. An Arabic file name in an English UI is read in Arabic.
+- [ ] **VoiceOver** (macOS). Move with VO+Right through the toolbar and a dialog: names and roles
+      in the UI language, in reading order. The rotor lists the form controls. Composing Hangul in
+      a text field is announced once, when it commits.
+- [ ] **Orca** (Linux, GNOME). Tab through the main window and one dialog: names and roles are
+      read in the UI language. Focus moves visibly with each announcement.
diff --git a/docs/theme-infrastructure.md b/docs/theme-infrastructure.md
index 1c4aabba..78b1b566 100644
--- a/docs/theme-infrastructure.md
+++ b/docs/theme-infrastructure.md
@@ -93,7 +93,9 @@ locale handling and fallback order: PhotoCraft uses its text and preference crat
 uses `vectorcraft_text`; DesignCraft and WordCraft use their font crates; PdfCraft adds script
 and system fallback; LightCraft uses its engine catalog; FilmCraft and EffectCraft use their text
 crates and local font discovery. DesignCraft also configures named Arabic shaping families.
-These dependencies and font assets stay outside `craft-ui`.
+Those dependencies and the font files stay in the apps. What they had in common, the fallback
+order and the system-font fallback, is `craft_ui::fonts` (see the
+[craft-ui README](../crates/ui/README.md#ui-fonts)); each app hands it the faces it embeds.
 
 Theme references occur throughout panels, menus and tools, with local visual/spacing overrides
 in every app. A source search alone cannot turn this into a percentage of correctly themed UI:
@@ -128,7 +130,7 @@ Examples worth preserving or reviewing separately:
   customize backgrounds and slider widths.
 
 This extraction preserves those choices. It does not certify whole-app accessibility or theme
-consistency, and it does not move font installation into the shared crate.
+consistency. Font installation is separate from theme application: `craft_ui::fonts` handles it.
 
 ## Migration and validation
 
diff --git a/docs/ui-docking.md b/docs/ui-docking.md
index 82324509..6ff2ee8e 100644
--- a/docs/ui-docking.md
+++ b/docs/ui-docking.md
@@ -1,151 +1,804 @@
 # Panel docking
 
-`craft_ui::docking` lets an application move the same panel between docked tabs, side splits and
-floating groups. The shared layer owns placement and interaction; the application owns each
-panel's contents, commands, document state and persistence policy.
+`craft_ui::docking` lets the user arrange an app's panels: tab groups, docks with columns,
+splits, floating windows and iconic columns. craft-ui owns the layout model, the renderer and the
+gestures. The app owns panel contents, commands, document state and where layouts are saved.
 
-## Model and transactions
+Office apps that draw their own document with a few task panes beside it use
+[`craft_ui::panes`](ui-panes.md) instead.
 
-`Layout<P>` contains an optional root `Node<P>` and floating tab groups. A node can be:
+## Arrangements
 
-- `Tabs`: ordered panel identities with one active index.
-- `Split`: horizontal or vertical children, with a ratio or fixed first/second size.
-- `Stack`: accordion entries with individual open state and optional content height.
+One model serves every app. What differs between apps is the default layout and a few
+`DockStyle` settings. An app builds its style with `DockStyle::from_ui`, `from_visuals` or
+`default` and then sets fields; new fields can be added, so the struct has no literal form
+outside the crate.
 
-Choose a stable, nonlocalized panel ID type implementing `Clone + Eq + Hash`. Rendering also
-requires `Debug + Send + Sync + 'static`. A panel identity occurs at most once in the layout.
-Keep transient document/sequence tabs separate when they represent documents inside one panel.
+| Arrangement | Layout | Style settings | Apps |
+|---|---|---|---|
+| Docks beside a canvas (the defaults) | `Node::Dock`s on the window's start and end edges. A dock has columns; a column has stacked groups and can collapse to icons. Frames (tab groups and splits) fill the space between the docks. | `new_dock_zones` on | Creative apps with a canvas and panel docks |
+| A split tree of tab groups | `Split`s and `Tabs` only. | `side_edge_zones`, `maximize_item`, `close_others_item`, `command_press_floats`, `float_hint`, `wheel_selects_tabs`, `middle_click_closes_tabs` on, `new_dock_zones`, `float_on_empty_drop` and `title_bar_docks` off; menu labels such as "Undock Panel" set on `float_label`, `float_group_label` and `close_group_label` | Apps whose whole window is frames |
+
+Sides are logical: `Side::Start` is the left edge, or the right edge when
+`DockStyle::right_to_left` is set. egui has no app-wide direction, so the app sets it from its
+locale. Right to left, tab strips also mirror: the first tab is rightmost, the group header and
+drag bar are at the left, and drop insertion slots follow. Accordion headers and floating title
+bars (`chrome::TitleBar`, through `ChromeStyle::right_to_left`) mirror too. Frame splits keep
+their sides.
+
+## Model
+
+`Layout<P>` holds an optional root `Node<P>` and a list of `Floating` windows.
+
+| Node | Holds |
+|---|---|
+| `Tabs` | A tab group: panels and the active index. |
+| `Split` | Two children, horizontal or vertical, and a size: a ratio, a fixed first size or a fixed second size. A moved divider keeps the mode: a fixed side stores its new size in points, a ratio its new ratio. |
+| `Stack` | Accordion entries, each open or closed, with an optional height. |
+| `Dock` | A side and its columns. A `Column` has `Group`s, a width, and `iconic`. |
+
+A `Floating` window holds a tree like the docked layout's (`root`: splits, tab groups and
+accordions, no docks), a rect, an optional native-window rect with the monitor it is on, and
+`minimized`. Its `id` names the window across panel moves (see [Native windows](#native-windows)).
+`Floating::single` makes a window with one group, `Floating::new` one with a tree, and
+`Floating::stack` one with groups stacked top to bottom (a vertical split sized by the groups'
+heights, as an app's own stacked layouts migrate); `panels()` and `contains()` read it. Each of
+these calls makes a new window with a fresh `id`. Build a layout once and keep it, or give its
+windows ids with `with_id`: a layout built anew each frame, as an unsaved default layout might
+be, otherwise opens new OS windows each frame and loses their drags and places. Debug builds log
+a warning when native windows are replaced by new ones with the same panels three frames running. Saved layouts keep loading: a window stored as one group (v1) or as a
+stack of groups loads as that group or as a vertical split of the stacked groups, sized by their
+heights.
+
+`P` is the app's panel id: stable, not localized, `Clone + Eq + Hash`. The renderer also needs
+`Debug + Send + Sync + 'static`. A panel occurs at most once in a layout.
+
+Change a layout only through `Action`s:
 
 ```rust
 use craft_ui::docking::{Action, Floating, Layout, Node, Placement};
 
 let mut layout = Layout {
     root: Some(Node::Tabs { panels: vec!["layers", "properties"], active: 0 }),
-    floating: vec![Floating {
-        panels: vec!["brushes"], active: 0, rect: [40.0, 80.0, 240.0, 300.0],
-    }],
+    floating: vec![Floating::single(vec!["brushes"], 0, [40.0, 80.0, 240.0, 300.0]).with_id(1)],
 };
 layout.apply(Action::Move {
-    panel: "brushes", anchor: "layers",
+    panel: "brushes",
+    anchor: "layers",
     placement: Placement::Tab { before: Some("properties") },
 })?;
 # Ok::<(), craft_ui::docking::DockError>(())
 ```
 
-Every transaction validates the original layout before cloning or recursive mutation. It checks
-the resulting layout before replacing the original. Missing or self targets, duplicate IDs,
-invalid active indices, excessive depth/count and invalid geometry return `DockError`; they do
-not remove the source panel. Tab removals retain the selected panel by identity when possible.
-Empty source groups collapse. Moving within an accordion preserves its entry state and height;
-unaffected split sizing and accordion entries remain unchanged.
+- `Move`, `MovePanel`, `Float` and `Close` act on one panel. `MoveGroup`, `MoveColumn` and
+  `MoveWindow` move a group, a dock column or a floating window, named by any panel in it.
+- `Open` reveals an absent panel as the last tab of its `anchor`'s group. Without an anchor it
+  becomes the root of an empty layout, else joins the first dock group that accepts tabs and is
+  shown, not minimized or in an iconic column (the end-side dock's first), else gets a new frame a quarter wide at the right edge of the docked
+  area. `OpenAt` takes any placement.
+- A `Target` is `At { anchor, placement }`, `Float { rect }` or `NewDock { side }`.
+- A `Placement` is a tab position, a split zone, a new group above or below (with an optional
+  preferred `height`), a new column, or a new frame on an outer edge.
+- Containers take different placements: a dock column takes groups and columns, not splits.
+  `Placement::for_zone(layout, anchor, zone, right_to_left)` maps a left, right, top, bottom or
+  center zone onto what the anchor's container takes: a split in the frame tree, a new column on
+  that side or a new group above or below in a dock. A floating window takes splits as the
+  docked layout does; `Placement::Group` on a floating anchor splits its group above or below.
+- A side split zone puts what moves in a new half-size split of the anchor's frame, and no
+  other frame changes size. The new split has its own divider. `Placement::SplitSized` sizes
+  that split instead (`size`) and resizes the enclosing split whose divider runs along the
+  anchor frame's side (`outer`), so the frames beyond that divider give the new frame its room.
+- Other actions select, minimize, collapse to icons, resize splits (`ResizeSplit` in the docked
+  layout, `ResizeWindowSplit` in the floating window holding a panel), columns and groups, and
+  move a floating window to its own OS window (`SetNative`, and `SetMonitor` for the monitor it
+  is on, feature `native-windows`).
+- A move between windows (docked to floating, floating to floating) is one action, checked as a
+  whole like any other.
 
-`OpenAt` adds a currently absent registered panel at an explicit tab or side destination. `Open`
-is the simpler group-reveal operation. Registry checks remain app-owned: the shared model cannot
-know whether an ID names an actual panel or whether its content is supported by the application.
+Every action checks the whole result before it commits. A bad target, a duplicate id, a stale
+split path or invalid geometry returns a `DockError` and leaves the layout unchanged. The source
+panel is never lost. `apply`, `apply_with_permissions` and `apply_all` return the panels the
+actions closed, so the app can release their state; `closed_by` lists them before applying.
 
-Use `apply_with_permissions` to prevent moving/closing a document canvas or merging a panel into
-it. `Permissions::PROTECTED` disallows these operations while allowing side splits around it.
-An app that requires a permanently docked panel also checks that policy before accepting a
-transaction; an empty shared root is valid when all panels float.
+`Permissions` limit what may happen to a panel: `movable`, `floatable`, `closable`,
+`accepts_tabs` and `accepts_splits`. `apply_with_permissions` enforces them for every action,
+whoever issues it. `Permissions::PROTECTED` keeps a canvas docked and open and takes neither tabs
+nor side splits; a group dropped on it floats there. An app that opens panels beside its canvas
+uses `Permissions { accepts_splits: true, ..Permissions::PROTECTED }`.
 
-## Rendering and interaction
+## Workspace
 
-Existing renderers can convert their layout into the shared model for transactions and retain
-their own panel chrome. `DropTarget` describes visible body/tab rectangles and whether a group
-accepts tabs or splits. Supply targets back-to-front, including floating-window layer order.
-`resolve_drop` returns a tab insertion or side/center placement and its preview rectangle.
-The frontmost containing group blocks targets underneath even when it rejects a drop.
+`Workspace<P>` is what an app saves: the layout, the hidden panels with where each one goes back,
+an optional saved arrangement for Reset, and `locked`.
 
-The optional `DockArea` renderer handles tab fitting and overflow, drag/drop previews,
-Escape/focus-loss cancellation, split/accordion dividers and floating-group resize grips. It renders a
-snapshot and returns `DockOutput.actions`; apply them through the application's command path.
-With `serde` enabled, `Action` also serializes so pointer, keyboard and control-channel requests
-can share that command path, including splitter changes, tab reorder and floating bounds.
-Panel body callbacks receive stable global egui IDs, so moving a panel does not reset its widget
-memory. The application should still keep durable panel/document data outside transient egui
-widget memory.
+| Method | Does |
+|---|---|
+| `apply`, `apply_all` | Apply actions all or none, with the app's permissions. Closed panels are recorded in `hidden`. While `locked`, moving, floating and closing are refused; `SetNative`, which records the OS windows, still applies. |
+| `set_visible(panel, visible, fallback, permissions)` | Hide a panel that may close, or show it at its recorded place, else as `Open` beside `fallback`, or where `Open` without an anchor puts it. A group or window closed one panel at a time comes back as one group as its panels are shown again. |
+| `reconcile(registered, permissions, default)` | Fit a loaded workspace to the panels the app has now. Unknown panels move to `hidden`, so they come back when registered again. A registered panel that cannot close, such as the canvas, is always shown. |
+| `reset(default)` | Return to the saved arrangement, or to `default` for a built-in workspace. |
+| `validate` | Check a loaded workspace before use. |
 
-`DockStyle` supplies colors, font, spacing and localized action labels. `show_with_limits` also
-accepts per-panel minimum/maximum sizes. Visible geometry clamps to the available area; a narrow
-viewport relaxes minima proportionally. Persisted preferred sizes are unchanged by this drawing
-clamp. A divider gesture produces an explicit resize action.
+With the `serde` feature, `Workspace`, `Layout` and `Action` serialize. Files without a version
+are v1 and load unchanged. craft-ui does not choose where files go; the app does.
 
-Use `begin_drag` with the same area ID to carry an existing tab/header gesture into `DockArea`
-when an app switches from its default arrangement to a customizable workspace.
+## Rendering
 
-Floating groups are egui areas in one viewport. Native child windows, cross-viewport drag
-transport, OS window ownership and multi-monitor coordinate conversion remain the host's
-responsibility. The model does not instantiate or reparent native windows.
+`DockArea::new(id).show_content(ui, &layout, &style, &mut content)` draws a layout snapshot and
+returns a `DockOutput`. It does not change the layout. The app applies `output.actions` through
+its own command path, so pointer, keyboard and control commands share one path.
 
-## Persistence and visibility
+`DockContent<P>` is the app's adapter. It draws each panel body and gives its label, icon,
+permissions, size limits, dock column heights, preferred floating size, panel menu and group header. The group header
+sits at the end of the tab strip; `group_header_width` gets the strip width, so a header that
+draws its own tabs can size them to the room left. Extra tabs (`group_extra_tabs_width` and
+`group_extra_tabs`) sit right after the group's panel tabs, before the drag bar, and fit with
+them: both shrink widest first to `min_tab_width`, the extra tabs as one tab, and in a row
+narrower still the panel tabs overflow while the extra tabs keep that width. The host fits its
+own tabs into the rect it gets. An icon is an image (`icon`), or drawn in code by `paint_icon`, which
+gets a painter, the icon rect and the tint color and returns true when it painted. Panel bodies keep a stable egui id when they move, so widget memory
+survives.
 
-Enable `craft-ui`'s optional `serde` feature to serialize the shared model, or retain an existing
-schema through an adapter. The serialization feature does not choose a filesystem location or
-write preferences. Applications validate panel IDs, payload size and schema version before
-committing loaded state. Bound recursive deserialization/conversion in the app as well as using
-`Layout::validate`; the validator cannot retroactively protect an unbounded parser.
+`DockOutput` also has:
 
-To hide a panel without forgetting its placement, capture `Layout::location`, then close it.
-Keep the resulting `Location` with the app's visibility state. `restore` uses stable neighbor
-IDs, restores captured fixed sizing/floating bounds and recreates a previously closed accordion
-group. If a neighbor was removed, it returns an unchanged layout and `MissingTarget`; choose an
-explicit fallback such as a default side or remembered floating rectangle. Restoring multiple
-panels closed from the same group in reverse close order preserves neighbor relationships.
+- `focused`: the panel the user focused this frame: a clicked tab, a drop, or a press of any
+  pointer button in a panel body (protected panels included) or in the group header,
+  which focuses the group's shown panel. Commands, `raise_panel` and
+  workspace resets never set it; a host that tracks the last focused panel clears it when a reset
+  or command hides, closes or moves that panel.
+- `events`: requests outside the layout, such as `DockEvent::ToggleMaximize` (`maximize_item`) and
+  `DockEvent::ToggleAutoCollapse` and `DockEvent::FlyoutChanged { panel }` (docks): the
+  flyout opened, switched or closed (`None`). It comes once per change, whatever made it: an
+  icon, Escape, a press outside, a raised panel, `open_flyout` or `close_flyout`.
+- `error`: a rejected gesture.
 
-## Acceptance
+Builder options on `DockArea`:
 
-The shared tests cover lossless moves, tab reorder, stale targets, atomic errors, protected
-canvases, accordion state, fixed sizing, hidden-panel restoration, bounded malformed layouts,
-and a deterministic sequence of 800 panel moves. Pointer tests exercise dragging a floating
-panel into the main tab strip and canceling a drag.
+| Option | Use |
+|---|---|
+| `maximized(panel)` | Maximize Frame: that frame fills the area. |
+| `hide_panels(HidePanels)` | Hide panels for Tab and Shift+Tab. Protected panels stay. |
+| `auto_collapse_iconic(on)` | Close a flyout on Escape or a click outside (default on). |
+| `raise_panel(panel)` | Raise a panel's floating window, or open its flyout, this frame. It moves no keyboard focus and does not set `DockOutput::focused`. |
+| `locked(on)` | Draw `Workspace::locked`: every panel gets `Permissions::locked`, so nothing starts a move, float or close the workspace would refuse. |
+| `blocked_rects(rects)` | App overlays that docking gestures must ignore. |
+| `float_bounds(rect)` | Where floating windows, flyouts and drag ghosts may go (default: the whole viewport). Pass the viewport below a title bar drawn under a transparent OS title bar, so no floating window sits where a press moves the app window. |
 
-`tests/docking_workflows.rs` renders a document and populated Layers/Properties/Brushes panels,
-then uses actual pointer events to merge, detach and redock Brushes. It checks retained values
-and widget identity at two widths, two display scales and both egui themes. To retain captures:
+`DockStyle::close_menu_items` and `DockStyle::close_button` hide the built-in Close menu items
+and the floating window ×. They hide controls only: a panel that stays `closable` still closes
+by the app's own Close items and commands.
+
+`DockArea::chrome_has_focus` tells whether keyboard focus is on docking chrome (any control a
+`Hit` names) rather than on a panel body. Focus follows only the user's input: a tab keeps keyboard focus until a command or a
+workspace reset hides, closes or moves its panel, and then gives it up. A divider or a floating
+window's resize grip holds focus only while the pointer drags it, so the app's shortcuts and
+canvas arrow keys work right after; one reached with Tab or F6 keeps its focus, and arrow keys
+resize it. Hovering focuses nothing. `begin_drag` hands a drag that started in the app's own chrome to the area.
+`docking::chrome` has the floating frame, the title bar and `drop_preview` (the drag ghost
+and region preview docking and `craft_ui::panes` both draw) for apps that draw their own windows.
+
+## Tab strips
+
+Tabs start at their natural width, wide enough for the panel's name. When the strip is too
+narrow, the widest tabs shrink first, to a common width; tabs whose names fit that width keep
+their natural width. A tab narrower than its name cuts the name with "…" and shows it in full as a
+tooltip. Shrunk tabs keep their hit areas, drag and keyboard behaviour, and accessibility labels
+with the full names.
+
+No tab shrinks below `DockStyle::min_tab_width`: by default about three characters and the "…"
+plus the tab's padding, 54 pt at the 12 pt font. Only when the tabs at that width do not all fit
+do the rest go to the "…" button at the end of the strip, whose menu lists the hidden panels;
+choosing one makes it active. The active tab is always shown, in its logical place, and the
+others take the remaining room in their order. An active tab with less room than its minimum
+width, or a lone tab wider than the strip, is cut the same way. The drag bar always keeps its
+reserved width: tabs shrink, then overflow, before it narrows, and only a strip narrower than the
+group header plus the bar shrinks it. A tab dropped on the "…" button goes to the end of the group.
+
+## Floating size
+
+A panel or group floated by a drag, a menu or a command without a rect takes its content height:
+the title bar, the tab strip and the height the active panel's content used when it was last
+drawn (the content ui's `min_rect`), at least 120 points. The most it takes is the height of
+`DockContent::floating_size`, or 320 points for a panel leaving a dock or frame and a group
+leaving a dock. A short panel therefore floats as a short window. Content that reaches the bottom
+of its body (a panel that allocates its whole rect) has no height of its own: it floats at the
+`floating_size` height, else at 320 points. A panel's width is its `floating_size` width, else
+its docked width; a group keeps its docked width.
+A flyout fits its content the same way, without the title bar.
+
+- A panel the area has not drawn floats at the `floating_size` height, else the docked height
+  capped at 320, or at a `FloatSpace::with_panel_size` size for commands.
+- A group from a frame without a `floating_size` keeps its frame size. A dock column of several
+  groups floats at the tallest `floating_size` height, else its column height capped at 320.
+- A rect from a command and a window the user resized keep their size; floating windows are not
+  refitted while open.
+- Docked layout does not change: a column's last group still fills the column.
+
+## Gestures
+
+- A tab drags one panel. A group's drag bar (the space beside its tabs) or its top border drags
+  the whole group. A column bar drags a column. A floating window's title bar drags the window;
+  with `title_bar_docks` a release over a target docks the whole window there, else it only
+  moves. While the drag highlights a drop target, the window is drawn at 75% opacity so the
+  target shows through it; over empty space, and once the drag ends, it is opaque. A native
+  window moved by its only tab or tab row fades the same way.
+- Inside a floating window, tabs and drag bars drag and dock as they do in the docked layout,
+  into any window. A drag bar or border of a window's only group takes the whole window along,
+  so, like the title bar, it looks through the window: the groups, docks and windows behind it
+  take the drop while the pointer is still inside it. In a window of several groups, the other
+  groups stay targets. Its groups split, join and resize like frames, with dividers and four-way
+  handles (`Divider::WindowSplit` and `Divider::WindowIntersection`, named by the window's first
+  panel). Double-clicking the title bar minimizes the window to its title bar, or to the tab strip
+  of its only group; so does double-clicking that group's strip. The group menu's float item
+  floats one group of a window that has several. Closing the window closes its panels; each
+  reopens where it was while the window or its neighbour in it is open, else in a window at the
+  window's last rect.
+- A movable floating window resizes from every edge and corner. The top edge and corners are a
+  4 pt band above the title bar (`chrome::RESIZE_BAND`), so they take no moves and no clicks on
+  the title bar's buttons. A resize keeps the opposite edges in place and stays within the size
+  limits and the screen. A focused resize handle moves its edge 8 pt per arrow key.
+- Over a group (a frame, a dock column's group or a floating group), the pointer's place
+  decides:
+  - The tab strip joins the group's tabs at the insertion slot under the pointer.
+  - In the body below the strip, the outer `DockStyle::side_zone_fraction` (one third) of its
+    width from the left or right edge, or of its height from the top or bottom edge, docks
+    beside the group on that side. Where two sides meet, at a corner, the side the pointer is
+    relatively nearer wins.
+  - The middle third joins the group's tabs.
+  - A group that takes no tabs, such as a protected canvas, takes nothing on its strip, and its
+    body has no middle: every point docks beside it on the relatively nearest side.
+  - In the docking profile (`new_dock_zones` without `side_edge_zones`), the body of a frame or
+    floating group that takes no tabs takes nothing, whatever its `accepts_splits`: a release
+    there is a release over no target, so a floating window stays floating and a docked panel
+    or group floats as `float_on_empty_drop` says. Only the bands along borders (below) dock
+    beside it, as in Adobe apps, whose document area is no drop zone. A dock column's group
+    keeps its sides.
+- Beside a frame is a split of that frame. Beside a group in a dock column, the top and bottom
+  stack a new group above or below it, and the left and right make a new column on that side.
+  A group dragged to an edge of its own column, such as the window edge of the column it heads,
+  makes a new column there, as one of its tabs would; when it is the column's only group,
+  nothing changes.
+- A frame too narrow or short for two halves of `DockStyle::min_pane` still splits when the
+  frames beyond it can give the room, as they do for a dragged divider. When they cannot, the
+  frame keeps its size and the new frame takes the width (or height) the moved panels have now,
+  at least its minimum, from the frames beyond the frame's divider on that side
+  (`Placement::SplitSized`). When those have no room either, that side joins the frame's tabs
+  instead, or takes nothing when the frame takes no tabs. The gap
+  between two frames is no target.
+- Bands along borders come before the group zones. Each is centred on its border where the
+  pointer can reach both sides:
+
+  | Band | Drop | Field (default) |
+  |---|---|---|
+  | The seam between two stacked groups of a dock column | A new group between them | `seam_band` (28 pt) |
+  | Each edge of a dock column | A new column on that side | `column_edge_band` (28 pt) |
+  | The docked area's left or right edge without a dock, and an empty dock | A new dock | `new_dock_band` (28 pt) |
+  | The edge area's top and bottom in `drop_edges` (all four sides with `side_edge_zones`) | A new frame along that whole side, a quarter of the edge area | `edge_band` (28 pt, 8 pt with `side_edge_zones`; at most a quarter of the edge area) |
+
+  Where a band overlaps a group's outer third, both mean the same side. Without
+  `side_edge_zones`, a band reaches only 4 pt past its line into a tab strip that takes tabs;
+  the rest of the strip joins. The outer
+  edge band is offered only when every frame keeps its minimum.
+- The edge area is the root, or the part between the docks. Without `side_edge_zones` it also
+  narrows to the canvas column: where neither side of a side-by-side split is a dock and only
+  one side holds a protected panel, that side. The top (bottom) band also narrows a split of
+  rows to its first (last) row when only that row holds the canvas, so a full-width row below
+  the canvas keeps the bottom band. Side panels in split frames then get no band across the
+  whole window, and the drop wraps only the canvas column. A drop on a narrowed band anchors
+  on the canvas, so `Placement::Edge` narrows the same way when applied; on a band that is not
+  narrowed it anchors on a panel that is not protected. The renderer tries the drop with its
+  own permissions and offers the band only when the drop wraps the panels the band shows.
+  `window.panel.dock` to an outer edge picks its anchor the same way, from the permissions
+  `apply` (or `to_actions`) gets and the area's `FloatSpace` (`with_side_edge_zones` before it
+  has drawn).
+- `DockStyle::drop_edges` (a `Sides`, all four by default) lists which sides of the layout's
+  outer edge, and of a group that takes no tabs (a canvas) without `new_dock_zones`, take a
+  drop. There a canvas's whole body goes to the nearest listed side; with none listed it takes
+  nothing. In the docking profile the canvas body takes no drop and the outer left and right
+  edges are new docks, so only the outer top and bottom apply. Groups that take tabs keep all
+  four sides. A dock-column app whose palettes dock only at the left
+  and right, as in AutoCAD, sets `Sides::NONE` with `new_dock_zones` on. Not used with
+  `side_edge_zones`.
+- With `side_edge_zones` (the split-tree arrangement), a frame's zones are a picture frame
+  instead: trapezoids along the four edges of the body below the tab strip, all four the same
+  depth, `docking::SIDE_EDGE_ZONE_DEPTH` (40 pt), or a quarter of the body's smaller side when
+  that is less, so every frame keeps a center. A dock column's groups take the same depth.
+  `drop_zone` and `resolve_drop` give these zones to hosts that draw their own frames.
+- A host that resolves drops over its own groups calls `resolve_drop_by` with
+  `DockStyle::zone_rule()`, so its zones and previews match the dock area's in either profile.
+  `resolve_drop` always gives the split-tree zones.
+- A dragged divider grows the frames that touch it on one side, up to their maximums. On the
+  other side the frame touching it shrinks to its minimum, then the next frame along the same
+  axis, and so on: the divider stops when every frame on that side is at its minimum. Frames
+  side by side across the axis shrink together, and the next frame gives way once one of them
+  is at its minimum. The line of frames ends at a split across the axis or at a dock; every
+  other frame keeps its size. Dividers between stacked panels and between the groups of a dock
+  column work the same way. Where a divider ends on another divider, a four-way handle
+  (`Divider::Intersection`) moves both.
+- Every frame has the same minimum, `DockStyle::min_pane` (plus its tab strip), unless its panels
+  ask for more through `PanelLimits::min`. Frames have no maximum unless every panel in them asks
+  for one through `PanelLimits::max`: a panel without a maximum lifts the maximum of the panels it
+  joins.
+- A dock column stacks its groups top to bottom. A minimized group shows only its tab strip, and a
+  group the user resized keeps that `Group::height`. A group the user never resized (`height` is
+  `None`) takes the default height its panels ask for through `DockContent::dock_heights`. Groups
+  whose panels ask for a `fill` height share the rest of the column, and groups whose panels ask
+  for no heights take their minimum. When no group asks for a fill, the groups without heights
+  share the rest, and when every open group has a height, the last one fills the column. In a short column the groups at their default give way first, down
+  to their `compact` heights, so the filling group gets its `fill` height. When the column is still
+  too short, every group gives way down to its minimum, and past that the column scrolls. Defaults
+  give way nearest the filling group first: one is at its compact height before the next gives
+  way. Towards the minimums, groups give way in proportion to their room. A group takes the
+  largest default, compact and fill height of its panels. All three are body heights, without
+  the tab strip, like `PanelLimits`.
+- Drop previews have four shapes, the same for tab and group drags:
+  - A drop beside something shows the rect the dragged panel, group or column will take, at its
+    real position and size, as a 2 pt accent outline with a light fill. The renderer applies
+    the drop to a copy of the layout and lays it out with the code that draws it, so the rect
+    is the one the panel's group gets on release: the new frame for a split (including
+    `Placement::SplitSized`), the new group for a stack above or below a dock group or on a
+    seam, and the whole column, bar included, for a new column between columns or beside a
+    dock group's side.
+  - A drop on a band along the layout's outer edge shows a `DockStyle::drop_line_width` (4 pt)
+    accent line along that edge: the new-dock band, the window edge of a dock's outermost
+    column, and the outer edge band (`Placement::Edge`), whose line spans the edge area it
+    wraps. A drop between the icon groups of an iconic column shows the same line there.
+  - A drop that joins a group shows the same outline and fill around the whole group, and on
+    its strip the 2 pt insertion marker.
+  - A drop that floats shows the floating rect.
+
+  A drop that would leave every panel where it is, changing only sizes, shows nothing and
+  changes nothing: a lone group dropped beside the group it already borders, or a frame's tab
+  on the layout edge the frame already holds. Split sizes, column widths, group heights and
+  window rectangles are not compared, and a run of splits along one axis is the same however
+  it nests.
+
+  A group drag also shows its ghost at the pointer. With `side_edge_zones`, a drag over a group
+  instead outlines each of its zones that a drop would change something in (the side
+  trapezoids, the center rectangle and the tab strip; `zone_shape` gives the outlines) and
+  fills the zone under the pointer. Sides the group does not take, by its permissions or
+  because a split leaves no room, are not drawn; nor is the center of the group a tab comes
+  from. A drop there that the zones do not show, such as the outer edge band, fills the region
+  it takes, and dock drops show the line along the edge they dock to. Escape or losing window focus cancels a drag.
+- A drag in progress (a tab, group, column, window bar, native window bar or divider, in any of
+  the app's windows) also ends when the layout passed to the area is not the one it drew last
+  frame, with or without its returned actions applied: the app switched workspaces, ran Reset
+  or changed the layout by command. Sizes and rectangles are not compared, so an app may clamp
+  a moved window or adjust a split during the drag. Nothing is restored from before the drag;
+  windows go where the new layout has them. `cancel_drag` ends the area's drags at any other
+  time. A native window moved by the compositor (`ViewportCommand::StartDrag`, as on Wayland)
+  is not the area's drag: it ends when the user releases the button. On macOS, where AppKit
+  moves a native window by its bar, a cancel ends the area's drag, so the release drops
+  nothing, but AppKit keeps moving the window until the release.
+- With `float_on_empty_drop`, a release over no target floats what moves at the pointer, such
+  as a panel dropped on a protected canvas. Without it, that release cancels the drag and
+  nothing moves: the gap between two groups, a menu bar or a status bar is no target. A release
+  outside the app window floats in both cases.
+- Ctrl (⌘ on macOS) held at the drop floats it wherever it lands. With `command_press_floats`,
+  the key held when a tab drag of a frame starts is enough. With `float_hint`, a hint under the
+  pointer names the modifier while a drag offers a docking target: `float_hint_label`, where
+  `{key}` becomes ⌘ or Ctrl.
+- Double-click a tab or drag bar to minimize a group to its strip.
+- Right-click a tab for its menu, or a drag bar for the group menu; Enter or Space on a focused
+  drag bar opens it too. A left click on the drag bar only focuses it.
+- With `DockStyle::wheel_selects_tabs`, the mouse wheel over a tab strip selects the next or
+  previous tab. With `middle_click_closes_tabs`, a middle click on a closable panel's tab closes
+  it.
+- A column's »/« button collapses it to icons, one icon per panel with a separator between groups.
+  Widen an iconic column to show panel names. Click an icon to open its group as a flyout on the
+  canvas side. Drag an icon to move its panel, or an icon group's top edge (the separator line above it) to move the group.
+
+## Commands
+
+With the `serde` feature, `DockCommand<P>` is the shared control vocabulary. The app puts the
+command id under `"command"` in the params and deserializes them. craft-ui has no `serde_json`
+dependency.
+
+```rust,ignore
+let mut params = params.clone();
+params["command"] = json!(id);
+let command: DockCommand<PanelId> = serde_json::from_value(params)?;
+if command.is_app_owned() {
+    return app.workspace_command(command);
+}
+let space = float_space(ctx, DOCK_ID).unwrap_or_else(|| FloatSpace::new(ctx.content_rect()));
+let closed = command.apply(&mut app.workspace, style.right_to_left, &space, |panel| app.permissions(panel))?;
+```
+
+| Id | Params (`?` is optional) |
+|---|---|
+| `window.panel.layout` | `{action}`: a serialized `Action` |
+| `window.panel.move` | `{panel, anchor, zone?, before?, group?, placement?}` |
+| `window.panel.float` | `{panel, x?, y?, width?, height?, group?, column?}` |
+| `window.panel.dock` | `{panel, anchor?, zone?, before?, group?, column?, side?}` |
+| `window.panel.activate`, `.close`, `.closeGroup`, `.closeOthers` | `{panel}` |
+| `window.panel.minimize` | `{panel, minimized?}` |
+| `window.panel.iconic` | `{panel, iconic?}` |
+| `window.panel.window` | `{panel, native?}` |
+| `window.workspace`, `.new`, `.delete` | `{name}` |
+| `window.workspace.reset`, `ui.dock.reset` | `{}` |
+| `window.workspace.lock` | `{locked?}` |
+| `ui.dock` | `{action}`, or `{operation, …}` |
+
+- `zone` is `tab`, `center`, `left`, `right`, `top`, `bottom`, `above` or `below`. `before` names
+  the tab to insert before; `null` appends. `left`, `right`, `top` and `bottom` follow
+  `Placement::for_zone`, so beside a docked panel they make a new column or group. `apply` and
+  `to_actions` take the layout's `right_to_left` for that.
+- `group` moves the panel's whole group; `column` moves its dock column, or its whole window when
+  it floats. `side` is `Start` or `End`: what moves becomes a new last column of that dock, or
+  a new dock; when it already is that dock's last column, the command does nothing.
+- `window.panel.dock` with `left`, `right`, `top` or `bottom` and no `anchor` or `side` makes a
+  new frame on that outer edge (`Placement::Edge`), wrapping what a drag to that edge would
+  (see the edge area above). A hidden panel is shown first.
+- Showing a panel (`activate`, `dock` without a destination, `ui.dock` `open`) restores a hidden
+  panel's place; a panel never laid out opens as `Open` without an anchor does.
+- `window.panel.float` without a rect floats what it moves at the size a drag floats it at (see
+  Floating size). It goes
+  inside the dock area, 24 points from its top-left corner, so it stays clear of the menu bar.
+  The area records that geometry in a `FloatSpace` each frame; `float_space(ctx, id)` reads it
+  and `apply` and `to_actions` take it. Before the area has drawn, `FloatSpace::new(area)` floats
+  a panel at 260x320 and a group or column at its column width by 320.
+  `FloatSpace::with_panel_size(panel, size)` gives a panel the area has not drawn (a hidden
+  panel, a headless run) the host's own size; a size the area recorded wins. `x`, `y`, `width` and
+  `height` replace the matching values, and a group or column that is already a whole floating
+  window keeps its rect.
+- Without a value, `minimized`, `iconic` and `locked` toggle.
+- `ui.dock` operations are those of LightCraft, PDFCraft, CADCraft and SoundCraft: `open`,
+  `close`, `activate`, `float {rect}`, `moveFloating {rect}`, `move {target, zone?, before?}`,
+  `setStackOpen {open}`, `resizeStack {height}` and `resizeSplit {path, size}`. `rect` is
+  `[x, y, width, height]`.
+
+`to_actions` returns the actions a command makes without applying them. `apply` applies them all
+or none and returns the panels it closed, so the app can release their state. Showing a hidden
+panel and Lock change the workspace directly. Named workspaces and Reset belong to the app:
+`is_app_owned` is true for them and `apply` refuses them. `DockCommand::IDS` lists every id for
+the app's command registry. App-specific aliases stay in the app.
+
+## Native windows
+
+With feature `native-windows`, on a backend with egui viewports (`!ctx.embed_viewports()`,
+eframe on desktop), every floating window opens in its own OS window: a Ctrl/Cmd-drag, Undock
+Panel and Undock Panel Group, every other drop that floats, and the floating windows of a
+restored layout. A window still in-window opens over its place in the app window (the main
+viewport's `inner_rect.min` plus its rect). A window with a panel whose
+`DockContent::allow_native` returns false (it returns true unless the app overrides it), or
+that is not floatable, stays in-window. Floating windows get no taskbar or Alt-Tab entry
+(`with_taskbar(false)`).
+
+On Wayland floating windows stay in-window: the compositor reports no window positions, so a
+native window could not dock again by drag or reopen where it was. Their `native` rects are
+kept, and the same layout opens native windows on X11, macOS and Windows. The dock area takes
+Wayland to be the backend when `WAYLAND_DISPLAY` or `WAYLAND_SOCKET` is set (winit's rule) and
+the main window has never reported its `outer_rect`; an app that forces X11 in code gets native
+windows from the first frame. `DockArea::native_windows(bool)` overrides the choice either way.
+
+- **Identity.** `Floating::id` names the OS window, so a window keeps it when its panels change,
+  including when its first panel moves out. `Floating::new` draws a fresh id and
+  `Floating::with_id` sets one. A saved layout stores every window's id and loads with unique
+  ids: a window saved without an id, or with one an earlier window took, gets a fresh one. A
+  window that merges into another takes the receiver's id, and a whole window that moves
+  (floated again, or its only group dragged) keeps its own.
+- **Kind and level.** `DockContent::window_kind` sorts panels into palettes
+  (`WindowKind::Palette`, the default) and viewers (`WindowKind::Normal`), such as a video
+  monitor on a second display. A window holding any `Normal` panel is a normal window, whichever
+  of its tabs shows; the rest are palettes.
+  - Palettes stay above other windows (`WindowLevel::AlwaysOnTop`), so clicking the document
+    does not bury them. They stay shown while the app is in the background, so files dragged
+    from another app reach them and an OS sheet attached to one stays open. While none of the
+    app's windows has focus they take `WindowLevel::Normal`, so they do not cover other apps
+    (on Windows `WindowLevel::AlwaysOnBottom`: there `Normal` would put them in front of the
+    app the user switched to), and they go back to `AlwaysOnTop` when one has it again. The app counts as in the
+    background after 250 ms without focus, so focus moving between its own windows changes
+    nothing. The level is sent only when it changes.
+  - Normal windows have `WindowLevel::Normal` and stay shown while the app is in the
+    background. They stack with the main window by focus, below every palette; a drag over a
+    normal window that lies behind the main window targets the main window where the two
+    overlap, and the normal window outside the main window.
+  - Like palettes, normal windows have no taskbar entry; they come forward with the app
+    instead. When one of the app's windows gains focus after none had it for 250 ms,
+    the main window and each normal window get `WindowLevel::AlwaysOnTop` and then
+    `WindowLevel::Normal`, one window per frame, in their focus order from back to front.
+    They keep their order, nothing takes focus, and the window the user activated is raised
+    last, so it stays in front. The focus order counts a press in the main window as focusing
+    it, since the window system raises it then. The main window is left at the normal level,
+    so an app that keeps its main window always on top should not use normal windows. On
+    Windows the toggle puts the window in front of every window that is not topmost, without
+    activating it; on X11 the window manager raises a window as it takes
+    `_NET_WM_STATE_ABOVE`. egui 0.36 cannot make the main window a native window's owner,
+    which on Windows would bring the window forward with the main window, and
+    `ViewportCommand::Focus` would take focus. On
+    macOS nothing is raised: activation from the Dock or the application switcher brings all
+    of the app's windows forward, and a click brings the clicked window alone, as with the
+    app's other windows.
+- **Bar.** Each window has a bar at the top, 18 points high, in the floating title bar's style:
+  the title (the shown panel of its first group) and ×. Dragging the bar moves the window. On
+  macOS the press on the bar hands the move to AppKit, and on Wayland, where a window cannot
+  be placed, the bar hands the move to the compositor. On
+  Windows and Linux the OS frame is off. On macOS the frame stays, with its title bar and
+  buttons hidden, for its resizing, rounded corners and standard window shadow. The dock area
+  paints no shadow of its own around a native window.
+- **The ×.** Its place is set in `render/native.rs` (`MACOS_CLOSE`, `OTHER_CLOSE`): the
+  glyph's inset from the top and trailing edges, its size, and how far the hit area reaches
+  past the glyph on each side. On macOS the 9 pt glyph sits where macOS puts the close button
+  of its own windows: centered in the bar, its trailing side 8 pt in. AppKit's corner resize
+  area covers the glyph's trailing half and takes presses there, so the hit area reaches 10 pt
+  further toward the leading edge and down to the bar's bottom. Elsewhere the × is an 18 pt
+  square, its trailing side 7 pt in. With `CRAFT_DOCK_DEBUG_CLOSE=1` in the environment,
+  native windows outline the ×'s hit area in red and, on macOS, AppKit's resize areas in
+  orange.
+- **Resize.** A movable window resizes from its edges and corners. On macOS AppKit does it,
+  with its own areas and cursors. Its corner area reaches about 15 pt into the window along
+  each edge (a 19 pt square, measured on macOS 26) and takes presses before the content sees
+  them. Over AppKit's areas the window sets no cursor of its own, which would flicker with
+  AppKit's. Elsewhere the window resizes from bands 6 pt deep along its edges, and each corner
+  is an L along both edges, 16 pt long and as deep as the edges. The bands leave out the bar's
+  buttons, so the corner's grab runs down beside the ×; elsewhere the top band lies over the
+  bar's drag area. The OS runs the resize from a band (`ViewportCommand::BeginResize`).
+- **Close.** The bar's × and the OS close request close the window's panels, as the
+  floating window's × does. They reopen from the app's Window menu. A window with a panel that
+  may not close, or in a locked area, has no × and answers the OS close request with
+  `ViewportCommand::CancelClose`.
+- **Place.** `Floating::native` is the desktop rect of the window's content (egui's
+  `inner_rect`), and the in-window `rect` follows it for builds that draw the window in-window.
+  The content is also the window's origin for drags; only `ViewportCommand::OuterPosition`
+  takes the outer position, which the renderer works out from the reported outer and inner
+  rects. Where the window system puts a new window's frame, not its content, at the place asked
+  for, the window is moved once so its content is there. When the app changes `native` (undo,
+  a workspace reset, a reloaded layout whose ids match), the OS window moves there; a report
+  that differs from `native` while a commanded move has not landed (up to 0.5 s) is ignored. `Floating::monitor` is the monitor
+  holding the window's center, from the list the app passes to `DockArea::monitors` (each a
+  `Monitor { name, rect, scale }` in desktop logical points). egui 0.36 reports no monitors, so
+  an app fills the list from its backend when it can; without one, `Floating::monitor_size`
+  keeps the monitor size egui reports.
+- **Restore.** Only the windows of a loaded layout (a `native` the session has not shown yet)
+  are restored. A window made this session (a drag out, Undock, a Ctrl/Cmd drop) opens at the
+  rect it was given, only made safe, wherever that is on the desktop. A restored window opens on
+  its saved monitor when one with that name (or else that rect) is connected, moved in
+  proportion if the monitor's rect changed, and moved onto it when too little of its bar lies on
+  a monitor to grab (40 by 9 points). Otherwise it opens on the main window's monitor at the
+  same offset from that monitor's origin, wholly on screen. Without a monitor list, it is
+  clamped onto the main window's monitor, taken from `monitor_size` and the main window's
+  position. Hostile rects are made safe first. With a monitor list, a window whose `native` the
+  app changes, or whose bar drag ends with too little of the bar on a monitor, goes onto the
+  nearest monitor too.
+- **Mixed scale factors.** Rects are stored in egui points as the window reports them, and
+  `Monitor::scale` is kept but not used. On macOS every window shares one point space, so this
+  is exact. On Windows egui-winit divides each window's physical position by that window's own
+  scale factor, so with monitors at different scales (say 100 % and 150 %) the points of windows
+  on different monitors are in different units. Across such monitors, a restored or
+  app-changed place can land off by the ratio of the scales, and a drop across windows on
+  different monitors can resolve against the wrong point. Same-scale setups are unaffected.
+- **Shortcuts.** egui gives each OS window only its own input. Key, text, copy, cut and paste
+  events that reach a native window and that none of its widgets used come back in
+  `DockOutput::forwarded_events`, with the modifiers held in that window in
+  `DockOutput::forwarded_modifiers` (egui-winit sends Cmd/Ctrl+C, X and V as `Copy`, `Cut` and
+  `Paste` without the key). The app feeds them to the shortcut handling it runs on the main
+  window. A window where any widget has keyboard focus forwards nothing, and an Escape that
+  cancels a drag is not forwarded.
+- **Input methods.** egui's IME descriptor (`PlatformOutput::ime`) goes out from the pass of
+  the window whose editor has the keyboard. A `craft_ui::ime::Composer` in a panel body of a
+  native window records its descriptor while the window draws, and the dock area publishes it
+  once per pass, after the window's last body. A body drawn after the editor's cannot clear it
+  (egui-winit turns the IME off in a pass without one, ending the composition). A descriptor
+  written directly in that pass, as a focused `TextEdit` writes one, is kept. An app whose own
+  editor publishes the descriptor does it in `DockContent::window_drawn`, called once per
+  window pass after the last body. Floating windows drawn in the main window (the web,
+  Wayland) are part of its pass, which publishes as it does without docking.
+- **Modal dialogs.** egui's `Modal` blocks input only in the viewport it is shown in. While the
+  app shows one, it passes `DockArea::input_blocked(true)`. Each native window is then drawn
+  under `DockStyle::blocked_dim` (by default the panel fill at 60 %), and its bar, tabs, body
+  and resize edges take no input: its widgets are disabled, the pointer, key, text and scroll
+  events are dropped at the start of its frame, and a layer over its content takes the pointer,
+  so a popup left open takes no click either. It forwards only key releases, so a key pressed
+  before the block does not stay down in the app's shortcuts. It reports no `window_files`,
+  offers no drop targets, starts no move or resize, is not focused by `raise_panel`, and
+  answers the OS close request with `ViewportCommand::CancelClose`. On macOS it is not
+  resizable meanwhile.
+  - *Stacking.* A palette drops to `WindowLevel::Normal` while blocked, so a click on the main
+    window brings it in front of a palette that covers the modal. It stays shown and at that
+    level when the app goes to the background and returns. When the app is activated meanwhile, the
+    main window is raised last, in front of the normal windows and of a palette the user
+    clicked.
+  - *Edges.* Turning blocking on cancels a drag in progress, and a widget of a native window
+    loses keyboard focus. If a native window has the OS keyboard focus then (the modal was
+    opened from it, say by a double-click in a floating panel) and still has it 0.2 s later,
+    the main window gets `ViewportCommand::Focus`, so the modal gets the keys. The wait lets an
+    OS dialog opened with the modal (a file dialog) take focus first; then nothing is sent. A
+    zoom gesture still shows in egui's `InputState::zoom_delta`, which cannot be cleared; a
+    widget that zooms only while hovered ignores it. egui smooths wheel
+    scrolling, so a scroll area in a native window may still scroll for about 100 ms after
+    blocking ends, with the remainder of a wheel turn made just before it began.
+  - Floating windows drawn in the main window need nothing: the modal covers them.
+- **Input hook.** eframe runs `App::raw_input_hook` for the main window only. An app that
+  rewrites input there (say, Ctrl+click to a secondary click on macOS, or blocking input
+  during automation) passes the same rewrite to `DockArea::native_input_hook` every frame as a
+  closure. eframe's hook takes `&mut self`, so state it shares with the closure goes in an
+  `Arc<Mutex<…>>`. The dock area runs it on each native window's `RawInput` (`viewport_id` names the window; see
+  `DockArea::window_viewport`). It runs as an egui `Plugin::input_hook`, before egui reads the
+  input, so widgets see rewritten pointer and key events as if the window system had sent them.
+  It runs once per pass, so a frame that egui runs twice calls it a second time with the
+  events already taken. The hook must be `Send + 'static`, as egui plugins are.
+- **Dropped files.** Files dragged over or dropped on a native window come back in
+  `DockOutput::window_files`, one `WindowFiles` per window that had any this frame: the
+  window's id and viewport, the panel whose body is under the pointer (else the window's
+  shown panel, since the window system may send no pointer moves during a file drag), the
+  pointer's last position in the window, and the window's `hovered_files` and
+  `dropped_files`. Files on the main window stay in its own `RawInput`.
+- **Drags.** Tabs, groups and whole windows drag between the app's OS windows, and the app's
+  own drags in panel bodies reach the window under the pointer.
+  - *Ownership.* The window where the button went down owns the drag: the window system sends it
+    the pointer's moves and the release while the button is held, inside the window or not. So
+    the pointer leaving a window (`PointerGone`) is not a release. A drag ends on release,
+    Escape (pressed in any of the app's windows, since keys go to the one with keyboard focus),
+    when none of the app's windows has focus, or when its window closes or its panel goes. A
+    window that AppKit moves (macOS, below) ignores Escape.
+  - *Hit-testing.* The owner adds its desktop origin to the pointer: a native window's reported
+    `inner_rect.min`, or while it moves by its bar, the place it was last put less the pointer's
+    offset from the pressed point. On macOS a window moving by its bar is hit-tested at
+    AppKit's cursor (`NSEvent::mouseLocation`). The window under that
+    desktop point is a floating native window in front of the main window first (palettes, then
+    normal windows, most recently focused first), then the main window, then a normal window
+    behind it. A window moving by its bar is never its own target. A point in no window is on the
+    desktop.
+  - *Targets and previews.* Each window draws its drop targets in its own coordinates, and the
+    window under the pointer draws the drop preview (zone, result rect, ghost) in its own frame.
+    The source window shows only the "Hold {key} to undock" hint. The release is resolved at the
+    end of the main window's frame, after every native window has drawn.
+  - *Drops.* Over a window, a tab or group docks or joins there with the usual targets: dock lines
+    and frame zones in the main window, frame zones and tab rows in floating windows. Over the
+    desktop, it floats into a new OS window placed so the grabbed tab stays under the pointer
+    (the window's top-left is the pointer minus the grab offset, less the bar's height). A
+    Ctrl/Cmd-drag floats there wherever it is released.
+  - *Moving a window.* Dragging the bar, the only tab of a window, or the drag area of its only
+    group moves the window, so the pressed point stays under the pointer.
+    - *macOS.* AppKit moves the window (`ViewportCommand::StartDrag`, which winit turns into
+      `performWindowDragWithEvent`), as it moves its own windows: from the press on the bar,
+      or from the start of the tab or group drag. The dock area sends no `OuterPosition`
+      meanwhile. egui keeps running frames, but the window's reported place lags the move by up
+      to a tenth of a second, so each frame takes the window's place as AppKit's cursor
+      (`NSEvent::mouseLocation`, flipped against the primary screen's height and divided by the
+      zoom factor) less the pressed point, and hit-tests targets, fades the window and routes
+      the drag at the cursor. The drag ends on the first frame where AppKit
+      (`NSEvent::pressedMouseButtons`) or egui reports the release; egui's can come a frame
+      later, and the drag is resolved once. Ctrl/Cmd is read from AppKit's modifier flags,
+      since AppKit sends egui no key events during the move; for the same reason Escape does
+      not cancel it, as with Finder's windows. A press on the bar released within the click
+      distance docks nothing.
+    - *Elsewhere.* The dock area moves the window with `OuterPosition`. Each move is worked
+      out from a pointer move of that frame and the window's reported place, which the
+      pointer's position is relative to; a move commanded earlier may land late. A frame with
+      no pointer move leaves the window. X11 sends no move whose position in the window repeats
+      the last one, so while the pointer keeps exact pace with the window the window can trail
+      it by one move until the next. Escape puts the window back.
+    - *Drops.* Released over a target in another window, the whole window docks or joins there
+      as its groups (`Action::MoveWindow`). The bar docks only with
+      `DockStyle::title_bar_docks`; the only tab or group docks either way, since it is the way
+      back in with that flag off. Targets: in the main window a dock line, a frame's tab row or
+      edge zone, or the layout's outer edge; in a floating window a frame zone or tab row. A
+      frame body's center takes a window moved by its only tab or group, as that tab or group
+      drag would, but not one moved by its bar. Over the desktop, or with Ctrl/Cmd held, it
+      stays where it was moved, and the layout takes its place once, at the release. An
+      in-window floating window's title bar still splits only groups of other floating windows.
+  - *Wayland.* With `DockArea::native_windows(true)` on Wayland, or wherever `outer_rect` is
+    `None`, desktop positions are unknown, so drops across windows cannot be resolved. A drag
+    works inside its own window, and a release outside it floats a new window that the
+    compositor places. Moving a window hands the move to the
+    compositor, which never docks it.
+  - *App drags in panel bodies.* A drag the app starts in a panel body can reach the window
+    under the pointer, so a drop site there works as it does inside one window.
+    - *Which drags.* An egui drag of one of the app's widgets, pressed with the primary button
+      in a panel body, that carries something: egui's `DragAndDrop` holds a payload
+      (`dnd_set_drag_payload`), or the app calls `docking::route_app_drag(ctx, area_id)` each
+      frame while the drag lasts, from the body or before the area shows. An app that keeps its
+      payload in the context's data makes that call. Other drags (sliders, scrollbars, text
+      selection, canvas pans) stay in their window and keep getting its pointer. A call counts
+      for its frame and the next; once routing starts, it lasts until the drag ends.
+    - *Events.* While the drag lasts, the owner's pointer moves over another of the app's
+      windows (found as for tab drags, front window first) go to that window in its own
+      coordinates: `PointerMoved` while the pointer is over it, `PointerGone` when it leaves,
+      and the release as a primary `PointerButton` with `pressed: false`. That window sees
+      `pointer_hover_pos` and `any_released` as if the window system had sent them. It sees no
+      press, so `any_down` stays false there and nothing in it is clicked. The owner sees the
+      pointer gone while it is over another window, so its panels under a palette see no hover
+      and no drop.
+    - *Input path.* Events go in through the area's egui input plugin, before any widget reads
+      the input; the app calls nothing more. In a native window this runs before the app's
+      `native_input_hook`. eframe runs the main window's `App::raw_input_hook` earlier, so that
+      hook sees the main window's input without the routed events.
+    - *Release timing.* A window drawn after the owner in the same pass gets the events in that
+      pass (from the main window, every native window does). The main window, and a native
+      window drawn before the owner, get them on the next pass, which is requested. When the
+      release goes to another window, the owner gets its own release, and the pointer events
+      that came after it, in the main window's next pass (a rerun of a discarded pass does not
+      count), so its drag stops (`drag_stopped`) then. egui clears a `DragAndDrop` payload when the owner sees the
+      release, so the target always reads its release while the payload is there. An app that
+      keeps its own payload clears it no earlier than the owner's release.
+    - *Limits.* Nothing is routed where desktop positions are unknown (Wayland,
+      `native_windows(false)`, embedded viewports) or while input is blocked. Escape in any of
+      the app's windows, a focus loss, `cancel_drag` and a replaced layout stop the routing:
+      the window under the pointer sees it go and gets no release it has not read yet. The drag
+      goes on in its own window until the button comes up, and the owner still gets its
+      release.
+
+On the web and wherever egui embeds viewports, nothing changes: floating windows stay in the
+page at their in-window rect, `native` and the monitor fields are kept but unused, the input
+hook never runs, and `forwarded_events` and `window_files` stay empty. Without the feature, the fields exist and are never set by the
+renderer.
+
+## Labels
+
+Every visible and accessibility label is a `*_label` field of `DockStyle`, with an English
+default: title case for menu items, sentence case for names only screen readers announce. `DockStyle::localized` sets them all from one keyed lookup:
+
+```rust,ignore
+let style = DockStyle::from_ui(ui).localized(|key| app.strings.get(key).cloned());
+```
+
+Keys are `dock.close`, `dock.float`, `dock.collapseToIcons` and so on; the rustdoc of `localized`
+lists them all. `DockContent::label` and `action_label` can shape panel and action text further;
+the logical label stays the accessibility name.
+
+## Testing
+
+`DockArea::hit_rects(ctx, id)` lists every gesture source drawn last frame as a `Hit` with its
+rect: tabs, drag bars, borders, column bars, »/« buttons, title bars, close buttons, icons, icon
+grips, resize edges and dividers. It is always compiled, so an app can return it from a
+`ui.docking` control method next to the layout and the focused panel.
+
+`DockArea::hit_id(id, &hit)` is the egui widget id of a control, for tests and automation that
+focus it or read its response. `DockArea::floating_layer(id, &window)` is a floating window's
+egui layer: compare its place in `memory.layer_ids()` with another layer to tell whether the
+window covers it, and read its rect with `memory.area_rect(layer.id)`. A window the area does not
+draw (its panels hidden, or a frame maximized) keeps its last rect there, so check
+`memory.areas().is_visible(&layer)` first.
+
+The `testing` feature adds `docking::testing::DockDriver`. It runs a `DockArea` in a headless
+egui context with real pointer and key events, and applies the actions each frame emits.
+
+```rust,ignore
+let mut driver = DockDriver::new(app_layout(), Panels::default());
+let bar = driver.hit(&Hit::DragBar(PanelId::Layers)).unwrap();
+driver.drag(bar.center(), egui::pos2(2.0, 300.0));
+driver.settle();
+assert!(driver.hit(&Hit::ColumnBar(PanelId::Layers)).is_some());
+```
+
+It also has `press`, `release`, `click`, `hold`, `key`, `focus`, `hits`, and checks for painted
+previews (`filled`, `outlined`). With `native-windows`, `with_native_host(origin)` stands in for
+OS windows: the main window's content sits at `origin` on the desktop, and each native window
+runs its own frame with its own input and desktop rect (`host()`, `window_step`,
+`window_click`). `NativeHost` can report a monitor size (`monitor_size`), give windows a frame
+between their outer position and content (`frame`), land `OuterPosition` a frame late (`lag`),
+and report no positions (`no_position`, as on Wayland). `window_pointer` moves the pointer to a
+desktop point in a native window. With `moves_windows` the host moves a window for
+`StartDrag` itself, as AppKit does: the window keeps the pointer at the pressed point, reports
+its place as where the drag began until the release, and the host tells the cursor and the
+button (`held`; a test sets it to `false` to report a release before egui does). A `HostWindow` takes files dragged
+over it (`hovered_files`) or dropped on it (`dropped_files`), and `with_native_input_hook`
+passes a hook to `DockArea::native_input_hook` every frame.
+
+`crates/ui/examples/docking_native.rs` (`cargo run -p craft-ui --example docking_native
+--features native-windows`) shows a dock with two native floating windows and prints every
+action and window place, for checking moves on a real window system.
+
+craft-ui's own tests in `crates/ui/tests/docking_workflows.rs`:
+
+- Load every app's v1 layout fixture, dock groups into a new dock, a bottom band and a seam,
+  collapse and expand the column, float it by command and drag it back, then check the layout
+  reads back as written.
+- Render Layers, Properties and Brushes panels with real content, and merge, detach and redock
+  Brushes by pointer at two widths, two scales and both themes. Set `CRAFT_UI_DOCK_VISUAL_DIR`
+  to keep the captures:
 
 ```sh
 CRAFT_UI_DOCK_VISUAL_DIR=/absolute/output/path cargo test -p craft-ui --test docking_workflows --all-features
 ```
 
-These are offscreen egui checks. An adopting application still needs command, content, workspace
-reload, theme and input tests using its own renderer and persistence adapter.
+An adopting app still tests its own commands, contents, saved workspaces and themes.
 
-## Application chrome and activation
+## What stays in the app
 
-`DockArea::show_customized` accepts one mutable `DockContent<P>` adapter, with body,
-panel-menu, group-header and label methods. Apps queue commands in these callbacks and
-apply them after rendering the readonly snapshot. `group_header_width` reserves a bounded
-trailing portion of the existing tab strip; its child UI is clipped to that region.
-Collapsed accordion entries still have panel menus; collapsing tab groups is host policy.
-
-`label` returns `WidgetText`, including an application-shaped galley, used for tab width,
-painting and menu labels. The separate logical label callback supplies tab accessibility
-text. `action_label` independently shapes the localized stock Float/Move/Close menu
-text without receiving a panel identity. Its default returns unchanged logical `WidgetText`;
-custom visual text never replaces the action's logical accessibility label. Panel targets
-and overflow entries continue to use `label`. Original `show` and `show_with_limits` call
-sites remain supported.
-
-Apply `Action::Activate` in the host, then use `DockArea::raise_panel(panel)` on the next
-frame to raise the owning in-viewport floating layer and focus the panel tab. This request
-does not mutate the serialized layout or persist z-order. Floating area identity still
-derives from the first panel; native-window identity remains host-owned.
-
-Floating groups have a distinct 12-point grip in the existing tab strip. Moving it emits
-`MoveFloating` for the whole group; dragging an individual tab detaches just that panel.
-`DockOutput::group_drag` and `group_drop` expose the group identity and release position
-for app-owned atomic group docking policies. Escape/lost focus restores the group's
-starting rectangle. No generic group docking or app command registry is inferred.
-
-Hosts supply overlay rectangles via `blocked_rects` before showing the surface. These
-block drop previews, release actions and float fallback at the pointer, including overlays
-appearing mid-drag. Hosts must provide current overlay geometry or cancel docking when
-modal state prevents interaction; later-drawn overlays cannot be discovered retroactively.
-
-`DockArea::chrome_has_focus(ctx, layout)` classifies focus on rendered dock tabs,
-collapse buttons, overflow, split/stack dividers, floating resize corners and group
-grips. It excludes panel content and custom header/menu widgets and rejects invalid
-layouts. Hosts can permit global commands from chrome while reserving Enter, Space,
-Tab, Escape and arrow keys for activation, traversal, cancellation and resizing.
-Content widgets retain their usual keyboard ownership. The renderer owns the IDs;
-hosts do not need to reconstruct them.
+- The panel registry, panel contents and document state.
+- Named workspaces, Reset, and when and where layouts are saved.
+- Menus and key bindings outside the docking chrome.
+- Native window ownership on platforms without egui viewports.
diff --git a/docs/ui-panes.md b/docs/ui-panes.md
new file mode 100644
index 00000000..9d043c66
--- /dev/null
+++ b/docs/ui-panes.md
@@ -0,0 +1,175 @@
+# Task panes
+
+`craft_ui::panes` draws task panes around an app's own document: Navigation, Styles, Comments,
+Format Shape and the like. Each pane is an egui side or bottom panel, or a floating frame. The
+document stays the app's `CentralPanel`.
+
+## Panes or docking
+
+| Use | When |
+|---|---|
+| `panes` | Office-style apps (WordCraft, DeckCraft, GridCraft). A few panes at the sides of a document the app draws itself; the app's commands own which panes are open. |
+| `docking` | Creative apps whose whole window is panels: tab groups, splits, stacked groups, workspaces, a protected canvas panel. See [ui-docking.md](ui-docking.md). |
+| plain egui panels | Fixed view parts: slide thumbnails, notes, formula bar, sheet tabs, status bar. |
+| `egui::Window` | Free tool windows that never dock (Read Aloud, Power Query). |
+
+`panes` needs no docking types; it uses only the docking chrome (`ChromeStyle`,
+`FloatingFrame`, `TitleBar`, `live_move`).
+
+## API
+
+```rust
+use craft_ui::panes::{Edge, PaneContent, PaneHost, PaneRequest, PaneState, Place, SidePolicy};
+
+impl PaneContent<Pane> for MyPanes<'_> {
+    fn title(&self, pane: &Pane) -> String { tr(pane.title()) }
+    fn body(&mut self, ui: &mut egui::Ui, pane: &Pane) { /* the pane's contents */ }
+    fn default_state(&self, pane: &Pane) -> PaneState { PaneState::docked(Edge::End, 250.0) }
+    // Optional: size_range (200..=520), movable, closable, menu (app items in the ▾ menu),
+    // title_bar (false: a docked pane draws no title bar; floating panes always draw one).
+}
+
+// Every frame, after the top and bottom bars and before the CentralPanel:
+let out = PaneHost::new(egui::Id::unique("task-panes"))
+    .rtl(ui_is_rtl)
+    .policy(SidePolicy::Columns)
+    .show(ui, &open_panes, |pane| prefs.pane_state(pane), &mut MyPanes { app });
+for request in out.requests {
+    match request {
+        PaneRequest::Close(pane) => app.run(pane.close_command()),
+        PaneRequest::Place(pane, place) => prefs.set_place(pane, place),
+        PaneRequest::Resize(pane, size) => prefs.set_size(pane, size),
+        PaneRequest::FloatRect(pane, rect) => prefs.set_float_rect(pane, rect),
+        // Move `pane` to directly before `before` in the open list (`None`: to its end).
+        PaneRequest::Before(pane, before) => app.move_pane_before(pane, before),
+        PaneRequest::Focus(_) => {}
+    }
+}
+egui::CentralPanel::default().show(ui, |ui| {
+    let response = document(ui);
+    if out.to_document {
+        // F6 or Shift+F6 left the panes: the document takes keyboard focus.
+        response.request_focus();
+    }
+});
+```
+
+| Piece | Behavior |
+|---|---|
+| `Edge::{Start, End, Bottom}` | Logical edges. `Start` is left, or right with `.rtl(true)`. |
+| `SidePolicy::Columns` | Every docked pane shows; panes on one edge sit side by side in `open` order, the first outermost. A drop that picks a position on an edge sends `Before(pane, next)` after its `Place`, so the app's `open` order puts the pane there. |
+| `SidePolicy::OneSlot` | One closable pane per edge: the last one in `open`. Non-closable context panes (PivotTable Fields) show beside the slot. A closable pane dropped on an edge takes the slot: `Before` moves it after the slot's pane. |
+| `.max_fraction(f)` | One docked pane takes at most `f` of the host's width (height for bottom panes). |
+| Chrome | Title, ▾ menu (app items, Move to Start, Move to End, Move to Bottom for bottom panes, Float, Close), ×, a resize edge with pointer and arrow keys. The edge takes presses on both sides of its line, over the document's own widgets too, and stays under floating windows. The title bar mirrors with `.rtl(true)`. Its accessible name is `PaneLabels::move_pane` with `{title}` replaced by the pane's title ("Move Styles pane"). |
+| Size | A docked pane reserves exactly its size and clips its body, so a body wider than the pane never pushes into the document. |
+| Drag out | A docked pane's title dragged more than `DOCK_SNAP` (32 pt) out of the pane floats it under the pointer when dropped, unless it is dropped on a dock target: within 32 pt of the host's left or right edge it docks there, outermost; over the outer third of another side pane (toward the window edge) it docks directly outside that pane, over its inner third directly inside it. The middle third is no target. While the pointer is on a target, a preview shows the rect the pane will take once the app applies the requests. A drop where the pane already is sends nothing. |
+| Floating | `FloatingFrame` with its resize handles; the title bar moves it. Escape or window focus loss during a move puts it back. A drop on a dock target docks it, with the same targets and preview as a drag out. Rects are clamped to the host area. |
+| Focus | `out.focused` is the pane holding keyboard focus or last clicked; a click or focus in the document clears it. F6 and Shift+F6 cycle through the shown panes and then report `out.to_document`: give focus to the document. `.f6(false)` leaves F6 to the app, which calls `panes::focus_next(ctx, id, reverse)` instead. |
+
+State:
+
+- The host never stores which panes are open and never writes files.
+- `states` returns the app's saved `PaneState` (place, size, float rect; serde with the `serde`
+  feature). Return `None` to let the host keep the state in egui memory for the session, as
+  egui panels keep widths today.
+- Apply `Resize` and `FloatRect` as they come: they arrive every frame of a gesture, and an
+  Escape sends the start rect back.
+- `panes::float_rect` brings a saved rect back inside the window, whatever the file says.
+
+## Rail
+
+`panes::Rail` is a vertical strip of icons, always shown at one edge. Each icon stands for a
+task pane, and one pane at a time is open beside the strip. A click on an icon opens its pane in
+place of the open one; a click on the open pane's icon closes it. The rail stores nothing: the
+app owns which pane is open, as with `PaneHost`.
+
+```rust
+use craft_ui::panes::{Edge, PaneHost, Rail, RailItem, RailRequest, SidePolicy};
+
+let items = [
+    RailItem::new(Pane::Comments, icons.source("comments"), tr("Comments")).marker(has_comments),
+    RailItem::new(Pane::Bookmarks, icons.source("bookmark"), tr("Bookmarks")).enabled(has_outline),
+];
+// After the top and bottom bars, before PaneHost: the rail is the outermost panel on its edge.
+let rail = Rail::new(egui::Id::unique("rail")).edge(Edge::End).rtl(ui_is_rtl).show(ui, &items, app.pane.as_ref(), |ui| {
+    page_navigation(ui); // the foot: below the items, always visible; may draw nothing
+});
+match rail.request {
+    Some(RailRequest::Open(pane)) => app.pane = Some(pane),
+    Some(RailRequest::Close(_)) => app.pane = None,
+    _ => {}
+}
+// The open pane, between the document and the rail. Its PaneContent returns `movable = false`
+// and a `default_state` docked at the rail's edge.
+// Apps whose panes draw their own headers return false from `title_bar`.
+let open: Vec<Pane> = app.pane.into_iter().collect();
+let out = PaneHost::new(egui::Id::unique("task-panes")).rtl(ui_is_rtl).policy(SidePolicy::OneSlot).show(ui, &open, |_| None, &mut MyPanes { app });
+egui::CentralPanel::default().show(ui, |ui| document(ui));
+```
+
+| Piece | Behavior |
+|---|---|
+| `RailItem` | `pane`, `icon` (an `egui::ImageSource`, like docking's `DockContent::icon`), `label` (tooltip and accessible name; translate it in the app), `enabled`, `marker`, `marker_label` (the accessible description while the marker shows, such as "Has comments"). `RailItem::new` makes an enabled item without a marker. |
+| `.edge(e)` | `End` (default) or `Start`. `Start` is left, or right with `.rtl(true)`. The rail is vertical, so `Bottom` draws at `End`. |
+| `.width(w)`, `.button_size(s)` | Rail width (48) and item size (34; the icon is 16 smaller). Non-finite values fall back to the defaults. |
+| `.frame(f)` | Default: the panel fill, 8 pt above and below. The panel's separator line draws the inner edge. Item colors come from `ChromeStyle`, like the pane title bars. |
+| Panel | Exact width, not resizable. Shown before `PaneHost::show`, it is outermost, so a docked pane on the same edge sits between it and the document. |
+| Items | Top-down in a vertical scroll area. The foot is a bottom sub-panel, so in a short window the items scroll and never run into it. A pane listed twice is drawn once. An empty list draws an empty rail. |
+| States | The open pane's item draws selected. `marker` draws a dot while the pane is not open. A disabled item draws disabled, takes no focus and sends nothing. An item disabled while focused hands focus to the nearest enabled item, the one below first. |
+| `RailOutput` | `#[non_exhaustive]`. `request`: `Open(p)` or `Close(p)` (`#[non_exhaustive]`), at most one per frame. `focused`: the item holding keyboard focus. `rect`: where the rail was drawn. |
+| Accessibility | Each item is a toggle button (accesskit `Button` with a toggled state) named by its `label`. |
+| Keyboard | Items take Tab focus. Enter or Space clicks the focused item. Up and Down move focus between enabled items and stop at the ends. Escape is the app's: the rail neither closes the pane nor moves focus on it. |
+
+F6 stays with the app. To include the rail in an F6 cycle, give `PaneHost` `.f6(false)` and,
+when the cycle reaches the rail, focus the open pane's item if it is enabled, else the first
+enabled one:
+
+```rust
+let enabled = || items.iter().filter(|item| item.enabled);
+let target = enabled().find(|item| Some(&item.pane) == app.pane.as_ref()).or_else(|| enabled().next());
+if let Some(item) = target {
+    ctx.memory_mut(|m| m.request_focus(Rail::new(egui::Id::unique("rail")).item_id(&item.pane)));
+}
+```
+
+While `rail.focused` is `Some`, focus is in the rail: the next F6 moves on, for example to the
+panes with `panes::focus_next`.
+
+## Adoption
+
+### WordCraft (`Columns`)
+
+- Add a `Pane` enum for the nine panes and implement `PaneContent` by calling the existing
+  bodies; drop their `header()` calls, since the host draws the title and ×.
+- Build `open` each frame from the `ViewState` flags, in today's order: SmartArt Text Pane (only
+  while SmartArt is selected), Navigation and Clipboard at `Start`; Styles, Style Inspector,
+  Accessibility, Alt Text, Restrict Editing and Comments at `End`. Default widths as today.
+- `Close(p)` runs the pane's existing command (`view.navigationPane {value: false}`, …). Command
+  ids and `nav_pane` in `ui.json` stay as they are.
+- Styles takes #2584's behavior through the host: map `StylesPaneDock::{Left, Right, Floating}`
+  to `Place` (`Left` is `Docked(Start)` in left-to-right interfaces), run `view.stylesPaneDock`
+  on `Place`, keep the float rect in UI prefs. #2584's own drag, snap and `float_rect` code goes.
+- Other panes return `None` from `states`; their widths stay session-only, as now.
+- Pane title bars are focusable. Check that Tab in the canvas still stays in the document, so
+  panes stay off its keyboard focus. Use `.f6(false)` if F6 is bound elsewhere.
+
+### DeckCraft (`OneSlot`)
+
+- `open` is `ui.pane` (one entry) at `End`; `states` returns `PaneState::docked(Edge::End,
+  pane_width)`; `Resize` writes `pane_width`; `Close` clears `ui.pane` as the × does today.
+  `size_range` is 240..=520. The `ui.json` fields stay.
+- Format, Animation and Selection return `movable = true`; the rest `false`. Saving their place
+  needs new optional `ui.json` fields (`#[serde(default)]`).
+- Thumbnails, outline, notes and the #835 canvas shell stay plain panels.
+- F6 from the host closes the ui-parity F6 gap.
+
+### GridCraft (`OneSlot`, `.max_fraction(0.5)`)
+
+- `open` is the task slot pane (`grid.pane`, or "comments" while `session.comments_pane`) plus
+  PivotTable Fields while the active cell is in a pivot. PivotTable Fields returns
+  `closable = false` and `movable = false`, so it stays beside the slot.
+- `Close("comments")` runs `review.showComments {on: false}`; agents still drive it through the
+  engine.
+- No pane prefs today: return `None` from `states`.
+- Code Editor (#1193) and Queries & Connections (#1203) become slot panes. The formula bar,
+  sheet tabs and status bar stay plain panels.
diff --git a/licenses/ui-test-fonts/OFL-NotoSansArabic.txt b/licenses/ui-test-fonts/OFL-NotoSansArabic.txt
new file mode 100644
index 00000000..14c589f6
--- /dev/null
+++ b/licenses/ui-test-fonts/OFL-NotoSansArabic.txt
@@ -0,0 +1,93 @@
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/arabic)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/licenses/ui-test-fonts/OFL-NotoSansCJK.txt b/licenses/ui-test-fonts/OFL-NotoSansCJK.txt
new file mode 100644
index 00000000..d952d62c
--- /dev/null
+++ b/licenses/ui-test-fonts/OFL-NotoSansCJK.txt
@@ -0,0 +1,92 @@
+This Font Software is licensed under the SIL Open Font License,
+Version 1.1.
+
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font
+creation efforts of academic and linguistic communities, and to
+provide a free and open framework in which fonts may be shared and
+improved in partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply to
+any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software
+components as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to,
+deleting, or substituting -- in part or in whole -- any of the
+components of the Original Version, by changing formats or by porting
+the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed,
+modify, redistribute, and sell modified and unmodified copies of the
+Font Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components, in
+Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the
+corresponding Copyright Holder. This restriction only applies to the
+primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created using
+the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/licenses/ui-test-fonts/OFL-NotoSansThai.txt b/licenses/ui-test-fonts/OFL-NotoSansThai.txt
new file mode 100644
index 00000000..7fa8dcb0
--- /dev/null
+++ b/licenses/ui-test-fonts/OFL-NotoSansThai.txt
@@ -0,0 +1,93 @@
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/thai)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/scripts/plate-check.sh b/scripts/plate-check.sh
new file mode 100755
index 00000000..d10a4a90
--- /dev/null
+++ b/scripts/plate-check.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Separate every plate-test scene with Ghostscript (local only, never CI) and judge the plates.
+# With --flatten, also flatten each scene with craft-prepress's flattener and judge that page.
+# Ghostscript is `gs` on PATH, or CRAFT_PLATE_TEST_GS.
+set -euo pipefail
+root=$(cd "$(dirname "$0")/.." && pwd)
+fonts="${XDG_CACHE_HOME:-$HOME/.cache}/craft-pdf-test-fonts"
+if [[ -z "${CRAFT_PDF_TEST_FONT_DIR:-}" && -f "$fonts/Inter-Regular.ttf" ]]; then
+  export CRAFT_PDF_TEST_FONT_DIR="$fonts"
+fi
+cd "$root"
+case "${1:-}" in
+  "")
+    cargo test -p craft-plate-test --test ghostscript -- --ignored --nocapture
+    echo "report: ${CARGO_TARGET_DIR:-target}/plate-test/report.md"
+    ;;
+  --flatten)
+    cargo test -p craft-prepress --features flatten --test flatten_plates -- --ignored --nocapture
+    echo "report: ${CARGO_TARGET_DIR:-target}/plate-test/flattened/report.md"
+    ;;
+  *)
+    echo "usage: $0 [--flatten]" >&2
+    exit 2
+    ;;
+esac
diff --git a/scripts/test-pdf-backends.sh b/scripts/test-pdf-backends.sh
index de8fae60..cc31a7fa 100644
--- a/scripts/test-pdf-backends.sh
+++ b/scripts/test-pdf-backends.sh
@@ -7,11 +7,11 @@ test_root=$(mktemp -d "${TMPDIR:-/tmp}/craft-pdf-backends.XXXXXX")
 trap 'rm -rf "$test_root"' EXIT
 export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$root/target}"
 patches=()
-for backend in hayro hayro-interpret hayro-syntax hayro-jbig2; do
+for backend in hayro hayro-interpret hayro-syntax hayro-jbig2 hayro-cmap hayro-postscript; do
   cp -R "$root/vendor/$backend" "$test_root/$backend"
   patches+=(--config "patch.crates-io.$backend.path=\"$test_root/$backend\"")
 done
-for backend in hayro-syntax hayro-interpret hayro hayro-jbig2; do
+for backend in hayro-syntax hayro-interpret hayro hayro-jbig2 hayro-cmap hayro-postscript; do
   cargo test --manifest-path "$test_root/$backend/Cargo.toml" --lib "${patches[@]}"
 done
 cargo test --manifest-path "$test_root/hayro-syntax/Cargo.toml" --doc "${patches[@]}"
diff --git a/vendor/README.craft-reader.md b/vendor/README.craft-reader.md
index d7444ba0..1627665f 100644
--- a/vendor/README.craft-reader.md
+++ b/vendor/README.craft-reader.md
@@ -1,11 +1,90 @@
 # Shared Hayro reader snapshot
 
 The `hayro`, `hayro-interpret`, `hayro-syntax` and `hayro-jbig2` directories are transferred
-from [PdfCraft revision 7437bde378f43856eada40af25b983812e615e8a](https://github.com/storytold/pdfcraft/tree/7437bde378f43856eada40af25b983812e615e8a/vendor).
-The upstream [patch ledger](https://github.com/storytold/pdfcraft/blob/7437bde378f43856eada40af25b983812e615e8a/vendor/README.md)
+from [PdfCraft revision ec0a965074f376a5bf610435948e4e5184bf3299](https://github.com/storytold/pdfcraft/tree/ec0a965074f376a5bf610435948e4e5184bf3299/vendor)
+(`main`, 2026-10-19). The upstream [patch ledger](https://github.com/storytold/pdfcraft/blob/ec0a965074f376a5bf610435948e4e5184bf3299/vendor/README.md)
 describes the inherited patches. Source manifests record every transferred Git blob and
 SHA-256 alongside the local hash. The source manifests themselves are not self-hashed.
 
+The first transfer was from PdfCraft revision 7437bde378f43856eada40af25b983812e615e8a.
+The snapshot was then re-synced to ec0a965 by a three-way merge (base 7437bde, PdfCraft's
+current tree, this tree), so every local patch described below is carried unchanged. The
+re-sync brings these PdfCraft changes:
+
+| PdfCraft PR | Crate | Change |
+|---|---|---|
+| #1691 | hayro-interpret | Patch 28: images with few possible pixel values convert each value once (spot-color images) |
+| #1903, #3316 | hayro-syntax | CCITT images that declare `/Rows 0`, or fewer `/Rows` than `/Height`, decode to their height |
+| #1954 | hayro-syntax | ASCII85 decoding stops at the stream's decode limit (here the per-document limit) |
+| #1982 | hayro-syntax | `Page::base_dimensions` keeps a one-point floor after `/UserUnit` |
+| #2027 | hayro-interpret | Reads a transparency group's `/I` and `/K`; a group that is neither isolated nor knockout composites directly onto its backdrop |
+| #2132 | hayro | A soft mask fades a gradient fill |
+| #1557 | hayro-interpret, hayro | Patch 29: devices are told where annotation drawing begins and ends |
+| 13e3154 | hayro-interpret | Annex D.2 alias codes in standard, TrueType, Type 1 and Type 3 fonts read as the glyphs they draw |
+| #2436 | hayro-interpret | Patches 31–33: faster sampled functions, image decodes reused across zoom levels, patch meshes interpolated once per grid point |
+| #2812 | hayro-interpret | Patch 34: a per-thread tint-transform counter for deterministic tests |
+| #2035 | hayro-syntax | Flate back-references are copied in runs |
+| #3356 | hayro | A tiling pattern drawn once shows its cell at full scale |
+| #3378 | hayro-syntax | Patch 20: spaces or tabs between `stream` and its line break are accepted |
+| #3363 | hayro-syntax | A JP2 image in a color space the decoder refuses is drawn by its component count |
+| #3412 | hayro-interpret | Type 3 glyph bounding boxes are transformed to device space before shading bounds are intersected |
+
+PdfCraft's vendored `vello_common` patch (clip-intersection performance) is not part of this
+reader snapshot.
+
+`hayro-cmap` 0.1.0 is transferred from [PdfCraft revision a2ec27b4775f53c40cad3456936d9406611e3a8d](https://github.com/storytold/pdfcraft/tree/a2ec27b4775f53c40cad3456936d9406611e3a8d/vendor/hayro-cmap)
+with its malformed-CMap patch (PdfCraft #3177): bad `bfchar` or `bfrange` entries, an
+unresolvable `usecmap` and an unparseable tail are skipped instead of discarding the whole
+CMap. Its tests `tests::bad_bfchar_entry_is_skipped` and `tests::unresolvable_usecmap_is_skipped`
+come with it. One local patch: a binary `usecmap` counts against the 16-level nesting limit
+as a text one does, so a self-referencing binary CMap stops instead of overflowing the stack.
+Consuming workspaces need a `hayro-cmap` patch entry beside the other Hayro entries.
+
+`hayro-postscript` 0.1.0 is the crates.io package (upstream revision
+a2354aebaf86f5ab13e5fd6b6b0521306488bf9d), the PostScript token scanner `hayro-cmap` uses
+to parse the CMap streams PDFs embed. One local patch: the scanner, which does not parse
+dictionaries yet, skips runs of `<<` and `>>` in a loop and returns the next object, instead
+of recursing once per delimiter, so a long run of `<` or `>` bytes no longer overflows the
+stack. Tests: `object::tests::long_open_dict_run_does_not_overflow`,
+`object::tests::long_close_dict_run_does_not_overflow`, `object::tests::dict_delimiters_are_skipped`
+and `object::tests::nested_dict_delimiters_are_skipped`. Its `SOURCE.json` records the
+registry hashes. Consuming workspaces need a `hayro-postscript` patch entry beside the other
+Hayro entries.
+
+Changes ported from PdfCraft pull requests that were open when they were ported, under the
+same MIT OR Apache-2.0 license. Code comments keep the pull request's patch numbers, except
+where noted below.
+
+| PdfCraft PR | Author | Source commit | Files | Change |
+|---|---|---|---|---|
+| [#2770](https://github.com/storytold/pdfcraft/pull/2770) | Guillem Hermida (guillehr2) | [6fcf2a4](https://github.com/guillehr2/pdfcraft/commit/6fcf2a4aca29e943e28cb69017ff8f87d00656c6) | hayro-interpret `color.rs`, `interpret/mod.rs`, `interpret/path.rs`, `interpret/state.rs`, `pattern.rs`, `shading.rs`, `soft_mask.rs`, `x_object.rs` | Patches 35 and 36, plate mode: `InterpreterSettings::plate` draws one ink's separation as a gray film (`color::Plate`, `ColorSpace::ink_use`/`ink_tint`); the graphics state reads `OP`, `op` and `OPM` and an overprinting paint that doesn't specify the plate's ink leaves the plate as it is (ISO 32000-2 §8.6.7); `InterpreterSettings::ink_sink` reports spot inks; `color::CmykSimulation` converts process color to an output intent's CMYK. Only the vendored interpreter part is ported; PdfCraft's `separations.rs` and Output Preview UI are not |
+| [#2974](https://github.com/storytold/pdfcraft/pull/2974) | mtlcl410 | [bae6981](https://github.com/mtlcl410/pdfcraft/commit/bae69819594a6385a027fec1f67e6b3c36c259b4) | hayro-interpret `device.rs`, `x_object.rs`; hayro `renderer.rs` | Knockout groups (`/K true`) knock out: while one is innermost, fills, strokes, glyph outlines and shadings are drawn with `Compose::Copy` (weighted by coverage); an unmasked image's rectangle (`Device::knockout_image`) and a nested group's shape (an erase pass between `Device::begin_knockout_erase` and `end_knockout_erase`) are cleared before their layer composites; a transparency group drawn in a knockout group always gets a layer of its own. Masked images and stencils composite as before |
+
+Code comments label #2974's changes `Knockout patch (pdfcraft #2974)` instead of a number: the
+pull request numbers them hayro-interpret patch 39 and hayro patch 19, and PdfCraft may
+renumber them when it merges. `crates/pdf/tests/knockout.rs` adapts its test; a plate-mode
+test in `crates/pdf/tests/plates.rs` checks that a knockout group separates with only the top
+object where two objects overlap. The erase pass resolves the group's resources with
+`Resources::from_scope`, as the group's own draw does in this tree.
+
+A craft-libs patch, labeled `Craft patch (CMYK masks)` in code comments,
+takes a luminosity soft mask whose group is DeviceCMYK from the group's inks: ISO 32000-2
+§11.6.5.2 and §10.4.2.2 give `1 - min(1, 0.3c + 0.59m + 0.11y + k)`, where the colors as
+drawn through the CMYK profile leave K 100% at about a tenth. hayro's `renderer.rs` draws
+the group's four process plates over the backdrop's film (`SoftMask::plate`,
+`SoftMask::interpret_plate`, `Plate::tint`) and applies the formula. On those plates spot
+colorants paint through their alternate space (`Plate::spots_as_process`) and nothing
+overprints. Masks in other color spaces are unchanged. A test in
+`crates/pdf/tests/plates.rs` checks process, spot, RGB and backdrop colors.
+
+The output-intent conversion of patch 36 goes through a `color::CmykConversion` trait, so
+that callers can convert with their own color management. `CmykSimulation::new` keeps
+#2770's moxcms conversion as the default, and `CmykSimulation::with_conversion` takes a
+caller's. Lab and ICCBased colors reach the conversion as CIE XYZ relative to the D50 PCS
+white (`color::PCS_WHITE`); the moxcms conversion takes them on through #2770's ProPhoto hub.
+`crates/pdf/tests/plates.rs` adapts #2770's plate tests to the raster path, with its
+synthetic ICC profiles in `crates/pdf/tests/support/synthetic_icc.rs`.
+
 The shared snapshot adds immutable per-document ordinary decode limits, threaded through
 initial xrefs, object streams, fallback and repair. Existing constructors retain their
 previous default. Known-size image budgets and streaming content budgets remain distinct.
@@ -58,6 +137,174 @@ Hostile-input bounds (CodeRabbit findings):
 - An xref-stream `/W` type field wider than one byte is read at its full width (big-endian)
   instead of only its first byte, and `/W[0]` over 8 bytes is refused like `/W[1]`.
   A dash array over 256 entries strokes solid.
+- An xref-stream subsection running past object number `i32::MAX` is refused instead of
+  overflowing or turning negative.
+- A CID font's `/W2` run that starts past CID 65535 is skipped as in `/W`, instead of
+  overflowing and discarding the whole table.
+- CCITT images: `ccitt_size_ok` (inherited PdfCraft ledger item 2) allows at most 2^20
+  columns and 2^28 pixels (columns × rows) before the decoder allocates. A `/Columns` past
+  `u32::MAX` is refused rather than wrapped to a small width. `/Rows` follows PdfCraft (17)
+  and (19): `/Rows 0` or a value below `/Height` decodes to the image height, and decoding
+  still stops where the data ends.
+
+Reader limits from the [PdfCraft revision a2ec27b4775f53c40cad3456936d9406611e3a8d ledger](https://github.com/storytold/pdfcraft/blob/a2ec27b4775f53c40cad3456936d9406611e3a8d/vendor/README.md),
+by its item ids: hayro-interpret (31) comes with the ec0a965 re-sync (patches 31–33 above):
+its flat sample array computes the largest 32-bit Type 0 sample in 64 bits instead of
+overflowing `2_u32.pow(32)`. hayro-syntax (7), (22) and (25) are covered by the local bounds
+above: ASCII85 output stops at the decode limit, object-stream indexes are parsed once with
+checked offsets, and direct objects nest at most 64 levels, stricter than PdfCraft's 128. Test:
+`function::type0::tests::thirty_two_bit_samples_do_not_overflow`.
+
+Fixes from the same [PdfCraft revision a2ec27b4775f53c40cad3456936d9406611e3a8d ledger](https://github.com/storytold/pdfcraft/blob/a2ec27b4775f53c40cad3456936d9406611e3a8d/vendor/README.md),
+by its item ids, each marked `PdfCraft patch` in the source. The ec0a965 re-sync brings
+hayro-syntax (17) and (19), CCITT `/Rows 0` or fewer `/Rows` than `/Height` decode to the
+image height; (20), spaces or tabs between `stream` and its line break; the `base_dimensions`
+one-point floor after `/UserUnit`; and in hayro-interpret (30), the Annex D.2 alias codes
+(WinAnsi 0xA0 and 0xAD, MacRoman 0xCA) read as an ordinary space and hyphen unless
+`/Differences` names them, and (P2), a Type 3 glyph's `/FontBBox` is taken to device space
+before it bounds the glyph's clip and shadings. Ported from the ledger on top of it: in
+hayro-syntax, the `EI` extension of (4), `EI` followed by a delimiter ends an inline image;
+(23), bytes above 0x7F after an `EI` candidate don't reject it; the unledgered #3565 fix, a
+doubled sign (`--280`) is one number in both read and skip, beside the local zero-tolerance
+sign tokens; in hayro-interpret, (44), a `/ToUnicode /Identity-H` or `/Identity-V` name reads
+two-byte codes as Unicode; (P6), glyph names outside the Adobe Glyph List (`f_i`,
+`hyphen.case`, `uniXXXXXXXX`) read by the glyph list specification's full mapping; (P8), a
+substitute without a spacing character draws its ordinary space; and the extension of (26),
+comma-below letters (ș ț ķ ļ ņ ŗ Ģ) in the standard-font stand-ins are built from the font's
+comma. The unit tests of all these items come with them; the CCITT, Type 3 and comma-below
+raster tests are adapted in `tests/upstream_raster.rs` and the text contracts in
+`tests/upstream_text.rs`. (P8)'s PdfCraft test needs a Japanese substitute font and is not
+ported.
+- A CCITT image with `/Rows 0` (unknown height) decodes at most the rows that fit the stream's
+  output limit (counted in 1-bit rows) and 2^28 pixels; a known height is clamped the same way.
+  Before, it decoded to the end of the data, and a bit of 2D code can repeat a whole row.
+- A JPEG 2000 image over 2^28 pixels, or over its output limit (at least 64 MiB), by the
+  codestream's own dimensions is refused before decoding, and its buffer is reserved fallibly:
+  the image dictionary's smaller size no longer stands in for the size the decoder allocates.
+
+Paint fixes from the [PdfCraft revision 0b670caf4a090e9d83a7f41a84b4cb2144a2d33e ledger](https://github.com/storytold/pdfcraft/blob/0b670caf4a090e9d83a7f41a84b4cb2144a2d33e/vendor/README.md),
+each marked `PdfCraft patch` in the source: hayro-interpret (46) with its hayro counterpart
+(PdfCraft #2977), a stencil mask is painted with the fill paint, not the stroke paint, at the
+fill opacity once, and a pattern paint drops the opacity it captured at `scn`
+(`Pattern::without_opacity`); the unledgered PdfCraft #3246, a shading pattern takes the alpha
+current when it is painted (`Pattern::set_alpha`, also on a plate), so a `gs` after `scn` or
+`SCN` still applies; (36), marked `PdfCraft patch (#3035)` because the plate-mode code uses
+(35) and (36) for #2770's own numbers, a mesh pixel whose corner no triangle holds takes the
+triangle covering its center (`Triangle::covers`), so shared edges leave no seam; and (51),
+the saved-state byte and count sums saturate, so a huge dash array or clip list stays over
+the bound on 32-bit targets instead of wrapping. The PdfCraft raster tests for (46), #3246 and
+(36) are adapted in `tests/upstream_raster.rs`.
+
+Font and text fixes from the [PdfCraft revision 0b670caf4a090e9d83a7f41a84b4cb2144a2d33e ledger](https://github.com/storytold/pdfcraft/blob/0b670caf4a090e9d83a7f41a84b4cb2144a2d33e/vendor/README.md),
+each marked `PdfCraft patch` in the source: hayro-interpret (49) (PdfCraft #2949 and its
+follow-up), `OpenTypeFontBlob::new` accepts a `post` table version 1.0, 2.0 or 3.0 written
+with its 16-bit halves swapped (`00 00 00 03`, as ScanSoft PDF Create! embeds every font), and
+`glyph_names` reads such a table from a copy with the version written correctly, so a 2.0
+table's names serve `/Differences`; any other unknown version is still refused; (50)
+(PdfCraft #3958), `CffFontBlob::glyph_index_by_name` looks names up in a map built on first
+use and shared between clones instead of searching the charset for every character code, and
+the first glyph with a name still wins; and the unledgered PdfCraft #3116 (#3109), marked
+`PdfCraft patch (#3116)`, text in mode 7 (clip only) installs its clip and reaches the device
+as `GlyphDrawMode::Clip`, which hayro does not paint, so extraction that leaves out invisible
+OCR text (mode 3) keeps a heading drawn through its clip. The unit tests
+`font::blob::tests::{a_post_version_with_swapped_halves_is_read_as_the_version_it_means,
+glyph_names_resolve_to_the_first_glyph_with_that_name}` come with (49) and (50); the #3116
+contract is in `tests/upstream_text.rs`.
+
+Fixes from the [PdfCraft revision 0b670caf4a090e9d83a7f41a84b4cb2144a2d33e ledger](https://github.com/storytold/pdfcraft/blob/0b670caf4a090e9d83a7f41a84b4cb2144a2d33e/vendor/README.md),
+by its item ids, each marked `PdfCraft patch` in the source. hayro-syntax (24), PdfCraft
+#2400: `xref::prev_offset` reads a trailer `/Prev` written as a reference `N G R` as the
+offset that object holds when the section's own entries place it (iText's
+`indirectPrev.pdf`), and otherwise as offset N (tiff2pdf), so the earlier sections' pages
+are seen. Each section's entries are read before its `Prev` is followed; the local
+xref-stream bounds above apply to them unchanged. Tests:
+`xref::tests::prev_as_reference_reaches_the_earlier_section` and
+`xref::tests::prev_as_reference_to_an_object_holding_the_offset_reads_that_offset`.
+hayro-syntax (P5), PdfCraft #3184: `filter::jpx::decode` applies a JP2 palette (`pclr`) when
+the image dictionary has no `/ColorSpace`, or one that does not resolve, since the colors then
+come from the JP2 header (ISO 32000-2 §7.4.9). With a `/ColorSpace` the raw indices are kept,
+as an `/Indexed` space needs. Resolved palette colors are 8-bit samples whatever the
+precision of the indices; an image without a palette keeps its own. Tests:
+`filter::jpx::tests::jpx_palette_is_applied_without_a_color_space`,
+`filter::jpx::tests::jpx_palette_indices_stay_raw_for_an_indexed_color_space` and
+`filter::jpx::tests::palette_colours_are_eight_bit_and_other_samples_keep_their_precision`.
+PdfCraft's raster test `a_jp2_palette_keeps_its_colours_whatever_the_index_precision` is not
+ported: the unit tests show the same behavior.
+
+From [PdfCraft revision 0b670caf4a090e9d83a7f41a84b4cb2144a2d33e](https://github.com/storytold/pdfcraft/tree/0b670caf4a090e9d83a7f41a84b4cb2144a2d33e/vendor),
+unledgered and marked `PdfCraft patch` in the source: hayro-syntax #3438 (issue #3107), with
+its look-ahead bound from 01af6cba3. An inline image without a filter ends at the byte
+length its `/W`, `/H`, `/CS`, `/BPC` and `/IM` give (rows padded to whole bytes) when white
+space and `EI` follow there, so an `EI` inside its samples does not end it. Conflicting
+long and short keys, filters and other color spaces keep the `EI` look-ahead. When the
+computed end lies past the content window, the tokenizer asks for more data only while the
+image, its header and the terminator fit within `MAX_DECODED_STREAM`, and otherwise falls
+back to the look-ahead. Its unit tests in `content::tests` come with it. PdfCraft's raster
+test is not ported: the windowed tokenizer tests cover the same content streams.
+
+Rendering fixes from the [PdfCraft revision 0b670caf4a090e9d83a7f41a84b4cb2144a2d33e ledger](https://github.com/storytold/pdfcraft/blob/0b670caf4a090e9d83a7f41a84b4cb2144a2d33e/vendor/README.md),
+each marked `PdfCraft patch` in the source: hayro-interpret (40) (PdfCraft #2987), an optional
+content membership dictionary with a visibility expression (`/VE`: `/And`, `/Or` and `/Not`
+over groups the document lists in `/OCProperties /OCGs`) shows its content when the
+expression is true, ahead of `/OCGs` and `/P`; a malformed expression, or one nested deeper
+than 32 levels, is ignored and `/OCGs` and `/P` decide; and hayro (18) (PdfCraft #2972), the
+page renders as one transparency group over a transparent backdrop that is then put on the
+background, so a blend mode over an empty part of the page keeps its color; with a color
+replacement (reading colors) the background stays inside the group as its backdrop. A plate
+render (`InterpreterSettings::plate`) also keeps the background inside, marked `Craft patch`,
+so blend modes on a separation's film blend with the paper. The PdfCraft raster tests of both
+are adapted in `tests/upstream_raster.rs`.
+
+Default color spaces from the [PdfCraft revision 0b670caf4a090e9d83a7f41a84b4cb2144a2d33e ledger](https://github.com/storytold/pdfcraft/blob/0b670caf4a090e9d83a7f41a84b4cb2144a2d33e/vendor/README.md):
+hayro-interpret (38) (PdfCraft #3018), marked `PdfCraft patch (#3018)` because the plate-mode
+code labels #2770's changes by that pull request's own patch numbers. The `/DefaultGray`,
+`/DefaultRGB` and `/DefaultCMYK` color spaces of the resources in scope (ISO 32000-2
+§8.6.5.6) replace the device space that `g`/`G`, `rg`/`RG`, `k`/`K` and `cs`/`CS` select (by
+name, or through a `/ColorSpace` resource that is a device space), and the device
+`/ColorSpace` of an image XObject, an inline image or a shading painted by `sh` or as a
+shading pattern (`DefaultColorSpaces`, looked up once per content window). A default that is
+a device, Lab, Indexed or Pattern space, or has the wrong number of components, is ignored.
+Decoded images and shadings are cached per default. Two local differences: a form XObject
+with `/Resources` of its own sees only its own defaults, as it sees only its own other
+resources here (`Resources::from_scope`), where PdfCraft falls back to the page's; and on a
+plate (patch 35) no default applies, so DeviceCMYK still separates as its components with
+the nonzero overprint mode, and DeviceGray on black alone, rather than through a DefaultCMYK
+or DefaultGray profile and the CMYK simulation of patch 36. PdfCraft's eight raster tests are
+adapted in `tests/upstream_raster.rs` (`default_color_spaces`); the plate case is
+`default_color_spaces_leave_device_color_on_its_plates` in `tests/plates.rs`.
+
+A rendering speedup from the [PdfCraft revision 0b670caf4a090e9d83a7f41a84b4cb2144a2d33e ledger](https://github.com/storytold/pdfcraft/blob/0b670caf4a090e9d83a7f41a84b4cb2144a2d33e/vendor/README.md),
+hayro-interpret (35) with hayro (19), PdfCraft #3296, marked `PdfCraft patch (#3296)` because
+the plate-mode code uses (35) for #2770's own numbers. `EncodedShadingPattern::extent` is the
+device-space rectangle of the pixels a mesh shading's triangles touched when it was encoded
+(`None` for function-based, axial and radial shadings, and for a mesh with a `/Background`).
+`Renderer::set_paint` returns `PaintSetup`: a mesh texture covers that extent (and a
+transparent pixel around it, padded instead of repeated) rather than the whole path, and a
+mesh with no triangle on the canvas returns `PaintSetup::Nothing`, which the fill, stroke,
+rect and stencil callers skip. The rendered output is the same. The knockout erase pass
+returns before the extent is used, so it still clears under the whole path. Tests:
+`mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha,
+a_mesh_off_the_canvas_paints_nothing}` in hayro.
+
+An ICC profile cache fix from the [PdfCraft revision 0b670caf4a090e9d83a7f41a84b4cb2144a2d33e ledger](https://github.com/storytold/pdfcraft/blob/0b670caf4a090e9d83a7f41a84b4cb2144a2d33e/vendor/README.md):
+hayro-interpret (48) (PdfCraft #3020), marked `PdfCraft patch (#3020)`. The color space read
+from an `/ICCBased` profile stream is cached by `IccProfileKey`, not by the stream
+dictionary's bytes alone, so two profiles with the same `/N` and `/Length` no longer share
+whichever was read first. A stream object is looked up by its object identifier without
+reading it, and on a miss by its dictionary key and raw (decrypted, undecoded) bytes, so
+copies of a profile are read once; a stream written directly in its array has only the
+content key. `InterpreterCache::icc_profile_reads` counts the reads. The CMYK simulation of
+patch 36 doesn't use this cache: it is built from the output intent's bytes by the caller,
+and the digest that tells its profile from a document profile is still a hash of the
+decoded profile bytes. PdfCraft's two raster tests are adapted in `tests/upstream_raster.rs`
+(`icc_profile_cache`).
+
+Local fixes on top of these ports, marked `Craft patch` or in the comments of the ported
+code: an inflated patch-mesh triangle is rebuilt with `Triangle::new`, so its stored dot
+products match its vertices (moving the points alone skewed barycentric coordinates by about
+5 %, in `covers` and in interpolation); a stencil image puts the fill alpha back itself, since
+`restore_state` doesn't when the saved-state bound skipped the save; and a resolved JP2
+palette decodes to 8 bits whatever `/BitsPerComponent` the dictionary gives.
 
 This remains the patched 0.7 backend. It retains the existing Bradford Lab conversion,
 floating component precision and codec versions, rather than claiming full 0.8
@@ -79,3 +326,21 @@ The snapshot also preserves PdfCraft #1477 (WinAnsi Unicode fallback for TrueTyp
 fonts without Encoding) and #1499 (byte-aligned packed TIFF predictor rows).
 Synthetic tests cover 1/2/4/8-bit RGB rows and rendering, plus embedded TrueType
 text with absent or partial ToUnicode maps and explicit encoding precedence.
+
+## Craft patches for the flattener
+
+Local changes for craft-prepress's PDF-in adapter (`craft_prepress::flatten::pdf`), which reads
+pages through a `Device` that keeps colors as inks and embeds the source fonts again. Code
+comments label them `Craft patch (flatten)`.
+
+| Files | Change |
+|---|---|
+| hayro-interpret `font/outline.rs`, `font/cid.rs` | `OutlineFontData::embedded`: true when the bytes come from the PDF's `FontFile*`, false for a non-embedded CID font's substitute from the font resolver |
+| hayro-interpret `font/outline.rs`, `font/cid.rs`, `font/blob.rs` | `OutlineFontData::index`: the face index of the bytes in a font collection, as the resolver returned it |
+| hayro-interpret `font/outline.rs`, `font/type1.rs`, `font/mod.rs` | `OutlineGlyph::font_data` returns the bare CFF bytes of a simple `FontFile3/Type1C` font, with `embedded: true`; its glyph ids index the CFF. The descriptive fields (`postscript_name`, `weight`, flags) are left empty |
+| hayro-interpret `device.rs` | `Device::set_overprint(fill, stroke, mode)`: the `op`, `OP` and `OPM` for the paints that follow. `Device::set_isolated`: the group just pushed is isolated (`/I true`). Both default to no-ops |
+| hayro-interpret `interpret/path.rs`, `interpret/text.rs`, `x_object.rs` | `set_overprint` is called where `set_blend_mode` is for fills, strokes (the `sh` operator included), glyphs and images; `set_isolated` after an isolated group is pushed |
+| hayro-interpret `color.rs` | `Color::ink_paint`: the inks a color paints, as plate mode separates it (`color::InkPaint`). `Color::spot_alternate`: a spot ink at 100% (`color::SpotAlternate`), CMYK when the alternate space is DeviceCMYK. `Color::opacity` and `Color::is_device_cmyk` |
+| hayro-interpret `color.rs` | `color::InkSpace`, `ColorSpace::ink_space` and `ColorSpace::ink_values`: how a space's colors are kept as inks (gray, CMYK, its colorants, `All`, `None`) and colors converted in batches, process color as `Color::ink_paint` converts it. `ColorSpace::components`; `ColorSpace::is_device_cmyk` and `ColorSpace::spot_alternate` public |
+| hayro-interpret `types.rs`, `x_object.rs` | `RasterImage::with_inks`: an image's samples in its own space's inks (`InkImage`), `/Decode` and `/Matte` applied, transfer functions left out, with its alpha at the alpha's own size |
+| hayro-interpret `interpret/mod.rs` | The `sh` operator drops the shading's `/Background`, which only a shading pattern paints (ISO 32000-2 §8.7.4.5.1) |
diff --git a/vendor/hayro-cmap/Cargo.lock b/vendor/hayro-cmap/Cargo.lock
new file mode 100644
index 00000000..b19a6c70
--- /dev/null
+++ b/vendor/hayro-cmap/Cargo.lock
@@ -0,0 +1,53 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece"
+dependencies = [
+ "alloc-no-stdlib",
+]
+
+[[package]]
+name = "brotli"
+version = "8.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bd8b9603c7aa97359dbd97ecf258968c95f3adddd6db2f7e7a5bef101c84560"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "874bb8112abecc98cbd6d81ea4fa7e94fb9449648c93cc89aa40c81c24d7de03"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
+[[package]]
+name = "hayro-cmap"
+version = "0.1.0"
+dependencies = [
+ "brotli",
+ "hayro-postscript",
+]
+
+[[package]]
+name = "hayro-postscript"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "885c5ef0654933139a9b9546fc2c69e18d37f38aa2520f079092b1be18f1fcaa"
diff --git a/vendor/hayro-cmap/Cargo.toml b/vendor/hayro-cmap/Cargo.toml
new file mode 100644
index 00000000..3818d177
--- /dev/null
+++ b/vendor/hayro-cmap/Cargo.toml
@@ -0,0 +1,87 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2024"
+name = "hayro-cmap"
+version = "0.1.0"
+authors = ["Laurenz Stampfl <laurenz.stampfl@gmail.com>"]
+build = false
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "A parser for CMap files."
+readme = "README.md"
+license = "Apache-2.0 OR MIT"
+repository = "https://github.com/LaurenzV/hayro"
+resolver = "2"
+
+[features]
+default = ["embed-cmaps"]
+embed-cmaps = [
+    "std",
+    "dep:brotli",
+]
+std = []
+
+[lib]
+name = "hayro_cmap"
+path = "src/lib.rs"
+
+[dependencies.brotli]
+version = "8"
+features = [
+    "std",
+    "std",
+]
+optional = true
+default-features = false
+
+[dependencies.hayro-postscript]
+version = "0.1.0"
+default-features = false
+
+[lints.clippy]
+collection_is_never_read = "warn"
+dbg_macro = "warn"
+debug_assert_with_mut_call = "warn"
+default_trait_access = "warn"
+doc_markdown = "warn"
+fn_to_numeric_cast_any = "warn"
+infinite_loop = "warn"
+large_stack_arrays = "warn"
+mismatching_type_param_order = "warn"
+negative_feature_names = "warn"
+redundant_feature_names = "warn"
+same_functions_in_if_condition = "warn"
+semicolon_if_nothing_returned = "warn"
+todo = "warn"
+too_many_arguments = "allow"
+unseparated_literal_suffix = "warn"
+use_self = "warn"
+wildcard_dependencies = "warn"
+
+[lints.rust]
+elided_lifetimes_in_paths = "warn"
+keyword_idents_2024 = "forbid"
+missing_docs = "warn"
+non_ascii_idents = "forbid"
+non_local_definitions = "forbid"
+trivial_numeric_casts = "warn"
+unnameable_types = "warn"
+unreachable_pub = "warn"
+unsafe_op_in_unsafe_fn = "forbid"
+unused_import_braces = "warn"
+unused_lifetimes = "warn"
+unused_macro_rules = "warn"
+unused_qualifications = "warn"
diff --git a/vendor/hayro-cmap/Cargo.toml.orig b/vendor/hayro-cmap/Cargo.toml.orig
new file mode 100644
index 00000000..59f5c99d
--- /dev/null
+++ b/vendor/hayro-cmap/Cargo.toml.orig
@@ -0,0 +1,21 @@
+[package]
+name = "hayro-cmap"
+version = "0.1.0"
+description = "A parser for CMap files."
+authors = { workspace = true }
+edition = { workspace = true }
+repository = { workspace = true }
+license = { workspace = true }
+
+[features]
+default = ["embed-cmaps"]
+std = []
+# Embed the 61 predefined cmaps into the binary. Adds about ~250KB of brotli-encoded data.
+embed-cmaps = ["std", "dep:brotli"]
+
+[dependencies]
+hayro-postscript = { workspace = true }
+brotli = { workspace = true, optional = true, features = ["std"] }
+
+[lints]
+workspace = true
diff --git a/vendor/hayro-cmap/LICENSE-APACHE b/vendor/hayro-cmap/LICENSE-APACHE
new file mode 100644
index 00000000..4947287f
--- /dev/null
+++ b/vendor/hayro-cmap/LICENSE-APACHE
@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
\ No newline at end of file
diff --git a/vendor/hayro-cmap/LICENSE-MIT b/vendor/hayro-cmap/LICENSE-MIT
new file mode 100644
index 00000000..ae3742de
--- /dev/null
+++ b/vendor/hayro-cmap/LICENSE-MIT
@@ -0,0 +1,7 @@
+Copyright (c) The Hayro Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
\ No newline at end of file
diff --git a/vendor/hayro-cmap/README.md b/vendor/hayro-cmap/README.md
new file mode 100644
index 00000000..bc93f93d
--- /dev/null
+++ b/vendor/hayro-cmap/README.md
@@ -0,0 +1,25 @@
+# hayro-cmap
+
+[![Crates.io](https://img.shields.io/crates/v/hayro-cmap.svg)](https://crates.io/crates/hayro-cmap)
+[![Documentation](https://docs.rs/hayro-cmap/badge.svg)](https://docs.rs/hayro-cmap)
+
+<!-- cargo-rdme start -->
+
+A parser for cmap files, as they are found in PDFs.
+
+This crate provides a parser for CMap files and allows you to
+- Map character codes from text-showing operators to CID identifiers.
+- Map CIDs to Unicode characters or strings.
+
+### Safety
+This crate forbids unsafe code via a crate-level attribute.
+
+<!-- cargo-rdme end -->
+
+## License
+Licensed under either of
+
+- Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or <http://www.apache.org/licenses/LICENSE-2.0>)
+- MIT license ([LICENSE-MIT](LICENSE-MIT) or <http://opensource.org/licenses/MIT>)
+
+at your option.
diff --git a/vendor/hayro-cmap/SOURCE.json b/vendor/hayro-cmap/SOURCE.json
new file mode 100644
index 00000000..2c72f523
--- /dev/null
+++ b/vendor/hayro-cmap/SOURCE.json
@@ -0,0 +1,98 @@
+{
+  "crate": "hayro-cmap",
+  "source_repository": "https://github.com/storytold/pdfcraft",
+  "source_revision": "a2ec27b4775f53c40cad3456936d9406611e3a8d",
+  "source_directory": "vendor/hayro-cmap",
+  "files": [
+    {
+      "path": "Cargo.lock",
+      "source_sha256": "b0ffb94a754c7254ecbead6649fa7877b6875531f9af8c62f7c28e1b11c5a391",
+      "source_git_blob": "b19a6c70fe633320e822a370fa242f32b7e0f914",
+      "sha256": "b0ffb94a754c7254ecbead6649fa7877b6875531f9af8c62f7c28e1b11c5a391"
+    },
+    {
+      "path": "Cargo.toml",
+      "source_sha256": "7066550c610db3cb13df3c955f5737dccc3d9d24b6b680e9f633ecfadb82bf86",
+      "source_git_blob": "3818d177b6dcc5c0d754bc3ecf1a3422476c7e2f",
+      "sha256": "7066550c610db3cb13df3c955f5737dccc3d9d24b6b680e9f633ecfadb82bf86"
+    },
+    {
+      "path": "Cargo.toml.orig",
+      "source_sha256": "9bcaf09fca4f5880318ba762cf07d5d269c458bb06f0b6409ae0879b2e564be3",
+      "source_git_blob": "59f5c99d3f5082e9f5064055da016aed0d4fcf35",
+      "sha256": "9bcaf09fca4f5880318ba762cf07d5d269c458bb06f0b6409ae0879b2e564be3"
+    },
+    {
+      "path": "LICENSE-APACHE",
+      "source_sha256": "0cec06e0e55fbc3dc5cee4fca9b607f66cb8f4e4dbcf3b3c013594dd156732e9",
+      "source_git_blob": "4947287f7b5ccb5d1e8b7b2d3aa5d89f322c160d",
+      "sha256": "0cec06e0e55fbc3dc5cee4fca9b607f66cb8f4e4dbcf3b3c013594dd156732e9"
+    },
+    {
+      "path": "LICENSE-MIT",
+      "source_sha256": "51b50e6120c344dcc146bbd6375ca1c78e079d97c8bea76e67a53d6ff0efebac",
+      "source_git_blob": "ae3742de4e9ccb463cb46f05fe3ca0ec23fbb0d2",
+      "sha256": "51b50e6120c344dcc146bbd6375ca1c78e079d97c8bea76e67a53d6ff0efebac"
+    },
+    {
+      "path": "README.md",
+      "source_sha256": "167f3ef1e830520bcc45359a21e513069e75a42393722accca9f56822f1dcc82",
+      "source_git_blob": "bc93f93daa6b750afd709e2bcdfa2b2518b6e6a5",
+      "sha256": "167f3ef1e830520bcc45359a21e513069e75a42393722accca9f56822f1dcc82"
+    },
+    {
+      "path": "assets/LICENSE.txt",
+      "source_sha256": "742665db9c8e1bc72603c6d319ca3e90b83bd6d95202f0cd4ef11068a07a9c29",
+      "source_git_blob": "2552cc990c12f85cdc50ef3c5185061a8c64e326",
+      "sha256": "742665db9c8e1bc72603c6d319ca3e90b83bd6d95202f0cd4ef11068a07a9c29"
+    },
+    {
+      "path": "assets/README.md",
+      "source_sha256": "61a2206d48aa4bac7dfc39416b0526fd994d0173897666f231f5c370cc06f646",
+      "source_git_blob": "4cedb1ff6d3c6d0b44e5cf20f749fb470bc8de01",
+      "sha256": "61a2206d48aa4bac7dfc39416b0526fd994d0173897666f231f5c370cc06f646"
+    },
+    {
+      "path": "assets/cmaps.brotli",
+      "source_sha256": "ddf37af521d904d5646c2fc37b2b7e912dc1b56f0d210190b61f598154758e46",
+      "source_git_blob": "ba74bd32fc71bb274e3e7e5c36bafaf89b9d6815",
+      "sha256": "ddf37af521d904d5646c2fc37b2b7e912dc1b56f0d210190b61f598154758e46"
+    },
+    {
+      "path": "src/bcmap/embedded.rs",
+      "source_sha256": "c1e18cf9fa5c413fe87bbc69394f2b8f0a7f6b5cda30b926665d0596ea79691b",
+      "source_git_blob": "0f5c241a0e278da6e3eefe72fe3925ce7e177f57",
+      "sha256": "c1e18cf9fa5c413fe87bbc69394f2b8f0a7f6b5cda30b926665d0596ea79691b"
+    },
+    {
+      "path": "src/bcmap/huffman.rs",
+      "source_sha256": "9b1f4ba036f8b6e9011b2fb9c1d80f6b34ba4c1be3c101b9678a8b49a8d352ea",
+      "source_git_blob": "b6e8e9ab5d9fcdf831ceedaa7f620bd9d5e7ac8c",
+      "sha256": "9b1f4ba036f8b6e9011b2fb9c1d80f6b34ba4c1be3c101b9678a8b49a8d352ea"
+    },
+    {
+      "path": "src/bcmap/mod.rs",
+      "source_sha256": "38dafbd8fcb5ca6f647d70d02cdb5af532ea7f2a3ac3f7ac8d1dea23abc93058",
+      "source_git_blob": "997bc00d85db1504c63cf56e3cb157410ebdb0bb",
+      "sha256": "3d0ea5e34bc92c40a250923ecb71b48571100bba5cc4664ea2c46d51086fe6be"
+    },
+    {
+      "path": "src/bcmap/reader.rs",
+      "source_sha256": "343b20170f8445258fb564f4f5387f66df804920d73886981f0db8829562d1cf",
+      "source_git_blob": "25d6639104148a9123044c2c092a9bee5c889fd3",
+      "sha256": "343b20170f8445258fb564f4f5387f66df804920d73886981f0db8829562d1cf"
+    },
+    {
+      "path": "src/lib.rs",
+      "source_sha256": "d666b3d8e4d37fc06c299a60ab9748ae17badcea271ff2cf864dcee76e27648c",
+      "source_git_blob": "fb42ff37ec9ccece66d33d1888bd25963cbf1171",
+      "sha256": "d6b9c6fa8de00942dd4cdfbd43578d3e53f8a3a6cf1e3563b345a9f6f35bc5e8"
+    },
+    {
+      "path": "src/parse.rs",
+      "source_sha256": "1999127f05b59bdd55e2a7349dafc0b2213238201da37f7c35cd698996f2dc6b",
+      "source_git_blob": "a936209275ffca797912dec052dc03ddb0d2dce4",
+      "sha256": "1999127f05b59bdd55e2a7349dafc0b2213238201da37f7c35cd698996f2dc6b"
+    }
+  ]
+}
diff --git a/vendor/hayro-cmap/assets/LICENSE.txt b/vendor/hayro-cmap/assets/LICENSE.txt
new file mode 100644
index 00000000..2552cc99
--- /dev/null
+++ b/vendor/hayro-cmap/assets/LICENSE.txt
@@ -0,0 +1,28 @@
+Copyright 1990-2023 Adobe. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+Redistributions of source code must retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+Neither the name of Adobe nor the names of its contributors may be
+used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/hayro-cmap/assets/README.md b/vendor/hayro-cmap/assets/README.md
new file mode 100644
index 00000000..4cedb1ff
--- /dev/null
+++ b/vendor/hayro-cmap/assets/README.md
@@ -0,0 +1,2 @@
+See https://github.com/LaurenzV/cmap-resources/tree/hayro for information on how this blob was generated and how
+it can be parsed.
\ No newline at end of file
diff --git a/vendor/hayro-cmap/assets/cmaps.brotli b/vendor/hayro-cmap/assets/cmaps.brotli
new file mode 100644
index 00000000..ba74bd32
Binary files /dev/null and b/vendor/hayro-cmap/assets/cmaps.brotli differ
diff --git a/vendor/hayro-cmap/src/bcmap/embedded.rs b/vendor/hayro-cmap/src/bcmap/embedded.rs
new file mode 100644
index 00000000..0f5c241a
--- /dev/null
+++ b/vendor/hayro-cmap/src/bcmap/embedded.rs
@@ -0,0 +1,129 @@
+use std::ops::Range;
+use std::sync::LazyLock;
+
+use super::huffman::{self, HuffmanTable};
+use super::reader::Reader;
+use crate::CMapName;
+
+pub(super) static BUNDLE: LazyLock<Bundle> = LazyLock::new(|| {
+    // We already know the bundle is valid, so we can skip validation and just
+    // unwrap everywhere.
+
+    let compressed = include_bytes!("../../assets/cmaps.brotli");
+    let mut decompressed = Vec::new();
+    let mut reader = compressed.as_slice();
+
+    brotli::BrotliDecompress(&mut reader, &mut decompressed)
+        .ok()
+        .unwrap();
+
+    let mut reader = Reader::new(&decompressed);
+    let huff_size = reader.read_u32().unwrap() as usize;
+    let huff_data = reader.read_bytes(huff_size).unwrap();
+    let (delta_table, count_table) = huffman::decode_tables(huff_data).unwrap();
+
+    let mut entries = Vec::new();
+
+    while !reader.at_end() {
+        let start = reader.position();
+
+        // Skip file magic and version.
+        reader.read_bytes(6).unwrap();
+        let file_len = reader.read_u32().unwrap() as usize;
+
+        reader.read_bytes(file_len - 10).unwrap();
+        entries.push(start..start + file_len);
+    }
+
+    Bundle {
+        data: decompressed,
+        delta_table,
+        count_table,
+        entries,
+    }
+});
+
+pub(super) struct Bundle {
+    data: Vec<u8>,
+    pub(super) delta_table: HuffmanTable,
+    pub(super) count_table: HuffmanTable,
+    entries: Vec<Range<usize>>,
+}
+
+/// Load the data for a cmap file, by name.
+pub fn load_embedded(name: CMapName<'_>) -> Option<&'static [u8]> {
+    // Get the index of the font of the cmap in the bundle. They are sorted
+    // alphabetically.
+    let idx = match name {
+        CMapName::N83pvRksjH => 0,
+        CMapName::N90msRksjH => 1,
+        CMapName::N90msRksjV => 2,
+        CMapName::N90mspRksjH => 3,
+        CMapName::N90mspRksjV => 4,
+        CMapName::N90pvRksjH => 5,
+        CMapName::AddRksjH => 6,
+        CMapName::AddRksjV => 7,
+        CMapName::AdobeCns1Ucs2 => 8,
+        CMapName::AdobeGb1Ucs2 => 9,
+        CMapName::AdobeJapan1Ucs2 => 10,
+        CMapName::AdobeKorea1Ucs2 => 11,
+        CMapName::B5pcH => 12,
+        CMapName::B5pcV => 13,
+        CMapName::CnsEucH => 14,
+        CMapName::CnsEucV => 15,
+        CMapName::ETenB5H => 16,
+        CMapName::ETenB5V => 17,
+        CMapName::ETenmsB5H => 18,
+        CMapName::ETenmsB5V => 19,
+        CMapName::EucH => 20,
+        CMapName::EucV => 21,
+        CMapName::ExtRksjH => 22,
+        CMapName::ExtRksjV => 23,
+        CMapName::GbEucH => 24,
+        CMapName::GbEucV => 25,
+        CMapName::GbkEucH => 26,
+        CMapName::GbkEucV => 27,
+        CMapName::Gbk2kH => 28,
+        CMapName::Gbk2kV => 29,
+        CMapName::GbkpEucH => 30,
+        CMapName::GbkpEucV => 31,
+        CMapName::GbpcEucH => 32,
+        CMapName::GbpcEucV => 33,
+        CMapName::H => 34,
+        CMapName::HKscsB5H => 35,
+        CMapName::HKscsB5V => 36,
+        CMapName::IdentityH => 37,
+        CMapName::IdentityV => 38,
+        CMapName::KscEucH => 39,
+        CMapName::KscEucV => 40,
+        CMapName::KscmsUhcH => 41,
+        CMapName::KscmsUhcHwH => 42,
+        CMapName::KscmsUhcHwV => 43,
+        CMapName::KscmsUhcV => 44,
+        CMapName::KscpcEucH => 45,
+        CMapName::UniCnsUcs2H => 46,
+        CMapName::UniCnsUcs2V => 47,
+        CMapName::UniCnsUtf16H => 48,
+        CMapName::UniCnsUtf16V => 49,
+        CMapName::UniGbUcs2H => 50,
+        CMapName::UniGbUcs2V => 51,
+        CMapName::UniGbUtf16H => 52,
+        CMapName::UniGbUtf16V => 53,
+        CMapName::UniJisUcs2H => 54,
+        CMapName::UniJisUcs2HwH => 55,
+        CMapName::UniJisUcs2HwV => 56,
+        CMapName::UniJisUcs2V => 57,
+        CMapName::UniJisUtf16H => 58,
+        CMapName::UniJisUtf16V => 59,
+        CMapName::UniKsUcs2H => 60,
+        CMapName::UniKsUcs2V => 61,
+        CMapName::UniKsUtf16H => 62,
+        CMapName::UniKsUtf16V => 63,
+        CMapName::V => 64,
+        CMapName::Custom(_) => return None,
+    };
+
+    let range = BUNDLE.entries.get(idx)?;
+
+    Some(&BUNDLE.data[range.clone()])
+}
diff --git a/vendor/hayro-cmap/src/bcmap/huffman.rs b/vendor/hayro-cmap/src/bcmap/huffman.rs
new file mode 100644
index 00000000..b6e8e9ab
--- /dev/null
+++ b/vendor/hayro-cmap/src/bcmap/huffman.rs
@@ -0,0 +1,180 @@
+use alloc::vec;
+use alloc::vec::Vec;
+use core::num::NonZeroU32;
+
+use super::reader::Reader;
+
+#[derive(Debug, Clone, Copy)]
+pub(super) enum HuffmanNode {
+    /// Intermediate node with optional children.
+    Intermediate {
+        /// Index of the zero-child.
+        zero: Option<NonZeroU32>,
+        /// Index of the one-child.
+        one: Option<NonZeroU32>,
+    },
+    /// Leaf node holding a decoded symbol value.
+    Leaf(u32),
+}
+
+/// A Huffman table built from canonical codes.
+#[derive(Debug)]
+pub(super) struct HuffmanTable {
+    nodes: Vec<HuffmanNode>,
+}
+
+impl HuffmanTable {
+    /// Decode a single symbol from the bit reader.
+    pub(super) fn decode(&self, reader: &mut Reader<'_>) -> Option<u32> {
+        let mut idx = 0_u32;
+
+        loop {
+            match self.nodes[idx as usize] {
+                HuffmanNode::Intermediate { zero, one } => {
+                    let bit = reader.read_bit()?;
+                    let child = if bit == 0 { zero } else { one };
+                    idx = child?.get();
+                }
+                HuffmanNode::Leaf(symbol) => return Some(symbol),
+            }
+        }
+    }
+
+    fn insert_code(
+        nodes: &mut Vec<HuffmanNode>,
+        node_index: u32,
+        code: u32,
+        length: u8,
+        symbol: u32,
+    ) {
+        if length == 0 {
+            nodes[node_index as usize] = HuffmanNode::Leaf(symbol);
+
+            return;
+        }
+
+        let bit = (code >> (length - 1)) & 1;
+        let remaining = code & ((1 << (length - 1)) - 1);
+
+        let child_index = match &nodes[node_index as usize] {
+            HuffmanNode::Intermediate { zero, one } => {
+                let existing = if bit == 0 { *zero } else { *one };
+                match existing {
+                    Some(idx) => idx,
+                    None => {
+                        let new_idx = NonZeroU32::new(nodes.len() as u32).unwrap();
+                        nodes.push(HuffmanNode::Intermediate {
+                            zero: None,
+                            one: None,
+                        });
+
+                        match &mut nodes[node_index as usize] {
+                            HuffmanNode::Intermediate { zero, one } => {
+                                if bit == 0 {
+                                    *zero = Some(new_idx);
+                                } else {
+                                    *one = Some(new_idx);
+                                }
+                            }
+                            _ => unreachable!(),
+                        }
+                        new_idx
+                    }
+                }
+            }
+            _ => return,
+        };
+
+        Self::insert_code(nodes, child_index.get(), remaining, length - 1, symbol);
+    }
+
+    fn build(code_lengths: &[u8], symbols: &[u32]) -> Self {
+        debug_assert_eq!(code_lengths.len(), symbols.len());
+
+        if symbols.is_empty() {
+            return Self {
+                nodes: vec![HuffmanNode::Intermediate {
+                    zero: None,
+                    one: None,
+                }],
+            };
+        }
+
+        let max_length = *code_lengths.iter().max().unwrap_or(&0) as usize;
+
+        let mut codes = vec![0_u32; symbols.len()];
+        let mut code = 0_u32;
+
+        for length in 1..=max_length {
+            for (i, &cl) in code_lengths.iter().enumerate() {
+                if cl as usize == length {
+                    codes[i] = code;
+                    code += 1;
+                }
+            }
+            code <<= 1;
+        }
+
+        let mut nodes = vec![HuffmanNode::Intermediate {
+            zero: None,
+            one: None,
+        }];
+
+        for (i, &symbol) in symbols.iter().enumerate() {
+            if code_lengths[i] == 0 {
+                continue;
+            }
+
+            Self::insert_code(&mut nodes, 0, codes[i], code_lengths[i], symbol);
+        }
+
+        Self { nodes }
+    }
+}
+
+pub(super) fn decode_tables(data: &[u8]) -> Option<(HuffmanTable, HuffmanTable)> {
+    let mut reader = Reader::new(data);
+    let delta = decode_single_table(&mut reader, |r| r.read_u32())?;
+    let count = decode_single_table(&mut reader, |r| r.read_u8().map(u32::from))?;
+
+    Some((delta, count))
+}
+
+fn decode_single_table(
+    reader: &mut Reader<'_>,
+    read_sym: fn(&mut Reader<'_>) -> Option<u32>,
+) -> Option<HuffmanTable> {
+    let n_symbols = reader.read_u16()? as usize;
+
+    if n_symbols == 0 {
+        let _max_len = reader.read_u8()?;
+
+        return Some(HuffmanTable {
+            nodes: vec![HuffmanNode::Intermediate {
+                zero: None,
+                one: None,
+            }],
+        });
+    }
+
+    let max_code_length = reader.read_u8()? as usize;
+
+    let mut counts = Vec::with_capacity(max_code_length);
+    for _ in 0..max_code_length {
+        counts.push(reader.read_u16()?);
+    }
+
+    let mut code_lengths = Vec::with_capacity(n_symbols);
+    let mut symbols = Vec::with_capacity(n_symbols);
+
+    for (length_idx, &count) in counts.iter().enumerate() {
+        let code_len = (length_idx + 1) as u8;
+
+        for _ in 0..count {
+            symbols.push(read_sym(reader)?);
+            code_lengths.push(code_len);
+        }
+    }
+
+    Some(HuffmanTable::build(&code_lengths, &symbols))
+}
diff --git a/vendor/hayro-cmap/src/bcmap/mod.rs b/vendor/hayro-cmap/src/bcmap/mod.rs
new file mode 100644
index 00000000..e20c4590
--- /dev/null
+++ b/vendor/hayro-cmap/src/bcmap/mod.rs
@@ -0,0 +1,419 @@
+//! Inspired by pdf.js, we use a custom binary format to optionally embed
+//! the required cmaps in a space-efficient manner. However, we don't use
+//! their format description but have a custom one. For more information,
+//! see <https://github.com/LaurenzV/cmap-resources/tree/hayro>.
+
+pub(crate) mod embedded;
+pub(crate) mod huffman;
+pub(crate) mod reader;
+
+use alloc::boxed::Box;
+use alloc::vec::Vec;
+
+pub use embedded::load_embedded;
+
+use crate::bcmap::embedded::BUNDLE;
+use crate::{
+    BfRange, CMap, CMapName, CharacterCollection, CidFamily, CidRange, CodespaceRange, Metadata,
+    PartitionedRanges, Range, WritingMode, parse,
+};
+use huffman::HuffmanTable;
+use reader::Reader;
+
+const BCMAP_MAGIC: &[u8] = b"bcmap";
+const BCMAP_VERSION: u8 = 0x01;
+const BCMAP_FILE_HEADER_SIZE: usize = 10;
+const SEG_HEADER_SIZE: usize = 5;
+
+const SEGMENT_RANGE_1B: u8 = 0x01;
+const SEGMENT_SINGLE_1B: u8 = 0x02;
+const SEGMENT_RANGE_2B: u8 = 0x03;
+const SEGMENT_SINGLE_2B: u8 = 0x04;
+const SEGMENT_RANGE_3B: u8 = 0x05;
+const SEGMENT_SINGLE_3B: u8 = 0x06;
+const SEGMENT_RANGE_4B: u8 = 0x07;
+const SEGMENT_SINGLE_4B: u8 = 0x08;
+const SEGMENT_USECMAP: u8 = 0x09;
+const SEGMENT_NOTDEF: u8 = 0x0A;
+const SEGMENT_WMODE: u8 = 0x0B;
+const SEGMENT_CODESPACE: u8 = 0x0C;
+const SEGMENT_NAME: u8 = 0x0D;
+const SEGMENT_CID_SYSTEM_INFO: u8 = 0x0E;
+const SEGMENT_BF_RANGE_VARIABLE: u8 = 0x0F;
+const SEGMENT_BF_SINGLE_VARIABLE: u8 = 0x10;
+const SEGMENT_BF_SINGLE_1U: u8 = 0x11;
+const SEGMENT_BF_SINGLE_2U: u8 = 0x12;
+const SEGMENT_BF_SINGLE_3U: u8 = 0x13;
+const SEGMENT_BF_SINGLE_4U: u8 = 0x14;
+const SEGMENT_BF_RANGE_1U: u8 = 0x15;
+const SEGMENT_BF_RANGE_2U: u8 = 0x16;
+
+pub(crate) fn parse<'a>(
+    data: &[u8],
+    get_cmap: impl Fn(CMapName<'_>) -> Option<&'a [u8]> + Clone + 'a,
+    depth: u32,
+) -> Option<CMap> {
+    // While in theory we can assume that all binary cmaps are valid, it can
+    // of course happen that an invalid one has been passed from outside, so
+    // we still need to do proper validation.
+
+    if data.get(..5)? != BCMAP_MAGIC || *data.get(5)? != BCMAP_VERSION {
+        return None;
+    }
+
+    let mut reader = Reader::new(data);
+    reader.read_bytes(6)?; // Skip magic + version.
+
+    let file_len = reader.read_u32()? as usize;
+
+    let delta_table = &BUNDLE.delta_table;
+    let count_table = &BUNDLE.count_table;
+
+    let mut cmap_name = None;
+    let mut character_collection = None;
+    let mut writing_mode = None;
+    let mut base: Option<Box<CMap>> = None;
+    let mut _codespace_ranges = Vec::new();
+    let mut cid_ranges = PartitionedRanges::new();
+    let mut notdef_ranges = PartitionedRanges::new();
+    let mut bf_entries = Vec::new();
+
+    // Start parsing all segments of the file.
+    let mut reader = Reader::new(data.get(BCMAP_FILE_HEADER_SIZE..file_len)?);
+
+    while !reader.at_end() {
+        let seg_type = reader.read_u8()?;
+        let seg_len = reader.read_u32()? as usize;
+
+        let payload = reader.read_bytes(seg_len.checked_sub(SEG_HEADER_SIZE)?)?;
+
+        match seg_type {
+            SEGMENT_NAME => {
+                cmap_name = Some(Vec::from(payload));
+            }
+            SEGMENT_CID_SYSTEM_INFO => {
+                // Format: Each string is 0-terminated.
+                let mut r = Reader::new(payload);
+                let registry = Vec::from(r.eat_until(|b| b == 0));
+                r.read_u8()?;
+
+                let ordering = Vec::from(r.eat_until(|b| b == 0));
+                r.read_u8()?;
+                let supplement = r.read_u16()? as i32;
+
+                character_collection = Some(CharacterCollection {
+                    family: CidFamily::from_registry_ordering(&registry, &ordering),
+                    supplement,
+                });
+            }
+            SEGMENT_USECMAP => {
+                let base_data = get_cmap(CMapName::from_bytes(payload))?;
+
+                // PdfCraft patch: a binary `usecmap` counts against the nesting limit as a text
+                // one does; passing the same depth let a self-referencing CMap recurse until the
+                // stack overflowed.
+                base = Some(Box::new(parse::parse_inner(
+                    base_data,
+                    get_cmap.clone(),
+                    depth + 1,
+                )?));
+            }
+            SEGMENT_WMODE => {
+                writing_mode = match payload.first()? {
+                    0 => Some(WritingMode::Horizontal),
+                    1 => Some(WritingMode::Vertical),
+                    _ => None,
+                };
+            }
+            SEGMENT_CODESPACE => {
+                parse_codespace(payload, &mut _codespace_ranges)?;
+            }
+            SEGMENT_NOTDEF => {
+                parse_notdef(payload, &mut notdef_ranges)?;
+            }
+            SEGMENT_RANGE_1B | SEGMENT_RANGE_2B | SEGMENT_RANGE_3B | SEGMENT_RANGE_4B => {
+                let bw = seg_type.div_ceil(2) as usize;
+                parse_cid_segment(payload, &mut cid_ranges, bw, delta_table, Some(count_table))?;
+            }
+            SEGMENT_SINGLE_1B | SEGMENT_SINGLE_2B | SEGMENT_SINGLE_3B | SEGMENT_SINGLE_4B => {
+                let bw = seg_type.div_ceil(2) as usize;
+                parse_cid_segment(payload, &mut cid_ranges, bw, delta_table, None)?;
+            }
+            SEGMENT_BF_RANGE_VARIABLE => {
+                parse_bf_segment(
+                    payload,
+                    &mut bf_entries,
+                    delta_table,
+                    Some(count_table),
+                    None,
+                )?;
+            }
+            SEGMENT_BF_SINGLE_VARIABLE => {
+                parse_bf_segment(payload, &mut bf_entries, delta_table, None, None)?;
+            }
+            SEGMENT_BF_RANGE_1U => {
+                parse_bf_segment(
+                    payload,
+                    &mut bf_entries,
+                    delta_table,
+                    Some(count_table),
+                    Some(1),
+                )?;
+            }
+            SEGMENT_BF_RANGE_2U => {
+                parse_bf_segment(
+                    payload,
+                    &mut bf_entries,
+                    delta_table,
+                    Some(count_table),
+                    Some(2),
+                )?;
+            }
+            SEGMENT_BF_SINGLE_1U => {
+                parse_bf_segment(payload, &mut bf_entries, delta_table, None, Some(1))?;
+            }
+            SEGMENT_BF_SINGLE_2U => {
+                parse_bf_segment(payload, &mut bf_entries, delta_table, None, Some(2))?;
+            }
+            SEGMENT_BF_SINGLE_3U => {
+                parse_bf_segment(payload, &mut bf_entries, delta_table, None, Some(3))?;
+            }
+            SEGMENT_BF_SINGLE_4U => {
+                parse_bf_segment(payload, &mut bf_entries, delta_table, None, Some(4))?;
+            }
+            _ => {
+                return None;
+            }
+        }
+    }
+
+    cid_ranges.sort();
+    notdef_ranges.sort();
+    bf_entries.sort_by(|a, b| a.range.start.cmp(&b.range.start));
+
+    Some(CMap {
+        metadata: Metadata {
+            character_collection,
+            name: cmap_name,
+            writing_mode,
+        },
+        _codespace_ranges,
+        cid_ranges,
+        notdef_ranges,
+        bf_entries,
+        base,
+    })
+}
+
+fn parse_codespace(payload: &[u8], ranges: &mut Vec<CodespaceRange>) -> Option<()> {
+    let mut r = Reader::new(payload);
+    let n_ranges = r.read_u8()? as usize;
+
+    for _ in 0..n_ranges {
+        let bw = r.read_u8()? as usize;
+        let low = r.read_n_bytes(bw)?;
+        let high = r.read_n_bytes(bw)?;
+
+        ranges.push(CodespaceRange {
+            number_bytes: bw as u8,
+            low,
+            high,
+        });
+    }
+
+    Some(())
+}
+
+fn parse_notdef(payload: &[u8], ranges: &mut PartitionedRanges) -> Option<()> {
+    let mut r = Reader::new(payload);
+    let bw = r.read_u8()? as usize;
+    let n_entries = r.read_u16()? as usize;
+
+    for _ in 0..n_entries {
+        let start = r.read_n_bytes(bw)?;
+        let end = r.read_n_bytes(bw)?;
+        let cid = r.read_u16()? as u32;
+
+        ranges.push(
+            bw,
+            CidRange {
+                range: Range { start, end },
+                cid_start: cid,
+            },
+        );
+    }
+
+    Some(())
+}
+
+fn parse_cid_segment(
+    payload: &[u8],
+    ranges: &mut PartitionedRanges,
+    byte_width: usize,
+    delta_table: &HuffmanTable,
+    count_table: Option<&HuffmanTable>,
+) -> Option<()> {
+    let mut r = Reader::new(payload);
+    let n_entries = r.read_u16()? as usize;
+
+    if n_entries == 0 {
+        return Some(());
+    }
+
+    // There are two types of CID segments, all of which are stored in a columnar
+    // fastion in the file:
+    // For the first type, we have a simple mapping from a single code to a single
+    // CID. In this case, the data stream first contains all codes using delta-coding,
+    // encoded using huffman coding. This is followed by all CIDs, stored as
+    // u16 (either as a raw CID, or as `0` in case the CID is +1 the previous CID).
+    //
+    // For the second type, we have a range of consecutive codes, which map
+    // to a range of consecutive CIDs. In this case, we have an additional "count"
+    // column that stores how many codes are mapped consecutively. These are also
+    // encoded using huffman coding.
+
+    // Read deltas for the start code points.
+    let delta_len = r.read_u32()? as usize;
+    let delta_data = r.read_bytes(delta_len)?;
+
+    let mut delta_reader = Reader::new(delta_data);
+    let mut deltas = Vec::with_capacity(n_entries);
+
+    for _ in 0..n_entries {
+        deltas.push(delta_table.decode(&mut delta_reader)?);
+    }
+
+    // Read the counts for each consecutive code range.
+    let mut counts = Vec::new();
+    if let Some(ct) = count_table {
+        let count_len = r.read_u32()? as usize;
+        let count_data = r.read_bytes(count_len)?;
+
+        let mut count_reader = Reader::new(count_data);
+        counts.reserve(n_entries);
+        for _ in 0..n_entries {
+            counts.push(ct.decode(&mut count_reader)?);
+        }
+    }
+
+    // Read the CIDs and reconstruct the character codes that map to them.
+    let is_range = count_table.is_some();
+    let mut prev_end: Option<u32> = None;
+    let mut prev_cid: Option<u32> = None;
+    let mut prev_range_len: u32 = 0;
+
+    for i in 0..n_entries {
+        let raw_cid = r.read_u16()?;
+
+        // Note that start deltas and counts are encoded minus one, so we
+        // need to add one when reconstructing them.
+
+        // Reconstruct start code.
+        let start = if let Some(pe) = prev_end {
+            pe + 1 + deltas[i]
+        } else {
+            deltas[i]
+        };
+
+        // Reconstruct end code.
+        let end = if is_range {
+            start + counts[i] + 1
+        } else {
+            start
+        };
+
+        // CID 0 means it's consecutive to the last seen CID, plus 1.
+        let cid = if raw_cid == 0 {
+            if let Some(pc) = prev_cid {
+                pc + prev_range_len + 1
+            } else {
+                0
+            }
+        } else {
+            raw_cid as u32
+        };
+
+        ranges.push(
+            byte_width,
+            CidRange {
+                range: Range { start, end },
+                cid_start: cid,
+            },
+        );
+
+        prev_end = Some(end);
+        prev_cid = Some(cid);
+        prev_range_len = end - start;
+    }
+
+    Some(())
+}
+
+fn parse_bf_segment(
+    payload: &[u8],
+    entries: &mut Vec<BfRange>,
+    delta_table: &HuffmanTable,
+    count_table: Option<&HuffmanTable>,
+    fixed_units: Option<usize>,
+) -> Option<()> {
+    let mut r = Reader::new(payload);
+    let n_entries = r.read_u16()? as usize;
+
+    let delta_len = r.read_u32()? as usize;
+    let delta_data = r.read_bytes(delta_len)?;
+
+    let mut delta_reader = Reader::new(delta_data);
+    let mut deltas = Vec::with_capacity(n_entries);
+    for _ in 0..n_entries {
+        deltas.push(delta_table.decode(&mut delta_reader)?);
+    }
+
+    // Read counts for range segments.
+    let mut counts = Vec::new();
+    if let Some(ct) = count_table {
+        let count_len = r.read_u32()? as usize;
+        let count_data = r.read_bytes(count_len)?;
+
+        let mut count_reader = Reader::new(count_data);
+        counts.reserve(n_entries);
+        for _ in 0..n_entries {
+            counts.push(ct.decode(&mut count_reader)?);
+        }
+    }
+
+    let is_range = count_table.is_some();
+    let mut prev_end: Option<u32> = None;
+
+    for i in 0..n_entries {
+        // Fixed-width segments encode destinations without a length prefix.
+        let n_units = match fixed_units {
+            Some(nu) => nu,
+            None => r.read_u8()? as usize,
+        };
+        let mut dst_base = Vec::with_capacity(n_units);
+        for _ in 0..n_units {
+            dst_base.push(r.read_u16()?);
+        }
+
+        let start = if let Some(pe) = prev_end {
+            pe + 1 + deltas[i]
+        } else {
+            deltas[i]
+        };
+
+        let end = if is_range {
+            start + counts[i] + 1
+        } else {
+            start
+        };
+
+        entries.push(BfRange {
+            range: Range { start, end },
+            dst_base,
+        });
+
+        prev_end = Some(end);
+    }
+
+    Some(())
+}
diff --git a/vendor/hayro-cmap/src/bcmap/reader.rs b/vendor/hayro-cmap/src/bcmap/reader.rs
new file mode 100644
index 00000000..25d66391
--- /dev/null
+++ b/vendor/hayro-cmap/src/bcmap/reader.rs
@@ -0,0 +1,123 @@
+pub(super) struct Reader<'a> {
+    data: &'a [u8],
+    byte_pos: usize,
+    bit_pos: u8,
+}
+
+impl<'a> Reader<'a> {
+    #[inline]
+    pub(super) fn new(data: &'a [u8]) -> Self {
+        Self {
+            data,
+            byte_pos: 0,
+            bit_pos: 0,
+        }
+    }
+
+    #[inline]
+    pub(super) fn read_bit(&mut self) -> Option<u8> {
+        let byte = *self.data.get(self.byte_pos)?;
+        let bit = (byte >> (7 - self.bit_pos)) & 1;
+
+        self.bit_pos += 1;
+
+        if self.bit_pos == 8 {
+            self.bit_pos = 0;
+            self.byte_pos += 1;
+        }
+
+        Some(bit)
+    }
+
+    #[inline]
+    pub(super) fn read_u16(&mut self) -> Option<u16> {
+        debug_assert_eq!(self.bit_pos, 0, "read_u16 called at non-byte boundary");
+
+        let bytes: [u8; 2] = self
+            .data
+            .get(self.byte_pos..self.byte_pos + 2)?
+            .try_into()
+            .ok()?;
+        self.byte_pos += 2;
+
+        Some(u16::from_be_bytes(bytes))
+    }
+
+    #[inline]
+    pub(super) fn read_u32(&mut self) -> Option<u32> {
+        debug_assert_eq!(self.bit_pos, 0, "read_u32 called at non-byte boundary");
+
+        let bytes: [u8; 4] = self
+            .data
+            .get(self.byte_pos..self.byte_pos + 4)?
+            .try_into()
+            .ok()?;
+        self.byte_pos += 4;
+
+        Some(u32::from_be_bytes(bytes))
+    }
+
+    #[inline]
+    pub(super) fn read_u8(&mut self) -> Option<u8> {
+        debug_assert_eq!(self.bit_pos, 0, "read_u8 called at non-byte boundary");
+
+        let val = *self.data.get(self.byte_pos)?;
+        self.byte_pos += 1;
+
+        Some(val)
+    }
+
+    #[inline]
+    pub(super) fn read_n_bytes(&mut self, n: usize) -> Option<u32> {
+        debug_assert_eq!(
+            self.bit_pos, 0,
+            "read_n_bytes_be called at non-byte boundary"
+        );
+
+        match n {
+            1 => Some(self.read_u8()? as u32),
+            2 => Some(self.read_u16()? as u32),
+            3 => {
+                let bytes = self.read_bytes(3)?;
+                Some((bytes[0] as u32) << 16 | (bytes[1] as u32) << 8 | bytes[2] as u32)
+            }
+            4 => self.read_u32(),
+            _ => None,
+        }
+    }
+
+    #[inline]
+    pub(super) fn read_bytes(&mut self, n: usize) -> Option<&'a [u8]> {
+        debug_assert_eq!(self.bit_pos, 0, "read_bytes called at non-byte boundary");
+
+        let bytes = self.data.get(self.byte_pos..self.byte_pos + n)?;
+        self.byte_pos += n;
+
+        Some(bytes)
+    }
+
+    #[inline]
+    pub(super) fn position(&self) -> usize {
+        self.byte_pos
+    }
+
+    #[inline]
+    pub(super) fn at_end(&self) -> bool {
+        self.byte_pos >= self.data.len()
+    }
+
+    #[inline]
+    pub(super) fn eat_until(&mut self, f: impl Fn(u8) -> bool) -> &'a [u8] {
+        debug_assert_eq!(self.bit_pos, 0, "eat_until called at non-byte boundary");
+
+        let start = self.byte_pos;
+        while let Some(&b) = self.data.get(self.byte_pos) {
+            if f(b) {
+                break;
+            }
+            self.byte_pos += 1;
+        }
+
+        &self.data[start..self.byte_pos]
+    }
+}
diff --git a/vendor/hayro-cmap/src/lib.rs b/vendor/hayro-cmap/src/lib.rs
new file mode 100644
index 00000000..2ef3c6d1
--- /dev/null
+++ b/vendor/hayro-cmap/src/lib.rs
@@ -0,0 +1,1710 @@
+/*!
+A parser for cmap files, as they are found in PDFs.
+
+This crate provides a parser for cmap files and allows you to
+- Map character codes from text-showing operators to CID identifiers.
+- Map CIDs to Unicode characters or strings.
+
+## Safety
+This crate forbids unsafe code via a crate-level attribute.
+*/
+
+#![cfg_attr(not(feature = "std"), no_std)]
+#![forbid(unsafe_code)]
+#![deny(missing_docs)]
+
+extern crate alloc;
+
+#[cfg(feature = "embed-cmaps")]
+mod bcmap;
+mod parse;
+
+#[cfg(feature = "embed-cmaps")]
+pub use bcmap::load_embedded;
+
+/// Look up an embedded binary cmap by name.
+///
+/// Returns `None` when the `embed-cmaps` feature is not enabled.
+#[cfg(not(feature = "embed-cmaps"))]
+pub fn load_embedded(_name: CMapName<'_>) -> Option<&'static [u8]> {
+    None
+}
+
+use alloc::boxed::Box;
+use alloc::string::String;
+use alloc::vec::Vec;
+
+/// A CID (Character Identifier).
+pub type Cid = u32;
+
+/// The name of the cmap.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum CMapName<'a> {
+    // ── Adobe-Japan1 (Japanese) ── Shift-JIS (RKSJ) encodings ──
+    /// `83pv-RKSJ-H` — Adobe-Japan1, Mac Shift-JIS (`KanjiTalk` 6), horizontal.
+    N83pvRksjH,
+    /// `90ms-RKSJ-H` — Adobe-Japan1, Windows Shift-JIS (code page 932), horizontal.
+    N90msRksjH,
+    /// `90ms-RKSJ-V` — Adobe-Japan1, Windows Shift-JIS (code page 932), vertical.
+    N90msRksjV,
+    /// `90msp-RKSJ-H` — Adobe-Japan1, Windows Shift-JIS with proportional Roman, horizontal.
+    N90mspRksjH,
+    /// `90msp-RKSJ-V` — Adobe-Japan1, Windows Shift-JIS with proportional Roman, vertical.
+    N90mspRksjV,
+    /// `90pv-RKSJ-H` — Adobe-Japan1, Mac Shift-JIS (`KanjiTalk` 7), horizontal.
+    N90pvRksjH,
+    /// `Add-RKSJ-H` — Adobe-Japan1, Fujitsu FMR Shift-JIS, horizontal.
+    AddRksjH,
+    /// `Add-RKSJ-V` — Adobe-Japan1, Fujitsu FMR Shift-JIS, vertical.
+    AddRksjV,
+
+    // ── Adobe UCS2 (CID → Unicode) ──
+    // Note that these are not part of the predefined CMaps, but we use them
+    // so we can more easily map CIDs back to Unicode.
+    /// `Adobe-CNS1-UCS2` — Adobe-CNS1, CID-to-Unicode mapping.
+    AdobeCns1Ucs2,
+    /// `Adobe-GB1-UCS2` — Adobe-GB1, CID-to-Unicode mapping.
+    AdobeGb1Ucs2,
+    /// `Adobe-Japan1-UCS2` — Adobe-Japan1, CID-to-Unicode mapping.
+    AdobeJapan1Ucs2,
+    /// `Adobe-Korea1-UCS2` — Adobe-Korea1, CID-to-Unicode mapping.
+    AdobeKorea1Ucs2,
+
+    // ── Adobe-CNS1 (Traditional Chinese) ── Big Five encodings ──
+    /// `B5pc-H` — Adobe-CNS1, Mac Big Five (`ETen` extensions), horizontal.
+    B5pcH,
+    /// `B5pc-V` — Adobe-CNS1, Mac Big Five (`ETen` extensions), vertical.
+    B5pcV,
+    /// `CNS-EUC-H` — Adobe-CNS1, CNS 11643 EUC encoding, horizontal.
+    CnsEucH,
+    /// `CNS-EUC-V` — Adobe-CNS1, CNS 11643 EUC encoding, vertical.
+    CnsEucV,
+    /// `ETen-B5-H` — Adobe-CNS1, `ETen` Big Five extensions, horizontal.
+    ETenB5H,
+    /// `ETen-B5-V` — Adobe-CNS1, `ETen` Big Five extensions, vertical.
+    ETenB5V,
+    /// `ETenms-B5-H` — Adobe-CNS1, `ETen` Big Five with Microsoft symbol extensions, horizontal.
+    ETenmsB5H,
+    /// `ETenms-B5-V` — Adobe-CNS1, `ETen` Big Five with Microsoft symbol extensions, vertical.
+    ETenmsB5V,
+
+    // ── Adobe-Japan1 (Japanese) ── EUC and extended Shift-JIS encodings ──
+    /// `EUC-H` — Adobe-Japan1, JIS X 0208 EUC-JP encoding, horizontal.
+    EucH,
+    /// `EUC-V` — Adobe-Japan1, JIS X 0208 EUC-JP encoding, vertical.
+    EucV,
+    /// `Ext-RKSJ-H` — Adobe-Japan1, Shift-JIS with NEC/IBM extensions, horizontal.
+    ExtRksjH,
+    /// `Ext-RKSJ-V` — Adobe-Japan1, Shift-JIS with NEC/IBM extensions, vertical.
+    ExtRksjV,
+
+    // ── Adobe-GB1 (Simplified Chinese) ──
+    /// `GB-EUC-H` — Adobe-GB1, GB 2312-80 EUC encoding, horizontal.
+    GbEucH,
+    /// `GB-EUC-V` — Adobe-GB1, GB 2312-80 EUC encoding, vertical.
+    GbEucV,
+    /// `GBK-EUC-H` — Adobe-GB1, GBK encoding (Microsoft code page 936), horizontal.
+    GbkEucH,
+    /// `GBK-EUC-V` — Adobe-GB1, GBK encoding (Microsoft code page 936), vertical.
+    GbkEucV,
+    /// `GBK2K-H` — Adobe-GB1, GB 18030-2000 encoding, horizontal.
+    Gbk2kH,
+    /// `GBK2K-V` — Adobe-GB1, GB 18030-2000 encoding, vertical.
+    Gbk2kV,
+    /// `GBKp-EUC-H` — Adobe-GB1, GBK with proportional Roman, horizontal.
+    GbkpEucH,
+    /// `GBKp-EUC-V` — Adobe-GB1, GBK with proportional Roman, vertical.
+    GbkpEucV,
+    /// `GBpc-EUC-H` — Adobe-GB1, Mac GB 2312 (simplified) EUC encoding, horizontal.
+    GbpcEucH,
+    /// `GBpc-EUC-V` — Adobe-GB1, Mac GB 2312 (simplified) EUC encoding, vertical.
+    GbpcEucV,
+
+    // ── Adobe-Japan1 (Japanese) ── JIS encoding ──
+    /// `H` — Adobe-Japan1, JIS X 0208 row-cell encoding, horizontal.
+    H,
+
+    // ── Adobe-CNS1 (Traditional Chinese) ── Hong Kong SCS ──
+    /// `HKscs-B5-H` — Adobe-CNS1, Hong Kong SCS (Big Five with HKSCS extensions), horizontal.
+    HKscsB5H,
+    /// `HKscs-B5-V` — Adobe-CNS1, Hong Kong SCS (Big Five with HKSCS extensions), vertical.
+    HKscsB5V,
+
+    // ── Adobe-Identity ──
+    /// `Identity-H` — Adobe-Identity, two-byte identity mapping, horizontal.
+    /// Character codes map directly to CIDs (i.e. CID = character code).
+    IdentityH,
+    /// `Identity-V` — Adobe-Identity, two-byte identity mapping, vertical.
+    /// Character codes map directly to CIDs (i.e. CID = character code).
+    IdentityV,
+
+    // ── Adobe-Korea1 (Korean) ──
+    /// `KSC-EUC-H` — Adobe-Korea1, KS X 1001:1992 EUC-KR encoding, horizontal.
+    KscEucH,
+    /// `KSC-EUC-V` — Adobe-Korea1, KS X 1001:1992 EUC-KR encoding, vertical.
+    KscEucV,
+    /// `KSCms-UHC-H` — Adobe-Korea1, Microsoft UHC (Unified Hangul Code, code page 949), horizontal.
+    KscmsUhcH,
+    /// `KSCms-UHC-HW-H` — Adobe-Korea1, Microsoft UHC with half-width Roman, horizontal.
+    KscmsUhcHwH,
+    /// `KSCms-UHC-HW-V` — Adobe-Korea1, Microsoft UHC with half-width Roman, vertical.
+    KscmsUhcHwV,
+    /// `KSCms-UHC-V` — Adobe-Korea1, Microsoft UHC (Unified Hangul Code, code page 949), vertical.
+    KscmsUhcV,
+    /// `KSCpc-EUC-H` — Adobe-Korea1, Mac KS X 1001:1992 EUC-KR encoding, horizontal.
+    KscpcEucH,
+
+    // ── Adobe-CNS1 (Traditional Chinese) ── Unicode encodings ──
+    /// `UniCNS-UCS2-H` — Adobe-CNS1, Unicode UCS-2 encoding, horizontal.
+    UniCnsUcs2H,
+    /// `UniCNS-UCS2-V` — Adobe-CNS1, Unicode UCS-2 encoding, vertical.
+    UniCnsUcs2V,
+    /// `UniCNS-UTF16-H` — Adobe-CNS1, Unicode UTF-16 encoding, horizontal.
+    UniCnsUtf16H,
+    /// `UniCNS-UTF16-V` — Adobe-CNS1, Unicode UTF-16 encoding, vertical.
+    UniCnsUtf16V,
+
+    // ── Adobe-GB1 (Simplified Chinese) ── Unicode encodings ──
+    /// `UniGB-UCS2-H` — Adobe-GB1, Unicode UCS-2 encoding, horizontal.
+    UniGbUcs2H,
+    /// `UniGB-UCS2-V` — Adobe-GB1, Unicode UCS-2 encoding, vertical.
+    UniGbUcs2V,
+    /// `UniGB-UTF16-H` — Adobe-GB1, Unicode UTF-16 encoding, horizontal.
+    UniGbUtf16H,
+    /// `UniGB-UTF16-V` — Adobe-GB1, Unicode UTF-16 encoding, vertical.
+    UniGbUtf16V,
+
+    // ── Adobe-Japan1 (Japanese) ── Unicode encodings ──
+    /// `UniJIS-UCS2-H` — Adobe-Japan1, Unicode UCS-2 encoding, horizontal.
+    UniJisUcs2H,
+    /// `UniJIS-UCS2-HW-H` — Adobe-Japan1, Unicode UCS-2 with half-width Roman, horizontal.
+    UniJisUcs2HwH,
+    /// `UniJIS-UCS2-HW-V` — Adobe-Japan1, Unicode UCS-2 with half-width Roman, vertical.
+    UniJisUcs2HwV,
+    /// `UniJIS-UCS2-V` — Adobe-Japan1, Unicode UCS-2 encoding, vertical.
+    UniJisUcs2V,
+    /// `UniJIS-UTF16-H` — Adobe-Japan1, Unicode UTF-16 encoding, horizontal.
+    UniJisUtf16H,
+    /// `UniJIS-UTF16-V` — Adobe-Japan1, Unicode UTF-16 encoding, vertical.
+    UniJisUtf16V,
+
+    // ── Adobe-Korea1 (Korean) ── Unicode encodings ──
+    /// `UniKS-UCS2-H` — Adobe-Korea1, Unicode UCS-2 encoding, horizontal.
+    UniKsUcs2H,
+    /// `UniKS-UCS2-V` — Adobe-Korea1, Unicode UCS-2 encoding, vertical.
+    UniKsUcs2V,
+    /// `UniKS-UTF16-H` — Adobe-Korea1, Unicode UTF-16 encoding, horizontal.
+    UniKsUtf16H,
+    /// `UniKS-UTF16-V` — Adobe-Korea1, Unicode UTF-16 encoding, vertical.
+    UniKsUtf16V,
+
+    // ── Adobe-Japan1 (Japanese) ── JIS encoding ──
+    /// `V` — Adobe-Japan1, JIS X 0208 row-cell encoding, vertical.
+    V,
+
+    /// A custom (non-predefined) `CMap` name.
+    Custom(&'a [u8]),
+}
+
+impl<'a> CMapName<'a> {
+    /// Create a `CMapType` from raw bytes.
+    pub fn from_bytes(name: &'a [u8]) -> Self {
+        match name {
+            b"83pv-RKSJ-H" => Self::N83pvRksjH,
+            b"90ms-RKSJ-H" => Self::N90msRksjH,
+            b"90ms-RKSJ-V" => Self::N90msRksjV,
+            b"90msp-RKSJ-H" => Self::N90mspRksjH,
+            b"90msp-RKSJ-V" => Self::N90mspRksjV,
+            b"90pv-RKSJ-H" => Self::N90pvRksjH,
+            b"Add-RKSJ-H" => Self::AddRksjH,
+            b"Add-RKSJ-V" => Self::AddRksjV,
+            b"Adobe-CNS1-UCS2" => Self::AdobeCns1Ucs2,
+            b"Adobe-GB1-UCS2" => Self::AdobeGb1Ucs2,
+            b"Adobe-Japan1-UCS2" => Self::AdobeJapan1Ucs2,
+            b"Adobe-Korea1-UCS2" => Self::AdobeKorea1Ucs2,
+            b"B5pc-H" => Self::B5pcH,
+            b"B5pc-V" => Self::B5pcV,
+            b"CNS-EUC-H" => Self::CnsEucH,
+            b"CNS-EUC-V" => Self::CnsEucV,
+            b"ETen-B5-H" => Self::ETenB5H,
+            b"ETen-B5-V" => Self::ETenB5V,
+            b"ETenms-B5-H" => Self::ETenmsB5H,
+            b"ETenms-B5-V" => Self::ETenmsB5V,
+            b"EUC-H" => Self::EucH,
+            b"EUC-V" => Self::EucV,
+            b"Ext-RKSJ-H" => Self::ExtRksjH,
+            b"Ext-RKSJ-V" => Self::ExtRksjV,
+            b"GB-EUC-H" => Self::GbEucH,
+            b"GB-EUC-V" => Self::GbEucV,
+            b"GBK-EUC-H" => Self::GbkEucH,
+            b"GBK-EUC-V" => Self::GbkEucV,
+            b"GBK2K-H" => Self::Gbk2kH,
+            b"GBK2K-V" => Self::Gbk2kV,
+            b"GBKp-EUC-H" => Self::GbkpEucH,
+            b"GBKp-EUC-V" => Self::GbkpEucV,
+            b"GBpc-EUC-H" => Self::GbpcEucH,
+            b"GBpc-EUC-V" => Self::GbpcEucV,
+            b"H" => Self::H,
+            b"HKscs-B5-H" => Self::HKscsB5H,
+            b"HKscs-B5-V" => Self::HKscsB5V,
+            b"Identity-H" => Self::IdentityH,
+            b"Identity-V" => Self::IdentityV,
+            b"KSC-EUC-H" => Self::KscEucH,
+            b"KSC-EUC-V" => Self::KscEucV,
+            b"KSCms-UHC-H" => Self::KscmsUhcH,
+            b"KSCms-UHC-HW-H" => Self::KscmsUhcHwH,
+            b"KSCms-UHC-HW-V" => Self::KscmsUhcHwV,
+            b"KSCms-UHC-V" => Self::KscmsUhcV,
+            b"KSCpc-EUC-H" => Self::KscpcEucH,
+            b"UniCNS-UCS2-H" => Self::UniCnsUcs2H,
+            b"UniCNS-UCS2-V" => Self::UniCnsUcs2V,
+            b"UniCNS-UTF16-H" => Self::UniCnsUtf16H,
+            b"UniCNS-UTF16-V" => Self::UniCnsUtf16V,
+            b"UniGB-UCS2-H" => Self::UniGbUcs2H,
+            b"UniGB-UCS2-V" => Self::UniGbUcs2V,
+            b"UniGB-UTF16-H" => Self::UniGbUtf16H,
+            b"UniGB-UTF16-V" => Self::UniGbUtf16V,
+            b"UniJIS-UCS2-H" => Self::UniJisUcs2H,
+            b"UniJIS-UCS2-HW-H" => Self::UniJisUcs2HwH,
+            b"UniJIS-UCS2-HW-V" => Self::UniJisUcs2HwV,
+            b"UniJIS-UCS2-V" => Self::UniJisUcs2V,
+            b"UniJIS-UTF16-H" => Self::UniJisUtf16H,
+            b"UniJIS-UTF16-V" => Self::UniJisUtf16V,
+            b"UniKS-UCS2-H" => Self::UniKsUcs2H,
+            b"UniKS-UCS2-V" => Self::UniKsUcs2V,
+            b"UniKS-UTF16-H" => Self::UniKsUtf16H,
+            b"UniKS-UTF16-V" => Self::UniKsUtf16V,
+            b"V" => Self::V,
+            _ => Self::Custom(name),
+        }
+    }
+
+    /// Convert the `CMapType` back to its raw byte representation.
+    pub fn to_bytes(&self) -> &[u8] {
+        match self {
+            Self::N83pvRksjH => b"83pv-RKSJ-H",
+            Self::N90msRksjH => b"90ms-RKSJ-H",
+            Self::N90msRksjV => b"90ms-RKSJ-V",
+            Self::N90mspRksjH => b"90msp-RKSJ-H",
+            Self::N90mspRksjV => b"90msp-RKSJ-V",
+            Self::N90pvRksjH => b"90pv-RKSJ-H",
+            Self::AddRksjH => b"Add-RKSJ-H",
+            Self::AddRksjV => b"Add-RKSJ-V",
+            Self::AdobeCns1Ucs2 => b"Adobe-CNS1-UCS2",
+            Self::AdobeGb1Ucs2 => b"Adobe-GB1-UCS2",
+            Self::AdobeJapan1Ucs2 => b"Adobe-Japan1-UCS2",
+            Self::AdobeKorea1Ucs2 => b"Adobe-Korea1-UCS2",
+            Self::B5pcH => b"B5pc-H",
+            Self::B5pcV => b"B5pc-V",
+            Self::CnsEucH => b"CNS-EUC-H",
+            Self::CnsEucV => b"CNS-EUC-V",
+            Self::ETenB5H => b"ETen-B5-H",
+            Self::ETenB5V => b"ETen-B5-V",
+            Self::ETenmsB5H => b"ETenms-B5-H",
+            Self::ETenmsB5V => b"ETenms-B5-V",
+            Self::EucH => b"EUC-H",
+            Self::EucV => b"EUC-V",
+            Self::ExtRksjH => b"Ext-RKSJ-H",
+            Self::ExtRksjV => b"Ext-RKSJ-V",
+            Self::GbEucH => b"GB-EUC-H",
+            Self::GbEucV => b"GB-EUC-V",
+            Self::GbkEucH => b"GBK-EUC-H",
+            Self::GbkEucV => b"GBK-EUC-V",
+            Self::Gbk2kH => b"GBK2K-H",
+            Self::Gbk2kV => b"GBK2K-V",
+            Self::GbkpEucH => b"GBKp-EUC-H",
+            Self::GbkpEucV => b"GBKp-EUC-V",
+            Self::GbpcEucH => b"GBpc-EUC-H",
+            Self::GbpcEucV => b"GBpc-EUC-V",
+            Self::H => b"H",
+            Self::HKscsB5H => b"HKscs-B5-H",
+            Self::HKscsB5V => b"HKscs-B5-V",
+            Self::IdentityH => b"Identity-H",
+            Self::IdentityV => b"Identity-V",
+            Self::KscEucH => b"KSC-EUC-H",
+            Self::KscEucV => b"KSC-EUC-V",
+            Self::KscmsUhcH => b"KSCms-UHC-H",
+            Self::KscmsUhcHwH => b"KSCms-UHC-HW-H",
+            Self::KscmsUhcHwV => b"KSCms-UHC-HW-V",
+            Self::KscmsUhcV => b"KSCms-UHC-V",
+            Self::KscpcEucH => b"KSCpc-EUC-H",
+            Self::UniCnsUcs2H => b"UniCNS-UCS2-H",
+            Self::UniCnsUcs2V => b"UniCNS-UCS2-V",
+            Self::UniCnsUtf16H => b"UniCNS-UTF16-H",
+            Self::UniCnsUtf16V => b"UniCNS-UTF16-V",
+            Self::UniGbUcs2H => b"UniGB-UCS2-H",
+            Self::UniGbUcs2V => b"UniGB-UCS2-V",
+            Self::UniGbUtf16H => b"UniGB-UTF16-H",
+            Self::UniGbUtf16V => b"UniGB-UTF16-V",
+            Self::UniJisUcs2H => b"UniJIS-UCS2-H",
+            Self::UniJisUcs2HwH => b"UniJIS-UCS2-HW-H",
+            Self::UniJisUcs2HwV => b"UniJIS-UCS2-HW-V",
+            Self::UniJisUcs2V => b"UniJIS-UCS2-V",
+            Self::UniJisUtf16H => b"UniJIS-UTF16-H",
+            Self::UniJisUtf16V => b"UniJIS-UTF16-V",
+            Self::UniKsUcs2H => b"UniKS-UCS2-H",
+            Self::UniKsUcs2V => b"UniKS-UCS2-V",
+            Self::UniKsUtf16H => b"UniKS-UTF16-H",
+            Self::UniKsUtf16V => b"UniKS-UTF16-V",
+            Self::V => b"V",
+            Self::Custom(name) => name,
+        }
+    }
+}
+
+/// Let's limit the number of nested `usecmap` references to 16.
+const MAX_NESTING_DEPTH: u32 = 16;
+
+/// A parsed cmap.
+#[derive(Debug, Clone)]
+pub struct CMap {
+    metadata: Metadata,
+    // Note that we don't actually use this, because Acrobat _seems_ to ignore
+    // it, too.
+    _codespace_ranges: Vec<CodespaceRange>,
+    cid_ranges: PartitionedRanges,
+    notdef_ranges: PartitionedRanges,
+    bf_entries: Vec<BfRange>,
+    base: Option<Box<Self>>,
+}
+
+impl CMap {
+    /// Parse a cmap from raw bytes.
+    ///
+    /// The `get_cmap` callback is used to recursively resolve cmaps that
+    /// are referenced via `usecmap`.
+    pub fn parse<'a>(
+        data: &[u8],
+        get_cmap: impl Fn(CMapName<'_>) -> Option<&'a [u8]> + Clone + 'a,
+    ) -> Option<Self> {
+        parse::parse_inner(data, get_cmap, 0)
+    }
+
+    /// Create an Identity-H cmap.
+    pub fn identity_h() -> Self {
+        Self::identity(WritingMode::Horizontal, b"Identity-H")
+    }
+
+    /// Create an Identity-V cmap.
+    pub fn identity_v() -> Self {
+        Self::identity(WritingMode::Vertical, b"Identity-V")
+    }
+
+    fn identity(writing_mode: WritingMode, name: &[u8]) -> Self {
+        Self {
+            metadata: Metadata {
+                character_collection: Some(CharacterCollection {
+                    family: CidFamily::AdobeIdentity,
+                    supplement: 0,
+                }),
+                name: Some(Vec::from(name)),
+                writing_mode: Some(writing_mode),
+            },
+            _codespace_ranges: Vec::new(),
+            cid_ranges: {
+                let mut r = PartitionedRanges::new();
+                r.push(
+                    2,
+                    CidRange {
+                        range: Range {
+                            start: 0,
+                            end: 0xFFFF,
+                        },
+                        cid_start: 0,
+                    },
+                );
+                r
+            },
+            notdef_ranges: PartitionedRanges::new(),
+            bf_entries: Vec::new(),
+            base: None,
+        }
+    }
+
+    /// Return the metadata of this cmap.
+    pub fn metadata(&self) -> &Metadata {
+        &self.metadata
+    }
+
+    /// Look up the CID code of a character code.
+    ///
+    /// Returns `None` if the code does not match any range for the given byte length.
+    pub fn lookup_cid_code(&self, code: u32, byte_len: u8) -> Option<Cid> {
+        // Note that, in theory, we are supposed to first check the code space range
+        // whether the entry exists in the first place. However, from my experiments
+        // Acrobat mostly seems to ignore this, so we do that as well.
+
+        let cid_ranges = self.cid_ranges.get(byte_len)?;
+        let notdef_ranges = self.notdef_ranges.get(byte_len)?;
+
+        if let Some(entry) = find_in_ranges(cid_ranges, code) {
+            let offset = code.checked_sub(entry.range.start)?;
+            return entry.cid_start.checked_add(offset);
+        } else if let Some(entry) = find_in_ranges(notdef_ranges, code) {
+            // For `.notdef` ranges, all codes map to the same `.notdef` CID, so
+            // no adding of the offset here.
+            return Some(entry.cid_start);
+        }
+
+        // See pdfjs_bug920426, it uses bf chars for encoding the characters
+        // of a text-showing operator, so try that as well. We don't want to
+        // recurse though, only check the bf chars of this level.
+        if let Some(BfString::Char(lookup)) = self.lookup_bf_string_inner(code, false) {
+            return Some(lookup as u32);
+        }
+
+        // If we still haven't found anything, check the base cmap.
+        self.base
+            .as_ref()
+            .and_then(|b| b.lookup_cid_code(code, byte_len))
+    }
+
+    /// Look up a bf string in the cmap. This is usually
+    /// used for mapping character codes to Unicode codepoints in a
+    /// `ToUnicode` cmap.
+    ///
+    /// Returns `None` if no mapping is available.
+    pub fn lookup_bf_string(&self, code: u32) -> Option<BfString> {
+        self.lookup_bf_string_inner(code, true)
+    }
+
+    fn lookup_bf_string_inner(&self, code: u32, recurse: bool) -> Option<BfString> {
+        if let Some(entry) = find_in_ranges(&self.bf_entries, code) {
+            let offset = u16::try_from(code - entry.range.start).ok()?;
+
+            fn decode_utf16(units: &[u16]) -> Option<BfString> {
+                let mut iter = core::char::decode_utf16(units.iter().copied());
+                let first = iter.next()?.ok()?;
+
+                if iter.next().is_none() {
+                    Some(BfString::Char(first))
+                } else {
+                    let s = String::from_utf16(units).ok()?;
+                    Some(BfString::String(s))
+                }
+            }
+
+            return if offset == 0 {
+                Some(decode_utf16(&entry.dst_base)?)
+            } else {
+                let mut units = entry.dst_base.clone();
+                *units.last_mut()? = units.last()?.checked_add(offset)?;
+                Some(decode_utf16(&units)?)
+            };
+        }
+
+        if recurse {
+            self.base.as_ref()?.lookup_bf_string(code)
+        } else {
+            None
+        }
+    }
+}
+
+trait HasRange {
+    fn range(&self) -> &Range;
+}
+
+fn find_in_ranges<T: HasRange>(entries: &[T], code: u32) -> Option<&T> {
+    let idx = entries
+        .binary_search_by(|entry| {
+            let r = entry.range();
+            if code < r.start {
+                core::cmp::Ordering::Greater
+            } else if code > r.end {
+                core::cmp::Ordering::Less
+            } else {
+                core::cmp::Ordering::Equal
+            }
+        })
+        .ok()?;
+
+    Some(&entries[idx])
+}
+
+/// A range with a start and end code.
+#[derive(Debug, Clone)]
+pub(crate) struct Range {
+    pub(crate) start: u32,
+    pub(crate) end: u32,
+}
+
+/// A range of character codes mapped to CIDs.
+#[derive(Debug, Clone)]
+pub struct CidRange {
+    pub(crate) range: Range,
+    pub(crate) cid_start: Cid,
+}
+
+impl HasRange for CidRange {
+    fn range(&self) -> &Range {
+        &self.range
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct PartitionedRanges {
+    buckets: [Vec<CidRange>; 4],
+}
+
+impl PartitionedRanges {
+    pub(crate) fn new() -> Self {
+        Self {
+            buckets: [Vec::new(), Vec::new(), Vec::new(), Vec::new()],
+        }
+    }
+
+    // PdfCraft patch: needed by the truncated-stream guard in parse.rs.
+    pub(crate) fn is_empty(&self) -> bool {
+        self.buckets.iter().all(|b| b.is_empty())
+    }
+
+    pub(crate) fn push(&mut self, byte_len: usize, range: CidRange) {
+        if let Some(bucket) = byte_len
+            .checked_sub(1)
+            .and_then(|i| self.buckets.get_mut(i))
+        {
+            bucket.push(range);
+        }
+    }
+
+    pub(crate) fn get(&self, byte_len: u8) -> Option<&[CidRange]> {
+        let idx = (byte_len as usize).checked_sub(1)?;
+        self.buckets.get(idx).map(|v| v.as_slice())
+    }
+
+    pub(crate) fn sort(&mut self) {
+        for bucket in &mut self.buckets {
+            bucket.sort_by(|a, b| a.range.start.cmp(&b.range.start));
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct BfRange {
+    pub(crate) range: Range,
+    pub(crate) dst_base: Vec<u16>,
+}
+
+impl HasRange for BfRange {
+    fn range(&self) -> &Range {
+        &self.range
+    }
+}
+
+/// A codespace range defining valid character code byte sequences.
+#[derive(Debug, Clone)]
+#[allow(dead_code)]
+pub(crate) struct CodespaceRange {
+    pub(crate) number_bytes: u8,
+    pub(crate) low: u32,
+    pub(crate) high: u32,
+}
+
+/// A Unicode value decoded from a cmap.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum BfString {
+    /// A single character.
+    Char(char),
+    /// A UTF-8 string.
+    String(String),
+}
+
+/// Metadata extracted from a cmap file.
+#[derive(Debug, Clone)]
+pub struct Metadata {
+    /// The referenced character collection.
+    pub character_collection: Option<CharacterCollection>,
+    /// The cmap name.
+    pub name: Option<Vec<u8>>,
+    /// The writing mode.
+    pub writing_mode: Option<WritingMode>,
+}
+
+/// The registry+ordering family of a CID character collection.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum CidFamily {
+    /// Adobe-Japan1
+    AdobeJapan1,
+    /// Adobe-GB1
+    AdobeGB1,
+    /// Adobe-CNS1
+    AdobeCNS1,
+    /// Adobe-Korea1
+    AdobeKorea1,
+    /// Adobe-Identity
+    AdobeIdentity,
+    /// A non-predefined registry/ordering pair.
+    Custom {
+        /// The registry name.
+        registry: Vec<u8>,
+        /// The ordering name.
+        ordering: Vec<u8>,
+    },
+}
+
+impl CidFamily {
+    /// Create a `CidFamily` from raw registry and ordering byte strings.
+    pub fn from_registry_ordering(registry: &[u8], ordering: &[u8]) -> Self {
+        if registry == b"Adobe" {
+            match ordering {
+                b"Japan1" => Self::AdobeJapan1,
+                b"GB1" => Self::AdobeGB1,
+                b"CNS1" => Self::AdobeCNS1,
+                b"Korea1" => Self::AdobeKorea1,
+                b"Identity" => Self::AdobeIdentity,
+                _ => Self::Custom {
+                    registry: registry.to_vec(),
+                    ordering: ordering.to_vec(),
+                },
+            }
+        } else {
+            Self::Custom {
+                registry: registry.to_vec(),
+                ordering: ordering.to_vec(),
+            }
+        }
+    }
+
+    /// Return the predefined UTF-16 `CMap` that maps Unicode code points to CIDs
+    /// for this family, if one exists.
+    pub fn unicode_cmap(&self) -> Option<CMapName<'static>> {
+        match self {
+            Self::AdobeJapan1 => Some(CMapName::UniJisUtf16H),
+            Self::AdobeGB1 => Some(CMapName::UniGbUtf16H),
+            Self::AdobeCNS1 => Some(CMapName::UniCnsUtf16H),
+            Self::AdobeKorea1 => Some(CMapName::UniKsUtf16H),
+            Self::AdobeIdentity | Self::Custom { .. } => None,
+        }
+    }
+
+    /// Return the `UCS2` cmap corresponding to the given character collection.
+    pub fn ucs2_cmap(&self) -> Option<CMapName<'static>> {
+        match self {
+            Self::AdobeJapan1 => Some(CMapName::AdobeJapan1Ucs2),
+            Self::AdobeGB1 => Some(CMapName::AdobeGb1Ucs2),
+            Self::AdobeCNS1 => Some(CMapName::AdobeCns1Ucs2),
+            Self::AdobeKorea1 => Some(CMapName::AdobeKorea1Ucs2),
+            Self::AdobeIdentity | Self::Custom { .. } => None,
+        }
+    }
+}
+
+/// A CID character collection identifying the character set and ordering.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CharacterCollection {
+    /// The registry+ordering family.
+    pub family: CidFamily,
+    /// The supplement number.
+    pub supplement: i32,
+}
+
+/// The writing mode of a cmap.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum WritingMode {
+    /// Horizontal writing mode.
+    #[default]
+    Horizontal,
+    /// Vertical writing mode.
+    Vertical,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Note that those cmaps might not be completely valid according to the rules
+    // of cmap/Postscript, but since our parser is very lenient and doesn't run a real
+    // interpreter we can shorten them by a lot.
+
+    const PREAMBLE: &[u8] = br#"/CIDSystemInfo 3 dict dup begin
+  /Registry (Adobe) def
+  /Ordering (Japan1) def
+  /Supplement 0 def
+end def
+/CMapName /Test def
+/WMode 0 def
+2 begincodespacerange
+<00> <FF>
+<0000> <FFFF>
+endcodespacerange
+"#;
+
+    fn parse_with_preamble(body: &[u8]) -> CMap {
+        let mut data = Vec::new();
+        data.extend_from_slice(PREAMBLE);
+        data.extend_from_slice(body);
+        CMap::parse(&data, |_| None).unwrap()
+    }
+
+    /// PdfCraft patch test: a binary CMap whose `usecmap` names itself stops at the nesting limit.
+    #[cfg(feature = "embed-cmaps")]
+    #[test]
+    fn self_referencing_binary_usecmap_stops_at_the_nesting_limit() {
+        // Header (magic, version, file length 19), then one usecmap segment (length 9) naming "Self".
+        const SELF_REF: &[u8] = &[
+            b'b', b'c', b'm', b'a', b'p', 1, 0, 0, 0, 19, 0x09, 0, 0, 0, 9, b'S', b'e', b'l', b'f',
+        ];
+        assert!(CMap::parse(SELF_REF, |_| Some(SELF_REF)).is_none());
+    }
+
+    #[test]
+    fn metadata_parsing() {
+        let data = br#"
+/CIDInit /ProcSet findresource begin
+12 dict begin
+begincmap
+/CIDSystemInfo 3 dict dup begin
+  /Registry (Adobe) def
+  /Ordering (Japan1) def
+  /Supplement 6 def
+end def
+/CMapName /Adobe-Japan1-H def
+/CMapType 1 def
+/WMode 0 def
+endcmap"#;
+
+        let cmap = CMap::parse(data, |_| None).unwrap();
+        let cc = cmap.metadata().character_collection.as_ref().unwrap();
+        assert_eq!(cc.family, CidFamily::AdobeJapan1);
+        assert_eq!(cc.supplement, 6);
+        assert_eq!(
+            cmap.metadata().name.as_deref(),
+            Some(b"Adobe-Japan1-H".as_slice())
+        );
+        assert_eq!(cmap.metadata().writing_mode, Some(WritingMode::Horizontal));
+    }
+
+    #[test]
+    fn vertical_writing_mode() {
+        let data = br#"
+/CIDSystemInfo 3 dict dup begin
+  /Registry (Adobe) def
+  /Ordering (Japan1) def
+  /Supplement 6 def
+end def
+/CMapName /Adobe-Japan1-V def
+/WMode 1 def
+"#;
+
+        let cmap = CMap::parse(data, |_| None).unwrap();
+        assert_eq!(cmap.metadata().writing_mode, Some(WritingMode::Vertical));
+        assert_eq!(
+            cmap.metadata().name.as_deref(),
+            Some(b"Adobe-Japan1-V".as_slice())
+        );
+    }
+
+    #[test]
+    fn cid_range_lookup() {
+        let cmap = parse_with_preamble(
+            br#"
+3 begincidrange
+<0000> <00FF> 0
+<0100> <01FF> 256
+<8140> <817E> 633
+endcidrange
+"#,
+        );
+
+        assert_eq!(cmap.lookup_cid_code(0x0000, 2), Some(0));
+        assert_eq!(cmap.lookup_cid_code(0x0042, 2), Some(0x42));
+        assert_eq!(cmap.lookup_cid_code(0x00FF, 2), Some(0xFF));
+
+        assert_eq!(cmap.lookup_cid_code(0x0100, 2), Some(256));
+        assert_eq!(cmap.lookup_cid_code(0x01FF, 2), Some(511));
+
+        assert_eq!(cmap.lookup_cid_code(0x8140, 2), Some(633));
+        assert_eq!(cmap.lookup_cid_code(0x817E, 2), Some(633 + 62));
+    }
+
+    #[test]
+    fn cid_char_lookup() {
+        let cmap = parse_with_preamble(
+            br#"
+3 begincidchar
+<03> 1
+<04> 2
+<20> 50
+endcidchar
+"#,
+        );
+
+        assert_eq!(cmap.lookup_cid_code(0x03, 1), Some(1));
+        assert_eq!(cmap.lookup_cid_code(0x04, 1), Some(2));
+        assert_eq!(cmap.lookup_cid_code(0x20, 1), Some(50));
+    }
+
+    #[test]
+    fn lookup_miss() {
+        let cmap = parse_with_preamble(
+            br#"
+1 begincidrange
+<0100> <01FF> 0
+endcidrange
+"#,
+        );
+
+        assert_eq!(cmap.lookup_cid_code(0x00FF, 2), None);
+        assert_eq!(cmap.lookup_cid_code(0x0200, 2), None);
+        assert_eq!(cmap.lookup_cid_code(0xFFFF, 2), None);
+    }
+
+    #[test]
+    fn multiple_sections() {
+        let cmap = parse_with_preamble(
+            br#"
+2 begincidrange
+<0000> <00FF> 0
+<0100> <01FF> 256
+endcidrange
+1 begincidchar
+<0200> 600
+endcidchar
+1 begincidrange
+<8140> <817E> 633
+endcidrange
+"#,
+        );
+
+        assert_eq!(cmap.lookup_cid_code(0x0000, 2), Some(0));
+        assert_eq!(cmap.lookup_cid_code(0x0100, 2), Some(256));
+        assert_eq!(cmap.lookup_cid_code(0x0200, 2), Some(600));
+        assert_eq!(cmap.lookup_cid_code(0x8140, 2), Some(633));
+    }
+
+    #[test]
+    fn single_byte_codes() {
+        let cmap = parse_with_preamble(
+            br#"
+2 begincidrange
+<00> <7F> 0
+<80> <FF> 200
+endcidrange
+"#,
+        );
+
+        assert_eq!(cmap.lookup_cid_code(0x00, 1), Some(0));
+        assert_eq!(cmap.lookup_cid_code(0x41, 1), Some(0x41));
+        assert_eq!(cmap.lookup_cid_code(0x80, 1), Some(200));
+        assert_eq!(cmap.lookup_cid_code(0xFF, 1), Some(200 + 127));
+    }
+
+    #[test]
+    fn dict_style_cidsysteminfo() {
+        let data = br#"
+/CIDInit /ProcSet findresource begin
+10 dict begin
+begincmap
+/CIDSystemInfo
+<< /Registry (Adobe)
+/Ordering (UCS)
+/Supplement 0
+>> def
+/CMapName /Adobe-Identity-UCS def
+/CMapType 2 def
+1 begincodespacerange
+<0000> <FFFF>
+endcodespacerange
+2 beginbfchar
+<001F> <F049>
+<002A> <F055>
+endbfchar
+endcmap
+CMapName currentdict /CMap defineresource pop
+end
+end
+"#;
+        let cmap = CMap::parse(data, |_| None).unwrap();
+        let cc = cmap.metadata().character_collection.as_ref().unwrap();
+        assert_eq!(
+            cc.family,
+            CidFamily::Custom {
+                registry: b"Adobe".to_vec(),
+                ordering: b"UCS".to_vec(),
+            }
+        );
+        assert_eq!(cc.supplement, 0);
+        assert_eq!(
+            cmap.metadata().name.as_deref(),
+            Some(b"Adobe-Identity-UCS".as_slice())
+        );
+        assert_eq!(
+            cmap.lookup_bf_string(0x001F),
+            Some(BfString::Char('\u{F049}'))
+        );
+        assert_eq!(
+            cmap.lookup_bf_string(0x002A),
+            Some(BfString::Char('\u{F055}'))
+        );
+    }
+
+    #[test]
+    fn usecmap_chaining() {
+        let base_data = br#"
+/CIDSystemInfo 3 dict dup begin
+  /Registry (Adobe) def
+  /Ordering (Japan1) def
+  /Supplement 0 def
+end def
+/CMapName /Base def
+/WMode 0 def
+1 begincodespacerange
+<0000> <FFFF>
+endcodespacerange
+1 begincidrange
+<0000> <00FF> 0
+endcidrange
+"#;
+
+        let child_data = br#"
+/Base usecmap
+/CIDSystemInfo 3 dict dup begin
+  /Registry (Adobe) def
+  /Ordering (Japan1) def
+  /Supplement 0 def
+end def
+/CMapName /Child def
+/WMode 0 def
+1 begincodespacerange
+<0000> <FFFF>
+endcodespacerange
+1 begincidrange
+<0100> <01FF> 256
+endcidrange
+"#;
+
+        let cmap = CMap::parse(child_data, |name| {
+            if name.to_bytes() == b"Base" {
+                Some(base_data.as_slice())
+            } else {
+                None
+            }
+        })
+        .unwrap();
+
+        assert_eq!(cmap.lookup_cid_code(0x0100, 2), Some(256));
+        assert_eq!(cmap.lookup_cid_code(0x01FF, 2), Some(511));
+        assert_eq!(cmap.lookup_cid_code(0x0000, 2), Some(0));
+        assert_eq!(cmap.lookup_cid_code(0x00FF, 2), Some(0xFF));
+
+        assert_eq!(cmap.lookup_cid_code(0x0200, 2), None);
+    }
+
+    #[test]
+    fn usecmap_partial_override() {
+        let base_data = br#"
+/CIDSystemInfo 3 dict dup begin
+  /Registry (Adobe) def
+  /Ordering (Japan1) def
+  /Supplement 0 def
+end def
+/CMapName /Base def
+/WMode 0 def
+1 begincodespacerange
+<0000> <FFFF>
+endcodespacerange
+1 begincidrange
+<0000> <00FF> 0
+endcidrange
+"#;
+
+        let child_data = br#"
+/Base usecmap
+/CIDSystemInfo 3 dict dup begin
+  /Registry (Adobe) def
+  /Ordering (Japan1) def
+  /Supplement 0 def
+end def
+/CMapName /Child def
+/WMode 0 def
+1 begincodespacerange
+<0000> <FFFF>
+endcodespacerange
+1 begincidrange
+<0040> <007F> 500
+endcidrange
+"#;
+
+        let cmap = CMap::parse(child_data, |name| {
+            if name.to_bytes() == b"Base" {
+                Some(base_data.as_slice())
+            } else {
+                None
+            }
+        })
+        .unwrap();
+
+        assert_eq!(cmap.lookup_cid_code(0x0000, 2), Some(0));
+        assert_eq!(cmap.lookup_cid_code(0x003F, 2), Some(0x3F));
+        assert_eq!(cmap.lookup_cid_code(0x0040, 2), Some(500));
+        assert_eq!(cmap.lookup_cid_code(0x007F, 2), Some(563));
+        assert_eq!(cmap.lookup_cid_code(0x0080, 2), Some(0x80));
+        assert_eq!(cmap.lookup_cid_code(0x00FF, 2), Some(0xFF));
+    }
+
+    #[test]
+    fn notdef_char_lookup() {
+        let cmap = parse_with_preamble(
+            br#"
+2 beginnotdefchar
+<03> 10
+<20> 20
+endnotdefchar
+"#,
+        );
+
+        assert_eq!(cmap.lookup_cid_code(0x03, 1), Some(10));
+        assert_eq!(cmap.lookup_cid_code(0x20, 1), Some(20));
+        assert_eq!(cmap.lookup_cid_code(0x04, 1), None);
+    }
+
+    #[test]
+    fn notdef_range_lookup() {
+        let cmap = parse_with_preamble(
+            br#"
+1 beginnotdefrange
+<0000> <001F> 100
+endnotdefrange
+"#,
+        );
+
+        assert_eq!(cmap.lookup_cid_code(0x0000, 2), Some(100));
+        assert_eq!(cmap.lookup_cid_code(0x0001, 2), Some(100));
+        assert_eq!(cmap.lookup_cid_code(0x001F, 2), Some(100));
+        assert_eq!(cmap.lookup_cid_code(0x0020, 2), None);
+    }
+
+    #[test]
+    fn bfchar_lookup() {
+        let cmap = parse_with_preamble(
+            br#"
+2 beginbfchar
+<0041> <0048>
+<0042> <0065>
+endbfchar
+"#,
+        );
+
+        assert_eq!(cmap.lookup_bf_string(0x0041), Some(BfString::Char('H')));
+        assert_eq!(cmap.lookup_bf_string(0x0042), Some(BfString::Char('e')));
+        assert_eq!(cmap.lookup_bf_string(0x0043), None);
+    }
+
+    #[test]
+    fn bfchar_ligature() {
+        let cmap = parse_with_preamble(
+            br#"
+1 beginbfchar
+<005F> <00660066>
+endbfchar
+"#,
+        );
+
+        assert_eq!(
+            cmap.lookup_bf_string(0x005F),
+            Some(BfString::String(String::from("ff")))
+        );
+    }
+
+    // PdfCraft patch: malformed pieces of a CMap are skipped, not fatal - the reading
+    // path used to discard the whole CMap and fall back to the font encoding for every
+    // code, so search and search-redaction missed text the edit layer could see (#3177).
+
+    #[test]
+    fn bad_bfchar_entry_is_skipped() {
+        let cmap = parse_with_preamble(
+            br#"
+2 beginbfchar
+<41> <ZZZZ>
+<42> <0059>
+endbfchar
+"#,
+        );
+        assert_eq!(cmap.lookup_bf_string(0x41), None);
+        assert_eq!(
+            cmap.lookup_bf_string(0x42),
+            Some(BfString::Char('Y'))
+        );
+    }
+
+    #[test]
+    fn stream_cut_off_inside_a_block_keeps_the_entries_before_it() {
+        let cmap = parse_with_preamble(b"1 beginbfchar <41> <0058>\n<42> <00");
+        assert_eq!(cmap.lookup_bf_string(0x41), Some(BfString::Char('X')));
+        assert_eq!(cmap.lookup_bf_string(0x42), None);
+    }
+
+    #[test]
+    fn truncated_stream_with_no_entries_reports_failure() {
+        // The tolerant parser keeps collected entries, but a stream that
+        // breaks before any entry must still report failure so callers
+        // fall back to the font's own encoding.
+        assert!(CMap::parse(b"<00", |_| None).is_none());
+    }
+
+    #[test]
+    fn truncated_stream_with_only_metadata_reports_failure() {
+        // Character-collection metadata alone is not a usable CMap: an empty
+        // metadata-only map would block the caller's fallback paths, so a
+        // truncated stream with no mappings must report failure here too.
+        assert!(CMap::parse(
+            b"/Registry (Adobe) /Ordering (Japan1) /Supplement 0 <00",
+            |_| None
+        )
+        .is_none());
+    }
+
+    #[test]
+    fn unresolved_usecmap_with_no_mappings_reports_failure() {
+        // A stream whose only content is a `usecmap` reference that cannot be
+        // resolved yields no mappings at all; returning an empty map here
+        // would block the caller's encoding fallback paths, so it must
+        // report failure exactly as a full parse failure did before.
+        assert!(CMap::parse(b"/Bogus usecmap", |_| None).is_none());
+    }
+
+    #[test]
+    fn unresolved_usecmap_keeps_local_mappings() {
+        // The same unresolved reference must not discard mappings the stream
+        // carries itself: only the missing base is dropped.
+        let cmap = CMap::parse(
+            b"/Bogus usecmap 1 beginbfchar <41> <0041> endbfchar",
+            |_| None,
+        )
+        .expect("local mappings survive an unresolved usecmap");
+        assert!(cmap.lookup_bf_string(0x41).is_some());
+    }
+
+    #[test]
+    fn bad_bfchar_code_keeps_later_entries_aligned() {
+        // The malformed 5-byte code still has a destination object; both
+        // must be skipped or every later pair shifts by one object.
+        let cmap = parse_with_preamble(
+            br#"
+2 beginbfchar
+<0102030405> <0041>
+<42> <0059>
+endbfchar
+"#,
+        );
+        assert_eq!(cmap.lookup_bf_string(0x41), None);
+        assert_eq!(cmap.lookup_bf_string(0x42), Some(BfString::Char('Y')));
+    }
+
+    #[test]
+    fn bfrange_array_stops_at_exhaustion() {
+        // One member for 256 codes: the array cannot be resynced, so the
+        // loop must stop rather than spin over the remaining codes.
+        let cmap = parse_with_preamble(
+            br#"
+1 beginbfrange
+<0000> <00FF> [<0041>]
+endbfrange
+"#,
+        );
+        assert_eq!(cmap.lookup_bf_string(0x00), Some(BfString::Char('A')));
+        assert_eq!(cmap.lookup_bf_string(0x01), None);
+    }
+
+    #[test]
+    fn unresolvable_usecmap_is_skipped() {
+        let cmap = parse_with_preamble(
+            br#"
+/Bogus usecmap
+1 beginbfchar
+<41> <0058>
+endbfchar
+"#,
+        );
+        assert_eq!(
+            cmap.lookup_bf_string(0x41),
+            Some(BfString::Char('X'))
+        );
+    }
+
+    #[test]
+    fn bfchar_surrogate_pair() {
+        let cmap = parse_with_preamble(
+            br#"
+1 beginbfchar
+<3A51> <D840DC3E>
+endbfchar
+"#,
+        );
+
+        assert_eq!(
+            cmap.lookup_bf_string(0x3A51),
+            Some(BfString::Char('\u{2003E}'))
+        );
+    }
+
+    #[test]
+    fn bfrange_incrementing() {
+        let cmap = parse_with_preamble(
+            br#"
+1 beginbfrange
+<0000> <0004> <0041>
+endbfrange
+"#,
+        );
+
+        assert_eq!(cmap.lookup_bf_string(0x0000), Some(BfString::Char('A')));
+        assert_eq!(cmap.lookup_bf_string(0x0001), Some(BfString::Char('B')));
+        assert_eq!(cmap.lookup_bf_string(0x0004), Some(BfString::Char('E')));
+        assert_eq!(cmap.lookup_bf_string(0x0005), None);
+    }
+
+    #[test]
+    fn bfrange_array() {
+        let cmap = parse_with_preamble(
+            br#"
+1 beginbfrange
+<005F> <0061> [<00660066> <00660069> <0066006C>]
+endbfrange
+"#,
+        );
+
+        // ff, fi, fl ligatures
+        assert_eq!(
+            cmap.lookup_bf_string(0x005F),
+            Some(BfString::String(String::from("ff")))
+        );
+        assert_eq!(
+            cmap.lookup_bf_string(0x0060),
+            Some(BfString::String(String::from("fi")))
+        );
+        assert_eq!(
+            cmap.lookup_bf_string(0x0061),
+            Some(BfString::String(String::from("fl")))
+        );
+    }
+
+    #[test]
+    fn unicode_lookup_miss() {
+        let cmap = parse_with_preamble(
+            br#"
+1 beginbfchar
+<0041> <0048>
+endbfchar
+"#,
+        );
+
+        assert_eq!(cmap.lookup_bf_string(0x0000), None);
+        assert_eq!(cmap.lookup_bf_string(0x0042), None);
+    }
+
+    #[test]
+    fn identity_h() {
+        let cmap = CMap::identity_h();
+        assert_eq!(
+            cmap.metadata().name.as_deref(),
+            Some(b"Identity-H".as_slice())
+        );
+        assert_eq!(cmap.metadata().writing_mode, Some(WritingMode::Horizontal));
+
+        assert_eq!(cmap.lookup_cid_code(0x0041, 2), Some(0x0041));
+        assert_eq!(cmap.lookup_cid_code(0x1234, 2), Some(0x1234));
+        assert_eq!(cmap.lookup_cid_code(0xFFFF, 2), Some(0xFFFF));
+
+        assert_eq!(cmap.lookup_cid_code(0x0041, 1), None);
+        assert_eq!(cmap.lookup_cid_code(0x0041, 3), None);
+    }
+
+    #[test]
+    fn identity_v() {
+        let cmap = CMap::identity_v();
+        assert_eq!(
+            cmap.metadata().name.as_deref(),
+            Some(b"Identity-V".as_slice())
+        );
+        assert_eq!(cmap.metadata().writing_mode, Some(WritingMode::Vertical));
+
+        assert_eq!(cmap.lookup_cid_code(0x0041, 2), Some(0x0041));
+        assert_eq!(cmap.lookup_cid_code(0xFFFF, 2), Some(0xFFFF));
+    }
+
+    #[test]
+    fn minimal_cmap_no_name_no_wmode() {
+        // Extracted from corpus PDF 0500013.
+        let data = br#"
+/CIDInit /ProcSet findresource begin
+12 dict begin
+begincmap
+/CMapType 2 def
+1 begincodespacerange
+<00><ff>
+endcodespacerange
+1 beginbfrange
+<01><01><0020>
+endbfrange
+endcmap
+"#;
+        let cmap = CMap::parse(data, |_| None).unwrap();
+        assert_eq!(cmap.metadata().name, None);
+        assert_eq!(cmap.metadata().character_collection, None);
+        assert_eq!(cmap.metadata().writing_mode, None);
+        assert_eq!(cmap.lookup_bf_string(0x01), Some(BfString::Char(' ')));
+    }
+
+    #[test]
+    fn registry_as_name() {
+        // Extracted from corpus PDF 0875241, uses names instead of strings for
+        // strings for metadata.
+        let data = br#"
+/CIDSystemInfo
+<< /Registry /ABCDEF+SimSun
+/Ordering (pdfbeaninc)
+/Supplement 0
+>> def
+/CMapName /ABCDEF+SimSun def
+/CMapType 2 def
+1 begincodespacerange
+<0000> <FFFF>
+endcodespacerange
+1 beginbfrange
+<0000> <0000> <6881>
+endbfrange
+"#;
+        let cmap = CMap::parse(data, |_| None).unwrap();
+        let cc = cmap.metadata().character_collection.as_ref().unwrap();
+        assert_eq!(
+            cc.family,
+            CidFamily::Custom {
+                registry: b"ABCDEF+SimSun".to_vec(),
+                ordering: b"pdfbeaninc".to_vec(),
+            }
+        );
+        assert_eq!(cc.supplement, 0);
+        assert_eq!(
+            cmap.lookup_bf_string(0x0000),
+            Some(BfString::Char('\u{6881}'))
+        );
+    }
+
+    #[test]
+    fn single_byte_bfrange_destination() {
+        // See for example corpus test case 0625248.
+        let cmap = parse_with_preamble(
+            br#"
+1 beginbfrange
+<00> <7f> <00>
+endbfrange
+"#,
+        );
+
+        assert_eq!(
+            cmap.lookup_bf_string(0x00),
+            Some(BfString::Char('\u{0000}'))
+        );
+        assert_eq!(cmap.lookup_bf_string(0x41), Some(BfString::Char('A')));
+        assert_eq!(
+            cmap.lookup_bf_string(0x7f),
+            Some(BfString::Char('\u{007F}'))
+        );
+    }
+}
+
+#[cfg(all(test, feature = "embed-cmaps"))]
+mod bcmap_tests {
+    use super::*;
+
+    fn get_embedded_cmap(name: CMapName<'_>) -> Option<&'static [u8]> {
+        load_embedded(name)
+    }
+
+    #[test]
+    fn embedded_h_cmap() {
+        let data = load_embedded(CMapName::H).expect("embedded H cmap not found");
+        let cmap = CMap::parse(data, get_embedded_cmap).expect("failed to parse H cmap");
+        assert_eq!(cmap.metadata().writing_mode, None);
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::AdobeJapan1,
+                supplement: 1,
+            })
+        );
+        assert_eq!(cmap.lookup_cid_code(0x2121, 2), Some(633));
+        assert_eq!(cmap.lookup_cid_code(0x2221, 2), Some(727));
+    }
+
+    #[test]
+    fn embedded_90ms_rksj_h() {
+        let data =
+            load_embedded(CMapName::N90msRksjH).expect("embedded 90ms-RKSJ-H cmap not found");
+        let cmap = CMap::parse(data, get_embedded_cmap).expect("failed to parse 90ms-RKSJ-H cmap");
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::AdobeJapan1,
+                supplement: 2,
+            })
+        );
+        assert_eq!(cmap.lookup_cid_code(0x20, 1), Some(231));
+        assert_eq!(cmap.lookup_cid_code(0x8140, 2), Some(633));
+    }
+
+    #[test]
+    fn embedded_v_cmap() {
+        let data = load_embedded(CMapName::V).expect("embedded V cmap not found");
+        let cmap = CMap::parse(data, get_embedded_cmap).expect("failed to parse V cmap");
+        assert_eq!(cmap.metadata().writing_mode, Some(WritingMode::Vertical));
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::AdobeJapan1,
+                supplement: 1,
+            })
+        );
+        // Inherited from base "H" via usecmap.
+        assert_eq!(cmap.lookup_cid_code(0x2121, 2), Some(633));
+    }
+
+    #[test]
+    fn embedded_gbk_euc_h() {
+        let data = load_embedded(CMapName::GbkEucH).expect("embedded GBK-EUC-H not found");
+        let cmap = CMap::parse(data, get_embedded_cmap).expect("failed to parse GBK-EUC-H");
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::AdobeGB1,
+                supplement: 2,
+            })
+        );
+        assert_eq!(cmap.lookup_cid_code(0x20, 1), Some(7716));
+        assert_eq!(cmap.lookup_cid_code(0x21, 1), Some(814));
+        assert_eq!(cmap.lookup_cid_code(0x7E, 1), Some(814 + 0x7E - 0x21));
+        assert_eq!(cmap.lookup_cid_code(0xFE80, 2), Some(22094));
+        assert_eq!(cmap.lookup_cid_code(0xFEA0, 2), Some(22094 + 0xA0 - 0x80));
+    }
+
+    #[test]
+    fn embedded_ksc_euc_h() {
+        let data = load_embedded(CMapName::KscEucH).unwrap();
+        let cmap = CMap::parse(data, get_embedded_cmap).unwrap();
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::AdobeKorea1,
+                supplement: 0,
+            })
+        );
+        assert_eq!(cmap.lookup_cid_code(0x20, 1), Some(8094));
+        assert_eq!(cmap.lookup_cid_code(0x41, 1), Some(8094 + 0x41 - 0x20));
+        assert_eq!(cmap.lookup_cid_code(0xA1A1, 2), Some(101));
+        assert_eq!(cmap.lookup_cid_code(0xA1FE, 2), Some(101 + 0xFE - 0xA1));
+        assert_eq!(cmap.lookup_cid_code(0xFDA1, 2), Some(7962));
+    }
+
+    #[test]
+    fn embedded_b5pc_h() {
+        let data = load_embedded(CMapName::B5pcH).unwrap();
+        let cmap = CMap::parse(data, get_embedded_cmap).unwrap();
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::AdobeCNS1,
+                supplement: 0,
+            })
+        );
+        assert_eq!(cmap.lookup_cid_code(0x20, 1), Some(1));
+        assert_eq!(cmap.lookup_cid_code(0x41, 1), Some(1 + 0x41 - 0x20));
+        assert_eq!(cmap.lookup_cid_code(0x80, 1), Some(61));
+        assert_eq!(cmap.lookup_cid_code(0xD140, 2), Some(7251));
+        assert_eq!(cmap.lookup_cid_code(0xD17E, 2), Some(7251 + 0x7E - 0x40));
+        assert_eq!(cmap.lookup_cid_code(0xF9D5, 2), Some(13642 + 3));
+    }
+
+    #[test]
+    fn embedded_unijis_utf16_h() {
+        let data = load_embedded(CMapName::UniJisUtf16H).unwrap();
+        let cmap = CMap::parse(data, get_embedded_cmap).unwrap();
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::AdobeJapan1,
+                supplement: 7,
+            })
+        );
+        assert_eq!(cmap.lookup_cid_code(0x20, 2), Some(1));
+        assert_eq!(cmap.lookup_cid_code(0x41, 2), Some(1 + 0x41 - 0x20));
+        assert_eq!(cmap.lookup_cid_code(0x5C, 2), Some(97));
+        assert_eq!(cmap.lookup_cid_code(0x5BCC, 2), Some(3531));
+        assert_eq!(cmap.lookup_cid_code(0xD884DF50, 4), Some(19130));
+    }
+
+    #[test]
+    fn embedded_identity_h() {
+        let data = load_embedded(CMapName::IdentityH).expect("embedded Identity-H not found");
+        let cmap = CMap::parse(data, get_embedded_cmap).expect("failed to parse Identity-H cmap");
+        assert_eq!(cmap.metadata().writing_mode, None);
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::AdobeIdentity,
+                supplement: 0,
+            })
+        );
+        assert_eq!(cmap.lookup_cid_code(0x0000, 2), Some(0));
+        assert_eq!(cmap.lookup_cid_code(0x0041, 2), Some(0x41));
+        assert_eq!(cmap.lookup_cid_code(0xFFFF, 2), Some(0xFFFF));
+    }
+
+    #[test]
+    fn embedded_identity_v() {
+        let data = load_embedded(CMapName::IdentityV).expect("embedded Identity-V not found");
+        let cmap = CMap::parse(data, get_embedded_cmap).expect("failed to parse Identity-V cmap");
+        assert_eq!(cmap.metadata().writing_mode, Some(WritingMode::Vertical));
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::AdobeIdentity,
+                supplement: 0,
+            })
+        );
+        assert_eq!(cmap.lookup_cid_code(0x0000, 2), Some(0));
+        assert_eq!(cmap.lookup_cid_code(0x0041, 2), Some(0x41));
+        assert_eq!(cmap.lookup_cid_code(0xFFFF, 2), Some(0xFFFF));
+    }
+
+    // Note: Some tests AI-generated, haven't double-checked them.
+
+    #[test]
+    fn embedded_adobe_gb1_ucs2() {
+        let data = load_embedded(CMapName::AdobeGb1Ucs2).unwrap();
+        let cmap = CMap::parse(data, get_embedded_cmap).unwrap();
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::Custom {
+                    registry: b"Adobe".to_vec(),
+                    ordering: b"Adobe_GB1_UCS2".to_vec(),
+                },
+                supplement: 5,
+            })
+        );
+
+        assert_eq!(
+            cmap.lookup_bf_string(0x0063),
+            Some(BfString::Char('\u{00B7}'))
+        );
+        assert_eq!(cmap.lookup_bf_string(0x0001), Some(BfString::Char(' ')));
+        assert_eq!(cmap.lookup_bf_string(0x0022), Some(BfString::Char('A')));
+        assert_eq!(cmap.lookup_bf_string(0x005F), Some(BfString::Char('~')));
+        assert_eq!(
+            cmap.lookup_bf_string(0x560F),
+            Some(BfString::String(String::from("\u{90CE}\u{FE00}")))
+        );
+    }
+
+    #[test]
+    fn embedded_adobe_japan1_ucs2() {
+        let data = load_embedded(CMapName::AdobeJapan1Ucs2).unwrap();
+        let cmap = CMap::parse(data, get_embedded_cmap).unwrap();
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::Custom {
+                    registry: b"Adobe".to_vec(),
+                    ordering: b"Adobe_Japan1_UCS2".to_vec(),
+                },
+                supplement: 7,
+            })
+        );
+
+        assert_eq!(
+            cmap.lookup_bf_string(0x003D),
+            Some(BfString::Char('\u{00A5}'))
+        );
+        assert_eq!(cmap.lookup_bf_string(0x0001), Some(BfString::Char(' ')));
+        assert_eq!(cmap.lookup_bf_string(0x003C), Some(BfString::Char('[')));
+        assert_eq!(
+            cmap.lookup_bf_string(0x0476),
+            Some(BfString::String(String::from("\u{82A6}\u{E0100}")))
+        );
+        assert_eq!(
+            cmap.lookup_bf_string(0x265B),
+            Some(BfString::String(String::from("10/11")))
+        );
+        assert_eq!(
+            cmap.lookup_bf_string(0x2E6B),
+            Some(BfString::String(String::from("オングストローム")))
+        );
+    }
+
+    #[test]
+    fn embedded_adobe_korea1_ucs2() {
+        let data = load_embedded(CMapName::AdobeKorea1Ucs2).unwrap();
+        let cmap = CMap::parse(data, get_embedded_cmap).unwrap();
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::Custom {
+                    registry: b"Adobe".to_vec(),
+                    ordering: b"Adobe_Korea1_UCS2".to_vec(),
+                },
+                supplement: 2,
+            })
+        );
+
+        assert_eq!(
+            cmap.lookup_bf_string(0x0060),
+            Some(BfString::Char('\u{20A9}'))
+        );
+        assert_eq!(
+            cmap.lookup_bf_string(0x2072),
+            Some(BfString::String(String::from("[10]")))
+        );
+        assert_eq!(
+            cmap.lookup_bf_string(0x2073),
+            Some(BfString::String(String::from("[11]")))
+        );
+    }
+
+    #[test]
+    fn embedded_adobe_cns1_ucs2() {
+        let data = load_embedded(CMapName::AdobeCns1Ucs2).unwrap();
+        let cmap = CMap::parse(data, get_embedded_cmap).unwrap();
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::Custom {
+                    registry: b"Adobe".to_vec(),
+                    ordering: b"Adobe_CNS1_UCS2".to_vec(),
+                },
+                supplement: 7,
+            })
+        );
+
+        assert_eq!(
+            cmap.lookup_bf_string(0x0060),
+            Some(BfString::Char('\u{00A9}'))
+        );
+        assert_eq!(cmap.lookup_bf_string(0x0001), Some(BfString::Char(' ')));
+        assert_eq!(cmap.lookup_bf_string(0x005F), Some(BfString::Char('~')));
+        assert_eq!(
+            cmap.lookup_bf_string(0x36B0),
+            Some(BfString::Char('\u{200CC}'))
+        );
+    }
+
+    #[test]
+    fn embedded_eten_b5_h() {
+        let data = load_embedded(CMapName::ETenB5H).unwrap();
+        let cmap = CMap::parse(data, get_embedded_cmap).unwrap();
+        assert_eq!(
+            cmap.metadata().character_collection,
+            Some(CharacterCollection {
+                family: CidFamily::AdobeCNS1,
+                supplement: 0,
+            })
+        );
+        assert_eq!(cmap.lookup_cid_code(0x20, 1), Some(13648));
+        assert_eq!(cmap.lookup_cid_code(0x7E, 1), Some(13648 + 0x7E - 0x20));
+        assert_eq!(cmap.lookup_cid_code(0xA140, 2), Some(99));
+        assert_eq!(cmap.lookup_cid_code(0xA158, 2), Some(99 + 0x58 - 0x40));
+        assert_eq!(cmap.lookup_cid_code(0xD040, 2), Some(7094));
+        assert_eq!(cmap.lookup_cid_code(0xF9FE, 2), Some(14056 + 0xFE - 0xD6));
+    }
+}
diff --git a/vendor/hayro-cmap/src/parse.rs b/vendor/hayro-cmap/src/parse.rs
new file mode 100644
index 00000000..a9362092
--- /dev/null
+++ b/vendor/hayro-cmap/src/parse.rs
@@ -0,0 +1,469 @@
+use alloc::boxed::Box;
+use alloc::vec::Vec;
+
+use hayro_postscript::{Object, Scanner};
+
+#[cfg(feature = "embed-cmaps")]
+use crate::bcmap;
+use crate::{
+    BfRange, CMap, CMapName, CharacterCollection, CidFamily, CidRange, CodespaceRange,
+    MAX_NESTING_DEPTH, Metadata, PartitionedRanges, Range, WritingMode,
+};
+
+struct Context<F> {
+    buf: Vec<u8>,
+    get_cmap: F,
+}
+
+pub(crate) fn parse_inner<'a>(
+    data: &[u8],
+    get_cmap: impl Fn(CMapName<'_>) -> Option<&'a [u8]> + Clone + 'a,
+    depth: u32,
+) -> Option<CMap> {
+    // Prevent stack overflow for malicious cmap files or circular references.
+    if depth >= MAX_NESTING_DEPTH {
+        return None;
+    }
+
+    // Check if it's in our custom embedded cmap format.
+    #[cfg(feature = "embed-cmaps")]
+    if data.starts_with(b"bcmap") {
+        return bcmap::parse(data, get_cmap, depth);
+    }
+
+    let mut scanner = Scanner::new(data);
+    let mut ctx = Context {
+        buf: Vec::new(),
+        get_cmap,
+    };
+    let mut _codespace_ranges = Vec::new();
+    let mut ranges = PartitionedRanges::new();
+    let mut notdef_ranges = PartitionedRanges::new();
+    let mut bf_entries = Vec::new();
+    let mut base = None;
+
+    let mut registry = None;
+    let mut ordering = None;
+    let mut supplement = None;
+    let mut cmap_name = None;
+    let mut writing_mode = None;
+    let mut last_name: Option<Vec<u8>> = None;
+
+    // PdfCraft patch: track whether the scan was cut short. A CMap with an
+    // unparseable tail, including one that ends inside a `begin…` block,
+    // keeps the entries read so far (the block parsers push into the shared
+    // lists as they go) instead of being discarded wholesale; one that
+    // yielded nothing still reports failure.
+    let mut truncated = false;
+
+    // PdfCraft patch: track a `usecmap` reference that could not be resolved
+    // or parsed. When the stream yields no mappings of its own, the caller
+    // must see failure rather than an empty map, so its encoding fallback
+    // paths run exactly as they did before the tolerant-usecmap change.
+    let mut usecmap_failed = false;
+    while !scanner.at_end() {
+        let Ok(obj) = scanner.parse_object() else {
+            truncated = true;
+            break;
+        };
+
+        let Object::Name(name) = &obj else { continue };
+
+        if name.is_literal() {
+            match name.as_str() {
+                // Strictly speaking, Registry and Ordering should be strings,
+                // but some PDF generators emit names instead, so be lenient
+                // and try both.
+                Some("Registry") => {
+                    registry = parse_string_or_name(&mut scanner);
+                }
+                Some("Ordering") => {
+                    ordering = parse_string_or_name(&mut scanner);
+                }
+                Some("Supplement") => {
+                    supplement = scanner.parse_number().ok().map(|n| n.as_i32());
+                }
+                Some("CMapName") => {
+                    cmap_name = scanner.parse_name().ok().and_then(|n| n.decode().ok());
+                }
+                Some("WMode") => {
+                    writing_mode = parse_writing_mode(&mut scanner);
+                }
+                _ => {
+                    last_name = name.decode().ok();
+                }
+            }
+        } else {
+            match name.as_str() {
+                Some("begincodespacerange") => {
+                    if parse_codespace_range(&mut scanner, &mut _codespace_ranges, &mut ctx).is_none() {
+                        truncated = true;
+                        break;
+                    }
+                }
+                Some("begincidrange") => {
+                    if parse_range(&mut scanner, &mut ranges, &mut ctx, "endcidrange").is_none() {
+                        truncated = true;
+                        break;
+                    }
+                }
+                Some("begincidchar") => {
+                    if parse_char(&mut scanner, &mut ranges, &mut ctx, "endcidchar").is_none() {
+                        truncated = true;
+                        break;
+                    }
+                }
+                Some("beginnotdefrange") => {
+                    if parse_range(&mut scanner, &mut notdef_ranges, &mut ctx, "endnotdefrange").is_none() {
+                        truncated = true;
+                        break;
+                    }
+                }
+                Some("beginnotdefchar") => {
+                    if parse_char(&mut scanner, &mut notdef_ranges, &mut ctx, "endnotdefchar").is_none() {
+                        truncated = true;
+                        break;
+                    }
+                }
+                Some("beginbfchar") => {
+                    if parse_bf_char(&mut scanner, &mut bf_entries, &mut ctx).is_none() {
+                        truncated = true;
+                        break;
+                    }
+                }
+                Some("beginbfrange") => {
+                    if parse_bf_range(&mut scanner, &mut bf_entries, &mut ctx).is_none() {
+                        truncated = true;
+                        break;
+                    }
+                }
+                Some("usecmap") => {
+                    // PdfCraft patch: an unresolvable or unparseable `usecmap`
+                    // reference drops only the base, not the whole CMap, but
+                    // is remembered so a stream that then yields no mappings
+                    // at all still reports failure.
+                    let resolved = last_name.as_deref().and_then(|name| {
+                        (ctx.get_cmap)(CMapName::from_bytes(name))
+                    });
+                    match resolved {
+                        Some(nested_data) => {
+                            match parse_inner(nested_data, ctx.get_cmap.clone(), depth + 1) {
+                                Some(nested) => base = Some(Box::new(nested)),
+                                None => usecmap_failed = true,
+                            }
+                        }
+                        None => usecmap_failed = true,
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+
+
+    // Since we will use binary search for finding the correct entry, sort now.
+    ranges.sort();
+    notdef_ranges.sort();
+    bf_entries.sort_by(|a, b| a.range.start.cmp(&b.range.start));
+
+    // See PDFJS-3323, which has an invalid CIDSystemInfo entry.
+    // We ignore it if it's invalid.
+    let character_collection = if let (Some(registry), Some(ordering), Some(supplement)) =
+        (registry, ordering, supplement)
+    {
+        Some(CharacterCollection {
+            family: CidFamily::from_registry_ordering(&registry, &ordering),
+            supplement,
+        })
+    } else {
+        None
+    };
+
+    let metadata = Metadata {
+        character_collection,
+        name: cmap_name,
+        writing_mode,
+    };
+
+    // PdfCraft patch: a CMap that was cut short or whose `usecmap` base could
+    // not be resolved, and that yielded no mappings of its own, still reports
+    // failure, so callers fall back to the font's own encoding exactly as
+    // before.
+    if (truncated || usecmap_failed)
+        && ranges.is_empty()
+        && notdef_ranges.is_empty()
+        && bf_entries.is_empty()
+        && base.is_none()
+    {
+        return None;
+    }
+
+    Some(CMap {
+        metadata,
+        _codespace_ranges,
+        cid_ranges: ranges,
+        notdef_ranges,
+        bf_entries,
+        base,
+    })
+}
+
+fn parse_writing_mode(scanner: &mut Scanner<'_>) -> Option<WritingMode> {
+    match scanner.parse_number().ok()?.as_i32() {
+        0 => Some(WritingMode::Horizontal),
+        1 => Some(WritingMode::Vertical),
+        _ => None,
+    }
+}
+
+fn parse_string_or_name(scanner: &mut Scanner<'_>) -> Option<Vec<u8>> {
+    match scanner.parse_object().ok()? {
+        Object::String(s) => s.decode().ok(),
+        Object::Name(n) => n.decode().ok(),
+        _ => None,
+    }
+}
+
+fn parse_codespace_range<F>(
+    scanner: &mut Scanner<'_>,
+    ranges: &mut Vec<CodespaceRange>,
+    ctx: &mut Context<F>,
+) -> Option<()> {
+    loop {
+        let obj = scanner.parse_object().ok()?;
+
+        if name_matches(&obj, "endcodespacerange") {
+            return Some(());
+        }
+
+        // PdfCraft patch: a malformed codespace entry is skipped, not fatal.
+        let Some(low) = extract_u32_code(&obj, &mut ctx.buf) else { continue };
+        let Ok(n_bytes) = u8::try_from(ctx.buf.len()) else { continue };
+        let Some(high) = read_u32_code(scanner, &mut ctx.buf) else { continue };
+
+        if ctx.buf.len() != usize::from(n_bytes) {
+            continue;
+        }
+
+        ranges.push(CodespaceRange {
+            number_bytes: n_bytes,
+            low,
+            high,
+        });
+    }
+}
+
+fn parse_range<F>(
+    scanner: &mut Scanner<'_>,
+    ranges: &mut PartitionedRanges,
+    ctx: &mut Context<F>,
+    end_marker: &str,
+) -> Option<()> {
+    loop {
+        let obj = scanner.parse_object().ok()?;
+
+        if name_matches(&obj, end_marker) {
+            return Some(());
+        }
+
+        // PdfCraft patch: a malformed range entry is skipped, not fatal.
+        let Some(start) = extract_u32_code(&obj, &mut ctx.buf) else { continue };
+        let byte_len = ctx.buf.len();
+        let Some(end) = read_u32_code(scanner, &mut ctx.buf) else { continue };
+        let Some(cid_start) = scanner.parse_number().ok().and_then(|n| u32::try_from(n.as_i32()).ok()) else { continue };
+
+        ranges.push(
+            byte_len,
+            CidRange {
+                range: Range { start, end },
+                cid_start,
+            },
+        );
+    }
+}
+
+fn parse_char<F>(
+    scanner: &mut Scanner<'_>,
+    ranges: &mut PartitionedRanges,
+    ctx: &mut Context<F>,
+    end_marker: &str,
+) -> Option<()> {
+    loop {
+        let obj = scanner.parse_object().ok()?;
+
+        if name_matches(&obj, end_marker) {
+            return Some(());
+        }
+
+        // PdfCraft patch: a malformed char entry is skipped, not fatal.
+        let Some(code) = extract_u32_code(&obj, &mut ctx.buf) else { continue };
+        let byte_len = ctx.buf.len();
+        let Some(cid_start) = scanner.parse_number().ok().and_then(|n| u32::try_from(n.as_i32()).ok()) else { continue };
+
+        ranges.push(
+            byte_len,
+            CidRange {
+                range: Range {
+                    start: code,
+                    end: code,
+                },
+                cid_start,
+            },
+        );
+    }
+}
+
+fn parse_bf_char<F>(
+    scanner: &mut Scanner<'_>,
+    entries: &mut Vec<BfRange>,
+    ctx: &mut Context<F>,
+) -> Option<()> {
+    loop {
+        let obj = scanner.parse_object().ok()?;
+
+        if name_matches(&obj, "endbfchar") {
+            return Some(());
+        }
+
+        // PdfCraft patch: a malformed bfchar entry (e.g. a non-hex destination)
+        // is skipped, not fatal - the entries after it still apply.
+        let Some(code) = extract_u32_code(&obj, &mut ctx.buf) else {
+            // The malformed code is still followed by its destination
+            // object; skip it so later entries stay aligned.
+            let _ = scanner.parse_object();
+            continue;
+        };
+        let Ok(dst) = scanner.parse_string() else { continue };
+        if dst.decode_into(&mut ctx.buf).is_err() { continue }
+        let Some(dst_base) = decode_be(&ctx.buf) else { continue };
+
+        entries.push(BfRange {
+            range: Range {
+                start: code,
+                end: code,
+            },
+            dst_base,
+        });
+    }
+}
+
+fn parse_bf_range<F>(
+    scanner: &mut Scanner<'_>,
+    entries: &mut Vec<BfRange>,
+    ctx: &mut Context<F>,
+) -> Option<()> {
+    loop {
+        let obj = scanner.parse_object().ok()?;
+
+        if name_matches(&obj, "endbfrange") {
+            return Some(());
+        }
+
+        // PdfCraft patch: a malformed bfrange entry is skipped, not fatal.
+        let Some(start) = extract_u32_code(&obj, &mut ctx.buf) else {
+            // Skip the range's end and destination objects too, so later
+            // entries stay aligned.
+            let _ = scanner.parse_object();
+            let _ = scanner.parse_object();
+            continue;
+        };
+        let Some(end) = read_u32_code(scanner, &mut ctx.buf) else {
+            // Skip the destination object as well to stay aligned.
+            let _ = scanner.parse_object();
+            continue;
+        };
+
+        let Ok(next) = scanner.parse_object() else { continue };
+
+        match &next {
+            Object::String(s) => {
+                if s.decode_into(&mut ctx.buf).is_err() { continue }
+                let Some(dst_base) = decode_be(&ctx.buf) else { continue };
+
+                entries.push(BfRange {
+                    range: Range { start, end },
+                    dst_base,
+                });
+            }
+            Object::Array(array) => {
+                let mut array_scanner = array.objects();
+
+                for code in start..=end {
+                    // An exhausted or broken array cannot be resynced to a
+                    // member boundary; stop instead of spinning over the
+                    // remaining codes. A decodable-but-bad member still
+                    // drops only itself.
+                    let Ok(s) = array_scanner.parse_string() else { break };
+                    if s.decode_into(&mut ctx.buf).is_err() { continue }
+                    let Some(dst_base) = decode_be(&ctx.buf) else { continue };
+
+                    entries.push(BfRange {
+                        range: Range {
+                            start: code,
+                            end: code,
+                        },
+                        dst_base,
+                    });
+                }
+            }
+            _ => continue,
+        }
+    }
+}
+
+/// Convert the buffer into native-endian u16, so that we can use `String::from_utf16`.
+fn decode_be(bytes: &[u8]) -> Option<Vec<u16>> {
+    if bytes.is_empty() {
+        return None;
+    }
+
+    let mut out = Vec::with_capacity(bytes.len().div_ceil(2));
+    let mut i = 0;
+
+    // My understanding is that the bf strings should always be UTF16-BE encoded,
+    // but it seems like some PDFs only have a single byte there? I guess we just
+    // pad them? Wasn't able to find anything specific in the specifications.
+    if !bytes.len().is_multiple_of(2) {
+        out.push(u16::from(bytes[0]));
+        i = 1;
+    }
+
+    while i < bytes.len() {
+        out.push(u16::from_be_bytes([bytes[i], bytes[i + 1]]));
+        i += 2;
+    }
+
+    Some(out)
+}
+
+#[inline]
+fn read_u32_code(scanner: &mut Scanner<'_>, buf: &mut Vec<u8>) -> Option<u32> {
+    let s = scanner.parse_string().ok()?;
+    s.decode_into(buf).ok()?;
+    bytes_to_u32(buf)
+}
+
+#[inline]
+fn extract_u32_code(obj: &Object<'_>, buf: &mut Vec<u8>) -> Option<u32> {
+    let Object::String(s) = obj else { return None };
+    s.decode_into(buf).ok()?;
+    bytes_to_u32(buf)
+}
+
+#[inline]
+fn bytes_to_u32(bytes: &[u8]) -> Option<u32> {
+    if bytes.is_empty() || bytes.len() > 4 {
+        return None;
+    }
+
+    let mut val = 0_u32;
+    for &b in bytes {
+        val = (val << 8) | b as u32;
+    }
+
+    Some(val)
+}
+
+fn name_matches(obj: &Object<'_>, expected: &str) -> bool {
+    matches!(obj, Object::Name(name) if !name.is_literal() && name.as_str() == Some(expected))
+}
diff --git a/vendor/hayro-interpret/SOURCE.json b/vendor/hayro-interpret/SOURCE.json
index 2ef84143..509fd7da 100644
--- a/vendor/hayro-interpret/SOURCE.json
+++ b/vendor/hayro-interpret/SOURCE.json
@@ -1,7 +1,7 @@
 {
   "crate": "hayro-interpret",
   "source_repository": "https://github.com/storytold/pdfcraft",
-  "source_revision": "7437bde378f43856eada40af25b983812e615e8a",
+  "source_revision": "ec0a965074f376a5bf610435948e4e5184bf3299",
   "source_directory": "vendor/hayro-interpret",
   "files": [
     {
@@ -174,21 +174,21 @@
     },
     {
       "path": "src/cache.rs",
-      "source_sha256": "a0a46ddbab7ed00b6bd0fb09f10d545c06bb4374ea0f520ae118c8d4f7b3c55d",
-      "source_git_blob": "2dda2e8a7cc0a2491b253ba1f42adac6074b1b34",
-      "sha256": "a0a46ddbab7ed00b6bd0fb09f10d545c06bb4374ea0f520ae118c8d4f7b3c55d"
+      "source_sha256": "76b5dc066330666a50a32124856306b72c98e646346263bd8a269bc99e5a0d42",
+      "source_git_blob": "e253a7b8c7dbfbfa2f7dc1f6c582559962060b94",
+      "sha256": "c63ed890ead39cc6205746063f90689b7a617e8c14a35e6ee1b955550d1230a5"
     },
     {
       "path": "src/color.rs",
-      "source_sha256": "c78cad4124e7bb203e0763f6bea36c542280fd0a8abfa3f7b3ea0bd728adb73b",
-      "source_git_blob": "dd2edf241d60f146ddb8ea4cbd4ad12a127fa0a7",
-      "sha256": "bc9b67008e8f7e5ba7bd96a9b49b6ec5d2818eedc44e003212342d8bc259cc36"
+      "source_sha256": "799ce29bb5e59c8fc94db202873e48c2047dd35962e6f26efd215156c47158c1",
+      "source_git_blob": "56bb04f24c04ba33ab6bf99c02a24735670959ad",
+      "sha256": "025186ea5726339068f66d39bc0f5eafb05f6223e4a9a74b9944c20d0fbe7886"
     },
     {
       "path": "src/context.rs",
-      "source_sha256": "e6898005282196c77bf44357237c79f8c839e74f666e8157756230fd9e2f93ed",
-      "source_git_blob": "3e83229c5f58cfbbefd15bf3b5e7b71380291c01",
-      "sha256": "c6f3ca9d12a53042a28dbb8088ee97ba8b2fc6b03ec35867b58fca99dd9b9807"
+      "source_sha256": "dc2be553958ee3f5e5e644a77a0301723bae9ca027a352c13b9caaf549cc0e56",
+      "source_git_blob": "d6772baa15ebb95d3ba2d1f54ce5c250ad1e8137",
+      "sha256": "98ed66aab25f1e3b8b9dfd9b6837dc0d9519a9fd7f5429b695865879abc24f6d"
     },
     {
       "path": "src/convert.rs",
@@ -198,27 +198,27 @@
     },
     {
       "path": "src/device.rs",
-      "source_sha256": "b95b9c91184dde6bb7dcf2dfcad1244f44ae5c73b02d78ea6cd2c692ac8a5ce4",
-      "source_git_blob": "72d5a98098cb3544259dcb05df7b5b265310ff2f",
-      "sha256": "b95b9c91184dde6bb7dcf2dfcad1244f44ae5c73b02d78ea6cd2c692ac8a5ce4"
+      "source_sha256": "6f0c1203d1e60724cdd11e9a230249247a70f578c4a7ccb9bf39a23411b32db6",
+      "source_git_blob": "36c64a23fd23f6c4abad941077cf93296a67841f",
+      "sha256": "4465153ace47c6893958f187a37579dd87139e04505749483aea139f5f2bac99"
     },
     {
       "path": "src/encode.rs",
-      "source_sha256": "68973a358f38bd6d7f09277e6319506122f586d1cda092b933c2a18680fe6d8f",
-      "source_git_blob": "498ed909ca65f9765b4f0c3b2ea10386e2e6c48d",
-      "sha256": "68973a358f38bd6d7f09277e6319506122f586d1cda092b933c2a18680fe6d8f"
+      "source_sha256": "674a97c48cc62e9a218f843246776528173c36c00aa96a1e4c291c1d912c29c6",
+      "source_git_blob": "b3f830ba2dcdb7069ea73706be43c55be398f670",
+      "sha256": "46c9773f05c329cad20f3126394f89a551ee393569c58911b0a921be8c020376"
     },
     {
       "path": "src/font/blob.rs",
       "source_sha256": "30a9dadf498829ee03eb1ddc6deaeb09a06ee42415f288d46f4a67640582c575",
       "source_git_blob": "6eabc26b9bc30bdc51f0b5fdd5e4b556d7583ec5",
-      "sha256": "30a9dadf498829ee03eb1ddc6deaeb09a06ee42415f288d46f4a67640582c575"
+      "sha256": "8c39f3ef95c48054d4aacaeb17189193c075df42fc767eee596bc4dbf2453d5f"
     },
     {
       "path": "src/font/cid.rs",
       "source_sha256": "c1dbe7fe5b7f7092d97b84063008df54aebf87db4ba1fdb3a179fab9fe6674b8",
       "source_git_blob": "b99dcbc116ca1169df3a229eafd05ee5b9204626",
-      "sha256": "c1dbe7fe5b7f7092d97b84063008df54aebf87db4ba1fdb3a179fab9fe6674b8"
+      "sha256": "6c9927c47893edacab4a3258d4ec72b4d3cc2dd25c518e308884321110847ab6"
     },
     {
       "path": "src/font/generated/glyph_names.rs",
@@ -288,39 +288,39 @@
     },
     {
       "path": "src/font/mod.rs",
-      "source_sha256": "f7a8cfe30893115cc05906cbec747ad368b5645de101c8cbf7bf622f7611973b",
-      "source_git_blob": "5ccf5c48a6132b7704baff81ece3492a6a7acae2",
-      "sha256": "f7a8cfe30893115cc05906cbec747ad368b5645de101c8cbf7bf622f7611973b"
+      "source_sha256": "7e6411927d91205ca76c6b59f9d737cd1104d066f8cfcc0a87f481016ef30313",
+      "source_git_blob": "7c8c8d086d59139df791cdb6952506473ec4b5a7",
+      "sha256": "c0c903cb8a33ab863412c407ad10181adec0d22b81c899fc5225de14d8878091"
     },
     {
       "path": "src/font/outline.rs",
       "source_sha256": "2462d9ae4008c620afb47103bfa55362e75d84a28cb418240439b147de4ada8c",
       "source_git_blob": "558d886cad5b9f79c6c1422f604c517a5f98ce0d",
-      "sha256": "2462d9ae4008c620afb47103bfa55362e75d84a28cb418240439b147de4ada8c"
+      "sha256": "a15235fb600d8bf6496405c125ea03f9196e7428e439ef7e01303eef14efa000"
     },
     {
       "path": "src/font/standard_font.rs",
-      "source_sha256": "048bcfb0d7d63ced49cef583c954b7507e5f078313caf5cf565adb97ad4bda46",
-      "source_git_blob": "c73c75dd22c7937585a0646f49bc89514ce054df",
-      "sha256": "048bcfb0d7d63ced49cef583c954b7507e5f078313caf5cf565adb97ad4bda46"
+      "source_sha256": "af3c51592c086671cb127745d4351d1380ef1212aee325099f1e933607995d7d",
+      "source_git_blob": "139454a0b21eb992e9e52bf73c85e965c0f86cda",
+      "sha256": "01241c51fe85d94fa1bc3963e16a45be7c292104b204c37704e636ba2c0b0c5d"
     },
     {
       "path": "src/font/true_type.rs",
-      "source_sha256": "8e8ffcf8f9749b10262793f1ecaf86ac7c65e6d5608e013d938a03adf210ad84",
-      "source_git_blob": "40f33590309100f295cb441069c340f9e034b49b",
-      "sha256": "8e8ffcf8f9749b10262793f1ecaf86ac7c65e6d5608e013d938a03adf210ad84"
+      "source_sha256": "278fed0cddcc43cc7d616200dcefb45720db9d560f54e41a82c281c3163b411d",
+      "source_git_blob": "b36266985942b4d7e2970f9edf7329c4edbcfa11",
+      "sha256": "a1262fd7efcf358b85b7863c97733a40e5df4295a9d1b54f66b1bada5898f600"
     },
     {
       "path": "src/font/type1.rs",
-      "source_sha256": "5779b825fa6a5589978ed5b30910b7af0986ace42bac4e3652f7975a479874d4",
-      "source_git_blob": "32b5e3ddd9a2ca877d760bc5150bd55c3302bb33",
-      "sha256": "5779b825fa6a5589978ed5b30910b7af0986ace42bac4e3652f7975a479874d4"
+      "source_sha256": "431b1fe86ca51bd993e81084a64c3e8ed8b90a67385a30eb4ffedfdd98c6f96b",
+      "source_git_blob": "02f76bfb8095041e3d54df014190047de46be4c5",
+      "sha256": "af73de5038ee590bb062ee1e610a60e5e4f51d109ae765922ce9669b4e36ce95"
     },
     {
       "path": "src/font/type3.rs",
-      "source_sha256": "257f7a2c8780c8e565f46dfd7dd1e3d50bef1e2c44aae5777994addb0ca26d62",
-      "source_git_blob": "ccfeeb766472f16f15b04710bab711f669b94adf",
-      "sha256": "5bd99e9a219c4ed437f964b3b81e10381ad4f0bfdee8b2f9be1a6d3940fcd9b4"
+      "source_sha256": "bc33784f0dd3e599028b28b3696b9e4380cbff08f4c4e6299dee51f8df5eb08f",
+      "source_git_blob": "c0e0d0b2df8f38183b8e23e9e8f644c0b81d0529",
+      "sha256": "1778362c6c4a5cb015e756fd3f36afd7482f20a230dde0206f4339da922eaca4"
     },
     {
       "path": "src/function/mod.rs",
@@ -330,9 +330,9 @@
     },
     {
       "path": "src/function/type0.rs",
-      "source_sha256": "84cb6ccb45536ca5731394558883350f43b5e66330e07eb8d5a0e070c8e20704",
-      "source_git_blob": "02bbc41b84caddc9b5dfc8f49b2da081eb281199",
-      "sha256": "84cb6ccb45536ca5731394558883350f43b5e66330e07eb8d5a0e070c8e20704"
+      "source_sha256": "a10a3a8c2154c19c5c637d5ff70b87b4d28a8bb857d82f2b06de68414ef93be7",
+      "source_git_blob": "9a82c5978657170c44a2e2b771f2610ade5fb292",
+      "sha256": "4a9a1f3d6da0c13bc359a8eb5fcbb2591e21d0944ba676d48ac58b6b565366fa"
     },
     {
       "path": "src/function/type2.rs",
@@ -360,27 +360,27 @@
     },
     {
       "path": "src/interpret/mod.rs",
-      "source_sha256": "2b286df0c34b8194e1bdd1b63c1e08354d24f8389958fd782f42e2cabf364673",
-      "source_git_blob": "931b3388cef188cee0a5a1d495b69a6ff04f5e51",
-      "sha256": "72650303e920e855cf4c78c82bee2c4b72a4f251c58e16d27bd5ae3860c9983b"
+      "source_sha256": "2b002323055bc19aa497e92c81ad8e06dc60ee03686cad89366df4ac7c7a06b2",
+      "source_git_blob": "fe08fc284ba7c914d1414b68a5a346674a6f910f",
+      "sha256": "3f8958e8d234f00b24478acb8081aa1aaffdca6b8a12b24c4abc6f534ce09a05"
     },
     {
       "path": "src/interpret/path.rs",
       "source_sha256": "a5defbc4b883b262662f7e7474a00ec1f97dbef8c03b8669859f624f5d02344b",
       "source_git_blob": "838ea099f11d918d6e333e32503368be864689f8",
-      "sha256": "a5defbc4b883b262662f7e7474a00ec1f97dbef8c03b8669859f624f5d02344b"
+      "sha256": "0e4d2dc0a2d5a2c5cdc0d1d9358fcf3b0854e8d24d002ce1830a1b4def786bc8"
     },
     {
       "path": "src/interpret/state.rs",
       "source_sha256": "dce778291b13f6df83c8c13aee22f60edd033ec9f7d89309ef148d46d3ba9814",
       "source_git_blob": "95b773fb5cc434ab8db362d00e4e5180a8b740c9",
-      "sha256": "a0d726f48645374f5cbf4ecb10906c13cabc747e3de878b9140c73b6d1303819"
+      "sha256": "bc5e73c3b29cdfe9d5f5036ea82beb2cf5a12ccd8a8c93277c15670b5f81ec08"
     },
     {
       "path": "src/interpret/text.rs",
       "source_sha256": "35eafa80147aea635bdef127c33ace20e1695e11e87c7bfe1e035c886806ff30",
       "source_git_blob": "ddec0400ea7a639c14769ac9ee7e137d000b3efd",
-      "sha256": "239ca1ac3ad2a34bfce3d70935ea3483dbb5c5a689c44cd7c5a22693dab51b75"
+      "sha256": "b34117d28ca7987833626f2e938abe4dd5d02ea869db7b0bdc1b8a264d775f9c"
     },
     {
       "path": "src/lib.rs",
@@ -398,31 +398,31 @@
       "path": "src/ocg.rs",
       "source_sha256": "439455f65b8ad6ed9b0306536c2f75fa5f3fdda42ed4ca351ec3d340c38dc330",
       "source_git_blob": "c59b70df4be6a83485360dacd76bead9f80c7f94",
-      "sha256": "439455f65b8ad6ed9b0306536c2f75fa5f3fdda42ed4ca351ec3d340c38dc330"
+      "sha256": "802fd4c330f5066bcb2070aa0986dc869cd6f1f443e8e92857a598f7336266b7"
     },
     {
       "path": "src/pattern.rs",
       "source_sha256": "17b49a465275c20e6645dea9443f2cb3a64c594925fd860e74b80b44d5344e37",
       "source_git_blob": "9295f51709f8915951d7b9afca9411651d65a1f8",
-      "sha256": "24ac7a1cfd9a55b7d40d572120f52743bd390fab0007603aec64034ae7d2fd23"
+      "sha256": "e57d4de60126eafa0da2113af12bbbde1aabd15554f1ee26f6551b8219f4ede5"
     },
     {
       "path": "src/shading.rs",
-      "source_sha256": "a28f730ede65bb4e480d0a6ae49a21e69ed23d7b0fd6f8006e487c83faa0756d",
-      "source_git_blob": "98fbb58310900160d1d4067e0707708ba2f673d0",
-      "sha256": "a28f730ede65bb4e480d0a6ae49a21e69ed23d7b0fd6f8006e487c83faa0756d"
+      "source_sha256": "5d541a2d52f69c88e87a40580bf28afa4b8a6a2d62a3385009087264384ead32",
+      "source_git_blob": "2e619e47f2800d7fc7cbdae77c66c58f012c84c2",
+      "sha256": "861ad2a40d1d3f09dc1fdb4a240a36f2873ffe2b5bedf54bb601f6ac8e5b05bb"
     },
     {
       "path": "src/soft_mask.rs",
       "source_sha256": "6cd9c59c0cff580879c1f06ff40f3537c04b719bdb3ea59008fa1ab7559db5dd",
       "source_git_blob": "4d97d565b53c820fa927fbba8c3dda6acead7f34",
-      "sha256": "780ffbf73567a7ae33f2fb673676840e0a29cb6b59f1d8b625034f42c4d17a22"
+      "sha256": "fe3da157602bf5b16a452ecbe1d8d554af992a5b9dfaa771dd23c2e2e66d730b"
     },
     {
       "path": "src/types.rs",
       "source_sha256": "0e66569b8a7dc243b0a384cf1d3615ca62bf660b5324236f2594609bdfddfd46",
       "source_git_blob": "64d2b849bdd3fdcd4ebfd76845edcef77b625fbd",
-      "sha256": "542fafbfcf8a472466377cacd580eda2fc2d40b834a8d5ecd1ad35d75445f532"
+      "sha256": "669fb4a9427193a962b7cda70656b688795ea691f67ae52333124807ba88006c"
     },
     {
       "path": "src/util.rs",
@@ -432,9 +432,9 @@
     },
     {
       "path": "src/x_object.rs",
-      "source_sha256": "b325843a8f4088cdb1cc1d471971bd88932fb1e538d06a20a1cc2bee138d5624",
-      "source_git_blob": "68d97d55554888b9afe6c16d08ab2cbaca61924e",
-      "sha256": "93539c173b193aa740aa7a839ec05c9676a89cbee404726767cf82b63f19bda6"
+      "source_sha256": "e1c51e96a335c32c122011b2d05c5020c36a33c2c73342ba173c28a3e2fe0219",
+      "source_git_blob": "21b134ce8cd9604399cd0776febf923d69c02673",
+      "sha256": "4d2d5a2b8ff6d75308cb4fbb606bb2135073d35e859f1b32a5be5b3276ca2c20"
     }
   ],
   "compatibility_reference": {
diff --git a/vendor/hayro-interpret/src/cache.rs b/vendor/hayro-interpret/src/cache.rs
index 2dda2e8a..d2be7543 100644
--- a/vendor/hayro-interpret/src/cache.rs
+++ b/vendor/hayro-interpret/src/cache.rs
@@ -4,11 +4,14 @@ use kurbo::Affine;
 use std::any::Any;
 use std::collections::HashMap;
 use std::collections::hash_map::Entry;
+use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::{Arc, Mutex};
 
 type CacheMap = HashMap<u128, Option<Box<dyn Any + Send + Sync>>>;
+/// The objects read from a document, by key. PdfCraft patch (#3020): the second field counts
+/// the ICC profiles read through it ([`Cache::icc_profile_reads`]).
 #[derive(Clone)]
-pub(crate) struct Cache(Arc<Mutex<CacheMap>>);
+pub(crate) struct Cache(Arc<Mutex<CacheMap>>, Arc<AtomicUsize>);
 impl Default for Cache {
     fn default() -> Self {
         Self::new()
@@ -17,7 +20,18 @@ impl Default for Cache {
 
 impl Cache {
     pub(crate) fn new() -> Self {
-        Self(Arc::new(Mutex::new(HashMap::new())))
+        Self(Arc::new(Mutex::new(HashMap::new())), Arc::default())
+    }
+
+    /// PdfCraft patch (#3020): count one ICC profile read, the color space of an `/ICCBased`
+    /// profile no entry held yet being built from it.
+    pub(crate) fn count_icc_profile_read(&self) {
+        self.1.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// PdfCraft patch (#3020): how many ICC profiles were read through this cache.
+    pub(crate) fn icc_profile_reads(&self) -> usize {
+        self.1.load(Ordering::Relaxed)
     }
 
     pub(crate) fn get_or_insert_with<T: Clone + Send + Sync + 'static>(
@@ -72,7 +86,11 @@ pub(crate) struct DecodedImageCache {
 /// - the dictionary's bytes (`dict_hash`: `/Decode`, `/ColorSpace`, `/SMask`, `/Mask`,
 ///   `/BitsPerComponent`, filters, …) and its object (`obj`: the decryption key depends on it);
 /// - whether it is decoded as a mask, a stencil mask, raster or mask output, interpolation,
-///   the decode target size, and preview or final quality.
+///   the decode target size (only for an image a JPX stream decodes, which is the only
+///   decode that reads it: PdfCraft patch 32), and preview or final quality;
+/// - the default color space drawn in place of the image's device space, if any (the cache
+///   key of its object, PdfCraft patch #3018): the same image can be drawn by resources with a
+///   `/DefaultRGB` and by resources without one.
 ///
 /// A transfer function (graphics state `/TR`) also changes the pixels and has no cheap key, so
 /// an image drawn under one is not cached; neither is an inline image, whose dictionary lives in
@@ -87,6 +105,7 @@ pub(crate) struct DecodedImageKey {
     pub(crate) is_mask: bool,
     pub(crate) is_stencil_mask: bool,
     pub(crate) interpolate: bool,
+    pub(crate) default_space: Option<u128>,
     pub(crate) target: Option<(u32, u32)>,
     pub(crate) preview: bool,
 }
@@ -95,6 +114,8 @@ pub(crate) struct DecodedImageKey {
 struct DecodedImageCacheInner {
     map: HashMap<DecodedImageKey, Option<Box<dyn Any + Send + Sync>>>,
     bytes: usize,
+    /// PdfCraft patch (32): how many keyed decodes ran (cache misses).
+    decodes: usize,
 }
 
 impl DecodedImageCache {
@@ -105,6 +126,12 @@ impl DecodedImageCache {
         }
     }
 
+    /// PdfCraft patch (32): how many decodes the cache was asked to keep (its misses), for
+    /// diagnostics and tests. 0 when the lock is poisoned.
+    pub(crate) fn decodes(&self) -> usize {
+        self.inner.lock().map(|locked| locked.decodes).unwrap_or(0)
+    }
+
     /// The same cache, for a preview (`true`) or a final render.
     pub(crate) fn for_render(&self, preview: bool) -> Self {
         Self {
@@ -141,6 +168,7 @@ impl DecodedImageCache {
         let Ok(mut locked) = self.inner.lock() else {
             return val;
         };
+        locked.decodes = locked.decodes.saturating_add(1);
         // Another thread may have decoded it meanwhile: keep the first copy.
         if let Some(existing) = locked.map.get(&key)
             && let Some(existing) = existing.as_ref().and_then(|val| val.downcast_ref::<T>())
diff --git a/vendor/hayro-interpret/src/color.rs b/vendor/hayro-interpret/src/color.rs
index 4db84631..3965581e 100644
--- a/vendor/hayro-interpret/src/color.rs
+++ b/vendor/hayro-interpret/src/color.rs
@@ -2,6 +2,7 @@
 
 use crate::cache::{Cache, CacheKey};
 use crate::function::Function;
+use crate::util::hash128;
 use hayro_syntax::object;
 use hayro_syntax::object::Array;
 use hayro_syntax::object::Dict;
@@ -9,12 +10,14 @@ use hayro_syntax::object::Name;
 use hayro_syntax::object::Object;
 use hayro_syntax::object::Stream;
 use hayro_syntax::object::dict::keys::*;
+use hayro_syntax::page::Resources;
 use moxcms::{
-    ColorProfile, DataColorSpace, Layout, Transform8BitExecutor, TransformF32Executor,
-    TransformOptions,
+    ColorProfile, DataColorSpace, Layout, ProfileText, RenderingIntent, Transform8BitExecutor,
+    TransformF32Executor, TransformOptions,
 };
 use smallvec::{SmallVec, ToSmallVec, smallvec};
 use std::borrow::Cow;
+use std::cell::OnceCell;
 use std::fmt::{Debug, Formatter};
 use std::ops::Deref;
 use std::sync::{Arc, LazyLock, OnceLock};
@@ -22,6 +25,25 @@ use std::sync::{Arc, LazyLock, OnceLock};
 /// A storage for the components of colors.
 pub type ColorComponents = SmallVec<[f32; 4]>;
 
+std::thread_local! {
+    // PdfCraft patch (34): see `tint_transform_runs`.
+    static TINT_TRANSFORM_RUNS: core::cell::Cell<u64> = const { core::cell::Cell::new(0) };
+}
+
+/// PdfCraft patch (34): how many colours this thread has run through a Separation or DeviceN
+/// tint transform, for diagnostics and tests. An image converted through patch (28)'s lookup
+/// table runs it once per possible sample value, not once per pixel. Per thread, so a caller
+/// counting its own render is not disturbed by renders on other threads.
+pub fn tint_transform_runs() -> u64 {
+    TINT_TRANSFORM_RUNS.with(core::cell::Cell::get)
+}
+
+/// PdfCraft patch (34): count `colours` runs of a tint transform (called once per batch).
+fn count_tint_transform_runs(colours: usize) {
+    let colours = u64::try_from(colours).unwrap_or(u64::MAX);
+    TINT_TRANSFORM_RUNS.with(|runs| runs.set(runs.get().saturating_add(colours)));
+}
+
 /// An RGB color with an alpha channel.
 #[derive(Debug, Copy, Clone)]
 pub struct AlphaColor {
@@ -98,6 +120,36 @@ pub(crate) enum ColorSpaceType {
     Lab(Lab),
     Separation(Separation),
     DeviceN(DeviceN),
+    /// PdfCraft patch (35): `inner` drawn as the plate of one ink (see [`Plate`]).
+    Plate(PlateSpace),
+}
+
+/// PdfCraft patch (#3020): what the color space read from an `/ICCBased` profile stream is
+/// cached by. hayro keyed it by the stream dictionary's bytes alone, so two different profiles
+/// with the same `/N` and `/Length` shared whichever was read first, and colors in the second
+/// were drawn through the first.
+#[derive(Hash)]
+enum IccProfileKey<'a> {
+    /// The stream object a space names, looked up without reading the stream: an object holds
+    /// one profile for as long as the document, and so the cache, lives.
+    Object(object::ObjectIdentifier),
+    /// What the space is built from: the stream dictionary's key (its bytes, the old key:
+    /// `/N`, `/Alternate`, the filters) and the stream's own bytes, decrypted but not decoded,
+    /// which decode to the profile. Copies of a profile share it, and a lookup never decodes:
+    /// decoding waits for a miss.
+    Content { dict: u128, data: &'a [u8] },
+}
+
+/// PdfCraft patch (#3020): the object of the `/ICCBased` profile `stream` that `array` names,
+/// or `None` for a stream written directly in the array (its dictionary lies within the
+/// array's bytes). Such a stream has no object of its own: its dictionary reports the object
+/// that holds the array, which every other stream written there reports too.
+fn icc_stream_object(array: &Array<'_>, stream: &Stream<'_>) -> Option<object::ObjectIdentifier> {
+    let dict = stream.dict();
+    if array.data().as_ptr_range().contains(&dict.data().as_ptr()) {
+        return None;
+    }
+    dict.obj_id()
 }
 
 impl ColorSpaceType {
@@ -118,34 +170,50 @@ impl ColorSpaceType {
                     let dict = icc_stream.dict();
                     let num_components = dict.get::<usize>(N)?;
 
-                    return cache.get_or_insert_with(icc_stream.cache_key(), || {
-                        if let Some(decoded) = icc_stream.decoded().ok().as_ref() {
-                            ICCProfile::new(decoded, num_components)
-                                .map(|icc| {
-                                    // TODO: For SVG and PNG we can assume that the output color space is
-                                    // sRGB. If we ever implement PDF-to-PDF, we probably want to
-                                    // let the user pass the native color type and don't make this optimization
-                                    // if it's not sRGB.
-                                    if icc.is_srgb() {
-                                        Self::DeviceRgb
-                                    } else {
-                                        Self::ICCBased(icc)
-                                    }
-                                })
-                                .or_else(|| {
-                                    dict.get::<Object<'_>>(ALTERNATE)
-                                        .and_then(|o| Self::new(o, cache))
-                                })
-                                .or_else(|| match dict.get::<u8>(N) {
-                                    Some(1) => Some(Self::DeviceGray),
-                                    Some(3) => Some(Self::DeviceRgb),
-                                    Some(4) => Some(Self::DeviceCmyk),
-                                    _ => None,
-                                })
-                        } else {
-                            None
+                    // PdfCraft patch (#3020): cached by what the profile is read from (see
+                    // `IccProfileKey`), not by the stream dictionary's bytes alone.
+                    let read = || {
+                        let data = icc_stream.raw_data();
+                        let content = IccProfileKey::Content {
+                            dict: icc_stream.cache_key(),
+                            data: &data,
+                        };
+                        cache.get_or_insert_with(hash128(&content), || {
+                            cache.count_icc_profile_read();
+                            if let Some(decoded) = icc_stream.decoded().ok().as_ref() {
+                                ICCProfile::new(decoded, num_components)
+                                    .map(|icc| {
+                                        // TODO: For SVG and PNG we can assume that the output color space is
+                                        // sRGB. If we ever implement PDF-to-PDF, we probably want to
+                                        // let the user pass the native color type and don't make this optimization
+                                        // if it's not sRGB.
+                                        if icc.is_srgb() {
+                                            Self::DeviceRgb
+                                        } else {
+                                            Self::ICCBased(icc)
+                                        }
+                                    })
+                                    .or_else(|| {
+                                        dict.get::<Object<'_>>(ALTERNATE)
+                                            .and_then(|o| Self::new(o, cache))
+                                    })
+                                    .or_else(|| match dict.get::<u8>(N) {
+                                        Some(1) => Some(Self::DeviceGray),
+                                        Some(3) => Some(Self::DeviceRgb),
+                                        Some(4) => Some(Self::DeviceCmyk),
+                                        _ => None,
+                                    })
+                            } else {
+                                None
+                            }
+                        })
+                    };
+                    return match icc_stream_object(&color_array, &icc_stream) {
+                        Some(object) => {
+                            cache.get_or_insert_with(hash128(&IccProfileKey::Object(object)), read)
                         }
-                    });
+                        None => read(),
+                    };
                 }
                 CALCMYK => return Some(Self::DeviceCmyk),
                 CALGRAY => {
@@ -251,7 +319,12 @@ impl ColorSpace {
 
     /// Return `true` if the current color space is an indexed color space.
     pub(crate) fn is_indexed(&self) -> bool {
-        matches!(self.0.as_ref(), ColorSpaceType::Indexed(_))
+        match self.0.as_ref() {
+            ColorSpaceType::Indexed(_) => true,
+            // PdfCraft patch (35): a plate decodes its samples as its space does.
+            ColorSpaceType::Plate(p) => p.inner.is_indexed(),
+            _ => false,
+        }
     }
 
     /// Get the default decode array for the color space.
@@ -271,6 +344,7 @@ impl ColorSpace {
             ColorSpaceType::Indexed(_) => smallvec![(0.0, 2.0_f32.powf(n) - 1.0)],
             ColorSpaceType::Separation(_) => smallvec![(0.0, 1.0)],
             ColorSpaceType::DeviceN(d) => smallvec![(0.0, 1.0); d.num_components as usize],
+            ColorSpaceType::Plate(p) => p.inner.default_decode_arr(n),
             // Not a valid image color space.
             ColorSpaceType::Pattern(_) => smallvec![(0.0, 1.0)],
         }
@@ -302,6 +376,7 @@ impl ColorSpace {
             ColorSpaceType::Separation(_) => smallvec![1.0],
             ColorSpaceType::Pattern(c) => c.initial_color(),
             ColorSpaceType::DeviceN(d) => smallvec![1.0; d.num_components as usize],
+            ColorSpaceType::Plate(p) => p.inner.initial_color(),
         }
     }
 
@@ -323,6 +398,7 @@ impl ColorSpace {
             ColorSpaceType::Separation(_) => 1,
             ColorSpaceType::Pattern(p) => p.num_components(),
             ColorSpaceType::DeviceN(d) => d.num_components,
+            ColorSpaceType::Plate(p) => p.inner.num_components(),
         }
     }
 
@@ -331,6 +407,149 @@ impl ColorSpace {
         self.to_alpha_color(c, opacity, manual_scale)
             .unwrap_or(AlphaColor::BLACK)
     }
+
+    /// PdfCraft patch (#3018): whether this space can be the default color space of `family`
+    /// (ISO 32000-2 §8.6.5.6): it has as many components as the device space and is not a
+    /// Lab, Indexed or Pattern space. Nor is a device space: a default that names one is
+    /// ignored, so substitution never recurses.
+    fn can_stand_in_for(&self, family: DeviceFamily) -> bool {
+        !matches!(
+            self.0.as_ref(),
+            ColorSpaceType::DeviceGray
+                | ColorSpaceType::DeviceRgb
+                | ColorSpaceType::DeviceCmyk
+                | ColorSpaceType::Lab(_)
+                | ColorSpaceType::Indexed(_)
+                | ColorSpaceType::Pattern(_)
+        ) && self.num_components() == family.num_components()
+    }
+}
+
+/// PdfCraft patch (#3018): a device color space (ISO 32000-2 §8.6.4), which the resources'
+/// default color space for it replaces wherever content selects it (§8.6.5.6).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum DeviceFamily {
+    Gray,
+    Rgb,
+    Cmyk,
+}
+
+impl DeviceFamily {
+    /// The device space a color space operand names: `/DeviceGray`, `/DeviceRGB` or
+    /// `/DeviceCMYK` (or an abbreviation read as one), alone or at the head of an array. `None`
+    /// for any other space, including the ICC-based and calibrated ones drawn as device color
+    /// here (an sRGB profile, `/CalCMYK`): they are not device spaces.
+    pub(crate) fn of_object(object: &Object<'_>) -> Option<Self> {
+        match object {
+            Object::Name(name) => Self::of_name(name),
+            Object::Array(array) => array
+                .flex_iter()
+                .next::<Name<'_>>()
+                .and_then(|name| Self::of_name(&name)),
+            _ => None,
+        }
+    }
+
+    /// The device space `name` names, as [`DeviceFamily::of_object`].
+    pub(crate) fn of_name(name: &Name<'_>) -> Option<Self> {
+        match name.deref() {
+            DEVICE_GRAY | G => Some(Self::Gray),
+            DEVICE_RGB | RGB => Some(Self::Rgb),
+            DEVICE_CMYK | CMYK => Some(Self::Cmyk),
+            _ => None,
+        }
+    }
+
+    /// The device space itself.
+    fn space(self) -> ColorSpace {
+        match self {
+            Self::Gray => ColorSpace::device_gray(),
+            Self::Rgb => ColorSpace::device_rgb(),
+            Self::Cmyk => ColorSpace::device_cmyk(),
+        }
+    }
+
+    fn num_components(self) -> u8 {
+        match self {
+            Self::Gray => 1,
+            Self::Rgb => 3,
+            Self::Cmyk => 4,
+        }
+    }
+
+    /// The `/ColorSpace` resource that holds the default for this space.
+    fn default_key(self) -> &'static [u8] {
+        match self {
+            Self::Gray => DEFAULT_GRAY,
+            Self::Rgb => DEFAULT_RGB,
+            Self::Cmyk => DEFAULT_CMYK,
+        }
+    }
+}
+
+/// PdfCraft patch (#3018): the default color spaces (`/DefaultGray`, `/DefaultRGB` and
+/// `/DefaultCMYK`, ISO 32000-2 §8.6.5.6) of the resources content is drawn with, each read the
+/// first time the content selects its device space. Like any named resource, a default comes
+/// from the resources in scope: a form XObject without `/Resources` draws in its page's
+/// defaults, one with `/Resources` only in its own.
+///
+/// On a plate (patch 35) device color keeps its device space: plates separate DeviceCMYK
+/// by its components, with nonzero overprint mode, and a DefaultCMYK profile would route it
+/// through the CMYK simulation (patch 36) instead. Defaults change how device color looks,
+/// not which inks it is printed with.
+pub(crate) struct DefaultColorSpaces<'r, 'a> {
+    resources: &'r Resources<'a>,
+    cache: Cache,
+    on_plate: bool,
+    gray: OnceCell<Option<(ColorSpace, u128)>>,
+    rgb: OnceCell<Option<(ColorSpace, u128)>>,
+    cmyk: OnceCell<Option<(ColorSpace, u128)>>,
+}
+
+impl<'r, 'a> DefaultColorSpaces<'r, 'a> {
+    pub(crate) fn new(resources: &'r Resources<'a>, cache: &Cache, on_plate: bool) -> Self {
+        Self {
+            resources,
+            cache: cache.clone(),
+            on_plate,
+            gray: OnceCell::new(),
+            rgb: OnceCell::new(),
+            cmyk: OnceCell::new(),
+        }
+    }
+
+    /// The default for `family`, with the cache key of the object it was read from. `None`
+    /// when the resources have none, or theirs is not a color space that can stand in for
+    /// the device space, or on a plate: device color is then drawn as it is.
+    pub(crate) fn get(&self, family: DeviceFamily) -> Option<(ColorSpace, u128)> {
+        if self.on_plate {
+            return None;
+        }
+        let found = match family {
+            DeviceFamily::Gray => &self.gray,
+            DeviceFamily::Rgb => &self.rgb,
+            DeviceFamily::Cmyk => &self.cmyk,
+        };
+        found
+            .get_or_init(|| {
+                let object = self
+                    .resources
+                    .get_color_space(&Name::new_unescaped(family.default_key()))?;
+                let key = object.cache_key();
+                let space = self
+                    .cache
+                    .get_or_insert_with(key, || ColorSpace::new(object.clone(), &self.cache))?;
+                space.can_stand_in_for(family).then_some((space, key))
+            })
+            .clone()
+    }
+
+    /// The color space content that selects `family` draws in: its default, else the device
+    /// space itself.
+    pub(crate) fn device(&self, family: DeviceFamily) -> ColorSpace {
+        self.get(family)
+            .map_or_else(|| family.space(), |(space, _)| space)
+    }
 }
 
 impl ToRgb for ColorSpace {
@@ -373,6 +592,7 @@ impl ToRgb for ColorSpace {
             ColorSpaceType::Lab(i) => i.convert_f32(input, output, manual_scale),
             ColorSpaceType::Separation(i) => i.convert_f32(input, output, manual_scale),
             ColorSpaceType::DeviceN(i) => i.convert_f32(input, output, manual_scale),
+            ColorSpaceType::Plate(i) => i.convert_f32(input, output, manual_scale),
         }
     }
 
@@ -389,6 +609,7 @@ impl ToRgb for ColorSpace {
             ColorSpaceType::Lab(i) => i.supports_u8(),
             ColorSpaceType::Separation(i) => i.supports_u8(),
             ColorSpaceType::DeviceN(i) => i.supports_u8(),
+            ColorSpaceType::Plate(i) => i.supports_u8(),
         }
     }
 
@@ -417,6 +638,7 @@ impl ToRgb for ColorSpace {
             ColorSpaceType::Lab(i) => i.convert_u8(input, output),
             ColorSpaceType::Separation(i) => i.convert_u8(input, output),
             ColorSpaceType::DeviceN(i) => i.convert_u8(input, output),
+            ColorSpaceType::Plate(i) => i.convert_u8(input, output),
         }
     }
 
@@ -424,6 +646,7 @@ impl ToRgb for ColorSpace {
         match self.0.as_ref() {
             ColorSpaceType::Separation(s) => s.is_none(),
             ColorSpaceType::DeviceN(d) => d.is_none(),
+            ColorSpaceType::Plate(p) => p.inner.is_none(),
             _ => false,
         }
     }
@@ -682,6 +905,11 @@ impl Lab {
     /// be expressed in LMS before taking their ratios. CalRGB's separate
     /// flat-white/black-point pipeline retains its existing normalization.
     fn adapt_to_d65(white_point: &[f32; 3], xyz: &[f32; 3]) -> [f32; 3] {
+        Self::adapt(white_point, &CalRgb::D65_WHITEPOINT, xyz)
+    }
+
+    /// `xyz`, seen under `white_point`, Bradford-adapted to `destination`.
+    fn adapt(white_point: &[f32; 3], destination: &[f32; 3], xyz: &[f32; 3]) -> [f32; 3] {
         let source_lms = CalRgb::matrix_product(&CalRgb::BRADFORD_SCALE_MATRIX, white_point);
         // A malformed but positive XYZ white can still yield a zero or
         // overflowing cone response. Leave it unadapted rather than divide by
@@ -689,7 +917,7 @@ impl Lab {
         if source_lms.iter().any(|v| !v.is_finite() || v.abs() <= f32::EPSILON) {
             return *xyz;
         }
-        let destination_lms = CalRgb::matrix_product(&CalRgb::BRADFORD_SCALE_MATRIX, &CalRgb::D65_WHITEPOINT);
+        let destination_lms = CalRgb::matrix_product(&CalRgb::BRADFORD_SCALE_MATRIX, destination);
         let lms = CalRgb::matrix_product(&CalRgb::BRADFORD_SCALE_MATRIX, xyz);
         let adapted = [
             lms[0] * destination_lms[0] / source_lms[0],
@@ -709,43 +937,60 @@ impl Lab {
             3.0 * DELTA * DELTA * (t - 4.0 / 29.0)
         }
     }
+
+    /// PdfCraft patch: the L*, a* and b* of the colour `input`, clamped to L* 0..100 and the
+    /// a*/b* /Range. `manual_scale` means the components arrive normalised to [0, 1] (an
+    /// `/Indexed` palette over Lab looks its bytes up as `byte / 255`): they map linearly onto
+    /// L* 0..100 and the /Range (ISO 32000-2 §8.6.6.3).
+    fn components(&self, input: &[f32], manual_scale: bool) -> [f32; 3] {
+        let [min_a, max_a, min_b, max_b] = self.range;
+        let get = |k: usize| input.get(k).copied().unwrap_or(0.0);
+        let (l, a, b) = if manual_scale {
+            (
+                clamp_component(get(0), 0.0, 1.0) * 100.0,
+                min_a + clamp_component(get(1), 0.0, 1.0) * (max_a - min_a),
+                min_b + clamp_component(get(2), 0.0, 1.0) * (max_b - min_b),
+            )
+        } else {
+            (get(0), get(1), get(2))
+        };
+        [
+            clamp_component(l, 0.0, 100.0),
+            clamp_component(a, min_a, max_a),
+            clamp_component(b, min_b, max_b),
+        ]
+    }
+
+    /// The XYZ of L*a*b*, in the coordinates of the space's white point.
+    fn xyz(&self, [l, a, b]: [f32; 3]) -> [f32; 3] {
+        let [xw, yw, zw] = self.usable_white_point();
+        let fy = (l + 16.0) / 116.0;
+        let fx = fy + a / 500.0;
+        let fz = fy - b / 200.0;
+        [
+            xw * Self::inverse_lab_f(fx),
+            yw * Self::inverse_lab_f(fy),
+            zw * Self::inverse_lab_f(fz),
+        ]
+    }
+
+    /// PdfCraft patch (36): the color `input` as XYZ relative to [`PCS_WHITE`], relative
+    /// colorimetric: the space's white point becomes the PCS white (Bradford-adapted).
+    fn to_pcs(&self, input: &[f32], manual_scale: bool) -> [f32; 3] {
+        let xyz = self.xyz(self.components(input, manual_scale));
+        Self::adapt(&self.usable_white_point(), &PCS_WHITE, &xyz)
+    }
 }
 
 impl ToRgb for Lab {
     fn convert_f32(&self, input: &[f32], output: &mut [u8], manual_scale: bool) -> Option<()> {
-        let [min_a, max_a, min_b, max_b] = self.range;
         let white_point = self.usable_white_point();
-        let [xw, yw, zw] = white_point;
 
         for (input, output) in input.chunks_exact(3).zip(output.chunks_exact_mut(3)) {
-            // PdfCraft patch: `manual_scale` means the components arrive
-            // normalised to [0, 1] (an `/Indexed` palette over Lab looks its
-            // bytes up as `byte / 255`). Map them linearly onto L* 0..100 and
-            // the a*/b* /Range (ISO 32000-2 §8.6.6.3) before converting.
-            let (l, a, b) = if manual_scale {
-                (
-                    clamp_component(input[0], 0.0, 1.0) * 100.0,
-                    min_a + clamp_component(input[1], 0.0, 1.0) * (max_a - min_a),
-                    min_b + clamp_component(input[2], 0.0, 1.0) * (max_b - min_b),
-                )
-            } else {
-                (input[0], input[1], input[2])
-            };
-            let l = clamp_component(l, 0.0, 100.0);
-            let a = clamp_component(a, min_a, max_a);
-            let b = clamp_component(b, min_b, max_b);
-
             // L*a*b* is relative to the space's own /WhitePoint. Map it to XYZ
             // in that white's coordinates, Bradford-adapt to D65 and convert to
             // sRGB (ISO 32000-2 §8.6.5.4).
-            let fy = (l + 16.0) / 116.0;
-            let fx = fy + a / 500.0;
-            let fz = fy - b / 200.0;
-            let xyz = [
-                xw * Self::inverse_lab_f(fx),
-                yw * Self::inverse_lab_f(fy),
-                zw * Self::inverse_lab_f(fz),
-            ];
+            let xyz = self.xyz(self.components(input, manual_scale));
 
             let xyz_d65 = Self::adapt_to_d65(&white_point, &xyz);
             let srgb = CalRgb::matrix_product(&CalRgb::SRGB_D65_XYZ_TO_RGB_MATRIX, &xyz_d65);
@@ -833,6 +1078,8 @@ pub(crate) struct Separation {
     alternate_space: ColorSpace,
     tint_transform: Function,
     is_none_separation: bool,
+    /// PdfCraft patch (35): the colorant the space paints, for separations.
+    colorant: Colorant,
 }
 
 impl Separation {
@@ -846,17 +1093,20 @@ impl Separation {
         // Either I did something wrong, or no other viewers properly handles
         // `All`, so let's just ignore it as well.
         let is_none_separation = name.as_str() == "None";
+        let colorant = Colorant::from_name(name.deref());
 
         Some(Self {
             alternate_space,
             tint_transform,
             is_none_separation,
+            colorant,
         })
     }
 }
 
 impl ToRgb for Separation {
     fn convert_f32(&self, input: &[f32], output: &mut [u8], _: bool) -> Option<()> {
+        count_tint_transform_runs(input.len());
         let evaluated = input
             .iter()
             .flat_map(|n| {
@@ -879,6 +1129,8 @@ pub(crate) struct DeviceN {
     num_components: u8,
     tint_transform: Function,
     is_none: bool,
+    /// PdfCraft patch (35): the colorant of each component, for separations.
+    colorants: Vec<Colorant>,
 }
 
 impl DeviceN {
@@ -900,17 +1152,30 @@ impl DeviceN {
             return None;
         }
 
+        // `All` names every colorant only in a Separation (ISO 32000-2 §8.6.6.5), so a DeviceN
+        // component named `All` paints nothing in particular.
+        let colorants = names
+            .iter()
+            .map(|n| match Colorant::from_name(n.deref()) {
+                Colorant::All => Colorant::None,
+                c => c,
+            })
+            .collect();
+
         Some(Self {
             alternate_space,
             num_components,
             tint_transform,
             is_none: all_none,
+            colorants,
         })
     }
 }
 
 impl ToRgb for DeviceN {
     fn convert_f32(&self, input: &[f32], output: &mut [u8], _: bool) -> Option<()> {
+        let colours = input.len().checked_div(usize::from(self.num_components));
+        count_tint_transform_runs(colours.unwrap_or(0));
         let evaluated = input
             .chunks_exact(self.num_components as usize)
             .flat_map(|n| {
@@ -935,6 +1200,12 @@ struct ICCColorRepr {
     is_lab: bool,
     transform_u8: Arc<Transform8BitExecutor>,
     transform_f32: OnceLock<Arc<TransformF32Executor>>,
+    /// PdfCraft patch (36): a digest of the profile's bytes, to tell a colour in a
+    /// [`CmykSimulation`]'s own profile from one in another.
+    digest: u128,
+    /// PdfCraft patch (36): the transform into the separation hub (see [`Hub`]), made on first
+    /// use; `None` when the profile doesn't convert to it.
+    to_hub: OnceLock<Option<Arc<TransformF32Executor>>>,
 }
 
 #[derive(Clone)]
@@ -958,7 +1229,13 @@ impl ICCProfile {
             .unwrap_or(false);
         let is_lab = src_profile.color_space == DataColorSpace::Lab;
 
-        Self::new_from_src_profile(src_profile, is_srgb, is_lab, number_components)
+        Self::new_from_src_profile(
+            src_profile,
+            is_srgb,
+            is_lab,
+            number_components,
+            hash128(profile),
+        )
     }
 
     fn new_from_src_profile(
@@ -966,6 +1243,7 @@ impl ICCProfile {
         is_srgb: bool,
         is_lab: bool,
         number_components: usize,
+        digest: u128,
     ) -> Option<Self> {
         let src_layout = match number_components {
             1 => Layout::Gray,
@@ -997,9 +1275,52 @@ impl ICCProfile {
             is_lab,
             transform_u8,
             transform_f32: OnceLock::new(),
+            digest,
+            to_hub: OnceLock::new(),
         })))
     }
 
+    /// PdfCraft patch (36): `input` (whole colors of this profile's components) as XYZ
+    /// relative to [`PCS_WHITE`], three values per color in `xyz`, through the separation hub
+    /// (see [`Hub`]). L*a*b* components are scaled to the profile's encoding unless
+    /// `manual_scale` says they already are (an Indexed palette's).
+    fn to_pcs(&self, input: &[f32], manual_scale: bool, xyz: &mut [f32]) -> Option<()> {
+        let transform = self
+            .0
+            .to_hub
+            .get_or_init(|| {
+                transform_f32(
+                    &self.0.src_profile,
+                    self.0.src_layout,
+                    &HUB.profile,
+                    Layout::Rgb,
+                )
+                .map(|(transform, _)| transform)
+            })
+            .as_ref()?;
+        let n = self.0.number_components;
+        let samples = input.len() / n.max(1);
+        if samples > SIMULATION_CHUNK || xyz.len() != samples.checked_mul(3)? {
+            return None;
+        }
+        // Values outside the encoding (or NaN) never reach the tables.
+        let mut encoded = [0.0_f32; SIMULATION_CHUNK * 4];
+        let encoded = encoded.get_mut(..samples.checked_mul(n)?)?;
+        for (e, (k, v)) in encoded.iter_mut().zip(input.iter().enumerate()) {
+            *e = match (self.is_lab() && !manual_scale, k % 3) {
+                (true, 0) => unit(*v / 100.0),
+                (true, _) => unit((*v + 128.0) / 255.0),
+                (false, _) => unit(*v),
+            };
+        }
+        transform.transform(encoded, xyz).ok()?;
+        for color in xyz.chunks_exact_mut(3) {
+            let pcs = HUB.to_pcs(&[color[0], color[1], color[2]]);
+            color.copy_from_slice(&pcs);
+        }
+        Some(())
+    }
+
     fn is_srgb(&self) -> bool {
         self.0.is_srgb
     }
@@ -1099,6 +1420,16 @@ pub struct Color {
 }
 
 impl Color {
+    /// PdfCraft patch (46): the same color, fully opaque (see `Pattern::without_opacity`). A
+    /// fully transparent color stays so: on a plate it is the paint that leaves the plate as it
+    /// is (`for_plate`), and making it opaque would knock the plate out.
+    pub(crate) fn opaque(mut self) -> Self {
+        if self.opacity != 0.0 {
+            self.opacity = 1.0;
+        }
+        self
+    }
+
     pub(crate) fn new(color_space: ColorSpace, components: ColorComponents, opacity: f32) -> Self {
         Self {
             color_space,
@@ -1122,6 +1453,1031 @@ impl Color {
             opacity: c[3],
         }
     }
+
+    /// PdfCraft patch (35): the gray film of `tint` on a plate (see [`Plate`]).
+    pub(crate) fn film(tint: f32, opacity: f32) -> Self {
+        Self::new(
+            ColorSpace::device_gray(),
+            smallvec![1.0 - unit(tint)],
+            opacity,
+        )
+    }
+
+    /// PdfCraft patch (35): this colour as drawn on `plate`. `overprint` is the graphics
+    /// state's overprint parameter for this paint (`OP` for strokes, `op` otherwise) and
+    /// `overprint_mode` its `OPM` (ISO 32000-2 §8.6.7). A paint that leaves the plate as it is
+    /// becomes fully transparent.
+    pub(crate) fn for_plate(&self, plate: &Plate, overprint: bool, overprint_mode: u8) -> Self {
+        let overprint = plate.overprint && overprint;
+        let untouched = Self::film(0.0, 0.0);
+        match self.color_space.ink_use(&plate.ink, plate.spots_as_process) {
+            InkUse::Nothing => untouched,
+            InkUse::Unspecified if overprint => untouched,
+            InkUse::Unspecified => Self::film(0.0, self.opacity),
+            InkUse::Paints => {
+                let tint = self.color_space.ink_tint(
+                    &self.components,
+                    &plate.ink,
+                    plate.simulation.as_ref(),
+                    false,
+                    plate.spots_as_process,
+                );
+                // Nonzero overprint mode: a DeviceCMYK component of 0 leaves its plate as it
+                // is. It applies to colours set in DeviceCMYK itself, not to images, shadings
+                // or colours converted from another space.
+                if overprint
+                    && overprint_mode == 1
+                    && self.color_space.is_device_cmyk()
+                    && tint <= 0.0
+                {
+                    untouched
+                } else {
+                    Self::film(tint, self.opacity)
+                }
+            }
+        }
+    }
+}
+
+/// PdfCraft patch (35): a printing ink, the unit of a separation: one of the four process
+/// colorants or a spot colorant named by a `Separation` or `DeviceN` colour space (ISO 32000-2
+/// §8.6.6.4).
+#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub enum Ink {
+    /// Process cyan.
+    Cyan,
+    /// Process magenta.
+    Magenta,
+    /// Process yellow.
+    Yellow,
+    /// Process black.
+    Black,
+    /// A spot colorant, by its name in the colour space.
+    Spot(Arc<str>),
+}
+
+impl Ink {
+    /// The four process inks, in plate order.
+    pub const PROCESS: [Ink; 4] = [Ink::Cyan, Ink::Magenta, Ink::Yellow, Ink::Black];
+
+    /// The ink's colorant name, as a `Separation` colour space spells it.
+    pub fn name(&self) -> &str {
+        match self {
+            Self::Cyan => "Cyan",
+            Self::Magenta => "Magenta",
+            Self::Yellow => "Yellow",
+            Self::Black => "Black",
+            Self::Spot(name) => name,
+        }
+    }
+
+    /// The ink's position in a CMYK colour, for a process ink.
+    pub(crate) fn process_index(&self) -> Option<usize> {
+        match self {
+            Self::Cyan => Some(0),
+            Self::Magenta => Some(1),
+            Self::Yellow => Some(2),
+            Self::Black => Some(3),
+            Self::Spot(_) => None,
+        }
+    }
+}
+
+/// PdfCraft patch (35): what a `Separation` or `DeviceN` colorant name paints (ISO 32000-2
+/// §8.6.6.4): an ink (the process names are the process inks), every ink (`All`), or nothing
+/// (`None`).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum Colorant {
+    Ink(Ink),
+    All,
+    None,
+}
+
+impl Colorant {
+    fn from_name(name: &[u8]) -> Self {
+        match name {
+            b"Cyan" => Self::Ink(Ink::Cyan),
+            b"Magenta" => Self::Ink(Ink::Magenta),
+            b"Yellow" => Self::Ink(Ink::Yellow),
+            b"Black" => Self::Ink(Ink::Black),
+            b"All" => Self::All,
+            b"None" => Self::None,
+            other => Self::Ink(Ink::Spot(Arc::from(
+                String::from_utf8_lossy(other).as_ref(),
+            ))),
+        }
+    }
+}
+
+/// PdfCraft patch (35): draw one ink's separation instead of the composite page. Every paint
+/// draws the ink's tint as a gray film: white where the plate carries no ink, black where it
+/// carries 100%. Set through [`InterpreterSettings::plate`](crate::InterpreterSettings::plate).
+#[derive(Clone, Debug, PartialEq)]
+pub struct Plate {
+    /// The ink whose separation is drawn.
+    pub ink: Ink,
+    /// Honour the overprint parameters `OP`, `op` and `OPM` (ISO 32000-2 §8.6.7) as a
+    /// separating device does: a paint whose colour space doesn't specify this ink leaves the
+    /// plate as it is. When `false`, every paint knocks out what is under it, as on a
+    /// composite device.
+    pub overprint: bool,
+    /// PdfCraft patch (36): the printing condition process colour converts to, from the
+    /// document's output intent. `None` converts by the ISO 32000-2 §10.4.2 device formulas.
+    pub simulation: Option<CmykSimulation>,
+    /// Craft patch (CMYK masks): spot colorants paint the process plates through their
+    /// alternate space and tint transform, as a composite CMYK device converts them, so no spot
+    /// ink has a plate of its own. A DeviceCMYK soft mask's luminosity is separated this way;
+    /// separations leave it `false`.
+    pub spots_as_process: bool,
+}
+
+impl Plate {
+    /// Craft patch (CMYK masks): the tint, `0.0` (no ink) to `1.0` (solid), that `color` puts
+    /// on this plate, ignoring overprint and opacity.
+    pub fn tint(&self, color: &Color) -> f32 {
+        match color.color_space.ink_use(&self.ink, self.spots_as_process) {
+            InkUse::Paints => color.color_space.ink_tint(
+                &color.components,
+                &self.ink,
+                self.simulation.as_ref(),
+                false,
+                self.spots_as_process,
+            ),
+            InkUse::Unspecified | InkUse::Nothing => 0.0,
+        }
+    }
+}
+
+/// PdfCraft patch (35): told about each spot ink a paint uses, with the ink's appearance: the
+/// sRGB colour of that ink alone at a tint in `0.0..=1.0`, through the colour space's
+/// alternate space and tint transform.
+pub type InkSinkFn = Arc<dyn Fn(&Ink, &dyn Fn(f32) -> [u8; 3]) + Send + Sync>;
+
+/// PdfCraft patch (35): how a colour space paints one ink's plate.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum InkUse {
+    /// The space specifies the ink: its colours set the plate's tint.
+    Paints,
+    /// The space doesn't specify the ink. Overprinting leaves the plate alone; otherwise the
+    /// paint knocks it out (tint 0).
+    Unspecified,
+    /// The space paints nothing at all (the `None` colorant).
+    Nothing,
+}
+
+/// PdfCraft patch (35): DeviceCMYK to sRGB as pages are drawn (the bundled CGATS-compatible
+/// profile), to compose separations back into a preview. `cmyk` holds whole pixels of four
+/// bytes and `rgb` the same number of three-byte pixels; `None` when the lengths disagree or
+/// the transform fails.
+pub fn cmyk_to_srgb8(cmyk: &[u8], rgb: &mut [u8]) -> Option<()> {
+    if cmyk.len() % 4 != 0 || (cmyk.len() / 4).checked_mul(3)? != rgb.len() {
+        return None;
+    }
+    CMYK_TRANSFORM.convert_u8(cmyk, rgb)
+}
+
+/// A component as a tint: clamped to `0.0..=1.0`, NaN read as no ink.
+fn unit(value: f32) -> f32 {
+    clamp_component(value, 0.0, 1.0)
+}
+
+/// The DeviceCMYK colour of a DeviceRGB one by ISO 32000-2 §10.4.2.4, with black generation
+/// and undercolour removal both the identity (`BG(k) = UCR(k) = k`). Those two functions are
+/// device dependent; the identity is the simplest choice the formulas allow.
+fn rgb_to_cmyk([r, g, b]: [f32; 3]) -> [f32; 4] {
+    let (c, m, y) = (1.0 - unit(r), 1.0 - unit(g), 1.0 - unit(b));
+    let k = c.min(m).min(y);
+    [unit(c - k), unit(m - k), unit(y - k), unit(k)]
+}
+
+/// PdfCraft patch (36): colours converted per step through a [`CmykSimulation`], so that the
+/// buffers stay on the stack whatever an image's size.
+const SIMULATION_CHUNK: usize = 256;
+
+/// PdfCraft patch (36): the printing condition separations simulate, from an output intent's
+/// destination profile (ISO 32000-2 §14.11.5): a CMYK ICC profile with PCS-to-device (BToA)
+/// tables. Set through [`Plate::simulation`]. Process colour in other spaces converts to the
+/// profile's CMYK through those tables, instead of by the device formulas of §10.4.2:
+///
+/// - DeviceRGB as sRGB, as pages are drawn; CalRGB and CalGray through their sRGB colours;
+/// - Lab and ICCBased colours (RGB, gray, L\*a\*b\*, and CMYK in another profile) through
+///   CIE XYZ relative to the PCS white ([`PCS_WHITE`]);
+/// - DeviceCMYK, ICCBased CMYK in this same profile, and DeviceGray stay as they are: gray is a
+///   device colour, which a CMYK device prints with black ink alone (§10.4.2.2).
+///
+/// Conversions are relative colorimetric, the initial rendering intent (§8.6.5.8; the
+/// graphics state's `ri` isn't read). A [`CmykConversion`] converts into the profile's CMYK:
+/// [`CmykSimulation::new`] makes one with moxcms, and [`CmykSimulation::with_conversion`]
+/// takes the caller's.
+#[derive(Clone)]
+pub struct CmykSimulation(Arc<SimulationRepr>);
+
+struct SimulationRepr {
+    digest: u128,
+    conversion: Box<dyn CmykConversion>,
+}
+
+/// The conversion into a [`CmykSimulation`]'s CMYK, relative colorimetric. Each call converts
+/// whole colors, at most 256 of them; CMYK components are `0.0..=1.0`, four per color. A
+/// method returns `None` when it can't convert, and the color then separates by the device
+/// formulas.
+pub trait CmykConversion: Send + Sync {
+    /// sRGB colors, gamma-encoded, three components in `0.0..=1.0` per color, to CMYK.
+    fn from_srgb(&self, rgb: &[f32], cmyk: &mut [f32]) -> Option<()>;
+
+    /// CIE XYZ colors relative to [`PCS_WHITE`] (the Y of white is 1), three components per
+    /// color, to CMYK. The source's white has already been adapted to the PCS white.
+    fn from_pcs_xyz(&self, xyz: &[f32], cmyk: &mut [f32]) -> Option<()>;
+
+    /// CMYK bytes, four per pixel, to sRGB bytes, three per pixel, to show what the printing
+    /// condition prints.
+    fn to_srgb8(&self, cmyk: &[u8], rgb: &mut [u8]) -> Option<()> {
+        let _ = (cmyk, rgb);
+        None
+    }
+
+    /// The profile's description, to name the printing condition.
+    fn description(&self) -> Option<&str> {
+        None
+    }
+
+    /// Whether the conversions use the profile's perceptual tables, because it has no
+    /// colorimetric ones.
+    fn perceptual(&self) -> bool {
+        false
+    }
+}
+
+/// The D50 white of the ICC profile connection space (ICC.1 §7.2.16), the white that
+/// [`CmykConversion::from_pcs_xyz`] takes its colors relative to.
+pub const PCS_WHITE: [f32; 3] = [0.9642, 1.0, 0.8249];
+
+impl Debug for CmykSimulation {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CmykSimulation")
+            .field("description", &self.description())
+            .field("perceptual", &self.perceptual())
+            .finish_non_exhaustive()
+    }
+}
+
+/// Two simulations of the same profile are the same.
+impl PartialEq for CmykSimulation {
+    fn eq(&self, other: &Self) -> bool {
+        self.0.digest == other.0.digest
+    }
+}
+
+/// PdfCraft patch (36): why an ICC profile can't be simulated.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum NoSimulation {
+    /// The profile doesn't parse.
+    Unreadable,
+    /// Its data colour space isn't CMYK.
+    NotCmyk,
+    /// It has no PCS-to-device (BToA) tables, or they don't convert.
+    NoPcsToDevice,
+}
+
+impl CmykSimulation {
+    /// The printing condition of the ICC profile `profile`, if it is a CMYK profile whose
+    /// PCS-to-device tables convert, converted to with moxcms. A profile without colorimetric
+    /// tables is used through its perceptual ones (tag 0, which every LUT-based ICC.1 profile
+    /// has). Black point compensation isn't applied.
+    pub fn new(profile: &[u8]) -> Result<Self, NoSimulation> {
+        Ok(Self::with_conversion(
+            profile,
+            MoxcmsConversion::new(profile)?,
+        ))
+    }
+
+    /// The printing condition of the CMYK ICC profile `profile`, converted to by `conversion`,
+    /// which the caller made from that profile. ICCBased CMYK colors in `profile` itself stay
+    /// as they are.
+    pub fn with_conversion(profile: &[u8], conversion: impl CmykConversion + 'static) -> Self {
+        Self(Arc::new(SimulationRepr {
+            digest: hash128(profile),
+            conversion: Box::new(conversion),
+        }))
+    }
+
+    /// The profile's description; `None` when it has none.
+    pub fn description(&self) -> Option<&str> {
+        self.0.conversion.description()
+    }
+
+    /// Whether conversions use the profile's perceptual tables, because it has no
+    /// colorimetric ones.
+    pub fn perceptual(&self) -> bool {
+        self.0.conversion.perceptual()
+    }
+
+    /// A digest of the profile's bytes, for cache keys.
+    pub(crate) fn digest(&self) -> u128 {
+        self.0.digest
+    }
+
+    fn conversion(&self) -> &dyn CmykConversion {
+        self.0.conversion.as_ref()
+    }
+
+    /// CMYK in this printing condition to sRGB, relative colorimetric, to show what it prints.
+    /// As [`cmyk_to_srgb8`]; also `None` when the conversion can't show CMYK.
+    pub fn cmyk_to_srgb8(&self, cmyk: &[u8], rgb: &mut [u8]) -> Option<()> {
+        if cmyk.len() % 4 != 0 || (cmyk.len() / 4).checked_mul(3)? != rgb.len() {
+            return None;
+        }
+        self.conversion().to_srgb8(cmyk, rgb)
+    }
+}
+
+/// PdfCraft patch (36): the conversion [`CmykSimulation::new`] makes with moxcms. XYZ colors
+/// pass through the separation hub (see [`Hub`]).
+struct MoxcmsConversion {
+    description: Option<String>,
+    perceptual: bool,
+    from_srgb: Arc<TransformF32Executor>,
+    from_hub: Arc<TransformF32Executor>,
+    to_srgb: Option<Arc<Transform8BitExecutor>>,
+}
+
+impl MoxcmsConversion {
+    /// The longest description kept, in characters.
+    const MAX_DESCRIPTION: usize = 160;
+
+    fn new(profile: &[u8]) -> Result<Self, NoSimulation> {
+        let parsed = ColorProfile::new_from_slice(profile).map_err(|_| NoSimulation::Unreadable)?;
+        if parsed.color_space != DataColorSpace::Cmyk {
+            return Err(NoSimulation::NotCmyk);
+        }
+        if parsed.lut_b_to_a_colorimetric.is_none() && parsed.lut_b_to_a_perceptual.is_none() {
+            return Err(NoSimulation::NoPcsToDevice);
+        }
+        let (from_hub, perceptual) =
+            transform_f32(&HUB.profile, Layout::Rgb, &parsed, Layout::Rgba)
+                .ok_or(NoSimulation::NoPcsToDevice)?;
+        let (from_srgb, _) = transform_f32(&SRGB, Layout::Rgb, &parsed, Layout::Rgba)
+            .ok_or(NoSimulation::NoPcsToDevice)?;
+        let to_srgb = transform_u8(&parsed, Layout::Rgba, &SRGB, Layout::Rgb);
+        Ok(Self {
+            description: profile_description(&parsed, Self::MAX_DESCRIPTION),
+            perceptual,
+            from_srgb,
+            from_hub,
+            to_srgb,
+        })
+    }
+}
+
+impl CmykConversion for MoxcmsConversion {
+    fn from_srgb(&self, rgb: &[f32], cmyk: &mut [f32]) -> Option<()> {
+        self.from_srgb.transform(rgb, cmyk).ok()
+    }
+
+    fn from_pcs_xyz(&self, xyz: &[f32], cmyk: &mut [f32]) -> Option<()> {
+        let mut rgb = [0.0_f32; SIMULATION_CHUNK * 3];
+        let rgb = rgb.get_mut(..xyz.len())?;
+        for (out, xyz) in rgb.chunks_exact_mut(3).zip(xyz.chunks_exact(3)) {
+            out.copy_from_slice(&HUB.from_pcs(&[xyz[0], xyz[1], xyz[2]]));
+        }
+        self.from_hub.transform(rgb, cmyk).ok()
+    }
+
+    fn to_srgb8(&self, cmyk: &[u8], rgb: &mut [u8]) -> Option<()> {
+        self.to_srgb.as_ref()?.transform(cmyk, rgb).ok()
+    }
+
+    fn description(&self) -> Option<&str> {
+        self.description.as_deref()
+    }
+
+    fn perceptual(&self) -> bool {
+        self.perceptual
+    }
+}
+
+/// PdfCraft patch (36): a profile's description, without control characters and at most `max`
+/// characters long; `None` when it has none.
+fn profile_description(profile: &ColorProfile, max: usize) -> Option<String> {
+    let text = match profile.description.as_ref()? {
+        ProfileText::PlainString(s) => s.as_str(),
+        ProfileText::Localizable(list) => {
+            &list
+                .iter()
+                .find(|s| s.language == "en")
+                .or(list.first())?
+                .value
+        }
+        ProfileText::Description(d) if d.ascii_string.trim().is_empty() => &d.unicode_string,
+        ProfileText::Description(d) => &d.ascii_string,
+    };
+    let clean: String = text
+        .chars()
+        .map(|c| if c.is_control() { ' ' } else { c })
+        .take(max)
+        .collect();
+    let clean = clean.trim();
+    (!clean.is_empty()).then(|| clean.to_string())
+}
+
+/// PdfCraft patch (36): a transform from `source` to `destination`, relative colorimetric, or
+/// through the perceptual tables (`true`) where a profile lacks colorimetric ones.
+fn transform_f32(
+    source: &ColorProfile,
+    source_layout: Layout,
+    destination: &ColorProfile,
+    destination_layout: Layout,
+) -> Option<(Arc<TransformF32Executor>, bool)> {
+    [
+        RenderingIntent::RelativeColorimetric,
+        RenderingIntent::Perceptual,
+    ]
+    .into_iter()
+    .find_map(|rendering_intent| {
+        let options = TransformOptions {
+            rendering_intent,
+            ..TransformOptions::default()
+        };
+        source
+            .create_transform_f32(source_layout, destination, destination_layout, options)
+            .ok()
+            .map(|t| (t, rendering_intent == RenderingIntent::Perceptual))
+    })
+}
+
+/// PdfCraft patch (36): as [`transform_f32`], for bytes.
+fn transform_u8(
+    source: &ColorProfile,
+    source_layout: Layout,
+    destination: &ColorProfile,
+    destination_layout: Layout,
+) -> Option<Arc<Transform8BitExecutor>> {
+    [
+        RenderingIntent::RelativeColorimetric,
+        RenderingIntent::Perceptual,
+    ]
+    .into_iter()
+    .find_map(|rendering_intent| {
+        let options = TransformOptions {
+            rendering_intent,
+            ..TransformOptions::default()
+        };
+        source
+            .create_transform_8bit(source_layout, destination, destination_layout, options)
+            .ok()
+    })
+}
+
+static SRGB: LazyLock<ColorProfile> = LazyLock::new(ColorProfile::new_srgb);
+
+/// PdfCraft patch (36): the separation hub, the RGB that ICCBased colors leave their profile
+/// in, and that [`MoxcmsConversion`] takes PCS XYZ to its CMYK through: ROMM RGB (ProPhoto)
+/// primaries, D50 white, gamma 1.8. Its
+/// gamut holds practically every surface colour, so nothing printable clips on the way, and
+/// paper white and black land on exact grid points of the conversion's tables. (moxcms
+/// converts CMYK to CMYK and gray to CMYK only through an intermediate.)
+struct Hub {
+    profile: ColorProfile,
+    /// Linear hub RGB to XYZ, row-major.
+    to_xyz: [f32; 9],
+    /// XYZ to linear hub RGB, row-major.
+    from_xyz: [f32; 9],
+    /// The XYZ of hub white, `(1, 1, 1)`.
+    white: [f32; 3],
+}
+
+impl Hub {
+    const GAMMA: f32 = 1.8;
+
+    fn new() -> Self {
+        let profile = ColorProfile::new_pro_photo_rgb();
+        let to_xyz = profile.rgb_to_xyz_matrix();
+        let from_xyz = to_xyz.inverse().v;
+        let white = to_xyz.v.map(|row| (row[0] + row[1] + row[2]) as f32);
+        let flat = |m: [[f64; 3]; 3]| {
+            let mut out = [0.0_f32; 9];
+            for (out, v) in out.iter_mut().zip(m.iter().flatten()) {
+                *out = *v as f32;
+            }
+            out
+        };
+        Self {
+            profile,
+            to_xyz: flat(to_xyz.v),
+            from_xyz: flat(from_xyz),
+            white,
+        }
+    }
+
+    /// XYZ relative to [`PCS_WHITE`] as hub RGB, clipped to its gamut. The PCS white is scaled
+    /// onto the hub's own D50 white, so that paper white lands on hub white exactly.
+    fn from_pcs(&self, xyz: &[f32; 3]) -> [f32; 3] {
+        let xyz = [0, 1, 2].map(|k| xyz[k] * self.white[k] / PCS_WHITE[k]);
+        CalRgb::matrix_product(&self.from_xyz, &xyz).map(|v| unit(v).powf(1.0 / Self::GAMMA))
+    }
+
+    /// Hub RGB as XYZ relative to [`PCS_WHITE`]; the inverse of [`Hub::from_pcs`] in gamut.
+    fn to_pcs(&self, rgb: &[f32; 3]) -> [f32; 3] {
+        let linear = rgb.map(|v| unit(v).powf(Self::GAMMA));
+        let xyz = CalRgb::matrix_product(&self.to_xyz, &linear);
+        [0, 1, 2].map(|k| xyz[k] * PCS_WHITE[k] / self.white[k])
+    }
+}
+
+static HUB: LazyLock<Hub> = LazyLock::new(Hub::new);
+
+impl ColorSpace {
+    /// PdfCraft patch (35): this space drawn as `plate` (for images and shadings, whose
+    /// colours are converted sample by sample), converting process colour through its
+    /// `simulation` (patch 36).
+    pub(crate) fn plate(&self, plate: &Plate) -> Self {
+        Self(Arc::new(ColorSpaceType::Plate(PlateSpace {
+            inner: self.clone(),
+            ink: plate.ink.clone(),
+            simulation: plate.simulation.clone(),
+            spots_as_process: plate.spots_as_process,
+        })))
+    }
+
+    /// PdfCraft patch (36): whether `simulation` converts this space's colours (see
+    /// [`CmykSimulation`]).
+    fn simulated_by(&self, simulation: &CmykSimulation) -> bool {
+        match self.0.as_ref() {
+            ColorSpaceType::DeviceRgb
+            | ColorSpaceType::CalRgb(_)
+            | ColorSpaceType::CalGray(_)
+            | ColorSpaceType::Lab(_) => true,
+            ColorSpaceType::ICCBased(icc) => {
+                icc.0.number_components != 4 || icc.0.digest != simulation.0.digest
+            }
+            _ => false,
+        }
+    }
+
+    /// PdfCraft patch (36): the colours `input` (whole colours of this space's components;
+    /// `manual_scale` as for [`ToRgb::convert_f32`]) in `simulation`'s CMYK, four values per
+    /// colour in `cmyk`. `None` when the space isn't [`simulated_by`](Self::simulated_by)
+    /// `simulation`, the lengths disagree, or a conversion fails.
+    fn simulate_cmyk(
+        &self,
+        simulation: &CmykSimulation,
+        input: &[f32],
+        manual_scale: bool,
+        cmyk: &mut [f32],
+    ) -> Option<()> {
+        let n = usize::from(self.num_components()).max(1);
+        let colours = input.len() / n;
+        if cmyk.len() != colours.checked_mul(4)? {
+            return None;
+        }
+        let conversion = simulation.conversion();
+        // sRGB or PCS XYZ, by the space.
+        let mut rgb = [0.0_f32; SIMULATION_CHUNK * 3];
+        let mut srgb = [0_u8; SIMULATION_CHUNK * 3];
+        for (input, cmyk) in input
+            .chunks(SIMULATION_CHUNK * n)
+            .zip(cmyk.chunks_mut(SIMULATION_CHUNK * 4))
+        {
+            let count = cmyk.len() / 4;
+            let input = input.get(..count.checked_mul(n)?)?;
+            let rgb = rgb.get_mut(..count * 3)?;
+            match self.0.as_ref() {
+                ColorSpaceType::DeviceRgb => {
+                    for (out, v) in rgb.iter_mut().zip(input) {
+                        *out = unit(*v);
+                    }
+                    conversion.from_srgb(rgb, cmyk)?;
+                }
+                ColorSpaceType::CalRgb(_) | ColorSpaceType::CalGray(_) => {
+                    let srgb = srgb.get_mut(..count * 3)?;
+                    self.convert_f32(input, srgb, manual_scale)?;
+                    for (out, v) in rgb.iter_mut().zip(srgb.iter()) {
+                        *out = u8_to_f32(*v);
+                    }
+                    conversion.from_srgb(rgb, cmyk)?;
+                }
+                ColorSpaceType::Lab(lab) => {
+                    for (out, colour) in rgb.chunks_exact_mut(3).zip(input.chunks_exact(3)) {
+                        out.copy_from_slice(&lab.to_pcs(colour, manual_scale));
+                    }
+                    conversion.from_pcs_xyz(rgb, cmyk)?;
+                }
+                ColorSpaceType::ICCBased(icc) if self.simulated_by(simulation) => {
+                    icc.to_pcs(input, manual_scale, rgb)?;
+                    conversion.from_pcs_xyz(rgb, cmyk)?;
+                }
+                _ => return None,
+            }
+        }
+        Some(())
+    }
+
+    /// PdfCraft patch (35): DeviceCMYK itself (`CalCMYK` reads as it too), where the nonzero
+    /// overprint mode applies. Craft patch (flatten): public.
+    pub fn is_device_cmyk(&self) -> bool {
+        matches!(self.0.as_ref(), ColorSpaceType::DeviceCmyk)
+    }
+
+    /// PdfCraft patch (35): spaces whose colours are converted to sRGB before separation
+    /// (DeviceRGB is separated from its components directly, without a conversion).
+    fn separates_through_srgb(&self) -> bool {
+        match self.0.as_ref() {
+            ColorSpaceType::CalRgb(_) | ColorSpaceType::Lab(_) => true,
+            ColorSpaceType::ICCBased(icc) => icc.0.number_components == 3,
+            _ => false,
+        }
+    }
+
+    /// Craft patch (CMYK masks): the alternate space of a `Separation` or `DeviceN` space that
+    /// names a spot ink; `None` for other spaces, and for colorants that are all process inks,
+    /// `All` or `None`.
+    fn spot_alternate_space(&self) -> Option<&ColorSpace> {
+        let is_spot = |c: &Colorant| matches!(c, Colorant::Ink(Ink::Spot(_)));
+        match self.0.as_ref() {
+            ColorSpaceType::Separation(s) if is_spot(&s.colorant) => Some(&s.alternate_space),
+            ColorSpaceType::DeviceN(d) if !d.is_none && d.colorants.iter().any(is_spot) => {
+                Some(&d.alternate_space)
+            }
+            _ => None,
+        }
+    }
+
+    /// Craft patch (CMYK masks): a `Separation` or `DeviceN` color in its alternate space,
+    /// through the tint transform; the components unchanged for other spaces.
+    fn tint_transform(&self, components: &[f32]) -> ColorComponents {
+        let (function, alternate) = match self.0.as_ref() {
+            ColorSpaceType::Separation(s) => (&s.tint_transform, &s.alternate_space),
+            ColorSpaceType::DeviceN(d) => (&d.tint_transform, &d.alternate_space),
+            _ => return components.iter().copied().collect(),
+        };
+        count_tint_transform_runs(1);
+        function
+            .eval(components.iter().copied().collect())
+            .unwrap_or(alternate.initial_color())
+    }
+
+    /// PdfCraft patch (35): how the space paints `ink`'s plate. Gray, RGB, CIE-based and ICC
+    /// spaces are process colour: they specify the four process inks and no spot ink. With
+    /// `spots_as_process` (Craft patch, CMYK masks), a space naming a spot ink paints as its
+    /// alternate space.
+    pub(crate) fn ink_use(&self, ink: &Ink, spots_as_process: bool) -> InkUse {
+        if spots_as_process && let Some(alternate) = self.spot_alternate_space() {
+            return alternate.ink_use(ink, false);
+        }
+        match self.0.as_ref() {
+            ColorSpaceType::DeviceCmyk
+            | ColorSpaceType::DeviceGray
+            | ColorSpaceType::DeviceRgb
+            | ColorSpaceType::ICCBased(_)
+            | ColorSpaceType::CalGray(_)
+            | ColorSpaceType::CalRgb(_)
+            | ColorSpaceType::Lab(_) => {
+                if ink.process_index().is_some() {
+                    InkUse::Paints
+                } else {
+                    InkUse::Unspecified
+                }
+            }
+            ColorSpaceType::Indexed(i) => i.base.ink_use(ink, spots_as_process),
+            ColorSpaceType::Separation(s) => match &s.colorant {
+                Colorant::None => InkUse::Nothing,
+                Colorant::All => InkUse::Paints,
+                Colorant::Ink(i) if i == ink => InkUse::Paints,
+                Colorant::Ink(_) => InkUse::Unspecified,
+            },
+            ColorSpaceType::DeviceN(d) => {
+                if d.is_none {
+                    InkUse::Nothing
+                } else if d
+                    .colorants
+                    .iter()
+                    .any(|c| matches!(c, Colorant::Ink(i) if i == ink))
+                {
+                    InkUse::Paints
+                } else {
+                    InkUse::Unspecified
+                }
+            }
+            // A pattern is separated through what it paints.
+            ColorSpaceType::Pattern(_) => InkUse::Unspecified,
+            ColorSpaceType::Plate(p) => p.inner.ink_use(ink, spots_as_process),
+        }
+    }
+
+    /// PdfCraft patch (35): the tint, `0.0` (no ink) to `1.0` (solid), that the colour
+    /// `components` puts on `ink`'s plate; `0.0` when the space doesn't specify the ink.
+    /// Process colour converts through `simulation` when there is one (patch 36).
+    /// `manual_scale` as for [`ToRgb::convert_f32`] (components normalised to `0.0..=1.0`, as
+    /// an Indexed palette gives them). `spots_as_process` as for [`Self::ink_use`].
+    pub(crate) fn ink_tint(
+        &self,
+        components: &[f32],
+        ink: &Ink,
+        simulation: Option<&CmykSimulation>,
+        manual_scale: bool,
+        spots_as_process: bool,
+    ) -> f32 {
+        if spots_as_process && let Some(alternate) = self.spot_alternate_space() {
+            let alternate_components = self.tint_transform(components);
+            return alternate.ink_tint(&alternate_components, ink, simulation, false, false);
+        }
+        let tint = match self.0.as_ref() {
+            ColorSpaceType::Separation(s) => match &s.colorant {
+                Colorant::All => components.first().copied().unwrap_or(0.0),
+                Colorant::Ink(i) if i == ink => components.first().copied().unwrap_or(0.0),
+                _ => 0.0,
+            },
+            ColorSpaceType::DeviceN(d) => d
+                .colorants
+                .iter()
+                .position(|c| matches!(c, Colorant::Ink(i) if i == ink))
+                .and_then(|k| components.get(k))
+                .copied()
+                .unwrap_or(0.0),
+            ColorSpaceType::Indexed(i) => {
+                let index = components.first().copied().unwrap_or(0.0);
+                let index = (clamp_component(index, 0.0, f32::from(i.hival)) + 0.5) as usize;
+                match i.values.get(index) {
+                    Some(values) => {
+                        i.base
+                            .ink_tint(values, ink, simulation, true, spots_as_process)
+                    }
+                    None => 0.0,
+                }
+            }
+            ColorSpaceType::Pattern(_) => 0.0,
+            ColorSpaceType::Plate(p) => {
+                p.inner
+                    .ink_tint(components, ink, simulation, manual_scale, spots_as_process)
+            }
+            _ => match (
+                self.process_cmyk(components, simulation, manual_scale),
+                ink.process_index(),
+            ) {
+                (Some(cmyk), Some(k)) => cmyk.get(k).copied().unwrap_or(0.0),
+                _ => 0.0,
+            },
+        };
+        unit(tint)
+    }
+
+    /// PdfCraft patch (35): a process colour as DeviceCMYK: CMYK spaces (DeviceCMYK, ICC with
+    /// four components) as they are, gray as black only (`k = 1 − gray`, §10.4.2.2), and RGB,
+    /// CIE-based and three-component ICC spaces through sRGB by [`rgb_to_cmyk`]. Patch 36:
+    /// the spaces `simulation` converts go through it instead, and only fall back to those
+    /// formulas if the conversion fails.
+    fn process_cmyk(
+        &self,
+        components: &[f32],
+        simulation: Option<&CmykSimulation>,
+        manual_scale: bool,
+    ) -> Option<[f32; 4]> {
+        if let Some(simulation) = simulation.filter(|s| self.simulated_by(s)) {
+            let n = usize::from(self.num_components()).max(1);
+            let mut colour: ColorComponents = components.iter().copied().take(n).collect();
+            colour.resize(n, 0.0);
+            let mut cmyk = [0.0; 4];
+            if self
+                .simulate_cmyk(simulation, &colour, manual_scale, &mut cmyk)
+                .is_some()
+            {
+                return Some(cmyk.map(unit));
+            }
+        }
+        let get = |k: usize| unit(components.get(k).copied().unwrap_or(0.0));
+        match self.0.as_ref() {
+            ColorSpaceType::DeviceCmyk => Some([get(0), get(1), get(2), get(3)]),
+            ColorSpaceType::ICCBased(icc) if icc.0.number_components == 4 => {
+                Some([get(0), get(1), get(2), get(3)])
+            }
+            ColorSpaceType::ICCBased(icc) if icc.0.number_components == 1 => {
+                Some([0.0, 0.0, 0.0, 1.0 - get(0)])
+            }
+            ColorSpaceType::DeviceGray | ColorSpaceType::CalGray(_) => {
+                Some([0.0, 0.0, 0.0, 1.0 - get(0)])
+            }
+            ColorSpaceType::DeviceRgb => Some(rgb_to_cmyk([get(0), get(1), get(2)])),
+            _ if self.separates_through_srgb() => {
+                let mut rgb = [0_u8; 3];
+                self.convert_sample(components, &mut rgb, manual_scale)?;
+                Some(rgb_to_cmyk(rgb.map(u8_to_f32)))
+            }
+            _ => None,
+        }
+    }
+
+    /// PdfCraft patch (35): tell `sink` about every spot ink the space names, with the ink's
+    /// appearance (the space's colour with only that component set).
+    pub(crate) fn report_spots(&self, sink: &InkSinkFn) {
+        match self.0.as_ref() {
+            ColorSpaceType::Separation(s) => {
+                if let Colorant::Ink(ink @ Ink::Spot(_)) = &s.colorant {
+                    sink(ink, &|tint| self.appearance(&[tint]));
+                }
+            }
+            ColorSpaceType::DeviceN(d) => {
+                for (k, colorant) in d.colorants.iter().enumerate() {
+                    if let Colorant::Ink(ink @ Ink::Spot(_)) = colorant {
+                        sink(ink, &|tint| {
+                            let mut components: ColorComponents = smallvec![0.0; d.colorants.len()];
+                            if let Some(c) = components.get_mut(k) {
+                                *c = tint;
+                            }
+                            self.appearance(&components)
+                        });
+                    }
+                }
+            }
+            ColorSpaceType::Indexed(i) => i.base.report_spots(sink),
+            ColorSpaceType::Pattern(cs) => cs.report_spots(sink),
+            ColorSpaceType::Plate(p) => p.inner.report_spots(sink),
+            _ => {}
+        }
+    }
+
+    /// The sRGB colour of `components` (the `None` colorant's invisibility aside).
+    fn appearance(&self, components: &[f32]) -> [u8; 3] {
+        let [r, g, b, _] = self.to_rgba(components, 1.0, false).to_rgba8();
+        [r, g, b]
+    }
+}
+
+/// PdfCraft patch (35): a colour space drawn as one ink's plate: each colour becomes the gray
+/// film of that ink's tint (see [`Plate`]).
+#[derive(Debug, Clone)]
+pub(crate) struct PlateSpace {
+    inner: ColorSpace,
+    ink: Ink,
+    /// Patch 36: the printing condition process colour converts to, if any.
+    simulation: Option<CmykSimulation>,
+    /// Craft patch (CMYK masks): see [`Plate::spots_as_process`].
+    spots_as_process: bool,
+}
+
+impl PlateSpace {
+    fn samples(&self) -> usize {
+        usize::from(self.inner.num_components()).max(1)
+    }
+
+    /// The film of the tint the colour `sample` puts on the plate.
+    fn film(&self, sample: &[f32], manual_scale: bool) -> u8 {
+        let tint = self
+            .inner
+            .ink_tint(
+                sample,
+                &self.ink,
+                self.simulation.as_ref(),
+                manual_scale,
+                self.spots_as_process,
+            );
+        f32_to_u8(1.0 - tint)
+    }
+
+    /// PdfCraft patch (36): the inner space's colours `input` converted through the
+    /// simulation, as film; `None` when the space isn't simulated or a conversion fails.
+    fn film_through_simulation(
+        &self,
+        input: &[f32],
+        output: &mut [u8],
+        manual_scale: bool,
+    ) -> Option<()> {
+        let simulation = self
+            .simulation
+            .as_ref()
+            .filter(|s| self.inner.simulated_by(s))?;
+        let Some(k) = self.ink.process_index() else {
+            output.fill(255);
+            return Some(());
+        };
+        let n = self.samples();
+        let mut cmyk = [0.0_f32; SIMULATION_CHUNK * 4];
+        for (input, rgb) in input
+            .chunks(SIMULATION_CHUNK * n)
+            .zip(output.chunks_mut(SIMULATION_CHUNK * 3))
+        {
+            let count = (input.len() / n).min(rgb.len() / 3);
+            let cmyk = cmyk.get_mut(..count * 4)?;
+            self.inner
+                .simulate_cmyk(simulation, input.get(..count * n)?, manual_scale, cmyk)?;
+            for (px, colour) in rgb.chunks_exact_mut(3).zip(cmyk.chunks_exact(4)) {
+                px.fill(f32_to_u8(1.0 - unit(colour.get(k).copied().unwrap_or(0.0))));
+            }
+        }
+        Some(())
+    }
+
+    /// The film of every entry of an Indexed inner space's palette, worked out once for an
+    /// image's `samples` rather than once per sample; `None` for other spaces, and when there
+    /// are no more samples than palette entries.
+    fn palette_films(&self, samples: usize) -> Option<Vec<u8>> {
+        let ColorSpaceType::Indexed(indexed) = self.inner.0.as_ref() else {
+            return None;
+        };
+        if samples <= usize::from(indexed.hival) + 1 {
+            return None;
+        }
+        Some(
+            (0..=indexed.hival)
+                .map(|index| self.film(&[f32::from(index)], false))
+                .collect(),
+        )
+    }
+
+    /// Turn sRGB pixels, converted from the inner space, into film in place.
+    fn film_from_srgb(&self, output: &mut [u8]) {
+        let Some(k) = self.ink.process_index() else {
+            output.fill(255);
+            return;
+        };
+        for rgb in output.chunks_exact_mut(3) {
+            let cmyk = rgb_to_cmyk([u8_to_f32(rgb[0]), u8_to_f32(rgb[1]), u8_to_f32(rgb[2])]);
+            let film = f32_to_u8(1.0 - cmyk.get(k).copied().unwrap_or(0.0));
+            rgb.copy_from_slice(&[film; 3]);
+        }
+    }
+}
+
+impl ToRgb for PlateSpace {
+    fn convert_f32(&self, input: &[f32], output: &mut [u8], manual_scale: bool) -> Option<()> {
+        if self
+            .film_through_simulation(input, output, manual_scale)
+            .is_some()
+        {
+            return Some(());
+        }
+        if self.inner.separates_through_srgb() {
+            self.inner.convert_f32(input, output, manual_scale)?;
+            self.film_from_srgb(output);
+            return Some(());
+        }
+        if let Some(films) = self.palette_films(input.len()) {
+            // As `ink_tint` reads an Indexed sample: the index, clamped and rounded.
+            let hival = films.len().saturating_sub(1) as f32;
+            for (index, rgb) in input.iter().zip(output.chunks_exact_mut(3)) {
+                let index = (clamp_component(*index, 0.0, hival) + 0.5) as usize;
+                rgb.fill(films.get(index).copied().unwrap_or(255));
+            }
+            return Some(());
+        }
+        for (sample, rgb) in input
+            .chunks_exact(self.samples())
+            .zip(output.chunks_exact_mut(3))
+        {
+            rgb.fill(self.film(sample, manual_scale));
+        }
+        Some(())
+    }
+
+    // The spaces that take bytes (device and ICC spaces) read them as component × 255.
+    fn supports_u8(&self) -> bool {
+        self.inner.supports_u8()
+    }
+
+    fn convert_u8(&self, input: &[u8], output: &mut [u8]) -> Option<()> {
+        if self
+            .simulation
+            .as_ref()
+            .is_some_and(|s| self.inner.simulated_by(s))
+        {
+            // Bytes are the components' encoding scaled to 0–255 (an ICC L*a*b* colour's too,
+            // so they arrive as `manual_scale` components).
+            let n = self.samples();
+            let mut floats = [0.0_f32; SIMULATION_CHUNK * 4];
+            let mut done = Some(());
+            for (bytes, rgb) in input
+                .chunks(SIMULATION_CHUNK * n)
+                .zip(output.chunks_mut(SIMULATION_CHUNK * 3))
+            {
+                let floats = floats.get_mut(..bytes.len())?;
+                for (f, b) in floats.iter_mut().zip(bytes) {
+                    *f = u8_to_f32(*b);
+                }
+                done = done.and(self.film_through_simulation(floats, rgb, true));
+            }
+            if done.is_some() {
+                return Some(());
+            }
+        }
+        if self.inner.separates_through_srgb() {
+            self.inner.convert_u8(input, output)?;
+            self.film_from_srgb(output);
+            return Some(());
+        }
+        let mut sample: ColorComponents = SmallVec::new();
+        for (bytes, rgb) in input
+            .chunks_exact(self.samples())
+            .zip(output.chunks_exact_mut(3))
+        {
+            sample.clear();
+            sample.extend(bytes.iter().copied().map(u8_to_f32));
+            rgb.fill(self.film(&sample, false));
+        }
+        Some(())
+    }
+
+    fn is_none(&self) -> bool {
+        self.inner.is_none()
+    }
 }
 
 static CMYK_TRANSFORM: LazyLock<ICCProfile> = LazyLock::new(|| {
@@ -1184,6 +2540,299 @@ pub(crate) trait ToRgb {
     }
 }
 
+/// Craft patch (flatten): the inks a colour paints, for devices that keep colours as inks
+/// instead of RGB (see [`Color::ink_paint`]).
+#[derive(Clone, Debug, PartialEq)]
+pub enum InkPaint {
+    /// Tints `0.0..=1.0` of the listed inks; other inks are unspecified. Process colour lists
+    /// all four process inks.
+    Tints(Vec<(Ink, f32)>),
+    /// The same tint on every plate (the `All` colorant).
+    All(f32),
+    /// No ink (the `None` colorant).
+    None,
+}
+
+/// Craft patch (flatten): how a spot ink looks at 100%, from its colour space's alternate.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum SpotAlternate {
+    /// The alternate space is DeviceCMYK: the tint transform's CMYK.
+    Cmyk([f32; 4]),
+    /// Any other alternate space: the sRGB appearance.
+    Srgb([u8; 3]),
+}
+
+impl Color {
+    /// Craft patch (flatten): the opacity (`ca` or `CA`) the colour paints with.
+    pub fn opacity(&self) -> f32 {
+        self.opacity
+    }
+
+    /// Craft patch (flatten): whether the colour was set in DeviceCMYK itself, where the
+    /// nonzero overprint mode applies (ISO 32000-2 §8.6.7).
+    pub fn is_device_cmyk(&self) -> bool {
+        self.color_space.is_device_cmyk()
+    }
+
+    /// Craft patch (flatten): the inks the colour paints, as plate mode separates it:
+    /// `Separation` and `DeviceN` colorants as they are, and process colour as CMYK, converted
+    /// through `simulation` where plate mode converts it. `None` for a pattern space.
+    pub fn ink_paint(&self, simulation: Option<&CmykSimulation>) -> Option<InkPaint> {
+        self.color_space
+            .ink_paint(&self.components, simulation, false)
+    }
+
+    /// Craft patch (flatten): how spot `ink` of this colour's space looks at 100%; `None` when
+    /// the space doesn't name it.
+    pub fn spot_alternate(&self, ink: &Ink) -> Option<SpotAlternate> {
+        self.color_space.spot_alternate(ink)
+    }
+}
+
+impl ColorSpace {
+    /// Craft patch (flatten): see [`Color::ink_paint`].
+    fn ink_paint(
+        &self,
+        components: &[f32],
+        simulation: Option<&CmykSimulation>,
+        manual_scale: bool,
+    ) -> Option<InkPaint> {
+        let get = |k: usize| unit(components.get(k).copied().unwrap_or(0.0));
+        Some(match self.0.as_ref() {
+            ColorSpaceType::Separation(s) => match &s.colorant {
+                Colorant::None => InkPaint::None,
+                Colorant::All => InkPaint::All(get(0)),
+                Colorant::Ink(ink) => InkPaint::Tints(vec![(ink.clone(), get(0))]),
+            },
+            ColorSpaceType::DeviceN(d) => {
+                let tints: Vec<_> = d
+                    .colorants
+                    .iter()
+                    .enumerate()
+                    .filter_map(|(k, c)| match c {
+                        Colorant::Ink(ink) => Some((ink.clone(), get(k))),
+                        _ => None,
+                    })
+                    .collect();
+                if d.is_none || tints.is_empty() {
+                    InkPaint::None
+                } else {
+                    InkPaint::Tints(tints)
+                }
+            }
+            ColorSpaceType::Indexed(i) => {
+                let index = components.first().copied().unwrap_or(0.0);
+                let index = (clamp_component(index, 0.0, f32::from(i.hival)) + 0.5) as usize;
+                return i.base.ink_paint(i.values.get(index)?, simulation, true);
+            }
+            ColorSpaceType::Pattern(_) => return None,
+            ColorSpaceType::Plate(p) => {
+                return p.inner.ink_paint(components, simulation, manual_scale);
+            }
+            _ => {
+                let cmyk = self.process_cmyk(components, simulation, manual_scale)?;
+                InkPaint::Tints(Ink::PROCESS.into_iter().zip(cmyk).collect())
+            }
+        })
+    }
+
+    /// Craft patch (flatten): see [`Color::spot_alternate`].
+    pub fn spot_alternate(&self, ink: &Ink) -> Option<SpotAlternate> {
+        let (alternate, transform, components) = match self.0.as_ref() {
+            ColorSpaceType::Separation(s) => {
+                if s.colorant != Colorant::Ink(ink.clone()) {
+                    return None;
+                }
+                (&s.alternate_space, &s.tint_transform, smallvec![1.0])
+            }
+            ColorSpaceType::DeviceN(d) => {
+                let k = d
+                    .colorants
+                    .iter()
+                    .position(|c| matches!(c, Colorant::Ink(i) if i == ink))?;
+                let mut components: ColorComponents = smallvec![0.0; d.colorants.len()];
+                *components.get_mut(k)? = 1.0;
+                (&d.alternate_space, &d.tint_transform, components)
+            }
+            ColorSpaceType::Indexed(i) => return i.base.spot_alternate(ink),
+            ColorSpaceType::Pattern(cs) => return cs.spot_alternate(ink),
+            ColorSpaceType::Plate(p) => return p.inner.spot_alternate(ink),
+            _ => return None,
+        };
+        if alternate.is_device_cmyk()
+            && let Some(cmyk) = transform.eval(components.clone())
+            && let [c, m, y, k] = cmyk[..]
+        {
+            return Some(SpotAlternate::Cmyk([c, m, y, k].map(unit)));
+        }
+        Some(SpotAlternate::Srgb(self.appearance(&components)))
+    }
+}
+
+/// Craft patch (flatten): the components a device that keeps colours as inks stores a space's
+/// colours in, as plate mode separates them (see [`ColorSpace::ink_values`]).
+#[derive(Clone, Debug, PartialEq)]
+pub enum InkSpace {
+    /// DeviceGray: one gray level, 1 = white.
+    Gray,
+    /// The four process tints. `converted` when the colours are converted into CMYK (RGB, Lab,
+    /// CIE-based and ICC spaces other than a CMYK profile the simulation leaves as it is).
+    Cmyk {
+        /// Whether the colours are converted into CMYK.
+        converted: bool,
+    },
+    /// Tints of these inks: `Separation` and `DeviceN` colorants, `None` colorants left out.
+    Inks(Vec<Ink>),
+    /// One tint for every ink (the `All` colorant).
+    All,
+    /// No ink (the `None` colorant, or a pattern space).
+    None,
+}
+
+impl InkSpace {
+    /// Values per colour.
+    pub fn len(&self) -> usize {
+        match self {
+            Self::Gray | Self::All => 1,
+            Self::Cmyk { .. } => 4,
+            Self::Inks(inks) => inks.len(),
+            Self::None => 0,
+        }
+    }
+
+    /// Whether colours have no values (the space paints nothing).
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+impl ColorSpace {
+    /// Craft patch (flatten): the components per colour.
+    pub fn components(&self) -> usize {
+        usize::from(self.num_components())
+    }
+
+    /// Craft patch (flatten): how [`Self::ink_values`] stores this space's colours. An Indexed
+    /// space stores its base space's.
+    pub fn ink_space(&self, simulation: Option<&CmykSimulation>) -> InkSpace {
+        match self.0.as_ref() {
+            ColorSpaceType::DeviceGray => InkSpace::Gray,
+            ColorSpaceType::DeviceCmyk => InkSpace::Cmyk { converted: false },
+            ColorSpaceType::ICCBased(icc) if icc.0.number_components == 4 => InkSpace::Cmyk {
+                converted: simulation.is_some_and(|s| self.simulated_by(s)),
+            },
+            ColorSpaceType::Indexed(i) => i.base.ink_space(simulation),
+            ColorSpaceType::Separation(s) => match &s.colorant {
+                Colorant::Ink(ink) => InkSpace::Inks(vec![ink.clone()]),
+                Colorant::All => InkSpace::All,
+                Colorant::None => InkSpace::None,
+            },
+            ColorSpaceType::DeviceN(d) => {
+                let inks: Vec<Ink> = d
+                    .colorants
+                    .iter()
+                    .filter_map(|c| match c {
+                        Colorant::Ink(ink) => Some(ink.clone()),
+                        _ => None,
+                    })
+                    .collect();
+                if d.is_none || inks.is_empty() {
+                    InkSpace::None
+                } else {
+                    InkSpace::Inks(inks)
+                }
+            }
+            ColorSpaceType::Pattern(_) => InkSpace::None,
+            ColorSpaceType::Plate(p) => p.inner.ink_space(simulation),
+            _ => InkSpace::Cmyk { converted: true },
+        }
+    }
+
+    /// Craft patch (flatten): the colours `colors` (whole colours of [`Self::components`]
+    /// values each) appended to `out` as [`Self::ink_space`] values, `0.0..=1.0`. Process
+    /// colour converts as [`Color::ink_paint`] does, in batches.
+    pub fn ink_values(&self, colors: &[f32], simulation: Option<&CmykSimulation>, out: &mut Vec<f32>) {
+        self.ink_values_scaled(colors, simulation, false, out);
+    }
+
+    fn ink_values_scaled(
+        &self,
+        colors: &[f32],
+        simulation: Option<&CmykSimulation>,
+        manual_scale: bool,
+        out: &mut Vec<f32>,
+    ) {
+        let n = usize::from(self.num_components()).max(1);
+        let colors = &colors[..colors.len() / n * n];
+        match self.0.as_ref() {
+            ColorSpaceType::Indexed(i) => {
+                let width = i.base.ink_space(simulation).len();
+                let mut table = Vec::with_capacity((usize::from(i.hival) + 1) * width);
+                for values in &i.values {
+                    let start = table.len();
+                    i.base.ink_values_scaled(values, simulation, true, &mut table);
+                    table.resize(start + width, 0.0);
+                }
+                for index in colors {
+                    let index = (clamp_component(*index, 0.0, f32::from(i.hival)) + 0.5) as usize;
+                    match table.get(index * width..(index + 1) * width) {
+                        Some(values) => out.extend_from_slice(values),
+                        None => out.extend(std::iter::repeat_n(0.0, width)),
+                    }
+                }
+            }
+            ColorSpaceType::Plate(p) => p.inner.ink_values_scaled(colors, simulation, manual_scale, out),
+            ColorSpaceType::Pattern(_) => {}
+            ColorSpaceType::DeviceGray => out.extend(colors.iter().map(|v| unit(*v))),
+            ColorSpaceType::Separation(s) => {
+                if s.colorant != Colorant::None {
+                    out.extend(colors.iter().map(|v| unit(*v)));
+                }
+            }
+            ColorSpaceType::DeviceN(d) => {
+                if d.is_none {
+                    return;
+                }
+                for colour in colors.chunks_exact(n) {
+                    for (c, v) in d.colorants.iter().zip(colour) {
+                        if matches!(c, Colorant::Ink(_)) {
+                            out.push(unit(*v));
+                        }
+                    }
+                }
+            }
+            _ => {
+                let start = out.len();
+                out.resize(start + colors.len() / n * 4, 0.0);
+                if let Some(simulation) = simulation.filter(|s| self.simulated_by(s))
+                    && self
+                        .simulate_cmyk(simulation, colors, manual_scale, &mut out[start..])
+                        .is_some()
+                {
+                    for v in &mut out[start..] {
+                        *v = unit(*v);
+                    }
+                    return;
+                }
+                if self.separates_through_srgb() {
+                    let mut rgb = vec![0_u8; colors.len() / n * 3];
+                    if self.convert_f32(colors, &mut rgb, manual_scale).is_some() {
+                        for (cmyk, rgb) in out[start..].chunks_exact_mut(4).zip(rgb.chunks_exact(3)) {
+                            cmyk.copy_from_slice(&rgb_to_cmyk([rgb[0], rgb[1], rgb[2]].map(u8_to_f32)));
+                        }
+                        return;
+                    }
+                }
+                for (cmyk, colour) in out[start..].chunks_exact_mut(4).zip(colors.chunks_exact(n)) {
+                    if let Some(c) = self.process_cmyk(colour, None, manual_scale) {
+                        cmyk.copy_from_slice(&c);
+                    }
+                }
+            }
+        }
+    }
+}
+
 #[cfg(test)]
 mod device_color_compatibility_tests {
     use super::ColorSpace;
diff --git a/vendor/hayro-interpret/src/context.rs b/vendor/hayro-interpret/src/context.rs
index 326aa201..e4d84130 100644
--- a/vendor/hayro-interpret/src/context.rs
+++ b/vendor/hayro-interpret/src/context.rs
@@ -150,6 +150,19 @@ impl<'a> InterpreterCache<'a> {
             decoded_cache: DecodedImageCache::new(),
         }
     }
+
+    /// PdfCraft patch (32): how many images were decoded through this cache (its misses, not
+    /// counting images that are never cached), for diagnostics and tests.
+    pub fn decoded_image_decodes(&self) -> usize {
+        self.decoded_cache.decodes()
+    }
+
+    /// PdfCraft patch (#3020): how many `/ICCBased` profiles were read through this cache, for
+    /// diagnostics and tests. A profile used again, by the same stream object or by a copy with
+    /// the same dictionary and bytes, is read once.
+    pub fn icc_profile_reads(&self) -> usize {
+        self.object_cache.icc_profile_reads()
+    }
 }
 
 /// A per-page interpretation context that borrows shared data from an [`InterpreterCache`].
@@ -179,10 +192,19 @@ const MAX_SAVED_STATES: usize = 4096;
 const MAX_SAVED_STATE_BYTES: usize = 64 << 20;
 
 /// Roughly what a saved copy of `state` holds.
+/// PdfCraft patch (51): the sums saturate, so a huge dash array or clip list counts as over the
+/// bound rather than wrapping on a 32-bit target.
 fn state_bytes(state: &State<'_>) -> usize {
     size_of::<State<'_>>()
-        + state.graphics_state.stroke_props.dash_array.len() * size_of::<f32>()
-        + state.clips.len() * size_of::<ClipType>()
+        .saturating_add(
+            state
+                .graphics_state
+                .stroke_props
+                .dash_array
+                .len()
+                .saturating_mul(size_of::<f32>()),
+        )
+        .saturating_add(state.clips.len().saturating_mul(size_of::<ClipType>()))
 }
 
 impl<'a> Context<'a> {
@@ -263,7 +285,7 @@ impl<'a> Context<'a> {
         }
 
         let cur = cur.clone();
-        self.saved_bytes += bytes;
+        self.saved_bytes = self.saved_bytes.saturating_add(bytes);
         self.states.push(cur);
     }
 
@@ -440,7 +462,7 @@ impl<'a> Context<'a> {
 
     pub(crate) fn num_states(&self) -> usize {
         // PdfCraft patch: saves not kept still count, so callers restore back past them.
-        self.states.len() + self.skipped_saves.len()
+        self.states.len().saturating_add(self.skipped_saves.len())
     }
 
     pub(crate) fn nesting_depth(&self) -> u32 {
diff --git a/vendor/hayro-interpret/src/device.rs b/vendor/hayro-interpret/src/device.rs
index 72d5a980..6f666291 100644
--- a/vendor/hayro-interpret/src/device.rs
+++ b/vendor/hayro-interpret/src/device.rs
@@ -66,6 +66,55 @@ pub trait Device<'a> {
     fn actual_text(&mut self, _text: &[u8]) {}
     /// Called at the end of a marked content sequence (EMC).
     fn end_marked_content(&mut self) {}
+    /// PdfCraft patch (29): the page's annotations are about to be drawn (until
+    /// `end_annotations`), as page content finishes. Devices can use this to treat their
+    /// paints as annotation colours rather than document colours — the reading-colours
+    /// setting replaces document colours only, never the colours a comment was given.
+    fn begin_annotations(&mut self) {}
+    /// PdfCraft patch (29): the page's annotations are done; what follows is page content.
+    fn end_annotations(&mut self) {}
+    /// Knockout patch (pdfcraft #2974): the transparency group just pushed is a knockout group
+    /// (`/K true`): each of its elements composites with the group's initial backdrop, not with the
+    /// elements drawn before it in the group (ISO 32000-2, knockout groups), until the matching
+    /// `pop_transparency_group`.
+    fn set_knockout(&mut self) {}
+    /// Knockout patch (pdfcraft #2974): an element whose shape is `shape` (device space) is about
+    /// to be drawn into a transparency group of its own. In a knockout group (`set_knockout`) the
+    /// element replaces what the group drew under its shape, so a device clears that first; the
+    /// element's layer then composites over the cleared area as usual.
+    fn knockout_shape(&mut self, _shape: &BezPath) {}
+    /// Knockout patch (pdfcraft #2974): whether `knockout_shape` would clear anything now, that is
+    /// whether the innermost transparency group is a knockout group. Lets the interpreter skip work
+    /// it only needs for the clear.
+    fn in_knockout_group(&mut self) -> bool {
+        false
+    }
+    /// Knockout patch (pdfcraft #2974): `image`, an unmasked raster image, is about to be drawn
+    /// with `transform` in a knockout group. A device that will draw it (it isn't skipped and it
+    /// decodes) clears what the group drew under its placement rectangle first, so the image
+    /// replaces it. Decided by the device, at the size it draws the image, so the draw reuses that
+    /// decode.
+    fn knockout_image(&mut self, _image: &crate::RasterImage<'_>, _transform: Affine) {}
+    /// Knockout patch (pdfcraft #2974): whether a transparency group drawn now is an element of a
+    /// knockout group that the device wants cleared under the group's shape first. If so the
+    /// interpreter draws the group's content once between `begin_knockout_erase` and
+    /// `end_knockout_erase`, in which every paint clears what is under its shape instead of
+    /// painting, and then draws the group as usual, in a layer of its own.
+    fn knockout_erase_wanted(&mut self) -> bool {
+        false
+    }
+    /// Knockout patch (pdfcraft #2974): see `knockout_erase_wanted`.
+    fn begin_knockout_erase(&mut self) {}
+    /// Knockout patch (pdfcraft #2974): see `knockout_erase_wanted`.
+    fn end_knockout_erase(&mut self) {}
+    /// Craft patch (flatten): the overprint parameters for the paints that follow, until the
+    /// next call: `op` (`fill`, for fills, glyph fills and images), `OP` (`stroke`) and `OPM`
+    /// (`mode`, 0 or 1; ISO 32000-2 §8.6.7). Called where `set_blend_mode` is called for a
+    /// paint.
+    fn set_overprint(&mut self, _fill: bool, _stroke: bool, _mode: u8) {}
+    /// Craft patch (flatten): the transparency group just pushed is isolated (`/I true`), until
+    /// the matching `pop_transparency_group`.
+    fn set_isolated(&mut self) {}
 }
 
 /// A device that discards all drawing operations.
diff --git a/vendor/hayro-interpret/src/encode.rs b/vendor/hayro-interpret/src/encode.rs
index 498ed909..314d133f 100644
--- a/vendor/hayro-interpret/src/encode.rs
+++ b/vendor/hayro-interpret/src/encode.rs
@@ -3,7 +3,7 @@
 use crate::color::{AlphaColor, ColorComponents, ColorSpace};
 use crate::interpret::state::ActiveTransferFunction;
 use crate::pattern::ShadingPattern;
-use crate::shading::{ShadingFunction, ShadingType, Triangle};
+use crate::shading::{ShadingFunction, ShadingType, Triangle, TriangleVertex};
 use kurbo::{Affine, Point};
 use rustc_hash::FxHashMap;
 use smallvec::{ToSmallVec, smallvec};
@@ -18,6 +18,13 @@ pub struct EncodedShadingPattern {
     pub(crate) shading_type: EncodedShadingType,
     pub(crate) opacity: f32,
     pub(crate) transfer_function: Option<ActiveTransferFunction>,
+    /// PdfCraft patch (#3296): where the shading can paint at all, in device space: for a mesh
+    /// (types 4–7), the pixels its triangles touched when it was encoded (empty when none
+    /// lies in the area); `None` for the shading types that paint everywhere (function-based,
+    /// axial, radial). The renderer samples a texture only there, and skips a mesh that
+    /// touches nothing: painted over the whole canvas, 310 one-triangle meshes on a plan cost
+    /// 310 full tiles per tile, and the watchdog gave the page up.
+    pub extent: Option<kurbo::Rect>,
 }
 
 impl EncodedShadingPattern {
@@ -50,6 +57,8 @@ impl ShadingPattern {
     /// Mesh shadings are sampled pixel by pixel, and only there (see `TriangleSampler`).
     pub fn encode_within(&self, area: Option<kurbo::Rect>) -> EncodedShadingPattern {
         let base_transform;
+        // PdfCraft patch (#3296): see `EncodedShadingPattern::extent`.
+        let mut extent = None;
 
         let shading_type = match self.shading.shading_type.as_ref() {
             ShadingType::FunctionBased {
@@ -81,6 +90,7 @@ impl ShadingPattern {
                 let full_transform = self.matrix;
                 let mut sampler = TriangleSampler::new(area);
                 sampler.sample(triangles, full_transform);
+                extent = Some(sampler.extent());
                 let samples = sampler.map;
 
                 base_transform = Affine::IDENTITY;
@@ -102,10 +112,11 @@ impl ShadingPattern {
                     }
                     triangles.clear();
                     patch.to_triangles(&mut triangles);
-                    if !sampler.sample(&triangles, full_transform) {
+                    if !sampler.sample_owned(&mut triangles, full_transform) {
                         break;
                     }
                 }
+                extent = Some(sampler.extent());
                 let samples = sampler.map;
 
                 base_transform = Affine::IDENTITY;
@@ -126,10 +137,11 @@ impl ShadingPattern {
                     }
                     triangles.clear();
                     patch.to_triangles(&mut triangles);
-                    if !sampler.sample(&triangles, full_transform) {
+                    if !sampler.sample_owned(&mut triangles, full_transform) {
                         break;
                     }
                 }
+                extent = Some(sampler.extent());
                 let samples = sampler.map;
 
                 base_transform = Affine::IDENTITY;
@@ -162,6 +174,13 @@ impl ShadingPattern {
             base_transform,
             opacity: self.opacity,
             transfer_function: self.transfer_function.clone(),
+            // A `/Background` is painted wherever the triangles aren't (pattern fills), so such
+            // a mesh has no extent to confine it to.
+            extent: if self.shading.background.is_some() {
+                None
+            } else {
+                extent
+            },
         }
     }
 }
@@ -249,6 +268,8 @@ struct TriangleSampler {
     map: FxHashMap<(u16, u16), ColorComponents>,
     area: kurbo::Rect,
     visits_left: u64,
+    /// PdfCraft patch (#3296): the pixels sampled so far, as `(x0, y0, x1, y1)` inclusive.
+    touched: Option<(u16, u16, u16, u16)>,
 }
 
 impl TriangleSampler {
@@ -263,52 +284,102 @@ impl TriangleSampler {
             map: FxHashMap::default(),
             area: area.unwrap_or(kurbo::Rect::new(0.0, 0.0, 65536.0, 65536.0)),
             visits_left,
+            touched: None,
+        }
+    }
+
+    /// PdfCraft patch (#3296): the device-space rectangle covering every pixel sampled so far
+    /// (whole pixels), or an empty rectangle when no triangle touched the area.
+    fn extent(&self) -> kurbo::Rect {
+        match self.touched {
+            Some((x0, y0, x1, y1)) => kurbo::Rect::new(
+                f64::from(x0),
+                f64::from(y0),
+                f64::from(x1) + 1.0,
+                f64::from(y1) + 1.0,
+            ),
+            None => kurbo::Rect::ZERO,
         }
     }
 
     /// Sample `triangles`; `false` once a budget is spent (the rest is left unsampled).
     fn sample(&mut self, triangles: &[Triangle], transform: Affine) -> bool {
+        if !self.take_page_budget(triangles.len()) {
+            return false;
+        }
+        triangles.iter().all(|t| {
+            self.sample_one(transformed(
+                t.p0.clone(),
+                t.p1.clone(),
+                t.p2.clone(),
+                transform,
+            ))
+        })
+    }
+
+    /// PdfCraft patch (33): [`Self::sample`] for triangles made for this sampling alone (a
+    /// patch's), moving their vertices instead of copying each one's colours (`triangles` is
+    /// left empty).
+    fn sample_owned(&mut self, triangles: &mut Vec<Triangle>, transform: Affine) -> bool {
+        if !self.take_page_budget(triangles.len()) {
+            return false;
+        }
+        triangles
+            .drain(..)
+            .all(|t| self.sample_one(transformed(t.p0, t.p1, t.p2, transform)))
+    }
+
+    /// Take `count` triangles from the page's budget; `false` (and none left) when it is short.
+    fn take_page_budget(&mut self, count: usize) -> bool {
         let page_left = MESH_TRIANGLES_LEFT.with(core::cell::Cell::get);
-        if page_left < triangles.len() as u64 {
+        if page_left < count as u64 {
             MESH_TRIANGLES_LEFT.with(|n| n.set(0));
             warn!("page mesh triangle budget exceeded; the rest of the shading is not drawn");
             return false;
         }
-        MESH_TRIANGLES_LEFT.with(|n| n.set(page_left - triangles.len() as u64));
-        for t in triangles {
-            let t = {
-                let p0 = transform * t.p0.point;
-                let p1 = transform * t.p1.point;
-                let p2 = transform * t.p2.point;
+        MESH_TRIANGLES_LEFT.with(|n| n.set(page_left - count as u64));
+        true
+    }
 
-                let mut v0 = t.p0.clone();
-                v0.point = p0;
-                let mut v1 = t.p1.clone();
-                v1.point = p1;
-                let mut v2 = t.p2.clone();
-                v2.point = p2;
+    /// Sample one triangle in device space; `false` once the visit budget is spent.
+    fn sample_one(&mut self, t: Triangle) -> bool {
+        // Only the part of the triangle inside `area`; only such triangles add visits.
+        let bbox = t.bounding_box().intersect(self.area);
+        if bbox.width() <= 0.0 || bbox.height() <= 0.0 {
+            return true;
+        }
+        self.visits_left = self.visits_left.saturating_add(MESH_VISITS_PER_TRIANGLE);
 
-                Triangle::new(v0, v1, v2)
-            };
-
-            // Only the part of the triangle inside `area`; only such triangles add visits.
-            let bbox = t.bounding_box().intersect(self.area);
-            if bbox.width() <= 0.0 || bbox.height() <= 0.0 {
-                continue;
-            }
-            self.visits_left = self.visits_left.saturating_add(MESH_VISITS_PER_TRIANGLE);
-
-            for y in (bbox.y0.floor() as u16)..(bbox.y1.ceil() as u16) {
-                for x in (bbox.x0.floor() as u16)..(bbox.x1.ceil() as u16) {
-                    if self.visits_left == 0 {
-                        warn!("mesh shading visit budget exceeded; the rest is not drawn");
-                        return false;
-                    }
-                    self.visits_left -= 1;
-                    let point = Point::new(x as f64, y as f64);
-                    if t.contains_point(point) {
-                        self.map.insert((x, y), t.interpolate(point));
-                    }
+        for y in (bbox.y0.floor() as u16)..(bbox.y1.ceil() as u16) {
+            for x in (bbox.x0.floor() as u16)..(bbox.x1.ceil() as u16) {
+                if self.visits_left == 0 {
+                    warn!("mesh shading visit budget exceeded; the rest is not drawn");
+                    return false;
+                }
+                self.visits_left -= 1;
+                let corner = Point::new(x as f64, y as f64);
+                let sampled = if t.contains_point(corner) {
+                    self.map.insert((x, y), t.interpolate(corner));
+                    true
+                } else if t.covers(Point::new(x as f64 + 0.5, y as f64 + 0.5)) {
+                    // PdfCraft patch (#3035): a pixel whose corner no triangle holds strictly (it
+                    // lies on an edge two triangles share, or on the mesh's side) still belongs
+                    // to the triangle that covers its center, edges included. Testing only the
+                    // corner left a white seam along every shared edge. Such a pixel takes the
+                    // color at its corner, as every other pixel does (where MuPDF's colors
+                    // agree), unless a triangle that holds the corner gives it one.
+                    self.map
+                        .entry((x, y))
+                        .or_insert_with(|| t.interpolate(corner));
+                    true
+                } else {
+                    false
+                };
+                if sampled {
+                    self.touched = Some(match self.touched {
+                        Some((x0, y0, x1, y1)) => (x0.min(x), y0.min(y), x1.max(x), y1.max(y)),
+                        None => (x, y, x, y),
+                    });
                 }
             }
         }
@@ -316,6 +387,20 @@ impl TriangleSampler {
     }
 }
 
+/// The triangle `v0`, `v1`, `v2` with its points mapped through `transform` (its colours as
+/// they are).
+fn transformed(
+    mut v0: TriangleVertex,
+    mut v1: TriangleVertex,
+    mut v2: TriangleVertex,
+    transform: Affine,
+) -> Triangle {
+    v0.point = transform * v0.point;
+    v1.point = transform * v1.point;
+    v2.point = transform * v2.point;
+    Triangle::new(v0, v1, v2)
+}
+
 fn encode_function_shading(domain: &[f32; 4], function: &ShadingFunction) -> EncodedShadingType {
     let domain = kurbo::Rect::new(
         domain[0] as f64,
diff --git a/vendor/hayro-interpret/src/font/blob.rs b/vendor/hayro-interpret/src/font/blob.rs
index 6eabc26b..53501e5a 100644
--- a/vendor/hayro-interpret/src/font/blob.rs
+++ b/vendor/hayro-interpret/src/font/blob.rs
@@ -13,7 +13,7 @@ use skrifa::raw::{FontData as ReadFontData, FontRead};
 use skrifa::{FontRef, GlyphId, MetadataProvider, OutlineGlyphCollection};
 use std::collections::HashMap;
 use std::fmt::{Debug, Formatter};
-use std::sync::Arc;
+use std::sync::{Arc, OnceLock};
 use yoke::{Yoke, Yokeable};
 
 type FontData = Arc<dyn AsRef<[u8]> + Send + Sync>;
@@ -50,7 +50,10 @@ impl Type1FontBlob {
 
 /// A font blob for CFF-based fonts.
 #[derive(Clone)]
-pub(crate) struct CffFontBlob(Arc<CffFontYoke>);
+pub(crate) struct CffFontBlob(Arc<CffFontYoke>, Arc<OnceLock<GlyphNames>>);
+
+/// PdfCraft patch (50): glyph name to glyph id, built on first use.
+type GlyphNames = HashMap<Box<[u8]>, GlyphId>;
 
 impl Debug for CffFontBlob {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
@@ -84,7 +87,7 @@ impl CffFontBlob {
         });
 
         let _ = (cff, charset, subfonts);
-        Some(Self(Arc::new(yoke)))
+        Some(Self(Arc::new(yoke), Arc::new(OnceLock::new())))
     }
 
     pub(crate) fn font_data(&self) -> FontData {
@@ -134,11 +137,23 @@ impl CffFontBlob {
     }
 
     pub(crate) fn glyph_index_by_name(&self, name: &str) -> Option<GlyphId> {
-        // TODO: This is probably slow to do repeatedly?
-        self.charset()?.iter().find_map(|(gid, sid)| {
-            let bytes = self.0.as_ref().get().cff.string(sid)?;
-            (bytes == name.as_bytes()).then_some(gid)
-        })
+        // PdfCraft patch (50): called for every character code of a font, so the charset is
+        // read once. The first glyph of a name wins, as it did when the charset was searched
+        // in order.
+        self.1
+            .get_or_init(|| {
+                let mut names = GlyphNames::new();
+                if let Some(charset) = self.charset() {
+                    for (gid, sid) in charset.iter() {
+                        if let Some(bytes) = self.0.as_ref().get().cff.string(sid) {
+                            names.entry(bytes.into()).or_insert(gid);
+                        }
+                    }
+                }
+                names
+            })
+            .get(name.as_bytes())
+            .copied()
     }
 
     pub(crate) fn glyph_index_by_cid(&self, cid: u16) -> Option<GlyphId> {
@@ -165,6 +180,8 @@ impl CffFontBlob {
 pub(crate) struct OpenTypeFontBlob {
     yoke: Arc<OpenTypeFontYoke>,
     cff_blob: Option<CffFontBlob>,
+    // Craft patch (flatten): the face index in a collection, for `OutlineFontData::index`.
+    index: u32,
 }
 
 impl Debug for OpenTypeFontBlob {
@@ -179,11 +196,14 @@ impl OpenTypeFontBlob {
         let f = FontRef::from_index(data.as_ref().as_ref(), index).ok()?;
         // Reject fonts with invalid post table version, fixes pdf.js issue 9462. Not sure if there
         // is a better fix, for some reason skrifa accepts the font which is completely invalid.
+        // PdfCraft patch (49): also accept 1.0, 2.0 and 3.0 with the two 16-bit halves swapped
+        // (`00 00 00 03` for 3.0), as ScanSoft PDF Create! writes it into every font it embeds
+        // (#2946). Rejecting those fonts drew their text with a substitute that has no such glyphs.
         let invalid = f.post().is_ok_and(|p| {
             !matches!(
                 p.version().to_major_minor(),
                 (1, 0) | (2, 0) | (2, 5) | (3, 0)
-            )
+            ) && !matches!(p.version().to_be_bytes(), [0, 0, 0, 1..=3])
         });
 
         if invalid {
@@ -230,6 +250,7 @@ impl OpenTypeFontBlob {
         Some(Self {
             yoke: Arc::new(font_ref_yoke),
             cff_blob,
+            index,
         })
     }
 
@@ -237,6 +258,11 @@ impl OpenTypeFontBlob {
         self.yoke.backing_cart().clone()
     }
 
+    /// Craft patch (flatten): the face index the blob was read with.
+    pub(crate) fn index(&self) -> u32 {
+        self.index
+    }
+
     pub(crate) fn font_ref(&self) -> &FontRef<'_> {
         &self.yoke.as_ref().get().font_ref
     }
@@ -253,6 +279,27 @@ impl OpenTypeFontBlob {
             return glyph_names;
         };
 
+        // PdfCraft patch (49): a version written with its halves swapped (`00 00 00 02`,
+        // accepted in `new`) is read as the version it means, from a copy of the table with the
+        // version written correctly: read-fonts reads a 2.0 table's name index only under
+        // version 2.0, so otherwise its glyph names were never found (#2946).
+        let repaired = match post.version().to_be_bytes() {
+            [0, 0, 0, n @ 1..=3] => self
+                .font_ref()
+                .table_data(skrifa::raw::types::Tag::new(b"post"))
+                .map(|data| {
+                    let mut bytes = data.as_bytes().to_vec();
+                    if let Some(version) = bytes.get_mut(..4) {
+                        version.copy_from_slice(&[0, n, 0, 0]);
+                    }
+                    bytes
+                }),
+            _ => None,
+        };
+        let repaired_post = repaired
+            .as_deref()
+            .and_then(|b| skrifa::raw::tables::post::Post::read(ReadFontData::new(b)).ok());
+        let post = repaired_post.as_ref().unwrap_or(&post);
         match post.version().to_major_minor() {
             (1, 0) => {
                 for (gid, name) in DEFAULT_GLYPH_NAMES.iter().enumerate() {
@@ -333,3 +380,146 @@ struct CFFYoke<'a> {
     charset: Option<Charset<'a>>,
     subfonts: Vec<Subfont>,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A CFF font with glyphs `.notdef`, `Alpha`, `Alpha` (a duplicate name) and `Beta`.
+    fn cff_with_names() -> Vec<u8> {
+        fn index(items: &[&[u8]]) -> Vec<u8> {
+            let mut out = (items.len() as u16).to_be_bytes().to_vec();
+            if items.is_empty() {
+                return out;
+            }
+            out.push(1);
+            let mut offset = 1u8;
+            out.push(offset);
+            for item in items {
+                offset += item.len() as u8;
+                out.push(offset);
+            }
+            for item in items {
+                out.extend_from_slice(item);
+            }
+            out
+        }
+        // Operands use the 5-byte form so the Top DICT has a fixed size.
+        fn int(value: usize) -> Vec<u8> {
+            let mut out = vec![29];
+            out.extend_from_slice(&(value as u32).to_be_bytes());
+            out
+        }
+        fn build_top(charset: usize, char_strings: usize, private: usize) -> Vec<u8> {
+            let mut dict = Vec::new();
+            dict.extend(int(charset));
+            dict.push(15);
+            dict.extend(int(char_strings));
+            dict.push(17);
+            dict.extend(int(0));
+            dict.extend(int(private));
+            dict.push(18);
+            dict
+        }
+        let header = vec![1, 0, 4, 1];
+        let names = index(&[b"T"]);
+        let strings = index(&[b"Alpha", b"Beta"]);
+        let subrs = index(&[]);
+        // Standard strings take SIDs 0..=390, so the first custom string is 391.
+        let charset = vec![0, 0x01, 0x87, 0x01, 0x87, 0x01, 0x88];
+        let char_strings = index(&[&[14], &[14], &[14], &[14]]);
+        // The Top DICT has a fixed size because every operand takes the 5-byte form.
+        let top_len = index(&[&build_top(0, 0, 0)]).len();
+        let charset_at = header.len() + names.len() + top_len + strings.len() + subrs.len();
+        let char_strings_at = charset_at + charset.len();
+        let private_at = char_strings_at + char_strings.len();
+        let dict = build_top(charset_at, char_strings_at, private_at);
+        let top = index(&[&dict]);
+        let mut out = header;
+        for part in [names, top, strings, subrs, charset, char_strings] {
+            out.extend(part);
+        }
+        out
+    }
+
+    /// The charset search `glyph_index_by_name` replaced.
+    fn linear(blob: &CffFontBlob, name: &str) -> Option<GlyphId> {
+        blob.charset()?.iter().find_map(|(gid, sid)| {
+            let bytes = blob.0.as_ref().get().cff.string(sid)?;
+            (bytes == name.as_bytes()).then_some(gid)
+        })
+    }
+
+    #[test]
+    fn glyph_names_resolve_to_the_first_glyph_with_that_name() {
+        let data: FontData = Arc::new(cff_with_names());
+        let blob = CffFontBlob::new(data).expect("the test font parses");
+        assert!(blob.1.get().is_none(), "the name map is built on first use");
+        assert_eq!(blob.glyph_index_by_name("Alpha"), Some(GlyphId::new(1)));
+        assert_eq!(blob.glyph_index_by_name("Beta"), Some(GlyphId::new(3)));
+        assert_eq!(blob.glyph_index_by_name("Missing"), None);
+        assert_eq!(blob.glyph_index_by_name(""), None);
+        for name in ["Alpha", "Beta", "Missing", ".notdef", ""] {
+            assert_eq!(
+                blob.glyph_index_by_name(name),
+                linear(&blob, name),
+                "{name:?}"
+            );
+            // The second lookup is answered from the stored map.
+            assert_eq!(
+                blob.glyph_index_by_name(name),
+                linear(&blob, name),
+                "{name:?}"
+            );
+        }
+        assert!(blob.1.get().is_some(), "the lookups built the name map");
+        let shared = blob.clone();
+        assert!(Arc::ptr_eq(&blob.1, &shared.1), "clones share one name map");
+        assert_eq!(shared.glyph_index_by_name("Alpha"), Some(GlyphId::new(1)));
+    }
+
+    /// An sfnt with only a `post` table of the given version, naming three glyphs `.notdef`,
+    /// `A` (a standard name) and `W.cv07` (a name of its own) when the version is 2.0.
+    fn font_with_post(version: [u8; 4]) -> FontData {
+        let mut post = version.to_vec();
+        post.extend_from_slice(&[0; 28]);
+        post.extend_from_slice(&3u16.to_be_bytes());
+        for index in [0u16, 36, 258] {
+            post.extend_from_slice(&index.to_be_bytes());
+        }
+        post.push(6);
+        post.extend_from_slice(b"W.cv07");
+        let mut font = vec![0, 1, 0, 0, 0, 1, 0, 16, 0, 0, 0, 0];
+        font.extend_from_slice(b"post");
+        font.extend_from_slice(&[0; 4]);
+        font.extend_from_slice(&28u32.to_be_bytes());
+        font.extend_from_slice(&(post.len() as u32).to_be_bytes());
+        font.extend(post);
+        Arc::new(font)
+    }
+
+    #[test]
+    fn a_post_version_with_swapped_halves_is_read_as_the_version_it_means() {
+        for (swapped, correct) in [([0, 0, 0, 1], [0, 1, 0, 0]), ([0, 0, 0, 3], [0, 3, 0, 0])] {
+            assert!(OpenTypeFontBlob::new(font_with_post(correct), 0).is_some());
+            assert!(
+                OpenTypeFontBlob::new(font_with_post(swapped), 0).is_some(),
+                "{swapped:?} is accepted"
+            );
+        }
+        let names = |version| {
+            OpenTypeFontBlob::new(font_with_post(version), 0)
+                .unwrap()
+                .glyph_names()
+        };
+        let correct = names([0, 2, 0, 0]);
+        assert_eq!(correct.get("A"), Some(&GlyphId::new(1)));
+        assert_eq!(correct.get("W.cv07"), Some(&GlyphId::new(2)));
+        assert_eq!(
+            names([0, 0, 0, 2]),
+            correct,
+            "a swapped 2.0 table names its glyphs"
+        );
+        assert!(OpenTypeFontBlob::new(font_with_post([0, 9, 0, 0]), 0).is_none());
+    }
+}
diff --git a/vendor/hayro-interpret/src/font/cid.rs b/vendor/hayro-interpret/src/font/cid.rs
index b99dcbc1..db40d5a7 100644
--- a/vendor/hayro-interpret/src/font/cid.rs
+++ b/vendor/hayro-interpret/src/font/cid.rs
@@ -45,9 +45,16 @@ pub(crate) struct Type0Font {
     /// PdfCraft patch: whether the CIDs belong to an Adobe character collection (Japan1, GB1,
     /// CNS1, Korea1), whose glyph numbering no substitute other than a CID-keyed CFF font shares.
     adobe_collection: bool,
+    /// PdfCraft patch: `/ToUnicode /Identity-H` (a name, not a CMap stream), which CAD exporters
+    /// such as WSCAD write for fonts whose two-byte codes are UTF-16 code units. Acrobat shows
+    /// such text as the code's Unicode value; the identity CMap the name resolves to maps codes
+    /// to CIDs only and gave no text at all.
+    identity_to_unicode: bool,
 }
 
 impl Type0Font {
+    /// Reads a Type 0 font from its dictionary: the descendant CID font, the encoding CMap and
+    /// the code-to-Unicode map (`/ToUnicode`, the `/Identity-H` name, or the UCS2 CMap).
     pub(crate) fn new(
         dict: &Dict<'_>,
         font_resolver: &FontResolverFn,
@@ -117,6 +124,9 @@ impl Type0Font {
         let cache_key = dict.cache_key();
 
         let mut to_unicode = read_to_unicode(dict, cmap_resolver);
+        let identity_to_unicode = dict
+            .get::<Name<'_>>(TO_UNICODE)
+            .is_some_and(|n| matches!(n.as_ref(), b"Identity-H" | b"Identity-V"));
         let mut to_unicode_is_cid_indexed = false;
 
         // If there is no ToUnicode map, try to get the UCS2 CMap.
@@ -162,6 +172,7 @@ impl Type0Font {
             fallback,
             to_unicode_is_cid_indexed,
             adobe_collection,
+            identity_to_unicode,
         })
     }
 
@@ -264,7 +275,13 @@ impl Type0Font {
                 {
                     return Some(glyph);
                 }
-                charmap.map(character)
+                // PdfCraft patch: a substitute may lack a spacing character (#3601; e.g.
+                // Adobe-Japan1's U+2002). Draw its ordinary space instead of .notdef;
+                // the PDF's widths and Unicode mapping still determine advance and text.
+                charmap.map(character).or_else(|| match character {
+                    '\u{00a0}' | '\u{2000}'..='\u{200a}' | '\u{202f}' | '\u{205f}' | '\u{3000}' => charmap.map(' '),
+                    _ => None,
+                })
             }
             FontType::Cff(c) => {
                 // Map codepoint to glyph name via AFL, and then look it up.
@@ -326,6 +343,20 @@ impl Type0Font {
         }
     }
 
+    /// Craft patch (flatten): the face index of `font_data`.
+    pub(crate) fn font_index(&self) -> u32 {
+        match &self.font_type {
+            FontType::OpenType(t) => t.index(),
+            FontType::Cff(_) | FontType::Type1(_) => 0,
+        }
+    }
+
+    /// Craft patch (flatten): whether `font_data` comes from the file rather than the font
+    /// resolver.
+    pub(crate) fn is_embedded(&self) -> bool {
+        !self.fallback
+    }
+
     /// Get the PostScript name.
     pub(crate) fn postscript_name(&self) -> Option<&str> {
         self.postscript_name.as_deref()
@@ -430,7 +461,15 @@ impl Type0Font {
         }
     }
 
+    /// The text a character code stands for, or `None` when the font gives none (or, for an
+    /// identity `/ToUnicode` name, when the code is a control or a lone surrogate).
     pub(crate) fn char_code_to_unicode(&self, code: u32) -> Option<BfString> {
+        if self.identity_to_unicode {
+            // Controls and lone surrogates are not text.
+            return char::from_u32(code)
+                .filter(|c| !c.is_control())
+                .map(BfString::Char);
+        }
         if let Some(to_unicode) = &self.to_unicode {
             let key = if self.to_unicode_is_cid_indexed {
                 self.code_to_cid(code).unwrap_or(0)
@@ -592,6 +631,12 @@ fn read_widths2(arr: &Array<'_>) -> Option<HashMap<u32, [f32; 3]>> {
             let mut iter = range.iter::<f32>();
 
             while let Some(w) = iter.next() {
+                // PdfCraft patch: as in `read_widths`, checked before the run's metrics are
+                // read. Without it, a run starting at 4294967295 overflowed `first` and
+                // discarded the whole /W2 table.
+                if first > MAX_CID {
+                    break;
+                }
                 let v1 = iter.next()?;
                 let v2 = iter.next()?;
                 map.insert(first, [w, v1, v2]);
@@ -643,3 +688,22 @@ fn read_encoding(object: &Object<'_>, cmap_resolver: &CMapResolverFn) -> Option<
         _ => None,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::read_widths2;
+    use hayro_syntax::object::{Array, FromBytes};
+
+    #[test]
+    fn w2_run_past_the_largest_cid_keeps_the_rest_of_the_table() {
+        let arr =
+            Array::from_bytes(b"[4294967295 [1000 500] 10 [900 450 860] 20 30 800 400 870]")
+                .unwrap();
+        let map = read_widths2(&arr).unwrap();
+
+        assert_eq!(map.get(&4_294_967_295), None);
+        assert_eq!(map.get(&10), Some(&[900.0, 450.0, 860.0]));
+        assert_eq!(map.get(&25), Some(&[800.0, 400.0, 870.0]));
+        assert_eq!(map.len(), 12);
+    }
+}
diff --git a/vendor/hayro-interpret/src/font/mod.rs b/vendor/hayro-interpret/src/font/mod.rs
index 5ccf5c48..37f51f8c 100644
--- a/vendor/hayro-interpret/src/font/mod.rs
+++ b/vendor/hayro-interpret/src/font/mod.rs
@@ -155,7 +155,8 @@ impl OutlineGlyph {
 
     /// Get raw font bytes and metadata for downstream use.
     ///
-    /// Returns `None` for Type1 fonts.
+    /// Returns `None` for Type1 fonts. Craft patch (flatten): Type1C (`FontFile3`) fonts return
+    /// their CFF bytes.
     pub fn font_data(&self) -> Option<OutlineFontData> {
         self.font.font_data()
     }
@@ -444,6 +445,29 @@ impl Encoding {
             Self::BuiltIn => None,
         }
     }
+
+    /// PdfCraft patch: the glyph name an Annex D.2 *alias code* reads as when the glyph is taken
+    /// as text rather than looked up in a font program; `None` for every other code.
+    ///
+    /// Annex D.2 gives WinAnsiEncoding codes 0xA0 and 0xAD the glyph names `space` and `hyphen`,
+    /// the same names it gives 0x20 and 0x2D, and MacRomanEncoding 0xCA `space`. The tables above
+    /// call them `nbspace` and `sfthyphen`, whose Adobe Glyph List values U+00A0 and U+00AD are
+    /// *formatting* characters, so extraction hid ink the reader can see: a soft hyphen is
+    /// invisible, and text that drew one matched no search and no redaction pattern -- one corpus
+    /// file alone produced 104 of them -- while a non-breaking space did not match the space a
+    /// reader typed. pdftotext reads both codes as the ordinary character.
+    ///
+    /// Only the base table is aliased, in the text direction only. A `/Differences` entry naming
+    /// `sfthyphen` or `nbspace` is a deliberate statement and keeps its glyph list value, which
+    /// is what pdftotext does too; and glyph *lookup* is untouched, so a font program's own
+    /// `sfthyphen` program is still found first.
+    fn text_alias(&self, code: u8) -> Option<&'static str> {
+        match (self, code) {
+            (Self::WinAnsi, 0xA0) | (Self::MacRoman, 0xCA) => Some("space"),
+            (Self::WinAnsi, 0xAD) => Some("hyphen"),
+            _ => None,
+        }
+    }
 }
 
 /// The font stretch.
@@ -646,6 +670,49 @@ pub(crate) fn glyph_name_to_unicode(name: &str) -> Option<char> {
     })
 }
 
+/// PdfCraft patch: the text of a glyph name `glyph_name_to_unicode` doesn't know, by the
+/// Adobe Glyph List Specification's full mapping: drop everything from the first `.`
+/// (`hyphen.case`, `a.sc`), split the rest on `_` into components (`f_i`, `f_f_l`), and map each
+/// one through the glyph list, as `uniXXXX[XXXX…]` (BMP values, four hex digits each) or as
+/// `uXXXX` to `uXXXXXX`. A component it can't map, or a `uni` component with any group that
+/// isn't a character, adds nothing; `None` when nothing is left.
+pub(crate) fn glyph_name_to_text(name: &str) -> Option<BfString> {
+    let hex = |h: &str| u32::from_str_radix(h, 16).ok().and_then(char::from_u32);
+    // The specification's digits are uppercase only (`uni20ac` maps to nothing, review on
+    // #3239).
+    let upper_hex = |d: &str| d.bytes().all(|b| matches!(b, b'0'..=b'9' | b'A'..=b'F'));
+    let base = name.split('.').next().unwrap_or_default();
+    let mut text = String::new();
+    for part in base.split('_') {
+        if let Some(s) = glyph_names::get(part) {
+            text.push_str(s);
+        } else if let Some(digits) = part
+            .strip_prefix("uni")
+            .filter(|d| !d.is_empty() && d.len() % 4 == 0 && upper_hex(d))
+        {
+            // All ASCII, so every fourth byte is a char boundary. A group that isn't a
+            // character (a surrogate) makes the whole component map to nothing.
+            let chars: Option<String> = (0..digits.len())
+                .step_by(4)
+                .map(|at| digits.get(at..at + 4).and_then(hex))
+                .collect();
+            text.extend(chars);
+        } else if let Some(c) = part
+            .strip_prefix('u')
+            .filter(|d| (4..=6).contains(&d.len()) && upper_hex(d))
+            .and_then(hex)
+        {
+            text.push(c);
+        }
+    }
+    let mut chars = text.chars();
+    match (chars.next(), chars.next()) {
+        (None, _) => None,
+        (Some(c), None) => Some(BfString::Char(c)),
+        _ => Some(BfString::String(text)),
+    }
+}
+
 pub(crate) fn unicode_from_name(name: &str) -> Option<char> {
     let convert = |input: &str| u32::from_str_radix(input, 16).ok().and_then(char::from_u32);
 
diff --git a/vendor/hayro-interpret/src/font/outline.rs b/vendor/hayro-interpret/src/font/outline.rs
index 558d886c..f46005b9 100644
--- a/vendor/hayro-interpret/src/font/outline.rs
+++ b/vendor/hayro-interpret/src/font/outline.rs
@@ -15,6 +15,11 @@ pub struct OutlineFontData {
     pub data: crate::font::FontData,
     /// Cache key for font deduplication.
     pub cache_key: u128,
+    /// Craft patch (flatten): the face index of `data` in a font collection.
+    pub index: u32,
+    /// Craft patch (flatten): true when `data` comes from the PDF (`FontFile*`); false when it
+    /// is the font resolver's substitute for a font the PDF doesn't embed.
+    pub embedded: bool,
     /// PostScript name (e.g., "TimesNewRomanPS-BoldMT").
     pub postscript_name: Option<String>,
     /// Font weight (100-900, 400=normal, 700=bold).
@@ -119,13 +124,28 @@ impl OutlineFont {
 
     /// Get raw font bytes and metadata.
     ///
-    /// Returns None for Type1 fonts and non-embedded TrueType fonts.
+    /// Returns None for Type1 (`FontFile`), standard and non-embedded simple fonts.
     pub(crate) fn font_data(&self) -> Option<OutlineFontData> {
         match self {
-            Self::Type1(_) => None,
+            // Craft patch (flatten): Type1C (`FontFile3`) fonts hand out their bare CFF bytes.
+            // The font dictionary's descriptive fields are not read.
+            Self::Type1(t) => Some(OutlineFontData {
+                data: t.font_data()?,
+                cache_key: t.cache_key(),
+                index: 0,
+                embedded: true,
+                postscript_name: None,
+                weight: None,
+                is_italic: false,
+                is_serif: false,
+                is_monospace: false,
+            }),
             Self::TrueType(t) => Some(OutlineFontData {
                 data: t.font_data()?,
                 cache_key: t.cache_key(),
+                // Craft patch (flatten): only an embedded `FontFile2`, read as face 0, has bytes.
+                index: 0,
+                embedded: true,
                 postscript_name: t.postscript_name().map(|s| s.to_string()),
                 weight: t.weight(),
                 is_italic: t.is_italic(),
@@ -135,6 +155,9 @@ impl OutlineFont {
             Self::Type0(t) => Some(OutlineFontData {
                 data: t.font_data()?,
                 cache_key: t.cache_key(),
+                // Craft patch (flatten): a substitute from the resolver is not embedded.
+                index: t.font_index(),
+                embedded: t.is_embedded(),
                 postscript_name: t.postscript_name().map(|s| s.to_string()),
                 weight: t.weight(),
                 is_italic: t.is_italic(),
diff --git a/vendor/hayro-interpret/src/font/standard_font.rs b/vendor/hayro-interpret/src/font/standard_font.rs
index c73c75dd..5941160f 100644
--- a/vendor/hayro-interpret/src/font/standard_font.rs
+++ b/vendor/hayro-interpret/src/font/standard_font.rs
@@ -397,7 +397,7 @@ impl StandardKind {
         })
     }
 
-    fn code_to_ps_name(&self, code: u8) -> Option<&str> {
+    pub(crate) fn code_to_ps_name(&self, code: u8) -> Option<&str> {
         let bf = self.base_font;
 
         self.encodings
@@ -445,7 +445,8 @@ impl StandardKind {
     /// PdfCraft patch: the outline of a glyph from [`Self::composite_glyph`] — the base letter,
     /// then the accent centred on it. An accent above a letter taller than `x` is raised by the
     /// difference (the stand-in's accents sit on lowercase letters) and, in an italic font,
-    /// moved along the slant; an ogonek hangs from the letter's right edge.
+    /// moved along the slant; an ogonek hangs from the letter's right edge; a comma below is
+    /// the font's comma, smaller, under the baseline.
     fn composite_outline(&self, glyph: GlyphId) -> Option<BezPath> {
         let code = u8::try_from(glyph.to_u32().checked_sub(COMPOSITE_GLYPH_BASE)?).ok()?;
         let (base, accent, place) = accented_parts(self.code_to_ps_name(code)?)?;
@@ -455,13 +456,27 @@ impl StandardKind {
                 .map(|g| self.base_font_blob.outline_glyph(g))
         };
         let mut path = outline(base)?;
-        let accent = outline(accent)?;
+        let mut accent = outline(accent)?;
         if path.elements().is_empty() || accent.elements().is_empty() {
             return Some(path);
         }
+        if place == Place::CommaBelow {
+            accent = Affine::scale(COMMA_BELOW_SCALE) * accent;
+        }
         let (b, a) = (path.bounding_box(), accent.bounding_box());
         let (dx, dy) = match place {
             Place::Below => (b.center().x - a.center().x, 0.0),
+            Place::CommaBelow => {
+                // Its top a little below the baseline (or the letter's overshoot below it), and
+                // in an italic font moved back along the slant by as much as it is lowered.
+                let dy = b.y0.min(0.0) - COMMA_BELOW_GAP * a.height() - a.y1;
+                let slant = if self.base_font.is_italic() {
+                    dy * ITALIC_ACCENT_SLANT
+                } else {
+                    0.0
+                };
+                (b.center().x - a.center().x + slant, dy)
+            }
             Place::Ogonek => (b.x1 - a.x1, 0.0),
             Place::Above => {
                 let x_top = outline("x")
@@ -546,6 +561,14 @@ impl StandardKind {
     }
 
     pub(crate) fn char_code_to_unicode(&self, code: u8) -> Option<char> {
+        // PdfCraft patch: an Annex D.2 alias code reads as the ordinary character; see
+        // `Encoding::text_alias`. `code_to_ps_name` is shared with glyph lookup and stays as it
+        // is, so the alias is applied here, after `/Differences` has had its say.
+        if !self.encodings.contains_key(&code)
+            && let Some(name) = self.encoding.text_alias(code)
+        {
+            return glyph_name_to_unicode(name);
+        }
         self.code_to_ps_name(code).and_then(glyph_name_to_unicode)
     }
 
@@ -574,12 +597,21 @@ const COMPOSITE_GLYPH_BASE: u32 = 0x0100_0000;
 /// an italic stand-in (tan 15°; the standard italics lean 12° to 16°).
 const ITALIC_ACCENT_SLANT: f64 = 0.27;
 
+/// PdfCraft patch: the size of a comma accent against the font's comma. A full-size comma
+/// moved under the baseline reaches past the descenders and into the line below.
+const COMMA_BELOW_SCALE: f64 = 0.75;
+
+/// PdfCraft patch: the gap between the baseline and a comma accent, as a share of its height.
+const COMMA_BELOW_GAP: f64 = 0.15;
+
 /// Where an accent goes on its base letter.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum Place {
     Above,
     Below,
     Ogonek,
+    /// The font's comma, smaller, under the letter (the stand-ins have no `commaaccent`).
+    CommaBelow,
 }
 
 /// PdfCraft patch: the stand-ins for the standard fonts (PDFium's Foxit fonts) carry only the
@@ -588,7 +620,11 @@ enum Place {
 /// iText 2 writes Turkish text with Times New Roman left unembedded) drew nothing for them. Each of
 /// these Latin Extended-A letters is a base letter the stand-ins have plus one of their accents,
 /// as Type 1 `seac` composites and the composites of the standard-14 AFM files are built.
-/// Letters whose accent isn't a plain one (ď ľ ť and the comma accents) aren't here.
+/// The comma-below letters of Romanian (ș ț) and Latvian (ķ ļ ņ ŗ Ģ) are the base letter and the
+/// font's comma, since the stand-ins have no `commaaccent` either; without them a form laid out
+/// from its XFA template drew Romanian ș as a blank and ț with a cedilla. Letters whose accent
+/// isn't a plain one (ď ľ ť, whose caron is an apostrophe beside the letter, and ģ, whose comma
+/// is turned and above it) aren't here.
 const ACCENTED_LETTERS: &[(&str, &str, &str, Place)] = &[
     ("Amacron", "A", "macron", Place::Above),
     ("amacron", "a", "macron", Place::Above),
@@ -620,6 +656,7 @@ const ACCENTED_LETTERS: &[(&str, &str, &str, Place)] = &[
     ("Gbreve", "G", "breve", Place::Above),
     ("gbreve", "g", "breve", Place::Above),
     ("Gdotaccent", "G", "dotaccent", Place::Above),
+    ("Gcommaaccent", "G", "comma", Place::CommaBelow),
     ("gdotaccent", "g", "dotaccent", Place::Above),
     ("Hcircumflex", "H", "circumflex", Place::Above),
     ("hcircumflex", "h", "circumflex", Place::Above),
@@ -633,10 +670,16 @@ const ACCENTED_LETTERS: &[(&str, &str, &str, Place)] = &[
     ("iogonek", "i", "ogonek", Place::Ogonek),
     ("Idotaccent", "I", "dotaccent", Place::Above),
     ("Jcircumflex", "J", "circumflex", Place::Above),
+    ("Kcommaaccent", "K", "comma", Place::CommaBelow),
+    ("kcommaaccent", "k", "comma", Place::CommaBelow),
     ("Lacute", "L", "acute", Place::Above),
     ("lacute", "l", "acute", Place::Above),
+    ("Lcommaaccent", "L", "comma", Place::CommaBelow),
+    ("lcommaaccent", "l", "comma", Place::CommaBelow),
     ("Nacute", "N", "acute", Place::Above),
     ("nacute", "n", "acute", Place::Above),
+    ("Ncommaaccent", "N", "comma", Place::CommaBelow),
+    ("ncommaaccent", "n", "comma", Place::CommaBelow),
     ("Ncaron", "N", "caron", Place::Above),
     ("ncaron", "n", "caron", Place::Above),
     ("Omacron", "O", "macron", Place::Above),
@@ -647,6 +690,8 @@ const ACCENTED_LETTERS: &[(&str, &str, &str, Place)] = &[
     ("ohungarumlaut", "o", "hungarumlaut", Place::Above),
     ("Racute", "R", "acute", Place::Above),
     ("racute", "r", "acute", Place::Above),
+    ("Rcommaaccent", "R", "comma", Place::CommaBelow),
+    ("rcommaaccent", "r", "comma", Place::CommaBelow),
     ("Rcaron", "R", "caron", Place::Above),
     ("rcaron", "r", "caron", Place::Above),
     ("Sacute", "S", "acute", Place::Above),
@@ -655,8 +700,12 @@ const ACCENTED_LETTERS: &[(&str, &str, &str, Place)] = &[
     ("scircumflex", "s", "circumflex", Place::Above),
     ("Scedilla", "S", "cedilla", Place::Below),
     ("scedilla", "s", "cedilla", Place::Below),
+    ("Scommaaccent", "S", "comma", Place::CommaBelow),
+    ("scommaaccent", "s", "comma", Place::CommaBelow),
     ("Tcedilla", "T", "cedilla", Place::Below),
     ("tcedilla", "t", "cedilla", Place::Below),
+    ("Tcommaaccent", "T", "comma", Place::CommaBelow),
+    ("tcommaaccent", "t", "comma", Place::CommaBelow),
     ("Tcaron", "T", "caron", Place::Above),
     ("Utilde", "U", "tilde", Place::Above),
     ("utilde", "u", "tilde", Place::Above),
@@ -680,8 +729,28 @@ const ACCENTED_LETTERS: &[(&str, &str, &str, Place)] = &[
     ("zdotaccent", "z", "dotaccent", Place::Above),
 ];
 
+/// PdfCraft patch: the comma-below letters of [`ACCENTED_LETTERS`] by character. The glyph list
+/// names the Latvian ones `Kcedilla`… (their comma is a cedilla in Unicode's names), has no name
+/// for Ț ț, and gives `Tcommaaccent` and `tcommaaccent` to Ţ ţ, which keep their cedilla.
+const COMMA_BELOW_BY_CHAR: &[(char, &str)] = &[
+    ('\u{0122}', "Gcommaaccent"),
+    ('\u{0136}', "Kcommaaccent"),
+    ('\u{0137}', "kcommaaccent"),
+    ('\u{013B}', "Lcommaaccent"),
+    ('\u{013C}', "lcommaaccent"),
+    ('\u{0145}', "Ncommaaccent"),
+    ('\u{0146}', "ncommaaccent"),
+    ('\u{0156}', "Rcommaaccent"),
+    ('\u{0157}', "rcommaaccent"),
+    ('\u{0218}', "Scommaaccent"),
+    ('\u{0219}', "scommaaccent"),
+    ('\u{021A}', "Tcommaaccent"),
+    ('\u{021B}', "tcommaaccent"),
+];
+
 /// PdfCraft patch: the base letter, accent and placement of an accented letter in
-/// [`ACCENTED_LETTERS`], by glyph name (`uni011E` and `u011E` forms too).
+/// [`ACCENTED_LETTERS`], by glyph name (`uni011E` and `u011E` forms too). A comma-below letter
+/// is found by its character ([`COMMA_BELOW_BY_CHAR`]), so `/uni0136` and `/Kcedilla` are Ķ too.
 fn accented_parts(name: &str) -> Option<(&'static str, &'static str, Place)> {
     let name = normalized_glyph_name(name);
     let by_name = |n: &str| {
@@ -690,5 +759,11 @@ fn accented_parts(name: &str) -> Option<(&'static str, &'static str, Place)> {
             .find(|(letter, ..)| *letter == n)
             .map(|&(_, base, accent, place)| (base, accent, place))
     };
-    by_name(name).or_else(|| by_name(glyph_names::get_reverse(glyph_name_to_unicode(name)?)?))
+    by_name(name).or_else(|| {
+        let c = glyph_name_to_unicode(name)?;
+        match COMMA_BELOW_BY_CHAR.iter().find(|(letter, _)| *letter == c) {
+            Some((_, comma_below)) => by_name(comma_below),
+            None => by_name(glyph_names::get_reverse(c)?),
+        }
+    })
 }
diff --git a/vendor/hayro-interpret/src/font/true_type.rs b/vendor/hayro-interpret/src/font/true_type.rs
index 40f33590..c6504399 100644
--- a/vendor/hayro-interpret/src/font/true_type.rs
+++ b/vendor/hayro-interpret/src/font/true_type.rs
@@ -2,7 +2,7 @@ use crate::font::blob::{CffFontBlob, OpenTypeFontBlob};
 use crate::font::generated::{glyph_names, mac_os_roman, mac_roman, standard, win_ansi};
 use crate::font::standard_font::StandardKind;
 use crate::font::{
-    Encoding, FallbackFontQuery, FontFlags, glyph_name_to_unicode, read_to_unicode,
+    Encoding, FallbackFontQuery, FontFlags, glyph_name_to_text, glyph_name_to_unicode, read_to_unicode,
     strip_subset_prefix, unicode_from_name,
 };
 use crate::util::OptionLog;
@@ -190,10 +190,11 @@ impl TrueTypeFont {
         }
 
         match &self.kind {
-            Kind::Embedded(e) => e
-                .code_to_unicode_name(code as u8)
-                .and_then(glyph_name_to_unicode)
-                .map(BfString::Char),
+            // PdfCraft patch (#3169): a name outside the glyph list reads by the glyph list
+            // specification's full mapping (`f_i`, `hyphen.case`).
+            Kind::Embedded(e) => e.code_to_unicode_name(code as u8).and_then(|name| {
+                glyph_name_to_unicode(name).map(BfString::Char).or_else(|| glyph_name_to_text(name))
+            }),
             Kind::Standard(s) => s.char_code_to_unicode(code as u8).map(BfString::Char),
         }
 
@@ -286,7 +287,13 @@ impl EmbeddedKind {
         self.differences
             .get(&code)
             .map(|s| s.as_str())
+            // PdfCraft patch: an Annex D.2 alias code reads as the ordinary character; see
+            // `Encoding::text_alias`.
+            .or_else(|| self.encoding.text_alias(code))
             .or_else(|| self.encoding.map_code(code))
+            // The last resort reads the code as WinAnsi whatever the font said, so it takes the
+            // same aliasing.
+            .or_else(|| Encoding::WinAnsi.text_alias(code))
             .or_else(|| win_ansi::get(code))
     }
 
diff --git a/vendor/hayro-interpret/src/font/type1.rs b/vendor/hayro-interpret/src/font/type1.rs
index 32b5e3dd..3f9bac40 100644
--- a/vendor/hayro-interpret/src/font/type1.rs
+++ b/vendor/hayro-interpret/src/font/type1.rs
@@ -2,7 +2,8 @@ use crate::font::blob::{CffFontBlob, Type1FontBlob};
 use crate::font::standard_font::{StandardFont, StandardKind, select_standard_font};
 use crate::font::true_type::{Width, read_encoding, read_widths};
 use crate::font::{
-    Encoding, FallbackFontQuery, glyph_name_to_unicode, normalized_glyph_name, read_to_unicode,
+    Encoding, FallbackFontQuery, glyph_name_to_text, glyph_name_to_unicode, normalized_glyph_name,
+    read_to_unicode,
 };
 use crate::{CMapResolverFn, CacheKey, FontResolverFn};
 use hayro_cmap::{BfString, CMap};
@@ -104,6 +105,15 @@ impl Type1Font {
         }
     }
 
+    /// Craft patch (flatten): the bare CFF bytes of a `FontFile3/Type1C` font, which the glyph
+    /// ids index. Type 1 and standard fonts have none.
+    pub(crate) fn font_data(&self) -> Option<crate::font::FontData> {
+        match &self.1 {
+            Kind::Cff(c) => Some(c.font.font_data()),
+            Kind::Standard(_) | Kind::Type1(_) => None,
+        }
+    }
+
     pub(crate) fn char_code_to_unicode(&self, char_code: u32) -> Option<BfString> {
         if let Some(to_unicode) = &self.2
             && let Some(c) = to_unicode.lookup_bf_string(char_code)
@@ -117,11 +127,25 @@ impl Type1Font {
         }
 
         let code = char_code as u8;
-        match &self.1 {
-            Kind::Standard(s) => s.char_code_to_unicode(code).map(BfString::Char),
-            Kind::Cff(c) => c.char_code_to_unicode(code).map(BfString::Char),
-            Kind::Type1(t) => t.char_code_to_unicode(code).map(BfString::Char),
+        let found = match &self.1 {
+            Kind::Standard(s) => s.char_code_to_unicode(code),
+            Kind::Cff(c) => c.char_code_to_unicode(code),
+            Kind::Type1(t) => t.char_code_to_unicode(code),
+        };
+        if let Some(c) = found {
+            return Some(BfString::Char(c));
         }
+        // PdfCraft patch (#3169, #3170): a name outside the glyph list still reads by the
+        // glyph list specification's full mapping (`f_i`, `hyphen.case`). A name that only
+        // numbers the glyph (`C39`, `c251`) says nothing about the character and reads as
+        // nothing: the code's StandardEncoding character would be a guess, wrong wherever the
+        // font's /Encoding puts the glyph elsewhere (review on #3239).
+        let name = match &self.1 {
+            Kind::Standard(s) => s.code_to_ps_name(code),
+            Kind::Cff(c) => c.code_to_ps_name(code),
+            Kind::Type1(t) => t.code_to_ps_name(code),
+        }?;
+        glyph_name_to_text(name)
     }
 }
 
@@ -239,6 +263,14 @@ impl Type1Kind {
     }
 
     fn char_code_to_unicode(&self, code: u8) -> Option<char> {
+        // PdfCraft patch: an Annex D.2 alias code reads as the ordinary character; see
+        // `Encoding::text_alias`. `code_to_ps_name` is shared with glyph lookup and stays as it
+        // is, so the alias is applied here, after `/Differences` has had its say.
+        if !self.encodings.contains_key(&code)
+            && let Some(name) = self.encoding.text_alias(code)
+        {
+            return glyph_name_to_unicode(name);
+        }
         self.code_to_ps_name(code).and_then(glyph_name_to_unicode)
     }
 }
@@ -336,6 +368,14 @@ impl CffKind {
     }
 
     fn char_code_to_unicode(&self, code: u8) -> Option<char> {
+        // PdfCraft patch: an Annex D.2 alias code reads as the ordinary character; see
+        // `Encoding::text_alias`. `code_to_ps_name` is shared with glyph lookup and stays as it
+        // is, so the alias is applied here, after `/Differences` has had its say.
+        if !self.encodings.contains_key(&code)
+            && let Some(name) = self.encoding.text_alias(code)
+        {
+            return glyph_name_to_unicode(name);
+        }
         self.code_to_ps_name(code).and_then(glyph_name_to_unicode)
     }
 }
diff --git a/vendor/hayro-interpret/src/font/type3.rs b/vendor/hayro-interpret/src/font/type3.rs
index 6824d4ff..216f2618 100644
--- a/vendor/hayro-interpret/src/font/type3.rs
+++ b/vendor/hayro-interpret/src/font/type3.rs
@@ -108,6 +108,9 @@ impl<'a> Type3<'a> {
                     .encodings
                     .get(&code)
                     .map(|s| s.as_str())
+                    // PdfCraft patch: an Annex D.2 alias code reads as the ordinary character;
+                    // see `Encoding::text_alias`.
+                    .or_else(|| self.encoding.text_alias(code))
                     .or_else(|| self.encoding.map_code(code));
                 name.and_then(crate::font::glyph_name_to_unicode)
                     .or_else(|| (0x20..0x7f).contains(&code).then_some(code as char))
@@ -165,9 +168,10 @@ impl<'a> Type3<'a> {
             is_shape_glyph
         };
 
+        // PdfCraft patch: context clips and shading bounds are in device space; FontBBox is in glyph space.
         let mut context = Context::new_with(
             state.ctm,
-            self.font_bbox,
+            root_transform.transform_rect_bbox(self.font_bbox),
             &glyph.cache,
             glyph.xref,
             glyph.settings.clone(),
diff --git a/vendor/hayro-interpret/src/function/type0.rs b/vendor/hayro-interpret/src/function/type0.rs
index 02bbc41b..2b7b3ba9 100644
--- a/vendor/hayro-interpret/src/function/type0.rs
+++ b/vendor/hayro-interpret/src/function/type0.rs
@@ -3,14 +3,18 @@ use hayro_syntax::bit_reader::BitReader;
 use hayro_syntax::object::Array;
 use hayro_syntax::object::Stream;
 use hayro_syntax::object::dict::keys::{BITS_PER_SAMPLE, DECODE, ENCODE, SIZE};
-use smallvec::{SmallVec, ToSmallVec, smallvec};
-use std::collections::HashMap;
+use smallvec::SmallVec;
 
 /// A type 0 function (sampled function).
 #[derive(Debug)]
 pub(crate) struct Type0 {
     sizes: IntVec,
-    table: HashMap<Key, IntVec>,
+    /// PdfCraft patch (31): the samples in stream order, `range.len()` to a grid point, the
+    /// first input varying fastest. They were a hash map keyed by each grid point, built again
+    /// every time a shading using the function was painted.
+    samples: Vec<u32>,
+    /// PdfCraft patch (31): how many grid points one step along each input moves.
+    strides: SmallVec<[usize; 4]>,
     clamper: Clamper,
     range: TupleVec,
     bits_per_sample: u8,
@@ -85,14 +89,22 @@ impl Type0 {
             data.truncate(num_expected_entries);
         }
 
-        let table = build_table(&data, &sizes, range.len())?;
+        // Saturating: the grid has at most `MAX_SAMPLE_ENTRIES` points unless a size is 0, and
+        // then no point is on it (`entry` checks each coordinate against its size first).
+        let mut strides = SmallVec::with_capacity(sizes.len());
+        let mut stride = 1usize;
+        for size in &sizes {
+            strides.push(stride);
+            stride = stride.saturating_mul(*size as usize);
+        }
 
         Some(Self {
             sizes,
             clamper,
             range,
             bits_per_sample,
-            table,
+            samples: data,
+            strides,
             encode,
             decode,
         })
@@ -122,29 +134,16 @@ impl Type0 {
 
         let in_prev = key.iter().map(|v| v.floor() as u32).collect::<IntVec>();
         let in_next = key.iter().map(|v| v.ceil() as u32).collect::<IntVec>();
+        let mut coord: IntVec = in_prev.clone();
 
-        let interpolator = Interpolator::new(
-            key.clone().to_smallvec(),
-            in_prev,
-            in_next,
-            self.sizes.clone(),
-            self.range.len(),
-        );
-
-        let interpolated = interpolator.interpolate(&self.table)?;
+        let interpolated = self.interpolate(&key, &in_prev, &in_next, &mut coord, 0)?;
 
+        // PdfCraft patch (31): `2_u32.pow(32)` overflowed (a panic with overflow checks on).
+        let max_sample = ((1u64 << self.bits_per_sample) - 1) as f32;
         let mut out = interpolated
             .iter()
             .zip(self.decode.iter())
-            .map(|(x, decode)| {
-                interpolate(
-                    *x,
-                    0.0,
-                    (2_u32.pow(self.bits_per_sample as u32) - 1) as f32,
-                    decode.0,
-                    decode.1,
-                )
-            })
+            .map(|(x, decode)| interpolate(*x, 0.0, max_sample, decode.0, decode.1))
             .collect::<SmallVec<_>>();
 
         self.clamper.clamp_output(&mut out);
@@ -157,95 +156,57 @@ type FloatVec = SmallVec<[f32; 4]>;
 type IntVec = SmallVec<[u32; 4]>;
 
 // See <https://github.com/apache/pdfbox/blob/bb778d4784f354c36ce032e91a0cee2169a4c598/pdfbox/src/main/java/org/apache/pdfbox/pdmodel/common/function/PDFunctionType0.java#L252>
-struct Interpolator {
-    input: FloatVec,
-    sizes: IntVec,
-    in_prev: IntVec,
-    in_next: IntVec,
-    out_len: usize,
-}
-
-impl Interpolator {
-    fn new(
-        input: FloatVec,
-        in_prev: IntVec,
-        in_next: IntVec,
-        sizes: IntVec,
-        out_len: usize,
-    ) -> Self {
-        Self {
-            input,
-            in_prev,
-            in_next,
-            sizes,
-            out_len,
-        }
-    }
-
-    fn interpolate(&self, table: &HashMap<Key, IntVec>) -> Option<FloatVec> {
-        self.interpolate_inner(smallvec![0; self.input.len()], 0, table)
-    }
-
-    fn interpolate_inner(
+impl Type0 {
+    /// PdfCraft patch (31): the value at `input` between the grid points `in_prev` and
+    /// `in_next`, interpolating the inputs from `step` on (the earlier ones are placed in
+    /// `coord`). The same multilinear interpolation, in the same order, as the hash-map
+    /// version, so the results are bit for bit the same; one level of recursion per input,
+    /// as before.
+    fn interpolate(
         &self,
-        mut coord: IntVec,
+        input: &[f32],
+        in_prev: &[u32],
+        in_next: &[u32],
+        coord: &mut IntVec,
         step: usize,
-        table: &HashMap<Key, IntVec>,
     ) -> Option<FloatVec> {
-        if step == self.input.len() - 1 {
-            if self.in_prev[step] == self.in_next[step] {
-                coord[step] = self.in_prev[step];
+        let (Some(x), Some(prev), Some(next)) =
+            (input.get(step), in_prev.get(step), in_next.get(step))
+        else {
+            // Every input placed: the grid point itself.
+            return Some(self.entry(coord)?.iter().map(|n| *n as f32).collect());
+        };
+        let (x, prev, next) = (*x, *prev, *next);
 
-                Some(
-                    table
-                        .get(&Key::from_raw(&self.sizes, &coord))?
-                        .clone()
-                        .iter()
-                        .map(|n| *n as f32)
-                        .collect(),
-                )
-            } else {
-                coord[step] = self.in_prev[step];
-                let val1 = table.get(&Key::from_raw(&self.sizes, &coord))?;
-                coord[step] = self.in_next[step];
-                let val2 = table.get(&Key::from_raw(&self.sizes, &coord))?;
-                let mut out = smallvec![0.0; self.out_len];
-
-                for i in 0..self.out_len {
-                    out[i] = interpolate(
-                        self.input[step],
-                        self.in_prev[step] as f32,
-                        self.in_next[step] as f32,
-                        val1[i] as f32,
-                        val2[i] as f32,
-                    );
-                }
-
-                Some(out)
-            }
-        } else if self.in_prev[step] == self.in_next[step] {
-            coord[step] = self.in_prev[step];
-            self.interpolate_inner(coord, step + 1, table)
-        } else {
-            coord[step] = self.in_prev[step];
-            let val1 = self.interpolate_inner(coord.clone(), step + 1, table)?;
-            coord[step] = self.in_next[step];
-            let val2 = self.interpolate_inner(coord, step + 1, table)?;
-
-            let mut out = smallvec![0.0; self.out_len];
-
-            for i in 0..self.out_len {
-                out[i] = interpolate(
-                    self.input[step],
-                    self.in_prev[step] as f32,
-                    self.in_next[step] as f32,
-                    val1[i],
-                    val2[i],
-                );
-            }
-
-            Some(out)
+        *coord.get_mut(step)? = prev;
+        let val1 = self.interpolate(input, in_prev, in_next, coord, step + 1)?;
+        if prev == next {
+            return Some(val1);
         }
+        *coord.get_mut(step)? = next;
+        let val2 = self.interpolate(input, in_prev, in_next, coord, step + 1)?;
+
+        Some(
+            val1.iter()
+                .zip(val2.iter())
+                .map(|(a, b)| interpolate(x, prev as f32, next as f32, *a, *b))
+                .collect(),
+        )
+    }
+
+    /// PdfCraft patch (31): the samples of grid point `coord`, or `None` where it is off the
+    /// grid or the stream ended before it (where the hash map had no entry).
+    fn entry(&self, coord: &[u32]) -> Option<&[u32]> {
+        let mut index = 0usize;
+        for ((c, size), stride) in coord.iter().zip(&self.sizes).zip(&self.strides) {
+            if c >= size {
+                return None;
+            }
+            index = index.checked_add((*c as usize).checked_mul(*stride)?)?;
+        }
+        let n = self.range.len();
+        let start = index.checked_mul(n)?;
+        self.samples.get(start..start.checked_add(n)?)
     }
 }
 
@@ -258,70 +219,23 @@ impl Interpolator {
 const MAX_SAMPLE_VALUES: usize = 1 << 23;
 const MAX_SAMPLE_ENTRIES: usize = 1 << 21;
 
-fn build_table(data: &[u32], sizes: &[u32], n: usize) -> Option<HashMap<Key, IntVec>> {
-    let mut key = Key::new(sizes);
-    let mut table = HashMap::new();
+#[cfg(test)]
+mod tests {
+    use crate::function::Function;
+    use hayro_syntax::object::{FromBytes, Object};
+    use smallvec::smallvec;
 
-    let mut first = true;
+    /// PdfCraft patch (31): 32-bit samples scale by `2^32 - 1` without overflowing (adapted from
+    /// PdfCraft's `raster::tests::sampled_functions_interpolate_their_grid_as_before`).
+    #[test]
+    fn thirty_two_bit_samples_do_not_overflow() {
+        let mut data = b"<< /FunctionType 0 /Domain [0 1] /Range [0 1] /Size [2] /BitsPerSample 32 /Length 8 >>\nstream\n".to_vec();
+        data.extend_from_slice(&[0, 0, 0, 0, 0xff, 0xff, 0xff, 0xff]);
+        data.extend_from_slice(b"\nendstream");
 
-    for b in data.chunks_exact(n) {
-        if !first {
-            key.increment();
-        }
-
-        table.insert(key.clone(), b.to_smallvec());
-
-        first = false;
-    }
-
-    Some(table)
-}
-
-/// A sampled function consists of a (possibly) multi-dimensional table that we can index
-/// into. We do this by representing the entries as a flat list of vectors, where each
-/// element in the vector represents the value of the key in that specific dimension.
-#[derive(Debug, Clone, PartialEq, Eq, Hash)]
-struct Key {
-    sizes: SmallVec<[u32; 4]>,
-    parts: SmallVec<[u32; 4]>,
-}
-
-impl Key {
-    fn new(sizes: &[u32]) -> Self {
-        let parts = smallvec![0; sizes.len()];
-
-        Self {
-            sizes: sizes.to_smallvec(),
-            parts,
-        }
-    }
-
-    fn from_raw(sizes: &[u32], parts: &[u32]) -> Self {
-        Self {
-            sizes: sizes.to_smallvec(),
-            parts: parts.to_smallvec(),
-        }
-    }
-
-    fn increment(&mut self) -> Option<()> {
-        self.increment_index(0)
-    }
-
-    fn increment_index(&mut self, index: usize) -> Option<()> {
-        let size = *self.sizes.get(index).or_else(|| {
-            error!("overflowed key in sampled function");
-
-            None
-        })?;
-        let val = self.parts.get_mut(index)?;
-
-        if *val >= (size - 1) {
-            *val = 0;
-            self.increment_index(index + 1)?;
-        } else {
-            *val += 1;
-        }
-
-        Some(())
+        let object = Object::from_bytes(&data).unwrap();
+        let function = Function::new(&object).unwrap();
+        assert_eq!(function.eval(smallvec![0.0]).unwrap().as_slice(), &[0.0]);
+        assert_eq!(function.eval(smallvec![1.0]).unwrap().as_slice(), &[1.0]);
     }
 }
diff --git a/vendor/hayro-interpret/src/interpret/mod.rs b/vendor/hayro-interpret/src/interpret/mod.rs
index 8af574c3..1e9c0b80 100644
--- a/vendor/hayro-interpret/src/interpret/mod.rs
+++ b/vendor/hayro-interpret/src/interpret/mod.rs
@@ -1,5 +1,5 @@
 use crate::{BlendMode, FillRule};
-use crate::color::ColorSpace;
+use crate::color::{ColorSpace, DefaultColorSpaces, DeviceFamily};
 use crate::context::Context;
 use crate::convert::{convert_line_cap, convert_line_join};
 use crate::device::Device;
@@ -120,6 +120,15 @@ pub struct InterpreterSettings {
     /// costs a decode and a resample each for pixels nobody can see. Never set it for a final
     /// render (tiles, whole pages, print, export).
     pub preview: bool,
+    /// PdfCraft patch (35): draw one ink's separation instead of the composite page (see
+    /// [`Plate`](crate::color::Plate)). Soft masks still draw in colour: a mask's luminosity
+    /// comes from its group's colours, not from the page's plate (a DeviceCMYK luminosity
+    /// mask's from its own process plates, see `SoftMask::plate`). Patch 36: the plate's
+    /// `simulation` converts process colour to an output intent's CMYK.
+    pub plate: Option<crate::color::Plate>,
+    /// PdfCraft patch (35): told about each spot ink a paint uses (colours, images, shadings
+    /// and uncoloured patterns), whether or not `plate` is set.
+    pub ink_sink: Option<crate::color::InkSinkFn>,
 }
 
 impl Default for InterpreterSettings {
@@ -142,6 +151,8 @@ impl Default for InterpreterSettings {
             ocg_overrides: Arc::new(Vec::new()),
             cancelled: None,
             preview: false,
+            plate: None,
+            ink_sink: None,
         }
     }
 }
@@ -175,6 +186,9 @@ pub fn interpret_page<'a>(
     if context.settings.render_annotations
         && let Some(annot_arr) = page.raw().get::<Array<'_>>(ANNOTS)
     {
+        // PdfCraft patch (29): bracket the annotations so devices can tell their paints from
+        // the document's own (the reading-colours setting recolours the document, not comments).
+        device.begin_annotations();
         for annot in annot_arr.iter::<Dict<'_>>() {
             let flags = annot.get::<u32>(F).unwrap_or(0);
 
@@ -275,6 +289,7 @@ pub fn interpret_page<'a>(
                 draw_highlight_without_appearance(&annot, context, device);
             }
         }
+        device.end_annotations();
     }
 }
 
@@ -332,6 +347,30 @@ fn draw_highlight_without_appearance<'a>(
     context.restore_state(device);
 }
 
+/// PdfCraft patch (#3018): the color space `cs` or `CS` selects by `name`: a device space, else
+/// the `/ColorSpace` resource `name`. A device space, named directly or by a resource, is
+/// replaced by its default from `defaults` (ISO 32000-2 §8.6.5.6).
+fn named_color_space<'a>(
+    name: &hayro_syntax::object::Name<'_>,
+    resources: &Resources<'a>,
+    defaults: &DefaultColorSpaces<'_, '_>,
+    context: &mut Context<'a>,
+) -> Option<ColorSpace> {
+    if let Some(named) = ColorSpace::new_from_name(name) {
+        let default = DeviceFamily::of_name(name).and_then(|family| defaults.get(family));
+        return Some(default.map_or(named, |(space, _)| space));
+    }
+    let resource = resources.get_color_space(name);
+    if let Some((space, _)) = resource
+        .as_ref()
+        .and_then(DeviceFamily::of_object)
+        .and_then(|family| defaults.get(family))
+    {
+        return Some(space);
+    }
+    context.get_color_space(resources, name)
+}
+
 /// Interprets the instructions that `ops` yields, until they run out or the caller cancels. It runs
 /// once per window of a content stream, between one `save_state` and its restore (see
 /// `interpret_content`).
@@ -341,6 +380,13 @@ fn interpret_window<'a>(
     context: &mut Context<'a>,
     device: &mut impl Device<'a>,
 ) {
+    // PdfCraft patch (#3018): the resources' DefaultGray, DefaultRGB and DefaultCMYK replace the
+    // device spaces that color operators and images select (ISO 32000-2 §8.6.5.6).
+    let defaults = DefaultColorSpaces::new(
+        resources,
+        &context.interpreter_cache.object_cache,
+        context.settings.plate.is_some(),
+    );
     while let Some(op) = ops.next() {
         // PdfCraft patch: stop when the caller cancelled (see `InterpreterSettings::cancelled`).
         if context.settings.cancelled.as_ref().is_some_and(|c| c.load(Ordering::Relaxed)) {
@@ -349,18 +395,21 @@ fn interpret_window<'a>(
         match op {
             TypedInstruction::SaveState(_) => context.save_state(),
             TypedInstruction::StrokeColorDeviceRgb(s) => {
-                context.get_mut().graphics_state.stroke_cs = ColorSpace::device_rgb();
+                // PdfCraft patch (#3018): DeviceRGB, or the DefaultRGB that replaces it.
+                context.get_mut().graphics_state.stroke_cs = defaults.device(DeviceFamily::Rgb);
                 context.get_mut().graphics_state.stroke_color =
                     smallvec![s.0.as_f32(), s.1.as_f32(), s.2.as_f32()];
                 context.get_mut().graphics_state.stroke_pattern = None;
             }
             TypedInstruction::StrokeColorDeviceGray(s) => {
-                context.get_mut().graphics_state.stroke_cs = ColorSpace::device_gray();
+                // PdfCraft patch (#3018): DeviceGray, or the DefaultGray that replaces it.
+                context.get_mut().graphics_state.stroke_cs = defaults.device(DeviceFamily::Gray);
                 context.get_mut().graphics_state.stroke_color = smallvec![s.0.as_f32()];
                 context.get_mut().graphics_state.stroke_pattern = None;
             }
             TypedInstruction::StrokeColorCmyk(s) => {
-                context.get_mut().graphics_state.stroke_cs = ColorSpace::device_cmyk();
+                // PdfCraft patch (#3018): DeviceCMYK, or the DefaultCMYK that replaces it.
+                context.get_mut().graphics_state.stroke_cs = defaults.device(DeviceFamily::Cmyk);
                 context.get_mut().graphics_state.stroke_color =
                     smallvec![s.0.as_f32(), s.1.as_f32(), s.2.as_f32(), s.3.as_f32()];
                 context.get_mut().graphics_state.stroke_pattern = None;
@@ -424,18 +473,24 @@ fn interpret_window<'a>(
                 fill_stroke_path(context, device, FillRule::NonZero);
             }
             TypedInstruction::NonStrokeColorDeviceGray(s) => {
-                context.get_mut().graphics_state.none_stroke_cs = ColorSpace::device_gray();
+                // PdfCraft patch (#3018): DeviceGray, or the DefaultGray that replaces it.
+                context.get_mut().graphics_state.none_stroke_cs =
+                    defaults.device(DeviceFamily::Gray);
                 context.get_mut().graphics_state.non_stroke_color = smallvec![s.0.as_f32()];
                 context.get_mut().graphics_state.non_stroke_pattern = None;
             }
             TypedInstruction::NonStrokeColorDeviceRgb(s) => {
-                context.get_mut().graphics_state.none_stroke_cs = ColorSpace::device_rgb();
+                // PdfCraft patch (#3018): DeviceRGB, or the DefaultRGB that replaces it.
+                context.get_mut().graphics_state.none_stroke_cs =
+                    defaults.device(DeviceFamily::Rgb);
                 context.get_mut().graphics_state.non_stroke_color =
                     smallvec![s.0.as_f32(), s.1.as_f32(), s.2.as_f32()];
                 context.get_mut().graphics_state.non_stroke_pattern = None;
             }
             TypedInstruction::NonStrokeColorCmyk(s) => {
-                context.get_mut().graphics_state.none_stroke_cs = ColorSpace::device_cmyk();
+                // PdfCraft patch (#3018): DeviceCMYK, or the DefaultCMYK that replaces it.
+                context.get_mut().graphics_state.none_stroke_cs =
+                    defaults.device(DeviceFamily::Cmyk);
                 context.get_mut().graphics_state.non_stroke_color =
                     smallvec![s.0.as_f32(), s.1.as_f32(), s.2.as_f32(), s.3.as_f32()];
                 context.get_mut().graphics_state.non_stroke_pattern = None;
@@ -524,13 +579,9 @@ fn interpret_window<'a>(
                 // Ignore for now.
             }
             TypedInstruction::ColorSpaceStroke(c) => {
-                let cs = if let Some(named) = ColorSpace::new_from_name(c.0) {
-                    named
-                } else {
-                    context
-                        .get_color_space(resources, c.0)
-                        .unwrap_or(ColorSpace::device_gray())
-                };
+                // PdfCraft patch (#3018): see `named_color_space`.
+                let cs = named_color_space(c.0, resources, &defaults, context)
+                    .unwrap_or(ColorSpace::device_gray());
 
                 if !cs.is_pattern() {
                     context.get_mut().graphics_state.stroke_pattern = None;
@@ -539,13 +590,9 @@ fn interpret_window<'a>(
                 context.get_mut().graphics_state.stroke_cs = cs;
             }
             TypedInstruction::ColorSpaceNonStroke(c) => {
-                let cs = if let Some(named) = ColorSpace::new_from_name(c.0) {
-                    named
-                } else {
-                    context
-                        .get_color_space(resources, c.0)
-                        .unwrap_or(ColorSpace::device_gray())
-                };
+                // PdfCraft patch (#3018): see `named_color_space`.
+                let cs = named_color_space(c.0, resources, &defaults, context)
+                    .unwrap_or(ColorSpace::device_gray());
 
                 if !cs.is_pattern() {
                     context.get_mut().graphics_state.non_stroke_pattern = None;
@@ -568,7 +615,7 @@ fn interpret_window<'a>(
                 context.get_mut().graphics_state.non_stroke_pattern = n.1.and_then(|name| {
                     resources
                         .get_pattern(name)
-                        .and_then(|d| Pattern::new(d, context, resources))
+                        .and_then(|d| Pattern::new(d, context, resources, &defaults))
                 });
             }
             TypedInstruction::StrokeColorNamed(n) => {
@@ -577,7 +624,7 @@ fn interpret_window<'a>(
                 context.get_mut().graphics_state.stroke_pattern = n.1.and_then(|name| {
                     resources
                         .get_pattern(name)
-                        .and_then(|d| Pattern::new(d, context, resources))
+                        .and_then(|d| Pattern::new(d, context, resources, &defaults))
                 });
             }
             TypedInstruction::BeginMarkedContentWithProperties(bdc) => {
@@ -778,6 +825,8 @@ fn interpret_window<'a>(
                         &cache,
                         Some(&decoded_cache),
                         transfer_function.clone(),
+                        // PdfCraft patch (#3018): an image in a device space draws in its default.
+                        &defaults,
                     )
                 }) {
                     draw_xobject(&x_object, resources, context, device);
@@ -788,14 +837,17 @@ fn interpret_window<'a>(
                 let transfer_function = context.get().graphics_state.transfer_function.clone();
                 let cache = context.interpreter_cache.object_cache.clone();
                 // PdfCraft patch: inline images are not cached (see `DecodedImageKey`).
+                // PdfCraft patch (#3018): an inline image in a device space, named directly or by a
+                // resource, draws in its default.
                 if let Some(x_object) = ImageXObject::new(
                     i.0,
-                    |name| context.get_color_space(resources, name),
+                    |name| named_color_space(name, resources, &defaults, context),
                     &warning_sink,
                     &cache,
                     None,
                     false,
                     transfer_function,
+                    Some(&defaults),
                 ) {
                     draw_image_xobject(&x_object, context, device);
                 }
@@ -814,9 +866,18 @@ fn interpret_window<'a>(
                     .get_shading(s.0)
                     .and_then(|o| {
                         let (dict, stream) = dict_or_stream(&o)?;
-                        Shading::new(dict, stream, &context.interpreter_cache.object_cache)
+                        // PdfCraft patch (#3018): a shading in a device space draws in its default.
+                        Shading::new(
+                            dict,
+                            stream,
+                            &context.interpreter_cache.object_cache,
+                            &defaults,
+                        )
                     })
-                    .map(|s| {
+                    .map(|mut s| {
+                        // Craft patch (flatten): `sh` ignores `/Background` (ISO 32000-2
+                        // §8.7.4.5.1); only a shading pattern paints it.
+                        s.background = None;
                         Pattern::Shading(ShadingPattern {
                             shading: Arc::new(s),
                             matrix: Affine::IDENTITY,
diff --git a/vendor/hayro-interpret/src/interpret/path.rs b/vendor/hayro-interpret/src/interpret/path.rs
index 838ea099..07d37b2d 100644
--- a/vendor/hayro-interpret/src/interpret/path.rs
+++ b/vendor/hayro-interpret/src/interpret/path.rs
@@ -1,6 +1,8 @@
-use crate::color::{Color, ColorSpace};
+use crate::color::{Color, ColorSpace, InkUse, Plate};
 use crate::context::{Context, path_as_rect};
 use crate::device::Device;
+use crate::interpret::state::PaintData;
+use crate::pattern::Pattern;
 use crate::util::{BezPathExt, Float32Ext};
 use crate::{FillRule, Paint, PathDrawMode, StrokeProps};
 use kurbo::{BezPath, Cap, Join, PathEl};
@@ -74,6 +76,8 @@ pub(crate) fn fill_path_impl<'a>(
     let paint = get_paint(context, false);
     device.set_soft_mask(context.get().graphics_state.soft_mask.clone());
     device.set_blend_mode(context.get().graphics_state.blend_mode);
+    // Craft patch (flatten): tell the device the overprint parameters.
+    set_overprint(context, device);
 
     let mut draw = |path: &BezPath| {
         // pdf.js issue 4260: Replace zero-sized paths with a small stroke instead.
@@ -134,6 +138,8 @@ pub(crate) fn stroke_path_impl<'a>(
     let stroke_props = context.stroke_props();
     device.set_soft_mask(context.get().graphics_state.soft_mask.clone());
     device.set_blend_mode(context.get().graphics_state.blend_mode);
+    // Craft patch (flatten): tell the device the overprint parameters.
+    set_overprint(context, device);
     let paint = get_paint(context, true);
 
     let path = path.unwrap_or(context.path());
@@ -146,6 +152,16 @@ pub(crate) fn stroke_path_impl<'a>(
     }
 }
 
+/// Craft patch (flatten): passes the graphics state's `op`, `OP` and `OPM` to the device.
+pub(crate) fn set_overprint<'a>(context: &Context<'a>, device: &mut impl Device<'a>) {
+    let state = &context.get().graphics_state;
+    device.set_overprint(
+        state.overprint_fill,
+        state.overprint_stroke,
+        state.overprint_mode,
+    );
+}
+
 pub(crate) fn get_paint<'a>(context: &Context<'a>, is_stroke: bool) -> Paint<'a> {
     let data = if is_stroke {
         context.get().stroke_data()
@@ -153,12 +169,32 @@ pub(crate) fn get_paint<'a>(context: &Context<'a>, is_stroke: bool) -> Paint<'a>
         context.get().non_stroke_data()
     };
 
+    // PdfCraft patch (35): report spot inks, and draw separations.
+    if let Some(sink) = &context.settings.ink_sink {
+        data.color_space.report_spots(sink);
+        if let Some(Pattern::Shading(s)) = &data.pattern {
+            s.shading.color_space.report_spots(sink);
+        }
+    }
+    if let Some(plate) = &context.settings.plate {
+        let state = &context.get().graphics_state;
+        let overprint = if is_stroke {
+            state.overprint_stroke
+        } else {
+            state.overprint_fill
+        };
+        return plate_paint(context, data, plate, overprint, state.overprint_mode);
+    }
+
     if data.color_space.is_pattern() || data.pattern.is_some() {
         if let Some(mut pattern) = data.pattern {
             if let Some(tf) = &data.transfer_function {
                 pattern.set_transfer_function(tf.clone());
             }
 
+            // PdfCraft patch (#3246): `CA`/`ca` can be set by a `gs` after `scn`/`SCN`, so the
+            // pattern takes the alpha current at paint time.
+            pattern.set_alpha(data.alpha);
             pattern.pre_concat_transform(context.root_transform());
 
             Paint::Pattern(Box::new(pattern))
@@ -176,3 +212,45 @@ pub(crate) fn get_paint<'a>(context: &Context<'a>, is_stroke: bool) -> Paint<'a>
         }
     }
 }
+
+/// PdfCraft patch (35): the paint `data` as drawn on `plate`: a colour becomes its film, a
+/// shading is converted through the plate, and a paint that leaves the plate as it is (an
+/// overprinting paint that doesn't specify the plate's ink, or the `None` colorant) becomes
+/// transparent. Transfer functions are left out: they act on device colorants, which the
+/// film doesn't model.
+fn plate_paint<'a>(
+    context: &Context<'a>,
+    data: PaintData<'a>,
+    plate: &Plate,
+    overprint: bool,
+    overprint_mode: u8,
+) -> Paint<'a> {
+    let untouched = || Paint::Color(Color::film(0.0, 0.0));
+    if !(data.color_space.is_pattern() || data.pattern.is_some()) {
+        let color = Color::new(data.color_space, data.color, data.alpha);
+        return Paint::Color(color.for_plate(plate, overprint, overprint_mode));
+    }
+    let Some(mut pattern) = data.pattern else {
+        // Pattern was likely invalid, use transparent paint.
+        return untouched();
+    };
+    match &mut pattern {
+        Pattern::Shading(s) => {
+            match s
+                .shading
+                .color_space
+                .ink_use(&plate.ink, plate.spots_as_process)
+            {
+                InkUse::Nothing => return untouched(),
+                InkUse::Unspecified if plate.overprint && overprint => return untouched(),
+                InkUse::Paints | InkUse::Unspecified => {}
+            }
+            std::sync::Arc::make_mut(&mut s.shading).for_plate(plate);
+        }
+        Pattern::Tiling(t) => t.for_plate(plate, overprint, overprint_mode),
+    }
+    // PdfCraft patch (#3246): the alpha current at paint time, as in `get_paint`.
+    pattern.set_alpha(data.alpha);
+    pattern.pre_concat_transform(context.root_transform());
+    Paint::Pattern(Box::new(pattern))
+}
diff --git a/vendor/hayro-interpret/src/interpret/state.rs b/vendor/hayro-interpret/src/interpret/state.rs
index 8488144a..a146d266 100644
--- a/vendor/hayro-interpret/src/interpret/state.rs
+++ b/vendor/hayro-interpret/src/interpret/state.rs
@@ -269,6 +269,12 @@ pub(crate) struct GraphicsState<'a> {
     pub(crate) soft_mask: Option<SoftMask<'a>>,
     pub(crate) transfer_function: Option<ActiveTransferFunction>,
     pub(crate) blend_mode: BlendMode,
+
+    // PdfCraft patch (35): the overprint parameters (ISO 32000-2 §8.6.7, `OP`, `op` and `OPM`
+    // in a graphics state parameter dictionary). They only matter when drawing separations.
+    pub(crate) overprint_stroke: bool,
+    pub(crate) overprint_fill: bool,
+    pub(crate) overprint_mode: u8,
 }
 
 impl Default for GraphicsState<'_> {
@@ -286,6 +292,9 @@ impl Default for GraphicsState<'_> {
             soft_mask: None,
             transfer_function: None,
             blend_mode: BlendMode::default(),
+            overprint_stroke: false,
+            overprint_fill: false,
+            overprint_mode: 0,
         }
     }
 }
@@ -406,6 +415,21 @@ pub(crate) fn handle_gs_single<'a>(
             context.get_mut().graphics_state.stroke_props.dash_array =
                 crate::types::dash_array(dash_array.iter::<f32>());
         }
+        // PdfCraft patch (35): `OP` sets stroking overprint, and non-stroking overprint too when
+        // the dictionary has no `op` of its own; `OPM` is 0 or 1 (§8.6.7).
+        "OP" => {
+            let overprint = dict.get::<bool>(key)?;
+            let state = &mut context.get_mut().graphics_state;
+            state.overprint_stroke = overprint;
+            if !dict.contains_key("op") {
+                state.overprint_fill = overprint;
+            }
+        }
+        "op" => context.get_mut().graphics_state.overprint_fill = dict.get::<bool>(key)?,
+        "OPM" => {
+            let mode = dict.get::<u8>(key)?;
+            context.get_mut().graphics_state.overprint_mode = u8::from(mode == 1);
+        }
         "Type" => {}
         _ => {}
     }
diff --git a/vendor/hayro-interpret/src/interpret/text.rs b/vendor/hayro-interpret/src/interpret/text.rs
index 65a9a279..f9f68b1e 100644
--- a/vendor/hayro-interpret/src/interpret/text.rs
+++ b/vendor/hayro-interpret/src/interpret/text.rs
@@ -127,6 +127,8 @@ fn show_glyph<'a>(
 
     device.set_soft_mask(ctx.get().graphics_state.soft_mask.clone());
     device.set_blend_mode(ctx.get().graphics_state.blend_mode);
+    // Craft patch (flatten): tell the device the overprint parameters.
+    crate::interpret::path::set_overprint(ctx, device);
     let stroke_props = ctx.stroke_props();
 
     // PdfCraft patch: only mode 3 has any effect on text in a Type 3 font (ISO 32000-1
@@ -189,6 +191,16 @@ fn show_glyph<'a>(
         }
         TextRenderingMode::Clip => {
             clip_glyph(ctx, glyph, glyph_transform);
+            // PdfCraft patch (#3116): report clipping text separately from invisible OCR text.
+            // Extraction filters must retain text that is filled through its
+            // clipping path without rendering devices drawing it directly.
+            device.draw_glyph(
+                glyph,
+                ctx.get().ctm,
+                glyph_transform,
+                &get_paint(ctx, false),
+                &GlyphDrawMode::Clip,
+            );
         }
         TextRenderingMode::FillAndClip => {
             clip_glyph(ctx, glyph, glyph_transform);
diff --git a/vendor/hayro-interpret/src/ocg.rs b/vendor/hayro-interpret/src/ocg.rs
index c59b70df..156bda2e 100644
--- a/vendor/hayro-interpret/src/ocg.rs
+++ b/vendor/hayro-interpret/src/ocg.rs
@@ -1,9 +1,14 @@
-use hayro_syntax::object::dict::keys::{BASE_STATE, D, OCGS, OCMD, OCPROPERTIES, OFF, ON, P, TYPE};
-use hayro_syntax::object::{Array, Dict, Name, ObjectIdentifier};
+use hayro_syntax::object::dict::keys::{
+    BASE_STATE, D, OCGS, OCMD, OCPROPERTIES, OFF, ON, P, TYPE, VE,
+};
+use hayro_syntax::object::{Array, Dict, MaybeRef, Name, Object, ObjectIdentifier};
 use std::collections::HashSet;
 
 pub(crate) struct OcgState {
     inactive_ocgs: HashSet<ObjectIdentifier>,
+    /// PdfCraft patch (40): every group the document lists in `/OCProperties /OCGs`, so a
+    /// visibility expression naming anything else is known to be malformed.
+    known_ocgs: HashSet<ObjectIdentifier>,
     visibility_stack: Vec<bool>,
 }
 
@@ -11,6 +16,7 @@ impl OcgState {
     fn dummy() -> Self {
         Self {
             inactive_ocgs: HashSet::default(),
+            known_ocgs: HashSet::default(),
             visibility_stack: vec![],
         }
     }
@@ -25,6 +31,15 @@ impl OcgState {
         };
 
         let mut inactive = HashSet::new();
+        let known: HashSet<ObjectIdentifier> = oc_properties
+            .get::<Array<'_>>(OCGS)
+            .map(|ocgs| {
+                ocgs.raw_iter()
+                    .filter_map(|item| item.as_obj_ref())
+                    .map(Into::into)
+                    .collect()
+            })
+            .unwrap_or_default();
 
         let base_state = config
             .get::<Name<'_>>(BASE_STATE)
@@ -61,6 +76,7 @@ impl OcgState {
 
         Self {
             inactive_ocgs: inactive,
+            known_ocgs: known,
             visibility_stack: Vec::new(),
         }
     }
@@ -72,6 +88,17 @@ impl OcgState {
     }
 
     pub(crate) fn begin_ocmd(&mut self, ocmd: &Dict<'_>) {
+        // PdfCraft patch (40): a visibility expression takes precedence over /OCGs and /P
+        // (ISO 32000-2 §8.11.2.2); a malformed one is ignored and they decide instead.
+        if let Some(visible) = ocmd
+            .get::<Array<'_>>(VE)
+            .and_then(|ve| self.visibility_expression(&ve, 0))
+        {
+            let visible = self.is_visible() && visible;
+            self.visibility_stack.push(visible);
+            return;
+        }
+
         let policy = ocmd
             .get::<Name<'_>>(P)
             .and_then(|n| OcmdPolicy::from_name(n.as_ref()))
@@ -104,6 +131,48 @@ impl OcgState {
         self.visibility_stack.push(visible);
     }
 
+    /// PdfCraft patch (40): evaluate a visibility expression (`/VE`, PDF 1.6): `[/And e…]`,
+    /// `[/Or e…]` or `[/Not e]`, each `e` an optional content group (by reference) or a nested
+    /// expression. `None` for a malformed expression: an unknown operator, a `/Not` without
+    /// exactly one operand, an `/And` or `/Or` without any, an operand that is neither (a
+    /// reference to an object the document doesn't list as a group is neither), or nesting
+    /// deeper than `MAX_VISIBILITY_EXPRESSION_DEPTH`.
+    fn visibility_expression(&self, expr: &Array<'_>, depth: usize) -> Option<bool> {
+        if depth > MAX_VISIBILITY_EXPRESSION_DEPTH {
+            return None;
+        }
+        let mut items = expr.raw_iter();
+        let operator = match items.next()? {
+            MaybeRef::NotRef(Object::Name(name)) => name,
+            _ => return None,
+        };
+        let (mut count, mut all, mut any) = (0usize, true, false);
+        for item in items {
+            let value = match item {
+                MaybeRef::Ref(r) => {
+                    let id: ObjectIdentifier = r.into();
+                    if !self.known_ocgs.contains(&id) {
+                        return None;
+                    }
+                    !self.inactive_ocgs.contains(&id)
+                }
+                MaybeRef::NotRef(Object::Array(nested)) => {
+                    self.visibility_expression(&nested, depth + 1)?
+                }
+                _ => return None,
+            };
+            count = count.saturating_add(1);
+            all &= value;
+            any |= value;
+        }
+        match (operator.as_ref(), count) {
+            (b"And", 1..) => Some(all),
+            (b"Or", 1..) => Some(any),
+            (b"Not", 1) => Some(!all),
+            _ => None,
+        }
+    }
+
     pub(crate) fn begin_ocg(&mut self, props: &Dict<'_>, ref_id: ObjectIdentifier) {
         match props.get::<Name<'_>>(TYPE).as_deref() {
             Some(OCMD) => self.begin_ocmd(props),
@@ -140,6 +209,9 @@ impl Default for OcgState {
     }
 }
 
+/// PdfCraft patch (40): how deep visibility expressions may nest; deeper ones are malformed.
+const MAX_VISIBILITY_EXPRESSION_DEPTH: usize = 32;
+
 #[derive(Debug, PartialEq, Eq, Copy, Clone)]
 enum BaseState {
     On,
diff --git a/vendor/hayro-interpret/src/pattern.rs b/vendor/hayro-interpret/src/pattern.rs
index 3d6d2229..00686161 100644
--- a/vendor/hayro-interpret/src/pattern.rs
+++ b/vendor/hayro-interpret/src/pattern.rs
@@ -1,7 +1,7 @@
 //! PDF patterns.
 
 use crate::cache::Cache;
-use crate::color::{Color, ColorSpace};
+use crate::color::{Color, ColorSpace, DefaultColorSpaces, Plate};
 use crate::context::{Context, InterpreterCache};
 use crate::device::Device;
 use crate::font::Glyph;
@@ -34,16 +34,19 @@ pub enum Pattern<'a> {
 }
 
 impl<'a> Pattern<'a> {
+    /// PdfCraft patch (#3018): `defaults` are those of the resources the pattern is selected
+    /// with, for a shading pattern's shading in a device space.
     pub(crate) fn new(
         object: Object<'a>,
         ctx: &Context<'a>,
         resources: &Resources<'a>,
+        defaults: &DefaultColorSpaces<'_, '_>,
     ) -> Option<Self> {
         match object {
             Object::Dict(dict) => Some(Self::Shading(ShadingPattern::new(
                 &dict,
                 &ctx.interpreter_cache.object_cache,
-                ctx.get().graphics_state.non_stroke_alpha,
+                defaults,
             )?)),
             Object::Stream(stream) => Some(Self::Tiling(Box::new(TilingPattern::new(
                 stream, ctx, resources,
@@ -63,6 +66,29 @@ impl<'a> Pattern<'a> {
         }
     }
 
+    /// PdfCraft patch (46): the pattern without the fill or stroke opacity it captured when it was
+    /// set (`scn`). A stencil mask's transparency group applies the opacity in force when the mask
+    /// is drawn, so a pattern paint carrying it too drew the mask at the opacity squared (#2975).
+    pub(crate) fn without_opacity(mut self) -> Self {
+        match &mut self {
+            Self::Shading(p) => p.opacity = 1.0,
+            Self::Tiling(p) => {
+                p.non_stroking_paint = p.non_stroking_paint.clone().opaque();
+                p.stroke_paint = p.stroke_paint.clone().opaque();
+            }
+        }
+        self
+    }
+
+    /// PdfCraft patch (#3246): set the alpha of the graphics state in effect when the pattern is
+    /// painted. A `gs` can come after `scn`/`SCN`, so the alpha must not be captured when the
+    /// pattern is selected.
+    pub(crate) fn set_alpha(&mut self, alpha: f32) {
+        if let Self::Shading(p) = self {
+            p.opacity = alpha;
+        }
+    }
+
     pub(crate) fn set_transfer_function(&mut self, tf: ActiveTransferFunction) {
         if let Self::Shading(p) = self {
             p.transfer_function = Some(tf);
@@ -93,11 +119,15 @@ pub struct ShadingPattern {
 }
 
 impl ShadingPattern {
-    pub(crate) fn new(dict: &Dict<'_>, cache: &Cache, opacity: f32) -> Option<Self> {
+    pub(crate) fn new(
+        dict: &Dict<'_>,
+        cache: &Cache,
+        defaults: &DefaultColorSpaces<'_, '_>,
+    ) -> Option<Self> {
         let shading = dict.get::<Object<'_>>(SHADING).and_then(|o| {
             let (dict, stream) = dict_or_stream(&o)?;
 
-            Shading::new(dict, stream, cache)
+            Shading::new(dict, stream, cache, defaults)
         })?;
         let matrix = dict
             .get::<[f64; 6]>(MATRIX)
@@ -110,7 +140,8 @@ impl ShadingPattern {
 
         Some(Self {
             shading: Arc::new(shading),
-            opacity,
+            // PdfCraft patch (#3246): `get_paint` sets the alpha current at paint time.
+            opacity: 1.0,
             matrix,
             transfer_function: None,
         })
@@ -147,6 +178,30 @@ pub struct TilingPattern<'a> {
     nesting_depth: u32,
 }
 
+impl TilingPattern<'_> {
+    /// PdfCraft patch (35): an uncoloured pattern draws its cell in the colour it is used
+    /// with, so on a plate it draws that colour's film. A coloured pattern's cell is separated
+    /// as it is drawn.
+    pub(crate) fn for_plate(&mut self, plate: &Plate, overprint: bool, overprint_mode: u8) {
+        if !self.is_color {
+            self.stroke_paint = self
+                .stroke_paint
+                .for_plate(plate, overprint, overprint_mode);
+            self.non_stroking_paint =
+                self.non_stroking_paint
+                    .for_plate(plate, overprint, overprint_mode);
+        }
+        let simulation = plate.simulation.as_ref().map(|s| s.digest());
+        self.cache_key = hash128(&(
+            self.cache_key,
+            &plate.ink,
+            plate.overprint,
+            overprint,
+            simulation,
+        ));
+    }
+}
+
 impl Debug for TilingPattern<'_> {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         f.write_str("TilingPattern")
diff --git a/vendor/hayro-interpret/src/shading.rs b/vendor/hayro-interpret/src/shading.rs
index 98fbb583..98cd68f3 100644
--- a/vendor/hayro-interpret/src/shading.rs
+++ b/vendor/hayro-interpret/src/shading.rs
@@ -4,9 +4,9 @@
 
 use crate::CacheKey;
 use crate::cache::Cache;
-use crate::color::{ColorComponents, ColorSpace};
+use crate::color::{ColorComponents, ColorSpace, DefaultColorSpaces, DeviceFamily};
 use crate::function::{Function, StitchingBounds, Values, interpolate};
-use crate::util::{Float32Ext, PointExt, RectExt};
+use crate::util::{Float32Ext, PointExt, RectExt, hash128};
 use hayro_syntax::bit_reader::BitReader;
 use hayro_syntax::object::Array;
 use hayro_syntax::object::Dict;
@@ -139,12 +139,37 @@ pub struct Shading {
 }
 
 impl Shading {
-    pub(crate) fn new(dict: &Dict<'_>, stream: Option<&Stream<'_>>, cache: &Cache) -> Option<Self> {
-        let cache_key = dict.cache_key();
+    /// PdfCraft patch (35): the shading drawn as `plate`'s plate, through its simulation
+    /// (patch 36).
+    pub(crate) fn for_plate(&mut self, plate: &crate::color::Plate) {
+        self.color_space = self.color_space.plate(plate);
+        let simulation = plate.simulation.as_ref().map(|s| s.digest());
+        self.cache_key = hash128(&(
+            self.cache_key,
+            &plate.ink,
+            simulation,
+            plate.spots_as_process,
+        ));
+    }
 
+    /// PdfCraft patch (#3018): a shading in a device space is drawn in its default color space
+    /// from `defaults`, the resources it is painted with (ISO 32000-2 §8.6.5.6), and keyed by
+    /// it as an image is.
+    pub(crate) fn new(
+        dict: &Dict<'_>,
+        stream: Option<&Stream<'_>>,
+        cache: &Cache,
+        defaults: &DefaultColorSpaces<'_, '_>,
+    ) -> Option<Self> {
         let shading_num = dict.get::<u8>(SHADING_TYPE)?;
 
-        let color_space = ColorSpace::new(dict.get(COLORSPACE)?, cache)?;
+        let color_space_obj = dict.get::<Object<'_>>(COLORSPACE)?;
+        let default =
+            DeviceFamily::of_object(&color_space_obj).and_then(|family| defaults.get(family));
+        let (color_space, cache_key) = match default {
+            Some((space, key)) => (space, hash128(&(dict.cache_key(), key))),
+            None => (ColorSpace::new(color_space_obj, cache)?, dict.cache_key()),
+        };
 
         let shading_type = match shading_num {
             1 => {
@@ -375,6 +400,24 @@ impl Triangle {
         self.kurbo_tri.winding(pos) != 0
     }
 
+    /// PdfCraft patch (#3035): whether the point is inside the triangle or on one of its edges.
+    /// Two triangles of a mesh share an edge; a sample on it belongs to both (their colors
+    /// agree there), where `contains_point` can give it to neither and leave a seam. A
+    /// degenerate triangle covers nothing.
+    pub fn covers(&self, pos: Point) -> bool {
+        // Relative to the barycentric coordinates' scale (1), well above f64 rounding.
+        const EDGE: f64 = 1e-9;
+        let (a, b, c) = (self.p0.point, self.p1.point, self.p2.point);
+        let (v0, v1, v2) = (b - a, c - a, pos - a);
+        let denom = self.d00 * self.d11 - self.d01 * self.d01;
+        let (d20, d21) = (v2.dot(v0), v2.dot(v1));
+        let v = (self.d11 * d20 - self.d01 * d21) / denom;
+        let w = (self.d00 * d21 - self.d01 * d20) / denom;
+        // A degenerate triangle divides by zero: NaN fails every comparison, and infinite
+        // coordinates can't sum to at most one.
+        v >= -EDGE && w >= -EDGE && v + w <= 1.0 + EDGE
+    }
+
     /// Return the bounding box of the triangle.
     pub fn bounding_box(&self) -> kurbo::Rect {
         self.kurbo_tri.bounding_box()
@@ -731,6 +774,10 @@ where
 {
     const GRID_SIZE: usize = 20;
     let mut grid = vec![vec![Point::ZERO; GRID_SIZE]; GRID_SIZE];
+    // PdfCraft patch (33): each grid point's colours, interpolated once. Every cell below
+    // interpolated its four corners itself, so an inner point was interpolated four times
+    // (1,444 interpolations a patch instead of 400) for the same values.
+    let mut colors = vec![vec![ColorComponents::new(); GRID_SIZE]; GRID_SIZE];
 
     // Create grid by mapping unit square coordinates.
     for i in 0..GRID_SIZE {
@@ -741,6 +788,7 @@ where
             // Map unit square coordinate to patch coordinate.
             let unit_point = Point::new(u, v);
             grid[i][j] = map_coordinate(unit_point);
+            colors[i][j] = interpolate(unit_point);
         }
     }
 
@@ -751,32 +799,26 @@ where
             let p01 = grid[i][j + 1];
             let p11 = grid[i + 1][j + 1];
 
-            // Calculate unit square coordinates for color interpolation.
-            let u0 = i as f64 / (GRID_SIZE - 1) as f64;
-            let u1 = (i + 1) as f64 / (GRID_SIZE - 1) as f64;
-            let v0 = j as f64 / (GRID_SIZE - 1) as f64;
-            let v1 = (j + 1) as f64 / (GRID_SIZE - 1) as f64;
-
-            // Create triangle vertices with interpolated colors.
+            // Create triangle vertices with their grid points' colors.
             let v00 = TriangleVertex {
                 flag: 0,
                 point: p00,
-                colors: interpolate(Point::new(u0, v0)),
+                colors: colors[i][j].clone(),
             };
             let v10 = TriangleVertex {
                 flag: 0,
                 point: p10,
-                colors: interpolate(Point::new(u1, v0)),
+                colors: colors[i + 1][j].clone(),
             };
             let v01 = TriangleVertex {
                 flag: 0,
                 point: p01,
-                colors: interpolate(Point::new(u0, v1)),
+                colors: colors[i][j + 1].clone(),
             };
             let v11 = TriangleVertex {
                 flag: 0,
                 point: p11,
-                colors: interpolate(Point::new(u1, v1)),
+                colors: colors[i + 1][j + 1].clone(),
             };
 
             let inflate_point = |p: Point, mid: Point| -> Point {
@@ -786,25 +828,27 @@ where
 
             // Converting to triangles is lossy and can lead to gaps. To make this a bit better,
             // we slightly inflate the triangles.
-            let inflate = |mut triangle: Triangle| {
+            // Craft patch: the inflated triangle is built anew, so its stored dot products
+            // (and `kurbo_tri`) match its vertices; moving the points alone skewed the
+            // barycentric coordinates by about 5 %.
+            let inflate = |triangle: Triangle| {
                 let mid = triangle.kurbo_tri.centroid();
-                triangle.p0.point = inflate_point(triangle.p0.point, mid);
-                triangle.p1.point = inflate_point(triangle.p1.point, mid);
-                triangle.p2.point = inflate_point(triangle.p2.point, mid);
+                let Triangle {
+                    mut p0,
+                    mut p1,
+                    mut p2,
+                    ..
+                } = triangle;
+                p0.point = inflate_point(p0.point, mid);
+                p1.point = inflate_point(p1.point, mid);
+                p2.point = inflate_point(p2.point, mid);
 
-                triangle
+                Triangle::new(p0, p1, p2)
             };
 
-            buffer.push(inflate(Triangle::new(
-                v00.clone(),
-                v10.clone(),
-                v01.clone(),
-            )));
-            buffer.push(inflate(Triangle::new(
-                v10.clone(),
-                v11.clone(),
-                v01.clone(),
-            )));
+            // PdfCraft patch (33): the second triangle takes the vertices the first copied.
+            buffer.push(inflate(Triangle::new(v00, v10.clone(), v01.clone())));
+            buffer.push(inflate(Triangle::new(v10, v11, v01)));
         }
     }
 }
diff --git a/vendor/hayro-interpret/src/soft_mask.rs b/vendor/hayro-interpret/src/soft_mask.rs
index 92cab551..4fdeaac8 100644
--- a/vendor/hayro-interpret/src/soft_mask.rs
+++ b/vendor/hayro-interpret/src/soft_mask.rs
@@ -1,4 +1,4 @@
-use crate::color::{Color, ColorComponents, ColorSpace};
+use crate::color::{CmykSimulation, Color, ColorComponents, ColorSpace, Ink, Plate};
 use crate::context::{Context, InterpreterCache};
 use crate::device::Device;
 use crate::function::Function;
@@ -76,6 +76,10 @@ struct Repr<'a> {
     background: Color,
     xref: &'a XRef,
     nesting_depth: u32,
+    /// Craft patch (CMYK masks): the group's `/CS` is DeviceCMYK.
+    device_cmyk: bool,
+    /// Craft patch (CMYK masks): the page plate's printing condition, for [`SoftMask::plate`].
+    simulation: Option<CmykSimulation>,
 }
 
 impl Hash for Repr<'_> {
@@ -128,6 +132,7 @@ impl<'a> SoftMask<'a> {
             .and_then(|g| g.get::<Object<'_>>(CS))
             .and_then(|o| ColorSpace::new(o, &context.interpreter_cache.object_cache))
             .unwrap_or_else(ColorSpace::device_rgb);
+        let device_cmyk = cs.is_device_cmyk();
         let transfer_function = dict
             .get::<Object<'_>>(TR)
             .and_then(|o| Function::new(&o))
@@ -152,7 +157,13 @@ impl<'a> SoftMask<'a> {
         let root_transform = context.get().ctm;
         let bbox = context.bbox();
         let resources_key = resources_cache_key(&parent_resources);
+        let simulation = context
+            .settings
+            .plate
+            .as_ref()
+            .and_then(|p| p.simulation.clone());
         let cache_key = hash128(&(
+            simulation.as_ref().map(|s| s.digest()),
             dict.cache_key(),
             root_transform.cache_key(),
             [bbox.x0.to_bits(), bbox.y0.to_bits(), bbox.x1.to_bits(), bbox.y1.to_bits()],
@@ -169,14 +180,62 @@ impl<'a> SoftMask<'a> {
             transfer_function,
             bbox: context.bbox(),
             interpreter_cache: context.interpreter_cache.clone(),
-            settings: context.settings.clone(),
+            // PdfCraft patch (35): a mask's luminosity comes from its group's colours, never
+            // from the page's plate, and the inks it uses are never printed.
+            settings: InterpreterSettings {
+                plate: None,
+                ink_sink: None,
+                ..context.settings.clone()
+            },
             xref: context.xref,
             background,
             parent_resources,
             nesting_depth,
+            device_cmyk,
+            simulation,
         })))
     }
 
+    /// Craft patch (CMYK masks): whether the mask group's color space is DeviceCMYK. A
+    /// luminosity mask then takes its values from the group's CMYK by the ISO 32000-2 §10.4.2.2
+    /// formula, `1 - min(1, 0.3c + 0.59m + 0.11y + k)`, rather than from its colors as drawn:
+    /// drawn through a CMYK profile, K 100% is not black.
+    pub fn is_device_cmyk(&self) -> bool {
+        self.0.device_cmyk
+    }
+
+    /// Craft patch (CMYK masks): the plate of process `ink` that the mask group composites on a
+    /// CMYK device, for [`Self::interpret_plate`] and [`Plate::tint`] of the backdrop. Spot
+    /// colorants paint through their alternate space, and nothing overprints.
+    pub fn plate(&self, ink: Ink) -> Plate {
+        Plate {
+            ink,
+            overprint: false,
+            simulation: self.0.simulation.clone(),
+            spots_as_process: true,
+        }
+    }
+
+    /// Craft patch (CMYK masks): interpret the mask's contents as the film of `plate`'s ink
+    /// (see [`Self::plate`]).
+    pub fn interpret_plate(&self, device: &mut impl Device<'a>, plate: Plate) {
+        let state = State::new(self.0.root_transform);
+        let settings = InterpreterSettings {
+            plate: Some(plate),
+            ..self.0.settings.clone()
+        };
+        let mut ctx = Context::new_with(
+            self.0.root_transform,
+            self.0.bbox,
+            &self.0.interpreter_cache,
+            self.0.xref,
+            settings,
+            state,
+            self.0.nesting_depth,
+        );
+        draw_form_xobject(&self.0.parent_resources, &self.0.group, &mut ctx, device);
+    }
+
     /// Interpret the contents of the mask into the given device.
     pub fn interpret(&self, device: &mut impl Device<'a>) {
         let state = State::new(self.0.root_transform);
diff --git a/vendor/hayro-interpret/src/types.rs b/vendor/hayro-interpret/src/types.rs
index ff7776f3..7c46cbc8 100644
--- a/vendor/hayro-interpret/src/types.rs
+++ b/vendor/hayro-interpret/src/types.rs
@@ -106,6 +106,39 @@ impl RasterImage<'_> {
     }
 }
 
+impl RasterImage<'_> {
+    /// Craft patch (flatten): the image's samples as inks, in its own color space (see
+    /// [`InkImage`]); process colour converts through `simulation` where plate mode converts it.
+    pub fn with_inks(
+        &self,
+        simulation: Option<&crate::color::CmykSimulation>,
+        func: impl FnOnce(InkImage),
+    ) {
+        if let Some(image) = crate::x_object::decode_inks(&self.0, simulation) {
+            func(image);
+        }
+    }
+}
+
+/// Craft patch (flatten): a raster image decoded into inks rather than RGB.
+#[derive(Clone)]
+pub struct InkImage {
+    /// The width in samples.
+    pub width: u32,
+    /// The height in samples.
+    pub height: u32,
+    /// What each sample's values are.
+    pub space: crate::color::InkSpace,
+    /// The image's color space (an Indexed space itself, not its base).
+    pub color_space: crate::color::ColorSpace,
+    /// `space.len()` bytes per sample, rows top to bottom, 255 = 1.0.
+    pub samples: Vec<u8>,
+    /// The `/SMask`, `/Mask` or `/SMaskInData` alpha, at its own size.
+    pub alpha: Option<LumaData>,
+    /// As [`RgbData::scale_factors`].
+    pub scale_factors: (f32, f32),
+}
+
 impl CacheKey for RasterImage<'_> {
     fn cache_key(&self) -> u128 {
         self.0.cache_key()
@@ -284,6 +317,8 @@ pub enum GlyphDrawMode {
     Fill,
     /// Draw using a stroke.
     Stroke(StrokeProps),
+    /// PdfCraft patch (#3116): text that shapes a clip; report it without painting a glyph.
+    Clip,
     /// Invisible text (for text extraction but not visual rendering).
     Invisible,
 }
diff --git a/vendor/hayro-interpret/src/x_object.rs b/vendor/hayro-interpret/src/x_object.rs
index 767a54f3..d8f01a30 100644
--- a/vendor/hayro-interpret/src/x_object.rs
+++ b/vendor/hayro-interpret/src/x_object.rs
@@ -1,13 +1,16 @@
 use crate::cache::{Cache, DecodedImageCache, DecodedImageKey};
-use crate::color::{ColorComponents, ColorSpace, ToRgb};
+use crate::color::{
+    CmykSimulation, ColorComponents, ColorSpace, DefaultColorSpaces, DeviceFamily, InkSpace,
+    InkUse, Plate, ToRgb,
+};
 use crate::context::Context;
 use crate::device::Device;
 use crate::function::{Function, interpolate};
-use crate::interpret::path::get_paint;
+use crate::interpret::path::{get_paint, set_overprint};
 use crate::interpret::state::ActiveTransferFunction;
-use crate::{BlendMode, CacheKey, ClipPath, Image, RasterImage, StencilImage};
+use crate::{BlendMode, CacheKey, ClipPath, Image, Paint, RasterImage, StencilImage};
 use crate::{FillRule, InterpreterWarning, WarningSinkFn, interpret};
-use crate::{ImageData, LumaData, RgbData};
+use crate::{ImageData, InkImage, LumaData, RgbData};
 use hayro_syntax::bit_reader::BitReader;
 use hayro_syntax::content::TypedIter;
 use hayro_syntax::object::Array;
@@ -36,6 +39,7 @@ impl<'a> XObject<'a> {
         cache: &Cache,
         decoded_cache: Option<&DecodedImageCache>,
         transfer_function: Option<ActiveTransferFunction>,
+        defaults: &DefaultColorSpaces<'_, '_>,
     ) -> Option<Self> {
         let dict = stream.dict();
         match dict.get::<Name<'_>>(SUBTYPE)?.deref() {
@@ -47,6 +51,7 @@ impl<'a> XObject<'a> {
                 decoded_cache,
                 false,
                 transfer_function,
+                Some(defaults),
             )?)),
             FORM => Some(Self::FormXObject(FormXObject::new(stream)?)),
             _ => None,
@@ -60,6 +65,9 @@ pub(crate) struct FormXObject<'a> {
     pub(crate) matrix: Affine,
     pub(crate) bbox: [f32; 4],
     is_transparency_group: bool,
+    // PdfCraft patch: the group's /I and /K (ISO 32000-2 §11.6.6, both false by default).
+    is_isolated: bool,
+    is_knockout: bool,
     pub(crate) dict: Dict<'a>,
     resources: Option<Dict<'a>>,
 }
@@ -77,12 +85,17 @@ impl<'a> FormXObject<'a> {
                 .unwrap_or([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]),
         );
         let bbox = dict.get::<[f32; 4]>(BBOX)?;
-        let is_transparency_group = dict.get::<Dict<'_>>(GROUP).is_some();
+        let group = dict.get::<Dict<'_>>(GROUP);
+        let is_transparency_group = group.is_some();
+        let is_isolated = group.as_ref().and_then(|g| g.get::<bool>(I)).unwrap_or(false);
+        let is_knockout = group.as_ref().and_then(|g| g.get::<bool>(K)).unwrap_or(false);
 
         Some(Self {
             decoded,
             matrix,
             is_transparency_group,
+            is_isolated,
+            is_knockout,
             bbox,
             dict: dict.clone(),
             resources,
@@ -134,7 +147,57 @@ pub(crate) fn draw_form_xobject<'a, 'b>(
     context.pre_concat_affine(x_object.matrix);
     context.push_root_transform();
 
-    if x_object.is_transparency_group {
+    // PdfCraft patch: a transparency group that is neither isolated nor knockout composites
+    // its elements with the backdrop already on the page (§11.4.7), so when it is entered at
+    // full opacity with no soft mask and Normal blending there is nothing for a layer of its
+    // own to add, and drawing straight onto the page is the exact result. A layer here was
+    // wrong, not just slower: a blend mode inside the group (the `/BM /Multiply` of a highlight
+    // appearance written by other editors) saw the layer's transparent backdrop instead of the
+    // text, and the layer then covered the page as an opaque block (#1968). An isolated group
+    // starts from a blank backdrop by definition, and a knockout group or one entered at partial
+    // opacity, under a soft mask or with a blend mode keeps its layer, where the group's
+    // elements still composite with a blank backdrop (an approximation of §11.4.7 for them).
+    let neutral = !x_object.is_isolated && !x_object.is_knockout && {
+        let state = &context.get().graphics_state;
+        state.non_stroke_alpha >= 1.0
+            && state.stroke_alpha >= 1.0
+            && state.soft_mask.is_none()
+            && state.blend_mode == BlendMode::Normal
+    };
+    // Knockout patch (pdfcraft #2974): a group drawn as an element of a knockout group replaces
+    // what that group drew under its shape, the union of its own elements' shapes (pdfcraft #2971).
+    // The shape is cleared by drawing the group's content once in the device's erase mode; the
+    // group then composites over the cleared area in a layer of its own (also when it would
+    // otherwise be drawn straight onto its parent, where its elements would knock each other out).
+    let knockout_element = x_object.is_transparency_group && device.knockout_erase_wanted();
+    if knockout_element {
+        context.save_state();
+        device.begin_knockout_erase();
+        device.push_clip_path(&ClipPath {
+            path: context.get().ctm
+                * Rect::new(
+                    x_object.bbox[0] as f64,
+                    x_object.bbox[1] as f64,
+                    x_object.bbox[2] as f64,
+                    x_object.bbox[3] as f64,
+                )
+                .to_path(0.1),
+            fill: FillRule::NonZero,
+        });
+        interpret(
+            TypedIter::new(x_object.decoded.as_ref()),
+            &Resources::from_scope(x_object.resources.clone(), resources.clone()),
+            context,
+            device,
+        );
+        device.pop_clip_path();
+        device.end_knockout_erase();
+        context.restore_state(device);
+        context.path_mut().truncate(0);
+    }
+    let own_layer = x_object.is_transparency_group && (!neutral || knockout_element);
+
+    if own_layer {
         device.push_transparency_group(
             context.get().graphics_state.non_stroke_alpha,
             std::mem::take(&mut context.get_mut().graphics_state.soft_mask),
@@ -143,6 +206,14 @@ pub(crate) fn draw_form_xobject<'a, 'b>(
 
         context.get_mut().graphics_state.non_stroke_alpha = 1.0;
         context.get_mut().graphics_state.stroke_alpha = 1.0;
+        // Knockout patch (pdfcraft #2974): its elements knock each other out (pdfcraft #2971).
+        if x_object.is_knockout {
+            device.set_knockout();
+        }
+        // Craft patch (flatten): tell the device the group is isolated.
+        if x_object.is_isolated {
+            device.set_isolated();
+        }
     }
 
     device.set_soft_mask(context.get().graphics_state.soft_mask.clone());
@@ -169,7 +240,7 @@ pub(crate) fn draw_form_xobject<'a, 'b>(
 
     device.pop_clip_path();
 
-    if x_object.is_transparency_group {
+    if own_layer {
         device.pop_transparency_group();
     }
 
@@ -200,6 +271,37 @@ pub(crate) fn draw_image_xobject<'a, 'b>(
         return;
     }
 
+    // PdfCraft patch (35): report the image's spot inks, and draw it on a plate. An image
+    // without a colour space takes one from its data (JPEG, JPEG 2000): gray, RGB or CMYK,
+    // all process colour. Images paint with the non-stroking overprint parameter.
+    let raster_cs = if x_object.is_mask {
+        None
+    } else {
+        x_object.color_space.as_ref()
+    };
+    if let (Some(sink), Some(cs)) = (&context.settings.ink_sink, raster_cs) {
+        cs.report_spots(sink);
+    }
+    let mut on_plate = None;
+    if let Some(plate) = &context.settings.plate
+        && !x_object.is_mask
+    {
+        let ink_use = match raster_cs {
+            Some(cs) => cs.ink_use(&plate.ink, plate.spots_as_process),
+            None if plate.ink.process_index().is_some() => InkUse::Paints,
+            None => InkUse::Unspecified,
+        };
+        let overprint = plate.overprint && context.get().graphics_state.overprint_fill;
+        if ink_use == InkUse::Nothing || (ink_use == InkUse::Unspecified && overprint) {
+            if has_oc {
+                context.ocg_state.end_marked_content();
+            }
+            return;
+        }
+        on_plate = Some(x_object.for_plate(plate));
+    }
+    let x_object = on_plate.as_ref().unwrap_or(x_object);
+
     let width = x_object.width as f64;
     let height = x_object.height as f64;
 
@@ -224,6 +326,17 @@ pub(crate) fn draw_image_xobject<'a, 'b>(
         soft_mask = None;
     }
 
+    // Knockout patch (pdfcraft #2974): an image without a mask covers its whole placement
+    // rectangle, so in a knockout group it replaces what the group drew there (pdfcraft #2971). A
+    // stencil's or a masked image's shape is its mask; those composite as before (exact where the
+    // mask is opaque or transparent, which is what masks mostly are). Only an image the device
+    // draws clears: one that doesn't decode (over `MAX_IMAGE_PIXELS`, damaged data) or that it
+    // skips (a preview's tiny image) replaces nothing. The device decides, at its own draw size
+    // (review on #2974: a full-size decode here cost a second decode of every downscaled image).
+    if !x_object.is_mask && !has_alpha && device.in_knockout_group() {
+        device.knockout_image(&RasterImage(x_object.clone()), transform);
+    }
+
     device.push_transparency_group(
         context.get().graphics_state.non_stroke_alpha,
         std::mem::take(&mut soft_mask),
@@ -232,10 +345,22 @@ pub(crate) fn draw_image_xobject<'a, 'b>(
 
     device.set_soft_mask(None);
     device.set_blend_mode(BlendMode::default());
+    // Craft patch (flatten): tell the device the overprint parameters.
+    set_overprint(context, device);
+    // PdfCraft patch (46): the group just pushed applies the fill opacity, so a stencil mask's
+    // paint (the fill color) must not carry it again: at `ca 0.5` a mask was drawn at a
+    // quarter of its opacity (#2975). The alpha is put back below: `restore_state` doesn't
+    // when the saved-state bound skipped the save.
+    let fill_alpha = context.get().graphics_state.non_stroke_alpha;
+    context.get_mut().graphics_state.non_stroke_alpha = 1.0;
 
     let image = if x_object.is_mask {
         Image::Stencil(StencilImage {
-            paint: get_paint(context, false),
+            // A pattern paint keeps the opacity it was set with: drop it too (patch 46).
+            paint: match get_paint(context, false) {
+                Paint::Pattern(pattern) => Paint::Pattern(Box::new(pattern.without_opacity())),
+                paint => paint,
+            },
             image_xobject: x_object.clone(),
         })
     } else {
@@ -245,6 +370,7 @@ pub(crate) fn draw_image_xobject<'a, 'b>(
     device.draw_image(image, transform);
     device.pop_transparency_group();
 
+    context.get_mut().graphics_state.non_stroke_alpha = fill_alpha;
     context.restore_state(device);
 
     if has_oc {
@@ -281,9 +407,28 @@ pub(crate) struct ImageXObject<'a> {
     stream: Stream<'a>,
     transfer_function: Option<ActiveTransferFunction>,
     warning_sink: WarningSinkFn,
+    /// PdfCraft patch (35): the plate the image is drawn on, if any.
+    plate: Option<Plate>,
+    /// PdfCraft patch (#3018): the cache key of the default color space drawn in place of the
+    /// image's device space, if one is.
+    default_space: Option<u128>,
 }
 
 impl<'a> ImageXObject<'a> {
+    /// PdfCraft patch (35): the image drawn on `plate`. Not cached (the cache holds colour
+    /// decodes), and without a transfer function (see `get_paint`).
+    fn for_plate(&self, plate: &Plate) -> Self {
+        Self {
+            plate: Some(plate.clone()),
+            decoded_cache: None,
+            transfer_function: None,
+            ..self.clone()
+        }
+    }
+
+    /// PdfCraft patch (#3018): an image in a device space is drawn in its default color space
+    /// from `defaults`. Masks have none to replace, and `resolve_cs` (an inline image's named
+    /// color space) substitutes its own.
     pub(crate) fn new(
         stream: &Stream<'a>,
         resolve_cs: impl FnOnce(&Name<'_>) -> Option<ColorSpace>,
@@ -292,6 +437,7 @@ impl<'a> ImageXObject<'a> {
         decoded_cache: Option<&DecodedImageCache>,
         mut is_mask: bool,
         transfer_function: Option<ActiveTransferFunction>,
+        defaults: Option<&DefaultColorSpaces<'_, '_>>,
     ) -> Option<Self> {
         let dict = stream.dict();
 
@@ -301,6 +447,7 @@ impl<'a> ImageXObject<'a> {
             .unwrap_or(false);
         is_mask |= is_stencil_mask;
 
+        let mut default_space = None;
         let image_cs = if is_mask {
             // Masks are always single-channel.
             Some(ColorSpace::device_gray())
@@ -309,15 +456,25 @@ impl<'a> ImageXObject<'a> {
                 .get::<Object<'_>>(CS)
                 .or_else(|| dict.get::<Object<'_>>(COLORSPACE));
 
-            cs_obj
-                .clone()
-                .and_then(|c| ColorSpace::new(c, cache))
-                // Inline images can also refer to color spaces by name.
-                .or_else(|| {
-                    cs_obj
-                        .and_then(|c| c.into_name())
-                        .and_then(|n| resolve_cs(&n))
-                })
+            let default = cs_obj
+                .as_ref()
+                .and_then(DeviceFamily::of_object)
+                .zip(defaults)
+                .and_then(|(family, defaults)| defaults.get(family));
+            if let Some((space, key)) = default {
+                default_space = Some(key);
+                Some(space)
+            } else {
+                cs_obj
+                    .clone()
+                    .and_then(|c| ColorSpace::new(c, cache))
+                    // Inline images can also refer to color spaces by name.
+                    .or_else(|| {
+                        cs_obj
+                            .and_then(|c| c.into_name())
+                            .and_then(|n| resolve_cs(&n))
+                    })
+            }
         };
 
         let interpolate = dict
@@ -344,6 +501,8 @@ impl<'a> ImageXObject<'a> {
             stream: stream.clone(),
             is_mask,
             is_stencil_mask,
+            plate: None,
+            default_space,
         })
     }
 
@@ -407,11 +566,30 @@ impl<'a> ImageXObject<'a> {
             is_mask: self.is_mask,
             is_stencil_mask: self.is_stencil_mask,
             interpolate: self.interpolate,
-            target: target_dimension,
+            // PdfCraft patch (#3018): the same image drawn in a default color space or without one.
+            default_space: self.default_space,
+            // PdfCraft patch (32): see `decode_reads_target`.
+            target: if self.decode_reads_target() {
+                target_dimension
+            } else {
+                None
+            },
             preview: cache.preview,
         })
     }
 
+    /// PdfCraft patch (32): whether decoding this image depends on the size it is drawn at.
+    /// Only the JPX filter decodes at a reduced resolution for a target size, in the image
+    /// itself or in the soft mask or mask decoded with it; every other filter decodes the whole
+    /// image whatever the target. Keyed by the target, a scan was decoded again at every zoom
+    /// step and kept once per zoom level; without it, one decode serves them all.
+    fn decode_reads_target(&self) -> bool {
+        let dict = self.stream.dict();
+        uses_jpx(&self.stream)
+            || dict.get::<Stream<'_>>(SMASK).is_some_and(|s| uses_jpx(&s))
+            || dict.get::<Stream<'_>>(MASK).is_some_and(|s| uses_jpx(&s))
+    }
+
     pub(crate) fn width(&self) -> u32 {
         self.width
     }
@@ -440,6 +618,20 @@ fn decoded_mask_size(mask: &DecodedMask) -> usize {
     mask.luma.width as usize * mask.luma.height as usize
 }
 
+/// PdfCraft patch (32): whether `stream` names the JPX filter, as a name or in an array, under
+/// `/Filter` or its inline abbreviation `/F`. Errs towards `true`: a name the decoder would
+/// ignore still counts, which only keeps the target in the key as before.
+fn uses_jpx(stream: &Stream<'_>) -> bool {
+    let dict = stream.dict();
+    let is_jpx = |name: &Name<'_>| name.deref() == JPX_DECODE;
+    [F, FILTER].into_iter().any(|key| {
+        dict.get::<Name<'_>>(key).is_some_and(|name| is_jpx(&name))
+            || dict
+                .get::<Array<'_>>(key)
+                .is_some_and(|filters| filters.iter::<Name<'_>>().any(|name| is_jpx(&name)))
+    })
+}
+
 /// PdfCraft patch: pixel bytes held by a decoded raster image and its mask.
 fn decoded_raster_size(raster: &DecodedRaster) -> usize {
     let image = match &raster.image {
@@ -536,6 +728,11 @@ fn decode_context<'a>(
                 })
         })
         .unwrap_or(ColorSpace::device_gray());
+    // PdfCraft patch (35): on a plate, every sample converts to the ink's film.
+    let color_space = match &obj.plate {
+        Some(plate) => color_space.plate(plate),
+        None => color_space,
+    };
 
     let fallback_bpc = if obj.is_stencil_mask { 1 } else { 8 };
 
@@ -667,23 +864,38 @@ fn decode_raster(
             ctx.bits_per_component,
         )?;
 
-        let mut f32_data = apply_decode_array(
+        // PdfCraft patch (28): an image with few possible pixel values converts each of them once.
+        let mut rgb_data = if let Some(rgb) = rgb_via_lookup(
             &components,
-            &ctx.color_space,
-            ctx.bits_per_component,
-            &ctx.decode_arr,
-        )?;
-
-        fix_image_length(&mut f32_data, ctx.width, &mut height, 0.0, &ctx.color_space)?;
-
-        let mut rgb_data = get_rgb_data(
-            &f32_data,
             ctx.width,
             height,
             ctx.scale_factors,
             &ctx.color_space,
+            ctx.bits_per_component,
+            &ctx.decode_arr,
             obj.interpolate,
-        );
+        ) {
+            height = rgb.height;
+            Some(rgb)
+        } else {
+            let mut f32_data = apply_decode_array(
+                &components,
+                &ctx.color_space,
+                ctx.bits_per_component,
+                &ctx.decode_arr,
+            )?;
+
+            fix_image_length(&mut f32_data, ctx.width, &mut height, 0.0, &ctx.color_space)?;
+
+            get_rgb_data(
+                &f32_data,
+                ctx.width,
+                height,
+                ctx.scale_factors,
+                &ctx.color_space,
+                obj.interpolate,
+            )
+        };
 
         if let Some(transfer_function) = &obj.transfer_function
             && let Some(rgb_data) = &mut rgb_data
@@ -745,6 +957,111 @@ fn decode_raster(
     Some(DecodedRaster { image, alpha })
 }
 
+/// Craft patch (flatten): the image's samples in its own space's inks (see
+/// [`RasterImage::with_inks`](crate::RasterImage::with_inks)): `/Decode` and `/Matte` applied,
+/// process colour converted as [`ColorSpace::ink_values`] does, transfer functions left out
+/// (as on a plate).
+pub(crate) fn decode_inks(
+    obj: &ImageXObject<'_>,
+    simulation: Option<&CmykSimulation>,
+) -> Option<InkImage> {
+    if obj.is_mask {
+        return None;
+    }
+    let mut ctx = decode_context(obj, None)?;
+    let cs = ctx.color_space.clone();
+    let n = cs.components();
+    if n == 0 {
+        return None;
+    }
+    let space = cs.ink_space(simulation);
+    let bpc = ctx.bits_per_component;
+    let mut height = ctx.height;
+    let is_default = ctx.decode_arr == cs.default_decode_arr(bpc as f32);
+    let is_inverted = ctx.decode_arr == cs.inverted_default_decode_arr(bpc as f32);
+    let identity = !cs.is_indexed()
+        && space.len() == n
+        && !matches!(space, InkSpace::Cmyk { converted: true });
+    let matte = obj
+        .stream
+        .dict()
+        .get::<Stream<'_>>(SMASK)
+        .and_then(|s| s.dict().get::<ColorComponents>(MATTE))
+        .filter(|m| m.len() == n && !cs.is_indexed());
+
+    let mut alpha_height = height;
+    let alpha = resolve_alpha(
+        obj,
+        &mut ctx.decoded,
+        None,
+        &cs,
+        bpc,
+        ctx.width,
+        &mut alpha_height,
+        ctx.scale_factors,
+        None,
+    )
+    .flatten();
+    let matte_alpha = alpha
+        .as_ref()
+        .filter(|a| a.width == ctx.width && a.height == height && matte.is_some());
+
+    let samples = if bpc == 8 && identity && (is_default || is_inverted) && matte_alpha.is_none() {
+        let mut data = ctx.decoded.data.into_owned();
+        fix_image_length(&mut data, ctx.width, &mut height, 0, &cs)?;
+        if is_inverted {
+            for b in &mut data {
+                *b = 255 - *b;
+            }
+        }
+        data
+    } else {
+        let mut components = get_components(&ctx.decoded.data, ctx.width, height, &cs, bpc)?;
+        fix_image_length(&mut components, ctx.width, &mut height, 0, &cs)?;
+        let width = space.len();
+        let mut samples = Vec::with_capacity(components.len() / n * width);
+        let mut colors = Vec::new();
+        let mut values = Vec::new();
+        const CHUNK: usize = 1 << 14;
+        for (c, chunk) in components.chunks(CHUNK * n).enumerate() {
+            colors.clear();
+            for pixel in chunk.chunks_exact(n) {
+                let start = colors.len();
+                for (sample, range) in pixel.iter().zip(&ctx.decode_arr) {
+                    colors.push(decode_sample(*sample, bpc, *range));
+                }
+                colors.resize(start + n, 0.0);
+            }
+            if let (Some(matte), Some(alpha)) = (&matte, matte_alpha) {
+                for (k, pixel) in colors.chunks_exact_mut(n).enumerate() {
+                    let a = alpha.data.get(c * CHUNK + k).copied().unwrap_or(255);
+                    if a == 0 {
+                        continue;
+                    }
+                    let a = f32::from(a) / 255.0;
+                    for (v, m) in pixel.iter_mut().zip(matte.iter()) {
+                        *v = m + (*v - m) / a;
+                    }
+                }
+            }
+            values.clear();
+            cs.ink_values(&colors, simulation, &mut values);
+            samples.extend(values.iter().map(|v| (v.clamp(0.0, 1.0) * 255.0 + 0.5) as u8));
+        }
+        samples
+    };
+
+    Some(InkImage {
+        width: ctx.width,
+        height,
+        space,
+        color_space: cs,
+        samples,
+        alpha,
+        scale_factors: ctx.scale_factors,
+    })
+}
+
 fn decode_mask_bytes(
     mut decoded_data: Cow<'_, [u8]>,
     width: u32,
@@ -832,7 +1149,7 @@ fn resolve_alpha(
         .get::<Stream<'_>>(SMASK)
         .or_else(|| dict.get::<Stream<'_>>(MASK))
     {
-        let obj = ImageXObject::new(&s_mask, |_| None, &obj.warning_sink, &obj.cache, obj.decoded_cache.as_ref(), true, None)?;
+        let obj = ImageXObject::new(&s_mask, |_| None, &obj.warning_sink, &obj.cache, obj.decoded_cache.as_ref(), true, None, None)?;
 
         decode_mask(&obj, target_dimension).map(|decoded| decoded.luma)
     } else if let Some(color_key_mask) = dict.get::<SmallVec<[u16; 4]>>(MASK) {
@@ -892,7 +1209,7 @@ fn resolve_matte(
     let mut matte_rgb = [0_u8; 3];
     color_space.convert_f32(&matte, &mut matte_rgb, false);
 
-    let mask_obj = ImageXObject::new(&s_mask, |_| None, &obj.warning_sink, &obj.cache, obj.decoded_cache.as_ref(), true, None)?;
+    let mask_obj = ImageXObject::new(&s_mask, |_| None, &obj.warning_sink, &obj.cache, obj.decoded_cache.as_ref(), true, None, None)?;
     let alpha = decode_mask(&mask_obj, target_dimension)?.luma;
 
     Some((alpha, matte_rgb))
@@ -1034,27 +1351,136 @@ fn apply_decode_array(
     bits_per_component: u8,
     decode: &[(f32, f32)],
 ) -> Option<Vec<f32>> {
-    let interpolate = |n: f32, d_min: f32, d_max: f32| {
-        interpolate(
-            n,
-            0.0,
-            2.0_f32.powi(bits_per_component as i32) - 1.0,
-            d_min,
-            d_max,
-        )
-    };
-
     let mut decoded_arr = vec![];
 
     for pixel in components.chunks(color_space.num_components() as usize) {
-        for (component, (d_min, d_max)) in pixel.iter().zip(decode) {
-            decoded_arr.push(interpolate(*component as f32, *d_min, *d_max));
+        for (component, range) in pixel.iter().zip(decode) {
+            decoded_arr.push(decode_sample(*component, bits_per_component, *range));
         }
     }
 
     Some(decoded_arr)
 }
 
+/// One sample mapped through its `/Decode` range (ISO 32000-2 §8.9.5.2). PdfCraft patch (28):
+/// shared by [`apply_decode_array`] and [`rgb_via_lookup`], so both decode alike.
+fn decode_sample(sample: u16, bits_per_component: u8, (d_min, d_max): (f32, f32)) -> f32 {
+    interpolate(
+        sample as f32,
+        0.0,
+        2.0_f32.powi(bits_per_component as i32) - 1.0,
+        d_min,
+        d_max,
+    )
+}
+
+/// PdfCraft patch (28): the most bits a pixel's samples may hold together for
+/// [`rgb_via_lookup`] (a table of 65,536 colours).
+const MAX_LOOKUP_BITS: usize = 16;
+
+/// PdfCraft patch (28): the RGB of an image whose pixels hold at most [`MAX_LOOKUP_BITS`] bits
+/// of samples, converted once per possible pixel value rather than once per pixel, at the
+/// height `fix_image_length` gives. `None` when the table would not pay off (the image has no
+/// more pixels than it has entries) or does not apply; the caller then converts every pixel.
+///
+/// The colour of a pixel depends only on its own samples, so the result is the per-pixel one,
+/// except where a tint transform gives the wrong number of components. The per-pixel batch then
+/// shifts the colours after that pixel. The table converts each entry on its own
+/// ([`convert_each`]), so a wrong-sized entry changes only itself, and a value the image never
+/// uses cannot change the colour of one it does.
+/// A Separation or DeviceN tint transform is a PDF function, often a PostScript calculator
+/// program: run once per pixel, an 8-bit spot-colour background of 3304 × 4105 took four
+/// seconds and 430 MB to draw; looked up from 256 entries it takes milliseconds.
+#[allow(clippy::too_many_arguments)]
+fn rgb_via_lookup(
+    components: &[u16],
+    width: u32,
+    height: u32,
+    scale_factors: (f32, f32),
+    cs: &ColorSpace,
+    bits_per_component: u8,
+    decode: &[(f32, f32)],
+    interpolate: bool,
+) -> Option<RgbData> {
+    let n = cs.num_components() as usize;
+    let bpc = usize::from(bits_per_component);
+    let bits = bpc.checked_mul(n)?;
+    // `apply_decode_array` decodes only the samples `/Decode` has a range for: leave a short
+    // array to it, and every sample size it doesn't read.
+    if n == 0 || bits == 0 || bits > MAX_LOOKUP_BITS || bpc > 16 || decode.len() < n {
+        return None;
+    }
+    // The length rules of `fix_image_length`: extra samples are dropped; missing ones shorten
+    // the image to the rows begun, the last row padded with decoded zeros.
+    let row_len = usize::try_from(width).ok()?.checked_mul(n)?;
+    let wanted = row_len.checked_mul(usize::try_from(height).ok()?)?;
+    let (height, used) = if wanted <= components.len() {
+        (height, wanted)
+    } else {
+        (u32::try_from(components.len().div_ceil(row_len)).ok()?, components.len())
+    };
+    let pixels = usize::try_from(width).ok()?.checked_mul(usize::try_from(height).ok()?)?;
+    let total = pixels.checked_mul(n)?;
+    let entries = 1usize << bits;
+    if pixels <= entries {
+        return None;
+    }
+
+    // Every possible pixel value, its samples in order, decoded as `apply_decode_array` would.
+    let mask = (1usize << bpc) - 1;
+    let mut table_input = Vec::with_capacity(entries * n);
+    for code in 0..entries {
+        for (k, range) in decode.iter().take(n).enumerate() {
+            let sample = ((code >> (bpc * (n - 1 - k))) & mask) as u16;
+            table_input.push(decode_sample(sample, bits_per_component, *range));
+        }
+    }
+    let mut table = vec![0; entries * 3];
+    convert_each(cs, &table_input, n, &mut table);
+
+    let mut data = vec![0; pixels.checked_mul(3)?];
+    let whole = used / n;
+    let samples = components.get(..whole * n)?;
+    for (pixel, rgb) in samples.chunks_exact(n).zip(data.chunks_exact_mut(3)) {
+        let code = pixel.iter().fold(0usize, |code, s| (code << bpc) | (usize::from(*s) & mask));
+        if let Some(colour) = table.get(code * 3..code * 3 + 3) {
+            rgb.copy_from_slice(colour);
+        }
+    }
+    // The pixels past the samples present (at most a row): converted as before, padding and all.
+    if whole < pixels {
+        let tail: Vec<f32> = (whole * n..total)
+            .map(|i| match (components.get(i), decode.get(i % n)) {
+                (Some(s), Some(range)) if i < used => decode_sample(*s, bits_per_component, *range),
+                _ => 0.0,
+            })
+            .collect();
+        let _ = cs.convert_f32(&tail, data.get_mut(whole * 3..)?, false);
+    }
+
+    Some(RgbData {
+        data,
+        width,
+        height,
+        interpolate,
+        scale_factors,
+    })
+}
+
+/// PdfCraft patch (28): `input`, `n` decoded samples a pixel, converted into `output` (RGB) one
+/// pixel at a time. A Separation or DeviceN tint transform may give more or fewer components
+/// than its alternate space takes (a Type 4 program's count is only warned about): converted as
+/// one batch, such a result shifts every pixel after it; converted alone, it affects only its
+/// own. A failed conversion leaves black, as in `get_rgb_data`.
+fn convert_each(cs: &ColorSpace, input: &[f32], n: usize, output: &mut [u8]) {
+    if n == 0 {
+        return;
+    }
+    for (pixel, rgb) in input.chunks_exact(n).zip(output.chunks_exact_mut(3)) {
+        let _ = cs.convert_f32(pixel, rgb, false);
+    }
+}
+
 /// PdfCraft patch: whether an image or mask of `width` × `height` may be decoded (at most
 /// 2^28 pixels, the renderer's `MAX_IMAGE_PIXELS`).
 pub fn image_size_ok(width: u32, height: u32) -> bool {
diff --git a/vendor/hayro-jbig2/SOURCE.json b/vendor/hayro-jbig2/SOURCE.json
index 6ff0455d..6a972c12 100644
--- a/vendor/hayro-jbig2/SOURCE.json
+++ b/vendor/hayro-jbig2/SOURCE.json
@@ -1,7 +1,7 @@
 {
   "crate": "hayro-jbig2",
   "source_repository": "https://github.com/storytold/pdfcraft",
-  "source_revision": "7437bde378f43856eada40af25b983812e615e8a",
+  "source_revision": "ec0a965074f376a5bf610435948e4e5184bf3299",
   "source_directory": "vendor/hayro-jbig2",
   "files": [
     {
diff --git a/vendor/hayro-postscript/Cargo.lock b/vendor/hayro-postscript/Cargo.lock
new file mode 100644
index 00000000..b95d3415
--- /dev/null
+++ b/vendor/hayro-postscript/Cargo.lock
@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "hayro-postscript"
+version = "0.1.0"
diff --git a/vendor/hayro-postscript/Cargo.toml b/vendor/hayro-postscript/Cargo.toml
new file mode 100644
index 00000000..b1d53c3f
--- /dev/null
+++ b/vendor/hayro-postscript/Cargo.toml
@@ -0,0 +1,70 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2024"
+name = "hayro-postscript"
+version = "0.1.0"
+authors = ["Laurenz Stampfl <laurenz.stampfl@gmail.com>"]
+build = false
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "A lightweight PostScript scanner."
+readme = "README.md"
+license = "Apache-2.0 OR MIT"
+repository = "https://github.com/LaurenzV/hayro"
+resolver = "2"
+
+[lib]
+name = "hayro_postscript"
+path = "src/lib.rs"
+
+[[example]]
+name = "tokenize"
+path = "examples/tokenize.rs"
+
+[lints.clippy]
+collection_is_never_read = "warn"
+dbg_macro = "warn"
+debug_assert_with_mut_call = "warn"
+default_trait_access = "warn"
+doc_markdown = "warn"
+fn_to_numeric_cast_any = "warn"
+infinite_loop = "warn"
+large_stack_arrays = "warn"
+mismatching_type_param_order = "warn"
+negative_feature_names = "warn"
+redundant_feature_names = "warn"
+same_functions_in_if_condition = "warn"
+semicolon_if_nothing_returned = "warn"
+todo = "warn"
+too_many_arguments = "allow"
+unseparated_literal_suffix = "warn"
+use_self = "warn"
+wildcard_dependencies = "warn"
+
+[lints.rust]
+elided_lifetimes_in_paths = "warn"
+keyword_idents_2024 = "forbid"
+missing_docs = "warn"
+non_ascii_idents = "forbid"
+non_local_definitions = "forbid"
+trivial_numeric_casts = "warn"
+unnameable_types = "warn"
+unreachable_pub = "warn"
+unsafe_op_in_unsafe_fn = "forbid"
+unused_import_braces = "warn"
+unused_lifetimes = "warn"
+unused_macro_rules = "warn"
+unused_qualifications = "warn"
diff --git a/vendor/hayro-postscript/Cargo.toml.orig b/vendor/hayro-postscript/Cargo.toml.orig
new file mode 100644
index 00000000..6ba1eed2
--- /dev/null
+++ b/vendor/hayro-postscript/Cargo.toml.orig
@@ -0,0 +1,11 @@
+[package]
+name = "hayro-postscript"
+version = "0.1.0"
+description = "A lightweight PostScript scanner."
+authors = { workspace = true }
+edition = { workspace = true }
+repository = { workspace = true }
+license = { workspace = true }
+
+[lints]
+workspace = true
diff --git a/vendor/hayro-postscript/LICENSE-APACHE b/vendor/hayro-postscript/LICENSE-APACHE
new file mode 100644
index 00000000..4947287f
--- /dev/null
+++ b/vendor/hayro-postscript/LICENSE-APACHE
@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
\ No newline at end of file
diff --git a/vendor/hayro-postscript/LICENSE-MIT b/vendor/hayro-postscript/LICENSE-MIT
new file mode 100644
index 00000000..ae3742de
--- /dev/null
+++ b/vendor/hayro-postscript/LICENSE-MIT
@@ -0,0 +1,7 @@
+Copyright (c) The Hayro Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
\ No newline at end of file
diff --git a/vendor/hayro-postscript/README.md b/vendor/hayro-postscript/README.md
new file mode 100644
index 00000000..3c228271
--- /dev/null
+++ b/vendor/hayro-postscript/README.md
@@ -0,0 +1,30 @@
+# hayro-postscript
+
+[![Crates.io](https://img.shields.io/crates/v/hayro-postscript.svg)](https://crates.io/crates/hayro-postscript)
+[![Documentation](https://docs.rs/hayro-postscript/badge.svg)](https://docs.rs/hayro-postscript)
+
+<!-- cargo-rdme start -->
+
+A lightweight PostScript scanner.
+
+This crate provides a scanner for tokenizing PostScript programs into typed objects.
+It currently only implements a very small subset of the PostScript language, 
+with the main goal of being enough to parse CMAP files, but the scope _might_
+be expanded upon in the future.
+
+The supported types include integers and real numbers, name objects, strings and arrays.
+Unsupported is anything else, including dictionaries, procedures, etc. An error
+will be returned in case any of these is encountered.
+
+### Safety
+This crate forbids unsafe code via a crate-level attribute.
+
+<!-- cargo-rdme end -->
+
+## License
+Licensed under either of
+
+- Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or <http://www.apache.org/licenses/LICENSE-2.0>)
+- MIT license ([LICENSE-MIT](LICENSE-MIT) or <http://opensource.org/licenses/MIT>)
+
+at your option.
diff --git a/vendor/hayro-postscript/SOURCE.json b/vendor/hayro-postscript/SOURCE.json
new file mode 100644
index 00000000..2e4cc5a7
--- /dev/null
+++ b/vendor/hayro-postscript/SOURCE.json
@@ -0,0 +1,123 @@
+{
+  "crate": "hayro-postscript",
+  "source_repository": "https://crates.io/api/v1/crates/hayro-postscript/0.1.0/download",
+  "source_revision": "0.1.0",
+  "source_directory": "hayro-postscript-0.1.0",
+  "source_archive_sha256": "885c5ef0654933139a9b9546fc2c69e18d37f38aa2520f079092b1be18f1fcaa",
+  "upstream_repository": "https://github.com/LaurenzV/hayro",
+  "upstream_revision": "a2354aebaf86f5ab13e5fd6b6b0521306488bf9d",
+  "upstream_directory": "hayro-postscript",
+  "local_patches": [
+    "Skip runs of `<<` and `>>` in a loop in `object::read` instead of recursing once per delimiter, so a long run cannot overflow the stack."
+  ],
+  "files": [
+    {
+      "path": "Cargo.lock",
+      "source_sha256": "9cc223b0396508805ff123d5d067bb9585cb30c1faef3de8ca61e1f6db69147c",
+      "source_git_blob": null,
+      "sha256": "9cc223b0396508805ff123d5d067bb9585cb30c1faef3de8ca61e1f6db69147c"
+    },
+    {
+      "path": "Cargo.toml",
+      "source_sha256": "f4d3a179a58f7d2c8e4cacf86c703f7b0a84198d73dc4d215ceb19022d7f2a8e",
+      "source_git_blob": null,
+      "sha256": "f4d3a179a58f7d2c8e4cacf86c703f7b0a84198d73dc4d215ceb19022d7f2a8e"
+    },
+    {
+      "path": "Cargo.toml.orig",
+      "source_sha256": "1020656196fae16c71159fc28291b6c7244207e783c96c29d073555b0b1986f7",
+      "source_git_blob": null,
+      "sha256": "1020656196fae16c71159fc28291b6c7244207e783c96c29d073555b0b1986f7"
+    },
+    {
+      "path": "LICENSE-APACHE",
+      "source_sha256": "0cec06e0e55fbc3dc5cee4fca9b607f66cb8f4e4dbcf3b3c013594dd156732e9",
+      "source_git_blob": null,
+      "sha256": "0cec06e0e55fbc3dc5cee4fca9b607f66cb8f4e4dbcf3b3c013594dd156732e9"
+    },
+    {
+      "path": "LICENSE-MIT",
+      "source_sha256": "51b50e6120c344dcc146bbd6375ca1c78e079d97c8bea76e67a53d6ff0efebac",
+      "source_git_blob": null,
+      "sha256": "51b50e6120c344dcc146bbd6375ca1c78e079d97c8bea76e67a53d6ff0efebac"
+    },
+    {
+      "path": "README.md",
+      "source_sha256": "67f97360e5229700ae8c5734ececa4a4ed7bdbdb9bc6e5f0eb906cdf704c0448",
+      "source_git_blob": null,
+      "sha256": "67f97360e5229700ae8c5734ececa4a4ed7bdbdb9bc6e5f0eb906cdf704c0448"
+    },
+    {
+      "path": "examples/tokenize.rs",
+      "source_sha256": "349a945efa6aecd04fc774e052408fad16d6e4e0a1e731e03473bbdbc7720188",
+      "source_git_blob": null,
+      "sha256": "349a945efa6aecd04fc774e052408fad16d6e4e0a1e731e03473bbdbc7720188"
+    },
+    {
+      "path": "src/array.rs",
+      "source_sha256": "f271ba0b99889672305a39f7978eed6daf07cc112c5a6bac0f8caa329a25ebca",
+      "source_git_blob": null,
+      "sha256": "f271ba0b99889672305a39f7978eed6daf07cc112c5a6bac0f8caa329a25ebca"
+    },
+    {
+      "path": "src/error.rs",
+      "source_sha256": "aa36f56028af56192ecb76db43bf1be42e47abc317d8cb5a5c98c926dbc41021",
+      "source_git_blob": null,
+      "sha256": "aa36f56028af56192ecb76db43bf1be42e47abc317d8cb5a5c98c926dbc41021"
+    },
+    {
+      "path": "src/lib.rs",
+      "source_sha256": "357a6f5a549cb1a0214f8a00fe529ce0486f566fc7174c8deccd79e8c8e1f8bd",
+      "source_git_blob": null,
+      "sha256": "357a6f5a549cb1a0214f8a00fe529ce0486f566fc7174c8deccd79e8c8e1f8bd"
+    },
+    {
+      "path": "src/name.rs",
+      "source_sha256": "045a46c014b040f26aa07155f99a9251f8e5b5a184b01d5a01b424691dd9cb54",
+      "source_git_blob": null,
+      "sha256": "045a46c014b040f26aa07155f99a9251f8e5b5a184b01d5a01b424691dd9cb54"
+    },
+    {
+      "path": "src/number.rs",
+      "source_sha256": "ba1a75549f35616a1607acb97926aaa6be3e05a1e701a5119f9ac90d40b126e8",
+      "source_git_blob": null,
+      "sha256": "ba1a75549f35616a1607acb97926aaa6be3e05a1e701a5119f9ac90d40b126e8"
+    },
+    {
+      "path": "src/object.rs",
+      "source_sha256": "a1c495be0fe8713ef06eafd0a4e93de50c24f7c9dde0cba9e1914a0602632791",
+      "source_git_blob": null,
+      "sha256": "a6245b15c18c21604bf1ac94dcf2fece11b09e243bb1de17392028e80c8cbae2"
+    },
+    {
+      "path": "src/reader.rs",
+      "source_sha256": "69ef868370f3c64eff9a3c7d92ca7bc24b4b8d644dc52ea7edd6bc7a60bc4c6d",
+      "source_git_blob": null,
+      "sha256": "69ef868370f3c64eff9a3c7d92ca7bc24b4b8d644dc52ea7edd6bc7a60bc4c6d"
+    },
+    {
+      "path": "src/string.rs",
+      "source_sha256": "1c47947beb5ce7c56036d5b115a47e703a5a276cb9f3faf5e9b2a4304e4a518f",
+      "source_git_blob": null,
+      "sha256": "1c47947beb5ce7c56036d5b115a47e703a5a276cb9f3faf5e9b2a4304e4a518f"
+    },
+    {
+      "path": "src/string/ascii_85.rs",
+      "source_sha256": "488ec377a16b409b77135e6baf05c39774951be63f82ef69d7061322d92b16f2",
+      "source_git_blob": null,
+      "sha256": "488ec377a16b409b77135e6baf05c39774951be63f82ef69d7061322d92b16f2"
+    },
+    {
+      "path": "src/string/ascii_hex.rs",
+      "source_sha256": "3f363f8944c4789f0b620367854355d45f9721f505f5ea3c5c20d4b2cc23aa34",
+      "source_git_blob": null,
+      "sha256": "3f363f8944c4789f0b620367854355d45f9721f505f5ea3c5c20d4b2cc23aa34"
+    },
+    {
+      "path": "src/string/literal.rs",
+      "source_sha256": "8633efbb282227512ef506d020ea69d4ef47c549ae9248e7b0d4fcefd2aaf933",
+      "source_git_blob": null,
+      "sha256": "8633efbb282227512ef506d020ea69d4ef47c549ae9248e7b0d4fcefd2aaf933"
+    }
+  ]
+}
diff --git a/vendor/hayro-postscript/examples/tokenize.rs b/vendor/hayro-postscript/examples/tokenize.rs
new file mode 100644
index 00000000..c8cd84d0
--- /dev/null
+++ b/vendor/hayro-postscript/examples/tokenize.rs
@@ -0,0 +1,74 @@
+//! A small example that shows how to tokenize a PostScript program.
+
+#![allow(missing_docs)]
+
+use hayro_postscript::{Number, Object, Scanner};
+use std::env;
+use std::fs;
+use std::process;
+
+fn main() {
+    let path = match env::args().nth(1) {
+        Some(p) => p,
+        None => {
+            eprintln!("Usage: tokenize <file>");
+            process::exit(1);
+        }
+    };
+
+    let data = match fs::read(&path) {
+        Ok(d) => d,
+        Err(e) => {
+            eprintln!("Error reading {path}: {e}");
+            process::exit(1);
+        }
+    };
+
+    let mut scanner = Scanner::new(&data);
+
+    while !scanner.at_end() {
+        match scanner.parse_object() {
+            Ok(object) => {
+                print_object(&object);
+                println!();
+            }
+            Err(e) => eprintln!("Error: {e}"),
+        }
+    }
+}
+
+fn print_object(object: &Object<'_>) {
+    match object {
+        Object::Number(Number::Integer(n)) => print!("Integer({n})"),
+        Object::Number(Number::Real(n)) => print!("Real({n})"),
+        Object::Name(name) => {
+            let kind = if name.is_literal() {
+                "literal"
+            } else {
+                "executable"
+            };
+            let text = name.as_str().unwrap_or("<non-ascii name>");
+            print!("Name({text}, {kind})");
+        }
+        Object::String(s) => {
+            let decoded = s.decode().unwrap_or_else(|_| Vec::new());
+            print!("String({})", String::from_utf8_lossy(&decoded));
+        }
+        Object::Array(arr) => {
+            print!("[");
+            let mut inner = arr.objects();
+            let mut first = true;
+            while !inner.at_end() {
+                if !first {
+                    print!(" ");
+                }
+                first = false;
+                match inner.parse_object() {
+                    Ok(obj) => print_object(&obj),
+                    Err(e) => print!("Error({e})"),
+                }
+            }
+            print!("]");
+        }
+    }
+}
diff --git a/vendor/hayro-postscript/src/array.rs b/vendor/hayro-postscript/src/array.rs
new file mode 100644
index 00000000..b96b3601
--- /dev/null
+++ b/vendor/hayro-postscript/src/array.rs
@@ -0,0 +1,127 @@
+use crate::error::{Error, Result};
+use crate::object;
+use crate::reader::Reader;
+use crate::string;
+
+/// A PostScript array object.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Array<'a> {
+    data: &'a [u8],
+}
+
+impl<'a> Array<'a> {
+    pub(crate) fn new(data: &'a [u8]) -> Self {
+        Self { data }
+    }
+
+    /// Return a [`Scanner`](crate::Scanner) that iterates over the objects inside
+    /// this array.
+    pub fn objects(&self) -> crate::Scanner<'a> {
+        crate::Scanner::new(self.data)
+    }
+}
+
+pub(crate) fn parse<'a>(r: &mut Reader<'a>) -> Result<&'a [u8]> {
+    r.forward_tag(b"[").ok_or(Error::SyntaxError)?;
+
+    let start = r.offset();
+    skip_array(r)?;
+    let end = r.offset() - 1;
+
+    r.range(start..end).ok_or(Error::SyntaxError)
+}
+
+fn skip_array(r: &mut Reader<'_>) -> Result<()> {
+    let mut depth = 1_u32;
+
+    while depth > 0 {
+        match r.peek_byte().ok_or(Error::SyntaxError)? {
+            b'[' => {
+                r.forward();
+                depth += 1;
+            }
+            b']' => {
+                r.forward();
+                depth -= 1;
+            }
+            b'(' => {
+                let _ = string::parse_literal(r).ok_or(Error::SyntaxError)?;
+            }
+            b'<' => {
+                if r.peek_bytes(2) == Some(b"<~") {
+                    let _ = string::parse_ascii85(r).ok_or(Error::SyntaxError)?;
+                } else if r.peek_bytes(2) == Some(b"<<") {
+                    r.forward();
+                    r.forward();
+                } else {
+                    let _ = string::parse_hex(r).ok_or(Error::SyntaxError)?;
+                }
+            }
+            b'%' => object::skip_whitespace_and_comments(r),
+            _ => {
+                r.forward();
+            }
+        }
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn parse_array(input: &[u8]) -> Result<&[u8]> {
+        let mut r = Reader::new(input);
+        parse(&mut r)
+    }
+
+    #[test]
+    fn empty() {
+        assert_eq!(parse_array(b"[]").unwrap(), b"");
+    }
+
+    #[test]
+    fn simple() {
+        assert_eq!(parse_array(b"[1 2 3]").unwrap(), b"1 2 3");
+    }
+
+    #[test]
+    fn nested() {
+        assert_eq!(parse_array(b"[1 [2 3] 4]").unwrap(), b"1 [2 3] 4");
+    }
+
+    #[test]
+    fn with_string() {
+        // The ']' inside the string should not close the array.
+        assert_eq!(parse_array(b"[1 (str]) 2]").unwrap(), b"1 (str]) 2");
+    }
+
+    #[test]
+    fn with_hex_string() {
+        assert_eq!(parse_array(b"[<48> /name]").unwrap(), b"<48> /name");
+    }
+
+    #[test]
+    fn with_ascii85_string() {
+        assert_eq!(parse_array(b"[<~87cURDZ~> 1]").unwrap(), b"<~87cURDZ~> 1");
+    }
+
+    #[test]
+    fn with_comment() {
+        assert_eq!(
+            parse_array(b"[1 % comment with ]\n2]").unwrap(),
+            b"1 % comment with ]\n2"
+        );
+    }
+
+    #[test]
+    fn unterminated() {
+        assert_eq!(parse_array(b"[1 2"), Err(Error::SyntaxError));
+    }
+
+    #[test]
+    fn not_an_array() {
+        assert_eq!(parse_array(b"1 2]"), Err(Error::SyntaxError));
+    }
+}
diff --git a/vendor/hayro-postscript/src/error.rs b/vendor/hayro-postscript/src/error.rs
new file mode 100644
index 00000000..3a2627a1
--- /dev/null
+++ b/vendor/hayro-postscript/src/error.rs
@@ -0,0 +1,30 @@
+//! Error types for the PostScript scanner.
+
+use core::fmt;
+
+/// A specialized [`Result`] type for PostScript scanner operations.
+pub type Result<T> = core::result::Result<T, Error>;
+
+/// An error encountered while scanning a PostScript token stream.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Error {
+    /// A syntax error in the input.
+    SyntaxError,
+    /// A numeric value exceeded implementation limits.
+    LimitCheck,
+    /// An unsupported PostScript type was encountered (like dictionaries or
+    /// procedures, which will be added in the future).
+    UnsupportedType,
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::SyntaxError => f.write_str("syntaxerror"),
+            Self::LimitCheck => f.write_str("limitcheck"),
+            Self::UnsupportedType => f.write_str("unsupported type"),
+        }
+    }
+}
+
+impl core::error::Error for Error {}
diff --git a/vendor/hayro-postscript/src/lib.rs b/vendor/hayro-postscript/src/lib.rs
new file mode 100644
index 00000000..e16d5556
--- /dev/null
+++ b/vendor/hayro-postscript/src/lib.rs
@@ -0,0 +1,179 @@
+/*!
+A lightweight PostScript scanner.
+
+This crate provides a scanner for tokenizing PostScript programs into typed objects.
+It currently only implements a very small subset of the PostScript language,
+with the main goal of being enough to parse CMAP files, but the scope _might_
+be expanded upon in the future.
+
+The supported types include integers and real numbers, name objects, strings and arrays.
+Unsupported is anything else, including dictionaries, procedures, etc. An error
+will be returned in case any of these is encountered.
+
+## Safety
+This crate forbids unsafe code via a crate-level attribute.
+*/
+
+#![no_std]
+#![forbid(unsafe_code)]
+#![allow(missing_docs)]
+
+extern crate alloc;
+
+mod array;
+mod error;
+mod name;
+mod number;
+mod object;
+mod reader;
+mod string;
+
+pub use array::Array;
+pub use error::{Error, Result};
+pub use name::Name;
+pub use number::Number;
+pub use object::Object;
+pub use string::String;
+
+use reader::Reader;
+
+/// A PostScript scanner that parses [`Object`]s from a byte stream.
+pub struct Scanner<'a> {
+    reader: Reader<'a>,
+}
+
+impl<'a> Scanner<'a> {
+    /// Create a new scanner over the given bytes of a PostScript program.
+    pub fn new(data: &'a [u8]) -> Self {
+        Self {
+            reader: Reader::new(data),
+        }
+    }
+
+    /// Returns `true` if there are no more objects to parse.
+    pub fn at_end(&mut self) -> bool {
+        object::at_end(&mut self.reader)
+    }
+
+    /// Parse the next object.
+    pub fn parse_object(&mut self) -> Result<Object<'a>> {
+        object::read(&mut self.reader)
+    }
+
+    /// Parse the next object as a [`Number`].
+    pub fn parse_number(&mut self) -> Result<Number> {
+        match self.parse_object()? {
+            Object::Number(n) => Ok(n),
+            _ => Err(Error::SyntaxError),
+        }
+    }
+
+    /// Parse the next object as a [`Name`].
+    pub fn parse_name(&mut self) -> Result<Name<'a>> {
+        match self.parse_object()? {
+            Object::Name(n) => Ok(n),
+            _ => Err(Error::SyntaxError),
+        }
+    }
+
+    /// Parse the next object as a [`String`].
+    pub fn parse_string(&mut self) -> Result<String<'a>> {
+        match self.parse_object()? {
+            Object::String(s) => Ok(s),
+            _ => Err(Error::SyntaxError),
+        }
+    }
+
+    /// Parse the next object as an [`Array`].
+    pub fn parse_array(&mut self) -> Result<Array<'a>> {
+        match self.parse_object()? {
+            Object::Array(a) => Ok(a),
+            _ => Err(Error::SyntaxError),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cmap_snippet() {
+        let input = br#"/CIDInit /ProcSet findresource begin
+12 dict begin
+begincmap
+/CMapName /Test-H def
+1 begincodespacerange
+<00> <FF>
+endcodespacerange
+2 beginbfchar
+<03> <0041>
+<04> <0042>
+endbfchar
+endcmap"#;
+
+        let mut s = Scanner::new(input);
+
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"CIDInit", true));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"ProcSet", true));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"findresource", false));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"begin", false));
+        assert_eq!(s.parse_number().unwrap(), Number::Integer(12));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"dict", false));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"begin", false));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"begincmap", false));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"CMapName", true));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"Test-H", true));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"def", false));
+        assert_eq!(s.parse_number().unwrap(), Number::Integer(1));
+        assert_eq!(
+            s.parse_name().unwrap(),
+            Name::new(b"begincodespacerange", false)
+        );
+        assert_eq!(s.parse_string().unwrap(), String::from_hex(b"00"));
+        assert_eq!(s.parse_string().unwrap(), String::from_hex(b"FF"));
+        assert_eq!(
+            s.parse_name().unwrap(),
+            Name::new(b"endcodespacerange", false)
+        );
+        assert_eq!(s.parse_number().unwrap(), Number::Integer(2));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"beginbfchar", false));
+        assert_eq!(s.parse_string().unwrap(), String::from_hex(b"03"));
+        assert_eq!(s.parse_string().unwrap(), String::from_hex(b"0041"));
+        assert_eq!(s.parse_string().unwrap(), String::from_hex(b"04"));
+        assert_eq!(s.parse_string().unwrap(), String::from_hex(b"0042"));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"endbfchar", false));
+        assert_eq!(s.parse_name().unwrap(), Name::new(b"endcmap", false));
+        assert!(s.at_end());
+    }
+
+    #[test]
+    fn array_round_trip() {
+        let input = b"[123 /abc (xyz)]";
+        let mut scanner = Scanner::new(input);
+        let arr = scanner.parse_array().unwrap();
+        assert!(scanner.at_end());
+
+        let mut inner = arr.objects();
+        assert_eq!(inner.parse_number().unwrap(), Number::Integer(123));
+        assert_eq!(inner.parse_name().unwrap(), Name::new(b"abc", true));
+        assert_eq!(inner.parse_string().unwrap(), String::from_literal(b"xyz"));
+        assert!(inner.at_end());
+    }
+
+    #[test]
+    fn comments_skipped() {
+        let input = b"% comment\n42 % another\n/Name";
+        let mut scanner = Scanner::new(input);
+
+        assert_eq!(scanner.parse_number().unwrap(), Number::Integer(42));
+        assert_eq!(scanner.parse_name().unwrap(), Name::new(b"Name", true));
+        assert!(scanner.at_end());
+    }
+
+    #[test]
+    fn wrong_type_is_error() {
+        let mut scanner = Scanner::new(b"42 ");
+        assert!(scanner.parse_name().is_err());
+    }
+}
diff --git a/vendor/hayro-postscript/src/name.rs b/vendor/hayro-postscript/src/name.rs
new file mode 100644
index 00000000..ab78e7ba
--- /dev/null
+++ b/vendor/hayro-postscript/src/name.rs
@@ -0,0 +1,191 @@
+use alloc::vec::Vec;
+
+use crate::error::{Error, Result};
+use crate::reader::{Reader, is_regular};
+use crate::string::ascii_hex::decode_hex_digit;
+
+/// A PostScript name object.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Name<'a> {
+    data: &'a [u8],
+    literal: bool,
+}
+
+impl<'a> Name<'a> {
+    pub(crate) fn new(data: &'a [u8], literal: bool) -> Self {
+        Self { data, literal }
+    }
+
+    /// Returns `true` if this is a literal name.
+    pub fn is_literal(&self) -> bool {
+        self.literal
+    }
+
+    /// Returns the name as a string if it is valid UTF-8, or
+    /// `None` if it contains non-ASCII bytes.
+    pub fn as_str(&self) -> Option<&'a str> {
+        core::str::from_utf8(self.data).ok()
+    }
+
+    /// Decode the name into `out`, replacing any previous contents.
+    pub fn decode_into(&self, out: &mut Vec<u8>) -> Result<()> {
+        out.clear();
+
+        // Fast path: no escape sequences.
+        if !self.data.contains(&b'#') {
+            out.extend_from_slice(self.data);
+            return Ok(());
+        }
+
+        // Slow path: Process escape sequences.
+        let mut inner = Reader::new(self.data);
+
+        while let Some(b) = inner.read_byte() {
+            if b == b'#' {
+                let hex = inner.read_bytes(2).ok_or(Error::SyntaxError)?;
+                let hi = decode_hex_digit(hex[0]).ok_or(Error::SyntaxError)?;
+                let lo = decode_hex_digit(hex[1]).ok_or(Error::SyntaxError)?;
+                out.push(hi << 4 | lo);
+            } else {
+                out.push(b);
+            }
+        }
+
+        Ok(())
+    }
+
+    /// Decode the name.
+    pub fn decode(&self) -> Result<Vec<u8>> {
+        let mut out = Vec::new();
+        self.decode_into(&mut out)?;
+        Ok(out)
+    }
+}
+
+pub(crate) fn parse_literal<'a>(r: &mut Reader<'a>) -> Option<&'a [u8]> {
+    r.forward_tag(b"/")?;
+    let start = r.offset();
+    while r.eat(is_regular).is_some() {}
+    r.range(start..r.offset())
+}
+
+pub(crate) fn parse_executable<'a>(r: &mut Reader<'a>) -> Option<&'a [u8]> {
+    let start = r.offset();
+    r.forward_while(is_regular);
+    if r.offset() == start {
+        return None;
+    }
+    r.range(start..r.offset())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn read_literal(input: &[u8]) -> Option<Name<'_>> {
+        let mut r = Reader::new(input);
+        parse_literal(&mut r).map(|d| Name::new(d, true))
+    }
+
+    fn read_executable(input: &[u8]) -> Option<Name<'_>> {
+        let mut r = Reader::new(input);
+        parse_executable(&mut r).map(|d| Name::new(d, false))
+    }
+
+    #[test]
+    fn literal_simple() {
+        let n = read_literal(b"/Name1").unwrap();
+        assert_eq!(n.as_str().unwrap(), "Name1");
+        assert!(n.is_literal());
+    }
+
+    #[test]
+    fn literal_empty_name() {
+        let n = read_literal(b"/").unwrap();
+        assert_eq!(n.as_str().unwrap(), "");
+        assert!(n.is_literal());
+    }
+
+    #[test]
+    fn literal_with_hex_escape() {
+        let n = read_literal(b"/lime#20Green").unwrap();
+        assert_eq!(n.as_str().unwrap(), "lime#20Green");
+        assert_eq!(n.decode().unwrap(), b"lime Green");
+    }
+
+    #[test]
+    fn literal_multiple_hex_escapes() {
+        let n = read_literal(b"/paired#28#29parentheses").unwrap();
+        assert_eq!(n.decode().unwrap(), b"paired()parentheses");
+    }
+
+    #[test]
+    fn literal_special_chars() {
+        let n = read_literal(b"/A;Name_With-Various***Characters?").unwrap();
+        assert_eq!(n.as_str().unwrap(), "A;Name_With-Various***Characters?");
+    }
+
+    #[test]
+    fn literal_stops_at_delimiter() {
+        let mut r = Reader::new(b"/Name(rest");
+        let data = parse_literal(&mut r).unwrap();
+        assert_eq!(data, b"Name");
+        assert_eq!(r.peek_byte(), Some(b'('));
+    }
+
+    #[test]
+    fn literal_stops_at_whitespace() {
+        let mut r = Reader::new(b"/Name rest");
+        let data = parse_literal(&mut r).unwrap();
+        assert_eq!(data, b"Name");
+        assert_eq!(r.peek_byte(), Some(b' '));
+    }
+
+    #[test]
+    fn literal_not_a_name() {
+        assert!(read_literal(b"Name").is_none());
+    }
+
+    #[test]
+    fn executable_simple() {
+        let n = read_executable(b"beginbfchar ").unwrap();
+        assert_eq!(n.as_str().unwrap(), "beginbfchar");
+        assert!(!n.is_literal());
+    }
+
+    #[test]
+    fn executable_stops_at_delimiter() {
+        let mut r = Reader::new(b"def/name");
+        let data = parse_executable(&mut r).unwrap();
+        assert_eq!(data, b"def");
+        assert_eq!(r.peek_byte(), Some(b'/'));
+    }
+
+    #[test]
+    fn executable_at_eof() {
+        let n = read_executable(b"endcmap").unwrap();
+        assert_eq!(n.as_str().unwrap(), "endcmap");
+    }
+
+    #[test]
+    fn executable_empty() {
+        assert!(read_executable(b"").is_none());
+    }
+
+    #[test]
+    fn executable_starts_at_delimiter() {
+        assert!(read_executable(b"(foo)").is_none());
+    }
+
+    #[test]
+    fn decode_no_escapes() {
+        let n = Name::new(b"simple", true);
+        assert_eq!(n.decode().unwrap(), b"simple");
+    }
+
+    #[test]
+    fn decode_with_escapes() {
+        let n = Name::new(b"lime#20Green", true);
+        assert_eq!(n.decode().unwrap(), b"lime Green");
+    }
+}
diff --git a/vendor/hayro-postscript/src/number.rs b/vendor/hayro-postscript/src/number.rs
new file mode 100644
index 00000000..5c6d3ba1
--- /dev/null
+++ b/vendor/hayro-postscript/src/number.rs
@@ -0,0 +1,177 @@
+use crate::error::{Error, Result};
+use crate::reader::{Reader, is_delimiter, is_whitespace};
+
+/// A PostScript number object (integer or real).
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Number {
+    Integer(i32),
+    Real(f32),
+}
+
+impl Number {
+    /// Return the value as an `i32`. Reals are truncated.
+    pub fn as_i32(self) -> i32 {
+        match self {
+            Self::Integer(v) => v,
+            Self::Real(v) => v as i32,
+        }
+    }
+
+    /// Return the value as an `f32`.
+    pub fn as_f32(self) -> f32 {
+        match self {
+            Self::Integer(v) => v as f32,
+            Self::Real(v) => v,
+        }
+    }
+
+    /// Return the value as an `f64`.
+    pub fn as_f64(self) -> f64 {
+        match self {
+            Self::Integer(v) => v as f64,
+            Self::Real(v) => v as f64,
+        }
+    }
+}
+
+fn is_terminated(r: &Reader<'_>) -> bool {
+    match r.peek_byte() {
+        None => true,
+        Some(b) => is_whitespace(b) || is_delimiter(b),
+    }
+}
+
+pub(crate) fn read(r: &mut Reader<'_>) -> Result<Number> {
+    let saved = r.offset();
+
+    // Optional sign.
+    let first = r.peek_byte().ok_or(Error::SyntaxError)?;
+    let has_sign = first == b'+' || first == b'-';
+
+    if has_sign {
+        r.forward();
+    }
+
+    // Consume leading digits.
+    let digit_start = r.offset();
+    r.forward_while(|b| b.is_ascii_digit());
+    let has_digits = r.offset() > digit_start;
+
+    // Check if number is a radix number.
+    if !has_sign && has_digits && r.peek_byte() == Some(b'#') {
+        let base_bytes = r.range(digit_start..r.offset()).ok_or(Error::SyntaxError)?;
+        let base_str = core::str::from_utf8(base_bytes).map_err(|_| Error::SyntaxError)?;
+        let base = base_str.parse::<u32>().map_err(|_| Error::SyntaxError)?;
+
+        if !(2..=36).contains(&base) {
+            return Err(Error::SyntaxError);
+        }
+
+        // Skip `#`.
+        r.forward();
+
+        let num_start = r.offset();
+        r.forward_while(|b| b.is_ascii_alphanumeric());
+
+        if r.offset() == num_start || !is_terminated(r) {
+            return Err(Error::SyntaxError);
+        }
+
+        let num_bytes = r.range(num_start..r.offset()).ok_or(Error::SyntaxError)?;
+        let num_str = core::str::from_utf8(num_bytes).map_err(|_| Error::SyntaxError)?;
+        let value = i32::from_str_radix(num_str, base).map_err(|_| Error::SyntaxError)?;
+
+        return Ok(Number::Integer(value));
+    }
+
+    // Check for real number indicators: `.` or `e`/`E`.
+    let has_dot = r.peek_byte() == Some(b'.');
+
+    if has_dot {
+        r.forward(); // skip '.'
+        r.forward_while(|b| b.is_ascii_digit());
+    }
+
+    // At this point we need at least some digits (before or after the dot).
+    if !has_digits && !has_dot {
+        return Err(Error::SyntaxError);
+    }
+
+    let has_exponent = matches!(r.peek_byte(), Some(b'e' | b'E'));
+    if has_exponent {
+        r.forward();
+
+        // Optional exponent sign.
+        if matches!(r.peek_byte(), Some(b'+' | b'-')) {
+            r.forward();
+        }
+
+        r.forward_while(|b| b.is_ascii_digit());
+    }
+
+    if !is_terminated(r) {
+        return Err(Error::SyntaxError);
+    }
+
+    let token = r.range(saved..r.offset()).ok_or(Error::SyntaxError)?;
+    let str = core::str::from_utf8(token).map_err(|_| Error::SyntaxError)?;
+
+    if has_dot || has_exponent {
+        let value = str.parse::<f32>().map_err(|_| Error::SyntaxError)?;
+
+        Ok(Number::Real(value))
+    } else {
+        if !has_digits {
+            return Err(Error::SyntaxError);
+        }
+
+        let value = str.parse::<i32>().map_err(|_| Error::SyntaxError)?;
+
+        Ok(Number::Integer(value))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn read_num(input: &[u8]) -> Result<Number> {
+        let mut r = Reader::new(input);
+        read(&mut r)
+    }
+
+    #[test]
+    fn signed_integers() {
+        assert_eq!(read_num(b"123 ").unwrap(), Number::Integer(123));
+        assert_eq!(read_num(b"-98 ").unwrap(), Number::Integer(-98));
+        assert_eq!(read_num(b"43445 ").unwrap(), Number::Integer(43445));
+        assert_eq!(read_num(b"0 ").unwrap(), Number::Integer(0));
+        assert_eq!(read_num(b"+17 ").unwrap(), Number::Integer(17));
+    }
+
+    #[test]
+    fn real_numbers() {
+        assert_eq!(read_num(b"-.002 ").unwrap(), Number::Real(-0.002));
+        assert_eq!(read_num(b"34.5 ").unwrap(), Number::Real(34.5));
+        assert_eq!(read_num(b"-3.62 ").unwrap(), Number::Real(-3.62));
+        assert_eq!(read_num(b"123.6e10 ").unwrap(), Number::Real(123.6e10));
+        assert_eq!(read_num(b"1.0E-5 ").unwrap(), Number::Real(1.0E-5));
+        assert_eq!(read_num(b"1E6 ").unwrap(), Number::Real(1E6));
+        assert_eq!(read_num(b"-1. ").unwrap(), Number::Real(-1.0));
+        assert_eq!(read_num(b"0.0 ").unwrap(), Number::Real(0.0));
+    }
+
+    #[test]
+    fn radix_numbers() {
+        assert_eq!(read_num(b"8#1777 ").unwrap(), Number::Integer(0o1777));
+        assert_eq!(read_num(b"16#FFFE ").unwrap(), Number::Integer(0xFFFE));
+        assert_eq!(read_num(b"2#1000 ").unwrap(), Number::Integer(0b1000));
+    }
+
+    #[test]
+    fn invalid() {
+        assert!(read_num(b"abc").is_err());
+        assert!(read_num(b"+abc").is_err());
+        assert!(read_num(b"1a").is_err());
+    }
+}
diff --git a/vendor/hayro-postscript/src/object.rs b/vendor/hayro-postscript/src/object.rs
new file mode 100644
index 00000000..7c200758
--- /dev/null
+++ b/vendor/hayro-postscript/src/object.rs
@@ -0,0 +1,226 @@
+use crate::array::{self, Array};
+use crate::error::{Error, Result};
+use crate::name::{self, Name};
+use crate::number::{self, Number};
+use crate::reader::Reader;
+use crate::string::{self, String};
+
+/// A PostScript object.
+#[derive(Debug, Clone, PartialEq)]
+pub enum Object<'a> {
+    /// A number object.
+    Number(Number),
+    /// A name object.
+    Name(Name<'a>),
+    /// A string object.
+    String(String<'a>),
+    /// An array object.
+    Array(Array<'a>),
+}
+
+pub(crate) fn read<'a>(r: &mut Reader<'a>) -> Result<Object<'a>> {
+    // PdfCraft patch: `<<` and `>>` are skipped by looping instead of
+    // recursing once per delimiter, so a long run cannot overflow the stack.
+    loop {
+        skip_whitespace_and_comments(r);
+
+        let b = r.peek_byte().ok_or(Error::SyntaxError)?;
+
+        return match b {
+            b'(' => string::parse_literal(r)
+                .map(|s| Object::String(String::from_literal(s)))
+                .ok_or(Error::SyntaxError),
+            b'<' => {
+                if r.peek_bytes(2) == Some(b"<~") {
+                    string::parse_ascii85(r)
+                        .map(|s| Object::String(String::from_ascii85(s)))
+                        .ok_or(Error::SyntaxError)
+                } else if r.peek_bytes(2) == Some(b"<<") {
+                    // TODO: Proper dict support. For now, skip `<<` and return
+                    // the next object so callers see the inner tokens.
+                    r.forward();
+                    r.forward();
+                    continue;
+                } else {
+                    string::parse_hex(r)
+                        .map(|s| Object::String(String::from_hex(s)))
+                        .ok_or(Error::SyntaxError)
+                }
+            }
+            b'/' => name::parse_literal(r)
+                .map(|s| Object::Name(Name::new(s, true)))
+                .ok_or(Error::SyntaxError),
+            b'[' => array::parse(r).map(|d| Object::Array(Array::new(d))),
+            b'>' => {
+                if r.peek_bytes(2) == Some(b">>") {
+                    // TODO: Proper dict support. Skip `>>` closing delimiter.
+                    r.forward();
+                    r.forward();
+                    continue;
+                } else {
+                    Err(Error::SyntaxError)
+                }
+            }
+            b'{' => {
+                r.forward();
+                Err(Error::UnsupportedType)
+            }
+            b'.' | b'+' | b'-' | b'0'..=b'9' => number::read(r).map(Object::Number),
+            _ => name::parse_executable(r)
+                .map(|s| Object::Name(Name::new(s, false)))
+                .ok_or(Error::SyntaxError),
+        };
+    }
+}
+
+pub(crate) fn at_end(r: &mut Reader<'_>) -> bool {
+    skip_whitespace_and_comments(r);
+    r.peek_byte().is_none()
+}
+
+pub(crate) fn skip_whitespace_and_comments(r: &mut Reader<'_>) {
+    loop {
+        match r.peek_byte() {
+            Some(b) if crate::reader::is_whitespace(b) => {
+                r.forward();
+            }
+            Some(b'%') => {
+                r.forward();
+                r.forward_while(|b| !crate::reader::is_eol(b));
+            }
+            _ => return,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn read_one(input: &[u8]) -> Result<Object<'_>> {
+        let mut r = Reader::new(input);
+        read(&mut r)
+    }
+
+    fn read_ok(input: &[u8]) -> Object<'_> {
+        read_one(input).unwrap()
+    }
+
+    fn read_err(input: &[u8]) -> Error {
+        read_one(input).unwrap_err()
+    }
+
+    #[test]
+    fn integer() {
+        assert_eq!(read_ok(b"42 "), Object::Number(Number::Integer(42)));
+    }
+
+    #[test]
+    fn negative_integer() {
+        assert_eq!(read_ok(b"-7 "), Object::Number(Number::Integer(-7)));
+    }
+
+    #[test]
+    fn literal_name() {
+        assert_eq!(
+            read_ok(b"/CMapName "),
+            Object::Name(Name::new(b"CMapName", true))
+        );
+    }
+
+    #[test]
+    fn executable_name() {
+        let obj = read_ok(b"beginbfchar ");
+        assert_eq!(obj, Object::Name(Name::new(b"beginbfchar", false)));
+    }
+
+    #[test]
+    fn literal_string() {
+        assert_eq!(
+            read_ok(b"(Hello)"),
+            Object::String(String::from_literal(b"Hello"))
+        );
+    }
+
+    #[test]
+    fn hex_string() {
+        assert_eq!(
+            read_ok(b"<48656C6C6F>"),
+            Object::String(String::from_hex(b"48656C6C6F"))
+        );
+    }
+
+    #[test]
+    fn ascii85_string() {
+        assert_eq!(
+            read_ok(b"<~87cURDZ~>"),
+            Object::String(String::from_ascii85(b"87cURDZ"))
+        );
+    }
+
+    #[test]
+    fn array_simple() {
+        let obj = read_ok(b"[1 2 3]");
+        assert_eq!(obj, Object::Array(Array::new(b"1 2 3")));
+    }
+
+    #[test]
+    fn stray_close_bracket() {
+        assert_eq!(read_err(b"]"), Error::SyntaxError);
+    }
+
+    #[test]
+    fn stray_gt() {
+        assert_eq!(read_err(b">x"), Error::SyntaxError);
+    }
+
+    #[test]
+    fn skips_whitespace() {
+        assert_eq!(read_ok(b"  \t\n 42 "), Object::Number(Number::Integer(42)));
+    }
+
+    #[test]
+    fn skips_comments() {
+        assert_eq!(
+            read_ok(b"% this is a comment\n42 "),
+            Object::Number(Number::Integer(42))
+        );
+    }
+
+    #[test]
+    fn eof() {
+        assert!(read_one(b"").is_err());
+        assert!(read_one(b"   ").is_err());
+        assert!(read_one(b"% comment only\n").is_err());
+    }
+
+    // PdfCraft patch: `<<` and `>>` runs are skipped without recursion.
+    #[test]
+    fn long_open_dict_run_does_not_overflow() {
+        let input = alloc::vec![b'<'; 1_000_000];
+        assert_eq!(read_err(&input), Error::SyntaxError);
+    }
+
+    #[test]
+    fn long_close_dict_run_does_not_overflow() {
+        let input = b">>".repeat(500_000);
+        assert_eq!(read_err(&input), Error::SyntaxError);
+    }
+
+    #[test]
+    fn dict_delimiters_are_skipped() {
+        let mut r = Reader::new(b"<< /A 1 >>");
+        assert_eq!(read(&mut r), Ok(Object::Name(Name::new(b"A", true))));
+        assert_eq!(read(&mut r), Ok(Object::Number(Number::Integer(1))));
+        assert_eq!(read(&mut r), Err(Error::SyntaxError));
+    }
+
+    #[test]
+    fn nested_dict_delimiters_are_skipped() {
+        let mut r = Reader::new(b"<<<< /X >>>> 7 <<\n% c\n<< >> 8");
+        assert_eq!(read(&mut r), Ok(Object::Name(Name::new(b"X", true))));
+        assert_eq!(read(&mut r), Ok(Object::Number(Number::Integer(7))));
+        assert_eq!(read(&mut r), Ok(Object::Number(Number::Integer(8))));
+        assert!(at_end(&mut r));
+    }
+}
diff --git a/vendor/hayro-postscript/src/reader.rs b/vendor/hayro-postscript/src/reader.rs
new file mode 100644
index 00000000..f8a49674
--- /dev/null
+++ b/vendor/hayro-postscript/src/reader.rs
@@ -0,0 +1,136 @@
+use core::ops::Range;
+
+#[derive(Clone, Debug)]
+pub(crate) struct Reader<'a> {
+    pub(crate) data: &'a [u8],
+    pub(crate) offset: usize,
+}
+
+impl<'a> Reader<'a> {
+    #[inline]
+    pub(crate) fn new(data: &'a [u8]) -> Self {
+        Self { data, offset: 0 }
+    }
+
+    #[inline]
+    pub(crate) fn jump(&mut self, offset: usize) {
+        self.offset = offset;
+    }
+
+    #[inline]
+    pub(crate) fn range(&self, range: Range<usize>) -> Option<&'a [u8]> {
+        self.data.get(range)
+    }
+
+    #[inline]
+    pub(crate) fn offset(&self) -> usize {
+        self.offset
+    }
+
+    #[inline]
+    pub(crate) fn read_bytes(&mut self, len: usize) -> Option<&'a [u8]> {
+        let v = self.peek_bytes(len)?;
+        self.offset += len;
+        Some(v)
+    }
+
+    #[inline]
+    pub(crate) fn read_byte(&mut self) -> Option<u8> {
+        let v = self.peek_byte()?;
+        self.offset += 1;
+        Some(v)
+    }
+
+    #[inline]
+    pub(crate) fn peek_bytes(&self, len: usize) -> Option<&'a [u8]> {
+        self.data.get(self.offset..self.offset + len)
+    }
+
+    #[inline]
+    pub(crate) fn peek_byte(&self) -> Option<u8> {
+        self.data.get(self.offset).copied()
+    }
+
+    #[inline]
+    pub(crate) fn eat(&mut self, f: impl Fn(u8) -> bool) -> Option<u8> {
+        let val = self.peek_byte()?;
+        if f(val) {
+            self.forward();
+            Some(val)
+        } else {
+            None
+        }
+    }
+
+    #[inline]
+    pub(crate) fn forward(&mut self) {
+        self.offset += 1;
+    }
+
+    #[inline]
+    pub(crate) fn forward_while(&mut self, f: impl Fn(u8) -> bool) {
+        while let Some(b) = self.peek_byte() {
+            if f(b) {
+                self.forward();
+            } else {
+                break;
+            }
+        }
+    }
+
+    #[inline]
+    pub(crate) fn forward_tag(&mut self, tag: &[u8]) -> Option<()> {
+        self.peek_tag(tag)?;
+        self.offset += tag.len();
+        Some(())
+    }
+
+    #[inline]
+    pub(crate) fn peek_tag(&self, tag: &[u8]) -> Option<()> {
+        let mut cloned = self.clone();
+
+        for b in tag.iter().copied() {
+            if cloned.peek_byte() == Some(b) {
+                cloned.forward();
+            } else {
+                return None;
+            }
+        }
+
+        Some(())
+    }
+
+    #[inline]
+    pub(crate) fn skip_eol(&mut self) {
+        while let Some(b) = self.peek_byte() {
+            if is_eol(b) {
+                self.forward();
+            } else {
+                return;
+            }
+        }
+    }
+}
+
+#[inline(always)]
+pub(crate) fn is_whitespace(b: u8) -> bool {
+    matches!(b, 0x00 | 0x09 | 0x0a | 0x0c | 0x0d | 0x20)
+}
+
+#[inline(always)]
+pub(crate) fn is_delimiter(b: u8) -> bool {
+    matches!(
+        b,
+        b'(' | b')' | b'<' | b'>' | b'[' | b']' | b'{' | b'}' | b'/' | b'%'
+    )
+}
+
+#[inline(always)]
+pub(crate) fn is_regular(b: u8) -> bool {
+    !is_whitespace(b) && !is_delimiter(b)
+}
+
+#[inline(always)]
+pub(crate) fn is_eol(b: u8) -> bool {
+    matches!(b, 0x0a | 0x0d)
+}
diff --git a/vendor/hayro-postscript/src/string.rs b/vendor/hayro-postscript/src/string.rs
new file mode 100644
index 00000000..ed39d57c
--- /dev/null
+++ b/vendor/hayro-postscript/src/string.rs
@@ -0,0 +1,288 @@
+mod ascii_85;
+pub(crate) mod ascii_hex;
+mod literal;
+
+use alloc::vec::Vec;
+
+use crate::error::{Error, Result};
+use crate::reader::Reader;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum StringInner<'a> {
+    Literal(&'a [u8]),
+    Hex(&'a [u8]),
+    Ascii85(&'a [u8]),
+}
+
+/// A PostScript string object.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct String<'a> {
+    inner: StringInner<'a>,
+}
+
+impl<'a> String<'a> {
+    pub(crate) const fn from_literal(data: &'a [u8]) -> Self {
+        Self {
+            inner: StringInner::Literal(data),
+        }
+    }
+
+    pub(crate) const fn from_hex(data: &'a [u8]) -> Self {
+        Self {
+            inner: StringInner::Hex(data),
+        }
+    }
+
+    pub(crate) const fn from_ascii85(data: &'a [u8]) -> Self {
+        Self {
+            inner: StringInner::Ascii85(data),
+        }
+    }
+
+    /// Decode the string content into `out`, replacing any previous contents.
+    pub fn decode_into(&self, out: &mut Vec<u8>) -> Result<()> {
+        out.clear();
+        match self.inner {
+            StringInner::Literal(data) => literal::decode_into(data, out),
+            StringInner::Hex(data) => ascii_hex::decode_into(data, out),
+            StringInner::Ascii85(data) => ascii_85::decode_into(data, out),
+        }
+        .ok_or(Error::SyntaxError)
+    }
+
+    /// Decode the string content.
+    pub fn decode(&self) -> Result<Vec<u8>> {
+        let mut out = Vec::new();
+        self.decode_into(&mut out)?;
+        Ok(out)
+    }
+}
+
+pub(crate) fn parse_literal<'a>(r: &mut Reader<'a>) -> Option<&'a [u8]> {
+    let start = r.offset();
+    skip_literal(r)?;
+    let end = r.offset();
+    // Exclude outer parentheses.
+    r.range(start + 1..end - 1)
+}
+
+pub(crate) fn parse_hex<'a>(r: &mut Reader<'a>) -> Option<&'a [u8]> {
+    r.forward_tag(b"<")?;
+    let start = r.offset();
+    while let Some(b) = r.read_byte() {
+        if b == b'>' {
+            return r.range(start..r.offset() - 1);
+        }
+    }
+    None
+}
+
+pub(crate) fn parse_ascii85<'a>(r: &mut Reader<'a>) -> Option<&'a [u8]> {
+    r.forward_tag(b"<~")?;
+    let start = r.offset();
+    loop {
+        let b = r.read_byte()?;
+        if b == b'~' {
+            let end = r.offset() - 1;
+            r.forward_tag(b">")?;
+            return r.range(start..end);
+        }
+    }
+}
+
+fn skip_literal(r: &mut Reader<'_>) -> Option<()> {
+    r.forward_tag(b"(")?;
+    let mut depth = 1_u32;
+
+    while depth > 0 {
+        let byte = r.read_byte()?;
+        match byte {
+            b'\\' => {
+                let _ = r.read_byte()?;
+            }
+            b'(' => depth += 1,
+            b')' => depth -= 1,
+            _ => {}
+        }
+    }
+
+    Some(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn decode_literal(input: &[u8]) -> Result<Vec<u8>> {
+        let mut r = Reader::new(input);
+        let data = parse_literal(&mut r).ok_or(Error::SyntaxError)?;
+        String::from_literal(data).decode()
+    }
+
+    #[test]
+    fn literal_empty() {
+        assert_eq!(decode_literal(b"()").unwrap(), b"");
+    }
+
+    #[test]
+    fn literal_simple() {
+        assert_eq!(decode_literal(b"(Hello)").unwrap(), b"Hello");
+    }
+
+    #[test]
+    fn literal_nested_parens() {
+        assert_eq!(
+            decode_literal(b"(Hi (()) there)").unwrap(),
+            b"Hi (()) there"
+        );
+    }
+
+    #[test]
+    fn literal_escape_n() {
+        assert_eq!(decode_literal(b"(a\\nb)").unwrap(), b"a\nb");
+    }
+
+    #[test]
+    fn literal_escape_r() {
+        assert_eq!(decode_literal(b"(a\\rb)").unwrap(), b"a\rb");
+    }
+
+    #[test]
+    fn literal_escape_t() {
+        assert_eq!(decode_literal(b"(a\\tb)").unwrap(), b"a\tb");
+    }
+
+    #[test]
+    fn literal_escape_b() {
+        assert_eq!(decode_literal(b"(a\\bb)").unwrap(), &[b'a', 0x08, b'b']);
+    }
+
+    #[test]
+    fn literal_escape_f() {
+        assert_eq!(decode_literal(b"(a\\fb)").unwrap(), &[b'a', 0x0C, b'b']);
+    }
+
+    #[test]
+    fn literal_escape_backslash() {
+        assert_eq!(decode_literal(b"(a\\\\b)").unwrap(), b"a\\b");
+    }
+
+    #[test]
+    fn literal_escape_parens() {
+        assert_eq!(decode_literal(b"(Hi \\()").unwrap(), b"Hi (");
+    }
+
+    #[test]
+    fn literal_octal_three_digits() {
+        assert_eq!(decode_literal(b"(\\053)").unwrap(), b"+");
+    }
+
+    #[test]
+    fn literal_octal_two_digits() {
+        assert_eq!(decode_literal(b"(\\36)").unwrap(), b"\x1e");
+    }
+
+    #[test]
+    fn literal_octal_one_digit() {
+        assert_eq!(decode_literal(b"(\\3)").unwrap(), b"\x03");
+    }
+
+    #[test]
+    fn literal_line_continuation_lf() {
+        assert_eq!(decode_literal(b"(Hi \\\nthere)").unwrap(), b"Hi there");
+    }
+
+    #[test]
+    fn literal_line_continuation_cr() {
+        assert_eq!(decode_literal(b"(Hi \\\rthere)").unwrap(), b"Hi there");
+    }
+
+    #[test]
+    fn literal_line_continuation_crlf() {
+        assert_eq!(decode_literal(b"(Hi \\\r\nthere)").unwrap(), b"Hi there");
+    }
+
+    #[test]
+    fn literal_bare_eol_lf() {
+        assert_eq!(decode_literal(b"(a\nb)").unwrap(), b"a\nb");
+    }
+
+    #[test]
+    fn literal_bare_eol_cr() {
+        assert_eq!(decode_literal(b"(a\rb)").unwrap(), b"a\nb");
+    }
+
+    #[test]
+    fn literal_bare_eol_crlf() {
+        assert_eq!(decode_literal(b"(a\r\nb)").unwrap(), b"a\nb");
+    }
+
+    fn decode_hex(input: &[u8]) -> Result<Vec<u8>> {
+        let mut r = Reader::new(input);
+        let data = parse_hex(&mut r).ok_or(Error::SyntaxError)?;
+        String::from_hex(data).decode()
+    }
+
+    #[test]
+    fn hex_simple() {
+        assert_eq!(decode_hex(b"<48656C6C6F>").unwrap(), b"Hello");
+    }
+
+    #[test]
+    fn hex_with_whitespace() {
+        assert_eq!(decode_hex(b"<48 65 6C 6C 6F>").unwrap(), b"Hello");
+    }
+
+    #[test]
+    fn hex_odd_nibble() {
+        assert_eq!(decode_hex(b"<ABC>").unwrap(), &[0xAB, 0xC0]);
+    }
+
+    #[test]
+    fn hex_empty() {
+        assert_eq!(decode_hex(b"<>").unwrap(), b"");
+    }
+
+    #[test]
+    fn hex_lowercase() {
+        assert_eq!(decode_hex(b"<abcd>").unwrap(), &[0xAB, 0xCD]);
+    }
+
+    #[test]
+    fn hex_mixed_case() {
+        assert_eq!(decode_hex(b"<aB3E>").unwrap(), &[0xAB, 0x3E]);
+    }
+
+    fn decode_a85(input: &[u8]) -> Result<Vec<u8>> {
+        let mut r = Reader::new(input);
+        let data = parse_ascii85(&mut r).ok_or(Error::SyntaxError)?;
+        String::from_ascii85(data).decode()
+    }
+
+    #[test]
+    fn ascii85_simple() {
+        // "Hello" in ASCII85 is "87cURDZ"
+        assert_eq!(decode_a85(b"<~87cURDZ~>").unwrap(), b"Hello");
+    }
+
+    #[test]
+    fn ascii85_empty() {
+        assert_eq!(decode_a85(b"<~~>").unwrap(), b"");
+    }
+
+    #[test]
+    fn ascii85_z_shorthand() {
+        assert_eq!(decode_a85(b"<~z~>").unwrap(), &[0, 0, 0, 0]);
+    }
+
+    #[test]
+    fn ascii85_partial_group() {
+        let result = decode_a85(b"<~87~>").unwrap();
+        assert_eq!(result.len(), 1);
+    }
+
+    #[test]
+    fn ascii85_with_whitespace() {
+        assert_eq!(decode_a85(b"<~87cU RDZ~>").unwrap(), b"Hello");
+    }
+}
diff --git a/vendor/hayro-postscript/src/string/ascii_85.rs b/vendor/hayro-postscript/src/string/ascii_85.rs
new file mode 100644
index 00000000..93f7f502
--- /dev/null
+++ b/vendor/hayro-postscript/src/string/ascii_85.rs
@@ -0,0 +1,90 @@
+// Keep in sync with `hayro-syntax/src/filter/ascii_85.rs`.
+
+use crate::reader::{Reader, is_whitespace};
+use alloc::vec::Vec;
+
+pub(crate) fn decode_into(data: &[u8], out: &mut Vec<u8>) -> Option<()> {
+    const POW_85: [u32; 5] = [52200625, 614125, 7225, 85, 1];
+
+    let mut reader = Reader::new(data);
+
+    let mut read_byte = || -> Option<u8> {
+        loop {
+            let b = reader.read_byte()?;
+
+            // White space characters should be ignored.
+            if !is_whitespace(b) {
+                return Some(b);
+            }
+        }
+    };
+
+    let flush_group = |group: &mut Vec<u8>, decoded: &mut Vec<u8>| -> Option<()> {
+        let (digits, output_len): ([u32; 5], usize) = match group.len() {
+            0 => return Some(()),
+            1 => return None, // A single character is not valid.
+            2 => (
+                [group[0], group[1], b'u', b'u', b'u'].map(|b| (b - b'!') as u32),
+                1,
+            ),
+            3 => (
+                [group[0], group[1], group[2], b'u', b'u'].map(|b| (b - b'!') as u32),
+                2,
+            ),
+            4 => (
+                [group[0], group[1], group[2], group[3], b'u'].map(|b| (b - b'!') as u32),
+                3,
+            ),
+            5 => (
+                [group[0], group[1], group[2], group[3], group[4]].map(|b| (b - b'!') as u32),
+                4,
+            ),
+            _ => unreachable!(),
+        };
+
+        let value = digits[0]
+            .checked_mul(POW_85[0])?
+            .checked_add(digits[1].checked_mul(POW_85[1])?)?
+            .checked_add(digits[2].checked_mul(POW_85[2])?)?
+            .checked_add(digits[3].checked_mul(POW_85[3])?)?
+            .checked_add(digits[4])?;
+
+        decoded.extend_from_slice(&value.to_be_bytes()[..output_len]);
+        group.clear();
+        Some(())
+    };
+
+    out.reserve(data.len() * 4 / 5);
+    let mut group = Vec::with_capacity(5);
+
+    loop {
+        let Some(b) = read_byte() else {
+            // Be lenient and accept what we have (see PDFBOX-5910).
+            flush_group(&mut group, out)?;
+
+            return Some(());
+        };
+
+        match b {
+            b'!'..=b'u' => {
+                group.push(b);
+
+                if group.len() == 5 {
+                    flush_group(&mut group, out)?;
+                }
+            }
+            b'z' => {
+                flush_group(&mut group, out)?;
+                out.extend_from_slice(&[0, 0, 0, 0]);
+            }
+            b'~' => {
+                // Technically requires a '>', but there is a PDF where it isn't
+                // appended and decodes fine in other viewers.
+                flush_group(&mut group, out)?;
+
+                return Some(());
+            }
+            _ => return None, // Invalid character.
+        }
+    }
+}
diff --git a/vendor/hayro-postscript/src/string/ascii_hex.rs b/vendor/hayro-postscript/src/string/ascii_hex.rs
new file mode 100644
index 00000000..bdf74389
--- /dev/null
+++ b/vendor/hayro-postscript/src/string/ascii_hex.rs
@@ -0,0 +1,59 @@
+// Keep in sync with `hayro-syntax/src/filter/ascii_hex.rs`.
+
+use crate::reader::is_whitespace;
+use alloc::vec::Vec;
+
+pub(crate) fn decode_into(data: &[u8], out: &mut Vec<u8>) -> Option<()> {
+    let has_whitespace = data.iter().any(|&b| is_whitespace(b));
+
+    out.reserve(data.len().div_ceil(2));
+
+    if !has_whitespace {
+        // Fast path, don't need to worry about white spaces.
+        let mut i = 0;
+        while i + 1 < data.len() {
+            out.push(decode_hex_digit(data[i])? << 4 | decode_hex_digit(data[i + 1])?);
+            i += 2;
+        }
+        if i < data.len() {
+            out.push(decode_hex_digit(data[i])? << 4);
+        }
+    } else {
+        // Slow path, need to strip white spaces.
+        let mut iter = data.iter().copied();
+        let mut read_byte = || -> Option<u8> {
+            loop {
+                let b = iter.next()?;
+                if !is_whitespace(b) {
+                    return Some(b);
+                }
+            }
+        };
+
+        loop {
+            match (read_byte(), read_byte()) {
+                (Some(hi), Some(lo)) => {
+                    out.push(decode_hex_digit(hi)? << 4 | decode_hex_digit(lo)?);
+                }
+                (Some(hi), None) => {
+                    out.push(decode_hex_digit(hi)? << 4);
+
+                    break;
+                }
+                (None, _) => break,
+            }
+        }
+    }
+
+    Some(())
+}
+
+#[inline(always)]
+pub(crate) fn decode_hex_digit(c: u8) -> Option<u8> {
+    match c {
+        b'0'..=b'9' => Some(c - b'0'),
+        b'A'..=b'F' => Some(c - b'A' + 10),
+        b'a'..=b'f' => Some(c - b'a' + 10),
+        _ => None,
+    }
+}
diff --git a/vendor/hayro-postscript/src/string/literal.rs b/vendor/hayro-postscript/src/string/literal.rs
new file mode 100644
index 00000000..37a15934
--- /dev/null
+++ b/vendor/hayro-postscript/src/string/literal.rs
@@ -0,0 +1,85 @@
+// Keep in sync with `hayro-syntax/src/object/string.rs` (`read_literal`).
+
+use alloc::vec::Vec;
+
+use crate::reader::Reader;
+
+pub(crate) fn decode_into(data: &[u8], out: &mut Vec<u8>) -> Option<()> {
+    let mut r = Reader::new(data);
+
+    while let Some(byte) = r.read_byte() {
+        match byte {
+            b'\\' => {
+                let next = r.read_byte()?;
+
+                if is_octal_digit(next) {
+                    let second = r.read_byte();
+                    let third = r.read_byte();
+
+                    let bytes = match (second, third) {
+                        (Some(n1), Some(n2)) => match (is_octal_digit(n1), is_octal_digit(n2)) {
+                            (true, true) => [next, n1, n2],
+                            (true, _) => {
+                                r.jump(r.offset() - 1);
+                                [b'0', next, n1]
+                            }
+                            _ => {
+                                r.jump(r.offset() - 2);
+                                [b'0', b'0', next]
+                            }
+                        },
+                        (Some(n1), None) => {
+                            if is_octal_digit(n1) {
+                                [b'0', next, n1]
+                            } else {
+                                r.jump(r.offset() - 1);
+                                [b'0', b'0', next]
+                            }
+                        }
+                        _ => [b'0', b'0', next],
+                    };
+
+                    let str = core::str::from_utf8(&bytes).unwrap();
+
+                    if let Ok(num) = u8::from_str_radix(str, 8) {
+                        out.push(num);
+                    }
+                } else {
+                    match next {
+                        b'n' => out.push(0xA),
+                        b'r' => out.push(0xD),
+                        b't' => out.push(0x9),
+                        b'b' => out.push(0x8),
+                        b'f' => out.push(0xC),
+                        b'(' => out.push(b'('),
+                        b')' => out.push(b')'),
+                        b'\\' => out.push(b'\\'),
+                        b'\n' | b'\r' => {
+                            // "If the \ is followed immediately by a newline
+                            // (CR, LF, or CR-LF pair), the scanner ignores
+                            // both the initial \ and the newline; this breaks
+                            // a string into multiple lines without including
+                            // the newline character as part of the string."
+                            r.skip_eol();
+                        }
+                        _ => out.push(next),
+                    }
+                }
+            }
+            b'(' | b')' => out.push(byte),
+            // "But if a newline appears without a preceding \, the result is
+            // equivalent to \n."
+            b'\n' | b'\r' => {
+                out.push(b'\n');
+                r.skip_eol();
+            }
+            other => out.push(other),
+        }
+    }
+
+    Some(())
+}
+
+fn is_octal_digit(byte: u8) -> bool {
+    matches!(byte, b'0'..=b'7')
+}
diff --git a/vendor/hayro-syntax/SOURCE.json b/vendor/hayro-syntax/SOURCE.json
index 800895ae..5e9fb9b1 100644
--- a/vendor/hayro-syntax/SOURCE.json
+++ b/vendor/hayro-syntax/SOURCE.json
@@ -1,14 +1,14 @@
 {
   "crate": "hayro-syntax",
   "source_repository": "https://github.com/storytold/pdfcraft",
-  "source_revision": "7437bde378f43856eada40af25b983812e615e8a",
+  "source_revision": "ec0a965074f376a5bf610435948e4e5184bf3299",
   "source_directory": "vendor/hayro-syntax",
   "files": [
     {
       "path": "Cargo.lock",
       "source_sha256": "d73da432072780b3d1fc725da68ad174c75f1720d0ed903521f664bfc16c70a8",
       "source_git_blob": "ebc07dfff7b53f62a5ff422c19a779ab61c106cc",
-      "sha256": "d73da432072780b3d1fc725da68ad174c75f1720d0ed903521f664bfc16c70a8"
+      "sha256": "6106b3f3ad57258826fa72d2eaebfd2f66a37fccdc67507c348e603f71db088d"
     },
     {
       "path": "Cargo.toml",
@@ -68,7 +68,7 @@
       "path": "src/content/mod.rs",
       "source_sha256": "b0f36badb2688c90691c27a4e5dcdfec7639858081553242744dd7bc39ffc0d0",
       "source_git_blob": "8e47324d0b0bd90ed15efe5ff1e9de0cb46e75d9",
-      "sha256": "b0f36badb2688c90691c27a4e5dcdfec7639858081553242744dd7bc39ffc0d0"
+      "sha256": "ae0b0596d2304adc4109294cc7af681698071060d9e8cd6d44f0bb46baffec6b"
     },
     {
       "path": "src/content/ops.rs",
@@ -132,9 +132,9 @@
     },
     {
       "path": "src/filter/ascii_85.rs",
-      "source_sha256": "df32c6783b1c1969f9b6b03de3bf204384dfdba767f7beefdd8baa8590387d24",
-      "source_git_blob": "5a18cf8352d7d5a1770b4ea3068254187ff4b4f9",
-      "sha256": "df32c6783b1c1969f9b6b03de3bf204384dfdba767f7beefdd8baa8590387d24"
+      "source_sha256": "550cd5b3ceb7ee9342959ac9cc80c35b176aed3c7f061789e379beb8b5873f48",
+      "source_git_blob": "943bfeb742ac8cdc8ba64fcc538a044cb812577e",
+      "sha256": "054c13b992fd2c4a1a2d9881198eadb82d8c8454666d136b3c2dfaea60f7308a"
     },
     {
       "path": "src/filter/ascii_hex.rs",
@@ -144,9 +144,9 @@
     },
     {
       "path": "src/filter/ccitt.rs",
-      "source_sha256": "101e2e7e69ece280a258edcadd29f5ea0442ce6822cf1dd1906dca41a69436bf",
-      "source_git_blob": "98924f2dbdd942bc6ee64f66749b8d2496d8b45e",
-      "sha256": "101e2e7e69ece280a258edcadd29f5ea0442ce6822cf1dd1906dca41a69436bf"
+      "source_sha256": "45d7eb89934d28cff97a00c7b264010bccfd14f3d511e1307ad50a9fef3b53c8",
+      "source_git_blob": "685d680d2fbadce608a9bd3ca925c2ccc6c5d641",
+      "sha256": "67d17a339639eb0fef4cc6c745b579c6ba9ae3f2f67fd3bacb1bf1389aa5ffab"
     },
     {
       "path": "src/filter/dct.rs",
@@ -162,21 +162,21 @@
     },
     {
       "path": "src/filter/jpx.rs",
-      "source_sha256": "a9cab59f286bf3d3c99aa008f8fdede5028117c0f36018f3c02e52ed097c299a",
-      "source_git_blob": "6a788591e3338c55eccd616e21aa6e683f8d3351",
-      "sha256": "a9cab59f286bf3d3c99aa008f8fdede5028117c0f36018f3c02e52ed097c299a"
+      "source_sha256": "c9f068629c9cbe79af6793c3c125df4631ca1455691cb1335b44ff43cb1b4056",
+      "source_git_blob": "74efd8b31e2b2935ff2bbceda2c1ffd36ea9c20d",
+      "sha256": "dc3742454cfde9a994ce48984e8fcb7b18851efb36ce2d62e31629efea063a1b"
     },
     {
       "path": "src/filter/lzw_flate.rs",
-      "source_sha256": "e2d2196bc47c00474dc8f61d281ba327b88aa0d5f9e5475d29bf63a0572522e3",
-      "source_git_blob": "f9da1590b27b3e582ddac2fdfe9c1ef80ea72aff",
-      "sha256": "e1a6125b27423c91d79127ce6f8bfec507bd4d6ab0f959b2740a8a6e392d3e49"
+      "source_sha256": "db51a57effe90ad9db2d314e16081ce90e3ef99e5a5f46fcc4bdbdacfd13a528",
+      "source_git_blob": "f1ab1aae73e4c84ec0993a6eb96594018ca7cc91",
+      "sha256": "00d478a55b0c123d903768186592d138d563543abf46e5c786c67b9fffd69637"
     },
     {
       "path": "src/filter/mod.rs",
-      "source_sha256": "5e6d62da5b1fd023f85f79bc8ade928b508214e13668f9fc99f3a08bc4d48a15",
-      "source_git_blob": "22bebf6d3287f1dc893c67b76a139108b28a8188",
-      "sha256": "8cc6c2572519046bd27adfc597630045e453829a954eaf1747fee7a447e5c5cb"
+      "source_sha256": "0af7145ab16b15b7a60c4b57efecb9bd5fd0cfdc9bb5f9388abb695386e63e49",
+      "source_git_blob": "06bda29487d62c25dc39c1ee109091cb17e3867f",
+      "sha256": "e43d7d309a4993f4a1f698208997122431b4a8b0db838bb07d4358ccbc00f02f"
     },
     {
       "path": "src/filter/run_length.rs",
@@ -260,7 +260,7 @@
       "path": "src/object/number.rs",
       "source_sha256": "4bc2df257241ccb66450b7176bcab20d780bc9e22469cec588ebee5fac272905",
       "source_git_blob": "bd37b19c3053317dabbfa38d3473618631e6b669",
-      "sha256": "85598a27cf730aa9d2fe6a7094a2b375e67c4fed588de86b47cb8ebf38a702fa"
+      "sha256": "f5a6a10e80abd84395edc34ceae43887fc6bc8941c8f0e26799cc4754f6b1543"
     },
     {
       "path": "src/object/rect.rs",
@@ -276,9 +276,9 @@
     },
     {
       "path": "src/object/stream.rs",
-      "source_sha256": "151721c7bfe558a6942aba323d3185cf6db5bf726bd905326881c70ef480240f",
-      "source_git_blob": "833610817b4738304a7376cd43ea079cb352bd8c",
-      "sha256": "e83d7ecb01a038d5a0ae589d77e877f9521097010e5f88db8f8a333fd161aff1"
+      "source_sha256": "f5229eb2f52c9918830027c93112e042a9e97d34b5fec72f97dcc7de8c5410ac",
+      "source_git_blob": "a80f0730cba317ed3771cee61d6a7ab18de296d7",
+      "sha256": "05928b3008cd06098220ee7cdfd03ebc6351c205d947491be37c77cd091dc78e"
     },
     {
       "path": "src/object/string.rs",
@@ -294,9 +294,9 @@
     },
     {
       "path": "src/page.rs",
-      "source_sha256": "19d0e7604a3a692956e523128022d07944253b308793598795e09595cb04e79e",
-      "source_git_blob": "7d63931a324f5faf90bb37e0a90670643567dace",
-      "sha256": "681681016eda0d1cdbec10d2cb0305c5f439724ec5d0b3be218a18e99b5e72b8"
+      "source_sha256": "17be32b2eaa03a3367f1f20040556f7ee5b207588cf44a1af3e5253386fb46f9",
+      "source_git_blob": "d7f0ec953722a938508f1f31f0adaecc0a181d20",
+      "sha256": "e39c9888ff5d1a6e6565d1e9fc810b2e4b285c9a014e5b887080a8839c7d5490"
     },
     {
       "path": "src/pdf.rs",
@@ -338,7 +338,7 @@
       "path": "src/xref.rs",
       "source_sha256": "51ffeeb7d4ac035bae2cd5ba9288c180088ae06cdcefe2b29dfeda560a793aa0",
       "source_git_blob": "20e33a410489d42e438a3f2b87d70c7bb8d66eae",
-      "sha256": "411ce7e3c0d385b1735f945b92dba164825456ef3b70ef464279ba0bac0879d4"
+      "sha256": "98fb56eb5c2da8b0c40202ed30b2f464874c1143436e72eda4e49f2333dd7c7f"
     },
     {
       "path": "src/decode_limits_tests.rs",
diff --git a/vendor/hayro-syntax/src/content/mod.rs b/vendor/hayro-syntax/src/content/mod.rs
index 8e47324d..5b19d509 100644
--- a/vendor/hayro-syntax/src/content/mod.rs
+++ b/vendor/hayro-syntax/src/content/mod.rs
@@ -35,12 +35,12 @@ pub mod ops;
 
 use crate::content::ops::TypedInstruction;
 use crate::object;
-use crate::object::dict::InlineImageDict;
+use crate::object::dict::{Dict, InlineImageDict};
 use crate::object::name::{Name, skip_name_like};
 use crate::object::{Array, Null, Number, Object, Stream};
 use crate::reader::Reader;
 use crate::reader::{Readable, ReaderContext, ReaderExt, Skippable};
-use crate::trivia::{Comment, is_white_space_character};
+use crate::trivia::{Comment, is_regular_character, is_white_space_character};
 use crate::util::find_needle;
 use core::array;
 use core::fmt::{Debug, Formatter};
@@ -242,15 +242,42 @@ impl<'a> UntypedIter<'a> {
                     let mut lookahead_touched = false;
                     let mut accepted = false;
 
-                    'outer: while let Some(pos) = find_needle(self.reader.tail()?, b"EI") {
+                    // PdfCraft patch: an unfiltered inline image's byte length is determined by
+                    // its parameters (and `/L` or `/Length` when present and consistent), so
+                    // `EI` inside its samples does not cut the image short (#3107, PR #3438).
+                    match unfiltered_image_end(
+                        stream_data,
+                        &dict,
+                        self.complete,
+                        start_offset.saturating_sub(self.committed),
+                    ) {
+                        UnfilteredEnd::Found(end_data, end_after_ei) => {
+                            let image_data = stream_data.get(..end_data)?;
+                            let stream = Stream::new(image_data, dict.clone());
+                            self.stack.push(Object::Stream(stream))?;
+                            self.reader.read_bytes(end_after_ei)?;
+                            self.reader.skip_white_spaces();
+                            accepted = true;
+                        }
+                        UnfilteredEnd::NeedsMore => {
+                            self.needs_more = true;
+                            return None;
+                        }
+                        UnfilteredEnd::Fallback => {}
+                    }
+
+                    'outer: while !accepted
+                        && let Some(pos) = find_needle(self.reader.tail()?, b"EI")
+                    {
                         self.reader.read_bytes(pos)?;
 
                         if self.reader.peek_bytes(2) == Some(b"EI") {
-                            // If the following character is not a whitespace character, then we are in a ASCII-85 stream.
+                            // PdfCraft patch: if the following character is a regular character,
+                            // then the token is not `EI` (white space and delimiters both end it).
                             if self
                                 .reader
                                 .peek_bytes(3)
-                                .is_some_and(|b| !is_white_space_character(b[2]))
+                                .is_some_and(|b| is_regular_character(b[2]))
                             {
                                 self.reader.read_bytes(3)?;
 
@@ -299,16 +326,21 @@ impl<'a> UntypedIter<'a> {
                                 find_reader.read_bytes(next_pos)?;
 
                                 if is_ei {
-                                    let analyze_data = &tail[..find_reader.offset()];
+                                    // PdfCraft patch: a byte above 0x7F between the two "EI"s
+                                    // used to reject the candidate ("binary data in-between, so
+                                    // we for sure have not reached the end"). When the candidate
+                                    // is the real end, those bytes are the content stream that
+                                    // follows the image, and a content stream carries bytes above
+                                    // 0x7F inside its strings: WinAnsi text such as `(Grüße) Tj`,
+                                    // or the two-byte codes of any Type 0 font. A page whose text
+                                    // held one, with a capital "EI" in a later word (EINGANG,
+                                    // BEI, KLEIN), had no valid candidate left, so the image data
+                                    // ran to the end of the stream and nothing after the image
+                                    // was drawn or extracted. The operator check below is the
+                                    // discriminator, and `MAX_EI_CANDIDATES` already bounds how
+                                    // often it runs.
 
-                                    // If there is any binary data in-between, we for sure
-                                    // have not reached the end.
-                                    if analyze_data.iter().any(|c| !c.is_ascii()) {
-                                        self.reader.read_bytes(2)?;
-                                        continue 'outer;
-                                    }
-
-                                    // Otherwise, the only possibility that we reached an
+                                    // The only possibility that we reached an
                                     // "EI", even though the previous one was valid, is
                                     // that it's part of a string in the content
                                     // stream that follows the inline image. Therefore,
@@ -852,9 +884,175 @@ mod macros {
     pub(crate) use op6;
 }
 
+/// PdfCraft patch: outcome of checking an unfiltered inline image's deterministic byte length.
+enum UnfilteredEnd {
+    /// Deterministic end found: `(end_data, end_after_ei)`.
+    Found(usize, usize),
+    /// Window ran out before the terminator after the expected sample bytes could be decided.
+    NeedsMore,
+    /// Not an unfiltered image with a valid terminator at its computed length; use the heuristic.
+    Fallback,
+}
+
+/// PdfCraft patch: an unfiltered inline image's sample byte count, including byte padding per row,
+/// and `/Length` or `/L` when present and consistent (#3107).
+fn unfiltered_image_len(dict: &Dict<'_>) -> Option<usize> {
+    for key in [b"Filter".as_slice(), b"F"] {
+        if let Some(filter) = dict.get::<Object<'_>>(key)
+            && !matches!(filter, Object::Null(_))
+            && !matches!(&filter, Object::Array(filters) if filters.iter::<Object<'_>>().next().is_none())
+        {
+            return None;
+        }
+    }
+    for (full, short) in [
+        (b"Width".as_slice(), b"W".as_slice()),
+        (b"Height", b"H"),
+        (b"ColorSpace", b"CS"),
+        (b"BitsPerComponent", b"BPC"),
+        (b"ImageMask", b"IM"),
+    ] {
+        if let (Some(full), Some(short)) =
+            (dict.get::<Object<'_>>(full), dict.get::<Object<'_>>(short))
+            && full != short
+        {
+            return None;
+        }
+    }
+    let get = |full: &[u8], short: &[u8]| {
+        dict.get::<Object<'_>>(full)
+            .or_else(|| dict.get::<Object<'_>>(short))
+    };
+    let int = |obj: &Object<'_>| match obj {
+        Object::Number(n) => i32::try_from(n.as_i64())
+            .ok()
+            .filter(|&i| Number::from_i32(i) == *n)
+            .map(i64::from),
+        _ => None,
+    };
+    let width = usize::try_from(int(&get(b"Width", b"W")?)?)
+        .ok()
+        .filter(|n| *n > 0)?;
+    let height = usize::try_from(int(&get(b"Height", b"H")?)?)
+        .ok()
+        .filter(|n| *n > 0)?;
+    let mask = match get(b"ImageMask", b"IM") {
+        None | Some(Object::Null(_) | Object::Boolean(false)) => false,
+        Some(Object::Boolean(true)) => true,
+        _ => return None,
+    };
+    let bits = match get(b"BitsPerComponent", b"BPC") {
+        None | Some(Object::Null(_)) => None,
+        Some(value) => Some(int(&value)?),
+    };
+    let (components, bits) = if mask {
+        if bits.is_some_and(|bits| bits != 1) {
+            return None;
+        }
+        (1usize, 1usize)
+    } else {
+        let (components, max_bits) = match get(b"ColorSpace", b"CS")? {
+            Object::Name(name) => match name.as_ref() {
+                b"DeviceGray" | b"G" => (1, 16),
+                b"DeviceRGB" | b"RGB" => (3, 16),
+                b"DeviceCMYK" | b"CMYK" => (4, 16),
+                _ => return None,
+            },
+            Object::Array(space) => {
+                let mut items = space.iter::<Object<'_>>();
+                if !matches!(items.next(), Some(Object::Name(n)) if matches!(n.as_ref(), b"Indexed" | b"I"))
+                    || items.count() != 3
+                {
+                    return None;
+                }
+                (1, 8)
+            }
+            _ => return None,
+        };
+        let bits = match bits? {
+            bits @ (1 | 2 | 4 | 8 | 16) => bits as usize,
+            _ => return None,
+        };
+        if bits > max_bits {
+            return None;
+        }
+        (components, bits)
+    };
+    let row = width
+        .checked_mul(components)?
+        .checked_mul(bits)?
+        .div_ceil(8);
+    row.checked_mul(height)
+}
+
+/// PdfCraft patch: locate the deterministic `EI` terminator of an unfiltered inline image (#3107).
+fn unfiltered_image_end(
+    data: &[u8],
+    dict: &Dict<'_>,
+    complete: bool,
+    header_bytes: usize,
+) -> UnfilteredEnd {
+    let Some(end_data) = unfiltered_image_len(dict) else {
+        return UnfilteredEnd::Fallback;
+    };
+    // An inline image shares the content window's budget, not the larger decoded-image
+    // budget. Include its dictionary/header and the shortest whitespace + EI + delimiter
+    // look-ahead, or one more byte beyond any separator whitespace already present.
+    // Missing bytes that cannot fit must use the existing heuristic, not pin the window
+    // and discard following content. Already-available exact ends still win.
+    let missing_end = if complete
+        || end_data
+            .checked_add(4)
+            .and_then(|minimum| data.len().checked_add(1).map(|next| minimum.max(next)))
+            .and_then(|needed| needed.checked_add(header_bytes))
+            .is_none_or(|needed| needed > crate::MAX_DECODED_STREAM)
+    {
+        UnfilteredEnd::Fallback
+    } else {
+        UnfilteredEnd::NeedsMore
+    };
+    let Some(after) = data.get(end_data..) else {
+        return missing_end;
+    };
+    let Some(&first) = after.first() else {
+        return missing_end;
+    };
+    if !is_white_space_character(first) {
+        return UnfilteredEnd::Fallback;
+    }
+    let Some(separator) = after.iter().position(|&b| !is_white_space_character(b)) else {
+        return missing_end;
+    };
+    let Some(rest) = after.get(separator..) else {
+        return UnfilteredEnd::Fallback;
+    };
+    if rest.first() != Some(&b'E') {
+        return UnfilteredEnd::Fallback;
+    }
+    let Some(&second) = rest.get(1) else {
+        return missing_end;
+    };
+    if second != b'I' {
+        return UnfilteredEnd::Fallback;
+    }
+    let Some(end_after_ei) = end_data
+        .checked_add(separator)
+        .and_then(|ei| ei.checked_add(2))
+    else {
+        return UnfilteredEnd::Fallback;
+    };
+    match rest.get(2) {
+        Some(&b) if !is_regular_character(b) => UnfilteredEnd::Found(end_data, end_after_ei),
+        Some(_) => UnfilteredEnd::Fallback,
+        None if complete => UnfilteredEnd::Found(end_data, end_after_ei),
+        None => missing_end,
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::{ContentTokenizer, UntypedIter};
+    use crate::reader::ReaderExt;
 
     fn operators(data: &[u8]) -> Vec<Vec<u8>> {
         let mut tokenizer = UntypedIter::new(data);
@@ -872,6 +1070,67 @@ mod tests {
         assert_eq!(operators(data), [b"TJ".to_vec(), b"BI".to_vec(), b"q".to_vec(), b"Q".to_vec()]);
     }
 
+    /// PdfCraft patch: bytes above 0x7F after an `EI` candidate don't reject it.
+    #[test]
+    fn an_inline_image_ends_at_its_own_ei_when_later_text_holds_a_non_ascii_byte() {
+        // `(Grüße)` in WinAnsi, then a word holding a capital "EI": both are everyday content,
+        // and the look-ahead used to read the non-ASCII bytes of the string as image data.
+        let data = b"BI /W 1 /H 1 /BPC 8 /CS /DeviceGray ID \x00 EI BT /F1 12 Tf (Gr\xFC\xDFe) Tj (EINGANG) Tj ET";
+
+        assert_eq!(
+            operators(data),
+            [
+                b"BI".to_vec(),
+                b"BT".to_vec(),
+                b"Tf".to_vec(),
+                b"Tj".to_vec(),
+                b"Tj".to_vec(),
+                b"ET".to_vec()
+            ]
+        );
+    }
+
+    /// PdfCraft patch: `EI` followed by a delimiter ends the image.
+    #[test]
+    fn inline_image_ei_may_be_followed_by_a_delimiter() {
+        let mut image = b"BI /W 16 /H 4 /BPC 8 /CS /G ID ".to_vec();
+        image.extend([0x80; 64]);
+        image.extend(b"\nEI");
+        let tail = b" Q BT /F1 24 Tf 72 200 Td (AFTER) Tj ET";
+        let ops = |suffix: &[u8]| {
+            let mut data = image.clone();
+            data.extend(suffix);
+            data.extend(tail);
+            operators(&data)
+        };
+        let control = ops(b"");
+        assert_eq!(control.len(), 7);
+        assert_eq!(ops(b"%c\n"), control);
+        assert_eq!(ops(b"[] 0 d"), [&control[..1], &[b"d".to_vec()], &control[1..]].concat());
+    }
+
+    #[test]
+    fn inline_image_ei_followed_by_a_regular_character_is_not_the_end() {
+        let data = b"BI /W 1 /H 1 /BPC 8 /CS /G ID \x80 EIQ \x81 EI Q BT (a) Tj ET";
+        // `EIQ` is one token and stays part of the image data.
+        let expected: Vec<Vec<u8>> =
+            ["BI", "Q", "BT", "Tj", "ET"].iter().map(|s| s.as_bytes().to_vec()).collect();
+        assert_eq!(operators(data), expected);
+    }
+
+    #[test]
+    fn ascii85_inline_image_data_may_contain_ei_before_a_delimiter() {
+        for glue in [&b"EI["[..], b"EI/", b"EI%", b"EI(", b"EI<"] {
+            let mut data = b"BI /W 4 /H 4 /BPC 8 /CS /G /F /A85 ID 9jqo^".to_vec();
+            data.extend(glue);
+            data.extend(b"87cURD]i,\"Ebo80~>EI Q BT /F1 12 Tf (AFTER) Tj ET");
+            let expected: Vec<Vec<u8>> =
+                ["BI", "Q", "BT", "Tf", "Tj", "ET"].iter().map(|s| s.as_bytes().to_vec()).collect();
+            assert_eq!(operators(&data), expected, "{}", String::from_utf8_lossy(glue));
+        }
+    }
+
+
     #[test]
     fn tokenizer_interface_preserves_every_byte_boundary() {
         let data = b"% comment\n1 -2.5 /Name /A#20B (a\\(b\\) \\101) <4869> [1 2] << /Key (value) >> [(a) 1] TJ BI /W 1 /H 1 /BPC 8 /CS /DeviceGray ID \x00 EI q Q";
@@ -1014,4 +1273,193 @@ mod tests {
             assert_eq!(windowed, expected, "{:?}", String::from_utf8_lossy(&data));
         }
     }
+
+    #[test]
+    fn unfiltered_inline_image_with_ei_in_samples_is_not_cut_early() {
+        // 48-byte unfiltered DeviceGray image whose first four bytes are `0EI `
+        // followed by valid page content operators (`Q BT ... Tj ET q`).
+        let data = b"q 100 0 0 100 72 650 cm \
+BI /W 48 /H 1 /CS /G /BPC 8 ID 0EI Q BT /F1 18 Tf 72 600 Td (Injected) Tj ET q! EI Q \
+BT /F1 14 Tf 72 550 Td (After) Tj ET";
+        assert_eq!(
+            operators(data),
+            vec![
+                b"q".to_vec(),
+                b"cm".to_vec(),
+                b"BI".to_vec(),
+                b"Q".to_vec(),
+                b"BT".to_vec(),
+                b"Tf".to_vec(),
+                b"Td".to_vec(),
+                b"Tj".to_vec(),
+                b"ET".to_vec(),
+            ]
+        );
+        let expected = slice_instructions(data);
+        for piece in 1..=data.len() {
+            assert_eq!(
+                windowed_instructions(data, || piece),
+                expected,
+                "piece size {piece}"
+            );
+        }
+    }
+
+    #[test]
+    fn oversized_unfiltered_inline_image_does_not_hold_following_content() {
+        for length in [
+            crate::MAX_DECODED_STREAM - 1,
+            crate::MAX_DECODED_STREAM,
+            crate::MAX_DECODED_STREAM + 1,
+        ] {
+            // The next BI supplies the existing EI heuristic's bounded look-ahead. The
+            // stream is not exhausted: an impossible declaration must not pin this window.
+            let data = format!(
+                "BI /W {length} /H 1 /CS /G /BPC 8 ID x EI BT (After) Tj ET \
+                 BI /W 1 /H 1 /CS /G /BPC 8 ID y EI Q"
+            );
+            let mut tokenizer = UntypedIter::new_window(data.as_bytes(), false);
+            for expected in [b"BI".as_slice(), b"BT", b"Tj", b"ET"] {
+                let instruction = tokenizer
+                    .next_instruction()
+                    .expect("following content survives");
+                assert_eq!(
+                    instruction.operator.as_ref(),
+                    expected,
+                    "declared length {length}"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn unfiltered_inline_image_budget_includes_header_and_terminator() {
+        let mut reader = crate::reader::Reader::new(b"/W 1 /H 1 /CS /G /BPC 8 ID ");
+        let inline = reader
+            .read_without_context::<crate::object::dict::InlineImageDict<'_>>()
+            .expect("synthetic inline dictionary");
+        let dict = inline.get_dict();
+        let fits = crate::MAX_DECODED_STREAM - 5; // One sample + whitespace/EI/delimiter.
+        assert!(matches!(
+            super::unfiltered_image_end(b"", dict, false, fits),
+            super::UnfilteredEnd::NeedsMore
+        ));
+        assert!(matches!(
+            super::unfiltered_image_end(b"x    ", dict, false, fits),
+            super::UnfilteredEnd::Fallback
+        ));
+        assert!(matches!(
+            super::unfiltered_image_end(b"x EI", dict, false, fits + 1),
+            super::UnfilteredEnd::Fallback
+        ));
+        assert!(matches!(
+            super::unfiltered_image_end(b"x EI", dict, true, usize::MAX),
+            super::UnfilteredEnd::Found(1, 4)
+        ));
+        for header in [fits + 1, usize::MAX] {
+            assert!(matches!(
+                super::unfiltered_image_end(b"", dict, false, header),
+                super::UnfilteredEnd::Fallback
+            ));
+            // The guard is only for missing bytes, never a reason to reinterpret available samples.
+            assert!(matches!(
+                super::unfiltered_image_end(b"x EI Q", dict, false, header),
+                super::UnfilteredEnd::Found(1, 4)
+            ));
+        }
+    }
+
+    #[test]
+    fn large_unfiltered_inline_image_still_waits_for_its_samples() {
+        // A valid image larger than the interpreter's initial 64 KiB window must
+        // still use its exact length rather than execute operators in its samples.
+        let length = (64 << 10) + 1;
+        let mut data = format!("BI /W {length} /H 1 /CS /G /BPC 8 ID ").into_bytes();
+        let sample_start = data.len();
+        data.extend_from_slice(b"0EI Q BT (Injected) Tj ET q");
+        data.resize(sample_start + length, b'0');
+        data.extend_from_slice(b" EI BT (After) Tj ET");
+        let mut partial = UntypedIter::new_window(&data[..64 << 10], false);
+        assert!(partial.next_instruction().is_none());
+        assert!(partial.needs_more);
+        assert_eq!(partial.committed, 0);
+        assert_eq!(
+            operators(&data),
+            [
+                b"BI".to_vec(),
+                b"BT".to_vec(),
+                b"Tj".to_vec(),
+                b"ET".to_vec()
+            ]
+        );
+        let expected = slice_instructions(&data);
+        for piece in [4096, 64 << 10, data.len()] {
+            assert_eq!(
+                windowed_instructions(&data, || piece),
+                expected,
+                "piece size {piece}"
+            );
+        }
+    }
+
+    #[test]
+    fn unfiltered_inline_image_variants_and_fallbacks() {
+        // ImageMask with 1-bit row padding (width 10 -> 2 bytes per row, height 2 -> 4 bytes)
+        let mask_stream = b"BI /IM true /W 10 /H 2 ID 0EI\n EI Q";
+        assert_eq!(operators(mask_stream), vec![b"BI".to_vec(), b"Q".to_vec()]);
+        let expected_mask = slice_instructions(mask_stream);
+        for piece in 1..=mask_stream.len() {
+            assert_eq!(windowed_instructions(mask_stream, || piece), expected_mask);
+        }
+
+        // Indexed color space with 4-bit samples (width 5 -> 3 bytes per row, height 2 -> 6 bytes)
+        // and explicit /L matching computed length.
+        let indexed_stream =
+            b"BI /Width 5 /Height 2 /CS [/I /RGB 1 <000000ffffff>] /BPC 4 /L 6 ID 0EI Q! EI Q";
+        assert_eq!(
+            operators(indexed_stream),
+            vec![b"BI".to_vec(), b"Q".to_vec()]
+        );
+        let expected_indexed = slice_instructions(indexed_stream);
+        for piece in 1..=indexed_stream.len() {
+            assert_eq!(
+                windowed_instructions(indexed_stream, || piece),
+                expected_indexed
+            );
+        }
+
+        // Conflicting /W and /Width falls back to the heuristic scan; mismatched /L does not disrupt the verified layout.
+        let mismatch_l = b"BI /W 4 /H 1 /CS /G /BPC 8 /L 99 ID abcd EI Q";
+        assert_eq!(operators(mismatch_l), vec![b"BI".to_vec(), b"Q".to_vec()]);
+        let conflict_w = b"BI /W 4 /Width 8 /H 1 /CS /G /BPC 8 ID abcd EI Q";
+        assert_eq!(operators(conflict_w), vec![b"BI".to_vec(), b"Q".to_vec()]);
+    }
+
+    #[test]
+    fn each_layout_keeps_its_computed_length() {
+        let inject = b" EI Q BT /F1 9 Tf (X) Tj ET q";
+        let case = |params: &str, len: usize| {
+            let mut samples = inject.to_vec();
+            samples.resize(len, b'0');
+            let mut data = format!("BI {params} ID ").into_bytes();
+            data.extend_from_slice(&samples);
+            data.extend_from_slice(b" EI Q");
+            data
+        };
+        for (params, len) in [
+            ("/W 16 /H 2 /CS /RGB /BPC 8", 96),
+            ("/W 12 /H 2 /CS /CMYK /BPC 8", 96),
+            ("/W 70 /H 4 /CS /G /BPC 1", 36),
+            ("/IM true /W 70 /H 4", 36),
+            ("/W 30 /H 2 /CS [/I /RGB 1 <000000ffffff>] /BPC 4 /L 30", 30),
+            ("/W 15 /H 2 /CS /G /BPC 16 /L 60", 60),
+            ("/W 47 /H 1 /CS /G /BPC 8 /L 5", 47),
+        ] {
+            assert_eq!(
+                operators(&case(params, len)),
+                vec![b"BI".to_vec(), b"Q".to_vec()],
+                "{params}"
+            );
+        }
+    }
 }
diff --git a/vendor/hayro-syntax/src/filter/ccitt.rs b/vendor/hayro-syntax/src/filter/ccitt.rs
index 98924f2d..a7921a5d 100644
--- a/vendor/hayro-syntax/src/filter/ccitt.rs
+++ b/vendor/hayro-syntax/src/filter/ccitt.rs
@@ -8,18 +8,34 @@ use alloc::vec::Vec;
 use core::iter;
 use hayro_ccitt::{DecodeSettings, Decoder, DecoderContext, EncodingMode};
 
+/// PdfCraft patch: `limit` is the most bytes the filter may produce (see `decode_limit`).
 pub(crate) fn decode(
     data: &[u8],
     params: &Dict<'_>,
     image_params: &ImageDecodeParams,
+    limit: usize,
 ) -> Option<FilterResult<'static>> {
     let k = params.get::<i32>(K).unwrap_or(0);
 
-    let rows = params.get::<u32>(ROWS).unwrap_or(image_params.height);
+    // PdfCraft patch: `/Rows 0` means the height is not predetermined (ISO 32000-2 Table 11, and
+    // the default), not zero rows. Scanners write it on Group 4 pages, which rendered blank.
+    // PdfCraft patch (19): fewer `/Rows` than the image's `/Height` doesn't cut the image short: a
+    // plotter driver wrote `/Rows` equal to `/Columns`, and the rows after it were drawn black
+    // (#3308). The decoder still stops where the data ends.
+    let rows = params
+        .get::<u32>(ROWS)
+        .filter(|&rows| rows != 0)
+        .map_or(image_params.height, |rows| rows.max(image_params.height));
     let end_of_block = params.get::<bool>(END_OF_BLOCK).unwrap_or(true);
+    // A `/Columns` past `u32::MAX` is refused: truncated, it would wrap to a small width that
+    // passes `ccitt_size_ok` and decode the image at the wrong width.
+    let columns = match params.get::<usize>(COLUMNS) {
+        Some(columns) => u32::try_from(columns).ok()?,
+        None => 1728,
+    };
 
     let settings = DecodeSettings {
-        columns: params.get::<usize>(COLUMNS).unwrap_or(1728) as u32,
+        columns,
         rows,
         end_of_block,
         end_of_line: params.get::<bool>(END_OF_LINE).unwrap_or(false),
@@ -38,6 +54,16 @@ pub(crate) fn decode(
     if !super::ccitt_size_ok(settings.columns, settings.rows) {
         return None;
     }
+    // PdfCraft patch: the decoder stops after `rows` rows; with `/Rows 0` (unknown) it ran to the
+    // end of the data, and a bit of 2D code can repeat a whole row, so a small stream produced
+    // gigabytes. Decode at most the rows that fit the output limit and the pixel cap. The limit
+    // counts the stream's own 1-bit rows (`decode_limit`), whatever depth the rows are widened to.
+    let mut settings = settings;
+    let fit = super::ccitt_max_rows(settings.columns, settings.columns.div_ceil(8), limit);
+    settings.rows = if settings.rows == 0 { fit } else { settings.rows.min(fit) };
+    if settings.rows == 0 {
+        return None;
+    }
 
     // Whenever possible (if we don't have an indexed color space), we convert
     // the data as 8-bit instead of 1-bit, so that it can be easier converted
@@ -154,3 +180,22 @@ pub(crate) fn decode(
         }),
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::decode;
+    use crate::object::stream::ImageDecodeParams;
+    use crate::object::{Dict, FromBytes};
+
+    // An 8 x 4 all-black Group 4 stream: one horizontal-mode row, three V0 rows, then EOFB.
+    const ALL_BLACK_8X4: [u8; 6] = [0x26, 0xa2, 0xfe, 0x00, 0x20, 0x02];
+
+    #[test]
+    fn columns_past_u32_max_are_refused_not_wrapped() {
+        let params = ImageDecodeParams { width: 8, height: 4, ..Default::default() };
+        let decoded = |dict: &[u8]| decode(&ALL_BLACK_8X4, &Dict::from_bytes(dict).unwrap(), &params, 1 << 20);
+        assert!(decoded(b"<< /K -1 /Columns 8 >>").is_some());
+        // 2^32 + 8 would wrap to 8 columns.
+        assert!(decoded(b"<< /K -1 /Columns 4294967304 >>").is_none());
+    }
+}
diff --git a/vendor/hayro-syntax/src/filter/jpx.rs b/vendor/hayro-syntax/src/filter/jpx.rs
index 6a788591..d04f3990 100644
--- a/vendor/hayro-syntax/src/filter/jpx.rs
+++ b/vendor/hayro-syntax/src/filter/jpx.rs
@@ -17,20 +17,55 @@ impl ImageColorSpace {
     }
 }
 
-pub(crate) fn decode(data: &[u8], params: &ImageDecodeParams) -> Option<FilterResult<'static>> {
+/// PdfCraft patch: the most pixels a JPEG 2000 image may decode to, as for JBIG2.
+const MAX_PIXELS: u64 = 1 << 28;
+
+/// PdfCraft patch: the least output `limit` a JPEG 2000 image is held to: the limit comes from the
+/// image dictionary's size, which a decoder may round differently from the codestream's.
+const MIN_LIMIT: usize = 64 << 20;
+
+/// PdfCraft patch: `limit` is the most bytes the filter may produce (see `decode_limit`).
+pub(crate) fn decode(data: &[u8], params: &ImageDecodeParams, limit: usize) -> Option<FilterResult<'static>> {
     use crate::object::stream::ImageColorSpace;
 
     let settings = DecodeSettings {
-        resolve_palette_indices: false,
+        // PdfCraft patch: (PdfCraft #3184) with no /ColorSpace in the image dictionary the colors
+        // come from the JP2 header (ISO 32000-2 §7.4.9), so its palette (`pclr`) is applied here;
+        // with a /ColorSpace the header color data is ignored, and an /Indexed space takes the raw
+        // indices. A /ColorSpace that does not resolve also leaves `num_components` unset: the
+        // header's colors are then the only ones there are, so the palette is applied too (raw
+        // indices would be drawn as gray).
+        resolve_palette_indices: params.num_components.is_none(),
         strict: false,
         target_resolution: params.target_dimension,
     };
 
-    let image = hayro_jpeg2000::Image::new(data, &settings).ok()?;
+    // PdfCraft patch (21): a JP2 colour specification naming an enumerated colour space the
+    // decoder refuses (CIEJab, enum 19, in a veraPDF fixture; YCbCr, PhotoYCC, …) made the whole
+    // image fail, so the page drew blank (#3306). Then it is decoded as if it had no colour
+    // specification, as MuPDF and Poppler draw it: grey, RGB or CMYK by its component count.
+    let repaired;
+    let image = match hayro_jpeg2000::Image::new(data, &settings) {
+        Ok(image) => image,
+        Err(_) => {
+            repaired = without_refused_enumerated_colour(data)?;
+            hayro_jpeg2000::Image::new(&repaired, &settings).ok()?
+        }
+    };
 
     let width = image.width();
     let height = image.height();
-    let bpc = params.bpc.unwrap_or(image.original_bit_depth());
+    // PdfCraft patch: (PdfCraft #3184) a resolved palette gives colors, decoded to 8 bits like
+    // every sample; the codestream's precision is that of the indices (1 bit, say), and rescaling
+    // the colors to it kept only 0 or 255 per channel.
+    let palette_resolved = settings.resolve_palette_indices && has_palette(data);
+    // A `/BitsPerComponent` the dictionary gives (JPXDecode ignores it) can't apply to
+    // resolved colors either.
+    let bpc = if palette_resolved {
+        8
+    } else {
+        params.bpc.unwrap_or(image.original_bit_depth())
+    };
     let cs = match image.color_space() {
         ColorSpace::Gray => ImageColorSpace::Gray,
         ColorSpace::RGB => ImageColorSpace::Rgb,
@@ -47,7 +82,23 @@ pub(crate) fn decode(data: &[u8], params: &ImageDecodeParams) -> Option<FilterRe
         },
     };
     let has_alpha = image.has_alpha();
-    let bitmap = image.decode().ok()?;
+    // PdfCraft patch: the decoder sizes its output from the codestream's own dimensions, not the
+    // image dictionary's, and allocates it infallibly. Refuse more than `MAX_PIXELS` pixels or
+    // more than `limit` bytes before decoding, and reserve the buffer fallibly.
+    if u64::from(width) * u64::from(height) > MAX_PIXELS {
+        return None;
+    }
+    let channels = usize::from(cs.num_components()) + usize::from(has_alpha);
+    let len = (width as usize).checked_mul(height as usize)?.checked_mul(channels)?;
+    let output_limit = limit.max(MIN_LIMIT);
+    if len > output_limit {
+        return None;
+    }
+    let mut bitmap = Vec::new();
+    bitmap.try_reserve_exact(len).ok()?;
+    bitmap.resize(len, 0);
+    let mut context = hayro_jpeg2000::DecoderContext::default();
+    image.decode_into(&mut bitmap, &mut context).ok()?;
 
     let (mut data, mut alpha) = if !has_alpha {
         (bitmap, None)
@@ -71,6 +122,18 @@ pub(crate) fn decode(data: &[u8], params: &ImageDecodeParams) -> Option<FilterRe
     // The decoded image is always 8-bit, so if necessary we have to rescale
     // ourselves.
     if bpc != 8 {
+        // PdfCraft patch: the rescaled buffer can be larger than the 8-bit bitmap (up to 32 bits
+        // per component), so bound it, with alpha, by the same output limit.
+        let bits_per_row = (width as usize)
+            .checked_mul(usize::from(cs.num_components()))?
+            .checked_mul(usize::from(bpc))?;
+        let scaled_len = bits_per_row
+            .div_ceil(8)
+            .checked_mul(height as usize)?
+            .checked_mul(if alpha.is_some() { 2 } else { 1 })?;
+        if scaled_len > output_limit {
+            return None;
+        }
         data = scale(&data, bpc, cs.num_components(), width, height)?;
         alpha = alpha.and_then(|alpha| scale(&alpha, bpc, cs.num_components(), width, height));
     }
@@ -87,6 +150,91 @@ pub(crate) fn decode(data: &[u8], params: &ImageDecodeParams) -> Option<FilterRe
     })
 }
 
+/// PdfCraft patch: (PdfCraft #3184) whether JP2 file `data` has a palette box (`pclr`) in its
+/// header box (`jp2h`, ISO 15444-1 I.5.3.4). A raw codestream has none.
+fn has_palette(data: &[u8]) -> bool {
+    boxes(data)
+        .find(|&(kind, _, _)| kind == *b"jp2h")
+        .and_then(|(_, start, end)| data.get(start..end))
+        .is_some_and(|header| boxes(header).any(|(kind, _, _)| kind == *b"pclr"))
+}
+
+/// The enumerated colour spaces (`EnumCS`, ISO 15444-1 I.5.3.3 and 15444-2 M.11.7.2) the decoder
+/// handles: CMYK, CIELab, sRGB, greyscale, sYCC, e-sRGB and ROMM-RGB.
+const DECODED_ENUMERATED: [u32; 7] = [12, 14, 16, 17, 18, 20, 21];
+
+/// PdfCraft patch (21): a copy of JP2 file `data` whose colour specification boxes (`colr`, in
+/// the `jp2h` header box) that name an enumerated colour space outside [`DECODED_ENUMERATED`]
+/// name the space the decoder assumes without one instead: greyscale, sRGB or CMYK for 1, 3 or
+/// 4 components (`ihdr`). `None` when there is nothing to change or the boxes can't be read.
+pub(crate) fn without_refused_enumerated_colour(data: &[u8]) -> Option<Vec<u8>> {
+    let header = boxes(data).find(|&(kind, _, _)| kind == *b"jp2h")?;
+    let (_, start, end) = header;
+    let inner = data.get(start..end)?;
+    let (_, ih_start, _) = boxes(inner).find(|&(kind, _, _)| kind == *b"ihdr")?;
+    // ihdr: height (4), width (4), number of components (2).
+    let components = u16::from_be_bytes(inner.get(ih_start + 8..ih_start + 10)?.try_into().ok()?);
+    let replacement: u32 = match components {
+        1 => 17,
+        3 => 16,
+        4 => 12,
+        _ => return None,
+    };
+    // Where each refused enum is, found before anything is copied: a stream the decoder refused
+    // for another reason isn't copied for nothing.
+    let mut refused = Vec::new();
+    for (kind, body, body_end) in boxes(inner) {
+        if kind != *b"colr" {
+            continue;
+        }
+        // colr: METH (1), PREC (1), APPROX (1), then EnumCS (4) when METH is 1.
+        let colr = inner.get(body..body_end)?;
+        if colr.first() != Some(&1) {
+            continue;
+        }
+        let enumerated = u32::from_be_bytes(colr.get(3..7)?.try_into().ok()?);
+        if DECODED_ENUMERATED.contains(&enumerated) {
+            continue;
+        }
+        refused.push(start.checked_add(body)?.checked_add(3)?);
+    }
+    if refused.is_empty() {
+        return None;
+    }
+    let mut out = data.to_vec();
+    for at in refused {
+        out.get_mut(at..at.checked_add(4)?)?.copy_from_slice(&replacement.to_be_bytes());
+    }
+    Some(out)
+}
+
+/// The boxes in `data` (ISO 15444-1 I.4): each one's type and the start and end of its contents.
+/// Stops at the first box whose length doesn't fit.
+fn boxes(data: &[u8]) -> impl Iterator<Item = ([u8; 4], usize, usize)> + '_ {
+    let mut at = 0usize;
+    core::iter::from_fn(move || {
+        let length = u32::from_be_bytes(data.get(at..at.checked_add(4)?)?.try_into().ok()?);
+        let kind: [u8; 4] = data.get(at + 4..at.checked_add(8)?)?.try_into().ok()?;
+        let (header, size) = match length {
+            // The rest of the data.
+            0 => (8, data.len().checked_sub(at)?),
+            // An 8-byte length follows the type.
+            1 => {
+                let large = u64::from_be_bytes(data.get(at + 8..at.checked_add(16)?)?.try_into().ok()?);
+                (16, usize::try_from(large).ok()?)
+            }
+            n => (8, usize::try_from(n).ok()?),
+        };
+        let end = at.checked_add(size)?;
+        if size < header || end > data.len() {
+            return None;
+        }
+        let item = (kind, at + header, end);
+        at = end;
+        Some(item)
+    })
+}
+
 fn scale(
     data: &[u8],
     bit_per_component: u8,
@@ -111,7 +259,9 @@ fn scale(
         .checked_mul(num_components as usize)?
         .checked_mul(bit_per_component as usize)?;
     let input_len = bits_per_row.div_ceil(8).checked_mul(height as usize)?;
-    let mut input = vec![0; input_len];
+    let mut input = Vec::new();
+    input.try_reserve_exact(input_len).ok()?;
+    input.resize(input_len, 0);
     let mut writer = BitWriter::new(&mut input, bit_per_component)?;
     let components_per_row = (num_components as usize).checked_mul(width as usize)?;
 
@@ -134,8 +284,9 @@ fn scale(
 
 #[cfg(test)]
 mod tests {
-    use super::scale;
+    use super::{decode, scale, without_refused_enumerated_colour};
     use crate::bit_reader::{BitReader, bit_mask};
+    use crate::object::stream::{ImageColorSpace, ImageDecodeParams};
     use alloc::vec::Vec;
 
     #[test]
@@ -188,4 +339,209 @@ mod tests {
             }
         }
     }
+
+    /// A JP2 header (`jp2h`) holding `ihdr` for `components` and the given `colr` bodies, with
+    /// a codestream box after it.
+    fn jp2(components: u16, colrs: &[&[u8]]) -> Vec<u8> {
+        let jp2_box = |kind: &[u8], body: &[u8]| {
+            let mut b = ((8 + body.len()) as u32).to_be_bytes().to_vec();
+            b.extend_from_slice(kind);
+            b.extend_from_slice(body);
+            b
+        };
+        let mut ihdr = Vec::new();
+        ihdr.extend_from_slice(&[0, 0, 0, 1, 0, 0, 0, 1]);
+        ihdr.extend_from_slice(&components.to_be_bytes());
+        ihdr.extend_from_slice(&[7, 7, 0, 0]);
+        let mut header = jp2_box(b"ihdr", &ihdr);
+        for c in colrs {
+            header.extend(jp2_box(b"colr", c));
+        }
+        let mut out = jp2_box(b"ftyp", b"jp2 \0\0\0\0jp2 ");
+        out.extend(jp2_box(b"jp2h", &header));
+        out.extend(jp2_box(b"jp2c", &[0xff, 0x4f]));
+        out
+    }
+
+    fn enumerated(e: u32) -> Vec<u8> {
+        let mut c = alloc::vec![1, 0, 0];
+        c.extend_from_slice(&e.to_be_bytes());
+        c
+    }
+
+    /// The enumerated colour spaces found in the copy's `colr` boxes, in order.
+    fn enums_in(data: &[u8]) -> Vec<u32> {
+        data.windows(4)
+            .enumerate()
+            .filter(|(_, w)| *w == b"colr")
+            .filter(|(i, _)| data.get(i + 4) == Some(&1))
+            .map(|(i, _)| u32::from_be_bytes(data[i + 7..i + 11].try_into().unwrap()))
+            .collect()
+    }
+
+    #[test]
+    fn refused_enumerated_colour_spaces_become_the_component_counts_default() {
+        // CIEJab (19) and other refused spaces, by component count.
+        for (components, refused, expected) in [(3, 19, 16), (3, 22, 16), (1, 15, 17), (4, 13, 12), (3, 1, 16)] {
+            let data = jp2(components, &[&enumerated(refused)]);
+            let out = without_refused_enumerated_colour(&data).unwrap();
+            assert_eq!(enums_in(&out), [expected], "{refused} with {components} component(s)");
+            assert_eq!(out.len(), data.len(), "only the enum changes");
+        }
+        // Several colour specifications: each refused one, and only those.
+        let out = without_refused_enumerated_colour(&jp2(3, &[&enumerated(19), &enumerated(14), &enumerated(24)])).unwrap();
+        assert_eq!(enums_in(&out), [16, 14, 16]);
+        // An 8-byte box length (LBox 1) is read too.
+        let mut long = jp2(3, &[&enumerated(19)]);
+        let at = long.windows(4).position(|w| w == b"jp2h").unwrap() - 4;
+        let len = u32::from_be_bytes(long[at..at + 4].try_into().unwrap()) as u64 + 8;
+        long.splice(at..at + 4, [0, 0, 0, 1]);
+        long.splice(at + 8..at + 8, (len).to_be_bytes());
+        assert_eq!(enums_in(&without_refused_enumerated_colour(&long).unwrap()), [16]);
+    }
+
+    #[test]
+    fn what_the_decoder_handles_or_cant_be_read_is_left_alone() {
+        for known in [12, 14, 16, 17, 18, 20, 21] {
+            assert_eq!(without_refused_enumerated_colour(&jp2(3, &[&enumerated(known)])), None, "{known}");
+        }
+        // An ICC profile (METH 2), a component count with no default, no header at all.
+        // (Its bytes where an enum would be read say 19: only METH 1 is an enum.)
+        assert_eq!(without_refused_enumerated_colour(&jp2(3, &[&[2, 0, 0, 0, 0, 0, 19, 0, 0]])), None);
+        assert_eq!(without_refused_enumerated_colour(&jp2(2, &[&enumerated(19)])), None);
+        assert_eq!(without_refused_enumerated_colour(&[0xff, 0x4f, 0xff, 0x51]), None);
+        // Damaged lengths: none of these may panic, and none is changed.
+        let good = jp2(3, &[&enumerated(19)]);
+        for cut in 0..good.len() {
+            let _ = without_refused_enumerated_colour(&good[..cut]);
+        }
+        for bad in [0x0000_0004_u32, 0x7fff_ffff, 0xffff_ffff] {
+            let mut data = good.clone();
+            let at = data.windows(4).position(|w| w == b"colr").unwrap() - 4;
+            data[at..at + 4].copy_from_slice(&bad.to_be_bytes());
+            assert_eq!(without_refused_enumerated_colour(&data), None, "{bad:#x}");
+        }
+    }
+
+    /// A 4x2 JP2 written for this test: one 8-bit component whose samples (0, 1) index a
+    /// two-entry sRGB palette (`pclr` + `cmap`): red, then blue. Rows: 0 1 0 1 / 1 0 1 0.
+    const PALETTE_JP2: &[u8] = &[
+        0x00, 0x00, 0x00, 0x0c, 0x6a, 0x50, 0x20, 0x20, 0x0d, 0x0a, 0x87, 0x0a, 0x00, 0x00, 0x00,
+        0x14, 0x66, 0x74, 0x79, 0x70, 0x6a, 0x70, 0x32, 0x20, 0x00, 0x00, 0x00, 0x00, 0x6a, 0x70,
+        0x32, 0x20, 0x00, 0x00, 0x00, 0x55, 0x6a, 0x70, 0x32, 0x68, 0x00, 0x00, 0x00, 0x16, 0x69,
+        0x68, 0x64, 0x72, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x07, 0x07,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x63, 0x6f, 0x6c, 0x72, 0x01, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x10, 0x00, 0x00, 0x00, 0x14, 0x70, 0x63, 0x6c, 0x72, 0x00, 0x02, 0x03, 0x07, 0x07,
+        0x07, 0xff, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x00, 0x14, 0x63, 0x6d, 0x61, 0x70,
+        0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x02, 0x00, 0x00, 0x00,
+        0x8c, 0x6a, 0x70, 0x32, 0x63, 0xff, 0x4f, 0xff, 0x51, 0x00, 0x29, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x04, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x01, 0x07, 0x01, 0x01, 0xff, 0x52, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01,
+        0x04, 0x04, 0x00, 0x01, 0xff, 0x5c, 0x00, 0x07, 0x40, 0x40, 0x48, 0x48, 0x50, 0xff, 0x64,
+        0x00, 0x25, 0x00, 0x01, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20,
+        0x4f, 0x70, 0x65, 0x6e, 0x4a, 0x50, 0x45, 0x47, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+        0x6e, 0x20, 0x32, 0x2e, 0x35, 0x2e, 0x34, 0xff, 0x90, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x17, 0x00, 0x01, 0xff, 0x93, 0xcf, 0xb4, 0x08, 0x08, 0x67, 0x90, 0x07, 0x41, 0x08,
+        0xff, 0xd9,
+    ];
+
+    /// PdfCraft #3179: with no `/ColorSpace` in the image dictionary, the JP2 palette gives the
+    /// colors. Raw indices (0 and 1) would come back as a gray image, drawn as noise.
+    #[test]
+    fn jpx_palette_is_applied_without_a_color_space() {
+        let params = ImageDecodeParams {
+            width: 4,
+            height: 2,
+            ..ImageDecodeParams::default()
+        };
+        let result = decode(PALETTE_JP2, &params, usize::MAX).unwrap();
+        let image = result.image_data.unwrap();
+        assert!(matches!(image.color_space, Some(ImageColorSpace::Rgb)));
+        let red = [255, 0, 0];
+        let blue = [0, 0, 255];
+        let expected: Vec<u8> = [red, blue, red, blue, blue, red, blue, red].concat();
+        assert_eq!(&*result.data, &expected[..]);
+    }
+
+    /// With an `/Indexed` color space in the dictionary, the PDF supplies the palette, so the raw
+    /// indices are what the image holds.
+    #[test]
+    fn jpx_palette_indices_stay_raw_for_an_indexed_color_space() {
+        let params = ImageDecodeParams {
+            is_indexed: true,
+            num_components: Some(1),
+            width: 4,
+            height: 2,
+            ..ImageDecodeParams::default()
+        };
+        let result = decode(PALETTE_JP2, &params, usize::MAX).unwrap();
+        assert_eq!(&*result.data, &[0, 1, 0, 1, 1, 0, 1, 0][..]);
+    }
+
+    /// A 1x1, 1-bit codestream (one empty packet, so its sample is the midpoint 1) as a JP2 file
+    /// whose header holds `extra` boxes after `ihdr` and `colr`.
+    fn one_bit_jp2(extra: &[u8]) -> Vec<u8> {
+        let jp2_box = |kind: &[u8], body: &[u8]| {
+            let mut b = ((8 + body.len()) as u32).to_be_bytes().to_vec();
+            b.extend_from_slice(kind);
+            b.extend_from_slice(body);
+            b
+        };
+        let mut codestream = alloc::vec![0xff, 0x4f, 0xff, 0x51, 0, 41, 0, 0];
+        for value in [1_u32, 1, 0, 0, 1, 1, 0, 0] {
+            codestream.extend_from_slice(&value.to_be_bytes());
+        }
+        codestream.extend_from_slice(&[0, 1, 0, 1, 1]);
+        codestream.extend_from_slice(&[0xff, 0x52, 0, 12, 0, 0, 0, 1, 0, 0, 4, 4, 0, 1]);
+        codestream.extend_from_slice(&[0xff, 0x5c, 0, 4, 0x40, 0x40]);
+        codestream.extend_from_slice(&[0xff, 0x90, 0, 10, 0, 0, 0, 0, 0, 15, 0, 1, 0xff, 0x93, 0]);
+        codestream.extend_from_slice(&[0xff, 0xd9]);
+        let mut header = jp2_box(b"ihdr", &[0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 7, 0, 0]);
+        header.extend(jp2_box(b"colr", &[1, 0, 0, 0, 0, 0, 16]));
+        header.extend_from_slice(extra);
+        let mut out = alloc::vec![0, 0, 0, 12, b'j', b'P', b' ', b' ', 0x0d, 0x0a, 0x87, 0x0a];
+        out.extend(jp2_box(b"ftyp", b"jp2 \0\0\0\0jp2 "));
+        out.extend(jp2_box(b"jp2h", &header));
+        out.extend(jp2_box(b"jp2c", &codestream));
+        out
+    }
+
+    /// PdfCraft #3184: resolved palette colors are 8-bit samples whatever the indices' precision;
+    /// an image without a palette keeps its own (1 bit here).
+    #[test]
+    fn palette_colours_are_eight_bit_and_other_samples_keep_their_precision() {
+        let params = ImageDecodeParams {
+            width: 1,
+            height: 1,
+            ..ImageDecodeParams::default()
+        };
+        let bpc = |data: &[u8]| {
+            decode(data, &params, usize::MAX)
+                .and_then(|r| r.image_data)
+                .map(|d| d.bits_per_component)
+        };
+        let mut palette = Vec::new();
+        for (kind, body) in [
+            (
+                &b"pclr"[..],
+                &[0, 2, 3, 7, 7, 7, 255, 0, 0, 64, 128, 192][..],
+            ),
+            (b"cmap", &[0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 2]),
+        ] {
+            palette.extend_from_slice(&((8 + body.len()) as u32).to_be_bytes());
+            palette.extend_from_slice(kind);
+            palette.extend_from_slice(body);
+        }
+        assert_eq!(bpc(&one_bit_jp2(&palette)), Some(8));
+        assert_eq!(bpc(&one_bit_jp2(&[])), Some(1));
+        let one_bit = ImageDecodeParams {
+            bpc: Some(1),
+            ..params.clone()
+        };
+        let palette_bpc = decode(&one_bit_jp2(&palette), &one_bit, usize::MAX)
+            .and_then(|r| r.image_data)
+            .map(|d| d.bits_per_component);
+        assert_eq!(palette_bpc, Some(8), "/BitsPerComponent 1 with a palette");
+    }
 }
diff --git a/vendor/hayro-syntax/src/filter/lzw_flate.rs b/vendor/hayro-syntax/src/filter/lzw_flate.rs
index e65e83bd..9642a749 100644
--- a/vendor/hayro-syntax/src/filter/lzw_flate.rs
+++ b/vendor/hayro-syntax/src/filter/lzw_flate.rs
@@ -560,23 +560,27 @@ pub(crate) mod flate {
 
             /// Copies `left` bytes from `distance` back in the output, up to the limit. Returns how
             /// many are still to copy. A copy whose source does not exist writes nothing.
-            fn copy_back(&mut self, valid: bool, distance: usize, mut left: usize) -> usize {
-                while left > 0 && self.output.len() < self.limit {
-                    if valid {
-                        let byte = self
-                            .output
-                            .len()
-                            .checked_sub(distance)
-                            .and_then(|index| self.output.get(index))
-                            .copied();
-                        if let Some(byte) = byte {
-                            self.output.push(byte);
-                        }
+            fn copy_back(&mut self, valid: bool, distance: usize, left: usize) -> usize {
+                let len = self.output.len();
+                // Without a source the copy writes nothing, and it runs out only at the limit.
+                let Some(mut start) = len.checked_sub(distance).filter(|_| valid && distance > 0) else {
+                    return if len < self.limit { 0 } else { left };
+                };
+                // PdfCraft patch: copy in runs of up to `distance` bytes. Each run reads only bytes
+                // already in the output, so the bytes are the ones a byte-at-a-time copy writes.
+                let copy = left.min(self.limit.saturating_sub(len));
+                let mut done = 0;
+                while done < copy {
+                    let end = start.saturating_add((copy - done).min(distance));
+                    if end > self.output.len() {
+                        break;
                     }
-                    left -= 1;
+                    self.output.extend_from_within(start..end);
+                    done += end - start;
+                    start = end;
                 }
 
-                left
+                left - done
             }
 
             fn read_dynamic_tables(&mut self) -> Option<(HuffmanTable, HuffmanTable)> {
@@ -1318,6 +1322,52 @@ mod tests {
         );
     }
 
+    /// PdfCraft patch: 300 zero bytes, zlib-compressed: one literal, then copies of distance 1 that
+    /// are longer than their distance.
+    const ZEROS_300: [u8; 13] = [0x78, 0xda, 0x63, 0x60, 0x18, 0x05, 0xc4, 0x02, 0x00, 0x01, 0x2c, 0x00, 0x01];
+
+    #[test]
+    fn back_reference_longer_than_its_distance_repeats_its_source() {
+        let mut state = flate::FlateState::new(&ZEROS_300);
+        let mut out = Vec::new();
+        state.decode_into(&ZEROS_300, &mut out, 1000);
+
+        assert_eq!(out, vec![0; 300]);
+    }
+
+    #[test]
+    fn back_reference_cut_by_the_limit_resumes_in_the_next_call() {
+        let mut state = flate::FlateState::new(&ZEROS_300);
+        let mut out = Vec::new();
+        state.decode_into(&ZEROS_300, &mut out, 100);
+        assert_eq!(out, vec![0; 100]);
+
+        state.decode_into(&ZEROS_300, &mut out, 1000);
+        assert_eq!(out, vec![0; 300]);
+    }
+
+    #[test]
+    fn back_reference_reads_bytes_written_by_an_earlier_call() {
+        // "abc" repeated 2000 times, zlib-compressed: copies reach 3 bytes back, and the calls below
+        // stop every 7 bytes, so most copies start in an earlier call's output.
+        const ABC_2000: [u8; 32] = [
+            0x78, 0xda, 0xed, 0xc2, 0x41, 0x11, 0x00, 0x00, 0x0c, 0x02, 0xa0, 0xac, 0x6a, 0xff, 0x0e, 0x0b,
+            0xb1, 0x2f, 0x1c, 0xe9, 0xa2, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xfe, 0x1e, 0x2f, 0x01, 0xf9, 0x59,
+        ];
+        let expected = b"abc".repeat(2000);
+        let mut state = flate::FlateState::new(&ABC_2000);
+        let mut out = Vec::new();
+        loop {
+            let before = out.len();
+            state.decode_into(&ABC_2000, &mut out, before + 7);
+            if out.len() == before || out.len() >= expected.len() {
+                break;
+            }
+        }
+
+        assert_eq!(out, expected);
+    }
+
     #[test]
     fn predictor_paeth() {
         predictor_test(
diff --git a/vendor/hayro-syntax/src/filter/mod.rs b/vendor/hayro-syntax/src/filter/mod.rs
index e3622795..c6ee6ed2 100644
--- a/vendor/hayro-syntax/src/filter/mod.rs
+++ b/vendor/hayro-syntax/src/filter/mod.rs
@@ -110,11 +110,11 @@ impl Filter {
             #[cfg(feature = "images")]
             Self::DctDecode => dct::decode(data, params, image_params).ok_or(DecodeFailure::ImageDecode),
             #[cfg(feature = "images")]
-            Self::CcittFaxDecode => ccitt::decode(data, params, image_params).ok_or(DecodeFailure::ImageDecode),
+            Self::CcittFaxDecode => ccitt::decode(data, params, image_params, limit).ok_or(DecodeFailure::ImageDecode),
             #[cfg(feature = "images")]
             Self::Jbig2Decode => jbig2::decode(data, params, image_params).ok_or(DecodeFailure::ImageDecode),
             #[cfg(feature = "images")]
-            Self::JpxDecode => jpx::decode(data, image_params).ok_or(DecodeFailure::ImageDecode),
+            Self::JpxDecode => jpx::decode(data, image_params, limit).ok_or(DecodeFailure::ImageDecode),
             #[cfg(not(feature = "images"))]
             Self::DctDecode | Self::CcittFaxDecode | Self::Jbig2Decode | Self::JpxDecode => {
                 warn!("image decoding is not supported (enable the `images` feature)");
@@ -168,6 +168,30 @@ pub(crate) fn decode_limit(params: &ImageDecodeParams, last: bool, limits: crate
 /// real fax lines are a few thousand pixels wide.
 pub fn ccitt_size_ok(columns: u32, rows: u32) -> bool {
     const MAX_COLUMNS: u32 = 1 << 20;
-    const MAX_PIXELS: u64 = 1 << 28;
-    columns > 0 && columns <= MAX_COLUMNS && u64::from(columns) * u64::from(rows.max(1)) <= MAX_PIXELS
+    columns > 0 && columns <= MAX_COLUMNS && u64::from(columns) * u64::from(rows.max(1)) <= MAX_CCITT_PIXELS
+}
+
+/// PdfCraft patch: the most pixels a CCITT image may decode to.
+const MAX_CCITT_PIXELS: u64 = 1 << 28;
+
+/// PdfCraft patch: the most rows of `columns` pixels, `row_bytes` bytes each once decoded, that fit
+/// both `limit` bytes and the pixel cap; at least one when one row fits.
+pub(crate) fn ccitt_max_rows(columns: u32, row_bytes: u32, limit: usize) -> u32 {
+    let by_pixels = MAX_CCITT_PIXELS / u64::from(columns.max(1));
+    let by_bytes = u64::try_from(limit).unwrap_or(u64::MAX) / u64::from(row_bytes.max(1));
+    u32::try_from(by_pixels.min(by_bytes)).unwrap_or(u32::MAX)
+}
+
+#[cfg(test)]
+mod ccitt_tests {
+    use super::ccitt_max_rows;
+
+    /// PdfCraft patch: an image of unknown height decodes at most the rows that fit both the output
+    /// limit (in 1-bit rows) and the 2^28-pixel cap.
+    #[test]
+    fn unknown_ccitt_rows_fit_the_limit_and_the_pixel_cap() {
+        assert_eq!(ccitt_max_rows(1728, 216, 216 * 100), 100);
+        assert_eq!(ccitt_max_rows(1 << 20, 1 << 17, usize::MAX), 1 << 8);
+        assert_eq!(ccitt_max_rows(1728, 216, 100), 0);
+    }
 }
diff --git a/vendor/hayro-syntax/src/object/number.rs b/vendor/hayro-syntax/src/object/number.rs
index b9985612..b887333e 100644
--- a/vendor/hayro-syntax/src/object/number.rs
+++ b/vendor/hayro-syntax/src/object/number.rs
@@ -70,6 +70,13 @@ impl Number {
 impl Skippable for Number {
     fn skip(r: &mut Reader<'_>, _: bool) -> Option<()> {
         let has_sign = r.forward_if(|b| b == b'+' || b == b'-').is_some();
+        // PdfCraft patch: one more sign, so that skipping a number covers what `read_inner`
+        // reads. `--280` was already covered by the `b'-'` arm below, but `-+280` and `++280`
+        // were not, and a skip that fails where a read succeeds puts the reader back where it
+        // started (#3630 review).
+        if has_sign {
+            r.forward_if(|b| b == b'+' || b == b'-');
+        }
 
         // Some PDFs have weird trailing minuses, so try to accept those as well.
         match r.peek_byte()? {
@@ -113,19 +120,25 @@ impl Readable<'_> for Number {
 
 #[inline(always)]
 fn read_inner(r: &mut Reader<'_>) -> Option<Number> {
-    let first = r.peek_byte()?;
-    let has_sign = matches!(first, b'+' | b'-');
-    let negative = match first {
-        b'-' => {
-            r.forward();
-            true
-        }
-        b'+' => {
-            r.forward();
-            false
-        }
-        _ => false,
-    };
+    // PdfCraft patch: a doubled sign is one number, not two. `--280` left `negative` set with no
+    // digits read, so it returned 0 and the reader stopped on `-280`, which became a second
+    // number: a `cm` with it got seven operands, kept the last six, and the matrix
+    // `0 0 1 0 -280 10` hid everything drawn under it (#3565). `Number::skip` above already
+    // consumes the whole token, so read and skip disagreed about where the number ended.
+    //
+    // One extra sign is absorbed and the value is negative if either sign was a minus, which is
+    // what the COS lexer does since #3299 (`--280` and `+-280` are both -280). A third sign is
+    // left to the digit loop's trailing-minus arm, as before.
+    let mut negative = false;
+    let mut signs = 0;
+    while signs < 2
+        && let Some(b @ (b'-' | b'+')) = r.peek_byte()
+    {
+        r.forward();
+        negative |= b == b'-';
+        signs += 1;
+    }
+    let has_sign = signs > 0;
 
     // PdfCraft patch: high-precision float mantissa overflow (jsPDF double-precision coordinates).
     // Digits that don't fit in `mantissa` are dropped: past the dot they are only precision;
@@ -350,6 +363,39 @@ mod tests {
     use crate::reader::Reader;
     use crate::reader::ReaderExt;
 
+    /// PdfCraft patch: a doubled sign is one number. `--280` returned 0 and left `-280` to be
+    /// read as a second number, so a `cm` carrying it got seven operands and a degenerate matrix
+    /// (#3565). The COS lexer reads these the same way since #3299.
+    #[test]
+    fn a_doubled_sign_is_one_number() {
+        for (src, want) in [("--280", -280), ("+-280", -280), ("-+280", -280), ("++280", 280), ("-280", -280), ("+280", 280)] {
+            let mut r = Reader::new(src.as_bytes());
+            assert_eq!(r.read_without_context::<i32>().unwrap(), want, "{src}");
+            assert!(r.at_end(), "{src}: the whole number was read, leaving nothing for a second one");
+        }
+        // The fraction too, and a lone sign is still zero.
+        assert_eq!(Reader::new("--280.5".as_bytes()).read_without_context::<f64>().unwrap(), -280.5);
+        assert_eq!(Reader::new("-".as_bytes()).read_without_context::<i32>().unwrap(), 0);
+
+        // Skipping covers what reading accepts: a skip that fails where a read succeeds puts the
+        // reader back where it started, so `Object::skip` would leave the number in place
+        // (#3630 review).
+        for src in ["--280", "+-280", "-+280", "++280", "-280", "+280", "--280.5"] {
+            let mut r = Reader::new(src.as_bytes());
+            assert!(r.skip::<Number>(false).is_some(), "{src}: not skipped");
+            assert!(r.at_end(), "{src}: only part of the number was skipped");
+        }
+        // A doubled sign alone is a zero token, like a single one.
+        for token in ["--", "+-", "-+", "++"] {
+            let bytes = format!("{token} 3");
+            let mut skipped = Reader::new(bytes.as_bytes());
+            assert!(skipped.skip::<Number>(false).is_some(), "{token}");
+            let mut read = Reader::new(bytes.as_bytes());
+            assert_eq!(read.read_without_context::<Number>().unwrap().as_f64(), 0.0, "{token}");
+            assert_eq!(read.offset(), skipped.offset(), "{token}");
+        }
+    }
+
     #[test]
     fn tolerant_signed_and_dot_zero_tokens_match_skip() {
         for token in ["+", "-", ".", "+.", "-.", "0", "+0", "-0", "0.", "+0.", "-0."] {
diff --git a/vendor/hayro-syntax/src/object/stream.rs b/vendor/hayro-syntax/src/object/stream.rs
index c975ed9f..7de3b297 100644
--- a/vendor/hayro-syntax/src/object/stream.rs
+++ b/vendor/hayro-syntax/src/object/stream.rs
@@ -351,14 +351,25 @@ impl FilterResult<'_> {
     }
 }
 
+/// PdfCraft patch (20): the end-of-line after the `stream` keyword. Microsoft Reporting Services
+/// writes `stream \r\n`, a space before the line break, which the specification does not allow.
+/// Without this the content stream was taken to start at the space, failed to inflate, and the
+/// page rendered blank (bank statements, invoices) while other viewers showed it. Only spaces and
+/// tabs are skipped, and only when a line break follows, so stream data is never swallowed.
+fn forward_stream_eol(r: &mut Reader<'_>) -> Option<()> {
+    r.forward_while(|b| b == b' ' || b == b'\t');
+    r.forward_tag(b"\n")
+        .or_else(|| r.forward_tag(b"\r\n"))
+        // Technically not allowed, but no reason to not try it.
+        .or_else(|| r.forward_tag(b"\r"))
+}
+
 fn parse_proper<'a>(r: &mut Reader<'a>, dict: &Dict<'a>) -> Option<Stream<'a>> {
     let length = dict.get::<u32>(LENGTH)?;
 
     r.skip_white_spaces_and_comments();
     r.forward_tag(b"stream")?;
-    r.forward_tag(b"\n")
-        .or_else(|| r.forward_tag(b"\r\n"))
-        .or_else(|| r.forward_tag(b"\r"))?;
+    forward_stream_eol(r)?;
     let data = r.read_bytes(length as usize)?;
     r.skip_white_spaces();
     r.forward_tag(b"endstream")?;
@@ -374,11 +385,7 @@ fn parse_fallback<'a>(r: &mut Reader<'a>, dict: &Dict<'a>) -> Option<Stream<'a>>
     // A wrong `/Length` still recovers, because that keyword sits directly after the dict.
     r.skip_white_spaces_and_comments();
     r.forward_tag(b"stream")?;
-
-    r.forward_tag(b"\n")
-        .or_else(|| r.forward_tag(b"\r\n"))
-        // Technically not allowed, but no reason to not try it.
-        .or_else(|| r.forward_tag(b"\r"))?;
+    forward_stream_eol(r)?;
 
     let tail = r.tail()?;
     let endstream_offset = find_needle(tail, b"endstream")?;
@@ -463,4 +470,21 @@ mod tests {
         let mut r = Reader::new(data);
         assert!(r.read_with_context::<Stream<'_>>(&ReaderContext::dummy()).is_none());
     }
+
+    /// PdfCraft patch (20): spaces or tabs between `stream` and its line break are skipped.
+    #[test]
+    fn stream_keyword_may_be_followed_by_spaces_before_the_line_break() {
+        for data in [
+            &b"<< /Length 10 >> stream \r\nabcdefghij\nendstream"[..],
+            &b"<< /Length 10 >> stream\t \nabcdefghij\nendstream"[..],
+            &b"<< /Length 999 >> stream \r\nabcdefghij\nendstream"[..],
+        ] {
+            let mut r = Reader::new(data);
+            let stream = r
+                .read_with_context::<Stream<'_>>(&ReaderContext::dummy())
+                .unwrap();
+
+            assert_eq!(stream.data, b"abcdefghij");
+        }
+    }
 }
diff --git a/vendor/hayro-syntax/src/page.rs b/vendor/hayro-syntax/src/page.rs
index 20d6adef..62e8c457 100644
--- a/vendor/hayro-syntax/src/page.rs
+++ b/vendor/hayro-syntax/src/page.rs
@@ -604,9 +604,17 @@ impl<'a> Page<'a> {
         {
             (A4.width() as f32, A4.height() as f32)
         } else {
+            // PdfCraft patch: retain a one-point floor after UserUnit, not one raw unit.
+            // The stored unit is finite and within 1..=75000. Round upward only if the
+            // reciprocal's f32 product would fall below one and trigger a placeholder.
+            let mut raw_floor = 1.0 / self.user_unit;
+            if raw_floor * self.user_unit < 1.0 {
+                raw_floor = raw_floor.next_up();
+            }
+            let raw_floor = f64::from(raw_floor);
             (
-                crop_box.width().max(1.0) as f32,
-                crop_box.height().max(1.0) as f32,
+                crop_box.width().max(raw_floor) as f32,
+                crop_box.height().max(raw_floor) as f32,
             )
         }
     }
@@ -1005,6 +1013,45 @@ mod page_tree_tests {
         assert_eq!(repaired.get().len(), 1);
         assert_eq!(repaired.get()[0].raw().obj_id().unwrap().obj_number, 3);
     }
+
+    fn raw_crop_unit_page(unit: f64, crop: [f64; 4]) -> Vec<u8> {
+        let bounds = crop.map(|n| n.to_string()).join(" ");
+        let objects = [
+            "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+            format!("<< /Type /Page /Parent 2 0 R /MediaBox [{bounds}] /CropBox [{bounds}] /UserUnit {unit} /Resources << >> /Contents [] >>"),
+        ];
+        pdf_bytes(&objects)
+    }
+
+    /// PdfCraft patch: a tiny crop box keeps a one-point floor after `/UserUnit`, not one raw unit.
+    #[test]
+    fn raw_crop_unit_floor_is_one_point_after_user_unit() {
+        for (unit, width, height) in [(1.0, 1.0, 1.0), (4096.0, 512.0, 1024.0), (75000.0, 9375.0, 18750.0)] {
+            let pdf = Pdf::new(raw_crop_unit_page(unit, [10.0, 20.0, 10.125, 20.25])).unwrap();
+            let page = &pdf.pages()[0];
+            assert_eq!(page.base_dimensions(), ((width / unit) as f32, (height / unit) as f32), "unit={unit}");
+        }
+        // In f32, the nearest reciprocal of 41 or 47 multiplies back to 0.99999994.
+        for unit in [1.0, 41.0, 47.0] {
+            let pdf = Pdf::new(raw_crop_unit_page(unit, [0.0, 0.0, 0.01, 0.01])).unwrap();
+            let page = &pdf.pages()[0];
+            let (width, height) = page.base_dimensions();
+            assert!(width * page.user_unit() >= 1.0 && height * page.user_unit() >= 1.0, "unit={unit}");
+            let (width, height) = page.render_dimensions();
+            assert!((1.0..=1.000001).contains(&width) && (1.0..=1.000001).contains(&height), "unit={unit}: {width} by {height}");
+        }
+        // A nearly-zero crop box still falls back to A4.
+        for unit in [1.0, 4096.0, 75000.0] {
+            for side in [0.0, 0.0001] {
+                let pdf = Pdf::new(raw_crop_unit_page(unit, [0.0, 0.0, side, side])).unwrap();
+                let page = &pdf.pages()[0];
+                let expected = (595.2755905511812_f64 as f32, 841.8897637795277_f64 as f32);
+                assert_eq!(page.base_dimensions(), expected, "unit={unit}, side={side}");
+                assert_eq!(page.render_dimensions(), (expected.0 * unit as f32, expected.1 * unit as f32));
+            }
+        }
+    }
 }
 
 #[cfg(test)]
diff --git a/vendor/hayro-syntax/src/xref.rs b/vendor/hayro-syntax/src/xref.rs
index a86a1f4a..4f9de535 100644
--- a/vendor/hayro-syntax/src/xref.rs
+++ b/vendor/hayro-syntax/src/xref.rs
@@ -759,6 +759,34 @@ fn populate_xref_impl<'a>(data: &'a [u8], pos: usize, xref_map: &mut XrefMap, li
     populate_xref_impl_inner(data, pos, xref_map, &mut visited, limits)
 }
 
+/// The offset of the previous xref section (`Prev`).
+// PdfCraft patch: (PdfCraft #2400) some writers give `Prev` as a reference `N G R`. When this
+// section's own entries (`own`) place that object and it holds an offset (iText's
+// `indirectPrev.pdf`), that is the offset; otherwise its object number is (tiff2pdf, in JHOVE's
+// PDF-HUL-157 files), as other readers take it.
+fn prev_offset(data: &[u8], trailer: &Dict<'_>, own: &XrefMap) -> Option<usize> {
+    if let Some(prev) = trailer.get::<i32>(PREV) {
+        return usize::try_from(prev).ok();
+    }
+
+    let r = trailer.get_ref(PREV)?;
+    let id = ObjectIdentifier::new(r.obj_number, r.gen_number);
+    let held = match own.get(&id) {
+        Some(EntryType::Normal(at)) => {
+            let mut reader = Reader::new(data);
+            reader.jump(*at);
+            reader
+                .read_with_context::<IndirectObject<i32>>(&ReaderContext::dummy())
+                .filter(|o| o.id() == &id)
+                .map(|o| o.get())
+                .filter(|p| *p >= 0)
+        }
+        _ => None,
+    };
+
+    usize::try_from(held.unwrap_or(r.obj_number)).ok()
+}
+
 /// Maximum number of allowed xref `Prev` pointers before we abort.
 const MAX_XREF_CHAIN_DEPTH: usize = 256;
 
@@ -832,17 +860,8 @@ fn populate_from_xref_table<'a>(
     reader.skip_white_spaces();
 
     let mut max_obj = 0;
-
-    if let Some(prev) = trailer.get::<i32>(PREV) {
-        // First insert the entries from any previous xref tables.
-        populate_xref_impl_inner(data, prev as usize, insert_map, visited, limits)?;
-    }
-
-    // In hybrid files, entries in `XRefStm` should have higher priority, therefore we insert them
-    // after looking at `PREV`.
-    if let Some(xref_stm) = trailer.get::<i32>(XREF_STM) {
-        populate_xref_impl_inner(data, xref_stm as usize, insert_map, visited, limits)?;
-    }
+    // PdfCraft patch: (PdfCraft #2400) this section's entries are read first, for `prev_offset`.
+    let mut own = XrefMap::default();
 
     while let Some(header) = reader.read_without_context::<SubsectionHeader>() {
         reader.skip_white_spaces();
@@ -858,7 +877,7 @@ fn populate_from_xref_table<'a>(
             // Specification says we should ignore any object number > SIZE, but probably
             // not important?
             if entry.used {
-                insert_map.insert(
+                own.insert(
                     ObjectIdentifier::new(obj_number as i32, entry.gen_number),
                     EntryType::Normal(entry.offset),
                 );
@@ -866,6 +885,19 @@ fn populate_from_xref_table<'a>(
         }
     }
 
+    if let Some(prev) = prev_offset(data, &trailer, &own) {
+        // First insert the entries from any previous xref tables.
+        populate_xref_impl_inner(data, prev, insert_map, visited, limits)?;
+    }
+
+    // In hybrid files, entries in `XRefStm` should have higher priority, therefore we insert them
+    // after looking at `PREV`.
+    if let Some(xref_stm) = trailer.get::<i32>(XREF_STM) {
+        populate_xref_impl_inner(data, xref_stm as usize, insert_map, visited, limits)?;
+    }
+
+    insert_map.extend(own);
+
     Some(trailer.data())
 }
 
@@ -878,11 +910,6 @@ fn populate_from_xref_stream<'a>(
 ) -> Option<&'a [u8]> {
     let stream = reader.read_with_context::<IndirectObject<Stream<'_>>>(&ReaderContext::dummy_with_limits(limits))?.get();
 
-    if let Some(prev) = stream.dict().get::<i32>(PREV) {
-        // First insert the entries from any previous xref tables.
-        let _ = populate_xref_impl_inner(data, prev as usize, insert_map, visited, limits)?;
-    }
-
     let size = stream.dict().get::<u32>(SIZE)?;
 
     let [f1_len, f2_len, f3_len] = stream.dict().get::<[u8; 3]>(W)?;
@@ -895,6 +922,8 @@ fn populate_from_xref_stream<'a>(
     }
 
     let xref_data = stream.decoded().ok()?;
+    // PdfCraft patch: (PdfCraft #2400) this section's entries are read first, for `prev_offset`.
+    let mut own = XrefMap::default();
     let mut xref_reader = Reader::new(xref_data.as_ref());
 
     if let Some(arr) = stream.dict().get::<Array<'_>>(INDEX) {
@@ -908,21 +937,20 @@ fn populate_from_xref_stream<'a>(
                 f1_len,
                 f2_len,
                 f3_len,
-                insert_map,
+                &mut own,
             )?;
         }
     } else {
-        xref_stream_subsection(
-            &mut xref_reader,
-            0,
-            size,
-            f1_len,
-            f2_len,
-            f3_len,
-            insert_map,
-        )?;
+        xref_stream_subsection(&mut xref_reader, 0, size, f1_len, f2_len, f3_len, &mut own)?;
     }
 
+    if let Some(prev) = prev_offset(data, stream.dict(), &own) {
+        // First insert the entries from any previous xref tables.
+        let _ = populate_xref_impl_inner(data, prev, insert_map, visited, limits)?;
+    }
+
+    insert_map.extend(own);
+
     Some(stream.dict().data())
 }
 
@@ -984,7 +1012,9 @@ fn xref_stream_subsection<'a>(
             bytes.iter().fold(0u64, |acc, b| (acc << 8) | *b as u64)
         };
 
-        let obj_number = start + i;
+        // PdfCraft patch: object numbers are stored as `i32`; a subsection running past
+        // `i32::MAX` is refused instead of overflowing or turning negative.
+        let obj_number = i32::try_from(start.checked_add(i)?).ok()?;
 
         match f_type {
             // We don't care about free objects.
@@ -1007,7 +1037,7 @@ fn xref_stream_subsection<'a>(
                 };
 
                 insert_map.insert(
-                    ObjectIdentifier::new(obj_number as i32, gen_number as i32),
+                    ObjectIdentifier::new(obj_number, gen_number as i32),
                     EntryType::Normal(offset as usize),
                 );
             }
@@ -1025,7 +1055,7 @@ fn xref_stream_subsection<'a>(
                 };
 
                 insert_map.insert(
-                    ObjectIdentifier::new(obj_number as i32, gen_number),
+                    ObjectIdentifier::new(obj_number, gen_number),
                     EntryType::ObjStream(obj_stream_number, index),
                 );
             }
@@ -1177,6 +1207,13 @@ mod tests {
         let mut whole = Reader::new(&data[..6]);
         assert!(xref_stream_subsection(&mut whole, 0, 2, 1, 1, 1, &mut map).is_some());
         assert_eq!(map.len(), 2);
+        // A subsection running past object number i32::MAX is refused.
+        for start in [i32::MAX as u32, u32::MAX] {
+            let mut past_end = XrefMap::default();
+            let mut wrap = Reader::new(&data[..6]);
+            assert!(xref_stream_subsection(&mut wrap, start, 2, 1, 1, 1, &mut past_end).is_none());
+            assert!(past_end.keys().all(|id| id.obj_number >= 0));
+        }
     }
 
     #[test]
@@ -1441,6 +1478,90 @@ mod tests {
         let _result = populate_xref_impl(pdf.as_ref(), xref_pos, &mut xref_map, DecodeLimits::default());
     }
 
+    #[test]
+    fn prev_as_reference_reaches_the_earlier_section() {
+        let mut pdf = b"%PDF-1.0\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n".to_vec();
+        let first_xref_pos = pdf.len();
+        pdf.extend_from_slice(
+            format!(
+                "xref\n\
+                 0 2\n\
+                 0000000000 65535 f \n\
+                 0000000009 00000 n \n\
+                 trailer\n<< /Size 2 /Root 1 0 R >>\n\
+                 startxref\n{first_xref_pos}\n%%EOF\n"
+            )
+            .as_bytes(),
+        );
+        let second_xref_pos = pdf.len();
+        pdf.extend_from_slice(
+            format!(
+                "xref\n\
+                 0 1\n\
+                 0000000000 65535 f \n\
+                 trailer\n<< /Size 2 /Root 1 0 R /Prev {first_xref_pos} 0 R >>\n\
+                 startxref\n{second_xref_pos}\n%%EOF"
+            )
+            .as_bytes(),
+        );
+
+        let mut xref_map = FxHashMap::default();
+        let xref_pos = find_last_xref_pos(pdf.as_ref()).unwrap();
+        assert_eq!(xref_pos, second_xref_pos);
+        populate_xref_impl(
+            pdf.as_ref(),
+            xref_pos,
+            &mut xref_map,
+            DecodeLimits::default(),
+        )
+        .unwrap();
+        assert!(xref_map.contains_key(&ObjectIdentifier::new(1, 0)));
+    }
+
+    #[test]
+    fn prev_as_reference_to_an_object_holding_the_offset_reads_that_offset() {
+        let mut pdf = b"%PDF-1.0\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n".to_vec();
+        let first_xref_pos = pdf.len();
+        pdf.extend_from_slice(
+            format!(
+                "xref\n\
+                 0 2\n\
+                 0000000000 65535 f \n\
+                 0000000009 00000 n \n\
+                 trailer\n<< /Size 2 /Root 1 0 R >>\n\
+                 startxref\n{first_xref_pos}\n%%EOF\n"
+            )
+            .as_bytes(),
+        );
+        // Object 3 holds the offset; read as offset 3, `Prev` would point inside the header.
+        let held_pos = pdf.len();
+        pdf.extend_from_slice(format!("3 0 obj\n{first_xref_pos}\nendobj\n").as_bytes());
+        let second_xref_pos = pdf.len();
+        pdf.extend_from_slice(
+            format!(
+                "xref\n\
+                 3 1\n\
+                 {held_pos:010} 00000 n \n\
+                 trailer\n<< /Size 4 /Root 1 0 R /Prev 3 0 R >>\n\
+                 startxref\n{second_xref_pos}\n%%EOF"
+            )
+            .as_bytes(),
+        );
+
+        let mut xref_map = FxHashMap::default();
+        let xref_pos = find_last_xref_pos(pdf.as_ref()).unwrap();
+        assert_eq!(xref_pos, second_xref_pos);
+        populate_xref_impl(
+            pdf.as_ref(),
+            xref_pos,
+            &mut xref_map,
+            DecodeLimits::default(),
+        )
+        .unwrap();
+        assert!(xref_map.contains_key(&ObjectIdentifier::new(1, 0)));
+        assert!(xref_map.contains_key(&ObjectIdentifier::new(3, 0)));
+    }
+
     #[test]
     fn find_last_xref_uses_last_startxref() {
         let pdf = b"%PDF-1.0\nstartxref\n5\n%%EOF\nstartxref\n42\n%%EOF";
diff --git a/vendor/hayro/SOURCE.json b/vendor/hayro/SOURCE.json
index 50e0340a..1ea22629 100644
--- a/vendor/hayro/SOURCE.json
+++ b/vendor/hayro/SOURCE.json
@@ -1,7 +1,7 @@
 {
   "crate": "hayro",
   "source_repository": "https://github.com/storytold/pdfcraft",
-  "source_revision": "7437bde378f43856eada40af25b983812e615e8a",
+  "source_revision": "ec0a965074f376a5bf610435948e4e5184bf3299",
   "source_directory": "vendor/hayro",
   "files": [
     {
@@ -60,15 +60,15 @@
     },
     {
       "path": "src/lib.rs",
-      "source_sha256": "1ce3e02072acb639c33476618446af80fca29b960a3ca764168c1c2d348d5e5d",
-      "source_git_blob": "def102b4291b1fe99f2c8975477e5d294c4f955f",
-      "sha256": "1ce3e02072acb639c33476618446af80fca29b960a3ca764168c1c2d348d5e5d"
+      "source_sha256": "682db2a32fbf4d875c0e9dd7ac5dc875a6b09ade375efbce6f104de9197de078",
+      "source_git_blob": "6333ed5808ae0cf9cf158e4730e973c1d7089bab",
+      "sha256": "8b17f78900e6f15b0d458629d69c954e436a3e8b97c01563c884456b87379d9f"
     },
     {
       "path": "src/renderer.rs",
-      "source_sha256": "b74b630b73e86b69b26ef433ee6aabbb684def133e4ae46f0cbf8f9f1fbd4484",
-      "source_git_blob": "23fc2e36cae7368e1a508bb246f3a1a15bb60a67",
-      "sha256": "b74b630b73e86b69b26ef433ee6aabbb684def133e4ae46f0cbf8f9f1fbd4484"
+      "source_sha256": "f7ff7bd088ceb43823ede33151138384af331cf71403f7d23f7b2937212efc3b",
+      "source_git_blob": "6aa53716ad2d0203a8058b2f7271515b4fc1db22",
+      "sha256": "02d256f43d9b8bceb68cee9f9f9ed0bcb48bb70d7068f2d1c6d6a9d85e3f4e64"
     }
   ]
 }
diff --git a/vendor/hayro/src/lib.rs b/vendor/hayro/src/lib.rs
index def102b4..bd6468c8 100644
--- a/vendor/hayro/src/lib.rs
+++ b/vendor/hayro/src/lib.rs
@@ -61,7 +61,7 @@ use vello_cpu::{Level, Pixmap, RenderMode};
 
 mod renderer;
 /// PdfCraft patch: exported for its regression test.
-pub use renderer::{image_resampling_size, tiling_cell_scale};
+pub use renderer::{image_resampling_size, tiling_cell_scale, usable_cell_scale};
 /// PdfCraft patch: exported for its regression test.
 #[doc(hidden)]
 pub use renderer::set_skip_offscreen_paths;
@@ -254,6 +254,23 @@ pub fn render_into<'a>(
         interpreter_settings.preview,
     );
 
+    // PdfCraft patch (18): the page renders as one transparency group (the page group). Its
+    // objects composite with an initially transparent backdrop, and the group is then put on
+    // the paper (ISO 32000-2, page group), so a blend mode only blends where something was
+    // drawn: a /BM /Screen fill over an empty part of the page keeps its color (#2970).
+    // Under reading colors the background is painted *inside* the group instead, as its
+    // initial backdrop, so a Multiply highlight blends with the dark background: outside it,
+    // the highlight kept its own flat color and the words under it vanished into the band
+    // (#1548). Reading colors replace the page's colors anyway; for document colors the
+    // background stays outside, or every separable mode but Normal, Multiply, Darken and
+    // HardLight would blend with the white paper. Craft patch: a plate render keeps the
+    // background inside as well, so blend modes on a separation's film blend with the paper.
+    let backdrop_inside =
+        render_settings.color_replacement.is_some() || interpreter_settings.plate.is_some();
+    if backdrop_inside {
+        device.push_transparency_group(1.0, None, BlendMode::Normal);
+    }
+
     device.ctx.set_paint(render_settings.bg_color);
     device
         .ctx
@@ -264,13 +281,19 @@ pub fn render_into<'a>(
         path: clip_path,
         fill: FillRule::NonZero,
     });
+    if !backdrop_inside {
+        device.push_transparency_group(1.0, None, BlendMode::Normal);
+    }
 
-    device.push_transparency_group(1.0, None, BlendMode::Normal);
     interpret_page(page, &mut state, &mut device);
 
-    device.pop_transparency_group();
-
+    if !backdrop_inside {
+        device.pop_transparency_group();
+    }
     device.pop_clip_path();
+    if backdrop_inside {
+        device.pop_transparency_group();
+    }
 
     let mut resources = vello_cpu::Resources::default();
     device.ctx.render_to_buffer(
@@ -667,3 +690,152 @@ mod color_replacement_render_tests {
         assert_eq!(sample(&no_line_art, 40, 25), [0, 0, 0, 255]);
     }
 }
+
+/// PdfCraft patch (#3296): a mesh shading paints its triangles alone (`EncodedShadingPattern::extent`),
+/// and one with no triangle on the canvas paints nothing.
+#[cfg(test)]
+mod mesh_extent_tests {
+    use super::{InterpreterSettings, Pdf, Pixmap, RenderCache, RenderSettings, render};
+    use vello_cpu::color::palette::css::WHITE;
+
+    /// A one-page 200×200 pt PDF whose content is `body`, with a type 4 (free-form triangle)
+    /// shading `/Sh0`: one red triangle with corners (x0, y0), (x1, y0) and (x0, y1) in user
+    /// space, and an ExtGState `/Half` with 50% alpha.
+    fn fixture(body: &str, (x0, y0, x1, y1): (i32, i32, i32, i32)) -> Vec<u8> {
+        // Three vertices: a flag, x and y (8 bits each, decoded into the ranges) and RGB.
+        let mesh: [u8; 18] = [
+            0, 0, 0, 255, 0, 0, //
+            0, 255, 0, 255, 0, 0, //
+            0, 0, 255, 255, 0, 0,
+        ];
+        let mut objs: Vec<Vec<u8>> = vec![
+            b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+            b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >>".to_vec(),
+            b"<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> \
+              /ExtGState << /Half << /ca 0.5 /CA 0.5 >> >> >> >>"
+                .to_vec(),
+            format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()).into_bytes(),
+        ];
+        let mut shading = format!(
+            "<< /ShadingType 4 /ColorSpace /DeviceRGB /BitsPerCoordinate 8 /BitsPerComponent 8 \
+             /BitsPerFlag 8 /Decode [{x0} {x1} {y0} {y1} 0 1 0 1 0 1] /Length {} >>\nstream\n",
+            mesh.len()
+        )
+        .into_bytes();
+        shading.extend_from_slice(&mesh);
+        shading.extend_from_slice(b"\nendstream");
+        objs.push(shading);
+
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+            out.extend_from_slice(o);
+            out.extend_from_slice(b"\nendobj\n");
+        }
+        let xref = out.len();
+        out.extend_from_slice(
+            format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes(),
+        );
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(
+            format!(
+                "trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n",
+                objs.len() + 1
+            )
+            .as_bytes(),
+        );
+        out
+    }
+
+    fn render_at(pdf: Vec<u8>, scale: f32) -> Pixmap {
+        let pdf = Pdf::new(pdf).unwrap();
+        let cache = RenderCache::new();
+        let settings = RenderSettings {
+            x_scale: scale,
+            y_scale: scale,
+            bg_color: WHITE,
+            ..RenderSettings::default()
+        };
+        render(
+            pdf.pages().get(0).expect("the fixture has one page"),
+            &cache,
+            &InterpreterSettings::default(),
+            &settings,
+        )
+    }
+
+    fn px(pixmap: &Pixmap, x: u16, y: u16) -> [u8; 4] {
+        let p = pixmap.sample(x, y);
+        [p.r, p.g, p.b, p.a]
+    }
+
+    fn inked(pixmap: &Pixmap) -> usize {
+        (0..pixmap.height())
+            .flat_map(|y| (0..pixmap.width()).map(move |x| (x, y)))
+            .filter(|&(x, y)| px(pixmap, x, y) != [255, 255, 255, 255])
+            .count()
+    }
+
+    /// The triangle (100, 100)–(110, 100)–(100, 110) in a 200 pt page: in device space (y
+    /// down) the pixel (102, 97) is inside it, (108, 91) past its hypotenuse, and the rest of
+    /// the page is nowhere near it.
+    #[test]
+    fn a_mesh_paints_its_triangles_alone() {
+        let white = [255, 255, 255, 255];
+        for scale in [1.0_f32, 4.0] {
+            let p = render_at(fixture("/Sh0 sh", (100, 100, 110, 110)), scale);
+            let at = |x: f32, y: f32| ((x * scale) as u16, (y * scale) as u16);
+            let (x, y) = at(102.5, 97.5);
+            assert_eq!(
+                px(&p, x, y),
+                [255, 0, 0, 255],
+                "scale {scale}: inside the triangle"
+            );
+            let (x, y) = at(108.5, 91.5);
+            assert_eq!(px(&p, x, y), white, "scale {scale}: past the hypotenuse");
+            let (x, y) = at(150.0, 50.0);
+            assert_eq!(px(&p, x, y), white, "scale {scale}: far from it");
+            let (x, y) = at(10.0, 190.0);
+            assert_eq!(
+                px(&p, x, y),
+                white,
+                "scale {scale}: the texture is not repeated"
+            );
+            // A 10 × 10 pt right triangle covers 50 pt²; the sampler counts the pixels whose
+            // corner lies inside it (36 at scale 1, nearer 50 as the scale grows), and nothing
+            // beyond its own bounding box is touched.
+            let area = inked(&p) as f32 / (scale * scale);
+            assert!(
+                (30.0..=60.0).contains(&area),
+                "scale {scale}: {area} pt² inked"
+            );
+        }
+    }
+
+    /// The alpha of the graphics state still applies: red at 50% over white is pink.
+    #[test]
+    fn a_mesh_keeps_the_graphics_state_alpha() {
+        let p = render_at(fixture("/Half gs /Sh0 sh", (100, 100, 110, 110)), 1.0);
+        let [r, g, b, a] = px(&p, 102, 97);
+        assert!(
+            r == 255 && (120..=136).contains(&g) && g == b && a == 255,
+            "{:?}",
+            [r, g, b, a]
+        );
+    }
+
+    /// A mesh whose triangle lies off the canvas paints nothing, and costs no texture.
+    #[test]
+    fn a_mesh_off_the_canvas_paints_nothing() {
+        let p = render_at(fixture("/Sh0 sh", (300, 300, 310, 310)), 1.0);
+        assert_eq!(inked(&p), 0);
+        // One straddling the edge paints its part on the canvas.
+        let p = render_at(fixture("/Sh0 sh", (195, 100, 205, 110)), 1.0);
+        assert_eq!(px(&p, 196, 98), [255, 0, 0, 255]);
+        assert_eq!(px(&p, 150, 50), [255, 255, 255, 255]);
+    }
+}
diff --git a/vendor/hayro/src/renderer.rs b/vendor/hayro/src/renderer.rs
index 23fc2e36..ea329b81 100644
--- a/vendor/hayro/src/renderer.rs
+++ b/vendor/hayro/src/renderer.rs
@@ -427,11 +427,31 @@ fn snap_minified_image(
     (w.abs_diff(planned.0) <= 1 && h.abs_diff(planned.1) <= 1).then_some((w, h, x0, y0))
 }
 
+/// PdfCraft patch (#3296): what `Renderer::set_paint` found out: the clip path to apply while
+/// painting (if any), or that the paint touches no pixel of the canvas, so the caller skips
+/// the fill or stroke (a mesh shading whose triangles all lie outside the path or canvas).
+#[must_use]
+enum PaintSetup {
+    Clip(Option<BezPath>),
+    Nothing,
+}
+
 pub(crate) struct Renderer {
     pub(crate) ctx: RenderContext,
     /// PdfCraft patch: when set, solid text and line-art paint colours are remapped
     /// while rendering (the "reading colours" view setting).
     color_replacement: Option<ColorReplacement>,
+    /// PdfCraft patch (17): while the page's annotations are being drawn, paints keep their
+    /// colours — reading colours replace document colours, never annotation colours.
+    in_annotations: bool,
+    /// Knockout patch (pdfcraft #2974): one entry per transparency group pushed, whether it is a
+    /// knockout group (`Device::set_knockout`).
+    knockout: Vec<bool>,
+    /// Knockout patch (pdfcraft #2974): inside a knockout erase pass
+    /// (`Device::begin_knockout_erase`), and how many transparency groups were skipped in it
+    /// (nothing is layered while erasing).
+    erasing: bool,
+    erase_groups: usize,
     pub(crate) inside_pattern: bool,
     /// Soft masks drawn during this render. PdfCraft note: it belongs to one `Renderer` (one
     /// render, every nested renderer starting empty) and so to one `preview` setting: a mask
@@ -455,6 +475,12 @@ enum ImagePixelFormat {
 }
 
 impl Renderer {
+    /// Knockout patch (pdfcraft #2974): whether the innermost transparency group is a knockout
+    /// group.
+    fn in_knockout(&self) -> bool {
+        self.knockout.last().copied().unwrap_or(false)
+    }
+
     pub(crate) fn new(
         width: u16,
         height: u16,
@@ -466,6 +492,10 @@ impl Renderer {
         Self {
             ctx: RenderContext::new_with(width, height, settings),
             color_replacement,
+            in_annotations: false,
+            knockout: Vec::new(),
+            erasing: false,
+            erase_groups: 0,
             inside_pattern: false,
             soft_mask_cache: HashMap::default(),
             outline_cache: cache.outline_cache.clone(),
@@ -522,14 +552,7 @@ impl Renderer {
             },
         };
 
-        // A miter limit that isn't finite leaves miters unbounded: never skipped.
-        let miter = stroke.miter_limit.abs();
-        let reach = stroke.width / 2.0
-            * if miter.is_finite() {
-                miter.max(std::f64::consts::SQRT_2)
-            } else {
-                f64::INFINITY
-            };
+        let reach = stroke_reach(&stroke);
         self.ctx.set_stroke(stroke);
         reach
     }
@@ -573,6 +596,10 @@ impl Renderer {
                 // PdfCraft patch: this renders an image's alpha mask, which must keep its
                 // original values, so it is never remapped by the reading-colours setting.
                 color_replacement: None,
+                in_annotations: false,
+                knockout: Vec::new(),
+                erasing: false,
+                erase_groups: 0,
                 inside_pattern: false,
                 soft_mask_cache: HashMap::default(),
                 outline_cache: self.outline_cache.clone(),
@@ -737,6 +764,40 @@ impl Renderer {
         }
     }
 
+    /// The size an image of `width` x `height` samples is decoded at to be drawn with
+    /// `transform`, or `None` if `draw_image` skips it: off the canvas (PdfCraft patch: see
+    /// `may_paint_rect`; checked before decoding, so a tile no longer decodes every image on its
+    /// page), or, in a preview, covering only a few device pixels (PdfCraft patch; final renders
+    /// always draw them). The tiny-image test measures axis lengths: the size returned maps a
+    /// point, so it includes the translation and only suits the decode hint.
+    fn image_draw_size(&self, width: u32, height: u32, transform: Affine) -> Option<(u32, u32)> {
+        if !may_paint_rect(
+            Rect::new(0.0, 0.0, f64::from(width), f64::from(height)),
+            transform,
+            self.ctx.width(),
+            self.ctx.height(),
+        ) {
+            return None;
+        }
+        let target_width = (transform * Point::new(width as f64, 0.0))
+            .to_vec2()
+            .length()
+            .ceil() as u32;
+        let target_height = (transform * Point::new(0.0, height as f64))
+            .to_vec2()
+            .length()
+            .ceil() as u32;
+        if self.preview {
+            let c = transform.as_coeffs();
+            let tiny_w = (f64::from(width) * (c[0] * c[0] + c[1] * c[1]).sqrt()).ceil() as u32;
+            let tiny_h = (f64::from(height) * (c[2] * c[2] + c[3] * c[3]).sqrt()).ceil() as u32;
+            if tiny_w.saturating_mul(tiny_h) < PREVIEW_MIN_IMAGE_AREA {
+                return None;
+            }
+        }
+        Some((target_width, target_height))
+    }
+
     fn draw_image(&mut self, image_data: ImageData, alpha_data: Option<LumaData>) {
         let cur_transform = *self.ctx.transform();
         let (x_scale, y_scale) = {
@@ -1023,6 +1084,11 @@ impl Renderer {
         let Some(replacement) = self.color_replacement else {
             return paint.clone();
         };
+        // PdfCraft patch (17): annotations keep the colours they were given; reading colours
+        // replace document colours only (issue #1548).
+        if self.in_annotations {
+            return paint.clone();
+        }
         match paint {
             Paint::Color(c) => {
                 let mapped = replacement.map(c.to_rgba().to_rgba8(), is_text);
@@ -1036,9 +1102,26 @@ impl Renderer {
     }
 
     #[must_use]
-    fn set_paint(&mut self, paint: &Paint<'_>, path: &BezPath, is_stroke: bool) -> Option<BezPath> {
+    fn set_paint(&mut self, paint: &Paint<'_>, path: &BezPath, is_stroke: bool) -> PaintSetup {
+        // Knockout patch (pdfcraft #2974): in a knockout erase pass every paint clears what is
+        // under its shape (a transparent fill with `Compose::Copy`, weighted by coverage).
+        if self.erasing {
+            self.ctx.set_blend_mode(knockout_blend_mode());
+            self.ctx.set_paint(AlphaColor::<Srgb>::new([0.0, 0.0, 0.0, 0.0]));
+            // A shading's `/BBox` clips what it paints, so it clips what it clears too.
+            return PaintSetup::Clip(match paint {
+                Paint::Pattern(p) => match p.as_ref() {
+                    Pattern::Shading(s) => s.shading.clip_path.clone(),
+                    _ => None,
+                },
+                _ => None,
+            });
+        }
         let mut paint_transform = Affine::IDENTITY;
         let mut clip_path = None;
+        // PdfCraft patch (#3296): `Extend::Repeat` tiles the texture over the path; a mesh
+        // texture covers its triangles alone and must not repeat outside them.
+        let mut extend = peniko::Extend::Repeat;
 
         let paint: PaintType = match paint.clone() {
             Paint::Color(c) => {
@@ -1071,17 +1154,44 @@ impl Renderer {
                         // pixel around it: texels at a fractional edge look one pixel further).
                         let encoded = s.encode_within(Some(bbox.inflate(1.0, 1.0)));
 
+                        // PdfCraft patch (#3296): a mesh paints only where its triangles are.
+                        // The texture covers the triangles alone (and a pixel around them,
+                        // which stays transparent and is what `Extend::Pad` repeats), not the
+                        // whole path (the canvas, for `sh`): sampled pixel by pixel, 310
+                        // one-triangle meshes on a plan cost 310 full tiles per tile, and the
+                        // watchdog gave the page up. A mesh with no triangle on the canvas
+                        // paints nothing at all.
+                        if let Some(extent) = encoded.extent {
+                            // An empty extent (no triangle in the area) is `Rect::ZERO`, which
+                            // sits at the canvas origin: test it before intersecting, or a
+                            // 1 × 1 transparent texture would still be painted over the whole
+                            // path (310 of them cost 230 ms per tile).
+                            if extent.width() <= 0.0 || extent.height() <= 0.0 {
+                                return PaintSetup::Nothing;
+                            }
+                            bbox = bbox.intersect(extent.inflate(1.0, 1.0));
+                            if bbox.width() <= 0.0 || bbox.height() <= 0.0 {
+                                return PaintSetup::Nothing;
+                            }
+                            extend = peniko::Extend::Pad;
+                        }
+
                         // PdfCraft patch (backport of hayro 0.8): axial and radial shadings
                         // become native gradients instead of a texture sampled pixel by pixel.
                         // Upstream also shifts by half a pixel for vello_cpu 0.3; 0.0.8 already
                         // evaluates gradients at pixel centres, like the texture below.
-                        if let Some(native) =
-                            encoded.as_svg_gradient(bbox, NATIVE_GRADIENT_TOLERANCE)
+                        // PdfCraft patch (#2128): vello_cpu 0.0.8 copies an opaque gradient
+                        // over fully covered tiles without applying the mask or blend mode, and
+                        // a gradient can't be flagged transparent like the texture below, so
+                        // under a soft mask or blend mode the shading is sampled instead.
+                        if !self.force_images_may_have_transparency()
+                            && let Some(native) =
+                                encoded.as_svg_gradient(bbox, NATIVE_GRADIENT_TOLERANCE)
                         {
                             self.ctx
                                 .set_paint_transform(path_transform.inverse() * native.transform);
                             self.ctx.set_paint(native_gradient(native));
-                            return clip_path;
+                            return PaintSetup::Clip(clip_path);
                         }
 
                         let (image, width, height, transform, may_have_transparency) =
@@ -1100,8 +1210,8 @@ impl Renderer {
                         let image = Image {
                             image: ImageSource::Pixmap(Arc::new(pixmap)),
                             sampler: ImageSampler {
-                                x_extend: peniko::Extend::Repeat,
-                                y_extend: peniko::Extend::Repeat,
+                                x_extend: extend,
+                                y_extend: extend,
                                 quality: ImageQuality::Medium,
                                 alpha: 1.0,
                             },
@@ -1127,6 +1237,68 @@ impl Renderer {
                         };
                         xs = xs.max(min_x_scale).min(max_x_scale);
                         ys = ys.max(min_y_scale).min(max_y_scale);
+                        // PdfCraft patch (20): a step too large for a cell pixmap, where what is
+                        // painted can only show the first cell (PowerPoint writes `/XStep
+                        // 2147480100` for a picture fill drawn once, #3349): the cell's `/BBox` is
+                        // drawn at full scale with a transparent border and padded, not tiled.
+                        // Shrinking the cell to fit the step left a picture under one pixel.
+                        // How far a stroke's paint reaches past the path, miters included, in
+                        // device pixels: the most the transform stretches any direction (a skew
+                        // stretches some further than either axis), times the reach.
+                        let reach = if is_stroke {
+                            path_transform.spectral_norm() * stroke_reach(self.ctx.stroke())
+                        } else {
+                            0.0
+                        };
+                        if usable_cell_scale(xs, ys)
+                            && (xs * t.x_step.abs() > MAX_PIXMAP_SIZE || ys * t.y_step.abs() > MAX_PIXMAP_SIZE)
+                            && shows_one_cell(&t.matrix, path_transform, path, reach, bbox, t.x_step, t.y_step)
+                        {
+                            const BORDER: f64 = 1.0;
+                            let pix_width = ((bbox.width() as f32 * xs).ceil() as u16).saturating_add(2);
+                            let pix_height = ((bbox.height() as f32 * ys).ceil() as u16).saturating_add(2);
+                            let mut renderer = Self {
+                                ctx: RenderContext::new_with(
+                                    pix_width,
+                                    pix_height,
+                                    derive_settings(self.ctx.render_settings()),
+                                ),
+                                color_replacement: None,
+                                in_annotations: false,
+                                knockout: Vec::new(),
+                                erasing: false,
+                                erase_groups: 0,
+                                cur_mask: None,
+                                inside_pattern: true,
+                                soft_mask_cache: HashMap::default(),
+                                outline_cache: self.outline_cache.clone(),
+                                in_type3_glyph: false,
+                                scaler: self.scaler,
+                                preview: self.preview,
+                                image_transparency_stack: Vec::new(),
+                            };
+                            let initial_transform = Affine::translate((BORDER, BORDER))
+                                * Affine::scale_non_uniform(xs as f64, ys as f64)
+                                * Affine::translate((-bbox.x0, -bbox.y0));
+                            t.interpret(&mut renderer, initial_transform, is_stroke);
+                            let mut pix = Pixmap::new(pix_width, pix_height);
+                            renderer.ctx.flush();
+                            let mut resources = vello_cpu::Resources::default();
+                            renderer.ctx.render_to_pixmap(&mut resources, &mut pix);
+                            paint_transform = path_transform.inverse() * t.matrix * initial_transform.inverse();
+                            let image = Image {
+                                image: ImageSource::Pixmap(Arc::new(pix)),
+                                sampler: ImageSampler {
+                                    x_extend: peniko::Extend::Pad,
+                                    y_extend: peniko::Extend::Pad,
+                                    quality: ImageQuality::Medium,
+                                    alpha: 1.0,
+                                },
+                            };
+                            self.ctx.set_paint_transform(paint_transform);
+                            self.ctx.set_paint(PaintType::Image(image));
+                            return PaintSetup::Clip(clip_path);
+                        }
                         // PdfCraft patch: the cell pixmap is `step × scale` pixels, which only the
                         // u16 cast below bounded (a fuzzed /XStep far beyond /BBox gave 65535² cells).
                         xs = tiling_cell_scale(xs, t.x_step, MAX_PIXMAP_SIZE);
@@ -1149,6 +1321,10 @@ impl Renderer {
                             // PdfCraft patch: a pattern cell is painted as one artwork, so its
                             // content is never remapped by the reading-colours setting.
                             color_replacement: None,
+                            in_annotations: false,
+                            knockout: Vec::new(),
+                            erasing: false,
+                            erase_groups: 0,
                             cur_mask: None,
                             inside_pattern: true,
                             soft_mask_cache: HashMap::default(),
@@ -1199,7 +1375,7 @@ impl Renderer {
         self.ctx.set_paint_transform(paint_transform);
         self.ctx.set_paint(paint);
 
-        clip_path
+        PaintSetup::Clip(clip_path)
     }
 
     fn stroke_path(
@@ -1219,7 +1395,9 @@ impl Renderer {
 
         // PdfCraft patch: apply the reading-colours mapping before painting.
         let paint = self.replaced(paint, is_text);
-        let clip_path = self.set_paint(&paint, path, true);
+        let PaintSetup::Clip(clip_path) = self.set_paint(&paint, path, true) else {
+            return;
+        };
         if let Some(clip_path) = clip_path.as_ref() {
             self.push_clip_path_inner(clip_path, FillRule::NonZero);
         }
@@ -1248,7 +1426,9 @@ impl Renderer {
 
         // PdfCraft patch: apply the reading-colours mapping before painting.
         let paint = self.replaced(paint, is_text);
-        let clip_path = self.set_paint(&paint, path, false);
+        let PaintSetup::Clip(clip_path) = self.set_paint(&paint, path, false) else {
+            return;
+        };
         if let Some(clip_path) = clip_path.as_ref() {
             self.push_clip_path_inner(clip_path, fill_rule);
         }
@@ -1342,40 +1522,19 @@ impl Renderer {
 
 impl<'a> Device<'a> for Renderer {
     fn draw_image(&mut self, image: hayro_interpret::Image<'a, '_>, mut transform: Affine) {
-        // PdfCraft patch: see `may_paint_rect`. Checked before decoding: off-canvas images
-        // cost nothing, so a tile no longer decodes every image on its page.
-        if !may_paint_rect(
-            Rect::new(0.0, 0.0, f64::from(image.width()), f64::from(image.height())),
-            transform,
-            self.ctx.width(),
-            self.ctx.height(),
-        ) {
+        // Knockout patch (pdfcraft #2974): an erase pass paints nothing; an unmasked image's
+        // rectangle was cleared by `knockout_shape`, and a masked image's shape is left alone.
+        if self.erasing {
             return;
         }
+        let Some((target_width, target_height)) =
+            self.image_draw_size(image.width(), image.height(), transform)
+        else {
+            return;
+        };
         self.ctx.set_paint_transform(Affine::IDENTITY);
         self.ctx.set_aliasing_threshold(Some(1));
 
-        let target_width = (transform * Point::new(image.width() as f64, 0.0))
-            .to_vec2()
-            .length()
-            .ceil() as u32;
-        let target_height = (transform * Point::new(0.0, image.height() as f64))
-            .to_vec2()
-            .length()
-            .ceil() as u32;
-
-        // PdfCraft patch: previews skip images that would cover only a few device pixels.
-        // Final renders always draw them. (Measured as axis lengths: the `target_*` above
-        // map a point, so they include the translation and only suit the decode hint.)
-        if self.preview {
-            let c = transform.as_coeffs();
-            let tiny_w = (f64::from(image.width()) * (c[0] * c[0] + c[1] * c[1]).sqrt()).ceil() as u32;
-            let tiny_h = (f64::from(image.height()) * (c[2] * c[2] + c[3] * c[3]).sqrt()).ceil() as u32;
-            if tiny_w.saturating_mul(tiny_h) < PREVIEW_MIN_IMAGE_AREA {
-                return;
-            }
-        }
-
         match image {
             hayro_interpret::Image::Stencil(s) => {
                 s.with_stencil(
@@ -1464,6 +1623,10 @@ impl<'a> Device<'a> for Renderer {
                                         // coverage values, so its content is never remapped by
                                         // the reading-colours setting.
                                         color_replacement: None,
+                                        in_annotations: false,
+                                        knockout: Vec::new(),
+                                        erasing: false,
+                                        erase_groups: 0,
                                         inside_pattern: false,
                                         soft_mask_cache: HashMap::default(),
                                         outline_cache: self.outline_cache.clone(),
@@ -1493,14 +1656,19 @@ impl<'a> Device<'a> for Renderer {
                                 );
                                 self.ctx.set_transform(transform);
 
-                                let clip_path =
-                                    self.set_paint(paint, &stencil_rect.to_path(0.1), true);
-                                if let Some(clip_path) = clip_path.as_ref() {
-                                    self.push_clip_path_inner(clip_path, FillRule::NonZero);
-                                }
-                                self.ctx.fill_rect(&stencil_rect);
-                                if clip_path.is_some() {
-                                    self.ctx.pop_clip_path();
+                                // PdfCraft patch: a stencil mask is painted with the fill
+                                // (non-stroking) paint; `true` drew an uncolored tiling pattern
+                                // in its stroke color (black by default) (#2975).
+                                if let PaintSetup::Clip(clip_path) =
+                                    self.set_paint(paint, &stencil_rect.to_path(0.1), false)
+                                {
+                                    if let Some(clip_path) = clip_path.as_ref() {
+                                        self.push_clip_path_inner(clip_path, FillRule::NonZero);
+                                    }
+                                    self.ctx.fill_rect(&stencil_rect);
+                                    if clip_path.is_some() {
+                                        self.ctx.pop_clip_path();
+                                    }
                                 }
 
                                 self.ctx.pop_layer();
@@ -1536,6 +1704,11 @@ impl<'a> Device<'a> for Renderer {
         mask: Option<SoftMask<'_>>,
         blend_mode: BlendMode,
     ) {
+        // Knockout patch (pdfcraft #2974): nothing is layered in a knockout erase pass.
+        if self.erasing {
+            self.erase_groups += 1;
+            return;
+        }
         let settings = *self.ctx.render_settings();
         let force_images_may_have_transparency = mask.is_some()
             || blend_mode != BlendMode::Normal
@@ -1562,6 +1735,7 @@ impl<'a> Device<'a> for Renderer {
         );
         self.image_transparency_stack
             .push(force_images_may_have_transparency);
+        self.knockout.push(false);
     }
 
     fn pop_clip_path(&mut self) {
@@ -1569,10 +1743,86 @@ impl<'a> Device<'a> for Renderer {
     }
 
     fn pop_transparency_group(&mut self) {
+        if self.erasing && self.erase_groups > 0 {
+            self.erase_groups -= 1;
+            return;
+        }
         self.image_transparency_stack.pop();
+        self.knockout.pop();
         self.ctx.pop_layer();
     }
 
+    /// Knockout patch (pdfcraft #2974): the group just pushed is a knockout group. Its elements are
+    /// drawn with `Compose::Copy`, which (weighted by coverage) replaces what earlier elements drew
+    /// where the element's shape is, so each element composites with the group's initial backdrop
+    /// (transparent: an isolated group, and the non-isolated approximation every group layer here
+    /// already makes) instead of with the elements before it. Against a transparent backdrop the
+    /// element's own blend mode has nothing to blend with, so the mix is Normal. This covers paths,
+    /// strokes, glyph outlines and shadings. Images and nested groups are drawn into a layer of
+    /// their own, which can't be copied (it covers the whole canvas, transparent where nothing was
+    /// drawn): what is under their shape is cleared first (`knockout_shape`, the knockout erase
+    /// pass) and the layer composites over it.
+    fn set_knockout(&mut self) {
+        if let Some(top) = self.knockout.last_mut() {
+            *top = true;
+            self.ctx.set_blend_mode(knockout_blend_mode());
+        }
+    }
+
+    /// Knockout patch (pdfcraft #2974): in a knockout group, clear what the group drew under
+    /// `shape` (a transparent fill with `Compose::Copy`, weighted by coverage) before an element
+    /// drawn into a layer of its own composites there, so the element replaces it.
+    fn knockout_erase_wanted(&mut self) -> bool {
+        self.in_knockout() && !self.erasing
+    }
+
+    fn begin_knockout_erase(&mut self) {
+        self.erasing = true;
+        self.erase_groups = 0;
+    }
+
+    fn end_knockout_erase(&mut self) {
+        self.erasing = false;
+        self.erase_groups = 0;
+        self.ctx.set_blend_mode(knockout_blend_mode());
+    }
+
+    fn in_knockout_group(&mut self) -> bool {
+        self.in_knockout()
+    }
+
+    fn knockout_image(&mut self, image: &hayro_interpret::RasterImage<'_>, transform: Affine) {
+        if !self.in_knockout() {
+            return;
+        }
+        // Only an image `draw_image` will draw, decoded at the size it draws it (the same
+        // decode, so a cached decode serves both).
+        let Some(size) = self.image_draw_size(image.width(), image.height(), transform) else {
+            return;
+        };
+        let mut decodes = false;
+        image.with_rgba(|_, _| decodes = true, Some(size));
+        if decodes {
+            let rect = Rect::new(0.0, 0.0, f64::from(image.width()), f64::from(image.height()));
+            self.knockout_shape(&(transform * rect.to_path(0.1)));
+        }
+    }
+
+    fn knockout_shape(&mut self, shape: &BezPath) {
+        if !self.in_knockout() {
+            return;
+        }
+        let old_transform = *self.ctx.transform();
+        let old_rule = *self.ctx.fill_rule();
+        self.ctx.set_transform(Affine::IDENTITY);
+        self.ctx.set_fill_rule(Fill::NonZero);
+        self.ctx.set_blend_mode(knockout_blend_mode());
+        self.ctx.set_paint(AlphaColor::<Srgb>::new([0.0, 0.0, 0.0, 0.0]));
+        self.ctx.fill_path(shape);
+        self.ctx.set_fill_rule(old_rule);
+        self.ctx.set_transform(old_transform);
+    }
+
     fn set_soft_mask(&mut self, mask: Option<SoftMask<'_>>) {
         let settings = *self.ctx.render_settings();
         self.cur_mask = mask.map(|m| {
@@ -1608,6 +1858,16 @@ impl<'a> Device<'a> for Renderer {
         }
     }
 
+    /// PdfCraft patch (17): the reading-colours mapping is suspended for annotations.
+    fn begin_annotations(&mut self) {
+        self.in_annotations = true;
+    }
+
+    /// PdfCraft patch (17): back to document content; reading colours apply again.
+    fn end_annotations(&mut self) {
+        self.in_annotations = false;
+    }
+
     fn draw_rect(
         &mut self,
         rect: &Rect,
@@ -1627,7 +1887,9 @@ impl<'a> Device<'a> for Renderer {
 
                 // PdfCraft patch: apply the reading-colours mapping before painting.
                 let paint = self.replaced(paint, false);
-                let clip_path = self.set_paint(&paint, &path, false);
+                let PaintSetup::Clip(clip_path) = self.set_paint(&paint, &path, false) else {
+                    return;
+                };
                 if let Some(clip_path) = clip_path.as_ref() {
                     self.push_clip_path_inner(clip_path, *fill_rule);
                 }
@@ -1659,14 +1921,21 @@ impl<'a> Device<'a> for Renderer {
             GlyphDrawMode::Stroke(s) => {
                 Self::stroke_glyph(self, glyph, transform, glyph_transform, paint, s);
             }
-            GlyphDrawMode::Invisible => {
-                // Don't render invisible text for visual output
+            GlyphDrawMode::Invisible | GlyphDrawMode::Clip => {
+                // PdfCraft patch (#3116): neither mode paints; the interpreter installs the clip.
             }
         }
     }
 
     fn set_blend_mode(&mut self, blend_mode: BlendMode) {
-        self.ctx.set_blend_mode(convert_blend_mode(blend_mode));
+        // Knockout patch (pdfcraft #2974): inside a knockout group every element replaces what it
+        // covers.
+        let mode = if self.in_knockout() {
+            knockout_blend_mode()
+        } else {
+            convert_blend_mode(blend_mode)
+        };
+        self.ctx.set_blend_mode(mode);
     }
 }
 
@@ -1743,12 +2012,17 @@ fn render_shading_texture(
     )
 }
 
-fn draw_soft_mask(mask: &SoftMask<'_>, settings: RenderSettings, width: u16, height: u16, preview: bool) -> Mask {
-    let mut renderer = Renderer {
-        ctx: RenderContext::new_with(width, height, derive_settings(&settings)),
+/// A renderer for a soft mask's contents, `width` × `height` device pixels.
+fn soft_mask_renderer(settings: &RenderSettings, width: u16, height: u16, preview: bool) -> Renderer {
+    Renderer {
+        ctx: RenderContext::new_with(width, height, derive_settings(settings)),
         // PdfCraft patch: a soft mask must keep its original luminance values, so its
         // content is never remapped by the reading-colours setting.
         color_replacement: None,
+        in_annotations: false,
+        knockout: Vec::new(),
+        erasing: false,
+        erase_groups: 0,
         inside_pattern: false,
         cur_mask: None,
         soft_mask_cache: HashMap::default(),
@@ -1757,35 +2031,42 @@ fn draw_soft_mask(mask: &SoftMask<'_>, settings: RenderSettings, width: u16, hei
         scaler: Scaler::new(ResamplingFunction::CatmullRom),
         preview,
         image_transparency_stack: Vec::new(),
-    };
-
-    let bg_color = mask.background_color().to_rgba();
-    let apply_bg = bg_color.to_rgba8() != BLACK.to_rgba8().to_u8_array();
-
-    if apply_bg {
-        renderer
-            .ctx
-            .set_paint(AlphaColor::<Srgb>::new(bg_color.components()));
-        renderer
-            .ctx
-            .fill_rect(&Rect::new(0.0, 0.0, width as f64, height as f64));
-        renderer.ctx.push_layer(None, None, None, None, None);
     }
+}
 
-    mask.interpret(&mut renderer);
+fn draw_soft_mask(mask: &SoftMask<'_>, settings: RenderSettings, width: u16, height: u16, preview: bool) -> Mask {
+    let mut rendered_mask = if mask.mask_type() == MaskType::Luminosity && mask.is_device_cmyk() {
+        cmyk_luminosity(mask, &settings, width, height, preview)
+    } else {
+        let mut renderer = soft_mask_renderer(&settings, width, height, preview);
+        let bg_color = mask.background_color().to_rgba();
+        let apply_bg = bg_color.to_rgba8() != BLACK.to_rgba8().to_u8_array();
 
-    if apply_bg {
-        renderer.ctx.pop_layer();
-    }
+        if apply_bg {
+            renderer
+                .ctx
+                .set_paint(AlphaColor::<Srgb>::new(bg_color.components()));
+            renderer
+                .ctx
+                .fill_rect(&Rect::new(0.0, 0.0, width as f64, height as f64));
+            renderer.ctx.push_layer(None, None, None, None, None);
+        }
 
-    let mut pix = Pixmap::new(width, height);
-    renderer.ctx.flush();
-    let mut resources = vello_cpu::Resources::default();
-    renderer.ctx.render_to_pixmap(&mut resources, &mut pix);
+        mask.interpret(&mut renderer);
 
-    let mut rendered_mask = match mask.mask_type() {
-        MaskType::Luminosity => Mask::new_luminance(&pix),
-        MaskType::Alpha => Mask::new_alpha(&pix),
+        if apply_bg {
+            renderer.ctx.pop_layer();
+        }
+
+        let mut pix = Pixmap::new(width, height);
+        renderer.ctx.flush();
+        let mut resources = vello_cpu::Resources::default();
+        renderer.ctx.render_to_pixmap(&mut resources, &mut pix);
+
+        match mask.mask_type() {
+            MaskType::Luminosity => Mask::new_luminance(&pix),
+            MaskType::Alpha => Mask::new_alpha(&pix),
+        }
     };
 
     if let Some(transfer_function) = mask.transfer_function() {
@@ -1806,6 +2087,43 @@ fn draw_soft_mask(mask: &SoftMask<'_>, settings: RenderSettings, width: u16, hei
     rendered_mask
 }
 
+/// Craft patch (CMYK masks): a luminosity mask whose group is DeviceCMYK. ISO 32000-2 §11.6.5.2
+/// takes the luminosity of the group's CMYK result, which §10.4.2.2 defines as `1 - min(1, 0.3c
+/// + 0.59m + 0.11y + k)`. Taken from the colors as drawn, through the CMYK profile, K 100%
+/// would leave about a tenth of the masked object visible. So each process ink's plate of the
+/// group is drawn over the backdrop's film, and the formula is applied to the four tints.
+fn cmyk_luminosity(mask: &SoftMask<'_>, settings: &RenderSettings, width: u16, height: u16, preview: bool) -> Mask {
+    let backdrop = mask.background_color();
+    let pixels = usize::from(width) * usize::from(height);
+    let mut ink = vec![0.0_f32; pixels];
+    for (plate_ink, weight) in hayro_interpret::color::Ink::PROCESS.into_iter().zip([0.3, 0.59, 0.11, 1.0]) {
+        let plate = mask.plate(plate_ink);
+        let film = 1.0 - plate.tint(&backdrop);
+        let mut renderer = soft_mask_renderer(settings, width, height, preview);
+        renderer.ctx.set_paint(AlphaColor::<Srgb>::new([film, film, film, 1.0]));
+        renderer
+            .ctx
+            .fill_rect(&Rect::new(0.0, 0.0, width as f64, height as f64));
+        renderer.ctx.push_layer(None, None, None, None, None);
+        mask.interpret_plate(&mut renderer, plate);
+        renderer.ctx.pop_layer();
+
+        let mut pix = Pixmap::new(width, height);
+        renderer.ctx.flush();
+        let mut resources = vello_cpu::Resources::default();
+        renderer.ctx.render_to_pixmap(&mut resources, &mut pix);
+        // The backdrop is opaque, so every pixel is too: red is the film.
+        for (sum, px) in ink.iter_mut().zip(pix.data()) {
+            *sum += weight * (1.0 - f32::from(px.r) / 255.0);
+        }
+    }
+    let values = ink
+        .into_iter()
+        .map(|sum| ((1.0 - sum.min(1.0)) * 255.0 + 0.5) as u8)
+        .collect();
+    Mask::from_parts(values, width, height)
+}
+
 pub(crate) fn max_factor(transform: &Affine) -> f32 {
     let scale_skew_transform = {
         let c = transform.as_coeffs();
@@ -1843,6 +2161,12 @@ fn convert_fill_rule(fill_rule: FillRule) -> Fill {
     }
 }
 
+/// Knockout patch (pdfcraft #2974): how an element of a knockout group is drawn (see
+/// `set_knockout`).
+fn knockout_blend_mode() -> peniko::BlendMode {
+    peniko::BlendMode::new(Mix::Normal, Compose::Copy)
+}
+
 fn convert_blend_mode(blend_mode: BlendMode) -> peniko::BlendMode {
     let mix = match blend_mode {
         BlendMode::Normal => Mix::Normal,
@@ -1866,6 +2190,46 @@ fn convert_blend_mode(blend_mode: BlendMode) -> peniko::BlendMode {
     peniko::BlendMode::new(mix, Compose::SrcOver)
 }
 
+/// PdfCraft patch: how far a stroke's paint reaches past its path, in user units: half the width
+/// times the larger of the miter limit and √2 (a miter join or a square cap). A miter limit that
+/// isn't finite leaves miters unbounded, so the reach is too.
+fn stroke_reach(stroke: &kurbo::Stroke) -> f64 {
+    let miter = stroke.miter_limit.abs();
+    stroke.width / 2.0
+        * if miter.is_finite() {
+            miter.max(std::f64::consts::SQRT_2)
+        } else {
+            f64::INFINITY
+        }
+}
+
+/// PdfCraft patch (20): whether a cell's scale can draw it at full size: finite and positive. A
+/// `/BBox` too thin to divide by (1e-40 wide passes the zero-area check) gives an infinite scale,
+/// which would send non-finite geometry to the cell renderer; such a cell keeps the old path.
+pub fn usable_cell_scale(xs: f32, ys: f32) -> bool {
+    xs.is_finite() && ys.is_finite() && xs > 0.0 && ys > 0.0
+}
+
+/// PdfCraft patch (20): whether `path` (drawn with `path_transform`, its paint reaching `reach`
+/// device pixels past it), mapped into the space of a tiling pattern with matrix `matrix`, can
+/// only meet the first cell's `/BBox`: every other cell's content lies a whole step or more
+/// away. False when the matrix can't be inverted or the bounds aren't finite.
+pub(crate) fn shows_one_cell(matrix: &Affine, path_transform: &Affine, path: &BezPath, reach: f64, bbox: Rect, x_step: f32, y_step: f32) -> bool {
+    if matrix.determinant().abs() < 1e-12 || !matrix.determinant().is_finite() {
+        return false;
+    }
+    let device = (*path_transform * path.clone()).bounding_box().inflate(reach, reach);
+    let bounds = (matrix.inverse() * device.to_path(0.1)).bounding_box();
+    let (sx, sy) = (f64::from(x_step.abs()), f64::from(y_step.abs()));
+    let finite = [bounds.x0, bounds.y0, bounds.x1, bounds.y1, sx, sy].iter().all(|v| v.is_finite());
+    // Cell k's content spans `bbox + k × step`; with k = ±1 out of reach, so is every other.
+    finite
+        && bounds.x1 < bbox.x0 + sx
+        && bounds.x0 > bbox.x1 - sx
+        && bounds.y1 < bbox.y0 + sy
+        && bounds.y0 > bbox.y1 - sy
+}
+
 /// PdfCraft patch: the scale for a tiling cell, lowered so that the cell pixmap (`|step| ×
 /// scale` pixels a side) stays within `max_pixels`. Geometry is unchanged (the pattern transform
 /// is derived from the scale); an over-large step only renders at lower resolution.
diff --git a/vendor/krilla/README.craft.md b/vendor/krilla/README.craft.md
index d0aff457..6171ba88 100644
--- a/vendor/krilla/README.craft.md
+++ b/vendor/krilla/README.craft.md
@@ -1,11 +1,43 @@
-# Local Krilla 0.8.2 patch
+# Local Krilla 0.8.2 fork
 
 This is the crates.io Krilla 0.8.2 package (MIT OR Apache-2.0), upstream commit
-`3ffdf0588cf98050aad6edba51ca70162e1fb5b5`. `SOURCE.json` records each retained
-upstream file hash and the patched hash. Registry bookkeeping files,
-`Cargo.lock` and the redundant original manifest are omitted. Upstream MIT/Apache licence texts are retained under `../../licenses/pdf-writer`;
-the registry package itself omits those texts. Its examples and four CC0 ICC
-profiles are retained without changes.
+`3ffdf0588cf98050aad6edba51ca70162e1fb5b5`, with the patches listed below. Registry
+bookkeeping files, `Cargo.lock` and the redundant original manifest are omitted. Upstream
+MIT/Apache license texts are retained under `../../licenses/pdf-writer`; the registry package
+itself omits those texts. Its examples and four CC0 ICC profiles are retained without changes.
+
+## Patch ledger
+
+| File | Patch | Touches |
+|---|---|---|
+| `patches/01-unwind-safe-drop.patch` | Unwind-safe drop | `document.rs`, `error.rs`, `lib.rs`, `page.rs`, `serialize.rs`, `surface.rs` |
+| `patches/02-group-color-space.patch` | Blending color space | `error.rs`, `graphics/{graphics_state,image,mask,tiling_pattern,xobject}.rs`, `lib.rs`, `page.rs`, `pdf.rs`, `resource.rs`, `serialize.rs`, `text/type3.rs` |
+| `patches/03-overprint.patch` | Overprint | `configure/{PDF_A2.md,PDF_A4.md,validate.rs}`, `content.rs`, `graphics/{blend,graphics_state}.rs`, `surface.rs` |
+| `patches/04-knockout.patch` | Knockout groups | `content.rs`, `graphics/{blend,xobject}.rs`, `surface.rs` |
+| `patches/05-soft-mask-backdrop.patch` | Soft-mask backdrop and transfer function | `configure/{PDF_A2,PDF_A4}.md`, `graphics/mask.rs` |
+| `patches/06-device-n.patch` | DeviceN colors | `configure/{PDF_A1.md,PDF_A2.md,PDF_A4.md,validate.rs}`, `graphics/{color,device_n,mod,paint}.rs`, `serialize.rs` |
+| `patches/07-device-n-images-shadings.patch` | DeviceN images and shadings | `graphics/{image,paint,shading_function}.rs` |
+| `patches/08-print-output-intent.patch` | Print output intent and PDF/X markers | `chunk_container.rs`, `configure/{PDF_A1.md,PDF_A2.md,PDF_A4.md,validate.rs}`, `interchange/metadata.rs`, `lib.rs`, `serialize.rs` |
+| `patches/09-rendition-class.patch` | Master rendition in XMP | `chunk_container.rs` |
+| `patches/10-mesh-gradients.patch` | Mesh gradients | `content.rs`, `error.rs`, `graphics/{mask,paint,shading_function}.rs`, `serialize.rs`, `surface.rs` |
+| `patches/11-png-decode-cap.patch` | PNG decode cap | `graphics/image.rs` |
+| `patches/12-optional-content.patch` | Optional content | `chunk_container.rs`, `configure/{PDF_A1,PDF_A2,PDF_A4,PDF_UA1}.md`, `configure/validate.rs`, `content.rs`, `error.rs`, `graphics/{mod,optional_content}.rs`, `lib.rs`, `resource.rs`, `serialize.rs`, `surface.rs` |
+| `patches/13-annotation-bounds.patch` | Annotation and destination bounds | `error.rs`, `interactive/{annotation,destination}.rs`, `page.rs`, `serialize.rs` |
+| `patches/14-devicen-pdf-version.patch` | DeviceN attributes by PDF version | `graphics/device_n.rs` |
+| `patches/15-pdfx-conformance.patch` | PDF/X conformance key | `serialize.rs` |
+| `patches/16-modification-date.patch` | Modification date | `interchange/metadata.rs` |
+
+Each patch applies with `patch -p1` from this directory, in numeric order, to the pristine
+crate. `SOURCE.json` records, for every retained file, the upstream hash (`upstream_sha256`)
+and the hash after all patches (`sha256`), plus the hash of the `.crate` download
+(`crate_sha256`).
+
+Every change to `src/` updates its patch file, this ledger and `SOURCE.json` in the same
+commit. To take a new Krilla release: unpack the crates.io package, apply the patches in
+order, drop the ones the release makes unnecessary, regenerate `SOURCE.json`, and rerun the
+craft-pdf and plate-test suites.
+
+## 01: unwind-safe drop
 
 The patch changes two destructors: `Surface::drop` and `Page::drop` return early
 when `std::thread::panicking()` is true. Drawing can panic with an unfinished
@@ -27,8 +59,354 @@ cleanup and a successful fresh export afterward. Native and WASM export tests
 cover the unchanged successful path. WASM aborts, aborting panic configurations
 and process-wide allocation failures remain outside unwind recovery.
 
+## 02: blending color space
+
+Upstream gives every transparency group an RGB `/CS` and writes no page group, so
+transparency over CMYK content blends in RGB and comes back with all four process inks
+(K50 over C100 separates as roughly C84 M34 Y33 K37 instead of C50 K50).
+
+`SerializeSettings::group_color_space` chooses the blending space. `GroupColorSpace::Rgb`,
+the default, writes the same groups and page dictionaries as upstream. With
+`GroupColorSpace::Cmyk`:
+
+- Content groups (`draw_masked`, `draw_opacified`, `draw_isolated`, `Graphic`) write no `/CS`
+  and inherit the page group.
+- A page that uses transparency gets `/Group <</S/Transparency/CS …>>`: DeviceCMYK, or the
+  `cmyk_profile` ICC space when `no_device_cs` is set. Opaque pages get no page group, so
+  they stay valid for PDF/X-1a and X-3.
+- Soft-mask source groups have no parent, so they name their own space: DeviceCMYK, or
+  sGrey when `no_device_cs` is set. Through a CMYK profile K 100% is not black, so an ICC
+  CMYK mask group would give the default black backdrop a luminosity above 0, and the masked
+  object would show where the mask content paints nothing. The XObject `Repr` carries a
+  `GroupRole` (content or mask source) for this.
+- Pages placed as XObjects (`draw_pdf_page`) get an isolated group without `/CS`; the RGB
+  color space is not registered. The source page's own group is dropped, as before;
+  krilla #410 (unreleased, needs hayro-write 0.8) keeps it.
+- `no_device_cs` without a `cmyk_profile` fails at `Document::finish` with
+  `KrillaError::MissingGroupCmykProfile`.
+
+Which pages blend is tracked by object reference, because cached objects are serialized
+once: transparent graphics states (alpha below 1, a blend mode other than Normal, a soft
+mask), group XObjects, images with alpha and embedded pages are recorded when written,
+and so are forms, tiling patterns and Type 3 fonts whose resources include one of these.
+A page blends when its resources name a recorded object.
+
+Tests: `crates/pdf/tests/print_color.rs`, and the plate-test scenes S06, S07, S08, S10,
+S15 and D04.
+
+## 03: overprint
+
+Upstream writes no overprint entries, so separated output knocks out every plate under an
+object; a [Black] rect over C100 prints K100 instead of C100 K100.
+
+`Surface::push_overprint(Overprint { fill, stroke, nonzero })` pushes overprint settings
+like `push_blend_mode`: no group, popped with `Surface::pop`. Paths, text and images drawn
+in between get an ExtGState with `/op` (fill), `/OP` (stroke) and `/OPM` (1 when `nonzero`,
+otherwise 0). All three entries are always written, so an inner push replaces an outer one
+completely and a RIP never inherits OPM 1 from an enclosing state. Groups pushed inside
+inherit the settings through the `Do` that paints them. Overprint is not a field of `Fill`
+or `Stroke`, because apps build those as struct literals.
+
+The ExtGState `Repr` carries `overprint_fill`, `overprint_stroke` and `overprint_mode`;
+`empty`, `combine` and `serialize` handle them like the other entries. Overprint is
+not transparency: it marks no page as blending.
+
+Validation: ISO 19005-2 and 19005-4 (6.2.4.2) forbid OPM 1 when an ICCBased CMYK color
+space is used for a side that overprints. Validated PDF/A export writes all CMYK as
+ICCBased, and the graphics state doesn't know the colors painted under it, so OPM 1 with
+`/op` or `/OP` true under `no_device_cs` registers `ValidationError::OverprintModeIccCmyk`,
+which PDF/A-2, A-3 and A-4 prohibit. PDF/A-1 and PDF/UA allow it. ISO 32000-1 (8.6.7)
+applies OPM 1 to DeviceCMYK only, so under `no_device_cs` it has no effect in a PDF 1.7
+reader; `Overprint::nonzero` says so.
+
+Tests: `crates/pdf/tests/print_color.rs`, and the plate-test scenes S01, S03, S04, S12,
+S16, D06 and D10.
+
+## 04: knockout groups
+
+Upstream can only push isolated groups, so objects overlapping inside a group always
+composite with each other; a knockout group of a 50% cyan and a 50% magenta circle over
+yellow separates as C25 M50 Y25 where they overlap instead of M50 Y50.
+
+`Surface::push_group(GroupOptions { isolated, knockout })` pushes a group with `/I` and
+`/K` set independently; `push_isolated` is shorthand for `isolated` alone. A knockout
+group is a transparency group even when it is not isolated, so it gets patch 02's `/CS`
+rules: krilla's RGB `/CS` under `GroupColorSpace::Rgb`, none under `Cmyk`, and it marks
+its page as blending. A group with neither attribute is a plain form XObject, as before.
+
+The XObject `Repr` carries `knockout`; `XObject::group` builds a content group from
+`GroupOptions`.
+
+Tests: `crates/pdf/tests/print_color.rs`, and the plate-test scene S09.
+## 05: soft-mask backdrop and transfer function
+
+Upstream writes soft masks with `/S` and `/G` only. A luminosity mask then has the default
+black backdrop, so the masked object is hidden wherever the mask content paints nothing, and
+there is no transfer curve.
+
+- `Mask::with_backdrop(color)` writes `/BC` on luminosity masks, in the mask group's color
+  space: RGB under `GroupColorSpace::Rgb` (DeviceRGB or sRGB); under `GroupColorSpace::Cmyk`,
+  four components (DeviceCMYK), or one (sGrey) with `no_device_cs`. Colors from another space
+  are converted with the device formulas; luma becomes equal RGB components or black ink only.
+  On an alpha mask, where `/BC` has no meaning, the call returns the mask unchanged.
+- `Mask::with_transfer(TransferFunction)` writes `/TR`: `/Identity`, or a Type 0 sampled
+  function (domain and range 0 to 1, 16-bit samples, linear interpolation) for
+  `TransferFunction::Sampled`. An empty curve is written as `/Identity`; one sample is
+  repeated to span the domain.
+
+Standards: PDF/A-2 and PDF/A-4 6.2.5 forbid `TR` in graphics states (veraPDF rules test
+`PDExtGState` only); nothing restricts the soft-mask dictionary's `/TR`, so no validation
+error is added and the PDF/A notes say so. PDF/X (ISO 15930-7) forbids graphics-state transfer
+functions; whether it or a PDF/X-4 preflight also flags a soft-mask `/TR` could not be checked
+against the standard's text.
+
+Tests: `crates/pdf/tests/print_color.rs`, and the plate-test scenes S11, M1, M2 and D08.
+## 06: DeviceN colors
+
+Upstream has only Separation as a special color space, so a color that sets several
+inks at once (C60 K40 without touching M and Y, or a process ink with a spot) has to be
+written as CMYK, which knocks out or replaces the other plates.
+
+`color::device_n` adds `SpecialColor::DeviceN`:
+
+- `DeviceNSpace::new(colorants)` takes an ordered list of `Colorant::Process(Process)` and
+  `Colorant::Spot { name, alternate: cmyk::Color }`. It returns `None` for an empty list,
+  more than 32 colorants, a repeated name, or a spot named `All`, `None` or like a process
+  ink. `device_n::Color::new(tints, space)` takes one tint per colorant.
+- The space is written as `[/DeviceN [names] alternate tint attributes]` and cached like a
+  Separation space. The alternate is DeviceCMYK, or the `cmyk_profile` ICC space with
+  `no_device_cs`.
+- The tint transform is a Type 4 (PostScript calculator) function. Each colorant
+  contributes its tint times its CMYK alternate (process inks: 1 on their own component);
+  contributions combine as `1 - (1 - a)(1 - b)…`, so process tints pass through unchanged.
+  It registers `ValidationError::ContainsPostScript`, which krilla's PDF/A tables forbid for
+  PDF/A-1, -2 and -3.
+- From PDF 1.6, a space with spots gets an attributes dictionary whose `/Colorants` maps
+  each spot to its Separation space. When spots and process inks mix, it is
+  `/Subtype /NChannel` with `/Process << /ColorSpace alternate /Components [/Cyan /Magenta
+  /Yellow /Black] >>`. Patch 14 changes which of these each PDF version gets.
+- Validation: a spot's CMYK alternate counts as its Separation fallback, so one colorant
+  name keeps one alternate across Separation and DeviceN spaces
+  (`ValidationError::InconsistentSeparationFallback`). `/All` and `/None` are Separation-only
+  and checked as before. The PDF/A ledgers state that DeviceN fails export under PDF/A-1, -2
+  and -3 and is written under PDF/A-4.
+- `Color::to_regular` (annotations, tags) gives the alternate CMYK; `Paint::as_rgb` gives
+  `None`, as for CMYK.
+
+Images and shadings use the same `DeviceNSpace` (patch 07).
+
+Tests: `crates/pdf/tests/print_color.rs` (`device_n_*`), and the plate-test scene N1.
+
+## 07: DeviceN images and shadings
+
+Upstream images are RGB, gray or CMYK, so a duotone or a spot-channel image can't name its
+inks. Gradient stops must share one color space: a stop that mixes a spot with process
+inks, or two spots, has no space to go in, and stops from different spaces fail an
+assertion while writing.
+
+- `ImageColorspace::DeviceN` for `CustomImage`, with the space from the new
+  `CustomImage::device_n_space` (default `None`): one sample per colorant, in the space's
+  colorant order, 0 = no ink. `Image::from_custom` refuses a DeviceN image without a space.
+  The image's `/ColorSpace` is the cached DeviceN space from patch 06; an ICC profile is
+  ignored. `ImageColorspace` stays `Copy`, so the new variant breaks only exhaustive
+  matches.
+- Gradient stops (linear, radial, sweep) in different ink-based spaces are rewritten into
+  one space when the shading function is created. Ink-based: CMYK, gray (as black), a
+  Separation with a named colorant, DeviceN. A process colorant takes part when a stop has
+  it at a nonzero tint or a DeviceN stop names it; a spot takes part when a stop names it.
+  - One spot and no process colorant: a Separation shading in the spot's own space. A spot
+    to paper (CMYK 0 0 0 0, white, or tint 0) stays a Separation shading.
+  - Process colorants only (gray to CMYK, for example): DeviceCMYK.
+  - Anything else: a DeviceN shading, process colorants in CMYK order, then spots in the
+    order the stops name them; the function has one output per colorant. A spot whose
+    fallback isn't CMYK can't join a DeviceN space.
+  - Stops that already share a space, and mixes with RGB, `All` or `None`, are written as
+    upstream does.
+- PostScript (sweep) gradient functions get one `/Range` pair per output component;
+  upstream always wrote three.
+
+The conversion lives in `shading_function::common_color_space`, which takes a list of
+colors, so other shading types (such as mesh gradients) can call it for their colors.
+
+Tests: `crates/pdf/tests/print_color.rs` (`device_n_image_*`, `device_n_shading_*`), and
+the plate-test scene S14.
+## 08: print output intent and PDF/X markers
+
+Upstream writes an output intent only for PDF/A, always sRGB, and has no `/Trapped` or PDF/X
+version. DesignCraft and VectorCraft added these by rewriting the serialized bytes.
+
+- `SerializeSettings::output_intent: Option<OutputIntent>` writes an `/OutputIntents` entry
+  with `/S /GTS_PDFX`: the CMYK profile as `/DestOutputProfile`, `/OutputConditionIdentifier`,
+  and optional `/OutputCondition`, `/RegistryName` and `/Info`. With a PDF/A validator, the
+  `GTS_PDFA1` entry names the same profile object and condition instead of sRGB, because
+  PDF/A requires every output intent to share one destination profile.
+- `SerializeSettings::trapped: Option<Trapped>` writes `/Trapped` to the document
+  information dictionary and `pdf:Trapped` to XMP, `Unknown` included (the Adobe PDF schema
+  allows it, and PDF/A-1 requires the two to match).
+- `SerializeSettings::pdfx_version: Option<String>` writes `/GTS_PDFXVersion` to the
+  dictionary and `pdfxid:GTS_PDFXVersion` to XMP. PDF/A-1, -2 and -3 require an extension
+  schema for the XMP property, which this patch does not write, so the setting registers
+  `ValidationError::PdfxVersionWithoutExtensionSchema`, which they prohibit. PDF/A-4 has no
+  extension schema requirement and allows it.
+- The dictionary entries follow the dictionary's PDF 2.0 deprecation: from PDF 2.0 only XMP
+  carries them. The dictionary is written without `Metadata` when it has print markers.
+- All three default to `None`, which keeps upstream's output.
+- The PDF/A ledgers state the two output intents and the CMYK destination profile; krilla
+  checks only that the profile has four components.
+
+krilla does not check PDF/X conformance; callers do. `CRAFT_PRINT_COLOR` marks the fork's
+print color patches (02 to 08) so craft-pdf fails to build against an unpatched Krilla.
+
+Tests: `crates/pdf/tests/print_color.rs` and the plate-test print preset over every scene.
+
+## 09: master rendition in XMP
+
+From storytold/craft-libs#183 by Hamza (@Hamza0101). Upstream writes
+`xmpMM:RenditionClass` as `proof` on every document, which tells a prepress system that a
+print deliverable is a proof copy. XMP Part 2 (Media Management) defines `default` as the
+master rendition, so the patch writes `default`. Every document's XMP differs from
+upstream's output in this value, whatever the other settings.
+
+## 10: mesh gradients
+
+From storytold/craft-libs#184 by @fastmikey99.
+
+Krilla 0.8.2 paints only flat color, linear, radial and sweep gradients and tiling patterns, so
+an app writing a gradient mesh had to cut each patch into flat-color pieces: a VectorCraft
+document holding an Illustrator file's 22,850 mesh patches became a 197 MB PDF with stepped
+blends. The patch adds `paint::MeshGradient` (and `MeshPatch`): Coons patches with a color and
+an opacity at each corner, written as one PDF Type 6 shading (ISO 32000-1, 8.7.4.5.7) through
+pdf-writer's `StreamShading`, so the viewer or RIP blends them at its own resolution. Each patch
+is an 8-bit flag (no shared edge), its twelve points as 32-bit coordinates over the mesh's
+bounds (`Decode`) and its four corner colors at 8 bits a component, Flate-compressed. It goes
+through the same path as the other gradients (`GradientProperties::MeshGradient`): a shading
+pattern for the fill, and for corner opacities below 1 a luminosity soft mask holding the same
+mesh in gray (`use_opacities`), as cairo and Illustrator write transparent meshes.
+
+The corner colors of every patch go through `common_color_space` from patch 07, the rule
+gradient stops follow, before the shading is written: process colors alone become
+DeviceCMYK, one spot alone a Separation space, and any other mix of inks a DeviceN space with
+the process colorants in CMYK order, then the spots. A mesh mixing CMYK and a spot is a
+DeviceN mesh with one component per colorant at each corner. Colors the rule can't bring into
+one space (RGB with CMYK, `All` or `None` with anything else) would be written with another
+space's component count, so the document fails with `KrillaError::MixedMeshColorSpaces`
+instead. The soft mask is written in gray from the opacities and is unaffected.
+
+Tests: `crates/pdf/tests/print_color.rs` (`mesh_*`, `rgb_mesh_*`) and the plate-test scene S17.
+
+## 11: PNG decode cap
+
 A PNG whose header implies more than 1 GiB of decoded output is refused by
 `Image::from_png` and by the deferred decoder, and the decoded buffer is reserved
 fallibly, so a small file (or a bitmap glyph in a font) cannot request an allocation that
-ends the process. The colour and alpha buffers that PNG, GIF and WebP decoding split an
+ends the process. The color and alpha buffers that PNG, GIF and WebP decoding split an
 image into are reserved fallibly too, and a failure there is an image error.
+`Image::from_custom` computes the expected channel lengths with checked `usize` arithmetic and
+returns an error when they overflow or don't match the data, where upstream multiplied in
+`u32` and asserted while writing (32 DeviceN components at 16 bits overflow at about 67
+megapixels).
+
+## 12: optional content
+
+Krilla 0.8.2 can't write optional content groups (layers), and it has no hook for raw content
+operators or extra catalog and resource entries, so CADCraft's drawing layers can't be added
+from outside. The new module `graphics/optional_content.rs` holds the feature; the other files
+get small hooks.
+
+- `Document::add_optional_content_group(name, visible) -> OcgId` writes
+  `<< /Type /OCG /Name (…) >>` once (a text string, so any Unicode name works).
+- `Surface::start_optional_content(OcgId)` and `Surface::end_optional_content()`, both
+  returning `KrillaResult<()>`, write `/OC /ocN BDC` … `EMC`, with `/ocN` in the current
+  stream's `/Properties` resources (a new resource kind beside `/ExtGState`). Inside a group,
+  opacity or mask, the entry goes in that form's resources.
+- Marks nest, and nest independently of tagging, whose single marked-content level is
+  unchanged. An end with nothing open, or one that would close a tagged section started inside
+  the mark, returns `KrillaError::UnbalancedOptionalContent` and writes nothing. An `OcgId` index
+  the document doesn't have returns `KrillaError::UnknownOptionalContentGroup`. Marks still open
+  when their stream finishes (surface finish, or a pop of a group, opacity or mask), and a
+  tagged section ended while a mark started inside it is open, are closed with `EMC` and make
+  `Document::finish` fail with `KrillaError::UnbalancedOptionalContent`. Nothing panics.
+- When any group exists, the catalog gets `/OCProperties << /OCGs [all] /D << /Name (Layers)
+  /Order [all] /OFF [hidden] >> >>`, listing groups that no page uses too; `/OFF` is omitted
+  when every group is shown. `Document::set_optional_content_page_mode(true)` adds
+  `/PageMode /UseOC`, written only when groups exist.
+- Validation: adding a group registers `ValidationError::OptionalContent`, which PDF/A-1
+  prohibits (6.1.13), and below PDF 1.5 also
+  `ValidationError::RequiresNewerPdfVersion(VersionedFeature::OptionalContent)`, which PDF/UA-1
+  prohibits. Without a validator a PDF 1.4 document still gets the groups, as with krilla's
+  other versioned features. The PDF/A-2, A-4 and UA-1 ledgers record that the one
+  configuration has a `Name`, an `Order` listing every group and no `AS`.
+
+`CRAFT_OPTIONAL_CONTENT` marks the patch; craft-pdf requires it at compile time.
+
+Tests: `crates/pdf/tests/optional_content.rs`.
+
+## 13: annotation and destination bounds
+
+Upstream panics on link geometry that has no finite place on the page, which aborts a WASM
+app. `Document::finish` returns an error instead and writes nothing for the object:
+
+| Input | Upstream | Error |
+|---|---|---|
+| `LinkAnnotation::new_with_quad_points` with no quads, a non-finite point, or a bounding box whose width or height overflows | `assert!` or `unwrap` | `InvalidAnnotationGeometry(location)` |
+| A link rect or quad bounding box that overflows when flipped into PDF coordinates (`page_height - y`) | `unwrap` | `InvalidAnnotationGeometry(location)` |
+| A media, crop, bleed, trim or art box that overflows the same way | `unwrap` | `InvalidPageBox(page_index)` |
+| An `XyzDestination` page index past the last page | `panic!` | `InvalidDestination(page_index)` |
+| An `XyzDestination` point that maps to a non-finite coordinate | writes `inf` or `NaN` | `InvalidDestination(page_index)` |
+
+The constructors keep their signatures: `LinkAnnotation` holds an `Option<Rect>` and the check
+runs at serialization, before the annotation object starts. Refusing a single annotation
+instead of skipping it keeps the indices of tagged annotations in the structure tree valid.
+
+Tests: `crates/pdf/tests/link_annotations.rs`.
+
+## 14: DeviceN attributes by PDF version
+
+Patch 06 writes the DeviceN attributes dictionary only from PDF 1.6. A PDF/X-1a file is PDF
+1.3 or 1.4, so its spots then had no `/Colorants`, and a file written at 1.6 or later and
+relabeled 1.4 kept `/Subtype /NChannel` and `/Process`, which preflight tools flag in a 1.4
+file.
+
+ISO 32000-1, 8.6.6.5 (Table 71) marks the attributes dictionary and its `/Colorants` entry
+PDF 1.3, and `/Subtype`, `/Process` and `/MixingHints` PDF 1.6; the PDF Reference for 1.3 and
+1.4 lists `/Colorants` as the dictionary's only entry. The spec was checked from memory, not
+against the text.
+
+- Every version krilla writes (1.4 and later): a space with spots gets an attributes
+  dictionary with `/Colorants`, each spot mapped to its Separation space.
+- From PDF 1.6, a space that mixes spots and process inks also gets `/Subtype /NChannel` and
+  `/Process`, as patch 06 writes them.
+- A space of process inks only gets no attributes, as before.
+
+Tests: `crates/pdf/tests/print_color.rs` (`device_n_attributes_follow_the_pdf_version`) and
+`crates/prepress/tests/flatten_document.rs` (`pdf_x1a_output_is_pdf_14_without_nchannel`).
+
+## 15: PDF/X conformance key
+
+Patch 08 writes only `GTS_PDFXVersion`. PDF/X-1a and X-3 also need `GTS_PDFXConformance` in
+the document information dictionary: a PDF/X-1a:2003 file carries `GTS_PDFXVersion
+(PDF/X-1:2003)` and `GTS_PDFXConformance (PDF/X-1a:2003)` (ISO 15930-4). Later parts (X-4
+and on) have no conformance key.
+
+- `SerializeSettings::pdfx_conformance: Option<String>` writes `/GTS_PDFXConformance` to the
+  dictionary, under the same PDF 2.0 rule as patch 08's entries. It defaults to `None`.
+- There is no XMP property for it: the `pdfxid` schema (ISO 15930-7) defines only
+  `GTS_PDFXVersion`. A PDF 2.0 file therefore omits the key.
+
+Tests: `crates/pdf/tests/print_color.rs` (`trapped_and_pdfx_version_are_written_to_info_and_xmp`)
+and `crates/prepress/tests/flatten_document.rs` (`pdf_x1a_output_is_pdf_14_without_nchannel`).
+
+## 16: modification date
+
+Upstream has only a creation date and writes it as the modification date too (`/ModDate` and
+`xmp:ModifyDate`), so a document rewritten from another, such as a flattened copy, can't keep
+its source's modification date.
+
+- `Metadata::modification_date(DateTime)` sets the date written as `/ModDate` and
+  `xmp:ModifyDate`. Without it, the creation date is written there, as upstream does.
+- The XMP history events keep the creation date.
+
+Tests: `crates/pdf/tests/writing.rs` (`writes_pages_metadata_and_selected_version_without_a_renderer`,
+`the_creation_date_is_the_modification_date_when_none_is_given`) and
+`crates/prepress/tests/flatten_document.rs`
+(`a_document_flattens_page_by_page_and_keeps_boxes_metadata_and_shared_fonts`).
diff --git a/vendor/krilla/SOURCE.json b/vendor/krilla/SOURCE.json
index ca911455..c802335c 100644
--- a/vendor/krilla/SOURCE.json
+++ b/vendor/krilla/SOURCE.json
@@ -72,17 +72,17 @@
     {
       "path": "src/chunk_container.rs",
       "upstream_sha256": "7317162f659d7c756ee170146d360e2c757cef953dc5a2a62f32daea90fc0c3f",
-      "sha256": "7317162f659d7c756ee170146d360e2c757cef953dc5a2a62f32daea90fc0c3f"
+      "sha256": "b6ddeb3cb612feedb9b4b869a421bb3f9a56a8407f3294c3401485df65357af6"
     },
     {
       "path": "src/configure/PDF_A1.md",
       "upstream_sha256": "e6ea127125ec0984f3fcd57f9886fc960aa90c9f751dd59cd61fe9cbc2cdb903",
-      "sha256": "e6ea127125ec0984f3fcd57f9886fc960aa90c9f751dd59cd61fe9cbc2cdb903"
+      "sha256": "ce55787bf6f984552492f771d2dc500cb730038f9ba19355bb466c680384b54b"
     },
     {
       "path": "src/configure/PDF_A2.md",
       "upstream_sha256": "47c87d3b29aff6e87703ba6f6021a2cfa88b4faf7f2c35101719b8b9f1bb9705",
-      "sha256": "47c87d3b29aff6e87703ba6f6021a2cfa88b4faf7f2c35101719b8b9f1bb9705"
+      "sha256": "90799a209489944266918690a59c7053f8b14c880e9caf23069ed601c539855f"
     },
     {
       "path": "src/configure/PDF_A3.md",
@@ -92,12 +92,12 @@
     {
       "path": "src/configure/PDF_A4.md",
       "upstream_sha256": "27710cf95e6ef83714cfa372e09796c9ec0d5455ceb31c101a7dccfdd8ee1b5b",
-      "sha256": "27710cf95e6ef83714cfa372e09796c9ec0d5455ceb31c101a7dccfdd8ee1b5b"
+      "sha256": "2e68d89bfc0f3f020ee96da85a3b9c59f643d3fc3119e35798e5eaf90ea5254e"
     },
     {
       "path": "src/configure/PDF_UA1.md",
       "upstream_sha256": "f3932749a56db38eb302e05b59b6a18312b9eda2e473b2b6e99645a29d3dc670",
-      "sha256": "f3932749a56db38eb302e05b59b6a18312b9eda2e473b2b6e99645a29d3dc670"
+      "sha256": "64d0c64fd15e30c0d3b786d4ebd2928d219a529114e39d6c26e5680cdc8a1ea3"
     },
     {
       "path": "src/configure/README.md",
@@ -112,7 +112,7 @@
     {
       "path": "src/configure/validate.rs",
       "upstream_sha256": "7e2a0ac6d7ecaac1ed2158cdc9e94411c2499c98e541ffb471f2bb06d5069c33",
-      "sha256": "7e2a0ac6d7ecaac1ed2158cdc9e94411c2499c98e541ffb471f2bb06d5069c33"
+      "sha256": "3c281fc219faea71de989bdeb571c676596dd1050ec64113c10cf9a357ff0100"
     },
     {
       "path": "src/configure/version.rs",
@@ -122,7 +122,7 @@
     {
       "path": "src/content.rs",
       "upstream_sha256": "9e59b2c77b73b36caedacfe80894d1cce7fd6fe6f7438ea24fda2019391a980c",
-      "sha256": "9e59b2c77b73b36caedacfe80894d1cce7fd6fe6f7438ea24fda2019391a980c"
+      "sha256": "e477e77d7209bc837b045f448b502fcce81047d91b8b27ab49e26a9410e74322"
     },
     {
       "path": "src/data.rs",
@@ -137,7 +137,7 @@
     {
       "path": "src/error.rs",
       "upstream_sha256": "656b260bd99d250535099f17f2db8e6e6135e72c74fb6dff304371db9f646be5",
-      "sha256": "340791663a19e56a421968aaab1e127b69fdf7e3b91647e2807efb88c393f376"
+      "sha256": "8d06efd85136668d1a491f2f04ba2d69e82347a89f275d9299998445f28172ac"
     },
     {
       "path": "src/geom.rs",
@@ -147,12 +147,17 @@
     {
       "path": "src/graphics/blend.rs",
       "upstream_sha256": "f2629743d9e2ea1440763231f3d4cc914224ca238d88fa0630b7c7e9628b58dd",
-      "sha256": "f2629743d9e2ea1440763231f3d4cc914224ca238d88fa0630b7c7e9628b58dd"
+      "sha256": "a3a014d76a379d378dd6893b3e41688ba2ebd358c1295ed0532a443a143fb5ab"
     },
     {
       "path": "src/graphics/color.rs",
       "upstream_sha256": "e5843d33ef184ab5c458025d1b1dc53df6ee6aaf085595ea14604d080b98f8a4",
-      "sha256": "e5843d33ef184ab5c458025d1b1dc53df6ee6aaf085595ea14604d080b98f8a4"
+      "sha256": "553c2c1ce7a7c26dc11a227d70db0e30933e0b0e69d2d6c550e1384c0a3037ec"
+    },
+    {
+      "path": "src/graphics/device_n.rs",
+      "upstream_sha256": null,
+      "sha256": "02f4d1ad8d5e72ddcf633c8d9255632386bd73f19aacf84941746409e0823bed"
     },
     {
       "path": "src/graphics/graphic.rs",
@@ -162,7 +167,7 @@
     {
       "path": "src/graphics/graphics_state.rs",
       "upstream_sha256": "77537e134e8d2ed3602730d2b3637421e9dbc6ac615085d45c680b1e6d5eb5bb",
-      "sha256": "77537e134e8d2ed3602730d2b3637421e9dbc6ac615085d45c680b1e6d5eb5bb"
+      "sha256": "3c6f9217437995c180633a506c22e902b5f664f4221cbae76ad91a36306f9ae3"
     },
     {
       "path": "src/graphics/icc.rs",
@@ -172,22 +177,27 @@
     {
       "path": "src/graphics/image.rs",
       "upstream_sha256": "61324d6426ac79aa5322d0d33a95532934cd1e41797a9dad6302210a2b799d5d",
-      "sha256": "25fb30fc591e180f8ab4a6445cbda0d14f1cfc7860c4699b444c3fbaab97bd69"
+      "sha256": "d4f857d6fbf46bcc71ff392a5f6919380d57625128f751eabb8860d4ad3053ed"
     },
     {
       "path": "src/graphics/mask.rs",
       "upstream_sha256": "d1dbc7d4d28388ee43c43294bfcbeec79136a65ac2816bdaf19eac4b88669661",
-      "sha256": "d1dbc7d4d28388ee43c43294bfcbeec79136a65ac2816bdaf19eac4b88669661"
+      "sha256": "e8cbcd90dea39129a01ab136219b5d169906aecaa232333852f540e75233b29c"
     },
     {
       "path": "src/graphics/mod.rs",
       "upstream_sha256": "9f82d56c24f2fd51736e68b9c182cae90617816d00e814102f45996705b13224",
-      "sha256": "9f82d56c24f2fd51736e68b9c182cae90617816d00e814102f45996705b13224"
+      "sha256": "19fc4fc3476ef3882b9ff9d654f12ee5313d4d6a5fddeeb6ceccdc176a15f6db"
+    },
+    {
+      "path": "src/graphics/optional_content.rs",
+      "upstream_sha256": null,
+      "sha256": "6ac9d9276434a8e6189dc8947a557303feea15353588b86ee09b4e97cadeddc5"
     },
     {
       "path": "src/graphics/paint.rs",
       "upstream_sha256": "c3de4b7056f3f952009f39f0e0d0311bc9af54807660f9e46f67c177572edf45",
-      "sha256": "c3de4b7056f3f952009f39f0e0d0311bc9af54807660f9e46f67c177572edf45"
+      "sha256": "4154beecc810f3d609d2c46ce82ec63b3421c199f01d922f28b9ed9fa4c7a1e5"
     },
     {
       "path": "src/graphics/separation.rs",
@@ -197,7 +207,7 @@
     {
       "path": "src/graphics/shading_function.rs",
       "upstream_sha256": "0e0fc8bb1a32272457ef560fa80933972d0f5ef5fb7046424c6de48093cfd978",
-      "sha256": "0e0fc8bb1a32272457ef560fa80933972d0f5ef5fb7046424c6de48093cfd978"
+      "sha256": "2831ec0d78a755db9311a16d01afd5c9f714e4d43bdf69b42c0cb291387ca743"
     },
     {
       "path": "src/graphics/shading_pattern.rs",
@@ -207,12 +217,12 @@
     {
       "path": "src/graphics/tiling_pattern.rs",
       "upstream_sha256": "e38ed5243b4b3d2d4fc23c623c6de9c7b813cceb580ec1ea4d0a5b449433d2f6",
-      "sha256": "e38ed5243b4b3d2d4fc23c623c6de9c7b813cceb580ec1ea4d0a5b449433d2f6"
+      "sha256": "5d5a8b2da66d7e5815bc5cd5cf9d8393380a5e527b62f5fc1cb3b4a0369f2656"
     },
     {
       "path": "src/graphics/xobject.rs",
       "upstream_sha256": "4f6db246a626d39367660e1b089bc83a828fe97ba6e69d5527bbede876ae4a66",
-      "sha256": "4f6db246a626d39367660e1b089bc83a828fe97ba6e69d5527bbede876ae4a66"
+      "sha256": "854386d221196f0361b07ef09b9cbbdc0749550a67b96a9711463f7988631ba2"
     },
     {
       "path": "src/interactive/action.rs",
@@ -222,12 +232,12 @@
     {
       "path": "src/interactive/annotation.rs",
       "upstream_sha256": "45b01acfef124a5ab9b6799ab4c83734f929b3573fdb28c218b108e220afad39",
-      "sha256": "45b01acfef124a5ab9b6799ab4c83734f929b3573fdb28c218b108e220afad39"
+      "sha256": "50f2a4bdc99d82bda275533e3a269eca6e7ae3ecb68b781203160122c744e55e"
     },
     {
       "path": "src/interactive/destination.rs",
       "upstream_sha256": "fbe7ce81ce195dbc86502e8555268c026a7c795cfe8a94a975e23cab16b657c3",
-      "sha256": "fbe7ce81ce195dbc86502e8555268c026a7c795cfe8a94a975e23cab16b657c3"
+      "sha256": "3043468f3caafe0fd0d3cac6cdd6bafe5ccbd89c4c3a5817ce505d5fe9403c36"
     },
     {
       "path": "src/interactive/mod.rs",
@@ -242,7 +252,7 @@
     {
       "path": "src/interchange/metadata.rs",
       "upstream_sha256": "14fab986f2436a4275e7cca13e065763b14b938ae180632294455ad0199380ec",
-      "sha256": "14fab986f2436a4275e7cca13e065763b14b938ae180632294455ad0199380ec"
+      "sha256": "7c8a66d89eba13a150295837ef5042d1909cc2901be1433b776597c557345d1f"
     },
     {
       "path": "src/interchange/mod.rs",
@@ -282,7 +292,7 @@
     {
       "path": "src/lib.rs",
       "upstream_sha256": "7533b14f1cef6749c961a7c1ba95d3274d6584e60febfccc03b9d63b4dc2abeb",
-      "sha256": "8da1abd3331575d5d67ce276aabc492ad00fbb3bfa5901867c0ab78e230751d9"
+      "sha256": "7263cddc8304d24b018e9552f5764358ad642198d4e79d75df568ceee213a9be"
     },
     {
       "path": "src/num.rs",
@@ -292,22 +302,22 @@
     {
       "path": "src/page.rs",
       "upstream_sha256": "ef85a771013896b185c9393414175ee91e5541c9a3fad4760c161764088ac177",
-      "sha256": "9684b5e0256c212be77b992687cb3774030f8e7c0c49a26ad520f5c81a1b8532"
+      "sha256": "9822a623229000c1017d636867971a9f7aa3a4cc3094ba3057786ee146ee3dcd"
     },
     {
       "path": "src/pdf.rs",
       "upstream_sha256": "de10d523ecf07ec9c9d17a17f5616786cb179168d0356d8182ffcf047b473db1",
-      "sha256": "de10d523ecf07ec9c9d17a17f5616786cb179168d0356d8182ffcf047b473db1"
+      "sha256": "1118c950577aecabf1bdf6e4bdd892114488bbf96e0dd7475b7e273ff45459f7"
     },
     {
       "path": "src/resource.rs",
       "upstream_sha256": "56a062eb37e5da88a78a129c6391103caddf7a2c7ca9fcfdb577319412c97107",
-      "sha256": "56a062eb37e5da88a78a129c6391103caddf7a2c7ca9fcfdb577319412c97107"
+      "sha256": "6062e553b90733b66207d27f98383f7458cc72048596590dc5fbde487c3a9099"
     },
     {
       "path": "src/serialize.rs",
       "upstream_sha256": "4f2c439dbd20006eea112e056b2f1a5ba98a1ede9227a45f66a6df46fb1a07e8",
-      "sha256": "f0b1d921badbd8f2e8b006b39d3f6522f672fede176f512c6c0739f832872244"
+      "sha256": "031eb4ba074367da1da63ec924ae4e5b67fbbbeb66c8ceef7fafb373bc769af3"
     },
     {
       "path": "src/stream.rs",
@@ -317,7 +327,7 @@
     {
       "path": "src/surface.rs",
       "upstream_sha256": "94de0a0384fc69c9785c6595b3f2c7ed8319635c901b8dc12894e252ab3ef8da",
-      "sha256": "936dfeb978add9d4443658c209f2d72034583a7771179587d8135ab870ded905"
+      "sha256": "67e0f7db850084692132271364259fc42597f4a0f699ffad5d74c59834976040"
     },
     {
       "path": "src/text/cid.rs",
@@ -372,7 +382,7 @@
     {
       "path": "src/text/type3.rs",
       "upstream_sha256": "7ac9b8529369a55fa8e9eb2163909bac36212b057eec72710ea8b7a2455e9bd7",
-      "sha256": "7ac9b8529369a55fa8e9eb2163909bac36212b057eec72710ea8b7a2455e9bd7"
+      "sha256": "a20fd0e84f78228de02235b3cc87c51aadc67a4d8a381ebdd650b59ec479ebf2"
     },
     {
       "path": "src/util.rs",
diff --git a/vendor/krilla/patches/01-unwind-safe-drop.patch b/vendor/krilla/patches/01-unwind-safe-drop.patch
new file mode 100644
index 00000000..79618af9
--- /dev/null
+++ b/vendor/krilla/patches/01-unwind-safe-drop.patch
@@ -0,0 +1,134 @@
+diff -ruN a/src/document.rs b/src/document.rs
+--- a/src/document.rs
++++ b/src/document.rs
+@@ -16,7 +16,7 @@
+ 
+ use crate::chunk_container::ChunkContainer;
+ use crate::destination::NamedDestination;
+-use crate::error::KrillaResult;
++use crate::error::{KrillaError, KrillaResult};
+ use crate::interchange::embed::EmbeddedFile;
+ use crate::interchange::metadata::Metadata;
+ use crate::interchange::outline::Outline;
+@@ -141,6 +141,10 @@
+ 
+     /// Attempt to export the document to a PDF file.
+     pub fn finish(mut self) -> KrillaResult<Vec<u8>> {
++        if self.serializer_context.poisoned {
++            return Err(KrillaError::Poisoned);
++        }
++
+         // Write empty page if none has been created yet.
+         if self.serializer_context.page_infos().is_empty() {
+             self.start_page();
+diff -ruN a/src/error.rs b/src/error.rs
+--- a/src/error.rs
++++ b/src/error.rs
+@@ -22,6 +22,8 @@
+ /// An error in krilla.
+ #[derive(Debug, PartialEq, Eq, Clone)]
+ pub enum KrillaError {
++    /// A page or surface failed during cleanup; discard the complete document.
++    Poisoned,
+     /// An error while attempting to embed a font.
+     Font(Font, String),
+     /// A list of validation errors. Can only occur if you set the `validator` in
+@@ -59,6 +61,7 @@
+ impl Display for KrillaError {
+     fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+         match self {
++            KrillaError::Poisoned => f.write_str("document contains a failed page or surface"),
+             KrillaError::Font(_, message) => write!(f, "failed to embed font: {message}"),
+             KrillaError::Validation(errors) => {
+                 let count = errors.len();
+diff -ruN a/src/lib.rs b/src/lib.rs
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -177,3 +177,9 @@
+ pub use interactive::*;
+ pub use interchange::*;
+ pub use serialize::SerializeSettings;
++
++/// Identifies the local patch that discards unfinished page/surface state during unwind.
++pub const CRAFT_UNWIND_SAFE_DROP: bool = true;
++
++/// Identifies the patch that rejects serialization after failed page/surface cleanup.
++pub const CRAFT_UNWIND_POISONING: bool = true;
+diff -ruN a/src/page.rs b/src/page.rs
+--- a/src/page.rs
++++ b/src/page.rs
+@@ -277,6 +277,16 @@
+ 
+ impl Drop for Page<'_> {
+     fn drop(&mut self) {
++        // Keep the document poisoned if cleanup unwinds, including an invariant failure
++        // during an explicit finish. Successful cleanup preserves any earlier poison.
++        let poisoned = std::mem::replace(&mut self.sc.poisoned, true);
++        // A drawing panic can leave page state incomplete. Discard it while
++        // unwinding; finalization here could panic again and abort the process.
++        // The caller must discard the whole document after a caught panic.
++        if std::thread::panicking() {
++            return;
++        }
++
+         // Since we cannot take ownership in `drop`, just make use `mem::take` to pick
+         // what we need.
+         let annotations = std::mem::take(&mut self.annotations);
+@@ -296,6 +306,7 @@
+             self.page_index,
+         );
+         self.sc.register_page(page);
++        self.sc.poisoned = poisoned;
+     }
+ }
+ 
+diff -ruN a/src/serialize.rs b/src/serialize.rs
+--- a/src/serialize.rs
++++ b/src/serialize.rs
+@@ -240,6 +240,8 @@
+ /// - Annotations used in the document.
+ ///   etc.
+ pub(crate) struct SerializeContext {
++    /// An unfinished or failed page/surface must never serialize as a complete document.
++    pub(crate) poisoned: bool,
+     /// The ref of the page tree.
+     page_tree_ref: Ref,
+     /// PDF 2.0 namespaces.
+@@ -294,6 +296,7 @@
+         };
+ 
+         Self {
++            poisoned: false,
+             cached_mappings: HashMap::new(),
+             pdf2_ns,
+             global_objects: GlobalObjects::default(),
+diff -ruN a/src/surface.rs b/src/surface.rs
+--- a/src/surface.rs
++++ b/src/surface.rs
+@@ -610,6 +610,16 @@
+ 
+ impl Drop for Surface<'_> {
+     fn drop(&mut self) {
++        // Keep the document poisoned if cleanup unwinds, including an invariant failure
++        // during an explicit finish. Successful cleanup preserves any earlier poison.
++        let poisoned = std::mem::replace(&mut self.sc.poisoned, true);
++        // A drawing panic can leave surface state incomplete. Discard it while
++        // unwinding; finalization here could panic again and abort the process.
++        // The caller must discard the whole document after a caught panic.
++        if std::thread::panicking() {
++            return;
++        }
++
+         let root_builder = std::mem::replace(
+             &mut self.bd.root_builder,
+             ContentBuilder::new(Transform::identity(), false, self.sc),
+@@ -623,7 +633,8 @@
+         assert!(self.push_instructions.is_empty());
+         assert!(!root_builder.active_marked_content);
+ 
+-        (self.finish_fn)(root_builder.finish(self.sc), num_mcids)
++        (self.finish_fn)(root_builder.finish(self.sc), num_mcids);
++        self.sc.poisoned = poisoned;
+     }
+ }
+ 
diff --git a/vendor/krilla/patches/02-group-color-space.patch b/vendor/krilla/patches/02-group-color-space.patch
new file mode 100644
index 00000000..20349749
--- /dev/null
+++ b/vendor/krilla/patches/02-group-color-space.patch
@@ -0,0 +1,571 @@
+diff --git a/src/error.rs b/src/error.rs
+index 26cd767..1807ac3 100644
+--- a/src/error.rs
++++ b/src/error.rs
+@@ -24,6 +24,11 @@ pub type KrillaResult<T> = Result<T, KrillaError>;
+ pub enum KrillaError {
+     /// A page or surface failed during cleanup; discard the complete document.
+     Poisoned,
++    /// [`GroupColorSpace::Cmyk`] with `no_device_cs` needs a `cmyk_profile` for the group
++    /// color space.
++    ///
++    /// [`GroupColorSpace::Cmyk`]: crate::GroupColorSpace::Cmyk
++    MissingGroupCmykProfile,
+     /// An error while attempting to embed a font.
+     Font(Font, String),
+     /// A list of validation errors. Can only occur if you set the `validator` in
+@@ -62,6 +67,9 @@ impl Display for KrillaError {
+     fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+         match self {
+             KrillaError::Poisoned => f.write_str("document contains a failed page or surface"),
++            KrillaError::MissingGroupCmykProfile => {
++                f.write_str("a CMYK group color space with no_device_cs needs a CMYK profile")
++            }
+             KrillaError::Font(_, message) => write!(f, "failed to embed font: {message}"),
+             KrillaError::Validation(errors) => {
+                 let count = errors.len();
+diff --git a/src/graphics/graphics_state.rs b/src/graphics/graphics_state.rs
+index 918f059..9fc913c 100644
+--- a/src/graphics/graphics_state.rs
++++ b/src/graphics/graphics_state.rs
+@@ -122,6 +122,7 @@ impl Cacheable for ExtGState {
+         if let Some(nsa) = self.0.non_stroking_alpha {
+             if nsa != NormalizedF32::ONE {
+                 sc.register_validation_error(ValidationError::Transparency(sc.location));
++                sc.mark_transparent(root_ref);
+             }
+ 
+             ext_st.non_stroking_alpha(nsa.get());
+@@ -130,6 +131,7 @@ impl Cacheable for ExtGState {
+         if let Some(sa) = self.0.stroking_alpha {
+             if sa != NormalizedF32::ONE {
+                 sc.register_validation_error(ValidationError::Transparency(sc.location));
++                sc.mark_transparent(root_ref);
+             }
+ 
+             ext_st.stroking_alpha(sa.get());
+@@ -138,6 +140,7 @@ impl Cacheable for ExtGState {
+         if let Some(bm) = self.0.blend_mode {
+             if bm != BlendMode::Normal {
+                 sc.register_validation_error(ValidationError::Transparency(sc.location));
++                sc.mark_transparent(root_ref);
+             }
+ 
+             ext_st.blend_mode(bm);
+@@ -145,6 +148,7 @@ impl Cacheable for ExtGState {
+ 
+         if let Some(mask_ref) = self.0.mask {
+             sc.register_validation_error(ValidationError::Transparency(sc.location));
++            sc.mark_transparent(root_ref);
+ 
+             ext_st.pair(Name(b"SMask"), mask_ref);
+         }
+diff --git a/src/graphics/image.rs b/src/graphics/image.rs
+index 22a68ca..c911f06 100644
+--- a/src/graphics/image.rs
++++ b/src/graphics/image.rs
+@@ -365,6 +365,7 @@ impl Image {
+     ) {
+         let soft_mask_id = self.0.metadata.has_alpha.then(|| {
+             sc.register_validation_error(ValidationError::Transparency(sc.location));
++            sc.mark_transparent(root_ref);
+             sc.new_ref()
+         });
+ 
+diff --git a/src/graphics/mask.rs b/src/graphics/mask.rs
+index ffbb3de..9fc958e 100644
+--- a/src/graphics/mask.rs
++++ b/src/graphics/mask.rs
+@@ -5,10 +5,10 @@ use pdf_writer::{Finish, Name, Ref};
+ use crate::chunk_container::ChunkContainer;
+ use crate::geom::{Rect, Transform};
+ use crate::graphics::shading_function::{GradientProperties, ShadingFunction};
+-use crate::graphics::xobject::XObject;
++use crate::graphics::xobject::{GroupRole, XObject};
+ use crate::resource;
+ use crate::resource::Resourceable;
+-use crate::serialize::{Cacheable, SerializeContext};
++use crate::serialize::{Cacheable, GroupColorSpace, SerializeContext};
+ use crate::stream::Stream;
+ use crate::stream::StreamBuilder;
+ 
+@@ -108,9 +108,15 @@ impl Cacheable for Mask {
+         chunk_container: &mut ChunkContainer,
+         root_ref: Ref,
+     ) {
++        // Under RGB blending a mask source group is written like a content group, so
++        // keeping the content role there leaves object deduplication as it was.
++        let role = match sc.serialize_settings().group_color_space {
++            GroupColorSpace::Rgb => GroupRole::Content,
++            GroupColorSpace::Cmyk => GroupRole::MaskSource,
++        };
+         let x_object = sc.register_cacheable(
+             chunk_container,
+-            XObject::new(self.stream, false, true, self.custom_bbox),
++            XObject::with_role(self.stream, false, true, self.custom_bbox, role),
+         );
+ 
+         let chunk = &mut chunk_container.non_stream.masks;
+diff --git a/src/graphics/tiling_pattern.rs b/src/graphics/tiling_pattern.rs
+index e26f1d8..94e640e 100644
+--- a/src/graphics/tiling_pattern.rs
++++ b/src/graphics/tiling_pattern.rs
+@@ -85,6 +85,10 @@ impl Cacheable for TilingPattern {
+             sc.register_validation_error(validation_error);
+         }
+ 
++        if sc.uses_transparency(&self.stream.resource_dictionary) {
++            sc.mark_transparent(root_ref);
++        }
++
+         let pattern_stream = FilterStreamBuilder::new_from_content_stream(
+             &self.stream.content,
+             &sc.serialize_settings(),
+diff --git a/src/graphics/xobject.rs b/src/graphics/xobject.rs
+index 28d6f38..6c56b0e 100644
+--- a/src/graphics/xobject.rs
++++ b/src/graphics/xobject.rs
+@@ -1,24 +1,36 @@
+ use std::ops::DerefMut;
+ use std::sync::Arc;
+ 
++use pdf_writer::writers::Group;
+ use pdf_writer::{Finish, Name, Ref};
+ 
+ use crate::chunk_container::ChunkContainer;
+ use crate::configure::ValidationError;
+ use crate::geom::Rect;
+-use crate::graphics::color::{rgb, DEVICE_RGB};
++use crate::graphics::color::{rgb, DEVICE_CMYK, DEVICE_RGB};
+ use crate::resource;
+ use crate::resource::{Resource, Resourceable};
+-use crate::serialize::{Cacheable, MaybeDeviceColorSpace, SerializeContext};
++use crate::serialize::{Cacheable, GroupColorSpace, MaybeDeviceColorSpace, SerializeContext};
+ use crate::stream::{FilterStreamBuilder, Stream};
+ use crate::util::{NameExt, Prehashed};
+ 
++/// What a group XObject is used for, which decides its `/CS` under
++/// [`GroupColorSpace::Cmyk`].
++#[derive(Debug, Hash, Eq, PartialEq, Clone, Copy)]
++pub(crate) enum GroupRole {
++    /// Drawn in a page or another form: inherits the parent's blending space.
++    Content,
++    /// The `/G` of a soft mask: has no parent, so it names its blending space.
++    MaskSource,
++}
++
+ #[derive(Debug, Hash, Eq, PartialEq)]
+ struct Repr {
+     stream: Stream,
+     isolated: bool,
+     transparency_group_color_space: bool,
+     custom_bbox: Option<Rect>,
++    role: GroupRole,
+ }
+ 
+ #[derive(Debug, Hash, Clone, Eq, PartialEq)]
+@@ -26,10 +38,26 @@ pub(crate) struct XObject(Arc<Prehashed<Repr>>);
+ 
+ impl XObject {
+     pub(crate) fn new(
++        stream: Stream,
++        isolated: bool,
++        transparency_group_color_space: bool,
++        custom_bbox: Option<Rect>,
++    ) -> Self {
++        Self::with_role(
++            stream,
++            isolated,
++            transparency_group_color_space,
++            custom_bbox,
++            GroupRole::Content,
++        )
++    }
++
++    pub(crate) fn with_role(
+         stream: Stream,
+         isolated: bool,
+         mut transparency_group_color_space: bool,
+         custom_bbox: Option<Rect>,
++        role: GroupRole,
+     ) -> Self {
+         // In case a mask was invoked in the content stream, we _always_ create
+         // a new transparency group. Please see <https://github.com/typst/typst/issues/5509>.
+@@ -48,6 +76,7 @@ impl XObject {
+             isolated,
+             transparency_group_color_space,
+             custom_bbox,
++            role,
+         })))
+     }
+ 
+@@ -79,6 +108,10 @@ impl Cacheable for XObject {
+             sc.register_validation_error(ValidationError::Transparency(sc.location));
+         }
+ 
++        if use_transparency_group || sc.uses_transparency(&self.0.stream.resource_dictionary) {
++            sc.mark_transparent(root_ref);
++        }
++
+         let serialize_settings = sc.serialize_settings();
+ 
+         // "Ordinarily, the CS entry may be present only for isolated transparency groups (those
+@@ -88,13 +121,21 @@ impl Cacheable for XObject {
+         //
+         // So while we don't technically always need to write it, let's just play it save
+         // and always add a group color space in case we have a transparency group.
+-        let transparency_group_cs = if use_transparency_group {
+-            Some(sc.register_colorspace(
+-                chunk_container,
+-                rgb::color_space(serialize_settings.no_device_cs).into(),
+-            ))
+-        } else {
++        //
++        // Under `GroupColorSpace::Cmyk`, content groups inherit the CMYK page group instead.
++        let transparency_group_cs = if !use_transparency_group {
+             None
++        } else {
++            match (serialize_settings.group_color_space, self.0.role) {
++                (GroupColorSpace::Rgb, _) => Some(sc.register_colorspace(
++                    chunk_container,
++                    rgb::color_space(serialize_settings.no_device_cs).into(),
++                )),
++                (GroupColorSpace::Cmyk, GroupRole::Content) => None,
++                (GroupColorSpace::Cmyk, GroupRole::MaskSource) => {
++                    Some(sc.mask_group_color_space(chunk_container))
++                }
++            }
+         };
+ 
+         let x_object_stream = FilterStreamBuilder::new_from_content_stream(
+@@ -126,14 +167,7 @@ impl Cacheable for XObject {
+             }
+ 
+             if let Some(transparency_group_cs) = transparency_group_cs {
+-                let pdf_cs = transparency.insert(Name(b"CS"));
+-
+-                match transparency_group_cs {
+-                    MaybeDeviceColorSpace::DeviceRgb => pdf_cs.primitive(DEVICE_RGB.to_pdf_name()),
+-                    // Can only be SRGB
+-                    MaybeDeviceColorSpace::ColorSpace(cs) => pdf_cs.primitive(cs.get_ref()),
+-                    _ => unreachable!(),
+-                }
++                write_group_color_space(transparency, transparency_group_cs);
+             }
+ 
+             transparency.finish();
+@@ -145,6 +179,18 @@ impl Cacheable for XObject {
+     }
+ }
+ 
++/// Write the `/CS` of a transparency group: DeviceRGB, DeviceCMYK, sRGB or the CMYK profile.
++pub(crate) fn write_group_color_space(group: &mut Group<'_>, cs: MaybeDeviceColorSpace) {
++    let pdf_cs = group.insert(Name(b"CS"));
++
++    match cs {
++        MaybeDeviceColorSpace::DeviceRgb => pdf_cs.primitive(DEVICE_RGB.to_pdf_name()),
++        MaybeDeviceColorSpace::DeviceCMYK => pdf_cs.primitive(DEVICE_CMYK.to_pdf_name()),
++        MaybeDeviceColorSpace::ColorSpace(cs) => pdf_cs.primitive(cs.get_ref()),
++        _ => unreachable!(),
++    }
++}
++
+ impl Resourceable for XObject {
+     type Resource = resource::XObject;
+ }
+diff --git a/src/lib.rs b/src/lib.rs
+index efbe6f8..b331053 100644
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -176,7 +176,7 @@ pub use document::*;
+ pub use graphics::*;
+ pub use interactive::*;
+ pub use interchange::*;
+-pub use serialize::SerializeSettings;
++pub use serialize::{GroupColorSpace, SerializeSettings};
+ 
+ /// Identifies the local patch that discards unfinished page/surface state during unwind.
+ pub const CRAFT_UNWIND_SAFE_DROP: bool = true;
+diff --git a/src/page.rs b/src/page.rs
+index ed6b1e2..3b3227b 100644
+--- a/src/page.rs
++++ b/src/page.rs
+@@ -14,10 +14,11 @@ use crate::configure::ValidationError;
+ use crate::content::ContentBuilder;
+ use crate::error::KrillaResult;
+ use crate::geom::{Rect, Size, Transform};
++use crate::graphics::xobject::write_group_color_space;
+ use crate::interactive::annotation::Annotation;
+ use crate::interchange::tagging::{Identifier, PageTagIdentifier};
+ use crate::resource::ResourceDictionary;
+-use crate::serialize::{PageInfo, SerializeContext};
++use crate::serialize::{GroupColorSpace, PageInfo, SerializeContext};
+ use crate::stream::{FilterStreamBuilder, Stream};
+ use crate::surface::Surface;
+ use crate::tagging::AnnotationIdentifier;
+@@ -412,8 +413,20 @@ impl InternalPage {
+             }
+         }
+ 
++        // Under CMYK blending, a page that blends gets a page group naming the space its
++        // content groups inherit. Opaque pages stay without one (PDF/X-1a and X-3).
++        let page_group_cs = (sc.serialize_settings().group_color_space == GroupColorSpace::Cmyk
++            && sc.uses_transparency(&self.stream_resources))
++        .then(|| sc.cmyk_group_color_space(chunk_container));
++
+         let chunk = &mut chunk_container.non_stream.pages;
+         let mut page = chunk.page(root_ref);
++        if let Some(cs) = page_group_cs {
++            let mut group = page.group();
++            group.transparency();
++            write_group_color_space(&mut group, cs);
++            group.finish();
++        }
+         self.stream_resources.to_pdf_resources(
+             &mut page,
+             sc,
+diff --git a/src/pdf.rs b/src/pdf.rs
+index bbdae8e..b2666a7 100644
+--- a/src/pdf.rs
++++ b/src/pdf.rs
+@@ -18,7 +18,7 @@ use crate::configure::{PdfVersion, ValidationError};
+ use crate::error::{KrillaError, KrillaResult};
+ use crate::graphics::color::rgb;
+ use crate::resource::Resource;
+-use crate::serialize::{MaybeDeviceColorSpace, SerializeContext};
++use crate::serialize::{GroupColorSpace, MaybeDeviceColorSpace, SerializeContext};
+ use crate::surface::Location;
+ use crate::util::{Deferred, Prehashed};
+ 
+@@ -179,10 +179,16 @@ impl PdfSerializerContext {
+             // but we just always allocate it if we have at least one PDF,
+             // regardless of how the files are embedded. We can change this in the
+             // future, but it keeps the code simpler.
+-            let xobject_group_color_space = sc.register_colorspace(
+-                chunk_container,
+-                rgb::color_space(sc.serialize_settings().no_device_cs).into(),
+-            );
++            //
++            // Under CMYK blending the group writes no `/CS` and inherits the page group,
++            // so no color space is registered.
++            let xobject_group_color_space = match sc.serialize_settings().group_color_space {
++                GroupColorSpace::Rgb => Some(sc.register_colorspace(
++                    chunk_container,
++                    rgb::color_space(sc.serialize_settings().no_device_cs).into(),
++                )),
++                GroupColorSpace::Cmyk => None,
++            };
+             let chunk_settings = sc.chunk_settings();
+ 
+             let deferred_chunk = Deferred::new(move || {
+@@ -197,11 +203,11 @@ impl PdfSerializerContext {
+                 // krilla PDF, we replace `local_ref` with `cs_ref` such that it
+                 // actually points to the colorspace that is embedded in the full PDF.
+                 let (assigned_cs_ref, should_cs_ref) = match &xobject_group_color_space {
+-                    MaybeDeviceColorSpace::DeviceRgb => (None, None),
+-                    MaybeDeviceColorSpace::ColorSpace(cs) => {
++                    None | Some(MaybeDeviceColorSpace::DeviceRgb) => (None, None),
++                    Some(MaybeDeviceColorSpace::ColorSpace(cs)) => {
+                         (Some(new_ref.bump()), Some(cs.get_ref()))
+                     }
+-                    MaybeDeviceColorSpace::DeviceGray | MaybeDeviceColorSpace::DeviceCMYK => {
++                    Some(MaybeDeviceColorSpace::DeviceGray | MaybeDeviceColorSpace::DeviceCMYK) => {
+                         unreachable!()
+                     }
+                 };
+@@ -224,7 +230,9 @@ impl PdfSerializerContext {
+                     Box::new(|| new_ref.bump()),
+                     chunk_settings,
+                     |group| {
+-                        if let Some(local_group_color_space_ref) = assigned_cs_ref {
++                        if xobject_group_color_space.is_none() {
++                            // Inherit the blending space of the page group.
++                        } else if let Some(local_group_color_space_ref) = assigned_cs_ref {
+                             group
+                                 .insert(Name(b"CS"))
+                                 .primitive(local_group_color_space_ref);
+diff --git a/src/resource.rs b/src/resource.rs
+index 5ad0585..56b8488 100644
+--- a/src/resource.rs
++++ b/src/resource.rs
+@@ -326,6 +326,10 @@ where
+         format!("{}{}", T::get_prefix(), num)
+     }
+ 
++    pub(crate) fn refs(&self) -> impl Iterator<Item = Ref> + '_ {
++        self.entries.iter().copied()
++    }
++
+     pub(crate) fn get_entries(&self) -> impl Iterator<Item = (String, Ref)> + '_ {
+         self.entries
+             .iter()
+diff --git a/src/serialize.rs b/src/serialize.rs
+index d79ce28..58c0090 100644
+--- a/src/serialize.rs
++++ b/src/serialize.rs
+@@ -16,7 +16,7 @@ use crate::configure::validate::ValidationStore;
+ use crate::configure::{Configuration, PdfVersion, ValidationError, Validators};
+ use crate::error::{KrillaError, KrillaResult, LimitError};
+ use crate::geom::Size;
+-use crate::graphics::color::{rgb, ColorSpace};
++use crate::graphics::color::{cmyk, luma, rgb, ColorSpace};
+ use crate::graphics::icc::{ICCBasedColorSpace, ICCProfile};
+ #[cfg(feature = "raster-images")]
+ use crate::graphics::image::Image;
+@@ -29,7 +29,7 @@ use crate::page::{InternalPage, PageLabel, PageLabelContainer};
+ #[cfg(feature = "pdf")]
+ use crate::pdf::{PdfDocument, PdfSerializerContext};
+ use crate::resource;
+-use crate::resource::{Resource, Resourceable};
++use crate::resource::{Resource, ResourceDictionary, Resourceable};
+ use crate::surface::{Location, Surface};
+ use crate::text::GlyphId;
+ use crate::text::{Font, FontContainer, FontIdentifier};
+@@ -116,6 +116,30 @@ pub struct SerializeSettings {
+     /// just use the default function which doesn't render them at all. If you do want this, it
+     /// is recommended that you use the function provided by the `krilla-svg` crate.
+     pub render_svg_glyph_fn: RenderSvgGlyphFn,
++    /// The color space in which transparency is blended.
++    ///
++    /// See [`GroupColorSpace`].
++    pub group_color_space: GroupColorSpace,
++}
++
++/// The color space in which transparency groups blend.
++#[derive(Clone, Copy, Debug, Default, Hash, PartialEq, Eq)]
++pub enum GroupColorSpace {
++    /// Every transparency group gets an RGB `/CS` (DeviceRGB, or sRGB when
++    /// `no_device_cs` is set). Pages get no `/Group`. Suits screen output.
++    #[default]
++    Rgb,
++    /// Pages that use transparency get a page group with a CMYK `/CS`: DeviceCMYK, or the
++    /// [`SerializeSettings::cmyk_profile`] when `no_device_cs` is set. Content groups and
++    /// embedded PDF pages write no `/CS` and inherit it. Soft-mask groups, which have no
++    /// parent, name DeviceCMYK, or sGrey when `no_device_cs` is set. Pages without
++    /// transparency get no page group.
++    ///
++    /// With `no_device_cs` and no `cmyk_profile`, [`Document::finish`] fails with
++    /// [`KrillaError::MissingGroupCmykProfile`].
++    ///
++    /// [`Document::finish`]: crate::Document::finish
++    Cmyk,
+ }
+ 
+ pub type RenderSvgGlyphFn = fn(&[u8], rgb::Color, GlyphId, (f32, f32), &mut Surface) -> Option<()>;
+@@ -148,6 +172,7 @@ impl Default for SerializeSettings {
+             configuration: Configuration::default(),
+             enable_tagging: true,
+             render_svg_glyph_fn: |_, _, _, _, _| None,
++            group_color_space: GroupColorSpace::Rgb,
+         }
+     }
+ }
+@@ -275,6 +300,11 @@ pub(crate) struct SerializeContext {
+     validation_store: ValidationStore,
+     /// The current location, if set.
+     pub(crate) location: Option<Location>,
++    /// Objects whose use makes a page blend: transparent graphics states, groups, images
++    /// with alpha, and forms, patterns and Type 3 fonts that use any of these. Decides
++    /// which pages get a page group under [`GroupColorSpace::Cmyk`]. Cached objects are
++    /// serialized once, so this is tracked by reference instead of by location.
++    transparent_refs: HashSet<Ref>,
+ }
+ 
+ impl SerializeContext {
+@@ -309,6 +339,50 @@ impl SerializeContext {
+             chunk_settings,
+             limits: Limits::new(),
+             validation_store: ValidationStore::new(),
++            transparent_refs: HashSet::new(),
++        }
++    }
++
++    /// Record that drawing `object` involves transparency.
++    pub(crate) fn mark_transparent(&mut self, object: Ref) {
++        self.transparent_refs.insert(object);
++    }
++
++    /// Whether content using `resources` involves transparency.
++    pub(crate) fn uses_transparency(&self, resources: &ResourceDictionary) -> bool {
++        resources
++            .ext_g_states
++            .refs()
++            .chain(resources.x_objects.refs())
++            .chain(resources.patterns.refs())
++            .chain(resources.fonts.refs())
++            .any(|r| self.transparent_refs.contains(&r))
++    }
++
++    /// The CMYK blending color space for page groups under [`GroupColorSpace::Cmyk`]. Falls back to DeviceCMYK when `no_device_cs` is set
++    /// without a CMYK profile; `finish` rejects that configuration.
++    pub(crate) fn cmyk_group_color_space(
++        &mut self,
++        chunk_container: &mut ChunkContainer,
++    ) -> MaybeDeviceColorSpace {
++        let cs = cmyk::color_space(&self.serialize_settings)
++            .unwrap_or_else(|| DeviceColorSpace::Cmyk.into());
++        self.register_colorspace(chunk_container, cs.into())
++    }
++
++    /// The blending color space of soft-mask groups under [`GroupColorSpace::Cmyk`]:
++    /// DeviceCMYK, or sGrey when `no_device_cs` is set. A mask group has no parent, so it
++    /// need not match the page group. An ICC CMYK mask group would give the default black
++    /// backdrop a luminosity above 0, because 100% black through a CMYK profile is not black,
++    /// and the masked object would show where the mask content paints nothing.
++    pub(crate) fn mask_group_color_space(
++        &mut self,
++        chunk_container: &mut ChunkContainer,
++    ) -> MaybeDeviceColorSpace {
++        if self.serialize_settings.no_device_cs {
++            self.register_colorspace(chunk_container, luma::color_space(true).into())
++        } else {
++            self.cmyk_group_color_space(chunk_container)
+         }
+     }
+ 
+@@ -428,9 +502,13 @@ impl SerializeContext {
+         let xobj_ref = self.new_ref();
+ 
+         // Note that `add_xobject` might return a different ref than the one we created.
+-        self.global_objects
+-            .pdf_ctx
+-            .add_xobject(pdf, page_idx, xobj_ref, self.location)
++        let xobj_ref =
++            self.global_objects
++                .pdf_ctx
++                .add_xobject(pdf, page_idx, xobj_ref, self.location);
++        // Embedded pages are always drawn as isolated transparency groups.
++        self.mark_transparent(xobj_ref);
++        xobj_ref
+     }
+ 
+     pub(crate) fn page_tree_ref(&mut self) -> Ref {
+@@ -450,6 +528,14 @@ impl SerializeContext {
+     }
+ 
+     pub(crate) fn finish(mut self, mut chunk_container: ChunkContainer) -> KrillaResult<Pdf> {
++        let settings = &self.serialize_settings;
++        if settings.group_color_space == GroupColorSpace::Cmyk
++            && settings.no_device_cs
++            && settings.cmyk_profile.is_none()
++        {
++            return Err(KrillaError::MissingGroupCmykProfile);
++        }
++
+         // We need to be careful here that we serialize the objects in the right order,
+         // as in some cases we use MaybeTake::take to remove an object, which means that
+         // no object that is serialized afterwards must depend on it.
+diff --git a/src/text/type3.rs b/src/text/type3.rs
+index 1ba149c..9d43bd6 100644
+--- a/src/text/type3.rs
++++ b/src/text/type3.rs
+@@ -212,6 +212,9 @@ impl Type3Font {
+             .collect::<Vec<Ref>>();
+ 
+         let resource_dictionary = rd_builder.finish();
++        if sc.uses_transparency(&resource_dictionary) {
++            sc.mark_transparent(root_ref);
++        }
+         let chunk = &mut chunk_container.non_stream.fonts;
+ 
+         let descriptor_ref = if sc.serialize_settings().pdf_version() >= PdfVersion::Pdf15 {
diff --git a/vendor/krilla/patches/03-overprint.patch b/vendor/krilla/patches/03-overprint.patch
new file mode 100644
index 00000000..6427b150
--- /dev/null
+++ b/vendor/krilla/patches/03-overprint.patch
@@ -0,0 +1,312 @@
+diff --git a/src/configure/PDF_A2.md b/src/configure/PDF_A2.md
+index a4e4377..9609ea2 100644
+--- a/src/configure/PDF_A2.md
++++ b/src/configure/PDF_A2.md
+@@ -67,7 +67,8 @@ in case CMYK is used but no profile was provided, export fails.
+ 
+ 6.2.4.2: 
+ - sRGB/sGrey ICC profiles conform to ICC v4 specification. 🟢
+-- krilla does not support overprinting. 🔵
++- krilla fails export if overprint mode 1 is combined with fill or stroke overprint, since
++  all CMYK is ICCBased in this mode. 🟢
+ 
+ 6.2.4.3: 
+ - krilla always uses sRGB for RGB, and in addition also embeds an sRGB output intent. 🟢
+diff --git a/src/configure/PDF_A4.md b/src/configure/PDF_A4.md
+index 44a294f..d5e4374 100644
+--- a/src/configure/PDF_A4.md
++++ b/src/configure/PDF_A4.md
+@@ -66,7 +66,8 @@ See `README.md` for the meaning of each color.
+ ### 6.2.4 Colour spaces
+ - krilla only uses device-independent colors in this export mode. 🟢 
+ - krilla uses compatible ICC profiles. 🟢
+-- krilla does not use the OPM entry. 🟢
++- krilla fails export if overprint mode 1 is combined with fill or stroke overprint, since
++  all CMYK is ICCBased in this mode. 🟢
+ - krilla never uses CMYK profiles as the destination profile. 🟢
+ - krilla does not use device color spaces in this mode. 🟢
+ - krilla ensures the Alternate space in Separation color spaces obeys the restrictions
+diff --git a/src/configure/validate.rs b/src/configure/validate.rs
+index e92da05..91996ee 100644
+--- a/src/configure/validate.rs
++++ b/src/configure/validate.rs
+@@ -131,6 +131,16 @@ pub enum ValidationError {
+     Transparency(Option<Location>),
+     /// The PDF contains an image with `interpolate` set to `true`.
+     ImageInterpolation(Option<Location>),
++    /// Overprint mode 1 (`/OPM 1`) was combined with fill or stroke overprint while CMYK
++    /// colors are ICCBased.
++    ///
++    /// PDF/A-2 and later forbid overprint mode 1 when an ICCBased CMYK color space is used
++    /// for a side that overprints. Validated export always writes CMYK as ICCBased, so any
++    /// [`Overprint`] with `nonzero` and `fill` or `stroke` set triggers it; use
++    /// `nonzero: false` there.
++    ///
++    /// [`Overprint`]: crate::blend::Overprint
++    OverprintModeIccCmyk(Option<Location>),
+     /// The PDF contains an embedded file.
+     EmbeddedFile(EmbedError, Option<Location>),
+     /// The PDF contains no tagging.
+@@ -554,6 +564,7 @@ impl Archival {
+             (
+                 Self::A1_A | Self::A1_B,
+                 ValidationError::InconsistentSeparationFallback(_)
++                | ValidationError::OverprintModeIccCmyk(_)
+                 | ValidationError::InvalidCodepointMapping(_, _, _, _)
+                 | ValidationError::UnicodePrivateArea(_, _, _, _)
+                 | ValidationError::NoDocumentTitle
+@@ -592,6 +603,7 @@ impl Archival {
+                 | ValidationError::RestrictedLicense(_)
+                 | ValidationError::MissingDocumentDate
+                 | ValidationError::ImageInterpolation(_)
++                | ValidationError::OverprintModeIccCmyk(_)
+                 | ValidationError::EmbeddedPDF(_),
+             ) => true,
+             // Allowed under all PDF/A-2 and PDF/A-3 profiles.
+@@ -656,6 +668,7 @@ impl Archival {
+                 | ValidationError::RestrictedLicense(_)
+                 | ValidationError::MissingDocumentDate
+                 | ValidationError::ImageInterpolation(_)
++                | ValidationError::OverprintModeIccCmyk(_)
+                 | ValidationError::EmbeddedPDF(_),
+             ) => true,
+             // Allowed under all PDF/A-4 profiles.
+@@ -1130,6 +1143,7 @@ impl Accessibility {
+                 | ValidationError::NoDocumentLanguage
+                 | ValidationError::Transparency(_)
+                 | ValidationError::ImageInterpolation(_)
++                | ValidationError::OverprintModeIccCmyk(_)
+                 | ValidationError::EmbeddedFile(
+                     EmbedError::Existence | EmbedError::MissingDate | EmbedError::MissingMimeType,
+                     _,
+diff --git a/src/content.rs b/src/content.rs
+index dd5b1cb..751cb2f 100644
+--- a/src/content.rs
++++ b/src/content.rs
+@@ -16,6 +16,7 @@ use crate::configure::ValidationError;
+ #[cfg(feature = "raster-images")]
+ use crate::geom::Size;
+ use crate::geom::{Point, Rect, Transform};
++use crate::graphics::blend::Overprint;
+ use crate::graphics::color::{Color, ColorSpace};
+ use crate::graphics::graphics_state::{ExtGState, GraphicsStates};
+ #[cfg(feature = "raster-images")]
+@@ -183,6 +184,12 @@ impl ContentBuilder {
+         }
+     }
+ 
++    pub(crate) fn set_overprint(&mut self, overprint: Overprint) {
++        let state =
++            ExtGState::new().overprint(overprint.fill, overprint.stroke, overprint.to_pdf_mode());
++        self.graphics_states.combine(&state);
++    }
++
+     pub(crate) fn expand_bbox(&mut self, new_bbox: Rect) {
+         let new_bbox = self.graphics_states.transform_bbox(new_bbox);
+         if let Some(bbox) = &mut self.bbox {
+diff --git a/src/graphics/blend.rs b/src/graphics/blend.rs
+index 9d0e98d..8d7c5c7 100644
+--- a/src/graphics/blend.rs
++++ b/src/graphics/blend.rs
+@@ -1,4 +1,4 @@
+-//! Blending.
++//! Blending and overprint.
+ 
+ /// How to blend source and backdrop.
+ #[derive(Debug, Copy, Clone, Eq, PartialEq, Hash)]
+@@ -44,3 +44,38 @@ impl BlendMode {
+         }
+     }
+ }
++
++/// Overprint settings for the graphics state (`/op`, `/OP`, `/OPM`).
++///
++/// With overprint on, painting in one colorant leaves the other colorants of the backdrop
++/// in place on separated output instead of knocking them out. Viewers that don't simulate
++/// overprint ignore it.
++#[derive(Debug, Copy, Clone, Default, Eq, PartialEq, Hash)]
++pub struct Overprint {
++    /// Overprint for fills, including filled text (`/op`).
++    pub fill: bool,
++    /// Overprint for strokes, including stroked text (`/OP`).
++    pub stroke: bool,
++    /// Nonzero overprint mode (`/OPM 1`): a DeviceCMYK component of 0 leaves that
++    /// colorant of the backdrop unchanged. With `false` (`/OPM 0`), every DeviceCMYK
++    /// component paints, zero included.
++    ///
++    /// ISO 32000-1 (8.6.7) applies the mode to DeviceCMYK only. With
++    /// [`SerializeSettings::no_device_cs`] all CMYK is ICCBased, so a PDF 1.7 reader paints
++    /// zero components as with `false`, and PDF/A-2 and later reject the combination
++    /// ([`ValidationError::OverprintModeIccCmyk`]).
++    ///
++    /// [`SerializeSettings::no_device_cs`]: crate::SerializeSettings::no_device_cs
++    /// [`ValidationError::OverprintModeIccCmyk`]: crate::configure::ValidationError::OverprintModeIccCmyk
++    pub nonzero: bool,
++}
++
++impl Overprint {
++    pub(crate) fn to_pdf_mode(self) -> pdf_writer::types::OverprintMode {
++        if self.nonzero {
++            pdf_writer::types::OverprintMode::IgnoreZeroChannel
++        } else {
++            pdf_writer::types::OverprintMode::OverrideAllColorants
++        }
++    }
++}
+diff --git a/src/graphics/graphics_state.rs b/src/graphics/graphics_state.rs
+index 9fc913c..93f3e25 100644
+--- a/src/graphics/graphics_state.rs
++++ b/src/graphics/graphics_state.rs
+@@ -1,7 +1,7 @@
+ use std::hash::Hash;
+ use std::sync::Arc;
+ 
+-use pdf_writer::types::BlendMode;
++use pdf_writer::types::{BlendMode, OverprintMode};
+ use pdf_writer::{Finish, Name, Ref};
+ 
+ use crate::chunk_container::ChunkContainer;
+@@ -24,6 +24,12 @@ struct Repr {
+     blend_mode: Option<BlendMode>,
+     /// An active mask.
+     mask: Option<Ref>,
++    /// Fill overprint (`/op`).
++    overprint_fill: Option<bool>,
++    /// Stroke overprint (`/OP`).
++    overprint_stroke: Option<bool>,
++    /// Overprint mode (`/OPM`).
++    overprint_mode: Option<OverprintMode>,
+ }
+ 
+ /// A graphics state containing information about
+@@ -31,6 +37,7 @@ struct Repr {
+ /// - The current non-stroking alpha.
+ /// - The current blend mode.
+ /// - The current mask.
++/// - The current overprint settings.
+ ///
+ /// This struct provides exposes a builder pattern for setting the various properties
+ /// individually.
+@@ -66,6 +73,16 @@ impl ExtGState {
+         self
+     }
+ 
++    /// Create a new graphics state with fill and stroke overprint and an overprint mode.
++    #[must_use]
++    pub(crate) fn overprint(mut self, fill: bool, stroke: bool, mode: OverprintMode) -> Self {
++        let repr = Arc::make_mut(&mut self.0);
++        repr.overprint_fill = Some(fill);
++        repr.overprint_stroke = Some(stroke);
++        repr.overprint_mode = Some(mode);
++        self
++    }
++
+     /// Create a new graphics state with a mask.
+     #[must_use]
+     pub(crate) fn mask(
+@@ -85,6 +102,9 @@ impl ExtGState {
+             && self.0.stroking_alpha.is_none()
+             && self.0.non_stroking_alpha.is_none()
+             && self.0.blend_mode.is_none()
++            && self.0.overprint_fill.is_none()
++            && self.0.overprint_stroke.is_none()
++            && self.0.overprint_mode.is_none()
+     }
+ 
+     /// Integrate another graphics state into the current one. This is done by replacing
+@@ -106,6 +126,18 @@ impl ExtGState {
+         if let Some(mask) = other.0.mask {
+             Arc::make_mut(&mut self.0).mask = Some(mask);
+         }
++
++        if let Some(fill) = other.0.overprint_fill {
++            Arc::make_mut(&mut self.0).overprint_fill = Some(fill);
++        }
++
++        if let Some(stroke) = other.0.overprint_stroke {
++            Arc::make_mut(&mut self.0).overprint_stroke = Some(stroke);
++        }
++
++        if let Some(mode) = other.0.overprint_mode {
++            Arc::make_mut(&mut self.0).overprint_mode = Some(mode);
++        }
+     }
+ }
+ 
+@@ -153,6 +185,30 @@ impl Cacheable for ExtGState {
+             ext_st.pair(Name(b"SMask"), mask_ref);
+         }
+ 
++        if let Some(fill) = self.0.overprint_fill {
++            ext_st.overprint_fill(fill);
++        }
++
++        if let Some(stroke) = self.0.overprint_stroke {
++            ext_st.overprint(stroke);
++        }
++
++        if let Some(mode) = self.0.overprint_mode {
++            // Under `no_device_cs` all CMYK is ICCBased, which PDF/A-2 and later forbid with
++            // OPM 1 when that side overprints. The colors painted under this state aren't
++            // known here, so any overprinting side counts.
++            let overprints =
++                self.0.overprint_fill == Some(true) || self.0.overprint_stroke == Some(true);
++            if mode == OverprintMode::IgnoreZeroChannel
++                && overprints
++                && sc.serialize_settings().no_device_cs
++            {
++                sc.register_validation_error(ValidationError::OverprintModeIccCmyk(sc.location));
++            }
++
++            ext_st.overprint_mode(mode);
++        }
++
+         ext_st.finish();
+     }
+ }
+diff --git a/src/surface.rs b/src/surface.rs
+index 990527f..09b1b40 100644
+--- a/src/surface.rs
++++ b/src/surface.rs
+@@ -16,7 +16,7 @@ use crate::geom::Path;
+ use crate::geom::Size;
+ use crate::geom::{Point, Transform};
+ use crate::graphic::Graphic;
+-use crate::graphics::blend::BlendMode;
++use crate::graphics::blend::{BlendMode, Overprint};
+ use crate::graphics::graphics_state::ExtGState;
+ #[cfg(feature = "raster-images")]
+ use crate::graphics::image::Image;
+@@ -422,6 +422,16 @@ impl<'a> Surface<'a> {
+         self.bd.get_mut().set_blend_mode(blend_mode.to_pdf());
+     }
+ 
++    /// Push overprint settings. Paths, text and images drawn until the matching
++    /// [`Surface::pop`] carry them, and so do groups pushed inside. The `/op`, `/OP` and
++    /// `/OPM` entries are always written, so `Overprint::default()` turns overprint off
++    /// inside an outer `push_overprint`.
++    pub fn push_overprint(&mut self, overprint: Overprint) {
++        self.push_instructions.push(PushInstruction::Overprint);
++        self.bd.get_mut().save_graphics_state();
++        self.bd.get_mut().set_overprint(overprint);
++    }
++
+     /// Push a new clip path.
+     pub fn push_clip_path(&mut self, path: &Path, clip_rule: &FillRule) {
+         self.push_instructions.push(PushInstruction::ClipPath);
+@@ -509,6 +519,7 @@ impl<'a> Surface<'a> {
+             }
+             PushInstruction::ClipPath => self.bd.get_mut().pop_clip_path(),
+             PushInstruction::BlendMode => self.bd.get_mut().restore_graphics_state(),
++            PushInstruction::Overprint => self.bd.get_mut().restore_graphics_state(),
+             PushInstruction::Mask(mask) => {
+                 let stream = self.bd.sub_builders.pop().unwrap().finish(self.sc);
+                 self.bd
+@@ -670,6 +681,7 @@ pub(crate) enum PushInstruction {
+     Opacity(NormalizedF32),
+     ClipPath,
+     BlendMode,
++    Overprint,
+     Mask(Box<Mask>),
+     Isolated,
+ }
diff --git a/vendor/krilla/patches/04-knockout.patch b/vendor/krilla/patches/04-knockout.patch
new file mode 100644
index 00000000..cd0db6a5
--- /dev/null
+++ b/vendor/krilla/patches/04-knockout.patch
@@ -0,0 +1,202 @@
+diff --git a/src/content.rs b/src/content.rs
+index 751cb2f..f723f20 100644
+--- a/src/content.rs
++++ b/src/content.rs
+@@ -16,7 +16,7 @@ use crate::configure::ValidationError;
+ #[cfg(feature = "raster-images")]
+ use crate::geom::Size;
+ use crate::geom::{Point, Rect, Transform};
+-use crate::graphics::blend::Overprint;
++use crate::graphics::blend::{GroupOptions, Overprint};
+ use crate::graphics::color::{Color, ColorSpace};
+ use crate::graphics::graphics_state::{ExtGState, GraphicsStates};
+ #[cfg(feature = "raster-images")]
+@@ -933,14 +933,15 @@ impl ContentBuilder {
+         self.draw_xobject(sc, chunk_container, x_object, &state);
+     }
+ 
+-    pub(crate) fn draw_isolated(
++    pub(crate) fn draw_group(
+         &mut self,
+         sc: &mut SerializeContext,
+         chunk_container: &mut ChunkContainer,
++        options: GroupOptions,
+         stream: Stream,
+     ) {
+         let state = ExtGState::new();
+-        let x_object = XObject::new(stream, true, false, None);
++        let x_object = XObject::group(stream, options);
+         self.draw_xobject(sc, chunk_container, x_object, &state);
+     }
+ 
+diff --git a/src/graphics/blend.rs b/src/graphics/blend.rs
+index 8d7c5c7..7f01733 100644
+--- a/src/graphics/blend.rs
++++ b/src/graphics/blend.rs
+@@ -79,3 +79,21 @@ impl Overprint {
+         }
+     }
+ }
++
++/// Attributes of a transparency group pushed with [`Surface::push_group`].
++///
++/// A group with neither attribute set is drawn as a plain form XObject: composited with
++/// the Normal blend mode at full opacity, it looks the same as its contents drawn directly.
++///
++/// [`Surface::push_group`]: crate::surface::Surface::push_group
++#[derive(Debug, Copy, Clone, Default, Eq, PartialEq, Hash)]
++pub struct GroupOptions {
++    /// Isolated group (`/I true`): its contents composite onto a fully transparent
++    /// backdrop instead of the group's backdrop, so blend modes inside it don't reach
++    /// what lies beneath.
++    pub isolated: bool,
++    /// Knockout group (`/K true`): each object inside composites with the group's
++    /// initial backdrop instead of the objects before it, so where objects overlap only
++    /// the topmost shows.
++    pub knockout: bool,
++}
+diff --git a/src/graphics/xobject.rs b/src/graphics/xobject.rs
+index 6c56b0e..a8c9568 100644
+--- a/src/graphics/xobject.rs
++++ b/src/graphics/xobject.rs
+@@ -7,6 +7,7 @@ use pdf_writer::{Finish, Name, Ref};
+ use crate::chunk_container::ChunkContainer;
+ use crate::configure::ValidationError;
+ use crate::geom::Rect;
++use crate::graphics::blend::GroupOptions;
+ use crate::graphics::color::{rgb, DEVICE_CMYK, DEVICE_RGB};
+ use crate::resource;
+ use crate::resource::{Resource, Resourceable};
+@@ -28,6 +29,7 @@ pub(crate) enum GroupRole {
+ struct Repr {
+     stream: Stream,
+     isolated: bool,
++    knockout: bool,
+     transparency_group_color_space: bool,
+     custom_bbox: Option<Rect>,
+     role: GroupRole,
+@@ -52,9 +54,39 @@ impl XObject {
+         )
+     }
+ 
++    /// A content group with the given group attributes.
++    pub(crate) fn group(stream: Stream, options: GroupOptions) -> Self {
++        Self::build(
++            stream,
++            options.isolated,
++            options.knockout,
++            false,
++            None,
++            GroupRole::Content,
++        )
++    }
++
+     pub(crate) fn with_role(
+         stream: Stream,
+         isolated: bool,
++        transparency_group_color_space: bool,
++        custom_bbox: Option<Rect>,
++        role: GroupRole,
++    ) -> Self {
++        Self::build(
++            stream,
++            isolated,
++            false,
++            transparency_group_color_space,
++            custom_bbox,
++            role,
++        )
++    }
++
++    fn build(
++        stream: Stream,
++        isolated: bool,
++        knockout: bool,
+         mut transparency_group_color_space: bool,
+         custom_bbox: Option<Rect>,
+         role: GroupRole,
+@@ -74,6 +106,7 @@ impl XObject {
+         Self(Arc::new(Prehashed::new(Repr {
+             stream,
+             isolated,
++            knockout,
+             transparency_group_color_space,
+             custom_bbox,
+             role,
+@@ -102,7 +135,8 @@ impl Cacheable for XObject {
+             sc.register_validation_error(validation_error.clone());
+         }
+ 
+-        let use_transparency_group = self.0.isolated || self.0.transparency_group_color_space;
++        let use_transparency_group =
++            self.0.isolated || self.0.knockout || self.0.transparency_group_color_space;
+ 
+         if use_transparency_group {
+             sc.register_validation_error(ValidationError::Transparency(sc.location));
+@@ -166,6 +200,10 @@ impl Cacheable for XObject {
+                 transparency.isolated(self.0.isolated);
+             }
+ 
++            if self.0.knockout {
++                transparency.knockout(true);
++            }
++
+             if let Some(transparency_group_cs) = transparency_group_cs {
+                 write_group_color_space(transparency, transparency_group_cs);
+             }
+diff --git a/src/surface.rs b/src/surface.rs
+index 09b1b40..0cbbc4b 100644
+--- a/src/surface.rs
++++ b/src/surface.rs
+@@ -16,7 +16,7 @@ use crate::geom::Path;
+ use crate::geom::Size;
+ use crate::geom::{Point, Transform};
+ use crate::graphic::Graphic;
+-use crate::graphics::blend::{BlendMode, Overprint};
++use crate::graphics::blend::{BlendMode, GroupOptions, Overprint};
+ use crate::graphics::graphics_state::ExtGState;
+ #[cfg(feature = "raster-images")]
+ use crate::graphics::image::Image;
+@@ -494,9 +494,19 @@ impl<'a> Surface<'a> {
+         }
+     }
+ 
+-    /// Push a new isolated layer.
++    /// Push a new isolated layer. Shorthand for [`Surface::push_group`] with only
++    /// `isolated` set.
+     pub fn push_isolated(&mut self) {
+-        self.push_instructions.push(PushInstruction::Isolated);
++        self.push_group(GroupOptions {
++            isolated: true,
++            knockout: false,
++        });
++    }
++
++    /// Push a new transparency group with the given attributes. Everything drawn until
++    /// the matching [`Surface::pop`] goes into the group.
++    pub fn push_group(&mut self, options: GroupOptions) {
++        self.push_instructions.push(PushInstruction::Group(options));
+         self.bd
+             .sub_builders
+             .push(ContentBuilder::new(Transform::identity(), true, self.sc));
+@@ -526,11 +536,11 @@ impl<'a> Surface<'a> {
+                     .get_mut()
+                     .draw_masked(self.sc, self.chunk_container, *mask, stream)
+             }
+-            PushInstruction::Isolated => {
++            PushInstruction::Group(options) => {
+                 let stream = self.bd.sub_builders.pop().unwrap().finish(self.sc);
+                 self.bd
+                     .get_mut()
+-                    .draw_isolated(self.sc, self.chunk_container, stream);
++                    .draw_group(self.sc, self.chunk_container, options, stream);
+             }
+         }
+     }
+@@ -683,5 +693,5 @@ pub(crate) enum PushInstruction {
+     BlendMode,
+     Overprint,
+     Mask(Box<Mask>),
+-    Isolated,
++    Group(GroupOptions),
+ }
diff --git a/vendor/krilla/patches/05-soft-mask-backdrop.patch b/vendor/krilla/patches/05-soft-mask-backdrop.patch
new file mode 100644
index 00000000..955c2579
--- /dev/null
+++ b/vendor/krilla/patches/05-soft-mask-backdrop.patch
@@ -0,0 +1,267 @@
+diff --git a/src/configure/PDF_A2.md b/src/configure/PDF_A2.md
+index 9609ea2..6157896 100644
+--- a/src/configure/PDF_A2.md
++++ b/src/configure/PDF_A2.md
+@@ -88,7 +88,9 @@ in case CMYK is used but no profile was provided, export fails.
+ 
+ 6.2.4.5: Fulfilled because patterns are treated the same as all other elements in krilla. 🟢
+ 
+-6.2.5: krilla does not use the transfer functions, halftones, TR/HTP/RI/FL keys. 🔵
++6.2.5: krilla does not use the transfer functions, halftones, TR/HTP/RI/FL keys in graphics
++states. A soft mask's `/TR` (`Mask::with_transfer`) is a key of the soft-mask dictionary, which
++6.2.5 does not cover. 🔵
+ 
+ 6.2.6: krilla does never define a rendering intent. 🔵
+ 
+diff --git a/src/configure/PDF_A4.md b/src/configure/PDF_A4.md
+index d5e4374..91727cb 100644
+--- a/src/configure/PDF_A4.md
++++ b/src/configure/PDF_A4.md
+@@ -79,7 +79,8 @@ See `README.md` for the meaning of each color.
+   the same color space 🟢
+ 
+ ### 6.2.5 Extended graphics state
+-- krilla does not use the `TR`, `HTO`, `TR2` or `HT` keys. 🟢
++- krilla does not use the `TR`, `HTO`, `TR2` or `HT` keys in graphics states. A soft mask's `/TR`
++  (`Mask::with_transfer`) is a key of the soft-mask dictionary, which 6.2.5 does not cover. 🟢
+ - krilla does not use halftones. 🟢
+ - krilla does not use the `FL`, `BG`, `BG2`, `UCR` or `URC2` functions. 🟢
+ 
+diff --git a/src/graphics/mask.rs b/src/graphics/mask.rs
+index 9fc958e..2763a27 100644
+--- a/src/graphics/mask.rs
++++ b/src/graphics/mask.rs
+@@ -1,16 +1,20 @@
+ //! Alpha and luminosity masks.
+ 
++use std::ops::DerefMut;
++
+ use pdf_writer::{Finish, Name, Ref};
+ 
+ use crate::chunk_container::ChunkContainer;
++use crate::color::RegularColor;
+ use crate::geom::{Rect, Transform};
+ use crate::graphics::shading_function::{GradientProperties, ShadingFunction};
+ use crate::graphics::xobject::{GroupRole, XObject};
++use crate::num::NormalizedF32;
+ use crate::resource;
+ use crate::resource::Resourceable;
+ use crate::serialize::{Cacheable, GroupColorSpace, SerializeContext};
+-use crate::stream::Stream;
+ use crate::stream::StreamBuilder;
++use crate::stream::{FilterStreamBuilder, Stream};
+ 
+ /// A mask. Can be a luminance mask or an alpha mask.
+ ///
+@@ -28,6 +32,10 @@ pub struct Mask {
+     /// we want to manually set the bbox of the underlying XObject to match the shape that the
+     /// gradient is being applied to.
+     custom_bbox: Option<Rect>,
++    /// `/BC`: the backdrop color of a luminosity mask.
++    backdrop: Option<RegularColor>,
++    /// `/TR`: the transfer function from group alpha or luminosity to mask value.
++    transfer: Option<TransferFunction>,
+ }
+ 
+ impl Mask {
+@@ -38,9 +46,40 @@ impl Mask {
+             stream,
+             mask_type,
+             custom_bbox: None,
++            backdrop: None,
++            transfer: None,
+         }
+     }
+ 
++    /// Set the backdrop color (`/BC`) of a luminosity mask: the color the mask group is
++    /// composited over, which gives the mask value wherever the mask content paints nothing.
++    /// The default is black, so the masked object is hidden outside the mask content.
++    ///
++    /// The color is written in the mask group's color space: RGB under
++    /// [`GroupColorSpace::Rgb`]; under [`GroupColorSpace::Cmyk`], DeviceCMYK, or sGrey when
++    /// `no_device_cs` is set. A color from another space is converted with the device
++    /// formulas; luma maps to equal RGB components or to black ink only.
++    ///
++    /// Only luminosity masks have a backdrop color. On an alpha mask this returns the mask
++    /// unchanged.
++    pub fn with_backdrop(mut self, color: impl Into<RegularColor>) -> Self {
++        if self.mask_type == MaskType::Luminosity {
++            self.backdrop = Some(color.into());
++        }
++        self
++    }
++
++    /// Set the transfer function (`/TR`) that maps the group alpha or luminosity to the mask
++    /// value. Without one, PDF readers use the identity.
++    ///
++    /// PDF/A-2 to 4 forbid the `TR` key of graphics states (6.2.5), not of soft-mask
++    /// dictionaries, so krilla's validators accept it. PDF/X forbids transfer functions in
++    /// graphics states; check the target preflight before using a soft-mask `/TR` in PDF/X.
++    pub fn with_transfer(mut self, transfer: TransferFunction) -> Self {
++        self.transfer = Some(transfer);
++        self
++    }
++
+     /// Create a new mask for a shading to encode the opacity channels.
+     pub(crate) fn new_from_shading(
+         gradient_properties: GradientProperties,
+@@ -78,6 +117,8 @@ impl Mask {
+             stream: shading_stream,
+             mask_type: MaskType::Luminosity,
+             custom_bbox: Some(bbox),
++            backdrop: None,
++            transfer: None,
+         })
+     }
+ }
+@@ -101,6 +142,18 @@ impl MaskType {
+     }
+ }
+ 
++/// The transfer function (`/TR`) of a soft mask.
++#[derive(Clone, PartialEq, Eq, Debug, Hash)]
++pub enum TransferFunction {
++    /// Mask values equal the group alpha or luminosity (`/Identity`).
++    Identity,
++    /// A curve sampled at equal steps over the input range 0 to 1, first sample at 0 and last
++    /// at 1, interpolated linearly in between. Written as a Type 0 (sampled) function with
++    /// 16-bit samples. An empty curve is written as `/Identity`; a single sample gives a
++    /// constant mask value.
++    Sampled(Vec<NormalizedF32>),
++}
++
+ impl Cacheable for Mask {
+     fn serialize(
+         self,
+@@ -119,16 +172,131 @@ impl Cacheable for Mask {
+             XObject::with_role(self.stream, false, true, self.custom_bbox, role),
+         );
+ 
++        let backdrop = self
++            .backdrop
++            .filter(|_| self.mask_type == MaskType::Luminosity)
++            .map(|color| {
++                let settings = sc.serialize_settings();
++                match settings.group_color_space {
++                    GroupColorSpace::Rgb => backdrop_rgb(color).to_vec(),
++                    GroupColorSpace::Cmyk if settings.no_device_cs => vec![backdrop_gray(color)],
++                    GroupColorSpace::Cmyk => backdrop_cmyk(color).to_vec(),
++                }
++            });
++
++        let transfer = match &self.transfer {
++            Some(TransferFunction::Sampled(samples)) if !samples.is_empty() => {
++                Some(Some(write_sampled_transfer(sc, chunk_container, samples)))
++            }
++            Some(_) => Some(None),
++            None => None,
++        };
++
+         let chunk = &mut chunk_container.non_stream.masks;
+         let mut dict = chunk.indirect(root_ref).dict();
+         dict.pair(Name(b"Type"), Name(b"Mask"));
+         dict.pair(Name(b"S"), self.mask_type.to_name());
+         dict.pair(Name(b"G"), x_object);
+ 
++        if let Some(backdrop) = backdrop {
++            dict.insert(Name(b"BC")).array().items(backdrop);
++        }
++
++        match transfer {
++            Some(Some(function)) => {
++                dict.pair(Name(b"TR"), function);
++            }
++            Some(None) => {
++                dict.pair(Name(b"TR"), Name(b"Identity"));
++            }
++            None => {}
++        }
++
+         dict.finish();
+     }
+ }
+ 
++/// A backdrop color in an RGB mask group.
++fn backdrop_rgb(color: RegularColor) -> [f32; 3] {
++    match color {
++        RegularColor::Rgb(rgb) => rgb.to_pdf_color(),
++        RegularColor::Luma(luma) => [luma.to_pdf_color(); 3],
++        RegularColor::Cmyk(cmyk) => {
++            let [c, m, y, k] = cmyk.to_pdf_color();
++            [
++                (1.0 - c) * (1.0 - k),
++                (1.0 - m) * (1.0 - k),
++                (1.0 - y) * (1.0 - k),
++            ]
++        }
++    }
++}
++
++/// A backdrop color in a gray mask group.
++fn backdrop_gray(color: RegularColor) -> f32 {
++    match color {
++        RegularColor::Luma(luma) => luma.to_pdf_color(),
++        RegularColor::Rgb(rgb) => {
++            let [r, g, b] = rgb.to_pdf_color();
++            0.3 * r + 0.59 * g + 0.11 * b
++        }
++        RegularColor::Cmyk(cmyk) => {
++            let [c, m, y, k] = cmyk.to_pdf_color();
++            1.0 - (0.3 * c + 0.59 * m + 0.11 * y + k).min(1.0)
++        }
++    }
++}
++
++/// A backdrop color in a CMYK mask group.
++fn backdrop_cmyk(color: RegularColor) -> [f32; 4] {
++    match color {
++        RegularColor::Cmyk(cmyk) => cmyk.to_pdf_color(),
++        RegularColor::Luma(luma) => [0.0, 0.0, 0.0, 1.0 - luma.to_pdf_color()],
++        RegularColor::Rgb(rgb) => {
++            let [r, g, b] = rgb.to_pdf_color();
++            let k = 1.0 - r.max(g).max(b);
++            if k >= 1.0 {
++                return [0.0, 0.0, 0.0, 1.0];
++            }
++            let ink = |v: f32| (1.0 - v - k) / (1.0 - k);
++            [ink(r), ink(g), ink(b), k]
++        }
++    }
++}
++
++/// Write a sampled transfer curve as a Type 0 function and return its reference.
++fn write_sampled_transfer(
++    sc: &mut SerializeContext,
++    chunk_container: &mut ChunkContainer,
++    samples: &[NormalizedF32],
++) -> Ref {
++    let root_ref = sc.new_ref();
++    let serialize_settings = sc.serialize_settings();
++
++    // A Type 0 function needs two samples to span its domain.
++    let samples = match samples {
++        [only] => vec![*only, *only],
++        _ => samples.to_vec(),
++    };
++    let data: Vec<u8> = samples
++        .iter()
++        .flat_map(|sample| ((sample.get() * 65535.0).round() as u16).to_be_bytes())
++        .collect();
++
++    let stream = FilterStreamBuilder::new_from_binary_data(&data).finish(&serialize_settings);
++    let mut chunk = sc.new_chunk();
++    let mut function = chunk.sampled_function(root_ref, stream.encoded_data());
++    stream.write_filters(function.deref_mut().deref_mut());
++    function.domain([0.0, 1.0]);
++    function.range([0.0, 1.0]);
++    function.size([samples.len() as i32]);
++    function.bits_per_sample(16);
++    function.finish();
++    chunk_container.streams.shading_functions.push(chunk);
++
++    root_ref
++}
++
+ impl Resourceable for Mask {
+     type Resource = resource::XObject;
+ }
diff --git a/vendor/krilla/patches/06-device-n.patch b/vendor/krilla/patches/06-device-n.patch
new file mode 100644
index 00000000..0ec6a538
--- /dev/null
+++ b/vendor/krilla/patches/06-device-n.patch
@@ -0,0 +1,639 @@
+diff --git a/src/configure/PDF_A1.md b/src/configure/PDF_A1.md
+index 2ade327..c525953 100644
+--- a/src/configure/PDF_A1.md
++++ b/src/configure/PDF_A1.md
+@@ -54,7 +54,8 @@ with an even number of characters and without whitespaces. 🟢
+ - krilla does check the maximum entries of a dictionary. 🟢
+ - krilla fails export if more than 8388607 indirect objects exist. 🟢
+ - krilla fails export if a higher nesting-level than 28 exists. 🔵
+-- krilla does not use the DeviceN color space. 🟢
++- krilla fails export if a DeviceN color space is used (see 6.2.3.4), so the limit of 8
++  DeviceN colorants is never reached. 🟢
+ - krilla only uses u16 for CIDs. 🟢
+ 
+ 6.1.13: krilla does not support optional content. 🔵
+@@ -81,7 +82,8 @@ in case CMYK is used but no profile was provided, export fails. 🟢
+ 6.2.3.4:
+ - krilla ensures the Alternate space in Separation color spaces obeys the restrictions
+   in the applicable clauses 🟢
+-- krilla does not support DeviceN color spaces. 🔵
++- krilla fails export if a DeviceN color space is used: its tint transform is a PostScript
++  calculator function (`ValidationError::ContainsPostScript`). 🟢
+ 
+ 6.2.4: 
+ - krilla does not use the `Alternates`/`Intent` keys for images. 🔵
+diff --git a/src/configure/PDF_A2.md b/src/configure/PDF_A2.md
+index 6157896..9ff3593 100644
+--- a/src/configure/PDF_A2.md
++++ b/src/configure/PDF_A2.md
+@@ -80,7 +80,8 @@ in case CMYK is used but no profile was provided, export fails.
+ 6.2.4.4:
+ - krilla ensures the Alternate space in Separation color spaces obeys the restrictions
+   in the applicable clauses 🟢
+-- krilla does not support DeviceN color spaces. 🔵
++- krilla fails export if a DeviceN color space is used: its tint transform is a PostScript
++  calculator function (`ValidationError::ContainsPostScript`). 🟢
+ - krilla fails export if a Separation colorant is associated with multiple different
+   fallback color spaces 🟢
+ - krilla manages the `tintTransform` function and will always write the same function for
+diff --git a/src/configure/PDF_A4.md b/src/configure/PDF_A4.md
+index 91727cb..7cd5df3 100644
+--- a/src/configure/PDF_A4.md
++++ b/src/configure/PDF_A4.md
+@@ -72,9 +72,12 @@ See `README.md` for the meaning of each color.
+ - krilla does not use device color spaces in this mode. 🟢
+ - krilla ensures the Alternate space in Separation color spaces obeys the restrictions
+   in the applicable clauses 🟢
+-- krilla does not support DeviceN color spaces. 🔵
++- krilla writes DeviceN color spaces with the CMYK ICC profile as their alternate in this
++  mode. Each spot colorant is also listed under `/Colorants` as a Separation space with the
++  same alternate, and a space mixing spot and process colorants is `/Subtype /NChannel`.
++  The tint transform is a PostScript calculator function, which PDF/A-4 allows. 🟢
+ - krilla fails export if a Separation colorant is associated with multiple different
+-  fallback color spaces 🟢
++  fallback color spaces, a DeviceN spot colorant's alternate included 🟢
+ - krilla manages the `tintTransform` function and will always write the same function for
+   the same color space 🟢
+ 
+diff --git a/src/configure/validate.rs b/src/configure/validate.rs
+index 91996ee..273f292 100644
+--- a/src/configure/validate.rs
++++ b/src/configure/validate.rs
+@@ -83,7 +83,8 @@ pub enum ValidationError {
+     MissingCMYKProfile,
+     /// The same Separation colorant was used with multiple different fallback colors.
+     ///
+-    /// Occurs if the user specified multiple Separation color spaces with the same colorant but a different fallback color.
++    /// Occurs if the user specified multiple Separation color spaces with the same colorant but a different fallback color,
++    /// or a DeviceN spot colorant whose CMYK alternate differs from the fallback used elsewhere for that name.
+     InconsistentSeparationFallback(SeparationColorant),
+     /// The `.notdef` glyph was used, which is forbidden by some export formats.
+     ///
+@@ -1234,17 +1235,28 @@ impl ValidationStore {
+     pub(crate) fn validate_separation(
+         &mut self,
+         separation: &SeparationSpace,
++    ) -> Result<(), ValidationError> {
++        self.validate_colorant(&separation.colorant, separation.fallback)
++    }
++
++    /// Register a colorant used by a Separation or DeviceN color space with its
++    /// fallback (the DeviceN spot's CMYK alternate) and raise an error if the name
++    /// already has another one.
++    pub(crate) fn validate_colorant(
++        &mut self,
++        colorant: &SeparationColorant,
++        fallback: RegularColor,
+     ) -> Result<(), ValidationError> {
+         if self
+             .separation_fallback_map
+-            .entry(separation.colorant.clone())
+-            .or_insert(separation.fallback)
+-            == &separation.fallback
++            .entry(colorant.clone())
++            .or_insert(fallback)
++            == &fallback
+         {
+             Ok(())
+         } else {
+             Err(ValidationError::InconsistentSeparationFallback(
+-                separation.colorant.clone(),
++                colorant.clone(),
+             ))
+         }
+     }
+diff --git a/src/graphics/color.rs b/src/graphics/color.rs
+index 559305c..6fb0618 100644
+--- a/src/graphics/color.rs
++++ b/src/graphics/color.rs
+@@ -2,11 +2,12 @@
+ //!
+ //! # Color spaces
+ //!
+-//! krilla currently supports four color models:
++//! krilla currently supports five color models:
+ //! - RGB
+ //! - Luma
+ //! - CMYK
+ //! - Separation (also known as Spot)
++//! - DeviceN (several process and spot colorants at once)
+ //!
+ //! Each color space is associated with its specific color type, which you can use to create new
+ //! instances of a specific color in that color space.
+@@ -54,7 +55,16 @@
+ //! given colorant should not be referred to by multiple, slightly different names. Just the same
+ //! for fallback colors: For a given colorant, there should be only one fallback color. Using multiple
+ //! Separation color spaces with the same colorant and distinct fallback colors is considered a bad
+-//! practice and forbidden in PDF/A-2 and later.
++//! practice and forbidden in PDF/A-2 and later. DeviceN spot colorants count too: a spot's
++//! CMYK alternate in a DeviceN color space must match its Separation fallback.
++//!
++//! # DeviceN
++//!
++//! A [`device_n::DeviceNSpace`] paints several colorants with one color, for example
++//! 60% Cyan and 40% Black without touching Magenta and Yellow, or a process ink mixed
++//! with a spot. Its alternate space is DeviceCMYK, or the `cmyk_profile` ICC space with
++//! `no_device_cs`. The tint transform is a PostScript calculator (Type 4) function, which
++//! some export formats forbid.
+ //!
+ //! [`SerializeSettings`]: crate::SerializeSettings
+ 
+@@ -97,6 +107,8 @@ pub enum RegularColor {
+ pub enum SpecialColor {
+     /// A separation color.
+     Separation(separation::Color),
++    /// A DeviceN color.
++    DeviceN(device_n::Color),
+ }
+ 
+ impl Color {
+@@ -106,6 +118,7 @@ impl Color {
+             Color::Regular(RegularColor::Luma(l)) => vec![l.to_pdf_color()],
+             Color::Regular(RegularColor::Cmyk(cmyk)) => cmyk.to_pdf_color().to_vec(),
+             Color::Special(SpecialColor::Separation(spot)) => vec![spot.to_pdf_color()],
++            Color::Special(SpecialColor::DeviceN(c)) => c.to_pdf_color(),
+         }
+     }
+ 
+@@ -122,6 +135,7 @@ impl Color {
+         match self {
+             Color::Regular(c) => *c,
+             Color::Special(SpecialColor::Separation(c)) => c.space.fallback,
++            Color::Special(SpecialColor::DeviceN(c)) => c.alternate().into(),
+         }
+     }
+ }
+@@ -162,6 +176,7 @@ impl SpecialColor {
+     pub(crate) fn color_space(&self) -> SpecialColorSpace {
+         match self {
+             Self::Separation(spot) => spot.color_space().into(),
++            Self::DeviceN(c) => SpecialColorSpace::DeviceN(c.space.clone()),
+         }
+     }
+ }
+@@ -479,6 +494,208 @@ pub mod separation {
+     }
+ }
+ 
++/// DeviceN colors: several process and spot colorants painted by one color.
++pub mod device_n {
++    use std::sync::Arc;
++
++    use crate::color::cmyk;
++
++    /// A process colorant.
++    #[derive(Debug, Eq, PartialEq, Hash, Clone, Copy)]
++    pub enum Process {
++        /// Cyan.
++        Cyan,
++        /// Magenta.
++        Magenta,
++        /// Yellow.
++        Yellow,
++        /// Black.
++        Black,
++    }
++
++    impl Process {
++        /// The process colorants in DeviceCMYK order.
++        pub const ALL: [Process; 4] = [Self::Cyan, Self::Magenta, Self::Yellow, Self::Black];
++
++        /// The PDF colorant name.
++        pub fn name(self) -> &'static str {
++            match self {
++                Self::Cyan => "Cyan",
++                Self::Magenta => "Magenta",
++                Self::Yellow => "Yellow",
++                Self::Black => "Black",
++            }
++        }
++
++        fn index(self) -> usize {
++            self as usize
++        }
++    }
++
++    /// One colorant of a DeviceN color space.
++    #[derive(Debug, Eq, PartialEq, Hash, Clone)]
++    pub enum Colorant {
++        /// A process colorant, painted on its own CMYK plate.
++        Process(Process),
++        /// A spot colorant with the CMYK color that stands in for it at 100% tint.
++        ///
++        /// To export PDF/A-2 and later, use the same alternate wherever the name appears,
++        /// including as a Separation fallback.
++        Spot {
++            /// The colorant name.
++            name: String,
++            /// The CMYK color of a 100% tint.
++            alternate: cmyk::Color,
++        },
++    }
++
++    impl Colorant {
++        /// The PDF colorant name.
++        pub fn name(&self) -> &str {
++            match self {
++                Self::Process(p) => p.name(),
++                Self::Spot { name, .. } => name,
++            }
++        }
++
++        /// The CMYK components (0–1) a 100% tint of this colorant contributes.
++        pub(crate) fn alternate(&self) -> [f32; 4] {
++            match self {
++                Self::Process(p) => {
++                    let mut out = [0.0; 4];
++                    out[p.index()] = 1.0;
++                    out
++                }
++                Self::Spot { alternate, .. } => alternate.to_pdf_color(),
++            }
++        }
++    }
++
++    /// A DeviceN color space: an ordered list of colorants.
++    ///
++    /// A color's tints map to the alternate CMYK space component by component: each
++    /// colorant contributes its tint times its CMYK alternate, and the contributions
++    /// combine as `1 - (1 - a)(1 - b)…`. Process colorants contribute only to their own
++    /// component, so a space of process colorants alone maps tints directly.
++    #[derive(Debug, Eq, PartialEq, Hash, Clone)]
++    pub struct DeviceNSpace {
++        pub(crate) colorants: Arc<[Colorant]>,
++    }
++
++    impl DeviceNSpace {
++        /// The largest number of colorants PDF allows in a DeviceN color space.
++        pub const MAX_COLORANTS: usize = 32;
++
++        /// Create a DeviceN color space with the colorants in this order.
++        ///
++        /// Returns `None` without colorants, with more than [`Self::MAX_COLORANTS`], with
++        /// a name used twice, or with a spot named like a process colorant, `All`, `None`
++        /// or the empty string.
++        pub fn new(colorants: impl IntoIterator<Item = Colorant>) -> Option<Self> {
++            let colorants: Arc<[Colorant]> = colorants.into_iter().collect();
++            if colorants.is_empty() || colorants.len() > Self::MAX_COLORANTS {
++                return None;
++            }
++            for (i, colorant) in colorants.iter().enumerate() {
++                let name = colorant.name();
++                if let Colorant::Spot { .. } = colorant {
++                    let reserved = ["", "All", "None"].contains(&name)
++                        || Process::ALL.iter().any(|p| p.name() == name);
++                    if reserved {
++                        return None;
++                    }
++                }
++                if colorants[..i].iter().any(|c| c.name() == name) {
++                    return None;
++                }
++            }
++            Some(Self { colorants })
++        }
++
++        /// The colorants in color component order.
++        pub fn colorants(&self) -> &[Colorant] {
++            &self.colorants
++        }
++
++        pub(crate) fn has_process(&self) -> bool {
++            self.colorants
++                .iter()
++                .any(|c| matches!(c, Colorant::Process(_)))
++        }
++
++        pub(crate) fn spots(&self) -> impl Iterator<Item = (&str, cmyk::Color)> {
++            self.colorants.iter().filter_map(|c| match c {
++                Colorant::Spot { name, alternate } => Some((name.as_str(), *alternate)),
++                Colorant::Process(_) => None,
++            })
++        }
++
++        /// The alternate CMYK components (0–1) for tints (0–1), as the tint transform
++        /// computes them.
++        pub(crate) fn alternate(&self, tints: &[f32]) -> [f32; 4] {
++            let mut out = [0.0; 4];
++            for (component, value) in out.iter_mut().enumerate() {
++                let blank: f32 = self
++                    .colorants
++                    .iter()
++                    .zip(tints)
++                    .map(|(c, t)| 1.0 - t * c.alternate()[component])
++                    .product();
++                *value = 1.0 - blank;
++            }
++            out
++        }
++    }
++
++    impl From<DeviceNSpace> for super::SpecialColorSpace {
++        fn from(value: DeviceNSpace) -> Self {
++            Self::DeviceN(value)
++        }
++    }
++
++    /// A DeviceN color: one tint per colorant of its space.
++    #[derive(Debug, Hash, Eq, PartialEq, Clone)]
++    pub struct Color {
++        pub(crate) tints: Vec<u8>,
++        pub(crate) space: DeviceNSpace,
++    }
++
++    impl Color {
++        /// Create a DeviceN color, with the tints (0 = no ink, 255 = full ink) in the
++        /// order of the space's colorants.
++        ///
++        /// Returns `None` unless there is one tint per colorant.
++        pub fn new(tints: Vec<u8>, space: DeviceNSpace) -> Option<Self> {
++            (tints.len() == space.colorants.len()).then_some(Self { tints, space })
++        }
++
++        pub(crate) fn to_pdf_color(&self) -> Vec<f32> {
++            self.tints.iter().map(|t| *t as f32 / 255.0).collect()
++        }
++
++        /// The color in the alternate CMYK space.
++        pub(crate) fn alternate(&self) -> cmyk::Color {
++            let [c, m, y, k] = self
++                .space
++                .alternate(&self.to_pdf_color())
++                .map(|v| (v * 255.0).round().clamp(0.0, 255.0) as u8);
++            cmyk::Color::new(c, m, y, k)
++        }
++    }
++
++    impl From<Color> for super::SpecialColor {
++        fn from(val: Color) -> Self {
++            super::SpecialColor::DeviceN(val)
++        }
++    }
++
++    impl From<Color> for super::Color {
++        fn from(val: Color) -> Self {
++            super::SpecialColor::from(val).into()
++        }
++    }
++}
++
+ #[derive(Debug, Eq, PartialEq, Hash, Clone)]
+ pub(crate) enum ColorSpace {
+     Device(DeviceColorSpace),
+@@ -543,6 +760,8 @@ impl From<CieBasedColorSpace> for RegularColorSpace {
+ pub(crate) enum SpecialColorSpace {
+     /// A Separation color space with its colorant and fallback.
+     Separation(separation::SeparationSpace),
++    /// A DeviceN color space with its colorants.
++    DeviceN(device_n::DeviceNSpace),
+ }
+ 
+ impl From<SpecialColorSpace> for ColorSpace {
+diff --git a/src/graphics/device_n.rs b/src/graphics/device_n.rs
+new file mode 100644
+index 0000000..8ee7064
+--- /dev/null
++++ b/src/graphics/device_n.rs
+@@ -0,0 +1,194 @@
++use std::ops::DerefMut;
++
++use pdf_writer::types::PostScriptOp;
++use pdf_writer::{Finish, Name, Ref};
++
++use crate::chunk_container::ChunkContainer;
++use crate::color::device_n::DeviceNSpace;
++use crate::color::separation::{SeparationColorant, SeparationSpace};
++use crate::color::{cmyk, ColorSpace, RegularColor, SpecialColorSpace};
++use crate::color::{DEVICE_CMYK, DEVICE_GRAY, DEVICE_RGB};
++use crate::configure::{PdfVersion, ValidationError};
++use crate::resource::{self, Resource, Resourceable};
++use crate::serialize::{Cacheable, MaybeDeviceColorSpace, SerializeContext};
++use crate::stream::FilterStreamBuilder;
++
++/// A DeviceN color space, written as
++/// `[/DeviceN [names] alternate tintTransform attributes?]`.
++///
++/// The alternate is DeviceCMYK, or the `cmyk_profile` ICC space with `no_device_cs`. The
++/// attributes dictionary (PDF 1.6+) lists each spot's Separation color space under
++/// `/Colorants`; when spots and process colorants mix, it is an `NChannel` space whose
++/// `/Process` names the CMYK space and components.
++#[derive(Debug, Eq, PartialEq, Hash, Clone)]
++pub(crate) struct DeviceNColorSpace {
++    space: DeviceNSpace,
++}
++
++impl DeviceNColorSpace {
++    pub fn new(space: DeviceNSpace) -> Self {
++        Self { space }
++    }
++}
++
++impl Cacheable for DeviceNColorSpace {
++    fn serialize(
++        self,
++        sc: &mut SerializeContext,
++        chunk_container: &mut ChunkContainer,
++        root_ref: Ref,
++    ) {
++        let space = self.space;
++        let alternate_cs = RegularColor::from(cmyk::Color::default()).color_space(sc);
++        let alternate = sc.register_colorspace(chunk_container, alternate_cs.into());
++
++        for (name, cmyk) in space.spots() {
++            let colorant = SeparationColorant::Custom(name.to_owned());
++            if let Err(e) = sc
++                .validation_store()
++                .validate_colorant(&colorant, cmyk.into())
++            {
++                sc.register_validation_error(e);
++            }
++        }
++
++        let tint_ref = tint_transform(&space, sc, chunk_container);
++
++        let with_attrs = sc.serialize_settings().pdf_version() >= PdfVersion::Pdf16;
++        let mut separations = Vec::new();
++        if with_attrs {
++            for (name, cmyk) in space.spots() {
++                let separation =
++                    SeparationSpace::new(SeparationColorant::Custom(name.to_owned()), cmyk.into());
++                let cs = ColorSpace::Special(SpecialColorSpace::Separation(separation));
++                if let MaybeDeviceColorSpace::ColorSpace(cs) =
++                    sc.register_colorspace(chunk_container, cs)
++                {
++                    separations.push((name.to_owned(), cs.get_ref()));
++                }
++            }
++        }
++        let nchannel = with_attrs && space.has_process() && !separations.is_empty();
++
++        let chunk = &mut chunk_container.non_stream.color_spaces;
++        let mut array = chunk.indirect(root_ref).array();
++        array.item(Name(b"DeviceN"));
++        array
++            .push()
++            .array()
++            .items(space.colorants().iter().map(|c| Name(c.name().as_bytes())));
++        write_color_space(&mut array, &alternate);
++        array.item(tint_ref);
++
++        if !separations.is_empty() {
++            let mut attrs = array.push().dict();
++            if nchannel {
++                attrs.pair(Name(b"Subtype"), Name(b"NChannel"));
++            }
++            let mut colorants = attrs.insert(Name(b"Colorants")).dict();
++            for (name, separation) in &separations {
++                colorants.pair(Name(name.as_bytes()), *separation);
++            }
++            colorants.finish();
++            if nchannel {
++                let mut process = attrs.insert(Name(b"Process")).dict();
++                match &alternate {
++                    MaybeDeviceColorSpace::ColorSpace(cs) => {
++                        process.pair(Name(b"ColorSpace"), cs.get_ref());
++                    }
++                    _ => {
++                        process.pair(Name(b"ColorSpace"), Name(DEVICE_CMYK.as_bytes()));
++                    }
++                }
++                process
++                    .insert(Name(b"Components"))
++                    .array()
++                    .items(PROCESS_NAMES.map(|n| Name(n.as_bytes())));
++            }
++        }
++
++        array.finish();
++    }
++}
++
++impl Resourceable for DeviceNColorSpace {
++    type Resource = resource::ColorSpace;
++}
++
++const PROCESS_NAMES: [&str; 4] = ["Cyan", "Magenta", "Yellow", "Black"];
++
++fn write_color_space(array: &mut pdf_writer::Array<'_>, cs: &MaybeDeviceColorSpace) {
++    match cs {
++        MaybeDeviceColorSpace::DeviceRgb => array.item(Name(DEVICE_RGB.as_bytes())),
++        MaybeDeviceColorSpace::DeviceGray => array.item(Name(DEVICE_GRAY.as_bytes())),
++        MaybeDeviceColorSpace::DeviceCMYK => array.item(Name(DEVICE_CMYK.as_bytes())),
++        MaybeDeviceColorSpace::ColorSpace(cs) => array.item(cs.get_ref()),
++    };
++}
++
++/// Write the Type 4 tint transform from the space's tints to CMYK and return its
++/// reference. It computes [`DeviceNSpace::alternate`].
++fn tint_transform(
++    space: &DeviceNSpace,
++    sc: &mut SerializeContext,
++    chunk_container: &mut ChunkContainer,
++) -> Ref {
++    use PostScriptOp::*;
++
++    sc.register_validation_error(ValidationError::ContainsPostScript(sc.location));
++
++    let n = space.colorants().len();
++    let mut code = Vec::new();
++    // The stack holds the n tints; each pass pushes one CMYK component on top.
++    for component in 0..4 {
++        let terms: Vec<(usize, f32)> = space
++            .colorants()
++            .iter()
++            .enumerate()
++            .map(|(i, c)| (i, c.alternate()[component]))
++            .filter(|(_, a)| *a > 0.0)
++            .collect();
++        // Depth of tint `i` below the top, with `extra` values pushed above the tints.
++        let depth = |i: usize, extra: usize| (n - 1 - i + extra) as i32;
++        let scale = |code: &mut Vec<PostScriptOp<'static>>, a: f32| {
++            if a < 1.0 {
++                code.extend([Real(a), Mul]);
++            }
++        };
++        match terms.as_slice() {
++            [] => code.push(Real(0.0)),
++            [(i, a)] => {
++                code.extend([Integer(depth(*i, component)), Index]);
++                scale(&mut code, *a);
++            }
++            _ => {
++                // Product of (1 - tint × alternate), then 1 minus the product.
++                code.push(Real(1.0));
++                for (i, a) in &terms {
++                    code.extend([Integer(depth(*i, component + 1)), Index]);
++                    scale(&mut code, *a);
++                    code.extend([Real(1.0), Exch, Sub, Mul]);
++                }
++                code.extend([Real(1.0), Exch, Sub]);
++            }
++        }
++    }
++    // Move the four components below the tints, then drop the tints.
++    code.extend([Integer(n as i32 + 4), Integer(4), Roll]);
++    code.extend((0..n).map(|_| Pop));
++
++    let encoded = PostScriptOp::encode(&code);
++    sc.register_limits(encoded.limits());
++    let encoded = FilterStreamBuilder::new_from_content_stream(&encoded, &sc.serialize_settings())
++        .finish(&sc.serialize_settings());
++
++    let tint_ref = sc.new_ref();
++    let mut chunk = sc.new_chunk();
++    let mut function = chunk.post_script_function(tint_ref, encoded.encoded_data());
++    encoded.write_filters(function.deref_mut().deref_mut());
++    function.domain([0.0, 1.0].repeat(n));
++    function.range([0.0, 1.0].repeat(4));
++    function.finish();
++    chunk_container.streams.shading_functions.push(chunk);
++    tint_ref
++}
+diff --git a/src/graphics/mod.rs b/src/graphics/mod.rs
+index fa15fda..57e9406 100644
+--- a/src/graphics/mod.rs
++++ b/src/graphics/mod.rs
+@@ -7,6 +7,7 @@ pub mod icc;
+ pub mod image;
+ pub mod mask;
+ pub mod paint;
++pub(crate) mod device_n;
+ pub(crate) mod separation;
+ pub(crate) mod shading_function;
+ pub(crate) mod shading_pattern;
+diff --git a/src/graphics/paint.rs b/src/graphics/paint.rs
+index cd4413c..d964ac0 100644
+--- a/src/graphics/paint.rs
++++ b/src/graphics/paint.rs
+@@ -186,6 +186,7 @@ impl Paint {
+             InnerPaint::Color(c) => match c {
+                 Color::Regular(c) => c.as_rgb(),
+                 Color::Special(SpecialColor::Separation(c)) => c.space.fallback.as_rgb(),
++                Color::Special(SpecialColor::DeviceN(_)) => None,
+             },
+             _ => None,
+         }
+diff --git a/src/serialize.rs b/src/serialize.rs
+index 58c0090..d16261c 100644
+--- a/src/serialize.rs
++++ b/src/serialize.rs
+@@ -17,6 +17,7 @@ use crate::configure::{Configuration, PdfVersion, ValidationError, Validators};
+ use crate::error::{KrillaError, KrillaResult, LimitError};
+ use crate::geom::Size;
+ use crate::graphics::color::{cmyk, luma, rgb, ColorSpace};
++use crate::graphics::device_n::DeviceNColorSpace;
+ use crate::graphics::icc::{ICCBasedColorSpace, ICCProfile};
+ #[cfg(feature = "raster-images")]
+ use crate::graphics::image::Image;
+@@ -766,6 +767,11 @@ impl SerializeContext {
+                     self.register_resourceable(chunk_container, SeparationColorSpace::new(s)),
+                 )
+             }
++            ColorSpace::Special(SpecialColorSpace::DeviceN(s)) => {
++                MaybeDeviceColorSpace::ColorSpace(
++                    self.register_resourceable(chunk_container, DeviceNColorSpace::new(s)),
++                )
++            }
+         }
+     }
+ }
diff --git a/vendor/krilla/patches/07-device-n-images-shadings.patch b/vendor/krilla/patches/07-device-n-images-shadings.patch
new file mode 100644
index 00000000..e41ea568
--- /dev/null
+++ b/vendor/krilla/patches/07-device-n-images-shadings.patch
@@ -0,0 +1,501 @@
+diff --git a/src/graphics/image.rs b/src/graphics/image.rs
+index c911f06..cf1728d 100644
+--- a/src/graphics/image.rs
++++ b/src/graphics/image.rs
+@@ -22,8 +22,9 @@ use zune_jpeg::JpegDecoder;
+ use crate::chunk_container::ChunkContainer;
+ use crate::configure::ValidationError;
+ use crate::error::KrillaError;
++use crate::graphics::color::device_n::DeviceNSpace;
+ use crate::graphics::color::DEVICE_GRAY;
+-use crate::graphics::color::{cmyk, luma, rgb};
++use crate::graphics::color::{cmyk, luma, rgb, ColorSpace as PdfColorSpace, SpecialColorSpace};
+ use crate::graphics::icc::{GenericICCProfile, ICCBasedColorSpace, ICCProfile};
+ use crate::serialize::SerializeContext;
+ use crate::stream::{deflate_encode, FilterStreamBuilder};
+@@ -57,22 +58,19 @@ pub enum ImageColorspace {
+     Luma,
+     /// The CMYK color space.
+     Cmyk,
++    /// The DeviceN color space that [`CustomImage::device_n_space`] returns: one sample per
++    /// colorant, in the space's colorant order, 0 = no ink. Only for [`CustomImage`]; an ICC
++    /// profile is ignored.
++    DeviceN,
+ }
+ 
+ impl ImageColorspace {
+-    fn num_components(&self) -> u8 {
+-        match self {
+-            ImageColorspace::Luma => 1,
+-            ImageColorspace::Rgb => 3,
+-            ImageColorspace::Cmyk => 4,
+-        }
+-    }
+-
+     fn matches_icc_profile(&self, profile: &GenericICCProfile) -> bool {
+         match self {
+             ImageColorspace::Rgb => matches!(profile, GenericICCProfile::Rgb(_)),
+             ImageColorspace::Luma => matches!(profile, GenericICCProfile::Luma(_)),
+             ImageColorspace::Cmyk => matches!(profile, GenericICCProfile::Cmyk(_)),
++            ImageColorspace::DeviceN => false,
+         }
+     }
+ }
+@@ -139,6 +137,11 @@ pub trait CustomImage: Hash + Clone + Send + Sync + 'static {
+     fn icc_profile(&self) -> Option<&[u8]>;
+     /// Return the color space of the image.
+     fn color_space(&self) -> ImageColorspace;
++    /// Return the DeviceN color space of the image. Required when [`Self::color_space`]
++    /// returns [`ImageColorspace::DeviceN`], ignored otherwise.
++    fn device_n_space(&self) -> Option<DeviceNSpace> {
++        None
++    }
+ }
+ 
+ struct ImageMetadata {
+@@ -147,6 +150,19 @@ struct ImageMetadata {
+     has_alpha: bool,
+     bits_per_component: BitsPerComponent,
+     icc: Option<GenericICCProfile>,
++    /// The space of an [`ImageColorspace::DeviceN`] image.
++    device_n: Option<DeviceNSpace>,
++}
++
++impl ImageMetadata {
++    fn num_components(&self) -> usize {
++        match self.color_space {
++            ImageColorspace::Luma => 1,
++            ImageColorspace::Rgb => 3,
++            ImageColorspace::Cmyk => 4,
++            ImageColorspace::DeviceN => self.device_n.as_ref().map_or(0, |s| s.colorants().len()),
++        }
++    }
+ }
+ 
+ struct ImageRepr {
+@@ -278,7 +294,7 @@ impl Image {
+     /// data doesn't match.
+     pub fn from_custom<T: CustomImage>(image: T, interpolate: bool) -> Result<Image, String> {
+         let hash = (image.clone(), interpolate).sip_hash();
+-        let metadata = ImageMetadata {
++        let mut metadata = ImageMetadata {
+             size: image.size(),
+             color_space: image.color_space(),
+             has_alpha: image.alpha_channel().is_some(),
+@@ -286,13 +302,22 @@ impl Image {
+             icc: image
+                 .icc_profile()
+                 .and_then(|d| get_icc_profile_type(d, image.color_space())),
++            device_n: None,
+         };
++        if metadata.color_space == ImageColorspace::DeviceN {
++            metadata.device_n = Some(
++                image
++                    .device_n_space()
++                    .ok_or("DeviceN image without a DeviceN space")?,
++            );
++        }
+ 
++        let num_components = metadata.num_components() as u32;
+         Ok(Self(Arc::new(ImageRepr {
+             inner: Deferred::new(move || {
+                 let bytes_per_component = (image.bits_per_component().as_u8() / 8) as u32;
+                 let color_channel_len = bytes_per_component
+-                    * image.color_space().num_components() as u32
++                    * num_components
+                     * metadata.size.0
+                     * metadata.size.1;
+                 let color_channel = image.color_channel();
+@@ -325,6 +350,7 @@ impl Image {
+             bits_per_component: BitsPerComponent::Eight,
+             color_space: ImageColorspace::Rgb,
+             icc: None,
++            device_n: None,
+         };
+ 
+         Self(Arc::new(ImageRepr {
+@@ -417,6 +443,13 @@ impl Image {
+                     }
+                     Some(cs) => cs.into(),
+                 },
++                ImageColorspace::DeviceN => match &self.0.metadata.device_n {
++                    Some(space) => {
++                        PdfColorSpace::Special(SpecialColorSpace::DeviceN(space.clone()))
++                    }
++                    // `from_custom` refuses a DeviceN image without a space.
++                    None => luma::color_space(sc.serialize_settings().no_device_cs).into(),
++                },
+             };
+ 
+             sc.register_colorspace(chunk_container, cs)
+@@ -496,8 +529,7 @@ impl Image {
+             // marker.
+             if let Repr::Jpeg(j) = repr {
+                 if j.invert_cmyk {
+-                    image_x_object
+-                        .decode([1.0, 0.0].repeat(self.color_space().num_components() as usize));
++                    image_x_object.decode([1.0, 0.0].repeat(self.0.metadata.num_components()));
+                 }
+             }
+ 
+@@ -553,6 +585,7 @@ fn png_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
+         bits_per_component,
+         color_space: image_color_space,
+         icc,
++        device_n: None,
+     })
+ }
+ 
+@@ -619,6 +652,7 @@ fn jpeg_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
+         bits_per_component: BitsPerComponent::Eight,
+         color_space: image_color_space,
+         icc,
++        device_n: None,
+     })
+ }
+ 
+@@ -683,6 +717,7 @@ fn gif_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
+         size: (size.width as u32, size.height as u32),
+         color_space: ImageColorspace::Rgb,
+         icc: None,
++        device_n: None,
+     })
+ }
+ 
+@@ -702,6 +737,7 @@ fn webp_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
+         size,
+         color_space,
+         icc,
++        device_n: None,
+     })
+ }
+ 
+@@ -812,6 +848,7 @@ fn get_icc_profile_type(data: &[u8], color_space: ImageColorspace) -> Option<Gen
+         ImageColorspace::Rgb => GenericICCProfile::Rgb(ICCProfile::new(data)?),
+         ImageColorspace::Luma => GenericICCProfile::Luma(ICCProfile::new(data)?),
+         ImageColorspace::Cmyk => GenericICCProfile::Cmyk(ICCProfile::new(data)?),
++        ImageColorspace::DeviceN => return None,
+     };
+ 
+     Some(wrapper)
+diff --git a/src/graphics/paint.rs b/src/graphics/paint.rs
+index d964ac0..d4b9efb 100644
+--- a/src/graphics/paint.rs
++++ b/src/graphics/paint.rs
+@@ -28,7 +28,10 @@ pub struct LinearGradient {
+     pub spread_method: SpreadMethod,
+     /// The color stops of the linear gradient.
+     ///
+-    /// Note that all stops need to be in the same color space.
++    /// Stops in different color spaces built from inks (CMYK, luma as black, spots with a
++    /// CMYK fallback, DeviceN) are written in one space: Separation for a single spot,
++    /// DeviceCMYK for process colors alone, DeviceN otherwise. Other stops need to be in the
++    /// same color space.
+     pub stops: Vec<Stop>,
+     /// Whether the gradient should be anti-aliased.
+     pub anti_alias: bool,
+@@ -73,7 +76,10 @@ pub struct RadialGradient {
+     pub spread_method: SpreadMethod,
+     /// The color stops of the radial gradient.
+     ///
+-    /// Note that all stops need to be in the same color space.
++    /// Stops in different color spaces built from inks (CMYK, luma as black, spots with a
++    /// CMYK fallback, DeviceN) are written in one space: Separation for a single spot,
++    /// DeviceCMYK for process colors alone, DeviceN otherwise. Other stops need to be in the
++    /// same color space.
+     pub stops: Vec<Stop>,
+     /// Whether the gradient should be anti-aliased.
+     pub anti_alias: bool,
+@@ -115,7 +121,10 @@ pub struct SweepGradient {
+     pub spread_method: SpreadMethod,
+     /// The color stops of the sweep gradient.
+     ///
+-    /// Note that all stops need to be in the same color space.
++    /// Stops in different color spaces built from inks (CMYK, luma as black, spots with a
++    /// CMYK fallback, DeviceN) are written in one space: Separation for a single spot,
++    /// DeviceCMYK for process colors alone, DeviceN otherwise. Other stops need to be in the
++    /// same color space.
+     pub stops: Vec<Stop>,
+     /// Whether the gradient should be anti-aliased.
+     pub anti_alias: bool,
+diff --git a/src/graphics/shading_function.rs b/src/graphics/shading_function.rs
+index 0b652a8..ad0e783 100644
+--- a/src/graphics/shading_function.rs
++++ b/src/graphics/shading_function.rs
+@@ -10,8 +10,10 @@ use tiny_skia_path::Point;
+ use crate::chunk_container::ChunkContainer;
+ use crate::configure::ValidationError;
+ use crate::geom::{Rect, Transform};
+-use crate::graphics::color::luma;
+-use crate::graphics::color::{Color, ColorSpace};
++use crate::graphics::color::device_n::{self, Colorant, DeviceNSpace, Process};
++use crate::graphics::color::separation::{self, SeparationColorant, SeparationSpace};
++use crate::graphics::color::{cmyk, luma};
++use crate::graphics::color::{Color, ColorSpace, RegularColor, SpecialColor};
+ use crate::graphics::paint::{LinearGradient, RadialGradient, SweepGradient};
+ use crate::graphics::paint::{SpreadMethod, Stop};
+ use crate::num::NormalizedF32;
+@@ -218,6 +220,11 @@ pub(crate) struct ShadingFunction(Arc<Repr>);
+ 
+ impl ShadingFunction {
+     pub(crate) fn new(properties: GradientProperties, use_opacities: bool) -> Self {
++        let properties = if use_opacities {
++            properties
++        } else {
++            properties.with_common_color_space()
++        };
+         Self(Arc::new(Repr {
+             properties,
+             use_opacities,
+@@ -225,6 +232,212 @@ impl ShadingFunction {
+     }
+ }
+ 
++impl GradientProperties {
++    /// Rewrite stops in different ink-based color spaces into one space (see
++    /// [`common_color_space`]); other gradients are returned unchanged.
++    fn with_common_color_space(self) -> Self {
++        fn convert(stops: &mut [Stop]) {
++            let colors: Vec<Color> = stops.iter().map(|s| s.color.clone()).collect();
++            if let Some(colors) = common_color_space(&colors) {
++                for (stop, color) in stops.iter_mut().zip(colors) {
++                    stop.color = color;
++                }
++            }
++        }
++
++        match self {
++            GradientProperties::RadialAxialGradient(mut rag) => {
++                convert(&mut rag.stops);
++                GradientProperties::RadialAxialGradient(rag)
++            }
++            GradientProperties::PostScriptGradient(mut psg) => {
++                convert(&mut psg.stops);
++                GradientProperties::PostScriptGradient(psg)
++            }
++        }
++    }
++}
++
++/// The inks of one gradient color: process tints and spot tints (0–255).
++struct Inks {
++    process: [u8; 4],
++    /// Process colorants a DeviceN color names, even at zero tint.
++    named_process: [bool; 4],
++    spots: Vec<(String, u8)>,
++}
++
++/// A spot named by a gradient color: the Separation space a stop used, and the CMYK
++/// alternate a DeviceN space needs.
++struct SpotInk {
++    name: String,
++    separation: Option<SeparationSpace>,
++    alternate: Option<cmyk::Color>,
++}
++
++/// Record a spot; the first Separation space and CMYK alternate seen for a name win.
++fn add_spot(
++    spot_inks: &mut Vec<SpotInk>,
++    name: &str,
++    separation: Option<&SeparationSpace>,
++    alternate: Option<cmyk::Color>,
++) {
++    match spot_inks.iter_mut().find(|s| s.name == name) {
++        Some(ink) => {
++            if ink.separation.is_none() {
++                ink.separation = separation.cloned();
++            }
++            if ink.alternate.is_none() {
++                ink.alternate = alternate;
++            }
++        }
++        None => spot_inks.push(SpotInk {
++            name: name.to_owned(),
++            separation: separation.cloned(),
++            alternate,
++        }),
++    }
++}
++
++fn same_color_space(a: &Color, b: &Color) -> bool {
++    match (a, b) {
++        (Color::Regular(a), Color::Regular(b)) => {
++            std::mem::discriminant(a) == std::mem::discriminant(b)
++        }
++        (
++            Color::Special(SpecialColor::Separation(a)),
++            Color::Special(SpecialColor::Separation(b)),
++        ) => a.space == b.space,
++        (Color::Special(SpecialColor::DeviceN(a)), Color::Special(SpecialColor::DeviceN(b))) => {
++            a.space == b.space
++        }
++        _ => false,
++    }
++}
++
++/// The colors rewritten in one color space when they are in different spaces built from
++/// inks (CMYK, gray as black, named spots with a CMYK fallback, DeviceN). `None` keeps
++/// them as they are: they share a space already, or one of them isn't made of inks.
++///
++/// A process colorant takes part when a color has it at a nonzero tint or a DeviceN color
++/// names it; a spot takes part when any color names it. One spot alone gives a Separation
++/// space, process colorants alone DeviceCMYK, anything else a DeviceN space with the
++/// process colorants in CMYK order, then the spots in the order the colors name them.
++/// Paper (CMYK 0 0 0 0, white, tint 0) adds no colorant, so a spot to paper stays a
++/// Separation gradient.
++pub(crate) fn common_color_space(colors: &[Color]) -> Option<Vec<Color>> {
++    let first = colors.first()?;
++    if colors.iter().all(|c| same_color_space(first, c)) {
++        return None;
++    }
++
++    let mut spot_inks: Vec<SpotInk> = Vec::new();
++    let mut all_inks = Vec::with_capacity(colors.len());
++    for color in colors {
++        let mut inks = Inks {
++            process: [0; 4],
++            named_process: [false; 4],
++            spots: Vec::new(),
++        };
++        match color {
++            Color::Regular(RegularColor::Cmyk(c)) => inks.process = [c.0, c.1, c.2, c.3],
++            Color::Regular(RegularColor::Luma(l)) => inks.process[3] = 255 - l.0,
++            Color::Regular(RegularColor::Rgb(_)) => return None,
++            Color::Special(SpecialColor::Separation(s)) => {
++                let SeparationColorant::Custom(name) = &s.space.colorant else {
++                    return None;
++                };
++                let alternate = match s.space.fallback {
++                    RegularColor::Cmyk(c) => Some(c),
++                    _ => None,
++                };
++                add_spot(&mut spot_inks, name, Some(&s.space), alternate);
++                inks.spots.push((name.clone(), s.tint));
++            }
++            Color::Special(SpecialColor::DeviceN(c)) => {
++                for (colorant, tint) in c.space.colorants().iter().zip(&c.tints) {
++                    match colorant {
++                        Colorant::Process(p) => {
++                            let i = Process::ALL.iter().position(|q| q == p).unwrap_or(0);
++                            inks.process[i] = *tint;
++                            inks.named_process[i] = true;
++                        }
++                        Colorant::Spot { name, alternate } => {
++                            add_spot(&mut spot_inks, name, None, Some(*alternate));
++                            inks.spots.push((name.clone(), *tint));
++                        }
++                    }
++                }
++            }
++        }
++        all_inks.push(inks);
++    }
++
++    let process: Vec<usize> = (0..4)
++        .filter(|&i| {
++            all_inks
++                .iter()
++                .any(|inks| inks.process[i] > 0 || inks.named_process[i])
++        })
++        .collect();
++    let spot_tint = |inks: &Inks, name: &str| {
++        inks.spots
++            .iter()
++            .find(|(n, _)| n == name)
++            .map_or(0, |(_, t)| *t)
++    };
++
++    match (process.as_slice(), spot_inks.as_slice()) {
++        (_, []) => Some(
++            all_inks
++                .iter()
++                .map(|inks| {
++                    let [c, m, y, k] = inks.process;
++                    cmyk::Color::new(c, m, y, k).into()
++                })
++                .collect(),
++        ),
++        ([], [spot]) => {
++            let space = match (&spot.separation, spot.alternate) {
++                (Some(space), _) => space.clone(),
++                (None, Some(alternate)) => SeparationSpace::new(
++                    SeparationColorant::Custom(spot.name.clone()),
++                    alternate.into(),
++                ),
++                (None, None) => return None,
++            };
++            Some(
++                all_inks
++                    .iter()
++                    .map(|inks| {
++                        separation::Color::new(spot_tint(inks, &spot.name), space.clone()).into()
++                    })
++                    .collect(),
++            )
++        }
++        _ => {
++            let mut colorants: Vec<Colorant> = process
++                .iter()
++                .map(|&i| Colorant::Process(Process::ALL[i]))
++                .collect();
++            for spot in &spot_inks {
++                colorants.push(Colorant::Spot {
++                    name: spot.name.clone(),
++                    alternate: spot.alternate?,
++                });
++            }
++            let space = DeviceNSpace::new(colorants)?;
++            all_inks
++                .iter()
++                .map(|inks| {
++                    let mut tints: Vec<u8> = process.iter().map(|&i| inks.process[i]).collect();
++                    tints.extend(spot_inks.iter().map(|s| spot_tint(inks, &s.name)));
++                    device_n::Color::new(tints, space.clone()).map(Color::from)
++                })
++                .collect()
++        }
++    }
++}
++
+ impl Cacheable for ShadingFunction {
+     fn serialize(
+         self,
+@@ -497,13 +710,21 @@ fn serialize_sweep_postscript(
+         properties.domain.bottom(),
+     ]);
+ 
++    postscript_function.range([0.0, 1.0].repeat(output_components(properties, use_opacities)));
++
++    root_ref
++}
++
++/// The number of values a PostScript gradient function returns.
++fn output_components(properties: &PostScriptGradient, use_opacities: bool) -> usize {
+     if use_opacities {
+-        postscript_function.range([0.0, 1.0]);
++        1
+     } else {
+-        postscript_function.range([0.0, 1.0, 0.0, 1.0, 0.0, 1.0]);
++        properties
++            .stops
++            .first()
++            .map_or(1, |s| s.color.to_pdf_color().len())
+     }
+-
+-    root_ref
+ }
+ 
+ const MAX_POSTSCRIPT_STOPS: usize = 97;
+@@ -563,11 +784,7 @@ fn serialize_linear_postscript(
+         properties.domain.bottom(),
+     ]);
+ 
+-    if use_opacities {
+-        postscript_function.range([0.0, 1.0]);
+-    } else {
+-        postscript_function.range([0.0, 1.0, 0.0, 1.0, 0.0, 1.0]);
+-    }
++    postscript_function.range([0.0, 1.0].repeat(output_components(properties, use_opacities)));
+ 
+     root_ref
+ }
diff --git a/vendor/krilla/patches/08-print-output-intent.patch b/vendor/krilla/patches/08-print-output-intent.patch
new file mode 100644
index 00000000..64a29f9b
--- /dev/null
+++ b/vendor/krilla/patches/08-print-output-intent.patch
@@ -0,0 +1,455 @@
+diff --git a/src/chunk_container.rs b/src/chunk_container.rs
+index 0530dd2..593302b 100644
+--- a/src/chunk_container.rs
++++ b/src/chunk_container.rs
+@@ -147,14 +147,12 @@ impl ChunkContainer {
+             sc.register_validation_error(ValidationError::NoDocumentTitle);
+         }
+ 
+-        // Write the PDF document info metadata.
+-        if let Some(metadata) = &self.metadata {
+-            metadata.serialize_document_info(
+-                &mut remapped_ref,
+-                &mut pdf,
+-                sc.serialize_settings().configuration,
+-            );
+-        }
++        // Write the PDF document info metadata, also without metadata when print markers need it.
++        let no_metadata = Metadata::default();
++        self.metadata
++            .as_ref()
++            .unwrap_or(&no_metadata)
++            .serialize_document_info(&mut remapped_ref, &mut pdf, &sc.serialize_settings());
+ 
+         let instance_id = stable_hash_base64(pdf.as_bytes());
+ 
+@@ -182,6 +180,7 @@ impl ChunkContainer {
+         let settings = sc.serialize_settings();
+         let validators = settings.validators();
+         validators.write_xmp(&mut xmp);
++        settings.write_print_xmp(&mut xmp);
+ 
+         xmp.num_pages(sc.page_infos().len() as u32);
+         xmp.format("application/pdf");
+diff --git a/src/configure/PDF_A1.md b/src/configure/PDF_A1.md
+index c525953..06b5243 100644
+--- a/src/configure/PDF_A1.md
++++ b/src/configure/PDF_A1.md
+@@ -64,7 +64,10 @@ with an even number of characters and without whitespaces. 🟢
+ 
+ 6.2.2:
+ - krilla always writes a valid output intent. 🟢
+-- krilla always only writes one output intent. 🟢
++- krilla writes one output intent, or with `SerializeSettings::output_intent` two
++  (`GTS_PDFA1` and `GTS_PDFX`) that name the same destination profile object. 🟢
++- krilla checks only that a profile given in `SerializeSettings::output_intent` has four
++  components; that it is an output (`prtr`) profile is up to the caller. 🟣
+ 
+ 6.2.3.1: krilla overrides the `no_device_cs` property if PDF/A is selected, and
+ in case CMYK is used but no profile was provided, export fails. 🟢
+@@ -73,7 +76,8 @@ in case CMYK is used but no profile was provided, export fails. 🟢
+ - sRGB/sGrey ICC profiles conform to ICC v2 specification. 🟢
+ 
+ 6.2.4.3: 
+-- krilla always uses sRGB for RGB, and in addition also embeds an sRGB output intent. 🟢
++- krilla always uses sRGB for RGB, with an sRGB output intent unless
++  `SerializeSettings::output_intent` gives a CMYK one. 🟢
+ - krilla always uses sGrey (except for encoding the alpha channel in images, where DeviceGray
+   is required), and in addition always embeds an output intent. 🟢
+ - krilla always uses an CMYK ICC profile, and always sets CMYK as the output intent. 🟢
+@@ -181,7 +185,9 @@ when a PostScript function is used. 🟢
+ 6.7.7: krilla writes a minimal `xmpMM:History` entry when a creation date is
+ provided. 🟢
+ 
+-6.7.8: krilla writes the extension schemas. 🟢
++6.7.8: krilla writes the extension schemas. `SerializeSettings::pdfx_version` would need one
++for `pdfxid:GTS_PDFXVersion`, which krilla does not write, so it is a validation error
++(`ValidationError::PdfxVersionWithoutExtensionSchema`). 🟢
+ 
+ 6.7.9: `xmp-writer` always produces valid XMP packets. 🟢
+ 
+diff --git a/src/configure/PDF_A2.md b/src/configure/PDF_A2.md
+index 9ff3593..7e3fd8f 100644
+--- a/src/configure/PDF_A2.md
++++ b/src/configure/PDF_A2.md
+@@ -60,7 +60,13 @@ user enables `ascii_compatible`, we still write a binary header marker. 🟢
+ - krilla doesn't use the `ri` or `i` operator. 🟢
+ - krilla ensure that content stream has their own associated resource dictionary. 🟢
+ 
+-6.2.3: krilla always write an `sRGB` output intent for PDF/A. 🟢
++6.2.3:
++- krilla writes an `sRGB` output intent for PDF/A, or the CMYK profile given in
++  `SerializeSettings::output_intent`. 🟢
++- krilla writes one output intent, or with `SerializeSettings::output_intent` two
++  (`GTS_PDFA1` and `GTS_PDFX`) that name the same destination profile object. 🟢
++- krilla checks only that a profile given in `SerializeSettings::output_intent` has four
++  components; that it is an output (`prtr`) profile is up to the caller. 🟣
+ 
+ 6.2.4.1: krilla overrides the `no_device_cs` property if PDF/A is selected, and
+ in case CMYK is used but no profile was provided, export fails.
+@@ -71,7 +77,8 @@ in case CMYK is used but no profile was provided, export fails.
+   all CMYK is ICCBased in this mode. 🟢
+ 
+ 6.2.4.3: 
+-- krilla always uses sRGB for RGB, and in addition also embeds an sRGB output intent. 🟢
++- krilla always uses sRGB for RGB, with an sRGB output intent unless
++  `SerializeSettings::output_intent` gives a CMYK one. 🟢
+ - krilla always uses sGrey (except for encoding the alpha channel in images, where DeviceGray
+   is required), and in addition always embeds an output intent. 🟢
+ - krilla always uses an CMYK ICC profile, and always sets CMYK as the output intent. 🟢
+@@ -190,7 +197,9 @@ always required. 🟢
+ 
+ 6.6.2.2: -
+ 
+-6.6.2.3.1: krilla doesn't use any non-standard properties. 🟢
++6.6.2.3.1: krilla doesn't use any non-standard properties. `SerializeSettings::pdfx_version`
++would write `pdfxid:GTS_PDFXVersion`, which needs an extension schema that krilla does not
++write, so it is a validation error (`ValidationError::PdfxVersionWithoutExtensionSchema`). 🟢
+ 
+ 6.6.2.3.2: krilla writes the extension schemas. 🟢
+ 
+diff --git a/src/configure/PDF_A4.md b/src/configure/PDF_A4.md
+index 7cd5df3..aac8008 100644
+--- a/src/configure/PDF_A4.md
++++ b/src/configure/PDF_A4.md
+@@ -59,16 +59,20 @@ See `README.md` for the meaning of each color.
+ ### 6.2.3 Output intent
+ - krilla always writes the output intent for this export mode. 🟢
+ - krilla does not use the `DestOutputProfileRef` attribute. 🟢
+-- krilla does not write multiple output intents (since PDF/X and PDF/E are not supported). 🟢
+-- krilla only uses a Display ICC profile for output intent. 🟢
+-- krilla only uses RGB for output intents. 🟢
++- krilla writes one output intent, or with `SerializeSettings::output_intent` two
++  (`GTS_PDFA1` and `GTS_PDFX`) that name the same destination profile object. 🟢
++- krilla uses the sRGB display profile for the output intent, or the CMYK profile given in
++  `SerializeSettings::output_intent`. 🟢
++- krilla checks only that a profile given in `SerializeSettings::output_intent` has four
++  components; that it is an output (`prtr`) profile is up to the caller. 🟣
+ 
+ ### 6.2.4 Colour spaces
+ - krilla only uses device-independent colors in this export mode. 🟢 
+ - krilla uses compatible ICC profiles. 🟢
+ - krilla fails export if overprint mode 1 is combined with fill or stroke overprint, since
+   all CMYK is ICCBased in this mode. 🟢
+-- krilla never uses CMYK profiles as the destination profile. 🟢
++- krilla uses a CMYK profile as the destination profile only when
++  `SerializeSettings::output_intent` gives one. 🟢
+ - krilla does not use device color spaces in this mode. 🟢
+ - krilla ensures the Alternate space in Separation color spaces obeys the restrictions
+   in the applicable clauses 🟢
+diff --git a/src/configure/validate.rs b/src/configure/validate.rs
+index 273f292..b0a8f03 100644
+--- a/src/configure/validate.rs
++++ b/src/configure/validate.rs
+@@ -142,6 +142,12 @@ pub enum ValidationError {
+     ///
+     /// [`Overprint`]: crate::blend::Overprint
+     OverprintModeIccCmyk(Option<Location>),
++    /// [`SerializeSettings::pdfx_version`] is set. Its XMP property
++    /// `pdfxid:GTS_PDFXVersion` needs a PDF/A extension schema, which krilla does not write;
++    /// PDF/A-1, -2 and -3 require one for every property outside the predefined schemas.
++    ///
++    /// [`SerializeSettings::pdfx_version`]: crate::SerializeSettings::pdfx_version
++    PdfxVersionWithoutExtensionSchema,
+     /// The PDF contains an embedded file.
+     EmbeddedFile(EmbedError, Option<Location>),
+     /// The PDF contains no tagging.
+@@ -558,6 +564,7 @@ impl Archival {
+                 | ValidationError::MissingDocumentDate
+                 | ValidationError::Transparency(_)
+                 | ValidationError::ImageInterpolation(_)
++                | ValidationError::PdfxVersionWithoutExtensionSchema
+                 | ValidationError::EmbeddedFile(EmbedError::Existence, _)
+                 | ValidationError::EmbeddedPDF(_),
+             ) => true,
+@@ -605,6 +612,7 @@ impl Archival {
+                 | ValidationError::MissingDocumentDate
+                 | ValidationError::ImageInterpolation(_)
+                 | ValidationError::OverprintModeIccCmyk(_)
++                | ValidationError::PdfxVersionWithoutExtensionSchema
+                 | ValidationError::EmbeddedPDF(_),
+             ) => true,
+             // Allowed under all PDF/A-2 and PDF/A-3 profiles.
+@@ -683,6 +691,7 @@ impl Archival {
+                 | ValidationError::TooManyIndirectObjects
+                 | ValidationError::TooHighQNestingLevel
+                 | ValidationError::ContainsPostScript(_)
++                | ValidationError::PdfxVersionWithoutExtensionSchema
+                 | ValidationError::NoDocumentLanguage
+                 | ValidationError::NoDocumentTitle
+                 | ValidationError::MissingAltText(_)
+@@ -1145,6 +1154,7 @@ impl Accessibility {
+                 | ValidationError::Transparency(_)
+                 | ValidationError::ImageInterpolation(_)
+                 | ValidationError::OverprintModeIccCmyk(_)
++                | ValidationError::PdfxVersionWithoutExtensionSchema
+                 | ValidationError::EmbeddedFile(
+                     EmbedError::Existence | EmbedError::MissingDate | EmbedError::MissingMimeType,
+                     _,
+diff --git a/src/interchange/metadata.rs b/src/interchange/metadata.rs
+index 18dde72..4cfc8e5 100644
+--- a/src/interchange/metadata.rs
++++ b/src/interchange/metadata.rs
+@@ -9,8 +9,8 @@ use pdf_writer::{Finish, Pdf, Ref, TextStr};
+ use std::cell::LazyCell;
+ use xmp_writer::{LangId, Timezone, XmpWriter};
+ 
+-use crate::configure::{Configuration, PdfVersion, ValidationError};
+-use crate::serialize::SerializeContext;
++use crate::configure::{PdfVersion, ValidationError};
++use crate::serialize::{SerializeContext, SerializeSettings};
+ 
+ /// Metadata for a PDF document.
+ #[derive(Default, Clone, Debug)]
+@@ -248,13 +248,14 @@ impl Metadata {
+         &self,
+         ref_: &mut Ref,
+         pdf: &mut Pdf,
+-        config: Configuration,
++        settings: &SerializeSettings,
+     ) {
++        let config = settings.configuration;
+         if config.validators().prohibits_info_dict() {
+             return;
+         }
+ 
+-        if self.has_document_info() {
++        if self.has_document_info() || settings.has_print_info(config.version()) {
+             let ref_ = ref_.bump();
+             let mut document_info = LazyCell::new(|| pdf.document_info(ref_));
+ 
+@@ -292,6 +293,10 @@ impl Metadata {
+                 document_info.modified_date(pdf_date(date_time));
+                 document_info.creation_date(pdf_date(date_time));
+             }
++
++            if settings.has_print_info(config.version()) {
++                settings.write_print_info(&mut document_info);
++            }
+         }
+     }
+ }
+diff --git a/src/lib.rs b/src/lib.rs
+index b331053..099a9d4 100644
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -176,10 +176,14 @@ pub use document::*;
+ pub use graphics::*;
+ pub use interactive::*;
+ pub use interchange::*;
+-pub use serialize::{GroupColorSpace, SerializeSettings};
++pub use serialize::{GroupColorSpace, OutputIntent, SerializeSettings, Trapped};
+ 
+ /// Identifies the local patch that discards unfinished page/surface state during unwind.
+ pub const CRAFT_UNWIND_SAFE_DROP: bool = true;
+ 
+ /// Identifies the patch that rejects serialization after failed page/surface cleanup.
+ pub const CRAFT_UNWIND_POISONING: bool = true;
++
++/// Identifies the print color patches: CMYK blending groups, print output intent and
++/// PDF/X markers.
++pub const CRAFT_PRINT_COLOR: bool = true;
+diff --git a/src/serialize.rs b/src/serialize.rs
+index d16261c..9b22240 100644
+--- a/src/serialize.rs
++++ b/src/serialize.rs
+@@ -6,9 +6,10 @@ use std::rc::Rc;
+ use std::sync::Arc;
+ 
+ use indexmap::IndexMap;
+-use pdf_writer::types::{StructRole, StructRole2};
+-use pdf_writer::writers::{OutputIntent, StructTreeRoot};
++use pdf_writer::types::{OutputIntentSubtype, StructRole, StructRole2, TrappingStatus};
++use pdf_writer::writers::{DocumentInfo, OutputIntent as OutputIntentWriter, StructTreeRoot};
+ use pdf_writer::{Chunk, Content, Finish, Limits, Name, Pdf, Ref, Settings, Str, TextStr};
++use xmp_writer::{Namespace, XmpWriter};
+ 
+ use crate::chunk_container::ChunkContainer;
+ use crate::color::{CieBasedColorSpace, DeviceColorSpace, SpecialColorSpace};
+@@ -121,6 +122,48 @@ pub struct SerializeSettings {
+     ///
+     /// See [`GroupColorSpace`].
+     pub group_color_space: GroupColorSpace,
++    /// The printing condition the document is prepared for, written as a `GTS_PDFX`
++    /// output intent. See [`OutputIntent`].
++    pub output_intent: Option<OutputIntent>,
++    /// Whether the document has been trapped: `/Trapped` in the document information
++    /// dictionary and `pdf:Trapped` in the XMP metadata.
++    pub trapped: Option<Trapped>,
++    /// The PDF/X version the caller claims, such as `PDF/X-4`: `/GTS_PDFXVersion` in the
++    /// document information dictionary and `pdfxid:GTS_PDFXVersion` in the XMP metadata.
++    ///
++    /// krilla does not check PDF/X conformance; the caller does. PDF/A-1, -2 and -3 need an
++    /// extension schema for the XMP property, which krilla does not write, so export under
++    /// them fails with [`ValidationError::PdfxVersionWithoutExtensionSchema`].
++    pub pdfx_version: Option<String>,
++}
++
++/// A CMYK printing condition, written as an `/OutputIntents` entry with `/S /GTS_PDFX`.
++///
++/// When a PDF/A validator is active, its `GTS_PDFA1` entry names the same profile and
++/// condition, because PDF/A requires all output intents to share one destination profile.
++#[derive(Clone, Debug, Hash, PartialEq, Eq)]
++pub struct OutputIntent {
++    /// The destination profile (`/DestOutputProfile`).
++    pub profile: ICCProfile<4>,
++    /// `/OutputConditionIdentifier`, such as `FOGRA39`, or `Custom`.
++    pub condition_identifier: String,
++    /// `/OutputCondition`: a human-readable description of the condition.
++    pub condition: Option<String>,
++    /// `/RegistryName`, such as `http://www.color.org`.
++    pub registry_name: Option<String>,
++    /// `/Info`: required by PDF/X when the identifier is not in the registry.
++    pub info: Option<String>,
++}
++
++/// The trapping state of a document.
++#[derive(Clone, Copy, Debug, Hash, PartialEq, Eq)]
++pub enum Trapped {
++    /// The document is fully trapped.
++    True,
++    /// The document has not been trapped.
++    False,
++    /// The document is partly trapped or the state is unknown.
++    Unknown,
+ }
+ 
+ /// The color space in which transparency groups blend.
+@@ -154,6 +197,45 @@ impl SerializeSettings {
+         self.configuration.validators()
+     }
+ 
++    /// Whether the document information dictionary carries print markers. Like the rest of
++    /// the dictionary, they are deprecated in PDF 2.0 and only written to XMP there.
++    pub(crate) fn has_print_info(&self, version: PdfVersion) -> bool {
++        version < PdfVersion::Pdf20 && (self.trapped.is_some() || self.pdfx_version.is_some())
++    }
++
++    pub(crate) fn write_print_info(&self, info: &mut DocumentInfo<'_>) {
++        if let Some(trapped) = self.trapped {
++            info.trapped(match trapped {
++                Trapped::True => TrappingStatus::Trapped,
++                Trapped::False => TrappingStatus::NotTrapped,
++                Trapped::Unknown => TrappingStatus::Unknown,
++            });
++        }
++        if let Some(version) = &self.pdfx_version {
++            info.pair(Name(b"GTS_PDFXVersion"), TextStr(version));
++        }
++    }
++
++    pub(crate) fn write_print_xmp(&self, xmp: &mut XmpWriter) {
++        match self.trapped {
++            Some(Trapped::True) => {
++                xmp.trapped(true);
++            }
++            Some(Trapped::False) => {
++                xmp.trapped(false);
++            }
++            // The Adobe PDF schema allows `Unknown`, which `XmpWriter::trapped` can't write.
++            // PDF/A-1 requires it to match the information dictionary.
++            Some(Trapped::Unknown) => {
++                xmp.element("Trapped", Namespace::AdobePdf).value("Unknown");
++            }
++            None => {}
++        }
++        if let Some(version) = &self.pdfx_version {
++            xmp.pdfx_version(version);
++        }
++    }
++
+     /// Whether the `/AF` key is supported, accounting for the PDF version and active standards.
+     pub(crate) fn supports_associated_files(&self) -> bool {
+         self.configuration.version().specifies_associated_files()
+@@ -174,6 +256,9 @@ impl Default for SerializeSettings {
+             enable_tagging: true,
+             render_svg_glyph_fn: |_, _, _, _, _| None,
+             group_color_space: GroupColorSpace::Rgb,
++            output_intent: None,
++            trapped: None,
++            pdfx_version: None,
+         }
+     }
+ }
+@@ -536,6 +621,9 @@ impl SerializeContext {
+         {
+             return Err(KrillaError::MissingGroupCmykProfile);
+         }
++        if self.serialize_settings.pdfx_version.is_some() {
++            self.register_validation_error(ValidationError::PdfxVersionWithoutExtensionSchema);
++        }
+ 
+         // We need to be careful here that we serialize the objects in the right order,
+         // as in some cases we use MaybeTake::take to remove an object, which means that
+@@ -781,18 +869,42 @@ impl SerializeContext {
+ impl SerializeContext {
+     fn serialize_destination_profiles(&mut self, chunk_container: &mut ChunkContainer) {
+         let validators = self.serialize_settings.validators();
+-        chunk_container.non_stream.destination_profiles =
+-            validators.output_intent().map(|subtype| {
+-                let root_ref = self.new_ref();
+-                let mut chunk = self.new_chunk();
++        let pdfa = validators.output_intent();
++        let print = self.serialize_settings.output_intent.clone();
++        if pdfa.is_none() && print.is_none() {
++            return;
++        }
++
++        let root_ref = self.new_ref();
++        let mut chunk = self.new_chunk();
++        let mut intents = Vec::new();
+ 
++        if let Some(print) = print {
++            let profile_ref = self.register_cacheable(chunk_container, print.profile.clone());
++            for subtype in pdfa.into_iter().chain([OutputIntentSubtype::PDFX]) {
+                 let oi_ref = self.new_ref();
+-                let mut oi = chunk.indirect(oi_ref).start::<OutputIntent>();
+-                let icc_profile = self.serialize_settings.pdf_version().rgb_icc();
++                let mut oi = chunk.indirect(oi_ref).start::<OutputIntentWriter>();
++                oi.dest_output_profile(profile_ref)
++                    .subtype(subtype)
++                    .output_condition_identifier(TextStr(&print.condition_identifier));
++                if let Some(condition) = &print.condition {
++                    oi.output_condition(TextStr(condition));
++                }
++                if let Some(registry_name) = &print.registry_name {
++                    oi.registry_name(TextStr(registry_name));
++                }
++                if let Some(info) = &print.info {
++                    oi.info(TextStr(info));
++                }
++                oi.finish();
++                intents.push(oi_ref);
++            }
++        } else if let Some(subtype) = pdfa {
++            let oi_ref = self.new_ref();
++            let mut oi = chunk.indirect(oi_ref).start::<OutputIntentWriter>();
++            let icc_profile = self.serialize_settings.pdf_version().rgb_icc();
+ 
+-                oi.dest_output_profile(
+-                    self.register_cacheable(chunk_container, icc_profile.clone()),
+-                )
++            oi.dest_output_profile(self.register_cacheable(chunk_container, icc_profile.clone()))
+                 .subtype(subtype)
+                 .output_condition_identifier(TextStr("Custom"))
+                 .output_condition(TextStr("sRGB"))
+@@ -805,14 +917,12 @@ impl SerializeContext {
+                     )
+                     .as_str(),
+                 ));
+-                oi.finish();
+-
+-                let mut array = chunk.indirect(root_ref).array();
+-                array.item(oi_ref);
+-                array.finish();
++            oi.finish();
++            intents.push(oi_ref);
++        }
+ 
+-                (root_ref, chunk)
+-            });
++        chunk.indirect(root_ref).array().items(intents);
++        chunk_container.non_stream.destination_profiles = Some((root_ref, chunk));
+     }
+ 
+     fn serialize_page_label_tree(&mut self, chunk_container: &mut ChunkContainer) {
diff --git a/vendor/krilla/patches/09-rendition-class.patch b/vendor/krilla/patches/09-rendition-class.patch
new file mode 100644
index 00000000..85230d68
--- /dev/null
+++ b/vendor/krilla/patches/09-rendition-class.patch
@@ -0,0 +1,18 @@
+diff --git a/src/chunk_container.rs b/src/chunk_container.rs
+index 593302b..978eacc 100644
+--- a/src/chunk_container.rs
++++ b/src/chunk_container.rs
+@@ -191,7 +191,12 @@ impl ChunkContainer {
+             instance_id.as_bytes().to_vec(),
+         ));
+ 
+-        xmp.rendition_class(RenditionClass::Proof);
++        // PdfCraft patch: a document written here is the master rendition, not a proof copy.
++        // `xmpMM:RenditionClass` says which rendition a file is (XMP Part 2, Media Management):
++        // `default` is the master, `proof` a proof copy. Writing `proof` on every file told a
++        // prepress system that a print deliverable was a proof, and PDF/X output carries it
++        // (storytold/designcraft#1207).
++        xmp.rendition_class(RenditionClass::Default);
+         sc.serialize_settings().pdf_version().write_xmp(&mut xmp);
+ 
+         let named_destinations = sc.global_objects.named_destinations.take();
diff --git a/vendor/krilla/patches/10-mesh-gradients.patch b/vendor/krilla/patches/10-mesh-gradients.patch
new file mode 100644
index 00000000..d2e93a7a
--- /dev/null
+++ b/vendor/krilla/patches/10-mesh-gradients.patch
@@ -0,0 +1,397 @@
+diff --git a/src/content.rs b/src/content.rs
+index f723f20..26ad665 100644
+--- a/src/content.rs
++++ b/src/content.rs
+@@ -1122,6 +1122,16 @@ impl ContentBuilder {
+                 let (gradient_props, transform) = sg.clone().gradient_properties(bounds);
+                 write_gradient(gradient_props, sc, chunk_container, transform, self);
+             }
++            InnerPaint::MeshGradient(mg) => {
++                let transform = mg.transform;
++                write_gradient(
++                    GradientProperties::MeshGradient(mg.clone()),
++                    sc,
++                    chunk_container,
++                    transform,
++                    self,
++                );
++            }
+             InnerPaint::Pattern(pat) => {
+                 let mut pat = Arc::unwrap_or_clone(pat.clone());
+                 pat.transform = pattern_transform(pat.transform);
+diff --git a/src/error.rs b/src/error.rs
+index 1807ac3..4c582ae 100644
+--- a/src/error.rs
++++ b/src/error.rs
+@@ -29,6 +29,11 @@ pub enum KrillaError {
+     ///
+     /// [`GroupColorSpace::Cmyk`]: crate::GroupColorSpace::Cmyk
+     MissingGroupCmykProfile,
++    /// A mesh gradient's corner colors are in color spaces that can't be written as one
++    /// (see [`MeshGradient`]), for example RGB with CMYK.
++    ///
++    /// [`MeshGradient`]: crate::paint::MeshGradient
++    MixedMeshColorSpaces(Option<Location>),
+     /// An error while attempting to embed a font.
+     Font(Font, String),
+     /// A list of validation errors. Can only occur if you set the `validator` in
+@@ -70,6 +75,10 @@ impl Display for KrillaError {
+             KrillaError::MissingGroupCmykProfile => {
+                 f.write_str("a CMYK group color space with no_device_cs needs a CMYK profile")
+             }
++            KrillaError::MixedMeshColorSpaces(location) => {
++                f.write_str("a mesh gradient mixes color spaces that can't be written as one")?;
++                write_location(f, *location)
++            }
+             KrillaError::Font(_, message) => write!(f, "failed to embed font: {message}"),
+             KrillaError::Validation(errors) => {
+                 let count = errors.len();
+diff --git a/src/graphics/mask.rs b/src/graphics/mask.rs
+index 2763a27..b526db9 100644
+--- a/src/graphics/mask.rs
++++ b/src/graphics/mask.rs
+@@ -99,6 +99,15 @@ impl Mask {
+                     return None;
+                 }
+             }
++            GradientProperties::MeshGradient(mg) => {
++                if mg
++                    .patches
++                    .iter()
++                    .all(|p| p.opacities.iter().all(|o| o.get() == 1.0))
++                {
++                    return None;
++                }
++            }
+         }
+ 
+         let shading_function = ShadingFunction::new(gradient_properties, true);
+diff --git a/src/graphics/paint.rs b/src/graphics/paint.rs
+index d4b9efb..abe8892 100644
+--- a/src/graphics/paint.rs
++++ b/src/graphics/paint.rs
+@@ -52,6 +52,65 @@ impl Hash for LinearGradient {
+     }
+ }
+ 
++/// One Coons patch of a [`MeshGradient`].
++#[derive(Debug, Clone, PartialEq)]
++pub struct MeshPatch {
++    /// The twelve boundary control points, in the order a PDF Type 6 shading lists them
++    /// (ISO 32000-1, 8.7.4.5.7): starting at a corner, three cubic Bézier edges' worth of points
++    /// going one way round the patch, so the corners are `points[0]`, `[3]`, `[6]` and `[9]`.
++    pub points: [(f32, f32); 12],
++    /// The colors at the corners `points[0]`, `[3]`, `[6]` and `[9]`.
++    ///
++    /// Corner colors of a mesh in different color spaces built from inks (CMYK, luma as
++    /// black, spots with a CMYK fallback, DeviceN) are written in one space: Separation for a
++    /// single spot, DeviceCMYK for process colors alone, DeviceN otherwise. Other colors need
++    /// to share one color space across the whole mesh, or [`Document::finish`] fails with
++    /// [`KrillaError::MixedMeshColorSpaces`].
++    ///
++    /// [`Document::finish`]: crate::Document::finish
++    /// [`KrillaError::MixedMeshColorSpaces`]: crate::error::KrillaError::MixedMeshColorSpaces
++    pub colors: [Color; 4],
++    /// The opacities at the same corners.
++    pub opacities: [NormalizedF32; 4],
++}
++
++impl Eq for MeshPatch {}
++
++impl Hash for MeshPatch {
++    fn hash<H: Hasher>(&self, state: &mut H) {
++        for (x, y) in &self.points {
++            x.to_bits().hash(state);
++            y.to_bits().hash(state);
++        }
++        self.colors.hash(state);
++        self.opacities.hash(state);
++    }
++}
++
++/// A mesh gradient: Coons patches, each blending its four corner colors across its curved
++/// shape, written as one PDF Type 6 shading so the viewer or RIP blends them smoothly at its
++/// own resolution. Corner opacities below 1 add a soft mask, as for the other gradients.
++/// Patches paint in order (a later one over an earlier one); a fill paints only where they lie.
++#[derive(Debug, Clone, PartialEq)]
++pub struct MeshGradient {
++    /// The patches.
++    pub patches: Vec<MeshPatch>,
++    /// A transform that should be applied to the mesh gradient.
++    pub transform: Transform,
++    /// Whether the gradient should be anti-aliased.
++    pub anti_alias: bool,
++}
++
++impl Eq for MeshGradient {}
++
++impl Hash for MeshGradient {
++    fn hash<H: Hasher>(&self, state: &mut H) {
++        self.patches.hash(state);
++        self.transform.hash(state);
++        self.anti_alias.hash(state);
++    }
++}
++
+ /// A radial gradient.
+ #[derive(Debug, Clone, PartialEq)]
+ pub struct RadialGradient {
+@@ -178,6 +237,7 @@ pub(crate) enum InnerPaint {
+     LinearGradient(LinearGradient),
+     RadialGradient(RadialGradient),
+     SweepGradient(SweepGradient),
++    MeshGradient(Arc<MeshGradient>),
+     Pattern(Arc<Pattern>),
+ }
+ 
+@@ -220,6 +280,12 @@ impl From<cmyk::Color> for Paint {
+     }
+ }
+ 
++impl From<MeshGradient> for Paint {
++    fn from(value: MeshGradient) -> Self {
++        Paint(InnerPaint::MeshGradient(Arc::new(value)))
++    }
++}
++
+ impl From<Color> for Paint {
+     fn from(value: Color) -> Self {
+         Paint(InnerPaint::Color(value))
+diff --git a/src/graphics/shading_function.rs b/src/graphics/shading_function.rs
+index ad0e783..74c56f3 100644
+--- a/src/graphics/shading_function.rs
++++ b/src/graphics/shading_function.rs
+@@ -4,6 +4,7 @@ use std::sync::Arc;
+ 
+ use bumpalo::Bump;
+ use pdf_writer::types::{FunctionShadingType, PostScriptOp};
++use pdf_writer::writers::StreamShadingType;
+ use pdf_writer::{Chunk, Finish, Ref};
+ use tiny_skia_path::Point;
+ 
+@@ -14,7 +15,7 @@ use crate::graphics::color::device_n::{self, Colorant, DeviceNSpace, Process};
+ use crate::graphics::color::separation::{self, SeparationColorant, SeparationSpace};
+ use crate::graphics::color::{cmyk, luma};
+ use crate::graphics::color::{Color, ColorSpace, RegularColor, SpecialColor};
+-use crate::graphics::paint::{LinearGradient, RadialGradient, SweepGradient};
++use crate::graphics::paint::{LinearGradient, MeshGradient, RadialGradient, SweepGradient};
+ use crate::graphics::paint::{SpreadMethod, Stop};
+ use crate::num::NormalizedF32;
+ use crate::resource;
+@@ -84,6 +85,7 @@ impl Hash for PostScriptGradient {
+ pub(crate) enum GradientProperties {
+     RadialAxialGradient(RadialAxialGradient),
+     PostScriptGradient(PostScriptGradient),
++    MeshGradient(Arc<MeshGradient>),
+ }
+ 
+ impl GradientProperties {
+@@ -100,6 +102,7 @@ impl GradientProperties {
+                     return Some((&psg.stops[0].color, psg.stops[0].opacity));
+                 }
+             }
++            GradientProperties::MeshGradient(_) => {}
+         }
+ 
+         None
+@@ -233,8 +236,8 @@ impl ShadingFunction {
+ }
+ 
+ impl GradientProperties {
+-    /// Rewrite stops in different ink-based color spaces into one space (see
+-    /// [`common_color_space`]); other gradients are returned unchanged.
++    /// Rewrite stops, or mesh corner colors, in different ink-based color spaces into one
++    /// space (see [`common_color_space`]); other gradients are returned unchanged.
+     fn with_common_color_space(self) -> Self {
+         fn convert(stops: &mut [Stop]) {
+             let colors: Vec<Color> = stops.iter().map(|s| s.color.clone()).collect();
+@@ -254,6 +257,22 @@ impl GradientProperties {
+                 convert(&mut psg.stops);
+                 GradientProperties::PostScriptGradient(psg)
+             }
++            GradientProperties::MeshGradient(mesh) => {
++                let colors: Vec<Color> = mesh
++                    .patches
++                    .iter()
++                    .flat_map(|p| p.colors.iter().cloned())
++                    .collect();
++                let Some(colors) = common_color_space(&colors) else {
++                    return GradientProperties::MeshGradient(mesh);
++                };
++                let mut mesh = Arc::unwrap_or_clone(mesh);
++                let corners = mesh.patches.iter_mut().flat_map(|p| p.colors.iter_mut());
++                for (corner, color) in corners.zip(colors) {
++                    *corner = color;
++                }
++                GradientProperties::MeshGradient(Arc::new(mesh))
++            }
+         }
+     }
+ }
+@@ -478,6 +497,35 @@ impl Cacheable for ShadingFunction {
+                     registered_cs,
+                 )
+             }
++            GradientProperties::MeshGradient(mg) => {
++                // No patches paints nothing; the shading is still written, as it is referenced.
++                let first = mg
++                    .patches
++                    .first()
++                    .map_or_else(|| luma::Color::black().into(), |p| p.colors[0].clone());
++                // `ShadingFunction::new` has brought ink-based colors into one space; any
++                // others left can't share the stream's one color space.
++                if !self.0.use_opacities
++                    && sc.mixed_mesh_colors.is_none()
++                    && !mg
++                        .patches
++                        .iter()
++                        .flat_map(|p| p.colors.iter())
++                        .all(|c| same_color_space(&first, c))
++                {
++                    sc.mixed_mesh_colors = Some(sc.location);
++                }
++                let shading_cs = shading_color_space(sc, first, self.0.use_opacities);
++                let registered_cs = sc.register_colorspace(chunk_container, shading_cs);
++                serialize_mesh_shading(
++                    sc,
++                    &mut stream_chunk,
++                    root_ref,
++                    mg,
++                    self.0.use_opacities,
++                    registered_cs,
++                );
++            }
+         }
+ 
+         // Note: The stream chunk might be empty.
+@@ -497,6 +545,83 @@ fn shading_color_space(sc: &mut SerializeContext, color: Color, use_opacities: b
+     }
+ }
+ 
++/// A mesh gradient as a Type 6 (Coons patch mesh) shading: per patch an 8-bit edge flag (0, no
++/// shared edge), the twelve points as 32-bit coordinates over the mesh's bounds (`Decode`), and
++/// the four corner colors (with `use_opacities`, the opacities as gray) at 8 bits a component,
++/// Flate-compressed. 32-bit coordinates keep the patches where they are to well under a printer
++/// dot, as Illustrator writes its meshes.
++fn serialize_mesh_shading(
++    sc: &mut SerializeContext,
++    chunk: &mut Chunk,
++    root_ref: Ref,
++    mesh: &MeshGradient,
++    use_opacities: bool,
++    cs: MaybeDeviceColorSpace,
++) {
++    let (mut x0, mut y0, mut x1, mut y1) = (f32::MAX, f32::MAX, f32::MIN, f32::MIN);
++    for (x, y) in mesh.patches.iter().flat_map(|p| p.points.iter()) {
++        (x0, y0, x1, y1) = (x0.min(*x), y0.min(*y), x1.max(*x), y1.max(*y));
++    }
++    if !(x0.is_finite() && y0.is_finite() && x1.is_finite() && y1.is_finite()) {
++        (x0, y0, x1, y1) = (0.0, 0.0, 1.0, 1.0);
++    }
++    // A zero-size range would divide by zero: widen it by a point either way.
++    if x1 - x0 < f32::EPSILON {
++        (x0, x1) = (x0 - 1.0, x1 + 1.0);
++    }
++    if y1 - y0 < f32::EPSILON {
++        (y0, y1) = (y0 - 1.0, y1 + 1.0);
++    }
++    let components = if use_opacities {
++        1
++    } else {
++        mesh.patches
++            .first()
++            .map_or(1, |p| p.colors[0].to_pdf_color().len())
++    };
++    let coord = |v: f32, lo: f32, hi: f32| {
++        (((f64::from(v) - f64::from(lo)) / (f64::from(hi) - f64::from(lo))).clamp(0.0, 1.0)
++            * f64::from(u32::MAX))
++        .round() as u32
++    };
++    let byte = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
++    let mut data = Vec::with_capacity(mesh.patches.len() * (1 + 12 * 8 + 4 * components));
++    for patch in &mesh.patches {
++        data.push(0u8);
++        for (x, y) in &patch.points {
++            data.extend(coord(*x, x0, x1).to_be_bytes());
++            data.extend(coord(*y, y0, y1).to_be_bytes());
++        }
++        for (color, opacity) in patch.colors.iter().zip(patch.opacities.iter()) {
++            if use_opacities {
++                data.push(byte(opacity.get()));
++            } else {
++                let values = color.to_pdf_color();
++                // Mixed spaces fail the document (`mixed_mesh_colors`); still never misread bytes.
++                for i in 0..components {
++                    data.push(byte(values.get(i).copied().unwrap_or(0.0)));
++                }
++            }
++        }
++    }
++    let filter_stream =
++        FilterStreamBuilder::new_from_binary_data(&data).finish(&sc.serialize_settings());
++    let mut shading = chunk.stream_shading(root_ref, filter_stream.encoded_data());
++    filter_stream.write_filters(shading.deref_mut().deref_mut());
++    shading.shading_type(StreamShadingType::CoonsPatch);
++    set_colorspace(cs, shading.deref_mut().deref_mut());
++    shading.bits_per_coordinate(32);
++    shading.bits_per_component(8);
++    shading.bits_per_flag(8);
++    let mut decode = vec![x0, x1, y0, y1];
++    for _ in 0..components {
++        decode.extend([0.0, 1.0]);
++    }
++    shading.decode(decode);
++    shading.anti_alias(mesh.anti_alias);
++    shading.finish();
++}
++
+ fn serialize_postscript_shading(
+     sc: &mut SerializeContext,
+     chunk: &mut Chunk,
+diff --git a/src/serialize.rs b/src/serialize.rs
+index 9b22240..587e2c6 100644
+--- a/src/serialize.rs
++++ b/src/serialize.rs
+@@ -353,6 +353,9 @@ pub(crate) enum MaybeDeviceColorSpace {
+ pub(crate) struct SerializeContext {
+     /// An unfinished or failed page/surface must never serialize as a complete document.
+     pub(crate) poisoned: bool,
++    /// Where the first mesh gradient whose corner colors share no color space was drawn;
++    /// [`SerializeContext::finish`] fails with [`KrillaError::MixedMeshColorSpaces`].
++    pub(crate) mixed_mesh_colors: Option<Option<Location>>,
+     /// The ref of the page tree.
+     page_tree_ref: Ref,
+     /// PDF 2.0 namespaces.
+@@ -413,6 +416,7 @@ impl SerializeContext {
+ 
+         Self {
+             poisoned: false,
++            mixed_mesh_colors: None,
+             cached_mappings: HashMap::new(),
+             pdf2_ns,
+             global_objects: GlobalObjects::default(),
+@@ -624,6 +628,9 @@ impl SerializeContext {
+         if self.serialize_settings.pdfx_version.is_some() {
+             self.register_validation_error(ValidationError::PdfxVersionWithoutExtensionSchema);
+         }
++        if let Some(location) = self.mixed_mesh_colors {
++            return Err(KrillaError::MixedMeshColorSpaces(location));
++        }
+ 
+         // We need to be careful here that we serialize the objects in the right order,
+         // as in some cases we use MaybeTake::take to remove an object, which means that
+diff --git a/src/surface.rs b/src/surface.rs
+index 0cbbc4b..15a728d 100644
+--- a/src/surface.rs
++++ b/src/surface.rs
+@@ -615,6 +615,10 @@ impl<'a> Surface<'a> {
+                 r.stops.iter().any(|s| s.opacity != NormalizedF32::ONE)
+             }
+             InnerPaint::SweepGradient(r) => r.stops.iter().any(|s| s.opacity != NormalizedF32::ONE),
++            InnerPaint::MeshGradient(m) => m
++                .patches
++                .iter()
++                .any(|p| p.opacities.iter().any(|o| *o != NormalizedF32::ONE)),
+             InnerPaint::Pattern(_) => false,
+         };
+ 
diff --git a/vendor/krilla/patches/11-png-decode-cap.patch b/vendor/krilla/patches/11-png-decode-cap.patch
new file mode 100644
index 00000000..aac3f2dc
--- /dev/null
+++ b/vendor/krilla/patches/11-png-decode-cap.patch
@@ -0,0 +1,280 @@
+diff --git a/src/graphics/image.rs b/src/graphics/image.rs
+index cf1728d..1c4f073 100644
+--- a/src/graphics/image.rs
++++ b/src/graphics/image.rs
+@@ -290,8 +290,8 @@ impl Image {
+ 
+     /// Create a new image from a custom image.
+     ///
+-    /// Panics if the dimensions of the image and the length of the
+-    /// data doesn't match.
++    /// Returns an error if the dimensions of the image and the length of the
++    /// data don't match.
+     pub fn from_custom<T: CustomImage>(image: T, interpolate: bool) -> Result<Image, String> {
+         let hash = (image.clone(), interpolate).sip_hash();
+         let mut metadata = ImageMetadata {
+@@ -312,22 +312,30 @@ impl Image {
+             );
+         }
+ 
+-        let num_components = metadata.num_components() as u32;
++        // Checked: 32 DeviceN components at 16 bits overflow `u32` at about 67 megapixels.
++        let bytes_per_component = usize::from(image.bits_per_component().as_u8() / 8);
++        let (width, height) = metadata.size;
++        let alpha_channel_len = usize::try_from(width)
++            .ok()
++            .zip(usize::try_from(height).ok())
++            .and_then(|(w, h)| w.checked_mul(h)?.checked_mul(bytes_per_component))
++            .ok_or("image dimensions are too large")?;
++        let color_channel_len = alpha_channel_len
++            .checked_mul(metadata.num_components())
++            .ok_or("image dimensions are too large")?;
++        if image.color_channel().len() != color_channel_len {
++            return Err("color channel length doesn't match the image dimensions".to_string());
++        }
++        if image
++            .alpha_channel()
++            .is_some_and(|alpha| alpha.len() != alpha_channel_len)
++        {
++            return Err("alpha channel length doesn't match the image dimensions".to_string());
++        }
++
+         Ok(Self(Arc::new(ImageRepr {
+             inner: Deferred::new(move || {
+-                let bytes_per_component = (image.bits_per_component().as_u8() / 8) as u32;
+-                let color_channel_len = bytes_per_component
+-                    * num_components
+-                    * metadata.size.0
+-                    * metadata.size.1;
+                 let color_channel = image.color_channel();
+-                assert_eq!(color_channel.len(), color_channel_len as usize);
+-
+-                let alpha_channel_len = bytes_per_component * metadata.size.0 * metadata.size.1;
+-                let alpha_channel = image.alpha_channel();
+-                if let Some(alpha_channel) = alpha_channel {
+-                    assert_eq!(alpha_channel.len(), alpha_channel_len as usize);
+-                }
+ 
+                 Ok(Repr::Sampled(SampledRepr {
+                     color_channel: deflate_encode(color_channel),
+@@ -356,7 +364,7 @@ impl Image {
+         Self(Arc::new(ImageRepr {
+             inner: Deferred::new(move || {
+                 let (color_channel, alpha_channel, bits_per_component) =
+-                    handle_u8_image(&data, ColorSpace::RGBA);
++                    handle_u8_image(&data, ColorSpace::RGBA)?;
+ 
+                 Ok(Repr::Sampled(SampledRepr {
+                     color_channel,
+@@ -555,6 +563,13 @@ fn png_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
+     let reader = decoder
+         .read_info()
+         .map_err(|e| e.to_string().to_ascii_lowercase())?;
++    // Craft patch: refused here too, so `Image::from_png` fails instead of the deferred decode.
++    if reader
++        .output_buffer_size()
++        .is_none_or(|n| n > MAX_DECODED_PNG_BYTES)
++    {
++        return Err("image is too large".to_string());
++    }
+     let info = reader.info();
+ 
+     let size = (info.width, info.height);
+@@ -589,6 +604,11 @@ fn png_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
+     })
+ }
+ 
++/// Craft patch: most bytes a PNG may decode to (16384 x 16384 RGBA8). The header alone sets the
++/// output size, so it is checked before any pixel data, and reserved fallibly, so that a bad
++/// image is an error instead of an allocation failure that ends the process.
++const MAX_DECODED_PNG_BYTES: usize = 1 << 30;
++
+ fn decode_png(data: &[u8]) -> Result<Repr, String> {
+     let cursor = Cursor::new(data);
+     let mut decoder = png::Decoder::new(cursor);
+@@ -596,7 +616,15 @@ fn decode_png(data: &[u8]) -> Result<Repr, String> {
+     let mut reader = decoder
+         .read_info()
+         .map_err(|e| e.to_string().to_ascii_lowercase())?;
+-    let mut img_data = vec![0; reader.output_buffer_size().ok_or("image is too large")?];
++    let size = reader
++        .output_buffer_size()
++        .filter(|&n| n <= MAX_DECODED_PNG_BYTES)
++        .ok_or("image is too large")?;
++    let mut img_data = Vec::new();
++    img_data
++        .try_reserve_exact(size)
++        .map_err(|_| "image is too large".to_string())?;
++    img_data.resize(size, 0);
+     let _ = reader
+         .next_frame(&mut img_data)
+         .map_err(|e| e.to_string())?;
+@@ -611,8 +639,8 @@ fn decode_png(data: &[u8]) -> Result<Repr, String> {
+     };
+ 
+     let (color_channel, alpha_channel, bits_per_component) = match bit_depth {
+-        BitDepth::Eight => handle_u8_image(&img_data, color_space),
+-        BitDepth::Sixteen => handle_u16_image(&img_data, color_space),
++        BitDepth::Eight => handle_u8_image(&img_data, color_space)?,
++        BitDepth::Sixteen => handle_u16_image(&img_data, color_space)?,
+         _ => return Err("image has an unsupported bit-depth".to_string()),
+     };
+ 
+@@ -698,7 +726,7 @@ fn decode_gif(data: Data) -> Result<Repr, String> {
+         .ok_or("GIF image seems to be empty".to_string())?;
+ 
+     let (color_channel, alpha_channel, bits_per_component) =
+-        handle_u8_image(first_frame.buffer.as_ref(), ColorSpace::RGBA);
++        handle_u8_image(first_frame.buffer.as_ref(), ColorSpace::RGBA)?;
+ 
+     Ok(Repr::Sampled(SampledRepr {
+         color_channel,
+@@ -756,7 +784,7 @@ fn decode_webp(data: Data) -> Result<Repr, String> {
+     };
+ 
+     let (color_channel, alpha_channel, bits_per_component) =
+-        handle_u8_image(&first_frame, color_space);
++        handle_u8_image(&first_frame, color_space)?;
+ 
+     Ok(Repr::Sampled(SampledRepr {
+         color_channel,
+@@ -765,9 +793,21 @@ fn decode_webp(data: Data) -> Result<Repr, String> {
+     }))
+ }
+ 
+-fn handle_u8_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, BitsPerComponent) {
++/// Craft patch: an empty vector with room for `capacity` bytes, or an error instead of the
++/// allocation failure that would end the process. Splitting a decoded image into colour and alpha
++/// briefly needs about twice its size beside the decoded pixels.
++fn try_buffer(capacity: usize) -> Result<Vec<u8>, String> {
++    let mut v = Vec::new();
++    v.try_reserve_exact(capacity)
++        .map_err(|_| "image is too large".to_string())?;
++    Ok(v)
++}
++
++type SplitImage = (Vec<u8>, Option<Vec<u8>>, BitsPerComponent);
++
++fn handle_u8_image(data: &[u8], cs: ColorSpace) -> Result<SplitImage, String> {
+     let mut alphas = if cs.has_alpha() {
+-        Vec::with_capacity(data.len() / cs.num_components())
++        try_buffer(data.len() / cs.num_components())?
+     } else {
+         Vec::new()
+     };
+@@ -775,7 +815,7 @@ fn handle_u8_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, Bi
+     let color_channel = match cs {
+         ColorSpace::RGB => deflate_encode(data),
+         ColorSpace::RGBA => {
+-            let mut buf = Vec::with_capacity(data.len() * 3 / 4);
++            let mut buf = try_buffer(data.len() * 3 / 4)?;
+             data.chunks_exact(4).for_each(|data| {
+                 buf.extend_from_slice(&data[0..3]);
+                 alphas.push(data[3]);
+@@ -784,7 +824,7 @@ fn handle_u8_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, Bi
+         }
+         ColorSpace::Luma => deflate_encode(data),
+         ColorSpace::LumaA => {
+-            let mut buf = Vec::with_capacity(data.len() / 2);
++            let mut buf = try_buffer(data.len() / 2)?;
+             data.chunks_exact(2).for_each(|data| {
+                 buf.push(data[0]);
+                 alphas.push(data[1]);
+@@ -801,12 +841,12 @@ fn handle_u8_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, Bi
+         None
+     };
+ 
+-    (color_channel, alpha_channel, BitsPerComponent::Eight)
++    Ok((color_channel, alpha_channel, BitsPerComponent::Eight))
+ }
+ 
+-fn handle_u16_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, BitsPerComponent) {
++fn handle_u16_image(data: &[u8], cs: ColorSpace) -> Result<SplitImage, String> {
+     let mut alphas = if cs.has_alpha() {
+-        Vec::with_capacity(data.len() / cs.num_components())
++        try_buffer(data.len() / cs.num_components())?
+     } else {
+         Vec::new()
+     };
+@@ -814,7 +854,7 @@ fn handle_u16_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, B
+     let encoded_image = match cs {
+         ColorSpace::RGB => deflate_encode(data),
+         ColorSpace::RGBA => {
+-            let mut buf = Vec::with_capacity(data.len() * 3 / 4);
++            let mut buf = try_buffer(data.len() * 3 / 4)?;
+             data.chunks_exact(8).for_each(|data| {
+                 buf.extend_from_slice(&data[0..6]);
+                 alphas.extend_from_slice(&data[6..]);
+@@ -823,7 +863,7 @@ fn handle_u16_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, B
+         }
+         ColorSpace::Luma => deflate_encode(data),
+         ColorSpace::LumaA => {
+-            let mut buf = Vec::with_capacity(data.len() / 2);
++            let mut buf = try_buffer(data.len() / 2)?;
+             data.chunks_exact(4).for_each(|data| {
+                 buf.extend_from_slice(&data[0..2]);
+                 alphas.extend_from_slice(&data[2..]);
+@@ -840,7 +880,7 @@ fn handle_u16_image(data: &[u8], cs: ColorSpace) -> (Vec<u8>, Option<Vec<u8>>, B
+         None
+     };
+ 
+-    (encoded_image, encoded_mask, BitsPerComponent::Sixteen)
++    Ok((encoded_image, encoded_mask, BitsPerComponent::Sixteen))
+ }
+ 
+ fn get_icc_profile_type(data: &[u8], color_space: ImageColorspace) -> Option<GenericICCProfile> {
+@@ -865,6 +905,54 @@ mod tests {
+         assert!(e.is_err());
+     }
+ 
++    /// A PNG whose header alone claims `width` x `height` RGBA16, with an empty IDAT.
++    fn png_header(width: u32, height: u32) -> Vec<u8> {
++        fn crc(bytes: &[u8]) -> u32 {
++            let mut c = !0u32;
++            for &b in bytes {
++                c ^= u32::from(b);
++                for _ in 0..8 {
++                    c = if c & 1 != 0 { 0xEDB8_8320 ^ (c >> 1) } else { c >> 1 };
++                }
++            }
++            !c
++        }
++        fn chunk(out: &mut Vec<u8>, kind: &[u8; 4], data: &[u8]) {
++            out.extend_from_slice(&(data.len() as u32).to_be_bytes());
++            let start = out.len();
++            out.extend_from_slice(kind);
++            out.extend_from_slice(data);
++            let sum = crc(&out[start..]);
++            out.extend_from_slice(&sum.to_be_bytes());
++        }
++        let mut out = b"\x89PNG\r\n\x1a\n".to_vec();
++        let mut ihdr = Vec::new();
++        ihdr.extend_from_slice(&width.to_be_bytes());
++        ihdr.extend_from_slice(&height.to_be_bytes());
++        ihdr.extend_from_slice(&[16, 6, 0, 0, 0]);
++        chunk(&mut out, b"IHDR", &ihdr);
++        chunk(&mut out, b"IDAT", &[0x78, 0x9C, 0x03, 0x00, 0x00, 0x00, 0x00, 0x01]);
++        chunk(&mut out, b"IEND", &[]);
++        out
++    }
++
++    #[test]
++    fn a_png_header_claiming_a_huge_image_is_refused_before_allocating() {
++        // 65535 x 65535 RGBA16 would be 34 GB of output.
++        let huge = png_header(65_535, 65_535);
++        assert!(Image::from_png(Arc::new(huge.clone()).into(), false).is_err());
++        assert!(super::decode_png(&huge).is_err());
++    }
++
++    #[test]
++    fn rgba_split_buffers_are_reserved_fallibly() {
++        assert!(super::try_buffer(usize::MAX).is_err());
++        let (color, alpha, _) = super::handle_u8_image(&[1, 2, 3, 128, 4, 5, 6, 255], super::ColorSpace::RGBA).unwrap();
++        assert!(!color.is_empty() && alpha.is_some());
++        let (_, alpha, _) = super::handle_u16_image(&[0; 16], super::ColorSpace::RGBA).unwrap();
++        assert!(alpha.is_some());
++    }
++
+     #[test]
+     fn invalid_jpeg_image() {
+         let e = Image::from_jpeg(Arc::new(b"dfngiudfg".to_vec()).into(), false);
diff --git a/vendor/krilla/patches/12-optional-content.patch b/vendor/krilla/patches/12-optional-content.patch
new file mode 100644
index 00000000..c211ad62
--- /dev/null
+++ b/vendor/krilla/patches/12-optional-content.patch
@@ -0,0 +1,709 @@
+diff --git a/src/chunk_container.rs b/src/chunk_container.rs
+index 978eacc..023784f 100644
+--- a/src/chunk_container.rs
++++ b/src/chunk_container.rs
+@@ -55,6 +55,7 @@ pub(crate) struct NonStreamChunks {
+     pub(crate) patterns: Chunk,
+     pub(crate) pages: Chunk,
+     pub(crate) embedded_files: Chunk,
++    pub(crate) optional_content: Chunk,
+ }
+ 
+ impl ChunkContainer {
+@@ -93,6 +94,7 @@ impl ChunkContainer {
+                 patterns: sc.new_chunk(),
+                 pages: sc.new_chunk(),
+                 embedded_files: sc.new_chunk(),
++                optional_content: sc.new_chunk(),
+             },
+         }
+     }
+@@ -345,6 +347,9 @@ impl ChunkContainer {
+                 }
+             }
+ 
++            sc.optional_content
++                .write_catalog_entries(&mut catalog, &remapper);
++
+             catalog.finish();
+         }
+ 
+@@ -441,6 +446,7 @@ impl Visit for NonStreamChunks {
+         self.patterns.visit(sc, f)?;
+         self.pages.visit(sc, f)?;
+         self.embedded_files.visit(sc, f)?;
++        self.optional_content.visit(sc, f)?;
+ 
+         Ok(())
+     }
+diff --git a/src/configure/PDF_A1.md b/src/configure/PDF_A1.md
+index 06b5243..a4c7bc3 100644
+--- a/src/configure/PDF_A1.md
++++ b/src/configure/PDF_A1.md
+@@ -58,7 +58,8 @@ with an even number of characters and without whitespaces. 🟢
+   DeviceN colorants is never reached. 🟢
+ - krilla only uses u16 for CIDs. 🟢
+ 
+-6.1.13: krilla does not support optional content. 🔵
++6.1.13: krilla fails export if an optional content group is added
++(`ValidationError::OptionalContent`), so the catalog never has `OCProperties`. 🟢
+ 
+ ## 6.2 Graphics
+ 
+diff --git a/src/configure/PDF_A2.md b/src/configure/PDF_A2.md
+index 7e3fd8f..69acde5 100644
+--- a/src/configure/PDF_A2.md
++++ b/src/configure/PDF_A2.md
+@@ -222,7 +222,9 @@ krilla prohibits embedding files in this export mode. 🟢
+ 
+ # 6.9 Optional content
+ 
+-krilla does not support optional content. 🔵
++- krilla writes every optional content group with a `Name`. 🟢
++- krilla writes one optional content configuration, `D`, with the `Name` `Layers`, an `Order`
++  array that lists every group, and no `AS` key. 🟢
+ 
+ # 6.10 Use of alternate presentations and transitions
+ 
+diff --git a/src/configure/PDF_A4.md b/src/configure/PDF_A4.md
+index aac8008..be1314b 100644
+--- a/src/configure/PDF_A4.md
++++ b/src/configure/PDF_A4.md
+@@ -191,7 +191,9 @@ See `README.md` for the meaning of each color.
+ - krilla straight out forbids embedding files in this export mode. 🟢
+ 
+ ## 6.10 Optional content
+-- krilla does not support optional content. 🟢
++- krilla writes every optional content group with a `Name`. 🟢
++- krilla writes one optional content configuration, `D`, with the `Name` `Layers`, an `Order`
++  array that lists every group, and no `AS` key. 🟢
+ 
+ ## 6.11 Use of alternate presentations and transitions
+ - krilla does not use the `AlternatePresentations` entry. 🟢
+diff --git a/src/configure/PDF_UA1.md b/src/configure/PDF_UA1.md
+index 16959bb..80449b8 100644
+--- a/src/configure/PDF_UA1.md
++++ b/src/configure/PDF_UA1.md
+@@ -87,7 +87,7 @@ See `README.md` for the meaning of each color.
+ - krilla always generates an ID for notes. 🟢
+ 
+ # 7.10 Optional content
+-- krilla does currently not support optional content. 🔵
++- krilla writes its one optional content configuration, `D`, with a `Name`. 🟢
+ 
+ # 7.11 Embedded files
+ - krilla supports embedded files, and requires a description in this export mode. 🟢
+diff --git a/src/configure/validate.rs b/src/configure/validate.rs
+index b0a8f03..fb429ce 100644
+--- a/src/configure/validate.rs
++++ b/src/configure/validate.rs
+@@ -159,6 +159,12 @@ pub enum ValidationError {
+     EmbeddedPDF(Option<Location>),
+     /// A feature only available in a later PDF version was required.
+     RequiresNewerPdfVersion(VersionedFeature, Option<Location>),
++    /// The PDF contains optional content groups, which PDF/A-1 forbids.
++    ///
++    /// Occurs if [`Document::add_optional_content_group`] was called.
++    ///
++    /// [`Document::add_optional_content_group`]: crate::Document::add_optional_content_group
++    OptionalContent(Option<Location>),
+ }
+ 
+ /// Features that may require a later PDF version than the current one.
+@@ -170,6 +176,8 @@ pub enum VersionedFeature {
+     HeaderFooterArtifactSubtypes,
+     /// Scope attribute for table header cells.
+     TableHeaderScope,
++    /// Optional content groups (layers).
++    OptionalContent,
+ }
+ 
+ impl VersionedFeature {
+@@ -179,6 +187,7 @@ impl VersionedFeature {
+             VersionedFeature::StructureOrderTabbing => PdfVersion::Pdf15,
+             VersionedFeature::HeaderFooterArtifactSubtypes => PdfVersion::Pdf17,
+             VersionedFeature::TableHeaderScope => PdfVersion::Pdf15,
++            VersionedFeature::OptionalContent => PdfVersion::Pdf15,
+         }
+     }
+ }
+@@ -566,7 +575,8 @@ impl Archival {
+                 | ValidationError::ImageInterpolation(_)
+                 | ValidationError::PdfxVersionWithoutExtensionSchema
+                 | ValidationError::EmbeddedFile(EmbedError::Existence, _)
+-                | ValidationError::EmbeddedPDF(_),
++                | ValidationError::EmbeddedPDF(_)
++                | ValidationError::OptionalContent(_),
+             ) => true,
+             // Allowed under all PDF/A-1 profiles.
+             (
+@@ -582,7 +592,8 @@ impl Archival {
+                 | ValidationError::RequiresNewerPdfVersion(
+                     VersionedFeature::HeaderFooterArtifactSubtypes
+                     | VersionedFeature::StructureOrderTabbing
+-                    | VersionedFeature::TableHeaderScope,
++                    | VersionedFeature::TableHeaderScope
++                    | VersionedFeature::OptionalContent,
+                     _,
+                 ),
+             ) => false,
+@@ -628,9 +639,11 @@ impl Archival {
+                 | ValidationError::RequiresNewerPdfVersion(
+                     VersionedFeature::HeaderFooterArtifactSubtypes
+                     | VersionedFeature::StructureOrderTabbing
+-                    | VersionedFeature::TableHeaderScope,
++                    | VersionedFeature::TableHeaderScope
++                    | VersionedFeature::OptionalContent,
+                     _,
+-                ),
++                )
++                | ValidationError::OptionalContent(_),
+             ) => false,
+             // Forbidden under PDF/A-2 but allowed under PDF/A-3.
+             (
+@@ -707,9 +720,11 @@ impl Archival {
+                 | ValidationError::RequiresNewerPdfVersion(
+                     VersionedFeature::HeaderFooterArtifactSubtypes
+                     | VersionedFeature::StructureOrderTabbing
+-                    | VersionedFeature::TableHeaderScope,
++                    | VersionedFeature::TableHeaderScope
++                    | VersionedFeature::OptionalContent,
+                     _,
+-                ),
++                )
++                | ValidationError::OptionalContent(_),
+             ) => false,
+             // Forbidden under PDF/A-4 but allowed under other PDF/A-4 profiles.
+             (
+@@ -1133,7 +1148,8 @@ impl Accessibility {
+                 | ValidationError::RequiresNewerPdfVersion(
+                     VersionedFeature::HeaderFooterArtifactSubtypes
+                     | VersionedFeature::StructureOrderTabbing
+-                    | VersionedFeature::TableHeaderScope,
++                    | VersionedFeature::TableHeaderScope
++                    | VersionedFeature::OptionalContent,
+                     _,
+                 ),
+             ) => true,
+@@ -1159,7 +1175,8 @@ impl Accessibility {
+                     EmbedError::Existence | EmbedError::MissingDate | EmbedError::MissingMimeType,
+                     _,
+                 )
+-                | ValidationError::MissingDocumentDate,
++                | ValidationError::MissingDocumentDate
++                | ValidationError::OptionalContent(_),
+             ) => false,
+         }
+     }
+diff --git a/src/content.rs b/src/content.rs
+index 26ad665..68779d6 100644
+--- a/src/content.rs
++++ b/src/content.rs
+@@ -22,6 +22,7 @@ use crate::graphics::graphics_state::{ExtGState, GraphicsStates};
+ #[cfg(feature = "raster-images")]
+ use crate::graphics::image::Image;
+ use crate::graphics::mask::Mask;
++use crate::graphics::optional_content::{self, OpenMarks};
+ use crate::graphics::paint::{Fill, FillRule, InnerPaint, LineCap, LineJoin, Paint, Stroke};
+ use crate::graphics::shading_function::{
+     GradientProperties, GradientPropertiesExt, ShadingFunction,
+@@ -42,8 +43,8 @@ use crate::text::{Glyph, GlyphId};
+ use crate::util::{calculate_stroke_bbox, NameExt};
+ 
+ pub(crate) struct ContentBuilder {
+-    rd_builder: ResourceDictionaryBuilder,
+-    content: Content,
++    pub(crate) rd_builder: ResourceDictionaryBuilder,
++    pub(crate) content: Content,
+     validation_errors: HashSet<ValidationError>,
+     root_transform: Transform,
+     graphics_states: GraphicsStates,
+@@ -57,6 +58,7 @@ pub(crate) struct ContentBuilder {
+     /// A temporary buffer that's reused across the builder.
+     scratch: Vec<u8>,
+     pub(crate) active_marked_content: bool,
++    pub(crate) optional_content: OpenMarks,
+ }
+ 
+ /// Stores either a device-specific color space,
+@@ -84,6 +86,7 @@ impl ContentBuilder {
+             bbox: None,
+             scratch: Vec::new(),
+             active_marked_content: false,
++            optional_content: OpenMarks::default(),
+         }
+     }
+ 
+@@ -96,7 +99,8 @@ impl ContentBuilder {
+         }
+     }
+ 
+-    pub(crate) fn finish(self, sc: &mut SerializeContext) -> Stream {
++    pub(crate) fn finish(mut self, sc: &mut SerializeContext) -> Stream {
++        optional_content::close_open_marks(&mut self, sc);
+         let buf = self.content.finish();
+         sc.register_limits(buf.limits());
+ 
+@@ -153,6 +157,7 @@ impl ContentBuilder {
+             panic!("can't end marked content when none has been started");
+         }
+ 
++        self.optional_content.tag_ended();
+         self.content.end_marked_content();
+         self.active_marked_content = false;
+     }
+diff --git a/src/error.rs b/src/error.rs
+index 4c582ae..a19ebf6 100644
+--- a/src/error.rs
++++ b/src/error.rs
+@@ -34,6 +34,15 @@ pub enum KrillaError {
+     ///
+     /// [`MeshGradient`]: crate::paint::MeshGradient
+     MixedMeshColorSpaces(Option<Location>),
++    /// [`Surface::start_optional_content`] was given an [`OcgId`] that this document did
++    /// not create.
++    ///
++    /// [`Surface::start_optional_content`]: crate::surface::Surface::start_optional_content
++    /// [`OcgId`]: crate::optional_content::OcgId
++    UnknownOptionalContentGroup(Option<Location>),
++    /// Optional content marks were not balanced: an end without a start, a mark still open
++    /// when its stream finished, or a mark overlapping a tagged section.
++    UnbalancedOptionalContent(Option<Location>),
+     /// An error while attempting to embed a font.
+     Font(Font, String),
+     /// A list of validation errors. Can only occur if you set the `validator` in
+@@ -79,6 +88,14 @@ impl Display for KrillaError {
+                 f.write_str("a mesh gradient mixes color spaces that can't be written as one")?;
+                 write_location(f, *location)
+             }
++            KrillaError::UnknownOptionalContentGroup(location) => {
++                f.write_str("an optional content group from another document was used")?;
++                write_location(f, *location)
++            }
++            KrillaError::UnbalancedOptionalContent(location) => {
++                f.write_str("optional content marks are not balanced")?;
++                write_location(f, *location)
++            }
+             KrillaError::Font(_, message) => write!(f, "failed to embed font: {message}"),
+             KrillaError::Validation(errors) => {
+                 let count = errors.len();
+diff --git a/src/graphics/mod.rs b/src/graphics/mod.rs
+index 57e9406..3864d6e 100644
+--- a/src/graphics/mod.rs
++++ b/src/graphics/mod.rs
+@@ -6,6 +6,7 @@ pub mod icc;
+ #[cfg(feature = "raster-images")]
+ pub mod image;
+ pub mod mask;
++pub mod optional_content;
+ pub mod paint;
+ pub(crate) mod device_n;
+ pub(crate) mod separation;
+diff --git a/src/graphics/optional_content.rs b/src/graphics/optional_content.rs
+new file mode 100644
+index 0000000..45c135f
+--- /dev/null
++++ b/src/graphics/optional_content.rs
+@@ -0,0 +1,266 @@
++//! Optional content (layers).
++//!
++//! An optional content group (OCG) is a named layer that a viewer can show or hide. Create
++//! groups on the [`Document`] with [`Document::add_optional_content_group`], then mark
++//! content on any surface with [`Surface::start_optional_content`] and
++//! [`Surface::end_optional_content`].
++//!
++//! Every group is written once as `<< /Type /OCG /Name (…) >>`, and the catalog gets
++//! `/OCProperties` listing all groups, also those that no page uses, with the hidden ones
++//! in the default configuration's `/OFF` array. Marked content is written as
++//! `/OC /ocN BDC … EMC`, with `/ocN` registered in the `/Properties` resources of the
++//! stream that holds it.
++//!
++//! Optional content marks nest independently of tagged sections, but they must not overlap
++//! them: a tagged section started inside a mark ends before the mark does, and a mark started
++//! inside a tagged section ends before the section does. Marks are balanced per stream: a mark
++//! started before [`Surface::push_group`] (or any other push that starts a new stream, such as
++//! an opacity or a mask) can't be ended inside it.
++//!
++//! Optional content needs PDF 1.5 and is forbidden in PDF/A-1.
++//!
++//! [`Surface::push_group`]: crate::surface::Surface::push_group
++
++use std::collections::HashMap;
++
++use pdf_writer::types::PageMode;
++use pdf_writer::writers::{self, Catalog};
++use pdf_writer::{Dict, Finish, Name, Ref, TextStr};
++
++use crate::configure::validate::VersionedFeature;
++use crate::configure::ValidationError;
++use crate::content::ContentBuilder;
++use crate::document::Document;
++use crate::error::{KrillaError, KrillaResult};
++use crate::resource::{Resource, ResourceDictionaryBuilder, ResourceMapper};
++use crate::serialize::SerializeContext;
++use crate::surface::{Location, Surface};
++use crate::util::NameExt;
++
++/// An optional content group of a [`Document`], returned by
++/// [`Document::add_optional_content_group`].
++///
++/// An id is only meaningful for the document that created it.
++#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
++pub struct OcgId(usize);
++
++struct Group {
++    ref_: Ref,
++    visible: bool,
++}
++
++/// The document's optional content groups and settings.
++#[derive(Default)]
++pub(crate) struct OptionalContent {
++    groups: Vec<Group>,
++    page_mode: bool,
++    /// Where the first unbalanced or overlapping mark was found;
++    /// [`SerializeContext::finish`] fails with [`KrillaError::UnbalancedOptionalContent`].
++    pub(crate) misuse: Option<Option<Location>>,
++}
++
++impl OptionalContent {
++    fn group_ref(&self, id: OcgId) -> Option<Ref> {
++        self.groups.get(id.0).map(|g| g.ref_)
++    }
++
++    fn record_misuse(&mut self, location: Option<Location>) {
++        self.misuse.get_or_insert(location);
++    }
++
++    /// Writes `/OCProperties`, and `/PageMode /UseOC` when requested, if any group exists.
++    pub(crate) fn write_catalog_entries(
++        &self,
++        catalog: &mut Catalog<'_>,
++        remapper: &HashMap<Ref, Ref>,
++    ) {
++        if self.groups.is_empty() {
++            return;
++        }
++
++        let all: Vec<Ref> = self
++            .groups
++            .iter()
++            .filter_map(|g| remapper.get(&g.ref_).copied())
++            .collect();
++        let hidden: Vec<Ref> = self
++            .groups
++            .iter()
++            .filter(|g| !g.visible)
++            .filter_map(|g| remapper.get(&g.ref_).copied())
++            .collect();
++
++        let mut properties = catalog.insert(Name(b"OCProperties")).dict();
++        properties
++            .insert(Name(b"OCGs"))
++            .array()
++            .items(all.iter().copied());
++        let mut config = properties.insert(Name(b"D")).dict();
++        config.pair(Name(b"Name"), TextStr("Layers"));
++        config
++            .insert(Name(b"Order"))
++            .array()
++            .items(all.iter().copied());
++        if !hidden.is_empty() {
++            config.insert(Name(b"OFF")).array().items(hidden);
++        }
++        config.finish();
++        properties.finish();
++
++        if self.page_mode {
++            catalog.page_mode(PageMode::UseOC);
++        }
++    }
++}
++
++impl Document {
++    /// Add an optional content group (a layer) named `name`, shown when the document opens
++    /// if `visible` is true.
++    ///
++    /// The group is listed in the catalog's `/OCProperties` even if no content uses it.
++    /// Names are text strings, so any Unicode name works; they need not be unique.
++    ///
++    /// Optional content needs PDF 1.5 and is forbidden in PDF/A-1: adding a group registers
++    /// [`ValidationError::OptionalContent`] and, below PDF 1.5,
++    /// [`ValidationError::RequiresNewerPdfVersion`].
++    pub fn add_optional_content_group(&mut self, name: impl Into<String>, visible: bool) -> OcgId {
++        let sc = &mut self.serializer_context;
++        let name = name.into();
++
++        sc.register_validation_error(ValidationError::OptionalContent(sc.location));
++        if sc.serialize_settings().pdf_version()
++            < VersionedFeature::OptionalContent.minimum_pdf_version()
++        {
++            sc.register_validation_error(ValidationError::RequiresNewerPdfVersion(
++                VersionedFeature::OptionalContent,
++                sc.location,
++            ));
++        }
++
++        let ref_ = sc.new_ref();
++        let mut ocg = self
++            .chunk_container
++            .non_stream
++            .optional_content
++            .indirect(ref_)
++            .dict();
++        ocg.pair(Name(b"Type"), Name(b"OCG"));
++        ocg.pair(Name(b"Name"), TextStr(&name));
++        ocg.finish();
++
++        let groups = &mut sc.optional_content.groups;
++        groups.push(Group { ref_, visible });
++        OcgId(groups.len() - 1)
++    }
++
++    /// Whether the document opens with the viewer's layers panel showing
++    /// (`/PageMode /UseOC`). Only written when the document has optional content groups.
++    /// Off by default.
++    pub fn set_optional_content_page_mode(&mut self, use_oc: bool) {
++        self.serializer_context.optional_content.page_mode = use_oc;
++    }
++}
++
++impl Surface<'_> {
++    /// Start content that belongs to the optional content group `group`, until the matching
++    /// [`Surface::end_optional_content`].
++    ///
++    /// Marks nest, and a mark may contain tagged sections (see the [module
++    /// documentation](crate::optional_content) for the nesting rules). Content left open
++    /// when the surface finishes, or when a group, opacity or mask pushed after the start
++    /// is popped, is closed there, and [`Document::finish`] then fails with
++    /// [`KrillaError::UnbalancedOptionalContent`].
++    ///
++    /// Returns [`KrillaError::UnknownOptionalContentGroup`] and writes nothing if `group`
++    /// does not belong to this document.
++    pub fn start_optional_content(&mut self, group: OcgId) -> KrillaResult<()> {
++        let (builder, sc) = self.content_and_context();
++        let Some(ocg) = sc.optional_content.group_ref(group) else {
++            return Err(KrillaError::UnknownOptionalContentGroup(sc.location));
++        };
++
++        let name = builder.rd_builder.register_resource(Properties(ocg));
++        builder
++            .content
++            .begin_marked_content_with_properties(Name(b"OC"))
++            .properties_named(name.to_pdf_name());
++        let tagged = builder.active_marked_content;
++        builder.optional_content.open.push(tagged);
++        Ok(())
++    }
++
++    /// End the innermost optional content started with [`Surface::start_optional_content`]
++    /// in the current stream.
++    ///
++    /// Returns [`KrillaError::UnbalancedOptionalContent`] and writes nothing if no optional
++    /// content is open in the current stream, or if a tagged section started inside it is
++    /// still open.
++    pub fn end_optional_content(&mut self) -> KrillaResult<()> {
++        let (builder, sc) = self.content_and_context();
++        let tagged = builder.active_marked_content;
++        if builder.optional_content.open.last() != Some(&tagged) {
++            return Err(KrillaError::UnbalancedOptionalContent(sc.location));
++        }
++
++        builder.optional_content.open.pop();
++        builder.content.end_marked_content();
++        Ok(())
++    }
++}
++
++/// The optional content marks open in one content stream. Each entry records whether a
++/// tagged section was open when the mark started.
++#[derive(Default)]
++pub(crate) struct OpenMarks {
++    open: Vec<bool>,
++    overlap: bool,
++}
++
++impl OpenMarks {
++    /// Called when a tagged section ends: a mark started inside it would be closed by its
++    /// `EMC`.
++    pub(crate) fn tag_ended(&mut self) {
++        if self.open.last() == Some(&true) {
++            self.overlap = true;
++        }
++    }
++}
++
++/// Close the marks still open in `builder` before its stream is finished, and record the
++/// misuse for [`SerializeContext::finish`].
++pub(crate) fn close_open_marks(builder: &mut ContentBuilder, sc: &mut SerializeContext) {
++    let open = std::mem::take(&mut builder.optional_content.open);
++    for _ in &open {
++        builder.content.end_marked_content();
++    }
++    if !open.is_empty() || builder.optional_content.overlap {
++        let location = sc.location;
++        sc.optional_content.record_misuse(location);
++    }
++}
++
++/// An entry of a resource dictionary's `/Properties`: an optional content group.
++#[derive(Debug, Eq, PartialEq, Hash, Clone)]
++pub(crate) struct Properties(Ref);
++
++impl Resource for Properties {
++    fn new(ref_: Ref) -> Self {
++        Self(ref_)
++    }
++
++    fn get_ref(&self) -> Ref {
++        self.0
++    }
++
++    fn get_dict<'a>(resources: &'a mut writers::Resources) -> Dict<'a> {
++        resources.insert(Name(b"Properties")).dict()
++    }
++
++    fn get_prefix() -> &'static str {
++        "oc"
++    }
++
++    fn get_mapper(b: &mut ResourceDictionaryBuilder) -> &mut ResourceMapper<Properties> {
++        &mut b.properties
++    }
++}
+diff --git a/src/lib.rs b/src/lib.rs
+index 099a9d4..cc608aa 100644
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -187,3 +187,6 @@ pub const CRAFT_UNWIND_POISONING: bool = true;
+ /// Identifies the print color patches: CMYK blending groups, print output intent and
+ /// PDF/X markers.
+ pub const CRAFT_PRINT_COLOR: bool = true;
++
++/// Identifies the optional content patch: layers written as optional content groups.
++pub const CRAFT_OPTIONAL_CONTENT: bool = true;
+diff --git a/src/resource.rs b/src/resource.rs
+index 56b8488..da8ab83 100644
+--- a/src/resource.rs
++++ b/src/resource.rs
+@@ -7,6 +7,7 @@ use pdf_writer::types::ProcSet;
+ use pdf_writer::writers;
+ use pdf_writer::{Chunk, Dict, Finish, Name, Ref};
+ 
++use crate::graphics::optional_content::Properties;
+ use crate::serialize::{Cacheable, SerializeContext};
+ use crate::util::NameExt;
+ 
+@@ -180,6 +181,7 @@ pub(crate) struct ResourceDictionaryBuilder {
+     pub(crate) x_objects: ResourceMapper<XObject>,
+     pub(crate) shadings: ResourceMapper<Shading>,
+     pub(crate) fonts: ResourceMapper<Font>,
++    pub(crate) properties: ResourceMapper<Properties>,
+ }
+ 
+ impl ResourceDictionaryBuilder {
+@@ -191,6 +193,7 @@ impl ResourceDictionaryBuilder {
+             x_objects: ResourceMapper::new(),
+             shadings: ResourceMapper::new(),
+             fonts: ResourceMapper::new(),
++            properties: ResourceMapper::new(),
+         }
+     }
+ 
+@@ -209,6 +212,7 @@ impl ResourceDictionaryBuilder {
+             x_objects: self.x_objects.into_resource_list(),
+             shadings: self.shadings.into_resource_list(),
+             fonts: self.fonts.into_resource_list(),
++            properties: self.properties.into_resource_list(),
+         }
+     }
+ }
+@@ -221,6 +225,7 @@ pub(crate) struct ResourceDictionary {
+     pub(crate) x_objects: ResourceList<XObject>,
+     pub(crate) shadings: ResourceList<Shading>,
+     pub(crate) fonts: ResourceList<Font>,
++    pub(crate) properties: ResourceList<Properties>,
+ }
+ 
+ impl Default for ResourceDictionary {
+@@ -232,6 +237,7 @@ impl Default for ResourceDictionary {
+             x_objects: ResourceList::empty(),
+             shadings: ResourceList::empty(),
+             fonts: ResourceList::empty(),
++            properties: ResourceList::empty(),
+         }
+     }
+ }
+@@ -253,7 +259,8 @@ impl ResourceDictionary {
+             || self.patterns.len() > 0
+             || self.x_objects.len() > 0
+             || self.shadings.len() > 0
+-            || self.fonts.len() > 0;
++            || self.fonts.len() > 0
++            || self.properties.len() > 0;
+ 
+         if !write_proc_sets && !has_resource_entries {
+             // `Resources` dictionary is mandatory (or rather, it's mandatory if
+@@ -282,6 +289,7 @@ impl ResourceDictionary {
+         write_resource_type::<XObject>(&mut resources, &self.x_objects);
+         write_resource_type::<Shading>(&mut resources, &self.shadings);
+         write_resource_type::<Font>(&mut resources, &self.fonts);
++        write_resource_type::<Properties>(&mut resources, &self.properties);
+         parent.set_resources(resources_ref);
+     }
+ }
+diff --git a/src/serialize.rs b/src/serialize.rs
+index 587e2c6..4f4af4c 100644
+--- a/src/serialize.rs
++++ b/src/serialize.rs
+@@ -22,6 +22,7 @@ use crate::graphics::device_n::DeviceNColorSpace;
+ use crate::graphics::icc::{ICCBasedColorSpace, ICCProfile};
+ #[cfg(feature = "raster-images")]
+ use crate::graphics::image::Image;
++use crate::graphics::optional_content::OptionalContent;
+ use crate::graphics::separation::SeparationColorSpace;
+ use crate::interactive::destination::{NamedDestination, XyzDestination};
+ use crate::interchange::embed::EmbeddedFile;
+@@ -356,6 +357,8 @@ pub(crate) struct SerializeContext {
+     /// Where the first mesh gradient whose corner colors share no color space was drawn;
+     /// [`SerializeContext::finish`] fails with [`KrillaError::MixedMeshColorSpaces`].
+     pub(crate) mixed_mesh_colors: Option<Option<Location>>,
++    /// The document's optional content groups.
++    pub(crate) optional_content: OptionalContent,
+     /// The ref of the page tree.
+     page_tree_ref: Ref,
+     /// PDF 2.0 namespaces.
+@@ -417,6 +420,7 @@ impl SerializeContext {
+         Self {
+             poisoned: false,
+             mixed_mesh_colors: None,
++            optional_content: OptionalContent::default(),
+             cached_mappings: HashMap::new(),
+             pdf2_ns,
+             global_objects: GlobalObjects::default(),
+@@ -631,6 +635,9 @@ impl SerializeContext {
+         if let Some(location) = self.mixed_mesh_colors {
+             return Err(KrillaError::MixedMeshColorSpaces(location));
+         }
++        if let Some(location) = self.optional_content.misuse {
++            return Err(KrillaError::UnbalancedOptionalContent(location));
++        }
+ 
+         // We need to be careful here that we serialize the objects in the right order,
+         // as in some cases we use MaybeTake::take to remove an object, which means that
+diff --git a/src/surface.rs b/src/surface.rs
+index 15a728d..b5b602d 100644
+--- a/src/surface.rs
++++ b/src/surface.rs
+@@ -100,6 +100,11 @@ impl<'a> Surface<'a> {
+         }
+     }
+ 
++    /// The content stream being drawn and the serialization context, borrowed together.
++    pub(crate) fn content_and_context(&mut self) -> (&mut ContentBuilder, &mut SerializeContext) {
++        (self.bd.get_mut(), self.sc)
++    }
++
+     /// Return a `StreamBuilder` to allow drawing on a sub-context.
+     pub fn stream_builder(&mut self) -> StreamBuilder<'_> {
+         StreamBuilder::new(self.sc, self.chunk_container)
diff --git a/vendor/krilla/patches/13-annotation-bounds.patch b/vendor/krilla/patches/13-annotation-bounds.patch
new file mode 100644
index 00000000..f7945f15
--- /dev/null
+++ b/vendor/krilla/patches/13-annotation-bounds.patch
@@ -0,0 +1,299 @@
+diff --git a/src/error.rs b/src/error.rs
+index a19ebf6..7158052 100644
+--- a/src/error.rs
++++ b/src/error.rs
+@@ -43,6 +43,15 @@ pub enum KrillaError {
+     /// Optional content marks were not balanced: an end without a start, a mark still open
+     /// when its stream finished, or a mark overlapping a tagged section.
+     UnbalancedOptionalContent(Option<Location>),
++    /// A link annotation has no finite bounding box on its page: its quad points are empty
++    /// or not finite, or its rect doesn't map to finite page coordinates.
++    InvalidAnnotationGeometry(Option<Location>),
++    /// An XYZ destination targets a page the document doesn't have (the index is
++    /// zero-based), or a point that isn't finite on that page.
++    InvalidDestination(usize),
++    /// A page's media, crop, bleed, trim or art box doesn't map to finite PDF coordinates.
++    /// Holds the zero-based page index.
++    InvalidPageBox(usize),
+     /// An error while attempting to embed a font.
+     Font(Font, String),
+     /// A list of validation errors. Can only occur if you set the `validator` in
+@@ -96,6 +105,20 @@ impl Display for KrillaError {
+                 f.write_str("optional content marks are not balanced")?;
+                 write_location(f, *location)
+             }
++            KrillaError::InvalidAnnotationGeometry(location) => {
++                f.write_str("a link annotation has no finite bounding box")?;
++                write_location(f, *location)
++            }
++            KrillaError::InvalidDestination(page_index) => write!(
++                f,
++                "a destination on page {} is not in the document or not finite",
++                page_index.saturating_add(1)
++            ),
++            KrillaError::InvalidPageBox(page_index) => write!(
++                f,
++                "a page box on page {} doesn't map to finite coordinates",
++                page_index.saturating_add(1)
++            ),
+             KrillaError::Font(_, message) => write!(f, "failed to embed font: {message}"),
+             KrillaError::Validation(errors) => {
+                 let count = errors.len();
+diff --git a/src/interactive/annotation.rs b/src/interactive/annotation.rs
+index 91c4cff..f2121f1 100644
+--- a/src/interactive/annotation.rs
++++ b/src/interactive/annotation.rs
+@@ -14,7 +14,7 @@ use pdf_writer::{Finish, Name, Ref, TextStr};
+ use crate::chunk_container::ChunkContainer;
+ use crate::color::Color;
+ use crate::configure::{PdfVersion, ValidationError};
+-use crate::error::KrillaResult;
++use crate::error::{KrillaError, KrillaResult};
+ use crate::geom::{Quadrilateral, Rect};
+ use crate::interactive::action::Action;
+ use crate::interactive::destination::Destination;
+@@ -70,15 +70,20 @@ impl Annotation {
+         root_ref: Ref,
+         page_height: f32,
+     ) -> KrillaResult<()> {
++        let AnnotationType::Link(l) = &self.annotation_type;
++        // Checked before the object starts, so a refused annotation writes nothing.
++        let rect = l
++            .page_rect(page_height)
++            .ok_or(KrillaError::InvalidAnnotationGeometry(self.location))?;
++
+         let chunk = &mut chunk_container.non_stream.annotations;
+         let mut annotation = chunk
+             .indirect(root_ref)
+             .start::<pdf_writer::writers::Annotation>();
+ 
+         self.annotation_type
+-            .serialize_type(sc, &mut annotation, page_height)?;
++            .serialize_type(sc, &mut annotation, page_height, rect)?;
+ 
+-        let AnnotationType::Link(l) = &self.annotation_type;
+         // Only set the print flag when really necessary (only PDF/A). Don't
+         // set it by default, so annotations with color borders will be shown
+         // on a screen but not printed.
+@@ -124,9 +129,10 @@ impl AnnotationType {
+         sc: &mut SerializeContext,
+         annotation: &mut pdf_writer::writers::Annotation,
+         page_height: f32,
++        rect: Rect,
+     ) -> KrillaResult<()> {
+         match self {
+-            AnnotationType::Link(l) => l.serialize_type(sc, annotation, page_height),
++            AnnotationType::Link(l) => l.serialize_type(sc, annotation, page_height, rect),
+         }
+     }
+ }
+@@ -157,7 +163,8 @@ impl LinkBorder {
+ 
+ /// A link annotation.
+ pub struct LinkAnnotation {
+-    pub(crate) rect: Rect,
++    /// `None` when the quad points have no finite bounding box.
++    pub(crate) rect: Option<Rect>,
+     pub(crate) quad_points: Option<Vec<Quadrilateral>>,
+     pub(crate) target: Target,
+     pub(crate) border: Option<LinkBorder>,
+@@ -170,7 +177,7 @@ impl LinkAnnotation {
+     /// `target`: The target of the link annotation.
+     pub fn new(rect: Rect, target: Target) -> Self {
+         Self {
+-            rect,
++            rect: Some(rect),
+             quad_points: None,
+             target,
+             border: None,
+@@ -183,8 +190,16 @@ impl LinkAnnotation {
+     /// `quad_points`: An array of quadrilaterals that define where the link
+     /// annotation should be activated. This is useful if you for example have
+     /// a link annotation that is broken to one or multiple lines.
++    ///
++    /// An empty list, or a point that isn't finite, makes [`Document::finish`] return
++    /// [`KrillaError::InvalidAnnotationGeometry`].
++    ///
++    /// [`Document::finish`]: crate::Document::finish
+     pub fn new_with_quad_points(quad_points: Vec<Quadrilateral>, target: Target) -> Self {
+-        assert!(!quad_points.is_empty());
++        let finite = quad_points
++            .iter()
++            .flat_map(|q| q.0)
++            .all(|p| p.x.is_finite() && p.y.is_finite());
+ 
+         let mut min_x = f32::INFINITY;
+         let mut min_y = f32::INFINITY;
+@@ -202,13 +217,16 @@ impl LinkAnnotation {
+         // that sometimes prevents the quadpoints from being used if the quad
+         // points lie exactly on the bounding rectangle.
+         const EPSILON: f32 = 0.001;
+-        let rect = Rect::from_ltrb(
+-            min_x - EPSILON,
+-            min_y - EPSILON,
+-            max_x + EPSILON,
+-            max_y + EPSILON,
+-        )
+-        .unwrap();
++        let rect = finite
++            .then(|| {
++                Rect::from_ltrb(
++                    min_x - EPSILON,
++                    min_y - EPSILON,
++                    max_x + EPSILON,
++                    max_y + EPSILON,
++                )
++            })
++            .flatten();
+ 
+         Self {
+             rect,
+@@ -227,19 +245,23 @@ impl LinkAnnotation {
+         }
+     }
+ 
++    /// The rect in PDF page coordinates, or `None` when there is no rect or it doesn't
++    /// map to finite coordinates. The quad points lie inside the rect, so they map to
++    /// finite coordinates whenever it does.
++    fn page_rect(&self, page_height: f32) -> Option<Rect> {
++        self.rect?.transform(page_root_transform(page_height))
++    }
++
+     fn serialize_type(
+         &self,
+         sc: &mut SerializeContext,
+         annotation: &mut pdf_writer::writers::Annotation,
+         page_height: f32,
++        rect: Rect,
+     ) -> KrillaResult<()> {
+         annotation.subtype(pdf_writer::types::AnnotationType::Link);
+ 
+-        let actual_rect = self
+-            .rect
+-            .transform(page_root_transform(page_height))
+-            .unwrap();
+-        annotation.rect(actual_rect.to_pdf_rect());
++        annotation.rect(rect.to_pdf_rect());
+         annotation.border(
+             0.0,
+             0.0,
+diff --git a/src/interactive/destination.rs b/src/interactive/destination.rs
+index de40085..ec50951 100644
+--- a/src/interactive/destination.rs
++++ b/src/interactive/destination.rs
+@@ -117,7 +117,10 @@ impl From<XyzDestination> for Destination {
+ impl XyzDestination {
+     /// Create a new XYZ destination. `page_index` should be the index (i.e. number) of the
+     /// target page, and point indicates the specific location on that page that should be
+-    /// targeted. If the `page_index` is out of range, export will panic.
++    /// targeted. A `page_index` out of range, or a point that isn't finite, makes
++    /// [`Document::finish`] return [`KrillaError::InvalidDestination`].
++    ///
++    /// [`Document::finish`]: crate::Document::finish
+     pub fn new(page_index: usize, point: Point) -> Self {
+         Self(Arc::new(XyzDestRepr { page_index, point }))
+     }
+@@ -127,17 +130,9 @@ impl XyzDestination {
+         sc: &mut SerializeContext,
+         chunk_container: &mut ChunkContainer,
+         root_ref: Ref,
+-    ) {
+-        let chunk = &mut chunk_container.non_stream.destinations;
+-        let destination = chunk.destination(root_ref);
+-
+-        let page_info = sc.page_infos().get(self.0.page_index).unwrap_or_else(|| {
+-            panic!(
+-                "attempted to link to page {}, but document only has {} pages",
+-                self.0.page_index + 1,
+-                sc.page_infos().len()
+-            )
+-        });
++    ) -> KrillaResult<()> {
++        let invalid = || KrillaError::InvalidDestination(self.0.page_index);
++        let page_info = sc.page_infos().get(self.0.page_index).ok_or_else(invalid)?;
+ 
+         let (ref_, surface_size) = match page_info {
+             PageInfo::Krilla {
+@@ -153,10 +148,17 @@ impl XyzDestination {
+         // Convert to PDF coordinates
+         let invert_transform = Transform::from_row(1.0, 0.0, 0.0, -1.0, 0.0, page_size);
+         invert_transform.map_point(&mut mapped_point);
++        if !(mapped_point.x.is_finite() && mapped_point.y.is_finite()) {
++            return Err(invalid());
++        }
+ 
+-        destination
++        chunk_container
++            .non_stream
++            .destinations
++            .destination(root_ref)
+             .page(page_ref)
+             .xyz(mapped_point.x, mapped_point.y, None);
++        Ok(())
+     }
+ }
+ 
+diff --git a/src/page.rs b/src/page.rs
+index 3b3227b..c596677 100644
+--- a/src/page.rs
++++ b/src/page.rs
+@@ -12,7 +12,7 @@ use crate::chunk_container::ChunkContainer;
+ use crate::configure::validate::VersionedFeature;
+ use crate::configure::ValidationError;
+ use crate::content::ContentBuilder;
+-use crate::error::KrillaResult;
++use crate::error::{KrillaError, KrillaResult};
+ use crate::geom::{Rect, Size, Transform};
+ use crate::graphics::xobject::write_group_color_space;
+ use crate::interactive::annotation::Annotation;
+@@ -437,31 +437,31 @@ impl InternalPage {
+             rect.transform(page_root_transform(
+                 self.page_settings.surface_size().height(),
+             ))
+-            .unwrap()
++            .ok_or(KrillaError::InvalidPageBox(self.page_index))
+         };
+ 
+         // media box is mandatory, so we need to fall back to the default bbox
+-        let media_box = transform_rect(self.page_settings.media_box().unwrap_or(self.bbox));
++        let media_box = transform_rect(self.page_settings.media_box().unwrap_or(self.bbox))?;
+         page.media_box(media_box.to_pdf_rect());
+ 
+         // the remaining type of box are not mandatory, so we only set them if they are present
+         if let Some(crop_box) = self.page_settings.crop_box() {
+-            let crop_box = transform_rect(crop_box);
++            let crop_box = transform_rect(crop_box)?;
+             page.crop_box(crop_box.to_pdf_rect());
+         }
+ 
+         if let Some(bleed_box) = self.page_settings.bleed_box() {
+-            let bleed_box = transform_rect(bleed_box);
++            let bleed_box = transform_rect(bleed_box)?;
+             page.bleed_box(bleed_box.to_pdf_rect());
+         }
+ 
+         if let Some(trim_box) = self.page_settings.trim_box() {
+-            let trim_box = transform_rect(trim_box);
++            let trim_box = transform_rect(trim_box)?;
+             page.trim_box(trim_box.to_pdf_rect());
+         }
+ 
+         if let Some(art_box) = self.page_settings.art_box() {
+-            let art_box = transform_rect(art_box);
++            let art_box = transform_rect(art_box)?;
+             page.art_box(art_box.to_pdf_rect());
+         }
+ 
+diff --git a/src/serialize.rs b/src/serialize.rs
+index 4f4af4c..f2986fc 100644
+--- a/src/serialize.rs
++++ b/src/serialize.rs
+@@ -1019,7 +1019,7 @@ impl SerializeContext {
+     ) -> KrillaResult<()> {
+         let xyz_destinations = self.global_objects.xyz_destinations.take();
+         for (ref_, dest) in &xyz_destinations {
+-            dest.serialize(self, chunk_container, *ref_);
++            dest.serialize(self, chunk_container, *ref_)?;
+         }
+ 
+         Ok(())
diff --git a/vendor/krilla/patches/14-devicen-pdf-version.patch b/vendor/krilla/patches/14-devicen-pdf-version.patch
new file mode 100644
index 00000000..3a63160a
--- /dev/null
+++ b/vendor/krilla/patches/14-devicen-pdf-version.patch
@@ -0,0 +1,51 @@
+diff --git a/src/graphics/device_n.rs b/src/graphics/device_n.rs
+index 8ee7064..f2873ac 100644
+--- a/src/graphics/device_n.rs
++++ b/src/graphics/device_n.rs
+@@ -17,9 +17,10 @@ use crate::stream::FilterStreamBuilder;
+ /// `[/DeviceN [names] alternate tintTransform attributes?]`.
+ ///
+ /// The alternate is DeviceCMYK, or the `cmyk_profile` ICC space with `no_device_cs`. The
+-/// attributes dictionary (PDF 1.6+) lists each spot's Separation color space under
+-/// `/Colorants`; when spots and process colorants mix, it is an `NChannel` space whose
+-/// `/Process` names the CMYK space and components.
++/// attributes dictionary lists each spot's Separation color space under `/Colorants`
++/// (PDF 1.3). From PDF 1.6, when spots and process colorants mix, it is an `NChannel` space
++/// whose `/Process` names the CMYK space and components; `/Subtype` and `/Process` don't
++/// exist before 1.6, and PDF/X-1a preflights reject them.
+ #[derive(Debug, Eq, PartialEq, Hash, Clone)]
+ pub(crate) struct DeviceNColorSpace {
+     space: DeviceNSpace,
+@@ -54,21 +55,20 @@ impl Cacheable for DeviceNColorSpace {
+ 
+         let tint_ref = tint_transform(&space, sc, chunk_container);
+ 
+-        let with_attrs = sc.serialize_settings().pdf_version() >= PdfVersion::Pdf16;
+         let mut separations = Vec::new();
+-        if with_attrs {
+-            for (name, cmyk) in space.spots() {
+-                let separation =
+-                    SeparationSpace::new(SeparationColorant::Custom(name.to_owned()), cmyk.into());
+-                let cs = ColorSpace::Special(SpecialColorSpace::Separation(separation));
+-                if let MaybeDeviceColorSpace::ColorSpace(cs) =
+-                    sc.register_colorspace(chunk_container, cs)
+-                {
+-                    separations.push((name.to_owned(), cs.get_ref()));
+-                }
++        for (name, cmyk) in space.spots() {
++            let separation =
++                SeparationSpace::new(SeparationColorant::Custom(name.to_owned()), cmyk.into());
++            let cs = ColorSpace::Special(SpecialColorSpace::Separation(separation));
++            if let MaybeDeviceColorSpace::ColorSpace(cs) =
++                sc.register_colorspace(chunk_container, cs)
++            {
++                separations.push((name.to_owned(), cs.get_ref()));
+             }
+         }
+-        let nchannel = with_attrs && space.has_process() && !separations.is_empty();
++        let nchannel = sc.serialize_settings().pdf_version() >= PdfVersion::Pdf16
++            && space.has_process()
++            && !separations.is_empty();
+ 
+         let chunk = &mut chunk_container.non_stream.color_spaces;
+         let mut array = chunk.indirect(root_ref).array();
diff --git a/vendor/krilla/patches/15-pdfx-conformance.patch b/vendor/krilla/patches/15-pdfx-conformance.patch
new file mode 100644
index 00000000..15c3af63
--- /dev/null
+++ b/vendor/krilla/patches/15-pdfx-conformance.patch
@@ -0,0 +1,46 @@
+diff --git a/src/serialize.rs b/src/serialize.rs
+index 4f4af4c..7f6ece3 100644
+--- a/src/serialize.rs
++++ b/src/serialize.rs
+@@ -136,6 +136,11 @@ pub struct SerializeSettings {
+     /// extension schema for the XMP property, which krilla does not write, so export under
+     /// them fails with [`ValidationError::PdfxVersionWithoutExtensionSchema`].
+     pub pdfx_version: Option<String>,
++    /// The PDF/X conformance level the caller claims, such as `PDF/X-1a:2003`:
++    /// `/GTS_PDFXConformance` in the document information dictionary. PDF/X-1a and X-3
++    /// require it next to the version (`PDF/X-1:2003` for PDF/X-1a:2003); later parts
++    /// have no conformance key. It has no XMP property, so PDF 2.0 output omits it.
++    pub pdfx_conformance: Option<String>,
+ }
+ 
+ /// A CMYK printing condition, written as an `/OutputIntents` entry with `/S /GTS_PDFX`.
+@@ -201,7 +206,10 @@ impl SerializeSettings {
+     /// Whether the document information dictionary carries print markers. Like the rest of
+     /// the dictionary, they are deprecated in PDF 2.0 and only written to XMP there.
+     pub(crate) fn has_print_info(&self, version: PdfVersion) -> bool {
+-        version < PdfVersion::Pdf20 && (self.trapped.is_some() || self.pdfx_version.is_some())
++        version < PdfVersion::Pdf20
++            && (self.trapped.is_some()
++                || self.pdfx_version.is_some()
++                || self.pdfx_conformance.is_some())
+     }
+ 
+     pub(crate) fn write_print_info(&self, info: &mut DocumentInfo<'_>) {
+@@ -215,6 +223,9 @@ impl SerializeSettings {
+         if let Some(version) = &self.pdfx_version {
+             info.pair(Name(b"GTS_PDFXVersion"), TextStr(version));
+         }
++        if let Some(conformance) = &self.pdfx_conformance {
++            info.pair(Name(b"GTS_PDFXConformance"), TextStr(conformance));
++        }
+     }
+ 
+     pub(crate) fn write_print_xmp(&self, xmp: &mut XmpWriter) {
+@@ -260,6 +271,7 @@ impl Default for SerializeSettings {
+             output_intent: None,
+             trapped: None,
+             pdfx_version: None,
++            pdfx_conformance: None,
+         }
+     }
+ }
diff --git a/vendor/krilla/patches/16-modification-date.patch b/vendor/krilla/patches/16-modification-date.patch
new file mode 100644
index 00000000..45940b53
--- /dev/null
+++ b/vendor/krilla/patches/16-modification-date.patch
@@ -0,0 +1,65 @@
+diff --git a/src/interchange/metadata.rs b/src/interchange/metadata.rs
+index 4cfc8e5..6c74b36 100644
+--- a/src/interchange/metadata.rs
++++ b/src/interchange/metadata.rs
+@@ -24,6 +24,7 @@ pub struct Metadata {
+     pub(crate) document_id: Option<String>,
+     pub(crate) language: Option<String>,
+     pub(crate) creation_date: Option<DateTime>,
++    pub(crate) modification_date: Option<DateTime>,
+     pub(crate) text_direction: Option<TextDirection>,
+     pub(crate) page_layout: Option<PageLayout>,
+ }
+@@ -101,6 +102,18 @@ impl Metadata {
+         self
+     }
+ 
++    /// The date the document was last modified. Without it, the creation date is
++    /// written as the modification date.
++    pub fn modification_date(mut self, modification_date: DateTime) -> Self {
++        self.modification_date = Some(modification_date);
++        self
++    }
++
++    /// The date written as the modification date: the one given, else the creation date.
++    fn modified(&self) -> Option<DateTime> {
++        self.modification_date.or(self.creation_date)
++    }
++
+     /// A document ID.
+     ///
+     /// This attribute will be used as an identifier for identifying
+@@ -129,6 +142,7 @@ impl Metadata {
+             || self.authors.is_some()
+             || self.creator.is_some()
+             || self.creation_date.is_some()
++            || self.modification_date.is_some()
+             || self.description.is_some()
+     }
+ 
+@@ -195,8 +209,11 @@ impl Metadata {
+             xmp.language([LangId(lang)]);
+         }
+ 
+-        if let Some(date) = self.creation_date.map(xmp_date) {
++        if let Some(date) = self.modified().map(xmp_date) {
+             xmp.modify_date(date);
++        }
++
++        if let Some(date) = self.creation_date.map(xmp_date) {
+             xmp.create_date(date);
+ 
+             if sc
+@@ -289,8 +306,11 @@ impl Metadata {
+                 }
+             }
+ 
+-            if let Some(date_time) = self.creation_date {
++            if let Some(date_time) = self.modified() {
+                 document_info.modified_date(pdf_date(date_time));
++            }
++
++            if let Some(date_time) = self.creation_date {
+                 document_info.creation_date(pdf_date(date_time));
+             }
+ 
diff --git a/vendor/krilla/src/chunk_container.rs b/vendor/krilla/src/chunk_container.rs
index 0530dd2f..023784f7 100644
--- a/vendor/krilla/src/chunk_container.rs
+++ b/vendor/krilla/src/chunk_container.rs
@@ -55,6 +55,7 @@ pub(crate) struct NonStreamChunks {
     pub(crate) patterns: Chunk,
     pub(crate) pages: Chunk,
     pub(crate) embedded_files: Chunk,
+    pub(crate) optional_content: Chunk,
 }
 
 impl ChunkContainer {
@@ -93,6 +94,7 @@ impl ChunkContainer {
                 patterns: sc.new_chunk(),
                 pages: sc.new_chunk(),
                 embedded_files: sc.new_chunk(),
+                optional_content: sc.new_chunk(),
             },
         }
     }
@@ -147,14 +149,12 @@ impl ChunkContainer {
             sc.register_validation_error(ValidationError::NoDocumentTitle);
         }
 
-        // Write the PDF document info metadata.
-        if let Some(metadata) = &self.metadata {
-            metadata.serialize_document_info(
-                &mut remapped_ref,
-                &mut pdf,
-                sc.serialize_settings().configuration,
-            );
-        }
+        // Write the PDF document info metadata, also without metadata when print markers need it.
+        let no_metadata = Metadata::default();
+        self.metadata
+            .as_ref()
+            .unwrap_or(&no_metadata)
+            .serialize_document_info(&mut remapped_ref, &mut pdf, &sc.serialize_settings());
 
         let instance_id = stable_hash_base64(pdf.as_bytes());
 
@@ -182,6 +182,7 @@ impl ChunkContainer {
         let settings = sc.serialize_settings();
         let validators = settings.validators();
         validators.write_xmp(&mut xmp);
+        settings.write_print_xmp(&mut xmp);
 
         xmp.num_pages(sc.page_infos().len() as u32);
         xmp.format("application/pdf");
@@ -192,7 +193,12 @@ impl ChunkContainer {
             instance_id.as_bytes().to_vec(),
         ));
 
-        xmp.rendition_class(RenditionClass::Proof);
+        // PdfCraft patch: a document written here is the master rendition, not a proof copy.
+        // `xmpMM:RenditionClass` says which rendition a file is (XMP Part 2, Media Management):
+        // `default` is the master, `proof` a proof copy. Writing `proof` on every file told a
+        // prepress system that a print deliverable was a proof, and PDF/X output carries it
+        // (storytold/designcraft#1207).
+        xmp.rendition_class(RenditionClass::Default);
         sc.serialize_settings().pdf_version().write_xmp(&mut xmp);
 
         let named_destinations = sc.global_objects.named_destinations.take();
@@ -341,6 +347,9 @@ impl ChunkContainer {
                 }
             }
 
+            sc.optional_content
+                .write_catalog_entries(&mut catalog, &remapper);
+
             catalog.finish();
         }
 
@@ -437,6 +446,7 @@ impl Visit for NonStreamChunks {
         self.patterns.visit(sc, f)?;
         self.pages.visit(sc, f)?;
         self.embedded_files.visit(sc, f)?;
+        self.optional_content.visit(sc, f)?;
 
         Ok(())
     }
diff --git a/vendor/krilla/src/configure/PDF_A1.md b/vendor/krilla/src/configure/PDF_A1.md
index 2ade3274..a4c7bc37 100644
--- a/vendor/krilla/src/configure/PDF_A1.md
+++ b/vendor/krilla/src/configure/PDF_A1.md
@@ -54,16 +54,21 @@ with an even number of characters and without whitespaces. 🟢
 - krilla does check the maximum entries of a dictionary. 🟢
 - krilla fails export if more than 8388607 indirect objects exist. 🟢
 - krilla fails export if a higher nesting-level than 28 exists. 🔵
-- krilla does not use the DeviceN color space. 🟢
+- krilla fails export if a DeviceN color space is used (see 6.2.3.4), so the limit of 8
+  DeviceN colorants is never reached. 🟢
 - krilla only uses u16 for CIDs. 🟢
 
-6.1.13: krilla does not support optional content. 🔵
+6.1.13: krilla fails export if an optional content group is added
+(`ValidationError::OptionalContent`), so the catalog never has `OCProperties`. 🟢
 
 ## 6.2 Graphics
 
 6.2.2:
 - krilla always writes a valid output intent. 🟢
-- krilla always only writes one output intent. 🟢
+- krilla writes one output intent, or with `SerializeSettings::output_intent` two
+  (`GTS_PDFA1` and `GTS_PDFX`) that name the same destination profile object. 🟢
+- krilla checks only that a profile given in `SerializeSettings::output_intent` has four
+  components; that it is an output (`prtr`) profile is up to the caller. 🟣
 
 6.2.3.1: krilla overrides the `no_device_cs` property if PDF/A is selected, and
 in case CMYK is used but no profile was provided, export fails. 🟢
@@ -72,7 +77,8 @@ in case CMYK is used but no profile was provided, export fails. 🟢
 - sRGB/sGrey ICC profiles conform to ICC v2 specification. 🟢
 
 6.2.4.3: 
-- krilla always uses sRGB for RGB, and in addition also embeds an sRGB output intent. 🟢
+- krilla always uses sRGB for RGB, with an sRGB output intent unless
+  `SerializeSettings::output_intent` gives a CMYK one. 🟢
 - krilla always uses sGrey (except for encoding the alpha channel in images, where DeviceGray
   is required), and in addition always embeds an output intent. 🟢
 - krilla always uses an CMYK ICC profile, and always sets CMYK as the output intent. 🟢
@@ -81,7 +87,8 @@ in case CMYK is used but no profile was provided, export fails. 🟢
 6.2.3.4:
 - krilla ensures the Alternate space in Separation color spaces obeys the restrictions
   in the applicable clauses 🟢
-- krilla does not support DeviceN color spaces. 🔵
+- krilla fails export if a DeviceN color space is used: its tint transform is a PostScript
+  calculator function (`ValidationError::ContainsPostScript`). 🟢
 
 6.2.4: 
 - krilla does not use the `Alternates`/`Intent` keys for images. 🔵
@@ -179,7 +186,9 @@ when a PostScript function is used. 🟢
 6.7.7: krilla writes a minimal `xmpMM:History` entry when a creation date is
 provided. 🟢
 
-6.7.8: krilla writes the extension schemas. 🟢
+6.7.8: krilla writes the extension schemas. `SerializeSettings::pdfx_version` would need one
+for `pdfxid:GTS_PDFXVersion`, which krilla does not write, so it is a validation error
+(`ValidationError::PdfxVersionWithoutExtensionSchema`). 🟢
 
 6.7.9: `xmp-writer` always produces valid XMP packets. 🟢
 
diff --git a/vendor/krilla/src/configure/PDF_A2.md b/vendor/krilla/src/configure/PDF_A2.md
index a4e4377a..69acde59 100644
--- a/vendor/krilla/src/configure/PDF_A2.md
+++ b/vendor/krilla/src/configure/PDF_A2.md
@@ -60,17 +60,25 @@ user enables `ascii_compatible`, we still write a binary header marker. 🟢
 - krilla doesn't use the `ri` or `i` operator. 🟢
 - krilla ensure that content stream has their own associated resource dictionary. 🟢
 
-6.2.3: krilla always write an `sRGB` output intent for PDF/A. 🟢
+6.2.3:
+- krilla writes an `sRGB` output intent for PDF/A, or the CMYK profile given in
+  `SerializeSettings::output_intent`. 🟢
+- krilla writes one output intent, or with `SerializeSettings::output_intent` two
+  (`GTS_PDFA1` and `GTS_PDFX`) that name the same destination profile object. 🟢
+- krilla checks only that a profile given in `SerializeSettings::output_intent` has four
+  components; that it is an output (`prtr`) profile is up to the caller. 🟣
 
 6.2.4.1: krilla overrides the `no_device_cs` property if PDF/A is selected, and
 in case CMYK is used but no profile was provided, export fails.
 
 6.2.4.2: 
 - sRGB/sGrey ICC profiles conform to ICC v4 specification. 🟢
-- krilla does not support overprinting. 🔵
+- krilla fails export if overprint mode 1 is combined with fill or stroke overprint, since
+  all CMYK is ICCBased in this mode. 🟢
 
 6.2.4.3: 
-- krilla always uses sRGB for RGB, and in addition also embeds an sRGB output intent. 🟢
+- krilla always uses sRGB for RGB, with an sRGB output intent unless
+  `SerializeSettings::output_intent` gives a CMYK one. 🟢
 - krilla always uses sGrey (except for encoding the alpha channel in images, where DeviceGray
   is required), and in addition always embeds an output intent. 🟢
 - krilla always uses an CMYK ICC profile, and always sets CMYK as the output intent. 🟢
@@ -79,7 +87,8 @@ in case CMYK is used but no profile was provided, export fails.
 6.2.4.4:
 - krilla ensures the Alternate space in Separation color spaces obeys the restrictions
   in the applicable clauses 🟢
-- krilla does not support DeviceN color spaces. 🔵
+- krilla fails export if a DeviceN color space is used: its tint transform is a PostScript
+  calculator function (`ValidationError::ContainsPostScript`). 🟢
 - krilla fails export if a Separation colorant is associated with multiple different
   fallback color spaces 🟢
 - krilla manages the `tintTransform` function and will always write the same function for
@@ -87,7 +96,9 @@ in case CMYK is used but no profile was provided, export fails.
 
 6.2.4.5: Fulfilled because patterns are treated the same as all other elements in krilla. 🟢
 
-6.2.5: krilla does not use the transfer functions, halftones, TR/HTP/RI/FL keys. 🔵
+6.2.5: krilla does not use the transfer functions, halftones, TR/HTP/RI/FL keys in graphics
+states. A soft mask's `/TR` (`Mask::with_transfer`) is a key of the soft-mask dictionary, which
+6.2.5 does not cover. 🔵
 
 6.2.6: krilla does never define a rendering intent. 🔵
 
@@ -186,7 +197,9 @@ always required. 🟢
 
 6.6.2.2: -
 
-6.6.2.3.1: krilla doesn't use any non-standard properties. 🟢
+6.6.2.3.1: krilla doesn't use any non-standard properties. `SerializeSettings::pdfx_version`
+would write `pdfxid:GTS_PDFXVersion`, which needs an extension schema that krilla does not
+write, so it is a validation error (`ValidationError::PdfxVersionWithoutExtensionSchema`). 🟢
 
 6.6.2.3.2: krilla writes the extension schemas. 🟢
 
@@ -209,7 +222,9 @@ krilla prohibits embedding files in this export mode. 🟢
 
 # 6.9 Optional content
 
-krilla does not support optional content. 🔵
+- krilla writes every optional content group with a `Name`. 🟢
+- krilla writes one optional content configuration, `D`, with the `Name` `Layers`, an `Order`
+  array that lists every group, and no `AS` key. 🟢
 
 # 6.10 Use of alternate presentations and transitions
 
diff --git a/vendor/krilla/src/configure/PDF_A4.md b/vendor/krilla/src/configure/PDF_A4.md
index 44a294f6..be1314bd 100644
--- a/vendor/krilla/src/configure/PDF_A4.md
+++ b/vendor/krilla/src/configure/PDF_A4.md
@@ -59,26 +59,35 @@ See `README.md` for the meaning of each color.
 ### 6.2.3 Output intent
 - krilla always writes the output intent for this export mode. 🟢
 - krilla does not use the `DestOutputProfileRef` attribute. 🟢
-- krilla does not write multiple output intents (since PDF/X and PDF/E are not supported). 🟢
-- krilla only uses a Display ICC profile for output intent. 🟢
-- krilla only uses RGB for output intents. 🟢
+- krilla writes one output intent, or with `SerializeSettings::output_intent` two
+  (`GTS_PDFA1` and `GTS_PDFX`) that name the same destination profile object. 🟢
+- krilla uses the sRGB display profile for the output intent, or the CMYK profile given in
+  `SerializeSettings::output_intent`. 🟢
+- krilla checks only that a profile given in `SerializeSettings::output_intent` has four
+  components; that it is an output (`prtr`) profile is up to the caller. 🟣
 
 ### 6.2.4 Colour spaces
 - krilla only uses device-independent colors in this export mode. 🟢 
 - krilla uses compatible ICC profiles. 🟢
-- krilla does not use the OPM entry. 🟢
-- krilla never uses CMYK profiles as the destination profile. 🟢
+- krilla fails export if overprint mode 1 is combined with fill or stroke overprint, since
+  all CMYK is ICCBased in this mode. 🟢
+- krilla uses a CMYK profile as the destination profile only when
+  `SerializeSettings::output_intent` gives one. 🟢
 - krilla does not use device color spaces in this mode. 🟢
 - krilla ensures the Alternate space in Separation color spaces obeys the restrictions
   in the applicable clauses 🟢
-- krilla does not support DeviceN color spaces. 🔵
+- krilla writes DeviceN color spaces with the CMYK ICC profile as their alternate in this
+  mode. Each spot colorant is also listed under `/Colorants` as a Separation space with the
+  same alternate, and a space mixing spot and process colorants is `/Subtype /NChannel`.
+  The tint transform is a PostScript calculator function, which PDF/A-4 allows. 🟢
 - krilla fails export if a Separation colorant is associated with multiple different
-  fallback color spaces 🟢
+  fallback color spaces, a DeviceN spot colorant's alternate included 🟢
 - krilla manages the `tintTransform` function and will always write the same function for
   the same color space 🟢
 
 ### 6.2.5 Extended graphics state
-- krilla does not use the `TR`, `HTO`, `TR2` or `HT` keys. 🟢
+- krilla does not use the `TR`, `HTO`, `TR2` or `HT` keys in graphics states. A soft mask's `/TR`
+  (`Mask::with_transfer`) is a key of the soft-mask dictionary, which 6.2.5 does not cover. 🟢
 - krilla does not use halftones. 🟢
 - krilla does not use the `FL`, `BG`, `BG2`, `UCR` or `URC2` functions. 🟢
 
@@ -182,7 +191,9 @@ See `README.md` for the meaning of each color.
 - krilla straight out forbids embedding files in this export mode. 🟢
 
 ## 6.10 Optional content
-- krilla does not support optional content. 🟢
+- krilla writes every optional content group with a `Name`. 🟢
+- krilla writes one optional content configuration, `D`, with the `Name` `Layers`, an `Order`
+  array that lists every group, and no `AS` key. 🟢
 
 ## 6.11 Use of alternate presentations and transitions
 - krilla does not use the `AlternatePresentations` entry. 🟢
diff --git a/vendor/krilla/src/configure/PDF_UA1.md b/vendor/krilla/src/configure/PDF_UA1.md
index 16959bbe..80449b8b 100644
--- a/vendor/krilla/src/configure/PDF_UA1.md
+++ b/vendor/krilla/src/configure/PDF_UA1.md
@@ -87,7 +87,7 @@ See `README.md` for the meaning of each color.
 - krilla always generates an ID for notes. 🟢
 
 # 7.10 Optional content
-- krilla does currently not support optional content. 🔵
+- krilla writes its one optional content configuration, `D`, with a `Name`. 🟢
 
 # 7.11 Embedded files
 - krilla supports embedded files, and requires a description in this export mode. 🟢
diff --git a/vendor/krilla/src/configure/validate.rs b/vendor/krilla/src/configure/validate.rs
index e92da05b..fb429ceb 100644
--- a/vendor/krilla/src/configure/validate.rs
+++ b/vendor/krilla/src/configure/validate.rs
@@ -83,7 +83,8 @@ pub enum ValidationError {
     MissingCMYKProfile,
     /// The same Separation colorant was used with multiple different fallback colors.
     ///
-    /// Occurs if the user specified multiple Separation color spaces with the same colorant but a different fallback color.
+    /// Occurs if the user specified multiple Separation color spaces with the same colorant but a different fallback color,
+    /// or a DeviceN spot colorant whose CMYK alternate differs from the fallback used elsewhere for that name.
     InconsistentSeparationFallback(SeparationColorant),
     /// The `.notdef` glyph was used, which is forbidden by some export formats.
     ///
@@ -131,6 +132,22 @@ pub enum ValidationError {
     Transparency(Option<Location>),
     /// The PDF contains an image with `interpolate` set to `true`.
     ImageInterpolation(Option<Location>),
+    /// Overprint mode 1 (`/OPM 1`) was combined with fill or stroke overprint while CMYK
+    /// colors are ICCBased.
+    ///
+    /// PDF/A-2 and later forbid overprint mode 1 when an ICCBased CMYK color space is used
+    /// for a side that overprints. Validated export always writes CMYK as ICCBased, so any
+    /// [`Overprint`] with `nonzero` and `fill` or `stroke` set triggers it; use
+    /// `nonzero: false` there.
+    ///
+    /// [`Overprint`]: crate::blend::Overprint
+    OverprintModeIccCmyk(Option<Location>),
+    /// [`SerializeSettings::pdfx_version`] is set. Its XMP property
+    /// `pdfxid:GTS_PDFXVersion` needs a PDF/A extension schema, which krilla does not write;
+    /// PDF/A-1, -2 and -3 require one for every property outside the predefined schemas.
+    ///
+    /// [`SerializeSettings::pdfx_version`]: crate::SerializeSettings::pdfx_version
+    PdfxVersionWithoutExtensionSchema,
     /// The PDF contains an embedded file.
     EmbeddedFile(EmbedError, Option<Location>),
     /// The PDF contains no tagging.
@@ -142,6 +159,12 @@ pub enum ValidationError {
     EmbeddedPDF(Option<Location>),
     /// A feature only available in a later PDF version was required.
     RequiresNewerPdfVersion(VersionedFeature, Option<Location>),
+    /// The PDF contains optional content groups, which PDF/A-1 forbids.
+    ///
+    /// Occurs if [`Document::add_optional_content_group`] was called.
+    ///
+    /// [`Document::add_optional_content_group`]: crate::Document::add_optional_content_group
+    OptionalContent(Option<Location>),
 }
 
 /// Features that may require a later PDF version than the current one.
@@ -153,6 +176,8 @@ pub enum VersionedFeature {
     HeaderFooterArtifactSubtypes,
     /// Scope attribute for table header cells.
     TableHeaderScope,
+    /// Optional content groups (layers).
+    OptionalContent,
 }
 
 impl VersionedFeature {
@@ -162,6 +187,7 @@ impl VersionedFeature {
             VersionedFeature::StructureOrderTabbing => PdfVersion::Pdf15,
             VersionedFeature::HeaderFooterArtifactSubtypes => PdfVersion::Pdf17,
             VersionedFeature::TableHeaderScope => PdfVersion::Pdf15,
+            VersionedFeature::OptionalContent => PdfVersion::Pdf15,
         }
     }
 }
@@ -547,13 +573,16 @@ impl Archival {
                 | ValidationError::MissingDocumentDate
                 | ValidationError::Transparency(_)
                 | ValidationError::ImageInterpolation(_)
+                | ValidationError::PdfxVersionWithoutExtensionSchema
                 | ValidationError::EmbeddedFile(EmbedError::Existence, _)
-                | ValidationError::EmbeddedPDF(_),
+                | ValidationError::EmbeddedPDF(_)
+                | ValidationError::OptionalContent(_),
             ) => true,
             // Allowed under all PDF/A-1 profiles.
             (
                 Self::A1_A | Self::A1_B,
                 ValidationError::InconsistentSeparationFallback(_)
+                | ValidationError::OverprintModeIccCmyk(_)
                 | ValidationError::InvalidCodepointMapping(_, _, _, _)
                 | ValidationError::UnicodePrivateArea(_, _, _, _)
                 | ValidationError::NoDocumentTitle
@@ -563,7 +592,8 @@ impl Archival {
                 | ValidationError::RequiresNewerPdfVersion(
                     VersionedFeature::HeaderFooterArtifactSubtypes
                     | VersionedFeature::StructureOrderTabbing
-                    | VersionedFeature::TableHeaderScope,
+                    | VersionedFeature::TableHeaderScope
+                    | VersionedFeature::OptionalContent,
                     _,
                 ),
             ) => false,
@@ -592,6 +622,8 @@ impl Archival {
                 | ValidationError::RestrictedLicense(_)
                 | ValidationError::MissingDocumentDate
                 | ValidationError::ImageInterpolation(_)
+                | ValidationError::OverprintModeIccCmyk(_)
+                | ValidationError::PdfxVersionWithoutExtensionSchema
                 | ValidationError::EmbeddedPDF(_),
             ) => true,
             // Allowed under all PDF/A-2 and PDF/A-3 profiles.
@@ -607,9 +639,11 @@ impl Archival {
                 | ValidationError::RequiresNewerPdfVersion(
                     VersionedFeature::HeaderFooterArtifactSubtypes
                     | VersionedFeature::StructureOrderTabbing
-                    | VersionedFeature::TableHeaderScope,
+                    | VersionedFeature::TableHeaderScope
+                    | VersionedFeature::OptionalContent,
                     _,
-                ),
+                )
+                | ValidationError::OptionalContent(_),
             ) => false,
             // Forbidden under PDF/A-2 but allowed under PDF/A-3.
             (
@@ -656,6 +690,7 @@ impl Archival {
                 | ValidationError::RestrictedLicense(_)
                 | ValidationError::MissingDocumentDate
                 | ValidationError::ImageInterpolation(_)
+                | ValidationError::OverprintModeIccCmyk(_)
                 | ValidationError::EmbeddedPDF(_),
             ) => true,
             // Allowed under all PDF/A-4 profiles.
@@ -669,6 +704,7 @@ impl Archival {
                 | ValidationError::TooManyIndirectObjects
                 | ValidationError::TooHighQNestingLevel
                 | ValidationError::ContainsPostScript(_)
+                | ValidationError::PdfxVersionWithoutExtensionSchema
                 | ValidationError::NoDocumentLanguage
                 | ValidationError::NoDocumentTitle
                 | ValidationError::MissingAltText(_)
@@ -684,9 +720,11 @@ impl Archival {
                 | ValidationError::RequiresNewerPdfVersion(
                     VersionedFeature::HeaderFooterArtifactSubtypes
                     | VersionedFeature::StructureOrderTabbing
-                    | VersionedFeature::TableHeaderScope,
+                    | VersionedFeature::TableHeaderScope
+                    | VersionedFeature::OptionalContent,
                     _,
-                ),
+                )
+                | ValidationError::OptionalContent(_),
             ) => false,
             // Forbidden under PDF/A-4 but allowed under other PDF/A-4 profiles.
             (
@@ -1110,7 +1148,8 @@ impl Accessibility {
                 | ValidationError::RequiresNewerPdfVersion(
                     VersionedFeature::HeaderFooterArtifactSubtypes
                     | VersionedFeature::StructureOrderTabbing
-                    | VersionedFeature::TableHeaderScope,
+                    | VersionedFeature::TableHeaderScope
+                    | VersionedFeature::OptionalContent,
                     _,
                 ),
             ) => true,
@@ -1130,11 +1169,14 @@ impl Accessibility {
                 | ValidationError::NoDocumentLanguage
                 | ValidationError::Transparency(_)
                 | ValidationError::ImageInterpolation(_)
+                | ValidationError::OverprintModeIccCmyk(_)
+                | ValidationError::PdfxVersionWithoutExtensionSchema
                 | ValidationError::EmbeddedFile(
                     EmbedError::Existence | EmbedError::MissingDate | EmbedError::MissingMimeType,
                     _,
                 )
-                | ValidationError::MissingDocumentDate,
+                | ValidationError::MissingDocumentDate
+                | ValidationError::OptionalContent(_),
             ) => false,
         }
     }
@@ -1220,17 +1262,28 @@ impl ValidationStore {
     pub(crate) fn validate_separation(
         &mut self,
         separation: &SeparationSpace,
+    ) -> Result<(), ValidationError> {
+        self.validate_colorant(&separation.colorant, separation.fallback)
+    }
+
+    /// Register a colorant used by a Separation or DeviceN color space with its
+    /// fallback (the DeviceN spot's CMYK alternate) and raise an error if the name
+    /// already has another one.
+    pub(crate) fn validate_colorant(
+        &mut self,
+        colorant: &SeparationColorant,
+        fallback: RegularColor,
     ) -> Result<(), ValidationError> {
         if self
             .separation_fallback_map
-            .entry(separation.colorant.clone())
-            .or_insert(separation.fallback)
-            == &separation.fallback
+            .entry(colorant.clone())
+            .or_insert(fallback)
+            == &fallback
         {
             Ok(())
         } else {
             Err(ValidationError::InconsistentSeparationFallback(
-                separation.colorant.clone(),
+                colorant.clone(),
             ))
         }
     }
diff --git a/vendor/krilla/src/content.rs b/vendor/krilla/src/content.rs
index dd5b1cb4..68779d60 100644
--- a/vendor/krilla/src/content.rs
+++ b/vendor/krilla/src/content.rs
@@ -16,11 +16,13 @@ use crate::configure::ValidationError;
 #[cfg(feature = "raster-images")]
 use crate::geom::Size;
 use crate::geom::{Point, Rect, Transform};
+use crate::graphics::blend::{GroupOptions, Overprint};
 use crate::graphics::color::{Color, ColorSpace};
 use crate::graphics::graphics_state::{ExtGState, GraphicsStates};
 #[cfg(feature = "raster-images")]
 use crate::graphics::image::Image;
 use crate::graphics::mask::Mask;
+use crate::graphics::optional_content::{self, OpenMarks};
 use crate::graphics::paint::{Fill, FillRule, InnerPaint, LineCap, LineJoin, Paint, Stroke};
 use crate::graphics::shading_function::{
     GradientProperties, GradientPropertiesExt, ShadingFunction,
@@ -41,8 +43,8 @@ use crate::text::{Glyph, GlyphId};
 use crate::util::{calculate_stroke_bbox, NameExt};
 
 pub(crate) struct ContentBuilder {
-    rd_builder: ResourceDictionaryBuilder,
-    content: Content,
+    pub(crate) rd_builder: ResourceDictionaryBuilder,
+    pub(crate) content: Content,
     validation_errors: HashSet<ValidationError>,
     root_transform: Transform,
     graphics_states: GraphicsStates,
@@ -56,6 +58,7 @@ pub(crate) struct ContentBuilder {
     /// A temporary buffer that's reused across the builder.
     scratch: Vec<u8>,
     pub(crate) active_marked_content: bool,
+    pub(crate) optional_content: OpenMarks,
 }
 
 /// Stores either a device-specific color space,
@@ -83,6 +86,7 @@ impl ContentBuilder {
             bbox: None,
             scratch: Vec::new(),
             active_marked_content: false,
+            optional_content: OpenMarks::default(),
         }
     }
 
@@ -95,7 +99,8 @@ impl ContentBuilder {
         }
     }
 
-    pub(crate) fn finish(self, sc: &mut SerializeContext) -> Stream {
+    pub(crate) fn finish(mut self, sc: &mut SerializeContext) -> Stream {
+        optional_content::close_open_marks(&mut self, sc);
         let buf = self.content.finish();
         sc.register_limits(buf.limits());
 
@@ -152,6 +157,7 @@ impl ContentBuilder {
             panic!("can't end marked content when none has been started");
         }
 
+        self.optional_content.tag_ended();
         self.content.end_marked_content();
         self.active_marked_content = false;
     }
@@ -183,6 +189,12 @@ impl ContentBuilder {
         }
     }
 
+    pub(crate) fn set_overprint(&mut self, overprint: Overprint) {
+        let state =
+            ExtGState::new().overprint(overprint.fill, overprint.stroke, overprint.to_pdf_mode());
+        self.graphics_states.combine(&state);
+    }
+
     pub(crate) fn expand_bbox(&mut self, new_bbox: Rect) {
         let new_bbox = self.graphics_states.transform_bbox(new_bbox);
         if let Some(bbox) = &mut self.bbox {
@@ -926,14 +938,15 @@ impl ContentBuilder {
         self.draw_xobject(sc, chunk_container, x_object, &state);
     }
 
-    pub(crate) fn draw_isolated(
+    pub(crate) fn draw_group(
         &mut self,
         sc: &mut SerializeContext,
         chunk_container: &mut ChunkContainer,
+        options: GroupOptions,
         stream: Stream,
     ) {
         let state = ExtGState::new();
-        let x_object = XObject::new(stream, true, false, None);
+        let x_object = XObject::group(stream, options);
         self.draw_xobject(sc, chunk_container, x_object, &state);
     }
 
@@ -1114,6 +1127,16 @@ impl ContentBuilder {
                 let (gradient_props, transform) = sg.clone().gradient_properties(bounds);
                 write_gradient(gradient_props, sc, chunk_container, transform, self);
             }
+            InnerPaint::MeshGradient(mg) => {
+                let transform = mg.transform;
+                write_gradient(
+                    GradientProperties::MeshGradient(mg.clone()),
+                    sc,
+                    chunk_container,
+                    transform,
+                    self,
+                );
+            }
             InnerPaint::Pattern(pat) => {
                 let mut pat = Arc::unwrap_or_clone(pat.clone());
                 pat.transform = pattern_transform(pat.transform);
diff --git a/vendor/krilla/src/error.rs b/vendor/krilla/src/error.rs
index 26cd7677..71580526 100644
--- a/vendor/krilla/src/error.rs
+++ b/vendor/krilla/src/error.rs
@@ -24,6 +24,34 @@ pub type KrillaResult<T> = Result<T, KrillaError>;
 pub enum KrillaError {
     /// A page or surface failed during cleanup; discard the complete document.
     Poisoned,
+    /// [`GroupColorSpace::Cmyk`] with `no_device_cs` needs a `cmyk_profile` for the group
+    /// color space.
+    ///
+    /// [`GroupColorSpace::Cmyk`]: crate::GroupColorSpace::Cmyk
+    MissingGroupCmykProfile,
+    /// A mesh gradient's corner colors are in color spaces that can't be written as one
+    /// (see [`MeshGradient`]), for example RGB with CMYK.
+    ///
+    /// [`MeshGradient`]: crate::paint::MeshGradient
+    MixedMeshColorSpaces(Option<Location>),
+    /// [`Surface::start_optional_content`] was given an [`OcgId`] that this document did
+    /// not create.
+    ///
+    /// [`Surface::start_optional_content`]: crate::surface::Surface::start_optional_content
+    /// [`OcgId`]: crate::optional_content::OcgId
+    UnknownOptionalContentGroup(Option<Location>),
+    /// Optional content marks were not balanced: an end without a start, a mark still open
+    /// when its stream finished, or a mark overlapping a tagged section.
+    UnbalancedOptionalContent(Option<Location>),
+    /// A link annotation has no finite bounding box on its page: its quad points are empty
+    /// or not finite, or its rect doesn't map to finite page coordinates.
+    InvalidAnnotationGeometry(Option<Location>),
+    /// An XYZ destination targets a page the document doesn't have (the index is
+    /// zero-based), or a point that isn't finite on that page.
+    InvalidDestination(usize),
+    /// A page's media, crop, bleed, trim or art box doesn't map to finite PDF coordinates.
+    /// Holds the zero-based page index.
+    InvalidPageBox(usize),
     /// An error while attempting to embed a font.
     Font(Font, String),
     /// A list of validation errors. Can only occur if you set the `validator` in
@@ -62,6 +90,35 @@ impl Display for KrillaError {
     fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
         match self {
             KrillaError::Poisoned => f.write_str("document contains a failed page or surface"),
+            KrillaError::MissingGroupCmykProfile => {
+                f.write_str("a CMYK group color space with no_device_cs needs a CMYK profile")
+            }
+            KrillaError::MixedMeshColorSpaces(location) => {
+                f.write_str("a mesh gradient mixes color spaces that can't be written as one")?;
+                write_location(f, *location)
+            }
+            KrillaError::UnknownOptionalContentGroup(location) => {
+                f.write_str("an optional content group from another document was used")?;
+                write_location(f, *location)
+            }
+            KrillaError::UnbalancedOptionalContent(location) => {
+                f.write_str("optional content marks are not balanced")?;
+                write_location(f, *location)
+            }
+            KrillaError::InvalidAnnotationGeometry(location) => {
+                f.write_str("a link annotation has no finite bounding box")?;
+                write_location(f, *location)
+            }
+            KrillaError::InvalidDestination(page_index) => write!(
+                f,
+                "a destination on page {} is not in the document or not finite",
+                page_index.saturating_add(1)
+            ),
+            KrillaError::InvalidPageBox(page_index) => write!(
+                f,
+                "a page box on page {} doesn't map to finite coordinates",
+                page_index.saturating_add(1)
+            ),
             KrillaError::Font(_, message) => write!(f, "failed to embed font: {message}"),
             KrillaError::Validation(errors) => {
                 let count = errors.len();
diff --git a/vendor/krilla/src/graphics/blend.rs b/vendor/krilla/src/graphics/blend.rs
index 9d0e98df..7f01733b 100644
--- a/vendor/krilla/src/graphics/blend.rs
+++ b/vendor/krilla/src/graphics/blend.rs
@@ -1,4 +1,4 @@
-//! Blending.
+//! Blending and overprint.
 
 /// How to blend source and backdrop.
 #[derive(Debug, Copy, Clone, Eq, PartialEq, Hash)]
@@ -44,3 +44,56 @@ impl BlendMode {
         }
     }
 }
+
+/// Overprint settings for the graphics state (`/op`, `/OP`, `/OPM`).
+///
+/// With overprint on, painting in one colorant leaves the other colorants of the backdrop
+/// in place on separated output instead of knocking them out. Viewers that don't simulate
+/// overprint ignore it.
+#[derive(Debug, Copy, Clone, Default, Eq, PartialEq, Hash)]
+pub struct Overprint {
+    /// Overprint for fills, including filled text (`/op`).
+    pub fill: bool,
+    /// Overprint for strokes, including stroked text (`/OP`).
+    pub stroke: bool,
+    /// Nonzero overprint mode (`/OPM 1`): a DeviceCMYK component of 0 leaves that
+    /// colorant of the backdrop unchanged. With `false` (`/OPM 0`), every DeviceCMYK
+    /// component paints, zero included.
+    ///
+    /// ISO 32000-1 (8.6.7) applies the mode to DeviceCMYK only. With
+    /// [`SerializeSettings::no_device_cs`] all CMYK is ICCBased, so a PDF 1.7 reader paints
+    /// zero components as with `false`, and PDF/A-2 and later reject the combination
+    /// ([`ValidationError::OverprintModeIccCmyk`]).
+    ///
+    /// [`SerializeSettings::no_device_cs`]: crate::SerializeSettings::no_device_cs
+    /// [`ValidationError::OverprintModeIccCmyk`]: crate::configure::ValidationError::OverprintModeIccCmyk
+    pub nonzero: bool,
+}
+
+impl Overprint {
+    pub(crate) fn to_pdf_mode(self) -> pdf_writer::types::OverprintMode {
+        if self.nonzero {
+            pdf_writer::types::OverprintMode::IgnoreZeroChannel
+        } else {
+            pdf_writer::types::OverprintMode::OverrideAllColorants
+        }
+    }
+}
+
+/// Attributes of a transparency group pushed with [`Surface::push_group`].
+///
+/// A group with neither attribute set is drawn as a plain form XObject: composited with
+/// the Normal blend mode at full opacity, it looks the same as its contents drawn directly.
+///
+/// [`Surface::push_group`]: crate::surface::Surface::push_group
+#[derive(Debug, Copy, Clone, Default, Eq, PartialEq, Hash)]
+pub struct GroupOptions {
+    /// Isolated group (`/I true`): its contents composite onto a fully transparent
+    /// backdrop instead of the group's backdrop, so blend modes inside it don't reach
+    /// what lies beneath.
+    pub isolated: bool,
+    /// Knockout group (`/K true`): each object inside composites with the group's
+    /// initial backdrop instead of the objects before it, so where objects overlap only
+    /// the topmost shows.
+    pub knockout: bool,
+}
diff --git a/vendor/krilla/src/graphics/color.rs b/vendor/krilla/src/graphics/color.rs
index 559305c5..6fb06180 100644
--- a/vendor/krilla/src/graphics/color.rs
+++ b/vendor/krilla/src/graphics/color.rs
@@ -2,11 +2,12 @@
 //!
 //! # Color spaces
 //!
-//! krilla currently supports four color models:
+//! krilla currently supports five color models:
 //! - RGB
 //! - Luma
 //! - CMYK
 //! - Separation (also known as Spot)
+//! - DeviceN (several process and spot colorants at once)
 //!
 //! Each color space is associated with its specific color type, which you can use to create new
 //! instances of a specific color in that color space.
@@ -54,7 +55,16 @@
 //! given colorant should not be referred to by multiple, slightly different names. Just the same
 //! for fallback colors: For a given colorant, there should be only one fallback color. Using multiple
 //! Separation color spaces with the same colorant and distinct fallback colors is considered a bad
-//! practice and forbidden in PDF/A-2 and later.
+//! practice and forbidden in PDF/A-2 and later. DeviceN spot colorants count too: a spot's
+//! CMYK alternate in a DeviceN color space must match its Separation fallback.
+//!
+//! # DeviceN
+//!
+//! A [`device_n::DeviceNSpace`] paints several colorants with one color, for example
+//! 60% Cyan and 40% Black without touching Magenta and Yellow, or a process ink mixed
+//! with a spot. Its alternate space is DeviceCMYK, or the `cmyk_profile` ICC space with
+//! `no_device_cs`. The tint transform is a PostScript calculator (Type 4) function, which
+//! some export formats forbid.
 //!
 //! [`SerializeSettings`]: crate::SerializeSettings
 
@@ -97,6 +107,8 @@ pub enum RegularColor {
 pub enum SpecialColor {
     /// A separation color.
     Separation(separation::Color),
+    /// A DeviceN color.
+    DeviceN(device_n::Color),
 }
 
 impl Color {
@@ -106,6 +118,7 @@ impl Color {
             Color::Regular(RegularColor::Luma(l)) => vec![l.to_pdf_color()],
             Color::Regular(RegularColor::Cmyk(cmyk)) => cmyk.to_pdf_color().to_vec(),
             Color::Special(SpecialColor::Separation(spot)) => vec![spot.to_pdf_color()],
+            Color::Special(SpecialColor::DeviceN(c)) => c.to_pdf_color(),
         }
     }
 
@@ -122,6 +135,7 @@ impl Color {
         match self {
             Color::Regular(c) => *c,
             Color::Special(SpecialColor::Separation(c)) => c.space.fallback,
+            Color::Special(SpecialColor::DeviceN(c)) => c.alternate().into(),
         }
     }
 }
@@ -162,6 +176,7 @@ impl SpecialColor {
     pub(crate) fn color_space(&self) -> SpecialColorSpace {
         match self {
             Self::Separation(spot) => spot.color_space().into(),
+            Self::DeviceN(c) => SpecialColorSpace::DeviceN(c.space.clone()),
         }
     }
 }
@@ -479,6 +494,208 @@ pub mod separation {
     }
 }
 
+/// DeviceN colors: several process and spot colorants painted by one color.
+pub mod device_n {
+    use std::sync::Arc;
+
+    use crate::color::cmyk;
+
+    /// A process colorant.
+    #[derive(Debug, Eq, PartialEq, Hash, Clone, Copy)]
+    pub enum Process {
+        /// Cyan.
+        Cyan,
+        /// Magenta.
+        Magenta,
+        /// Yellow.
+        Yellow,
+        /// Black.
+        Black,
+    }
+
+    impl Process {
+        /// The process colorants in DeviceCMYK order.
+        pub const ALL: [Process; 4] = [Self::Cyan, Self::Magenta, Self::Yellow, Self::Black];
+
+        /// The PDF colorant name.
+        pub fn name(self) -> &'static str {
+            match self {
+                Self::Cyan => "Cyan",
+                Self::Magenta => "Magenta",
+                Self::Yellow => "Yellow",
+                Self::Black => "Black",
+            }
+        }
+
+        fn index(self) -> usize {
+            self as usize
+        }
+    }
+
+    /// One colorant of a DeviceN color space.
+    #[derive(Debug, Eq, PartialEq, Hash, Clone)]
+    pub enum Colorant {
+        /// A process colorant, painted on its own CMYK plate.
+        Process(Process),
+        /// A spot colorant with the CMYK color that stands in for it at 100% tint.
+        ///
+        /// To export PDF/A-2 and later, use the same alternate wherever the name appears,
+        /// including as a Separation fallback.
+        Spot {
+            /// The colorant name.
+            name: String,
+            /// The CMYK color of a 100% tint.
+            alternate: cmyk::Color,
+        },
+    }
+
+    impl Colorant {
+        /// The PDF colorant name.
+        pub fn name(&self) -> &str {
+            match self {
+                Self::Process(p) => p.name(),
+                Self::Spot { name, .. } => name,
+            }
+        }
+
+        /// The CMYK components (0–1) a 100% tint of this colorant contributes.
+        pub(crate) fn alternate(&self) -> [f32; 4] {
+            match self {
+                Self::Process(p) => {
+                    let mut out = [0.0; 4];
+                    out[p.index()] = 1.0;
+                    out
+                }
+                Self::Spot { alternate, .. } => alternate.to_pdf_color(),
+            }
+        }
+    }
+
+    /// A DeviceN color space: an ordered list of colorants.
+    ///
+    /// A color's tints map to the alternate CMYK space component by component: each
+    /// colorant contributes its tint times its CMYK alternate, and the contributions
+    /// combine as `1 - (1 - a)(1 - b)…`. Process colorants contribute only to their own
+    /// component, so a space of process colorants alone maps tints directly.
+    #[derive(Debug, Eq, PartialEq, Hash, Clone)]
+    pub struct DeviceNSpace {
+        pub(crate) colorants: Arc<[Colorant]>,
+    }
+
+    impl DeviceNSpace {
+        /// The largest number of colorants PDF allows in a DeviceN color space.
+        pub const MAX_COLORANTS: usize = 32;
+
+        /// Create a DeviceN color space with the colorants in this order.
+        ///
+        /// Returns `None` without colorants, with more than [`Self::MAX_COLORANTS`], with
+        /// a name used twice, or with a spot named like a process colorant, `All`, `None`
+        /// or the empty string.
+        pub fn new(colorants: impl IntoIterator<Item = Colorant>) -> Option<Self> {
+            let colorants: Arc<[Colorant]> = colorants.into_iter().collect();
+            if colorants.is_empty() || colorants.len() > Self::MAX_COLORANTS {
+                return None;
+            }
+            for (i, colorant) in colorants.iter().enumerate() {
+                let name = colorant.name();
+                if let Colorant::Spot { .. } = colorant {
+                    let reserved = ["", "All", "None"].contains(&name)
+                        || Process::ALL.iter().any(|p| p.name() == name);
+                    if reserved {
+                        return None;
+                    }
+                }
+                if colorants[..i].iter().any(|c| c.name() == name) {
+                    return None;
+                }
+            }
+            Some(Self { colorants })
+        }
+
+        /// The colorants in color component order.
+        pub fn colorants(&self) -> &[Colorant] {
+            &self.colorants
+        }
+
+        pub(crate) fn has_process(&self) -> bool {
+            self.colorants
+                .iter()
+                .any(|c| matches!(c, Colorant::Process(_)))
+        }
+
+        pub(crate) fn spots(&self) -> impl Iterator<Item = (&str, cmyk::Color)> {
+            self.colorants.iter().filter_map(|c| match c {
+                Colorant::Spot { name, alternate } => Some((name.as_str(), *alternate)),
+                Colorant::Process(_) => None,
+            })
+        }
+
+        /// The alternate CMYK components (0–1) for tints (0–1), as the tint transform
+        /// computes them.
+        pub(crate) fn alternate(&self, tints: &[f32]) -> [f32; 4] {
+            let mut out = [0.0; 4];
+            for (component, value) in out.iter_mut().enumerate() {
+                let blank: f32 = self
+                    .colorants
+                    .iter()
+                    .zip(tints)
+                    .map(|(c, t)| 1.0 - t * c.alternate()[component])
+                    .product();
+                *value = 1.0 - blank;
+            }
+            out
+        }
+    }
+
+    impl From<DeviceNSpace> for super::SpecialColorSpace {
+        fn from(value: DeviceNSpace) -> Self {
+            Self::DeviceN(value)
+        }
+    }
+
+    /// A DeviceN color: one tint per colorant of its space.
+    #[derive(Debug, Hash, Eq, PartialEq, Clone)]
+    pub struct Color {
+        pub(crate) tints: Vec<u8>,
+        pub(crate) space: DeviceNSpace,
+    }
+
+    impl Color {
+        /// Create a DeviceN color, with the tints (0 = no ink, 255 = full ink) in the
+        /// order of the space's colorants.
+        ///
+        /// Returns `None` unless there is one tint per colorant.
+        pub fn new(tints: Vec<u8>, space: DeviceNSpace) -> Option<Self> {
+            (tints.len() == space.colorants.len()).then_some(Self { tints, space })
+        }
+
+        pub(crate) fn to_pdf_color(&self) -> Vec<f32> {
+            self.tints.iter().map(|t| *t as f32 / 255.0).collect()
+        }
+
+        /// The color in the alternate CMYK space.
+        pub(crate) fn alternate(&self) -> cmyk::Color {
+            let [c, m, y, k] = self
+                .space
+                .alternate(&self.to_pdf_color())
+                .map(|v| (v * 255.0).round().clamp(0.0, 255.0) as u8);
+            cmyk::Color::new(c, m, y, k)
+        }
+    }
+
+    impl From<Color> for super::SpecialColor {
+        fn from(val: Color) -> Self {
+            super::SpecialColor::DeviceN(val)
+        }
+    }
+
+    impl From<Color> for super::Color {
+        fn from(val: Color) -> Self {
+            super::SpecialColor::from(val).into()
+        }
+    }
+}
+
 #[derive(Debug, Eq, PartialEq, Hash, Clone)]
 pub(crate) enum ColorSpace {
     Device(DeviceColorSpace),
@@ -543,6 +760,8 @@ impl From<CieBasedColorSpace> for RegularColorSpace {
 pub(crate) enum SpecialColorSpace {
     /// A Separation color space with its colorant and fallback.
     Separation(separation::SeparationSpace),
+    /// A DeviceN color space with its colorants.
+    DeviceN(device_n::DeviceNSpace),
 }
 
 impl From<SpecialColorSpace> for ColorSpace {
diff --git a/vendor/krilla/src/graphics/device_n.rs b/vendor/krilla/src/graphics/device_n.rs
new file mode 100644
index 00000000..f2873ac1
--- /dev/null
+++ b/vendor/krilla/src/graphics/device_n.rs
@@ -0,0 +1,194 @@
+use std::ops::DerefMut;
+
+use pdf_writer::types::PostScriptOp;
+use pdf_writer::{Finish, Name, Ref};
+
+use crate::chunk_container::ChunkContainer;
+use crate::color::device_n::DeviceNSpace;
+use crate::color::separation::{SeparationColorant, SeparationSpace};
+use crate::color::{cmyk, ColorSpace, RegularColor, SpecialColorSpace};
+use crate::color::{DEVICE_CMYK, DEVICE_GRAY, DEVICE_RGB};
+use crate::configure::{PdfVersion, ValidationError};
+use crate::resource::{self, Resource, Resourceable};
+use crate::serialize::{Cacheable, MaybeDeviceColorSpace, SerializeContext};
+use crate::stream::FilterStreamBuilder;
+
+/// A DeviceN color space, written as
+/// `[/DeviceN [names] alternate tintTransform attributes?]`.
+///
+/// The alternate is DeviceCMYK, or the `cmyk_profile` ICC space with `no_device_cs`. The
+/// attributes dictionary lists each spot's Separation color space under `/Colorants`
+/// (PDF 1.3). From PDF 1.6, when spots and process colorants mix, it is an `NChannel` space
+/// whose `/Process` names the CMYK space and components; `/Subtype` and `/Process` don't
+/// exist before 1.6, and PDF/X-1a preflights reject them.
+#[derive(Debug, Eq, PartialEq, Hash, Clone)]
+pub(crate) struct DeviceNColorSpace {
+    space: DeviceNSpace,
+}
+
+impl DeviceNColorSpace {
+    pub fn new(space: DeviceNSpace) -> Self {
+        Self { space }
+    }
+}
+
+impl Cacheable for DeviceNColorSpace {
+    fn serialize(
+        self,
+        sc: &mut SerializeContext,
+        chunk_container: &mut ChunkContainer,
+        root_ref: Ref,
+    ) {
+        let space = self.space;
+        let alternate_cs = RegularColor::from(cmyk::Color::default()).color_space(sc);
+        let alternate = sc.register_colorspace(chunk_container, alternate_cs.into());
+
+        for (name, cmyk) in space.spots() {
+            let colorant = SeparationColorant::Custom(name.to_owned());
+            if let Err(e) = sc
+                .validation_store()
+                .validate_colorant(&colorant, cmyk.into())
+            {
+                sc.register_validation_error(e);
+            }
+        }
+
+        let tint_ref = tint_transform(&space, sc, chunk_container);
+
+        let mut separations = Vec::new();
+        for (name, cmyk) in space.spots() {
+            let separation =
+                SeparationSpace::new(SeparationColorant::Custom(name.to_owned()), cmyk.into());
+            let cs = ColorSpace::Special(SpecialColorSpace::Separation(separation));
+            if let MaybeDeviceColorSpace::ColorSpace(cs) =
+                sc.register_colorspace(chunk_container, cs)
+            {
+                separations.push((name.to_owned(), cs.get_ref()));
+            }
+        }
+        let nchannel = sc.serialize_settings().pdf_version() >= PdfVersion::Pdf16
+            && space.has_process()
+            && !separations.is_empty();
+
+        let chunk = &mut chunk_container.non_stream.color_spaces;
+        let mut array = chunk.indirect(root_ref).array();
+        array.item(Name(b"DeviceN"));
+        array
+            .push()
+            .array()
+            .items(space.colorants().iter().map(|c| Name(c.name().as_bytes())));
+        write_color_space(&mut array, &alternate);
+        array.item(tint_ref);
+
+        if !separations.is_empty() {
+            let mut attrs = array.push().dict();
+            if nchannel {
+                attrs.pair(Name(b"Subtype"), Name(b"NChannel"));
+            }
+            let mut colorants = attrs.insert(Name(b"Colorants")).dict();
+            for (name, separation) in &separations {
+                colorants.pair(Name(name.as_bytes()), *separation);
+            }
+            colorants.finish();
+            if nchannel {
+                let mut process = attrs.insert(Name(b"Process")).dict();
+                match &alternate {
+                    MaybeDeviceColorSpace::ColorSpace(cs) => {
+                        process.pair(Name(b"ColorSpace"), cs.get_ref());
+                    }
+                    _ => {
+                        process.pair(Name(b"ColorSpace"), Name(DEVICE_CMYK.as_bytes()));
+                    }
+                }
+                process
+                    .insert(Name(b"Components"))
+                    .array()
+                    .items(PROCESS_NAMES.map(|n| Name(n.as_bytes())));
+            }
+        }
+
+        array.finish();
+    }
+}
+
+impl Resourceable for DeviceNColorSpace {
+    type Resource = resource::ColorSpace;
+}
+
+const PROCESS_NAMES: [&str; 4] = ["Cyan", "Magenta", "Yellow", "Black"];
+
+fn write_color_space(array: &mut pdf_writer::Array<'_>, cs: &MaybeDeviceColorSpace) {
+    match cs {
+        MaybeDeviceColorSpace::DeviceRgb => array.item(Name(DEVICE_RGB.as_bytes())),
+        MaybeDeviceColorSpace::DeviceGray => array.item(Name(DEVICE_GRAY.as_bytes())),
+        MaybeDeviceColorSpace::DeviceCMYK => array.item(Name(DEVICE_CMYK.as_bytes())),
+        MaybeDeviceColorSpace::ColorSpace(cs) => array.item(cs.get_ref()),
+    };
+}
+
+/// Write the Type 4 tint transform from the space's tints to CMYK and return its
+/// reference. It computes [`DeviceNSpace::alternate`].
+fn tint_transform(
+    space: &DeviceNSpace,
+    sc: &mut SerializeContext,
+    chunk_container: &mut ChunkContainer,
+) -> Ref {
+    use PostScriptOp::*;
+
+    sc.register_validation_error(ValidationError::ContainsPostScript(sc.location));
+
+    let n = space.colorants().len();
+    let mut code = Vec::new();
+    // The stack holds the n tints; each pass pushes one CMYK component on top.
+    for component in 0..4 {
+        let terms: Vec<(usize, f32)> = space
+            .colorants()
+            .iter()
+            .enumerate()
+            .map(|(i, c)| (i, c.alternate()[component]))
+            .filter(|(_, a)| *a > 0.0)
+            .collect();
+        // Depth of tint `i` below the top, with `extra` values pushed above the tints.
+        let depth = |i: usize, extra: usize| (n - 1 - i + extra) as i32;
+        let scale = |code: &mut Vec<PostScriptOp<'static>>, a: f32| {
+            if a < 1.0 {
+                code.extend([Real(a), Mul]);
+            }
+        };
+        match terms.as_slice() {
+            [] => code.push(Real(0.0)),
+            [(i, a)] => {
+                code.extend([Integer(depth(*i, component)), Index]);
+                scale(&mut code, *a);
+            }
+            _ => {
+                // Product of (1 - tint × alternate), then 1 minus the product.
+                code.push(Real(1.0));
+                for (i, a) in &terms {
+                    code.extend([Integer(depth(*i, component + 1)), Index]);
+                    scale(&mut code, *a);
+                    code.extend([Real(1.0), Exch, Sub, Mul]);
+                }
+                code.extend([Real(1.0), Exch, Sub]);
+            }
+        }
+    }
+    // Move the four components below the tints, then drop the tints.
+    code.extend([Integer(n as i32 + 4), Integer(4), Roll]);
+    code.extend((0..n).map(|_| Pop));
+
+    let encoded = PostScriptOp::encode(&code);
+    sc.register_limits(encoded.limits());
+    let encoded = FilterStreamBuilder::new_from_content_stream(&encoded, &sc.serialize_settings())
+        .finish(&sc.serialize_settings());
+
+    let tint_ref = sc.new_ref();
+    let mut chunk = sc.new_chunk();
+    let mut function = chunk.post_script_function(tint_ref, encoded.encoded_data());
+    encoded.write_filters(function.deref_mut().deref_mut());
+    function.domain([0.0, 1.0].repeat(n));
+    function.range([0.0, 1.0].repeat(4));
+    function.finish();
+    chunk_container.streams.shading_functions.push(chunk);
+    tint_ref
+}
diff --git a/vendor/krilla/src/graphics/graphics_state.rs b/vendor/krilla/src/graphics/graphics_state.rs
index 918f0591..93f3e250 100644
--- a/vendor/krilla/src/graphics/graphics_state.rs
+++ b/vendor/krilla/src/graphics/graphics_state.rs
@@ -1,7 +1,7 @@
 use std::hash::Hash;
 use std::sync::Arc;
 
-use pdf_writer::types::BlendMode;
+use pdf_writer::types::{BlendMode, OverprintMode};
 use pdf_writer::{Finish, Name, Ref};
 
 use crate::chunk_container::ChunkContainer;
@@ -24,6 +24,12 @@ struct Repr {
     blend_mode: Option<BlendMode>,
     /// An active mask.
     mask: Option<Ref>,
+    /// Fill overprint (`/op`).
+    overprint_fill: Option<bool>,
+    /// Stroke overprint (`/OP`).
+    overprint_stroke: Option<bool>,
+    /// Overprint mode (`/OPM`).
+    overprint_mode: Option<OverprintMode>,
 }
 
 /// A graphics state containing information about
@@ -31,6 +37,7 @@ struct Repr {
 /// - The current non-stroking alpha.
 /// - The current blend mode.
 /// - The current mask.
+/// - The current overprint settings.
 ///
 /// This struct provides exposes a builder pattern for setting the various properties
 /// individually.
@@ -66,6 +73,16 @@ impl ExtGState {
         self
     }
 
+    /// Create a new graphics state with fill and stroke overprint and an overprint mode.
+    #[must_use]
+    pub(crate) fn overprint(mut self, fill: bool, stroke: bool, mode: OverprintMode) -> Self {
+        let repr = Arc::make_mut(&mut self.0);
+        repr.overprint_fill = Some(fill);
+        repr.overprint_stroke = Some(stroke);
+        repr.overprint_mode = Some(mode);
+        self
+    }
+
     /// Create a new graphics state with a mask.
     #[must_use]
     pub(crate) fn mask(
@@ -85,6 +102,9 @@ impl ExtGState {
             && self.0.stroking_alpha.is_none()
             && self.0.non_stroking_alpha.is_none()
             && self.0.blend_mode.is_none()
+            && self.0.overprint_fill.is_none()
+            && self.0.overprint_stroke.is_none()
+            && self.0.overprint_mode.is_none()
     }
 
     /// Integrate another graphics state into the current one. This is done by replacing
@@ -106,6 +126,18 @@ impl ExtGState {
         if let Some(mask) = other.0.mask {
             Arc::make_mut(&mut self.0).mask = Some(mask);
         }
+
+        if let Some(fill) = other.0.overprint_fill {
+            Arc::make_mut(&mut self.0).overprint_fill = Some(fill);
+        }
+
+        if let Some(stroke) = other.0.overprint_stroke {
+            Arc::make_mut(&mut self.0).overprint_stroke = Some(stroke);
+        }
+
+        if let Some(mode) = other.0.overprint_mode {
+            Arc::make_mut(&mut self.0).overprint_mode = Some(mode);
+        }
     }
 }
 
@@ -122,6 +154,7 @@ impl Cacheable for ExtGState {
         if let Some(nsa) = self.0.non_stroking_alpha {
             if nsa != NormalizedF32::ONE {
                 sc.register_validation_error(ValidationError::Transparency(sc.location));
+                sc.mark_transparent(root_ref);
             }
 
             ext_st.non_stroking_alpha(nsa.get());
@@ -130,6 +163,7 @@ impl Cacheable for ExtGState {
         if let Some(sa) = self.0.stroking_alpha {
             if sa != NormalizedF32::ONE {
                 sc.register_validation_error(ValidationError::Transparency(sc.location));
+                sc.mark_transparent(root_ref);
             }
 
             ext_st.stroking_alpha(sa.get());
@@ -138,6 +172,7 @@ impl Cacheable for ExtGState {
         if let Some(bm) = self.0.blend_mode {
             if bm != BlendMode::Normal {
                 sc.register_validation_error(ValidationError::Transparency(sc.location));
+                sc.mark_transparent(root_ref);
             }
 
             ext_st.blend_mode(bm);
@@ -145,10 +180,35 @@ impl Cacheable for ExtGState {
 
         if let Some(mask_ref) = self.0.mask {
             sc.register_validation_error(ValidationError::Transparency(sc.location));
+            sc.mark_transparent(root_ref);
 
             ext_st.pair(Name(b"SMask"), mask_ref);
         }
 
+        if let Some(fill) = self.0.overprint_fill {
+            ext_st.overprint_fill(fill);
+        }
+
+        if let Some(stroke) = self.0.overprint_stroke {
+            ext_st.overprint(stroke);
+        }
+
+        if let Some(mode) = self.0.overprint_mode {
+            // Under `no_device_cs` all CMYK is ICCBased, which PDF/A-2 and later forbid with
+            // OPM 1 when that side overprints. The colors painted under this state aren't
+            // known here, so any overprinting side counts.
+            let overprints =
+                self.0.overprint_fill == Some(true) || self.0.overprint_stroke == Some(true);
+            if mode == OverprintMode::IgnoreZeroChannel
+                && overprints
+                && sc.serialize_settings().no_device_cs
+            {
+                sc.register_validation_error(ValidationError::OverprintModeIccCmyk(sc.location));
+            }
+
+            ext_st.overprint_mode(mode);
+        }
+
         ext_st.finish();
     }
 }
diff --git a/vendor/krilla/src/graphics/image.rs b/vendor/krilla/src/graphics/image.rs
index d1d003d4..1c4f0736 100644
--- a/vendor/krilla/src/graphics/image.rs
+++ b/vendor/krilla/src/graphics/image.rs
@@ -22,8 +22,9 @@ use zune_jpeg::JpegDecoder;
 use crate::chunk_container::ChunkContainer;
 use crate::configure::ValidationError;
 use crate::error::KrillaError;
+use crate::graphics::color::device_n::DeviceNSpace;
 use crate::graphics::color::DEVICE_GRAY;
-use crate::graphics::color::{cmyk, luma, rgb};
+use crate::graphics::color::{cmyk, luma, rgb, ColorSpace as PdfColorSpace, SpecialColorSpace};
 use crate::graphics::icc::{GenericICCProfile, ICCBasedColorSpace, ICCProfile};
 use crate::serialize::SerializeContext;
 use crate::stream::{deflate_encode, FilterStreamBuilder};
@@ -57,22 +58,19 @@ pub enum ImageColorspace {
     Luma,
     /// The CMYK color space.
     Cmyk,
+    /// The DeviceN color space that [`CustomImage::device_n_space`] returns: one sample per
+    /// colorant, in the space's colorant order, 0 = no ink. Only for [`CustomImage`]; an ICC
+    /// profile is ignored.
+    DeviceN,
 }
 
 impl ImageColorspace {
-    fn num_components(&self) -> u8 {
-        match self {
-            ImageColorspace::Luma => 1,
-            ImageColorspace::Rgb => 3,
-            ImageColorspace::Cmyk => 4,
-        }
-    }
-
     fn matches_icc_profile(&self, profile: &GenericICCProfile) -> bool {
         match self {
             ImageColorspace::Rgb => matches!(profile, GenericICCProfile::Rgb(_)),
             ImageColorspace::Luma => matches!(profile, GenericICCProfile::Luma(_)),
             ImageColorspace::Cmyk => matches!(profile, GenericICCProfile::Cmyk(_)),
+            ImageColorspace::DeviceN => false,
         }
     }
 }
@@ -139,6 +137,11 @@ pub trait CustomImage: Hash + Clone + Send + Sync + 'static {
     fn icc_profile(&self) -> Option<&[u8]>;
     /// Return the color space of the image.
     fn color_space(&self) -> ImageColorspace;
+    /// Return the DeviceN color space of the image. Required when [`Self::color_space`]
+    /// returns [`ImageColorspace::DeviceN`], ignored otherwise.
+    fn device_n_space(&self) -> Option<DeviceNSpace> {
+        None
+    }
 }
 
 struct ImageMetadata {
@@ -147,6 +150,19 @@ struct ImageMetadata {
     has_alpha: bool,
     bits_per_component: BitsPerComponent,
     icc: Option<GenericICCProfile>,
+    /// The space of an [`ImageColorspace::DeviceN`] image.
+    device_n: Option<DeviceNSpace>,
+}
+
+impl ImageMetadata {
+    fn num_components(&self) -> usize {
+        match self.color_space {
+            ImageColorspace::Luma => 1,
+            ImageColorspace::Rgb => 3,
+            ImageColorspace::Cmyk => 4,
+            ImageColorspace::DeviceN => self.device_n.as_ref().map_or(0, |s| s.colorants().len()),
+        }
+    }
 }
 
 struct ImageRepr {
@@ -274,11 +290,11 @@ impl Image {
 
     /// Create a new image from a custom image.
     ///
-    /// Panics if the dimensions of the image and the length of the
-    /// data doesn't match.
+    /// Returns an error if the dimensions of the image and the length of the
+    /// data don't match.
     pub fn from_custom<T: CustomImage>(image: T, interpolate: bool) -> Result<Image, String> {
         let hash = (image.clone(), interpolate).sip_hash();
-        let metadata = ImageMetadata {
+        let mut metadata = ImageMetadata {
             size: image.size(),
             color_space: image.color_space(),
             has_alpha: image.alpha_channel().is_some(),
@@ -286,23 +302,40 @@ impl Image {
             icc: image
                 .icc_profile()
                 .and_then(|d| get_icc_profile_type(d, image.color_space())),
+            device_n: None,
         };
+        if metadata.color_space == ImageColorspace::DeviceN {
+            metadata.device_n = Some(
+                image
+                    .device_n_space()
+                    .ok_or("DeviceN image without a DeviceN space")?,
+            );
+        }
+
+        // Checked: 32 DeviceN components at 16 bits overflow `u32` at about 67 megapixels.
+        let bytes_per_component = usize::from(image.bits_per_component().as_u8() / 8);
+        let (width, height) = metadata.size;
+        let alpha_channel_len = usize::try_from(width)
+            .ok()
+            .zip(usize::try_from(height).ok())
+            .and_then(|(w, h)| w.checked_mul(h)?.checked_mul(bytes_per_component))
+            .ok_or("image dimensions are too large")?;
+        let color_channel_len = alpha_channel_len
+            .checked_mul(metadata.num_components())
+            .ok_or("image dimensions are too large")?;
+        if image.color_channel().len() != color_channel_len {
+            return Err("color channel length doesn't match the image dimensions".to_string());
+        }
+        if image
+            .alpha_channel()
+            .is_some_and(|alpha| alpha.len() != alpha_channel_len)
+        {
+            return Err("alpha channel length doesn't match the image dimensions".to_string());
+        }
 
         Ok(Self(Arc::new(ImageRepr {
             inner: Deferred::new(move || {
-                let bytes_per_component = (image.bits_per_component().as_u8() / 8) as u32;
-                let color_channel_len = bytes_per_component
-                    * image.color_space().num_components() as u32
-                    * metadata.size.0
-                    * metadata.size.1;
                 let color_channel = image.color_channel();
-                assert_eq!(color_channel.len(), color_channel_len as usize);
-
-                let alpha_channel_len = bytes_per_component * metadata.size.0 * metadata.size.1;
-                let alpha_channel = image.alpha_channel();
-                if let Some(alpha_channel) = alpha_channel {
-                    assert_eq!(alpha_channel.len(), alpha_channel_len as usize);
-                }
 
                 Ok(Repr::Sampled(SampledRepr {
                     color_channel: deflate_encode(color_channel),
@@ -325,6 +358,7 @@ impl Image {
             bits_per_component: BitsPerComponent::Eight,
             color_space: ImageColorspace::Rgb,
             icc: None,
+            device_n: None,
         };
 
         Self(Arc::new(ImageRepr {
@@ -365,6 +399,7 @@ impl Image {
     ) {
         let soft_mask_id = self.0.metadata.has_alpha.then(|| {
             sc.register_validation_error(ValidationError::Transparency(sc.location));
+            sc.mark_transparent(root_ref);
             sc.new_ref()
         });
 
@@ -416,6 +451,13 @@ impl Image {
                     }
                     Some(cs) => cs.into(),
                 },
+                ImageColorspace::DeviceN => match &self.0.metadata.device_n {
+                    Some(space) => {
+                        PdfColorSpace::Special(SpecialColorSpace::DeviceN(space.clone()))
+                    }
+                    // `from_custom` refuses a DeviceN image without a space.
+                    None => luma::color_space(sc.serialize_settings().no_device_cs).into(),
+                },
             };
 
             sc.register_colorspace(chunk_container, cs)
@@ -495,8 +537,7 @@ impl Image {
             // marker.
             if let Repr::Jpeg(j) = repr {
                 if j.invert_cmyk {
-                    image_x_object
-                        .decode([1.0, 0.0].repeat(self.color_space().num_components() as usize));
+                    image_x_object.decode([1.0, 0.0].repeat(self.0.metadata.num_components()));
                 }
             }
 
@@ -559,6 +600,7 @@ fn png_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
         bits_per_component,
         color_space: image_color_space,
         icc,
+        device_n: None,
     })
 }
 
@@ -638,6 +680,7 @@ fn jpeg_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
         bits_per_component: BitsPerComponent::Eight,
         color_space: image_color_space,
         icc,
+        device_n: None,
     })
 }
 
@@ -702,6 +745,7 @@ fn gif_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
         size: (size.width as u32, size.height as u32),
         color_space: ImageColorspace::Rgb,
         icc: None,
+        device_n: None,
     })
 }
 
@@ -721,6 +765,7 @@ fn webp_metadata(data: &[u8]) -> Result<ImageMetadata, String> {
         size,
         color_space,
         icc,
+        device_n: None,
     })
 }
 
@@ -843,6 +888,7 @@ fn get_icc_profile_type(data: &[u8], color_space: ImageColorspace) -> Option<Gen
         ImageColorspace::Rgb => GenericICCProfile::Rgb(ICCProfile::new(data)?),
         ImageColorspace::Luma => GenericICCProfile::Luma(ICCProfile::new(data)?),
         ImageColorspace::Cmyk => GenericICCProfile::Cmyk(ICCProfile::new(data)?),
+        ImageColorspace::DeviceN => return None,
     };
 
     Some(wrapper)
diff --git a/vendor/krilla/src/graphics/mask.rs b/vendor/krilla/src/graphics/mask.rs
index ffbb3de2..b526db9b 100644
--- a/vendor/krilla/src/graphics/mask.rs
+++ b/vendor/krilla/src/graphics/mask.rs
@@ -1,16 +1,20 @@
 //! Alpha and luminosity masks.
 
+use std::ops::DerefMut;
+
 use pdf_writer::{Finish, Name, Ref};
 
 use crate::chunk_container::ChunkContainer;
+use crate::color::RegularColor;
 use crate::geom::{Rect, Transform};
 use crate::graphics::shading_function::{GradientProperties, ShadingFunction};
-use crate::graphics::xobject::XObject;
+use crate::graphics::xobject::{GroupRole, XObject};
+use crate::num::NormalizedF32;
 use crate::resource;
 use crate::resource::Resourceable;
-use crate::serialize::{Cacheable, SerializeContext};
-use crate::stream::Stream;
+use crate::serialize::{Cacheable, GroupColorSpace, SerializeContext};
 use crate::stream::StreamBuilder;
+use crate::stream::{FilterStreamBuilder, Stream};
 
 /// A mask. Can be a luminance mask or an alpha mask.
 ///
@@ -28,6 +32,10 @@ pub struct Mask {
     /// we want to manually set the bbox of the underlying XObject to match the shape that the
     /// gradient is being applied to.
     custom_bbox: Option<Rect>,
+    /// `/BC`: the backdrop color of a luminosity mask.
+    backdrop: Option<RegularColor>,
+    /// `/TR`: the transfer function from group alpha or luminosity to mask value.
+    transfer: Option<TransferFunction>,
 }
 
 impl Mask {
@@ -38,9 +46,40 @@ impl Mask {
             stream,
             mask_type,
             custom_bbox: None,
+            backdrop: None,
+            transfer: None,
         }
     }
 
+    /// Set the backdrop color (`/BC`) of a luminosity mask: the color the mask group is
+    /// composited over, which gives the mask value wherever the mask content paints nothing.
+    /// The default is black, so the masked object is hidden outside the mask content.
+    ///
+    /// The color is written in the mask group's color space: RGB under
+    /// [`GroupColorSpace::Rgb`]; under [`GroupColorSpace::Cmyk`], DeviceCMYK, or sGrey when
+    /// `no_device_cs` is set. A color from another space is converted with the device
+    /// formulas; luma maps to equal RGB components or to black ink only.
+    ///
+    /// Only luminosity masks have a backdrop color. On an alpha mask this returns the mask
+    /// unchanged.
+    pub fn with_backdrop(mut self, color: impl Into<RegularColor>) -> Self {
+        if self.mask_type == MaskType::Luminosity {
+            self.backdrop = Some(color.into());
+        }
+        self
+    }
+
+    /// Set the transfer function (`/TR`) that maps the group alpha or luminosity to the mask
+    /// value. Without one, PDF readers use the identity.
+    ///
+    /// PDF/A-2 to 4 forbid the `TR` key of graphics states (6.2.5), not of soft-mask
+    /// dictionaries, so krilla's validators accept it. PDF/X forbids transfer functions in
+    /// graphics states; check the target preflight before using a soft-mask `/TR` in PDF/X.
+    pub fn with_transfer(mut self, transfer: TransferFunction) -> Self {
+        self.transfer = Some(transfer);
+        self
+    }
+
     /// Create a new mask for a shading to encode the opacity channels.
     pub(crate) fn new_from_shading(
         gradient_properties: GradientProperties,
@@ -60,6 +99,15 @@ impl Mask {
                     return None;
                 }
             }
+            GradientProperties::MeshGradient(mg) => {
+                if mg
+                    .patches
+                    .iter()
+                    .all(|p| p.opacities.iter().all(|o| o.get() == 1.0))
+                {
+                    return None;
+                }
+            }
         }
 
         let shading_function = ShadingFunction::new(gradient_properties, true);
@@ -78,6 +126,8 @@ impl Mask {
             stream: shading_stream,
             mask_type: MaskType::Luminosity,
             custom_bbox: Some(bbox),
+            backdrop: None,
+            transfer: None,
         })
     }
 }
@@ -101,6 +151,18 @@ impl MaskType {
     }
 }
 
+/// The transfer function (`/TR`) of a soft mask.
+#[derive(Clone, PartialEq, Eq, Debug, Hash)]
+pub enum TransferFunction {
+    /// Mask values equal the group alpha or luminosity (`/Identity`).
+    Identity,
+    /// A curve sampled at equal steps over the input range 0 to 1, first sample at 0 and last
+    /// at 1, interpolated linearly in between. Written as a Type 0 (sampled) function with
+    /// 16-bit samples. An empty curve is written as `/Identity`; a single sample gives a
+    /// constant mask value.
+    Sampled(Vec<NormalizedF32>),
+}
+
 impl Cacheable for Mask {
     fn serialize(
         self,
@@ -108,21 +170,142 @@ impl Cacheable for Mask {
         chunk_container: &mut ChunkContainer,
         root_ref: Ref,
     ) {
+        // Under RGB blending a mask source group is written like a content group, so
+        // keeping the content role there leaves object deduplication as it was.
+        let role = match sc.serialize_settings().group_color_space {
+            GroupColorSpace::Rgb => GroupRole::Content,
+            GroupColorSpace::Cmyk => GroupRole::MaskSource,
+        };
         let x_object = sc.register_cacheable(
             chunk_container,
-            XObject::new(self.stream, false, true, self.custom_bbox),
+            XObject::with_role(self.stream, false, true, self.custom_bbox, role),
         );
 
+        let backdrop = self
+            .backdrop
+            .filter(|_| self.mask_type == MaskType::Luminosity)
+            .map(|color| {
+                let settings = sc.serialize_settings();
+                match settings.group_color_space {
+                    GroupColorSpace::Rgb => backdrop_rgb(color).to_vec(),
+                    GroupColorSpace::Cmyk if settings.no_device_cs => vec![backdrop_gray(color)],
+                    GroupColorSpace::Cmyk => backdrop_cmyk(color).to_vec(),
+                }
+            });
+
+        let transfer = match &self.transfer {
+            Some(TransferFunction::Sampled(samples)) if !samples.is_empty() => {
+                Some(Some(write_sampled_transfer(sc, chunk_container, samples)))
+            }
+            Some(_) => Some(None),
+            None => None,
+        };
+
         let chunk = &mut chunk_container.non_stream.masks;
         let mut dict = chunk.indirect(root_ref).dict();
         dict.pair(Name(b"Type"), Name(b"Mask"));
         dict.pair(Name(b"S"), self.mask_type.to_name());
         dict.pair(Name(b"G"), x_object);
 
+        if let Some(backdrop) = backdrop {
+            dict.insert(Name(b"BC")).array().items(backdrop);
+        }
+
+        match transfer {
+            Some(Some(function)) => {
+                dict.pair(Name(b"TR"), function);
+            }
+            Some(None) => {
+                dict.pair(Name(b"TR"), Name(b"Identity"));
+            }
+            None => {}
+        }
+
         dict.finish();
     }
 }
 
+/// A backdrop color in an RGB mask group.
+fn backdrop_rgb(color: RegularColor) -> [f32; 3] {
+    match color {
+        RegularColor::Rgb(rgb) => rgb.to_pdf_color(),
+        RegularColor::Luma(luma) => [luma.to_pdf_color(); 3],
+        RegularColor::Cmyk(cmyk) => {
+            let [c, m, y, k] = cmyk.to_pdf_color();
+            [
+                (1.0 - c) * (1.0 - k),
+                (1.0 - m) * (1.0 - k),
+                (1.0 - y) * (1.0 - k),
+            ]
+        }
+    }
+}
+
+/// A backdrop color in a gray mask group.
+fn backdrop_gray(color: RegularColor) -> f32 {
+    match color {
+        RegularColor::Luma(luma) => luma.to_pdf_color(),
+        RegularColor::Rgb(rgb) => {
+            let [r, g, b] = rgb.to_pdf_color();
+            0.3 * r + 0.59 * g + 0.11 * b
+        }
+        RegularColor::Cmyk(cmyk) => {
+            let [c, m, y, k] = cmyk.to_pdf_color();
+            1.0 - (0.3 * c + 0.59 * m + 0.11 * y + k).min(1.0)
+        }
+    }
+}
+
+/// A backdrop color in a CMYK mask group.
+fn backdrop_cmyk(color: RegularColor) -> [f32; 4] {
+    match color {
+        RegularColor::Cmyk(cmyk) => cmyk.to_pdf_color(),
+        RegularColor::Luma(luma) => [0.0, 0.0, 0.0, 1.0 - luma.to_pdf_color()],
+        RegularColor::Rgb(rgb) => {
+            let [r, g, b] = rgb.to_pdf_color();
+            let k = 1.0 - r.max(g).max(b);
+            if k >= 1.0 {
+                return [0.0, 0.0, 0.0, 1.0];
+            }
+            let ink = |v: f32| (1.0 - v - k) / (1.0 - k);
+            [ink(r), ink(g), ink(b), k]
+        }
+    }
+}
+
+/// Write a sampled transfer curve as a Type 0 function and return its reference.
+fn write_sampled_transfer(
+    sc: &mut SerializeContext,
+    chunk_container: &mut ChunkContainer,
+    samples: &[NormalizedF32],
+) -> Ref {
+    let root_ref = sc.new_ref();
+    let serialize_settings = sc.serialize_settings();
+
+    // A Type 0 function needs two samples to span its domain.
+    let samples = match samples {
+        [only] => vec![*only, *only],
+        _ => samples.to_vec(),
+    };
+    let data: Vec<u8> = samples
+        .iter()
+        .flat_map(|sample| ((sample.get() * 65535.0).round() as u16).to_be_bytes())
+        .collect();
+
+    let stream = FilterStreamBuilder::new_from_binary_data(&data).finish(&serialize_settings);
+    let mut chunk = sc.new_chunk();
+    let mut function = chunk.sampled_function(root_ref, stream.encoded_data());
+    stream.write_filters(function.deref_mut().deref_mut());
+    function.domain([0.0, 1.0]);
+    function.range([0.0, 1.0]);
+    function.size([samples.len() as i32]);
+    function.bits_per_sample(16);
+    function.finish();
+    chunk_container.streams.shading_functions.push(chunk);
+
+    root_ref
+}
+
 impl Resourceable for Mask {
     type Resource = resource::XObject;
 }
diff --git a/vendor/krilla/src/graphics/mod.rs b/vendor/krilla/src/graphics/mod.rs
index fa15fdab..3864d6eb 100644
--- a/vendor/krilla/src/graphics/mod.rs
+++ b/vendor/krilla/src/graphics/mod.rs
@@ -6,7 +6,9 @@ pub mod icc;
 #[cfg(feature = "raster-images")]
 pub mod image;
 pub mod mask;
+pub mod optional_content;
 pub mod paint;
+pub(crate) mod device_n;
 pub(crate) mod separation;
 pub(crate) mod shading_function;
 pub(crate) mod shading_pattern;
diff --git a/vendor/krilla/src/graphics/optional_content.rs b/vendor/krilla/src/graphics/optional_content.rs
new file mode 100644
index 00000000..45c135f4
--- /dev/null
+++ b/vendor/krilla/src/graphics/optional_content.rs
@@ -0,0 +1,266 @@
+//! Optional content (layers).
+//!
+//! An optional content group (OCG) is a named layer that a viewer can show or hide. Create
+//! groups on the [`Document`] with [`Document::add_optional_content_group`], then mark
+//! content on any surface with [`Surface::start_optional_content`] and
+//! [`Surface::end_optional_content`].
+//!
+//! Every group is written once as `<< /Type /OCG /Name (…) >>`, and the catalog gets
+//! `/OCProperties` listing all groups, also those that no page uses, with the hidden ones
+//! in the default configuration's `/OFF` array. Marked content is written as
+//! `/OC /ocN BDC … EMC`, with `/ocN` registered in the `/Properties` resources of the
+//! stream that holds it.
+//!
+//! Optional content marks nest independently of tagged sections, but they must not overlap
+//! them: a tagged section started inside a mark ends before the mark does, and a mark started
+//! inside a tagged section ends before the section does. Marks are balanced per stream: a mark
+//! started before [`Surface::push_group`] (or any other push that starts a new stream, such as
+//! an opacity or a mask) can't be ended inside it.
+//!
+//! Optional content needs PDF 1.5 and is forbidden in PDF/A-1.
+//!
+//! [`Surface::push_group`]: crate::surface::Surface::push_group
+
+use std::collections::HashMap;
+
+use pdf_writer::types::PageMode;
+use pdf_writer::writers::{self, Catalog};
+use pdf_writer::{Dict, Finish, Name, Ref, TextStr};
+
+use crate::configure::validate::VersionedFeature;
+use crate::configure::ValidationError;
+use crate::content::ContentBuilder;
+use crate::document::Document;
+use crate::error::{KrillaError, KrillaResult};
+use crate::resource::{Resource, ResourceDictionaryBuilder, ResourceMapper};
+use crate::serialize::SerializeContext;
+use crate::surface::{Location, Surface};
+use crate::util::NameExt;
+
+/// An optional content group of a [`Document`], returned by
+/// [`Document::add_optional_content_group`].
+///
+/// An id is only meaningful for the document that created it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct OcgId(usize);
+
+struct Group {
+    ref_: Ref,
+    visible: bool,
+}
+
+/// The document's optional content groups and settings.
+#[derive(Default)]
+pub(crate) struct OptionalContent {
+    groups: Vec<Group>,
+    page_mode: bool,
+    /// Where the first unbalanced or overlapping mark was found;
+    /// [`SerializeContext::finish`] fails with [`KrillaError::UnbalancedOptionalContent`].
+    pub(crate) misuse: Option<Option<Location>>,
+}
+
+impl OptionalContent {
+    fn group_ref(&self, id: OcgId) -> Option<Ref> {
+        self.groups.get(id.0).map(|g| g.ref_)
+    }
+
+    fn record_misuse(&mut self, location: Option<Location>) {
+        self.misuse.get_or_insert(location);
+    }
+
+    /// Writes `/OCProperties`, and `/PageMode /UseOC` when requested, if any group exists.
+    pub(crate) fn write_catalog_entries(
+        &self,
+        catalog: &mut Catalog<'_>,
+        remapper: &HashMap<Ref, Ref>,
+    ) {
+        if self.groups.is_empty() {
+            return;
+        }
+
+        let all: Vec<Ref> = self
+            .groups
+            .iter()
+            .filter_map(|g| remapper.get(&g.ref_).copied())
+            .collect();
+        let hidden: Vec<Ref> = self
+            .groups
+            .iter()
+            .filter(|g| !g.visible)
+            .filter_map(|g| remapper.get(&g.ref_).copied())
+            .collect();
+
+        let mut properties = catalog.insert(Name(b"OCProperties")).dict();
+        properties
+            .insert(Name(b"OCGs"))
+            .array()
+            .items(all.iter().copied());
+        let mut config = properties.insert(Name(b"D")).dict();
+        config.pair(Name(b"Name"), TextStr("Layers"));
+        config
+            .insert(Name(b"Order"))
+            .array()
+            .items(all.iter().copied());
+        if !hidden.is_empty() {
+            config.insert(Name(b"OFF")).array().items(hidden);
+        }
+        config.finish();
+        properties.finish();
+
+        if self.page_mode {
+            catalog.page_mode(PageMode::UseOC);
+        }
+    }
+}
+
+impl Document {
+    /// Add an optional content group (a layer) named `name`, shown when the document opens
+    /// if `visible` is true.
+    ///
+    /// The group is listed in the catalog's `/OCProperties` even if no content uses it.
+    /// Names are text strings, so any Unicode name works; they need not be unique.
+    ///
+    /// Optional content needs PDF 1.5 and is forbidden in PDF/A-1: adding a group registers
+    /// [`ValidationError::OptionalContent`] and, below PDF 1.5,
+    /// [`ValidationError::RequiresNewerPdfVersion`].
+    pub fn add_optional_content_group(&mut self, name: impl Into<String>, visible: bool) -> OcgId {
+        let sc = &mut self.serializer_context;
+        let name = name.into();
+
+        sc.register_validation_error(ValidationError::OptionalContent(sc.location));
+        if sc.serialize_settings().pdf_version()
+            < VersionedFeature::OptionalContent.minimum_pdf_version()
+        {
+            sc.register_validation_error(ValidationError::RequiresNewerPdfVersion(
+                VersionedFeature::OptionalContent,
+                sc.location,
+            ));
+        }
+
+        let ref_ = sc.new_ref();
+        let mut ocg = self
+            .chunk_container
+            .non_stream
+            .optional_content
+            .indirect(ref_)
+            .dict();
+        ocg.pair(Name(b"Type"), Name(b"OCG"));
+        ocg.pair(Name(b"Name"), TextStr(&name));
+        ocg.finish();
+
+        let groups = &mut sc.optional_content.groups;
+        groups.push(Group { ref_, visible });
+        OcgId(groups.len() - 1)
+    }
+
+    /// Whether the document opens with the viewer's layers panel showing
+    /// (`/PageMode /UseOC`). Only written when the document has optional content groups.
+    /// Off by default.
+    pub fn set_optional_content_page_mode(&mut self, use_oc: bool) {
+        self.serializer_context.optional_content.page_mode = use_oc;
+    }
+}
+
+impl Surface<'_> {
+    /// Start content that belongs to the optional content group `group`, until the matching
+    /// [`Surface::end_optional_content`].
+    ///
+    /// Marks nest, and a mark may contain tagged sections (see the [module
+    /// documentation](crate::optional_content) for the nesting rules). Content left open
+    /// when the surface finishes, or when a group, opacity or mask pushed after the start
+    /// is popped, is closed there, and [`Document::finish`] then fails with
+    /// [`KrillaError::UnbalancedOptionalContent`].
+    ///
+    /// Returns [`KrillaError::UnknownOptionalContentGroup`] and writes nothing if `group`
+    /// does not belong to this document.
+    pub fn start_optional_content(&mut self, group: OcgId) -> KrillaResult<()> {
+        let (builder, sc) = self.content_and_context();
+        let Some(ocg) = sc.optional_content.group_ref(group) else {
+            return Err(KrillaError::UnknownOptionalContentGroup(sc.location));
+        };
+
+        let name = builder.rd_builder.register_resource(Properties(ocg));
+        builder
+            .content
+            .begin_marked_content_with_properties(Name(b"OC"))
+            .properties_named(name.to_pdf_name());
+        let tagged = builder.active_marked_content;
+        builder.optional_content.open.push(tagged);
+        Ok(())
+    }
+
+    /// End the innermost optional content started with [`Surface::start_optional_content`]
+    /// in the current stream.
+    ///
+    /// Returns [`KrillaError::UnbalancedOptionalContent`] and writes nothing if no optional
+    /// content is open in the current stream, or if a tagged section started inside it is
+    /// still open.
+    pub fn end_optional_content(&mut self) -> KrillaResult<()> {
+        let (builder, sc) = self.content_and_context();
+        let tagged = builder.active_marked_content;
+        if builder.optional_content.open.last() != Some(&tagged) {
+            return Err(KrillaError::UnbalancedOptionalContent(sc.location));
+        }
+
+        builder.optional_content.open.pop();
+        builder.content.end_marked_content();
+        Ok(())
+    }
+}
+
+/// The optional content marks open in one content stream. Each entry records whether a
+/// tagged section was open when the mark started.
+#[derive(Default)]
+pub(crate) struct OpenMarks {
+    open: Vec<bool>,
+    overlap: bool,
+}
+
+impl OpenMarks {
+    /// Called when a tagged section ends: a mark started inside it would be closed by its
+    /// `EMC`.
+    pub(crate) fn tag_ended(&mut self) {
+        if self.open.last() == Some(&true) {
+            self.overlap = true;
+        }
+    }
+}
+
+/// Close the marks still open in `builder` before its stream is finished, and record the
+/// misuse for [`SerializeContext::finish`].
+pub(crate) fn close_open_marks(builder: &mut ContentBuilder, sc: &mut SerializeContext) {
+    let open = std::mem::take(&mut builder.optional_content.open);
+    for _ in &open {
+        builder.content.end_marked_content();
+    }
+    if !open.is_empty() || builder.optional_content.overlap {
+        let location = sc.location;
+        sc.optional_content.record_misuse(location);
+    }
+}
+
+/// An entry of a resource dictionary's `/Properties`: an optional content group.
+#[derive(Debug, Eq, PartialEq, Hash, Clone)]
+pub(crate) struct Properties(Ref);
+
+impl Resource for Properties {
+    fn new(ref_: Ref) -> Self {
+        Self(ref_)
+    }
+
+    fn get_ref(&self) -> Ref {
+        self.0
+    }
+
+    fn get_dict<'a>(resources: &'a mut writers::Resources) -> Dict<'a> {
+        resources.insert(Name(b"Properties")).dict()
+    }
+
+    fn get_prefix() -> &'static str {
+        "oc"
+    }
+
+    fn get_mapper(b: &mut ResourceDictionaryBuilder) -> &mut ResourceMapper<Properties> {
+        &mut b.properties
+    }
+}
diff --git a/vendor/krilla/src/graphics/paint.rs b/vendor/krilla/src/graphics/paint.rs
index cd4413c4..abe88920 100644
--- a/vendor/krilla/src/graphics/paint.rs
+++ b/vendor/krilla/src/graphics/paint.rs
@@ -28,7 +28,10 @@ pub struct LinearGradient {
     pub spread_method: SpreadMethod,
     /// The color stops of the linear gradient.
     ///
-    /// Note that all stops need to be in the same color space.
+    /// Stops in different color spaces built from inks (CMYK, luma as black, spots with a
+    /// CMYK fallback, DeviceN) are written in one space: Separation for a single spot,
+    /// DeviceCMYK for process colors alone, DeviceN otherwise. Other stops need to be in the
+    /// same color space.
     pub stops: Vec<Stop>,
     /// Whether the gradient should be anti-aliased.
     pub anti_alias: bool,
@@ -49,6 +52,65 @@ impl Hash for LinearGradient {
     }
 }
 
+/// One Coons patch of a [`MeshGradient`].
+#[derive(Debug, Clone, PartialEq)]
+pub struct MeshPatch {
+    /// The twelve boundary control points, in the order a PDF Type 6 shading lists them
+    /// (ISO 32000-1, 8.7.4.5.7): starting at a corner, three cubic Bézier edges' worth of points
+    /// going one way round the patch, so the corners are `points[0]`, `[3]`, `[6]` and `[9]`.
+    pub points: [(f32, f32); 12],
+    /// The colors at the corners `points[0]`, `[3]`, `[6]` and `[9]`.
+    ///
+    /// Corner colors of a mesh in different color spaces built from inks (CMYK, luma as
+    /// black, spots with a CMYK fallback, DeviceN) are written in one space: Separation for a
+    /// single spot, DeviceCMYK for process colors alone, DeviceN otherwise. Other colors need
+    /// to share one color space across the whole mesh, or [`Document::finish`] fails with
+    /// [`KrillaError::MixedMeshColorSpaces`].
+    ///
+    /// [`Document::finish`]: crate::Document::finish
+    /// [`KrillaError::MixedMeshColorSpaces`]: crate::error::KrillaError::MixedMeshColorSpaces
+    pub colors: [Color; 4],
+    /// The opacities at the same corners.
+    pub opacities: [NormalizedF32; 4],
+}
+
+impl Eq for MeshPatch {}
+
+impl Hash for MeshPatch {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        for (x, y) in &self.points {
+            x.to_bits().hash(state);
+            y.to_bits().hash(state);
+        }
+        self.colors.hash(state);
+        self.opacities.hash(state);
+    }
+}
+
+/// A mesh gradient: Coons patches, each blending its four corner colors across its curved
+/// shape, written as one PDF Type 6 shading so the viewer or RIP blends them smoothly at its
+/// own resolution. Corner opacities below 1 add a soft mask, as for the other gradients.
+/// Patches paint in order (a later one over an earlier one); a fill paints only where they lie.
+#[derive(Debug, Clone, PartialEq)]
+pub struct MeshGradient {
+    /// The patches.
+    pub patches: Vec<MeshPatch>,
+    /// A transform that should be applied to the mesh gradient.
+    pub transform: Transform,
+    /// Whether the gradient should be anti-aliased.
+    pub anti_alias: bool,
+}
+
+impl Eq for MeshGradient {}
+
+impl Hash for MeshGradient {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.patches.hash(state);
+        self.transform.hash(state);
+        self.anti_alias.hash(state);
+    }
+}
+
 /// A radial gradient.
 #[derive(Debug, Clone, PartialEq)]
 pub struct RadialGradient {
@@ -73,7 +135,10 @@ pub struct RadialGradient {
     pub spread_method: SpreadMethod,
     /// The color stops of the radial gradient.
     ///
-    /// Note that all stops need to be in the same color space.
+    /// Stops in different color spaces built from inks (CMYK, luma as black, spots with a
+    /// CMYK fallback, DeviceN) are written in one space: Separation for a single spot,
+    /// DeviceCMYK for process colors alone, DeviceN otherwise. Other stops need to be in the
+    /// same color space.
     pub stops: Vec<Stop>,
     /// Whether the gradient should be anti-aliased.
     pub anti_alias: bool,
@@ -115,7 +180,10 @@ pub struct SweepGradient {
     pub spread_method: SpreadMethod,
     /// The color stops of the sweep gradient.
     ///
-    /// Note that all stops need to be in the same color space.
+    /// Stops in different color spaces built from inks (CMYK, luma as black, spots with a
+    /// CMYK fallback, DeviceN) are written in one space: Separation for a single spot,
+    /// DeviceCMYK for process colors alone, DeviceN otherwise. Other stops need to be in the
+    /// same color space.
     pub stops: Vec<Stop>,
     /// Whether the gradient should be anti-aliased.
     pub anti_alias: bool,
@@ -169,6 +237,7 @@ pub(crate) enum InnerPaint {
     LinearGradient(LinearGradient),
     RadialGradient(RadialGradient),
     SweepGradient(SweepGradient),
+    MeshGradient(Arc<MeshGradient>),
     Pattern(Arc<Pattern>),
 }
 
@@ -186,6 +255,7 @@ impl Paint {
             InnerPaint::Color(c) => match c {
                 Color::Regular(c) => c.as_rgb(),
                 Color::Special(SpecialColor::Separation(c)) => c.space.fallback.as_rgb(),
+                Color::Special(SpecialColor::DeviceN(_)) => None,
             },
             _ => None,
         }
@@ -210,6 +280,12 @@ impl From<cmyk::Color> for Paint {
     }
 }
 
+impl From<MeshGradient> for Paint {
+    fn from(value: MeshGradient) -> Self {
+        Paint(InnerPaint::MeshGradient(Arc::new(value)))
+    }
+}
+
 impl From<Color> for Paint {
     fn from(value: Color) -> Self {
         Paint(InnerPaint::Color(value))
diff --git a/vendor/krilla/src/graphics/shading_function.rs b/vendor/krilla/src/graphics/shading_function.rs
index 0b652a8f..74c56f36 100644
--- a/vendor/krilla/src/graphics/shading_function.rs
+++ b/vendor/krilla/src/graphics/shading_function.rs
@@ -4,15 +4,18 @@ use std::sync::Arc;
 
 use bumpalo::Bump;
 use pdf_writer::types::{FunctionShadingType, PostScriptOp};
+use pdf_writer::writers::StreamShadingType;
 use pdf_writer::{Chunk, Finish, Ref};
 use tiny_skia_path::Point;
 
 use crate::chunk_container::ChunkContainer;
 use crate::configure::ValidationError;
 use crate::geom::{Rect, Transform};
-use crate::graphics::color::luma;
-use crate::graphics::color::{Color, ColorSpace};
-use crate::graphics::paint::{LinearGradient, RadialGradient, SweepGradient};
+use crate::graphics::color::device_n::{self, Colorant, DeviceNSpace, Process};
+use crate::graphics::color::separation::{self, SeparationColorant, SeparationSpace};
+use crate::graphics::color::{cmyk, luma};
+use crate::graphics::color::{Color, ColorSpace, RegularColor, SpecialColor};
+use crate::graphics::paint::{LinearGradient, MeshGradient, RadialGradient, SweepGradient};
 use crate::graphics::paint::{SpreadMethod, Stop};
 use crate::num::NormalizedF32;
 use crate::resource;
@@ -82,6 +85,7 @@ impl Hash for PostScriptGradient {
 pub(crate) enum GradientProperties {
     RadialAxialGradient(RadialAxialGradient),
     PostScriptGradient(PostScriptGradient),
+    MeshGradient(Arc<MeshGradient>),
 }
 
 impl GradientProperties {
@@ -98,6 +102,7 @@ impl GradientProperties {
                     return Some((&psg.stops[0].color, psg.stops[0].opacity));
                 }
             }
+            GradientProperties::MeshGradient(_) => {}
         }
 
         None
@@ -218,6 +223,11 @@ pub(crate) struct ShadingFunction(Arc<Repr>);
 
 impl ShadingFunction {
     pub(crate) fn new(properties: GradientProperties, use_opacities: bool) -> Self {
+        let properties = if use_opacities {
+            properties
+        } else {
+            properties.with_common_color_space()
+        };
         Self(Arc::new(Repr {
             properties,
             use_opacities,
@@ -225,6 +235,228 @@ impl ShadingFunction {
     }
 }
 
+impl GradientProperties {
+    /// Rewrite stops, or mesh corner colors, in different ink-based color spaces into one
+    /// space (see [`common_color_space`]); other gradients are returned unchanged.
+    fn with_common_color_space(self) -> Self {
+        fn convert(stops: &mut [Stop]) {
+            let colors: Vec<Color> = stops.iter().map(|s| s.color.clone()).collect();
+            if let Some(colors) = common_color_space(&colors) {
+                for (stop, color) in stops.iter_mut().zip(colors) {
+                    stop.color = color;
+                }
+            }
+        }
+
+        match self {
+            GradientProperties::RadialAxialGradient(mut rag) => {
+                convert(&mut rag.stops);
+                GradientProperties::RadialAxialGradient(rag)
+            }
+            GradientProperties::PostScriptGradient(mut psg) => {
+                convert(&mut psg.stops);
+                GradientProperties::PostScriptGradient(psg)
+            }
+            GradientProperties::MeshGradient(mesh) => {
+                let colors: Vec<Color> = mesh
+                    .patches
+                    .iter()
+                    .flat_map(|p| p.colors.iter().cloned())
+                    .collect();
+                let Some(colors) = common_color_space(&colors) else {
+                    return GradientProperties::MeshGradient(mesh);
+                };
+                let mut mesh = Arc::unwrap_or_clone(mesh);
+                let corners = mesh.patches.iter_mut().flat_map(|p| p.colors.iter_mut());
+                for (corner, color) in corners.zip(colors) {
+                    *corner = color;
+                }
+                GradientProperties::MeshGradient(Arc::new(mesh))
+            }
+        }
+    }
+}
+
+/// The inks of one gradient color: process tints and spot tints (0–255).
+struct Inks {
+    process: [u8; 4],
+    /// Process colorants a DeviceN color names, even at zero tint.
+    named_process: [bool; 4],
+    spots: Vec<(String, u8)>,
+}
+
+/// A spot named by a gradient color: the Separation space a stop used, and the CMYK
+/// alternate a DeviceN space needs.
+struct SpotInk {
+    name: String,
+    separation: Option<SeparationSpace>,
+    alternate: Option<cmyk::Color>,
+}
+
+/// Record a spot; the first Separation space and CMYK alternate seen for a name win.
+fn add_spot(
+    spot_inks: &mut Vec<SpotInk>,
+    name: &str,
+    separation: Option<&SeparationSpace>,
+    alternate: Option<cmyk::Color>,
+) {
+    match spot_inks.iter_mut().find(|s| s.name == name) {
+        Some(ink) => {
+            if ink.separation.is_none() {
+                ink.separation = separation.cloned();
+            }
+            if ink.alternate.is_none() {
+                ink.alternate = alternate;
+            }
+        }
+        None => spot_inks.push(SpotInk {
+            name: name.to_owned(),
+            separation: separation.cloned(),
+            alternate,
+        }),
+    }
+}
+
+fn same_color_space(a: &Color, b: &Color) -> bool {
+    match (a, b) {
+        (Color::Regular(a), Color::Regular(b)) => {
+            std::mem::discriminant(a) == std::mem::discriminant(b)
+        }
+        (
+            Color::Special(SpecialColor::Separation(a)),
+            Color::Special(SpecialColor::Separation(b)),
+        ) => a.space == b.space,
+        (Color::Special(SpecialColor::DeviceN(a)), Color::Special(SpecialColor::DeviceN(b))) => {
+            a.space == b.space
+        }
+        _ => false,
+    }
+}
+
+/// The colors rewritten in one color space when they are in different spaces built from
+/// inks (CMYK, gray as black, named spots with a CMYK fallback, DeviceN). `None` keeps
+/// them as they are: they share a space already, or one of them isn't made of inks.
+///
+/// A process colorant takes part when a color has it at a nonzero tint or a DeviceN color
+/// names it; a spot takes part when any color names it. One spot alone gives a Separation
+/// space, process colorants alone DeviceCMYK, anything else a DeviceN space with the
+/// process colorants in CMYK order, then the spots in the order the colors name them.
+/// Paper (CMYK 0 0 0 0, white, tint 0) adds no colorant, so a spot to paper stays a
+/// Separation gradient.
+pub(crate) fn common_color_space(colors: &[Color]) -> Option<Vec<Color>> {
+    let first = colors.first()?;
+    if colors.iter().all(|c| same_color_space(first, c)) {
+        return None;
+    }
+
+    let mut spot_inks: Vec<SpotInk> = Vec::new();
+    let mut all_inks = Vec::with_capacity(colors.len());
+    for color in colors {
+        let mut inks = Inks {
+            process: [0; 4],
+            named_process: [false; 4],
+            spots: Vec::new(),
+        };
+        match color {
+            Color::Regular(RegularColor::Cmyk(c)) => inks.process = [c.0, c.1, c.2, c.3],
+            Color::Regular(RegularColor::Luma(l)) => inks.process[3] = 255 - l.0,
+            Color::Regular(RegularColor::Rgb(_)) => return None,
+            Color::Special(SpecialColor::Separation(s)) => {
+                let SeparationColorant::Custom(name) = &s.space.colorant else {
+                    return None;
+                };
+                let alternate = match s.space.fallback {
+                    RegularColor::Cmyk(c) => Some(c),
+                    _ => None,
+                };
+                add_spot(&mut spot_inks, name, Some(&s.space), alternate);
+                inks.spots.push((name.clone(), s.tint));
+            }
+            Color::Special(SpecialColor::DeviceN(c)) => {
+                for (colorant, tint) in c.space.colorants().iter().zip(&c.tints) {
+                    match colorant {
+                        Colorant::Process(p) => {
+                            let i = Process::ALL.iter().position(|q| q == p).unwrap_or(0);
+                            inks.process[i] = *tint;
+                            inks.named_process[i] = true;
+                        }
+                        Colorant::Spot { name, alternate } => {
+                            add_spot(&mut spot_inks, name, None, Some(*alternate));
+                            inks.spots.push((name.clone(), *tint));
+                        }
+                    }
+                }
+            }
+        }
+        all_inks.push(inks);
+    }
+
+    let process: Vec<usize> = (0..4)
+        .filter(|&i| {
+            all_inks
+                .iter()
+                .any(|inks| inks.process[i] > 0 || inks.named_process[i])
+        })
+        .collect();
+    let spot_tint = |inks: &Inks, name: &str| {
+        inks.spots
+            .iter()
+            .find(|(n, _)| n == name)
+            .map_or(0, |(_, t)| *t)
+    };
+
+    match (process.as_slice(), spot_inks.as_slice()) {
+        (_, []) => Some(
+            all_inks
+                .iter()
+                .map(|inks| {
+                    let [c, m, y, k] = inks.process;
+                    cmyk::Color::new(c, m, y, k).into()
+                })
+                .collect(),
+        ),
+        ([], [spot]) => {
+            let space = match (&spot.separation, spot.alternate) {
+                (Some(space), _) => space.clone(),
+                (None, Some(alternate)) => SeparationSpace::new(
+                    SeparationColorant::Custom(spot.name.clone()),
+                    alternate.into(),
+                ),
+                (None, None) => return None,
+            };
+            Some(
+                all_inks
+                    .iter()
+                    .map(|inks| {
+                        separation::Color::new(spot_tint(inks, &spot.name), space.clone()).into()
+                    })
+                    .collect(),
+            )
+        }
+        _ => {
+            let mut colorants: Vec<Colorant> = process
+                .iter()
+                .map(|&i| Colorant::Process(Process::ALL[i]))
+                .collect();
+            for spot in &spot_inks {
+                colorants.push(Colorant::Spot {
+                    name: spot.name.clone(),
+                    alternate: spot.alternate?,
+                });
+            }
+            let space = DeviceNSpace::new(colorants)?;
+            all_inks
+                .iter()
+                .map(|inks| {
+                    let mut tints: Vec<u8> = process.iter().map(|&i| inks.process[i]).collect();
+                    tints.extend(spot_inks.iter().map(|s| spot_tint(inks, &s.name)));
+                    device_n::Color::new(tints, space.clone()).map(Color::from)
+                })
+                .collect()
+        }
+    }
+}
+
 impl Cacheable for ShadingFunction {
     fn serialize(
         self,
@@ -265,6 +497,35 @@ impl Cacheable for ShadingFunction {
                     registered_cs,
                 )
             }
+            GradientProperties::MeshGradient(mg) => {
+                // No patches paints nothing; the shading is still written, as it is referenced.
+                let first = mg
+                    .patches
+                    .first()
+                    .map_or_else(|| luma::Color::black().into(), |p| p.colors[0].clone());
+                // `ShadingFunction::new` has brought ink-based colors into one space; any
+                // others left can't share the stream's one color space.
+                if !self.0.use_opacities
+                    && sc.mixed_mesh_colors.is_none()
+                    && !mg
+                        .patches
+                        .iter()
+                        .flat_map(|p| p.colors.iter())
+                        .all(|c| same_color_space(&first, c))
+                {
+                    sc.mixed_mesh_colors = Some(sc.location);
+                }
+                let shading_cs = shading_color_space(sc, first, self.0.use_opacities);
+                let registered_cs = sc.register_colorspace(chunk_container, shading_cs);
+                serialize_mesh_shading(
+                    sc,
+                    &mut stream_chunk,
+                    root_ref,
+                    mg,
+                    self.0.use_opacities,
+                    registered_cs,
+                );
+            }
         }
 
         // Note: The stream chunk might be empty.
@@ -284,6 +545,83 @@ fn shading_color_space(sc: &mut SerializeContext, color: Color, use_opacities: b
     }
 }
 
+/// A mesh gradient as a Type 6 (Coons patch mesh) shading: per patch an 8-bit edge flag (0, no
+/// shared edge), the twelve points as 32-bit coordinates over the mesh's bounds (`Decode`), and
+/// the four corner colors (with `use_opacities`, the opacities as gray) at 8 bits a component,
+/// Flate-compressed. 32-bit coordinates keep the patches where they are to well under a printer
+/// dot, as Illustrator writes its meshes.
+fn serialize_mesh_shading(
+    sc: &mut SerializeContext,
+    chunk: &mut Chunk,
+    root_ref: Ref,
+    mesh: &MeshGradient,
+    use_opacities: bool,
+    cs: MaybeDeviceColorSpace,
+) {
+    let (mut x0, mut y0, mut x1, mut y1) = (f32::MAX, f32::MAX, f32::MIN, f32::MIN);
+    for (x, y) in mesh.patches.iter().flat_map(|p| p.points.iter()) {
+        (x0, y0, x1, y1) = (x0.min(*x), y0.min(*y), x1.max(*x), y1.max(*y));
+    }
+    if !(x0.is_finite() && y0.is_finite() && x1.is_finite() && y1.is_finite()) {
+        (x0, y0, x1, y1) = (0.0, 0.0, 1.0, 1.0);
+    }
+    // A zero-size range would divide by zero: widen it by a point either way.
+    if x1 - x0 < f32::EPSILON {
+        (x0, x1) = (x0 - 1.0, x1 + 1.0);
+    }
+    if y1 - y0 < f32::EPSILON {
+        (y0, y1) = (y0 - 1.0, y1 + 1.0);
+    }
+    let components = if use_opacities {
+        1
+    } else {
+        mesh.patches
+            .first()
+            .map_or(1, |p| p.colors[0].to_pdf_color().len())
+    };
+    let coord = |v: f32, lo: f32, hi: f32| {
+        (((f64::from(v) - f64::from(lo)) / (f64::from(hi) - f64::from(lo))).clamp(0.0, 1.0)
+            * f64::from(u32::MAX))
+        .round() as u32
+    };
+    let byte = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
+    let mut data = Vec::with_capacity(mesh.patches.len() * (1 + 12 * 8 + 4 * components));
+    for patch in &mesh.patches {
+        data.push(0u8);
+        for (x, y) in &patch.points {
+            data.extend(coord(*x, x0, x1).to_be_bytes());
+            data.extend(coord(*y, y0, y1).to_be_bytes());
+        }
+        for (color, opacity) in patch.colors.iter().zip(patch.opacities.iter()) {
+            if use_opacities {
+                data.push(byte(opacity.get()));
+            } else {
+                let values = color.to_pdf_color();
+                // Mixed spaces fail the document (`mixed_mesh_colors`); still never misread bytes.
+                for i in 0..components {
+                    data.push(byte(values.get(i).copied().unwrap_or(0.0)));
+                }
+            }
+        }
+    }
+    let filter_stream =
+        FilterStreamBuilder::new_from_binary_data(&data).finish(&sc.serialize_settings());
+    let mut shading = chunk.stream_shading(root_ref, filter_stream.encoded_data());
+    filter_stream.write_filters(shading.deref_mut().deref_mut());
+    shading.shading_type(StreamShadingType::CoonsPatch);
+    set_colorspace(cs, shading.deref_mut().deref_mut());
+    shading.bits_per_coordinate(32);
+    shading.bits_per_component(8);
+    shading.bits_per_flag(8);
+    let mut decode = vec![x0, x1, y0, y1];
+    for _ in 0..components {
+        decode.extend([0.0, 1.0]);
+    }
+    shading.decode(decode);
+    shading.anti_alias(mesh.anti_alias);
+    shading.finish();
+}
+
 fn serialize_postscript_shading(
     sc: &mut SerializeContext,
     chunk: &mut Chunk,
@@ -497,15 +835,23 @@ fn serialize_sweep_postscript(
         properties.domain.bottom(),
     ]);
 
-    if use_opacities {
-        postscript_function.range([0.0, 1.0]);
-    } else {
-        postscript_function.range([0.0, 1.0, 0.0, 1.0, 0.0, 1.0]);
-    }
+    postscript_function.range([0.0, 1.0].repeat(output_components(properties, use_opacities)));
 
     root_ref
 }
 
+/// The number of values a PostScript gradient function returns.
+fn output_components(properties: &PostScriptGradient, use_opacities: bool) -> usize {
+    if use_opacities {
+        1
+    } else {
+        properties
+            .stops
+            .first()
+            .map_or(1, |s| s.color.to_pdf_color().len())
+    }
+}
+
 const MAX_POSTSCRIPT_STOPS: usize = 97;
 
 fn trim_stops(stops: &[Stop]) -> Vec<Stop> {
@@ -563,11 +909,7 @@ fn serialize_linear_postscript(
         properties.domain.bottom(),
     ]);
 
-    if use_opacities {
-        postscript_function.range([0.0, 1.0]);
-    } else {
-        postscript_function.range([0.0, 1.0, 0.0, 1.0, 0.0, 1.0]);
-    }
+    postscript_function.range([0.0, 1.0].repeat(output_components(properties, use_opacities)));
 
     root_ref
 }
diff --git a/vendor/krilla/src/graphics/tiling_pattern.rs b/vendor/krilla/src/graphics/tiling_pattern.rs
index e26f1d8c..94e640e3 100644
--- a/vendor/krilla/src/graphics/tiling_pattern.rs
+++ b/vendor/krilla/src/graphics/tiling_pattern.rs
@@ -85,6 +85,10 @@ impl Cacheable for TilingPattern {
             sc.register_validation_error(validation_error);
         }
 
+        if sc.uses_transparency(&self.stream.resource_dictionary) {
+            sc.mark_transparent(root_ref);
+        }
+
         let pattern_stream = FilterStreamBuilder::new_from_content_stream(
             &self.stream.content,
             &sc.serialize_settings(),
diff --git a/vendor/krilla/src/graphics/xobject.rs b/vendor/krilla/src/graphics/xobject.rs
index 28d6f388..a8c95687 100644
--- a/vendor/krilla/src/graphics/xobject.rs
+++ b/vendor/krilla/src/graphics/xobject.rs
@@ -1,24 +1,38 @@
 use std::ops::DerefMut;
 use std::sync::Arc;
 
+use pdf_writer::writers::Group;
 use pdf_writer::{Finish, Name, Ref};
 
 use crate::chunk_container::ChunkContainer;
 use crate::configure::ValidationError;
 use crate::geom::Rect;
-use crate::graphics::color::{rgb, DEVICE_RGB};
+use crate::graphics::blend::GroupOptions;
+use crate::graphics::color::{rgb, DEVICE_CMYK, DEVICE_RGB};
 use crate::resource;
 use crate::resource::{Resource, Resourceable};
-use crate::serialize::{Cacheable, MaybeDeviceColorSpace, SerializeContext};
+use crate::serialize::{Cacheable, GroupColorSpace, MaybeDeviceColorSpace, SerializeContext};
 use crate::stream::{FilterStreamBuilder, Stream};
 use crate::util::{NameExt, Prehashed};
 
+/// What a group XObject is used for, which decides its `/CS` under
+/// [`GroupColorSpace::Cmyk`].
+#[derive(Debug, Hash, Eq, PartialEq, Clone, Copy)]
+pub(crate) enum GroupRole {
+    /// Drawn in a page or another form: inherits the parent's blending space.
+    Content,
+    /// The `/G` of a soft mask: has no parent, so it names its blending space.
+    MaskSource,
+}
+
 #[derive(Debug, Hash, Eq, PartialEq)]
 struct Repr {
     stream: Stream,
     isolated: bool,
+    knockout: bool,
     transparency_group_color_space: bool,
     custom_bbox: Option<Rect>,
+    role: GroupRole,
 }
 
 #[derive(Debug, Hash, Clone, Eq, PartialEq)]
@@ -28,8 +42,54 @@ impl XObject {
     pub(crate) fn new(
         stream: Stream,
         isolated: bool,
+        transparency_group_color_space: bool,
+        custom_bbox: Option<Rect>,
+    ) -> Self {
+        Self::with_role(
+            stream,
+            isolated,
+            transparency_group_color_space,
+            custom_bbox,
+            GroupRole::Content,
+        )
+    }
+
+    /// A content group with the given group attributes.
+    pub(crate) fn group(stream: Stream, options: GroupOptions) -> Self {
+        Self::build(
+            stream,
+            options.isolated,
+            options.knockout,
+            false,
+            None,
+            GroupRole::Content,
+        )
+    }
+
+    pub(crate) fn with_role(
+        stream: Stream,
+        isolated: bool,
+        transparency_group_color_space: bool,
+        custom_bbox: Option<Rect>,
+        role: GroupRole,
+    ) -> Self {
+        Self::build(
+            stream,
+            isolated,
+            false,
+            transparency_group_color_space,
+            custom_bbox,
+            role,
+        )
+    }
+
+    fn build(
+        stream: Stream,
+        isolated: bool,
+        knockout: bool,
         mut transparency_group_color_space: bool,
         custom_bbox: Option<Rect>,
+        role: GroupRole,
     ) -> Self {
         // In case a mask was invoked in the content stream, we _always_ create
         // a new transparency group. Please see <https://github.com/typst/typst/issues/5509>.
@@ -46,8 +106,10 @@ impl XObject {
         Self(Arc::new(Prehashed::new(Repr {
             stream,
             isolated,
+            knockout,
             transparency_group_color_space,
             custom_bbox,
+            role,
         })))
     }
 
@@ -73,12 +135,17 @@ impl Cacheable for XObject {
             sc.register_validation_error(validation_error.clone());
         }
 
-        let use_transparency_group = self.0.isolated || self.0.transparency_group_color_space;
+        let use_transparency_group =
+            self.0.isolated || self.0.knockout || self.0.transparency_group_color_space;
 
         if use_transparency_group {
             sc.register_validation_error(ValidationError::Transparency(sc.location));
         }
 
+        if use_transparency_group || sc.uses_transparency(&self.0.stream.resource_dictionary) {
+            sc.mark_transparent(root_ref);
+        }
+
         let serialize_settings = sc.serialize_settings();
 
         // "Ordinarily, the CS entry may be present only for isolated transparency groups (those
@@ -88,13 +155,21 @@ impl Cacheable for XObject {
         //
         // So while we don't technically always need to write it, let's just play it save
         // and always add a group color space in case we have a transparency group.
-        let transparency_group_cs = if use_transparency_group {
-            Some(sc.register_colorspace(
-                chunk_container,
-                rgb::color_space(serialize_settings.no_device_cs).into(),
-            ))
-        } else {
+        //
+        // Under `GroupColorSpace::Cmyk`, content groups inherit the CMYK page group instead.
+        let transparency_group_cs = if !use_transparency_group {
             None
+        } else {
+            match (serialize_settings.group_color_space, self.0.role) {
+                (GroupColorSpace::Rgb, _) => Some(sc.register_colorspace(
+                    chunk_container,
+                    rgb::color_space(serialize_settings.no_device_cs).into(),
+                )),
+                (GroupColorSpace::Cmyk, GroupRole::Content) => None,
+                (GroupColorSpace::Cmyk, GroupRole::MaskSource) => {
+                    Some(sc.mask_group_color_space(chunk_container))
+                }
+            }
         };
 
         let x_object_stream = FilterStreamBuilder::new_from_content_stream(
@@ -125,15 +200,12 @@ impl Cacheable for XObject {
                 transparency.isolated(self.0.isolated);
             }
 
-            if let Some(transparency_group_cs) = transparency_group_cs {
-                let pdf_cs = transparency.insert(Name(b"CS"));
+            if self.0.knockout {
+                transparency.knockout(true);
+            }
 
-                match transparency_group_cs {
-                    MaybeDeviceColorSpace::DeviceRgb => pdf_cs.primitive(DEVICE_RGB.to_pdf_name()),
-                    // Can only be SRGB
-                    MaybeDeviceColorSpace::ColorSpace(cs) => pdf_cs.primitive(cs.get_ref()),
-                    _ => unreachable!(),
-                }
+            if let Some(transparency_group_cs) = transparency_group_cs {
+                write_group_color_space(transparency, transparency_group_cs);
             }
 
             transparency.finish();
@@ -145,6 +217,18 @@ impl Cacheable for XObject {
     }
 }
 
+/// Write the `/CS` of a transparency group: DeviceRGB, DeviceCMYK, sRGB or the CMYK profile.
+pub(crate) fn write_group_color_space(group: &mut Group<'_>, cs: MaybeDeviceColorSpace) {
+    let pdf_cs = group.insert(Name(b"CS"));
+
+    match cs {
+        MaybeDeviceColorSpace::DeviceRgb => pdf_cs.primitive(DEVICE_RGB.to_pdf_name()),
+        MaybeDeviceColorSpace::DeviceCMYK => pdf_cs.primitive(DEVICE_CMYK.to_pdf_name()),
+        MaybeDeviceColorSpace::ColorSpace(cs) => pdf_cs.primitive(cs.get_ref()),
+        _ => unreachable!(),
+    }
+}
+
 impl Resourceable for XObject {
     type Resource = resource::XObject;
 }
diff --git a/vendor/krilla/src/interactive/annotation.rs b/vendor/krilla/src/interactive/annotation.rs
index 91c4cff6..f2121f1a 100644
--- a/vendor/krilla/src/interactive/annotation.rs
+++ b/vendor/krilla/src/interactive/annotation.rs
@@ -14,7 +14,7 @@ use pdf_writer::{Finish, Name, Ref, TextStr};
 use crate::chunk_container::ChunkContainer;
 use crate::color::Color;
 use crate::configure::{PdfVersion, ValidationError};
-use crate::error::KrillaResult;
+use crate::error::{KrillaError, KrillaResult};
 use crate::geom::{Quadrilateral, Rect};
 use crate::interactive::action::Action;
 use crate::interactive::destination::Destination;
@@ -70,15 +70,20 @@ impl Annotation {
         root_ref: Ref,
         page_height: f32,
     ) -> KrillaResult<()> {
+        let AnnotationType::Link(l) = &self.annotation_type;
+        // Checked before the object starts, so a refused annotation writes nothing.
+        let rect = l
+            .page_rect(page_height)
+            .ok_or(KrillaError::InvalidAnnotationGeometry(self.location))?;
+
         let chunk = &mut chunk_container.non_stream.annotations;
         let mut annotation = chunk
             .indirect(root_ref)
             .start::<pdf_writer::writers::Annotation>();
 
         self.annotation_type
-            .serialize_type(sc, &mut annotation, page_height)?;
+            .serialize_type(sc, &mut annotation, page_height, rect)?;
 
-        let AnnotationType::Link(l) = &self.annotation_type;
         // Only set the print flag when really necessary (only PDF/A). Don't
         // set it by default, so annotations with color borders will be shown
         // on a screen but not printed.
@@ -124,9 +129,10 @@ impl AnnotationType {
         sc: &mut SerializeContext,
         annotation: &mut pdf_writer::writers::Annotation,
         page_height: f32,
+        rect: Rect,
     ) -> KrillaResult<()> {
         match self {
-            AnnotationType::Link(l) => l.serialize_type(sc, annotation, page_height),
+            AnnotationType::Link(l) => l.serialize_type(sc, annotation, page_height, rect),
         }
     }
 }
@@ -157,7 +163,8 @@ impl LinkBorder {
 
 /// A link annotation.
 pub struct LinkAnnotation {
-    pub(crate) rect: Rect,
+    /// `None` when the quad points have no finite bounding box.
+    pub(crate) rect: Option<Rect>,
     pub(crate) quad_points: Option<Vec<Quadrilateral>>,
     pub(crate) target: Target,
     pub(crate) border: Option<LinkBorder>,
@@ -170,7 +177,7 @@ impl LinkAnnotation {
     /// `target`: The target of the link annotation.
     pub fn new(rect: Rect, target: Target) -> Self {
         Self {
-            rect,
+            rect: Some(rect),
             quad_points: None,
             target,
             border: None,
@@ -183,8 +190,16 @@ impl LinkAnnotation {
     /// `quad_points`: An array of quadrilaterals that define where the link
     /// annotation should be activated. This is useful if you for example have
     /// a link annotation that is broken to one or multiple lines.
+    ///
+    /// An empty list, or a point that isn't finite, makes [`Document::finish`] return
+    /// [`KrillaError::InvalidAnnotationGeometry`].
+    ///
+    /// [`Document::finish`]: crate::Document::finish
     pub fn new_with_quad_points(quad_points: Vec<Quadrilateral>, target: Target) -> Self {
-        assert!(!quad_points.is_empty());
+        let finite = quad_points
+            .iter()
+            .flat_map(|q| q.0)
+            .all(|p| p.x.is_finite() && p.y.is_finite());
 
         let mut min_x = f32::INFINITY;
         let mut min_y = f32::INFINITY;
@@ -202,13 +217,16 @@ impl LinkAnnotation {
         // that sometimes prevents the quadpoints from being used if the quad
         // points lie exactly on the bounding rectangle.
         const EPSILON: f32 = 0.001;
-        let rect = Rect::from_ltrb(
-            min_x - EPSILON,
-            min_y - EPSILON,
-            max_x + EPSILON,
-            max_y + EPSILON,
-        )
-        .unwrap();
+        let rect = finite
+            .then(|| {
+                Rect::from_ltrb(
+                    min_x - EPSILON,
+                    min_y - EPSILON,
+                    max_x + EPSILON,
+                    max_y + EPSILON,
+                )
+            })
+            .flatten();
 
         Self {
             rect,
@@ -227,19 +245,23 @@ impl LinkAnnotation {
         }
     }
 
+    /// The rect in PDF page coordinates, or `None` when there is no rect or it doesn't
+    /// map to finite coordinates. The quad points lie inside the rect, so they map to
+    /// finite coordinates whenever it does.
+    fn page_rect(&self, page_height: f32) -> Option<Rect> {
+        self.rect?.transform(page_root_transform(page_height))
+    }
+
     fn serialize_type(
         &self,
         sc: &mut SerializeContext,
         annotation: &mut pdf_writer::writers::Annotation,
         page_height: f32,
+        rect: Rect,
     ) -> KrillaResult<()> {
         annotation.subtype(pdf_writer::types::AnnotationType::Link);
 
-        let actual_rect = self
-            .rect
-            .transform(page_root_transform(page_height))
-            .unwrap();
-        annotation.rect(actual_rect.to_pdf_rect());
+        annotation.rect(rect.to_pdf_rect());
         annotation.border(
             0.0,
             0.0,
diff --git a/vendor/krilla/src/interactive/destination.rs b/vendor/krilla/src/interactive/destination.rs
index de40085d..ec509511 100644
--- a/vendor/krilla/src/interactive/destination.rs
+++ b/vendor/krilla/src/interactive/destination.rs
@@ -117,7 +117,10 @@ impl From<XyzDestination> for Destination {
 impl XyzDestination {
     /// Create a new XYZ destination. `page_index` should be the index (i.e. number) of the
     /// target page, and point indicates the specific location on that page that should be
-    /// targeted. If the `page_index` is out of range, export will panic.
+    /// targeted. A `page_index` out of range, or a point that isn't finite, makes
+    /// [`Document::finish`] return [`KrillaError::InvalidDestination`].
+    ///
+    /// [`Document::finish`]: crate::Document::finish
     pub fn new(page_index: usize, point: Point) -> Self {
         Self(Arc::new(XyzDestRepr { page_index, point }))
     }
@@ -127,17 +130,9 @@ impl XyzDestination {
         sc: &mut SerializeContext,
         chunk_container: &mut ChunkContainer,
         root_ref: Ref,
-    ) {
-        let chunk = &mut chunk_container.non_stream.destinations;
-        let destination = chunk.destination(root_ref);
-
-        let page_info = sc.page_infos().get(self.0.page_index).unwrap_or_else(|| {
-            panic!(
-                "attempted to link to page {}, but document only has {} pages",
-                self.0.page_index + 1,
-                sc.page_infos().len()
-            )
-        });
+    ) -> KrillaResult<()> {
+        let invalid = || KrillaError::InvalidDestination(self.0.page_index);
+        let page_info = sc.page_infos().get(self.0.page_index).ok_or_else(invalid)?;
 
         let (ref_, surface_size) = match page_info {
             PageInfo::Krilla {
@@ -153,10 +148,17 @@ impl XyzDestination {
         // Convert to PDF coordinates
         let invert_transform = Transform::from_row(1.0, 0.0, 0.0, -1.0, 0.0, page_size);
         invert_transform.map_point(&mut mapped_point);
+        if !(mapped_point.x.is_finite() && mapped_point.y.is_finite()) {
+            return Err(invalid());
+        }
 
-        destination
+        chunk_container
+            .non_stream
+            .destinations
+            .destination(root_ref)
             .page(page_ref)
             .xyz(mapped_point.x, mapped_point.y, None);
+        Ok(())
     }
 }
 
diff --git a/vendor/krilla/src/interchange/metadata.rs b/vendor/krilla/src/interchange/metadata.rs
index 18dde72c..6c74b361 100644
--- a/vendor/krilla/src/interchange/metadata.rs
+++ b/vendor/krilla/src/interchange/metadata.rs
@@ -9,8 +9,8 @@ use pdf_writer::{Finish, Pdf, Ref, TextStr};
 use std::cell::LazyCell;
 use xmp_writer::{LangId, Timezone, XmpWriter};
 
-use crate::configure::{Configuration, PdfVersion, ValidationError};
-use crate::serialize::SerializeContext;
+use crate::configure::{PdfVersion, ValidationError};
+use crate::serialize::{SerializeContext, SerializeSettings};
 
 /// Metadata for a PDF document.
 #[derive(Default, Clone, Debug)]
@@ -24,6 +24,7 @@ pub struct Metadata {
     pub(crate) document_id: Option<String>,
     pub(crate) language: Option<String>,
     pub(crate) creation_date: Option<DateTime>,
+    pub(crate) modification_date: Option<DateTime>,
     pub(crate) text_direction: Option<TextDirection>,
     pub(crate) page_layout: Option<PageLayout>,
 }
@@ -101,6 +102,18 @@ impl Metadata {
         self
     }
 
+    /// The date the document was last modified. Without it, the creation date is
+    /// written as the modification date.
+    pub fn modification_date(mut self, modification_date: DateTime) -> Self {
+        self.modification_date = Some(modification_date);
+        self
+    }
+
+    /// The date written as the modification date: the one given, else the creation date.
+    fn modified(&self) -> Option<DateTime> {
+        self.modification_date.or(self.creation_date)
+    }
+
     /// A document ID.
     ///
     /// This attribute will be used as an identifier for identifying
@@ -129,6 +142,7 @@ impl Metadata {
             || self.authors.is_some()
             || self.creator.is_some()
             || self.creation_date.is_some()
+            || self.modification_date.is_some()
             || self.description.is_some()
     }
 
@@ -195,8 +209,11 @@ impl Metadata {
             xmp.language([LangId(lang)]);
         }
 
-        if let Some(date) = self.creation_date.map(xmp_date) {
+        if let Some(date) = self.modified().map(xmp_date) {
             xmp.modify_date(date);
+        }
+
+        if let Some(date) = self.creation_date.map(xmp_date) {
             xmp.create_date(date);
 
             if sc
@@ -248,13 +265,14 @@ impl Metadata {
         &self,
         ref_: &mut Ref,
         pdf: &mut Pdf,
-        config: Configuration,
+        settings: &SerializeSettings,
     ) {
+        let config = settings.configuration;
         if config.validators().prohibits_info_dict() {
             return;
         }
 
-        if self.has_document_info() {
+        if self.has_document_info() || settings.has_print_info(config.version()) {
             let ref_ = ref_.bump();
             let mut document_info = LazyCell::new(|| pdf.document_info(ref_));
 
@@ -288,10 +306,17 @@ impl Metadata {
                 }
             }
 
-            if let Some(date_time) = self.creation_date {
+            if let Some(date_time) = self.modified() {
                 document_info.modified_date(pdf_date(date_time));
+            }
+
+            if let Some(date_time) = self.creation_date {
                 document_info.creation_date(pdf_date(date_time));
             }
+
+            if settings.has_print_info(config.version()) {
+                settings.write_print_info(&mut document_info);
+            }
         }
     }
 }
diff --git a/vendor/krilla/src/lib.rs b/vendor/krilla/src/lib.rs
index efbe6f84..cc608aa0 100644
--- a/vendor/krilla/src/lib.rs
+++ b/vendor/krilla/src/lib.rs
@@ -176,10 +176,17 @@ pub use document::*;
 pub use graphics::*;
 pub use interactive::*;
 pub use interchange::*;
-pub use serialize::SerializeSettings;
+pub use serialize::{GroupColorSpace, OutputIntent, SerializeSettings, Trapped};
 
 /// Identifies the local patch that discards unfinished page/surface state during unwind.
 pub const CRAFT_UNWIND_SAFE_DROP: bool = true;
 
 /// Identifies the patch that rejects serialization after failed page/surface cleanup.
 pub const CRAFT_UNWIND_POISONING: bool = true;
+
+/// Identifies the print color patches: CMYK blending groups, print output intent and
+/// PDF/X markers.
+pub const CRAFT_PRINT_COLOR: bool = true;
+
+/// Identifies the optional content patch: layers written as optional content groups.
+pub const CRAFT_OPTIONAL_CONTENT: bool = true;
diff --git a/vendor/krilla/src/page.rs b/vendor/krilla/src/page.rs
index ed6b1e29..c5966776 100644
--- a/vendor/krilla/src/page.rs
+++ b/vendor/krilla/src/page.rs
@@ -12,12 +12,13 @@ use crate::chunk_container::ChunkContainer;
 use crate::configure::validate::VersionedFeature;
 use crate::configure::ValidationError;
 use crate::content::ContentBuilder;
-use crate::error::KrillaResult;
+use crate::error::{KrillaError, KrillaResult};
 use crate::geom::{Rect, Size, Transform};
+use crate::graphics::xobject::write_group_color_space;
 use crate::interactive::annotation::Annotation;
 use crate::interchange::tagging::{Identifier, PageTagIdentifier};
 use crate::resource::ResourceDictionary;
-use crate::serialize::{PageInfo, SerializeContext};
+use crate::serialize::{GroupColorSpace, PageInfo, SerializeContext};
 use crate::stream::{FilterStreamBuilder, Stream};
 use crate::surface::Surface;
 use crate::tagging::AnnotationIdentifier;
@@ -412,8 +413,20 @@ impl InternalPage {
             }
         }
 
+        // Under CMYK blending, a page that blends gets a page group naming the space its
+        // content groups inherit. Opaque pages stay without one (PDF/X-1a and X-3).
+        let page_group_cs = (sc.serialize_settings().group_color_space == GroupColorSpace::Cmyk
+            && sc.uses_transparency(&self.stream_resources))
+        .then(|| sc.cmyk_group_color_space(chunk_container));
+
         let chunk = &mut chunk_container.non_stream.pages;
         let mut page = chunk.page(root_ref);
+        if let Some(cs) = page_group_cs {
+            let mut group = page.group();
+            group.transparency();
+            write_group_color_space(&mut group, cs);
+            group.finish();
+        }
         self.stream_resources.to_pdf_resources(
             &mut page,
             sc,
@@ -424,31 +437,31 @@ impl InternalPage {
             rect.transform(page_root_transform(
                 self.page_settings.surface_size().height(),
             ))
-            .unwrap()
+            .ok_or(KrillaError::InvalidPageBox(self.page_index))
         };
 
         // media box is mandatory, so we need to fall back to the default bbox
-        let media_box = transform_rect(self.page_settings.media_box().unwrap_or(self.bbox));
+        let media_box = transform_rect(self.page_settings.media_box().unwrap_or(self.bbox))?;
         page.media_box(media_box.to_pdf_rect());
 
         // the remaining type of box are not mandatory, so we only set them if they are present
         if let Some(crop_box) = self.page_settings.crop_box() {
-            let crop_box = transform_rect(crop_box);
+            let crop_box = transform_rect(crop_box)?;
             page.crop_box(crop_box.to_pdf_rect());
         }
 
         if let Some(bleed_box) = self.page_settings.bleed_box() {
-            let bleed_box = transform_rect(bleed_box);
+            let bleed_box = transform_rect(bleed_box)?;
             page.bleed_box(bleed_box.to_pdf_rect());
         }
 
         if let Some(trim_box) = self.page_settings.trim_box() {
-            let trim_box = transform_rect(trim_box);
+            let trim_box = transform_rect(trim_box)?;
             page.trim_box(trim_box.to_pdf_rect());
         }
 
         if let Some(art_box) = self.page_settings.art_box() {
-            let art_box = transform_rect(art_box);
+            let art_box = transform_rect(art_box)?;
             page.art_box(art_box.to_pdf_rect());
         }
 
diff --git a/vendor/krilla/src/pdf.rs b/vendor/krilla/src/pdf.rs
index bbdae8e3..b2666a7b 100644
--- a/vendor/krilla/src/pdf.rs
+++ b/vendor/krilla/src/pdf.rs
@@ -18,7 +18,7 @@ use crate::configure::{PdfVersion, ValidationError};
 use crate::error::{KrillaError, KrillaResult};
 use crate::graphics::color::rgb;
 use crate::resource::Resource;
-use crate::serialize::{MaybeDeviceColorSpace, SerializeContext};
+use crate::serialize::{GroupColorSpace, MaybeDeviceColorSpace, SerializeContext};
 use crate::surface::Location;
 use crate::util::{Deferred, Prehashed};
 
@@ -179,10 +179,16 @@ impl PdfSerializerContext {
             // but we just always allocate it if we have at least one PDF,
             // regardless of how the files are embedded. We can change this in the
             // future, but it keeps the code simpler.
-            let xobject_group_color_space = sc.register_colorspace(
-                chunk_container,
-                rgb::color_space(sc.serialize_settings().no_device_cs).into(),
-            );
+            //
+            // Under CMYK blending the group writes no `/CS` and inherits the page group,
+            // so no color space is registered.
+            let xobject_group_color_space = match sc.serialize_settings().group_color_space {
+                GroupColorSpace::Rgb => Some(sc.register_colorspace(
+                    chunk_container,
+                    rgb::color_space(sc.serialize_settings().no_device_cs).into(),
+                )),
+                GroupColorSpace::Cmyk => None,
+            };
             let chunk_settings = sc.chunk_settings();
 
             let deferred_chunk = Deferred::new(move || {
@@ -197,11 +203,11 @@ impl PdfSerializerContext {
                 // krilla PDF, we replace `local_ref` with `cs_ref` such that it
                 // actually points to the colorspace that is embedded in the full PDF.
                 let (assigned_cs_ref, should_cs_ref) = match &xobject_group_color_space {
-                    MaybeDeviceColorSpace::DeviceRgb => (None, None),
-                    MaybeDeviceColorSpace::ColorSpace(cs) => {
+                    None | Some(MaybeDeviceColorSpace::DeviceRgb) => (None, None),
+                    Some(MaybeDeviceColorSpace::ColorSpace(cs)) => {
                         (Some(new_ref.bump()), Some(cs.get_ref()))
                     }
-                    MaybeDeviceColorSpace::DeviceGray | MaybeDeviceColorSpace::DeviceCMYK => {
+                    Some(MaybeDeviceColorSpace::DeviceGray | MaybeDeviceColorSpace::DeviceCMYK) => {
                         unreachable!()
                     }
                 };
@@ -224,7 +230,9 @@ impl PdfSerializerContext {
                     Box::new(|| new_ref.bump()),
                     chunk_settings,
                     |group| {
-                        if let Some(local_group_color_space_ref) = assigned_cs_ref {
+                        if xobject_group_color_space.is_none() {
+                            // Inherit the blending space of the page group.
+                        } else if let Some(local_group_color_space_ref) = assigned_cs_ref {
                             group
                                 .insert(Name(b"CS"))
                                 .primitive(local_group_color_space_ref);
diff --git a/vendor/krilla/src/resource.rs b/vendor/krilla/src/resource.rs
index 5ad0585a..da8ab834 100644
--- a/vendor/krilla/src/resource.rs
+++ b/vendor/krilla/src/resource.rs
@@ -7,6 +7,7 @@ use pdf_writer::types::ProcSet;
 use pdf_writer::writers;
 use pdf_writer::{Chunk, Dict, Finish, Name, Ref};
 
+use crate::graphics::optional_content::Properties;
 use crate::serialize::{Cacheable, SerializeContext};
 use crate::util::NameExt;
 
@@ -180,6 +181,7 @@ pub(crate) struct ResourceDictionaryBuilder {
     pub(crate) x_objects: ResourceMapper<XObject>,
     pub(crate) shadings: ResourceMapper<Shading>,
     pub(crate) fonts: ResourceMapper<Font>,
+    pub(crate) properties: ResourceMapper<Properties>,
 }
 
 impl ResourceDictionaryBuilder {
@@ -191,6 +193,7 @@ impl ResourceDictionaryBuilder {
             x_objects: ResourceMapper::new(),
             shadings: ResourceMapper::new(),
             fonts: ResourceMapper::new(),
+            properties: ResourceMapper::new(),
         }
     }
 
@@ -209,6 +212,7 @@ impl ResourceDictionaryBuilder {
             x_objects: self.x_objects.into_resource_list(),
             shadings: self.shadings.into_resource_list(),
             fonts: self.fonts.into_resource_list(),
+            properties: self.properties.into_resource_list(),
         }
     }
 }
@@ -221,6 +225,7 @@ pub(crate) struct ResourceDictionary {
     pub(crate) x_objects: ResourceList<XObject>,
     pub(crate) shadings: ResourceList<Shading>,
     pub(crate) fonts: ResourceList<Font>,
+    pub(crate) properties: ResourceList<Properties>,
 }
 
 impl Default for ResourceDictionary {
@@ -232,6 +237,7 @@ impl Default for ResourceDictionary {
             x_objects: ResourceList::empty(),
             shadings: ResourceList::empty(),
             fonts: ResourceList::empty(),
+            properties: ResourceList::empty(),
         }
     }
 }
@@ -253,7 +259,8 @@ impl ResourceDictionary {
             || self.patterns.len() > 0
             || self.x_objects.len() > 0
             || self.shadings.len() > 0
-            || self.fonts.len() > 0;
+            || self.fonts.len() > 0
+            || self.properties.len() > 0;
 
         if !write_proc_sets && !has_resource_entries {
             // `Resources` dictionary is mandatory (or rather, it's mandatory if
@@ -282,6 +289,7 @@ impl ResourceDictionary {
         write_resource_type::<XObject>(&mut resources, &self.x_objects);
         write_resource_type::<Shading>(&mut resources, &self.shadings);
         write_resource_type::<Font>(&mut resources, &self.fonts);
+        write_resource_type::<Properties>(&mut resources, &self.properties);
         parent.set_resources(resources_ref);
     }
 }
@@ -326,6 +334,10 @@ where
         format!("{}{}", T::get_prefix(), num)
     }
 
+    pub(crate) fn refs(&self) -> impl Iterator<Item = Ref> + '_ {
+        self.entries.iter().copied()
+    }
+
     pub(crate) fn get_entries(&self) -> impl Iterator<Item = (String, Ref)> + '_ {
         self.entries
             .iter()
diff --git a/vendor/krilla/src/serialize.rs b/vendor/krilla/src/serialize.rs
index d79ce28e..4a415337 100644
--- a/vendor/krilla/src/serialize.rs
+++ b/vendor/krilla/src/serialize.rs
@@ -6,9 +6,10 @@ use std::rc::Rc;
 use std::sync::Arc;
 
 use indexmap::IndexMap;
-use pdf_writer::types::{StructRole, StructRole2};
-use pdf_writer::writers::{OutputIntent, StructTreeRoot};
+use pdf_writer::types::{OutputIntentSubtype, StructRole, StructRole2, TrappingStatus};
+use pdf_writer::writers::{DocumentInfo, OutputIntent as OutputIntentWriter, StructTreeRoot};
 use pdf_writer::{Chunk, Content, Finish, Limits, Name, Pdf, Ref, Settings, Str, TextStr};
+use xmp_writer::{Namespace, XmpWriter};
 
 use crate::chunk_container::ChunkContainer;
 use crate::color::{CieBasedColorSpace, DeviceColorSpace, SpecialColorSpace};
@@ -16,10 +17,12 @@ use crate::configure::validate::ValidationStore;
 use crate::configure::{Configuration, PdfVersion, ValidationError, Validators};
 use crate::error::{KrillaError, KrillaResult, LimitError};
 use crate::geom::Size;
-use crate::graphics::color::{rgb, ColorSpace};
+use crate::graphics::color::{cmyk, luma, rgb, ColorSpace};
+use crate::graphics::device_n::DeviceNColorSpace;
 use crate::graphics::icc::{ICCBasedColorSpace, ICCProfile};
 #[cfg(feature = "raster-images")]
 use crate::graphics::image::Image;
+use crate::graphics::optional_content::OptionalContent;
 use crate::graphics::separation::SeparationColorSpace;
 use crate::interactive::destination::{NamedDestination, XyzDestination};
 use crate::interchange::embed::EmbeddedFile;
@@ -29,7 +32,7 @@ use crate::page::{InternalPage, PageLabel, PageLabelContainer};
 #[cfg(feature = "pdf")]
 use crate::pdf::{PdfDocument, PdfSerializerContext};
 use crate::resource;
-use crate::resource::{Resource, Resourceable};
+use crate::resource::{Resource, ResourceDictionary, Resourceable};
 use crate::surface::{Location, Surface};
 use crate::text::GlyphId;
 use crate::text::{Font, FontContainer, FontIdentifier};
@@ -116,6 +119,77 @@ pub struct SerializeSettings {
     /// just use the default function which doesn't render them at all. If you do want this, it
     /// is recommended that you use the function provided by the `krilla-svg` crate.
     pub render_svg_glyph_fn: RenderSvgGlyphFn,
+    /// The color space in which transparency is blended.
+    ///
+    /// See [`GroupColorSpace`].
+    pub group_color_space: GroupColorSpace,
+    /// The printing condition the document is prepared for, written as a `GTS_PDFX`
+    /// output intent. See [`OutputIntent`].
+    pub output_intent: Option<OutputIntent>,
+    /// Whether the document has been trapped: `/Trapped` in the document information
+    /// dictionary and `pdf:Trapped` in the XMP metadata.
+    pub trapped: Option<Trapped>,
+    /// The PDF/X version the caller claims, such as `PDF/X-4`: `/GTS_PDFXVersion` in the
+    /// document information dictionary and `pdfxid:GTS_PDFXVersion` in the XMP metadata.
+    ///
+    /// krilla does not check PDF/X conformance; the caller does. PDF/A-1, -2 and -3 need an
+    /// extension schema for the XMP property, which krilla does not write, so export under
+    /// them fails with [`ValidationError::PdfxVersionWithoutExtensionSchema`].
+    pub pdfx_version: Option<String>,
+    /// The PDF/X conformance level the caller claims, such as `PDF/X-1a:2003`:
+    /// `/GTS_PDFXConformance` in the document information dictionary. PDF/X-1a and X-3
+    /// require it next to the version (`PDF/X-1:2003` for PDF/X-1a:2003); later parts
+    /// have no conformance key. It has no XMP property, so PDF 2.0 output omits it.
+    pub pdfx_conformance: Option<String>,
+}
+
+/// A CMYK printing condition, written as an `/OutputIntents` entry with `/S /GTS_PDFX`.
+///
+/// When a PDF/A validator is active, its `GTS_PDFA1` entry names the same profile and
+/// condition, because PDF/A requires all output intents to share one destination profile.
+#[derive(Clone, Debug, Hash, PartialEq, Eq)]
+pub struct OutputIntent {
+    /// The destination profile (`/DestOutputProfile`).
+    pub profile: ICCProfile<4>,
+    /// `/OutputConditionIdentifier`, such as `FOGRA39`, or `Custom`.
+    pub condition_identifier: String,
+    /// `/OutputCondition`: a human-readable description of the condition.
+    pub condition: Option<String>,
+    /// `/RegistryName`, such as `http://www.color.org`.
+    pub registry_name: Option<String>,
+    /// `/Info`: required by PDF/X when the identifier is not in the registry.
+    pub info: Option<String>,
+}
+
+/// The trapping state of a document.
+#[derive(Clone, Copy, Debug, Hash, PartialEq, Eq)]
+pub enum Trapped {
+    /// The document is fully trapped.
+    True,
+    /// The document has not been trapped.
+    False,
+    /// The document is partly trapped or the state is unknown.
+    Unknown,
+}
+
+/// The color space in which transparency groups blend.
+#[derive(Clone, Copy, Debug, Default, Hash, PartialEq, Eq)]
+pub enum GroupColorSpace {
+    /// Every transparency group gets an RGB `/CS` (DeviceRGB, or sRGB when
+    /// `no_device_cs` is set). Pages get no `/Group`. Suits screen output.
+    #[default]
+    Rgb,
+    /// Pages that use transparency get a page group with a CMYK `/CS`: DeviceCMYK, or the
+    /// [`SerializeSettings::cmyk_profile`] when `no_device_cs` is set. Content groups and
+    /// embedded PDF pages write no `/CS` and inherit it. Soft-mask groups, which have no
+    /// parent, name DeviceCMYK, or sGrey when `no_device_cs` is set. Pages without
+    /// transparency get no page group.
+    ///
+    /// With `no_device_cs` and no `cmyk_profile`, [`Document::finish`] fails with
+    /// [`KrillaError::MissingGroupCmykProfile`].
+    ///
+    /// [`Document::finish`]: crate::Document::finish
+    Cmyk,
 }
 
 pub type RenderSvgGlyphFn = fn(&[u8], rgb::Color, GlyphId, (f32, f32), &mut Surface) -> Option<()>;
@@ -129,6 +203,51 @@ impl SerializeSettings {
         self.configuration.validators()
     }
 
+    /// Whether the document information dictionary carries print markers. Like the rest of
+    /// the dictionary, they are deprecated in PDF 2.0 and only written to XMP there.
+    pub(crate) fn has_print_info(&self, version: PdfVersion) -> bool {
+        version < PdfVersion::Pdf20
+            && (self.trapped.is_some()
+                || self.pdfx_version.is_some()
+                || self.pdfx_conformance.is_some())
+    }
+
+    pub(crate) fn write_print_info(&self, info: &mut DocumentInfo<'_>) {
+        if let Some(trapped) = self.trapped {
+            info.trapped(match trapped {
+                Trapped::True => TrappingStatus::Trapped,
+                Trapped::False => TrappingStatus::NotTrapped,
+                Trapped::Unknown => TrappingStatus::Unknown,
+            });
+        }
+        if let Some(version) = &self.pdfx_version {
+            info.pair(Name(b"GTS_PDFXVersion"), TextStr(version));
+        }
+        if let Some(conformance) = &self.pdfx_conformance {
+            info.pair(Name(b"GTS_PDFXConformance"), TextStr(conformance));
+        }
+    }
+
+    pub(crate) fn write_print_xmp(&self, xmp: &mut XmpWriter) {
+        match self.trapped {
+            Some(Trapped::True) => {
+                xmp.trapped(true);
+            }
+            Some(Trapped::False) => {
+                xmp.trapped(false);
+            }
+            // The Adobe PDF schema allows `Unknown`, which `XmpWriter::trapped` can't write.
+            // PDF/A-1 requires it to match the information dictionary.
+            Some(Trapped::Unknown) => {
+                xmp.element("Trapped", Namespace::AdobePdf).value("Unknown");
+            }
+            None => {}
+        }
+        if let Some(version) = &self.pdfx_version {
+            xmp.pdfx_version(version);
+        }
+    }
+
     /// Whether the `/AF` key is supported, accounting for the PDF version and active standards.
     pub(crate) fn supports_associated_files(&self) -> bool {
         self.configuration.version().specifies_associated_files()
@@ -148,6 +267,11 @@ impl Default for SerializeSettings {
             configuration: Configuration::default(),
             enable_tagging: true,
             render_svg_glyph_fn: |_, _, _, _, _| None,
+            group_color_space: GroupColorSpace::Rgb,
+            output_intent: None,
+            trapped: None,
+            pdfx_version: None,
+            pdfx_conformance: None,
         }
     }
 }
@@ -242,6 +366,11 @@ pub(crate) enum MaybeDeviceColorSpace {
 pub(crate) struct SerializeContext {
     /// An unfinished or failed page/surface must never serialize as a complete document.
     pub(crate) poisoned: bool,
+    /// Where the first mesh gradient whose corner colors share no color space was drawn;
+    /// [`SerializeContext::finish`] fails with [`KrillaError::MixedMeshColorSpaces`].
+    pub(crate) mixed_mesh_colors: Option<Option<Location>>,
+    /// The document's optional content groups.
+    pub(crate) optional_content: OptionalContent,
     /// The ref of the page tree.
     page_tree_ref: Ref,
     /// PDF 2.0 namespaces.
@@ -275,6 +404,11 @@ pub(crate) struct SerializeContext {
     validation_store: ValidationStore,
     /// The current location, if set.
     pub(crate) location: Option<Location>,
+    /// Objects whose use makes a page blend: transparent graphics states, groups, images
+    /// with alpha, and forms, patterns and Type 3 fonts that use any of these. Decides
+    /// which pages get a page group under [`GroupColorSpace::Cmyk`]. Cached objects are
+    /// serialized once, so this is tracked by reference instead of by location.
+    transparent_refs: HashSet<Ref>,
 }
 
 impl SerializeContext {
@@ -297,6 +431,8 @@ impl SerializeContext {
 
         Self {
             poisoned: false,
+            mixed_mesh_colors: None,
+            optional_content: OptionalContent::default(),
             cached_mappings: HashMap::new(),
             pdf2_ns,
             global_objects: GlobalObjects::default(),
@@ -309,6 +445,50 @@ impl SerializeContext {
             chunk_settings,
             limits: Limits::new(),
             validation_store: ValidationStore::new(),
+            transparent_refs: HashSet::new(),
+        }
+    }
+
+    /// Record that drawing `object` involves transparency.
+    pub(crate) fn mark_transparent(&mut self, object: Ref) {
+        self.transparent_refs.insert(object);
+    }
+
+    /// Whether content using `resources` involves transparency.
+    pub(crate) fn uses_transparency(&self, resources: &ResourceDictionary) -> bool {
+        resources
+            .ext_g_states
+            .refs()
+            .chain(resources.x_objects.refs())
+            .chain(resources.patterns.refs())
+            .chain(resources.fonts.refs())
+            .any(|r| self.transparent_refs.contains(&r))
+    }
+
+    /// The CMYK blending color space for page groups under [`GroupColorSpace::Cmyk`]. Falls back to DeviceCMYK when `no_device_cs` is set
+    /// without a CMYK profile; `finish` rejects that configuration.
+    pub(crate) fn cmyk_group_color_space(
+        &mut self,
+        chunk_container: &mut ChunkContainer,
+    ) -> MaybeDeviceColorSpace {
+        let cs = cmyk::color_space(&self.serialize_settings)
+            .unwrap_or_else(|| DeviceColorSpace::Cmyk.into());
+        self.register_colorspace(chunk_container, cs.into())
+    }
+
+    /// The blending color space of soft-mask groups under [`GroupColorSpace::Cmyk`]:
+    /// DeviceCMYK, or sGrey when `no_device_cs` is set. A mask group has no parent, so it
+    /// need not match the page group. An ICC CMYK mask group would give the default black
+    /// backdrop a luminosity above 0, because 100% black through a CMYK profile is not black,
+    /// and the masked object would show where the mask content paints nothing.
+    pub(crate) fn mask_group_color_space(
+        &mut self,
+        chunk_container: &mut ChunkContainer,
+    ) -> MaybeDeviceColorSpace {
+        if self.serialize_settings.no_device_cs {
+            self.register_colorspace(chunk_container, luma::color_space(true).into())
+        } else {
+            self.cmyk_group_color_space(chunk_container)
         }
     }
 
@@ -428,9 +608,13 @@ impl SerializeContext {
         let xobj_ref = self.new_ref();
 
         // Note that `add_xobject` might return a different ref than the one we created.
-        self.global_objects
-            .pdf_ctx
-            .add_xobject(pdf, page_idx, xobj_ref, self.location)
+        let xobj_ref =
+            self.global_objects
+                .pdf_ctx
+                .add_xobject(pdf, page_idx, xobj_ref, self.location);
+        // Embedded pages are always drawn as isolated transparency groups.
+        self.mark_transparent(xobj_ref);
+        xobj_ref
     }
 
     pub(crate) fn page_tree_ref(&mut self) -> Ref {
@@ -450,6 +634,23 @@ impl SerializeContext {
     }
 
     pub(crate) fn finish(mut self, mut chunk_container: ChunkContainer) -> KrillaResult<Pdf> {
+        let settings = &self.serialize_settings;
+        if settings.group_color_space == GroupColorSpace::Cmyk
+            && settings.no_device_cs
+            && settings.cmyk_profile.is_none()
+        {
+            return Err(KrillaError::MissingGroupCmykProfile);
+        }
+        if self.serialize_settings.pdfx_version.is_some() {
+            self.register_validation_error(ValidationError::PdfxVersionWithoutExtensionSchema);
+        }
+        if let Some(location) = self.mixed_mesh_colors {
+            return Err(KrillaError::MixedMeshColorSpaces(location));
+        }
+        if let Some(location) = self.optional_content.misuse {
+            return Err(KrillaError::UnbalancedOptionalContent(location));
+        }
+
         // We need to be careful here that we serialize the objects in the right order,
         // as in some cases we use MaybeTake::take to remove an object, which means that
         // no object that is serialized afterwards must depend on it.
@@ -680,6 +881,11 @@ impl SerializeContext {
                     self.register_resourceable(chunk_container, SeparationColorSpace::new(s)),
                 )
             }
+            ColorSpace::Special(SpecialColorSpace::DeviceN(s)) => {
+                MaybeDeviceColorSpace::ColorSpace(
+                    self.register_resourceable(chunk_container, DeviceNColorSpace::new(s)),
+                )
+            }
         }
     }
 }
@@ -689,18 +895,42 @@ impl SerializeContext {
 impl SerializeContext {
     fn serialize_destination_profiles(&mut self, chunk_container: &mut ChunkContainer) {
         let validators = self.serialize_settings.validators();
-        chunk_container.non_stream.destination_profiles =
-            validators.output_intent().map(|subtype| {
-                let root_ref = self.new_ref();
-                let mut chunk = self.new_chunk();
+        let pdfa = validators.output_intent();
+        let print = self.serialize_settings.output_intent.clone();
+        if pdfa.is_none() && print.is_none() {
+            return;
+        }
 
+        let root_ref = self.new_ref();
+        let mut chunk = self.new_chunk();
+        let mut intents = Vec::new();
+
+        if let Some(print) = print {
+            let profile_ref = self.register_cacheable(chunk_container, print.profile.clone());
+            for subtype in pdfa.into_iter().chain([OutputIntentSubtype::PDFX]) {
                 let oi_ref = self.new_ref();
-                let mut oi = chunk.indirect(oi_ref).start::<OutputIntent>();
-                let icc_profile = self.serialize_settings.pdf_version().rgb_icc();
+                let mut oi = chunk.indirect(oi_ref).start::<OutputIntentWriter>();
+                oi.dest_output_profile(profile_ref)
+                    .subtype(subtype)
+                    .output_condition_identifier(TextStr(&print.condition_identifier));
+                if let Some(condition) = &print.condition {
+                    oi.output_condition(TextStr(condition));
+                }
+                if let Some(registry_name) = &print.registry_name {
+                    oi.registry_name(TextStr(registry_name));
+                }
+                if let Some(info) = &print.info {
+                    oi.info(TextStr(info));
+                }
+                oi.finish();
+                intents.push(oi_ref);
+            }
+        } else if let Some(subtype) = pdfa {
+            let oi_ref = self.new_ref();
+            let mut oi = chunk.indirect(oi_ref).start::<OutputIntentWriter>();
+            let icc_profile = self.serialize_settings.pdf_version().rgb_icc();
 
-                oi.dest_output_profile(
-                    self.register_cacheable(chunk_container, icc_profile.clone()),
-                )
+            oi.dest_output_profile(self.register_cacheable(chunk_container, icc_profile.clone()))
                 .subtype(subtype)
                 .output_condition_identifier(TextStr("Custom"))
                 .output_condition(TextStr("sRGB"))
@@ -713,14 +943,12 @@ impl SerializeContext {
                     )
                     .as_str(),
                 ));
-                oi.finish();
+            oi.finish();
+            intents.push(oi_ref);
+        }
 
-                let mut array = chunk.indirect(root_ref).array();
-                array.item(oi_ref);
-                array.finish();
-
-                (root_ref, chunk)
-            });
+        chunk.indirect(root_ref).array().items(intents);
+        chunk_container.non_stream.destination_profiles = Some((root_ref, chunk));
     }
 
     fn serialize_page_label_tree(&mut self, chunk_container: &mut ChunkContainer) {
@@ -803,7 +1031,7 @@ impl SerializeContext {
     ) -> KrillaResult<()> {
         let xyz_destinations = self.global_objects.xyz_destinations.take();
         for (ref_, dest) in &xyz_destinations {
-            dest.serialize(self, chunk_container, *ref_);
+            dest.serialize(self, chunk_container, *ref_)?;
         }
 
         Ok(())
diff --git a/vendor/krilla/src/surface.rs b/vendor/krilla/src/surface.rs
index 990527f8..b5b602d7 100644
--- a/vendor/krilla/src/surface.rs
+++ b/vendor/krilla/src/surface.rs
@@ -16,7 +16,7 @@ use crate::geom::Path;
 use crate::geom::Size;
 use crate::geom::{Point, Transform};
 use crate::graphic::Graphic;
-use crate::graphics::blend::BlendMode;
+use crate::graphics::blend::{BlendMode, GroupOptions, Overprint};
 use crate::graphics::graphics_state::ExtGState;
 #[cfg(feature = "raster-images")]
 use crate::graphics::image::Image;
@@ -100,6 +100,11 @@ impl<'a> Surface<'a> {
         }
     }
 
+    /// The content stream being drawn and the serialization context, borrowed together.
+    pub(crate) fn content_and_context(&mut self) -> (&mut ContentBuilder, &mut SerializeContext) {
+        (self.bd.get_mut(), self.sc)
+    }
+
     /// Return a `StreamBuilder` to allow drawing on a sub-context.
     pub fn stream_builder(&mut self) -> StreamBuilder<'_> {
         StreamBuilder::new(self.sc, self.chunk_container)
@@ -422,6 +427,16 @@ impl<'a> Surface<'a> {
         self.bd.get_mut().set_blend_mode(blend_mode.to_pdf());
     }
 
+    /// Push overprint settings. Paths, text and images drawn until the matching
+    /// [`Surface::pop`] carry them, and so do groups pushed inside. The `/op`, `/OP` and
+    /// `/OPM` entries are always written, so `Overprint::default()` turns overprint off
+    /// inside an outer `push_overprint`.
+    pub fn push_overprint(&mut self, overprint: Overprint) {
+        self.push_instructions.push(PushInstruction::Overprint);
+        self.bd.get_mut().save_graphics_state();
+        self.bd.get_mut().set_overprint(overprint);
+    }
+
     /// Push a new clip path.
     pub fn push_clip_path(&mut self, path: &Path, clip_rule: &FillRule) {
         self.push_instructions.push(PushInstruction::ClipPath);
@@ -484,9 +499,19 @@ impl<'a> Surface<'a> {
         }
     }
 
-    /// Push a new isolated layer.
+    /// Push a new isolated layer. Shorthand for [`Surface::push_group`] with only
+    /// `isolated` set.
     pub fn push_isolated(&mut self) {
-        self.push_instructions.push(PushInstruction::Isolated);
+        self.push_group(GroupOptions {
+            isolated: true,
+            knockout: false,
+        });
+    }
+
+    /// Push a new transparency group with the given attributes. Everything drawn until
+    /// the matching [`Surface::pop`] goes into the group.
+    pub fn push_group(&mut self, options: GroupOptions) {
+        self.push_instructions.push(PushInstruction::Group(options));
         self.bd
             .sub_builders
             .push(ContentBuilder::new(Transform::identity(), true, self.sc));
@@ -509,17 +534,18 @@ impl<'a> Surface<'a> {
             }
             PushInstruction::ClipPath => self.bd.get_mut().pop_clip_path(),
             PushInstruction::BlendMode => self.bd.get_mut().restore_graphics_state(),
+            PushInstruction::Overprint => self.bd.get_mut().restore_graphics_state(),
             PushInstruction::Mask(mask) => {
                 let stream = self.bd.sub_builders.pop().unwrap().finish(self.sc);
                 self.bd
                     .get_mut()
                     .draw_masked(self.sc, self.chunk_container, *mask, stream)
             }
-            PushInstruction::Isolated => {
+            PushInstruction::Group(options) => {
                 let stream = self.bd.sub_builders.pop().unwrap().finish(self.sc);
                 self.bd
                     .get_mut()
-                    .draw_isolated(self.sc, self.chunk_container, stream);
+                    .draw_group(self.sc, self.chunk_container, options, stream);
             }
         }
     }
@@ -594,6 +620,10 @@ impl<'a> Surface<'a> {
                 r.stops.iter().any(|s| s.opacity != NormalizedF32::ONE)
             }
             InnerPaint::SweepGradient(r) => r.stops.iter().any(|s| s.opacity != NormalizedF32::ONE),
+            InnerPaint::MeshGradient(m) => m
+                .patches
+                .iter()
+                .any(|p| p.opacities.iter().any(|o| *o != NormalizedF32::ONE)),
             InnerPaint::Pattern(_) => false,
         };
 
@@ -670,6 +700,7 @@ pub(crate) enum PushInstruction {
     Opacity(NormalizedF32),
     ClipPath,
     BlendMode,
+    Overprint,
     Mask(Box<Mask>),
-    Isolated,
+    Group(GroupOptions),
 }
diff --git a/vendor/krilla/src/text/type3.rs b/vendor/krilla/src/text/type3.rs
index 1ba149cb..9d43bd65 100644
--- a/vendor/krilla/src/text/type3.rs
+++ b/vendor/krilla/src/text/type3.rs
@@ -212,6 +212,9 @@ impl Type3Font {
             .collect::<Vec<Ref>>();
 
         let resource_dictionary = rd_builder.finish();
+        if sc.uses_transparency(&resource_dictionary) {
+            sc.mark_transparent(root_ref);
+        }
         let chunk = &mut chunk_container.non_stream.fonts;
 
         let descriptor_ref = if sc.serialize_settings().pdf_version() >= PdfVersion::Pdf15 {